Endress+Hauser Gammapilot M FMG60 Instructions for use

SD00230F/00/EN/13.11
71133117
Functional safety manual
Gammapilot M FMG60
Radiometric measurement technology
Maximum point level detection
Application
Overfill protection or maximum point level detection of
all types of liquids and bulk solids in tanks, to satisfy the
particular requirements for safety-related systems as per
IEC 61508.
The measuring device meets the following requirements
• Functional safety in accordance with IEC 61508
• Explosion protection (depending on version)
• Electromagnetic compatibility as per EN 61326 and
NAMUR recommendation NE 21
• Electrical safety in accordance with IEC/EN 61010-1
Your benefits
• For overfill protection up to SIL 3
– independently assessed (Functional Safety
Assessment) by TÜV Rheinland in according
to IEC 61508
• Permanent self-monitoring
• Safe parameterization concept
• Mode of operation "Low demand mode" and
"High demand mode"

Gammapilot M
2Endress+Hauser
Table of contents
SIL Declaration of Conformity . . . . . . . . . . . . . . . . . . . 3
General information . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Structure of measuring system with
Gammapilot M FMG60 . . . . . . . . . . . . . . . . . . . . . . . . 4
Level limit detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Valid device types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Applicable device documentation . . . . . . . . . . . . . . . . . . . . . . . . . 6
Description of safety requirements and
boundary conditions . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Safety function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Restrictions for use in safety-related applications . . . . . . . . . . . . . 8
Functional safety parameters (SIL 2) . . . . . . . . . . . . . . . . . . . . . . . 9
Behavior of device when in operation and in case of failure . . . . 10
Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Calibrating the measuring point . . . . . . . . . . . . . . . . . . . . . . . . . 14
Maintenance, recalibration . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Proof-test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Proof-test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Repair . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Repair . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Appendix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Notes on the redundant connection of multiple sensors for SIL 3 . 19
Calibration Record. . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Gammapilot M
Endress+Hauser 3
SIL Declaration of Conformity
This binding document is included in the scope of supply when the Gammapilot M is ordered with the
"SIL Declaration of conformity" option.
SIL_07001d_en
Example

Gammapilot M
4Endress+Hauser
General information
!Note!
General information about functional safety (SIL) is available at www.endress.com/SIL and in the
competence brochure CP00002Z "Functional safety in the Process Industry - risk reduction with Safety
Instrumented Systems".
Structure of measuring system with Gammapilot M FMG60
Level limit measuring system
The following diagram shows an example of the measuring system in use.
SD230xx01
Point level detection The measuring system consists of a sensor and a gamma radiation source.
Point level detection takes place when a guided gamma ray is interrupted or attenuated by the medium which
is being monitored and this interruption or attenuation is detected.
Typical measurement setup:
SD230en02
In the transmitter (Gammapilot M), an analog signal (4 to 20 mA) proportional to the level is generated.
This signal is sent to a logic unit located downstream from the transmitter (e.g. PLC, limit signal transmitter)
and is monitored there to ensure it does not exceed a maximum value.
An individual gamma radiation source is recommended for each point level detection. The path of the beam
should be adapted to the dimension of the measuring length used.
When using multiple detectors with 1oo2 or 2oo3 votings, the height of the detector arrangement with regard
to the switch point must also be taken into account.
Gammapilot MGammapilot M
Gammapilot MGammapilot M
Gamma
radiation
source
Gamma
radiation
source
Useful beam Useful beam
interrupted
Medium
Tank
Medium
Tank
Signal
“full”
Signal
“empty”

Gammapilot M
Endress+Hauser 5
Valid device types The information in this manual pertaining to functional safety applies to the device versions listed below and
is valid from the stated software and hardware versions.
Unless otherwise indicated, all subsequent versions can also be used for safety functions. Device versions valid
for use in safety-related applications:
Valid software version: 01.02.00 and 01.02.02
Valid hardware version (electronics): from 30.04.2007
In the event of device modifications, a modification process compliant with IEC 61508 is applied.
FMG60 -
abcdefghk
Designation Version
aCertificates all
b Power supply all
c Wiring all
d Output 1 (4 to 20 mA HART)
e Scintillator / measuring range G, H, J, K (200 mm and 400 mm PVT)
f Material all
g Cable entry power supply all
h Cable entry output all
k Additional option B (SIL 2/SIL 3 IEC 61508 declaration of conformity, level limit)

Gammapilot M
6Endress+Hauser
Applicable device
documentation Documentation Contents Note
Technical Information
TI00363F/00/EN
(Gammapilot M FMG60)
– Technical data
– Information on accessories
Operating Instructions
BA00236F/00/EN
(Gammapilot M FMG60)
– Identification
–Mounting
– Wiring
– Operation
– Commissioning
– Maintenance
–Accessories
– Troubleshooting
– Technical data
– Appendix: Diagram of menus
Operating Instructions
BA00287F/00/EN
(Gammapilot M FMG60)
Description of device functions
– Description of operating concept
– Description of device functions
This document can be found in the form
of a PDF file on the DVD "FieldCare DS
Package".
KA00202F/00/EN
(separate operating and
display unit FHX40)
–Usage
–Mounting
– Commissioning
Use of the separate display/operating unit
is optional.
KA00253F/00/EN
(Mounting device FHG60
for Gammapilot M FMG60)
– Usage and application guidelines To ensure safe, mechanical attachment,
the mounting device FHG60 is
recommended for safety-related
applications. Alternative, equivalent
devices are used at the operator's risk.
Safety information depending
on the type of certificate chosen
– Safety, mounting and operating
instructions for devices suitable
for use in hazardous areas or as
overflow protection (WHG).
For certified device versions, additional
safety information (XA, XB, XC, ZE, ZD) is
provided.
The nameplate indicates which safety
information applies to your device version.
• Technical Information
TI00423F/00/EN
• Operating Instructions
BA00373F/00/EN
(Modulator FHG65)
– Technical data
–Mounting,wiring
– Commissioning
Use of modulator FHG65 in conjunction
with the Gammapilot M for the
suppression of interference radiation
("modulated mode")
• Technical Information
TI00435F/00/EN (FQG61/FQG62)
• Operating Instructions
BA00223F/00/EN (QG2000)
• Technical Information
TI00445F/00/EN (FQG60)
– Technical data
–Mounting
– Commissioning
– Operation
Which source container should be used
depends on the isotope and the activity of
the emitter.

Gammapilot M
Endress+Hauser 7
Description of safety requirements and boundary
conditions
Safety function The safety function of the measuring system is maximum point level detection (overfill protection).
The radiometric measuring system does not come into contact with the medium.
!Note!
To activate the safety functions, the Gammapilot M must be locked directly after calibration (see Section
"Method for device parameterization" →ä15).
Safety-related signal:
The safety-related signal of the Gammapilot M is the analog output signal 4 to 20 mA.
All safety measures are based exclusively on this output.
In addition, the Gammapilot M communicates non safety-related informations via HART and contains all
HART characteristics with additional device information.
The Gammapilot M generates an analog signal (4 to 20 mA) proportional to the pulse rate. This signal is sent
to a logic unit located downstream, e.g. a programmable logic controller or a limit signal transmitter, and
monitored there to establish if:
• a predefined level limit is exceeded
• an error occurs (e.g. error current in accordance with NE 43 (≤3.6 mA, ≥21 mA, interruption or short-
circuiting of signal line).
In addition to the analog signal path for the output current, the Gammapilot M has a redundant, internal, digital
signal path. Both paths are monitored permanently by the Gammapilot M. This results in the following behavior
of the output current:
SD230en05
•Electronic partial stroke test (analog signal path test):
This is a cyclical life test of the analog signal path. For this test, the output current is increased by 10 % of
the measuring range (1.6 mA) up to a maximum of 20 mA every 2 minutes for 15 seconds.
Safe point level detection is not affected by the hysteresis that has to be configured in the PLC
(see "Configuration of switch point and hysteresis" →ä17).
This signal path can be used to permanently monitor and detect the correct safety-related configuration and
correct functioning of the Gammapilot M.
•Digital signal path test:
This is a cyclical life test of the digital signal path. For this test, the output current is set to a value
< 3.6 mA (typically 2.4 mA) every 2 minutes for 250 ms. The evaluation unit located downstream must be
configured in such a way that this test is not interpreted as a signal on alarm.
According to NE 43 §7, for example, a signal on alarm is not to be recognized as such unless it lasts at least
4seconds.
15 s
250 ms
+1,6 mA
Electronic partial stroke test
(analog signal path test)
Digital signal path test
Analog signal 4...20 mA
Time t
Current
< 3.6 mA
(typically
2.4 mA)

Gammapilot M
8Endress+Hauser
Restrictions for use in
safety-related applications
Application, mounting, installation
• The use of the Gammapilot M is permitted only for maximum point level detection with a PVT scintillator
of length 200 mm and 400 mm.
• For permitted mounting positions, see "Orientation" →ä13.
• Sustained or temporary vibrations and shocks may influence the measuring signal and should therefore be
avoided if possible. This can, for example, be done by mounting the Gammapilot M in such a way that it is
decoupled from the source of vibration.
• In order to ensure interference freeness, series connection is not permitted in HART multidrop mode.
• In the case of pressurized tanks, the effect of the pressure on the safety function must be considered
separately. Pressurized gas phases may affect the absorption of radiation due to the change in their density.
• Strong magnetic fields in proximity to the Gammapilot M may result in a reduction in the pulse rate.
If necessary, protective measures must be taken.
• The mechanical attachment of the Gammapilot M and the source containers must be designed in such a way
that the devices are prevented at all times from moving or shifting.
Calibration, adjustment
• The change of the pulse rate between covered and free depends on the absorption of the radiation by the
content of the vessel. The absorption is determined on the basis of the number of half-value layers of the
content. The less the absorption the higher the pulse rate has to be at empty calibration.
The following table defines the minimum pulse rate values for empty calibration in conjunction with the
number of absorbing half-value layers.
• The pulse rate value at empty calibration must not fall below the values given in the table. When setting up
the radiation source, the decay of the gamma radiation source during the service life must be taken into
account.
Operating conditions, radiation sources
• To ensure the reliability of decay compensation, only 137Cs and 60Co radiation sources, which do not contain
any foreign isotopes with longer or shorter half-lives, may be used.
• Measurements of self-emitting media are permitted only in modulated mode (using modulator FHG65).
Operating conditions, detector
• The Gammapilot M may only be used in "stand-alone" mode or in "level limit" mode. The interconnection
of several detectors in a cascade is not permitted.
Number of half-value layers Minimum pulse rate at empty calibration
>3 500 cps
>2 to ≤3 1000 cps
≥1 to ≤2 1500 cps
For information:
• Half-life 60Co: approx. 5.3 years
• Half-life 137Cs: approx. 30 years
Example:
• Number of half-value layers: 3.2; i. e. minimum pulse rate at empty calibration: 500 cps
• Empty calibration: 1500 cps
• Half-life 60Co: approx. 5.3 years
• Permitted service life: 8.3 years
• Background radiation must not exceed 8,000 cps.
• The maximum pulse rate for empty calibration must not exceed 60,000 cps.
• The pulse rate for full calibration must always be lower than the pulse rate for empty calibration.
•Permitted service life = – ln
0.7 Empty calibration (cps)
Half-life Minimum pulse rate at empty calibration (cps)

Gammapilot M
Endress+Hauser 9
Functional safety parameters
(SIL 2)
The table shows the specific functional safety parameters for single-channel device operation *3:
SD230en07
Proof-test interval
Parameters according to IEC 61508 Value
Safety function Maximum point level detection
SIL Hardware: 2 Software: 3
HFT 0
Device type B
Mode of operation Low demand mode, High demand mode
SFF 96 %
MTTR 8 h
T1Proof-test interval; see chart
λsd 577 FIT
λsu 655 FIT*6/ 94 FIT*5
λdd 1316 FIT
λdu 92 FIT
λtot *13303 FIT
PFDavg for T1= 1 year *24.04 × 10-4
PFDavg for T1= 5 years *22.02 × 10-3
PFH *29.2 × 10-8 1/h
MTBF *135 years
Diagnostic test interval 15 min
Fault reaction time *46 s
*1According to Siemens SN29500.
*2Where the average temperature when in continuous use is in the region of 50 °C, a factor of 1.3 should be taken into
account.
*3For multichannel device operation, see the "Appendix" →ä19.
*4Fault reaction time: Time between detection of an internal fault and setting of error current (≤ 3.6 mA or ≥ 21 mA)
*5In accordance with IEC 61508 Ed.2
*6In accordance with IEC 61508 Ed.1
PFD
avg
2,5E-03
2,0E-03
1,5E-03
1,0E-03
5,0E-04
0,0E+00
012 345
Maximum point level detection
1oo1D
Proof-test interval (years)

Gammapilot M
10 Endress+Hauser
Dangerous undetected failures in this scenario:
A dangerous, undetected failure is defined as an incorrect output signal which deviates from the real measured
value by more than 10 %, with the output signal remaining within the range of 4 to 20 mA.
Diagnostic test interval:
The internal diagnostic test interval of the Gammapilot M is 15 minutes. During this time, all internal safety
functions are executed at least once.
Useful lifetime of electrical components:
The established failure rates of electrical components apply within the useful lifetime as per IEC 61508-2.
section 7.4.9.5 note 3.
!Note!
In accordance with DIN EN 61508-2, Note NA4, appropriate measures taken by the manufacturer and
operator can extend the useful lifetime.
!Note!
Correct installation is key to the safe operation of the Gammapilot M.
Behavior of device when in
operation and in case of failure
Behavior of device when switched on
Once it has been switched on, every Gammapilot M goes through a diagnosis phase lasting maximum
120 seconds.
During this time, the current output is at error current ≤3.6 mA.
During the diagnosis phase, communication via the display interface or via HART is not possible.
Once the diagnosis phase has been successfully completed, an uncalibrated device sets the current output to
error current ≥21 mA and retains this value until calibration has been completed.
Once calibration has been successfully completed, the device switches to measuring mode (current output:
4 to 20 mA).
If an internal device error is detected during the diagnosis phase, the current output remains at error current
≤3.6 mA.
If an internal device error is detected during calibration, the current output remains at error current ≥21 mA.
Once the diagnosis phase has been successfully completed, an already calibrated device switches to
measuring mode (current output: 4 to 20 mA). Otherwise, it remains at error current ≤3.6 mA.
!Note!
• If a calibrated Gammapilot M is cut off from its power supply, the internal clock is buffered for at least 6 days.
After this time, it may be necessary to reenter the current date and time. This is indicated by error current
≥21 mA and error message A635.
To enter the date and time, the device must be unlocked and then locked again (see Operating Instructions
BA00236F/00/EN Appendix "Operating menu for point level detection").
• To activate the safety functions, the Gammapilot M must be locked directly after calibration (see "Method
for device parameterization" →ä15).
Behavior of device on demand
Once the maximum level is reached, the radiation is absorbed by the medium in the tank. The output current
is set to 20 mA. The rise time corresponds to the configured output damping τ (1 to 999 s; default value 6 s)
plus the device-internal dead time. The device-internal dead time is dependent on the configuration of the
"Beam type" function.
"Caution!
Please also note the Section "Output damping" in the Operating Instructions BA00236F/00/EN.
Setting Menu selection "Basic setup", Function "Beam type" Device-internal dead time
Standard 1 s
Modulated 4 s

Gammapilot M
Endress+Hauser 11
Behavior of device in the event of alarms and warnings
Error current
The output current in the event of an alarm is fixed at a value ≥21 mA.
In some cases output currents ≤3.6 mA may occur (e.g. if the power supply fails or a line breaks or if there is
an error in the current output itself and the error current ≥21 mA can not be set).
For alarm monitoring, the logic unit must therefore be able to detect HI alarms (≥21 mA) and LO alarms
(≤3.6 mA).
Alarm and warning messages
The alarm and warning messages, which are output as error codes, provide additional information. The
following table shows the correlation between the error code and the current output:
Behavior of device in the event of interference radiation
The Gammapilot M provides two methods for dealing with interference radiation caused by non-destructive
material testing for example.
Detection of interference radiation (gammagraphy)
When the Gammapilot M is used in safety-related applications, the pulse rate is monitored to ensure that it
stays within the calibrated range. If the pulse rate is greater than the calibration value for "free" or less than the
calibration value for "covered", the current output switches to 3.8 mA for the duration of the configured hold
time of maximum 999 s.
"Caution!
An overfill can not be detected during this time.
If the pulse rate is still outside the calibrated range when the hold time elapses, the Gammapilot M switches
to alarm condtion until the pulse rate is again inside the calibrated range between full and empty calibration.
"Caution!
If x-ray tests are carried out within the sytem or in its immediate vicinity, or if any other sources of interference
are present, alternative measures must be taken to maintain safety during the hold time.
Error code *1Current output (message type) Note
Axxx ≥ 21 mA or ≤ 3.6 mA (alarm) xxx = three-digit number
Wxxx corresponding to measuring mode xxx = three-digit number
A692 ≥ 21 mA (alarm) Gammagraphy detected (alarm)
W693 3.8 mA ± 0.05 mA (warning) Gammagraphy detected (warning)
W640 ≤3.6 mA (SIL lock device W640) Locking sequence in operation
*1The error codes are listed in the Operating Instructions BA00236F/00/EN, Section "Error codes".

Gammapilot M
12 Endress+Hauser
Suppression of interference radiation using the Gamma-Modulator FHG65
The Gammapilot M can suppress interference radiation when used in conjunction with the Gamma-modulator
FHG65. The useful radiation is switched on and off periodically by the modulator using a fixed frequency.
The Gammapilot M can filter this alternating portion out of the total radiation as a measured value. This does
not entail any interruption to measurement or point level detection as in the case of basic gammagraphy
detection.
The following diagram shows, for example, a comparison between pulse rates with and without the
suppression of interference radiation.
SD230en08
Measuring signal of Gammapilot M in the event of interference radiation, for example
This function suppresses all sources of interference radiation, regardless of the source of useful radiation in use,
up to a local dose rate of approx. 50 μSv/h at the Gammapilot M (depending on detector length and the source
of interference involved).
Higher local dose rates can lead to a reduction in the detected pulse rate due to the statistical superposition of
pulses. This means that, for example, non-destructive material testing using gamma sources in the direct
vicinity of the Gammapilot M may lead to an overflow signal. Therefore, in these cases too, the Gammapilot M
is guaranteed to behave in a fail-safe manner.
!Note!
• The failure of the modulator (e.g. due to power failure) in this mode of operation, results in the Gammapilot
M having a higher output current (max. 20.5 mA) and is therefore fail-safe.
• In this operating mode of the Gammapilot M, modulator failure during the calibration of the measuring point
may cause the error message A692 "Gammagraphy detected" in the subsequent measuring mode.
35000
30000
25000
20000
15000
10000
0
5000
0
90 180 270 360 450
Time [s]
Behavior in the event of interference radiation
Pulse rate [cps]
without suppression of interference radiation
with suppression of interference radiation

Gammapilot M
Endress+Hauser 13
Installation Mounting, wiring and commissioning
The mounting, wiring and commissioning of the Gammapilot M is described in the Operating Instructions
BA00236F/00/EN.
!Note!
• When the device is being used in safety-related applications, the "Cascade in", "Cascade out" and "PT100"
terminals must not be wired (for terminal assignment, see Operating Instructions BA00236F/00/EN,
Section "Terminal assignment").
• To ensure system safety, it is recommended that safety-related and non-safety-related devices and functions
be kept strictly separate.
Orientation
Permitted orientations:
• Horizontal and at right angles to the direction of radiation (recommended due to higher sensitivity)
• Horizontal with frontal irradiation
The Gammapilot M must be positioned in the radiation path in such a way that the scintillator is completely
irradiated. The position and length of the scintillator is indicated by markings on the housing pipe.
It is permitted to use a water cooling jacket or additional coverings on the detector as protection from the sun
or weather. As additional coverings can affect the measuring signal due to backscatter, the measuring point
must not be calibrated until installation is complete.
The water cooling jacket must be filled completely during calibration. The flow values and limit temperature
values listed for water cooling in the Operating Instructions must be observed.
If several radiometric measuring points are in use, pay attention to the orientation of the sources and the
arrangement of the detectors to ensure that they do not interfere with each other.
Notes on the redundant use of multiple detectors
This section provides additional information on the use of multiple detectors in 1oo2 or 2oo3 votings for safety-
related point level detection:
• Only one radiation source may be used per measuring point.
• The following parameters must be configured identically when using multiple detectors:
Isotope, beam type, gammagraphy hold time, output damping, current date.
For background calibration as well as full and empty calibration, the same requirements that apply for single-
channel arrangement apply for each detector.
Installation with 1oo2 voting and detectors arranged one above the other:
SD230xx09
!Note!
The position of the upper detector determines the most unfavorable switch point.
X
X

Gammapilot M
14 Endress+Hauser
Installation with 1oo2 voting and detectors arranged horizontally beside one other:
SD230en10
!Note!
• Due to the limited beam path geometry, this detector arrangement can be advantageous for small container
diameters.
• The Gammapilot M close to the tank (detector A) partially screens the Gammapilot M facing away from the
tank (detector B). This must be taken into consideration when planning the activity of the source.
The following table provides approximate information on the absorption:
Where necessary, the absorption can be partially compensated if 200 mm is used as the measuring length for
detector A and 400 mm for detector B.
Installation with 2oo3 voting in preferred arrangement:
SD230xx11
!Note!
The position of the upper detector determines the most unfavorable switch point.
Operation
!Note!
The term calibration, which is often used in the context of radiometric measuring systems, refers to the
calibration process of the measuring point installed in the system. The measuring point comprises a detector, a
radiation source and, if necessary, a modulator.
Calibrating the measuring
point
Once the basic settings (mode of operation, measurement method, date, type of radiation, source of radiation,
output damping) have been made, the actual calibration is performed. To ensure that the Gammapilot M can
compensate correctly for background radiation, the background calibration must always be performed first.
This is followed by empty and full calibration, in no particular order.
!Note!
Once calibration has been completed, the Gammapilot M is operational and can be used in non-safety-related
applications.
For use in safety-related applications, the device must be locked in order to activate the safety functions
(see "Method for device parameterization" →ä15).
X
X
Detector A
Detector B
Percentage pulse rate available at detector B
Source Detector without water cooling Detector with water cooling
137Cs approx. 60 % approx. 36 %
60Co approx. 70 % approx. 48 %
X
X

Gammapilot M
Endress+Hauser 15
Method for device parameterization
The device can be operated using the display FHX40, HART Communicator DXR375 or FieldCare©.
To configure the operating parameters and to operate the Gammapilot M, please proceed in accordance with
the Operating Instructions BA00236F/00/EN and the description of the device functions for point level
detection BA00287F/00/EN.
During calibration, a log must be kept to document the configuration values (see "Appendix" →ä19).
"Caution!
Following calibration, the Gammapilot M must be locked in order to activate the safety functions.
The Gammapilot M may be operated in safety-related applications only when it is in locked mode.
Locking procedure:
"Caution!
If one of the parameters displayed does not correspond to the values logged during calibration, or if the
character string (step 4) is not displayed correctly, this parameter must be registered as not valid.
The Gammapilot M then automatically cancels the locking procedure. The status of the Gammapilot M is then
"unlocked".
Calibration can then be repeated.
If this is not successful, the device must not be used for safety-related applications.
Step Description Parameter
displayed
1 For this, please select the function "Safety locking (S22)" in the function group "Safety
settings (S2)".
Once the selection has been confirmed, an output current of ≤3 mA is output immediately.
2 Enter individual 4-digit password.
3 Confirmation of output current ≤ 3.0 mA. Verification of output current using measurement [Iout ≤ 3 mA]
4 The following character string appears
This character string is used to test the transmission of data to the operator device.
If the display is not correct, there is an error in the Gammapilot M or in the operator device.
Compare calibration values and configuration values with the calibration log and confirm
individually:
5 Background pulse rate [Backg: _ _ _ cps]
6 "Covered" calibration point
"Free" calibration point
[Covered: _ _ _ cps]
[Free: _ _ _ cps]
7 Isotope (137Cs or 60Co)
Beam type (standard or modulated)
[Source: _ _ _ ]
[Beam: _ _ _ ]
8 Time response (default value 10 s if "modulated" beam type was selected)
Output damping
[GammaHld: _ _ _ s]
[Integr.: _ _ _ s]
9 Current date
Calibration date
[Pres.: _ _ _ ]
[Calib: _ _ _ ]
10 Detector length (measurement length in mm) [ _ _ _ mm]
11 Once the calibration values have been checked, the password must be confirmed once again
to complete the safety-related locking procedure.
Once it has been successfully locked, the device switches to measuring mode after a
diagnosis phase.
[ _ _ _ _ ]
12 A test must then be carried out to verify whether the Gammapilot M is actually locked.
This is done by monitoring the output current. Following an interval of approx. 2 minutes,
the current increases by approx. 1.6 mA for 15 seconds (see also Chapter
"Safety function" Section "Electronic partial stroke test"). This signal change indicates
that the Gammapilot M is locked.
If there is no signal change, there was an error in the transmission of data for the
confirmation. In this case, the operator device should be replaced and the locking procedure
repeated.
0123456789 . -

Gammapilot M
16 Endress+Hauser
Behavior of current output during locking sequence:
At the start of the locking sequence, the detector outputs the error current ≤ 3.0 mA and remains at this value
until the sequence has been run through completely and the safety-related locking procedure has been
completed by confirming the password.
The output current value must be measured during the locking procedure and confirmed in the operating
menu. The current must be measured with a accuracy of ± 0.1 mA.
Following the correct locking procedure, the Gammapilot M executes all internal diagnosis tests. During this
time, (max. 60 s), the current output is at error current ≤3.6 mA.
Following completion of the diagnosis phase, the present current value (4 to 20 mA) is available at the output.
If a device error is detected during diagnosis, the current signal remains in a fault state ≤3.6 mA.
!Note!
• The lock is not cancelled if the power supply is switched off or if it fails.
• After it is locked, the detector cannot be reset using the Reset (333) function.
• If you have forgotten the password, please contact Endress+Hauser Service.
List of configuration parameters which must be confirmed
The following parameters can be configured by the user and must therefore be confirmed during the locking
procedure:
List of preconfigured parameters
The following parameters cannot be freely defined by the user.
The Gammapilot M configures them to the following initial settings by executing the locking function:
1. Background pulse rate (cps)
2. "Free" calibration point (cps)
3. "Covered" calibration point (cps)
4. Isotope (Cs or Co)
5. Beam type (standard or modulated)
6. (Gammagraphy) hold time (default value "10" for "modulated" beam type)
7. Output damping
8. Current date
9. Calibration date
1. Covered = 100 % → 20 mA
2. Free = 0 % →4 mA
3. Output in case of alarm = 22 mA
4. Gammagraphy detection = ON
5. (Gammagraphy) Span time = 0 seconds (no dynamic monitoring)
6. Output for gammagraphy = 3.8 mA
7. Gammagraphy sensitivity = 9 (Beam type "standard"); 20 (Beam type "modulated")
8. Low output limit = OFF
9. Current output mode = standard
10. Communication address = 0
11. Service parameters = Preset values
12. Simulation = OFF
13. Release code = SIL locked

Gammapilot M
Endress+Hauser 17
!Note!
• If the supply voltage for the Gammapilot M fails during the locking or unlocking procedure or during the
locking sequence, an alarm or warning is not output when the supply voltage is reapplied. For safety reasons,
however, the current output is set to error current ≤ 3.6 mA and held.
• To restart, the "safety locking (S22)" function has to be selected in the "safety settings (S2)" function group
and security locking has to be performed.
Configuration of switch point and hysteresis
The Gammapilot M converts the pulse rate linearly into the output current.
This requires configuration of switch point and hysteresis in the evaluation unit located downstream.
The following switch points must be configured in the evaluation unit:
1. 16 mA →Transition from "free" to "covered"
2. 8 mA →Transition from "covered" to "free"
SD230en13
Hysteresis to be configured in the control unit
Maintenance, recalibration Instructions for maintenance and recalibration can be found in the Operating Instructions BA00236F/00/EN.
During parameterization and maintenance work on the Gammapilot M, alternative monitoring measures must
be taken to ensure process safety.
"Caution!
The Gammapilot M must be recalibrated in the following circumstances:
If, following calibration of the measuring point, changes to the system are made in the immediate vicinity of
the measuring point which may affect the measuring signal due to scattering, or if changes are made to the
measuring point itself which alter the radiation conditions.
A check can be carried out by verifying the pulse rate with a free radiation path and comparing it to the
calibration record, →ä20.
481620
Level
free
covered
Current [mA]

Gammapilot M
18 Endress+Hauser
Proof-test
Proof-test Safety functions must be tested at appropriate intervals to ensure that they are functioning correctly and are
safe.
The time intervals must be defined by the operator.
Proof-testing of the Gammapilot M must be carried out in accordance with the following procedure.
If several detectors are used in MooN votings, the proof-test described here must be performed separately for
each detector.
In addition, checks must be carried out to ensure that all cover seals and cable entries are sealing correctly.
Testing of internal clock
The device must display the correct date. If the date is out by more than one day, it must be corrected to ensure
correct decay compensation.
Please see also the note in the Section "Behavior of device when switched on" →ä10.
Testing of Gammapilot M to ensure its safe functioning
During safety testing of the Gammapilot M, the radiation path of the measuring point must be clear.
For testing, the source of radiation is switched off. As a result, the output current changes from 4 mA to
20 mA.
In a second step, the source is switched back on, and the current then changes from 20 mA to 4 mA. This must
be checked by measuring the current using a calibrated measuring device with a accuracy of
± 0.1 mA. If the average value of the current deviates by more than 0.2 mA from the set point, the measuring
point must be recalibrated and this test must be repeated.
"Caution!
If recalibration and testing are not successful, the device must no longer be used as a safety device.
Please contact Endress+Hauser Service.
This test detects approx. 98 % of all possible dangerous undetected device failures.
!Note!
Please see also the Section "Maintenance, recalibration" →ä17.
Repair
Repair All repairs to the Gammapilot M must be carried out by Endress+Hauser.
In the event of failure of a SIL-labeled Endress+Hauser device, which has been operated in a safety function,
the "Declaration of Contamination and Cleaning" with the corresponding note "Used as SIL device in protection
system" must be enclosed when the defective device is returned
Please note the Operating Instructions BA00236F/00/EN, Section "Return" with regard to this.
If the Gammapilot M is equipped with new software, a reset must be carried out following download, and the
device must be tested to ensure that it is functioning correctly and also recalibrated.

Gammapilot M
Endress+Hauser 19
Appendix
Notes on the redundant
connection of multiple sensors
for SIL 3
With redundant connection with HFT = 1 (e.g. coincidence logic 1oo2 or 2oo3), the Gammapilot M meets the
requirements for SIL 3.
The common cause factors ß and ßDindicated in the table below are minimum values for the Gammapilot M.
These values should be used when calculating the failure probability of redundantly connected Gammapilot M
units as per IEC 61508-6.
The system-specific observation can return higher values depending on the actual installation and the use of
other components (e.g. Ex barriers).
Minimum value ß with homogeneous redundant use 5 %
Minimum value ßDwith homogeneous redundant use 2 %

Gammapilot M
20 Endress+Hauser
Calibration Record
Abgleichprotokoll-en
Calibration Record
Company: ___________________________________________
Measuring Point: ___________________________________________
Facility: ___________________________________________
Device Type: FMG60 - ___________________________________
Serial Number: ___________________________________________
Name: ___________________________________________
Date: ___________________________________________
Password: ___________________
(It is recommended to treat the calibration record as confidential after entering the password)
Signature: ___________________________________________
Settings and Configuration Parameters of the FMG60
1. Background pulse rate: ___________ cps
2. Calibration point "empty": ___________ cps
3. Calibration point "full": ___________ cps
4. Isotope: 137Cs 60Co 
5. Beam type: standard modulated 
6. Gammagraphy hold time: _____ seconds
(beam type "modulated": default = 10)
7. Integration time: _____ seconds
8. Present date: ____ . ____ . ________
(Day) (Month) (Year)
9. Calibration date: ____ . ____ . ________
(Day) (Month) (Year)
10. Detector length (Measuring length): _______ (mm)