Endress+Hauser Micropilot FMR62 Instructions for use

Products Solutions Services
Functional Safety Manual
Micropilot FMR62
Free space radar for liquids and bulk solids with 4 to 20
mA output signal
FY01055F/00/EN/01.21-00
71555196
2022-01-11
01.00.zz (Device firmware)

Micropilot FMR62
2 Endress+Hauser
Order code:
Ext. ord. cd.:
Ser. no.:
www.endress.com/deviceviewer Endress+Hauser
Operations App
XXXXXXXXXXXX
XXXXX-XXXXXX
XXX.XXXX.XX
Serial number
1.
3.
2.
A0023555

Micropilot FMR62 Table of contents
Endress+Hauser 3
Table of contents
1 Declaration of Conformity ........... 4
1.1 Safety-related characteristic values .......... 5
2 About this document ................ 6
2.1 Document function ..................... 6
2.2 Symbols used .......................... 6
2.2.1 Safety symbols .................. 6
2.2.2 Symbols for certain types of
information and graphics ........... 6
2.3 Supplementary device documentation ........ 7
2.3.1 Further applicable documents ....... 7
2.3.2 Technical Information (TI) ......... 7
2.3.3 Operating Instructions (BA) ......... 7
2.3.4 Brief Operating Instructions (KA) ..... 7
2.3.5 Description of Device Parameters
(GP) .......................... 7
2.3.6 Certificate ...................... 7
3 Design ............................. 8
3.1 Permitted device types ................... 8
3.1.1 Order codes ..................... 8
3.2 Identification marking ................... 9
3.3 Safety function ........................ 9
3.3.1 Safety-related output signal ......... 9
3.3.2 Redundant configuration of multiple
sensors ....................... 10
3.4 Basic conditions for use in safety-related
applications .......................... 10
3.4.1 Safety-related failures according to
IEC / EN 61508 ................. 10
3.4.2 Restrictions for safety-related use ... 11
3.5 Dangerous undetected failures in this
scenario ............................ 11
3.6 Useful lifetime of electric components ...... 11
4 Commissioning (installation and
configuration) .................... 11
4.1 Requirements for personnel .............. 11
4.2 Installation .......................... 12
4.3 Commissioning ....................... 12
4.4 Operation ........................... 12
4.5 Device configuration for safety-related
applications .......................... 12
4.5.1 Calibration of the measuring point ... 12
4.5.2 Configuration methods ........... 12
4.5.3 Locking in "Increased safety mode" ... 13
4.5.4 Locking in Expert mode ........... 14
4.5.5 Unlocking a SIL device ............ 15
4.6 Parameters and default settings for SIL
mode ............................... 16
5 Operation ......................... 19
5.1 Device behavior during power-up .......... 19
5.2 Device behavior in safety function demand
mode ............................... 19
5.3 Behavior of device in the event of an alarm
and warnings ......................... 19
5.4 Alarm and warning messages ............. 19
5.4.1 Exceptions .................... 20
6 Proof testing ...................... 20
6.1 Test sequence A ....................... 21
6.2 Test sequence B ....................... 22
6.3 Test sequence C ....................... 23
6.4 Test sequence D ....................... 24
6.5 Verification criterion ................... 26
7 Repair and error handling .......... 26
7.1 Maintenance ......................... 26
7.2 Repair .............................. 26
7.3 Modification ......................... 27
7.4 Decommissioning ..................... 28
7.5 Disposal ............................ 28
7.6 Battery disposal ...................... 28
8 Appendix ......................... 28
8.1 Structure of the measuring system ......... 28
8.1.1 System components .............. 28
8.1.2 Description of use as a safety
instrumented system ............. 29
8.1.3 Mounting requirements ........... 29
8.2 Commissioning or proof test report ........ 30
8.2.1 Test Report .................... 31
8.3 Version history ....................... 32

Declaration of Conformity Micropilot FMR62
4 Endress+Hauser
1 Declaration of Conformity
A0046346

Micropilot FMR62 Declaration of Conformity
Endress+Hauser 5
1.1 Safety-related characteristic values
A0046347

About this document Micropilot FMR62
6 Endress+Hauser
2 About this document
2.1 Document function
This supplementary Safety Manual applies in addition to the Operating Instructions,
Technical Information and ATEX Safety Instructions. The supplementary device
documentation must be observed during installation, commissioning and operation. The
requirements specific to the protection function are described in this safety manual.
General information on functional safety (SIL) is available at:
www.endress.com/SIL
2.2 Symbols used
2.2.1 Safety symbols
DANGER
This symbol alerts you to a dangerous situation. Failure to avoid this situation will result in
serious or fatal injury.
WARNING
This symbol alerts you to a dangerous situation. Failure to avoid this situation can result in
serious or fatal injury.
CAUTION
This symbol alerts you to a dangerous situation. Failure to avoid this situation can result in
minor or medium injury.
NOTICE
This symbol contains information on procedures and other facts which do not result in
personal injury.
2.2.2 Symbols for certain types of information and graphics
Tip
Indicates additional information
Reference to documentation
Reference to graphic
Notice or individual step to be observed
1.
,
2.
,
3.
Series of steps
Result of a step
1, 2, 3, ...
Item numbers
A, B, C, ...
Views

Micropilot FMR62 About this document
Endress+Hauser 7
2.3 Supplementary device documentation
For an overview of the scope of the associated Technical Documentation, refer to the
following:
•W@M Device Viewer (www.endress.com/deviceviewer): Enter the serial number
from the nameplate
•Endress+Hauser Operations App: Enter the serial number from the nameplate or
scan the matrix code on the nameplate
The following document types are available in the Downloads section of the
Endress+Hauser website (www.endress.com/downloads):
2.3.1 Further applicable documents
• TI01303F
• BA01619F
• KA01252F
• GP01101F
2.3.2 Technical Information (TI)
Planning aid
The document contains all the technical data on the device and provides an overview of
the accessories and other products that can be ordered for the device.
2.3.3 Operating Instructions (BA)
Your reference guide
These Operating Instructions contain all the information that is required in various phases
of the life cycle of the device: from product identification, incoming acceptance and
storage, to mounting, connection, operation and commissioning through to
troubleshooting, maintenance and disposal.
2.3.4 Brief Operating Instructions (KA)
Guide that takes you quickly to the 1st measured value
The Brief Operating Instructions contain all the essential information from incoming
acceptance to initial commissioning.
2.3.5 Description of Device Parameters (GP)
Parameter reference document
The document is part of the Operating Instructions and provides a detailed explanation of
each individual parameter in the operating menu.
2.3.6 Certificate
The associated certificate is available in the Endress+Hauser W@M Device Viewer (
Section 2.3) or can be found in the Declaration of Conformity ( Section 1) of the
applicable Functional Safety Manual. This certificate must be valid at the time of delivery
of the device.

Design Micropilot FMR62
8 Endress+Hauser
3 Design
3.1 Permitted device types
The details pertaining to functional safety in this manual relate to the device versions
listed below and are valid as of the specified firmware and hardware versions.
Unless otherwise specified, all subsequent versions can also be used for safety functions.
A modification process according to IEC 61508 is applied for any device modifications.
Any exemptions from possible combinations of features are saved in the Endress
+Hauser ordering system.
Valid device versions for safety-related use:
3.1.1 Order codes
Feature: 010 "Approval"
Version: all
Feature: 020 "Power supply; output"
Version:
• A: 2-wire; 4-20 mA HART
• B 1): 2-wire; 4-20 mA HART, switch output
• C 2): 2-wire; 4-20 mA HART, 4-20 mA
• K: 4-wire; 90-253 VAC; 4-20 mA HART
Feature: 030 "Display; operation"
Version: all
Feature: 040 "Housing"
Version: all
Feature: 050 "Electrical connection"
Version: all
Feature: 070 "Antenna"
Version: all
Feature: 090 "Seal"
Version: all
Feature: 100 "Process connection"
Version: all
Feature: 500 "Additional operating languages"
Version: all
Feature: 540 "Application package"
Version: all
Feature: 550 "Calibration"
Version: all
Feature: 570 "Service"
Version: all
Feature: 580 "Test; certificate"
Version: all
1) In this version with one current output and one switch output, only the current output (terminals 1 and 2) is approved for safety functions. The
switch output can, if necessary, be wired for non-safety-oriented purposes.
2) In this version with two current outputs, only the first output (terminals 1 and 2) is approved for safety functions. The second output can, if
necessary, be wired for non-safety-oriented purposes.

Micropilot FMR62 Design
Endress+Hauser 9
Feature: 590 "Additional approval"
Version:
• LA 3)
• The "LA" version must be selected for use as a safety function as per IEC 61508.
Feature: 610 "Accessory mounted"
Version: all
Feature: 620 "Accessory enclosed"
Version: all
Feature: 850 "Firmware version"
Version
If no version is selected here, the latest SW with SIL capability is supplied. Alternatively,
the following SW version may be selected:
72: 01.00.zz, HART 7, DevRev01
Valid versions
• Firmware: from 01.00.zz (→ device nameplate)
• Hardware (electronics): from date of manufacture 28 February 2017 (→ device
nameplate)
3.2 Identification marking
SIL-certified devices are marked with the SIL logo on the nameplate.
3.3 Safety function
The device's safety functions are:
• Maximum point level monitoring (overfill protection)
• Minimum point level monitoring (dry running protection)
• Level range monitoring
The safety functions include level measurement of a liquid or bulk solid.
3.3.1 Safety-related output signal
The device's safety-related signal is the analog output signal: 4 to 20 mA. All safety
measures refer exclusively to this signal.
In the case of devices with one current output and one switch output (order code "020",
option "B"), only the current output (terminals 1 and 2) is approved for safety functions.
The switch output (terminals 3 and 4) can, if necessary, be wired for non-safety-oriented
purposes.
In the case of devices with two current outputs (order code "020", option "C"), only the first
current output (terminals 1 and 2) is approved for safety functions. The second output
(terminals 3 and 4) can, if necessary, be wired for non-safety-oriented purposes.
The device additionally communicates for information only via HART and contains all
HART features with additional device information.
The safety-related output signal is fed to a downstream logic unit, e.g. a programmable
logic controller or a limit signal transmitter, where it is monitored to determine whether:
• it exceeds and/or drops below a predefined point level.
• a fault has occurred, e.g. failure current (≤ 3.6 mA, ≥ 21.0 mA, signal cable open circuit
or short-circuit).
3) An additional selection of any additional versions is possible.

Design Micropilot FMR62
10 Endress+Hauser
NOTICE
In an alarm condition
‣Ensure that the equipment under control achieves or maintains a safe state.
3.3.2 Redundant configuration of multiple sensors
This section provides additional information regarding the use of homogeneously
redundant sensors e.g. in 1oo2 or 2oo3 architectures.
The common cause factors ß and ßD indicated in the table below are minimum values for
the device. These must be used when designing the sensor subsystem.
Minimum value ß with homogeneous redundant use 5 %
Minimum value ßD with homogeneous redundant use 2 %
The device meets the requirements for SIL 3 in homogeneously redundant applications.
3.4 Basic conditions for use in safety-related applications
The measuring system must be used correctly for the specific application, taking into
account the medium properties and ambient conditions. Carefully follow instructions
pertaining to critical process situations and installation conditions from the Operating
Instructions. The application-specific limits must be observed. The specifications in the
Operating Instructions and the Technical Information must not be exceeded.
3.4.1 Safety-related failures according to IEC / EN 61508
I [mA]
B
C
A
t
3
31
2
4
A0034924
A HI alarm ≥ 21 mA
B SIL error range ±2%
C LO alarm ≤ 3.6 mA
No device error
• No failure
• Implications for the safety-related output signal:
None (1) and measuring uncertainty is within the specification ( TI, BA, etc.)