Endress+Hauser Liquiphant M/S Instructions for use

Point level measuring system
Products Solutions Services
Special Documentation
Liquiphant M/S with electronic
insert FEL58 + Nivotester
FTL325N
Functional Safety Manual
SD01522F/00/EN/02.16
71329744
CH1
CH1
[Ex ia]
CH1 CH2
CH2
CH3
CH3
[Ex ia]

Liquiphant M/S with electronic insert FEL58 + Nivotester FTL325N
2 Endress+Hauser
Table of contents
Declaration of conformity ..................... 3
General .................................... 4
Other safety-related characteristic values ............. 5
Useful lifetime of electrical components .............. 13
Certificate ................................ 14
Document information ...................... 15
Document function ........................... 15
Symbols used ............................... 15
Supplementary device documentation ............... 16
Permitted devices types ..................... 17
SIL label on the nameplate ...................... 18
Safety function ............................ 19
Definition of the safety function ................... 19
Restrictions for use in safety-related applications ....... 19
Use in safety instrumented systems ............ 22
Device behavior during operation .................. 22
Device configuration for safety-related applications ...... 22
Proof-testing ............................... 26
Life cycle ................................. 38
Requirements for personnel ..................... 38
Installation ................................. 38
Operation ................................. 38
Maintenance ............................... 38
Repair .................................... 38
Modification ................................ 39
Decommissioning ............................ 39
Appendix ................................ 40
Structure of the measuring system ................. 40
Commissioning or proof test report ................. 42
Further information ........................... 44
Version history .............................. 44

Liquiphant M/S with electronic insert FEL58 + Nivotester FTL325N
Endress+Hauser 3
Declaration of conformity
A0028074

Liquiphant M/S with electronic insert FEL58 + Nivotester FTL325N
4 Endress+Hauser
A0028075
General The components can be operated as different versions:
• Version I (→  6)
One Liquiphant for the direct activation of a NAMUR switching unit (e.g. transmitter, safety-
related PLC) via the NAMUR interface according to EN 50227 (DIN 19234; NAMUR) or
IEC 60947-5-6.
• Version II (→  7)
One Liquiphant with a 1-channel Nivotester; for the activation of an actuator or a safety-related
PLC via switching contacts, for instance
• Version III (→  8)
One Liquiphant with a 3-channel Nivotester; switching contacts are switched in series

Liquiphant M/S with electronic insert FEL58 + Nivotester FTL325N
Endress+Hauser 5
• Version IV (→  9)
Two Liquiphant devices with a 3-channel Nivotester; the switching contacts are switched in series
• Version V (→  11)
Three Liquiphant devices with a 3-channel Nivotester; all channels are used, evaluation is
performed in a safety-related PLC, for example
• Version VI (→  13)
Three Liquiphant devices with a 3-channel Nivotester; only channel 1 has a SIL-specific
monitoring function. Channels 2 and 3 are used for level control of the same level (e.g. Δs). This
level control may not then be considered as a safety measure as part of functional safety according
to EN 61508.
NOTICE
Measuring another, independent level (e.g. in a second tank)
‣The remaining channels may not be used for other levels.
Other safety-related
characteristic values
Please note the following for the tables below:
• A common cause factor β = 10 % has been assumed in the calculations indicated below.
• For multi-channel systems, the PFDavg values already contain common cause failures for the
specific wiring scheme.
• The PFDavg values only apply to the particular wiring scheme for which the values have been
calculated. They are not a suitable basis for making calculations for other wiring schemes.
The use of NC contacts instead of NO contacts, in particular, is not permitted for operation
according to SIL specifications.
• The wiring scheme indicates the number of devices and the circuitry of the level relay
contacts (open when required (demand mode)).
• If there are several devices in a wiring scheme, all the devices have the same settings shown.
• The tables show safety-related values and wiring options for the measuring system.
• FIT = Failure in Time, 1 FIT = 10-9 l/h.

Liquiphant M/S with electronic insert FEL58 + Nivotester FTL325N
6 Endress+Hauser
Specific functional safety parameters:
Version I: Liquiphant M/S
Characteristics as per IEC
61508
Value
Safety function MIN MAX
Example
Wiring scheme
A
A Other safety equipment e.g. actuator/safety-related PLC
SIL 2
HFT 0
Device type B
Mode of operation Low demand mode
SFF 69 % 75 %
MTTR 8 h
λsd 1) 66 FIT 78 FIT
λsu 85 FIT 87 FIT
λdd 13 FIT 12 FIT
λdu 73 FIT 59 FIT
PFDavg for T1 = 1 year 3.18 x 10-4 2.59 x 10-4
MTBF 482 years
Diagnostic test interval 2) ≤60 s
Fault reaction time 3) ≤3 s
System reaction time 4) 1 s (covered > free) 0.5 s (free > covered)
PTC test sequence A 5) 93 %
PTC test sequence B 6) 2 %
PTC test sequence C 7) - 93 %
1) This value takes into account failure types relevant to the function of the electronic components according
to Siemens SN29500.
2) During this time, all diagnostic functions are executed at least once.
3) Time between error detection and error response.
4) Step response time as per DIN EN 61298-2.
5) Proof test coverage when the level is approached, or when the sensor is removed and the tines are
immersed in a medium of similar density and viscosity.
6) Proof test coverage when simulation is performed on the Nivotester or the electronic insert FEL58 by
activating the test button.
7) Proof test coverage when checking the switch point under reference operating conditions.

Liquiphant M/S with electronic insert FEL58 + Nivotester FTL325N
Endress+Hauser 7
Version II: Liquiphant M/S; 1-channel Nivotester FTL325N
Characteristics as per IEC
61508
Value
Safety function MIN MAX
Example
Wiring scheme
ACH1
A Other safety equipment e.g. actuator/safety-related PLC
SIL 2
HFT 0
Device type B
Mode of operation Low demand mode
SFF 85 % 87 %
MTTR 8 h
λsd 1) 66 FIT 78 FIT
λsu 554 FIT
λdd 13 FIT
λdu 113 FIT 100 FIT
PFDavg for T1 = 1 year 4.96 x 10-4 4.37 x 10-4
MTBF 153 years
Diagnostic test interval 2) ≤60 s
Fault reaction time 3) ≤3 s
System reaction time 4) 1 s (covered > free) 0.5 s (free > covered)
PTC test sequence A 5) 92 %
PTC test sequence B 6) 34 % 38 %
PTC test sequence C 7) - 92 %
1) This value takes into account failure types relevant to the function of the electronic components according
to Siemens SN29500.
2) During this time, all diagnostic functions are executed at least once.
3) Time between error detection and error response.
4) Step response time as per DIN EN 61298-2.
5) Proof test coverage when the level is approached, or when the sensor is removed and the tines are
immersed in a medium of similar density and viscosity.
6) Proof test coverage when simulation is performed on the Nivotester or the electronic insert FEL58 by
activating the test button.
7) Proof test coverage when checking the switch point under reference operating conditions.

Liquiphant M/S with electronic insert FEL58 + Nivotester FTL325N
8 Endress+Hauser
Version III: Liquiphant M/S; 3-channel Nivotester FTL325N, CH2 and CH3 in series
Characteristics as per IEC
61508
Value
Safety function MIN MAX
Example
Wiring scheme
A
B C
A
(1oo2)
CH2 CH2
CH3 CH3
CH1 CH1
A Other safety equipment e.g. actuator/safety-related PLC
B Possibility 1
C Possibility 2; 1oo2 assessment
SIL 2
HFT 0
Device type B
Mode of operation Low demand mode
SFF 91 % 93 %
MTTR 8 h
λsd 1) 72 FIT 84 FIT
λsu 809 FIT 812 FIT
λdd 13 FIT
λdu 84 FIT 70 FIT
PFDavg for T1 = 1 year 3.67 x -10-4 3.08 x 10-4
MTBF 117 years
Diagnostic test interval 2) ≤60 s
Fault reaction time 3) ≤3 s
System reaction time 4) 1 s (covered > free) 0.5 s (free > covered)
PTC test sequence A 5) 96 %
PTC test sequence B 6) 51 % 56 %
PTC test sequence C 7) - 96 %
1) This value takes into account failure types relevant to the function of the electronic components according
to Siemens SN29500.
2) During this time, all diagnostic functions are executed at least once.
3) Time between error detection and error response.
4) Step response time as per DIN EN 61298-2.
5) Proof test coverage when the level is approached, or when the sensor is removed and the tines are
immersed in a medium of similar density and viscosity.
6) Proof test coverage when simulation is performed on the Nivotester or the electronic insert FEL58 by
activating the test button.
7) Proof test coverage when checking the switch point under reference operating conditions.

Liquiphant M/S with electronic insert FEL58 + Nivotester FTL325N
Endress+Hauser 9
Version IV: 2 Liquiphant M/S; 3-channel Nivotester FTL325N
Characteristics as per IEC
61508
Value
Safety function MIN MAX
Example
Wiring scheme
A
B C
A
(1oo3)
CH2 CH2
CH3 CH3
CH1 CH1
A Other safety equipment e.g. actuator/safety-related PLC
B Possibility 1
C Possibility 2; 1oo3 assessment
SIL 2
HFT 1
Device type B
Mode of operation Low demand mode
SFF 99 %
MTTR 8 h
λsd 1) 163 FIT 187 FIT
λsu 1 252 FIT 1 231 FIT
λdd 1 FIT
λdu 17 FIT 15 FIT
PFDavg for T1 = 1 year 7.27 x -10-5 6.68 x 10-5
MTBF 80 years
Diagnostic test interval 2) ≤60 s
Fault reaction time 3) ≤3 s
System reaction time 4) 1 s (covered > free) 0.5 s (free > covered)
PTC test sequence A 5) 92 %
PTC test sequence B 6) 34 % 38 %
PTC test sequence C 7) - 92 %
1) This value takes into account failure types relevant to the function of the electronic components according
to Siemens SN29500.
2) During this time, all diagnostic functions are executed at least once.
3) Time between error detection and error response.
4) Step response time as per DIN EN 61298-2.
5) Proof test coverage when the level is approached, or when the sensor is removed and the tines are
immersed in a medium of similar density and viscosity.
6) Proof test coverage when simulation is performed on the Nivotester or the electronic insert FEL58 by
activating the test button.
7) Proof test coverage when checking the switch point under reference operating conditions.

Liquiphant M/S with electronic insert FEL58 + Nivotester FTL325N
10 Endress+Hauser
The failure rates are based on an analysis in accordance with DIN EN 61508-6: 2011-02, Table
D.4, "Using the β-factor to calculate the probability of failure in an E/E/PE safety-related system
due to common cause failures". The calculation gives a β-factor of 10 %. This factor is based on
the failure rates indicated above. If additional measures are implemented during installation to
prevent common cause errors as defined in Table D.1, the β-factor can possibly be reduced to
5 %. Possible measures are:
• Sensors installed in a physically separate location
• Cable routed separately between Liquiphant and Nivotester
• Separate protection from environmental influences: impact, sunshine, EMC protection and/or
overvoltage
• Use of different sensor materials, and combination of high-temperature and normal version

Liquiphant M/S with electronic insert FEL58 + Nivotester FTL325N
Endress+Hauser 11
Version V: 3 Liquiphant M/S; 3-channel Nivotester FTL325N; 2oo3 architecture
Characteristics as per IEC
61508
Value
Safety function MIN MAX
Example
Wiring scheme
A
(2oo3)
CH2
CH3
CH1
A Other safety equipment e.g. actuator/safety-related PLC; 2oo3 assessment
SIL 2
HFT 1
Device type B
Mode of operation Low demand mode
SFF 99 %
MTTR 8 h
λsd 1) 242 FIT 277 FIT
λsu 1 448 FIT 1 416 FIT
λdd 1 FIT
λdu 19 FIT 17 FIT
PFDavg for T1 = 1 year 8.13 x -10-5 7.55 x 10-5
MTBF 67 years
Diagnostic test interval 2) ≤60 s
Fault reaction time 3) ≤3 s
System reaction time 4) 1 s (covered > free) 0.5 s (free > covered)
PTC test sequence A 5) 92 %
PTC test sequence B 6) 34 % 38 %
PTC test sequence C 7) - 92 %
1) This value takes into account failure types relevant to the function of the electronic components according
to Siemens SN29500.
2) During this time, all diagnostic functions are executed at least once.
3) Time between error detection and error response.
4) Step response time as per DIN EN 61298-2.
5) Proof test coverage when the level is approached, or when the sensor is removed and the tines are
immersed in a medium of similar density and viscosity.
6) Proof test coverage when simulation is performed on the Nivotester or the electronic insert FEL58 by
activating the test button.
7) Proof test coverage when checking the switch point under reference operating conditions.

Liquiphant M/S with electronic insert FEL58 + Nivotester FTL325N
12 Endress+Hauser
The failure rates are based on an analysis in accordance with DIN EN 61508-6: 2011-02, Table
D.4, "Using the β-factor to calculate the probability of failure in an E/E/PE safety-related system
due to common cause failures". The calculation gives a β-factor of 10 %. This factor is based on
the failure rates indicated above. If additional measures are implemented during installation to
prevent common cause errors as defined in Table D.1, the β-factor can possibly be reduced to
5 %. Possible measures are:
• Sensors installed in a physically separate location
• Cable routed separately between Liquiphant and Nivotester
• Separate protection from environmental influences: impact, sunshine, EMC protection and/or
overvoltage
• Use of different sensor materials, and combination of high-temperature and normal version

Liquiphant M/S with electronic insert FEL58 + Nivotester FTL325N
Endress+Hauser 13
Version VI: Liquiphant M/S; 3-channel Nivotester FTL325N
Characteristics as per IEC
61508
Value
Safety function MIN MAX
Example
DS
DS
A0027836
Wiring scheme
A
∆s
CH2
CH3
CH1
A Other safety equipment e.g. actuator/safety-related PLC
Δs level control (not SIL)
SIL 2
HFT 0
Device type B
Mode of operation Low demand mode
SFF 85 % 87 %
MTTR 8 h
λsd 1) 66 FIT 78 FIT
λsu 554 FIT
λdd 13 FIT
λdu 113 FIT 100 FIT
PFDavg for T1 = 1 year 4.96 x 10-4 4.37 x 10-4
MTBF 153 years
Diagnostic test interval 2) ≤60 s
Fault reaction time 3) ≤3 s
System reaction time 4) 1 s (covered > free) 0.5 s (free > covered)
PTC test sequence A 5) 92 %
PTC test sequence B 6) 34 % 38 %
PTC test sequence C 7) - 92 %
1) This value takes into account failure types relevant to the function of the electronic components according
to Siemens SN29500.
2) During this time, all diagnostic functions are executed at least once.
3) Time between error detection and error response.
4) Step response time as per DIN EN 61298-2.
5) Proof test coverage when the level is approached, or when the sensor is removed and the tines are
immersed in a medium of similar density and viscosity.
6) Proof test coverage when simulation is performed on the Nivotester or the electronic insert FEL58 by
activating the test button.
7) Proof test coverage when checking the switch point under reference operating conditions.
Useful lifetime of electrical
components
The established failure rates of electrical components apply within the useful lifetime as per
IEC 61508-2:2010 section 7.4.9.5 note 3.
According to DIN EN 61508-2:2011 section 7.4.9.5 national footnote N3, appropriate measures
taken by the manufacturer and operator can extend the useful lifetime.

Liquiphant M/S with electronic insert FEL58 + Nivotester FTL325N
14 Endress+Hauser
Certificate
A0028061

Liquiphant M/S with electronic insert FEL58 + Nivotester FTL325N
Endress+Hauser 15
Document information
Document function The document is part of the Operating Instructions and serves as a reference for application-specific
parameters and notes.
• General information about functional safety: SIL
• General information about SIL is available:
In the Download Area of the Endress+Hauser Internet site: www.de.endress.com/SIL
Symbols used Safety symbols
Symbol Meaning
DANGER
DANGER!
This symbol alerts you to a dangerous situation. Failure to avoid this situation will result in
serious or fatal injury.
WARNING
WARNING!
This symbol alerts you to a dangerous situation. Failure to avoid this situation can result in
serious or fatal injury.
CAUTION
CAUTION!
This symbol alerts you to a dangerous situation. Failure to avoid this situation can result in
minor or medium injury.
NOTICE
NOTE!
This symbol contains information on procedures and other facts which do not result in
personal injury.
Symbols for certain types of information
Symbol Meaning
A0011193
Tip
Indicates additional information.
A0011194
Reference to documentation
Refers to the corresponding device documentation.
A0011195
Reference to page
Refers to the corresponding page number.
A0011196
Reference to graphic
Refers to the corresponding graphic number and page number.
,… ,
Series of steps
Symbols in graphics
Symbol Meaning
1, 2, 3,... Item numbers
,… ,
Series of steps
A, B, C, ... Views

Liquiphant M/S with electronic insert FEL58 + Nivotester FTL325N
16 Endress+Hauser
Supplementary device
documentation
Liquiphant M FTL50, FTL50H, FTL51, FTL51H, FTL51C
Documentation Comment
Technical Information:
• TI00328F/00 (FTL50, FTL50H, FTL51, FTL51H)
• TI00347F/00 (FTL51C)
The documentation is available on the Internet:
→ www.endress.com
Operating Instructions:
• KA00143F/00 (FTL50, FTL51)
• KA00163F/00 (FTL50, FTL51 1))
• KA00144F/00 (FTL50H, FTL51H)
• KA00164F/00 (FTL50H, FTL51H 1))
• KA00162F/00 (FTL51C)
• KA00165F/00 (FTL51C 1))
• The document is provided with the device.
• The documentation is available on the Internet:
→ www.endress.com
Safety instructions depending on the selected option
"Approval".
Additional safety instructions (XA, ZE) are supplied with
certified device version.
Please refer to the nameplate for the relevant safety
instructions.
1) with T13 aluminum housing/separate connection compartment
Liquiphant S FTL70, FTL71
Documentation Comment
Technical Information:
TI00354F/00
The documentation is available on the Internet:
→ www.endress.com
Operating Instructions:
• KA00172F/00
• KA00173F/00 1)
• The document is provided with the device.
• The documentation is available on the Internet:
→ www.endress.com
Safety instructions depending on the selected option
"Approval".
Additional safety instructions (XA, ZE) are supplied with
certified device version.
Please refer to the nameplate for the relevant safety
instructions.
1) with T13 aluminum housing/separate connection compartment
Nivotester FTL325N
Documentation Comment
Technical Information:
TI00353F/00
The documentation is available on the Internet:
→ www.endress.com
Operating Instructions:
• KA00170F/00 (1-channel)
• KA00171F/00 (3-channel)
• The document is provided with the device.
• The documentation is available on the Internet:
→ www.endress.com
Safety instructions depending on the selected option
"Approval".
Additional safety instructions (XA, ZE) are supplied with
certified device version.
Please refer to the nameplate for the relevant safety
instructions.
This supplementary Safety Manual applies in addition to the Operating Instructions, Technical
Information and ATEX Safety Instructions. The supplementary device documentation must be
observed during installation, commissioning and operation. The requirements specific for the
protection function are described in this Safety Manual.

Liquiphant M/S with electronic insert FEL58 + Nivotester FTL325N
Endress+Hauser 17
Permitted devices types
The details pertaining to functional safety in this manual relate to the device versions listed below
and are valid as of the specified firmware and hardware versions. Unless otherwise specified, all the
following versions can also be used for protective systems. A modification process according to
IEC 61508 is applied for device changes.
Valid device versions for safety-related use: Liquiphant M FTL50, FTL50H, FTL51, FTL51H, FTL51C
Ordering feature Designation Option
010 Approval All
020 Process connection All
030 Probe length; type All
040 Electronics; output 8 FEL58; SIL NAMUR+test button (L-H signal)
050 Housing; cable entry All
060 Additional option All
570 Service All
580 Test, certificate All
600 Sensor design All
895 Marking All
• Valid firmware version: 01.00.01 and higher
• Valid hardware version: 01.01 and higher
Valid device versions for safety-related use: Liquiphant S FTL70, FTL71
Ordering feature Designation Option
010 Approval All
020 Process connection All
030 Probe length All
040 Electronics; output 8 FEL58; SIL NAMUR+test button (L-H signal)
050 Housing; cable entry All
060 Additional option All
070 Application All
570 Service All
580 Test, certificate All
600 Sensor design All
895 Marking All
• Valid firmware version: 01.00.01 and higher
• Valid hardware version: 01.01 and higher

Liquiphant M/S with electronic insert FEL58 + Nivotester FTL325N
18 Endress+Hauser
Valid device versions for safety-related use: Nivotester FTL325N
Ordering feature Designation Option
010 Approval • G
• H
• N
• P
• T
• W
• 2
ATEX II 3(1)G Ex nC/A [ia] IIC T4, SIL, IECEx Zone 2
ATEX II (1)GD [EEx ia] IIC, WHG, SIL, IECEx [Ex ia] IIC
NEPSI (Ex ia) IIC, SIL
FM IS Cl. I, II, III Div. 1 Gr. A-G, SIL
CSA IS Cl. I, II, III Div. 1 Gr. A-G, SIL
TIIS Ex ia IIC, SIL, labeling in Japan
INMETRO [Ex ia Ga] IIC, SIL
020 Housing • 1
• 3
Rail mounting, 22.5 mm, 1-channel
Rail mounting, 45mm, 3-channel
030 Power supply All
040 Switch output • 1
• 3
1x SPDT level + 1x SPST alarm
3x SPDT level + 1x SPST alarm
995 Marking All
Valid hardware version: 02.00 and higher
SIL label on the nameplate SIL certified devices are marked with the following symbol on the nameplate:

Liquiphant M/S with electronic insert FEL58 + Nivotester FTL325N
Endress+Hauser 19
Safety function
Definition of the safety
function
The measuring system's safety functions are:
• Maximum point level monitoring (overfill protection)
• Minimum point level monitoring (dry run protection)
For information on the choice of operating mode (MIN or MAX detection), see →  22.
Restrictions for use in safety-
related applications
• The measuring system must be used correctly for the specific application, taken into account the
medium properties and ambient conditions. Carefully follow instructions pertaining to critical
process situations and installation conditions from the Operating Instructions. The application-
specific limits must be observed.
• The specifications from the Operating Instructions must not be exceeded, →  15.
Density of the medium
Operation is only permitted with liquids:
• Depending on the configured density setting, the density of the liquid must be as follows:
– if the switch position is > 0.7 the density must be over 0.7 g/cm³ (common water- and oil-based
liquids).
– if the switch position is > 0.5 the density must be over 0.5 g/cm³ (e.g. liquefied gas, isopentane,
petroleum ether).
• The gas phase above the liquid may not exceed a maximum permitted density value. The
maximum possible gas density depends on the temperature and the device.
LCAUTION
Gas density is exceeded!
"Free" state is not detected and "Covered" is always signaled.
‣The gas density may not be exceeded.

Liquiphant M/S with electronic insert FEL58 + Nivotester FTL325N
20 Endress+Hauser
1.000
0.100
0.010
ρ[g/cm³]
0.001
+300
+527
-60
-76
+60
+140
+120
+248
+180
+356
+240
+464
±0
+32
[°C]
T
[°F]
1.1
2.1
1.2
2.2
A0026840
1.1 Liquiphant M; density switch position 0.7 g/cm³
1.2 Liquiphant S; density switch position 0.7 g/cm³
2.1 Liquiphant M; density switch position 0.5 g/cm³
2.2 Liquiphant S; density switch position 0.5 g/cm³
• There is no minimum density for the gas phase. Operation in a vacuum is permitted!
• There is no maximum density for the liquid.
• For more information on the levels of diagnostic coverage, refer to IEC 61508-2:2010
Appendix A.2, Comment 2 and Table A.1.
Buildup (only for minimum detection)
The device may only be used in media that do not tend to cause buildup. Buildup is considered to be
any deposits with a thickness of over 0.5 mm (0.02 in). Buildup can have the effect that the demand
mode of the safety function is not detected and the device will not switch as intended.
Buildup from 0.5 mm (0.02 in) is detected with low diagnostic coverage.
Solid particles - heterogeneous mixtures (only for minimum detection)
The medium may not contain solid particles with a diameter greater than 5 mm (0.2 in). Solid
particles lodged between the tines of the tuning fork can have the effect that the demand mode of
the safety function is not detected and the device will not switch as intended.
Lodged solid particles are detected with low diagnostic coverage.
Hydrogen diffusion (only Liquiphant S - high temperature)
If there is a danger of hydrogen diffusion, the device may not be used if the following conditions
apply simultaneously. Hydrogen entering the device damages the sensor to the extent that the
demand mode of the safety function is not detected and the device does not switch as intended.
• Not over +180 °C (+356 °F) and simultaneously
• Not over 64 bar (928 psi)
The error is not detected by the diagnostics system.