Endress+Hauser Gammapilot M FMG60 Instructions for use

SD00230F/00/EN/13.11
71133117
Functional safety manual
Gammapilot M FMG60
Radiometric measurement technology
Maximum point level detection
Application
Overfill protection or maximum point level detection of
all types of liquids and bulk solids in tanks, to satisfy the
particular requirements for safety-related systems as per
IEC 61508.
The measuring device meets the following requirements
• Functional safety in accordance with IEC 61508
• Explosion protection (depending on version)
• Electromagnetic compatibility as per EN 61326 and
NAMUR recommendation NE 21
• Electrical safety in accordance with IEC/EN 61010-1
Your benefits
• For overfill protection up to SIL 3
– independently assessed (Functional Safety
Assessment) by TÜV Rheinland in according
to IEC 61508
• Permanent self-monitoring
• Safe parameterization concept
• Mode of operation "Low demand mode" and
"High demand mode"

Gammapilot M
2Endress+Hauser
Table of contents
SIL Declaration of Conformity . . . . . . . . . . . . . . . . . . . 3
General information . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Structure of measuring system with
Gammapilot M FMG60 . . . . . . . . . . . . . . . . . . . . . . . . 4
Level limit detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Valid device types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Applicable device documentation . . . . . . . . . . . . . . . . . . . . . . . . . 6
Description of safety requirements and
boundary conditions . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Safety function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Restrictions for use in safety-related applications . . . . . . . . . . . . . 8
Functional safety parameters (SIL 2) . . . . . . . . . . . . . . . . . . . . . . . 9
Behavior of device when in operation and in case of failure . . . . 10
Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Calibrating the measuring point . . . . . . . . . . . . . . . . . . . . . . . . . 14
Maintenance, recalibration . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Proof-test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Proof-test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Repair . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Repair . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Appendix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Notes on the redundant connection of multiple sensors for SIL 3 . 19
Calibration Record. . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Gammapilot M
Endress+Hauser 3
SIL Declaration of Conformity
This binding document is included in the scope of supply when the Gammapilot M is ordered with the
"SIL Declaration of conformity" option.
SIL_07001d_en
Example

Gammapilot M
4Endress+Hauser
General information
!Note!
General information about functional safety (SIL) is available at www.endress.com/SIL and in the
competence brochure CP00002Z "Functional safety in the Process Industry - risk reduction with Safety
Instrumented Systems".
Structure of measuring system with Gammapilot M FMG60
Level limit measuring system
The following diagram shows an example of the measuring system in use.
SD230xx01
Point level detection The measuring system consists of a sensor and a gamma radiation source.
Point level detection takes place when a guided gamma ray is interrupted or attenuated by the medium which
is being monitored and this interruption or attenuation is detected.
Typical measurement setup:
SD230en02
In the transmitter (Gammapilot M), an analog signal (4 to 20 mA) proportional to the level is generated.
This signal is sent to a logic unit located downstream from the transmitter (e.g. PLC, limit signal transmitter)
and is monitored there to ensure it does not exceed a maximum value.
An individual gamma radiation source is recommended for each point level detection. The path of the beam
should be adapted to the dimension of the measuring length used.
When using multiple detectors with 1oo2 or 2oo3 votings, the height of the detector arrangement with regard
to the switch point must also be taken into account.
Gammapilot MGammapilot M
Gammapilot MGammapilot M
Gamma
radiation
source
Gamma
radiation
source
Useful beam Useful beam
interrupted
Medium
Tank
Medium
Tank
Signal
“full”
Signal
“empty”

Gammapilot M
Endress+Hauser 5
Valid device types The information in this manual pertaining to functional safety applies to the device versions listed below and
is valid from the stated software and hardware versions.
Unless otherwise indicated, all subsequent versions can also be used for safety functions. Device versions valid
for use in safety-related applications:
Valid software version: 01.02.00 and 01.02.02
Valid hardware version (electronics): from 30.04.2007
In the event of device modifications, a modification process compliant with IEC 61508 is applied.
FMG60 -
abcdefghk
Designation Version
aCertificates all
b Power supply all
c Wiring all
d Output 1 (4 to 20 mA HART)
e Scintillator / measuring range G, H, J, K (200 mm and 400 mm PVT)
f Material all
g Cable entry power supply all
h Cable entry output all
k Additional option B (SIL 2/SIL 3 IEC 61508 declaration of conformity, level limit)

Gammapilot M
6Endress+Hauser
Applicable device
documentation Documentation Contents Note
Technical Information
TI00363F/00/EN
(Gammapilot M FMG60)
– Technical data
– Information on accessories
Operating Instructions
BA00236F/00/EN
(Gammapilot M FMG60)
– Identification
–Mounting
– Wiring
– Operation
– Commissioning
– Maintenance
–Accessories
– Troubleshooting
– Technical data
– Appendix: Diagram of menus
Operating Instructions
BA00287F/00/EN
(Gammapilot M FMG60)
Description of device functions
– Description of operating concept
– Description of device functions
This document can be found in the form
of a PDF file on the DVD "FieldCare DS
Package".
KA00202F/00/EN
(separate operating and
display unit FHX40)
–Usage
–Mounting
– Commissioning
Use of the separate display/operating unit
is optional.
KA00253F/00/EN
(Mounting device FHG60
for Gammapilot M FMG60)
– Usage and application guidelines To ensure safe, mechanical attachment,
the mounting device FHG60 is
recommended for safety-related
applications. Alternative, equivalent
devices are used at the operator's risk.
Safety information depending
on the type of certificate chosen
– Safety, mounting and operating
instructions for devices suitable
for use in hazardous areas or as
overflow protection (WHG).
For certified device versions, additional
safety information (XA, XB, XC, ZE, ZD) is
provided.
The nameplate indicates which safety
information applies to your device version.
• Technical Information
TI00423F/00/EN
• Operating Instructions
BA00373F/00/EN
(Modulator FHG65)
– Technical data
–Mounting,wiring
– Commissioning
Use of modulator FHG65 in conjunction
with the Gammapilot M for the
suppression of interference radiation
("modulated mode")
• Technical Information
TI00435F/00/EN (FQG61/FQG62)
• Operating Instructions
BA00223F/00/EN (QG2000)
• Technical Information
TI00445F/00/EN (FQG60)
– Technical data
–Mounting
– Commissioning
– Operation
Which source container should be used
depends on the isotope and the activity of
the emitter.

Gammapilot M
Endress+Hauser 7
Description of safety requirements and boundary
conditions
Safety function The safety function of the measuring system is maximum point level detection (overfill protection).
The radiometric measuring system does not come into contact with the medium.
!Note!
To activate the safety functions, the Gammapilot M must be locked directly after calibration (see Section
"Method for device parameterization" →ä15).
Safety-related signal:
The safety-related signal of the Gammapilot M is the analog output signal 4 to 20 mA.
All safety measures are based exclusively on this output.
In addition, the Gammapilot M communicates non safety-related informations via HART and contains all
HART characteristics with additional device information.
The Gammapilot M generates an analog signal (4 to 20 mA) proportional to the pulse rate. This signal is sent
to a logic unit located downstream, e.g. a programmable logic controller or a limit signal transmitter, and
monitored there to establish if:
• a predefined level limit is exceeded
• an error occurs (e.g. error current in accordance with NE 43 (≤3.6 mA, ≥21 mA, interruption or short-
circuiting of signal line).
In addition to the analog signal path for the output current, the Gammapilot M has a redundant, internal, digital
signal path. Both paths are monitored permanently by the Gammapilot M. This results in the following behavior
of the output current:
SD230en05
•Electronic partial stroke test (analog signal path test):
This is a cyclical life test of the analog signal path. For this test, the output current is increased by 10 % of
the measuring range (1.6 mA) up to a maximum of 20 mA every 2 minutes for 15 seconds.
Safe point level detection is not affected by the hysteresis that has to be configured in the PLC
(see "Configuration of switch point and hysteresis" →ä17).
This signal path can be used to permanently monitor and detect the correct safety-related configuration and
correct functioning of the Gammapilot M.
•Digital signal path test:
This is a cyclical life test of the digital signal path. For this test, the output current is set to a value
< 3.6 mA (typically 2.4 mA) every 2 minutes for 250 ms. The evaluation unit located downstream must be
configured in such a way that this test is not interpreted as a signal on alarm.
According to NE 43 §7, for example, a signal on alarm is not to be recognized as such unless it lasts at least
4seconds.
15 s
250 ms
+1,6 mA
Electronic partial stroke test
(analog signal path test)
Digital signal path test
Analog signal 4...20 mA
Time t
Current
< 3.6 mA
(typically
2.4 mA)

Gammapilot M
8Endress+Hauser
Restrictions for use in
safety-related applications
Application, mounting, installation
• The use of the Gammapilot M is permitted only for maximum point level detection with a PVT scintillator
of length 200 mm and 400 mm.
• For permitted mounting positions, see "Orientation" →ä13.
• Sustained or temporary vibrations and shocks may influence the measuring signal and should therefore be
avoided if possible. This can, for example, be done by mounting the Gammapilot M in such a way that it is
decoupled from the source of vibration.
• In order to ensure interference freeness, series connection is not permitted in HART multidrop mode.
• In the case of pressurized tanks, the effect of the pressure on the safety function must be considered
separately. Pressurized gas phases may affect the absorption of radiation due to the change in their density.
• Strong magnetic fields in proximity to the Gammapilot M may result in a reduction in the pulse rate.
If necessary, protective measures must be taken.
• The mechanical attachment of the Gammapilot M and the source containers must be designed in such a way
that the devices are prevented at all times from moving or shifting.
Calibration, adjustment
• The change of the pulse rate between covered and free depends on the absorption of the radiation by the
content of the vessel. The absorption is determined on the basis of the number of half-value layers of the
content. The less the absorption the higher the pulse rate has to be at empty calibration.
The following table defines the minimum pulse rate values for empty calibration in conjunction with the
number of absorbing half-value layers.
• The pulse rate value at empty calibration must not fall below the values given in the table. When setting up
the radiation source, the decay of the gamma radiation source during the service life must be taken into
account.
Operating conditions, radiation sources
• To ensure the reliability of decay compensation, only 137Cs and 60Co radiation sources, which do not contain
any foreign isotopes with longer or shorter half-lives, may be used.
• Measurements of self-emitting media are permitted only in modulated mode (using modulator FHG65).
Operating conditions, detector
• The Gammapilot M may only be used in "stand-alone" mode or in "level limit" mode. The interconnection
of several detectors in a cascade is not permitted.
Number of half-value layers Minimum pulse rate at empty calibration
>3 500 cps
>2 to ≤3 1000 cps
≥1 to ≤2 1500 cps
For information:
• Half-life 60Co: approx. 5.3 years
• Half-life 137Cs: approx. 30 years
Example:
• Number of half-value layers: 3.2; i. e. minimum pulse rate at empty calibration: 500 cps
• Empty calibration: 1500 cps
• Half-life 60Co: approx. 5.3 years
• Permitted service life: 8.3 years
• Background radiation must not exceed 8,000 cps.
• The maximum pulse rate for empty calibration must not exceed 60,000 cps.
• The pulse rate for full calibration must always be lower than the pulse rate for empty calibration.
•Permitted service life = – ln
0.7 Empty calibration (cps)
Half-life Minimum pulse rate at empty calibration (cps)

Gammapilot M
Endress+Hauser 9
Functional safety parameters
(SIL 2)
The table shows the specific functional safety parameters for single-channel device operation *3:
SD230en07
Proof-test interval
Parameters according to IEC 61508 Value
Safety function Maximum point level detection
SIL Hardware: 2 Software: 3
HFT 0
Device type B
Mode of operation Low demand mode, High demand mode
SFF 96 %
MTTR 8 h
T1Proof-test interval; see chart
λsd 577 FIT
λsu 655 FIT*6/ 94 FIT*5
λdd 1316 FIT
λdu 92 FIT
λtot *13303 FIT
PFDavg for T1= 1 year *24.04 × 10-4
PFDavg for T1= 5 years *22.02 × 10-3
PFH *29.2 × 10-8 1/h
MTBF *135 years
Diagnostic test interval 15 min
Fault reaction time *46 s
*1According to Siemens SN29500.
*2Where the average temperature when in continuous use is in the region of 50 °C, a factor of 1.3 should be taken into
account.
*3For multichannel device operation, see the "Appendix" →ä19.
*4Fault reaction time: Time between detection of an internal fault and setting of error current (≤ 3.6 mA or ≥ 21 mA)
*5In accordance with IEC 61508 Ed.2
*6In accordance with IEC 61508 Ed.1
PFD
avg
2,5E-03
2,0E-03
1,5E-03
1,0E-03
5,0E-04
0,0E+00
012 345
Maximum point level detection
1oo1D
Proof-test interval (years)

Gammapilot M
10 Endress+Hauser
Dangerous undetected failures in this scenario:
A dangerous, undetected failure is defined as an incorrect output signal which deviates from the real measured
value by more than 10 %, with the output signal remaining within the range of 4 to 20 mA.
Diagnostic test interval:
The internal diagnostic test interval of the Gammapilot M is 15 minutes. During this time, all internal safety
functions are executed at least once.
Useful lifetime of electrical components:
The established failure rates of electrical components apply within the useful lifetime as per IEC 61508-2.
section 7.4.9.5 note 3.
!Note!
In accordance with DIN EN 61508-2, Note NA4, appropriate measures taken by the manufacturer and
operator can extend the useful lifetime.
!Note!
Correct installation is key to the safe operation of the Gammapilot M.
Behavior of device when in
operation and in case of failure
Behavior of device when switched on
Once it has been switched on, every Gammapilot M goes through a diagnosis phase lasting maximum
120 seconds.
During this time, the current output is at error current ≤3.6 mA.
During the diagnosis phase, communication via the display interface or via HART is not possible.
Once the diagnosis phase has been successfully completed, an uncalibrated device sets the current output to
error current ≥21 mA and retains this value until calibration has been completed.
Once calibration has been successfully completed, the device switches to measuring mode (current output:
4 to 20 mA).
If an internal device error is detected during the diagnosis phase, the current output remains at error current
≤3.6 mA.
If an internal device error is detected during calibration, the current output remains at error current ≥21 mA.
Once the diagnosis phase has been successfully completed, an already calibrated device switches to
measuring mode (current output: 4 to 20 mA). Otherwise, it remains at error current ≤3.6 mA.
!Note!
• If a calibrated Gammapilot M is cut off from its power supply, the internal clock is buffered for at least 6 days.
After this time, it may be necessary to reenter the current date and time. This is indicated by error current
≥21 mA and error message A635.
To enter the date and time, the device must be unlocked and then locked again (see Operating Instructions
BA00236F/00/EN Appendix "Operating menu for point level detection").
• To activate the safety functions, the Gammapilot M must be locked directly after calibration (see "Method
for device parameterization" →ä15).
Behavior of device on demand
Once the maximum level is reached, the radiation is absorbed by the medium in the tank. The output current
is set to 20 mA. The rise time corresponds to the configured output damping τ (1 to 999 s; default value 6 s)
plus the device-internal dead time. The device-internal dead time is dependent on the configuration of the
"Beam type" function.
"Caution!
Please also note the Section "Output damping" in the Operating Instructions BA00236F/00/EN.
Setting Menu selection "Basic setup", Function "Beam type" Device-internal dead time
Standard 1 s
Modulated 4 s