Endress+Hauser Liquiline M CM42 Instructions for use

Functional Safety Manual
for the Memosens transmitter Liquiline M CM42 SIL
Version: Page:
2.0 1of 72
Alle Recht
e vorbehalten. Das Kopieren dieses Dokuments und die Verwendung von Teilen aus diesem Dokument ist
ohne schriftliche Genehmigung der Endress+Hauser Conducta GmbH+Co. KG nicht erlaubt.
All rights reserved. Passing on and copying of this document, use and communication of its contents not
permitted without written authorization from Endress+Hauser Conducta GmbH+Co. KG.
Functional Safety Manual
Liquiline M CM42
Memosens Transmitter
Application
Used to run a Memosens sensor to
satisfy the particular requirements for
safety related systems as per IEC
61508.
The measuring device meets the
following requirements:
Functional safety in accordance with
IEC 61508
Explosion protection
Electromagnetic compatibility in
accordance with EN 61326 and
NAMUR-recommendation NE 21
Electrical safety in accordance with
IEC/EN 61010-1
Ingress protection IP66/IP67 in
accordance with DIN EN 60529
Your benefits
For all Memosens compatible systems
up to SIL 2
Independently assessed (Functional
Safety Assessment) by TÜV Süd in
accordance with IEC 61508
Permanent self-monitoring
Permanent connection monitoring
Safe Parameterization
Safe calibration and adjustment
SD153C/07/EN/13.10 71111752

Functional Safety Manual
for the Memosens transmitter Liquiline M CM42 SIL
Version: Page:
2.0 2of 72
Alle Recht
e vorbehalten. Das Kopieren dieses Dokuments und die Verwendung von Teilen aus diesem Dokument ist
ohne schriftliche Genehmigung der Endress+Hauser Conducta GmbH+Co. KG nicht erlaubt.
All rights reserved. Passing on and copying of this document, use and communication of its contents not
permitted without written authorization from Endress+Hauser Conducta GmbH+Co. KG.

Functional Safety Manual
for the Memosens transmitter Liquiline M CM42 SIL
Version: Page:
2.0 3of 72
Alle Recht
e vorbehalten. Das Kopieren dieses Dokuments und die Verwendung von Teilen aus diesem Dokument ist
ohne schriftliche Genehmigung der Endress+Hauser Conducta GmbH+Co. KG nicht erlaubt.
All rights reserved. Passing on and copying of this document, use and communication of its contents not
permitted without written authorization from Endress+Hauser Conducta GmbH+Co. KG.
SIL Konformitätserklärung / SIL Declaration of Conformity
Funktionale Sicherheit nach IEC 61508 / Functional Safety according to IEC 61508
Endress+Hauser Conducta GmbH+Co. KG, Dieselstr. 24, D-70839 Gerlingen
erklärt als Hersteller die Richtigkeit der folgenden Angaben. /
declares as manufacturer the correctness of the following data
Gerät/Product Liquiline M CM42
Schutzfunktion /
Safety function
1: Sichere Übermittlung des gemessenen mV-Wertes
und Ausgabe als Messwert in pH auf den
Stromausgängen /
Safe transmission of the measured mV value and
output of the converted pH value on both current
outs
2: Grenzwertüberwachung des pH-Wertes /
Limit monitoring of pH value
3+4: Sichere Kalibrierung, Justierung /
Safe calibration, adjustment
Systematischer SIL / Systematic SIL
:: Software SIL / Software SIL 2:: 2
HFT 0
Gerätetyp / Device type B
Betriebsart / Mode of operation Low demand mode
SFF / MTTR 94.8 % / 8 Stunden/hours
Prüfintervall T1/
Proof Test Interval T1
Empfohlen / recommended:
T1= 1 Jahr / year
SD /SU /DD /DU 688 FIT / 947 FIT / 2667 FIT / 236 FIT
PFDavg T1= 1 Jahr / year 1.03 ×10-3
MTBF / MTBFDU (reciprocal of
total / DU,assuming constant failure rate) 25 Jahre / years / 483 Jahre / years
Das Gerät wurde in einem vollständigen Functional Safety Assessment unabhängig bewertet.
The device was assessed independently in a complete Functional Safety Assessment.
In the event of device modifications, a modification process
compliant with IEC 61508 is applied.

Functional Safety Manual
for the Memosens transmitter Liquiline M CM42 SIL
Version: Page:
2.0 4of 72
Alle Recht
e vorbehalten. Das Kopieren dieses Dokuments und die Verwendung von Teilen aus diesem Dokument ist
ohne schriftliche Genehmigung der Endress+Hauser Conducta GmbH+Co. KG nicht erlaubt.
All rights reserved. Passing on and copying of this document, use and communication of its contents not
permitted without written authorization from Endress+Hauser Conducta GmbH+Co. KG.
TABLE OF CONTENTS
1Structure of measuring system using a CM42 SIL transmitter 6
1.1 System Components 6
1.2 Description of the application as a safety related system 7
1.3 Valid device types 9
1.4 Applicable device documentation 10
2Description of safety requirements and boundary conditions 10
2.1 Safety Function (SAF) – SIL measuring mode 10
2.1.1 Safety Function 1 (SAF1) – limit value monitoring 11
2.1.2 Safety Function 2 (SAF2) – safe measurement 13
2.1.3 Precision and Timing of SAF1 and SAF2 13
2.1.4 Safe calibration and adjustment (SAF3 and SAF4) 15
2.2 Safety-related signal and safe state 15
2.3 Restrictions for the use in safety related applications 18
2.4 Behavior of the device when in operation and in case of failure 24
2.4.1 Behavior of the device when switched on 24
2.4.2 Behavior of the device on demand 24
2.4.3 Behavior of the device in the event of alarms and warnings 25
3Installation 26
3.1 Mounting, wiring and commissioning 26
3.2 Orientation 26
4Operation 26
4.1 Basics of safety relevant operations 26
4.2 Calibrating the measuring point 26
4.3 Method of device parameterization 27
4.4 Using the SIL mode and the Classic mode – Switch to SIL mode 27
4.5 The SIL mode – Active safe state mode 33

Functional Safety Manual
for the Memosens transmitter Liquiline M CM42 SIL
Version: Page:
2.0 5of 72
Alle Recht
e vorbehalten. Das Kopieren dieses Dokuments und die Verwendung von Teilen aus diesem Dokument ist
ohne schriftliche Genehmigung der Endress+Hauser Conducta GmbH+Co. KG nicht erlaubt.
All rights reserved. Passing on and copying of this document, use and communication of its contents not
permitted without written authorization from Endress+Hauser Conducta GmbH+Co. KG.
4.6 Switch to SIL measurement mode 35
4.7 Using the safe sensor calibration and adjustment 38
4.7.1 2point pH calibration 38
4.7.2 1point temperature calibration 45
5Maintenance, recalibration 49
6Proof test 49
6.1 Proof test 49
6.2 Testing to ensure its safe functioning 49
6.2.1 Proof test of the Liquiline M CM42 transmitter 49
6.2.2 Proof test of the Memosens cable CYK10 51
6.2.3 Proof test of the Orbisint CPS11D pH sensor 54
7Repair 61
8Notes on the redundant use of the device for SIL 3 63
9Proof test protocol example 63
10 Overview of modes and current output 64
11 PFDavg computation examples 64
11.1 Example to calculate PFDavg after a proof test 64
11.2 PFDavg computation example for a pH measuring point 66

Functional Safety Manual
for the Memosens transmitter Liquiline M CM42 SIL
Version: Page:
2.0 6of 72
Alle Recht
e vorbehalten. Das Kopieren dieses Dokuments und die Verwendung von Teilen aus diesem Dokument ist
ohne schriftliche Genehmigung der Endress+Hauser Conducta GmbH+Co. KG nicht erlaubt.
All rights reserved. Passing on and copying of this document, use and communication of its contents not
permitted without written authorization from Endress+Hauser Conducta GmbH+Co. KG.
Note!
General information about functional safety (SIL) is available at www.endress.com/SIL
and in the competence brochure CP002Z "Functional safety in the Process Industry -
risk reduction with Safety Instrumented Systems".
Note!
For general and technical information please read the Technical Information or
Operating Instructions of Liquiline M CM42.
1Structure of measuring system using a CM42 SIL
transmitter
1.1 System Components
Asystem using CM42 looks for example like the following:
This part is covered by this document.
1. Memosens pH glass sensor, e.g. Orbisint CPS11D SIL
2. Memosens cable CYK10 SIL
3. Memosens transmitter Liquiline M CM42 SIL
The transmitter produces an analogue signal (4..20 mA) proportional to the measured
voltage at the sensor electrode. This signal must be processed by a logic component (e.g.

Functional Safety Manual
for the Memosens transmitter Liquiline M CM42 SIL
Version: Page:
2.0 7of 72
Alle Recht
e vorbehalten. Das Kopieren dieses Dokuments und die Verwendung von Teilen aus diesem Dokument ist
ohne schriftliche Genehmigung der Endress+Hauser Conducta GmbH+Co. KG nicht erlaubt.
All rights reserved. Passing on and copying of this document, use and communication of its contents not
permitted without written authorization from Endress+Hauser Conducta GmbH+Co. KG.
aPLC rated SIL2 or higher), which in turn uses maybe some actors to realize the safety
function.
The Liquiline M CM42 display is not safe and therefore all operations using the display
as an interface to the user are specially secured. It has been shown, that the display
hardware and software is reactionless to the CM42 system.
The transmitter is always only a part of the complete safety function. The transmitter is
acompliant item according to IEC 61508.
1.2 Description of the application as a safety related system
To use the Liquiline M CM42 safety related system, you need for example a safe
Memosens sensor and a safe Memosens cable of Endress+Hauser Conducta GmbH &
Co. KG. The display (GUI) hardware and software of the CM42 is reactionless for the
safety function of the transmitter.
The transmitter must be connected to a safe PCS by using both analogue current
outputs. The voter can for example be realized by safe function blocks inside a PLC or
by a hardware based 2oo2 voter.
The logic component must be able to handle LO- and HI-alarms (N3.6mA,
O21.0mA).
The CM42 system has several modes of operation:
1. Classic mode
2. SIL mode – Active safe state mode (referred to as "active safe state")
3. SIL mode – SIL measurement mode
4. SIL mode – Passive safe state mode (referred to as "passive safe state")
In Classic mode the system behaves almost like a traditional well-known CM42 system.
It is NOT executing any safety related functions and can therefore NOT be used in a
safety chain in this mode!
In Active safe state mode the system produces the error current on the current outputs
and waits for a manual switch to the SIL measurement mode or the Classic mode.
In SIL measurement mode the system is executing the safety function SAF1 or SAF2
(see later on). Only in this mode, the system operates in a safe manner and only in this
mode you can start a safe calibration or adjustment (SAF3/SAF4 – see later on).
In Passive safe state mode the system is staying in the safe state until you restart/reset
the system physically.
Attention:
The transmitter must be switched to the SIL measurement mode, only then the safety
function is active. Without switching the system to SIL measurement mode, the system

Functional Safety Manual
for the Memosens transmitter Liquiline M CM42 SIL
Version: Page:
2.0 8of 72
Alle Recht
e vorbehalten. Das Kopieren dieses Dokuments und die Verwendung von Teilen aus diesem Dokument ist
ohne schriftliche Genehmigung der Endress+Hauser Conducta GmbH+Co. KG nicht erlaubt.
All rights reserved. Passing on and copying of this document, use and communication of its contents not
permitted without written authorization from Endress+Hauser Conducta GmbH+Co. KG.
is not safe and therefore not executing the safety functions! After a reset/power-on the
system is NOT in SIL measurement mode!
The following diagram gives an overview of the two states of the system:
And the following diagram shows the possible states inside the SIL mode.

Functional Safety Manual
for the Memosens transmitter Liquiline M CM42 SIL
Version: Page:
2.0 9of 72
Alle Recht
e vorbehalten. Das Kopieren dieses Dokuments und die Verwendung von Teilen aus diesem Dokument ist
ohne schriftliche Genehmigung der Endress+Hauser Conducta GmbH+Co. KG nicht erlaubt.
All rights reserved. Passing on and copying of this document, use and communication of its contents not
permitted without written authorization from Endress+Hauser Conducta GmbH+Co. KG.
1.3 Valid device types
The information in this manual pertaining to functional safety applies to the device
versions listed below and is valid from the stated software and hardware versions.
Unless otherwise indicated, all subsequent versions can also be used for safety functions.
If in doubt, call Endress+Hauser service.
Device versions valid for use in safety-related applications: CM42-MGx4xxEBxxxx
Valid Hardware-Versions (electronics) currently:
FMIH1 module:
FC2W1: Ex Rev 07, Version 51512636
FBIH1: Ex Rev 01, Version 71131675
FSDG1 module: Ex Rev 04, Version 71083049
Valid Firmware/Software versions currently:
FMIH1 module:
FC2W1: V1.00.00-0012 (Parameter version: V11.00.00)
FBIH1: V3.03.04
FSDG1 module: V1.01.00
All versions can be looked up in the CM42 software menu. Please consult the manual of
the CM42 on how to do that. By switching to SIL mode the system itself checks for
these versions and denies the switch, if not all versions are correct.
You can use both variants of the housing: stainless steel or plastic.
The CM42 SIL transmitter is distinguishable from Non-SIL versions by the nameplate
with the TÜV logo and the Endress+Hauser SIL logo and can be identified using the
order code.
Order code: Liquiline M CM42-MGx4xxEBxxxx (4 refers to SIL)

Functional Safety Manual
for the Memosens transmitter Liquiline M CM42 SIL
Version: Page:
2.0 10 of 72
Alle Recht
e vorbehalten. Das Kopieren dieses Dokuments und die Verwendung von Teilen aus diesem Dokument ist
ohne schriftliche Genehmigung der Endress+Hauser Conducta GmbH+Co. KG nicht erlaubt.
All rights reserved. Passing on and copying of this document, use and communication of its contents not
permitted without written authorization from Endress+Hauser Conducta GmbH+Co. KG.
In the event of device modifications, a modification process compliant with IEC 61508
is applied by Endress+Hauser.
1.4 Applicable device documentation
With Liquiline M CM42 additional documentation is delivered. Please see the TI and
the Operating Instructions of Liquiline M CM42.
Documentation Contents
Technical Information
TI381CEN 1310
TI381CDE 1310
and future editions
-Technical data
-Details to accessories
Operating Instructions
(Depends on the order
code of CM42)
-Identification
-Installation
-Cabling
- Usage
-Commissioning
-etc.
Ex Information
XA381CA3 1008
and future editions
-Safety instructions
-Technical Data
-Electrical Data
2Description of safety requirements and boundary
conditions
2.1 Safety Function (SAF) – SIL measuring mode
The safe output values on the two current outputs are always produced conforming to
NAMUR NE43.
The device has a few safety functions (SAFs).
Attention:All safety functions do not take into account any physical or chemical
influences of the medium in contact with the sensor on the measured value. This has to