Endress+Hauser Liquiphant M/S with electronic Insert FEL56 Operator's manual

Point level measuring system
Products Solutions Services
Special Documentation
Liquiphant M/S with electronic
insert FEL56 + Nivotester
FTL325N
Functional Safety Manual
SD01521F/00/EN/04.19
71433131
2019-03-05
CH1
CH1
[Ex ia]
CH1 CH2
CH2
CH3
CH3
[Ex ia]

Liquiphant M/S with electronic insert FEL56 + Nivotester FTL325N
2 Endress+Hauser
Table of contents
Declaration of conformity ..................... 3
General .................................... 4
Other safety-related characteristic values ............. 5
Useful lifetime of electrical components .............. 13
Certificate ................................ 14
Document information ...................... 15
Document function ........................... 15
Symbols used ............................... 15
Supplementary device documentation ............... 16
Permitted devices types ..................... 18
SIL label on the nameplate ...................... 19
Safety function ............................ 20
Definition of the safety function ................... 20
Restrictions for use in safety-related applications ....... 20
Use in safety instrumented systems ............ 23
Device behavior during operation .................. 23
Device configuration for safety-related applications ...... 23
Proof-testing ............................... 27
Life cycle ................................. 38
Requirements for personnel ..................... 38
Installation ................................. 38
Operation ................................. 38
Maintenance ............................... 38
Repair .................................... 38
Modification ................................ 39
Decommissioning ............................ 39
Appendix ................................ 40
Structure of the measuring system ................. 40
Commissioning or proof test report ................. 42
Further information ........................... 44
Version history .............................. 44

Liquiphant M/S with electronic insert FEL56 + Nivotester FTL325N
Endress+Hauser 3
Declaration of conformity
A0025774

Liquiphant M/S with electronic insert FEL56 + Nivotester FTL325N
4 Endress+Hauser
A0025775
General The components can be operated as different versions:
• Version I (→  6)
One Liquiphant for the direct activation of a NAMUR switching unit (e.g. transmitter, safety-
related PLC) via the NAMUR interface according to EN 50227 (DIN 19234; NAMUR) or
IEC 60947-5-6.
• Version II (→  7)
One Liquiphant with a 1-channel Nivotester, for the activation of an actuator or a safety-related
PLC via switching contacts, for instance
• Version III (→  8)
One Liquiphant with a 3-channel Nivotester, switching contacts are switched in series

Liquiphant M/S with electronic insert FEL56 + Nivotester FTL325N
Endress+Hauser 5
• Version IV (→  9)
Two Liquiphant devices with a 3-channel Nivotester, switching contacts are switched in series
• Version V (→  11)
Three Liquiphant devices with a 3-channel Nivotester, all channels are used, evaluation is
performed in a safety-related PLC, for example
• Version VI (→  13)
Three Liquiphant devices with a 3-channel Nivotester, only channel 1 has a SIL-specific
monitoring function. Channels 2 and 3 are used for level control of the same level (e.g. Δs). This
level control may not be considered as a safety measure as part of functional safety according to
EN 61508.
NOTICE
Measuring another, independent level (e.g. in a second tank)
‣The remaining channels may not be used for other levels.
Other safety-related
characteristic values
Please note the following for the tables below:
• A common cause factor β = 10 % has been assumed in the calculations indicated below.
• For multi-channel systems, the PFDavg values already contain common cause failures for the
specific wiring scheme.
• The PFDavg values only apply to the particular wiring scheme for which the values have been
calculated. They are not a suitable basis for making calculations for other wiring schemes.
The use of NC contacts instead of NO contacts, in particular, is not permitted for operation
according to SIL specifications.
• The wiring scheme indicates the number of devices and the circuitry of the level relay
contacts (open when required (demand mode)).
• If there are several devices in a wiring scheme, all the devices have the same settings shown.
• The tables show safety-related values and wiring options for the measuring system.
• FIT = Failure in Time, 1 FIT = 10-9 l/h.

Liquiphant M/S with electronic insert FEL56 + Nivotester FTL325N
6 Endress+Hauser
Specific functional safety parameters:
Version I: Liquiphant M/S
Characteristics as per IEC
61508
Value
Safety function MIN MAX
Example
Wiring scheme
A
A Other safety equipment e.g. actuator/safety-related PLC
SIL 2
HFT 0
Device type B
Mode of operation Low demand mode
SFF 68 % 74 %
MTTR 8 h
λsd 1) 56 FIT 68 FIT
λsu 1) 80 FIT 82 FIT
λdd 1) 7 FIT
λdu 1) 67 FIT 54 FIT
PFDavg for T1 = 1 year 2.92 x 10-4 2.36 x 10-4
MTBF 543 years
Diagnostic test interval 2) ≤60 s
Fault reaction time 3) ≤3 s
System reaction time 4) 1 s (covered > free) 0.5 s (free > covered)
PTC test sequence A 5) 93 %
PTC test sequence C 6) - 93 %
1) This value takes into account failure types relevant to the function of the electronic components according
to Siemens SN29500.
2) During this time, all diagnostic functions are executed at least once.
3) Time between error detection and error response.
4) Step response time as per DIN EN 61298-2.
5) Proof test coverage when the level is approached, or when the sensor is removed and the tines are
immersed in a medium of similar density and viscosity.
6) Proof test coverage when checking the switch point under reference operating conditions.

Liquiphant M/S with electronic insert FEL56 + Nivotester FTL325N
Endress+Hauser 7
Version II: Liquiphant M/S; 1-channel Nivotester FTL325N
Characteristics as per IEC
61508
Value
Safety function MIN MAX
Example
Wiring scheme
ACH1
A Other safety equipment e.g. actuator/safety-related PLC
SIL 2
HFT 0
Device type B
Mode of operation Low demand mode
SFF 85 % 86 %
MTTR 8 h
λsd 1) 56 FIT 68 FIT
λsu 1) 542 FIT
λdd 1) 9 FIT
λdu 1) 110 FIT 97 FIT
PFDavg for T1 = 1 year 4.83 x 10-4 4.27 x 10-4
MTBF 159 years
Diagnostic test interval 2) ≤60 s
Fault reaction time 3) ≤3 s
System reaction time 4) 1 s (covered > free) 0.5 s (free > covered)
PTC test sequence A 5) 88 %
PTC test sequence B 6) 34 % 38 %
PTC test sequence C 7) - 88 %
1) This value takes into account failure types relevant to the function of the electronic components according
to Siemens SN29500.
2) During this time, all diagnostic functions are executed at least once.
3) Time between error detection and error response.
4) Step response time as per DIN EN 61298-2.
5) Proof test coverage when the level is approached, or when the sensor is removed and the tines are
immersed in a medium of similar density and viscosity.
6) Proof test coverage when simulation is performed on the Nivotester by activating the test button.
7) Proof test coverage when checking the switch point under reference operating conditions.

Liquiphant M/S with electronic insert FEL56 + Nivotester FTL325N
8 Endress+Hauser
Version III: Liquiphant M/S; 3-channel Nivotester FTL325N, CH2 and CH3 in series
Characteristics as per IEC
61508
Value
Safety function MIN MAX
Example
Wiring scheme
A
B C
A
(1oo2)
CH2 CH2
CH3 CH3
CH1 CH1
A Other safety equipment e.g. actuator/safety-related PLC
B Possibility 1
C Possibility 2; 1oo2 assessment
SIL 2
HFT 0
Device type B
Mode of operation Low demand mode
SFF 92 % 93 %
MTTR 8 h
λsd 1) 63 FIT 76 FIT
λsu 1) 803 FIT
λdd 1) 7 FIT
λdu 1) 78 FIT 65 FIT
PFDavg for T1 = 1 year 3.41 x 10-4 2.85 x 10-4
MTBF 120 years
Diagnostic test interval 2) ≤60 s
Fault reaction time 3) ≤3 s
System reaction time 4) 1 s (covered > free) 0.5 s (free > covered)
PTC test sequence A 5) 93 %
PTC test sequence B 6) 52 % 57 %
PTC test sequence C 7) - 93 %
1) This value takes into account failure types relevant to the function of the electronic components according
to Siemens SN29500.
2) During this time, all diagnostic functions are executed at least once.
3) Time between error detection and error response.
4) Step response time as per DIN EN 61298-2.
5) Proof test coverage when the level is approached, or when the sensor is removed and the tines are
immersed in a medium of similar density and viscosity.
6) Proof test coverage when simulation is performed on the Nivotester by activating the test button.
7) Proof test coverage when checking the switch point under reference operating conditions.

Liquiphant M/S with electronic insert FEL56 + Nivotester FTL325N
Endress+Hauser 9
Version IV: 2 Liquiphant M/S; 3-channel Nivotester FTL325N
Characteristics as per IEC
61508
Value
Safety function MIN MAX
Example
Wiring scheme
A
B C
A
(1oo3)
CH2 CH2
CH3 CH3
CH1 CH1
A Other safety equipment e.g. actuator/safety-related PLC
B Possibility 1
C Possibility 2; 1oo3 assessment
SIL 2
HFT 1
Device type B
Mode of operation Low demand mode
SFF 99 %
MTTR 8 h
λsd 1) 135 FIT 159 FIT
λsu 1 225 FIT 1 203 FIT
λdd 1 FIT
λdu 16 FIT 15 FIT
PFDavg for T1 = 1 year 7.07 x -10-5 6.52 x 10-5
MTBF 83 years
Diagnostic test interval 2) ≤60 s
Fault reaction time 3) ≤3 s
System reaction time 4) 1 s (covered > free) 0.5 s (free > covered)
PTC test sequence A 5) 88 %
PTC test sequence B 6) 34 % 38 %
PTC test sequence C 7) - 88 %
1) This value takes into account failure types relevant to the function of the electronic components according
to Siemens SN29500.
2) During this time, all diagnostic functions are executed at least once.
3) Time between error detection and error response.
4) Step response time as per DIN EN 61298-2.
5) Proof test coverage when the level is approached, or when the sensor is removed and the tines are
immersed in a medium of similar density and viscosity.
6) Proof test coverage when simulation is performed on the Nivotester by activating the test button.
7) Proof test coverage when checking the switch point under reference operating conditions.

Liquiphant M/S with electronic insert FEL56 + Nivotester FTL325N
10 Endress+Hauser
The failure rates are based on an analysis in accordance with DIN EN 61508-6: 2011-02, Table
D.4, "Using the β-factor to calculate the probability of failure in an E/E/PE safety-related system
due to common cause failures". The calculation gives a β-factor of 10 %. This factor is based on
the failure rates indicated above. If additional measures are implemented during installation to
prevent common cause errors as defined in Table D.1, the β-factor can possibly be reduced to
5 %. Possible measures are:
• Sensors installed in a physically separate location
• Cable routed separately between the Liquiphant and Nivotester
• Separate protection from environmental influences: impact, sunshine, EMC protection and/or
overvoltage
• Use of different sensor materials, and combination of high-temperature and normal version

Liquiphant M/S with electronic insert FEL56 + Nivotester FTL325N
Endress+Hauser 11
Version V: 3 Liquiphant M/S; 3-channel Nivotester FTL325N
Characteristics as per IEC
61508
Value
Safety function MIN MAX
Example
Wiring scheme
A
(2oo3)
CH2
CH3
CH1
A Other safety equipment e.g. actuator/safety-related PLC; 2oo3 assessment
SIL 2
HFT 1
Device type B
Mode of operation Low demand mode
SFF 99 %
MTTR 8 h
λsd 1) 198 FIT 234 FIT
λsu 1 411 FIT 1 377 FIT
λdd 1 FIT
λdu 18 FIT 17 FIT
PFDavg for T1 = 1 year 8.04 x -10-5 7.49 x 10-5
MTBF 70 years
Diagnostic test interval 2) ≤60 s
Fault reaction time 3) ≤3 s
System reaction time 4) 1 s (covered > free) 0.5 s (free > covered)
PTC test sequence A 5) 88 %
PTC test sequence B 6) 34 % 38 %
PTC test sequence C 7) - 88 %
1) This value takes into account failure types relevant to the function of the electronic components according
to Siemens SN29500.
2) During this time, all diagnostic functions are executed at least once.
3) Time between error detection and error response.
4) Step response time as per DIN EN 61298-2.
5) Proof test coverage when the level is approached, or when the sensor is removed and the tines are
immersed in a medium of similar density and viscosity.
6) Proof test coverage when simulation is performed on the Nivotester by activating the test button.
7) Proof test coverage when checking the switch point under reference operating conditions.

Liquiphant M/S with electronic insert FEL56 + Nivotester FTL325N
12 Endress+Hauser
The failure rates are based on an analysis in accordance with DIN EN 61508-6: 2011-02, Table
D.4, "Using the β-factor to calculate the probability of failure in an E/E/PE safety-related system
due to common cause failures". The calculation gives a β-factor of 10 %. This factor is based on
the failure rates indicated above. If additional measures are implemented during installation to
prevent common cause errors as defined in Table D.1, the β-factor can possibly be reduced to
5 %. Possible measures are:
• Sensors installed in a physically separate location
• Cable routed separately between the Liquiphant and Nivotester
• Separate protection from environmental influences: impact, sunshine, EMC protection and/or
overvoltage
• Use of different sensor materials, and combination of high-temperature and normal version

Liquiphant M/S with electronic insert FEL56 + Nivotester FTL325N
Endress+Hauser 13
Version VI: Liquiphant M/S; 3-channel Nivotester FTL325N
Characteristics as per IEC
61508
Value
Safety function MIN MAX
Example
DS
DS
A0027836
Wiring scheme
A
∆s
CH2
CH3
CH1
A Other safety equipment e.g. actuator/safety-related PLC
Δs level control (not SIL)
SIL 2
HFT 0
Device type B
Mode of operation Low demand mode
SFF 85 % 86 %
MTTR 8 h
λsd 1) 56 FIT 68 FIT
λsu 542 FIT
λdd 9 FIT
λdu 110 FIT 97 FIT
PFDavg for T1 = 1 year 4.83 x 10-4 4.27 x 10-4
MTBF 159 years
Diagnostic test interval 2) ≤60 s
Fault reaction time 3) ≤3 s
System reaction time 4) 1 s (covered > free) 0.5 s (free > covered)
PTC test sequence A 5) 88 %
PTC test sequence B 6) 34 % 38 %
PTC test sequence C 7) - 88 %
1) This value takes into account failure types relevant to the function of the electronic components according
to Siemens SN29500.
2) During this time, all diagnostic functions are executed at least once.
3) Time between error detection and error response.
4) Step response time as per DIN EN 61298-2.
5) Proof test coverage when the level is approached, or when the sensor is removed and the tines are
immersed in a medium of similar density and viscosity.
6) Proof test coverage when simulation is performed on the Nivotester by activating the test button.
7) Proof test coverage when checking the switch point under reference operating conditions.
Useful lifetime of electrical
components
The established failure rates of electrical components apply within the useful lifetime as per
IEC 61508-2:2010 section 7.4.9.5 note 3.
According to DIN EN 61508-2:2011 section 7.4.9.5 national footnote N3, appropriate measures
taken by the manufacturer and operator can extend the useful lifetime.

Liquiphant M/S with electronic insert FEL56 + Nivotester FTL325N
14 Endress+Hauser
Certificate
A0028061

Liquiphant M/S with electronic insert FEL56 + Nivotester FTL325N
Endress+Hauser 15
Document information
Document function The document is part of the Operating Instructions and serves as a reference for application-specific
parameters and notes.
• General information about functional safety: SIL
• General information about SIL is available:
In the Download Area of the Endress+Hauser Internet site: www.de.endress.com/SIL
Symbols used Safety symbols
Symbol Meaning
DANGER
DANGER!
This symbol alerts you to a dangerous situation. Failure to avoid this situation will
result in serious or fatal injury.
WARNING
WARNING!
This symbol alerts you to a dangerous situation. Failure to avoid this situation can
result in serious or fatal injury.
CAUTION
CAUTION!
This symbol alerts you to a dangerous situation. Failure to avoid this situation can
result in minor or medium injury.
NOTICE
NOTE!
This symbol contains information on procedures and other facts which do not result in
personal injury.
Symbols for certain types of information
Symbol Meaning
A0011193
Tip
Indicates additional information.
Reference to documentation
A
Reference to page
Reference to graphic
1.
,
2.
,
3.
… Series of steps
Symbols in graphics
Symbol Meaning
1, 2, 3,... Item numbers
1.
,
2.
,
3.
… Series of steps
A, B, C, ... Views

Liquiphant M/S with electronic insert FEL56 + Nivotester FTL325N
16 Endress+Hauser
Supplementary device
documentation
Liquiphant M FTL50, FTL50H, FTL51, FTL51H, FTL51C
Documentation Comment
Technical Information:
• TI00328F/00 (FTL50, FTL50H, FTL51, FTL51H)
• TI00347F/00 (FTL51C)
The documentation is available on the Internet:
→ www.endress.com
Operating Instructions:
• KA00143F/00 (FTL50, FTL51)
• KA00163F/00 (FTL50, FTL51 1))
• KA00144F/00 (FTL50H, FTL51H)
• KA00164F/00 (FTL50H, FTL51H 1))
• KA00162F/00 (FTL51C)
• KA00165F/00 (FTL51C 1))
• The document is provided with the device.
• The documentation is available on the Internet:
→ www.endress.com
Special version of documentation:
SV01222F/00
Additional installation instructions for Technical Special
Products (TSP) with removable electronics module
• The document is provided with the device.
• The documentation is available on the Internet:
→ www.endress.com → Search → Enter serial number
Safety instructions depending on the selected option
"Approval".
Additional safety instructions (XA, ZE) are supplied with
certified device version.
Please refer to the nameplate for the relevant safety
instructions.
1) with T13 aluminum housing/separate connection compartment
Liquiphant S FTL70, FTL71
Documentation Comment
Technical Information:
TI00354F/00
The documentation is available on the Internet:
→ www.endress.com
Operating Instructions:
• KA00172F/00
• KA00173F/00 1)
• The document is provided with the device.
• The documentation is available on the Internet:
→ www.endress.com
Special version of documentation:
SV01222F/00
Additional installation instructions for Technical Special
Products (TSP) with removable electronics module
• The document is provided with the device.
• The documentation is available on the Internet:
→ www.endress.com → Search → Enter serial number
Safety instructions depending on the selected option
"Approval".
Additional safety instructions (XA, ZE) are supplied with
certified device version.
Please refer to the nameplate for the relevant safety
instructions.
1) with T13 aluminum housing/separate connection compartment

Liquiphant M/S with electronic insert FEL56 + Nivotester FTL325N
Endress+Hauser 17
Nivotester FTL325N
Documentation Comment
Technical Information:
TI00353F/00
The documentation is available on the Internet:
→ www.endress.com
Operating Instructions:
• KA00170F/00 (1-channel)
• KA00171F/00 (3-channel)
• The document is provided with the device.
• The documentation is available on the Internet:
→ www.endress.com
Safety instructions depending on the selected option
"Approval".
Additional safety instructions (XA, ZE) are supplied with
certified device version.
Please refer to the nameplate for the relevant safety
instructions.
This supplementary Safety Manual applies in addition to the Operating Instructions, Technical
Information and ATEX Safety Instructions. The supplementary device documentation must be
observed during installation, commissioning and operation. The requirements specific for the
protection function are described in this Safety Manual.

Liquiphant M/S with electronic insert FEL56 + Nivotester FTL325N
18 Endress+Hauser
Permitted devices types
The details pertaining to functional safety in this manual relate to the device versions listed below
and are valid as of the specified firmware and hardware versions. Unless otherwise specified, all the
following versions can also be used for protective systems. A modification process according to
IEC 61508 is applied for device changes.
Valid device versions for safety-related use: Liquiphant M FTL50, FTL50H, FTL51, FTL51H, FTL51C
Ordering feature Designation Option
010 Approval All
020 Process connection All
030 Probe length; type All
040 Electronics; output 6 FEL56; SIL NAMUR (L-H signal)
050 Housing; cable entry All
060 Additional options All
570 Service All
580 Test, certificate All
600 Sensor design All
895 Marking All
• Valid firmware version: 01.00.01 and higher
• Valid hardware version: 01.01 and higher
Valid device versions for safety-related use: Liquiphant S FTL70, FTL71
Ordering feature Designation Option
010 Approval All
020 Process connection All
030 Probe length All
040 Electronics; output 6 FEL56; SIL NAMUR (L-H signal)
050 Housing; cable entry All
060 Additional options All
070 Application All
570 Service All
580 Test, certificate All
600 Sensor design All
895 Marking All
• Valid firmware version: 01.00.01 and higher
• Valid hardware version: 01.01 and higher

Liquiphant M/S with electronic insert FEL56 + Nivotester FTL325N
Endress+Hauser 19
Valid device versions for safety-related use: Nivotester FTL325N
Ordering feature Designation Option
010 Approval • G
• H
• N
• P
• T
• W
• 2
• 8
ATEX II 3(1)G Ex nC/A [ia] IIC T4, SIL, IECEx Zone 2
ATEX II (1)GD [EEx ia] IIC, WHG, SIL, IECEx [Ex ia] IIC
NEPSI (Ex ia) IIC, SIL
FM IS Cl. I, II, III Div. 1 Gr. A-G, SIL
CSA IS Cl. I, II, III Div. 1 Gr. A-G, SIL
TIIS Ex ia IIC, SIL, labeling in Japan
INMETRO [Ex ia Ga] IIC, SIL
EAC [Ex ia Ga] IIC SIL; EAC [Ex ia Da] IIC, SIL
020 Housing • 1
• 3
Rail mounting, 22.5 mm, 1-channel
Rail mounting, 45mm, 3-channel
030 Power connection All
040 Switch output • 1
• 3
1x SPDT level + 1x SPST alarm
3x SPDT level + 1x SPST alarm
995 Marking All
Valid hardware version: 02.00 and higher
SIL label on the nameplate SIL certified devices are marked with the following symbol on the nameplate:

Liquiphant M/S with electronic insert FEL56 + Nivotester FTL325N
20 Endress+Hauser
Safety function
Definition of the safety
function
The measuring system's safety functions are:
• Maximum point level monitoring (overfill protection)
• Minimum point level monitoring (dry run protection)
For information on the choice of operating mode (MIN or MAX detection), see →  23.
Restrictions for use in safety-
related applications
• The measuring system must be used correctly for the specific application, taken into account the
medium properties and ambient conditions. Carefully follow instructions pertaining to critical
process situations and installation conditions from the Operating Instructions. The application-
specific limits must be observed.
• The specifications from the Operating Instructions must not be exceeded, (→  16).
Density of the medium
Operation is only permitted with liquids:
• Depending on the configured density setting, the density of the liquid must be as follows:
– if the switch position is > 0.7 the density must be over 0.7 g/cm³ (common water- and oil-based
liquids).
– if the switch position is > 0.5 the density must be over 0.5 g/cm³ (e.g. liquefied gas, isopentane,
petroleum ether).
• The gas phase above the liquid may not exceed a maximum permitted density value. The
maximum possible gas density depends on the temperature and the device.
LCAUTION
Gas density is exceeded!
"Free" state is not detected and "Covered" is always signaled.
‣The gas density may not be exceeded.