Endress+Hauser Proservo NMS80 Instructions for use

Intelligent tank gauge for high-precision measurement of the level of liquids
with a 4-20 mA output signal and switch output
Products Solutions Services
Special Documentation
Proservo NMS80/81/83
Functional Safety Manual
SD01920G/00/EN/01.17
71350261

Proservo NMS80/81/83
2 Endress+Hauser
Table of contents
Declaration of Conformity .................... 3
Other safety-related characteristic values ............. 5
Useful lifetime of electric components ................ 5
Document information ....................... 6
Document function ............................ 6
Using this document ........................... 6
Symbols used ................................ 6
Supplementary device documentation ................ 7
Permitted devices types ...................... 8
SIL label on the nameplate ....................... 9
Safety function ............................. 9
Definition of the safety function .................... 9
Safety-related signal ........................... 9
Restrictions for use in safety-related applications ....... 10
Use in protective systems .................... 12
Device behavior during operation .................. 12
Parameter configuration for safety-related applications ... 13
Proof-testing ............................... 19
Life cycle ................................ 26
Requirements for personnel ..................... 26
Installation ................................. 26
Commissioning .............................. 26
Operation ................................. 26
Maintenance ............................... 26
Repairs ................................... 27
Modification ................................ 28
Appendix ................................ 29
Structure of the measuring system ................. 29
Proof-testing ............................... 31
Notes on the redundant configuration of multiple sensors .. 31
Further information ........................... 31

Proservo NMS80/81/83
Endress+Hauser 3
Declaration of Conformity
A0032861

Proservo NMS80/81/83
4 Endress+Hauser
A0032862

Proservo NMS80/81/83
Endress+Hauser 5
Other safety-related
characteristic values Characteristics as per IEC 61508 Value
Safety function MIN, MAX, Range
SIL SIL 2 (single-channel architecture 1oo1)
SIL 3 (multi-channel architecture, also with homogeneous
redundancy, e.g. 1oo2, 2oo3)
HFT 0
Device type B
Operating mode Low demand mode, high demand mode
SFF 98 %
MTTR 8 h
Recommended time interval for proof-testing T13 years
λsd 23 FIT
λsu 2 528 FIT
λdd 6 205 FIT
λdu 185 FIT
λtot 1) 8 941 FIT
PFDavg for T1 = 1 year 2) 8.59-4
PFDavg for T1 = 2 years 2) 1.67-3
PFH 1.85-7 h-1
MTBF 1) 28 years
Diagnostic test interval 3) 60 min
Fault reaction time 4) 60 s
System reaction time 5) In "Expert mode":
User configurable
1) According to Siemens SN29500. This value takes into account failure types relevant to the function of the
electronic components.
2) Valid for ambient temperature up to +40 °C (+104 °F). Where the average temperature when in continuous
use is in the region of +60 °C (+140 °F), a factor of 2.1 should be taken into account.
3) During this time, all diagnostic functions are executed at least once.
4) Time between error detection and error response.
5) Step response time as per DIN EN 61298-2: 274 s
Useful lifetime of electric
components
The established failure rates of electrical components apply within the useful lifetime as per
IEC 61508-2:2010 section 7.4.9.5, note 3. In accordance with DIN EN 61508-2:2011 section
7.4.9.5, national footnote N3, appropriate measures taken by the manufacturer and operator can
extend the useful lifetime.

Proservo NMS80/81/83
6 Endress+Hauser
Document information
Document function The document is part of the Operating Instructions and serves as a reference for application-specific
parameters and notes.
• General information about functional safety: SIL
• General information about SIL is available:
In the Download Area of the Endress+Hauser Internet site: www.de.endress.com/SIL
Using this document Information on the document structure
For the arrangement of the parameters as per the Operation menu, Setup menu, Diagnostics
menu, along with a short description, see the Operating Instructions for the device
Symbols used Safety symbols
Symbol Meaning
DANGER
DANGER!
This symbol alerts you to a dangerous situation. Failure to avoid this situation will
result in serious or fatal injury.
WARNING
WARNING!
This symbol alerts you to a dangerous situation. Failure to avoid this situation can
result in serious or fatal injury.
CAUTION
CAUTION!
This symbol alerts you to a dangerous situation. Failure to avoid this situation can
result in minor or medium injury.
NOTICE
NOTE!
This symbol contains information on procedures and other facts which do not result in
personal injury.
Symbols for certain types of information
Symbol Meaning
A0011193
Tip
Indicates additional information.
Reference to documentation
A
Reference to page
Reference to graphic
1.
,
2.
,
3.
… Series of steps
Symbols in graphics
Symbol Meaning
1, 2, 3,... Item numbers
1.
,
2.
,
3.
… Series of steps
A, B, C, ... Views

Proservo NMS80/81/83
Endress+Hauser 7
Supplementary device
documentation Documentation Comment
Technical Information:
• TI01248G/00 (NMS80)
• TI01249G/00 (NMS81)
• TI01250G/00 (NMS83)
The documentation is available on the Internet:
→ www.endress.com
Operating Instructions
• BA01456G/00 (NMS80)
• BA01459G/00 (NMS81)
• BA01462G/00 (NMS83)
The documentation is available on the Internet:
→ www.endress.com
Brief Operating Instructions:
• KA01200G/00 (NMS80)
• KA01203G/00 (NMS81)
• KA01206G/00 (NMS83)
• The document is provided with the device.
• The documentation is available on the Internet:
→ www.endress.com
Safety instructions depending on the selected option
"Approval".
Additional safety instructions (XA, ZE) are supplied with
certified device version.
Please refer to the nameplate for the relevant safety
instructions.
This supplementary Safety Manual applies in addition to the Operating Instructions, Technical
Information and ATEX Safety Instructions. The supplementary device documentation must be
observed during installation, commissioning and operation. The requirements specific to the
protection function are described in this Safety Manual.

Proservo NMS80/81/83
8 Endress+Hauser
Permitted devices types
The details pertaining to functional safety in this manual relate to the device versions listed below
and are valid as of the specified software and hardware version. Unless otherwise specified, all
subsequent versions can also be used for safety functions. A modification process according to
IEC 61508 is applied for device changes.
Valid device versions for safety-related use:
Ordering feature Designation Option
010 Approval All
020 Connector type All
030 Power supply; display All
040 Primary output All 1)
E1 4 to 20 mA HART Ex d/XP
H1 4 to 20 mA HART Ex i/IS
050 Secondary I/O analog All 1)
A1 Ex d/XP, 1x 4 to 20 mA HART, 1x RTD input
A2 Ex d/XP, 2x 4 to 20 mA HART, 2x RTD input
B1 Ex i/IS, 1x 4 to 20 mA HART, 1x RTD input
B2 Ex i/IS, 2x 4 to 20 mA HART, 2x RTD input
060 Secondary I/O digital
Ex d/XP
All 1)
A1 2x relay + 2x module, discrete
A2 4x relay + 4x module, discrete
A3 6x relay + 6x module, discrete
B2 Modbus RS485 + 2x relay + 2x module, discrete
B3 Modbus RS485 + 4x relay + 4x module, discrete
070 Housing All except Y
080 Process pressure All
090 Electrical connection All
110 Measuring range; wire;
diameter
All except Y
120 Displacer material; type All except Y
130 Process seal All
140 Process connection All
150 Accuracy, approval for
custody transfer
All
500 Operating languages;
display
All
540 Application package All
570 Service All
580 Test; certificate All
590 Additional approval LA 2) SIL
610 Accessory mounted All
620 Accessory enclosed All
850 Firmware version If no version is selected here, the latest SIL-enabled SW
is supplied. Alternatively, the following SW version
may be selected: 76____01.02.zz
895 Marking All
1) At least one of the versions listed must be selected.
2) An additional selection of further versions is possible.

Proservo NMS80/81/83
Endress+Hauser 9
• Valid firmware version: as of 01.02.zz (→ nameplate of the device)
• Valid hardware version (electronics): as of date of production 23.11.2016 (→ nameplate of the
device)
SIL label on the nameplate SIL certified devices are marked with the following symbol on the nameplate:
Safety function
Definition of the safety
function
The device's safety functions are:
Safety function 1 (level measurement)
• Maximum point level monitoring (overfill protection)
• Minimum point level monitoring (dry run protection)
• Level range monitoring
The safety functions comprise the measurement of the level of a liquid.
Safety function 2 (current input measurement)
Current input monitoring
The safety function comprises the measurement of the current of a connected device.
Safety-related signal Digital
The device's safety-related signal is the closed relay contact of the digital output. All safety measures
refer to this signal exclusively.
The level value (safety function 1: level measurement) or the analog input current (safety function 2:
current input measurement) are correctly converted to a digital output value. The relay contact is
closed within the range of validity, and is open outside this range.
The safety-related output signal is fed to a downstream logic unit, e.g. a programmable logic
controller or a limit signal transmitter where it is monitored for the following:
• Exceed and/or undershoot a specific level limit.
• The occurrence of a fault, e.g. contact open (interruption of the signal line).
In case of fault it must be ensured that the equipment under control achieves or maintains a
safe state.
Analog
The device's safety-related signal is the analog output signal 4 to 20 mA. All safety measures refer to
this signal exclusively.
The device can also communicate via HART for information purposes and contains all the HART
features with additional device information.
The safety-related output signal is fed to a downstream logic unit, e.g. a programmable logic
controller or a limit signal transmitter where it is monitored for the following:
• Exceed and/or undershoot a specific level limit.
• The occurrence of a fault, e.g. error current (≤3.6 mA, ≥21.0 mA), interruption or short-circuit of
the signal line).
In case of fault it must be ensured that the equipment under control achieves or maintains a
safe state.

Proservo NMS80/81/83
10 Endress+Hauser
Restrictions for use in safety-
related applications
• The measuring system must be used correctly for the specific application, taken into account the
medium properties and ambient conditions. Carefully follow instructions pertaining to critical
process situations and installation conditions from the Operating Instructions. The application-
specific limits must be observed.
• Information on the safety-related signal, (→  9).
• The specifications from the Operating Instructions must not be exceeded, (→  7).
• The following restrictions also applies to safety-related use:
– Strong, pulse-like EMC interference on the line can cause transient (< 1 s) deviations ≥ ±2% in
the output signal. For this reason, filtering with a time constant of ≥ 1 s should be performed in
the downstream logic unit.
– The error range is device specific and is defined according to FMEDA (Failure Modes, Effects and
Diagnostic Analysis) on delivery. It includes all influential factors described in the Technical
Information (e.g. non-linearity, non-repeatability, hysteresis, zero drift, temperature drift, EMC
influences).
According to IEC / EN 61508 the safety related failures are classified into different categories,
see the following table. The table shows the implications for the safety-related analog output
signal and for measuring uncertainty.
Safety related error Explanation Implications for the
safety related output
signal
Implications for the
measuring uncertainty
(Position, see figure.
→  10)
No device error Safe:
No error
None 1 Is within the
specification (see TI,
BA, ...)
λSD Safe detected:
Safe failure which can be
detected
Causes the output signal
to signal the failsafe mode
(see, →  12)
3 No implications
λSU Safe undetected:
Safe failure which cannot
be detected
Is within the defined error
range
2 May be beyond the
specification
λDD Dangerous detected:
Dangerous failure which
can be detected
(Diagnostic within the
device)
Causes the output signal
to signal the failsafe mode
(see, →  12)
3 No implications
λDU Dangerous undetected:
Dangerous failure which
cannot be detected
May be outside the
defined error range
4 May be outside the
defined error range
I [mA]
B
C
A
t
1
2
4
3
3
A0025264
A HI-Alarm ≥21 mA
B Error range ±2 %
C LO-Alarm ≤3.6 mA