Endress+Hauser Proline Prosonic Flow P 500 Instructions for use

Products Solutions Services
Functional Safety Manual
Proline Prosonic Flow P 500
Ultrasonic time-of-flight flowmeter
HART
FY02647D/06/EN/01.21
71510592
2021-05-10
Valid as of version
01.01.zz (Device firmware)

Proline Prosonic Flow P 500 HART Table of contents
Endress+Hauser 3
Table of contents
1 Manufacturer's Declaration .... 4
1.1 Safety-related characteristic values ..... 5
2 About this document ........... 7
2.1 Document function ................... 7
2.2 Using this document .................. 7
2.3 Symbols ............................ 7
2.4 Supplementary device documentation ... 8
3 Permitted device types ......... 9
3.1 SIL label on the nameplate ........... 10
4 Safety function ................ 10
4.1 Definition of the safety function ....... 10
4.2 Restrictions for use in safety-related
applications ........................ 12
5 Use in protective systems ..... 17
5.1 Device behavior during operation ...... 17
5.2 Parameter configuration for safety-
related applications ................. 18
5.3 Proof testing ....................... 26
6 Life cycle ....................... 38
6.1 Requirements for the personnel ....... 38
6.2 Installation ........................ 38
6.3 Commissioning ..................... 38
6.4 Operation ..........................39
6.5 Maintenance ....................... 39
6.6 Repair ............................. 39
6.7 Modification ....................... 39
6.8 Decommissioning ................... 40
7 Appendix ...................... 40
7.1 Structure of the measuring system ..... 40
7.2 Verification or calibration ............ 41
7.3 Notes on the redundant use of multiple
sensors ............................ 41
7.4 Version history ..................... 42

Manufacturer's Declaration Proline Prosonic Flow P 500 HART
4 Endress+Hauser
1 Manufacturer's Declaration
A0045946-EN

Proline Prosonic Flow P 500 HART Manufacturer's Declaration
Endress+Hauser 5
1.1 Safety-related characteristic values
General
Device designation and permitted
versions
9P5B (Prosonic Flow P 500)
Order code for "Output; input 1":
Option BA "4-20mA HART"
Order code for "Output; input 2":
All options
Order code for "Output; input 3":
All options
Order code for "Additional approval":
Option LA "SIL"
Safety-related output signal 4 to 20 mA (output; input 1)
Failure current ≤ 3.6 mA or ≥ 21 mA
Assessed measured variable/
function
Volume flow monitoring
Safety function(s) Min., Max., Range
Device type according to IEC
61508-2
 Type A  Type B
Mode  Low Demand Mode  High Demand Mode  Continuous Mode 1)
Valid hardware version (main
electronics)
From delivery date May 10, 2021
Valid firmware version 01.01.zz and higher (HART; from delivery date May 10, 2021)
Safety manual FY02647D
Type of assessment
(only 1 version can be selected)
 Complete HW/SW assessment in the context of development including
FMEDA and change process according to IEC 61508-2, 3
 Assessment of evidence for proven-in-use HW/SW including FMEDA and
change process according to IEC 61508-2, 3
 Analysis of HW/SW field data for evidence of "prior use" according to IEC
61511
 Assessment by FMEDA according to IEC 61508-2 for devices without software
Test documents Development documents, test reports, data sheets
1) No continuous operation as per IEC 61508: 2011 (section 3.5.16)
SIL integrity
Systematic safety integrity  SIL 2 capability  SIL 3 capability

Manufacturer's Declaration Proline Prosonic Flow P 500 HART
6 Endress+Hauser
Hardware safety integrity Single-channel service
(HFT = 0)
 SIL 2 capability  SIL 3 capability
Multi-channel service
(HFT ≥ 1)
 SIL 2 capability  SIL 3 capability
FMEDA
Safety function(s) Min., Max., Range
λDU 1) 268 FIT
λDD 1) 4062 FIT
λSU 1) 2736 FIT
λSD 1) 4605 FIT
SFF - Safe Failure Fraction 97 %
PFDavg for T1 = 1 year 2) (single-channel architecture) 11.8 · 10-4
PFH 1.4 · 10-7
PTC 3) Up to 99 %
MTBFtot 4) 60 years
Diagnostic test interval 5) 30 min
Fault response time 6) 30 s
Recommended test interval T11 year
1) FIT = Failure In Time, number of failures per 109 h
2) Valid for averaged ambient temperatures up to 40 °C (104 °F) in accordance with the general standard for devices
with SIL capability.
3) PTC = Proof Test Coverage (diagnostic coverage achieved by device failure detection during manual proof testing)
4) This value takes into account all failure types of the electronic components as per Siemens SN29500
5) All diagnostic functions are executed at least once during this time. For operation in high demand mode
according to IEC 61508, the safe use of the devices is limited to a safety function demand rate of ≤ 1/50 h.
6) Maximum time between fault detection and fault response.
Note
The measuring device has been developed for use in "Low Demand" and "High Demand" mode.
Explanation
Our in-house quality management system saves information on safety-related systematic errors that will become
known in the future.

Proline Prosonic Flow P 500 HART About this document
Endress+Hauser 7
2 About this document
2.1 Document function
The document is part of the Operating Instructions and serves as a reference for application-
specific parameters and notes.
• General information about functional safety: SIL
• General information about SIL is available:
In the Downloads area of the Endress+Hauser website: www.endress.com/SIL
2.2 Using this document
2.2.1 Information on the document structure
Additional information regarding:
• The arrangement of the parameters, along with a short description, according to the
Operation menu, Setup menu, Diagnostics menu: Operating Instructions
• Operating concept: Operating Instructions
2.3 Symbols
2.3.1 Safety symbols
DANGER
This symbol alerts you to a dangerous situation. Failure to avoid this situation will result in
serious or fatal injury.
WARNING
This symbol alerts you to a dangerous situation. Failure to avoid this situation can result in
serious or fatal injury.
CAUTION
This symbol alerts you to a dangerous situation. Failure to avoid this situation can result in
minor or medium injury.
NOTICE
This symbol contains information on procedures and other facts which do not result in
personal injury.
2.3.2 Symbols for certain types of information
Symbol Meaning
Permitted
Procedures, processes or actions that are permitted.
Forbidden
Procedures, processes or actions that are forbidden.
Tip
Indicates additional information.

About this document Proline Prosonic Flow P 500 HART
8 Endress+Hauser
Symbol Meaning
Reference to documentation
A
Reference to page
Reference to graphic
Notice or individual step to be observed
1.
,
2.
,
3.
… Series of steps
Result of a step
A0028662
Operation via local display
A0028663
Operation via operating tool
A0028665
Write-protected parameter
2.3.3 Symbols in graphics
Symbol Meaning
1, 2, 3 ... Item numbers
A, B, C, ... Views
A-A, B-B, C-C, ... Sections
2.4 Supplementary device documentation
For an overview of the scope of the associated Technical Documentation, refer to the
following:
•W@M Device Viewer (www.endress.com/deviceviewer): Enter the serial number from
nameplate
•Endress+Hauser Operations App: Enter the serial number from the nameplate or scan
the 2D matrix code (QR code) on the nameplate
This Special Documentation is available:
In the Download Area of the Endress+Hauser Internet site: www.endress.com →
Downloads
This documentation is an integral part of the following Operating Instructions:

Proline Prosonic Flow P 500 HART Permitted device types
Endress+Hauser 9
Measuring device Documentation code
Prosonic Flow P 500 BA02025D
3 Permitted device types
The details pertaining to functional safety in this manual relate to the device versions listed
below and are valid as of the specified software and hardware versions. Unless otherwise
specified, all subsequent versions can also be used for safety functions. A modification process
according to IEC 61508 is applied for any device modifications.
Feature Designation Option selected
– Order code 9P5B (Prosonic Flow P 500)
000 Mounting type All
010 Approval; transmitter; sensor All
015 Power supply All
020 Output; input 1 1) • Option BA "4-20mA HART"
• Option CA "4-20mA HART Ex-i passive"
• Option CC "4-20mA HART Ex-i active"
021 Output; input 2 All
022 Output; input 3 All
030 Display; Operation All
035 Integrated ISEM electronics All
041 Transmitter housing All
050 Electrical connection All
060 sensor version All
065 Process temperature All
066 Cables All
070 Installation set All
480 Device model All
500 Display operating language All
520 Sensor option All
530 Customer-specific configuration All
540 Application package All
570 Service All
580 Test, certificate All
590 Additional approval LA (= SIL) 2)

Safety function Proline Prosonic Flow P 500 HART
10 Endress+Hauser
Feature Designation Option selected
610 Accessory mounted All
620 Accessory enclosed All
850 Firmware version Firmware with SIL capability, e.g. 01.01.zz (HART)
895 Marking All
1) In devices with several outputs, only current output 1 (terminals 26 and 27) is suitable for safety functions. The
other outputs can, if necessary, be connected for non-safety-oriented purposes.
2) Additional selection of further approvals is possible.
3.1 SIL label on the nameplate
Order code:
Ser. no.:
Ext. ord. cd.:
ii
Date:
1
A0031473
1 SIL logo
4 Safety function
4.1 Definition of the safety function
The measuring device's permitted safety functions are:
Monitoring of a maximum or minimum volume flow or a volume flow range for liquid media
4.1.1 Safety-related output signal
The measuring device's safety-related signal is the 4–20 mA analog output signal (output;
input 1). All safety measures refer to this signal exclusively.

Proline Prosonic Flow P 500 HART Safety function
Endress+Hauser 11
In devices with several outputs, only current output 1 (terminals 26 and 27) is suitable for
safety functions. The other outputs can, if necessary, be connected for non-safety-oriented
purposes.
The safety-related output signal is fed to a downstream automation system where it is
monitored for the following:
• Overshooting and/or undershooting of a specified limit value for the volume flow
• The occurrence of a fault: e.g. failure current (≤ 3.6 mA, ≥ 21 mA), interruption or short-
circuit of the signal line
The safety-related errors are broken down in accordance with IEC/EN 61508 into different
categories and implications for the safety-related output signal.
Safety related
error
Explanation Position→  12 Implication for safety-related output
signal
No device error Safe:
No error
1 Within specification
λSD Safe detected:
Safe, detectable failure present
3 Device assumes a signal on alarm
λSU Safe undetected:
Safe, undetectable failure present
2 Is within the specified tolerance range
λDD Dangerous detected:
Dangerous but detectable failure
present (diagnosis in device)
3 Device assumes a signal on alarm
λDU Dangerous undetected:
Dangerous, undetectable failure
present
4 May be outside the specified tolerance
range

Safety function Proline Prosonic Flow P 500 HART
12 Endress+Hauser
I [mA]
B
C
A
t
3
31
2
4
A0034924
A Failure current ≥ 21 mA
B Measuring uncertainty
C Failure current ≤ 3.6 mA
4.2 Restrictions for use in safety-related applications
1. The measuring device must be used correctly for the specific application, taking into
account the medium properties and ambient conditions.
2. Carefully follow safety instructions pertaining to critical process situations and
installation conditions, which can be found in the device documentation.
3. Observe application-specific limits.
4. Do not exceed technical specifications of measuring device.
Information on the safety-related signal →  10
For detailed information on the technical specifications, see the device documentation
→  8.
4.2.1 Dangerous undetected failures in this scenario
An incorrect output signal that deviates from the value specified in the Operating Instructions
but is still in the range of 4 to 20 mA, is considered a dangerous, undetected failure.
Information on measured error→  14
For detailed information on the maximum measured error, see the Operating
Instructions.

Proline Prosonic Flow P 500 HART Safety function
Endress+Hauser 13
4.2.2 Useful lifetime of electric components
The established failure rates of electrical components apply for a useful lifetime of 12 years as
per IEC 61508-2: 2010, section 7.4.9.5, note 3.
The device's year of manufacture is coded in the first character of the serial number (→ table
below).
Example: serial number L5ABBF02000 → year of manufacture 2016
ASCII character Meaning ASCII character Meaning ASCII character Meaning
D 2010 K 2015 R 2020
E 2011 L 2016 S 2021
F 2012 M 2017 T 2022
H 2013 N 2018 V 2023
J 2014 P 2019 W 2024
4.2.3 Suitability of the measuring device
1. Carefully select the frequency of the sensor set in accordance with the application's
expected flow rates.
 The maximum flow rate during operation must not exceed the specified maximum
value for the sensor.
2. In safety-related applications, it is advisable to select the limit value for monitoring a
minimum flow such that this limit is at least twice the smallest specified flow that can
still be measured, with the actual medium.
 For further information, see the Technical Information
3. The sound velocity of the medium must be in the 600 to 2 100 m/s range.
4. The additional measuring uncertainties in the event of an error apply for
Reynolds numbers > 10000. SIL mode is not recommended for
Reynolds numbers < 10000.

Safety function Proline Prosonic Flow P 500 HART
14 Endress+Hauser
NOTICE
Use the measuring device according to the specifications.
‣Pay attention to the medium properties and the environmental conditions.
‣Carefully follow instructions pertaining to critical process situations and installation
conditions.
Detailed information on:
• Installation
• Electrical connection
• Medium properties
• Environment
• Process
Operating Instructions and Technical Information
Further information on the suitability of the measuring device for safety-related
operation is available from your Endress+Hauser sales center.
4.2.4 Information on measured errors
When the measured value is transmitted via the 4–20 mA current output, the measuring
device's relative measured error is made up of the contribution of the digitally determined
measured value and the accuracy of the analog current output. These contributions, which are
listed in the device documentation, apply under reference operating conditions and can
depend on the sensor version ordered.
The measured error of the digitally determined measured value comprises the measured error
of the measuring device and an additional, installation-specific measured error that is
independent of the measuring device.
The device's measured error is:
Nominal diameter Measuring device error limits
[mm] [in]
15 ½ ±0.5 % o.r. ± 5 mm/s (0.20 in/s)
25 to 200 1 to 8 ±0.5 % o.r. ± 7.5 mm/s (0.30 in/s)
> 200 > 8 ±0.5 % o.r. ± 3 mm/s (0.12 in/s)
For detailed information on the maximum measured error, see the Operating Instructions
→  9

Proline Prosonic Flow P 500 HART Safety function
Endress+Hauser 15
The installation-specific measured error depends on the installation conditions on site, such
as the nominal diameter, wall thickness, real pipe geometry or medium. The maximum
installation-specific measured error is:
Nominal diameter Installation-specific error limits
[mm] [in]
15 ½ ±16.12 % o.r.
25 1 ±10.50 % o.r.
40 1½ ±7.17 % o.r.
50 2 ±6.22 % o.r.
65 2½ ±6.67 % o.r.
80 3 ±6.08 % o.r.
100 4 ±5.48 % o.r.
150 6 ±4.91 % o.r.
200 8 ±4.69 % o.r.
300 12 ±4.45 % o.r.
400 16 ±4.42 % o.r.
500 20 ±4.37 % o.r.
600 24 ±4.33 % o.r.
1000 40 ±4.05 % o.r.
2000 80 ±3.92 % o.r.
3000 120 ±3.88 % o.r.
4000 160 ±3.86 % o.r.
The determined installation-specific measured error covers the following application
scenarios:
Pipe geometry In accordance with ASME B36.10M-2015
Deviation of the entry for the measuring pipe
outer diameter
Max. ±1 % or min. ±0.5 mm (±0.02 in)
(average tolerance class D2/T3 as per DIN EN ISO 1127)
Deviation of the entry for the measuring pipe
wall thickness
Max. ±10 %
(average tolerance class D2/T3 as per DIN EN ISO 1127)
Deviation of the sensor distance • DN 15 to 65 (½ to 2½"): max. ±1 mm (±0.04 in)
• DN 80 to 200 (3 to 8"): max. ±2 mm (±0.08 in)
• DN 300 to 4000 (12 to 160"): max. ±1 % of outer diameter
Number of traverses • DN 25 to 600 (1 to 24"): 2 traverses
• DN 1000 to 4000 (40 to 160"): 1 traverse

Safety function Proline Prosonic Flow P 500 HART
16 Endress+Hauser
The current sound velocity of the medium must not deviate significantly from the sound
velocity during installation. This deviation is a contributing factor in determining the
installation status displayed in the device (Setup → Installation status → Installation status).
The installation status Good is required for SIL mode. SIL mode is not recommended if the
installation status is Acceptable or Bad. In this case, the measuring device must be installed
again to take account of the current process conditions.
The measured errors indicated apply for Reynolds numbers > 10 000 and
flow velocity rates > 0.3 m/s (1 ft/s).
SIL mode is not recommended for Reynolds numbers < 10000 or
flow velocity rates < 0.3 m/s (1 ft/s).
For further information on calculating the measured error, see the Technical
Information.
4.2.5 Power supply to the 4–20 mA current output
Overvoltages at the 4–20 mA current output (passive, output; input 1) - caused by a fault in
the supply unit, for example - can result in a leak current in the device's input protection unit.
This may lead to falsification of the output signal by more than the specified error or the
minimum failure current (3.6 mA) can no longer be set due to the leak current.
‣Use a 4–20 mA power supply unit with either voltage limitation or voltage monitoring.
NOTICE
The safety-related connection values depend on the Ex approval.
‣Pay attention to the safety-related connection values.
For detailed information on the connection values, see the Safety Instructions.
4.2.6 HART communication
The measuring device also communicates via HART or WirelessHART in the SIL mode. This
comprises all the HART features with additional device information.
NOTICE
The measuring device's safety-related signal is the 4–20 mA analog output signal
(output; input 1).
All safety measures refer to this signal exclusively.
‣Please note the following: →  10.
NOTICE
When the SIL locking code is entered, the device parameters that affect the safety-
related output signal are locked and write-protected. It is still possible to read the
parameters.
When SIL locking is enabled, restrictions apply on all communication options, such as the
service interface (CDI-RJ45), HART protocol and WirelessHART protocol, local display and
WLAN.
‣Deactivation of the SIL mode →  25.

Proline Prosonic Flow P 500 HART Use in protective systems
Endress+Hauser 17
5 Use in protective systems
5.1 Device behavior during operation
5.1.1 Device behavior during power-up
Once switched on, the device runs through a start-up phase. The current output is set to
failure current during this time. This current is ≤ 3.6 mA in the initial seconds of this start-up
phase.
No communication with the device is possible via the interfaces during the start-up phase.
After the start-up phase the device switches to the normal mode (measuring operation).
5.1.2 Behavior of device during operation
The device outputs a current value which corresponds to the measured value to be monitored.
This value must be monitored and processed further in an attached automation system.
5.1.3 Device behavior in safety function demand mode
Depending on the setting of the Failure mode parameter, the current is as follows in demand
mode:
• For Min. option: ≤ 3.6 mA
• For Max. option: ≥ 21 mA
5.1.4 Device behavior in event of alarms and warnings
The output current on alarm can be set to a value ≤ 3.6 mA or ≥ 21 mA.
In some cases (e.g. a cable open circuit or faults in the current output itself, where it is not
possible to set the failure current ≥ 21 mA) output currents of ≤ 3.6 mA occur irrespective of
the configured failure current.
In some other cases (e.g. short circuit of cabling), output currents of ≥ 21 mA occur
irrespective of the configured failure current.
For alarm monitoring, the downstream automation system must be able to recognize both
maximum alarms (≥ 21 mA) and minimum alarms (≤ 3.6 mA).
5.1.5 Alarm and warning messages
Additional information is provided by the alarm and warning messages output in the form of
diagnostic events and associated event texts.
NOTICE
A diagnostic message is displayed even though the diagnostic event is no longer active in
the unlocked SIL mode.
When SIL mode is activated, additional diagnostics are activated. If a diagnostic event is
pending and the locked SIL mode is deactivated, the diagnostic message remains as long as
the error is still present.
‣In this case, the device must be disconnected briefly from the power supply .
‣When the device is then restarted, a self-check is carried out, and the diagnostics event is
reset where applicable.

Use in protective systems Proline Prosonic Flow P 500 HART
18 Endress+Hauser
This behavior occurs in the case of the following diagnostic messages:
803 Current loop diagnostic message
5.2 Parameter configuration for safety-related applications
5.2.1 Configuring the parameters of the measuring point
The measuring point is calibrated via the operating interfaces. A wizard guides you
systematically through all the submenus and parameters that have to be set for configuring
the measuring device.
For detailed information on the operating options, see the Operating Instructions.
For detailed information on configuring the measuring device, see the Operating
Instructions and Description of Device Parameters
To activate the SIL mode, the device must run through a confirmation sequence. While
running through this sequence, critical parameters are either set automatically by the device
to standard values or transferred to the local display/operating tool to enable verification of
the setting. On completion of parameter configuration, the SIL mode of the device must be
enabled with a SIL locking code.
Availability of the SIL mode function
NOTICE
The SIL confirmation sequence is only visible on the local display and in the operating
tools for devices with the order code for "Additional approval", option LA "SIL".
‣For this reason, the SIL mode can also only be activated on these measuring devices.
‣If the LA "SIL" option was ordered for the flowmeter ex works, this option is available when
the measuring device is delivered to the customer. Access is via the operating interfaces of
the measuring device.
‣If the order option cannot be accessed in the measuring device, the function cannot be
retrofitted during the life cycle of the device. If you have any questions please contact your
Endress+Hauser service or sales organization.
Ways to check function availability in the measuring device:
Using the serial number:
W@M Device viewer 1) → Order code for "Additional approval", option LA "SIL"
Detailed information concerning the SIL label:
• Permitted device types →  9
• SIL label on the transmitter nameplate →  10
1) www.endress.com/deviceviewer

Proline Prosonic Flow P 500 HART Use in protective systems
Endress+Hauser 19
Overview of the SIL mode
The SIL mode enables the following steps:
1. Makes sure that the preconditions are met.
 The measuring device checks whether the user has correctly configured a
predefined set of parameters for the safety function.
If the result is positive, the device continues with the activation of the SIL mode.
If the result is negative, the sequence is not permitted or is aborted, and the device
does not continue with the activation of the SIL mode.
2. Automatically switches a predefined set of parameters to the default values specified by
the manufacturer.
 This parameter set ensures that the flowmeter works in the safety mode.
3. Guides the user through the preconfigured parameters for checking.
 This ensures that the user actively checks all the important pre-settings.
4. Activates write protection for all the relevant parameters in the SIL mode.
All this ensures that the parameter settings that are required for the safety function are
configured correctly. (These settings cannot be circumvented either deliberately or by
accident.)
5.2.2 Locking a SIL device
When locking a SIL device, all safety-related parameter settings are shown to the operator
individually and must be confirmed explicitly. Parameter settings not permitted in the locked
SIL mode are reset to their default values where necessary. A SIL locking code is then entered
to lock the device software to ensure that parameters cannot be changed. Non-safety-related
parameters remain unchanged.

Use in protective systems Proline Prosonic Flow P 500 HART
20 Endress+Hauser
NOTICE
Once the SIL device has been locked, the process-related parameters are write protected,
and thereby locked, for security reasons.
It is still possible to read the parameters. When SIL locking is enabled, restrictions apply on all
communication options, such as the service interface, HART protocol and WirelessHART
protocol, local display and WLAN.
‣Follow the specified locking sequence.
1. Ensure preconditions are met.

Current output 1
Setup
Low flow cut off
Current span Failure mode Assign
process variable
= 4...20 mA or
= 4...20 mA US
= 4...20 mA NAMUR or
= Min. or
= Max.
= Volume flow
= Off
A0043165-EN
2. In the Setup menu → Advanced setup submenu, select the SIL confirmation wizard.
3. Select the Set write protection parameter.
4. Enter the SIL locking code 7452.
 The device first checks the preconditions listed under item 1.
NOTICE
If these preconditions are not met, the message "SIL preparation = failed" appears on the
display along with the parameter that failed to meet the preconditions under 1.
The SIL confirmation sequence is not continued.
‣Check preconditions.
If the preconditions are met, the message SIL preparation = finished appears on the display.
Once the preconditions have been met, the device automatically switches the following
parameters to safety-oriented settings: