Endress+Hauser Proservo NMS80 Instructions for use

Intelligent tank gauge for high-precision measurement of the level of liquids
with a 4-20 mA output signal and switch output
Products Solutions Services
Special Documentation
Proservo NMS80/81/83
Functional Safety Manual
SD01920G/00/EN/01.17
71350261

Proservo NMS80/81/83
2 Endress+Hauser
Table of contents
Declaration of Conformity .................... 3
Other safety-related characteristic values ............. 5
Useful lifetime of electric components ................ 5
Document information ....................... 6
Document function ............................ 6
Using this document ........................... 6
Symbols used ................................ 6
Supplementary device documentation ................ 7
Permitted devices types ...................... 8
SIL label on the nameplate ....................... 9
Safety function ............................. 9
Definition of the safety function .................... 9
Safety-related signal ........................... 9
Restrictions for use in safety-related applications ....... 10
Use in protective systems .................... 12
Device behavior during operation .................. 12
Parameter configuration for safety-related applications ... 13
Proof-testing ............................... 19
Life cycle ................................ 26
Requirements for personnel ..................... 26
Installation ................................. 26
Commissioning .............................. 26
Operation ................................. 26
Maintenance ............................... 26
Repairs ................................... 27
Modification ................................ 28
Appendix ................................ 29
Structure of the measuring system ................. 29
Proof-testing ............................... 31
Notes on the redundant configuration of multiple sensors .. 31
Further information ........................... 31

Proservo NMS80/81/83
Endress+Hauser 3
Declaration of Conformity
A0032861

Proservo NMS80/81/83
4 Endress+Hauser
A0032862

Proservo NMS80/81/83
Endress+Hauser 5
Other safety-related
characteristic values Characteristics as per IEC 61508 Value
Safety function MIN, MAX, Range
SIL SIL 2 (single-channel architecture 1oo1)
SIL 3 (multi-channel architecture, also with homogeneous
redundancy, e.g. 1oo2, 2oo3)
HFT 0
Device type B
Operating mode Low demand mode, high demand mode
SFF 98 %
MTTR 8 h
Recommended time interval for proof-testing T13 years
λsd 23 FIT
λsu 2 528 FIT
λdd 6 205 FIT
λdu 185 FIT
λtot 1) 8 941 FIT
PFDavg for T1 = 1 year 2) 8.59-4
PFDavg for T1 = 2 years 2) 1.67-3
PFH 1.85-7 h-1
MTBF 1) 28 years
Diagnostic test interval 3) 60 min
Fault reaction time 4) 60 s
System reaction time 5) In "Expert mode":
User configurable
1) According to Siemens SN29500. This value takes into account failure types relevant to the function of the
electronic components.
2) Valid for ambient temperature up to +40 °C (+104 °F). Where the average temperature when in continuous
use is in the region of +60 °C (+140 °F), a factor of 2.1 should be taken into account.
3) During this time, all diagnostic functions are executed at least once.
4) Time between error detection and error response.
5) Step response time as per DIN EN 61298-2: 274 s
Useful lifetime of electric
components
The established failure rates of electrical components apply within the useful lifetime as per
IEC 61508-2:2010 section 7.4.9.5, note 3. In accordance with DIN EN 61508-2:2011 section
7.4.9.5, national footnote N3, appropriate measures taken by the manufacturer and operator can
extend the useful lifetime.

Proservo NMS80/81/83
6 Endress+Hauser
Document information
Document function The document is part of the Operating Instructions and serves as a reference for application-specific
parameters and notes.
• General information about functional safety: SIL
• General information about SIL is available:
In the Download Area of the Endress+Hauser Internet site: www.de.endress.com/SIL
Using this document Information on the document structure
For the arrangement of the parameters as per the Operation menu, Setup menu, Diagnostics
menu, along with a short description, see the Operating Instructions for the device
Symbols used Safety symbols
Symbol Meaning
DANGER
DANGER!
This symbol alerts you to a dangerous situation. Failure to avoid this situation will
result in serious or fatal injury.
WARNING
WARNING!
This symbol alerts you to a dangerous situation. Failure to avoid this situation can
result in serious or fatal injury.
CAUTION
CAUTION!
This symbol alerts you to a dangerous situation. Failure to avoid this situation can
result in minor or medium injury.
NOTICE
NOTE!
This symbol contains information on procedures and other facts which do not result in
personal injury.
Symbols for certain types of information
Symbol Meaning
A0011193
Tip
Indicates additional information.
Reference to documentation
A
Reference to page
Reference to graphic
1.
,
2.
,
3.
… Series of steps
Symbols in graphics
Symbol Meaning
1, 2, 3,... Item numbers
1.
,
2.
,
3.
… Series of steps
A, B, C, ... Views

Proservo NMS80/81/83
Endress+Hauser 7
Supplementary device
documentation Documentation Comment
Technical Information:
• TI01248G/00 (NMS80)
• TI01249G/00 (NMS81)
• TI01250G/00 (NMS83)
The documentation is available on the Internet:
→ www.endress.com
Operating Instructions
• BA01456G/00 (NMS80)
• BA01459G/00 (NMS81)
• BA01462G/00 (NMS83)
The documentation is available on the Internet:
→ www.endress.com
Brief Operating Instructions:
• KA01200G/00 (NMS80)
• KA01203G/00 (NMS81)
• KA01206G/00 (NMS83)
• The document is provided with the device.
• The documentation is available on the Internet:
→ www.endress.com
Safety instructions depending on the selected option
"Approval".
Additional safety instructions (XA, ZE) are supplied with
certified device version.
Please refer to the nameplate for the relevant safety
instructions.
This supplementary Safety Manual applies in addition to the Operating Instructions, Technical
Information and ATEX Safety Instructions. The supplementary device documentation must be
observed during installation, commissioning and operation. The requirements specific to the
protection function are described in this Safety Manual.

Proservo NMS80/81/83
8 Endress+Hauser
Permitted devices types
The details pertaining to functional safety in this manual relate to the device versions listed below
and are valid as of the specified software and hardware version. Unless otherwise specified, all
subsequent versions can also be used for safety functions. A modification process according to
IEC 61508 is applied for device changes.
Valid device versions for safety-related use:
Ordering feature Designation Option
010 Approval All
020 Connector type All
030 Power supply; display All
040 Primary output All 1)
E1 4 to 20 mA HART Ex d/XP
H1 4 to 20 mA HART Ex i/IS
050 Secondary I/O analog All 1)
A1 Ex d/XP, 1x 4 to 20 mA HART, 1x RTD input
A2 Ex d/XP, 2x 4 to 20 mA HART, 2x RTD input
B1 Ex i/IS, 1x 4 to 20 mA HART, 1x RTD input
B2 Ex i/IS, 2x 4 to 20 mA HART, 2x RTD input
060 Secondary I/O digital
Ex d/XP
All 1)
A1 2x relay + 2x module, discrete
A2 4x relay + 4x module, discrete
A3 6x relay + 6x module, discrete
B2 Modbus RS485 + 2x relay + 2x module, discrete
B3 Modbus RS485 + 4x relay + 4x module, discrete
070 Housing All except Y
080 Process pressure All
090 Electrical connection All
110 Measuring range; wire;
diameter
All except Y
120 Displacer material; type All except Y
130 Process seal All
140 Process connection All
150 Accuracy, approval for
custody transfer
All
500 Operating languages;
display
All
540 Application package All
570 Service All
580 Test; certificate All
590 Additional approval LA 2) SIL
610 Accessory mounted All
620 Accessory enclosed All
850 Firmware version If no version is selected here, the latest SIL-enabled SW
is supplied. Alternatively, the following SW version
may be selected: 76____01.02.zz
895 Marking All
1) At least one of the versions listed must be selected.
2) An additional selection of further versions is possible.

Proservo NMS80/81/83
Endress+Hauser 9
• Valid firmware version: as of 01.02.zz (→ nameplate of the device)
• Valid hardware version (electronics): as of date of production 23.11.2016 (→ nameplate of the
device)
SIL label on the nameplate SIL certified devices are marked with the following symbol on the nameplate:
Safety function
Definition of the safety
function
The device's safety functions are:
Safety function 1 (level measurement)
• Maximum point level monitoring (overfill protection)
• Minimum point level monitoring (dry run protection)
• Level range monitoring
The safety functions comprise the measurement of the level of a liquid.
Safety function 2 (current input measurement)
Current input monitoring
The safety function comprises the measurement of the current of a connected device.
Safety-related signal Digital
The device's safety-related signal is the closed relay contact of the digital output. All safety measures
refer to this signal exclusively.
The level value (safety function 1: level measurement) or the analog input current (safety function 2:
current input measurement) are correctly converted to a digital output value. The relay contact is
closed within the range of validity, and is open outside this range.
The safety-related output signal is fed to a downstream logic unit, e.g. a programmable logic
controller or a limit signal transmitter where it is monitored for the following:
• Exceed and/or undershoot a specific level limit.
• The occurrence of a fault, e.g. contact open (interruption of the signal line).
In case of fault it must be ensured that the equipment under control achieves or maintains a
safe state.
Analog
The device's safety-related signal is the analog output signal 4 to 20 mA. All safety measures refer to
this signal exclusively.
The device can also communicate via HART for information purposes and contains all the HART
features with additional device information.
The safety-related output signal is fed to a downstream logic unit, e.g. a programmable logic
controller or a limit signal transmitter where it is monitored for the following:
• Exceed and/or undershoot a specific level limit.
• The occurrence of a fault, e.g. error current (≤3.6 mA, ≥21.0 mA), interruption or short-circuit of
the signal line).
In case of fault it must be ensured that the equipment under control achieves or maintains a
safe state.

Proservo NMS80/81/83
10 Endress+Hauser
Restrictions for use in safety-
related applications
• The measuring system must be used correctly for the specific application, taken into account the
medium properties and ambient conditions. Carefully follow instructions pertaining to critical
process situations and installation conditions from the Operating Instructions. The application-
specific limits must be observed.
• Information on the safety-related signal, (→  9).
• The specifications from the Operating Instructions must not be exceeded, (→  7).
• The following restrictions also applies to safety-related use:
– Strong, pulse-like EMC interference on the line can cause transient (< 1 s) deviations ≥ ±2% in
the output signal. For this reason, filtering with a time constant of ≥ 1 s should be performed in
the downstream logic unit.
– The error range is device specific and is defined according to FMEDA (Failure Modes, Effects and
Diagnostic Analysis) on delivery. It includes all influential factors described in the Technical
Information (e.g. non-linearity, non-repeatability, hysteresis, zero drift, temperature drift, EMC
influences).
According to IEC / EN 61508 the safety related failures are classified into different categories,
see the following table. The table shows the implications for the safety-related analog output
signal and for measuring uncertainty.
Safety related error Explanation Implications for the
safety related output
signal
Implications for the
measuring uncertainty
(Position, see figure.
→  10)
No device error Safe:
No error
None 1 Is within the
specification (see TI,
BA, ...)
λSD Safe detected:
Safe failure which can be
detected
Causes the output signal
to signal the failsafe mode
(see, →  12)
3 No implications
λSU Safe undetected:
Safe failure which cannot
be detected
Is within the defined error
range
2 May be beyond the
specification
λDD Dangerous detected:
Dangerous failure which
can be detected
(Diagnostic within the
device)
Causes the output signal
to signal the failsafe mode
(see, →  12)
3 No implications
λDU Dangerous undetected:
Dangerous failure which
cannot be detected
May be outside the
defined error range
4 May be outside the
defined error range
I [mA]
B
C
A
t
1
2
4
3
3
A0025264
A HI-Alarm ≥21 mA
B Error range ±2 %
C LO-Alarm ≤3.6 mA

Proservo NMS80/81/83
Endress+Hauser 11
Dangerous undetected failures in this scenario
A dangerous, undetected failure is considered to be an incorrect output signal that deviates from the
real value by more than 2 %, wherein the output signal is still in the range of 4 to 20 mA or the relay
contact remains closed.

Proservo NMS80/81/83
12 Endress+Hauser
Use in protective systems
Device behavior during
operation
Digital
Device behavior during power-up
Once switched on, the device runs through a diagnostic phase of approx. 30 seconds. The relay
contact is open during this time. During the diagnostic phase, no communication is possible via the
service interface (CDI) or via protocols (HART, V1, Modbus).
Device behavior in safety function demand mode
The device displays a digital output value which corresponds to the limit value to be monitored. The
relay contact is closed within the range of validity, and is open outside this range. This must be
monitored and processed accordingly by a connected logic unit.
Device behavior in event of alarms and warnings
The relay contact is always open in the event of alarms and warnings. This must be monitored and
processed accordingly by a connected logic unit.
Alarm and warning messages
Additional information is provided by the alarm and warning messages in the form of error codes
and associated clear text messages.
The following table shows the correlation between the error code and the relay contact output:
Error code 1) Relay contact (message type) Note
Fxxx Open xxx = three-digit number
Mxxx corresponding to measuring mode xxx = three-digit number
Cxxx corresponding to measuring mode xxx = three-digit number
Sxxx corresponding to measuring mode xxx = three-digit number
1) The error codes are listed in the Operating Instructions.
Analog
Device behavior during power-up
Once switched on, the device runs through a diagnostic phase of approx. 30 seconds. The current
output is set to error current ≤3.6 mA during this time.
During the diagnostic phase, no communication is possible via the service interface (CDI) or via
protocols (HART, V1, Modbus).
Device behavior in safety function demand mode
The device outputs a current value corresponding to the limit value to be monitored. This value must
be monitored and processed further in a connected logic unit.
Device behavior in event of alarms and warnings
The output current on alarm can be set to a value ≤3.6 mA or ≥21.0 mA.
In some cases e.g. failure of power supply, a cable open circuit and faults in the current output itself,
where the error current ≥21.0 mA cannot be set, output currents of ≤3.6 mA occur irrespective of
the configured error current .
In some other cases (e.g. cabling short circuit), output currents of ≥21.0 mA occur irrespective of the
configured error current.
For alarm monitoring, the downstream logic unit must be able to recognize error currents of the
upper level for signal on alarm (≥21.0 mA) and of the lower level for signal on alarm (≤3.6 mA).

Proservo NMS80/81/83
Endress+Hauser 13
Alarm and warning messages
Additional information is provided by the alarm and warning messages in the form of error codes
and associated clear text messages.
The following table shows the correlation between the error code and the current output:
Error code 1) Current output (message type) Note
Fxxx ≥21.0 mA or ≤3.6 mA xxx = three-digit number
Mxxx corresponding to measuring mode xxx = three-digit number
Cxxx corresponding to measuring mode xxx = three-digit number
Sxxx corresponding to measuring mode xxx = three-digit number
1) The error codes are listed in the Operating Instructions.
Exceptions:
Error code 1) Current output (message type) Note
C400 ≥21.0 mA or ≤3.6 mA Simulation failure mode
1) The error codes are listed in the Operating Instructions.
Parameter configuration for
safety-related applications
It is recommended to carried out factory reset before setting the parameters.
Navigate to: Setup → Advanced setup → Administration
Device reset = To factory defaults
This resets all parameters to defined values.
Calibration of the measuring point - safety function 1 (level measurement)
The calibration of the measuring point is described in the Operating Instructions (→  7).
Specify which type of configuration a) or b) should be used. Both configurations can apply in parallel
or in combination with safety function 2 (current input measurement).
a) Level value (source) (1) -> safety-related signal: analog output (2)
b) Level value (source) (1) -> safety-related signal: digital output (3)
Level value (source) (1)
Make sure that the application is configured correctly.
Navigate to: Setup
Setting
•Level source = Level
•Empty and Tank reference height must be set correctly.
•High stop level and Low stop level must be set correctly.
Navigate to: Setup → Gauge command
Setting
Gauge command = Level
Analog output (2)
Make sure that the correct output is configured (Analog I/O B1-3 or Analog I/O C1-3).
Navigate to: Setup → Advanced setup → Input/output → Analog I/O
Setting
•Operating mode = 4..20mA output or HART slave +4..20mA output
•Analog input source = Tank level
•0 % value must be set correctly.
•100 % value must be set correctly.
•Used for SIL/WHG = Enabled

Proservo NMS80/81/83
14 Endress+Hauser
Digital output (3)
First select an alarm block (Alarm 1, Alarm 2, Alarm 3 or Alarm 4) for the limit value settings.
Navigate to: Setup → Advanced setup → Application → Alarm → Alarm X
Setting
•Alarm mode = On
•Alarm value source = Tank level (depending on the source)
•HH alarm value, H alarm value, L alarm value and LL alarm value must be configured in line
with the application such that the valid range is within the HH, H and L, LL limits.
Make sure that the correct output is configured (Digital A1-2, Digital A3-4, Digital B1-2, Digital
B3-4, Digital C1-2, Digital C3-4, Digital D1-2, Digital D3-4).
Navigate to: Setup → Advanced setup → Input/output → Digital Xy-z
Setting
•Operating mode = Output passive
•Digital input source = selected alarm block: Alarm 1 any, Alarm 2 any, Alarm 3 any or Alarm 4
any
•Used for SIL/WHG = Enabled must be set to use this digital output as a SIL output.
Calibration of the measuring point - safety function 2 (current input measurement)
The calibration of the measuring point is described in the Operating Instructions (→  7).
Specify which type of configuration c) or d) should be used. Both configurations can apply in parallel
or in combination with safety function 1 (level measurement).
c) Analog input (source) (1) -> safety-related signal: analog output (2)
d) Analog input (source) (1) -> safety-related signal: digital output (3)
Analog input (source) (1)
Make sure that the correct source is configured (Analog I/O B1-3 or Analog I/O C1-3).
Navigate to: Setup → Advanced setup → Input/output → Analog I/O
Setting
•Operating mode = 4..20mA input or HART master+4..20mA input
•Analog input 0% value must be set correctly.
•Analog input 100% value must be set correctly.
Analog output (2)
Make sure that the correct output is configured (Analog I/O B1-3 or Analog I/O C1-3).
Navigate to: Setup → Advanced setup → Input/output → Analog I/O
Setting
•Operating mode = 4..20mA output or HART slave +4..20mA output
•Analog input source = AIO B1-3 value mA or AIO C1-3 value mA (depending on the source)
•0 % value
•100 % value
•Used for SIL/WHG = Enabled
Digital output (3)
First select an alarm block (Alarm 1, Alarm 2, Alarm 3 or Alarm 4) for the limit value settings.
Navigate to: Setup → Advanced setup → Application → Alarm → Alarm X
Setting
•Alarm mode = On
•Alarm value source = AIO B1-3 value mA or AIO C1-3 value mA (depending on the source)
•HH alarm value, H alarm value, L alarm value and LL alarm value must be configured in line
with the application such that the valid range is within the HH, H and L, LL limits.
Make sure that the correct output is configured (Digital A1-2, Digital A3-4, Digital B1-2, Digital
B3-4, Digital C1-2, Digital C3-4, Digital D1-2, Digital D3-4).
Navigate to: Setup → Advanced setup → Input/output → Digital Xy-z

Proservo NMS80/81/83
Endress+Hauser 15
Setting
•Operating mode = Output passive
•Digital input source = selected alarm block (Alarm 1 any, Alarm 2 any, Alarm 3 any or Alarm 4
any)
•Used for SIL/WHG = Enabled must be set to use this digital output as a SIL output.
Configuration method
When using the devices in process control safety systems, the device configuration must comply with
two requirements:
• Confirmation concept:
Proven, independent testing of safety-related parameters entered.
• Locking concept:
Locking of the device once configuration is complete (as required by IEC 61511-1 §11.6.4 and
NE79 §3).
To activate SIL mode, the device must run through an operating sequence, during which the device
can be operated via the device display or any Asset Management Tool (e.g. FieldCare) for which
integration is available.
"Expert mode"
A larger number of safety-related parameters can be freely configured here. This means that the
device can be adapted to difficult applications. However, the settings must be checked by directly
approaching the level in the tank or by applying a comparable method.
A tank with liquid can be used for example as a method for checking in the case of MAX monitoring.
A detailed description of the configuration steps is provided in the following section.
It is only in the case of SIL devices (ordering feature 590 "Additional Approval", option LA "SIL")
that the SIL commissioning sequence is visible on the display and in external operating tools.
For this reason, SIL locking can only be activated on these devices.
Locking in "Expert mode"
To commission the device, carry out and document the following steps in the order shown
(→  31):
1.
Carry out configuration, see also →  13.
The configuration procedure and the meaning of the individual parameters are described in
the Operating Instructions (→  7). Comply with the parameter settings in the following
table (→  17) .
2.
Start the commissioning check and ensure that the distance between the level and reference
position is at least 500 mm (19.7 in).
Navigate to: Diagnostics → Device check → Commissioning check
Commissioning check = Start (for more information, see Operating Instructions →  7).
A commissioning check is carried out. The device's sensor calibration is checked and any
installation errors are detected.
3.
Set Proservo to the "Level" gauge command.
Navigate to: Operation → Gauge command
Gauge command = Level
Proservo returns to level mode. Depending on the tank height and the previous position of
the displacer, wait for a sufficient period of time until the displacer reaches the level surface.
4.
Start the SIL confirmation sequence.
Navigate to: Setup → Advanced setup → SIL/WHG confirmation
SIL/WHG confirmation = Set write protection and enter the relevant locking code (SIL:
7452).
5.
Press "Next" to confirm Commissioning = Expert mode.
The device checks the parameter settings in accordance with the following table (→  17)
and forces the switching of parameters if necessary.
SIL preparation = Finished is shown when the check is finished. The commissioning
sequence can be continued. Press "Next" to confirm.

Proservo NMS80/81/83
16 Endress+Hauser
6.
Carry out function test.
For MIN and MAX monitoring, at least one level/current input value above (MAX
monitoring) or below (MIN monitoring) the switch point must be approached.
For range monitoring, 5 level values/current input values which cover the entire measuring
range should be approached. In doing so, check that the safety-related signal (current output/
relay contact) responds correctly in each case.
7.
Confirm that the function test has been successful.
Confirm function test = Yes.
8.
Set write protection = Enter the locking code again (SIL: 7452). Check the locking status
after performing SIL locking.
Navigate to: Setup → Advanced setup
Locking status = SIL locked must be confirmed by selecting "".
9.
As an option, hardware locking can also be activated (via the dip switch marked "WP" on the
main electronics).

Proservo NMS80/81/83
Endress+Hauser 17
Further parameter settings
The following parameters affect the safety function. However, they may be freely configured in
accordance with the application:
It is recommended to note down the configured values!
Parameter Parameter name
Setup Upper density
Setup Process condition
Setup High stop level
Setup Low stop level
Setup Empty
Current input measurement: Setup → Advanced setup → Input/output → Analog I/O 0 % value
100 % value
The following parameters affect the safety function and are not freely configurable in Expert mode.
Instead, they are automatically set by the device to the safety-related values mentioned at the start
of SIL confirmation:
Parameter Preset value
Operation → Gauge command → Gauge command Level
Setup → Advanced setup → Input/output → Digital input mapping → Digital input
source 1
None
Setup → Advanced setup → Input/output → Digital input mapping → Digital input
source 2
None
Setup → Advanced setup → Input/output → Digital Xy-z → Contact type Normally closed
Setup → Advanced setup → Input/output → Digital Xy-z → Output simulation Disable
Setup → Advanced setup → Application → Tank calculation → HyTD → HyTD mode No
Setup → Advanced setup → Application → Tank calculation → CTSh → CTSh mode No
Setup → Advanced setup → Application → Alarm → Alarm X → Error value All alarms
Setup → Advanced setup → Application → Alarm → Alarm X → Alarm mode On
Setup → Advanced setup → Safety settings → Output out of range Alarm
Diagnostics → Simulation → Simulation distance on Off
Diagnostics → Simulation → Current output 1 simulation Off
Expert → Input/output → Digital Xy-z → Error on event Any error
Expert → Input/output → Analog I/O → Error on event Any error
Expert → Input/output → Analog I/O → Output out of range Alarm
Expert → Input/output → Analog I/O → Feedback threshold 1 s
Those parameters which are not mentioned do not affect the safety function and can be
configured to any meaningful values. The visibility of the parameters mentioned in the
operating menu depends in part on the user role, the SW options ordered and on the
configuration of other parameters.
Unlocking a SIL device
When SIL locking is active on a device, the device is protected against unauthorized operation by
means of a locking code and, as an additional option, by means of a hardware write protection
switch. The device must be unlocked in order to change the configuration for proof-tests as per test
sequence A →  20, test sequence B →  22or test sequence C →  24.

Proservo NMS80/81/83
18 Endress+Hauser
LCAUTION
Unlocking the device deactivates diagnostic functions, and the device may not be able to carry
out its safety function when unlocked.
‣Therefore, independent measures must be taken to ensure that there is no risk of danger while
the device is unlocked.
To unlock, proceed as follows:
1. Check the position of the hardware write protection switch (dip switch marked "WP" on the
main electronics), and set this switch to "OFF".
2. Select the sequence Setup → Advanced setup → Deactivate SIL/WHG and enter the
corresponding unlocking code (SIL: 7452) for the Reset write protection.
 The "End of sequence" message indicates that the device was successfully unlocked.

Proservo NMS80/81/83
Endress+Hauser 19
Proof-testing Check the operativeness and safety of safety functions at appropriate intervals! The operator must
determine the time intervals.
The values and graphics in the "Additional safety-related characteristics" section can be used for this
purpose (→  5). The test must be carried out in such a way that it verifies the correct operation of
the protective system in interaction with all of the components.
In a single-channel architecture, the PFDavg value to be used depends on the diagnostic rate of
coverage for the proof-test (PTC = proof test coverage) and the intended lifetime (LT =
lifetime), as specified in the following formula:
• • • •• • •
PFD = T +PTC MTTR + (1 – PTC) LTl l l
avg DU 1 DD DU
1 1
2 2
A0024244
For the proof-tests described as follows, the respective proof test coverages are specified, which may
be used for calculation. The proof test coverage rates depend on the specific test sequence.
A test sequence for the proof test must be selected from the following table for every safety function
used. If both safety functions are used, two test sequences must be performed for the proof test.
Safety function 1 (level measurement) PTC
Test sequence A – Approach the level 99%
Test sequence B – Simulate the level 91%
Safety function 2 (current input measurement)
Test sequence C – Feed-in real currents 99%
You must also check that all cover seals and cable entries are sealing correctly.
LCAUTION
To ensure process safety.
‣During the proof-test, alternative monitoring measures must be taken to ensure process safety.
If one of the test criteria from the following test sequences is not fulfilled, the device may no
longer be used as part of a protective system. The purpose of proof-testing is to detect random
device failures (λdu). The impact of systematic faults on the safety function is not covered by this
test and must be assessed separately. Systematic faults can be caused, for example, by process
material properties, operating conditions, build-up or corrosion.

Proservo NMS80/81/83
20 Endress+Hauser
Test sequence A (approach the level)
Preparation
1. Level limit value monitoring and range monitoring can also be performed when the SIL mode
is active.
2. If the "Analog" safety-related signal is used, connect a suitable measuring device
(recommended accuracy better than ±0.1 mA) to the current output.
3. If the "Digital" safety-related signal is used, connect a suitable measuring device (resistance
tester/resistance measurement), (recommended accuracy better than ±0.1 Ω) to the digital
output.
4. Determine the safety setting (level limit or range monitoring).
Procedure for level limit monitoring
1. Check safety function: Approach at least one level immediately above (MAX monitoring) or
below (MIN monitoring) the limit to be monitored.
2. Check safety function: Read the output current (mA)/relay resistance value (Ω), record it and
assess for accuracy.
3. If (as an option) the function of the measuring point is to be checked immediately in front of
the switch point: Checks the function in front of MIN or MAX switch point: Approach level
immediately below (MAX monitoring) or above (MIN monitoring) the limit to be monitored.
Read the output current/relay resistance value, record it and assess for accuracy. This does not
check the safety function of the device.
4. The test has been passed successfully if the current values/relay resistance values trigger or
ensure the required function.
Procedure for range monitoring
1. Approach five levels within the range to be monitored.
2. For every level value, read the output current (mA)/relay resistance value (Ω), record it and
assess for accuracy.
3. The test has been passed successfully if the current values/relay resistance values in step 2 are
within the required level of accuracy.
Relay self-monitoring
Relay self-monitoring must only be performed if the "Digital" safety-related signal is used.
Example of terminal designation: If the Digital IO module used for the safety function is installed in
slot D and contacts 3 and 4 are used, Digital D3-4 must be used instead of Digital Xy-z below.
D
E
F
C
B
A
1
1
1
1 3
2
2 4
1
HR
CDI
WP
on
SIM
2
2
3
3
4
4
1
1
2
2
3
3
4
4
5
5
6
6
7
7
8
8
i
D C B A
1 1
2 2
3 3
4 4
1 1
2 2
3 3
4 4
5 5
6 6
7 7
8 8
G1
3
2
POWER
A0032860
1. Deactivate SIL mode. Navigate to: Setup → Advanced setup → Deactivate SIL/WHG and enter
the corresponding unlocking code (SIL: 7452) for the Reset write protection parameter.
2. Perform the device self-check as follows. Navigate to: Setup → Advanced setup
3. Set: Input/output = Digital Xy-z
4. Check whether Contact type = Normally closed (SIL factory setting).
5. Set: Output simulation = Simulating inactive.
6. Check whether the contact is closed (resistance <1 Ω) between contacts Xy and Xz.
7. Set: Output simulation = Fault 1.