Endress+Hauser Micropilot NMR81 Instructions for use

Free space radar for liquids with output signal 4...20 mA and switch output
Products Solutions Services
Special Documentation
Micropilot NMR81/84
Functional Safety Manual
SD01891G/00/EN/03.18
71413288
2018-08-10

Micropilot NMR81/84
2 Endress+Hauser
Table of contents
Declaration of Conformity .................... 3
Other safety-related characteristic values ............. 4
Useful lifetime of electric components ................ 5
Certificate ................................ 5
Document information ....................... 6
Document function ............................ 6
Using this document ........................... 6
Symbols used ................................ 6
Supplementary device documentation ................ 7
Permitted devices types ...................... 8
SIL label on the nameplate ....................... 9
Safety function ............................. 9
Definition of the safety function .................... 9
Safety-related signal ........................... 9
Restrictions for use in safety-related applications ....... 10
Use in protective systems .................... 12
Device behavior during operation .................. 12
Parameter configuration for safety-related applications ... 13
Proof-testing ............................... 19
Life cycle ................................ 28
Requirements for personnel ..................... 28
Installation ................................. 28
Commissioning .............................. 28
Operation ................................. 28
Maintenance ............................... 28
Repairs ................................... 29
Modification ................................ 29
Appendix ................................ 30
Structure of the measuring system ................. 30
Proof-testing ............................... 32
Information regarding redundant connection of multiple
sensors ................................... 32
Further information ........................... 32

Micropilot NMR81/84
Endress+Hauser 3
Declaration of Conformity
A0037370

Micropilot NMR81/84
4 Endress+Hauser
A0037371
Other safety-related
characteristic values Characteristics as per IEC 61508 Value
MTBF 1) 25 years
System reaction time as per DIN EN 61508-2 In "Expert mode":
User configurable
1) According to Siemens SN29500. This value takes into account failure types relevant to the function of the
electronic components.

Micropilot NMR81/84
Endress+Hauser 5
Useful lifetime of electric
components
The established failure rates of electrical components apply within the useful lifetime as per
IEC 61508-2:2010 section 7.4.9.5, note 3. In accordance with DIN EN 61508-2:2011 section
7.4.9.5, national footnote N3, appropriate measures taken by the manufacturer and operator can
extend the useful lifetime.
Certificate
A0036652

Micropilot NMR81/84
6 Endress+Hauser
Document information
Document function The document is part of the Operating Instructions and serves as a reference for application-specific
parameters and notes.
• General information about functional safety: SIL
• General information about SIL is available:
In the Download Area of the Endress+Hauser Internet site: www.de.endress.com/SIL
Using this document Information on the document structure
For the arrangement of the parameters as per the Operation menu, Setup menu, Diagnostics
menu, along with a short description, see the Operating Instructions for the device
Symbols used Safety symbols
Symbol Meaning
DANGER
DANGER!
This symbol alerts you to a dangerous situation. Failure to avoid this situation will
result in serious or fatal injury.
WARNING
WARNING!
This symbol alerts you to a dangerous situation. Failure to avoid this situation can
result in serious or fatal injury.
CAUTION
CAUTION!
This symbol alerts you to a dangerous situation. Failure to avoid this situation can
result in minor or medium injury.
NOTICE
NOTE!
This symbol contains information on procedures and other facts which do not result in
personal injury.
Symbols for certain types of information
Symbol Meaning
A0011193
Tip
Indicates additional information.
Reference to documentation
A
Reference to page
Reference to graphic
1.
,
2.
,
3.
… Series of steps
Symbols in graphics
Symbol Meaning
1, 2, 3,... Item numbers
1.
,
2.
,
3.
… Series of steps
A, B, C, ... Views

Micropilot NMR81/84
Endress+Hauser 7
Supplementary device
documentation Documentation Comment
Technical Information:
• TI01252G/00 (NMR81)
• TI01253G/00 (NMR84)
The documentation is available on the Internet:
→ www.endress.com
Operating Instructions
• BA01450G/00 (NMR81)
• BA01453G/00 (NMR84)
The documentation is available on the Internet:
→ www.endress.com
Brief Operating Instructions (HART):
• KA01194G/00 (NMR81)
• KA01197G/00 (NMR84)
• The document is provided with the device.
• The documentation is available on the Internet:
→ www.endress.com
Safety instructions depending on the selected option
"Approval".
Additional safety instructions (XA, ZE) are supplied with
certified device version.
Please refer to the nameplate for the relevant safety
instructions.
This supplementary Safety Manual applies in addition to the Operating Instructions, Technical
Information and ATEX Safety Instructions. The supplementary device documentation must be
observed during installation, commissioning and operation. The requirements specific for the
protection function are described in this Safety Manual.

Micropilot NMR81/84
8 Endress+Hauser
Permitted devices types
The details pertaining to functional safety in this manual relate to the device versions listed below
and are valid as of the specified software and hardware version. Unless otherwise specified, all
subsequent versions can also be used for safety instrumented systems. . A modification process
according to IEC 61508 is applied for device changes.
Valid device versions for safety-related use:
Order code Designation Option
010 Approval All
020 Connector type All
030 Power supply; display All
040 Primary output see next table
050 Secondary I/O analog see next table
060 Secondary I/O digital Ex d/XP see next table
070 Housing All except Y9
090 Electrical connection All
100 Antenna All
130 Process seal All
140 Process connection All
150 Accuracy, approval for custody transfer All
500 Operating languages; display All
540 Application package All
570 Service All
580 Test; certificate All
590 Additional approval LA 1) SIL
610 Accessory mounted All
620 Accessory enclosed All
850 Firmware version If no version is selected here, the latest SIL-
enabled SW is supplied. Alternatively, the
following SW version may be selected:
01.02.zz or 01.03.zz
895 Marking All
1) An additional selection of further versions is possible.
Order code 040 050 060
Option
E1 * *
H1 * *
* A1 *
* A2 *
* B1 *
* B2 *
* C2 *
* * A1
* * A2
* * A3

Micropilot NMR81/84
Endress+Hauser 9
Order code 040 050 060
* * B2
* * B3
* All options are possible. (This selection does not affect SIL capability.)
• Valid firmware version: as of 01.02.zz or 01.03.zz (→ nameplate of the device)
• Valid hardware version (electronics): as of date of production 23.11.2016 (→ nameplate of the
device)
SIL label on the nameplate SIL certified devices are marked with the following symbol on the nameplate:
Safety function
Definition of the safety
function
The device's safety functions are:
Safety function 1 (level measurement)
• Maximum point level monitoring (overfill protection)
• Minimum point level monitoring (dry run protection)
• Level range monitoring
The safety functions comprise the measurement of the level of a liquid.
Safety-related signal Digital
The device's safety-related signal is the closed relay contact of the digital output. All safety measures
refer to this signal exclusively.
The level value (safety function 1: level measurement) or the analog input current (safety function 2:
current input measurement) are correctly converted to a digital output value. The relay contact is
closed within the range of validity, and is open outside this range.
The safety-related output signal is fed to a downstream logic unit, e.g. a programmable logic
controller or a limit signal transmitter where it is monitored for the following:
• Exceed and/or undershoot a specific level limit.
• The occurrence of a fault, e.g. contact open (interruption of the signal line).
In case of fault it must be ensured that the equipment under control achieves or maintains a
safe state.
Analog
The device's safety-related signal is the analog output signal 4 to 20 mA. All safety measures refer to
this signal exclusively.
The device can also communicate via HART for information purposes and contains all the HART
features with additional device information.
The safety-related output signal is fed to a downstream logic unit, e.g. a programmable logic
controller or a limit signal transmitter where it is monitored for the following:
• Exceed and/or undershoot a specific level limit.
• The occurrence of a fault, e.g. error current (≤3.6 mA, ≥21.0 mA, interruption or short-circuit of
the signal line).
In case of fault it must be ensured that the equipment under control achieves or maintains a
safe state.

Micropilot NMR81/84
10 Endress+Hauser
Restrictions for use in safety-
related applications
• The measuring system must be used correctly for the specific application, taken into account the
medium properties and ambient conditions. Pay attention to the information concerning critical
process situations and installation conditions in the Operating Instructions/Technical Information.
The application-specific limits must be observed throughout the entire safety life cycle.
• Information on the safety-related signal, (→  10).
• The specifications from the Operating Instructions must not be exceeded, (→  7).
• The following restrictions also applies to safety-related use:
– Strong, pulse-like EMC interference on the line can cause transient (<1 s) deviations ≥±2 % in
the output signal. For this reason, filtering with a time constant ≥1 s should be performed in the
downstream logic unit.
– The error range is device specific and is defined according to FMEDA (Failure Modes, Effects and
Diagnostic Analysis) on delivery. It includes all influential factors described in the Technical
Information (e.g. non-linearity, non-repeatability, hysteresis, zero drift, temperature drift, EMC
influences).
According to IEC / EN 61508 the safety related failures are classified into different categories,
see the following table. The table shows the implications for the safety-related analog output
signal and for measuring uncertainty.
Safety related error Explanation Implications for the
safety related output
signal
Implications for the
measuring uncertainty
(Position, see figure
→  10)
No device error Safe:
No error
None 1 Is within the
specification (see TI,
BA, ...)
λSD Safe detected:
Safe failure which can be
detected
Causes the output signal
to signal the failsafe mode
(see, →  12)
3 No implications
λSU Safe undetected:
Safe failure which cannot
be detected
Is within the defined error
range
2 May be beyond the
specification
λDD Dangerous detected:
Dangerous failure which
can be detected
(Diagnostic within the
device)
Causes the output signal
to signal the failsafe mode
(see, →  12)
3 No implications
λDU Dangerous undetected:
Dangerous failure which
cannot be detected
May be outside the
defined error range
4 May be outside the
defined error range
I [mA]
B
C
A
t
1
2
4
3
3
A0025264
A HI-Alarm ≥21 mA
B Error range ±2 %
C LO-Alarm ≤3.6 mA

Micropilot NMR81/84
Endress+Hauser 11
Dangerous undetected failures in this scenario
A dangerous, undetected failure is considered to be an incorrect output signal that deviates from the
real value by more than 2 %, wherein the output signal is still in the range of 4 to 20 mA or the relay
contact remains closed.

Micropilot NMR81/84
12 Endress+Hauser
Use in protective systems
Device behavior during
operation
Digital
Device behavior during power-up
Once switched on, the device runs through a diagnostic phase of approx. 30 seconds. The relay
contact is open during this time. During the diagnostic phase, no communication is possible via the
service interface (CDI) or via protocols (HART, V1, Modbus).
Device behavior in safety function demand mode
The device displays a digital output value which corresponds to the limit value to be monitored. The
relay contact is closed within the range of validity, and is open outside this range. This must be
monitored and processed accordingly by a connected logic unit.
Device behavior in event of alarms and warnings
The relay contact is always open in the event of alarms and warnings. This must be monitored and
processed accordingly by a connected logic unit.
Alarm and warning messages
Additional information is provided by the alarm and warning messages in the form of error codes
and associated clear text messages.
The following table shows the correlation between the error code and the relay contact output:
Error code 1) Relay contact (message type) Note
Fxxx Open xxx = three-digit number
Mxxx corresponding to measuring mode xxx = three-digit number
Cxxx corresponding to measuring mode xxx = three-digit number
Sxxx corresponding to measuring mode xxx = three-digit number
1) The error codes are listed in the Operating Instructions.
Analog
Device behavior during power-up
Once switched on, the device runs through a diagnostic phase of approx. 30 seconds. The current
output is set to failure current ≤3.6 mA during this time.
During the diagnostic phase, no communication is possible via the service interface (CDI) or via
protocols (HART, V1, Modbus).
Device behavior in safety function demand mode
The device outputs a current value corresponding to the limit value to be monitored. This value must
be monitored and processed further in a connected logic unit.
Device behavior in event of alarms and warnings
The output current on alarm can be set to a value ≤3.6 mA or ≥21.0 mA.
In some cases e.g. failure of power supply, a cable open circuit and faults in the current output itself,
where the failure current ≥21.0 mA cannot be set, output currents of ≤3.6 mA occur irrespective of
the configured failure current .
In some other cases (e.g. cabling short circuit), output currents of ≥21.0 mA occur irrespective of the
configured failure current.
For alarm monitoring, the downstream logic unit must be able to recognize failure currents of the
upper level for signal on alarm (≥21.0 mA) and of the lower level for signal on alarm (≤3.6 mA).

Micropilot NMR81/84
Endress+Hauser 13
Alarm and warning messages
Additional information is provided by the alarm and warning messages in the form of error codes
and associated clear text messages.
The following table shows the correlation between the error code and the current output:
Error code 1) Current output (message type) Note
Fxxx ≥21.0 mA or ≤3.6 mA xxx = three-digit number
Mxxx corresponding to measuring mode xxx = three-digit number
Cxxx corresponding to measuring mode xxx = three-digit number
Sxxx corresponding to measuring mode xxx = three-digit number
1) The error codes are listed in the Operating Instructions.
Exceptions:
Error code 1) Current output (message type) Note
C484 ≥21.0 mA or ≤3.6 mA Simulation failure mode
1) The error codes are listed in the Operating Instructions.
Parameter configuration for
safety-related applications
It is recommended to carried out factory reset before setting the parameters.
Navigate to: Setup → Advanced setup → Administration
Device reset = To factory defaults
This resets all parameters to defined values.
Calibration of the measuring point - safety function 1 (level measurement)
The calibration of the measuring point is described in the Operating Instructions →  7.
Specify which type of configuration a) or b) should be used. Both configurations can apply in parallel
or in combination with safety function 2 (current input measurement).
a) Level value (source) (1) -> safety-related signal: analog output (2)
b) Level value (source) (1) -> safety-related signal: digital output (3)
Level value (source) (1)
Make sure that the application is configured correctly.
Navigate to: Setup → Advanced setup → Application → Tank configuration → Level
Setting
Tank reference height must be set correctly.
Analog output (2)
Make sure that the correct output is configured (Analog I/O B1-3 or Analog I/O C1-3).
Navigate to: Setup → Advanced setup → Input/output → Analog I/O
Setting
•Operating mode = 4..20mA output or HART slave +4..20mA output
•Analog input source = Tank level
•0 % value must be set correctly.
•100 % value must be set correctly.
•Used for SIL/WHG = Enabled
Digital output (3)
First select an alarm block (Alarm 1, Alarm 2, Alarm 3 or Alarm 4) for the limit value settings.
Navigate to: Setup → Advanced setup → Application → Alarm → Alarm X

Micropilot NMR81/84
14 Endress+Hauser
Setting
•Alarm mode = On
•Alarm value source = Tank level (depending on the source)
•HH alarm value, H alarm value, L alarm value and LL alarm value must be configured in line
with the application such that the valid range is within the HH, H and L, LL limits.
Make sure that the correct output is configured (Digital A1-2, Digital A3-4, Digital B1-2, Digital
B3-4, Digital C1-2, Digital C3-4, Digital D1-2, Digital D3-4).
Navigate to: Setup → Advanced setup → Input/output → Digital Xy-z
Setting
•Operating mode = Output passive
•Digital input source = selected alarm block: Alarm 1 any, Alarm 2 any, Alarm 3 any or Alarm 4
any
•Used for SIL/WHG = Enabled must be set to use this digital output as a SIL output.
Calibration of the measuring point - safety function 2 (current input measurement)
The calibration of the measuring point is described in the Operating Instructions (→  7).
Specify which type of configuration c) or d) should be used. Both configurations can apply in parallel
or in combination with safety function 1 (level measurement).
c) Analog input (source) (1) -> safety-related signal: analog output (2)
d) Analog input (source) (1) -> safety-related signal: digital output (3)
Analog input (source) (1)
Make sure that the correct source is configured (Analog I/O B1-3 or Analog I/O C1-3).
Navigate to: Setup → Advanced setup → Input/output → Analog I/O
Setting
•Operating mode = 4..20mA input or HART master+4..20mA input
•Analog input 0% value must be set correctly.
•Analog input 100% value must be set correctly.
Analog output (2)
Make sure that the correct output is configured (Analog I/O B1-3 or Analog I/O C1-3).
Navigate to: Setup → Advanced setup → Input/output → Analog I/O
Setting
•Operating mode = 4..20mA output or HART slave +4..20mA output
•Analog input source = AIO B1-3 value mA or AIO C1-3 value mA (depending on the source)
•0 % value
•100 % value
•Used for SIL/WHG = Enabled
Digital output (3)
First select an alarm block (Alarm 1, Alarm 2, Alarm 3 or Alarm 4) for the limit value settings.
Navigate to: Setup → Advanced setup → Application → Alarm → Alarm X
Setting
•Alarm mode = On
•Alarm value source = AIO B1-3 value mA or AIO C1-3 value mA (depending on the source)
•HH alarm value, H alarm value, L alarm value and LL alarm value must be configured in line
with the application such that the valid range is within the HH, H and L, LL limits.
Make sure that the correct output is configured (Digital A1-2, Digital A3-4, Digital B1-2, Digital
B3-4, Digital C1-2, Digital C3-4, Digital D1-2, Digital D3-4).
Navigate to: Setup → Advanced setup → Input/output → Digital Xy-z
Setting
•Operating mode = Output passive
•Digital input source = selected alarm block (Alarm 1 any, Alarm 2 any, Alarm 3 any or Alarm 4
any)
•Used for SIL/WHG = Enabled must be set to use this digital output as a SIL output.

Micropilot NMR81/84
Endress+Hauser 15
Configuration method
When using the devices in process control safety systems, the device configuration must comply with
two requirements:
• Confirmation concept:
Proven, independent testing of safety-related parameters entered.
• Locking concept:
Locking of the device following parameter configuration (IEC 61511-1: 2016 Section 11.6.3).
To activate SIL mode, the device must run through an operating sequence, during which the device
can be operated via the device display or any Asset Management Tool (e.g. FieldCare) for which
integration is available.
"Expert mode"
A larger number of safety-related parameters can be freely configured here. This means that the
device can be adapted to difficult applications. However, the settings must be checked by directly
approaching the level in the tank or by applying a comparable method.
A mechanical swivel reflector can be used for example as a method for checking in the case of MAX
monitoring.
A detailed description of the configuration steps is provided in the following section.
It is only in the case of SIL devices (ordering feature 590 "Additional Approval", option LA "SIL")
that the SIL commissioning sequence is visible on the display and in external operating tools.
For this reason, SIL locking can only be activated on these devices.
Locking in "Expert mode"
To commission the device, carry out and document the following steps in the order shown→  32:
1.
Perform parameter configuration, see also →  13: The parameter configuration procedure
as well as the meaning of the individual parameters is described in the Operating Instructions
→  7. The parameter settings in the following table must be observed →  17.
2.
Navigate to: Diagnostics → Device check
Start device check = Yes For more details, see the Operating Instructions →  7.
A device check is performed. The signal quality is tested and any installation errors are
detected.
The following message appears after the self test has been completed: Result device check =
Installation ok.
The self check has been passed.
3.
Start the SIL confirmation sequence.
Navigate to: Setup → Advanced setup → SIL/WHG confirmation
Set write protection = Enter the relevant locking code (SIL: 7452). Press "Next" to confirm.
4.
Press "Next" to confirm Commissioning = Expert mode. The device checks the parameter
settings in accordance with the following table →  17 and forces the switching of
parameters if necessary.
When the check is finished, SIL preparation = Finished is shown. The commissioning
sequence can be continued.
Press "Next" to confirm.
5.
Perform function test: For MIN and MAX monitoring, at least one level/current input value
above (MAX monitoring) or below (MIN monitoring) the switch point must be approached.
For range monitoring, 5 level values/current input values which cover the entire measuring
range should be approached. In doing so, check that the safety-related signal (current output/
relay) responds correctly in each case.
If it is not possible to approach the required level values, perform a test in accordance
with test sequence C →  24 prior to locking. However, this does not detect all
possible errors (e.g. insufficient adjustment). For this reason, we recommend that the
measured values be tested and documented in accordance with test sequence A
→  20 at a time when the required point levels/levels have been reached. In
accordance with IEC 61508-1:2010, Section 7.14, this test is included in the "Overall
safety validation" and is the responsibility of the operator.
6.
Confirm that the function test has been successful:
Confirm function test = Yes.

Micropilot NMR81/84
16 Endress+Hauser
7.
Set write protection = Enter the locking code again (SIL: 7452). Check the locking status
after performing SIL locking.
Navigate to: Setup → Advanced setup
Locking status = SIL locked must be confirmed by selecting "".
8.
As an option, hardware locking can also be activated (via the dip switch marked "WP" on the
main electronics).

Micropilot NMR81/84
Endress+Hauser 17
Further parameter settings
The following parameters affect the safety function. However, they may be freely configured in
accordance with the application:
It is recommended to note down the configured values!
Parameter Parameter name
Setup → Advanced setup → Sensor config Tube diameter 1)
Current input measurement: Setup → Advanced setup → Input/output → Analog I/O 0 % value
100 % value
1) Only for pipe/bypass
The following parameters affect the safety function and are not freely configurable in the Expert
mode. Instead, they are automatically set by the device to the safety-oriented values mentioned at
the start of SIL confirmation:
Parameter Preset value
Setup → Advanced setup → Input/output → Digital A1-2 → Contact type Normally closed
Setup → Advanced setup → Application → Alarm → Alarm X → Error value All alarms
Setup → Advanced setup → Application → Alarm → Alarm X → Alarm mode On
Setup → Advanced setup → Safety settings → Output echo lost Alarm
Setup → Advanced setup → Sensor config → Echo tracking → Evaluation mode History off
Setup → Advanced setup → Application → Tank calculation → CTSh → CTSh mode No
Setup → Advanced setup → Application → Tank calculation → HyTD → HyTD mode No
Diagnostics → Simulation → Current output 2 simulation Off
Diagnostics → Simulation → Simulation distance on Off
Expert → Input/output → Analog I/O → Error on event Any error
Expert → Input/output → Analog I/O → Output out of range Alarm
Expert → Input/output → Digital A1-2 → Error on event Any error
Expert → Input/output → Digital A1-2 → Output simulation Disable
Expert → Sensor → Filter options → Dead time 5 s
Those parameters which are not mentioned do not affect the safety function and can be
configured to any meaningful values. The visibility of the parameters mentioned in the
operating menu depends in part on the user role, the SW options ordered and on the
configuration of other parameters.
Unlocking a SIL device
When SIL locking is active on a device, the device is protected against unauthorized operation by
means of a locking code and, as an additional option, by means of a hardware write protection
switch. The device must be unlocked in order to change the configuration for proof-tests as per test
sequence A →  20, test sequence B →  22 or test sequence C →  26.
LCAUTION
Unlocking the device deactivates diagnostic functions, and the device may not be able to carry
out its safety function when unlocked.
‣Therefore, independent measures must be taken to ensure that there is no risk of danger while
the device is unlocked.
To unlock, proceed as follows:
1. Check the position of the hardware write protection switch (dip switch marked "WP" on main
electronics), and set this switch to "Off".

Micropilot NMR81/84
18 Endress+Hauser
2. Select the sequence "Setup → Advanced setup → Deactivate SIL/WHG" and enter the
corresponding unlocking code (SIL: 7452) for the Reset write protection parameter.
 The "End of sequence" message indicates that the device was successfully unlocked.

Micropilot NMR81/84
Endress+Hauser 19
Proof-testing Check the operativeness and safety of safety functions at appropriate intervals! The operator must
determine the time intervals.
The values and graphics in the "Additional safety-related characteristics" section can be used for this
purpose →  4. The test must be carried out in such a way that it verifies the correct operation of
the protective system in interaction with all of the components.
In a single-channel architecture, the PFDavg value to be used depends on the diagnostic rate of
coverage for the proof-test (PTC = proof test coverage) and the intended lifetime (LT =
lifetime), as specified in the following formula:
• • • •• • •
PFD = T +PTC MTTR + (1 – PTC) LTl l l
avg DU 1 DD DU
1 1
2 2
A0024244
For the proof-tests described as follows, the respective proof test coverages are specified, which may
be used for calculation. The proof test coverage rates depend on the specific test sequence.
A test sequence for the proof test must be selected from the following table for every safety function
used. If both safety functions are used, two test sequences must be performed for the proof test.
Safety function 1 (level
measurement)
PTC
Test sequence A – Approach the level 99%
Test sequence B – Simulate the level 74%
Test sequence C – Simulation of level and single-point verification of
level
90%
Safety function 2 (current input
measurement)
Test sequence D – Feed in real currents 99%
You must also check that all cover seals and cable entries are sealing correctly.
LCAUTION
To ensure process safety.
‣During the proof-test, alternative monitoring measures must be taken to ensure process safety.
If one of the test criteria from the following test sequence/s , the device may no longer be used
as part of a protective system. The purpose of proof-testing is to detect random device failures
(λdu). The impact of systematic faults on the safety function is not covered by this test and must
be assessed separately. Systematic faults can be caused, for example, by process material
properties, operating conditions, build-up or corrosion.

Micropilot NMR81/84
20 Endress+Hauser
Test sequence A (approach the level)
Preparation
1. Level limit value monitoring and range monitoring can also be performed when the SIL mode
is active.
2. If the safety-related "Analog" signal is used, loop a suitable measuring device (recommended
accuracy better than ±0.1 mA) into the installed circuit.
3. If the safety-related "Digital" signal is used, connect a suitable measuring device (resistance
tester / resistance measurement), (recommended accuracy better than ±0.1 Ω) to the digital
output.
4. Determine the fail-safe mode (level limit or range monitoring).
Procedure for point level monitoring
1. Check safety function: Approach at least one level immediately above (MAX monitoring) or
below (MIN monitoring) the limit to be monitored.
2. Check safety function: Read the output current (mA)/relay resistance value (Ω), record it and
assess for accuracy.
3. If (as an option) the function of the measuring point is to be checked immediately in front of
the switch point: Checks the function in front of MIN or MAX switch point: Approach level
immediately below (MAX monitoring) or above (MIN monitoring) the limit to be monitored.
Read the output current/relay resistance value, record it and assess for accuracy. This does not
check the safety function of the device.
The test has been passed successfully if the current values/relay resistance values trigger or ensure
the required function.
Procedure for range monitoring
1. Approach five levels within the range to be monitored.
2. For every level value, read the output current (mA)/relay resistance value (Ω), record it and
assess for accuracy.
The test has been passed successfully if the current values/relay resistance values in step 2 are
within the required level of accuracy.
Relay self-monitoring
Relay self-monitoring must only be performed if the "Digital" safety-related signal is used.
Example of terminal designation: If the Digital IO module used for the safety function is installed in
slot D and contacts 3 and 4 are used, Digital D3-4 must be used instead of Digital Xy-z below.
D
E
F
C
B
A
1
1
1
1 3
2
2 4
1
HR
CDI
WP
on
SIM
2
2
3
3
4
4
1
1
2
2
3
3
4
4
5
5
6
6
7
7
8
8
i
D C B A
1 1
2 2
3 3
4 4
1 1
2 2
3 3
4 4
5 5
6 6
7 7
8 8
G1
3
2
POWER
A0032388
1. Deactivate SIL mode. Navigate to: Setup → Advanced setup → Deactivate SIL/WHG and enter
the corresponding unlocking code (SIL: 7452) for the Reset write protection parameter.
2. Perform the device self-check as follows. Navigate to: Setup → Advanced setup
3. Set: Input/output = Digital Xy-z
4. Check whether Contact type = Normally closed (SIL factory setting).
5. Set: Output simulation = Simulating inactive.
6. Check whether the contact is closed (resistance <1 Ω) between contacts Xy and Xz.
7. Set: Output simulation = Fault 1.
8. Check whether the contact is open (resistance >1 MΩ) between contacts Xy and Xz.