Flowserve MX Electronic Actuator SIL Safety IOM - Manual (Page 12)

Limitorque MX Electronic Actuator FCD LMENIM2350-01 – 9/13
12
FLOWSERVE PROPRIETARY INFORMATION
Use or disclosure of this information is subject to the restrictions on the title page of this document
4.1 LimiGard™
LimiGard™ is at the heart of the design for safety that is integral to every Limitorque MXa and QX commercial and/or
SIL-rated electric actuator.
LimiGard is a patented digital command and monitoring system that employs coded signals throughout and automati-
cally monitors the health of each signal to ensure that no component failure in the signal path can cause the actuator to
move unexpectedly.
Motor control signals are redundant in that two healthy signals must be present before the motor will be able to move.
Both the enable signal and the direction signals (CW or CCW) must be present and healthy so that the motor will
respond to the command. All command signals must also meet the waveform shape specifications to be considered
healthy. If the command signal waveform does not meet the frequency and duty cycle specification, or fails to high or
low DC voltage values, then no charge can be pumped through the charge pump and the command signal will not be
passed to its target contactor coil.
The LimiGard feature also employs a function that can detect when a single output switch is “on.” Normally, zero
switches are on when the motor is idle, and two switches are on when the motor is active. Whenever a single switch is
on, the LimiGard feature detects that as a fault and alerts the user.
Operating mode signals from the knobs on the local control compartment are also redundant in the sense that there
are four sensors to detect three valid knob positions. Each valid knob position requires signals from two of the four
sensors. There are only five valid combinations out of the 16 possible sensor signal combinations that will be accepted
as valid signals. All other combinations will be detected and reported as “Hardware Fault / Knobs.”
The absolute encoder position sensor also rests within the scope of LimiGard protection. The encoder includes several
BIST features for which patents are pending. In particular, each data bit that comprises the resulting position value has
been validated by the encoder to ensure that each bit signal transmitter and receiver is healthy. Whenever any data bit is
determined to be unreliable or failed, the LimiGard feature alerts the user.
While most LimiGard alerts will be displayed on the digital screen in the window on the control compartment, some
failures, such as power loss, CPU failure or LCD failure will make it impossible to show details of the failure on the
digital display screen. The user should always rely on the state of the monitor relay, which will always de-energize
whenever the actuator is not available to respond to remote demand signals.
Note: Although “Local” and “Stop” operating modes are not failures, the actuator will not normally respond to remote
demand signals when it is in one of those modes. Therefore, the monitor relay will de-energize when the actuator is in
one of those modes.
Note: For emergency operation, many users will want the actuator to respond to emergency shutdown demand signals,
even if the operating mode is Local or Stop, or if some protective feature has been asserted by the actuator (e.g., motor
over temperature, hardware fault/knob, hardware fault/encoder). Many such protection features can be overridden by
the ESD function. However, by choosing to override the protection features to achieve a safety function at the expense
of sacrificing the actuator will void factory warranty.
4.2 Optional Safety Add-ons
4.2.1 Fire Protection
A self-sacrificing, fire-resistant coating may be applied to the actuator that will allow the actuator to continue func-
tioning for 30 minutes while immersed in flame.
Fire protection has not been included in the calculations for SIL rating of the basic actuator.