Endress+Hauser Micropilot FMR60 Instructions for use

Free space radar for liquids and bulk solids with 4 to 20 mA output signal
Products Solutions Services
Special Documentation
Micropilot FMR60/62/67
Functional Safety Manual
SD01950F/00/EN/01.17
71355048

Micropilot FMR60/62/67
2 Endress+Hauser
Table of contents
Declaration of Conformity .................... 3
Other safety-related characteristic values ............. 5
Useful lifetime of electric components ................ 5
Document information ....................... 6
Document function ............................ 6
Using this document ........................... 6
Symbols used ................................ 6
Supplementary device documentation ................ 7
Permitted devices types ...................... 8
SIL label on the nameplate ....................... 8
Safety function ............................. 9
Definition of the safety function .................... 9
Safety-related signal ........................... 9
Restrictions for use in safety-related applications ........ 9
Use in protective systems .................... 11
Device behavior during operation .................. 11
Parameter configuration for safety-related applications ... 12
Proof-testing ............................... 19
Life cycle ................................ 25
Requirements for personnel ..................... 25
Installation ................................. 25
Commissioning .............................. 25
Operation ................................. 25
Maintenance ............................... 25
Repairs ................................... 26
Modification ................................ 27
Decommissioning ............................ 27
Appendix ................................ 28
Structure of the measuring system ................. 28
Proof-testing ............................... 30
Further information ........................... 30
Change history .............................. 30

Micropilot FMR60/62/67
Endress+Hauser 3
Declaration of Conformity
A0033673

Micropilot FMR60/62/67
4 Endress+Hauser
A0033675

Micropilot FMR60/62/67
Endress+Hauser 5
Other safety-related
characteristic values Characteristics as per IEC 61508 Value
System reaction time as per DIN EN 61298-2 In "Increased safety mode"
• for "Medium type = Liquid": <19 s
• for "Medium type = Solid": < 300 s
In "Expert mode"
• for "Medium type = Liquid":
– very fast <6 s
– slow <90 s
• For "Medium type = Solid":
– very fast <6 s
– slow <710 s
Useful lifetime of electric
components
The established failure rates of electrical components apply within the useful lifetime as per
IEC 61508-2:2010 section 7.4.9.5, note 3. In accordance with DIN EN 61508-2:2011 section
7.4.9.5, national footnote N3, appropriate measures taken by the manufacturer and operator can
extend the useful lifetime.

Micropilot FMR60/62/67
6 Endress+Hauser
Document information
Document function The document is part of the Operating Instructions and serves as a reference for application-specific
parameters and notes.
• General information about functional safety: SIL
• General information about SIL is available:
In the Download Area of the Endress+Hauser Internet site: www.de.endress.com/SIL
Using this document Information on the document structure
For the arrangement of the parameters as per the Operation menu, Setup menu, Diagnostics
menu, along with a short description, see the Operating Instructions for the device
Symbols used Safety symbols
Symbol Meaning
DANGER
DANGER!
This symbol alerts you to a dangerous situation. Failure to avoid this situation will
result in serious or fatal injury.
WARNING
WARNING!
This symbol alerts you to a dangerous situation. Failure to avoid this situation can
result in serious or fatal injury.
CAUTION
CAUTION!
This symbol alerts you to a dangerous situation. Failure to avoid this situation can
result in minor or medium injury.
NOTICE
NOTE!
This symbol contains information on procedures and other facts which do not result in
personal injury.
Symbols for certain types of information
Symbol Meaning
A0011193
Tip
Indicates additional information.
Reference to documentation
A
Reference to page
Reference to graphic
1.
,
2.
,
3.
… Series of steps
Symbols in graphics
Symbol Meaning
1, 2, 3,... Item numbers
1.
,
2.
,
3.
… Series of steps
A, B, C, ... Views

Micropilot FMR60/62/67
Endress+Hauser 7
Supplementary device
documentation Documentation Comment
Technical Information:
• TI01302F/00 (FMR60)
• TI01303F/00 (FMR62)
• TI01304F/00 (FMR67)
The documentation is available on the Internet:
→ www.endress.com
Operating Instructions
• BA01618F/00 (FMR60)
• BA01619F/00 (FMR62)
• BA01620F/00 (FMR67)
The documentation is available on the Internet:
→ www.endress.com
Brief Operating Instructions:
• KA01251F/00 (FMR60)
• KA01252F/00 (FMR62)
• KA01253F/00 (FMR67)
• The document is provided with the device.
• The documentation is available on the Internet:
→ www.endress.com
Description of Device Parameters:
GP01101F/00 (in preparation)
The documentation is available on the Internet:
→ www.endress.com
Safety instructions depending on the selected option
"Approval".
Additional safety instructions (XA, ZE) are supplied with
certified device version.
Please refer to the nameplate for the relevant safety
instructions.
This supplementary Safety Manual applies in addition to the Operating Instructions, Technical
Information and ATEX Safety Instructions. The supplementary device documentation must be
observed during installation, commissioning and operation. The requirements specific to the
protection function are described in this Safety Manual.

Micropilot FMR60/62/67
8 Endress+Hauser
Permitted devices types
The details pertaining to functional safety in this manual relate to the device versions listed below
and are valid as of the specified software and hardware version. Unless otherwise specified, all
subsequent versions can also be used for safety functions. A modification process according to
IEC 61508 is applied for device changes.
Valid device versions for safety-related use:
Ordering feature Designation Option
010 Approval All
020 Power Supply;
Output
• A
• B 1)
• C 2)
• K
2-wire; 4-20 mA HART
2-wire; 4-20 mA HART, switch output
2-wire; 4-20 mA HART, 4-20 mA
4-wire 90-253 VAC; 4-20 mA HART
030 Display; operation All
040 Housing All
050 Electrical connection All
070 Antenna All
090 Seal All
100 Process connection All
500 Additional
Operation Language
All
540 Application package All
550 Calibration All
570 Service All
580 Test; Certificate All
590 Additional approval LA 3) SIL
610 Accessory mounted All
620 Accessory enclosed All
850 Firmware version If no version is selected here, the latest SIL-enabled SW is supplied.
Alternatively, the following SW version may be selected :
72 01.00.zz, HART 7, DevRev01
1) For this version with one current output and one switching output, only the current output (terminals 1
and 2) is suitable for safety functions. The switching output can, if necessary, be wired for non-safety-
oriented purposes.
2) For this version with 2 current outputs, only the first output (terminals 1 and 2) is suitable for safety
functions. The second output can, if necessary, be wired for non-safety-oriented purposes.
3) An additional selection of any further versions is possible.
• Valid firmware version: as of 01.00.zz (→ nameplate of the device)
• Valid hardware version (electronics): as of date of production 28.02.2017 (→ nameplate of the
device)
SIL label on the nameplate SIL certified devices are marked with the following symbol on the nameplate:

Micropilot FMR60/62/67
Endress+Hauser 9
Safety function
Definition of the safety
function
The device's safety functions are:
Safety function (level measurement)
• Maximum point level monitoring (overfill protection)
• Minimum point level monitoring (dry run protection)
• Level range monitoring
The safety functions include level measurement of a liquid or bulk solid.
Safety-related signal The safety-related signal is the analog output signal: 4 to 20 mA. All safety measures refer to this
signal exclusively.
For devices with current output and switch output (ordering feature 020 "Power Supply; Output",
option B "2-wire; 4-20 mA HART, switch output"), only the current output (terminals 1 and 2) is
approved for safety functions. The switch output (terminals 3 and 4) can, if necessary, be wired for
non-safety-oriented purposes.
For devices with two current outputs (ordering feature 020 "Power Supply; Output", option C "2-wire;
4-20 mA HART + 4-20 mA analog"), only the first current output (terminals 1 and 2) is approved for
safety functions. The second output (terminals 3 and 4) can, if necessary, be wired for non-safety-
oriented purposes.
The device additionally communicates for information only via HART and contains all HART features
with additional device information.
The safety-related output signal is fed to a downstream logic unit, e.g. a programmable logic
controller or a limit signal transmitter where it is monitored for the following:
• Exceed and/or undershoot a specific level limit.
• The occurrence of a fault, e.g. error current (≤3.6 mA, ≥21.0 mA, interruption or short-circuit of
the signal line).
In case of fault it must be ensured that the equipment under control achieves or maintains a
safe state.
Restrictions for use in safety-
related applications
• The measuring system must be used correctly for the specific application, taken into account the
medium properties and ambient conditions. Carefully follow instructions pertaining to critical
process situations and installation conditions from the Operating Instructions. The application-
specific limits must be observed.
• Information on the safety-related signal, (→  9).
• The specifications from the Operating Instructions must not be exceeded, (→  7).
• The following restrictions also applies to safety-related use:
– Strong, pulse-like EMC interference on the line can cause transient (< 1 s) deviations ≥ ±2% in
the output signal. For this reason, filtering with a time constant of ≥ 1 s should be performed in
the downstream logic unit.
– The error range is device specific and is defined according to FMEDA (Failure Modes, Effects and
Diagnostic Analysis) on delivery. It includes all influential factors described in the Technical
Information (e.g. non-linearity, non-repeatability, hysteresis, zero drift, temperature drift, EMC
influences).
According to IEC / EN 61508 the safety related failures are classified into different categories,
see the following table. The table shows the implications for the safety-related analog output
signal and for measuring uncertainty.

Micropilot FMR60/62/67
10 Endress+Hauser
Safety related error Explanation Implications for the
safety related output
signal
Implications for the
measuring uncertainty
(Position, see figure
→  10)
No device error Safe:
No error
None 1 Is within the
specification (see TI,
BA, ...)
λSD Safe detected:
Safe failure which can be
detected
Causes the output signal
to signal the failsafe mode
(see, →  11)
3 No implications
λSU Safe undetected:
Safe failure which cannot
be detected
Is within the defined error
range
2 May be beyond the
specification
λDD Dangerous detected:
Dangerous failure which
can be detected
(Diagnostic within the
device)
Causes the output signal
to signal the failsafe mode
(see, →  11)
3 No implications
λDU Dangerous undetected:
Dangerous failure which
cannot be detected
May be outside the
defined error range
4 May be outside the
defined error range
I [mA]
B
C
A
t
1
2
4
3
3
A0025264
A HI-Alarm ≥21 mA
B Error range ±2 %
C LO-Alarm ≤3.6 mA
Dangerous undetected failures in this scenario
An incorrect output signal that deviates from the real measured value by more than 2 %, but is still
in the range of 4 to 20 mA, is considered a dangerous, undetected failure.

Micropilot FMR60/62/67
Endress+Hauser 11
Use in protective systems
Device behavior during
operation
Device behavior in SIL-locked state
After SIL locking, additional diagnostics are active and critical parameters in the safety path are
set to safe values (→  15). Therefore, the behavior of the device in the "SIL-locked state"
may deviate from the "non-SIL-locked state". If a test phase takes place before the system is
finally put into production, it is recommended that this test phase be run in the locked state in
order to obtain the most conclusive results possible.
Device behavior during power-up
Once switched on, the device runs through a diagnostic phase of approx. 30 seconds. The current
output is set to error current during this time. For approx. 5 seconds of this diagnostic phase, this
current is ≤3.6 mA. After that, depending on the setting of the "Start-up mode" parameter, the
current is:
• at the MIN value: ≤3.6 mA
• at the MAX value : ≥21.0 mA
During the diagnostic phase, no communication is possible via the service interface (CDI) or via
HART.
Device behavior in safety function demand mode
The device outputs a current value corresponding to the limit value to be monitored. This value must
be monitored and processed further in an attached logic unit.
Device behavior in event of alarms and warnings
The output current on alarm can be set to a value ≤3.6 mA or ≥21.0 mA.
In some cases (e.g. failure of power supply, a cable open circuit and faults in the current output itself,
where the error current ≥21.0 mA cannot be set), output currents ≤3.6 mA irrespective of the
configured fault current can occur.
In some other cases (e.g. short circuit of cabling), output currents of ≥21.0 mA occur irrespective of
the configured error current.
For alarm monitoring, the logic unit must therefore be able to recognize failure currents of the upper
level for signal on alarm (≥21.0 mA) and of the lower level for signal on alarm (≤3.6 mA).
Alarm and warning messages
Additional information is provided by the alarm and warning messages in the form of error codes
and associated clear text messages.
The following table shows the correlation between the error code and the current output:
Error code 1) Current output (message type) Note
Fxxx ≥21.0 mA or ≤3.6 mA xxx = three-digit number
Mxxx corresponding to measuring mode xxx = three-digit number
Cxxx corresponding to measuring mode xxx = three-digit number
Sxxx corresponding to measuring mode xxx = three-digit number
1) The error codes are listed in the Operating Instructions.

Micropilot FMR60/62/67
12 Endress+Hauser
Exceptions:
Error code 1) Current output (message type) Note
M272 ≥21.0 mA or ≤3.6 mA Main electronic failure
C484 ≥21.0 mA or ≤3.6 mA Simulation failure mode
S942 ≥21.0 mA or ≤3.6 mA In safety distance
1) The error codes are listed in the Operating Instructions.
When SIL locking is active on the device, additional diagnostics are activated (e.g. a comparison
between the readback-current with the nominal value). If one of these diagnostics results in an
error message (e.g. F803 loop current) and the SIL locking is then deactivated, the error
message remains while the error persists, even it the diagnostic is no longer active in the unlock
state. In this case, the device must be disconnected briefly from the power supply (e.g. by
unplugging the terminals). When the device is then restarted, a self-check is carried out, and
the error message is reset where applicable.
Parameter configuration for
safety-related applications
Calibration of the measuring point
Calibration of the measuring point is described in the Operating Instructions (→  7).
Check th initial factory setting of the E (zero point) and F (range) parameters in accordance with the
desired measuring range and correct if necessary.
Methods of device configuration
When using the devices in process control safety systems, the device configuration must comply with
two requirements:
• Confirmation concept:
Proven, independent testing of safety-related parameters entered.
• Locking concept:
Locking of the device once configuration is complete (as required by IEC 61511-1 §11.6.4 and
NE79 §3).
To activate the SIL mode, the device must run through an operating sequence, during which the
device can be operated by means of the device display or any asset management tool (FieldCare,
Pactware, AMS, PDM, Field Communicator 375/475, ...) for which integration is available.
Two methods of configuring the device are provided, which differ mainly with regard to the
confirmation concept:
• "Increased safety mode"
While running through the commissioning sequence here, critical parameters which control
functions in the safety path are either set automatically by the device to safe values or transferred
to the display/operating tool via an alternative data format, to enable checking of the setting.
This mode can be used for standard applications. As there are only a few safety-related
parameters which can be freely configured, the risk of operating errors is greatly reduced, and the
level in the tank does not need to be changed during commissioning in order to check the settings.
• "Expert mode"
A larger number of safety-related parameters can be freely configured here. This means that the
device can be adapted to difficult applications. However, the settings must be checked by directly
approaching the level in the tank or a similar method.
A mechanical swivel reflector can be used for example as a method for checking in the case of
MAX monitoring. When using a swivel reflector, the device must be correctly configured in the
operating menu: Setup → Advanced setup → Level
Set: Max. filling speed liquid = Very fast > 2m (80in) /min.
A detailed description of both modes is provided in the following sections.
It is only in the case of SIL devices (ordering feature 590 "Additional Approval", option LA "SIL")
that the SIL commissioning sequence is visible on the display and in external operating tools.
For this reason, SIL locking can only be activated on these devices.

Micropilot FMR60/62/67
Endress+Hauser 13
Locking in "Increased safety mode"
To commission the device, carry out and document the following steps in the order shown
(→  30).
1.
Reset device. This resets all parameters to defined values.
Navigate to: Setup → Advanced setup → Administration
Setting
Device reset = To factory defaults or To delivery settings
2.
Carry out configuration. The configuration procedure and the meaning of the individual
parameters are described in the Operating Instructions (→  7). The following parameter
settings must be observed (→  15).
3.
Perform a device check (for more details, see the Operating Instructions →  7). The signal
quality is tested here and possible installation errors are detected.
Navigate to: Diagnostics → Device check
Setting
Start device check = Yes
4.
Start SIL/WHG confirmation sequence.
Navigate to: Setup → Advanced setup → SIL/WHG confirmation
Setting
Set write protection = enter the relevant locking code (HG: 7450; SIL: 7452; SIL and WHG:
7454).
In this way, forbidden parameter changes (e.g. via external operating tools if the
confirmation sequence is performed at the device display) are prevented already during
the SIL/WHG confirmation sequence.
5.
Setting
Commissioning = Increased safety mode
The device checks the parameter settings in accordance with the following table and forces
the switching of parameters if necessary.
When the check is finished, SIL/WHG preparation = Finished is shown. The commissioning
sequence can be continued. Press "Next" to confirm.
• If configuration was not performed in accordance with the specifications in point 2,
only "Expert mode" can be selected at this point.
• The commissioning mode must not be changed during the completion of the SIL
confirmation sequence. If the wrong option has been selected, the sequence must be
canceled and started again.
6.
Simulate distance values using the Simulation distance parameter, verifying that the
response of the current output is correct. For MIN monitoring and MAX monitoring, in each
case simulate a distance directly above and below the switch point. For range monitoring, 5
distance values should be simulated which cover the entire measuring range.
LCAUTION
During distance simulation, the loop current does not correspond to the measured value.
‣It must be ensured that there is no risk of danger arising from this.
7.
Confirm that the distance simulation is correct.
Setting
Simulation correct = Yes.
8.
Compare the character string which is now output ("0123456789+-,.") with the reference
string printed here, and confirm if the output is correct.
9.
The parameters previously configured and which require confirmation are transferred via an
independent data format to the display/operating tool. Check the parameters one after the
other and confirm if correct.

Micropilot FMR60/62/67
14 Endress+Hauser
10.
Setting
Set write protection = enter the locking code again (WHG: 7450; SIL: 7452; SIL and WHG:
7454). Check the locking status after performing SIL locking.
Navigate to: Setup → Advanced setup
Setting
Locking status = SIL locked must be confirmed by selecting "".
11.
As an option, hardware locking can also be activated (via the dip switch marked "WP" on the
main electronics).
Locking in "Expert mode"
To commission the device, carry out and document the following steps in the order shown
(→  30).
1.
Reset device. This resets all parameters to defined values.
Navigate to: Setup → Advanced setup → Administration
Setting
Device reset = To factory defaults or To delivery settings
2.
Carry out configuration. The configuration procedure and the meaning of the individual
parameters are described in the Operating Instructions (→  7). The following parameter
settings must be observed (→  15).
3.
Perform a device check (for more details, see the Operating Instructions →  7). The signal
quality is tested here and possible installation errors are detected.
Navigate to: Diagnostics → Device check
Setting
Start device check = Yes
4.
Start SIL/WHG confirmation sequence.
Navigate to: Setup → Advanced setup → SIL/WHG confirmation
Setting
Set write protection = enter the relevant locking code (HG: 7450; SIL: 7452; SIL and WHG:
7454).
5.
Setting
Commissioning = Expert mode
The device checks the parameter settings in accordance with the following table and forces
the switching of parameters if necessary.
When the check is finished, SIL/WHG preparation = Finished is shown. The commissioning
sequence can be continued. Press "Next" to confirm.
The commissioning mode must not be changed during the completion of the SIL
confirmation sequence. If the wrong option has been selected, the sequence must be
canceled and started again.
6.
Carry out function test.
For MIN and MAX monitoring, at least one level below (MIN monitoring) or above (MAX
monitoring) the switch point must be approached.
For range monitoring, 5 distance values should be approached which cover the entire
measuring range. Verify in each case that the response of the current output is correct.
7.
Confirm that the function test has been successful.
Setting
Confirm function test = Yes
8.
Setting
Set write protection = enter the locking code again (WHG: 7450; SIL: 7452; SIL and WHG:
7454). Check the locking status after performing SIL locking.
Navigate to: Setup → Advanced setup → Locking status
Setting
Locking status = SIL locked must be confirmed by selecting "".
9.
Optional, hardware locking may also be activated (via the dip switch marked "WP" on main
electronics).

Micropilot FMR60/62/67
Endress+Hauser 15
Further parameter settings
The following parameters affect the safety function. However, they may be freely configured in
accordance with the application. In increased safety mode, it is necessary to confirm the configured
values during the remainder of the commissioning process. Confirmation is not required in expert
mode.
It is recommended to note down the configured values!
Parameter Parameter name
Setup
Empty calibration
Full calibration
Tank type 1)
Bin type 2)
Max. filling speed solid 2)
Max. draining speed solid 2)
Medium group
Setup → Advanced setup → Level Tank/silo height
1) Only for liquid measurement
2) Only for bulk solids measurement
The following parameters affect the safety function and are not freely configurable in increased
safety mode. Instead, they are automatically changed by the device at the start of the SIL/WHG
confirmation to the safety-oriented values mentioned. If these parameters are to be set to other
values, expert mode must be selected.
Parameter Preset value
Setup → Advanced setup → Level → Level correction 0
Setup → Advanced setup → Linearization → Linearization type None
Setup → Advanced setup → Current output 1 → Damping output 0
Expert → Sensor → Level → Distance offset 0
Expert → Sensor → Level → L max. drain speed 0
Expert → Sensor → Level → L max. fill speed 0
Expert → Sensor → Level → Level limit mode Off
Expert → Sensor → Level → Output mode Ullage
Expert → Sensor → Safety settings → Jump delay echo lost Off
Expert → Sensor → Safety settings → Delay time echo lost 3 s
Expert → Sensor → Safety settings → Output echo lost Alarm
Expert → Sensor → Safety settings → In safety distance Alarm
Expert → Sensor → Echo tracking → Evaluation mode History off
Expert → Output → Current output 1 → Turn down Off
Expert → Output → Current output 1 → Measuring mode Standard
Expert → Communication → Configuration → HART address 0

Micropilot FMR60/62/67
16 Endress+Hauser
The following parameters affect the safety function and are automatically adapted by the device
when configuring higher-ranking parameters (known as application parameters). Values can not be
specified as the higher-ranking parameters may be freely configurable. This indirect setting is
permitted in increased safety mode. However, it is not permitted to change the parameters directly.
If these parameters were changed directly, only expert mode is available for selection in the
SIL/WHG confirmation.
Parameter Parameter name
Setup → Advanced setup → Level
Medium property
Max. draining speed liquid
Max. filling speed liquid
Blocking distance
Expert → Sensor → Distance
Dead time
Integration time
Max. integration time
Delta at integration time
Expert → Sensor → Safety settings
Echo lost window right
Echo lost window left
Draining speed
Filling speed
Expert → Sensor → Envelope curve
Envelope statistics down
Envelope statistics up
FAC offset
Expert → Sensor → Mapping Map gap
End of mapping
Expert → Sensor → Echo fine adjustment Fine adjustment mode
Expert → Sensor → Tank bottom evaluation Min. amplitude TBD
Lower level area
Expert → Sensor → Echo tracking Window size tracking
Maximal track counter

Micropilot FMR60/62/67
Endress+Hauser 17
The following parameters affect the safety function and cannot be freely configured in increased
safety mode or in expert mode. Instead they are automatically changed by the device at the start of
the SIL/WHG confirmation to the safety-oriented values mentioned.
Parameter Preset value
Setup → Advanced setup → Safety settings → Output echo lost Alarm
Setup → Advanced setup → Display → Backlight Disable
Diagnostics → Simulation → Assign measurement variable Off
Diagnostics → Simulation → Current output 1 to 2 simulation Off
Diagnostics → Simulation → Device alarm simulation Off
Diagnostics → Simulation → Diagnostic event simulation Off
Expert → Sensor → Distance → Velocity filter Off
Expert → Output → Current output 1 → Trim Off
Expert → Output → Current output 2 → Trim Off
Expert → Diagnostics → Simulation → Simulation distance on Off
The following parameters affect the safety function. If the settings differ from the as-delivered state
of the device, only expert mode is available for selection in the SIL/WHG confirmation. Values can
not be specified as the delivery state depends on the order code.
Parameter Parameter name
Setup → Advanced setup → Level Medium type
Setup → Advanced setup → Current output 1 Current span
Setup → Advanced setup → Current output 2 Current span
Expert → Sensor → Distance Blocking distance evaluation mode
Expert → Sensor → Envelope curve
Envelope curve statistic
Envelope smoothing mode
FAC window size
Max Value EWC
Expert → Sensor → Sensor properties Antenna zero distance
Expert → Sensor → Mapping Mapping Threshold
Mapping window size
Expert → Sensor → First echo factor First echo factor
Expert → Sensor → Echo fine adjustment Parabolic fit window size
Edge correction
Expert → Sensor → Tank bottom evaluation Tank bottom range
Expert → Sensor → Echo tracking Moving track recognition

Micropilot FMR60/62/67
18 Endress+Hauser
The following parameters affect the safety function. If the settings differ from the permitted values
mentioned, the SIL/WHG confirmation is canceled automatically, and the device cannot be locked
neither in increased safety mode nor in expert mode.
Parameter Parameter name
Setup → Advanced setup → Current output 1 Assign current output
Failure mode = Min. or Max.
Expert → Output → Current output 1 Assign current output
Start-up mode = Min. or Max.
Expert → Communication → Output Assign PV
• Those parameters which are not mentioned do not affect the safety function and can be
configured to any meaningful values. The visibility of the parameters mentioned in the
operating menu depends in part on the user role, the SW options ordered and on the
configuration of other parameters.
• In the SIL mode, the device must not be operated in HART-Multidrop mode, as otherwise the
current output will assume a fixed value. For this reason, only the following setting is
permitted in the SIL mode and in the combined SIL/WHG mode when in increased safety
mode: Expert → Communication → Configuration → HART address = 0. In pure WHG mode,
HART Multidrop is permitted in the expert mode as long as the HART signal is evaluated in
an external switching unit (e.g. Tank Side Monitor NRF590) that complies with the approval
principles as per WHG.
Unlocking a SIL device
When SIL locking is active on a device, the device is protected against unauthorized operation by
means of a locking code and, as an additional option, by means of a hardware write protection
switch. The device must be unlocked in order to change the configuration, to perform proof tests as
per test sequence B→  21, test sequence C→  22 or test sequence D→  23 , as well as to
reset self-holding diagnostic messages.
LCAUTION
Unlocking the device deactivates diagnostic functions, and the device may not be able to carry
out its safety function when unlocked.
‣Therefore, independent measures must be taken to ensure that there is no risk of danger while
the device is unlocked.
To unlock, proceed as follows:
1. Check the position of the hardware write protection switch (dip switch marked "WP" on main
electronics), and set this switch to "Off".
2. Select the sequence Setup → Advanced setup → Deactivate SIL/WHG and enter the relevant
locking code for the Reset write protection parameter (WHG: 7450; SIL: 7452; SIL and WHG:
7454).
 The "End of sequence" message indicates that the device was successfully unlocked.

Micropilot FMR60/62/67
Endress+Hauser 19
Proof-testing Check the operativeness and safety of safety functions at appropriate intervals! The operator must
determine the time intervals.
The values and graphics in the "Additional safety-related characteristics" section can be used for this
purpose →  5. The test must be carried out in such a way that it verifies the correct operation of
the protective system in interaction with all of the components.
The values and graphics in the "Additional safety-related characteristics" section can be used for this
purpose →  5. The test must be carried out in such a way that it verifies the correct operation of
the protective system in interaction with all of the components.
In a single-channel architecture, the PFDavg value to be used depends on the diagnostic rate of
coverage for the proof-test (PTC = proof test coverage) and the intended lifetime (LT =
lifetime), as specified in the following formula:
• • • •• • •
PFD = T +PTC MTTR + (1 – PTC) LTl l l
avg DU 1 DD DU
1 1
2 2
A0024244
For the proof-tests described as follows, the respective proof test coverages are specified, which may
be used for calculation.
The following proof tests can be applied here:
Test sequence A Approach the level in the original vessel.
Test sequence B Remove the device and test using a test vessel. No change of level in the tank is
necessary for this sequence.
Test sequence C Device self-test and level simulation.
Test sequence D Device self-test and level simulation. No change of level in the tank is necessary
for this sequence. Additional checking of the measurement at an arbitrary level
within the measuring range. This achieves a higher diagnostic rate of coverage
than with test sequence C without changing the level.
You must also check that all cover seals and cable entries are sealing correctly.
LCAUTION
To ensure process safety.
‣During the proof-test, alternative monitoring measures must be taken to ensure process safety.
If one of the test criteria from the following test sequences is not fulfilled, the device may no
longer be used as part of a protective system. The purpose of proof-testing is to detect random
device failures (λdu). The impact of systematic faults on the safety function is not covered by this
test and must be assessed separately. Systematic faults can be caused, for example, by process
material properties, operating conditions, build-up or corrosion.

Micropilot FMR60/62/67
20 Endress+Hauser
Test sequence A
Preparation
1. Connect suitable measuring device (recommended accuracy better than ±0.1 mA) to the
current output.
2. Determine the safety setting (level limit or range monitoring).
Procedure for level limit monitoring
1. Approach at least one level directly above (MAX monitoring) or directly below (MIN
monitoring) the level limit to be monitored. A mechanical swivel reflector can be used for
example as a method for checking in the case of MAX monitoring. When using a swivel
reflector, the device must be correctly configured in the operating menu when commissioning
for the first time.
Navigate to: Setup → Advanced setup → Level and configure the following: Max. filling speed
liquid = Very fast > 2m (80in) /min
 The safety function is checked.
2. Check safety function: Read the output current, record it and assess for accuracy.
3. If (as an option) the function of the measuring point is to be checked immediately in front of
the switch point: Checks the function in front of MIN or MAX switch point: Approach level
immediately below (MAX monitoring) or above (MIN monitoring) the limit to be monitored.
Read the output current, record it and assess for accuracy. This does not check the safety
function of the device.
 The test is to be considered successful if the current values trigger or ensure the required
function.
Procedure for range monitoring
1. Approach five levels within the range to be monitored.
2. Read the output current at each level value, record it and assess for accuracy.
 The test is to be considered successful if the current values in step 2 are within the
required level of accuracy.
The proof-test is to be considered to have failed if the expected current value deviates for a
specific level by > ±2 %. For troubleshooting, refer to the Operating Instructions (→  7). 99 %
of dangerous, undetected failures are detected using this test (Proof test coverage, PTC = 0.99).