Emerson EL-O-Matic F Series Safety Manual page 8

Section 4: Service Condition Limitations (Limitation of Use)
September 2018
•
•
Before selecting remote operating mode control of actuator, the manual override must be
disengaged according to the relevant Installation, Operation and Maintenance Manual.
The position selected (remote/automatic control or local /manual control) can be achieved
with a specific technical solution that does not allow to reach an intermediate position
lever's and avoids unintentional activation.
The engagement of the manual override shall be signaled, at least locally, according to
IOM. As optional request from final user, to determine if the manual override is engaged, an
electrical signal using contact switching can be provided to communicate the status to the
control room.
•
5
Use of manual override:
The use of a manual override is not recommended in a SIL classified application, as
it results in a bypass of the safety function. In case the manual override is used, the
following requirements must be fulfilled, or the Functional Safety Certification will
become invalid:
– The manual override shall be protected to prevent unauthorized use.
(e.g. by key locks in conjunction with effective management controls.).
– The users authorized to operate on the actuator shall be skilled personnel;
– The maximum duration of the manual override shall be defined.
– If necessary, compensatory measures to allow the safe operation of the
process shall be defined (responsibility of the final user).
When test or bypass facilities are included in the SIS (safety integrated system),
they shall conform with the following:
– The SIS shall be designed in accordance with the maintenance and testing
requirements defined in the SRS (safety requirement specification).
– The operator shall be alerted to the bypass of any portion of the SIS via an
alarm or operating procedure.
Loss of utility:
For double acting configurations that on loss of utility (e.g., electrical power,
or pneumatic supply) does not fail to the safe state a system for detecting and
alarming of loss of utility and SIS circuit integrity shall be implemented. (e.g., end-
of-line monitoring, supply pressure measurement), and action taken according to
par. 11.3 of IEC. 61511-1.
SIL Safety Manual
DOC.SILM.EF.EN Rev. 1
Service Condition Limitations (Limitation of Use)