Triple Channel (TMR) for 2003 solutions

The BRAUN High Safety Protection System Series E16x342 is TUV certified for SIL3 acc. IEC 61508:2010 and is API 670 Ed.5 and API 612 Ed.7 compliant. It provides protection against overspeed and detects reverse direction. Also up to six other trip criteria such as emergency stop, boiler protection, etc. can be included in the trip string.

Due to its globally unique and true 2oo3 architecture, the system will tolerate one faulty signal within each trip criterion without trip being released.

The TMR (Triple Modular Redundancy) design ensures highest safety and availability for the monitored machine, i.e. the system will bring the machine into a safe state once it has reached a critical condition. The E16 Protection System consists of three Monitors E1667 for the evaluation of speed and external trip signals, one Test Interface E1691 and a system backplane; all mounted into a 19" rack.

The E16 Protection System permanently monitors the speed sensors for their correct function. During its useful lifetime of 20 years, the system does not require any external proof tests. It is completely maintenance-free and therefore has minimized TCO (Total Cost of Ownership).

♦   SIL3 / IEC 61508:2010 certified
♦   API 670 Ed.5 compliant
♦   API 612 Ed.7 compliant
♦   Total Response Time to Trip < 15 ms
♦   Useful Lifetime and Proof Test Interval = 20 years
♦   Triple speed measurement and monitoring by each Monitor
♦   Variable Overspeed setpoint depending on acceleration
♦   Direction detection
♦   Evaluation of external Trip Criteria signals by up to 6 voters per Monitor
♦   All Trip Outputs formed with safety relay contacts in 2oo3 technique
♦   Trip Output Monitoring to solenoid with Trip-Lock
♦   Up to 5 additional speed setpoints in 2oo3 technique
♦   Sensor signal repeater outputs, free floating, and push/pull
♦   Remote test of solenoid trip block by test signals from DCS possible
♦   The only protection system worldwide where all relays or other active components are located on the Monitors
♦   1 PROFIBUS Interface

View Details

Download the latest Datasheet

Triple Channel (TMR) for 2003 solutions


♦    Fast, precise and safe
♦    Maintenance-free during Lifetime, therefore minimized TCO
♦    Highest safety at maximum availability due to true 2oo3 architecture for each trip criterion within each Monitor
♦    Very low PFD value (Probability of Failure on Demand), less than 8% of allowable value for a SIL3 loop
♦    Replacement of all active components during operation possible (hot swap and highest availability)

Increased Safety Requirements

With single channel processing (1oo1) security provision is solely determined by the device configuration. Therefore the use of sensor monitoring with integrated plausibility control is essential. In such a case no redundancy is provided. Should a fault be detected, the entire system will be shut down immediately.

With two channel systems, there is a choice of implementation, dependent upon requirements. In principle, the two monitors operate in parallel yet independently. Alarm indication can be realized through the linkage of their Safety Outputs.

For 1oo2 processing, we have system redundancy with enhanced security through comparative diagnosis. In the case of fault detection, the entire system will be shut down. With 2oo2 processing, we still have system redundancy but with enhanced availability. Only if both monitors fail, the system as a whole will be shut down.

The E16521D.1 Speed Monitor permanently monitors the speed sensor for its correct function. During its complete useful lifetime of 20 years, the Monitor does not require any external proof tests and is completely maintenance-free.