Endress+Hauser Liquiphant S FDL60 Instructions for use

SD175F/00/EN/09.09
71103335
Functional Safety Manual
Liquiphant S, Nivotester
FDL60/61, FTL670
Level limit measuring system
FTL670
s
Application
Overfill protection or maximum detection of all types of
liquids, to meet the particular requirements for safety-
related systems as per IEC 61508.
The measuring system meets the requirements for
• Functional safety in accordance with IEC 61508
• Explosion protection by intrinsic safety
• Electromagnetic compatibility as per EN 61326 and
NAMUR recommendation NE 21
• Electrical safety in accordance with IEC/EN 61010-1
Your benefits
• For overfill protection up to SIL 3
– independently assessed (Functional Safety
Assessment) by TÜV Süd in accordance with
IEC 61508
• Suitable for liquefied gases according to VdTÜV,
Merkblatt 100
– for tank categories B and C
– no annual recurrent test required
• Permanent self-monitoring
• Error message for circuit break and short-circuit
• Functional test of follow-up devices with press of
button or remote operation
• Monitoring for corrosion on the tuning fork of the
sensor
• No calibration
• Insensitive to external vibration
• Easy commissioning

Liquiphant S, Nivotester
2Endress+Hauser
Table of contents
SIL Declaration of Conformity . . . . . . . . . . . . . . . . . . . 3
General information . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Measuring system design. . . . . . . . . . . . . . . . . . . . . . . 4
System components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Description of use as a protective system . . . . . . . . . . . . . . . . . . . . 4
Permitted device types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Supplementary device documentation . . . . . . . . . . . . . . . . . . . . . . 6
Description of the safety requirements
and boundary conditions . . . . . . . . . . . . . . . . . . . . . . . 7
Safety function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Restrictions for use in safety-related applications . . . . . . . . . . . . . . 7
Functional safety figures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Behavior of device during operation and in case of error . . . . . . . . 9
Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Initial operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Proof-test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Proof-test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Procedure for proof-testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Repair . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Repair . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Appendix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Commissioning or proof-test protocol . . . . . . . . . . . . . . . . . . . . . 15
Technical report . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

Liquiphant S, Nivotester
Endress+Hauser 3
SIL Declaration of Conformity
SIL-03013b

Liquiphant S, Nivotester
4Endress+Hauser
General information
!Note!
General information on functional safety (SIL) is available at:
www.de.endress.com/SIL (German) or www.endress.com/SIL (English) and in the Competence Brochure
CP002Z "Functional Safety in the Process Industry - Risk Reduction with Safety Instrumented Systems".
Measuring system design
System components The measuring system's devices are displayed in the following diagram.
SD175en02
The measuring system consists of the Liquiphant S FDL60 or FDL61 sensor with the FEL67 electronic insert
and Nivotester FTL670 switching unit.
A signal which is dependent on the level is generated in the sensor. This is fed to the switching unit where it
is made available as a fail-safe contact.
Description of use as a
protective system
The tuning fork of the sensor vibrates at its intrinsic resonance frequency. The frequency decreases if the fork
is submersed in liquid. This change in frequency causes the fail-safe contact to change.
The switch point depends on installation. For information on the switch point, please refer to the Operating
Instructions (→ä6, "Supplementary device documentation").
SD175en03
1. Installation from above
2. Installation from the side
"Caution!
The measuring line only works in the overfill protection safety function (MAX safety) using the fail-safe contact!
The fail-safe contact always works in idle current safety; i.e. the contact opens when:
• The switch point is exceeded (level exceeds response height)
• A fault occurs
• The mains voltage fails
FTL670
s
Nivotester
FTL670
Cover
Electronic insert
FEL67
Liquiphant S
(FailSafe)
s*
1. 2.
approx. 5 mm

Liquiphant S, Nivotester
Endress+Hauser 5
In addition to the fail-safe contact, the fault-signalling contact (alarm relay) works as a changeover contact and
goes to idle condition when:
• One of the following faults occurs:
– Fault in the sensor FDL60, FDL61 (e.g. corrosion, electronics fault)
– Fault in data transfer
– Fault in FTL670 limit switch
• The mains voltage fails
!Note!
When the alarm relay changes to idle condition, the fail-safe contact also opens.
!Note!
Correct installation is essential to the safe operation of the device.
The instructions on installation conditions in the Operating Instructions (→ä6, "Supplementary device
documentation") must be followed.
Permitted device types The functional safety assessment described in this manual applies to the device versions listed below.
Unless otherwise indicated, all subsequent versions can also be used for safety functions.
In the event of device modifications, a modification process compliant with IEC 61508 is applied.
Device versions valid for use in safety-related applications:
Nivotester FTL670
The device version is suitable for use in safety-related applications.
Liquiphant S FDL60
Options Designation Version
010 Approval all
020 Process Connection all
025 Fork Surface Finish all
040 Electronics; Output all
050 Housing; Cable Entry all
Liquiphant S FDL61
Options Designation Version
010 Approval all
020 Process Connection all
025 Fork Surface Finish all
030 Probe Length all
040 Electronics; Output all
050 Housing; Cable Entry all

Liquiphant S, Nivotester
6Endress+Hauser
Supplementary device
documentation Liquiphant S FDL60, FDL61
Documentation Contents Note
Technical Information
TI223F/00
–Technicaldata
– Instructions on accessories
– The documentation is available on the
Internet.
→www.endress.com.
Operating Instructions
BA140F/00
–Introduction
– Mounting the Liquiphant S
– Mounting the Nivotester
– Connection
–Start-up
– Maintenance
– Trouble-Shooting
–TechnicalData
– Liquefied Gas: Special Instructions
– The documentation is available on the
Internet.
→www.endress.com.
Compact Instructions
KA030F/00
– Safety and Certificates
– Unpacking and Mounting
– Connection
– The documentation is supplied with
the device.
– The documentation is also available on
the Internet.
→www.endress.com.
Safety instructions
(depending on the selected
"Approval" version)
– Safety, mounting and operating
instructions for devices suitable for
use in hazardous areas or as overfill
protection (German Water
Resources Act).
Additional safety instructions (XA, XB,
XC, ZE, ZD) are supplied with certified
device versions.
Please refer to the nameplate for the
relevant safety instructions..
Nivotester FTL670
Documentation Contents Note
Technical Information
TI223F/00
–Technicaldata
– Instructions on accessories
– The documentation is available on the
Internet.
→www.endress.com.
Operating Instructions
BA140F/00
–Introduction
– Mounting the Liquiphant S
– Mounting the Nivotester
– Connection
–Start-up
– Maintenance
– Trouble-Shooting
–TechnicalData
– Liquefied Gas: Special Instructions
– The documentation is supplied with the
device.
– The documentation is also available on
the Internet.
→www.endress.com.
Compact Instructions
KA031F/00
– Safety and Certificates
– Connection
– Signalling
– The documentation is supplied with the
device.
– The documentation is also available on
the Internet.
→www.endress.com.
Safety instructions
(depending on the selected
"Approval" version)
– Safety, mounting and operating
instructions for devices suitable for
use in hazardous areas or as overfill
protection (German Water
Resources Act).
Additional safety instructions (XA, XB,
XC, ZE, ZD) are supplied with certified
device versions.
Please refer to the nameplate for the
relevant safety instructions..

Liquiphant S, Nivotester
Endress+Hauser 7
Description of the safety requirements
and boundary conditions
Safety function The safety function of the measuring system is maximum level limit monitoring (overfill protection).
Safety-related signal
The safety-related signal is the fail-safe contact:
• The fail-safe contact is closed in the operating state (tuning fork free).
• The fail-safe contact is opened (safe condition) on demand (tuning fork covered) or if a fault occurs.
Restrictions for use in safety-
related applications
The measuring system must be used correctly for the relevant application, taking into account the medium
properties and ambient conditions. The instructions for critical process situations and installation conditions,
as detailed in the Operating Instructions, must be observed.
The specifications in the Operating Instructions (→ä6, "Supplementary device documentation") must not be
exceeded.
Depending on the Nivotester density setting (→ä10, "Installation"), the density of the medium must not
undershoot specific limit values:
• Setting ρ> 0.7 (with jumper):
– All liquids of viscosity up to 2000 mm2/s with density greater than 0.7 g/cm3.
– Viscosities up to 10,000 mm2/s are possible in the case of orientations as per TI223F/00.
• Setting ρ> 0.5 (without jumper):
– All liquids of viscosity up to 2000 mm2/s with density greater than 0.5 g/cm3.
– Viscosities up to 10,000 mm2/s are possible in the case of orientations as per TI223F/00.
– Liquefied gas with density greater than 0.44 g/cm3.

Liquiphant S, Nivotester
8Endress+Hauser
Functional safety figures The table shows the specific figures for functional safety for Liquiphant S + FEL67 + Nivotester FTL670:
Dangerous undetected failures in this scenario:
A dangerous, undetected failure is defined as an incorrect output signal where the tuning fork is covered while
the fail-safe contact is closed.3
Useful lifetime of electrical components:
The established failure rates of electrical components apply within the useful lifetime as per IEC 61508-2,
Section 7.4.7.4. Note 3.
Figures
according to IEC 61508
Value
Liquiphant S + FEL67 Nivotester FTL670 Liquiphant S + FEL67
+ Nivotester FTL670
Safety function MAX Level
SIL 3
HFT 1
Device type B
Mode of operation Low demand mode, High demand mode
SFF 91.4 % 90.1 % 91 %
MTTR 8 h
Recommended
proof-test interval T1
15 years
λsd *2401.4 FIT 179.5 FIT
λsu *283.4 FIT 44.5 FIT
λdd *2401.4 FIT 179.5 FIT
λdu *283.4 FIT 44.5 FIT
λtot *2969.5 FIT 447.9 FIT 1417.4 FIT
β5 % 5 % -
βD2 % 2 % -
PFDavg for T1= 15 years *11.73 × 10-4 9.24 × 10-5 2.66 × 10-4
PFH for T1= 15 years *12.64 × 10-9 1.41 × 10-9 4.04 × 10-9
MTBF *3117 years 254 years 80 years
Diagnostic test interval *430 s
Fault reaction time *53 s
System reaction time *60.5 s with tuning fork covered
1.0 s with tuning fork uncovered
*1The values correspond to SIL 3 as per ISA S84.01.
*2According to Siemens SN29500.
*3According to Siemens SN29500, including faults outside of the safety function.
*4During this time, all diagnostic functions are executed at least once.
*5Time between fault detection and fault reaction.
*6Step response time as per DIN EN 61298-2.

Liquiphant S, Nivotester
Endress+Hauser 9
Behavior of device during
operation and in case of error
Behavior of device during power-up
Once a device has powered up, the output signal can be regarded as safe after 10 seconds.
The fail-safe contact is open during this time.
After this, the device is in normal operation and shows the status of the tuning fork (free/covered).
Behavior of device on demand
Once the level limit to be monitored is reached, the fail-safe contact changes from closed to open within the
system reaction time.
Behavior of device in the event of of faults
Fail-safe contact
The fail-safe contact is open in the event of faults.
Alarm relay
The alarm relay changes to idle condition in the event of faults.
The type of fault is also indicated by an LED on the Nivotester; see Operating Instructions (→ä6,
"Supplementary device documentation").
!Note!
This signaling is simply an additional piece of diagnostic information and does not form part of the safety-related
output signal.

Liquiphant S, Nivotester
10 Endress+Hauser
Installation Installation, wiring and commissioning
Installation, wiring and commissioning of the device is described in the Operating Instructions (→ä6,
"Supplementary device documentation").
SD175en04
* Overvoltage protector HAW560Z and HAW562Z if required
"Caution!
Note the following for Nivotester FTL670:
The operator must use suitable measures (e.g. current limiter, fuse) to ensure the following characteristics for
the fail-safe contact and alarm relay are not exceeded:
•U≤230 V AC, 50/60 Hz , I ≤2.5 A,
P ≤600 VA at cos ϕ = 1.0 or P ≤300 VA at cos ϕ ≥ 0.7 or
•U≤120 V DC, I ≤2.5 A, P ≤75 W
"Caution!
Changes to the measuring system and settings after start-up can impair the protection function!
Orientation
The permitted orientations of the device are described in the Operating Instruction (→ä6, "Supplementary
device documentation").
T
2
dbz
d2
4d4
6
8
10
12 z 12d12
14 z 14d14
16
18 d 18
d32L+
L–
z26
b28
20 b 20
z32
d26
22
24
26
28
30
32
r
U_20...30 V
HAW *
HAW *
Liquiphant S
FDL60, FDL61
Nivotester
FTL670
12
–+
FEL67
Explosion hazardous area
Density setting
Safety contact
Power supply
Stop filling
Test (Reset)
Fault indication
without jumper
rgreater than
0.5 and with
liquefied gas
rgreater than
0.7
with jumper
Safe area
Alarm relay
Signal line

Liquiphant S, Nivotester
Endress+Hauser 11
Initial operation When operated for the first time, the function of the entire system can be checked by raising the level in the
tank to the limit value. Pressing the "test" key on Nivotester FTL670 is sufficient for the functional test of the
follow-up devices (→ä13, "Flow diagram").
In Germany, specific regulations must be observed for the functional test of an overfill protection system.
Note the relevant information in the certificates.
Maintenance Please refer to the relevant Operating Instructions for instructions on maintenance (→ä6, "Supplementary
device documentation").
Alternative monitoring measures must be taken to ensure process safety during proof-testing and maintenance
work on the device.
Proof-test
Proof-test Safety functions must be tested at appropriate intervals to ensure that they are functioning correctly and are
safe. The time intervals must be defined by the operator.
Proof-testing of the device can be performed using one of the following procedures:
– Approaching the level (→Test procedure A).
– Removing and immersing in a medium of comparable density and viscosity (→Test procedure B).
– Simulation at the Nivotester by activating the "test" key (→Test procedure C).
In addition, checks must be carried out to ensure that all cover seals and cable entries are sealing correctly.
Procedure for proof-testing Preparation:
Connect a suitable measuring device (e.g. Multimeter, downstream plant sections etc.) to display the function
of the fail-safe contact.
Test procedure A
Procedure when it is possible to approach the level:
1. The tuning fork must be free. If necessary, reduce the level and wait 10 seconds.
2. Check is the LED for permanent self-monitoring flashing (→ä13, "Flow diagram")?
– No: fault in the Liquiphant or Nivotester.
– Yes: make a note of the initial status of the fail-safe contact (open/closed).
3. Check is the fail-safe contact closed?
– No: fault in the Liquiphant or Nivotester.
– Yes: dampen the tuning fork by approaching the level.
4. Make a note of the second status of the fail-safe contact (open/closed).
5. Check is the fail-safe contact open?
– No: fault in the Liquiphant or Nivotester.
– Yes: remove damping from the tuning fork: reduce the level.
6. Make a note of the third status of the fail-safe contact (open/closed).
7. Check is the fail-safe contact closed?
– No: fault in the Liquiphant or Nivotester.
– Yes: the test is successful and normal operation is resumed.
!Note!
With this type of test, the entire safety path from the tuning fork to the fail-safe contact is checked!
For troubleshooting, →Operating Instructions (→ä6, "Supplementary device documentation"),
Section "Troubleshooting".

Liquiphant S, Nivotester
12 Endress+Hauser
Test procedure B
Procedure when it is not possible to approach the level but the device can be removed:
1. Remove the Liquiphant electrically and mechanically.
2. Connect the Liquiphant to the Nivotester electrically.
3. Wait 10 seconds. (The tuning fork must be free).
4. Check is the LED for permanent self-monitoring flashing (→ä13, "Flow diagram")?
– No: fault in the Liquiphant or Nivotester.
– Yes: make a note of the initial status of the fail-safe contact (open/closed).
5. Check is the fail-safe contact closed?
– No: fault in the Liquiphant or Nivotester.
– Yes: dampen the tuning fork by immersing it in the medium.
6. Make a note of the second status of the fail-safe contact (open/closed).
7. Check is the fail-safe contact open?
– No: fault in the Liquiphant or Nivotester.
– Yes: remove damping: the tuning fork must be free.
8. Install the Liquiphant and check electrical and mechanical installation.
9. Make a note of the third status of the fail-safe contact (open/closed).
10. Check is the fail-safe contact closed?
– No: fault in the Liquiphant or Nivotester.
– Yes: the test is successful and normal operation is resumed.
!Note!
With this type of test, the entire safety path from the tuning fork to the fail-safe contact is checked!
For troubleshooting, →Operating Instructions (→ä6, "Supplementary device documentation"),
Section "Troubleshooting".
If necessary, the accuracy of the switch point can also be checked, →Operating Instructions, Section
"Mounting the Liquiphant S".
Test procedure C
!Note!
At the time of the test, ensure that the tuning fork is free!
Procedure when it is not possible to approach the level and the device cannot be removed:
1. Make a note of the initial status of the fail-safe contact (open/closed).
2. Check is the fail-safe contact closed?
– No: fault in the Liquiphant or Nivotester.
– Yes: press the "test" key (using tool) (→ä13, "Flow diagram"). Do not release!
3. Check does the device respond to keypress?
– No: fault in the Nivotester.
– Yes: all LEDs lit (→ä13, "Flow diagram").
4. Make a note of the second status of the fail-safe contact (open/closed).
5. Check is the fail-safe contact open?
– No: fault in the Liquiphant or Nivotester.
– Yes: release the "test" key.
6. Check does the test procedure run correctly (→ä13, "Flow diagram")?
– No: fault in the Liquiphant or Nivotester.
– Yes: make a note of the third status of the fail-safe contact (open/closed).
7. Check is the fail-safe contact closed?
– No: fault in the Liquiphant or Nivotester.
– Yes: the test is successful and normal operation is resumed.
!Note!
With this type of test, the entire safety path is not checked! The tuning fork is only included in test procedures
A or B.
For troubleshooting, →Operating Instructions (→ä6, "Supplementary device documentation"),
Section "Troubleshooting".

Liquiphant S, Nivotester
Endress+Hauser 13
SD175en05
Flow diagram of function test
1) lit: fault in sensor
2) lit: fault in data transfer
3) lit: fault in Nivotester
4) flashing: permanent self-monitoring
5) lit: level below maximum
6) lit: level alarm
7) "test" key
8) lit: fault; unlit: normal operation
!Note!
If one of the test criteria from the test sequences described above is not fulfilled, the device may no longer be
used as part of a safety instrumented system.
The purpose of proof-testing is to detect random device failures. The impact of systematic errors on the safety
function is not covered by this test and must be assessed separately.
Systematic errors can be caused, for example, by process material properties, operating conditions, buildup or
corrosion.
z26
d26
b28
d18
b20
d18
b20
FTL670
s
z26
d26
b28
s
*
*
012345678
1)
6)
2)
5)
3)
8)
7)
4)
yellow
yellow
yellow
yellow
green
red
red
Test key pressed
Level alarm relay de-energised
Fault alarm relay de-energised
energised
Time
energised
Test key released

Liquiphant S, Nivotester
14 Endress+Hauser
Repair
Repair All repairs to the devices must be carried out by Endress+Hauser only.
Safety functions cannot be guaranteed if repairs are carried out by anybody else.
Exception:
The customer is permitted to replace the electronic insert if the member of staff responsible has been trained
by Endress+Hauser to do so.
The replaced electronic insert must be sent to Endress+Hauser for fault analysis.
Once the electronic insert has been replaced, proof-testing must be carried out.
In the event of failure of a SIL-labeled Endress+Hauser device, which has been operated in a protection
function, the "Declaration of Contamination and Cleaning" with the corresponding note "Used as SIL device in
protection system" must be enclosed when the defective device is returned. Available at:
www.de.endress.com/dekontamination.

Liquiphant S, Nivotester
Endress+Hauser 15
Appendix
Commissioning or
proof-test protocol
SD175en06
System-specific data
Device-specific commissioning parameters
Company
Measuring points / TAG no.
System
Device type / Order code
Serial number of device
Name
Date
Signature
Medium
(density and viscosity)
Proof-test protocol
Test procedure
Please check:
Test stage
1. Is the LED for permanent
self-monitoring flashing?
2. Initial status of the fail-safe contact?
3. Second status of the fail-safe contact?
4. Is the test procedure running correctly?
5. Third status of the fail-safe contact?
Result: Proof test passed:
flashing
closed
open
–
closed
–
closed
open
yes
closed
Result:
OK / unsuccessful
A
Approach
level
1., 2., 3., 5.
=OK
Set point Actual
value
B
Remove
device
C
Simulation
2., 3., 4., 5.
=OK

Liquiphant S, Nivotester
16 Endress+Hauser
Technical report
ManagementSummary
ManagementSummary

Liquiphant S, Nivotester
Endress+Hauser 17
ManagementSummary
ManagementSummary

Liquiphant S, Nivotester
18 Endress+Hauser
ManagementSummary
ManagementSummary

Liquiphant S, Nivotester
Endress+Hauser 19
ManagementSummary
ManagementSummary

Liquiphant S, Nivotester
20 Endress+Hauser
Certificate
TUEV_Z10 03 11 20351 002 en