Endress+Hauser FTL62 Series Instructions for use

Products Solutions Services
Functional Safety Manual
Liquiphant FTL62
with electronic insert FEL67
Vibronic
Using with FTL325P
FY01018F/00/EN/01.20
71491956
2020-09-28
Valid as of version
01.01.zz (Device firmware)
01.00.zz (Device hardware)

Liquiphant FTL62 with electronic insert FEL67
2 Endress+Hauser
Order code:
Ext. ord. cd.:
Ser. no.:
www.endress.com/deviceviewer Endress+Hauser
Operations App
XXXXXXXXXXXX
XXXXX-XXXXXX
XXX.XXXX.XX
Serial number
1.
3.
2.
A0023555

Liquiphant FTL62 with electronic insert FEL67 Table of contents
Endress+Hauser 3
Table of contents
1 Declaration of Conformity ...... 4
1.1 Safety-related characteristic values ..... 5
2 About this document ........... 6
2.1 Document function ................... 6
2.2 Symbols used ........................ 6
2.3 Supplementary device documentation ... 7
3 Design ........................... 8
3.1 Permitted device types ................ 8
3.2 Identification marking ................ 9
3.3 Safety function ...................... 9
3.4 Basic conditions for use in safety-
related applications .................. 9
3.5 Useful lifetime of electric components .. 12
4 Commissioning (installation
and configuration) ............ 12
4.1 Requirements for personnel .......... 12
4.2 Installation ........................ 13
4.3 Commissioning ..................... 13
4.4 Operation ..........................13
4.5 Parameter configuration for safety-
related applications ................. 13
5 Operation ...................... 15
5.1 Device behavior during power-up ...... 15
5.2 Device behavior in safety function
demand mode ...................... 15
5.3 Device behavior in the event of an
alarm ............................. 15
6 Proof testing ................... 15
6.1 Basic test sequence .................. 16
7 Repair and error handling .... 16
7.1 Maintenance ....................... 16
7.2 Repair ............................. 16
7.3 Modification ....................... 17
7.4 Decommissioning ................... 17
7.5 Disposal ........................... 17
7.6 Battery disposal .................... 18
8 Appendix ...................... 18
8.1 Structure of the measuring system ..... 18
8.2 Version history ..................... 20

Declaration of Conformity Liquiphant FTL62 with electronic insert FEL67
4 Endress+Hauser
1 Declaration of Conformity
SIL_00351_01.20
Declaration of Conformity
Functional Safety according to IEC 61508
Based on NE 130 Form B.1
Endress+Hauser SE+Co. KG, Hauptstraße 1, 79689 Maulburg
being the manufacturer, declares that the product
Liquiphant FTL62 with electronic insert FEL67
(with dedicated Nivotester only)
is suitable for the use in safety-instrumented systems according to IEC 61508. The instructions of the
corresponding functional safety manual must be followed.
This declaration of conformity is exclusively valid for the customer listed in the cover letter of the
respective Endress+Hauser sales center and for the listed products and accessories in delivery status.
Maulburg, 27-July-2020
Endress+Hauser SE+Co. KG
i. V.
Manfred Hammer
Dept. Man. Technology
Quality Management / FSM
Research & Development
A0042175

Liquiphant FTL62 with electronic insert FEL67 Declaration of Conformity
Endress+Hauser 5
1.1 Safety-related characteristic values
SIL_00351_01.20
General
Device designation and permissible types Liquiphant with electronic insert FEL67
FTL62–**A7*************+LA
Safety-related output signal For connection to dedicated Nivotester only
Fault signal
Process variable/function Level switch for liquids
Safety function(s) Overfill protection or operating maximum/minimum detection
Device type acc. to IEC 61508-2 Type A Type B
Operating mode Low Demand Mode High Demand Mode 1) Continuous Mode
Valid hardware version 01.00.ww (ww: any double number)
Valid soware version 01.01.zz (zz: any double number)
Safety manual FY01018F
Type of evalulation
(check only one box)
Complete HW/SW evaluation parallel to development incl.
FMEDA and change request acc. to IEC 61508-2, 3
Evaluation of “proven in use” performance for HW/SW incl. FMEDA
and change request acc. to IEC 61508-2, 3
Evaluation of HW/SW field data to verify „prior use” acc. to
IEC 61511
Evaluation by FMEDA acc. to IEC 61508-2 for devices w/o soware
Evaluation through – report/certificate no. TÜV Rheinland / 968/FSP 1388.02/20
Test documents Development documents Test reports Data sheets
SIL - Integrity
Systematic safety integrity SIL 2 capable SIL 3 capable
Hardware safety integrity Single channel use (HFT = 0)
SIL 2 capable SIL 3 capable
Multi channel use (HFT ³ 1)
SIL 2 capable SIL 3 capable
FMEDA
Safety function MIN MAX —
λDU 2),3) 28 FIT 13 FIT —
λDD 2),3) 140 FIT 106 FIT —
λSU 2),3) 133 FIT 149 FIT —
λSD 2),3) 5 FIT 41 FIT —
SFF 91% 96% —
PFDavg (T1 = 1 year) 3) (single channel architecture) 1.24 × 10-4 5.67× 10-5 —
PFH 3) 2.83 × 10-8 1/h 1.29 × 10-8 1/h —
PTC 4) Test sequence A 94% 94% —
Test sequence B 8% 17% —
λtotal 2),3) 307 FIT 308 FIT —
Diagnostic test interval 5) ≤ 60 s, except RAM check ≤ 10 min —
Fault reaction time 6) ≤ 3 s —
Comments
Nivotester works without soware.
Declaration
Our internal company quality management system ensures information on safety-related systematic faults which become evident
in the future
1) Maximum admissible 1 demand per week.
2) FIT = Failure In Time, number of failures per 109 h
3) Valid for average ambient temperature up to +40 °C (+104 °F)
For continuous operation at ambient temperature close to +60 °C (+140 °F), a factor of 1.5 should be applied
4) PTC = Proof Test Coverage
5) All diagnostic functions are performed at least once within the diagnostic test interval
6) Maximum time between error recognition and error response
A0042176

About this document Liquiphant FTL62 with electronic insert FEL67
6 Endress+Hauser
2 About this document
2.1 Document function
This supplementary Safety Manual applies in addition to the Operating Instructions, Technical
Information and ATEX Safety Instructions. The supplementary device documentation must be
observed during installation, commissioning and operation. The requirements specific to the
protection function are described in this Safety Manual.
General information on functional safety (SIL) is available at:
•www.endress.com/SIL
• CP01008Z, Brochure "Functional Safety – SIL, Safety Instrumented Systems in the
Process Industry"
2.2 Symbols used
2.2.1 Safety symbols
DANGER
This symbol alerts you to a dangerous situation. Failure to avoid this situation will result in
serious or fatal injury.
WARNING
This symbol alerts you to a dangerous situation. Failure to avoid this situation can result in
serious or fatal injury.
CAUTION
This symbol alerts you to a dangerous situation. Failure to avoid this situation can result in
minor or medium injury.
NOTICE
This symbol contains information on procedures and other facts which do not result in
personal injury.
2.2.2 Symbols for certain types of information and graphics
Tip
Indicates additional information
Reference to documentation
Reference to graphic
Notice or individual step to be observed
1.
,
2.
,
3.
Series of steps
Result of a step

Liquiphant FTL62 with electronic insert FEL67 About this document
Endress+Hauser 7
1, 2, 3, ...
Item numbers
A, B, C, ...
Views
-
Hazardous area
Indicates the hazardous area
.
Safe area (non-hazardous area)
Indicates the non-hazardous area
2.3 Supplementary device documentation
For an overview of the scope of the associated Technical Documentation, refer to the
following:
•W@M Device Viewer (www.endress.com/deviceviewer): Enter the serial number from
nameplate
•Endress+Hauser Operations App: Enter the serial number from the nameplate or scan
the 2D matrix code (QR code) on the nameplate
The following documentation types are available in the Downloads section of the
Endress+Hauser website (www.endress.com/downloads):
2.3.1 Further applicable documents
• TI01539F
• BA02036F
• KA01479F
• FY001006F, Functional Safety Manual, FTL325P
2.3.2 Technical Information (TI)
Planning aid
The document contains all the technical data on the device and provides an overview of the
accessories and other products that can be ordered for the device.
2.3.3 Brief Operating Instructions (KA)
Guide that takes you quickly to the 1st measured value
The Brief Operating Instructions contain all the essential information from incoming
acceptance to initial commissioning.
2.3.4 Operating Instructions (BA)
Your reference guide
These Operating Instructions contain all the information that is required in various phases of
the life cycle of the device: from product identification, incoming acceptance and storage, to
mounting, connection, operation and commissioning through to troubleshooting,
maintenance and disposal.

Design Liquiphant FTL62 with electronic insert FEL67
8 Endress+Hauser
2.3.5 Safety Instructions (XA)
Depending on the approval, the following Safety Instructions (XA) are supplied with the
device. They are an integral part of the Operating Instructions.
The nameplate indicates the Safety Instructions (XA) that are relevant to the device.
3 Design
3.1 Permitted device types
The details pertaining to functional safety in this manual relate to the device versions listed
below and are valid as of the specified firmware and hardware versions.
Unless otherwise specified, all subsequent versions can also be used for safety functions.
A modification process according to IEC 61508 is applied for device changes.
Valid device versions for safety-related use:
3.1.1 Order codes
FTL62-
Feature: 010 "Approval"
Version: all
Feature: 020 "Output"
Version: A7; FEL67, 2-wire PFM + test button
Feature: 030 "Display, operation"
Version: all
Feature: 040 "Housing; material"
Version: all
Feature: 050 "Electrical connection"
Version: all
Feature: 060 "Application"
Version: all
Feature: 080 "Surface finish"
Version: all
Feature: 085 "Probe design"
Version: all
Feature: 090 "Sensor length, material"
Version: all
Feature: 105 "Process connection, sealing surface"
Version: all

Liquiphant FTL62 with electronic insert FEL67 Design
Endress+Hauser 9
Feature: 110 "Process connection"
Version: all
Feature: 590 "Additional approval"
Version: LA
Advanced diagnostic measures are only implemented in this version. This version must be
selected for use as a safety function as per IEC 61508.
3.2 Identification marking
SIL-certified devices are marked with the SIL logo on the nameplate.
3.3 Safety function
The device's safety functions are:
• Maximum level monitoring (overfill prevention, MAX detection)
• Minimum level monitoring (dry running protection, MIN detection)
3.4 Basic conditions for use in safety-related applications
The measuring system must be used correctly for the specific application, taking into account
the medium properties and ambient conditions. Carefully follow instructions pertaining to
critical process situations and installation conditions from the Operating Instructions. The
application-specific limits must be observed. The specifications in the Operating Instructions
and the Technical Information must not be exceeded.
3.4.1 Density of the medium
Operation is only permitted with liquids:
• Depending on the configured density setting, the density of the liquid must be as follows:
• if the switch position is > 0.7 the density must be over 0.7 g/cm³ (common water- and
oil-based liquids).
• if the switch position is > 0.5 the density must be over 0.5 g/cm³ (e.g., liquefied gas,
isopentane, petroleum ether).
• The gas phase above the liquid may not exceed a maximum permitted density value. The
maximum possible gas density depends on the temperature and the device.

Design Liquiphant FTL62 with electronic insert FEL67
10 Endress+Hauser
1.000
0.100
0.010
ρ[g/cm³]
0.001
+300
+527
-60
-76
+60
+140
+120
+248
+180
+356
+240
+464
±0
+32
[°C]
T
[°F]
1
2
A0026840
 1 Density of gas phase above the medium
1 Switch position for density 0.7 g/cm³
2 Switch position for density 0.5 g/cm³
LCAUTION
Gas density is exceeded!
"Free" status is not detected and "Covered" is always signaled.
‣The gas density may not be exceeded.
• There is no minimum density for the gas phase.
Operation in a vacuum is permitted!
• There is no maximum density for the liquid.
• For more information on the levels of diagnostic coverage, refer to IEC 61508-2:2010
Appendix A.2, Comment 2 and Table A.1.
3.4.2 Buildup (only for MIN detection)
The device may only be used in media that do not tend to cause buildup. Buildup is considered
to be any deposits with a thickness of over 0.5 mm (0.02 in). Buildup can have the effect that

Liquiphant FTL62 with electronic insert FEL67 Design
Endress+Hauser 11
the demand mode of the safety function is not detected and the device will not switch as
intended.
Buildup from 0.5 mm (0.02 in) is detected with low diagnostic coverage.
3.4.3 Solid particles - heterogeneous mixtures (only for MIN detection)
The medium may not contain solid particles with a diameter greater than 5 mm (0.2 in). Solid
particles lodged between the tines of the tuning fork can have the effect that the demand
mode of the safety function is not detected and the device will not switch as intended.
Lodged solid particles are detected with low diagnostic coverage.
3.4.4 Wall distance
The distance between the tuning fork of the device and the wall of the vessel containing
medium (e.g. tank, pipe) must be at least 10 mm (0.39 in).
3.4.5 Corrosion
The device may only be used in media to which the wetted parts used are resistant. Corrosion
can have the effect that the demand mode of the safety function is not detected and the
device will not switch as intended.
Corrosion is detected with low diagnostic coverage.
When using coated sensors, make sure the sensor is not damaged during installation and
operation.
3.4.6 Abrasion
It is not permitted to use the device with abrasive media. The removal of material from the
sensor as a result of abrasion can result in sensor failure.
Abrasion is detected with low diagnostic coverage.
3.4.7 Flow velocity
In the case of flowing media, the flow velocity in the area around the tuning fork may not
exceed 5 m/s. Higher flow velocities can have the effect that the demand mode is not detected
and the sensor signals that it is free (uncovered).
3.4.8 External vibration
In systems exposed to strong external vibrations, e.g., in the 400 to 1 200 Hz range
(acceleration spectral density >1 (m/s²)²/Hz) or ultrasound with cavitation, the safety
function must be verified by simulating a demand mode prior to operation. Accidental
switchings may sporadically occur if a strong frequency from an external source is
superimposed on the frequency of the tuning fork.

Commissioning (installation and configuration) Liquiphant FTL62 with electronic insert FEL67
12 Endress+Hauser
3.4.9 EMC compatibility
The device is certified in accordance with IEC 61326-3-1 and is thus suitable for general
industrial, safety-related applications. If the specified electromagnetic ambient conditions are
exceeded, the switch status might not be reliably detected. An unshielded cable up to
1 000 m (3 281 ft) long can be used between the devices in these environmental conditions.
Electromagnetic interference immunity can be further improved by using shielded cables.
3.4.10 Mounting with sliding sleeve
Coated sensor
NOTICE
Mechanical damage to coating
Corrosion protection and adequate sealing are no longer guaranteed. Device could be
destroyed.
‣Coated sensors must not be mounted with a sliding sleeve.
Uncoated sensor
Particular care is required when mounting the device with a pipe extension (uncoated sensors)
in conjunction with a sliding sleeve. The operator must implement appropriate measures to
ensure that the switch point is not tampered with or that any tampering is reliably detected.
3.4.11 COM interface
When used as a safety function, there is the option of connecting an additional module to the
COM interface.
Bluetooth: BT module VU121
The module may be used for informational purposes only but not as part of the safety
function. It does not have a modifying effect on the safety function.
3.5 Useful lifetime of electric components
The established failure rates of electrical components apply within the useful lifetime as per
IEC 61508-2:2010 section 7.4.9.5 note 3.
According to DIN EN 61508-2:2011 section 7.4.9.5 (national footnote N3) appropriate
measures taken by the operator can extend the useful lifetime.
4 Commissioning (installation and configuration)
4.1 Requirements for personnel
The personnel for installation, commissioning, diagnostics and maintenance must fulfill the
following requirements:
‣Trained, qualified specialists must have a relevant qualification for this specific function
and task.
‣Personnel must be authorized by the plant owner/operator.
‣Be familiar with federal/national regulations.

Liquiphant FTL62 with electronic insert FEL67 Commissioning (installation and configuration)
Endress+Hauser 13
‣Before starting work: personnel must read and understand the instructions in the manual
and supplementary documentation as well as the certificates (depending on the
application).
‣Personnel must follow instructions and comply with general policies.
The operating personnel must fulfill the following requirements:
‣Personnel are instructed and authorized according to the requirements of the task by the
facility's owner-operator.
‣Personnel follow the instructions in this manual.
4.2 Installation
The mounting and wiring of the device and the permitted orientations are described in the
Operating Instructions pertaining to the device.
4.3 Commissioning
The device is commissioned using the Commissioning Wizard. The commissioning procedure
is described in the Operating Instructions pertaining to the device.
Prior to operating the device in a safety instrumented system, verification must be performed
by carrying out a test sequence as described in Section 6 Proof testing.
4.4 Operation
The operation of the device is described in the Operating Instructions pertaining to the device.
4.5 Parameter configuration for safety-related applications
The device settings may not be changed if SIL operation is in progress.
NOTICE
The protective function can be impaired
After commissioning the measuring system, changes to the settings can impact the protective
function
‣After changing the settings, perform a proof test to ensure that the safety function is
working correctly

Commissioning (installation and configuration) Liquiphant FTL62 with electronic insert FEL67
14 Endress+Hauser
4.5.1 MIN/MAX detection mode
+–
A
>0,5
COM
– +
MIN
MAX >0,7
1
21 2
!
>0,5
MIN
MAX >0,7
1
2
A0039188
 2 Selection of MIN/MAX detection mode
A Additional safety equipment
4.5.2 Density mode
U= 0 V
>0,5
COM
– +
MIN
MAX >0,7
1
21 2
!
AB
A0039189
 3 Selection of density mode
A Default setting (density >0.7 g/cm³); always use this setting where possible
B Special setting (density >0.5 g/cm³); extremely light liquids (e.g., liquefied natural gas, isopentane,
petroleum ether)

Liquiphant FTL62 with electronic insert FEL67 Operation
Endress+Hauser 15
5 Operation
5.1 Device behavior during power-up
The behavior of the device when switched on is described in the relevant Operating
Instructions.
5.2 Device behavior in safety function demand mode
The safety-related output signal is described in detail in the Functional Safety Manual
(FY01006F) for Nivotester FTL325P.
The Nivotester FTL325P always has switch contacts, they work with quiescent current safety;
they are closed when the status is OK.
5.3 Device behavior in the event of an alarm
The behavior of the device in the event of an alarm is described in the relevant Operating
Instructions.
6 Proof testing
The functional integrity of the device in the SIL mode must be verified during
commissioning, when changes are made to safety-related parameters, as well as at
appropriate time intervals. The operator must determine the time intervals.
LCAUTION
The safety function is not guaranteed during a proof test.
‣Suitable measures must be taken to guarantee process safety during the test.
When using the proof-test wizard in the SmartBlue app, the correct version must be
selected.
Version II to version VI are described in the Functional Safety Manual for the Nivotester
FTL325P.
Note the following for the test sequences:
• A demand mode or a fault takes absolute precedence over the proof test and in the
measuring system safety path. For this reason, the demand mode must first be ended
or the fault rectified before the proof test can commence.
• The proof test can and may only be performed if the device status is OK.
• The status of the individual output signal is indicated by a measuring device or a
downstream component of the safety path (e.g., PLC, actuator).
• The individual proof test coverages (PTC) that can be used for calculation are specified
in the Declaration of Conformity.
• To monitor the safety-related output signal, it is sufficient to evaluate the response of
downstream components of the safety function. If the different states are correctly
identified there, the test steps are passed.

Repair and error handling Liquiphant FTL62 with electronic insert FEL67
16 Endress+Hauser
6.1 Basic test sequence
1
2
3
1.1
2.1
3.1
1.2
2.2
3.2 3.3
A0039241
 4 Basic test sequence
1.1 Status OK
1.2 Output signal for status OK?
2.1 Establish demand mode
2.2 Output signal for demand mode?
3.1 Re-install the sensor that was removed (optional)
3.2 Establish status OK
3.3 Output signal for status OK?
The output signal can be evaluated based on the response of the following components
of the safety function.
7 Repair and error handling
7.1 Maintenance
Maintenance instructions and instructions regarding recalibration may be found in the
Operating Instructions pertaining to the device.
Alternative monitoring measures must be taken to ensure process safety during
configuration, proof-testing and maintenance work on the device.
7.2 Repair
Repair means restoring functional integrity by replacing defective components.

Liquiphant FTL62 with electronic insert FEL67 Repair and error handling
Endress+Hauser 17
Components may be repaired/replaced by the customer's technical staff if genuine spare
parts from Endress+Hauser are used (they can be ordered by the end user) and the
appropriate installation instructions are followed.
A proof test must always be performed after every repair
Spare parts are grouped into logical kits with the associated replacement instructions.
Document the repair with the following information:
• Serial number of the device
• Date of the repair
• Type of repair
• Person who performed the repair
Installation Instructions are supplied with the orginal spare part and can also be accessed
in the Download Area at www.endress.com
Return the replaced component to Endress+Hauser for fault analysis.
When returning the defective component, always enclose the "Declaration of Hazardous
Material and Decontamination" with the note "Used as SIL device in a safety
instrumented system.
For information on device returns, please see:
http://www.endress.com/support/return-material
7.3 Modification
Modifications are changes to SIL devices that are already delivered or installed.
• Modifications to SIL devices are usually performed in the Endress+Hauser manufacturing
center.
• Modifications to SIL devices onsite at the user's plant are possible following approval by the
Endress+Hauser manufacturing center.
In this case, the modifications must be performed and documented by an Endress+Hauser
service technician.
•Modifications to SIL devices by the user are not permitted.
7.4 Decommissioning
When decommissioning, the requirements according to IEC 61508-1:2010 section 7.17 must
be observed.
7.5 Disposal
If required by the Directive 2012/19/EU on waste electrical and electronic equipment
(WEEE), the product is marked with the depicted symbol in order to minimize the disposal
of WEEE as unsorted municipal waste. Do not dispose of products bearing this marking as
unsorted municipal waste. Instead, return them to Endress+Hauser for disposal under the
applicable conditions.

Appendix Liquiphant FTL62 with electronic insert FEL67
18 Endress+Hauser
7.6 Battery disposal
• In some countries, the end user is legally obliged to return used batteries.
• The end user can return old batteries or electronic assemblies containing these batteries
free of charge to Endress+Hauser.
In accordance with German law regulating the use of batteries (BattG §17 Para Number 3),
this symbol is used to denote electronic assemblies that must not be disposed of as municipal
waste.
8 Appendix
8.1 Structure of the measuring system
8.1.1 System components
The measuring system's devices are shown in the following diagram (example).
12
A0043457
 5 System components
1 Measuring device/sensor
2 Nivotester for PFM signal 50/150 Hz, 1- or 3-channel with SIL certification
8.1.2 Description of application as a safety instrumented system
The sensor's tuning fork vibrates at its intrinsic frequency. The vibration frequency decreases
as the density increases. This change in the frequency causes the current signal to change.
The switch point is in the range of the tuning fork and depends on the installation position.

Liquiphant FTL62 with electronic insert FEL67 Appendix
Endress+Hauser 19
~13 (0.5)
D
A
~12.5 (0.49)
C
D
~6 (0.24)
B
D
A0042269
 6 Switch point depending on the installation position. Unit of measurement mm (in)
A Installation from above
B1 Installation from below, plastic-coated tuning fork
B2 Installation from below, enamel-coated tuning fork
C Installation from the side
D Switch point
For information on the switch point under reference operating conditions, see the
Technical Information.
Correct installation is a prerequisite for safe operation of the device.
8.1.3 Measurement function
Choice of operating modes:
• MIN detection
The measuring system is used to protect against a level that is too low (e.g., pump dry
running protection, protection against emptying or protection against insufficient filling).
In normal operation, the tuning fork is covered by liquid and the measuring system reports
the OK status. If the tuning fork is free, the device assumes the safe state and signals the
demand mode.
• MAX detection
The measuring system is used to protect against a level that is too high (e.g., overfill
prevention).
In normal operation, the tuning fork is not covered by liquid and the measuring system
reports the OK status. If the tuning fork is covered, the device assumes the safe state and
signals the demand mode.
8.1.4 Versions
The components Liquiphant FTL62 with electronic insert FEL67 and Nivotester FTL325P may
be operated in the versions described in the Functional Safety Manual for the Nivotester
FTL325P (FY01006F).
Version I, without the Nivotester, may not be used as a safety function in accordance with IEC
61508.

Appendix Liquiphant FTL62 with electronic insert FEL67
20 Endress+Hauser
8.2 Version history
FY01018F
• Version: 01.20
• Valid as of firmware version:
01.01.zz
• Valid as of hardware version:
01.00.zz
• Changes:
First version