Endress+Hauser Cerabar S PMC71 Instructions for use

Products Solutions Services
SD00190P/00/EN/16.17
71385812
Special Documentation
Cerabar S PMC71, PMP71, PMP75
Functional Safety Manual
Process pressure and level measurement with 4-20 mA output signal

Cerabar S
2Endress+Hauser
Table of contents
SIL Declaration of Conformity . . . . . . . . . . . . . . . . . . . . .3
Safety-related parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Useful lifetime of electric components . . . . . . . . . . . . . . . . . . . 13
Certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
General information . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Document purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Symbols used . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Supplementary device documentation . . . . . . . . . . . . . . . . . . . 16
Permitted device types . . . . . . . . . . . . . . . . . . . . . . . . . 17
SIL label on the nameplate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Safety function. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Definition of the safety function . . . . . . . . . . . . . . . . . . . . . . . . 19
Safety-related signal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Restrictions for use in safety-related applications . . . . . . . . . 19
Use in protective systems . . . . . . . . . . . . . . . . . . . . . . 21
Device behavior during operation . . . . . . . . . . . . . . . . . . . . . . . 21
Confirmation and locking methods . . . . . . . . . . . . . . . . . . . . . . 23
Increased security during parameter entry via onsite display,
Field Communicator or FieldCare/DeviceCare . . . . . . . . . . . . . 24
Standard device configuration via onsite display, Field
Communicator or FieldCare/DeviceCare . . . . . . . . . . . . . . . . . . 28
Conditions for safe measuring mode . . . . . . . . . . . . . . . . . . . . 29
Checks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Locking/unlocking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Proof-test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Life cycle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Requirements for personnel . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Commissioning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Repair . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Modification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Decommissioning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Appendix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Measuring system design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Notes on the redundant connection of multiple sensors
for SIL 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Additional information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Change history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Parameter description . . . . . . . . . . . . . . . . . . . . . . . . . 37
Parameter description of the SAFETY CONFIRM. group –
"Pressure" operating mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Form for standard device configuration - Pressure . 41
Form for standard device configuration - Level . . . . 43

Cerabar S
Endress+Hauser 3
SIL Declaration of Conformity
The binding document forms part of the scope of delivery when the Cerabar S is ordered with the "SIL 2/
SIL 3 IEC 61508 Declaration of Conformity" option.
SIL_Cerabar S

Cerabar S
4Endress+Hauser
Safety-related parameters In various applications, the operation of pressure or differential pressure transmitters at overpressure
(outside the measuring range, < MWP) or low pressure is not critical.
The state of the processes must be assessed and the various parameters must be taken into
consideration.
• Low pressure or overpressure not dangerous message E727 pressure overrange = Warning
• Low pressure or overpressure dangerous message E727 pressure overrange = Alarm
Depending on the configuration profile selected for the messages (Table ä22) different
parameters must be considered when assessing the facility:
• Message E727 pressure overrange = Alarm parameter profile A applies
• Message E727 pressure overrange = Warning parameter profile B applies
Parameter profiles A and B depend on the alarm settings and not on the firmware version.
For firmware versions up to and including firmware version 02.20.04, message E727 was set, as a rule,
to "Alarm" for SIL locking with increased security during parameter entry.
With firmware version 02.30.zz and higher, the settings for message E727 remain unchanged,
Table ä22.
Parameter profile A with message E727 (pressure overrange) configured as an alarm
PMP71, PMP75
Parameters according to IEC 61508 Value
Safety functions MIN, MAX, Range
SIL (hardware) • 2 (single-channel),
• 3 (with use of a SIL 3 capable coincidence logic)
SIL (software) 3
Device type B
Operating mode Low demand mode
Safety functions MIN MAX Range
sd 52 FIT 396 FIT 448 FIT
su 313 FIT 313 FIT 313 FIT
dd 396 FIT 52 FIT 0 FIT
du 65 FIT 65 FIT 65 FIT
tot 1)
1) According to Siemens SN29500. This value takes into account all failure types.
1063 FIT
MTBFtot )107 years
SFF 92.0%
PFDavg for T1= 1 year (single-channel) 2)
2) If the average temperature during continuous operation is in the region of +50 °C (+122 °F), a factor of 1.3
should be taken into account.
2.86 × 10-4
Diagnostic test interval 3)
3) During this time, all diagnostic functions are executed at least once.
5 min (RAM, ROM, ...), 1 s (Measurement)
Fault reaction time 4)
4) Time between fault detection and fault reaction.
5 min (RAM, ROM, …), 10 s (Measurement)
Settling time 5)
5) Step response time as per DIN EN 61298-2.
Technical Information TI00383P/00/EN,
"Dead time, time constant (T63)" section

Cerabar S
Endress+Hauser 5
Parameter profile B with message E727 (pressure overrange) configured as a warning
PMP71, PMP75
Parameters according to IEC 61508 Value
Safety functions MIN, MAX, Range
SIL (hardware) • 2 (single-channel),
• 3 (with use of a SIL 3 capable coincidence logic)
SIL (software) 3
Device type B
Operating mode Low demand mode
Safety functions MIN MAX Range
sd 50 FIT 406 FIT 456 FIT
su 311 FIT 311 FIT 311 FIT
dd 406 FIT 50 FIT 0 FIT
du 88 FIT 88 FIT 88 FIT
tot 1)
1) According to Siemens SN29500. This value takes into account all failure types.
1105 FIT
MTBFtot )103 years
SFF 90%
PFDavg for T1= 1 year (single-channel) 2)
2) If the average temperature during continuous operation is in the region of +50 °C (+122 °F), a factor of 1.3
should be taken into account.
3.85 × 10-4
Diagnostic test interval 3)
3) During this time, all diagnostic functions are executed at least once.
5 min (RAM, ROM, ...), 1 s (Measurement)
Fault reaction time 4)
4) Time between fault detection and fault reaction.
5 min (RAM, ROM, …), 10 s (Measurement)
Settling time 5)
5) Step response time as per DIN EN 61298-2.
Technical Information TI00383P/00/EN,
"Dead time, time constant (T63)" section

Cerabar S
6Endress+Hauser
Parameter profile A with message E727 (pressure overrange) configured as an alarm
PMC71 standard, Ex i
Parameters according to IEC 61508 Value
Safety functions MIN, MAX, Range
SIL (hardware) • 2 (single-channel),
• 3 (with use of a SIL 3 capable coincidence logic)
SIL (software) 3
Device type B
Operating mode Low demand mode
Safety functions MIN MAX Range
sd 52 FIT 367 FIT 419 FIT
su 392 FIT 392 FIT 392 FIT
dd 367 FIT 52 FIT 0 FIT
du 80 FIT 80 FIT 80 FIT
tot 1)
1) According to Siemens SN29500. This value takes into account all failure types.
1128 FIT
MTBFtot )101 years
SFF 91.0%
PFDavg for T1= 1 year (single-channel) 2)
2) If the average temperature during continuous operation is in the region of +50 °C (+122 °F), a factor of 1.3
should be taken into account.
3.50 × 10-4
Diagnostic test interval 3)
3) During this time, all diagnostic functions are executed at least once.
5 min (RAM, ROM, ...), 1 s (Measurement)
Fault reaction time 4)
4) Time between fault detection and fault reaction.
5 min (RAM, ROM, …), 10 s (Measurement)
Settling time 5)
5) Step response time as per DIN EN 61298-2.
Technical Information TI00383P/00/EN,
"Dead time, time constant (T63)" section

Cerabar S
Endress+Hauser 7
Parameter profile B with message E727 (pressure overrange) configured as a warning
PMC71 standard, Ex i
Parameters according to IEC 61508 Value
Safety functions MIN, MAX, Range
SIL (hardware) • 2 (single-channel),
• 3 (with use of a SIL 3 capable coincidence logic)
SIL (software) 3
Device type B
Operating mode Low demand mode
Safety functions MIN MAX Range
sd 50 FIT 363 FIT 413 FIT
su 390 FIT 390 FIT 390 FIT
dd 363 FIT 50 FIT 0 FIT
du 82 FIT 82 FIT 82 FIT
tot 1)
1) According to Siemens SN29500. This value takes into account all failure types.
1173 FIT
MTBFtot )97 years
SFF 90%
PFDavg for T1= 1 year (single-channel) 2)
2) If the average temperature during continuous operation is in the region of +50 °C (+122 °F), a factor of 1.3
should be taken into account.
3.59 × 10-4
Diagnostic test interval 3)
3) During this time, all diagnostic functions are executed at least once.
5 min (RAM, ROM, ...), 1 s (Measurement)
Fault reaction time 4)
4) Time between fault detection and fault reaction.
5 min (RAM, ROM, …), 10 s (Measurement)
Settling time 5)
5) Step response time as per DIN EN 61298-2.
Technical Information TI00383P/00/EN,
"Dead time, time constant (T)" section

Cerabar S
8Endress+Hauser
Parameter profile A with message E727 (pressure overrange) configured as an alarm
PMC71 standard HT, Ex i HT (HT = high temperature)
Parameters according to IEC 61508 Value
Safety functions MIN, MAX, Range
SIL (hardware) • 2 (single-channel),
• 3 (with use of a SIL 3 capable coincidence logic)
SIL (software) 3
Device type B
Operating mode Low demand mode
Safety functions MIN MAX Range
sd 52 FIT 375 FIT 427 FIT
su 396 FIT 396 FIT 396 FIT
dd 375 FIT 52 FIT 0 FIT
du 80 FIT 80 FIT 80 FIT
tot 1)
1) According to Siemens SN29500. This value takes into account all failure types.
1140 FIT
MTBFtot  100 years
SFF 91.1%
PFDavg for T1= 1 year (single-channel) 2)
2) If the average temperature during continuous operation is in the region of +50 °C (+122 °F), a factor of 1.3
should be taken into account.
3.52 × 10-4
Diagnostic test interval 3)
3) During this time, all diagnostic functions are executed at least once.
5 min (RAM, ROM, ...), 1 s (Measurement)
Fault reaction time 4)
4) Time between fault detection and fault reaction.
5 min (RAM, ROM, …), 10 s (Measurement)
Settling time 5)
5) Step response time as per DIN EN 61298-2.
Technical Information TI00383P/00,
"Dead time, time constant (T63)" section

Cerabar S
Endress+Hauser 9
Parameter profile B with message E727 (pressure overrange) configured as a warning
PMC71 standard HT, Ex i HT (HT = high temperature)
Parameters according to IEC 61508 Value
Safety functions MIN, MAX, Range
SIL (hardware) • 2 (single-channel),
• 3 (with use of a SIL 3 capable coincidence logic)
SIL (software) 3
Device type B
Operating mode Low demand mode
Safety functions MIN MAX Range
sd 50 FIT 371 FIT 420 FIT
su 394 FIT 394 FIT 394 FIT
dd 371 FIT 50 FIT 0 FIT
du 82 FIT 82 FIT 82 FIT
tot 1)
1) According to Siemens SN29500. This value takes into account all failure types.
1185 FIT
MTBFtot )96 years
SFF 91%
PFDavg for T1= 1 year (single-channel) 2)
2) If the average temperature during continuous operation is in the region of +50 °C (+122 °F), a factor of 1.3
should be taken into account.
3.61 × 10-4
Diagnostic test interval 3)
3) During this time, all diagnostic functions are executed at least once.
5 min (RAM, ROM, ...), 1 s (Measurement)
Fault reaction time 4)
4) Time between fault detection and fault reaction.
5 min (RAM, ROM, …), 10 s (Measurement)
Settling time 5)
5) Step response time as per DIN EN 61298-2.
Technical Information TI00383P/00/EN,
"Dead time, time constant (T)" section

Cerabar S
10 Endress+Hauser
Parameter profile A with message E727 (pressure overrange) configured as an alarm
PMC71 Ex d[ia]
Parameters according to IEC 61508 Value
Safety functions MIN, MAX, Range
SIL (hardware) • 2 (single-channel),
• 3 (with use of a SIL 3 capable coincidence logic)
SIL (software) 3
Device type B
Operating mode Low demand mode
Safety functions MIN MAX Range
sd 52 FIT 443 FIT 495 FIT
su 450 FIT 450 FIT 450 FIT
dd 443 FIT 52 FIT 0 FIT
du 85 FIT 85 FIT 85 FIT
tot 1)
1) According to Siemens SN29500. This value takes into account all failure types.
1267 FIT
MTBFtot )90 years
SFF 91.7%
PFDavg for T1= 1 year (single-channel) 2)
2) If the average temperature during continuous operation is in the region of +50 °C (+122 °F), a factor of 1.3
should be taken into account.
3.70 × 10-4
Diagnostic test interval 3)
3) During this time, all diagnostic functions are executed at least once.
5 min (RAM, ROM, ...), 1 s (Measurement)
Fault reaction time 4)
4) Time between fault detection and fault reaction.
5 min (RAM, ROM, …), 10 s (Measurement)
Settling time 5)
5) Step response time as per DIN EN 61298-2.
Technical Information TI00383P/00/EN,
"Dead time, time constant (T63)" section (T63)"

Cerabar S
Endress+Hauser 11
Parameter profile B with message E727 (pressure overrange) configured as a warning
PMC71 Ex d[ia]
Parameters according to IEC 61508 Value
Safety functions MIN, MAX, Range
SIL (hardware) • 2 (single-channel),
• 3 (with use of a SIL 3 capable coincidence logic)
SIL (software) 3
Device type B
Operating mode Low demand mode
Safety functions MIN MAX Range
sd 52 FIT 438 FIT 490 FIT
su 450 FIT 450 FIT 450 FIT
dd 438 FIT 52 FIT 0 FIT
du 57 FIT 57 FIT 57 FIT
tot 1)
1) According to Siemens SN29500. This value takes into account all failure types.
1267 FIT
MTBFtot )90 years
SFF 91.5%
PFDavg for T1= 1 year (single-channel) 2)
2) If the average temperature during continuous operation is in the region of +50 °C (+122 °F), a factor of 1.3
should be taken into account.
2.50 × 10-4
Diagnostic test interval 3)
3) During this time, all diagnostic functions are executed at least once.
5 min (RAM, ROM, ...), 1 s (Measurement)
Fault reaction time 4)
4) Time between fault detection and fault reaction.
5 min (RAM, ROM, …), 10 s (Measurement)
Settling time 5)
5) Step response time as per DIN EN 61298-2.
Technical Information TI00383P/00/EN,
"Dead time, time constant (T)" section

Cerabar S
12 Endress+Hauser
Parameter profile A with message E727 (pressure overrange) configured as an alarm
PMC71 Ex d[ia] HT (HT = high temperature)
Parameters according to IEC 61508 Value
Safety functions MIN, MAX, Range
SIL (hardware) • 2 (single-channel),
• 3 (with use of a SIL 3 capable coincidence logic)
SIL (software) 3
Device type B
Operating mode Low demand mode
Safety functions MIN MAX Range
sd 52 FIT 451 FIT 503 FIT
su 454 FIT 454 FIT 454 FIT
dd 451 FIT 52 FIT 0 FIT
du 85 FIT 85 FIT 85 FIT
tot 1)
1) According to Siemens SN29500. This value takes into account all failure types.
1279 FIT
MTBFtot )89 years
SFF 91.8%
PFDavg for T1= 1 year (single-channel) 2)
2) If the average temperature during continuous operation is in the region of +50 °C (+122 °F), a factor of 1.3
should be taken into account.
3.72 × 10-4
Diagnostic test interval 3)
3) During this time, all diagnostic functions are executed at least once.
5 min (RAM, ROM, ...), 1 s (Measurement)
Fault reaction time 4)
4) Time between fault detection and fault reaction.
5 min (RAM, ROM, …), 10 s (Measurement)
Settling time 5)
5) Step response time as per DIN EN 61298-2.
Technical Information TI00383P/00/EN,
"Dead time, time constant (T63)" section

Cerabar S
Endress+Hauser 13
Parameter profile B with message E727 (pressure overrange) configured as a warning
Useful lifetime of electric
components
The established failure rates of electrical components apply within the useful lifetime as per IEC
61508-2: 2010 section 7.4.9.5 note 3. According to DIN EN 61508-2:2011 section 7.4.9.5 national
footnote N3 appropriate measures taken by the manufacturer and operator can extend the useful
lifetime.
PMC71 Ex d[ia] HT (HT = high temperature)
Parameters according to IEC 61508 Value
Safety functions MIN, MAX, Range
SIL (hardware) • 2 (single-channel),
• 3 (with use of a SIL 3 capable coincidence logic)
SIL (software) 3
Device type B
Operating mode Low demand mode
Safety functions MIN MAX Range
sd 50 FIT 446 FIT 496 FIT
su 452 FIT 452 FIT 452 FIT
dd 446 FIT 50 FIT 0 FIT
du 87 FIT 87 FIT 87 FIT
tot 1)
1) According to Siemens SN29500. This value takes into account all failure types.
1279 FIT
MTBFtot )89 years
SFF 91.5%
PFDavg for T1= 1 year (single-channel) 2)
2) If the average temperature during continuous operation is in the region of +50 °C (+122 °F), a factor of 1.3
should be taken into account.
3.8 × 10-4
Diagnostic test interval 3)
3) During this time, all diagnostic functions are executed at least once.
5 min (RAM, ROM, ...), 1 s (Measurement)
Fault reaction time 4)
4) Time between fault detection and fault reaction.
5 min (RAM, ROM, …), 10 s (Measurement)
Settling time 5)
5) Step response time as per DIN EN 61298-2.
Technical Information TI00383P/00/EN,
"Dead time, time constant (T63)" section

Cerabar S
14 Endress+Hauser
Certificate
TUEV_EN

Cerabar S
Endress+Hauser 15
General information
Document purpose The document is part of the Operating Instructions and serves as a reference for application-specific
parameters and notes.
Symbols used Safety symbols
Symbols for certain types of information
Symbols in graphics
Symbols on the device
• General information about functional safety: SIL
• General information about SIL is available:
In the Download Area of the Endress+Hauser Internet site: www.de.endress.com Search 
Functional safety
Symbol Meaning
A0011189-DE
DANGER!
This symbol alerts you to a dangerous situation. Failure to avoid this situation will
result in serious or fatal injury.
A0011190-DE
WARNING!
This symbol alerts you to a dangerous situation. Failure to avoid this situation can
result in serious or fatal injury.
A0011191-DE
CAUTION!
This symbol alerts you to a dangerous situation. Failure to avoid this situation can
result in minor or medium injury.
A0011192-DE
NOTICE!
This symbol contains information on procedures and other facts which do not result in
personal injury.
Symbol Meaning
A0011193
Tip
Indicates additional information.
A0028659
Reference to page.
1, 2, 3, 4, ... Series of steps
Symbol Meaning
1, 2, 3, 4, ... Numbering of main items
Symbol Meaning
A0019159
Safety notice
Observe the safety instructions contained in the Operating Instructions associated with
the device.
DANGER
WARNING
CAUTION
NOTICE
A

Cerabar S
16 Endress+Hauser
Supplementary device
documentation Documentation Contents Note
Brief Operating
Instructions:
KA01019P/00
• Installation
• Wiring
•Operation
• Commissioning
• The documentation is provided with
the device.
• The documentation is available on the
Internet at www.de.endress.com
Technical Information:
TI00383P/00
Technical data The documentation is available on the
Internet at www.de.endress.com
Operating Instructions:
BA00271P/00
• Identification
• Installation
• Wiring
•Operation
• Commissioning, description of the
Quick Setup menu
• Maintenance
• Troubleshooting incl. spare parts
• Appendix: diagram of menus
The documentation is available on the
Internet at www.de.endress.com
Operating Instructions:
BA00274P/00
(Description of
Device Functions)
• Configuration examples for pressure,
level and flow measurement
• Parameter description
• Troubleshooting
• Appendix: diagram of menus
The documentation is available on the
Internet at www.de.endress.com
Compact Instructions:
KA00218P/00
• Wiring
• Operation without a display
• Description of the Quick Setup menu
•HistoROM/M-DAToperation
The documentation is provided with the
device. Connection compartment
cover
Safety Instructions,
Control Drawings or
Certificates
Safety, mounting and operating
instructions for devices suitable for use in
hazardous areas or as overfill prevention
(German Water Resources Act).
Select the desired explosion protection or
approval by means of feature 10
"Approval" in the order code.
The corresponding documentation is
provided with the device.

Cerabar S
Endress+Hauser 17
Permitted device types
The details pertaining to functional safety in this manual relate to the device versions listed below and
are valid as of the specified software and hardware version. Unless otherwise specified, all subsequent
versions can also be used for safety functions. A modification process according to IEC 61508 is applied
for device changes.
Device versions valid for use in safety-related applications: PMC71
Device versions valid for use in safety-related applications: PMP7x
Valid firmware version: 02.0x and higher; 02.30.zz recommended
Valid hardware version (electronics): 02.00 and higher
In the event of device modifications, a modification process compliant with IEC 61508 is applied.
Devices with a firmware version 02.0x and higher which are already in use can still be operated if the
suitable DTM or DD is used.
Feature Designation Feature version
010 Approval all
020 Output; Operation A
B
C
D
E
F
4-20 mA HART; extern. + LCD
4-20 mA HART; inside + LCD
4-20 mA HART; inside
4-20 mA HART; Li = 0; extern. + LCD
4-20 mA HART; Li = 0; inside + LCD
4-20 mA HART; Li = 0; inside
030 Housing; Cover Sealing;
Cable Entry
all
040 Sensor Range; Sensor
Overload Limit
all
050 Calibration; Unit all
070 Process Connection all
080 Seal all
100 Additional Option 1 E SIL Declaration of Conformity
or
110 Additional option 2 E SIL declaration of conformity
Feature Designation Feature version
010 Approval all
020 Output; Operation A
B
C
D
E
F
4-20 mA HART; extern. + LCD
4-20 mA HART; inside + LCD
4-20 mA HART; inside
4-20 mA HART; Li = 0; extern. + LCD
4-20 mA HART; Li = 0; inside + LCD
4-20 mA HART; Li = 0; inside
030 Housing; Cover Sealing;
Cable Entry
all
040 Sensor Range; Sensor
Overload Limit
all
050 Calibration; Unit all
060 Membrane Material all
070 Process Connection all
090 Fill Fluid all; PMP75 (see the following "Warning" ä19)
100 Additional Option 1 E SIL Declaration of Conformity
or
110 Additional option 2 E SIL declaration of conformity

Cerabar S
18 Endress+Hauser
An operating program is included in the scope of delivery for devices with the "HistoROM/M-DAT"
option (select the following in the product structure: feature 100 "Additional option 1", option N
"HistoROM/M-DAT Setup/diagnostic software included" or feature 110 "Additional option 2", option N
"HistoROM/M-DAT Setup/diagnostic software included").
WARNING
!
The functional safety assessment of the devices includes the basic unit with the main electronics,
sensor electronics and sensor up to the sensor membrane and the process connection mounted
directly. Process adapters, diaphragm seals and mounted/enclosed accessories were not taken
into account in the rating. The following applies for diaphragm seals:
The additional use of diaphragm seal systems has an impact on the overall accuracy of the
measuring transmission and the settling time.
The operator is responsible for assessing the suitability of the overall system, consisting of the basic
device and the diaphragm seal, for safety-related operation.
‣Observe the Technical Information ("Supplementary device documentation", ä16)
SIL label on the nameplate SIL certified devices bear the following symbol on the nameplate:

Cerabar S
Endress+Hauser 19
Safety function
Definition of the safety
function
The device's safety functions are:
• Absolute and gauge pressure
• Level monitoring
Safety-related signal The safety-related signal of the Cerabar S is the analog output signal 4 to 20 mA.
All safety functions solely refer to this output. In addition, the Cerabar S communicates via HART and
contains all HART features with additional diagnostics information.
The behavior of the output current in the event of an error depends on the setting for the messages
(Table ä22).
The safety-related output signal is fed to a downstream logic unit, e.g. a programmable logic controller
or a limit signal transmitter where it is monitored for the following:
• Exceeding and/or undershooting of a specific limit value.
• The occurrence of a fault, e.g. error current (≤3.6 mA, ≥21.0 mA, signal cable open circuit or short-
circuit).
The following dangerous undetected failures can occur in the devices:
• An incorrect output signal which deviates from the real measured value by more than 1%, with the
output signal remaining within the 4 to 20 mA or 3.8 to 20.5 mA range.
• A settling time that is delayed by more than the specified settling time plus tolerance.
For fault monitoring, the logic unit must be able to detect HI alarms (21 mA) and LO alarms
(3.6 mA).
The transmitter output is not safety-oriented during the following activities:
• Changes to the configuration
•Multidrop
– with software version < 02.20, if the parameter "bus address" (345) is set to ≠"0".
– with software version ≥02.20, if the parameter "current mode" (052) is set to "fixed" (onsite display
and FieldCare) or "disabled" (HART handheld terminal).
• Simulation
• Proof-test
While configuring the transmitter and performing maintenance work on Cerabar S, alternative
measures must be taken to ensure the process safety.
Restrictions for use in safety-
related applications
• Device warmup time: after device warmup, the safety functions are available after a 30-second
initialization period.
• With regard to the calculation of the SFF, a tolerance range of ±1 % was established for the deviation
of the output current in the event of a failure of a safety-related component in the pressure
transmitter. The ±1 % deviation refers to the actual measured, real value of the output current. If the
pressure transmitter is operated in safety-related applications, it is recommended to increase the
total performance failure, as indicated in the Technical Information (TI), by this value.
• In the case of local operation of the Cerabar S without a display and without an operating tool or
without a HART communicator, the device cannot be safely configured because the user cannot
perform a visual check. In both these situations, communication via HART alone is not sufficient.
• The Cerabar S must be locked following configuration.
• When using the Cerabar S as a subsystem of a safety function, the "Hold meas. value" setting in the
parameter "Output fail mode" (388) and also the Multidrop mode (ä19) may not be selected as
this option does not provide failsafe alarming.
• During commissioning, a complete function test of the safety-related functions must be performed.
• The maximum interval for proof-testing (Proof Test Interval) is 5 years.
• Faulty devices must be replaced as soon as possible to minimize the possibility of multiple errors
occurring.
The failure probabilities indicated in this Safety Manual are based on a medium time to repair
(MTTR) of 8 hours.
In the event of an error, it must be ensured that the facility to be monitored remains in a safe
state or is set to a safe state.
Safety-related
error
Explanation Implications for the
safety-related
output signal
Implications for
measuring uncertainty
(position, see Fig. ä20)
No device error Safe: SD
No error
None 1 Is within the specification
(see TI, BA, ...)

Cerabar S
20 Endress+Hauser
A0022897
AHI-Alarm≥21 mA
B Error range ± 1%
CLO-Alarm≤3.6 mA
Dangerous undetected failures in this scenario
An incorrect output signal that deviates from the real measured value by more than 1%, but is still in
the 4-20 mA range, is considered a dangerous, undetected failure.
λSD Safe detected:
Safe failure which can be
detected
Causes the output signal to
signal the failsafe mode
ä21
3 No implications
λSU Safe undetected:
Safe failure which cannot be
detected
Is within the defined
error range
2Maybeoutside
specifications
λDD Dangerous detected:
Dangerous failure which
can be detected
(Diagnostic within the
device)
Causes the output signal to
signal the failsafe mode
ä21
3 No implications
λDU Dangerous undetected:
Dangerous failure which
cannot be detected
May be outside the defined
error range
4 May be outside the defined
error range
Safety-related
error
Explanation Implications for the
safety-related
output signal
Implications for
measuring uncertainty
(position, see Fig. ä20)
I [mA]
B
C
A
t
1
2
4
3
3