Kindly Note: For expanding further cooperation with customers, old
and new, now we have MTL5544D, MTL5541 and MTL5511 barriers in stock with a
If you have any need, kindly send an inquiry to us !
1 INTRODUCTION SIL
1.1 Application and function
The analogue input modules, MTLx541 (single channel) and MTLx544
(dual channel) are intrinsic safety isolators that interface with
process measurement transmitters located in a hazardous area of a
process plant. They are also designed and assessed according to IEC
61508 for use in safety instrumented systems up to SIL2.
Each module provides a fully-floating dc supply for energising
conventional 2-wire or 3-wire process transmitters while repeating
the current flowing in the field loop into another floating circuit
to drive the safe area load. The MTLx544D repeats the current
flowing in a single field loop into two isolated safe area loads.
For ‘smart’ 2-wire transmitters using the HART protocol the units
allow bi-directional communications superimposed on the 4/20mA
signal current. There are no configuration switches or operator
controls to be set on the module.
These modules are members of the MTL4500 and MTL5500 Series of
1.2 Variant Description
Functionally the MTL4500 and MTL5500 Series modules are the same
but differ in the following way:
- the MTL4500 modules are designed for backplane mounted
- the MTL5500 modules are designed for DIN-rail mounting.
In both models the hazardous area field-wiring connections
(terminals 1-3, and 4-6) are made through the removable blue
connectors, but the safe area and power connections for the MTL454x
modules are made through the connector on the base, while the
MTL554x uses the removable grey connectors on the top and side of
Note that the safe-area connection terminal numbers differ between
the backplane and the DIN-rail mounting models.
The analogue input models covered by this manual are:
MTL4541 and MTL5541 single channel, safe area current source
MTL4544 and MTL5544 dual channel, safe area current source
MTL4541S and MTL5541S single channel, safe area current sink
MTL4544S and MTL5544S dual channel, safe area current sink
MTL4544D and MTL5544D single channel, two safe area current source outputs
Note: To avoid repetition, further use of MTLx54x in this document
can be understood to include both DIN-rail and backplane models.
Individual model numbers will be used only where there is a need to
distinguish between them.
Note: The MTL4541B is a version of the standard MTL4541 which has
the negative terminal of the safe area current output internally
connected to the negative terminal of the power supply to simplify
replacement of older MTL4041B and MTL4041B-SR items. For a
functional safety application the assessment is the same as for the
All the analogue input modules have the same connectivity for the
field signals, supporting two- and three-wire process transmitters,
as well as accepting signals from separately powered current
sources. The connection of the repeated current signals into the
input measurement channels for the safety logic system follows the
arrangement shown in the following diagram. When the input channels
of the SIS are providing power for the loop, the ‘S’ variants of
the isolator modules are used to ‘sink’ the measuring current. In
the other cases the isolator modules ‘source’ the measuring current
that flows into a load resistor inside the SIS.
2 System Configuration
An MTLx54x module may be used in single-channel (1oo1) safety
functions up to SIL2.
The figure below shows the system configuration and specifies
detailed interfaces to the safety related and non safety-related
system components. It does not aim to show all details of the
internal module structure, but is intended to support understanding
for the application.
The MTLx54x modules are designed to power process transmitters in
the hazardous area and to repeat the current flowing in the field
loop to the safe-area load. The shaded area indicates the
safety-related system connection, while the power supply
connections are not safety-related. For simplicity the term ‘PLC’
has been used to denote the safety system performing the monitoring
function of the process loop variable.
Note: When using the MTLX544 dual-channel modules, it is not
appropriate for both channels to be used in the same loop, or the
same safety function, as this creates concerns of common-cause
failures. Consideration must also be made of the effect of
common-cause failures when both loops of a dual-channel module are
used for different safety functions. A similar concern applies to
the MTLX544D where only one of the output channels can be used in a
safety loop, not both channels.
2.1 Associated System Components
There are many parallels between the loop components that must be
assessed for intrinsic safety as well as functional safety. In both
situations the contribution of each part is considered in relation
to the whole.
The MTLx54x module is a component in the signal path between
safety-related process transmitters and safety related control
The transmitter or other field device must be suitable for the
process and have been assessed and verified for use in functional
The instrumentation or control equipment shall have a current input
with a normal operating range of 4-20mA but capable of working over
the extended range of 3 to 22mA for under- and over-range. It shall
have the ability to detect and signal input currents higher than
the threshold of 21mA and lower than the threshold of 3.6mA to
determine out-of-range conditions.
The transmission of HART data is not considered as part of the
safety function and is excluded from this analysis.
However, for HART data communication to take place then the input
impedance of the equipment must be at least 240ohms.
3 Selection of product and implications
The output signal from the MTLx54x is within the operating range of
4-20mA under normal conditions.
If the field wiring to the transmitter or connection between the
isolator and logic solver is open-circuit then the loop current
will fall to less than 3.6mA and close to zero. If the field wiring
is short circuit then the loop current will rise to a value greater
For the modules that source the current in the safe area circuit,
i.e. MTLX541/44/44D, then if the connection between the isolator
and logic solver is shorted, the current seen by the logic solver
will be less than 3.6mA and close to zero. For the MTLX541S/44S
modules that control the current supplied by the logic solver
input, if the connection between the isolator and logic solver is
shorted, the current seen by the logic solver will rise to a value
greater than 21mA. In both cases, the fault condition should be
detected by the logic solver. This includes power supply failures
which cause the output of the isolator to fall to zero mA.
Using a process transmitter and logic controller, as defined in
section 2, with an MTLx54x then a system-loop can be implemented
that applies functional safety together with intrinsic safety to
meet the requirements of protection against explosion hazards. The
transfer of HART communications through the isolator is not
considered as part of the safety function of the isolator.
It should be recognised that the systematic capability of the
products limits their application to SIL2 loops.
4 Assessment of functional safety
The design features and the techniques/measures used to avoid
systematic faults permit the use of the MTLx54x modules in
instrument loops implementing safety functions up to SIL2 in a
The hardware assessment shows that MTLx54x Repeater Power Supplies:
• have a hardware fault tolerance of 0
• are classified as Type A devices (“non-complex” component with
well-defined failure modes)
• there are no internal diagnostic elements of these products.
There are two particular aspects of safety that must be considered
when installing the MTL4500 or MTL5500 modules and these are:
• Functional safety
• Intrinsic safety
Reference must be made to the relevant sections within the
instruction manual for MTL4500 Series (INM4500) or MTL5500 Series
(INM5500) which contain basic guides for the installation of the
interface equipment to meet the requirements of intrinsic safety.
In many countries there are specific codes of practice, together
with industry guidelines, which must also be adhered to.
Provided that these installation requirements are followed then
there are no additional factors to meet the needs of applying the
products for functional safety use.
To guard against the effects of dust and water the modules should
be mounted in an enclosure providing at least IP54 protection
degree, or the location of mounting should provide equivalent
protection such as inside an equipment cabinet.
In applications using MTL4500 Series, where the environment has a
high humidity, the mounting backplanes should be specified to
include conformal coating.
To follow the guidelines pertaining to operation and maintenance of
intrinsically safe equipment in a hazardous area, yearly periodic
audits of the installation are required by the various codes of
In addition, proof-testing of the loop operation to conform with
functional safety requirements should be carried out at the
intervals determined by safety case assessment.
Proof testing must be carried out according to the application
requirements, but it is recommended that this be carried out at
least once every three years.
Refer to Appendix B for the proof testing procedure of the MTL4500
or MTL5500 modules.
Note that there may also be specific requirements laid down in the
E/E/PE operational maintenance procedure for the complete
If an MTL4500 or MTL5500 module is found to be faulty during
commissioning or during the normal lifetime of the product then
such failures should be reported to MTL. When appropriate, a
Customer Incident Report (CIR) will be notified to enable the
return of the unit to the factory for analysis. If the unit is
within the warranty period then a replacement unit will be sent.
Consideration should be made of the normal lifetime for a device of
this type which would be in the region of ten years.