Endress+Hauser Proline t-mass 300 Operator's manual

Products Solutions Services
Special Documentation
Proline t-mass 300
Functional safety manual
HART
SD02483D/06/EN/03.22-00
71620266
2023-07-28
Valid as of version
01.00.zz (Device firmware)

Proline t-mass 300 HART Table of contents
Endress+Hauser 3
Table of contents
1 Manufacturer's declaration .... 4
1.1 Safety-related characteristic values ..... 5
2 Certificate ....................... 7
3 About this document ........... 7
3.1 Document function ................... 7
3.2 Using this document .................. 7
3.3 Symbols ............................ 7
3.4 Supplementary device documentation ... 9
4 Design .......................... 10
4.1 Permitted device types ............... 10
4.2 Marking ........................... 13
4.3 Notes on the redundant use of multiple
sensors ............................ 13
4.4 Basic conditions for use in safety-
related applications ................. 15
4.5 Safety measured error ............... 16
4.6 Useful lifetime of electrical
components ........................ 18
5 Commissioning (installation
and configuration) ............ 18
5.1 Requirements for the personnel ....... 18
5.2 Installation ........................ 18
5.3 Commissioning ..................... 18
5.4 Operation ..........................19
5.5 Parameter configuration for safety-
related applications ................. 19
6 Operation ...................... 29
6.1 Device behavior during power-up ...... 29
6.2 Device behavior in safety function
demand mode ...................... 29
6.3 Safe states ......................... 29
6.4 Device behavior in event of alarms and
warnings .......................... 29
6.5 Alarm and warning messages ......... 30
7 Proof testing ................... 30
7.1 Test sequence A (PTC = 99 %) ........ 32
7.2 Test sequence C (PTC = 98 %) ......... 35
7.3 Test sequence D (PTC = 36 %) ........ 36
7.4 Test sequence E (PTC = 19 %) ......... 39
7.5 Test sequence F (PTC = 0 %) .......... 41
7.6 Verification criterion ................ 42
8 Repair and error handling .... 43
8.1 Maintenance ....................... 43
8.2 Repair ............................. 43
8.3 Modification ....................... 44
8.4 Taking out of service ................ 44
8.5 Disposal ........................... 44
9 Appendix ...................... 44
9.1 Structure of the measuring system ..... 44
9.2 Commissioning or proof test report .... 47
9.3 Verification or calibration ............ 49
9.4 Version history ..................... 49

Manufacturer's declaration Proline t-mass 300 HART
4 Endress+Hauser
1 Manufacturer's declaration
A0046114-EN

Proline t-mass 300 HART Manufacturer's declaration
Endress+Hauser 5
1.1 Safety-related characteristic values
General
Device designation and permitted
versions
6F3B (t-mass F 300)
6I3B (t-mass I 300)
Order code for "Output; input 1":
• Option BA "4-20mA HART"
• Option CA "4-20mA HART Ex-i passive"
• Option CC "4-20mA HART Ex-i active"
Order code for "Output; input 2":
All options
Order code for "Output; input 3":
All options
Order code for "Additional approval":
Option LA "SIL"
Safety-related output signal 4 to 20 mA (output; input 1)
Failure current ≤ 3.6 mA or ≥ 21 mA
Assessed measured variable/
function
Monitoring of mass flow for gaseous media
Safety function(s) Min., Max., Range
Device type according to IEC
61508-2
 Type A  Type B
Mode of operation  Low Demand
Mode
 High
Demand Mode
 Continuous Mode 1)
Valid hardware version (main
electronics)
From delivery date 31.07.2020
Valid firmware version 01.00.zz and higher (HART; from delivery date July 31, 2020)
Safety manual SD02483D
Type of assessment
(only 1 version can be selected)
 Complete HW/SW assessment in the context of development including
FMEDA and change process according to IEC 61508-2, 3
 Assessment of evidence for proven-in-use HW/SW including FMEDA and
change process according to IEC 61508-2, 3
 Analysis of HW/SW field data for evidence of "prior use" according to IEC
61511
 Assessment by FMEDA according to IEC 61508-2 for devices without software
Test documents Development documents, test reports, data sheets
1) No continuous mode according to IEC 61508: 2011 (Section 3.5.16)
SIL integrity
Systematic safety integrity  SIL 2 capable  SIL 3 capable

Manufacturer's declaration Proline t-mass 300 HART
6 Endress+Hauser
Hardware safety integrity Single-channel service
(HFT = 0)
 SIL 2 capable  SIL 3 capable
Multi-channel service
(HFT ≥ 1)
 SIL 2 capable  SIL 3 capable
FMEDA
Safety function(s) Min., Max., Range
λDU 1) 195 FIT
λDD 1) 2112 FIT
λSU 1) 2021 FIT
λSD 1) 3085 FIT
SFF - Safe Failure Fraction 97 %
PFDavg for T1 = 1 year 2) (single-channel architecture) 8.6 · 10-4
PFH 9.8 · 10-8
PTC 3) Up to 99 %
MTBFtot 4) 51 years
Diagnostic test interval 5) 30 min
Fault response time 6) 30 s
Recommended test interval T12 years
MTTFd 7) 49 years
1) FIT = Failure In Time, number of failures per 109 h
2) Valid for averaged ambient temperatures up to 40 °C (104 °F) in accordance with the general standard for devices
with SIL capability.
3) PTC = Proof Test Coverage (diagnostic coverage achieved by device failure detection during manual proof testing)
4) This value takes into account all failure types of the electronic components as per Siemens SN29500
5) All diagnostic functions are executed at least once during this time. For operation in high demand mode
according to IEC 61508, the safe use of the devices is limited to a safety function demand rate of ≤ 1/50 h.
6) Maximum time between fault detection and fault response.
7) MTTFd as per ISO 13849/IEC 62061 also includes soft errors (sporadic bit errors in data memories).
Note
The measuring device has been developed for use in "Low Demand" and "High Demand" mode.
Explanation
Our in-house quality management system saves information on safety-related systematic errors that will become
known in the future.

Proline t-mass 300 HART Certificate
Endress+Hauser 7
2 Certificate
Certificate can be accessed at www.endress.com:
1. Downloads
2. Approvals
3. Type: Functional safety (SIL)
4. Product root: e.g. 5H3B
5. Press the "Search" button
3 About this document
3.1 Document function
This document is part of the Operating Instructions and serves as a reference for application-
specific parameters and notes.
General information about functional safety SIL is available in the Download Area of the
Endress+Hauser website: www.endress.com/SIL.
3.2 Using this document
3.2.1 Information on the document structure
For additional information regarding the arrangement of the parameters, along with a
short description, according to the Operation menu, Setup menu, Diagnostics menu and
the operating concept, see the Operating Instructions, "Supplementary device
documentation" section
3.3 Symbols
3.3.1 Safety symbols
DANGER
This symbol alerts you to a dangerous situation. Failure to avoid this situation will result in
serious or fatal injury.
WARNING
This symbol alerts you to a dangerous situation. Failure to avoid this situation can result in
serious or fatal injury.
CAUTION
This symbol alerts you to a dangerous situation. Failure to avoid this situation can result in
minor or medium injury.
NOTICE
This symbol contains information on procedures and other facts which do not result in
personal injury.

About this document Proline t-mass 300 HART
8 Endress+Hauser
3.3.2 Symbols for certain types of Information
Symbol Meaning
Permitted
Procedures, processes or actions that are permitted.
Preferred
Procedures, processes or actions that are preferred.
Forbidden
Procedures, processes or actions that are forbidden.
Tip
Indicates additional information.
Reference to documentation
A
Reference to page
Reference to graphic
Notice or individual step to be observed
1.
,
2.
,
3.
… Series of steps
Result of a step
A0028662
Operation via local display
A0028663
Operation via operating tool
A0028665
Write-protected parameter
3.3.3 Symbols in graphics
Symbol Meaning
1, 2, 3 ... Item numbers
A, B, C, ... Views
A-A, B-B, C-C, ... Sections

Proline t-mass 300 HART About this document
Endress+Hauser 9
3.4 Supplementary device documentation
For an overview of the scope of the associated Technical Documentation, refer to the
following:
•Device Viewer (www.endress.com/deviceviewer): Enter the serial number from the
nameplate
•Endress+Hauser Operations app: Enter serial number from nameplate or scan matrix
code on nameplate.
3.4.1 Standard documentation
Operating Instructions
Measuring device Documentation code
t-mass F 300 BA01992D
t-mass I 300 BA01993D
Description of Device Parameters
Measuring device Documentation code
t-mass 300 GP01143D
Technical Information
Measuring device Documentation code
t-mass F 300 TI01500D
t-mass I 300 TI01501D
3.4.2 Supplementary device-dependent documentation
Safety instructions
Safety instructions for electrical equipment for hazardous areas.
Contents Documentation code
ATEX/IECEx Ex d/Ex de XA01965D
ATEX/IECEx Ex ec XA01966D
cCSAus XP XA01969D
cCSAus Ex d/ Ex de XA01967D
cCSAus Ex nA XA01968D

Design Proline t-mass 300 HART
10 Endress+Hauser
Remote display and operating module DKX001
Contents Documentation code
ATEX/IECEx Ex i XA01494D
ATEX/IECEx Ex ec XA01498D
cCSAus IS XA01499D
cCSAus Ex nA XA01513D
INMETRO Ex i XA01500D
INMETRO Ex ec XA01501D
NEPSI Ex i XA01502D
NEPSI Ex nA XA01503D
Functional safety manual
Contents Documentation code
Proline t-mass 300 SD02483D
Special documentation
Installation Instructions
Contents Comment
Installation instructions for spare part sets and
accessories
Overview of accessories available for order: see the Operating
Instructions for the device
4 Design
4.1 Permitted device types
The information on functional safety contained in this manual relates to the device versions
listed below and are valid as of the specified software and hardware version.
Unless otherwise specified, all subsequent versions can also be used for safety functions.
A modification process according to IEC 61508 is applied for any device modifications.
Valid device versions for safety-related use:

Proline t-mass 300 HART Design
Endress+Hauser 11
4.1.1 Order codes
Feature Designation Option selected
– Order code 6F3B (t-mass F 300)
6I3B (t-mass I 300)
000 Nominal diameter All
010 Approval; transmitter + sensor All
015 Power supply All
020 Output; input 1 1) • Option BA "4-20mA HART"
• Option CA "4-20mA HART Ex-i passive"
• Option CC "4-20mA HART Ex-i active"
021 Output; input 2 All
022 Output; input 3 All
030 Display; operation All
040 Housing All
050 Electrical connection All
060 Sensor version; sensor; measuring tube • HA "Unidirectional; Alloy; stainless steel"
• SA "Unidirectional; stainless steel; stainless steel"
070 Process connection All
080 Calibration flow All
480 Device model All
500 Display operating language All
520 Sensor option CS "1x flow conditioner"
530 Customer-specific configuration • DA "Output 1"
• DB "Output 2"
• DG "Totalizer"
• DH "Display; totalizer"
540 Application package • EA "Extended HistoROM"
• EB "Heartbeat Verification + Monitoring"
570 Service All
580 Test, certificate All
590 Additional approval LA (= SIL) 2)
610 Accessory mounted All
620 Accessory enclosed All

Design Proline t-mass 300 HART
12 Endress+Hauser
Feature Designation Option selected
850 Firmware version Firmware with SIL capability, e.g. 01.01.zz (HART)
895 Marking All
1) In devices with several outputs, only current output 1 (terminals 26 and 27) is suitable for safety functions. The
other outputs can, if necessary, be connected for non-safety-oriented purposes.
2) Additional selection of further approvals is possible.
4.1.2 Suitability of the measuring device
1. Carefully select the nominal diameter of the measuring device in accordance with the
application's expected flow rates.
 The maximum flow rate during operation must not exceed the specified calibrated
maximum value for the sensor.
2. In safety-related applications, it is advisable to select the limit value for monitoring a
minimum flow such that this limit is at least twice the smallest specified flow that can
still be measured, with the actual medium and the selected nominal diameter.
 For further information, see the Technical Information →  9
Restrictions:
• Gas composition: only air, CH4, CO2, N2, O2, natural gas (CH4 80 to 99 %, N2 0.3 to 12
%, C2H6 0.3 to 12 %, CO2 0.3 to 12 %)
• Temperature range: –30 to +150 °C (–22 to +302 °F)
• Pressure range: 0.8 to 30 bar a (11.6 to 435 psi a)
• Nominal diameter: up to internal diameter 320 mm (12.6 in)
• Circular pipe for insertion version (cannot be used in rectangular ducts)
NOTICE
Use the measuring device according to the specifications.
‣Pay attention to the medium properties and the environmental conditions.
‣Carefully follow instructions pertaining to critical process situations and installation
conditions.
Detailed information on:
• Mounting
• Electrical connection
• Medium properties
• Environment
• Process
Operating Instructions →  9

Proline t-mass 300 HART Design
Endress+Hauser 13
LCAUTION
Pay particular attention to the following:
‣Mounting requirements →  9.
‣Only suitable for dry gases.
‣Turbulences can occur at high flow velocity rates, e.g. if valves are half-closed. This can
cause the measured values to fluctuate.
‣Avoid applications that cause buildup, corrosion or abrasion at the sensor.
‣Avoid proximity to sources that radiate heat.
Further information on the suitability of the measuring device for safety-related
operation is available from your Endress+Hauser sales center.
4.2 Marking
SIL certified devices are marked with the SIL logo on the nameplate.
Order code:
Ser. no.:
Ext. ord. cd.:
ii
Date:
1
A0031473
1 SIL logo
4.3 Notes on the redundant use of multiple sensors
This section provides additional information regarding the use of homogeneously redundant
sensors e.g. in 1oo2 or 2oo3 architectures.
The common cause factors β and βD indicated below are minimum values for the device. These
must be used when designing the sensor subsystem:
• Minimum value β for homogeneously redundant use: 2 %
• Minimum value βD for homogeneously redundant use: 1 %
The device meets the requirements for SIL 3 in homogeneously redundant applications.

Design Proline t-mass 300 HART
14 Endress+Hauser
To fully rule out potential interference, it is recommended to install the sensors at different
points of the pipe.
NOTICE
Note the following if a fault is detected in one of the redundantly operated devices
during the proof test:
‣Check the other devices to see if the same fault occurs there.
4.3.1 Safety-related output signal
The device's safety-related signal is the 4 to 20 mA analog output signal as per NAMUR NE43.
All safety measures refer to this signal exclusively.
The device additionally communicates for information only via HART and contains all HART
features with additional device information. HART communication is not part of the safety
function.
The safety-related output signal is fed to a downstream logic unit, e.g. a programmable logic
controller or a limit signal transmitter, where it is monitored for the following:
• Overshooting and/or undershooting of a specified limit value
• The occurrence of a fault: e.g. failure current (≤ 3.6 mA, ≥ 21 mA, signal cable open circuit
or short-circuit)
In the event of a fault, it must be ensured that the equipment under control achieves or
maintains a safe state.
The safety-related errors are broken down in accordance with IEC/EN 61508 into different
categories and implications for the safety-related output signal.
Safety-related
error
Explanation Item no →  1
Impact on measuring
uncertainty
Implication for safety-related
output signal
No device error Safe:
No error
1
Within specification
None
λSD Safe detected:
Safe, detectable failure present
3
No implications
Causes a failure current at the
output signal
λSU Safe undetected:
Safe, undetectable failure
present
2
May be outside specifications
Is within the defined error range
λDD Dangerous detected:
Dangerous but detectable failure
present (diagnosis in device)
3
No implications
Causes a failure current at the
output signal

Proline t-mass 300 HART Design
Endress+Hauser 15
Safety-related
error
Explanation Item no →  1
Impact on measuring
uncertainty
Implication for safety-related
output signal
λDU Dangerous undetected:
Dangerous, undetectable failure
present
4
May be outside the defined
error range
May be outside the defined
error range
I [mA]
B
C
A
t
3
31
2
4
A0034924
 1 Safety-related output signal
A Failure current ≥ 21 mA
B Measuring uncertainty according to device's technical data
C Failure current ≤ 3.6 mA
4.4 Basic conditions for use in safety-related applications
1. The measuring device must be used correctly for the specific application, taking into
account the medium properties and ambient conditions.
2. Carefully follow safety instructions pertaining to critical process situations and
installation conditions, which can be found in the device documentation.
3. Observe application-specific limits.
4. Do not exceed technical specifications of measuring device.
Information on the safety-related signal
For detailed information on the technical specifications, see the device documentation
→  9.

Design Proline t-mass 300 HART
16 Endress+Hauser
4.4.1 Additional restrictions for safety-related use
An incorrect output signal that deviates from the value specified in the Operating Instructions
but is still in the range of 4 to 20 mA, is considered a dangerous, undetected failure.
Information on measured error→  16
For detailed information on the maximum measured error, see the Technical
Information→  9
4.5 Safety measured error
When the measured value is transmitted via the 4–20 mA current output, the measuring
device's relative measured error is made up of the contribution of the digitally determined
measured value and the accuracy of the analog current output. These contributions, which are
listed in the device documentation, apply under reference operating conditions and can
depend on the sensor version ordered.
For detailed information on the maximum measured error, see the Technical
Information→  9
Guidelines for minimal measured errors:
1. Limit value monitoring: Depending on the process dynamics, the current value of the
unfiltered 4–20 mA output signal can temporarily exceed the specified error range.
The device can optionally provide damping of the current output via a parameter that
only affects the measured value output.
 Device-internal diagnostics or the outputting of a failure current (≤ 3.6 mA, ≥
21 mA) are not affected by this damping.
2. Furthermore, in the event of an error in safety-related applications an additional
measuring uncertainty percentage applies when the SIL mode is switched on; typical
component failures are taken into consideration for this value. This additional
uncertainty is specifically due to limited diagnostic capabilities. The additional
measuring uncertainty values are:
 ±2% for air
±4% for other gases
4.5.1 Power supply to the 4–20 mA current output
Overvoltages at the 4–20 mA current output (passive, output; input 1) - caused by a fault in
the supply unit, for example - can result in a leak current in the device's input protection unit.
This may lead to falsification of the output signal by more than the specified error or the
minimum failure current (3.6 mA) can no longer be set due to the leak current.
‣Use a 4–20 mA power supply unit with either voltage limitation or voltage monitoring.

Proline t-mass 300 HART Design
Endress+Hauser 17
NOTICE
The safety-related connection values depend on the Ex approval.
‣Pay attention to the safety-related connection values.
For detailed information on the connection values, see the Safety Instructions.→  9
4.5.2 HART communication
The measuring device also communicates via HART or WirelessHART in the SIL mode. This
comprises all the HART features with additional device information.
NOTICE
The measuring device's safety-related signal is the 4–20 mA analog output signal
(output; input 1).
All safety measures refer to this signal exclusively.
‣Please note the following: →  14.
NOTICE
When the SIL locking code is entered, the device parameters that affect the safety-
related output signal are locked and write-protected. It is still possible to read the
parameters.
When SIL locking is enabled, restrictions apply on all communication options, such as the
service interface (CDI-RJ45), HART protocol and WirelessHART protocol, local display and
WLAN.
‣Deactivation of the SIL mode →  28.

Commissioning (installation and configuration) Proline t-mass 300 HART
18 Endress+Hauser
4.6 Useful lifetime of electrical components
The established failure rates of electric components apply for a useful lifetime of 12 years as
per IEC 61508-2: 2010, Section 7.4.9.5, Note 3. Once a device has exceeded its useful
lifetime, it should be replaced.
The device's year of manufacture is coded in the first character of the serial number (→ table
below).
Example: serial number R5ABBF02000 → year of manufacture 2020
ASCII character Meaning ASCII character Meaning ASCII character Meaning
R 2020 2025 2030
S 2021 2026 2031
T 2022 2027 2032
V 2023 2028 2033
W 2024 2029 2034
5 Commissioning (installation and configuration)
5.1 Requirements for the personnel
The personnel for installation, commissioning, diagnostics and maintenance must fulfill the
following requirements:
‣Trained, qualified specialists must have a relevant qualification for this specific function
and task.
‣Are authorized by the plant owner/operator.
‣Are familiar with federal/national regulations.
‣Before starting work, read and understand the instructions in the manual and
supplementary documentation as well as the certificates (depending on the application).
‣Follow instructions and comply with basic conditions.
The operating personnel must fulfill the following requirements:
‣Are instructed and authorized according to the requirements of the task by the facility's
owner-operator.
‣Follow the instructions in this manual.
5.2 Installation
The mounting and wiring of the device and the permitted orientations are described in the
Operating Instructions pertaining to the device.
5.3 Commissioning
For detailed information on commissioning, see the Operating Instructions. →  9

Proline t-mass 300 HART Commissioning (installation and configuration)
Endress+Hauser 19
5.4 Operation
For detailed information on the operating options, see the Operating Instructions.→  9
5.5 Parameter configuration for safety-related applications
5.5.1 Adjustment of the measuring point
The measuring point is calibrated via the operating interfaces. A wizard guides you
systematically through all the submenus and parameters that have to be set for configuring
the measuring device.
For detailed information on the operating options, see the Operating Instructions.→  9
For detailed information on configuring the measuring device, see the Operating
Instructions and Description of Device Parameters →  9
Device protection
The devices can be protected against external influences as follows:
• Hardware write protection
• Software write protection
The application of these methods is described below.
5.5.2 Activation of SIL mode
To activate the SIL mode, the device must run through a confirmation sequence. While
running through this sequence, critical parameters are either set automatically by the device
to standard values or transferred to the local display/operating tool to enable verification of
the setting. On completion of parameter configuration, the SIL mode of the device must be
enabled with a SIL locking code.
Availability of the SIL mode function
NOTICE
The SIL confirmation sequence is only visible on the local display and in the operating
tools for devices with the order code for "Additional approval", option LA "SIL".
‣For this reason, the SIL mode can also only be activated on these measuring devices.
‣If the LA "SIL" option was ordered for the flowmeter ex works, this option is available when
the measuring device is delivered to the customer. Access is via the operating interfaces of
the measuring device.
‣If the order option cannot be accessed in the measuring device, the function cannot be
retrofitted during the life cycle of the device. If you have any questions please contact your
Endress+Hauser service or sales organization.
Ways to check function availability in the measuring device:
Using the serial number:
Device viewer 1) → Order code for "Additional approval", option LA "SIL"
1) www.endress.com/deviceviewer

Commissioning (installation and configuration) Proline t-mass 300 HART
20 Endress+Hauser
Detailed information concerning the SIL label:
• Permitted device types →  10
• SIL marking on the transmitter nameplate →  13
Overview of the SIL mode
The SIL mode enables the following steps:
1. Makes sure that the preconditions are met.
 The measuring device checks whether the user has correctly configured a
predefined set of parameters for the safety function.
If the result is positive, the device continues with the activation of the SIL mode.
If the result is negative, the sequence is not permitted or is aborted, and the device
does not continue with the activation of the SIL mode.
2. Automatically switches a predefined set of parameters to the default values specified by
the manufacturer.
 This parameter set ensures that the flowmeter works in the safety mode.
3. Guides the user through the preconfigured parameters for checking.
 This ensures that the user actively checks all the important pre-settings.
4. Activates write protection for all the relevant parameters in the SIL mode.
All this ensures that the parameter settings that are required for the safety function are
configured correctly. (These settings cannot be circumvented either deliberately or by
accident.)
5.5.3 Locking a SIL device
When locking a SIL device, all safety-related parameter settings are shown to the operator
individually and must be confirmed explicitly. Parameter settings not permitted in the locked
SIL mode are reset to their default values where necessary. A SIL locking code is then entered
to lock the device software to ensure that parameters cannot be changed. Non-safety-related
parameters remain unchanged.