KROHNE OPTIFLUX 400 Series Wiring diagram

Electromagnetic flowmeters
Safety manual
OPTIFLUX X400 Supplementary Instructions
© KROHNE 11/2021 - 4008790001 - AD OPTIFLUXx400 SIL R01 en

CONTENTS
2 www.krohne.com 11/2021 - 4008790001 - AD OPTIFLUXx400 SIL R01 en
OPTIFLUX X400
1 Introduction 4
1.1 Scope of the document..................................................................................................... 4
1.2 Revision history ................................................................................................................ 4
1.3 Device description ............................................................................................................ 4
1.4 Declaration ....................................................................................................................... 5
1.5 Device safety characteristics ........................................................................................... 6
1.6 Permitted device variants ................................................................................................ 8
1.6.1 Signal converter...................................................................................................................... 8
1.6.2 Flow sensor............................................................................................................................. 8
1.7 Related documentation .................................................................................................... 9
1.8 Terms and definitions....................................................................................................... 9
2 Specification of the safety function 11
2.1 Safety function................................................................................................................ 11
2.1.1 Definition ............................................................................................................................... 11
2.1.2 Process response time ......................................................................................................... 11
2.1.3 Failure detection and fault response time ........................................................................... 11
2.1.4 Measurement uncertainties ................................................................................................. 11
2.2 Safety application conditions (SAC)................................................................................ 12
2.2.1 General.................................................................................................................................. 12
2.2.2 Installation ............................................................................................................................ 12
2.2.3 Operation............................................................................................................................... 13
2.3 Operation modes ............................................................................................................ 13
2.3.1 Safe operation ....................................................................................................................... 13
2.3.2 Non-SIL operation................................................................................................................. 13
3 Operation 14
3.1 Condition of use.............................................................................................................. 14
3.2 Configuration of device for usage in safety application................................................. 14
3.2.1 Change of operation mode.................................................................................................... 14
3.2.2 Switch to safe operation ....................................................................................................... 15
3.2.3 Switch to non-SIL operation ................................................................................................. 15
3.2.4 Safe configuration................................................................................................................. 16
3.2.5 Safe parameter verification .................................................................................................. 17
3.2.6 Confirmation ......................................................................................................................... 18
3.3 Safe current output states ............................................................................................. 18
3.4 Error conditions.............................................................................................................. 19
3.5 Homogeneous redundancy............................................................................................. 20
3.5.1 How to set up a system with homogeneous redundancy..................................................... 20
3.5.2 How to calculate the effect of common cause failures........................................................ 21

CONTENTS
3
www.krohne.com11/2021 - 4008790001 - AD OPTIFLUXx400 SIL R01 en
OPTIFLUX X400
4 Service 22
4.1 Maintenance ................................................................................................................... 22
4.2 Availability of services .................................................................................................... 22
4.3 Proof test ........................................................................................................................ 22
4.4 Troubleshooting.............................................................................................................. 23
4.5 Support for IEC 61508 approved devices ....................................................................... 23

1 INTRODUCTION
4
OPTIFLUX X400
www.krohne.com 11/2021 - 4008790001 - AD OPTIFLUXx400 SIL R01 en
1.1 Scope of the document
This document supplies functional safety data and instructions for OPTIFLUX x400 devices.
1.2 Revision history
1.3 Device description
The OPTIFLUX x400 is a series of electromagnetic flowmeter measuring volume flow, mass flow,
flow velocity, conductivity, coil temperature, total volume and total mass.
The device can be used in safety applications measuring volume flow or mass flow (using a
configurable density to convert volume flow into mass flow) of liquids using the safe current
output at terminal C.
The safe current output is available as intrinsically safe and non-intrinsically safe variant
according to IEC 60079-11.
INFORMATION!
The data in this supplement provides additional information for using the device in safety
applications.
The technical data in the handbook (document [1], [2]) shall be valid, provided that it is not
rendered invalid or replaced by this supplement. If necessary, parts of document [1] are
referenced herein.
INFORMATION!
Installation, commissioning and maintenance may only be carried out by properly trained and
authorised personnel.
Document
revision
Release
date (ER)
Flow sensor Electronic revision Changes
R01 11/2021 OPTIFLUX 4000 ER 1.0.x_ Initial version
Table 1-1: Revision history

INTRODUCTION 1
5
OPTIFLUX X400
www.krohne.com11/2021 - 4008790001 - AD OPTIFLUXx400 SIL R01 en
1.4 Declaration
Figure 1-1: Declaration of conformity

1 INTRODUCTION
6
OPTIFLUX X400
www.krohne.com 11/2021 - 4008790001 - AD OPTIFLUXx400 SIL R01 en
1.5 Device safety characteristics
This data applies for devices switched to "Safe Operation" (for further information refer to Safe
operation on page 13). For more data about device characteristics and performance, refer to
"Technical data" in the handbook [1] [2].
General
Device designation and
permissible types OPTIFLUX with flow sensors and electronics IFC 400 (according to following section)
Safety-related output signal 4 to 20 mA (terminal C)
Safety function Transmit a safe current from 4 mA up to 20 mA via the safe current output as
function of determined volume flow or mass flow within the defined process
response time and with defined safety tolerance.
Device type acc. to IEC 61508-2 Type A Type B
Operating mode Low Demand Mode High Demand
Mode Continuous Mode
Valid Hardware and Software
Version ER 1.0.x_
Safety Manual 4008790001 – R01
Type of evaluation Complete HW/SW assessment in the context of development including
FMEDA and change process according to IEC 61508-2, 3
Evaluation of "prior use" performance for HW/SW including FMEDA and
change request according to IEC 61508-2, -3
Evaluation of HW/SW field data to verify "prior use" according to IEC 61511
Evaluation by FMEDA according to IEC 61508-2 for devices w/o software
Evaluation through – report no. TUEV Rheinland Industrie Service GmbH – Certificate No. 968/FSP 2314.00/22
Test documents Development documents, test reports, data sheets
Table 1-2: Safety-related characteristics - General
SIL - Integrity
Systematic safety integrity SIL 2 capable SIL 3 capable
Hardware safety integrity Single channel use (HFT = 0) SIL 2 capable SIL 3 capable
Multi channel use (HFT = 1) SIL 2 capable SIL 3 capable
Table 1-3: Safety-related characteristics - SIL - Integrity

INTRODUCTION 1
7
OPTIFLUX X400
www.krohne.com11/2021 - 4008790001 - AD OPTIFLUXx400 SIL R01 en
Useful lifetime of electrical components
The established failure rates of electronic components apply within the useful lifetime according
to IEC 61508-2, section 7.4.9.5 note 3.
The useful lifetime can only be extended under responsibility of the plant operator regarding
special operation conditions and the employment of suitable intervals for testing and
maintenance.
FMEDA 1
SD 0.1 FIT
SU 343.2 FIT
DD 1252.8 FIT
DU 62.0 FIT
SFF 96 %
PFDavg(TProof= 1 year) 2.72E-04
PFDavg(TProof= 3 years) 8.15E-04
PFDavg(TProof= 5 years) 1.36E-03
PFH 6.2E-08 1/h
PTC Up to 85 %
MTBF (safety function) 68.8 years
Diagnostic Test Interval 22 min.
Fault Reaction Time 1 s
Table 1-4: Safety-related characteristics - FMEDA
1 Based on failure types specified in Siemens SN29500. Soft errors are taken into account.
The values are valid for an averaged ambient temperature up to 40°C / 104°F
2 All diagnostic functions are carried out at least once during this time.

1 INTRODUCTION
8
OPTIFLUX X400
www.krohne.com 11/2021 - 4008790001 - AD OPTIFLUXx400 SIL R01 en
1.6 Permitted device variants
The permitted device variants for functional safety are defined by the signal converter variant
(for details refer to Signal converter on page 8), the flow sensor variant (for details refer to Flow
sensor on page 8) and the device versions defined by the electronic revision (for details refer to
Revision history on page 4). Unless otherwise specified, all subsequent versions can also be
used for safety functions.
1.6.1 Signal converter
The signal converter variant is identified by the CG number shown on the device nameplate.
The next figure describes the format of the CG number.
The following table shows the permitted signal converter variants for functional safety:
Details of the CG number decoding are provided in the handbook [1].
1.6.2 Flow sensor
The model and its options are identified by the V-type code on the device nameplate.
The type code is a series of alphanumeric characters (0...9 and A...Z).
Refer to the next table to find which positions in the V-type code are related to functional safety.
The positions are marked by the letter "x".
Figure 1-2: Code (CG number) of the signal converter variant
Code Description Applicable options for functional safe devices
1Measurement principle 0
2Production related any
3Power supply 3, T
4Front 1, 2, 3, 4
5I/O variant 2, 3, 4
6, 7optional modules for connection
terminal A and B any
Table 1-5: Permitted converter variants for functional safety
Type code VN ab c d e f g h j k l m p ... x y z aa ab ac
Codes
related to
functional
safety
x x x x x x x
Table 1-6: Description of V type code

INTRODUCTION 1
9
OPTIFLUX X400
www.krohne.com11/2021 - 4008790001 - AD OPTIFLUXx400 SIL R01 en
The next table shows all codes of the permitted flow sensor variants which have constraints
1.7 Related documentation
1.8 Terms and definitions
Code Description Applicable options for functional safe devices
ab Flow sensor type and size 02, 03, 04
d Nominal diameter VN02: 1, 2, 3, 5, 6
VN03: 4, 5, 6, 7, 8, A, B, C, D
VN04: E, F, G, H, K, L, M, N
g System design 1, 4, 5, 6, 8, A, B, C, E, R
h Signal converter model T, U
j Liner 0, 1, 2, G, H, K, S, U, V
k Electrodes 1, 2, 3, 4, 6, 7, B
p Cable 0 (for signal converter model = T)
1 (for signal converter model = U)
Table 1-7: Permitted flow sensor variants for functional safety
[1] KROHNE, IFC 400 Handbook.
[2] KROHNE, OPTIFLUX 4000 Handbook
[3] IEC 61508-1 to 7:2010 Functional safety of electrical/electronic/programmable electronic safety-
related
[4] KROHNE, OPTIFLUX Chemical Compatibility Guideline, 2021
[5] NAMUR, NE43: Standardization of the Signal Level for the Failure, 2003
Table 1-8: Related documentation
Term Description
Firmware Software embedded in the device
FIT Failure In Time (1x10-9 failures per hour)
FMEDA Failure Modes, Effects and Diagnostics Analysis
FRT Fault Response Time (diagnostic test interval + Fault Reaction Time).
This is the maximum time that is necessary for the current output to change to a
safe value when the safety function has an error condition.
HFT Hardware Fault Tolerance
High demand or
continuous mode Where the frequency of demands for operation made on a safety-related system is greater than one time per year.
I/O Input / output
DD Rate for dangerous detected failure
DU Rate for dangerous undetected failure
SD Rate for safe detected failure
SU Rate for safe undetected failure
Low demand mode Where the frequency of demands for operation made on a safety-related system is
not greater than one time per year.
MTBF Mean Time Between Failures
PFDAVG Average Probability of Failure on Demand

1 INTRODUCTION
10
OPTIFLUX X400
www.krohne.com 11/2021 - 4008790001 - AD OPTIFLUXx400 SIL R01 en
PFH Probability of a dangerous Failure per Hour
PLC Programmable logic controller
PTC Proof Test Coverage
Process safety
time Time starting when something fails and ending when the "undesired event" can no longer be prevented.
SAC Safety Application Condition. Conditions that must be adhered to when you use a
safety-related system or a safety-related sub-system.
SFF Safe Failure Fraction
SIL Safety Integrity Level
SIS Safety Instrumented Systems
Systematic
Capability Measure (given as a scale of SC 1 to SC 3) of the confidence that the systematic safety integrity of an element complies to the conditions of the specified SIL (related
to the safety function of an element), when the element is applied in accordance
with the instructions.
Type A system "Non-complex" system (all failure modes are well defined). For more data, refer to
subsection 7.4.3.1.2 of IEC 61508-2.
Type B system "Complex" system (not all failure modes are well defined). For more data, refer to
subsection 7.4.3.1.2 of IEC 61508-2.
TProof Proof Test Interval
T[Repair] Time to Repair
1oo1 1 out of 1 channel architecture (single channel architecture performs the safety
function)
1oo1D 1 out of 1 channel architecture with diagnostics
1oo2 1 out of 2 channel architecture (architecture with homogenous or heterogeneous
redundancy performs the safety function)
Table 1-9: Terms and definitions
Term Description

SPECIFICATION OF THE SAFETY FUNCTION 2
11
OPTIFLUX X400
www.krohne.com11/2021 - 4008790001 - AD OPTIFLUXx400 SIL R01 en
2.1 Safety function
2.1.1 Definition
The device has a safety function that complies to International Standard IEC 61508 [3].
Definition of the safety function: Transmit a safe current from 4 mA up to 20 mA via the safe
current output as function of determined volume flow or mass flow within the defined process
response time and with defined safety tolerance.
The device has a safety tolerance of 2% of the present measurement value or present output
current (whichever is greater).
2.1.2 Process response time
The process response time is defined as the T90 for a response to a step change between
process input and safe current output. It consists of a delay in the flow measurement and a delay
in the safe current output. The following table shows the flow measurement delay which
depends on the line frequency setting (menu C1.1.7) and the flow sensor size:
The process response time Tpis defined by the damping in the safe current output (menu C2.4.4)
and the flow measurement delay according to the following formula:
Tp = Tflow + 1.8 * Damping
The next table shows the process response time for 1 second damping (default value) at the safe
current output:
2.1.3 Failure detection and fault response time
If the device detects a failure, then it changes the current output to the low or high failure
current value in an interval equal to or less than the fault response time.
The maximum fault response time is 121 seconds.
2.1.4 Measurement uncertainties
The device measures with the same uncertainty in both operation modes (non-SIL mode and SIL
mode) if the device is undamaged.
The safety tolerance is the tolerable error before setting the safe state of the device.
A random fault can cause an error of up to 2% of the present measurement value or output
current before it is signalled.
Flow sensor size 50 Hz 60 Hz
Size up to 300 mm / 12 inch 2.0 s 1.7 s
Size above 300 mm / 12 inch 3.7 s 3.1 s
Table 2-1: Flow measurement delay Tflow
Flow sensor size 50 Hz 60 Hz
Size up to 300 mm / 12 inch 3.8 s 3.5 s
Size above 300 mm / 12 inch 5.75 s 4.9 s
Table 2-2: Process response time for 1 second damping

2 SPECIFICATION OF THE SAFETY FUNCTION
12
OPTIFLUX X400
www.krohne.com 11/2021 - 4008790001 - AD OPTIFLUXx400 SIL R01 en
2.2 Safety application conditions (SAC)
The handbook (document [1] [2]) gives instructions to correctly install the device and connect it
to an electrical circuit.
2.2.1 General
•The operator must carefully select the correct tube diameter with respect to the expected
flow rates.
•Compatible electrodes and liner material must be selected according to the Chemical
Compatibility Guideline [4].
•If the device is used in high demand mode of operation, the process safety time must be more
than 121 seconds. This minimum time agrees with International Standard IEC 61508 Part 2
([3], section 7.4.4.1.4).
2.2.2 Installation
•In case of a remote device variant, the serial number of the signal converter and flow sensor
must match.
•In case of a remote device variant, the following cables must be used for the connection
between flow sensor and signal converter:
- BTS300-3 for electrode connection
- Shielded field current cable for coil connection
•The maximum allowed cable length depends on the flow sensor variant and the conductivity
of the liquid according the following table:
•The current output at terminal C is the safety relevant output for safe operation.
•The operator must ensure that the wetted material is compatible with process product.
•Correctly sized cables for the cable glands must be used and the cable glands and the lid
must be tightened sufficiently. Furthermore, the device (lid, cable glands) must not be
opened during safe operation.
•If the safe current output is used in passive configuration an overvoltage at the terminal can
lead to loss of the safety function of the device. It is recommended to use a power supply with
voltage limitation or voltage monitoring.
•The distance between electromagnetic flowmeters must be greater than five times the
nominal diameter of the largest flowmeter under consideration.
•The device must not be operated above 2000 m / 6561 ft above sea level.
WARNING!
The safety application conditions and instructions must be followed if the device is used in a
safety related system.
Nominal size
DN [mm]
Nominal size
DN [inch]
Min. electrical conductivity
20 µS/cm 50 µS/cm 100 µS/cm 200 µS/cm
2.5...6 1/10…1/6 50 m / 164 ft 100 m / 328 ft 150 m / 492 ft 200 m / 656 ft
10...150 3/8...6 100 m / 328 ft 150 m / 492 ft 200 m / 656 ft 400 m / 1312 ft
200...600 8...24 150 m / 492 ft 200 m / 656 ft 400 m / 1312 ft 600 m / 1968.5 ft
Table 2-3: Maximum allowed cable length for minimum electrical conductivity

SPECIFICATION OF THE SAFETY FUNCTION 2
13
OPTIFLUX X400
www.krohne.com11/2021 - 4008790001 - AD OPTIFLUXx400 SIL R01 en
2.2.3 Operation
•The device must not be exposed to strong magnetic fields during operation.
•The device must not be exposed to excessive vibration during operation.
•The flow sensor pipe must be filled completely.
•The flow sensor pipe must be free of pollution.
•Ensure that entrained gas, cavitation, or two-phase flows do not occur in the flowmeter.
•The ambient temperature must not exceed the device limits.
•The process product must have a conductivity of at least 20 µS/cm.
•The process product must not contain any solid content.
•The process product must not contain magnetite.
•The process temperature, pressure and flow velocity must not exceed the flow sensor limits.
•In order to execute the safety function the device must be switched to safe operation
(for further information refer to
Switch to safe operation on page 15).
2.3 Operation modes
2.3.1 Safe operation
The device performs the safety function in safe operation. If it detects a failure, it will send a
failure current signal. The device continues to be functionally safe and the safety-related data
(e.g. hazard rate, FRT etc.) continues to be applicable.
Devices in safe operation mode have these operational restrictions:
•HART®multidrop mode is not available.
•The device cannot simulate measurement values at the output terminals.
2.3.2 Non-SIL operation
The device operates in non-SIL operation without any restriction to configuration or functionality.

3 OPERATION
14
OPTIFLUX X400
www.krohne.com 11/2021 - 4008790001 - AD OPTIFLUXx400 SIL R01 en
3.1 Condition of use
The device must be a SIL variant to operate in SIL mode to perform the safety function.
The configuration is protected by a password. For more data on password protection and device
configuration refer to
Switch to non-SIL operation on page 15.
3.2 Configuration of device for usage in safety application
Safety relevant parameters are write-locked and cannot be changed during safe operation.
Parameters which are not safety relevant can be changed in safe operation.
3.2.1 Change of operation mode
INFORMATION!
Only properly trained and authorised personnel shall change device settings. Keep a report of
changes to the device settings. These reports must include the date, the menu item, the old
setting and the new setting.
Non-SIL
operation

Set safety mode
to SIL mode 
Safe
configuration

Verify safe
parameters and
confirm

Safe operation
Set safety mode
to non-SIL mode
and confirm
  Unlock device 
State Icon 1Description Safe current output
Non-SIL operation - Device can be used in non-SIL
application and all
parameters can be changed.
Measurement signal or
failure signal
Safe configuration Device can be configured for
safe operation or device can
be switched to non-SIL mode.
Failure signal
Safe operation Device performs the safe
measurement according to its
configuration and all safety
relevant parameters are
locked.
Measurement signal or
failure signal
Table 3-1: Description of safety states
1 Icon shown at the local display or DTM.

OPERATION 3
15
OPTIFLUX X400
www.krohne.com11/2021 - 4008790001 - AD OPTIFLUXx400 SIL R01 en
3.2.2 Switch to safe operation
In order to switch the device from non-SIL operation to safe operation several steps have to be
performed.
•Switch the device to safe configuration state by setting safety mode to "SIL Mode" (menu
C7.2).
•Configure the device for safe operation (for further information refer to
Safe configuration on
page 16).
•Perform safe parameter verification (for further information refer to
Safe parameter
verification
on page 17).
•Perform confirmation (for further information refer to
Confirmation on page 18).
Safety relevant parameters cannot be changed in safe operation.
3.2.3 Switch to non-SIL operation
In order to switch the device from safe operation to non-SIL operation several steps have to be
performed.
•Unlock the device (menu C7.4) by entering the configurable unlock password (menu C7.5).
Default unlock password: 9999
•Change of safety mode to "Non-SIL Mode" (menu C7.2).
•Perform confirmation (for further information refer to
Confirmation on page 18).
WARNING!
The device cannot be switched to safe configuration or safe operation if a lock jumper is present
at the local display.
INFORMATION!
Change your unlock password (menu C7.5) before switching the device to safe operation to avoid
unauthorised access.

3 OPERATION
16
OPTIFLUX X400
www.krohne.com 11/2021 - 4008790001 - AD OPTIFLUXx400 SIL R01 en
3.2.4 Safe configuration
In safe configuration state some parameters are reset to their factory value and locked because
they have direct impact on the safety function of the device.
The following parameters are reset to factory configuration and cannot be changed in safe
configuration or safe operation:
Following parameters must be configured for safe operation of the device:
Parameter Menu reference Value
Current Span C2.4.6 4-20 mA
Polarity C2.4.5 Both
4mA Trimming C2.4.11 4 mA
20mA Trimming C2.4.12 20 mA
Loop Current Mode C4.2.0 Enabled
Terminal C C2.1.5 Current Output
Calibration Data C1.5 Factory configuration
Process Noise Suppr. (in Process Input) C1.1.4 Low
Damping (in Process Input) C1.1.2 0.5 s
Low Flow Cutoff (in Process Input) C1.1.4 Factory configuration
Sensor: Diagnostic C6.6.2 Failure
Electr: IO connection C6.6.7 Failure
Table 3-2: Fixed parameters in safe operation
ID Parameter Menu reference Selection or values
- Device Tag C6.1 -
1 Measurement C2.4.1 Mass Flow
Volume Flow
2 Range (lower) C2.4.2 Depends on Measurement (ID 1)
3 Range (upper) C2.4.2 Depends on Measurement (ID 1)
4 Alarm Code C2.4.9 Low = 3.5 mA
High = 21.5 mA
5 Low Flow Cutoff (threshold) C2.4.3 0%…20%, referring to upper range value (ID 3)
6 Low Flow Cutoff (hysteresis) C2.4.3 0%…20%, referring to upper range value (ID 3)
7 Damping C2.4.4 0…100 s
8 Terminal C Type 1C2.1.6 Active
Passive
9 Flow Direction C1.1.4 Normal Direction
Reverse Direction
10 Line Frequency C1.1.7 50 Hz
60 Hz
11 2Density C1.1.6 100…5000 kg/m³
Table 3-3: Changeable safety relevant parameters in safe configuration
1 Can only be configured for I/O variant (5) with code 4 (for details refer to
Signal converter on page 8)
2 Only shown during safe parameter verification when mass flow is selected as measurement

OPERATION 3
17
OPTIFLUX X400
www.krohne.com11/2021 - 4008790001 - AD OPTIFLUXx400 SIL R01 en
3.2.5 Safe parameter verification
The safe configuration must be verified either via local display or via HART® interface in order to
enter the safe operation state:
•Local display: Select menu item C7.3
•HART®: Use the device-specific DD or a DTM (only online mode)
During preparation of the safe parameter verification the following messages could be
displayed:
This process can only be started if the configuration is plausible. During verification of the safe
configuration all safety relevant parameters must be reviewed guided by a wizard.
In the verification wizard all safety relevant parameters are displayed in the following format:
The parameter ID is used for identification of the parameter as described in the chapter "Safe
configuration" on page 16.
Message Description
Checking Parameters… Configuration is checked for plausibility.
Not allowed Device in safe operation or non-SIL operation. Therefore safe parameter
verification is not allowed.
Config. invalid Implausible configuration.
Press Return to Start Configuration checked successfully and verification can start.
Remove Jumper A lock jumper is set. Please remove it!
Table 3-4: Messages during safe parameter verification
Local display HART DD or DTM
Table 3-5: Formats for display of safety relevant parameters
IFC400SIL_01_Volumeflow
Device Tag ID
Value
Unit
WARNING!
Check that all parameters listed in the table for the respective safe measurement are shown in
the verification process.
If the verification process is performed via HART® make sure that the correct device is
addressed by checking the device tag. Please make sure that the device tag is unique.

3 OPERATION
18
OPTIFLUX X400
www.krohne.com 11/2021 - 4008790001 - AD OPTIFLUXx400 SIL R01 en
3.2.6 Confirmation
During the last step of switching to safe operation or non-SIL operation the user must confirm
the action by entering a confirmation key. The device generates a random 3-digit confirmation
key which is displayed as depicted below.
When the safe configuration is confirmed, all safety relevant parameters are write-locked and
the device switches to safe operation state.
3.3 Safe current output states
Local display HART DD or DTM
Table 3-6: Dialogue containing the confirmation key for safe operation
IFC400SIL_99_SIL_956
Device Tag ID
Confirmation
key
Current output
condition
Value Description
Measurement 4....20 mA Measuring the flow and put it on the current output.
Extended Range 3.8…20.5 mA The current output complies to NAMUR Recommendation NE 43 [5].
The measurement is scaled to an output current which saturates at
3.8 mA or 20.5 mA. In these two conditions, the current output value
is identified as a "non-safe" measurement.
Safe State 3.6 mA or
21 mA For safe or dangerous detected failures, the device changes the safe current output to the failure current (failure signal) set in the device
configuration menu. Although this value can also be set to high
failure current value (21 mA), some hardware failures will always
cause the device to change to a low failure current value (3.6 mA).
Table 3-7: Safe current output states
WARNING!
We recommend not to use 3.8 mA or 20.5 mA as a limit for monitoring.
If the device is used in a safety loop both the high and low failure current must be monitored.

OPERATION 3
19
OPTIFLUX X400
www.krohne.com11/2021 - 4008790001 - AD OPTIFLUXx400 SIL R01 en
3.4 Error conditions
The device can detect error conditions. When the device detects an error, it supplies a failure
current value to show that this is a temporary (transient) or permanent (persistent) failure.
•The device will supply a failure current if there is a safety-critical failure.
•The failure current is the only signal that is related to the safety function. Ignore data from
other outputs and display options (e.g. HART® handheld controller etc.).
•Make sure that you monitor the low failure current value (3.6 mA) and the high failure
current value (21 mA).
•The following table shows the types of error that are related to functional safety.
For more data about error conditions, refer to the following table:
CAUTION!
Although the device can be set to send a high failure current signal (21 mA), some hardware
failures will always cause the device to send a low failure current signal (3.6 mA).
Error message Description Corrective actions
Electronic Temperature Electronics temperature exceeds limits. Protect electronics from heat by process or
direct sunlight.
Electronic Overtemp. The maximum electronics temperature was
exceeded at some point in the past. This
error is persistent over power cycles.
Contact the manufacturer.
I/O Connection Load for safe current output too high (e.g.
open circuit) or hardware error in safe
current output.
Check connection at safe current output,
reduce load and perform reset errors.
Internal Comm. Error IO C Internal communication error in the device. Perform power reset. If the status returns,
contact the manufacturer.
IO C Failure Hardware failure in safe current output. Perform power reset, reset errors. If the
status returns, contact the manufacturer.
Coil Connection Failure Field coil resistance is too low or too high,
indicating a short circuit or an open
connection.
In case of a remote device variant check
field coil connections for open circuit or
short circuit.
In case of a compact variant or if the status
message does not disappear, contact the
manufacturer.
Ground Connection Failure in ground connection for electrode
signal measurement. In case of a remote device variant check electrode connections at terminals 1 and 4.
In case of a compact variant or if the status
message does not disappear, contact the
manufacturer.
Electrode Connection Failure in electrode connection, open
circuit, or short circuit. In case of a remote device variant check electrodes' connection for open circuit or
short circuit.
In case of a compact variant or if the status
message does not disappear, contact the
manufacturer.
Electrode Circuit Failure An internal error in the electrode sampling
electronics is detected. Perform power reset. If the status returns, contact the manufacturer.
Coil Circuit Failure An internal error in the coil driver electronic
is detected. Perform power reset. If the status returns, contact the manufacturer.
Electrode CPU Failure An internal error in the electrode sampling
CPU is detected. Perform power reset. If the status returns, contact the manufacturer.

3 OPERATION
20
OPTIFLUX X400
www.krohne.com 11/2021 - 4008790001 - AD OPTIFLUXx400 SIL R01 en
3.5 Homogeneous redundancy
3.5.1 How to set up a system with homogeneous redundancy
If two devices installed in series with the same parameters used to measure the flow, then they
can be used as a SIL 3 safety function. The two devices provide the same measurements.
The safety function data from each device are sent to one or more logic solvers. The logic solver
compares the data from the two devices to select a device status for each device.
If the difference between the data from each device exceeds the limit for the safety application,
then the logic solver uses the safety function to change the safety loop's status to "safe".
Coil CPU Failure An internal error in the coil drive CPU is
detected. Perform power reset. If the status returns, contact the manufacturer.
Safe Config. Invalid Some safety relevant parameters are
invalid. Reset to factory configuration.
Process Input Config The process input configuration is invalid. Check process input configuration. Reset to
factory configuration.
Field Freq. too High The field current cannot be set successfully.
The flow reading is too low. Perform power reset. If the status returns, contact the manufacturer.
Field Current Instable The field current is not stable. The flow
reading is not reliable. Perform power reset. If the status returns, contact the manufacturer.
Electrodes
Unsymmetrical A problem in the electrode signal measurement occurred due to asymmetric
flow profile, deposits on electrodes, faulty
electrode connections or electronic failures.
Check installation conditions. In case of a
remote variant check electrode
connections. Check and clean the
electrodes. If the status message does not
disappear, contact the manufacturer.
Coil Unsymmetrical A problem in the generation of the field
current occurred due to faulty coil
connections, defective coils, or electronics
failures.
In case of a remote variant check coil
connections. If the status message does not
disappear, contact the manufacturer.
Safety Rel. Failure A safety relevant failure occurred described
by additional error messages. Check additional error messages.
Table 3-8: Error conditions related to the device hardware
Error message Description Corrective actions
Figure 3-1: Homogeneous redundancy
1 Sensor subsystem
2 Measurement device A
3 Measurement device A' (second device with the same configuration as device A)
4 Logic subsystem