Endress+Hauser Liquiline M CM42 Instructions for use

Functional Safety Manual
for the Memosens transmitter Liquiline M CM42 SIL
Version: Page:
2.0 1of 72
Alle Recht
e vorbehalten. Das Kopieren dieses Dokuments und die Verwendung von Teilen aus diesem Dokument ist
ohne schriftliche Genehmigung der Endress+Hauser Conducta GmbH+Co. KG nicht erlaubt.
All rights reserved. Passing on and copying of this document, use and communication of its contents not
permitted without written authorization from Endress+Hauser Conducta GmbH+Co. KG.
Functional Safety Manual
Liquiline M CM42
Memosens Transmitter
Application
Used to run a Memosens sensor to
satisfy the particular requirements for
safety related systems as per IEC
61508.
The measuring device meets the
following requirements:
Functional safety in accordance with
IEC 61508
Explosion protection
Electromagnetic compatibility in
accordance with EN 61326 and
NAMUR-recommendation NE 21
Electrical safety in accordance with
IEC/EN 61010-1
Ingress protection IP66/IP67 in
accordance with DIN EN 60529
Your benefits
For all Memosens compatible systems
up to SIL 2
Independently assessed (Functional
Safety Assessment) by TÜV Süd in
accordance with IEC 61508
Permanent self-monitoring
Permanent connection monitoring
Safe Parameterization
Safe calibration and adjustment
SD153C/07/EN/13.10 71111752

Functional Safety Manual
for the Memosens transmitter Liquiline M CM42 SIL
Version: Page:
2.0 2of 72
Alle Recht
e vorbehalten. Das Kopieren dieses Dokuments und die Verwendung von Teilen aus diesem Dokument ist
ohne schriftliche Genehmigung der Endress+Hauser Conducta GmbH+Co. KG nicht erlaubt.
All rights reserved. Passing on and copying of this document, use and communication of its contents not
permitted without written authorization from Endress+Hauser Conducta GmbH+Co. KG.

Functional Safety Manual
for the Memosens transmitter Liquiline M CM42 SIL
Version: Page:
2.0 3of 72
Alle Recht
e vorbehalten. Das Kopieren dieses Dokuments und die Verwendung von Teilen aus diesem Dokument ist
ohne schriftliche Genehmigung der Endress+Hauser Conducta GmbH+Co. KG nicht erlaubt.
All rights reserved. Passing on and copying of this document, use and communication of its contents not
permitted without written authorization from Endress+Hauser Conducta GmbH+Co. KG.
SIL Konformitätserklärung / SIL Declaration of Conformity
Funktionale Sicherheit nach IEC 61508 / Functional Safety according to IEC 61508
Endress+Hauser Conducta GmbH+Co. KG, Dieselstr. 24, D-70839 Gerlingen
erklärt als Hersteller die Richtigkeit der folgenden Angaben. /
declares as manufacturer the correctness of the following data
Gerät/Product Liquiline M CM42
Schutzfunktion /
Safety function
1: Sichere Übermittlung des gemessenen mV-Wertes
und Ausgabe als Messwert in pH auf den
Stromausgängen /
Safe transmission of the measured mV value and
output of the converted pH value on both current
outs
2: Grenzwertüberwachung des pH-Wertes /
Limit monitoring of pH value
3+4: Sichere Kalibrierung, Justierung /
Safe calibration, adjustment
Systematischer SIL / Systematic SIL
:: Software SIL / Software SIL 2:: 2
HFT 0
Gerätetyp / Device type B
Betriebsart / Mode of operation Low demand mode
SFF / MTTR 94.8 % / 8 Stunden/hours
Prüfintervall T1/
Proof Test Interval T1
Empfohlen / recommended:
T1= 1 Jahr / year
SD /SU /DD /DU 688 FIT / 947 FIT / 2667 FIT / 236 FIT
PFDavg T1= 1 Jahr / year 1.03 ×10-3
MTBF / MTBFDU (reciprocal of
total / DU,assuming constant failure rate) 25 Jahre / years / 483 Jahre / years
Das Gerät wurde in einem vollständigen Functional Safety Assessment unabhängig bewertet.
The device was assessed independently in a complete Functional Safety Assessment.
In the event of device modifications, a modification process
compliant with IEC 61508 is applied.

Functional Safety Manual
for the Memosens transmitter Liquiline M CM42 SIL
Version: Page:
2.0 4of 72
Alle Recht
e vorbehalten. Das Kopieren dieses Dokuments und die Verwendung von Teilen aus diesem Dokument ist
ohne schriftliche Genehmigung der Endress+Hauser Conducta GmbH+Co. KG nicht erlaubt.
All rights reserved. Passing on and copying of this document, use and communication of its contents not
permitted without written authorization from Endress+Hauser Conducta GmbH+Co. KG.
TABLE OF CONTENTS
1Structure of measuring system using a CM42 SIL transmitter 6
1.1 System Components 6
1.2 Description of the application as a safety related system 7
1.3 Valid device types 9
1.4 Applicable device documentation 10
2Description of safety requirements and boundary conditions 10
2.1 Safety Function (SAF) – SIL measuring mode 10
2.1.1 Safety Function 1 (SAF1) – limit value monitoring 11
2.1.2 Safety Function 2 (SAF2) – safe measurement 13
2.1.3 Precision and Timing of SAF1 and SAF2 13
2.1.4 Safe calibration and adjustment (SAF3 and SAF4) 15
2.2 Safety-related signal and safe state 15
2.3 Restrictions for the use in safety related applications 18
2.4 Behavior of the device when in operation and in case of failure 24
2.4.1 Behavior of the device when switched on 24
2.4.2 Behavior of the device on demand 24
2.4.3 Behavior of the device in the event of alarms and warnings 25
3Installation 26
3.1 Mounting, wiring and commissioning 26
3.2 Orientation 26
4Operation 26
4.1 Basics of safety relevant operations 26
4.2 Calibrating the measuring point 26
4.3 Method of device parameterization 27
4.4 Using the SIL mode and the Classic mode – Switch to SIL mode 27
4.5 The SIL mode – Active safe state mode 33

Functional Safety Manual
for the Memosens transmitter Liquiline M CM42 SIL
Version: Page:
2.0 5of 72
Alle Recht
e vorbehalten. Das Kopieren dieses Dokuments und die Verwendung von Teilen aus diesem Dokument ist
ohne schriftliche Genehmigung der Endress+Hauser Conducta GmbH+Co. KG nicht erlaubt.
All rights reserved. Passing on and copying of this document, use and communication of its contents not
permitted without written authorization from Endress+Hauser Conducta GmbH+Co. KG.
4.6 Switch to SIL measurement mode 35
4.7 Using the safe sensor calibration and adjustment 38
4.7.1 2point pH calibration 38
4.7.2 1point temperature calibration 45
5Maintenance, recalibration 49
6Proof test 49
6.1 Proof test 49
6.2 Testing to ensure its safe functioning 49
6.2.1 Proof test of the Liquiline M CM42 transmitter 49
6.2.2 Proof test of the Memosens cable CYK10 51
6.2.3 Proof test of the Orbisint CPS11D pH sensor 54
7Repair 61
8Notes on the redundant use of the device for SIL 3 63
9Proof test protocol example 63
10 Overview of modes and current output 64
11 PFDavg computation examples 64
11.1 Example to calculate PFDavg after a proof test 64
11.2 PFDavg computation example for a pH measuring point 66

Functional Safety Manual
for the Memosens transmitter Liquiline M CM42 SIL
Version: Page:
2.0 6of 72
Alle Recht
e vorbehalten. Das Kopieren dieses Dokuments und die Verwendung von Teilen aus diesem Dokument ist
ohne schriftliche Genehmigung der Endress+Hauser Conducta GmbH+Co. KG nicht erlaubt.
All rights reserved. Passing on and copying of this document, use and communication of its contents not
permitted without written authorization from Endress+Hauser Conducta GmbH+Co. KG.
Note!
General information about functional safety (SIL) is available at www.endress.com/SIL
and in the competence brochure CP002Z "Functional safety in the Process Industry -
risk reduction with Safety Instrumented Systems".
Note!
For general and technical information please read the Technical Information or
Operating Instructions of Liquiline M CM42.
1Structure of measuring system using a CM42 SIL
transmitter
1.1 System Components
Asystem using CM42 looks for example like the following:
This part is covered by this document.
1. Memosens pH glass sensor, e.g. Orbisint CPS11D SIL
2. Memosens cable CYK10 SIL
3. Memosens transmitter Liquiline M CM42 SIL
The transmitter produces an analogue signal (4..20 mA) proportional to the measured
voltage at the sensor electrode. This signal must be processed by a logic component (e.g.

Functional Safety Manual
for the Memosens transmitter Liquiline M CM42 SIL
Version: Page:
2.0 7of 72
Alle Recht
e vorbehalten. Das Kopieren dieses Dokuments und die Verwendung von Teilen aus diesem Dokument ist
ohne schriftliche Genehmigung der Endress+Hauser Conducta GmbH+Co. KG nicht erlaubt.
All rights reserved. Passing on and copying of this document, use and communication of its contents not
permitted without written authorization from Endress+Hauser Conducta GmbH+Co. KG.
aPLC rated SIL2 or higher), which in turn uses maybe some actors to realize the safety
function.
The Liquiline M CM42 display is not safe and therefore all operations using the display
as an interface to the user are specially secured. It has been shown, that the display
hardware and software is reactionless to the CM42 system.
The transmitter is always only a part of the complete safety function. The transmitter is
acompliant item according to IEC 61508.
1.2 Description of the application as a safety related system
To use the Liquiline M CM42 safety related system, you need for example a safe
Memosens sensor and a safe Memosens cable of Endress+Hauser Conducta GmbH &
Co. KG. The display (GUI) hardware and software of the CM42 is reactionless for the
safety function of the transmitter.
The transmitter must be connected to a safe PCS by using both analogue current
outputs. The voter can for example be realized by safe function blocks inside a PLC or
by a hardware based 2oo2 voter.
The logic component must be able to handle LO- and HI-alarms (N3.6mA,
O21.0mA).
The CM42 system has several modes of operation:
1. Classic mode
2. SIL mode – Active safe state mode (referred to as "active safe state")
3. SIL mode – SIL measurement mode
4. SIL mode – Passive safe state mode (referred to as "passive safe state")
In Classic mode the system behaves almost like a traditional well-known CM42 system.
It is NOT executing any safety related functions and can therefore NOT be used in a
safety chain in this mode!
In Active safe state mode the system produces the error current on the current outputs
and waits for a manual switch to the SIL measurement mode or the Classic mode.
In SIL measurement mode the system is executing the safety function SAF1 or SAF2
(see later on). Only in this mode, the system operates in a safe manner and only in this
mode you can start a safe calibration or adjustment (SAF3/SAF4 – see later on).
In Passive safe state mode the system is staying in the safe state until you restart/reset
the system physically.
Attention:
The transmitter must be switched to the SIL measurement mode, only then the safety
function is active. Without switching the system to SIL measurement mode, the system

Functional Safety Manual
for the Memosens transmitter Liquiline M CM42 SIL
Version: Page:
2.0 8of 72
Alle Recht
e vorbehalten. Das Kopieren dieses Dokuments und die Verwendung von Teilen aus diesem Dokument ist
ohne schriftliche Genehmigung der Endress+Hauser Conducta GmbH+Co. KG nicht erlaubt.
All rights reserved. Passing on and copying of this document, use and communication of its contents not
permitted without written authorization from Endress+Hauser Conducta GmbH+Co. KG.
is not safe and therefore not executing the safety functions! After a reset/power-on the
system is NOT in SIL measurement mode!
The following diagram gives an overview of the two states of the system:
And the following diagram shows the possible states inside the SIL mode.

Functional Safety Manual
for the Memosens transmitter Liquiline M CM42 SIL
Version: Page:
2.0 9of 72
Alle Recht
e vorbehalten. Das Kopieren dieses Dokuments und die Verwendung von Teilen aus diesem Dokument ist
ohne schriftliche Genehmigung der Endress+Hauser Conducta GmbH+Co. KG nicht erlaubt.
All rights reserved. Passing on and copying of this document, use and communication of its contents not
permitted without written authorization from Endress+Hauser Conducta GmbH+Co. KG.
1.3 Valid device types
The information in this manual pertaining to functional safety applies to the device
versions listed below and is valid from the stated software and hardware versions.
Unless otherwise indicated, all subsequent versions can also be used for safety functions.
If in doubt, call Endress+Hauser service.
Device versions valid for use in safety-related applications: CM42-MGx4xxEBxxxx
Valid Hardware-Versions (electronics) currently:
FMIH1 module:
FC2W1: Ex Rev 07, Version 51512636
FBIH1: Ex Rev 01, Version 71131675
FSDG1 module: Ex Rev 04, Version 71083049
Valid Firmware/Software versions currently:
FMIH1 module:
FC2W1: V1.00.00-0012 (Parameter version: V11.00.00)
FBIH1: V3.03.04
FSDG1 module: V1.01.00
All versions can be looked up in the CM42 software menu. Please consult the manual of
the CM42 on how to do that. By switching to SIL mode the system itself checks for
these versions and denies the switch, if not all versions are correct.
You can use both variants of the housing: stainless steel or plastic.
The CM42 SIL transmitter is distinguishable from Non-SIL versions by the nameplate
with the TÜV logo and the Endress+Hauser SIL logo and can be identified using the
order code.
Order code: Liquiline M CM42-MGx4xxEBxxxx (4 refers to SIL)

Functional Safety Manual
for the Memosens transmitter Liquiline M CM42 SIL
Version: Page:
2.0 10 of 72
Alle Recht
e vorbehalten. Das Kopieren dieses Dokuments und die Verwendung von Teilen aus diesem Dokument ist
ohne schriftliche Genehmigung der Endress+Hauser Conducta GmbH+Co. KG nicht erlaubt.
All rights reserved. Passing on and copying of this document, use and communication of its contents not
permitted without written authorization from Endress+Hauser Conducta GmbH+Co. KG.
In the event of device modifications, a modification process compliant with IEC 61508
is applied by Endress+Hauser.
1.4 Applicable device documentation
With Liquiline M CM42 additional documentation is delivered. Please see the TI and
the Operating Instructions of Liquiline M CM42.
Documentation Contents
Technical Information
TI381CEN 1310
TI381CDE 1310
and future editions
-Technical data
-Details to accessories
Operating Instructions
(Depends on the order
code of CM42)
-Identification
-Installation
-Cabling
- Usage
-Commissioning
-etc.
Ex Information
XA381CA3 1008
and future editions
-Safety instructions
-Technical Data
-Electrical Data
2Description of safety requirements and boundary
conditions
2.1 Safety Function (SAF) – SIL measuring mode
The safe output values on the two current outputs are always produced conforming to
NAMUR NE43.
The device has a few safety functions (SAFs).
Attention:All safety functions do not take into account any physical or chemical
influences of the medium in contact with the sensor on the measured value. This has to

Functional Safety Manual
for the Memosens transmitter Liquiline M CM42 SIL
Version: Page:
2.0 11 of 72
Alle Recht
e vorbehalten. Das Kopieren dieses Dokuments und die Verwendung von Teilen aus diesem Dokument ist
ohne schriftliche Genehmigung der Endress+Hauser Conducta GmbH+Co. KG nicht erlaubt.
All rights reserved. Passing on and copying of this document, use and communication of its contents not
permitted without written authorization from Endress+Hauser Conducta GmbH+Co. KG.
be done by the operator of the safety chain. So we are here never talking about
accuracy, but always about precision!
To use the safety functions, the device has to be switched to the safe "SIL mode" and
“SIL measurement mode” using the display and the keys/navigator. After switching to
SIL mode the device is able to execute safety functions.
Note!
If not otherwise stated, all comments/remarks/restrictions/etc. of this document refer
to safety functions SAF1 and SAF2. SAF3 and SAF4 are special safety functions, which
are not executed constantly like SAF1 or SAF2.
Note!
In SIL measuring mode the following formulas are used:
The pH value is computed for a measured voltage U at temperature Tk by using:
pH = - (U / STk) + pHNP
STk = slope at temperature Tk,zero-point pHNP:both from pH adjustment.
The pH value is always automatically temperature compensated (ATC) using the
formulas from chapter 4.7.1.
The system does only allow slopes between 50.0 and 61.0 and zero points between 6.0
and 8.0. All other values will not be accepted. Sensors with slope or zero point outside
these ranges can not be used.
2.1.1 Safety Function 1 (SAF1) – limit value monitoring
Monitoring of the measured value (internally converted from voltage to pH value):
If leaving a user-defined pH-interval I = [M min, M max], an error current is set.
Instead of an interval it is also possible to define an upper or a lower limit only. Then
the other limit is equal to the minimum (4.0 mA) or maximum (20.0 mA) possible
measured value.
The value of Imin in the figure below is 1.0 pH, the value of Imax is 14.0 pH (0.0 pH up
to 14.0 pH).

Functional Safety Manual
for the Memosens transmitter Liquiline M CM42 SIL
Version: Page:
2.0 12 of 72
Alle Recht
e vorbehalten. Das Kopieren dieses Dokuments und die Verwendung von Teilen aus diesem Dokument ist
ohne schriftliche Genehmigung der Endress+Hauser Conducta GmbH+Co. KG nicht erlaubt.
All rights reserved. Passing on and copying of this document, use and communication of its contents not
permitted without written authorization from Endress+Hauser Conducta GmbH+Co. KG.
The defined interval I of the monitored measured value is transferred automatically in
an optimum way (with respect to resolution) to the current outs using a lower limit of
4mA and an upper limit of 20 mA (see picture below).
The precision is therefore dependant on the spread configuration of the current outputs.

Functional Safety Manual
for the Memosens transmitter Liquiline M CM42 SIL
Version: Page:
2.0 13 of 72
Alle Recht
e vorbehalten. Das Kopieren dieses Dokuments und die Verwendung von Teilen aus diesem Dokument ist
ohne schriftliche Genehmigung der Endress+Hauser Conducta GmbH+Co. KG nicht erlaubt.
All rights reserved. Passing on and copying of this document, use and communication of its contents not
permitted without written authorization from Endress+Hauser Conducta GmbH+Co. KG.
2.1.2 Safety Function 2 (SAF2) – safe measurement
The safety function of the measuring chain is the output of the pH value on the current
output. To that end the mV and T value is received from the sensor with a given
precision and resolution, the pH value is computed and finally converted to a mA value,
which is then put out to the current output.
All errors (rounding, computations, conversion from pH to mA, etc.) caused by the
Liquiline M CM42 transmitter can be completely neglected compared to the errors on
the current output and the sensor.
The mV value from the Orbisint CPS11D sensor (communicated by the Memosens
protocol to the transmitter) has a resolution of ±0.1mV, the temperature ±0.01K, the
pH value ±0.01pH, the slope ±0.001pH/mV and the zero point ±0.001pH. The
precision of all values is given in the safety manual of the sensor.
2.1.3 Precision and Timing of SAF1 and SAF2
For all information or results given here, we assume we have no errors in the slope and
zero point of the sensor.
The error of the Liquiline M CM42 transmitter on the current output caused by the
hardware is below ±0.05 mA for the complete range from 4-20 mA and for all possible
allowed EMC/environment conditions. See the table in chapter 2.2 for the dependency
of current output spread and the precision.
If we assume that the slope, the zero point and temperature offset (=all sensor
adjustment values) have no errors, we get:
Error limit for zero point is ±0.001 pH (= resolution of storage in sensor),
Error limit for the slope at 25°C/77°F is ±0.001 pH/mV
(= resolution of storage in sensor),
Error limit for voltage value U from sensor is denoted as DU
(= resolution storage is ±0.1 mV),
Error limit for temperature value T from sensor is denoted as DT
(= resolution storage is ±0.01 K).
All errors due to the finite resolution of the values can always be neglected; they are
well below the measurement errors. Additionally, as stated already, all rounding errors
of the software can be neglected too; they are far below the measurement errors.
So the relative error limit of the calculated pH value DpH is just given by the temperature
measurement and the voltage measurement relative errors of the sensor:
DpH / pH = DU / U + DT / T.

Functional Safety Manual
for the Memosens transmitter Liquiline M CM42 SIL
Version: Page:
2.0 14 of 72
Alle Recht
e vorbehalten. Das Kopieren dieses Dokuments und die Verwendung von Teilen aus diesem Dokument ist
ohne schriftliche Genehmigung der Endress+Hauser Conducta GmbH+Co. KG nicht erlaubt.
All rights reserved. Passing on and copying of this document, use and communication of its contents not
permitted without written authorization from Endress+Hauser Conducta GmbH+Co. KG.
For Orbisint CPS11D (with KSG2-SIL head), the values are for example:
DpH/pH = 1.1% + 0.3% = 1.4% (for the temperature range 0°C/32°F to 60°C/140°F,
see safety manual of sensor). That means DpH is 0.2 pH for the temperature range
0°C/32°F to 60°C/140°F.
The complete detailed results are given in the table below about the complete
measuring chain.
The time for a measurement to be visible on the current output is in the worst case
scenario 5seconds (for example a change from 4 mA to 20 mA and communication
problems, etc.).
This value is only valid for the transmitter. They do not include delays caused by the
cable (almost zero for Memosens cable) or sensor (about 1 second for Orbisint CPS11D,
see safety manual of sensor).
Endress+Hauser pH measuring chain
If you are using a Endress+Hauser pH measuring chain using the SIL Memosens CYK10
cable and the pH glass sensor Orbisint CPS11D (with KSG2-SIL head), the following
figures apply to the whole pH measuring chain:
The time for a measurement to be visible on the current output is in the worst case
scenario <6 seconds, most of the time it is <2 seconds.
The precision depends on the temperature and the current output spreading (for the
values 0.3% and 4.0% used here, see the table and description in chapter 2.2):
Temperature
in Celsius
Temperature
in Fahrenheit
Precision
in pH
(= DpH)
Relative error
on current
output at a
spread of
1pH
Relative
error on
current
output at a
spread of
14 pH
-20°C – 0°C -4°F – 32°F ±0.30 30%+4%=34% 2.2%+0.3%
0°C – 60°C 32°F – 140°F ±0.20 20%+4%=24% 1.5%+0.3%
60°C – 90°C 140°F – 194°F ±0.30 30%+4%=34% 2.2%+0.3%
90°C – 110°C 194°F – 230°F ±0.40 40%+4%=44% 2.9%+0.3%
110°C – 125°C 230°F – 257°F ±0.45 45%+4%=49% 3.3%+0.3%

Functional Safety Manual
for the Memosens transmitter Liquiline M CM42 SIL
Version: Page:
2.0 15 of 72
Alle Recht
e vorbehalten. Das Kopieren dieses Dokuments und die Verwendung von Teilen aus diesem Dokument ist
ohne schriftliche Genehmigung der Endress+Hauser Conducta GmbH+Co. KG nicht erlaubt.
All rights reserved. Passing on and copying of this document, use and communication of its contents not
permitted without written authorization from Endress+Hauser Conducta GmbH+Co. KG.
This table includes all uncertainties (including EMI) except the precision of the slope,
zero point and temperature offset.
2.1.4 Safe calibration and adjustment (SAF3 and SAF4)
The safe calibration executes a safe calibration sequence, safe value computations and
safe interactions with the user for the calibration results using the display of the device.
The errors of all computations in the transmitter used for the slope and zero point of the
sensor are negligible, because they are well below the resolution used to store the
values in the sensor (slope ±0.001pH/mV and zero point ±0.001pH). This also refers to
the pH values needed for the used pH buffers at the given temperature.
The safe adjustment does store the results of the calibration in a safe manner into the
sensor interacting in a safe way with the user.
The safely calibrated and adjusted values in the sensor can then be used for the SIL
measurement of the pH value using SAF1 and/or SAF2.
Both safety functions can only be used in SIL mode and started in SIL measurement
mode. Both safety functions need the user to do some checks. To that end special
screens are used to communicate with the user in a safe way.
2.2 Safety-related signal and safe state
The safety-related signal is the analogue output (4..20 mA) on both current outputs.
There are no other safe outputs of the device.
The safe state is defined as either:
No current output at all (0mA) or
Low error current (3.6mA) on one of the outputs or
High error current (>21.0mA) on one of the outputs.
The safe signals have to be processed by a connected logical component PCS.
The voter can be a standalone voter realized in hardware and/or software or a software
voter integrated into a control system like a PLC.

Functional Safety Manual
for the Memosens transmitter Liquiline M CM42 SIL
Version: Page:
2.0 16 of 72
Alle Recht
e vorbehalten. Das Kopieren dieses Dokuments und die Verwendung von Teilen aus diesem Dokument ist
ohne schriftliche Genehmigung der Endress+Hauser Conducta GmbH+Co. KG nicht erlaubt.
All rights reserved. Passing on and copying of this document, use and communication of its contents not
permitted without written authorization from Endress+Hauser Conducta GmbH+Co. KG.
Anyway the signal has to be voted by a 2oo2 voter using the following algorithm:
If any of the current outs shows a HI or LO error current, an error current has to be
set.
If any current out delivers a signal below 3.6mA (e.g. 0 mA), an error current has to
be set.
If the both current outputs differ by more than ±0.04 pH from each other for
longer than 1 second, an error current has to be set.
The allowed current output difference is then dependant on the current output
spreading used.
E.g. for a given spread interval of 1pH we get an allowed difference of
0.04 pH×16 mA/pH = 0.64 mA (= 4.0% of full span),
for an interval of 14 pH the allowed difference is
0.04 pH×1.143 mA/pH=0.04572 mA (0.3% of full span; you have to use 0.05
because of the given physical resolution of the current outputs).
See below for a table of values for different spreading.
Spread
[pH] 1.0 2.0 3.0 4.0 5.0 6.0 7.0
Allowed
difference [mA]
0.64
=4% 0.32 0.21 0.16 0.13 0.11 0.09
Spread
[pH] 8.0 9.0 10.0 11.0 12.0 13.0 14.0
Allowed
difference [mA] 0.08 0.07 0.06 0.06 0.05 0.05 0.05 0.3%
The device is leaving the safe state when being restarted. After the device has booted
correctly and has detected a sensor, all start up self tests have been successfully
executed. The device is not automatically entering the safe SIL mode after a reboot,
even if it has been correctly working in SIL mode before the reset has taken place.
Note!
After the safe state has been detected by the logic component, the CM42 has to be
manually switched to the safe SIL mode back again. This is necessary, because the logic
component does not know, if the transmitter has been "repaired" after the safe state has
been reached at the logic component. The logic component just detects a measuring
value after the error current has been seen for at least 4 seconds.
Example for a voter realized in a PCS as a function block

Functional Safety Manual
for the Memosens transmitter Liquiline M CM42 SIL
Version: Page:
2.0 17 of 72
Alle Recht
e vorbehalten. Das Kopieren dieses Dokuments und die Verwendung von Teilen aus diesem Dokument ist
ohne schriftliche Genehmigung der Endress+Hauser Conducta GmbH+Co. KG nicht erlaubt.
All rights reserved. Passing on and copying of this document, use and communication of its contents not
permitted without written authorization from Endress+Hauser Conducta GmbH+Co. KG.
This is the safe function block F_1oo2AI of a Siemens PLC:
This function block checks for valid inputs, compares the two inputs against a
configured delta tolerance and checks for a discrepancy time. See the manuals of the
used PCS for more information. The allowed deviation is set to "DELTA" = 1mA and
"DIS_TIME" = 1second.

Functional Safety Manual
for the Memosens transmitter Liquiline M CM42 SIL
Version: Page:
2.0 18 of 72
Alle Recht
e vorbehalten. Das Kopieren dieses Dokuments und die Verwendung von Teilen aus diesem Dokument ist
ohne schriftliche Genehmigung der Endress+Hauser Conducta GmbH+Co. KG nicht erlaubt.
All rights reserved. Passing on and copying of this document, use and communication of its contents not
permitted without written authorization from Endress+Hauser Conducta GmbH+Co. KG.
2.3 Restrictions for the use in safety related applications
The given environmental conditions have to be obeyed at all times. All remarks in the
CM42 Operating Manual and Installation Instructions (see chapter 1.4) have to be
obeyed.
Additional mandatory restrictions for the use in safety related applications:
•Installation, commissioning, operation and maintenance of the safety
measuring system must only be carried out by trained technical personnel.
The technical personnel must be authorized to perform the tasks at the safety
relevant system by the owner-operator.
•Use of the device at a maximum average environment temperature of
60°C/140°F (the calculation of the failure rates have been based on this
assumption).
•It has to be checked, that at all times a SIL capable cable is used (e.g. CYK10
SIL - look for the nameplate with the SIL- and TÜV logo). This can not be
checked by the transmitter or the sensor in operation.
•Before going into operation, it has to be checked, if any metal masses are close
to the transmitter or the sensor head, which can influence the inductive
transmission of the cable and the transmitter.
•The connections of the cable to the transmitter and the sensor have to be
checked thoroughly before going into operational state.
•The environmental conditions from IEC 61326-3-2 have to be obeyed.
•The voter and its configuration have to be checked for, before going into
operation. A 2oo2 voter must be used.
•The connection of the Memosens cable to the transmitter has to be carefully
checked, see CM42 installation instructions.
•It is not allowed to use the system in a radioactive environment (apart from
natural radioactivity).
•Strong magnetic fields are not allowed in the neighborhood of the device.
•The device must be protected against lightning or strong electromagnetic
disturbances.
•Ashield connector at the transmitter must be used. You have to use two-wire
cabling shielded on both sides, "hard grounding".
•The display is NOT safe, even not in SIL mode.
•Please check the polarity of the connections carefully.
•If used outside, the weather protection must be used.

Functional Safety Manual
for the Memosens transmitter Liquiline M CM42 SIL
Version: Page:
2.0 19 of 72
Alle Recht
e vorbehalten. Das Kopieren dieses Dokuments und die Verwendung von Teilen aus diesem Dokument ist
ohne schriftliche Genehmigung der Endress+Hauser Conducta GmbH+Co. KG nicht erlaubt.
All rights reserved. Passing on and copying of this document, use and communication of its contents not
permitted without written authorization from Endress+Hauser Conducta GmbH+Co. KG.
•The environmental pressure has to be checked against the values given in the
Operating Instructions. Do not use outside the allowed ranges.
•Functional grounding must be used for the stainless steel housing.
•If using a different sensor as the Endress+Hauser ones like the CPS11D-8*
(SIL sensor), you have to make sure, that the sensor uses the exact same
calculations of the pH-value as the Endress+Hauser one. If not, the two
current outputs might differ systematically and your voter will detect the
difference and enter the safe state. To be sure, check with Endress + Hauser,
if the sensor is to be used safely with the Liquiline M CM42 transmitter.
•The used Orbisint CPS11D sensor must not be older than 3 years, starting
from the day of production. This is checked for by the Endress+Hauser
transmitter Liquiline M CM42.
•Storage temperature: see operating instructions.
•Environmental temperature: -20°C/-4°F up to 60°C/140°F
•The LED on the display is never used to display any relevant state of the
system. It is not part of the safe path and therefore deactivated.
•DAT modules are for safety reasons not allowed to be connected to the ports
of the display when in SIL mode and must be removed. This will be checked
by the software of the transmitter.
•The service interface is turned off in SIL mode for safety reasons and switched
back on, when leaving SIL mode. It can be used for service personnel of
Endress + Hauser to diagnose the system. It is not meant to be used in other
circumstances.
Therefore Memobase cannot be used with safe calibrations/adjustments. But
you can still do non safe calibrations in Classic mode using Memobase and use
these sensors for SIL measurements.
•For safe calibrations/adjustments in the laboratory a SILtransmitter, e.g.
Liquiline M CM42 SIL, is necessary.
•To store the settings (all parameters) of the used transmitter, you can use a
Copy-DAT (see operating instructions).
•The system needs 15,5V to output all error currents (LO and HI) and all
measurement values. Below 9V the system can not guarantee that there is an
error current on the outputs. Between 9V and 15,5V the system is always able
to output the HI error current, but not the LO error current.

Functional Safety Manual
for the Memosens transmitter Liquiline M CM42 SIL
Version: Page:
2.0 20 of 72
Alle Recht
e vorbehalten. Das Kopieren dieses Dokuments und die Verwendung von Teilen aus diesem Dokument ist
ohne schriftliche Genehmigung der Endress+Hauser Conducta GmbH+Co. KG nicht erlaubt.
All rights reserved. Passing on and copying of this document, use and communication of its contents not
permitted without written authorization from Endress+Hauser Conducta GmbH+Co. KG.
Voltage supervision:
(The following statements can be used for a FMEDA of the complete safety function
including the PLC, etc.)
oIf you are using the LO error current, you must use a voltage
supervision on both outputs and drive the system to a safe state, if
the voltage drops below 15,5V.
oIf you are using the HI error current, you must use voltage
supervision on current output 2 and drive the system to a safe state,
if the voltage drops below 9V. The current output 1 is supervised by
the Liquiline M CM42 system and is reset if the voltage on output 1
drops below 9V.
oWe recommend using two independent voltage supplies for
the two current loops. Then all errors lead to a safe state, except if
the voltage supply on current output 2 has an error and there is an
error current on current output 2 or a measurement signal (4-20
mA) on both outputs. For these two cases, the voter detects the
error with a DC of 90%.
oIf you are using just one voltage supply for both current outputs, the
following applies:
If the voltage supply has an error, the voter detects all voltage errors
with a DC of 60%.
The following table gives an overview of the device status in SIL mode: