Endress+Hauser Proserve NMS80 Instructions for use

Products Solutions Services
Functional Safety Manual
Proserve NMS80
Intelligent tank gauge for high-precision liquid level
measurements and bulk solids with a 4 to 20 mA output
signal and switch output
FY01099G/00/EN/01.23-00
71618211
2023-06-12
01.yy.zz (Device firmware)

Proserve NMS80
2 Endress+Hauser
Order code:
Ext. ord. cd.:
Ser. no.:
www.endress.com/deviceviewer Endress+Hauser
Operations App
XXXXXXXXXXXX
XXXXX-XXXXXX
XXX.XXXX.XX
Serial number
1.
3.
2.
A0023555

Proserve NMS80 Table of contents
Endress+Hauser 3
Table of contents
1 Declaration of conformity ........... 4
1.1 Other safety-related characteristic values ..... 6
1.2 Useful lifetime of electrical components ...... 6
2 Document information .............. 7
2.1 Document function ..................... 7
2.2 Using this document .................... 7
2.2.1 Information on the document
structure ....................... 7
2.3 Symbols used .......................... 7
2.3.1 Safety symbols .................. 7
2.3.2 Symbols for
certain types of information ......... 7
2.3.3 Symbols in graphics ............... 8
2.4 Supplementary device documentation ........ 8
3 Permitted devices types ............. 9
3.1 SIL label on the nameplate ............... 10
4 Safety function .................... 10
4.1 Definition of the safety function ........... 10
4.2 Safety-related signal ................... 10
4.3 Restrictions for use in safety-related
applications ......................... 11
4.3.1 Dangerous undetected failures in this
scenario ...................... 12
5 Use in safety instrumented
systems ........................... 13
5.1 Device behavior during operation .......... 13
5.1.1 Device behavior when switched on ... 13
5.1.2 Device behavior when safety
function is requested ............. 13
5.1.3 Device behavior in the event of
alarms and warnings ............. 13
5.1.4 Alarm and warning messages ...... 13
5.1.5 Device behavior when switched on ... 13
5.1.6 Device behavior when safety
function is requested ............. 13
5.1.7 Device behavior in the event of
alarms and warnings ............. 14
5.1.8 Alarm and warning messages ...... 14
5.2 Device configuration for safety-related
applications .......................... 14
5.2.1 Calibration of the measuring point -
safety function 1 (level
measurement) ................. 14
5.2.2 Calibration of the measuring point -
safety function 2 (current input
measurement) ................. 15
5.2.3 Configuration method ........... 16
5.3 Proof testing ......................... 21
5.3.1 Test sequence A (Approach the
level) ........................ 22
5.3.2 Test sequence B (simulate the level) .. 24
5.3.3 Test sequence C (simulation and
single-point level detection) ........ 26
5.3.4 Test sequence D (Feed in real
currents) ...................... 29
6 Life cycle ......................... 31
6.1 Requirements for personnel .............. 31
6.2 Installation .......................... 31
6.3 Commissioning ....................... 31
6.4 Operation ........................... 31
6.5 Maintenance ......................... 31
6.6 Repairs ............................. 32
6.7 Modification ......................... 33
7 Appendix ......................... 34
7.1 Structure of the measuring system ......... 34
7.1.1 System components ............. 34
7.1.2 Description of use as a protective
system ....................... 34
7.2 Proof testing ......................... 36
7.3 Notes on the redundant configuration of
multiple sensors ...................... 36
7.4 Further information .................... 37

Declaration of conformity Proserve NMS80
4 Endress+Hauser
1 Declaration of conformity
A0044238

Proserve NMS80 Declaration of conformity
Endress+Hauser 5
A0044239

Declaration of conformity Proserve NMS80
6 Endress+Hauser
1.1 Other safety-related characteristic values
Characteristic value as per IEC 61508 Value
MTBF 1) 29 Jahre
System reaction time as per DIN EN 61508-2 In "Expert mode":
User configurable
1) According to Siemens SN29500 This value takes into account failure modes relevant to the function of the
electronic components.
1.2 Useful lifetime of electrical components
The established failure rates of electrical components apply within the useful lifetime as
per IEC 61508-2:2010 section 7.4.9.5 note 3. In accordance with DIN EN 61508-2:2011
section 7.4.9.5 national footnote N3, appropriate measures taken by the manufacturer
and operator can extend the useful lifetime.

Proserve NMS80 Document information
Endress+Hauser 7
2 Document information
2.1 Document function
The document is part of the Operating Instructions and serves as a reference for
application-specific parameters and notes.
• General information about functional safety: SIL
• General information about SIL is available:
In the Download Area of the Endress+Hauser Internet site:
www.de.endress.com/SIL
2.2 Using this document
2.2.1 Information on the document structure
For the arrangement of the parameters as per the Operation menu, Setup menu,
Diagnostics menu, along with a short description, see the Operating Instructions for
the device
2.3 Symbols used
2.3.1 Safety symbols
Symbol Meaning
DANGER
DANGER!
This symbol alerts you to a dangerous situation. Failure to avoid this situation will
result in serious or fatal injury.
WARNING
WARNING!
This symbol alerts you to a dangerous situation. Failure to avoid this situation can
result in serious or fatal injury.
CAUTION
CAUTION!
This symbol alerts you to a dangerous situation. Failure to avoid this situation can
result in minor or medium injury.
NOTICE
NOTE!
This symbol contains information on procedures and other facts which do not result in
personal injury.
2.3.2 Symbols for certain types of information
Symbol Meaning
A0011193
Tip
Indicates additional information.
Reference to documentation
A
Reference to page
Reference to graphic
1.
,
2.
,
3.
… Series of steps

Document information Proserve NMS80
8 Endress+Hauser
2.3.3 Symbols in graphics
Symbol Meaning
1, 2, 3,... Item numbers
1.
,
2.
,
3.
… Series of steps
A, B, C, ... Views
2.4 Supplementary device documentation
Documentation Comment
Technical Information:
• TI01248G/00 (NMS80)
• TI01249G/00 (NMS81)
• TI01250G/00 (NMS83)
The documentation is available on the Internet:
→ www.endress.com
Operating Instructions
• BA01456G/00 (NMS80)
• BA01459G/00 (NMS81)
• BA01462G/00 (NMS83)
The documentation is available on the Internet:
→ www.endress.com
Brief Operating Instructions:
• KA01200G/00 (NMS80)
• KA01203G/00 (NMS81)
• KA01206G/00 (NMS83)
• The document is provided with the device.
• The documentation is available on the Internet:
→ www.endress.com
Safety instructions depending on the selected option
"Approval".
Additional safety instructions (XA, ZE) are supplied with
certified device version.
Please refer to the nameplate for the relevant safety
instructions.
This supplementary Safety Manual applies in addition to the Operating Instructions,
Technical Information and ATEX Safety Instructions. The supplementary device
documentation must be observed during installation, commissioning and operation.
The requirements specific to the protection function are described in this Safety
Manual.

Proserve NMS80 Permitted devices types
Endress+Hauser 9
3 Permitted devices types
The details pertaining to functional safety in this manual relate to the device versions
listed below and are valid as of the specified software and hardware version. Unless
otherwise specified, all subsequent versions can also be used for safety functions. A
modification process according to IEC 61508 is applied for any device modifications.
Valid device versions for safety-related use:
Order code Designation Option
010 Approval All
020 Connector type All
030 Power supply; display All
040 Primary output See next table
050 Secondary I/O analog See next table
060 Secondary I/O digital Ex d/XP See next table
070 Housing All except Y9
080 Process pressure All
090 Electrical connection All
110 Measuring range; wire; diameter All except Y
120 Displacer material; type All except Y
130 Process sealing All
140 Process connection All
150 Accuracy, approval for custody transfer All
500 Operating languages; display All
540 Application package All
570 Service All
580 Test; certificate All
590 Additional approval LA 1) SIL
610 Accessory mounted All
620 Accessory enclosed All
850 Firmware version If no version is selected here, the latest SW
with SIL capability is supplied. Alternatively,
the following SW version can be selected:
01.yy.zz
895 Identification All
1) An additional selection of other versions is possible.
Order code 040 050 060
Option
E1 * *
H1 * *
* A1 *
* A2 *
* B1 *
* B2 *
* C2 *
* * A1

Safety function Proserve NMS80
10 Endress+Hauser
Order code 040 050 060
* * A2
* * A3
* * B2
* * B3
* All options are possible. (This selection does not affect SIL capability.)
• Valid firmware version: as of 01.02.zz (→ nameplate of the device)
• Valid hardware version (electronics): as of date of production 23.11.2016 (→ nameplate
of the device)
3.1 SIL label on the nameplate
SIL certified devices are marked with the following symbol on the nameplate:
4 Safety function
4.1 Definition of the safety function
The device's safety functions are:
Safety function 1 (level measurement)
• Maximum point level monitoring (overfill protection)
• Minimum point level monitoring (dry run protection)
• Level range monitoring
The safety functions comprise the measurement of the level of a liquid.
Safety function 2 (current input measurement)
Current input monitoring
The safety function comprises the measurement of the current of a connected device.
4.2 Safety-related signal
Digital
The device's safety-related signal is the closed relay contact of the digital output. All safety
measures refer to this signal exclusively.
The level value (safety function 1: level measurement) or the analog input current (safety
function 2: current input measurement) are correctly converted to a digital output value.
The relay contact is closed within the range of validity, and is open outside this range.
The safety-related output signal is fed to a downstream logic unit, e.g. a programmable
logic controller or a limit signal transmitter where it is monitored for the following:
• Exceed and/or undershoot a specific level limit.
• The occurrence of a fault, e.g. contact open (interruption of the signal line).
In case of fault it must be ensured that the equipment under control achieves or
maintains a safe state.
Analog
The device's safety-related signal is the analog output signal 4 to 20 mA. All safety
measures refer to this signal exclusively.

Proserve NMS80 Safety function
Endress+Hauser 11
The device can also communicate via HART for information purposes and contains all the
HART features with additional device information.
The safety-related output signal is fed to a downstream logic unit, e.g. a programmable
logic controller or a limit signal transmitter where it is monitored for the following:
• Exceed and/or undershoot a specific level limit.
• The occurrence of a fault, e.g. failure current (≤3.6 mA, ≥21.0 mA), interruption or
short-circuit of the signal line).
In case of fault it must be ensured that the equipment under control achieves or
maintains a safe state.
4.3 Restrictions for use in safety-related applications
• The measuring system must be used correctly for the specific application, taken into
account the medium properties and ambient conditions. Carefully follow instructions
pertaining to critical process situations and installation conditions from the Operating
Instructions. The application-specific limits must be observed.
• Information on the safety-related signal, (→  10).
• The specifications from the Operating Instructions must not be exceeded, (→  8).
• The following restrictions also applies to safety-related use:
• Strong, pulse-like EMC interference on the line can cause transient (< 1 s) deviations
≥ ±2% in the output signal. For this reason, filtering with a time constant of ≥ 1 s
should be performed in the downstream logic unit.
• The error range is device specific and is defined according to FMEDA (Failure Modes,
Effects and Diagnostic Analysis) on delivery. It includes all influential factors described
in the Technical Information (e.g. non-linearity, non-repeatability, hysteresis,
zero drift, temperature drift, EMC influences).
According to IEC / EN 61508 the safety related failures are classified into different
categories, see the following table. The table shows the implications for the safety-
related analog output signal and for measuring uncertainty.
Safety related error Explanation Implications for the
safety related output
signal
Implications for the
measuring uncertainty
(Position, see figure.
→  12)
No device error Safe:
No error
None 1 Is within the
specification (see TI,
BA, ...)
λSD Safe detected:
Safe failure which can be
detected
Causes the output signal
to signal the failsafe mode
(see, →  13)
3 No implications
λSU Safe undetected:
Safe failure which cannot
be detected
Is within the defined error
range
2 May be beyond the
specification
λDD Dangerous detected:
Dangerous failure which
can be detected
(Diagnostic within the
device)
Causes the output signal
to signal the failsafe mode
(see, →  13)
3 No implications
λDU Dangerous undetected:
Dangerous failure which
cannot be detected
May be outside the
defined error range
4 May be outside the
defined error range

Safety function Proserve NMS80
12 Endress+Hauser
I [mA]
B
C
A
t
1
2
4
3
3
A0025264
A HI-Alarm ≥21 mA
B Error range ±2 %
C LO-Alarm ≤3.6 mA
4.3.1 Dangerous undetected failures in this scenario
A dangerous, undetected failure is considered to be an incorrect output signal that deviates
from the real value by more than 2 %, wherein the output signal is still in the range of
4 to 20 mA or the relay contact remains closed.

Proserve NMS80 Use in safety instrumented systems
Endress+Hauser 13
5 Use in safety instrumented systems
5.1 Device behavior during operation
Digital
5.1.1 Device behavior when switched on
Once switched on, the device runs through a diagnostic phase of approx. 30 seconds. The
relay contact is open during this time. During the diagnostic phase, communication via the
service interface (CDI) or via protocols (HART, V1, Modbus, WM550) is not possible.
5.1.2 Device behavior when safety function is requested
The device displays a digital output value which corresponds to the limit value to be
monitored. The relay contact is closed within the range of validity, and is open outside this
range. This contact must be monitored and processed accordingly by a connected logic
unit.
5.1.3 Device behavior in the event of alarms and warnings
The relay contact is always open in the event of alarms and warnings. This contact must be
monitored and processed accordingly by a connected logic unit.
5.1.4 Alarm and warning messages
Additional information is provided by the alarm and warning messages in the form of
error codes and associated plain text messages.
The following table shows the correlation between the error code and the relay contact
output:
Error code 1) Relay contact (message type) Note
Fxxx Open xxx = three-digit number
Mxxx corresponding to measuring mode xxx = three-digit number
Cxxx corresponding to measuring mode xxx = three-digit number
Sxxx corresponding to measuring mode xxx = three-digit number
1) The error codes are listed in the Operating Instructions.
Analog
5.1.5 Device behavior when switched on
Once switched on, the device runs through a diagnostic phase of approx. 30 seconds. The
current output is set to failure current ≤3.6 mA during this time.
During the diagnostic phase, communication via the service interface (CDI) or via protocols
(HART, V1, Modbus, WM550) is not possible.
5.1.6 Device behavior when safety function is requested
The device outputs a current value corresponding to the limit value to be monitored. This
value must be monitored and processed further in a connected logic unit.

Use in safety instrumented systems Proserve NMS80
14 Endress+Hauser
5.1.7 Device behavior in the event of alarms and warnings
The output current in the event of an alarm can be set to a value of ≤3.6 mA or ≥21.0 mA.
In some cases, e.g. failure of power supply, a cable break and faults in the current output
itself where the failure current ≥21.0 mA cannot be set, output currents ≤3.6 mA occur
irrespective of the configured failure current.
In some other cases (e.g. cabling short circuit), output currents of ≥21.0 mA occur
irrespective of the configured failure current.
For alarm monitoring, the downstream logic unit must be able to recognize failure currents
of the upper signal on alarm level (≥21.0 mA) and of the lower signal on alarm level
(≤3.6 mA).
5.1.8 Alarm and warning messages
Additional information is provided by the alarm and warning messages in the form of
error codes and associated clear text messages.
The following table shows the correlation between the error code and the current output:
Error code 1) Current output (message type) Note
Fxxx ≥21.0 mA or ≤3.6 mA xxx = three-digit number
Mxxx corresponding to measuring mode xxx = three-digit number
Cxxx corresponding to measuring mode xxx = three-digit number
Sxxx corresponding to measuring mode xxx = three-digit number
1) The error codes are listed in the Operating Instructions.
Exceptions:
Error code 1) Current output (message type) Note
C484 ≥21.0 mA or ≤3.6 mA Failure mode simulation
1) The error codes are listed in the Operating Instructions.
5.2 Device configuration for safety-related applications
It is recommended to carry out a factory reset before configuring the parameters.
Navigate to: Setup → Advanced setup → Administration
Device reset = To factory defaults
This resets all parameters to defined values.
5.2.1 Calibration of the measuring point - safety function 1 (level
measurement)
Calibration of the measuring point is described in the Operating Instructions (→  8).
Specify which type of configuration a) or b) should be used. Both configurations can apply
in parallel or in combination with safety function 2 (current input measurement).
a) Level value (source) (1) -> safety-related signal: analog output (2)
b) Level value (source) (1) -> safety-related signal: digital output (3)
Level value (source) (1)
Make sure that the application is configured correctly.

Proserve NMS80 Use in safety instrumented systems
Endress+Hauser 15
Navigate to: Setup
Setting
•Level source = Level
•Empty andTank reference height must be set correctly.
•High stop level andLow stop level must be set correctly.
Navigate to: Setup → Gauge command
Setting
Gauge command = Level
Analog output (2)
Make sure that the correct output is configured (Analog I/O B1-3 or Analog I/O C1-3).
Navigate to: Setup → Advanced setup → Input/output → Analog I/O
Setting
•Operating mode =4..20mA output or HART slave +4..20mA output
•Analog input source = Tank level
•0 % value must be set correctly.
•100 % value must be set correctly.
•Used for SIL/WHG = Enabled
Digital output (3)
First select an alarm block (Alarm 1, Alarm 2, Alarm 3 or Alarm 4) for the limit value
settings.
Navigate to: Setup → Advanced setup → Application → Alarm → Alarm X
Setting
•Alarm mode = On
•Alarm value source = Tank level (depending on the source)
•HH alarm value, H alarm value, L alarm value and LL alarm value must be configured
in line with the application such that the valid range is within the HH, H and L, LL limits.
Make sure that the correct output is configured (Digital A1-2, Digital A3-4, Digital B1-2,
Digital B3-4, Digital C1-2, Digital C3-4, Digital D1-2, Digital D3-4).
Navigate to: Setup → Advanced setup → Input/output → Digital Xy-z
Setting
•Operating mode = Output passive
•Digital input source = selected alarm block: Alarm 1 any, Alarm 2 any, Alarm 3 any or
Alarm 4 any
•Used for SIL/WHG = Enabled must be set to use this digital output as a SIL output.
5.2.2 Calibration of the measuring point - safety function 2 (current
input measurement)
Calibration of the measuring point is described in the Operating Instructions (→  8).
Specify which type of configuration c) or d) should be used. Both configurations can apply
in parallel or in combination with safety function 1 (level measurement).
c) Analog input (source) (1) -> safety-related signal: analog output (2)
d) Analog input (source) (1) -> safety-related signal: digital output (3)
Analog input (source) (1)
Make sure that the correct source is configured (Analog I/O B1-3 or Analog I/O C1-3).
Navigate to: Setup → Advanced setup → Input/output → Analog I/O

Use in safety instrumented systems Proserve NMS80
16 Endress+Hauser
Setting
•Operating mode =4..20mA input or HART master+4..20mA input
•Analog input 0% value must be set correctly.
•Analog input 100% value must be set correctly.
Analog output (2)
Make sure that the correct output is configured (Analog I/O B1-3 or Analog I/O C1-3).
Navigate to: Setup → Advanced setup → Input/output → Analog I/O
Setting
•Operating mode =4..20mA output or HART slave +4..20mA output
•Analog input source = AIO B1-3 value mA or AIO C1-3 value mA (depending on the
source)
•0 % value
•100 % value
•Used for SIL/WHG = Enabled
Digital output (3)
First select an alarm block (Alarm 1, Alarm 2, Alarm 3 or Alarm 4) for the limit value
settings.
Navigate to: Setup → Advanced setup → Application → Alarm → Alarm X
Setting
•Alarm mode = On
•Alarm value source = AIO B1-3 value mA or AIO C1-3 value mA (depending on the
source)
•HH alarm value, H alarm value, L alarm value and LL alarm value must be configured
in line with the application such that the valid range is within the HH, H and L, LL limits.
Make sure that the correct output is configured (Digital A1-2, Digital A3-4, Digital B1-2,
Digital B3-4, Digital C1-2, Digital C3-4, Digital D1-2, Digital D3-4).
Navigate to: Setup → Advanced setup → Input/output → Digital Xy-z
Setting
•Operating mode = Output passive
•Digital input source = selected alarm block (Alarm 1 any, Alarm 2 any, Alarm 3 any
or Alarm 4 any)
•Used for SIL/WHG = Enabled must be set to use this digital output as a SIL output.
5.2.3 Configuration method
When the devices are used in safety instrumented systems, the device configuration must
meet two requirements:
• Confirmation concept:
Proven, independent testing of safety-related parameters entered.
• Locking concept:
Locking of the device following parameter configuration (IEC 61511-1: 2016 Section
11.6.3)
To activate SIL mode, the device must run through an operating sequence, during which
the device can be operated via the device display or any Asset Management Tool (e.g.
FieldCare) for which integration is available.
"Expert mode"
A larger number of safety-related parameters can be freely configured here. This means
that the device can be adapted to difficult applications. However, the settings must be
checked by directly approaching the level in the tank or by applying a comparable method.
A tank with liquid can be used for example as a method for checking in the case of MAX
monitoring.

Proserve NMS80 Use in safety instrumented systems
Endress+Hauser 17
A detailed description of the configuration steps is provided in the following section.
Only in the case of SIL devices (order code 590 "Additional Approval", option LA "SIL")
is the SIL commissioning sequence visible on the display and in external operating
tools. For this reason, SIL locking can only be activated on these devices.
Locking in "Expert mode"
To commission the device, carry out and document the following steps in the order shown
(→  36):
1.
Perform the configuration; see also (→  14).
The configuration procedure and the meaning of the individual parameters are
described in the Operating Instructions (→  8). You must comply with the
parameter settings in the following table (→  19).
2.
Start the commissioning check and ensure that the distance between the level and
the reference position is at least 500 mm (19.7 in).
Navigate to: Diagnostics → Device check → Commissioning check
Commissioning check = Start (for more information, see Operating Instructions
→  8).
A commissioning check is carried out. The device's sensor calibration is checked and
any installation errors are detected.
3.
Set Proservo to the "Level" gauge command.
Navigate to: Operation → Gauge command
Gauge command = Level
Proservo returns to level mode. Depending on the tank height and the previous
position of the displacer, wait for a sufficient period of time until the displacer
reaches the level surface.
4.
Start the SIL confirmation sequence.
Navigate to: Setup → Advanced setup → SIL/WHG confirmation
SIL/WHG confirmation = Set write protection and enter the relevant locking code
(SIL: 7452).
Press "Next" to confirm.
5.
Press "Next" to confirm Commissioning = Expert mode.
The device checks the parameter settings in accordance with the following table
(→  19) and forces a switchover of parameters if necessary.
SIL preparation = Finished is shown when the check is finished. The
commissioning sequence can be continued. Press "Next" to confirm.
6.
Carry out function test.
For MIN and MAX monitoring, at least one level/current input value above (MAX
monitoring) or below (MIN monitoring) the switch point must be approached.
For range monitoring, 5 level values/current input values which cover the entire
measuring range should be approached. In doing so, check that the safety-related
signal (current output/relay contact) responds correctly in each case.
If it is not possible to approach the required level values: Carry out a test
according to test sequence C →  26 before locking. However, this will not
detect all possible errors (e.g. inadequate calibration). For this reason, we
recommend that the measured values be tested and documented in accordance
with test sequence A →  22 at the time when the required levels/point
levels are reached. In accordance with IEC 61508-1:2010, Section 7.14, this
test is included in the "Overall safety validation" and is the responsibility of the
operator.
7.
Confirm that the function test has been successful.
Confirm function test = Yes.

Use in safety instrumented systems Proserve NMS80
18 Endress+Hauser
8.
Set write protection = Enter the locking code again (SIL: 7452). Check the locking
status after performing SIL locking.
Navigate to: Setup → Advanced setup
Locking status = SIL locked must be confirmed by selecting "".
9.
As an option, hardware locking can also be activated (via the dip switch marked
"WP" on the main electronics).

Proserve NMS80 Use in safety instrumented systems
Endress+Hauser 19
Further parameter settings
The following parameters affect the safety function. However, they may be freely
configured in accordance with the application:
It is recommended to note down the configured values!
Parameter Parameter name
Setup Upper density
Setup Process condition
Setup High stop level
Setup Low stop level
Setup Empty
Current input measurement: Setup → Advanced setup → Input/output → Analog
I/O
0 % value
100 % value
The following parameters affect the safety function and are not freely configurable in
Expert mode. Instead, they are automatically set by the device to the safety-related values
mentioned at the start of SIL confirmation:
Parameter Preset value
Operation → Gauge command → Gauge command Level
Setup → Advanced setup → Input/output → Digital input mapping → Digital input
source 1
None
Setup → Advanced setup → Input/output → Digital input mapping → Digital input
source 2
None
Setup → Advanced setup → Input/output → Digital Xy-z → Contact type Normally closed
Setup → Advanced setup → Input/output → Digital Xy-z → Output simulation Disable
Setup → Advanced setup → Application → Tank calculation → HyTD → HyTD mode No
Setup → Advanced setup → Application → Tank calculation → CTSh → CTSh mode No
Setup → Advanced setup → Application → Alarm → Alarm X → Error value All alarms
Setup → Advanced setup → Application → Alarm → Alarm X → Alarm mode On
Setup → Advanced setup → Safety settings → Output out of range Alarm
Diagnostics → Simulation → Simulation distance on Off
Diagnostics → Simulation → Current output 1 simulation Off
Expert → Input/output → Digital Xy-z → Error on event Any error
Expert → Input/output → Analog I/O → Error on event Any error
Expert → Input/output → Analog I/O → Output out of range Alarm
Expert → Input/output → Analog I/O → Feedback threshold 1 s
Those parameters which are not mentioned do not affect the safety function and can
be configured to any meaningful values. The visibility of the parameters mentioned in
the operating menu depends in part on the user role, the SW options ordered and on
the configuration of other parameters.
Unlocking a SIL device
When SIL locking is active on a device, the device is protected against unauthorized
operation by means of a locking code and, as an additional option, by means of a hardware
write protection switch. The device must be unlocked in order to change the configuration

Use in safety instrumented systems Proserve NMS80
20 Endress+Hauser
for proof testing as per test sequence A →  22 or test sequence B →  24 or test
sequence C →  26.
LCAUTION
Unlocking the device deactivates diagnostic functions, and the device may not be able
to carry out its safety function when unlocked.
‣Therefore, independent measures must be taken to ensure that there is no risk of
danger while the device is unlocked.
To unlock, proceed as follows:
1. Check the position of the hardware write protection switch (dip switch marked "WP"
on the main electronics), and set this switch to "OFF".
2. Select the sequence Setup → Advanced setup → Deactivate SIL/WHG and enter the
relevant unlocking code (SIL: 7452) for the Reset write protection parameter.
 The "End of sequence" message indicates that the device was successfully
unlocked.