Endress+Hauser Micropilot FMR62 Instructions for use

Products Solutions Services
Functional Safety Manual
Micropilot FMR62
Free space radar for liquids and bulk solids with 4 to 20
mA output signal
FY01055F/00/EN/01.21-00
71555196
2022-01-11
01.00.zz (Device firmware)

Micropilot FMR62
2 Endress+Hauser
Order code:
Ext. ord. cd.:
Ser. no.:
www.endress.com/deviceviewer Endress+Hauser
Operations App
XXXXXXXXXXXX
XXXXX-XXXXXX
XXX.XXXX.XX
Serial number
1.
3.
2.
A0023555

Micropilot FMR62 Table of contents
Endress+Hauser 3
Table of contents
1 Declaration of Conformity ........... 4
1.1 Safety-related characteristic values .......... 5
2 About this document ................ 6
2.1 Document function ..................... 6
2.2 Symbols used .......................... 6
2.2.1 Safety symbols .................. 6
2.2.2 Symbols for certain types of
information and graphics ........... 6
2.3 Supplementary device documentation ........ 7
2.3.1 Further applicable documents ....... 7
2.3.2 Technical Information (TI) ......... 7
2.3.3 Operating Instructions (BA) ......... 7
2.3.4 Brief Operating Instructions (KA) ..... 7
2.3.5 Description of Device Parameters
(GP) .......................... 7
2.3.6 Certificate ...................... 7
3 Design ............................. 8
3.1 Permitted device types ................... 8
3.1.1 Order codes ..................... 8
3.2 Identification marking ................... 9
3.3 Safety function ........................ 9
3.3.1 Safety-related output signal ......... 9
3.3.2 Redundant configuration of multiple
sensors ....................... 10
3.4 Basic conditions for use in safety-related
applications .......................... 10
3.4.1 Safety-related failures according to
IEC / EN 61508 ................. 10
3.4.2 Restrictions for safety-related use ... 11
3.5 Dangerous undetected failures in this
scenario ............................ 11
3.6 Useful lifetime of electric components ...... 11
4 Commissioning (installation and
configuration) .................... 11
4.1 Requirements for personnel .............. 11
4.2 Installation .......................... 12
4.3 Commissioning ....................... 12
4.4 Operation ........................... 12
4.5 Device configuration for safety-related
applications .......................... 12
4.5.1 Calibration of the measuring point ... 12
4.5.2 Configuration methods ........... 12
4.5.3 Locking in "Increased safety mode" ... 13
4.5.4 Locking in Expert mode ........... 14
4.5.5 Unlocking a SIL device ............ 15
4.6 Parameters and default settings for SIL
mode ............................... 16
5 Operation ......................... 19
5.1 Device behavior during power-up .......... 19
5.2 Device behavior in safety function demand
mode ............................... 19
5.3 Behavior of device in the event of an alarm
and warnings ......................... 19
5.4 Alarm and warning messages ............. 19
5.4.1 Exceptions .................... 20
6 Proof testing ...................... 20
6.1 Test sequence A ....................... 21
6.2 Test sequence B ....................... 22
6.3 Test sequence C ....................... 23
6.4 Test sequence D ....................... 24
6.5 Verification criterion ................... 26
7 Repair and error handling .......... 26
7.1 Maintenance ......................... 26
7.2 Repair .............................. 26
7.3 Modification ......................... 27
7.4 Decommissioning ..................... 28
7.5 Disposal ............................ 28
7.6 Battery disposal ...................... 28
8 Appendix ......................... 28
8.1 Structure of the measuring system ......... 28
8.1.1 System components .............. 28
8.1.2 Description of use as a safety
instrumented system ............. 29
8.1.3 Mounting requirements ........... 29
8.2 Commissioning or proof test report ........ 30
8.2.1 Test Report .................... 31
8.3 Version history ....................... 32

Declaration of Conformity Micropilot FMR62
4 Endress+Hauser
1 Declaration of Conformity
A0046346

Micropilot FMR62 Declaration of Conformity
Endress+Hauser 5
1.1 Safety-related characteristic values
A0046347

About this document Micropilot FMR62
6 Endress+Hauser
2 About this document
2.1 Document function
This supplementary Safety Manual applies in addition to the Operating Instructions,
Technical Information and ATEX Safety Instructions. The supplementary device
documentation must be observed during installation, commissioning and operation. The
requirements specific to the protection function are described in this safety manual.
General information on functional safety (SIL) is available at:
www.endress.com/SIL
2.2 Symbols used
2.2.1 Safety symbols
DANGER
This symbol alerts you to a dangerous situation. Failure to avoid this situation will result in
serious or fatal injury.
WARNING
This symbol alerts you to a dangerous situation. Failure to avoid this situation can result in
serious or fatal injury.
CAUTION
This symbol alerts you to a dangerous situation. Failure to avoid this situation can result in
minor or medium injury.
NOTICE
This symbol contains information on procedures and other facts which do not result in
personal injury.
2.2.2 Symbols for certain types of information and graphics
Tip
Indicates additional information
Reference to documentation
Reference to graphic
Notice or individual step to be observed
1.
,
2.
,
3.
Series of steps
Result of a step
1, 2, 3, ...
Item numbers
A, B, C, ...
Views

Micropilot FMR62 About this document
Endress+Hauser 7
2.3 Supplementary device documentation
For an overview of the scope of the associated Technical Documentation, refer to the
following:
•W@M Device Viewer (www.endress.com/deviceviewer): Enter the serial number
from the nameplate
•Endress+Hauser Operations App: Enter the serial number from the nameplate or
scan the matrix code on the nameplate
The following document types are available in the Downloads section of the
Endress+Hauser website (www.endress.com/downloads):
2.3.1 Further applicable documents
• TI01303F
• BA01619F
• KA01252F
• GP01101F
2.3.2 Technical Information (TI)
Planning aid
The document contains all the technical data on the device and provides an overview of
the accessories and other products that can be ordered for the device.
2.3.3 Operating Instructions (BA)
Your reference guide
These Operating Instructions contain all the information that is required in various phases
of the life cycle of the device: from product identification, incoming acceptance and
storage, to mounting, connection, operation and commissioning through to
troubleshooting, maintenance and disposal.
2.3.4 Brief Operating Instructions (KA)
Guide that takes you quickly to the 1st measured value
The Brief Operating Instructions contain all the essential information from incoming
acceptance to initial commissioning.
2.3.5 Description of Device Parameters (GP)
Parameter reference document
The document is part of the Operating Instructions and provides a detailed explanation of
each individual parameter in the operating menu.
2.3.6 Certificate
The associated certificate is available in the Endress+Hauser W@M Device Viewer (
Section 2.3) or can be found in the Declaration of Conformity ( Section 1) of the
applicable Functional Safety Manual. This certificate must be valid at the time of delivery
of the device.

Design Micropilot FMR62
8 Endress+Hauser
3 Design
3.1 Permitted device types
The details pertaining to functional safety in this manual relate to the device versions
listed below and are valid as of the specified firmware and hardware versions.
Unless otherwise specified, all subsequent versions can also be used for safety functions.
A modification process according to IEC 61508 is applied for any device modifications.
Any exemptions from possible combinations of features are saved in the Endress
+Hauser ordering system.
Valid device versions for safety-related use:
3.1.1 Order codes
Feature: 010 "Approval"
Version: all
Feature: 020 "Power supply; output"
Version:
• A: 2-wire; 4-20 mA HART
• B 1): 2-wire; 4-20 mA HART, switch output
• C 2): 2-wire; 4-20 mA HART, 4-20 mA
• K: 4-wire; 90-253 VAC; 4-20 mA HART
Feature: 030 "Display; operation"
Version: all
Feature: 040 "Housing"
Version: all
Feature: 050 "Electrical connection"
Version: all
Feature: 070 "Antenna"
Version: all
Feature: 090 "Seal"
Version: all
Feature: 100 "Process connection"
Version: all
Feature: 500 "Additional operating languages"
Version: all
Feature: 540 "Application package"
Version: all
Feature: 550 "Calibration"
Version: all
Feature: 570 "Service"
Version: all
Feature: 580 "Test; certificate"
Version: all
1) In this version with one current output and one switch output, only the current output (terminals 1 and 2) is approved for safety functions. The
switch output can, if necessary, be wired for non-safety-oriented purposes.
2) In this version with two current outputs, only the first output (terminals 1 and 2) is approved for safety functions. The second output can, if
necessary, be wired for non-safety-oriented purposes.

Micropilot FMR62 Design
Endress+Hauser 9
Feature: 590 "Additional approval"
Version:
• LA 3)
• The "LA" version must be selected for use as a safety function as per IEC 61508.
Feature: 610 "Accessory mounted"
Version: all
Feature: 620 "Accessory enclosed"
Version: all
Feature: 850 "Firmware version"
Version
If no version is selected here, the latest SW with SIL capability is supplied. Alternatively,
the following SW version may be selected:
72: 01.00.zz, HART 7, DevRev01
Valid versions
• Firmware: from 01.00.zz (→ device nameplate)
• Hardware (electronics): from date of manufacture 28 February 2017 (→ device
nameplate)
3.2 Identification marking
SIL-certified devices are marked with the SIL logo on the nameplate.
3.3 Safety function
The device's safety functions are:
• Maximum point level monitoring (overfill protection)
• Minimum point level monitoring (dry running protection)
• Level range monitoring
The safety functions include level measurement of a liquid or bulk solid.
3.3.1 Safety-related output signal
The device's safety-related signal is the analog output signal: 4 to 20 mA. All safety
measures refer exclusively to this signal.
In the case of devices with one current output and one switch output (order code "020",
option "B"), only the current output (terminals 1 and 2) is approved for safety functions.
The switch output (terminals 3 and 4) can, if necessary, be wired for non-safety-oriented
purposes.
In the case of devices with two current outputs (order code "020", option "C"), only the first
current output (terminals 1 and 2) is approved for safety functions. The second output
(terminals 3 and 4) can, if necessary, be wired for non-safety-oriented purposes.
The device additionally communicates for information only via HART and contains all
HART features with additional device information.
The safety-related output signal is fed to a downstream logic unit, e.g. a programmable
logic controller or a limit signal transmitter, where it is monitored to determine whether:
• it exceeds and/or drops below a predefined point level.
• a fault has occurred, e.g. failure current (≤ 3.6 mA, ≥ 21.0 mA, signal cable open circuit
or short-circuit).
3) An additional selection of any additional versions is possible.

Design Micropilot FMR62
10 Endress+Hauser
NOTICE
In an alarm condition
‣Ensure that the equipment under control achieves or maintains a safe state.
3.3.2 Redundant configuration of multiple sensors
This section provides additional information regarding the use of homogeneously
redundant sensors e.g. in 1oo2 or 2oo3 architectures.
The common cause factors ß and ßD indicated in the table below are minimum values for
the device. These must be used when designing the sensor subsystem.
Minimum value ß with homogeneous redundant use 5 %
Minimum value ßD with homogeneous redundant use 2 %
The device meets the requirements for SIL 3 in homogeneously redundant applications.
3.4 Basic conditions for use in safety-related applications
The measuring system must be used correctly for the specific application, taking into
account the medium properties and ambient conditions. Carefully follow instructions
pertaining to critical process situations and installation conditions from the Operating
Instructions. The application-specific limits must be observed. The specifications in the
Operating Instructions and the Technical Information must not be exceeded.
3.4.1 Safety-related failures according to IEC / EN 61508
I [mA]
B
C
A
t
3
31
2
4
A0034924
A HI alarm ≥ 21 mA
B SIL error range ±2%
C LO alarm ≤ 3.6 mA
No device error
• No failure
• Implications for the safety-related output signal:
None (1) and measuring uncertainty is within the specification ( TI, BA, etc.)

Micropilot FMR62 Commissioning (installation and configuration)
Endress+Hauser 11
λS (Safe)
• Safe failure
• Implication for the safety-related output signal:
The current measured value is output (2) or adopts the safe state (3) and measuring
uncertainty is within the specified safety measured errors
λDD (dangerous detected)
• Dangerous but detectable failure
• Implication for the safety-related output signal:
Results in a failure mode at the output signal (3) and the measuring uncertainty can
exceed the specified safety measured error.
λDU (dangerous undetected)
• Dangerous and undetectable failure
• Implication for the safety-related output signal:
The current measured value is output (4) and the measuring uncertainty can exceed the
specified safety measured error.
3.4.2 Restrictions for safety-related use
• Information on the safety-related signal
• The following restriction also applies for safety-related use:
• Strong, pulse-like EMC interference on the line can result in transient (< 1 s)
deviations ≥ ±2 % in the output signal. Therefore, filtering with a time constant ≥ 1 s
should be performed in the downstream logic unit.
• The error range is device-specific and is defined according to FMEDA (Failure Modes,
Effects and Diagnostic Analysis) on delivery from the factory. It includes all influential
factors described in the Technical Information (e.g. non-linearity, non-repeatability,
hysteresis, zero drift, temperature drift, EMC influences).
The safety-related failures are classified into different categories according to IEC/EN
61508. The table shows the implications for the safety-related analog output signal
and for measuring uncertainty.
3.5 Dangerous undetected failures in this scenario
An incorrect output signal that deviates from the real measured value by more than 2 %,
but is still in the 4 to 20 mA range, is considered a dangerous, undetected failure.
3.6 Useful lifetime of electric components
The established failure rates of electrical components apply within the useful lifetime as
per IEC 61508-2:2010 section 7.4.9.5 note 3.
According to DIN EN 61508-2:2011 section 7.4.9.5 (national footnote N3) appropriate
measures taken by the operator can extend the useful lifetime.
4 Commissioning (installation and
configuration)
4.1 Requirements for personnel
The personnel for installation, commissioning, diagnostics and maintenance must fulfill
the following requirements:
‣Trained, qualified specialists must have a relevant qualification for this specific function
and task.

Commissioning (installation and configuration) Micropilot FMR62
12 Endress+Hauser
‣Personnel must be authorized by the plant owner/operator.
‣Be familiar with federal/national regulations.
‣Before starting work: personnel must read and understand the instructions in the
manual and supplementary documentation as well as the certificates (depending on
the application).
‣Personnel must follow instructions and comply with general policies.
The operating personnel must fulfill the following requirements:
‣Personnel are instructed and authorized according to the requirements of the task by
the facility's owner-operator.
‣Personnel follow the instructions in this manual.
4.2 Installation
The mounting and wiring of the device and the permitted orientations are described in the
Operating Instructions pertaining to the device.
Correct installation is a prerequisite for safe operation of the device.
4.3 Commissioning
The commissioning of the device is described in the Operating Instructions pertaining to
the device.
Prior to operating the device in a safety instrumented system, verification must be
performed by carrying out a test sequence as described in Section 6 Proof testing.
4.4 Operation
The operation of the device is described in the Operating Instructions pertaining to the
device.
4.5 Device configuration for safety-related applications
4.5.1 Calibration of the measuring point
For more information, see the Operating Instructions.
Check the initial factory setting of the E (zero point) and F (range) parameters according
to the desired measuring range and correct if necessary.
4.5.2 Configuration methods
When using the devices in process control safety systems, the device configuration must
meet two requirements:
• Confirmation concept:
Proven, independent testing of safety-related parameters entered.
• Locking concept:
Locking of the device following parameter configuration (according to IEC 61511-1 :
2016 Section 11.6.3).
To activate the SIL mode, the device must run through an operating sequence, during
which the device can be operated by means of the device display or any asset management
tool (FieldCare, Pactware, AMS, PDM, Field Communicator 375/475, ...) for which
integration is available.

Micropilot FMR62 Commissioning (installation and configuration)
Endress+Hauser 13
Two methods of configuring the device are provided, which differ mainly with regard to
the confirmation concept:
• "Increased safety mode"
While the commissioning sequence is performed, critical parameters which control
functions in the safety path are either set automatically by the device to safe values or
transferred to the display/operating tool via an alternative data format so that the
setting can be checked.
This mode can be used for standard applications. As there are only a few safety-related
parameters which can be freely configured, the risk of operating errors is greatly
reduced, and the level in the vessel does not need to be changed during commissioning
in order to check the settings.
• "Expert mode"
A larger number of safety-related parameters can be freely configured here. This means
that the device can be adapted to difficult applications. However, the settings must be
checked by directly approaching the level in the vessel or by applying a comparable
method.
One method for checking with MAX monitoring is the use of a mechanical rotary
reflector. If a rotary reflector is used, the device must be correctly configured in the
operating menu: Setup → Advanced setup → Level
Set: Max. filling speed liquid = Very fast > 2 m (80 in)/min.
A detailed description of both modes is provided in the following sections.
The SIL commissioning sequence is only visible on the display and in external
operating tools in the case of SIL devices (order code 590, option "LA"). For this
reason, SIL locking can only be activated on these devices.
4.5.3 Locking in "Increased safety mode"
To commission the device, carry out and document the following steps in the order shown:
1. Reset device. This resets all parameters to defined values. Navigate to: "Setup →
Advanced setup → Administration"
 Setting: "Device reset = To factory defaults or To delivery settings"
2. Carry out parameter configuration. The parameter configuration procedure and the
meaning of the individual parameters are described in the Operating Instructions.
Observe the following parameter settings.
3. Perform a "Device check" (for more information, see the Operating Instructions). The
signal quality is checked here and any installation errors are detected. Navigate to:
"Diagnostics → Device check"
 Setting: "Start device check = Yes"
4. Start the SIL/WHG confirmation sequence. Navigate to: "Setup → Advanced setup →
SIL/WHG confirmation".
 Setting: "Set write protection" = enter the corresponding locking code (WHG:
7450; SIL: 7452; SIL and WHG: 7454)
In this way, forbidden parameter changes (e.g. via external operating tools if the
confirmation sequence is performed at the device display) are prevented already
during the SIL/WHG confirmation sequence.

Commissioning (installation and configuration) Micropilot FMR62
14 Endress+Hauser
5. Setting: "Commissioning = Increased safety mode". The device checks the parameter
settings according to the following table and forces the switching of parameters if
necessary. Once testing is finished, "SIL/WHG preparation: Finished" is displayed, and
the commissioning sequence can continue. Press "Next" to confirm.
• If configuration was not performed in accordance with the specifications in point 2,
only "Expert mode" can be selected at this point.
• The commissioning mode must not be changed during the SIL confirmation
sequence. If the wrong mode has been selected, the sequence must be canceled and
started again.
6. Simulate distance values using the "Simulation distance" parameter, and check that
the current output responds as it should. For MIN monitoring and MAX monitoring,
in each case simulate a distance directly above and below the switch point. For range
monitoring, 5 distance values should be simulated which cover the entire measuring
range.
LCAUTION
During distance simulation, the loop current does not correspond to the measured
value.
‣Ensure that this does not pose any danger.
7. Confirm that the distance simulation is correct. To do so, select the "Yes" value for the
"Simulation correct" parameter
8. Compare the character string which is now output ("0123456789+-,.") with the
reference string printed here, and confirm if the value output is correct.
9. The parameters previously configured and which require confirmation are
transferred via an independent data format to the display/operating tool. Check the
parameters one after the other and confirm if correct.
10. Enter the locking code again under "Set write protection" (WHG: 7450; SIL: 7452; SIL
and WHG: 7454). The locking status must be checked after SIL locking: The
parameter "Setup → Advanced setup → Locking status → SIL Locking" must be
confirmed with an "".
11. As an option, hardware locking can also be activated (via the dip switch marked "WP"
on the main electronics).
4.5.4 Locking in Expert mode
To commission the device, carry out and document the following steps in the order shown:
1. Reset device. This resets all parameters to defined values. Navigate to: "Setup →
Advanced setup → Administration"
 Setting: "Device reset = To factory defaults or To delivery settings"
2. Carry out parameter configuration. The parameter configuration procedure and the
meaning of the individual parameters are described in the Operating Instructions.
Observe the following parameter settings.
3. Perform a "Device check" (for more information, see the Operating Instructions). The
signal quality is checked here and any installation errors are detected. Navigate to:
"Diagnostics → Device check"
 Setting: "Start device check = Yes"
4. Start the SIL/WHG confirmation sequence. Navigate to: "Setup → Advanced setup →
SIL/WHG confirmation".
 Setting: "Set write protection" = enter the corresponding locking code (WHG:
7450; SIL: 7452; SIL and WHG: 7454)

Micropilot FMR62 Commissioning (installation and configuration)
Endress+Hauser 15
5. Setting: "Commissioning = Expert mode". The device checks the parameter settings
according to the following table and forces the switching of parameters if necessary.
Once testing is finished, "SIL/WHG preparation: Finished" is displayed, and the
commissioning sequence can continue. Press "Next" to confirm.
The commissioning mode must not be changed during the SIL confirmation sequence.
If the wrong mode has been selected, the sequence must be canceled and started
again.
6. Carry out function test. For MIN and MAX monitoring, at least one level below (MIN
monitoring) or above (MAX monitoring) the switch point must be approached. For
range monitoring, 5 levels should be approached which cover the entire measuring
range. Verify in each case that the response of the current output is correct. If it is not
possible to approach the required level values, a test in accordance with test sequence
D (proof test) can be performed prior to locking. However, this does not detect all
possible errors (e.g. insufficient adjustment). For this reason, we recommend that the
measured values be checked and documented in accordance with test sequence A
(proof test) at a time when the required point levels/levels have been reached.
7. Confirm that the function test has been successful. To do so, select the "Yes" entry for
"Confirm function test".
8. Enter the locking code again under "Set write protection" (WHG: 7450; SIL: 7452; SIL
and WHG: 7454). The locking status must be checked after SIL locking: The
parameter "Setup → Advanced setup → Locking status → SIL Locking" must be
confirmed with an "".
9. As an option, hardware locking can also be activated (via the dip switch marked "WP"
on the main electronics).
For Step 6:
In accordance with IEC 61508-1 : 2010, Section 7.14, this test is part of the "Overall
safety validation" and is the responsibility of the operator.
4.5.5 Unlocking a SIL device
When SIL locking is active on a device, the device is protected against unauthorized
operation by means of a locking code and, as an additional option, by means of a hardware
write protection switch. The device must be unlocked in order to change the configuration,
for proof tests according to test sequence B, test sequence C or test sequence D, and to
reset self-holding diagnostic messages.
LCAUTION
Unlocking the device deactivates diagnostic functions, and the device may not be able
to carry out its safety function when unlocked.
‣Therefore, independent measures must be taken to ensure that there is no risk of
danger while the device is unlocked.
To unlock, proceed as follows:
1. Check the position of the hardware write protection switch (dip switch marked "WP"
on main electronics), and set this switch to "Off".
2. Select the sequence "Setup → Advanced setup → Deactivate SIL/WHG" and enter the
appropriate unlocking code in the "Reset write protection" parameter (WHG: 7450;
SIL: 7452; SIL and WHG: 7454).
The "End of sequence" message indicates that the device was successfully unlocked.

Commissioning (installation and configuration) Micropilot FMR62
16 Endress+Hauser
4.6 Parameters and default settings for SIL mode
The following parameters affect the safety function. However, they may be freely
configured in accordance with the application. In increased safety mode, it is necessary to
confirm the configured values during the remainder of the commissioning process.
Confirmation is not required in expert mode. It is recommended to note down the
configured values!
Setup
• Empty calibration
• Full calibration
• Tank type
Only for liquids
• Bin type
Only for bulk solids
• Max. filling speed solid
Only for bulk solids
• Max. draining speed solid
Only for bulk solids
• Medium group
• Advanced setup → Level → Tank/silo height
The following parameters affect the safety function and are not freely configurable in
increased safety mode. Instead, they are automatically set by the device to the safety-
oriented values mentioned at the start of SIL/WHG confirmation. If these parameters are
to be set to other values, expert mode must be selected.
Setup
• Advanced setup → Level → Level correction
Default value: 0
• Advanced setup → Linearization → Linearization type
Default value: None
• Advanced setup → Current output 1 → Damping output
Default value: 0
Expert
• Sensor → Level → Distance offset
Default value: 0
• Sensor → Level → L max. drain speed
Default value: 0
• Sensor → Level → L max. fill speed
Default value: 0
• Sensor → Level → Level limit mode
Default value: Off
• Sensor → Level → Output mode
Default value: Level linearized
• Sensor → Safety settings → Jump delay echo lost
Default value: Off
• Sensor → Safety settings → Delay time echo lost
Default value: 3 s
• Sensor → Safety settings → Output echo lost
Default value: Alarm
• Sensor → Safety settings → In safety distance
Default value: Alarm
• Sensor → Echo tracking → Evaluation mode
Default value: No history
• Output → Current output 1 → Turn down
Default value: Off
• Output → Current output 1 → Measuring mode
Default value: Standard
• Communication → Configuration → HART address
Default value: 0

Micropilot FMR62 Commissioning (installation and configuration)
Endress+Hauser 17
The following parameters affect the safety function and are automatically adapted by the
device when configuring higher-ranking parameters (known as application parameters). It
is not possible to specify values because the higher-ranking parameters may be user-
configurable. This indirect setting is permitted in increased safety mode. However, it is not
permitted to change the parameters directly. If these parameters were changed directly,
only expert mode is available for selection during SIL/WHG confirmation.
Setup
• Advanced setup → Level → Medium property
• Advanced setup → Level → Max. draining speed liquid
• Advanced setup → Level → Max. filling speed liquid
• Advanced setup → Level → Blocking distance
Expert
• Sensor → Distance → Dead time
• Sensor → Distance → Integration time
• Sensor → Distance → Max. integration time
• Sensor → Distance → Delta at integration time
• Sensor → Safety settings → Echo lost window right
• Sensor → Safety settings → Echo lost window left
• Sensor → Safety settings → Draining speed
• Sensor → Safety settings → Filling speed
• Sensor → Envelope curve → Envelope statistics down
• Sensor → Envelope curve → Envelope statistics up
• Sensor → Envelope curve → FAC offset
• Sensor → Mapping → Map gap
• Sensor → Mapping → End of mapping
• Sensor → Echo fine adjustment → Fine adjustment mode
• Sensor → Tank bottom evaluation → Min. amplitude TBD
• Sensor → Tank bottom evaluation → Lower level area
• Sensor → Echo tracking → Window size tracking
• Sensor → Echo tracking → Maximal track counter
The following parameters affect the safety function and cannot be freely configured in
either the increased safety mode or in the expert mode. Instead they are automatically
changed by the device to the safety-oriented values mentioned at the start of SIL/WHG
confirmation.
"Setup" menu
• Advanced setup → Safety settings → Output echo lost
Default value: Alarm
• Advanced setup → Display → Backlight
Default value: Disable
"Diagnostics" menu
• Simulation → Assign measurement variable
Default value: Off
• Simulation → Current output simulation 1 to 2
Default value: Off
• Simulation → Device alarm simulation
Default value: Off
• Simulation → Diagnostic event simulation
Default value: Off
"Expert" menu
• Sensor → Distance → Velocity filter
Default value: Off
• Output → Current output 1 → Trim
Default value: Off
• Output → Current output 2 → Trim
Default value: Off
• Diagnostics → Simulation → Simulation distance on
Default value: Off

Commissioning (installation and configuration) Micropilot FMR62
18 Endress+Hauser
The following parameters affect the safety function. If the settings differ from the as-
delivered state of the device, only the expert mode can be selected during SIL/WHG
confirmation. It is not possible to specify values because the as-delivered state of the
device depends on the order code.
"Setup" menu
• Advanced setup → Level → Medium type
• Advanced setup → Current output 1 → Current span
• Advanced setup → Current output 2 → Current span
"Expert" menu
• Sensor → Distance → Blocking distance evaluation mode
• Sensor → Envelope curve → Envelope curve statistic
• Sensor → Envelope curve → Envelope smoothing mode
• Sensor → Envelope curve → FAC window size
• Sensor → Envelope curve → Max Value EWC
• Sensor → Sensor properties → Antenna zero distance
• Sensor → Mapping → Mapping Threshold
• Sensor → Mapping → Mapping window size
• Sensor → First echo factor → First echo factor
• Sensor → Echo fine adjustment → Parabolic fit window size
• Sensor → Echo fine adjustment → Edge correction
• Sensor → Tank bottom evaluation → Tank bottom range
• Sensor → Echo tracking → Moving track recognition
The following parameters affect the safety function. If the settings differ from the
permitted values indicated, SIL/WHG confirmation is canceled automatically, and the
device cannot be locked in either the increased safety mode or in the expert mode.
"Setup" menu
• Advanced setup → Current output 1 → Assign current output
• Advanced setup → Current output 1 → Failure mode = Min. or Max.
"Expert" menu
• Output → Current output 1 → Assign current output
• Output → Current output 1 → Start-up mode = Min. or Max.
• Communication → Output → Assign PV
• Those parameters which are not mentioned do not affect the safety function and
can be configured to any meaningful values. The visibility of the parameters
mentioned in the operating menu depends in part on the user role, the SW options
ordered and on the configuration of other parameters.
• In the SIL mode, the device must not be operated in HART-Multidrop mode, as
otherwise the current output will assume a fixed value. For this reason, only the
setting "Expert → Communication → Configuration → HART address = 0" is
permitted in the SIL mode and in the combined SIL/WHG mode when the device is
in the increased safety mode. In pure WHG mode, HART Multidrop is permitted in
the expert mode as long as the HART signal is evaluated in an external switching
unit (e.g. Tank Side Monitor NRF590) that complies with the approval principles as
per WHG.

Micropilot FMR62 Operation
Endress+Hauser 19
5 Operation
5.1 Device behavior during power-up
After SIL locking, additional diagnostics are active and critical parameters in the
safety path are set to safe values. Therefore, the behavior of the device in the "SIL-
locked state" may deviate from the "non-SIL-locked state". If a test phase takes place
before the system is finally put into production, it is recommended that this test phase
be run in the locked state in order to obtain the most conclusive results possible.
Once switched on, the device runs through a diagnostic phase of approx. 30 s. The current
output is set to failure current during this time. For approx. 5 s of the diagnostic phase,
this current is ≤ 3.6 mA. After that, depending on the setting of the "Start-up mode"
parameter, the current is:
• at the MIN value: ≤ 3.6 mA
• at the MAX value: ≥ 21.0 mA
During the diagnostic phase, no communication is possible via the service interface (CDI)
or via HART.
5.2 Device behavior in safety function demand mode
The device outputs a current value corresponding to the limit value to be monitored. This
value must be monitored and processed further in an attached logic unit.
5.3 Behavior of device in the event of an alarm and
warnings
The output current on alarm can be set to a value of ≤ 3.6 mA or ≥ 21.0 mA.
In some cases (e.g. failure of power supply, a cable open circuit and faults in the current
output itself, where it is not possible to set the failure current ≥ 21.0 mA), output currents
≤ 3.6 mA can occur irrespective of the configured failure current.
In other cases (e.g. short circuit of cabling), output currents ≥ 21.0 mA occur irrespective
of the configured failure current.
For alarm monitoring, the downstream logic unit must be able to recognize failure currents
of the upper level for signal on alarm (≥ 21.0 mA) and the lower level for signal on alarm
(≤ 3.6 mA).
5.4 Alarm and warning messages
The behavior of the device in the event of an alarm and warnings is described in the
relevant Operating Instructions.
The error codes are listed in the Operating Instructions.
Additional information is provided by the alarm and warning messages in the form of
error codes and associated plain text messages. The following table shows the correlation
between the error code and the current output:
Error code "Fxxx"
•Current output: ≥ 21.0 mA or ≤ 3.6 mA
• Comment: xxx = three-digit number
Error code "Mxxx"
•Current output: corresponding to measuring mode
• Comment: xxx = three-digit number

Proof testing Micropilot FMR62
20 Endress+Hauser
Error code "Cxxx"
•Current output: corresponding to measuring mode
• Comment: xxx = three-digit number
Error code "Sxxx"
•Current output: corresponding to measuring mode
• Comment: xxx = three-digit number
5.4.1 Exceptions
The error codes are listed in the Operating Instructions.
Error code "M272"
•Current output: ≥ 21.0 mA or ≤ 3.6 mA
• Comment: main electronics error
Error code "C484"
•Current output: ≥ 21.0 mA or ≤ 3.6 mA
• Comment: simulation failure mode
Error code "S942"
•Current output: ≥ 21.0 mA or ≤ 3.6 mA
• Comment: in safety distance
When SIL locking is active on the device, additional diagnostics are activated (e.g. the
output current that is read back is compared with the target value). If one of these
diagnostics results in an error message (e.g. F803 loop current) and SIL locking is
then deactivated, the error message remains while the error persists, even if the
diagnostic is no longer active in the unlocked state. In this case, the device must be
disconnected briefly from the power supply (e.g. by unplugging the terminals). When
the device is then restarted, a self-check is carried out, and the error message is reset
where applicable.
6 Proof testing
The safety-related functionality of the device in the SIL mode must be verified during
commissioning, when changes are made to safety-related parameters, and also at
appropriate time intervals. This enables this functionality to be verified within the
entire safety instrumented system. The time intervals must be specified by the
operator.
LCAUTION
The safety function is not guaranteed during a proof test
Suitable measures must be taken to guarantee process safety during the test.
‣The safety-related output signal 4 to 20 mA must not be used for the protective system
during the test.
‣The operator specifies the testing interval and this must be taken into account when
determining the probability of failure PFDavg of the sensor system.
If no operator-specific proof testing requirements have been defined, the following is a
possible alternative for testing the transmitter depending on the measured variable used
for the safety function. The individual proof test coverages (PTC) that can be used for
calculation are specified for the test sequences described below.
Flexible testing of field devices
NAMUR Worksheet NA106 "Flexible proof testing of field devices in safety instrumented
systems" explains how to optimize testing activities on existing installations.