EN 12953-9:2007

Shell boilers - Part 9: Requirements for limiting devices of the boiler and accessories

This European Standard specifies requirements for limiters (or limiting devices) which are incorporated into safety systems for shell boilers as defined in EN 12953-1.
A limiter (or limiting device) can be either:
-   a safety accessory as defined in the Pressure Equipment Directive, Article 1, clause 2.1.3, and needs to include the safety logic and final actuator, or
-   one element of a safety system, for example, a self-monitoring water level sensor used as part of a safety accessory as defined in the Pressure Equipment Directive, Article 1, clause 2.1.3. The overall boiler protection function needs to be provided in association with additional safety logic (where appropriate) and a final actuator.
The design requirements and examination of functional capability for the limiters are covered in this European Standard.
For an explanation of the extent of the limiter (or limiting device) see Figure A.1.

Großwasserraumkessel - Teil 9: Anforderungen an Begrenzungseinrichtungen an Kessel und Zubehör

Diese Europäische Norm legt die Anforderungen an Begrenzer (oder Begrenzungseinrichtungen) fest, die in Sicherheitssystemen für Großwasserraumkessel nach EN 12953 1 eingebaut sind.
Ein Begrenzer (oder eine Begrenzungseinrichtung) kann entweder
   ein Ausrüstungsteil mit Sicherheitsfunktion sein, wie in der Druckgeräterichtlinie, Artikel 1, 2.1.3, festgelegt, das mit einer Sicherheitskette und einem Stellglied versehen ist, oder
   ein Element eines Sicherheitssystems sein, z. B. ein selbstüberwachender Wasserstandfühler als Teil eines Ausrüstungsteils mit Sicherheitsfunktion nach der Festlegung in der Druckgeräterichtlinie, Artikel 1, 2.1.3. Die Schutzfunktion für den gesamten Kessel wird mit einer zusätzlichen Sicherheitskette (wo angemessen) und einem Stellglied abgedeckt.
Diese Europäische Norm umfasst die Anforderungen an die Ausführung und die Prüfung der Funktions¬sicherheit der Begrenzer.
Der Funktionsumfang des Begrenzers (oder der Begrenzungseinrichtung) ist in Bild A.1 verdeutlicht.

Chaudières à tubes de fumée - Partie 9: Exigences pour les dispositifs de limitation de la chaudière et de ses accessoires

Mnogovodni kotli - 9. del: Zahteve za omejilne naprave kotla in opremo

General Information

• Status: Withdrawn
• Publication Date: 03-Jul-2007
• Withdrawal Date: 13-Apr-2025
• ICS: 27.060.30 - Boilers and heat exchangers
• Technical Committee: CEN/TC 269 - Shell and water tube boilers
• Drafting Committee: CEN/TC 269/WG 3 - Equipment
• Current Stage: 9960 - Withdrawal effective - Withdrawal
• Start Date: 18-Dec-2024
• Completion Date: 14-Apr-2025
• Directive: 2014/68/EU - Directive 2014/68/EU of the European Parliament and of the Council of 15 May 2014 on the harmonisation of the laws of the Member States relating to the making available on the market of pressure equipment
• Directive: 97/23/EC - Directive 97/23/EC of the European Parliament and of the Council of 29 May 1997 on the approximation of the laws of the Member States concerning pressure equipment
• Mandate: M/071 - Mandate to CEN for standardization in the field of Pressure equipment
• Ref Project: SIST EN 12953-9:2007 - Shell boilers - Part 9: Requirements for limiting devices of the boiler and accessories

Relations

• Replaced By: EN 12953-9:2024 - Shell boilers - Part 9: Requirements for limiting devices of the boiler and accessories
• Effective Date: 19-Jan-2023

Standards Content (Sample)

SLOVENSKI STANDARD
01-september-2007
Mnogovodni kotli - 9. del: Zahteve za omejilne naprave kotla in opremo
Shell boilers - Part 9: Requirements for limiting devices of the boiler and accessories
Großwasserraumkessel - Teil 9: Anforderungen an Begrenzungseinrichtungen an Kessel
und Zubehör
Chaudieres a tubes de fumée - Partie 9: Exigences pour les dispositifs de limitation de la
chaudiere et de ses accessoires
Ta slovenski standard je istoveten z: EN 12953-9:2007
ICS:
27.060.30 Grelniki vode in prenosniki Boilers and heat exchangers
toplote
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

EUROPEAN STANDARD
EN 12953-9
NORME EUROPÉENNE
EUROPÄISCHE NORM
July 2007
ICS 27.060.30
English Version
Shell boilers - Part 9: Requirements for limiting devices of the
boiler and accessories
Chaudières à tubes de fumée - Partie 9: Exigences pour Großwasserraumkessel - Teil 9: Anforderungen an
les dispositifs de limitation de la chaudière et de ses Begrenzungseinrichtungen an Kessel und Zubehör
accessoires
This European Standard was approved by CEN on 26 May 2007.
CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this European
Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references concerning such national
standards may be obtained on application to the CEN Management Centre or to any CEN member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by translation
under the responsibility of a CEN member into its own language and notified to the CEN Management Centre has the same status as the
official versions.
CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Cyprus, Czech Republic, Denmark, Estonia, Finland,
France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal,
Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland and United Kingdom.
EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION
EUROPÄISCHES KOMITEE FÜR NORMUNG
Management Centre: rue de Stassart, 36  B-1050 Brussels
© 2007 CEN All rights of exploitation in any form and by any means reserved Ref. No. EN 12953-9:2007: E
worldwide for CEN national Members.

Contents Page
Foreword. 4
1 Scope . 6
2 Normative references . 6
3 Terms and definitions . 7
4 Requirements for limiter . 9
4.1 General. 9
4.2 Materials and design . 9
4.3 Electrical equipment. 10
4.4 Fault assessment. 10
4.5 Marking . 12
5 Special requirements for water level limiters .14
5.1 Components. 14
5.2 Design . 14
5.3 Floating devices. 15
5.4 Level electrode devices . 15
5.5 Examination of functional capability . 16
5.6 Fault detection . 19
6 Special requirements for pressure limiters .19
6.1 Components. 19
6.2 Additional fault assessment requirements .19
6.3 Design . 19
6.4 Electrical equipment. 20
6.5 Examination of functional capability . 20
6.6 Fault detection . 22
7 Special requirements for temperature limiters. 22
7.1 Components. 22
7.2 Design . 22
7.3 Electrical equipment. 24
7.4 Examination of functional capability . 24
8 Special requirements for flow limiters. 25
8.1 Components. 25
8.2 Design . 25
8.3 Electrical equipment. 25
8.4 Examination of functional capability . 25
Annex A (informative) Limiting device. 26
Annex B (informative) Example of an examination plan . 27
Annex C (informative) Marking of limiters . 29
Annex D (normative) Immunity against electrical and electromagnetic influences —
Requirements and testing. 32
D.1 General. 32
D.2 Immunity against mains voltage variations .32
D.3 Immunity against short-time voltage interruptions and reductions. 32
D.4 Immunity against mains frequency changes. 33
D.5 Immunity against electrostatic discharge (ESD). 33
D.6 Immunity against fast transient disturbance variables (burst). 33
D.7 Immunity against surges . 34
D.8 Immunity against high-frequency electromagnetic fields. 34
D.9 Immunity against conducted disturbances induced by high frequency fields. 35
D.10 Immunity against power frequency magnetic fields. 35
Annex ZA (informative) Relationship between this European Standard and the Essential
Requirements of EU Directive 97/23/EC. 36
Bibliography. 37

Foreword
This document (EN 12953-9:2007) has been prepared by Technical Committee CEN/TC 269 “Shell and
water-tube boilers”, the secretariat of which is held by DIN.
This European Standard shall be given the status of a national standard, either by publication of an identical
text or by endorsement, at the latest by January 2008 and conflicting national standards shall be withdrawn at
the latest by January 2008.
This document has been prepared under a mandate given to CEN by the European Commission and the
European Free Trade Association, and supports essential requirements of EU Directive(s).
For relationship with EU Directive(s), see informative Annex ZA, which is an integral part of this document.
The European Standard EN 12953 concerning shell boilers consists of the following Parts:
 Part 1: General
 Part 2: Materials for pressure parts of boilers and accessories
 Part 3: Design and calculation for pressure parts
 Part 4: Workmanship and construction of pressure parts of the boiler
 Part 5: Inspection during construction, documentation and marking of pressure parts of the boiler
 Part 6: Requirements for equipment for the boiler
 Part 7: Requirements for firing systems for liquid and gaseous fuels for the boiler
 Part 8: Requirements for safeguards against excessive pressure
 Part 9: Requirements for limiting devices of the boiler and accessories
 Part 10: Requirements for feedwater and boiler water quality
 Part 11: Acceptance tests
 Part 12: Requirements for grate firing systems for solid fuels for the boiler
 Part 13: Operating instructions
CR 12953 Part 14: Guideline for the involvement of an inspection body independent of the manufacturer.
Although these Parts may be obtained separately, it should be recognised that the Parts are interdependent. As
such, the design and manufacture of shell boilers requires the application of more than one Part in order for the
requirements of the European Standard to be satisfactorily fulfilled.
According to the CEN/CENELEC Internal Regulations, the national standards organizations of the following
countries are bound to implement this European Standard: Austria, Belgium, Bulgaria, Cyprus, Czech
Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia,
Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain,
Sweden, Switzerland and United Kingdom.
Introduction
The types of limiters which shall be fitted to boilers are specified in EN 12953-6 and the design of the safety
systems are specified in EN 50156-1.
A limiter (or limiting device) is one element of a shell boiler safety system. It comprises a sensor and
monitoring elements to achieve the desired level of reliability.
In order to provide the necessary safety function, for example, to cut off the heat supply to the boiler in the
event of a low water fault, the limiter is connected to other elements in the safety system such as actuators
and safety logic circuits.
1 Scope
This European Standard specifies requirements for limiters (or limiting devices) which are incorporated into
safety systems for shell boilers as defined in EN 12953-1.
A limiter (or limiting device) can be either:
 a safety accessory as defined in the Pressure Equipment Directive, Article 1, clause 2.1.3, and needs to
include the safety logic and final actuator, or
 one element of a safety system, for example, a self-monitoring water level sensor used as part of a safety
accessory as defined in the Pressure Equipment Directive, Article 1, clause 2.1.3. The overall boiler
protection function needs to be provided in association with additional safety logic (where appropriate)
and a final actuator.
The design requirements and examination of functional capability for the limiters are covered in this European
Standard.
For an explanation of the extent of the limiter (or limiting device) see Figure A.1.
2 Normative references
The following referenced documents are indispensable for the application of this document. For dated
references, only the edition cited applies. For undated references, the latest edition of the referenced
document (including any amendments) applies.
EN 298:2003, Automatic gas burner control systems for gas burners and gas burning appliances with or
without fans
EN 50156-1:2004, Electrical equipment for furnaces and ancillary equipment — Part 1: Requirements for
application design and installation
EN 60529:1991, Degrees of protection provided by enclosures (IP code) (IEC 60529:1989)
EN 60664-1:2003, Insulation coordination for equipment within low-voltage systems — Part 1: Principles,
requirements and tests (IEC 60664-1:1992 + A1:2000 + A2:2002)
EN 60730-1:2000, Automatic electrical controls for household and similar use — Part 1: General requirements
(IEC 60730-1:1999, modified)
EN 61000-4-2:1995, Electromagnetic compatibility (EMC) — Part 4: Testing and measurement techniques —
Section 2: Electrostatic discharge immunity test — Basic EMC publication (IEC 61000-4-2:1995)
EN 61000-4-3:2006, Electromagnetic compatibility (EMC) — Part 4-3: Testing and measurement techniques
— Radiated, radio-frequency, electromagnetic field immunity test (IEC 61000-4-3:2006)
EN 61000-4-4:2004, Electromagnetic compatibility (EMC) — Part 4-4: Testing and measurement techniques
— Electrical fast transient/burst immunity test (IEC 61000-4-4:2004)
EN 61000-4-5:2006, Electromagnetic compatibility (EMC) — Part 4: Testing and measurement techniques —
Section 5: Surge immunity test (IEC 61000-4-5:2005)
EN 61000-4-6:1996, Electromagnetic compatibility (EMC) — Part 4: Testing and measurement techniques —
Section 6: Immunity to conducted disturbances, induced by radio-frequency fields (IEC 61000-4-6:1996)
EN 61000-4-8:1993, Electromagnetic compatibility (EMC) — Part 4: Testing and measurement techniques —
Section 8: Power frequency magnetic field immunity test; basic EMC publication (IEC 61000-4-8:1993)
EN 61000-4-11:2004, Electromagnetic compatibility (EMC) — Part 4-11: Testing and measurement
techniques — Voltage dips, short interruptions and voltage variations immunity tests (IEC 61000-4-11:2004)
EN 61000-6-2:2005, Electromagnetic compatibility (EMC) — Part 6-2: Generic standards — Immunity for
industrial environments (IEC 61000-6-2:2005)
EN 61508-3:2001, Functional safety of electrical/electronic/programmable electronic safety-related systems —
Part 3: Software requirements (IEC 61508-3:1998 + Corrigendum 1999)
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
3.1
limiter
limiting device that, on reaching a fixed value (e.g. pressure, temperature, flow, water level) is used to
interrupt and lock-out the energy supply
NOTE Limiting device comprises:
 a measuring or detection function and
 an activation function for correction, or shutdown, or shutdown and lockout, and which is used to carry out
safety related functions as defined in the PED, on its own or as part of a safety (protective) system (e.g.
sensors, limiters) (see also Figure 1). If this is achieved by multi channel systems, then all items or limiters
for safety purposes are included within the safety (protective) system

Figure 1 — Protective devices and safety accessories according to Directive 97/23/EC (PED)
3.2
actuating element
component which produces changes in other electrical circuits or volume flows (e.g. fuel, air) as a result of the
effect of changes in signal
NOTE For example, a gas shut off valve is not an actuating element.
3.3
fail-safe
limiter is fail-safe if it possesses the capability of remaining in a safe condition or transferring immediately to
another safe condition in the event of certain faults occurring
3.4
self-monitoring
regular and automatic determination that all chosen components of a safety system are capable of functioning
as required
3.5
redundancy
provision of more than one device or system which, in the event of a fault, will still be provided by the
necessary facilities
3.6
diversity
provision of different means of performing the required function, e.g. other physical principles or other ways of
solving the same problem
3.7
complex electronics
assemblies which use electronic components with more than one functional output
3.8
safety shut-down
process which is effected immediately following the detection of a fault within the limiter or caused by exceeding
the threshold of the process value limit resulting in a defined state with deactivated terminals of the safety
output(s)
3.9
lock-out
safety shut-down condition of the limiter, such that a restart can only be accomplished by a manual reset of
the limiter or by a manual reset of the safety logic and by no other means
NOTE This will be achieved by a competent operator taking account of the physical situation
3.10
sensor
transducer which, on reaching a defined limit value, outputs a signal and/or cuts out and only reverses the
output signal in the event of a specific change in the performance quantity (e.g. pressure, temperature, flow,
level)
NOTE Sensors are used for signalling or for triggering control processes
4 Requirements for limiter
4.1 General
4.1.1 The requirements set out below have been established to ensure uniform assessment of different
devices.
A limiter shall be such that a single fault in any related part shall not lead to a loss of the safety function. This
shall be achieved by fault avoidance techniques such as self-monitoring with redundancy, diversity or a
combination of these methods. Fault assessment for the electrical components shall be in accordance
with 4.4. The fault assessment chart, see Figure 2 shall also be applied for faults in hydraulic, pneumatic and
mechanical components.
NOTE The various elements of limiters are given in Annex A.
4.1.2 Limiters shall function independently of each other and of controls unless their safety function
cannot be affected by other such functions. Manual resetting can be realised as a part of the limiter or as a
part of the safety logic. Instructions shall be delivered together with the limiter including necessary precautions
for a safe installation of it.
4.2 Materials and design
4.2.1 The use of materials with significant differences in their electrochemical potential shall be avoided in
order to prevent corrosion which could affect the function of the limiter.
4.2.2 Care shall be taken that if magnetic materials are chosen, they do not adversely affect the working of
the limiter.
4.2.3 Parts of the limiter shall be designed to comply with the applicable European Standards.
4.2.4 Limiters shall be capable of withstanding the thermal, mechanical, chemical and electrical loads that
can occur during operation.
4.2.5 Limiters shall be designed such that changes in critical circuit component values (such as those
affecting timing) within the component manufacturer's declared worst case tolerances, including the long term
stability, shall result in the system continuing to function in accordance with this standard. Compliance shall be
checked by worst case analysis.
4.2.6 Limiters using complex electronics
For limiters using complex electronics the following requirements apply additionally:
• General
Systematic errors (built into the design) shall be avoided and random faults (component faults) shall be
controlled by techniques such as self-monitoring with redundancy, diversity or a combination of these methods.
• Fault avoidance and fault tolerance
The design of the software and hardware shall be based on the functional analysis of the limiter resulting in a
structured design explicitly incorporating the control flow, data flow and time related functions required by the
application. In the case of custom-chips special attention is required with regard to measures taken to
minimise systematic errors.
Software shall be designed using EN 61508-3 to a SIL level (Safety Integrity Level) as determined by analysis
according to EN 50156-1.
4.3 Electrical equipment
4.3.1 All wiring and electrical equipment in connection with the limiter shall be adequately protected against
the ingress of moisture and the effect of temperature (see also [2], [3]).
4.3.2 The function of the limiter and the associated electrical circuit responsible for shutting down and
locking out the heat supply system shall not be affected by other electrical circuits in their proximity. Screened
cables shall be used where necessary (see also [2], [3]).
4.3.3 Electrical components within units directly attached to the boiler shall be capable of withstanding a
temperature environment resulting from surrounding temperatures of up to 70 °C. Components within units not
directly attached to the boiler shall be capable of withstanding an ambient temperature of up to 55 °C. Any
equipment that is in contact with parts carrying steam or hot water shall be capable of withstanding the
temperature of those parts.
4.3.4 Devices shall have, as a minimum, a protection rating to IP 54 in accordance with EN 60529. When
units are installed inside an enclosure or control box, the IP rating required for the box shall be considered
adequate.
4.3.5 All mechanical output contacts of the device shall be of the snap action type. Semi-conductor
switches shall have similar characteristics.
4.3.6 The limiter shall tolerate electrical and electromagnetical influences as defined in Annex D.
4.4 Fault assessment
4.4.1 General
The limiter, excluding the stored programme section, shall be so constructed that the fault assessment
analysis in accordance with Figure 2 results in termination. Power failure, breaks in connecting cables and
short circuits shall also be considered and included in the fault assessment analysis.
4.4.2 Fault models and exclusions
4.4.2.1 General
With fault assessment in accordance with Figure 2, it shall be assumed that certain faults do not occur. Such
assumptions are justified by describing the failure mechanism as well as by stating the conditions relating to
design, construction, environment etc. for the conductors, components and equipment.
Faults which shall be taken into account are based in EN 298:2003, Annex A with consideration of the
following faults which may be excluded without further justification:
4.4.2.2 Conductor-to-conductor short circuit fault
This fault may be excluded if:
a) cables and conductors as specified in EN 50156-1 are used;
b) components are encapsulated so that they are moisture resistant or, if they are hermetically sealed and
they are capable of withstanding the test specified in EN 50156-1;
c) clearance between live parts shall be designed according to overvoltage category III and pollution
degree 3 and the creepage distance shall be designed according to pollution degree 3 but at least for the
nominal voltage of 63 V as specified in EN 60664-1;
d) printed conductors (tracks) shall be varnished so that they are resistant to ageing by virtue of the distance
between printed conductors being equivalent to at least the values specified in EN 60664-1:2003, Table 4
for pollution degree 1, and with a minimum nominal voltage of 32 V (minimum creepage distance of
0,14 mm).
4.4.2.3 Short circuit in wound film resistors
This fault may be excluded if the wound film resistors shall be used with a varnished or encapsulated resistive
layer and axial terminations. The possibility of condensation shall be excluded during operation. The limits, e.g.
voltage limit, power, shall not be exceeded even under worst case conditions.
4.4.2.4 Short circuit in wire-wound resistors
This fault may be excluded if the winding is a single layer winding and shall be secured by means of a glaze or
embedded in a sealing compound.
4.4.2.5 Non-opening of contact elements due to permanent welding
This fault may be excluded if contactors, relays or auxiliary switches for example, shall be protected against the
effects of short circuits by the appropriate overcurrent protective or current limiting devices. In rating the
overcurrent protective device, the nominal current of the device as stated by the manufacturer, shall be
multiplied by a safety factor of 0,6. Fault exclusion is also permissible if the prospective short circuit current is
less than the nominal current for the contact element concerned. Where contact elements are connected in
series, the contact element with the lowest overcurrent strength shall be the deciding factor.
Reed contacts shall not be used.
4.4.2.6 Mechanical failure of switching devices
This fault may be excluded if the switching devices are type tested to demonstrate they shall be still be operative
after at least 250 000 switching cycles under conditions similar to operating conditions. Contactors and relays
shall, in addition, be capable of a mechanical endurance of 3 000 000 switching cycles, except for pressure
limiters, see Table 2.
NOTE The term "conditions similar to operating conditions" covers chemical and climatic influences as well as
electrical and mechanical stresses.
4.4.2.7 Faults in components for safe isolation
Faults in components which are provided for safe isolation of electrical circuits (e.g. power circuits and telecom-
munications circuits) in accordance with EN 61140 may be excluded. These include:
a) inter-winding short circuits in transformers (e.g. primary-secondary).
Transformers shall comply with the electrical and mechanical requirements of EN 60742. In deviation
from EN 60742, for transformers with working voltages up to 200 V, insulation between windings and
insulation against the core shall be designed for a test voltage of 2 kV rms. Transformers shall as a
minimum be short-circuit proof. Displacement of windings, turns and connection lines shall be prevented,
e.g. by vacuum impregnation or encapsulation;
b) transient voltage of switching devices like relays, contactors or auxiliary contacts between contacts and
between coil and contacts.
The insulation between contacts or between coil and contact shall be designed for nominal voltages U up
b
to 200 V for a test voltage of 2 kV rms; at nominal voltages 200 V < U < 500 V for a test voltage of
b
3,75 kV rms. By special design features (e.g. caps, ribs, encapsulation, banding) at contacts and coils,
safe isolation shall also be guaranteed against faults such as spring breakage;
c) short-circuiting of isolating distances in optocouplers.
The clearance and creepage distances of the optocoupler in its installed position shall fulfil the relevant
conditions of EN 60664-1:2003, 3.1 and 3.2.
4.5 Marking
The limiters shall be marked with the following:
 manufacturer´s name and/or trademark;
 year of manufacture;
 maximum/minimum allowable design limits;
 unique type reference.
NOTE Other markings may be added by the limiter manufacturer or placed in the operating instructions, see
Annex C.
Key
1 reassessment
Figure 2 — Fault assessment chart for limiters excluding the stored programme section
5 Special requirements for water level limiters
5.1 Components
This limiter shall consist of one or more units needed to provide the necessary safety function. The limiter shall
comprise of the following elements where applicable: sensor, protection tube or external chamber (see NOTE),
timing element, testing devices and other associated equipment up to the terminals of the switching output
contacts as shown in Annex A.
NOTE Protection tubes and external chambers may be considered to be part of the boiler and in these cases it will
be necessary for the limiter manufacturer and the boiler manufacturer to agree on the design and manufacturing
requirements to ensure that the limiter system performs as intended. Examples of water level sensor are: float level
switch, electrode probe, conductivity sensor.
5.2 Design
5.2.1 General
Chambers, connecting pipes and protection tubes shall be designed so that they:
 allow free movement in the tube to equalise with the water level in the boiler;
 can be cleaned and inspected;
 prevent the build up of sludge in the tubes/chambers.
5.2.2 Internal protection tubes
5.2.2.1 Openings on the protection tube, which are necessary to ensure level equalisation, shall have a
minimum diameter of 20 mm or equivalent area but not greater than one-third of the clear bore of the
protection tube, except where specific type approval permits other dimensions.
5.2.2.2 The openings shall be positioned at the lowest point of the bottom and at the highest practicable
point of the protection tube.
5.2.3 External chambers
5.2.3.1 The pipe connections to external chambers shall not be less than 20 mm clear bore. It shall be
possible to blow down the chambers and connecting pipes to ensure that they do not become blocked.
Where applicable, blowdown systems should be fitted with a timing element which prevents the blow down
period exceeding a predetermined maximum safe time and monitors the complete move next of the relevant
valves and the function of the limiter output contact.
5.2.3.2 If isolating valves are fitted on the connecting pipes to external chambers, an interlock system
shall be installed to shut off the heat supply when valves are not fully open.
5.2.3.3 The drain connection of the chamber shall be 15 mm minimum clear bore.
5.2.3.4 Chambers can be considered as being an integral part of the boiler and need not be blown down
if:
a) the connecting pipes shall be 100 mm minimum clear bore on the water side and 40 mm minimum clear
bore on the steam side and
b) the connection pipes shall be less than one metre long and
c) there shall be no isolating valves fitted on the connecting pipes.
Limiters fitted in such a chamber may be deemed to be inside the boiler.
5.3 Floating devices
5.3.1 The float shall be guided and shall be able to move freely.
5.3.2 As the actuating force is small, it shall be converted to a positive movement with a minimum of friction.
5.3.3 Mechanical transfer shall be performed in such a way that no sticking can occur.
5.3.4 The magnets shall be protected against the influence of the boiler water (e.g. suspended magnetic
particles) by positioning them above the highest operational water level or by the use of an additional shield.
5.3.5 The magnetic materials shall be selected with regard to the temperature and operating conditions,
such that the magnetic properties of the materials will not decrease by more than 3 % over a 10 year period. It
shall be possible to prove by means of testing equipment integral with the water limiter system, that the
magnetic interaction remains adequate to operate the switch.
5.3.6 Stray magnetic fields shall not adversely influence the magnetic transfer.
5.3.7 The test force for float devices at 15 °C shall be no greater than the total weight of the float and the
parts attached to it.
5.4 Level electrode devices
5.4.1 The level electrodes shall be designed, positioned installed and protected in such a way that their
proper functioning is not affected by:
a) foam and turbulence from the boiler water;
b) dirt build up;
c) mechanical influences during operation (e.g. vibration);
d) positional changes relative to the protection tube and or to other electrodes which could result in a short
circuit.
5.4.2 Unless the manufacturers fault assessment shows that an equivalent degree of safety is maintained:
 the minimum air distance between measuring electrodes to earth and to each other inside the pressure
part shall be 14 mm;
 level electrode devices shall be installed vertically or at inclinations of up to 45° from the vertical.
5.4.3 Devices that are used to support or restrict movement of the electrode shall be included in the
examination of functional capability (5.5).
5.4.4 The maximum operating voltage of electrodes shall be 50 V a.c. rms without a d.c. component which
could cause significant polarisation effects. If galvanic isolation from the mains supply is required, it shall be
provided by a safety transformer in accordance with EN 60742, meeting the requirements of class of
protection II (double insulation).
5.4.5 The earth return connection shall be as close as possible to the electrode.
5.4.6 The manufacturer of the limiter shall define the limits of application with respect to the water
conductivity.
5.4.7 The insulation resistance of the electrode and the cable shall be monitored. In the case of low
insulation resistance caused for example, by dirt build up on the insulator or internal leakage of the electrode,
the system shall go into a safe state.
5.4.9 Only one low water limiter shall be permitted to be installed within the protection tube or an external
chamber. It is acceptable, however, to install additional electrodes for control and other alarm functions.
5.5 Examination of functional capability
The examination of the functional capability of the limiter shall be in accordance with the procedures given in
Table 1.
Table 1 — Examination of functional capability of water level limits
Pos. Description Verification Acceptance criteria
A FUNCTIONAL TESTS
A.1 Environmental influences Check operation of the water level limiter under the following conditions,
either by certified test document review, simulation, on a test boiler or in
any combination.
— power supply variation test; Annex D
— power supply interruption test; EN 50156-1
— frequency variation test;
— EMC immunity test;
— ambient temperature test;
— IP rating.
A.2 Test of independent When common components are shared, a failure of the second limiter or The safety function of the
functioning the control circuit(s) shall be simulated. limiter shall not be affected.
A.3 Thermal cycle test The whole limiter assembly shall be subjected to at least 100 thermal No steam leak shall be
cycles at full pressure by the manufacturer. permitted.

During each cycle, the limiter shall be shown to operate to the The resistance shall be
manufacturer's specification at the lowest temperature and highest
more than 10 MΩ at test
temperature, allowing sufficient soak time at both these conditions.
voltage of 500 V d.c. under
room conditions.
In the case of electrode devices, immediately after completing the cyclic
test, the insulation resistance of all insulated parts of the electrode shall
be measured.
A.4 Final performance test This shall consist of a comprehensive series of measurements and The water level limiter shall
observations of the characteristics and performance of the water level initiate alarm signals when
limiter to demonstrate that no unacceptable deterioration has occurred as the level drops below the
a result of previous tests. Tests shall be done at ambient temperature at low water level at for each
normal voltages and subsequently with the worst combination of supply of the max and min. water
voltages. In the case of electrode devices, the water level limiter shall be conductivities.
checked for correct operation within the maximum and minimum water
conductivities as specified by the manufacturer.

Table 1 — Examination of functional capability of water level limits (concluded)
Pos. Description Verification Acceptance criteria
B LEVEL ELECTRODE
DEVICES
B.1 Testing of internal faults Failure of each critical component shall be simulated and a check shall Compliance with 4.4.
be made to show that the water level limiter goes to a safe state in
accordance with the relevant fault assessment charts. By way of
examples "Internal Faults" are:
a) short circuit or interruptions in components such as in resistors,
capacitors, discrete and integrated semi-conductor elements etc.;
b) faulty oscillations of electrical circuits;
c) non-opening or non closing of electromagnetic components, such as
contactors, relays etc.;
d) short circuits or interruptions in control circuits, such as broken wires,
earth fault and conductor-to-conductor short circuit etc.;
e) software errors;
f) systematic hardware faults in integrated circuit components.
B.2 Insulation resistance test A check shall be made of the resistance between all insulated parts of The resistance shall be
the limiter circuits, which includes contacts of switches, relays or
more than 10 MΩ at test
contactors for isolation functions. voltage of 500 V d.c. under
room conditions.
B.3 Test for maximum operating Electrode shall be subjected to maximum voltage. 50 V a.c. rms maximum.
voltage
C FLOATING DEVICES
C.1 Durability test on Electromechanical switches shall be life tested to at least 100 000 The electromechanical
electromechanical switches operations at full rated temperature and full rated electrical load. At least switches shall still be
one sample shall be with the maximum rated a.c. inductive load, and functional at the end of
another with the maximum rated d.c. load. the test cycle.
C.2 Test for free movement of the The difference in diameter between the outside of the float and the inside The difference shall not be
float of the chamber or guide tube shall be checked. less than 10 mm.
C.3 Test for positive movement of A check shall be made to ensure that the mechanical parts which are The limiter shall not
the float subjected to wear shall be shown to work for a minimum of 250 000 malfunction during the test
operations within the full range of the mechanical movement. cycle.

5.6 Fault detection
5.6.1 The limiter shall be tested automatically and periodically during use to ensure that the safety is not
impaired by at least one of the following methods:
a) incorporating a self testing device;
b) lowering the water level;
c) sinking the float device.
5.6.2 The safety shutdown signal shall be initiated if the test sequence fails.
5.6.3 Manual functional testing of the limiters shall be possible at any time under any operating conditions, e.g.
by simulation where appropriate. The result of the test shall be clearly indicated to the boiler operator.
6 Special requirements for pressure limiters
6.1 Components
The limiter shall consist of one or more units needed to provide the necessary safety function. The limiter shall
comprise the following units where applicable: connecting piping, body, sensor, external chamber, timing element,
testing devices and other associated equipment up to the terminals of the switching output contacts as shown in
Annex A.
6.2 Additional fault assessment requirements
In addition to the requirements in 4.4, it may be assumed that failure of the component shall not occur where a
mechanical component of the pressure limiter has been designed for a dynamic load and has been successfully
tested for 2 000 000 cycles over its full range of mechanical movement.
6.3 Design
6.3.1 The limiter shall be capable of withstanding an overload of at least 1,5 times its maximum adjustable
pressure without detriment to its accuracy. The manufacturer may state a higher overload pressure.
6.3.2 The adjustment of the set pressure shall only be possible by means of a tool. Any adjustment shall be
capable of being secured so that it does not alter due to any environmental influence, e.g. vibration. The set
pressure shall be indicated on a scale.
6.3.3 It shall not be possible to adjust the set pressure to such an extent that the limiter loses its function (e.g. by
the spring becoming coil-bound).
6.3.4 Connecting pipes for the limiter on steam boilers shall be connected to the steam space of the boiler. If
necessary the limiter shall be protected from the steam temperature by a water seal. For fully flooded hot water
generators the limiter shall be connected to the supply pipe before the first shut-off valve.
If isolating valves are fitted on the connecting pipes, an interlock system shall be installed to shut off the heat
supply when valves are not fully open.
6.3.5 If there is the possibility of sludge build-up in the connecting pipe it shall be possible to purge the pipe.
Such purging shall not remove the water seal or introduce dirt into the water seal.
6.3.6 The limiter body shall be installed vertically so that dirt does not enter the limiter.
6.3.7 Connecting pipes and the boiler connection for the limiter shall be designed so that they can be cleaned
and inspected. The connecting pipe and its boiler connection shall have a clear bore of at least the following unless
the manufacturers fault assessment shows that an equivalent degree of safety is maintained:
a) 8 mm where the pipe is less than 1 m long and the pipe supplies only the limiter or
b) 15 mm where the pipe is gr
...

2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.Shell boilers - Part 9: Requirements for limiting devices of the boiler and accessoriesMnogovodni kotli - 9. del: Zahteve za omejevalne naprave kotla in opremeChaudieres a tubes de fumée - Partie 9: Exigences pour les dispositifs de limitation de la chaudiere et de ses accessoiresGroßwasserraumkessel - Teil 9: Anforderungen an Begrenzungseinrichtungen an Kessel und ZubehörTa slovenski standard je istoveten z:EN 12953-9:2007SIST EN 12953-9:2007en,fr,de27.060.30Grelniki vode in prenosniki toploteBoilers and heat exchangersICS:SLOVENSKI
STANDARDSIST EN 12953-9:200701-september-2007

EUROPEAN STANDARDNORME EUROPÉENNEEUROPÄISCHE NORMEN 12953-9July 2007ICS 27.060.30 English VersionShell boilers - Part 9: Requirements for limiting devices of theboiler and accessoriesChaudières à tubes de fumée - Partie 9: Exigences pourles dispositifs de limitation de la chaudière et de sesaccessoiresGroßwasserraumkessel - Teil 9: Anforderungen anBegrenzungseinrichtungen an Kessel und ZubehörThis European Standard was approved by CEN on 26 May 2007.CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this EuropeanStandard the status of a national standard without any alteration. Up-to-date lists and bibliographical references concerning such nationalstandards may be obtained on application to the CEN Management Centre or to any CEN member.This European Standard exists in three official versions (English, French, German). A version in any other language made by translationunder the responsibility of a CEN member into its own language and notified to the CEN Management Centre has the same status as theofficial versions.CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Cyprus, Czech Republic, Denmark, Estonia, Finland,France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal,Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland and United Kingdom.EUROPEAN COMMITTEE FOR STANDARDIZATIONCOMITÉ EUROPÉEN DE NORMALISATIONEUROPÄISCHES KOMITEE FÜR NORMUNGManagement Centre: rue de Stassart, 36
B-1050 Brussels© 2007 CENAll rights of exploitation in any form and by any means reservedworldwide for CEN national Members.Ref. No. EN 12953-9:2007: E

Limiting device.26 Annex B (informative)
Example of an examination plan.27 Annex C (informative)
Marking of limiters.29 Annex D (normative)
Immunity against electrical and electromagnetic influences —
Requirements and testing.32 D.1 General.32 D.2 Immunity against mains voltage variations.32 D.3 Immunity against short-time voltage interruptions and reductions.32 D.4 Immunity against mains frequency changes.33 D.5 Immunity against electrostatic discharge (ESD).33 D.6 Immunity against fast transient disturbance variables (burst).33 D.7 Immunity against surges.34 D.8 Immunity against high-frequency electromagnetic fields.34 D.9 Immunity against conducted disturbances induced by high frequency fields.35 D.10 Immunity against power frequency magnetic fields.35

Relationship between this European Standard and the Essential Requirements of EU Directive 97/23/EC.36 Bibliography.37

Figure 1 — Protective devices and safety accessories according to Directive 97/23/EC (PED) 3.2 actuating element component which produces changes in other electrical circuits or volume flows (e.g. fuel, air) as a result of the effect of changes in signal NOTE For example, a gas shut off valve is not an actuating element. 3.3 fail-safe limiter is fail-safe if it possesses the capability of remaining in a safe condition or transferring immediately to
another safe condition in the event of certain faults occurring

affecting timing) within the component manufacturer's declared worst case tolerances, including the long term stability, shall result in the system continuing to function in accordance with this standard. Compliance shall be checked by worst case analysis. 4.2.6 Limiters using complex electronics For limiters using complex electronics the following requirements apply additionally: • General Systematic errors (built into the design) shall be avoided and random faults (component faults) shall be controlled by techniques such as self-monitoring with redundancy, diversity or a combination of these methods. • Fault avoidance and fault tolerance The design of the software and hardware shall be based on the functional analysis of the limiter resulting in a structured design explicitly incorporating the control flow, data flow and time related functions required by the application. In the case of custom-chips special attention is required with regard to measures taken to minimise systematic errors. Software shall be designed using EN 61508-3 to a SIL level (Safety Integrity Level) as determined by analysis according to EN 50156-1.

temperature environment resulting from surrounding temperatures of up to 70 °C. Components within units not
directly attached to the boiler shall be capable of withstanding an ambient temperature of up to 55 °C. Any equipment that is in contact with parts carrying steam or hot water shall be capable of withstanding the temperature of those parts. 4.3.4 Devices shall have, as a minimum, a protection rating to IP 54 in accordance with EN 60529. When units are installed inside an enclosure or control box, the IP rating required for the box shall be considered adequate. 4.3.5 All mechanical output contacts of the device shall be of the snap action type. Semi-conductor switches shall have similar characteristics. 4.3.6 The limiter shall tolerate electrical and electromagnetical influences as defined in Annex D. 4.4 Fault assessment 4.4.1 General The limiter, excluding the stored programme section, shall be so constructed that the fault assessment analysis in accordance with Figure 2 results in termination. Power failure, breaks in connecting cables and short circuits shall also be considered and included in the fault assessment analysis. 4.4.2 Fault models and exclusions 4.4.2.1 General With fault assessment in accordance with Figure 2, it shall be assumed that certain faults do not occur. Such assumptions are justified by describing the failure mechanism as well as by stating the conditions relating to design, construction, environment etc. for the conductors, components and equipment. Faults which shall be taken into account are based in EN 298:2003, Annex A with consideration of the following faults which may be excluded without further justification: 4.4.2.2 Conductor-to-conductor short circuit fault This fault may be excluded if: a) cables and conductors as specified in EN 50156-1 are used; b) components are encapsulated so that they are moisture resistant or, if they are hermetically sealed and they are capable of withstanding the test specified in EN 50156-1; c) clearance between live parts shall be designed according to overvoltage category III and pollution degree 3 and the creepage distance shall be designed according to pollution degree 3 but at least for the nominal voltage of 63 V as specified in EN 60664-1;

between coil and contacts. The insulation between contacts or between coil and contact shall be designed for nominal voltages Ub up to 200 V for a test voltage of 2 kV rms; at nominal voltages 200 V < Ub < 500 V for a test voltage of 3,75 kV rms. By special design features (e.g. caps, ribs, encapsulation, banding) at contacts and coils, safe isolation shall also be guaranteed against faults such as spring breakage;

Annex C.
Key 1 reassessment Figure 2 — Fault assessment chart for limiters excluding the stored programme section

particles) by positioning them above the highest operational water level or by the use of an additional shield. 5.3.5 The magnetic materials shall be selected with regard to the temperature and operating conditions, such that the magnetic properties of the materials will not decrease by more than 3 % over a 10 year period. It shall be possible to prove by means of testing equipment integral with the water limiter system, that the magnetic interaction remains adequate to operate the switch. 5.3.6 Stray magnetic fields shall not adversely influence the magnetic transfer. 5.3.7 The test force for float devices at 15 °C shall be no greater than the total weight of the float and the parts attached to it. 5.4 Level electrode devices 5.4.1 The level electrodes shall be designed, positioned installed and protected in such a way that their proper functioning is not affected by: a) foam and turbulence from the boiler water; b) dirt build up; c) mechanical influences during operation (e.g. vibration); d) positional changes relative to the protection tube and or to other electrodes which could result in a short circuit. 5.4.2 Unless the manufacturers fault assessment shows that an equivalent degree of safety is maintained:  the minimum air distance between measuring electrodes to earth and to each other inside the pressure part shall be 14 mm;  level electrode devices shall be installed vertically or at inclinations of up to 45° from the vertical. 5.4.3 Devices that are used to support or restrict movement of the electrode shall be included in the examination of functional capability (5.5). 5.4.4 The maximum operating voltage of electrodes shall be 50 V a.c. rms without a d.c. component which could cause significant polarisation effects. If galvanic isolation from the mains supply is required, it shall be provided by a safety transformer in accordance with EN 60742, meeting the requirements of class of protection II (double insulation). 5.4.5 The earth return connection shall be as close as possible to the electrode. 5.4.6 The manufacturer of the limiter shall define the limits of application with respect to the water conductivity.

A.1 Environmental influences Check operation of the water level limiter under the following conditions, either by certified test document review, simulation, on a test boiler or in any combination.
— power supply variation test; — power supply interruption test; — frequency variation test; — EMC immunity test; — ambient temperature test; — IP rating. Annex D EN 50156-1 A.2 Test of independent functioning When common components are shared, a failure of the second limiter or the control circuit(s) shall be simulated. The safety function of the
limiter shall not be affected. A.3 Thermal cycle test The whole limiter assembly shall be subjected to at least 100 thermal cycles at full pressure by the manufacturer.
During each cycle, the limiter shall be shown to operate to the manufacturer's specification at the lowest temperature and highest temperature, allowing sufficient soak time at both these conditions.
In the case of electrode devices, immediately after completing the cyclic test, the insulation resistance of all insulated parts of the electrode shall be measured. No steam leak shall be
permitted.
The resistance shall be more than 10 MΩ at test voltage of 500 V d.c. under room conditions. A.4 Final performance test This shall consist of a comprehensive series of measurements and observations of the characteristics and performance of the water level limiter to demonstrate that no unacceptable deterioration has occurred as a result of previous tests. Tests shall be done at ambient temperature at normal voltages and subsequently with the worst combination of supply voltages. In the case of electrode devices, the water level limiter shall be checked for correct operation within the maximum and minimum water conductivities as specified by the manufacturer. The water level limiter shall
initiate alarm signals when the level drops below the low water level at for each of the max and min. water conductivities.

B.1 Testing of internal faults Failure of each critical component shall be simulated and a check shall be made to show that the water level limiter goes to a safe state in accordance with the relevant fault assessment charts. By way of examples "Internal Faults" are: a) short circuit or interruptions in components such as in resistors,
capacitors, discrete and integrated semi-conductor elements etc.; b) faulty oscillations of electrical circuits; c) non-opening or non closing of electromagnetic components, such as contactors, relays etc.; d) short circuits or interruptions in control circuits, such as broken wires,
earth fault and conductor-to-conductor short circuit etc.; e) software errors; f) systematic hardware faults in integrated circuit components. Compliance with 4.4. B.2 Insulation resistance test A check shall be made of the resistance between all insulated parts of the limiter circuits, which includes contacts of switches, relays or contactors for isolation functions. The resistance shall be more than 10 MΩ at test voltage of 500 V d.c. under room conditions. B.3 Test for maximum operating
voltage Electrode shall be subjected to maximum voltage. 50 V a.c. rms maximum. C FLOATING DEVICES
C.1 Durability test on electromechanical switches Electromechanical switches shall be life tested to at least 100 000 operations at full rated temperature and full rated electrical load. At least one sample shall be with the maximum rated a.c. inductive load, and another with the maximum rated d.c. load. The electromechanical switches shall still be
functional at the end of
the test cycle. C.2 Test for free movement of the float The difference in diameter between the outside of the float and the inside of the chamber or guide tube shall be checked. The difference shall not be less than 10 mm. C.3 Test for positive movement of the float A check shall be made to ensure that the mechanical parts which are subjected to wear shall be shown to work for a minimum of 250 000 operations within the full range of the mechanical movement. The limiter shall not malfunction during the test
cycle.
± 0,04 bar. The span is the difference between the lowest and the highest set pressure indicated on the scale. Full scale means the highest set pressure indicated on the scale. 6.5.2 The test required for the test procedure shall be in accordance with Table 2 and Figure 3. Table 2 — Test procedure Clause reference Adjustment Number of cycles Pressure TemperatureUpper Switching Point (USP) high pressure limiter Lower Switching Point (LSP) low pressure limiter Requirementsin accordancewith 6.5.1 20 °C USP 1 LSP 1
6.5.4 Lowest value Minimum 1 Switching pressure 70 °C USP 2 LSP 2 Compare USP 1/USP 2or LSP 1/LSP 2 20 °C USP 3 LSP 3
6.5.5 Highest value Minimum 1 Switching pressure 70 °C USP 4 LSP 4 Compare USP 3/USP 4or LSP 3/LSP 4 Minimum 1 Switching pressure 20 °C USP 5 LSP 5
6.5.6 Lowest value 100 Maximum overload 20 °C USP 6 LSP 6 Compare USP 5/USP 6or LSP 5/LSP 6
6.2 Mid point of the span 2 × 106 To give full mechanical movement 20 °C — — No mechanical damage

Key 1 pressure 2 falling pressure 3 rising pressure USP is the Upper Switching Point (relevant for high pressure limiter) LSP is the Lower Switching Point (relevant for low pressure limiter) Figure 3 — Switching point for pressure limiter 6.5.3 The repeatability shall be within the limits stated in 6.5.1 when the tests detailed in 6.5.4, 6.5.5 and 6.5.6 are carried out using air as the test medium. The pressure shall not be changed at a rate faster than the span of the limiter in one minute. 6.5.4 The set pressure shall be adjusted to the lower end of the set pressure scale and the switching pressure measured at an ambient temperature of 20 °C. The ambient temperature shall be raised to 70 °C and the switching pressure measured. 6.5.5 The test in 6.5.4 shall be repeated with the set pressure at the upper end of the set pressure sca
...