Endress+Hauser Micropilot NMR81 Instructions for use

Free space radar for liquids with output signal 4...20 mA and switch output
Products Solutions Services
Special Documentation
Micropilot NMR81/84
Functional Safety Manual
SD01891G/00/EN/03.18
71413288
2018-08-10

Micropilot NMR81/84
2 Endress+Hauser
Table of contents
Declaration of Conformity .................... 3
Other safety-related characteristic values ............. 4
Useful lifetime of electric components ................ 5
Certificate ................................ 5
Document information ....................... 6
Document function ............................ 6
Using this document ........................... 6
Symbols used ................................ 6
Supplementary device documentation ................ 7
Permitted devices types ...................... 8
SIL label on the nameplate ....................... 9
Safety function ............................. 9
Definition of the safety function .................... 9
Safety-related signal ........................... 9
Restrictions for use in safety-related applications ....... 10
Use in protective systems .................... 12
Device behavior during operation .................. 12
Parameter configuration for safety-related applications ... 13
Proof-testing ............................... 19
Life cycle ................................ 28
Requirements for personnel ..................... 28
Installation ................................. 28
Commissioning .............................. 28
Operation ................................. 28
Maintenance ............................... 28
Repairs ................................... 29
Modification ................................ 29
Appendix ................................ 30
Structure of the measuring system ................. 30
Proof-testing ............................... 32
Information regarding redundant connection of multiple
sensors ................................... 32
Further information ........................... 32

Micropilot NMR81/84
Endress+Hauser 3
Declaration of Conformity
A0037370

Micropilot NMR81/84
4 Endress+Hauser
A0037371
Other safety-related
characteristic values Characteristics as per IEC 61508 Value
MTBF 1) 25 years
System reaction time as per DIN EN 61508-2 In "Expert mode":
User configurable
1) According to Siemens SN29500. This value takes into account failure types relevant to the function of the
electronic components.

Micropilot NMR81/84
Endress+Hauser 5
Useful lifetime of electric
components
The established failure rates of electrical components apply within the useful lifetime as per
IEC 61508-2:2010 section 7.4.9.5, note 3. In accordance with DIN EN 61508-2:2011 section
7.4.9.5, national footnote N3, appropriate measures taken by the manufacturer and operator can
extend the useful lifetime.
Certificate
A0036652

Micropilot NMR81/84
6 Endress+Hauser
Document information
Document function The document is part of the Operating Instructions and serves as a reference for application-specific
parameters and notes.
• General information about functional safety: SIL
• General information about SIL is available:
In the Download Area of the Endress+Hauser Internet site: www.de.endress.com/SIL
Using this document Information on the document structure
For the arrangement of the parameters as per the Operation menu, Setup menu, Diagnostics
menu, along with a short description, see the Operating Instructions for the device
Symbols used Safety symbols
Symbol Meaning
DANGER
DANGER!
This symbol alerts you to a dangerous situation. Failure to avoid this situation will
result in serious or fatal injury.
WARNING
WARNING!
This symbol alerts you to a dangerous situation. Failure to avoid this situation can
result in serious or fatal injury.
CAUTION
CAUTION!
This symbol alerts you to a dangerous situation. Failure to avoid this situation can
result in minor or medium injury.
NOTICE
NOTE!
This symbol contains information on procedures and other facts which do not result in
personal injury.
Symbols for certain types of information
Symbol Meaning
A0011193
Tip
Indicates additional information.
Reference to documentation
A
Reference to page
Reference to graphic
1.
,
2.
,
3.
… Series of steps
Symbols in graphics
Symbol Meaning
1, 2, 3,... Item numbers
1.
,
2.
,
3.
… Series of steps
A, B, C, ... Views

Micropilot NMR81/84
Endress+Hauser 7
Supplementary device
documentation Documentation Comment
Technical Information:
• TI01252G/00 (NMR81)
• TI01253G/00 (NMR84)
The documentation is available on the Internet:
→ www.endress.com
Operating Instructions
• BA01450G/00 (NMR81)
• BA01453G/00 (NMR84)
The documentation is available on the Internet:
→ www.endress.com
Brief Operating Instructions (HART):
• KA01194G/00 (NMR81)
• KA01197G/00 (NMR84)
• The document is provided with the device.
• The documentation is available on the Internet:
→ www.endress.com
Safety instructions depending on the selected option
"Approval".
Additional safety instructions (XA, ZE) are supplied with
certified device version.
Please refer to the nameplate for the relevant safety
instructions.
This supplementary Safety Manual applies in addition to the Operating Instructions, Technical
Information and ATEX Safety Instructions. The supplementary device documentation must be
observed during installation, commissioning and operation. The requirements specific for the
protection function are described in this Safety Manual.

Micropilot NMR81/84
8 Endress+Hauser
Permitted devices types
The details pertaining to functional safety in this manual relate to the device versions listed below
and are valid as of the specified software and hardware version. Unless otherwise specified, all
subsequent versions can also be used for safety instrumented systems. . A modification process
according to IEC 61508 is applied for device changes.
Valid device versions for safety-related use:
Order code Designation Option
010 Approval All
020 Connector type All
030 Power supply; display All
040 Primary output see next table
050 Secondary I/O analog see next table
060 Secondary I/O digital Ex d/XP see next table
070 Housing All except Y9
090 Electrical connection All
100 Antenna All
130 Process seal All
140 Process connection All
150 Accuracy, approval for custody transfer All
500 Operating languages; display All
540 Application package All
570 Service All
580 Test; certificate All
590 Additional approval LA 1) SIL
610 Accessory mounted All
620 Accessory enclosed All
850 Firmware version If no version is selected here, the latest SIL-
enabled SW is supplied. Alternatively, the
following SW version may be selected:
01.02.zz or 01.03.zz
895 Marking All
1) An additional selection of further versions is possible.
Order code 040 050 060
Option
E1 * *
H1 * *
* A1 *
* A2 *
* B1 *
* B2 *
* C2 *
* * A1
* * A2
* * A3

Micropilot NMR81/84
Endress+Hauser 9
Order code 040 050 060
* * B2
* * B3
* All options are possible. (This selection does not affect SIL capability.)
• Valid firmware version: as of 01.02.zz or 01.03.zz (→ nameplate of the device)
• Valid hardware version (electronics): as of date of production 23.11.2016 (→ nameplate of the
device)
SIL label on the nameplate SIL certified devices are marked with the following symbol on the nameplate:
Safety function
Definition of the safety
function
The device's safety functions are:
Safety function 1 (level measurement)
• Maximum point level monitoring (overfill protection)
• Minimum point level monitoring (dry run protection)
• Level range monitoring
The safety functions comprise the measurement of the level of a liquid.
Safety-related signal Digital
The device's safety-related signal is the closed relay contact of the digital output. All safety measures
refer to this signal exclusively.
The level value (safety function 1: level measurement) or the analog input current (safety function 2:
current input measurement) are correctly converted to a digital output value. The relay contact is
closed within the range of validity, and is open outside this range.
The safety-related output signal is fed to a downstream logic unit, e.g. a programmable logic
controller or a limit signal transmitter where it is monitored for the following:
• Exceed and/or undershoot a specific level limit.
• The occurrence of a fault, e.g. contact open (interruption of the signal line).
In case of fault it must be ensured that the equipment under control achieves or maintains a
safe state.
Analog
The device's safety-related signal is the analog output signal 4 to 20 mA. All safety measures refer to
this signal exclusively.
The device can also communicate via HART for information purposes and contains all the HART
features with additional device information.
The safety-related output signal is fed to a downstream logic unit, e.g. a programmable logic
controller or a limit signal transmitter where it is monitored for the following:
• Exceed and/or undershoot a specific level limit.
• The occurrence of a fault, e.g. error current (≤3.6 mA, ≥21.0 mA, interruption or short-circuit of
the signal line).
In case of fault it must be ensured that the equipment under control achieves or maintains a
safe state.

Micropilot NMR81/84
10 Endress+Hauser
Restrictions for use in safety-
related applications
• The measuring system must be used correctly for the specific application, taken into account the
medium properties and ambient conditions. Pay attention to the information concerning critical
process situations and installation conditions in the Operating Instructions/Technical Information.
The application-specific limits must be observed throughout the entire safety life cycle.
• Information on the safety-related signal, (→  10).
• The specifications from the Operating Instructions must not be exceeded, (→  7).
• The following restrictions also applies to safety-related use:
– Strong, pulse-like EMC interference on the line can cause transient (<1 s) deviations ≥±2 % in
the output signal. For this reason, filtering with a time constant ≥1 s should be performed in the
downstream logic unit.
– The error range is device specific and is defined according to FMEDA (Failure Modes, Effects and
Diagnostic Analysis) on delivery. It includes all influential factors described in the Technical
Information (e.g. non-linearity, non-repeatability, hysteresis, zero drift, temperature drift, EMC
influences).
According to IEC / EN 61508 the safety related failures are classified into different categories,
see the following table. The table shows the implications for the safety-related analog output
signal and for measuring uncertainty.
Safety related error Explanation Implications for the
safety related output
signal
Implications for the
measuring uncertainty
(Position, see figure
→  10)
No device error Safe:
No error
None 1 Is within the
specification (see TI,
BA, ...)
λSD Safe detected:
Safe failure which can be
detected
Causes the output signal
to signal the failsafe mode
(see, →  12)
3 No implications
λSU Safe undetected:
Safe failure which cannot
be detected
Is within the defined error
range
2 May be beyond the
specification
λDD Dangerous detected:
Dangerous failure which
can be detected
(Diagnostic within the
device)
Causes the output signal
to signal the failsafe mode
(see, →  12)
3 No implications
λDU Dangerous undetected:
Dangerous failure which
cannot be detected
May be outside the
defined error range
4 May be outside the
defined error range
I [mA]
B
C
A
t
1
2
4
3
3
A0025264
A HI-Alarm ≥21 mA
B Error range ±2 %
C LO-Alarm ≤3.6 mA