Emerson Rosemount 8800D Series User guide

Safety Manual
00809-0200-4004, Rev AA
October 2017
Rosemount™ 8800D Series Vortex Flowmeter
Safety Manual for Safety Instrumented Systems
(SIS)

Contents
Chapter 1 Before you begin .............................................................................................................. 1
1.1 Emerson Flow customer service ..................................................................................................... 2
1.2 About this document ..................................................................................................................... 2
1.3 Related documents ........................................................................................................................ 3
1.4 Terms and definitions .....................................................................................................................3
1.5 Skill level requirement ....................................................................................................................4
1.6 Documentation and standards ....................................................................................................... 4
Chapter 2 Installation and commissioning ........................................................................................7
2.1 Identification of SIS certified transmitter ........................................................................................ 7
2.2 Set up the flowmeter ......................................................................................................................9
2.3 Enable transmitter write protection ............................................................................................. 10
2.4 Set failure mode ...........................................................................................................................11
2.5 Flow simulation diagnostic ...........................................................................................................12
2.6 Replace equipment ...................................................................................................................... 13
Chapter 3 Proof tests ......................................................................................................................15
3.1 Proof test requirement .................................................................................................................15
3.2 Repair and replacement ............................................................................................................... 15
3.3 Notification of failures .................................................................................................................. 15
3.4 Proof test interval .........................................................................................................................16
3.5 Tools required .............................................................................................................................. 16
3.6 Proof test options .........................................................................................................................16
3.7 Partial proof test ...........................................................................................................................16
3.8 Comprehensive proof test ............................................................................................................17
3.9 SIS example ..................................................................................................................................18
Chapter 4 Operating Constraints .................................................................................................... 23
4.1 Reverse flow .................................................................................................................................23
4.2 Reliability data ..............................................................................................................................23
4.3 Report failures ..............................................................................................................................24
Contents
Safety Manual i

Contents
ii Rosemount™ 8800D Safety Manual

1 Before you begin
Topics covered in this chapter:
•Emerson Flow customer service
•About this document
•Related documents
•Terms and definitions
•Skill level requirement
•Documentation and standards
Before you begin
Safety Manual 1

1.1 Emerson Flow customer service
Email:
•Worldwide: [email protected]
•Asia-Pacific: [email protected]
Telephone:
North and South America Europe and Middle East Asia Pacific
United States 800 522 6277 U.K. 0870 240 1978 Australia 800 158 727
Canada [phone] The Netherlands [phone]
666
New Zealand 099 128 804
Mexico [phone]
111
France 0800 917 901 India 800 440 1468
Argentina [phone] Germany 0800 182 5347 Pakistan 888 550 2682
Brazil [phone] Italy 8008 77334 China [phone]
Venezuela [phone] Central & Eastern [phone]
111
Japan [phone]
Russia/CIS [phone] South Korea [phone]
Egypt 0800 000 0015 Singapore [phone]
Oman 800 70101 Thailand 001 800 441 6426
Qatar 431 0044 Malaysia 800 814 008
Kuwait 663 299 01
South Africa 800 991 390
Saudi Arabia 800 844 9564
UAE 800 0444 0684
1.2 About this document
This document provides information about how to install, commission, and proof test the
Rosemount 8800D Series SIL 2/3 Capable Vortex Flowmeter to comply with Safety
Instrumented Systems (SIS) requirements.
The information in this document assumes that users understand:
•Basic flowmeter installation, configuration, and maintenance concepts and
procedures
•Safety Instrumented System (SIS) operations, including bypass procedures,
flowmeter maintenance, and company Management of Change procedures
•All corporate, local government, and national government safety standards and
requirements that guard against injuries or death
Before you begin
2 Rosemount™ 8800D Safety Manual

1.3 Related documents
You can find all product documentation via the Rosemount product documentation DVD
shipped with the product or at www.emerson.com/vortex. For more information, see any
of the following documents:
•Rosemount® 8800D Series Vortex Flow Meter Product Data Sheet
•Rosemount® 8800D Series Vortex Flow Meter Quick Start Guide
•Rosemount® 8800D Series Vortex Flow Meter Reference Manual
•Report No. ROS 06/03-34 R001; FMEDA report for Rosemount 8800D Vortex Flow
Meter Prepared for Emerson by exida.com LLC
1.4 Terms and definitions
BPCS Basic Process Control System
λDU Dangerous Undetected
λDD Dangerous Detected
λSU Safe Undetected
λSD Safe Detected
CPT Comprehensive Proof Test
Diagnostic
Coverage
[DC] Percentage of detectable faults
Diagnostic Test
Interval
Time during which all internal diagnostics are carried out at least
once.
Fail-safe state Failure that causes the device to go to the defined fail-safe state
without a demand from the process.
Fail dangerous Failure that deviates the process signal or the actual output by
more than the safety deviation specification, drifts away from the
user defined threshold (Trip Point) and that leaves the output
within the active scale.
FIT Failure In Time per billion hours
Fail Dangerous
Detected
Failure that is dangerous but is detected.
Fail Dangerous
Undetected
Failure that is dangerous and that is not detected.
Fail No Effect Failure of a component that is part of the safety function but that
has no effect on the safety function.
Fail Safe Failure that causes the output to go to the defined fail-safe state
without an input from the process.
FMEDA Failure Modes, Effects and Diagnostic Analysis
HART®Highway Addressable Remote Transducer
HFT Hardware Fault Tolerance as defined by 61508-2 7.4.4.1.1
Before you begin
Safety Manual 3

High demand
mode
The safety function is only performed on demand, in order to
transfer the EUC (Equipment Under Control) into a specified safe
state, and where the frequency of demands is greater than one per
year (IEC 61508-4).
Low demand
mode
The safety function is only performed on demand, in order to
transfer the EUC into a specified safe state, and where the
frequency of demands is no greater than one per year (IEC
61508-4).
PFDAVG Average Probability of Failure on Demand
PFH Probability of dangerous failure per hour.
PPT Partial Proof Test
Random Integrity The SIL limit imposed by the architectural constraints that must be
met for each element.
Safety Demand
Interval
The expected time between safety demands.
Systematic
Capability
A measure (expressed on a scale of SC 1 to SC 4) of the confidence
that the systematic safety integrity of an element meets the
requirements of the specified SIL, in respect of the specified
element safety function, when the element is applied in
accordance with the instructions specified in the compliant item
safety manual for the element as per 61508-4
SFF Safe Failure Fraction
SIF Safety Instrumented Function
SIL Safety Integrity Level - a discrete level (one out of four) for
specifying the safety integrity requirements of the safety
instrumented functions to be allocated to the safety instrumented
systems. SIL 4 has the highest level of safety integrity, and SIL 1 has
the lowest level.
SIS Safety Instrumented System (SIS) - an instrumented system used
to implement one or more safety instrumented functions. An SIS is
composed of any combination of sensors, logic solvers, and final
elements.
Type B device Complex device using controllers or programmable logic, as
defined by the standard IEC 61508.
1.5 Skill level requirement
System design, installation and commissioning, and repair and maintenance shall be
carried out by suitably qualified personnel.
1.6 Documentation and standards
This section lists the documentation and standards referred to by this safety manual.
Before you begin
4 Rosemount™ 8800D Safety Manual

Documents Purpose of documents
IEC 61508-2: 2010 Functional Safety of Electrical/Electronic/Programmable Electronic
Safety-Related Systems
IEC 61511 (ANSI/ISA
84.00.01-2004)
Functional safety - Safety instrumented systems for the process industry
sector
ROS 06/03-34 R001 FMEDA Report Version V1, Revision R1, or later, for the Rosemount
8800D Series Vortex Flowmeter
00813-0100-4004 Rosemount® 8800D Series Vortex Flow Meter Product Data Sheet
00809-0100-4004 Rosemount® 8800D Series Vortex Flow Meter Reference Manual
00825-0100-4004 Rosemount® 8800D Series Vortex Flow Meter Quick Start Guide
Before you begin
Safety Manual 5

Before you begin
6 Rosemount™ 8800D Safety Manual

2 Installation and commissioning
Topics covered in this chapter:
•Identification of SIS certified transmitter
•Set up the flowmeter
•Enable transmitter write protection
•Set failure mode
•Flow simulation diagnostic
•Replace equipment
Use this chapter to install and commission the Rosemount 8800D Series SIL 2/3 Capable
Vortex Flowmeter.
2.1 Identification of SIS certified transmitter
IEC 61508 relevant requirements
The Rosemount 8800D is certified per the relevant requirements of IEC 61508.
Systematic capability Safety Integrity Level (SIL) 3 capable
Random capability •Type B element
•SIL 2 capable @ HFT=0 (single transmitter)
•SIL 3 capable @ HFT=1 (dual transmitters)
•SIL 3 capable @ HFT=2 (quadruple transmitters)
Failure rates per IEC 61508 in FIT
Rosemount 8800D Series SIL 2/3 Capable Vortex FlowmeterTable 2-1:
Failure categories λSD λSU λDD λDU
Low Flow Trip 0 76 387 74
High Flow Trip 0 32 387 119
SIS-certified versions
All Rosemount 8800D Vortex Flowmeters must be identified as safety certified before
installing into SIS systems. To identify a safety certified Rosemount 8800D Vortex
Flowmeter, requirements 1 and 2, or requirements 2 and 3 must be satisfied. The
requirements are:
Installation and commissioning
Safety Manual 7

1. Verify the option code "SI" in the model code. The SI code will appear somewhere
after the 16th character of the model code (after the required fields.) Note that the
optional options, including SI, can appear in any order and be valid. Please refer to A
of Figure 2-1.
•For example: 8800D................SI
2. Verify 4-20mA marking on the transmitter housing nameplate. Please refer to B of
Figure 2-1.
3. Confirm firmware revision is 5.2.8. Please refer to Table 2-2.
Note
Software version information may be verified in the device from the Field Communicator: Overview >
Device Information > Revision Number.
Example of transmitter nameplateFigure 2-1:
A. SI option code
B. 4–20mA Output
Rosemount 8800D revisions and versionsTable 2-2:
Device Display tag Version
8800D firmware Universal revision 5
Transmitter revision 2
Software revision 8
8800D hardware Hardware revision 1
The safety certified output of the Rosemount 8800D is the 4-20 mA output. This output
provides a signal proportional to process flow, between low flow cutoff and the Upper
Range Value (URV). Detected faults are indicated by an offscale output (see Section 2.4).
The safety logic solver should be configured to detect offscale output levels. While the
pulse output may be used, it is not a safety certified output. Devices ordered without SI
option are not certified per IEC 61508.
Installation and commissioning
8 Rosemount™ 8800D Safety Manual

Safety precautions
Prior to making any changes to the flowmeter,such as changing the configuration or
replacing the transmitter hardware or sensor:
•Take appropriate action to avoid a false trip by electronically bypassing the safety
logic solver.
•Prior to placing the meter online and removing the bypass from the safety logic
solver, verify the transmitter configuration and all safety parameters per Section 2.2.
Important
Ensure alternate means are in place to maintain the process in a safe state.
2.2 Set up the flowmeter
Use the following procedure to make sure the flowmeter is installed and configured for SIS
applications.
You can use ProLinkIII software, AMS Device Manager,or the Field Communicator to verify,
or configure these settings. For more information, see the product reference manual.
The flowmeter does not require special installation other than the standard installation
procedures in the reference manual.
Note
Transmitter output is not safety-rated during the following: Configuration changes, loop test mode,
simulation mode, multidrop operation, temperature compensation of the process fluid, saturated
steam or mass flow with temperature compensation. Alternative means should be used to ensure
process safety during configuration and maintenance activities.
Procedure
1. Verify that the software revision running is 5.2.8.
ProLink III Software Device Tools > Device Information > Software Revision
2. Verify all safety parameters.
a. Verify that all appropriate flow calibration parameters are set (Reference K-
Factor, Process Fluid, Fixed Process Temperature, Fixed Process Density).
b. Verify that the Lower Range Value (LRV) and the Upper Range Value (URV) for
the 4-20 mA output is configured
Installation and commissioning
Safety Manual 9

2.3 Enable transmitter write protection
Write-protection helps protect the transmitter against accidental changes to
configuration. When the transmitter is write-protected, no changes to the transmitter
configuration will be accepted.
Tip
Write protecting the transmitter prevents accidental changes to configuration. It does not prevent
normal operational use. You can always disable write protection, perform any required configuration
changes, then re-enable write protection.
The SECURITY jumper enables write protection.
•If the jumper is in the ON position, write protection is enabled.
•If the jumper is in the OFF position, write protection is disabled.
Procedure
1. If you are in a hazardous area, power down the transmitter.
2. WARNING!
Never remove the transmitter housing cover in a hazardous area when the transmitter is
powered up. Failure to follow these instructions may result in an explosion.
Remove the transmitter housing cover (opposite of the terminal block).
3. Move the two-pin SECURITY jumper to the ON position.
The location of the security switch depends upon whether or not the transmitter has
the (M5) optional display.
SECURITY jumper location without M5 optional displayFigure 2-2:
Installation and commissioning
10 Rosemount™ 8800D Safety Manual

SECURITY jumper location with M5 optional displayFigure 2-3:
4. Replace the transmitter housing cover.
5. Power up the transmitter.
2.4 Set failure mode
As part of normal operations, the flowmeter continuously runs a self-diagnostic routine. If
the routine detects an internal failure, the failure mode setting determines whether the
flowmeter output is driven to a low or high alarm level.
The failure mode setting is controlled by the ALARM jumper, which is set at the factory per
the CDS (Configuration Data Sheet); the default setting is HI.
•If the ALARM jumper is in the HI position, the flowmeter output will be driven to a
high alarm level in the event of a failure.
•If the ALARM jumper is in the LOW position, the flowmeter output will be driven to a
low alarm level in the event of a failure.
Note
For exact alarm values, see the product reference manual.
Procedure
1. If you are in a hazardous area, power down the transmitter.
2. WARNING!
Never remove the transmitter housing cover in a hazardous area when the transmitter is
powered up. Failure to follow these instructions may result in an explosion.
Remove the transmitter housing cover (opposite of the terminal block).
3. Move the two-pin ALARM jumper to the HI or LOW position, as desired.
Installation and commissioning
Safety Manual 11

The location of the ALARM jumper depends upon whether or not the transmitter has
the (M5) optional display.
ALARM jumper location without (M5) optional displayFigure 2-4:
ALARM jumper location with (M5) optional displayFigure 2-5:
4. Replace the transmitter housing cover.
5. Power up the transmitter.
2.5 Flow simulation diagnostic
Performing an internal flow simulation ensures the current calibration state of the
transmitter by carrying out a verification of the electronics board stack to indicate the
health of the various components on the board stack. Failure may indicate a need to
replace the electronics. Every transmitter comes with internal flow simulation capabilities.
Installation and commissioning
12 Rosemount™ 8800D Safety Manual

Note
For the Flow Simulation Function to operate, Primary Variable must be set to Velocity Flow, Volume
Flow, or Mass Flow and the write protection must be disabled (see Section 2.3).
Procedure
1. Ensure that the write protection is disabled (see Section 2.3).
2. Read the calculated Shedding Frequency at URV.
ProLink III Software Device Tools > Configuration > Process Measurement > Sig-
nal Processing
3. Navigate to Flow Simulation.
ProLink III Software Device Tools > Diagnostics > Testing > Flow Simulation
4. Select Internal Flow Simulation, Fixed Flow, Percent of Range and enter 50% flow.
5. Verify that flow rate output is 50% of full scale and Frequency is 1/2 of calculated
Frequency at URV.
a. If the flow rate output is 50% of full scale, the electronics are working properly.
b. If the flow rate output is not 50% of full scale, see the troubleshooting
information in the product reference manual.
Note
(Optional): Verify shedding frequency from internal signal generator is the same as displayed
on handheld communicator, Prolink III, or AMS Device Manager. This can be accomplished by
connecting a device such as a Fluke multi-meter with frequency measurement capability to
the test points behind the display labeled "TP1" and Ground (using the universal ground
symbol). Connect the positive lead of the digital multi-meter to TP1 and the negative lead to
the Ground lug. The frequencies should match to a plant specified tolerance that is no less
than the tolerance of the device used to read the frequency.
•If the shedding frequency is 50% of full scale, the electronics are working properly.
•If the shedding frequency is not 50% of full scale, see the troubleshooting information in
the product reference manual.
6. Exit simulation by selecting Normal Flow Measurement or Exit.
7. Enable write protection (see Section 2.3).
2.6 Replace equipment
If you need to replace hardware, purchase all spare parts from Emerson. You cannot use
user-supplied components on any Rosemount printed circuit assemblies.
1. Replace the hardware by contacting your local Emerson or Emerson affiliated sales
representative to obtain the correct part number.
Installation and commissioning
Safety Manual 13

Use the product reference manual or quick start guide for proper maintenance
guidelines.
2. Verify the transmitter configuration and all safety parameters (see Section 2.2).
3. Enable write protection (see Section 2.3).
4. Set the failure mode (see Section 2.4.)
Installation and commissioning
14 Rosemount™ 8800D Safety Manual

3 Proof tests
Topics covered in this chapter:
•Proof test requirement
•Repair and replacement
•Notification of failures
•Proof test interval
•Tools required
•Proof test options
•Partial proof test
•Comprehensive proof test
•SIS example
3.1 Proof test requirement
During operation, a low-demand mode SIF must be proof tested. The objective of proof
testing is to detect failures within the equipment in the SIF that are not detected by any
automatic diagnostics of the system. Undetected failures that prevent the SIF from
performing its function are the main concern.
Periodic proof tests shall take place at the frequency (or interval) defined by the SIL
verification calculation. The proof-tests must be performed more frequently than or as
frequently as specified in the SIL verification calculation in order to maintain the required
safety integrity of the overall SIF.
Results from periodic proof tests shall be recorded and periodically reviewed.
3.2 Repair and replacement
Repair procedures in the product reference manual must be followed.
3.3 Notification of failures
In case of malfunction of the system or SIF, the Rosemount 8800D Series SIL 2/3 Capable
Vortex Flowmeter shall be put out of operation and the process shall be kept in a safe state
by other measures.
Emerson must be informed when the Rosemount 8800D Series SIL 2/3 Capable Vortex
Flowmeter is required to be replaced due to failure. The occurred failure shall be
documented and reported to Emerson using the contact details on the back page of this
functional safety manual. This is an important part of Emerson SIS management process.
Proof tests
Safety Manual 15

3.4 Proof test interval
The time intervals for proof testing are defined by the SIL verification calculation (subject
to the PFDAVG). The proof tests must be performed more frequently than or as frequently
as specified in the SIL verification calculation in order to maintain the required safety
integrity of the overall SIF.
Results from periodic proof tests shall be recorded and periodically reviewed. For the
specification of customer requirements required to fulfil this SIS requirement, please see
IEC-61511.
3.5 Tools required
•HART host or Field Communicator
•mA meter
3.6 Proof test options
The flowmeter has two proof tests you can use to detect failures. Proof tests can be
performed using ProLink III software or the Field Communicator.
Proof test optionsTable 3-1:
Device Proof test Description
DU failure
detection
8800D Partial •Low/High alarm checks
•Visual inspection of flow meter
•Single point reasonability check or internal
flow simulation at 2 points
•Checking for alarms
•Checking configuration
High flow trip:
85%
Low flow trip:
77%
Comprehen-
sive
•Low/High alarm checks
•Visual inspection of flow meter
•3 to 5-point calibration check using reference
standard
•Checking for alarms
•Checking configuration
High flow trip:
94%
Low flow trip:
92%
3.7 Partial proof test
The partial proof test is recommended for all Rosemount 8800D Series SIL 2/3 Capable
Vortex Flowmeters.
Proof tests
16 Rosemount™ 8800D Safety Manual