Endress+Hauser Deltapilot S FMB70 Instructions for use

Products Solutions Services
Functional Safety Manual
Deltapilot S FMB70
Level and pressure measurement with
4-20 mA output signal
FY01053F/00/EN/01.21
71543541
2021-08-02
02.00.zz (Device firmware)

Deltapilot S FMB70
2 Endress+Hauser
Order code:
Ext. ord. cd.:
Ser. no.:
www.endress.com/deviceviewer Endress+Hauser
Operations App
XXXXXXXXXXXX
XXXXX-XXXXXX
XXX.XXXX.XX
Serial number
1.
3.
2.
A0023555

Deltapilot S FMB70 Table of contents
Endress+Hauser 3
Table of contents
1 Declaration of Conformity ........... 4
1.1 Safety-related characteristic values .......... 5
2 About this document ................ 6
2.1 Document function ..................... 6
2.2 Symbols used .......................... 6
2.2.1 Safety symbols .................. 6
2.2.2 Symbols for certain types of
information and graphics ........... 6
2.3 Supplementary device documentation ........ 7
2.3.1 Further applicable documents ....... 7
2.3.2 Technical Information (TI) ......... 7
2.3.3 Operating Instructions (BA) ......... 7
2.3.4 Brief Operating Instructions (KA) ..... 7
2.3.5 Certificate ...................... 7
3 Design ............................. 7
3.1 Permitted devices types .................. 7
3.1.1 Order codes ..................... 8
3.2 Identification marking ................... 8
3.3 Safety function ........................ 8
3.3.1 Safety-related output signal ......... 9
3.3.2 Redundant configuration of multiple
sensors ........................ 9
3.4 Basic conditions for use in safety-related
applications ........................... 9
3.4.1 Safety-related failures according to
IEC / EN 61508 ................. 10
3.4.2 Safety measured error ............ 10
3.4.3 Restrictions for safety-related
operation ..................... 11
3.5 Dangerous undetected failures in this
scenario ............................ 11
3.6 Useful lifetime of electric components ...... 11
4 Commissioning (installation and
configuration) .................... 11
4.1 Requirements for personnel .............. 11
4.2 Installation .......................... 12
4.3 Commissioning ....................... 12
4.4 Operation ........................... 12
4.5 Device configuration for safety-related
applications .......................... 12
4.5.1 Calibration of the measuring point ... 12
4.5.2 Configuration methods ........... 12
4.5.3 Locking/unlocking a SIL device ..... 24
4.6 Parameters and default settings for SIL
mode ............................... 25
4.6.1 "Increased security during parameter
entry" method .................. 25
4.6.2 "Standard device configuration"
method ....................... 25
4.6.3 Permitted parameter settings ...... 25
4.6.4 Check ........................ 26
5 Operation ......................... 27
5.1 Device behavior during power-up .......... 27
5.2 Behavior of device in the event of an alarm
and warnings ......................... 27
5.3 Alarm and warning messages ............. 27
5.3.1 List of alarm and warning messages .. 27
5.3.2 Device response in event of
overranging ................... 28
6 Proof testing ...................... 29
6.1 Test sequence A ....................... 29
6.2 Test sequence B ....................... 29
6.3 Verification criterion ................... 30
7 Repair and error handling .......... 30
7.1 Maintenance ......................... 30
7.2 Repair .............................. 30
7.3 Modification ......................... 31
7.4 Decommissioning ..................... 31
7.5 Disposal ............................ 31
8 Appendix ......................... 32
8.1 Structure of the measuring system ......... 32
8.1.1 System components .............. 32
8.1.2 Description of use as a protective
system ....................... 32
8.1.3 Installation conditions ............ 32
8.1.4 Measurement function ........... 32
8.2 Commissioning or proof test report ........ 33
8.2.1 Pressure device parameter
configuration form .............. 34
8.2.2 Level device parameter configuration
form ......................... 36
8.3 Parameter description .................. 38
8.3.1 Parameter description of the SAFETY
CONFIRM. group - "Pressure"
measuring mode ................ 38
8.4 Version history ....................... 41

Declaration of Conformity Deltapilot S FMB70
4 Endress+Hauser
1 Declaration of Conformity
A0046527

Deltapilot S FMB70 Declaration of Conformity
Endress+Hauser 5
1.1 Safety-related characteristic values
A0046528

About this document Deltapilot S FMB70
6 Endress+Hauser
2 About this document
2.1 Document function
This supplementary Safety Manual applies in addition to the Operating Instructions,
Technical Information and ATEX Safety Instructions. The supplementary device
documentation must be observed during installation, commissioning and operation. The
requirements specific for the protection function are described in this Safety Manual.
General information on functional safety (SIL) is available at:
•www.endress.com/SIL
• WP01032F, Whitepaper "Functional Safety in practice"
2.2 Symbols used
2.2.1 Safety symbols
DANGER
This symbol alerts you to a dangerous situation. Failure to avoid this situation will result in
serious or fatal injury.
WARNING
This symbol alerts you to a dangerous situation. Failure to avoid this situation can result in
serious or fatal injury.
CAUTION
This symbol alerts you to a dangerous situation. Failure to avoid this situation can result in
minor or medium injury.
NOTICE
This symbol contains information on procedures and other facts which do not result in
personal injury.
2.2.2 Symbols for certain types of information and graphics
Tip
Indicates additional information
Reference to documentation
Reference to graphic
Notice or individual step to be observed
1.
,
2.
,
3.
Series of steps
Result of a step
1, 2, 3, ...
Item numbers
A, B, C, ...
Views

Deltapilot S FMB70 Design
Endress+Hauser 7
2.3 Supplementary device documentation
For an overview of the scope of the associated Technical Documentation, refer to the
following:
•W@M Device Viewer (www.endress.com/deviceviewer): Enter the serial number
from the nameplate
•Endress+Hauser Operations App: Enter the serial number from the nameplate or
scan the matrix code on the nameplate
The following document types are available in the Downloads section of the
Endress+Hauser website (www.endress.com/downloads):
2.3.1 Further applicable documents
• TI00416P
• BA00332P
• KA00218P
• KA01020P
• BA00274P (Description of Device Functions)
2.3.2 Technical Information (TI)
Planning aid
The document contains all the technical data on the device and provides an overview of
the accessories and other products that can be ordered for the device.
2.3.3 Operating Instructions (BA)
Your reference guide
These Operating Instructions contain all the information that is required in various phases
of the life cycle of the device: from product identification, incoming acceptance and
storage, to mounting, connection, operation and commissioning through to
troubleshooting, maintenance and disposal.
2.3.4 Brief Operating Instructions (KA)
Guide that takes you quickly to the 1st measured value
The Brief Operating Instructions contain all the essential information from incoming
acceptance to initial commissioning.
2.3.5 Certificate
The associated certificate is available in the Endress+Hauser W@M Device Viewer or can
be found in the declaration of conformity of the applicable Functional Safety Manual. This
certificate must be valid at the time of delivery of the device.
3 Design
3.1 Permitted devices types
The details pertaining to functional safety in this manual relate to the device versions
listed below and are valid as of the specified firmware and hardware versions.
Unless otherwise specified, all subsequent versions can also be used for safety functions.

Design Deltapilot S FMB70
8 Endress+Hauser
A modification process according to IEC 61508 is applied for any device modifications.
Any exemptions from possible combinations of features are saved in the Endress
+Hauser ordering system.
Valid device versions for safety-related use:
3.1.1 Order codes
Deltapilot S FMB70
Feature: 010 "Approval"
Version: all
Feature: 020 "Output; Operation"
Version:
• A: 4-20mA HART; extern. + LCD
• B: 4-20mA HART; inside + LCD
• C: 4-20mA HART; inside
• D: 4-20mA HART; Li=0 extern. + LCD
• E: 4-20mA HART; Li=0 inside + LCD
• F: 4-20mA HART; Li=0 inside
Feature: 030 "Housing; Cover sealing; Cable entry"
Version: all
Feature: 040 "Sensor range; Sensor overload limit"
Version: all
Feature: 050 "Calibration; Unit"
Version: all
Feature: 060 "Membrane material; Seal"
Version: all
Feature: 070 "Process connection"
Version: all
Feature: 090 "Fill fluid"
Version: all
Feature: 100 "Additional option 1"
Version: E; SIL
Feature: 110 "Additional option 2"
Version: E; SIL
Valid firmware version: from 02.00.zz (→ nameplate of the device)
Valid hardware version (electronics): from 02.00.ww (→ device nameplate)
3.2 Identification marking
SIL-certified devices are marked with the SIL logo on the nameplate.
3.3 Safety function
The device's safety functions are:
• Minimum, maximum or range monitoring
• Gauge pressure measurement
The assessment of the functional safety of a device includes the basic unit with the
main electronics, sensor electronics and sensor up to the sensor diaphragm and the
process connection mounted directly on the device. The process adapter and
mounted/enclosed accessories were not taken into account in the rating.

Deltapilot S FMB70 Design
Endress+Hauser 9
3.3.1 Safety-related output signal
The device's safety-related signal is the 4 to 20 mA analog output signal as per NAMUR
NE43. All safety measures refer to this signal exclusively. The device additionally
communicates for information only via HART and contains all HART features with
additional device information. HART communication is not part of the safety function. The
behavior of the output current in the event of a fault depends on the settings for the
alarms and warnings. The safety-related output signal is fed to a downstream logic unit,
e.g. a programmable logic controller or a limit signal transmitter, where it is monitored to
determine whether:
• it exceeds and/or drops below a predefined limit value
• a fault has occurred, e.g. failure current (≤3.6 mA, ≥21.0 mA, signal cable open circuit or
short-circuit).
NOTICE
In an alarm condition
‣Ensure that the equipment under control achieves or maintains a safe state.
The following dangerous undetected failures can occur in the devices:
• An incorrect output signal that deviates from the real measured value by more than 1 %,
but is still in the 4 to 20 mA or 3.8 to 20.5 mA range
• A settling time that is delayed by more than the specified settling time plus tolerance
For fault monitoring, the logic unit must be able to detect both HI alarms (≥21 mA) and LO
alarms (≤3.6 mA).
The transmitter output is not safety-oriented during the following activities:
• Configuration changes
• Multidrop
• with SW version < 02.20 if the "Bus address (345)" parameter is set to ≠ "0".
• with SW version ≥ 02.20 if the "Current mode (052)" parameter is set to "Fixed" (local
display and FieldCare) or "Disabled" (HART handheld terminal).
• Simulation
• Proof testing
Alternative monitoring measures must be taken to ensure process safety during
configuration, proof-testing and maintenance work on the device.
3.3.2 Redundant configuration of multiple sensors
With redundant configuration with HFT = 1 (e.g. 1oo2 or 2oo3 architecture), the device
meets the requirements for SIL 3.
The common cause factors ß and ßD indicated in the table below are minimum values for
the device. These values should be used when calculating the failure probability of
redundantly connected devices according to IEC 61508-6. The plant-specific assessment
can return higher values depending on the particular installation and the use of other
components (e.g. Ex barrier).
Minimum value ß with homogeneous redundant use 5 %
Minimum value ßD with homogeneous redundant use 2 %
3.4 Basic conditions for use in safety-related applications
The measuring system must be used correctly for the specific application, taking into
account the medium properties and ambient conditions. Carefully follow instructions
pertaining to critical process situations and installation conditions from the Operating
Instructions. The application-specific limits must be observed. The specifications in the
Operating Instructions and the Technical Information must not be exceeded.

Design Deltapilot S FMB70
10 Endress+Hauser
3.4.1 Safety-related failures according to IEC / EN 61508
Safety-related error Explanation Implications for the
safety related output
signal
Implications for measuring uncertainty (see item number in
graphic below)
No device error Safe: SD
No error
None 1 Is within the specification (see TI, BA, ...)
λSSafe failure Causes the output signal to
signal the failsafe mode
3 No implications
λSSafe failure Is within the defined error
range
2 May be outside specifications
λDD Dangerous detected:
Dangerous failure which
can be detected
(diagnostic at the device)
Causes the output signal to
signal the failsafe mode
3 No implications
λDU Dangerous undetected:
Dangerous failure which
cannot be detected
May be outside the
defined error range
4 May be outside the defined error range
I [mA]
B
C
A
t
1
2
4
3
3
A0025264
A Hi-Alarm ≥ 21 mA
B Error range ± 1 %
C Lo-Alarm ≤ 3.6 mA
3.4.2 Safety measured error
The total deviations with regard to the safety-related current output are composed of:
• Measured errors under reference operating conditions: as per Technical Information
• Measured errors due to process/installation/ambient conditions: as per Technical
Information
• Measured errors due to ambient conditions (EMC): ±0.5 % based on the span of the
safety-related current output
Strong, pulse-like EMC interference on the power supply line can result in transient
(< 1 s) deviations in the output signal (≥ ±1 % based on the span of the safety related
current output). Therefore, filtering with a time constant ≥ 1 s should be performed in
the downstream logic unit.
• Measured errors due to random component failures (SIL error range): ±1 % based on the
span of the safety-related current output