EN 12953-9:2024

SLOVENSKI STANDARD
01-februar-2025
Nadomešča:
SIST EN 12953-9:2007
Mnogovodni kotli - 9. del: Zahteve za omejilne naprave kotla in opremo
Shell boilers - Part 9: Requirements for limiting devices of the boiler and accessories
Großwasserraumkessel ­ Teil 9: Anforderungen an Begrenzungseinrichtungen an Kessel
und Zubehör
Chaudières à tubes de fumée ­ Partie 9: Exigences pour les dispositifs de limitation de
lachaudière et de ses accessoires
Ta slovenski standard je istoveten z: EN 12953-9:2024
ICS:
27.060.30 Grelniki vode in prenosniki Boilers and heat exchangers
toplote
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

EN 12953-9
EUROPEAN STANDARD
NORME EUROPÉENNE
December 2024
EUROPÄISCHE NORM
ICS 27.060.30 Supersedes EN 12953-9:2007
English Version
Shell boilers - Part 9: Requirements for limiting devices of
the boiler and accessories
Chaudières à tubes de fumée - Partie 9: Exigences pour Großwasserraumkessel - Teil 9: Anforderungen an
les dispositifs de limitation de la chaudière et de ses Begrenzungseinrichtungen an Kessel und Zubehör
accessoires
This European Standard was approved by CEN on 20 October 2024.

CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this
European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references
concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to any CEN
member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by
translation under the responsibility of a CEN member into its own language and notified to the CEN-CENELEC Management
Centre has the same status as the official versions.

CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia,
Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway,
Poland, Portugal, Republic of North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and
United Kingdom.
EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION

EUROPÄISCHES KOMITEE FÜR NORMUNG

CEN-CENELEC Management Centre: Rue de la Science 23, B-1040 Brussels
© 2024 CEN All rights of exploitation in any form and by any means reserved Ref. No. EN 12953-9:2024 E
worldwide for CEN national Members.

⁠⁠⁠Contents Page
⁠⁠⁠European foreword . 4
Introduction . 6
1 Scope . 7
2 Normative references . 7
3 Terms and definitions . 9
4 Requirements for limiter . 12
4.1 General . 12
4.2 Components . 12
4.3 Materials and design . 13
4.4 Electrical equipment . 14
4.5 Fault assessment . 15
4.5.1 General . 15
4.5.2 Fault models and exclusions . 18
4.6 Marking . 19
4.7 Operating instructions . 20
4.8 Type examination of functional capability . 20
4.9 Routine testing for final assessment . 23
5 Special requirements for water level limiters . 23
5.1 Design . 23
5.1.1 General . 23
5.1.2 Internal protection tubes . 24
5.1.3 External chambers . 24
5.2 Floating devices . 24
5.3 Level electrode devices . 25
5.4 Additional requirements for differential pressure sensors . 27
5.5 Type examination of functional capability . 27
6 Special requirements for pressure limiters . 28
6.1 Design . 28
6.2 Fault exclusion of mechanical failure of moving parts . 30
6.3 Type examination of functional capability . 30
7 Special requirements for temperature limiters . 32
7.1 Design . 32
7.2 Type examination of functional capability . 32
8 Special requirements for water conductivity limiters . 32
8.1 ⁠⁠⁠ Internally mounted transducers . 32
8.2 ⁠⁠⁠ ⁠⁠⁠Externally mounted transducers . 32
8.3 Transducers . 32
8.4 Type examination of functional capability of water conductivity limiter . 32
Annex A (informative) Limiting devices . 34
Annex B (informative) Example of an examination plan . 35
Annex C (informative) Marking of limiters . 37
Annex D (normative) Immunity against electrical and electromagnetic influences —
Requirements and testing . 40
D.1 General . 40
D.2 Immunity against mains voltage variations . 40
D.3 Immunity against short-time voltage interruptions and reductions . 40
D.4 Immunity against mains frequency changes . 41
D.5 Immunity against electrostatic discharge (ESD) . 41
D.6 Immunity against fast transient disturbance variables (burst) . 41
D.7 Immunity against surges . 42
D.8 Immunity against high-frequency electromagnetic fields . 42
D.9 Immunity against conducted disturbances induced by high frequency fields . 43
D.10 Immunity against power frequency magnetic fields . 44
Annex E (informative) Deterministic or probabilistic procedures for limiter safety cases . 45
E.1 General . 45
E.2 Relationships . 45
E.2.1 Type test . 45
E.2.2 Determination of characteristic data for use in protective circuits with SIL
classification (SIL = safety integrity level). 45
Annex F (normative) Requirements and tests of electrical safety . 46
Annex G (informative) Significant technical changes between this document and the
previous edition . 48
Annex ZA (informative) Relationship between this European Standard and the Essential
Requirements of EU Directive 2014/68/EU aimed to be covered . 49
⁠⁠⁠Bibliography . 50

⁠⁠⁠European foreword
This document (EN 12953-9:2024) has been prepared by Technical Committee CEN/TC 269 “Shell and
water-tube boilers”, the secretariat of which is held by DIN.
This European Standard shall be given the status of a national standard, either by publication of an
identical text or by endorsement, at the latest by June 2025, and conflicting national standards shall be
withdrawn at the latest by June 2025.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CEN shall not be held responsible for identifying any or all such patent rights.
This document supersedes EN 12953-9:2007.
This document has been prepared under a standardization request addressed to CEN by the European
Commission. The Standing Committee of the EFTA States subsequently approves these requests for its
Member States.
For the relationship with EU Legislation, see informative Annex ZA, which is an integral part of this
document.
Annex G provides details of significant technical changes between this European Standard and the
previous edition.
The European Standard series EN 12953 concerning shell boilers consists of the following Parts:
— Part 1: General
— Part 2: Materials for pressure parts of boilers and accessories
— Part 3: Design and calculation for pressure parts
— Part 4: Workmanship and construction of pressure parts of the boiler
— Part 5: Inspection during construction, documentation and marking of pressure parts of the boiler
— Part 6: Requirements for equipment for the boiler
— Part 7: Requirements for firing systems for liquid and gaseous fuels for the boiler
— Part 8: Requirements for safeguards against excessive pressure
— Part 9: Requirements for limiting devices of the boiler and accessories
— Part 10: Requirements for feedwater and boiler water quality
— Part 11: Acceptance tests
— Part 12: Requirements for grate firing systems for solid fuels for the boiler
— Part 13: Operating instructions
Although these parts may be obtained separately, it should be recognized that the parts are
interdependent. As such, the design and manufacture of shell boilers requires the application of more
than one part in order for the requirements of the European Standard to be satisfactorily fulfilled.
NOTE A “Boiler Helpdesk” has been established in CEN/TC 269 which can be contacted for any questions
regarding the application of the European Standards series EN 12952 and EN 12953 see the following website:
http://www.boiler-helpdesk.din.de.
Any feedback and questions on this document should be directed to the users’national standards body. A
complete listing of these bodies can be found on the CENwebsite.
According to the CEN-CENELEC Internal Regulations, the national standardsorganisations of the
following countries are bound to implement this EuropeanStandard: Austria, Belgium, Bulgaria, Croatia,
Cyprus, Czech Republic, Denmark,Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland,
Italy, Latvia,Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic ofNorth
Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland,Türkiye and the United
Kingdom.
Introduction
The types of limiters which are to be fitted to boilers are specified in EN 12953-6:2024 and the design of
the safety systems are specified in EN 50156-1:2015.
In order to provide the necessary safety function, for example, to cut off the energy supply to the boiler
in the event of a low water fault, the limiter is connected to other elements in the safety system.
1 Scope
This document specifies requirements for limiters which are incorporated into safety systems for shell
boilers as specified in EN 12953-1:2012.
The design requirements and examination of the limiters are covered in this document.
NOTE See Annex E for determination of the characteristic data for use in protective circuits with a safety
integrity level (SIL) rating. The requirements for limiters with regard to the safety integrity level (SIL), for example,
in accordance with EN 61508 are not covered in this document.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content
constitutes requirements of this document. For dated references, only the edition cited applies. For
undated references, the latest edition of the referenced document (including any amendments) applies.
EN ISO 228-1:2003, Pipe threads where pressure-tight joints are not made on the threads - Part 1:
Dimensions, tolerances and designation (ISO 228-1:2000)
EN 10226-1:2004, Pipe threads where pressure tight joints are made on the threads - Part 1: Taper external
threads and parallel internal threads - Dimensions, tolerances and designation
EN 12953-6:2024, Shell boilers — Part 6: Requirements for equipment for the boiler
EN 12953-10:2003, Shell boilers - Part 10 : Requirements for feedwater and boiler water quality
EN 14597:2012, Temperature control devices and temperature limiters for heat generating systems
EN 50156-1:2015, Electrical equipment for furnaces and ancillary equipment - Part 1: Requirements for
application design and installation
EN 50156-2:2015, Electrical equipment for furnaces and ancillary equipment - Part 2: Requirements for
design, development and type approval of safety devices and subsystems
EN 60529:1991, Degrees of protection provided by enclosures (IP code) (IEC 60529:1989)
EN IEC 60664-1:2020, Insulation coordination for equipment within low-voltage supply systems - Part 1:
Principles, requirements and tests (IEC 60664-1:2020)
EN 60730-1:2016, Automatic electrical controls - Part 1: General requirements (IEC 60730-1:2013)
EN 60730-2-6:2016, Automatic electrical controls - Part 2-6: Particular requirements for automatic
electrical pressure sensing controls including mechanical requirements (IEC 60730-2-6:2015)
EN IEC 60730-2-9:2019, Automatic electrical controls — Part 2-9: Particular requirements for
temperature sensing controls (IEC 60730-2-9:2015)

Document impacted by A1:2000, A2:2013 and AC:2016.
Document impacted by A1:2020.
Document impacted by A1:2019 and A2:2020.
EN IEC 60730-2-15:2019, Automatic electrical controls - Part 2-15: Particular requirements for automatic
electrical air flow, water flow and water level sensing controls (IEC 60730-2-15:2017)
EN IEC 60747-5-5:2020, Semiconductor devices — Part 5-5: Optoelectronic devices — Photocouplers
(IEC 60747-5-5:2020)
EN 60947-5-1:2017, Low-voltage switchgear and controlgear - Part 5-1: Control circuit devices and
switching elements - Electromechanical control circuit devices (IEC 60947-5-1:2016)
EN 61000-4-2:2009, Electromagnetic compatibility (EMC) - Part 4-2: Testing and measurement techniques
- Electrostatic discharge immunity test (IEC 61000-4-2:2008)
EN IEC 61000-4-3:2020, Electromagnetic compatibility (EMC) - Part 4-3 : Testing and measurement
techniques - Radiated, radio-frequency, electromagnetic field immunity test (IEC 61000-4-3:2020)
EN 61000-4-4:2012, Electromagnetic compatibility (EMC) - Part 4-4: Testing and measurement techniques
- Electrical fast transient/burst immunity test (IEC 61000-4-4:2012)
EN 61000-4-5:2014, Electromagnetic compatibility (EMC) — Part 4-5: Testing and measurement
techniques — Surge immunity test (IEC 61000-4-5:2014)
EN 61000-4-6:2014, Electromagnetic compatibility (EMC) - Part 4-6: Testing and measurement techniques
- Immunity to conducted disturbances, induced by radio-frequency fields (EN 61000-4-6:2013)
EN 61000-4-8:2010, Electromagnetic compatibility (EMC) - Part 4-8: Testing and measurement techniques
- Power frequency magnetic field immunity test (IEC 61000-4-8:2010)
EN IEC 61000-4-11:2020, Electromagnetic compatibility (EMC) — Part 4-11: Testing and measurement
techniques — Voltage dips, short interruptions and voltage variations immunity tests
(IEC 61000-4-11:2020)
EN IEC 61000-6-2:2019, Electromagnetic compatibility (EMC) - Part 6-2: Generic standards - Immunity
standard for industrial environments (IEC 61000-6-2:2016)
EN 61140:2016, Protection against electric shock - Common aspects for installation and equipment
(IEC 61140:2016)
EN IEC 61558-1:2019, Safety of transformers, reactors, power supply units and combinations thereof - Part
1: General requirements and tests (IEC 61558-1:2017)
EN 61558-2-6:2009, Safety of transformers, reactors, power supply units and similar products for supply
voltages up to 1 100 V - Part 2-6: Particular requirements and tests for safety isolating transformers and
power supply units incorporating safety isolating transformers (IEC 61558-2-6:2009)

Document impacted by A1:2017.
Document impacted by AC:2020-06 and AC:2022-10.
EN 61558-2-16:2009, Safety of power transformers, power supply units and similar — Part 2-17:
Particular requirements for safety isolating transformers for switch mode power supplies
(IEC 61558-2-16:2009)
3 Terms and definitions
For the purposes of this document, the terms and definitions given in EN 12953-6:2024,
EN 12953-10:2003 and the following apply.
ISO and IEC maintain terminological databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at https://www.iso.org/obp
— IEC Electropedia: available at http://www.electropedia.org/
3.1
limiter
limiting device
safety accessory which, on reaching a limiting value (water level, pressure, temperature, flow, water
quality), is used to interrupt and lock out the energy supply
Note 1 to entry: A limiter is an element of a safety device and a safety accessory for shell boilers as specified in
the Pressure Equipment Directive 2014/68/EU, Article 2, Clause 4. A limiter contains a sensor, possibly a sensor
control unit and ends at the output contact. The following safety logic and actuating element are not components of
this part of the standard, see Figure A.1.
Note 2 to entry: A limiting device comprises
— a measuring function and
— optional with a display and
— an activation function for correction, or shut-down, or safety shut-down and fault shut-down, and which
is used to carry out safety related functions as specified in the PED. These functions may be on their own or as part
of a safety (protective) system (e.g. sensors, limiters). If this is achieved by multichannel systems, then all items or
limiters for safety purposes are included within the safety (protective) system.
3.2
self-monitoring
regular and automatic determination that all chosen components of a safety system are capable of
functioning as required
3.3
redundancy
provision of more than one device or system which, in the event of a fault, will still be provided by the
necessary facilities
3.4
diversity
provision of different means of performing the required function, e.g. other physical principles or other
ways of solving the same problem

Document impacted by A1:2013.
3.5
safety shut-down
process which is effected immediately following the detection of a fault within the limiter or caused by
exceeding the threshold of the process value limit resulting in a specific state with deactivated terminals
of the safety output(s)
3.6
fault shut-down
safety shut-down with lock-out
3.7
lock-out
safety shut-down condition of the limiter, such that a restart can only be accomplished by manual
unlocking of the limiter or by manual unlocking of the safety logic on site and by no other means
3.8
sensor
measuring element for mechanical, physical or electrical properties optionally with transmitting and/or
transducing functions (provides an output quantity having a specified relation to the input quantity)
Note 1 to entry In this document, the wording “sensor” can be understood as “transducer” if the requirements
are combined with transmitting and/or transducing funtions.
3.9
make-up water
water which compensates for losses of water and steam from the system
[SOURCE: EN 12953-10:2003, 3.3/EN 12953-6:2024, 3.20]
3.10
feedwater
mixture of returned condensate and/or make up water supplied to the boiler inlet
[SOURCE: EN12953-10:2003, 3.4/EN 12953-6:2024, 3.21]
3.11
boiler water
water within a natural or assisted circulation boiler
[SOURCE: EN 12953-10:2003, 3.6]
3.12
water hardness
sum of alkaline earths in water (essentially calcium and magnesium ions)
Note 1 to entry Water hardness is given in millimoles per litre (mmol/l).
3.13
set point, limiting value
specific value of a measurand which when reached interrupts the feedwater supply
Note 1 to entry Measurand can be e.g. conductivity or water hardness.
Note 2 to entry Interrupts of the feedwater supply can occur e.g. if permissible limits for boiler or feedwater in
accordance with EN 12953-10:2003 are exceeded.
3.14
limit value range
range of a measurand within which the limit can be set
Note 1 to entry Measurand can be e.g. conductivity or water hardness.
3.15
sample line
supply of the water which is to be monitored to the monitoring system
3.16
dead time
time period between exceeding the permissible limit and output of the switching command
3.17
allowable temperature range
maximum/minimum allowable temperature TS of the medium indicated for the limiter
Note 1 to entry Maximum allowable temperature TS for the limiter might have the same or higher value than the
TS of the pressure equipment.
Examples for maximum allowable temperature TS for pressure equipment:
— for hot water boiler, TS means the flow temperature measured at the outlet branch;
— for steam generator, TS means the saturated steam temperature at PS;
— for superheater, TS means the temperature of the hot steam measured at the outlet branch;
— for economizer, TS means the flow temperature measured at the outlet branch.
3.18
ambient temperature
ambient air temperature range in which the device may be operated as specified by the manufacturer’s
manual
3.19
maximum allowable pressure
PS
maximum allowable pressure of the medium indicated for the limiter
Note 1 to entry Maximum allowable pressure PS for the limiter might have the same or higher value than the PS
of the pressure equipment.
3.20
fail-safe
it is the capability of the limiter to remain in a safe condition or transferring immediately to another safe
condition in the event of certain faults occurring
4 Requirements for limiter
4.1 General
4.1.1 The limiters described in this document are elements of a safety device and safety accessories
fixed for shell boilers and on reaching a limiting value (water level, pressure, temperature and
conductivity) interrupt and lock out the energy supply. A limiter contains a sensor, possibly a sensor
control unit and ends at the output contact. The following safety logic and actuating element are not
components of this part of the document.
NOTE 1 For safety logic and actuating elements, see also Figure A.1.
A limiter shall be such that, as a minimum, single faults in any related part shall not lead to a loss of the
safety function. For additional fault considerations, the requirements specified in 4.5 shall be fulfilled.
NOTE 2 EN 50156-1:2015 is mentioned several times in this document. EN 50156-2:2015, 4.2.2, mentions type
testing to fulfil EN 50156-1:2015. If the type testing according to EN 50156-2:2015 is not following the required
conformity assessment procedure for a safety accessory according to PED, a conformity assessment procedure of
the limiting device or protective system according to PED, indivually or during assembly, can be performed.
NOTE 3 Figure A.1 shows the scope of a limiter and of a protective system. Conformity assessment procedure
according to PED could refer to either the scope of a limiter or of the protective system. The boiler manufacturer
selects the conformity assessment procedure for protective system, if the limiter is not covered by a separate
conformity assessment procedure, the boiler manufacturer is responsible for all requirements of the protective
system including the limiters.
4.1.2 The requirements of Clause 4 have been established to ensure uniform assessment of different
devices.
a) The installation requirements associated with the selected measurement principle shall be taken into
consideration.
b) Simple removal and reinstallation for inspection and cleaning purposes shall be ensured.
c) Limiters shall function independently of each other and of controls. Other functions of the limiter are
accepted if the safety functions of the limiter are not affected.
d) Automatic locking or manual resetting shall be realized as a part of the limiter or as a part of the
safety logic.
e) Instructions shall be available with the limiter including necessary precautions for its safe
installation.
f) The function of fail-safe limiters, if applicable including their interlocking device, shall not be
impaired by other electrical circuits or controls. This applies in particular to devices with indicating
and warning devices and/or contacts for such equipment.
4.2 Components
This limiter shall consist of one or more units needed to provide the necessary safety function.
The limiter shall be comprised of the following elements where applicable: connection lines, spacer,
chamber, connecting flange and/or connecting thread, sensor, differential pressure transducer,
differential pressure tubes, protection tube or external chamber, timing element, sensor control units,
testing devices and other associated equipment up to the terminals of the switching output contacts as
shown in Annex A.
Limiters with own pressure housing, chambers, connecting pipes and protection tubes shall be designed
so that they:
a) can be cleaned and inspected;
b) prevent the build-up of sludge in the tubes/chambers;
c) can be drained and vented.
4.3 Materials and design
4.3.1 The use of materials or combination of materials, which may be affected by corrosive phenomena
(e.g. with significant differences in their electrochemical potential) shall be avoided in order to prevent
corrosion which could affect the function of the limiter.
4.3.2 Care shall be taken that if magnetic materials are chosen, they do not adversely affect the working
of the limiter.
4.3.3 Selection of materials for pressurized components shall be in accordance with:
a) harmonized European standards;
b) European Approvals for Materials (EAM) ;
c) Particular Material Appraisals (PMA).
4.3.4 Limiters shall be capable of withstanding the thermal, mechanical, chemical and electrical loads
that can occur during operation.
The device shall function safely without qualification for all possible combinations of the following
conditions:
a) within the ranges of the working pressure and of the maximum allowable pressure PS;
b) within the ranges of the working temperature and of the maximum allowable temperature TS;
c) within the ambient temperature range of 20 °C to 70 °C (or 55 °C for device components installed
exclusively in switch cabinets) or beyond in accordance with the operating instructions;
d) in all of the operating positions also designated as permissible by the operating instructions of the
device (e.g. horizontal or vertical installation)
If auxiliary equipment and remedial measures are required for compliance with the allowable operating
conditions, then they shall be specified in the installation and operating instructions.
4.3.5 Limiters shall be designed such that changes in critical circuit in the whole range of tolerances
shall not affect the safety function of the limiter. Critical circuit components for example affecting timing
or long term stability, shall be checked by worst case analysis.
4.3.6 The set and/or limiting value shall not be capable of changing itself under operating conditions.
Adjustment of the limiting value shall only be possible by means of auxiliary equipment (e.g. tools,
software, etc.) and shall be secured against accidental alteration (e.g. vibration), e.g. varnish or sealing.
The set value shall be visible (e.g. on the device, in a display, marking on the system).
4.3.7 Soft soldering is not permitted for connecting pressure components unless verification of
sufficient safety is provided.
4.3.8 Suitable sealing shall be used for thread connections (for examples: flat metal sealing rings or
filled sealing rings).
4.3.9 The limiter shall not have any sharp edges and corners which can cause damage and injuries or
impair its function.
4.3.10 The limiter operating equipment shall be constituted such that their operation does not cause any
foreseeable hazard.
4.4 Electrical equipment
4.4.1 Subclause 4.4 describes the basic requirements to be met by electrical equipment. If called for by
the fault assessment (4.5), then additional requirements can also be found there as well.
4.4.2 All wiring and electrical equipment in connection with the limiter shall be adequately protected
against the ingress of moisture and the effect of temperature (see also [2]).
4.4.3 The function of the limiter and the associated electrical circuit responsible for shutting down and
locking out the energy supply system shall not be affected by other electrical circuits in their proximity.
In such case, screened cables shall be used (see also [2]).
4.4.4 Electrical components within units directly attached to the boiler shall be capable of withstanding
a temperature environment resulting from surrounding temperatures of up to 70 °C. Components within
units not directly attached to the boiler shall be capable of withstanding an ambient temperature of up to
55 °C. Any equipment that is in contact with parts carrying steam or hot water shall be capable of
withstanding the temperature of those parts.
4.4.5 The device and its components shall as a minimum correspond to the degree of protection
specified in Table 1 in accordance with EN 60529:1991.
Table 1 — Degrees of protection
Location Degree of protection
Components located directly on the boiler IP 54
Components located in the boiler room IP 44
The degree of protection required for the
Device components installed in switch cabinets
switchgear shall suffice
For location of the boiler outside of the boiler room or the boiler house, the degree of protection shall be
suitable for the environmental conditions.
4.4.6 If mechanical output contacts are used they shall be of the quick acting type. Mercury switching
tubes, reed relays and reed contacts are not permitted.
The relays shall meet the following requirements that:
a) they are successfully tested at maximum contact load specified for the limiter for a minimum of 250
000 operating cycles;
NOTE Other standards (e.g. EN 13611:2019) applicable to the limiter may require additional operating cycles.
b) the maximum contact load shall be specified as part of the life test;
The maximum contact load shall be under consideration of the maximum load dependent on the
safety protective system in normal operation.
c) they have a mechanical endurance (without load) of at least 3 000 000 operating cycles in accordance
with EN 60947-5-1:2017, C.2.
Switches and micro-switches shall be succefully tested for a minimum of 100 000 operating cycles at the
maximum contact load.
4.4.7 The limiter shall tolerate electrical and electromagnetic influences as specified in Annex D.
4.4.8 Circuits with parts of the device that are in contact with the water shall be galvanically isolated
from the rest of the control circuits and from the mains.
Safety isolating transformers shall fulfill the requirements of EN 61558-2-6:2009 or
EN 61558-2-16:2009 for safety transformers.
If the control circuits are separated by means of optocouplers, these should comply with the applicable
requirements of the established standards (e.g. EN 60747-5-2:2001 [9]).
4.4.9 The electrical safety of the limiters shall comply with the requirements of Annex F.
4.4.10 The supply voltage for an electrical transducer type shall be designed as safety extra-low voltage
(SELV/PELV) according to EN 61140:2016.
4.4.11 Limiters using safety related PLC systems
PLC systems used for safety related systems shall be in accordance with EN 50156-2:2015, 4.2.3.
4.5 Fault assessment
4.5.1 General
A limiter shall be designed so that internal faults do not result in the loss of functional safety.
This requirement shall be fulfilled also for the lock-out.
Protection against internal faults shall be achieved through self-monitoring, redundancy, diversity or a
combination of these methods.
For protection against internal faults the limiters for water level, pressure and temperature shall
correspond to Class C as described in EN 60730-1:2016, H.2.22.3. With the exception of the stored
programme section, the limiter Class C shall be so constructed so that the fault assessment in accordance
with Figure 2 results in termination.
The equipment for conductivity, however, shall correspond to Class B as described in EN 60730-1:2016,
H.2.22.2. With the exception of the stored programme section, the limiter Class B shall be so constructed
so that the fault assessment in accordance with Figure 1 results in termination.
Power failure, breaks in connecting cables and short circuits shall also be considered and included in the
fault assessment.
Figure 1 — Fault assessment for Class B limiters
Figure 2 — Fault assessment for Class C limiters
4.5.2 Fault models and exclusions
4.5.2.1 ⁠⁠General
With fault assessment in accordance with Figures 1 and 2, it shall be assumed that certain faults do not
occur. Such assumptions are justified by describing the failure mechanism as well as by stating the
conditions relating to design, construction, environment etc. for the conductors, components and
equipment.
Faults which shall be taken into account are based on EN 60730-1:2016, Annex H, whereby faults shall
be excluded in accordance with 4.5.2.2 to 4.5.2.7. Additional fault exclusions are described in Clauses 5 to
8 of this document.
4.5.2.2 ⁠⁠Conductor-to-conductor short circuit fault
This fault shall be excluded if:
a) cables and conductors as specified in EN 50156-1:2015 are used;
b) components are moisture resistant or are capable of withstanding the test specified in
EN 50156-1:2015 (e.g. hermetically sealed);
c) clearance between live parts shall be designed according to overvoltage category III and pollution
degree 3 and the creepage distance shall be designed according to pollution degree 3 but at least for
the nominal voltage of 63 V as specified in EN IEC 60664-1:2020 (see EN 60730-1:2016, Table 22);
d) printed conductors (tracks) shall be varnished so that they are resistant to ageing by virtue of the
distance between printed conductors being equivalent to at least the values specified in
EN IEC 60664-1:2020, Table 4, for pollution degree 1, and with a minimum nominal voltage of 32 V
(minimum creepage distance of 0,14 mm) (see EN 60730-1:2016, Table 23).
4.5.2.3 ⁠⁠Short circuit in fixed resistors
This fault shall be excluded if the requirements in accordance with EN 50156-1:2015, 10.5.5.3.3 or
10.5.5.3.4, have been fulfilled.
4.5.2.4 ⁠⁠Non-opening due to permanent welding
This fault shall be excluded if the requirements in accordance with EN 50156-1:2015, 10.5.5.3.5, have
been fulfilled.
When a fuse is used for protection against the hazard of possible welding of relay contacts, then the fuse
may either not be interchangeable or external measures are required in order to prevent unauthorized
interchange. These measures shall be included in the operating instructions.
4.5.2.5 ⁠⁠Failure of switching devices
Switching devices are the limiter output contacts such as, for example, contactors, relays, micro-switches.
This fault may be excluded if the requirements in accordance with 4.4.6 have been fulfilled.
The fault “short-circuit of switching devices” and “mechanical failure of switching devices” may be
excluded if it is specified they are still operative after at least 250 000 switching cycles under conditions
similar to operating conditions.
NOTE 1 The term “conditions similar to operating conditions” covers chemical and climatic influences as well as
electrical and mechanical stresses.
Contactors and relays shall, in addition, be capable of a mechanical endurance of 3 000 000 switching
cycles.
NOTE 2 Other standards (e.g. EN 13611:2019) applicable to the limiter may require additional operating cycles.
NOTE 3 It is not a requirement of this document that conformity to the specification of the relay be verified from
the boiler manufacturer. The requirements can be specified in the documentation of the relay or limiter.
4.5.2.6 ⁠⁠Mechanical failure of moving mechanical parts
This error “mechanical failure”, e.g. breaks, blocking, shall be excluded if it is demonstrated that they are
still functional under conditions similar to operating conditions after at least 2 000 000 movement cycles
of at least 70 % of the mechanical path.
NOTE 1 The term “conditions similar to operating conditions” covers chemical and climatic influences as well as
mechanical stresses.
NOTE 2 Moving mechanical parts are, for example, paddles, floats, linkages, springs, diaphragms.
4.5.2.7 ⁠⁠Faults in components for safe isolation
Faults in components which are provided for safe isolation of electrical circuits (e.g. power circuits and
telecommunications circuits) in accordance with EN 61140:2016 shall be excluded:
a) inter-winding short circuits in transformers (e.g. primary-secondary).
Transformers shall comply with the electrical and mechanical requirements of EN 61558-2-6:2009.
The test voltage shall be implemented in accordance with EN IEC 61558-1:2019, Table 8a.
Transformers shall as a minimum be short-circuit-proof. Displacement of windings, turns and
connection lines shall be prevented, e.g. by vacuum impregnation or encapsulation;
b) transient voltage of switching devices like relays, contactors or auxiliary contacts between contacts
and between coil and contacts.
The insulation between contacts or between coil and contact as well as the test voltage shall be
implemented in accordance with EN 60730-1:2016, Table 12. By special design features (e.g. caps,
ribs, encapsulation, banding) at contacts and coils, safe isolation shall also be guaranteed against
faults such as spring breaka
...