Endress+Hauser Deltapilot S FMB70 Instructions for use

SD213P/00/en/04.08
71073465
Functional Safety Manual
Deltapilot S
FMB70
Level and Pressure Measurement
with Output Signal 4...20 mA
Application
Use for process pressure measurement in aggressive and
non-aggressive gases, vapours and liquids or level
measurement in systems that have to meet the particular
requirements for safety-related systems in accordance
with IEC 61508.
The measuring device fulfills the requirements
concerning:
• Functional safety in accordance with IEC 61508
• Explosion protection (depending on version)
• Electromagnetic compatibility in accordance with
EN 61326 and NAMUR recommendation NE 21
• Electrical safety in accordance with IEC/EN 61010-1
Your benefits
•Usefor
– level monitoring
– pressure monitoring
up to SIL 3, independently assessed (Functional Safety
Assessment) by TÜV Süd in accordance with
IEC 61508
• Continuous measurement
• Easy commissioning
• Permanent self-monitoring
• Safe parameterization concept

Deltapilot S
2Endress+Hauser
Table of contents
SIL Declaration of Conformity . . . . . . . . . . . . . . . . . . . 3
General information . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Measuring system design. . . . . . . . . . . . . . . . . . . . . . . 4
Permitted device types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Further applicable device documentation . . . . . . . . . . . . . . . . . . . 5
Description of safety requirements
and boundary conditions . . . . . . . . . . . . . . . . . . . . . . . 6
Safety function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Restrictions for use in safety-related applications . . . . . . . . . . . . . . 7
Functional safety parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Operating life of electrical components . . . . . . . . . . . . . . . . . . . . . 8
Behavior of device when in operation and in case of failure . . . . . . 8
Alarm response and current output . . . . . . . . . . . . . . . . . . . . . . . 8
Total performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Settling time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Maximum reaction time of alarms and warnings . . . . . . . . . . . . . 9
Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Device configuration . . . . . . . . . . . . . . . . . . . . . . . . . 10
Methods for device configuration. . . . . . . . . . . . . . . . . . . . . . . . . 10
Conditions for safe measuring mode - device configuration
with increased security during parameter entry . . . . . . . . . . . . . . 12
Increased security during parameter entry via on-site display
or handheld terminal 375 Field Communicator . . . . . . . . . . . . . 16
Increased security during parameter entry via operating tool . . . . 18
Parameter description of the SAFETY CONFIRM group –
"Pressure" operating mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Parameter description of the SAFETY CONFIRM group –
"Level" operating mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Standard device configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Checks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Locking/Unlocking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Proof-test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Proof-test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Repair . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Repair . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Appendix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Notes on the redundant connection of multiple sensors
for SIL 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Management summary . . . . . . . . . . . . . . . . . . . . . . . 30
Certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Form for standard device configuration -
Pressure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Form for standard device configuration -
Level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Deltapilot S
Endress+Hauser 3
SIL Declaration of Conformity
The binding document forms part of the scope of delivery when the Deltapilot S is ordered with the
"SIL 2/SIL 3 IEC 61508 Declaration of Conformity" option.
P01-xMD7xxxx-01-xx-xx-xx-006
Example

Deltapilot S
4Endress+Hauser
General information
!Note!
General information on functional safety (SIL) is available at:
www.de.endress.com/SIL (German) or www.endress.com/SIL (English) and in the Competence Brochure
CP002Z "Functional Safety in the Process Industry - Risk Reduction with Safety Instrumented Systems".
Measuring system design
Permitted device types The functional safety assessment described in this manual applies to the device versions listed below and is valid
from the stated software and hardware versions.
Unless otherwise indicated, all subsequent versions can also be used for safety functions. Device versions valid
for use in safety-related applications:
Valid software version: 02.10 and higher
Valid hardware version (electronics): 02.00 and higher
In the event of device modifications, a modification process compliant with IEC 61508 is applied.
The following controls are permitted for devices without an on-site display that are to be used in process control
protection equipment:
– DTM for Deltapilot S with software version 02.10,
e.g. can be operated with the Endress+Hauser FieldCare operating program
– Handheld terminal 375 Field Communicator.
An operating program forms part of the scope of delivery for devices with the "HistoROM/M-DAT" option
(version N in feature 100 "Additional option 1" or version N in feature 110 "Additional option 2" in the order
code).
#Warning!
The functional safety assessment of the devices includes the basic unit with the main electronics, sensor
electronics and sensor up to the sensor membrane and the process connection mounted directly.
FMB70 -
Options Designation Version
010 Approval all
020 Output; Operating A, B, C
030 Housing; Cable Entry all
040 Sensor Range; Sensor Overload Limit all
050 Calibration; Unit all
060 Membrane Material; Seal all
070 Process Connection all
090 Fill Fluid all
100 Additional Option 1 E (SIL, IEC 61508 Declaration of Conformity)
or
110 Additional Option 2 E (SIL, IEC 61508 Declaration of Conformity)

Deltapilot S
Endress+Hauser 5
Further applicable device
documentation Documentation Contents Note
Brief Operating Instructions
KA1020P
– Installation
– Wiring
– Operation
– Commissioning
– The documentation is provided with the
device.
Technical Information
TI416P
– Technical data – The documentation is provided on the
documentation CD enclosed.
– The documentation is also available via
the Internet at
→www.de.endress.com.
Operating Instructions
BA332P
– Identification
– Mounting
– Wiring
– Operation
– Commissioning, description of the Quick
Setup menu
– Maintenance
– Troubleshooting incl. spare parts
– Appendix: diagram of menus
– The documentation is provided on the
documentation CD enclosed.
– The documentation is also available via
the Internet at
→www.de.endress.com.
Operating Instructions
BA274P
(Description of Device
Functions)
– Configuration examples for pressure, level
and flow measurement
– Parameter description
– Troubleshooting
– Appendix: diagram of menus
– The documentation is provided on the
documentation CD enclosed.
– The documentation is also available via
the Internet at
→www.de.endress.com.
Compact Instructions
KA218P
– Wiring
– Operation without a display
– Description of the Quick Setup menu
–HistoROM
®/M-DAT operation
– The documentation is provided with the
device.
→Connection compartment cover.
Safety Instructions,
Control Drawings or
certificates
– Safety, mounting and operating
instructions for devices suitable for use in
hazardous areas or as overfill protection
(German Water Resources Act).
– Select the desired explosion protection or
approval by means of feature 10
"Approval" in the order code.
The corresponding documentation is
provided with the device.

Deltapilot S
6Endress+Hauser
Description of safety requirements
and boundary conditions
Safety function
SD213en02
Operating and configuration possibilities of the Deltapilot S
Safety-related signal
The safety-related signal of the Deltapilot S is the analog output signal 4...20 mA. All safety functions solely
refer to this output. In addition, the Deltapilot S communicates via HART and contains all HART characteristics
with additional diagnostics information.
Deltapilot S generates an analog signal (≥3.8...≤20.5 mA) that is proportional to the pressure. This signal is
sent to a logic unit located downstream, e.g. a programmable logic controller or a limit signal transmitter, and
monitored there to establish if:
– A specified value for the "Pressure" or
"Level" operating modes has been overshot or undershot ("Level Easy Pressure")
– A range to be monitored for the "Pressure" or "Level" operating modes has been violated ("Level Easy
Pressure")
– A fault has occurred (e.g. sensor error, sensor cable disconnection or short-circuit, supply voltage failure).
The following dangerous undetected failures can occur in the devices:
– An incorrect output signal which deviates from the real measured value by more than 1%, with the output
signal remaining within the 4...20 mA range.
– A settling time that is delayed by more than the specified settling time plus tolerance.
– Other deviations from specified safety-related properties.
For fault monitoring, the logic unit must be able to detect HI alarms (≥21 mA) and LO alarms (≤3.6 mA).
The transmitter output is not safety-oriented during the following activities:
– Changes to the configuration
– Multidrop
– Simulation
– Proof-test
While configuring the transmitter and performing maintenance work on Deltapilot S, alternative measures
must be taken to ensure the process safety.
4…20 mA
Commubox
FXA191/
FXA195
1
#% &
Copy
GH I
PQ R S
,( ) ‘
AB C
Paste
Page
On
Page
Up
DeleteBksp
Insert
JK L
TU V
_< >
DE F
HotKey
+Hot Key
MN O
WX Y Z
+* /
4
7
.
2
5
8
0
375
FIELD COMMUNICATOR
3
6
9
-
96
DELTABAR:** * * * * * *
ONLINE
1 QUICK SETUP
2 OPERATING MENU
4 SV 0°C
3 PV 352mbar
HELP SAVE
dsdmdm
dfdas.
asdasfa
asasla.
Logic unit
e.g. PLC,
limit signal generator
etc.
Computer with operating program
FieldCare as of version 2.02
Actuator
Deltapilot S
with display module (optional)
and local operation
Handheld terminal
375 Field Communicator

Deltapilot S
Endress+Hauser 7
Restrictions for use in safety-
related applications
– Device warmup time: after device warmup, the safety functions are available after a 30-second initialization
period.
– In the case of local operation of the Deltapilot S FMB70 without a display and without an operating tool or
without a HART communicator, the device cannot be safely configured because the user cannot perform a
visual check. In both these situations, communication via HART alone is not sufficient.
– The device must be locked following configuration.
– When using the device as a subsystem of a safety function, the "Hold meas. value" setting may not be selected
as this option does not provide failsafe alarming.
– During commissioning, a complete function test of the safety-related functions must be performed.
– The maximum interval for recurrent testing (Proof Test Interval) is 5 years.
– Faulty devices must be replaced as soon as possible to minimize the possibility of multiple errors occurring.
The failure probabilities indicated in this Safety Manual are based on a medium time to repair (MTTR) of
8hours.
Functional safety parameters The table shows the specific functional safety parameters.
Parameters according to IEC 61508 Value
Safety functions MIN, MAX, Range
SIL (Hardware) 2 (single-channel),
3 (with use of a SIL 3 capable coincidence logic)
SIL (Software) 3
Device type B
Mode of operation Low demand mode
Safety functions MIN, MAX, Range
λsd 0 FIT
λsu 332 FIT
λdd 463 FIT
λdu 53 FIT
λtot *11058 FIT
MTBF *1108 years
SFF 93.7 %
PFDavg for T1= 1 year (single-channel) *22.32 × 10-4
T1(Proof-test interval) →graphic
Diagnostic test interval *35 min (RAM, ROM, ...), 1 s (Measurement)
Fault reaction time *45 min (RAM, ROM, …), 10 s (Measurement)
Settling time *5→Technical Information TI416P, "Dead time, time constant (T63)" section
*1According to Siemens SN29500. This value takes into account all failure types (→"Management summary" →ä30).
*2Where the average temperature when in continuous use is in the region of 50 °C, a factor of 1.3 should be taken into
account. For further information →"Management summary" →ä30.
* 3 During this time, all diagnostic functions are executed at least once.
*4Time between fault detection and fault reaction.
*5Step response time as per DIN EN 61298-2.

Deltapilot S
8Endress+Hauser
SD213en03
Proof -test interval
Operating life of electrical
components
The underlying failure rates of electrical components apply within the usable operating life in accordance with
IEC 61508-2 Section 7.4.7.4 Note 3.
!Note!
Correct installation is essential to the safe operation of the Deltapilot S.
Behavior of device when in
operation and in case of failure
The behavior during operation and in case of failure is described in Operating Instructions BA332P.
Alarm response and current
output
Increased security during parameter entry
When using this configuration method, the Deltapilot S outputs a permanently configured error current
≥22 mA when the safety function is triggered or in the event of device errors.
!Note!
If you selected the "On" option for the ACK. ALARM MODE parameter and an alarm occurs, proceed as
follows:
– Rectify the cause of the alarm.
– Unlock the Deltapilot S via the SAFETY LOCK and SAFETY PASSWORD parameters.
– Acknowledge the alarm via the ACK. ALARM parameter.
– Select the "Lock" option for the SAFETY LOCK parameter.
– Enter the password for the SAFETY PASSWORD parameter.
– Confirm the values and option selected for the parameters queried.
– Lock the Deltapilot S via the password.
Standard device configuration
Configure the current output for an alarm condition via the parameters OUTPUT FAIL MODE (default value:
max. alarm) and SET MAX. ALARM (default value: 22 mA). These parameters can be set to the following
values:
#Warning!
When using the Deltapilot S as a subsystem of a safety function, the "Hold meas. value" setting may not be
selected as this option does not provide failsafe alarming.
!Note!
Please also refer to →ä26, "Standard device configuration" section.
012345678910
0
1x10
–3
2x10
–3
3x10
–3
PFD
avg
1oo1D
Proof-test interval (years)
OUTPUT FAIL MODE *1Current value in the event of a fault
Min. alarm (LO alarm) 3.6 mA
Max. alarm (HI alarm) Can be set via SET MAX. ALARM *1= 22 mA
*1Menu path: (GROUP SELECTION →) OPERATING MENU →OUTPUT

Deltapilot S
Endress+Hauser 9
!Note!
The following applies to both configuration methods "Increased security during parameter entry" and "Standard
device configuration":
– During device configuration, the selected current value in the event of a fault cannot be guaranteed for all
possible fault situations (e.g. cable open circuit). However, failure reaction in accordance with NE 43
(≤3.6 mA or ≥21 mA) is always ensured.
– The current value can be (independent of the selected current value) between 22 and 25 mA when the
integrated diagnostics and monitoring measures are triggered.
– In cases such as power failure or circuit break, output currents can be (independent of the selected current
value) ≤3.6 mA.
– After an error or a fault has been removed, the 4...20 mA output signal can be considered to be safe after
20 seconds.
– For the maximum reaction time of alarms and warnings →ä9.
Total performance "Total performance" comprises non-linearity including hysteresis and non-repeatability, the thermal change of
the zero point:
±1 % of the URL (upper range limit)
The information applies to a temperature range from –10...+60 °C (+14...+140°F).
Settling time The settling time is calculated according to the following formula:
tsettling time = t1+ (t2+ configured damping time) x 5
For t1(dead time) and t2(T63) →Technical Information TI416P, "Dead time, time constant (T63)" section.
The factory setting for the damping time is 2 seconds, but can be configured between 0 and 999 seconds.
In accordance with IEC 61298-2, the settling time is the time the output signal needs to reach its steady-state
value at 1% of the output span and remain within this range.
Maximum reaction time of
alarms and warnings
The reaction times of alarms and warnings are listed in the following table. In the event of an alarm (device
faults), the device outputs an error current, →ä8, "Alarm response and current output" section.
Installation Mounting, wiring and commissioning
The mounting, wiring and commissioning of the Deltapilot S is described in Operating Instructions BA332P.
Code *1Message type *2
(current output)
Maximum reaction
time
Diagnostic test
interval
113, 704, 705, 728, 729, 736 und 737 Alarm 5 min 5 min
703 und 739 Alarm 10 s 1 s
738, 131, 132, 133, 110, 121, 747 Alarm Only during
initialization
101, 115 *3, 120 *3, 122, 130, 703, 704, 707,
711, 713, 715 *3, 716, 717 *3, 718 *3, 719,
720 *3, 721, 722, 723, 725, 726 *3, 727 *3,
741, 742, 743, 744, 748
Alarm Immediately
102, 106, 116, 602, 604, 613, 700, 701, 702,
706, 710, 730 *4, 731 *4, 732 *4, 733 *4,
740 *4, 745, 746, 620 *3
Warning
(device continues
to measure)
Immediately
*1→Operating Instructions BA332P, Section 8.1 "Messages".
*2→Operating Instructions BA332P, Section 8.2 "Response of the outputs to error".
*3These messages are "Error"-type messages and are automatically set to "Alarm" when using the "Increased security
during parameter entry" method. These messages have to be set to "Alarm" manually when using the "Standard
device configuration" method. →ä26, "Standard device configuration" section.
*4These messages are "Error"-type messages and are set to "Warning" at the factory. These messages are not set to
"Alarm" when using the "Increased security during parameter entry" method.

Deltapilot S
10 Endress+Hauser
Device configuration
Methods for device
configuration
When using the devices in process control protection equipment, the device configuration must meet two
requirements:
1. Confirmation concept:
proven independent checking of the safety-related parameters input
2. Locking concept:
device locked after configuration (required in accordance with IEC 61511-1 §11.6.4 and NE 79 §3)
The following methods for device configuration are available:
1. Standard device configuration
2. Increased security during parameter entry
!Note!
Due to the increased configuration safety, the use of the "Increased security during parameter entry"
method is recommended when using the device in process control protection functions.
Procedure for "Standard device configuration"
Point ➀:
"Standard device configuration" section,
→ä26, and for the "Level" operating
mode, "Level Easy Pressure" level
selection, also observe the permitted
parameter settings, →ä12 ff.
Point ➁:
Observe the prescribed parameters in
accordance with the form, →ä34
("Pressure" operating mode) and
→ä35 ("Level" operating mode,
"Level Easy Pressure" level selection).
SD213en04
Standard device
(manual parameter confirmation and locking)
configuration
Read out the prescribed
parameters and compare
them to the protocol.
Is the configuration
identical to the
protocol?
Lock the device for safe
measuring mode via software
and/or hardware.
Perform a reset
(code "7864")
The correct display of the
characters and digits is checked
via the DIGITS SET parameter.
yes
no
Configure the device
(see Operating Instructions
BA332P and BA274P)
and make a protocol of the
.settings manually
Read out the
CONFIG RECORDER
parameter and document it.
2
2
1