KROHNE DR 400 Series Wiring diagram

DR3500 / DR5400
DR6400 / DR6500
DR7400 / DR7500
Safety manual
DRX400 / X500 Supplementary Instructions
© AMETEK Drexelbrook - DRx400-x500-PM - English – SIL2/3 06-29-21 – Issue 2

CONTENTS
2
www.drexelbrook.comDRx400-x500-PM - English – SIL2/3 06-29-21 – Issue 2
DRX400 / X500
1 Introduction 4
1.1 Scope of the document..................................................................................................... 4
1.2 Revision history ................................................................................................................ 4
1.3 Type code for devices that can operate in SIL mode ....................................................... 5
1.4 Device description ............................................................................................................ 6
1.5 Related documentation .................................................................................................... 7
1.6 Terms and definitions....................................................................................................... 7
2 Specification of the safety function 9
2.1 Preconditions.................................................................................................................... 9
2.2 Definition of the safety function ....................................................................................... 9
2.2.1 General notes.......................................................................................................................... 9
2.2.2 Current output ...................................................................................................................... 10
2.2.3 Fault response time.............................................................................................................. 11
2.3 Safety application conditions (SAC)................................................................................ 12
2.3.1 General.................................................................................................................................. 12
2.3.2 Installation ............................................................................................................................ 12
2.3.3 Electrical connection ............................................................................................................ 13
2.3.4 Functionally safe configuration ............................................................................................ 13
2.4 Operation modes ............................................................................................................ 14
2.4.1 SIL mode ............................................................................................................................... 14
2.4.2 Non-SIL mode ....................................................................................................................... 14
2.4.3 Maintenance mode................................................................................................................ 14
3 Operation 15
3.1 Operation in SIL mode.................................................................................................... 15
3.1.1 General notes........................................................................................................................ 15
3.1.2 Device configuration for operation in SIL mode................................................................... 15
3.2 How to change the configuration of a device operated in SIL mode ............................. 18
3.2.1 General notes........................................................................................................................ 18
3.2.2 How to change device operation from SIL mode to non-SIL mode ..................................... 18
3.3 Error conditions.............................................................................................................. 19
3.4 Parameter types............................................................................................................. 20
3.4.1 Safety-critical parameters.................................................................................................... 20
3.4.2 Safety-relevant parameters ................................................................................................. 20
3.4.3 Non-SIL parameters............................................................................................................. 21
3.4.4 Limits for parameters related to tank configuration ........................................................... 21
3.5 Homogeneous redundancy............................................................................................. 22
3.5.1 Description of a homogeneously redundant system............................................................ 22
3.5.2 How to estimate the effect of common cause failures ........................................................ 23
4 Service 24
4.1 Maintenance ................................................................................................................... 24
4.2 Availability of services .................................................................................................... 24

CONTENTS
3 www.drexelbrook.co DRx400-x500-PM - English – SIL2/3 06-29-21 – Issue 2
DRX400 / X500
4.3 How to check measurement accuracy before operation in SIL mode .......................... 24
4.3.1 General notes........................................................................................................................ 24
4.3.2 Measurement accuracy check (in process conditions)........................................................ 24
4.4 Operation modes and proof tests................................................................................... 25
4.5 How to reset the fail-safe flags...................................................................................... 28
4.6 Troubleshooting.............................................................................................................. 28
5 Technical data 29
5.1 Characteristics for the device safety function ............................................................... 29
5.2 Useful lifetime of electronic components...................................................................... 29
5.3 Assumptions................................................................................................................... 30
5.4 Measuring accuracy ....................................................................................................... 30
5.5 Support for SIL-approved devices.................................................................................. 31

INTRODUCTION 1
4
DRX400 / X500
www.drexelbrook.comDRx400-x500-PM - English – SIL2/3 06-29-21 – Issue 2
1.1 Scope of the document
This document supplies functional safety data for the devices that follow:
•DRx400: DR5400, DR6400 and DR7400
- 24 GHz FMCW radar level transmitters
•DRx500: DR3500, DR6500 and DR7500
- 80 GHz FMCW radar level transmitters
This data agrees with the IEC 61508 standard (document [N2]) if the device operates in SIL mode.
1.2 Revision history
Do a check at regular intervals to make sure that the firmware (electronic revision) and the
safety manual for the device is up to date. You can download the latest edition of the safety
manual from the website (Download Center). If the electronic revision is different, speak to your
supplier about the procedure to change the electronic revision of the device.
INFORMATION!
The data in this supplement only contains the data applicable to the SIL approval. The technical
data for the standard version in the handbook (document [N1]) shall be valid, provided that it is
not rendered invalid or replaced by this supplement. If necessary, parts of document [N1] are
referenced herein.
INFORMATION!
Installation, commissioning and maintenance can only be done by qualified personnel. The
system integrator is responsible for correct operation and parameterization of the device. The
system integrator is responsible for the definition and application of measures against
manipulation (e.g. lightning protection system, position of valves etc.).
Release date Electronic revision Changes and compatibility Documentation
2021-10-01 ER 2.1.1 First issue DRx400-x500-PM-English-SIL2/3
06-29-21-Issue 1
2022-06-28 ER 2.1.1 The maximum fault response time
changed from 50 s to 90 s. It is
necessary to do a proof test
immediately after temporary
failures.
DRx400-x500-PM-English-SIL2/3
06-29-21-Issue 2
Table 1-1: Revision history

1 INTRODUCTION
5
DRX400 / X500
www.drexelbrook.com DRx400-x500-PM - English – SIL2/3 06-29-21 – Issue 2
1.3 Type code for devices that can operate in SIL mode
The model name for the level transmitter and its options are identified by the DRxxxx type code
on the device nameplate. The type code is a series of alphanumeric characters (0...9 and A...Z).
Do a check of the device nameplate to make sure that device has the correct options for
functional safety.
Refer to the table that follows to find which positions in the type code are related to functional
safety. The position is shown with the letter "x".
The table that follows shows which alphanumeric codes in each position are related to function
safety. If a dash ("—") is shown, all options in this type code position are applicable to functional
safety.
Figure 1-1: Location of the type code on the device nameplate
1 Type code
Type code DRxxxx cdef g h i j k l m n opqrstuvw
Options related to
functional safety x x x x x x
Table 1-2: Type code - Options related to functional safety
Code Description Applicable options for SIL devices
DRxxxx Device prefix and model DR3500; DR5400; DR6400; DR6500;
DR7400, DR7500
cdef Standard, Version, Regional Directives, Ex Approvals —
gIndustry / Safety 1, 3, 5, 7, D, E, F, M, N, P
h Construction —
i Converter version 2, 3
jOutput 1

INTRODUCTION 1
6
DRX400 / X500
www.drexelbrook.comDRx400-x500-PM - English – SIL2/3 06-29-21 – Issue 2
1.4 Device description
A device that operates in SIL mode is a functionally safe level transmitter. It can be used in
safety-critical systems where the safety function is necessary (for more data, refer to Definition
of the safety function
on page 9).
Measurement data is supplied as a current output signal. This output can be used as a safe
output. When the device detects an internal device error or a measurement error, it supplies a
failure current.
The conditions that follow are applicable for measurement in SIL mode:
•The current output can supply a failure current. The current output is the only safe output.
•The local display screen and the HART® interface are not related to the safety function.
•The local display screen and the HART® interface are read-only in SIL mode.
•You can only change parameters in non-SIL mode.
For more data about the failure current, refer to
Error conditions on page 19.
k Cable entry / cable gland —
lDisplay 4
m Display - documentation language —
n Enhanced functions 0
opqrstuvw All other device descriptors —
Table 1-3: Applicable options for SIL devices
Code Description Applicable options for SIL devices
Current output
(safe)

Antenna Safe subsystem Non-safe
subsystem HART

Local display

1 INTRODUCTION
7
DRX400 / X500
www.drexelbrook.com DRx400-x500-PM - English – SIL2/3 06-29-21 – Issue 2
1.5 Related documentation
1.6 Terms and definitions
[N1] The applicable handbook for the DR3500, DR5400, DR6400, DR6500, DR7400 or DR7500. Refer to the
latest edition.
[N2] IEC 61508-1 to 7:2010 Functional safety of electrical / electronic / programmable electronic safety-
related systems
[N3] NAMUR Recommendation NE 043 Standardization of the Signal Level for the Failure Information of
Digital Transmitters
DC Diagnostic Coverage of dangerous failures
EUC Equipment Under Control
Firmware Software embedded in the device.
FIT Failure In Time (1×10-9 failures per hour)
FMEDA Failure Modes, Effects and Diagnostics Analysis
FRT Fault Response Time (diagnostic test interval + Fault Reaction Time). This is the
maximum time that is necessary for the current output to change to the error
value when the safety function has an error condition.
HFT Hardware Fault Tolerance
High demand or
continuous mode Where the frequency of demands for operation made on a safety-related system is greater than one time per year
I/O Input / output
DD Rate for dangerous detected failure
DU Rate for dangerous undetected failure
SD Rate for safe detected failure
SU Rate for safe undetected failure
Low demand mode Where the frequency of demands for operation made on a safety-related system
is no greater than one time per year
MTBF Mean Time Between Failures
MTTF Mean Time To Failure
MTTR Mean Time To Recovery
MTR Mean Time To Restoration
PFDAVG Average Probability of Failure on Demand
PFH Probability of a dangerous Failure per Hour
PLC Programmable logic controller
PTC Proof Test Coverage
Process safety time Time starting when something fails and ending when the 'undesired event' can
no longer be prevented
SAC Safety Application Conditions. Conditions that must be obeyed when you use a
safety-related system or a safety-related sub-system.
SFF Safe Failure Fraction
SIL Safety Integrity Level
SIS Safety Instrumented System

INTRODUCTION 1
8
DRX400 / X500
www.drexelbrook.comDRx400-x500-PM - English – SIL2/3 06-29-21 – Issue 2
Systematic Capability Measure (given as a scale of SC 1 to SC 3) of the confidence that the systematic
safety integrity of an element agrees with the conditions of the specified SIL
(related to the safety function of an element), when the element is applied in
accordance with the instructions.
Type A system "Non-complex" system (all failure modes are well defined). For more data, refer
to subsection 7.4.4.1.2 of IEC 61508-2.
Type B system "Complex" system (all failure modes are not well defined). For more data, refer
to subsection 7.4.4.1.3 of IEC 61508-2.
T[Proof] Proof Test Interval
T[Repair] Time to Repair
T[Test] Internal Diagnostics Test Interval
1oo1 1 out of 1 channel architecture (single architecture performs the safety function)
1oo1D 1 out of 1 channel architecture with diagnostics
1oo2 1 out of 2 channel architecture (architecture with homogeneous or
heterogeneous redundancy performs the safety function) 1
Table 1-4: Terms and definitions
1A system with homogeneous redundancy has two devices that operate with the same parameters. A system with het-
erogeneous redundancy has two devices that operate with different parameters.

2 SPECIFICATION OF THE SAFETY FUNCTION
9
DRX400 / X500
www.drexelbrook.com DRx400-x500-PM - English – SIL2/3 06-29-21 – Issue 2
2.1 Preconditions
The device must be operated in the process and ambient conditions given in the handbook
(document [N1]) of the device.
Other conditions must be obeyed for safety applications. For more data refer to
Safety
application conditions (SAC)
on page 12.
2.2 Definition of the safety function
2.2.1 General notes
The device contains a safety function that agrees with International Standard IEC 61508
(document [N2]). It can be used in safety-critical systems where the safety function is necessary.
The device can be used in standard configuration with a safety integrity level of "2" and in a
homogeneously redundant configuration at safety integrity level of "3". For more data about
homogeneous redundancy, refer to
Homogeneous redundancy on page 22.
For safe operation, the operator / SIS engineer must obey Safety Application Conditions (SAC).
For more data about Safety Application Conditions, refer to
Safety application conditions (SAC)
on page 12.
When the device detects a failure, it sends a failure current signal at one of two values: 3.6 mA
or 21 mA. For more data, refer to
Error conditions on page 19. Although the device can be set
to send a high failure current signal (21 mA), some hardware failures that have an effect on the
current output (for example, an open circuit or a power supply failure) will always cause the
device to send a low failure current signal (3.6 mA). Also, if the device is set to send a low
failure current signal, then a short circuit failure can cause the device to send a high failure
current signal. Thus, a logic controller must be able to identify the two failure current signals
(high and low) at all times.
It is possible that the device will identify radar signal interference (parasitic signals) as a
temporary failure. For example, obstacles in the tank can cause unwanted reflections.
Do a check (proof test) for the correct operation of the device after a temporary failure. For the
proof test procedure, refer to
Operation modes and proof tests on page 25.

SPECIFICATION OF THE SAFETY FUNCTION 2
10
DRX400 / X500
www.drexelbrook.comDRx400-x500-PM - English – SIL2/3 06-29-21 – Issue 2
2.2.2 Current output
The device sends a current output signal that agrees with the correct measured value. This
output has these properties:
•A current that is related to the correct measured value in an interval that is equal to or less
than the Fault Response Time.
•The maximum permitted measurement error is ±4% of the nominal current output range
•The primary measured value is ‘distance’. The secondary (calculated) values include "level",
"volume", "mass" or "linearized measurement". You can set these secondary (calculated)
values as parameters for device operation in SIL mode. These values can then be sent as
safety-related output signals.
•The "volume", "mass", "flow" and the "linearized measurement" values use a strapping table.
This strapping table does a linear interpolation between points for the measured distance
and the secondary (calculated) value (e.g. volume).
The value for Current Output, Full Scale (0...100% range) must be in the maximum measuring
range. If the measurement is the same as or less than the minimum limit of the normal range,
then the device will continue to show the minimum value (output "saturated" at 4 mA (standard
output range) or 3.8 mA (extended output range)). If the measurement is the same as or more
than the maximum limit of the normal range, then the device will continue to show the maximum
value (output "saturated" at 3.8 mA (standard output range) or 20.5 mA (extended output range)).
In these two conditions, the current output value is identified as a "non-safe" measurement. The
safe range of the current output is between:
•0.2 mA more than the minimum (saturated) current output for the measuring range, and
•0.5 mA less than the maximum (saturated) current output for the measuring range.
If the device has an internal failure, then this failure causes the device to send a permanent
failure current signal. To restart measurement after a permanent failure, you must reset the
device. For more data, refer to
How to reset the fail-safe flags on page 28.
Process conditions that have an effect on the devices status can cause temporary failures. The
device will try to restart operation.
CAUTION!
If the device measures volume, mass or flow, or uses a linearized scale, then do a check to make
sure that the values used in the strapping table are accurate. For an example of the procedure
you must use, refer to How to check measurement accuracy before operation in SIL mode on
page 24 .
CAUTION!
Make sure that the measured value is not less than the minimum limit or more than the
maximum limit of the measuring range. Do not let the current output become "saturated".

2 SPECIFICATION OF THE SAFETY FUNCTION
11
DRX400 / X500
www.drexelbrook.com DRx400-x500-PM - English – SIL2/3 06-29-21 – Issue 2
2.2.3 Fault response time
If the device detects a failure, then it changes the current output to the low or high failure
current value in an interval equal to or less than the fault response time. The maximum fault
response time is 90 seconds.
CAUTION!
Do regular checks for high and low failure currents. If the device cannot automatically restart
operation after a temporary failure, then you must reset the device. For more data, refer to How
to reset the fail-safe flags on page 28
.
CAUTION!
Make sure that the device operates correctly in the safety loop after a manual restart and that
the failure condition does not continue to be applicable.
CAUTION!
Make sure that you use other safety precautions to prevent safety-critical failures that can have
an effect on all of the system. For more data, refer to Operation modes and proof tests on page
25
.

SPECIFICATION OF THE SAFETY FUNCTION 2
12
DRX400 / X500
www.drexelbrook.comDRx400-x500-PM - English – SIL2/3 06-29-21 – Issue 2
2.3 Safety application conditions (SAC)
The handbook (document [N1]) gives instructions to correctly install the device and connect it to
an electrical circuit. These instructions are mandatory if you use the device in a safety-related
system.
2.3.1 General
•Unless they are specified in this safety manual, changes to the device configuration are not
permitted. Make sure that the device is in the approved configuration after you do
maintenance on the device. Also make sure that all Safety Application Conditions are obeyed.
For more data, refer to
Parameter types on page 20.
2.3.2 Installation
•The maximum permitted measuring distance is 18 m / 59 ft.
•Do the Quick Setup procedures in Program Mode (A Quick Setup menu) before the device
starts to operate in SIL mode. Make sure that the device configuration is correct (parameters
and values).
•If there is build-up on the antenna, make sure that you clean it at regular intervals.
•If it is necessary to set up a system with homogeneous redundancy, then it is permitted to
install more than one device on the same tank or silo. For more data, refer to
Homogeneous
redundancy on page 22.
•It is not permitted to install more than one independent operating radar on one tank. If there
is more than one, they have to be set up in a redundant configuration, where their output
signals are voted against each other.
•Only qualified personnel are permitted to remove or attach mechanical parts. Do a check of
the device configuration and electronic parts before you operate the device in SIL mode.
•Attach the weather protection accessory if you install the device more than 2000 m / 6560 ft
above sea level.
WARNING!
The device must have the applicable options and settings for the application. The ambient and
process conditions must agree with the technical data given in the handbook (document [N1])
and this document (safety manual). Obey the installation instructions given in the handbook
(document [N1]).
CAUTION!
We recommend that the 4 mA and 20 mA limits of the measuring range are not in the top or
bottom dead zones and the non-linearity zones.

2 SPECIFICATION OF THE SAFETY FUNCTION
13
DRX400 / X500
www.drexelbrook.com DRx400-x500-PM - English – SIL2/3 06-29-21 – Issue 2
2.3.3 Electrical connection
•Only connect the device to PELV circuits that agree with International Standard IEC 61140.
•Wait for 120 seconds after you de-energize the device before you connect the electrical
cables again.
2.3.4 Functionally safe configuration
•If you use the device in a continuous mode or high demand mode of operation, the process
safety time must be more than 90 seconds. This minimum time agrees with International
Standard IEC 61508 Part 2 (document [N2]), section 7.4.4.1.4).
•If you use the device in a high demand mode of operation, the maximum frequency of
demands is 1 demand every 83 minutes. This frequency agrees with International Standard
IEC 61508 Part 2 (document [N2]), section 7.4.4.1.4.
•Make sure that the device measures correctly before you operate the device in SIL mode. For
more data about the procedure, refer to
How to check measurement accuracy before
operation in SIL mode on page 24.
•The SIS engineer must make sure that changes to the device configuration do not have an
effect on the performance of the safety-related system. Use safety precautions for system
protection, if it necessary.

SPECIFICATION OF THE SAFETY FUNCTION 2
14
DRX400 / X500
www.drexelbrook.comDRx400-x500-PM - English – SIL2/3 06-29-21 – Issue 2
2.4 Operation modes
2.4.1 SIL mode
The device operates with a safety function. If the safety function detects a failure, it will send a
failure current signal that gives a warning that the safety function cannot continue to operate
correctly. The device continues to be functionally safe and the safety-related data (e.g. hazard
rate, FRT etc.) continues to be applicable.
Devices in SIL mode have these operational conditions:
•Program Mode is not available. Thus, you cannot use the device display screen or a HART®
controller to change the device configuration.
•HART® multidrop mode is not available.
•The device cannot simulate measurement values at the output terminals.
2.4.2 Non-SIL mode
The device operates as a standard device. Device operation and error detection agrees with all
the values set in Program Mode by the user. SIL mode constraints are not applicable.
2.4.3 Maintenance mode
You can use "Maintenance" mode to start a device and do tests in normal conditions in the
system.
Enter the "Expert" password to enter "Maintenance" mode. During the tests, you are responsible
for device operation and the possible effects it can have on the system. Make sure that you
change the device configuration back to SIL mode when you complete the tests.
WARNING!
Make sure that you change from "Maintenance" mode to "SIL" mode after you complete the
tests. If you do not change from "Maintenance" mode to "SIL" mode, then the device will not
operate correctly in a safety-related system. Make sure that the safety-related system has
protection from the effects of device operation in "Maintenance" mode.

3 OPERATION
15
DRX400 / X500
www.drexelbrook.com DRx400-x500-PM - English – SIL2/3 06-29-21 – Issue 2
3.1 Operation in SIL mode
3.1.1 General notes
The device must have the SIL option to operate in SIL mode and use the safety function. If you
sent an order for a device with a SIL option, then SIL mode activation is unlocked and the safety
function is available. A SIL symbol is shown on the top right side of the display screen when the
device operates in SIL mode.
The configuration is protected with a password. For more data on password protection and
device configuration, refer to the "Operation" chapter in the handbook (document [N1]).
For more data about the procedure, refer to
Device configuration for operation in SIL mode on
page 15.
3.1.2 Device configuration for operation in SIL mode
Equipment needed
•Device with the integrated display option
•Ammeter (not supplied)
•Display extractor
Part 1: Set the parameters
• The device is on a measurement screen in Normal mode. Push [] again and again to go to
the SIL setup screen.
• Push [>] to enter Program mode. Push [>] again to enter the Quick Setup menu.
• Push [] two times to go to A3 Login and enter the 4-digit password for the "Expert" access
level (default password: 0058) and push [^].
• Go to A4 Application Assistant or C Full Setup menus to change values.
iIt is not permitted to change menu items that have parameters that are important for the
safety function. The device shows a padlock symbol next to important parameters that are
automatically set and locked for SIL mode.
• Push [^] again and again to go back to the top menu.
• Save the new device configuration. Select "Yes".
iThe display screen shows the text: Switch to SIL mode?
• Select "Yes" to change from non-SIL mode to SIL mode.
• Enter the 4-digit password for the "Expert" access level (default password: 0058) and push [^]
to accept the change to SIL mode.
iThe device starts again after 60 seconds. The display screen shows the text "Press key for
verification".
WARNING!
Only qualified personnel can change the device configuration. Record changes to the device
configuration. This report must include the date, the menu item, the old value and the new value.

OPERATION 3
16
DRX400 / X500
www.drexelbrook.comDRx400-x500-PM - English – SIL2/3 06-29-21 – Issue 2
Part 2: Current output check
• Connect an ammeter to the circuit.
• Push a button on the keypad.
iThe device will do a check of the current output.
• Look at the current values on the ammeter display screen. The current output automatically
changes in this sequence at intervals of 1 second: 3.5 mA, 4 mA, 6 mA, 8 mA, 10 mA, 12 mA,
14 mA, 16 mA, 18 mA, 20 mA and 21.5 mA.
iThe display screen shows the text "Set SIL jumper or press key to cancel" during this test.
This sequence repeats continuously until you lock the device configuration in SIL Mode
(refer to Part 3) or you push a button on the keypad to cancel this procedure.
Part 3: Lock the device configuration in SIL mode
• Find the two clips that hold the display module in the housing.
• Use the display extractor to remove the display module from the housing. Put the display
extractor in the slots on the module for these clips.
• Carefully remove the display module from housing and then remove the display extractor from
the display module.
• Remove the jumper from the non-SIL mode position.
• Put the jumper in the SIL mode position.
iMake sure that the jumper is correctly connected to the pins on the circuit board. Refer to
the illustration that follows.
• Put the display module back on the electronics block.
iIf the clips make a click sound, then the display module is correctly attached to the
electronics block. The device display screen shows the text "LEVEL SENSOR starting up…"
and then measurements in normal mode.
• Make sure that the SIL symbol is shown in the top right corner of the display screen.
iThe device configuration is "locked" and parameters cannot be changed in SIL mode.

3 OPERATION
17
DRX400 / X500
www.drexelbrook.com DRx400-x500-PM - English – SIL2/3 06-29-21 – Issue 2
You will see the screens that follow after you connect the display module to the electronics
block:
Figure 3-1: How to lock the device configuration in SIL mode
Figure 3-2: Device operation in SIL mode
1 SIL mode symbol (this symbol is only shown in SIL mode)

OPERATION 3
18
DRX400 / X500
www.drexelbrook.comDRx400-x500-PM - English – SIL2/3 06-29-21 – Issue 2
3.2 How to change the configuration of a device operated in SIL mode
3.2.1 General notes
It is not permitted to change the configuration of a device in SIL mode. If it is necessary for the
device to use a new parameter in SIL mode, you must put the device in non-SIL mode to change
the configuration.
3.2.2 How to change device operation from SIL mode to non-SIL mode
Equipment needed
•Display extractor
• Find the two clips that hold the display module in the housing.
• Use the display extractor to remove the display module from the housing. Put the display
extractor in the slots on the module for these clips.
• Carefully remove the display module from housing and then remove the display extractor from
the display module.
• Remove the jumper from the SIL mode position.
• Put the jumper in the non-SIL mode position.
iMake sure that the jumper is correctly connected to the pins on the circuit board.
• Put the display module back on the electronics block.
iIf the clips make a click sound, then the display module is correctly attached to the
electronics block. The device display screen shows the text "LEVEL SENSOR starting up…"
and then the text "Press key for verification".
• Push a button on the keypad.
iThe device will do a check of the current output.
Figure 3-3: How to change from SIL mode to non-SIL mode
1 "SIL mode" position
2 "non-SIL mode" position

3 OPERATION
19
DRX400 / X500
www.drexelbrook.com DRx400-x500-PM - English – SIL2/3 06-29-21 – Issue 2
• Look at the current values on the ammeter display screen. The current output automatically
changes in this sequence at intervals of 1 second: 3.5 mA, 4 mA, 6 mA, 8 mA, 10 mA, 12 mA,
14 mA, 16 mA, 18 mA, 20 mA and 21.5 mA.
iThis sequence repeats continuously until you push a button to stop the sequence. The
display screen shows the text "Set SIL jumper or press key to cancel" during this test.
• Push a button on the keypad and enter the password (0058) and push [^].
iFirst, the device display screen shows the text "Wait for reboot" and then measurements in
normal mode. The device is in non-SIL mode. The SIL mode symbol is not shown on the top
right corner of the display screen.
3.3 Error conditions
The device can detect error conditions. When the device detects an error, it supplies a failure
current value to show that this a temporary (transient) or permanent (persistent) failure.
Error conditions are the same for non-SIL mode and SIL mode, but special conditions are
applicable to SIL mode. These special conditions are:
•The device will supply a failure current if there is a safety-critical failure.
•The failure current is the only signal that is related to the safety function. Ignore data from
other outputs and display options (e.g. HART® handheld controller etc.).
•Make sure that you monitor the low failure current value (3.6 mA) and the high failure
current value (21 mA).
•The tables that follows shows the types of error that is related to safety (SIL). Errors in this
group will only occur if you operate the device in SIL mode.
For more data about error conditions, refer to the tables that follows:
Error conditions related to the device hardware
INFORMATION!
For more data about the procedure to remove the display module, refer to "Turning the display"
section in the handbook (document [N1]).
CAUTION!
Although the device can be set to send a high failure current signal (21 mA), some hardware
failures will always cause the device to send a low failure current signal (3.6 mA).
Status type Error message Description Corrective actions
F Electronics
All error messages This type of error causes the
device to automatically stop
operation.
Restart the device. For more data
about the procedure to restart
the device, refer to How to reset
the fail-safe flags on page 28.
Table 3-1: Error conditions that can cause a permanent failure current

OPERATION 3
20
DRX400 / X500
www.drexelbrook.comDRx400-x500-PM - English – SIL2/3 06-29-21 – Issue 2
3.4 Parameter types
3.4.1 Safety-critical parameters
You cannot change safety-critical parameters. The menu items for these parameters are
automatically set, locked and show a padlock symbol adjacent to the related parameters in the
device menu.
3.4.2 Safety-relevant parameters
You can change safety-relevant parameters, but the range of values can be different from those
that are used in non-SIL mode. These values can have an effect on the current output.
Refer to the table that follows. This table only shows parameters that have lists or ranges of
values that are different from those that used in non-SIL mode. Other safety-relevant
parameters, where the lists or ranges of values are the same as those available in non-SIL
mode, are not shown.
You can change the parameters given in the table that follows and then use this new
configuration in SIL mode. The device does a check of the new configuration to make sure that it
is compatible with SIL mode. For more data, refer to
Operation in SIL mode on page 15.
CAUTION!
Safety-critical parameters for SIL mode do not always have the same values as the values set in
non-SIL mode. A safety-critical parameter has a SIL-specific value in SIL mode. Make sure that
your device is in the correct configuration with the correct values in a given mode.
Menu
No.
Menu item Safety-critical values Description
C1.6 Time Constant 3.000 s This is the approved time to change measurement
values on the device display screen and current
output. This value cannot be changed.
C2.4 Measuring Mode Direct "TBF Auto”, "TBF Full" and "Direct Plus"
measurement modes are not permitted.
C2.5 Overfill Detection Disabled "Enabled" is not permitted.
C2.11 Error Delay 10 Sec This is the approved time before the device records
an error. This value cannot be changed for
operation in SIL mode.
C4.1.9.2 4mA Trimming 0 Do not adjust the current output of the device.
C4.1.9.5 20mA Trimming 0 Do not adjust the current output of the device.
C5.1.1 Current Loop Mode On Operation in HART® multidrop mode ("Off") is not
permitted.
D3.3.1 Manual Correction Offset 0.0 m Service menu parameters. The Service menu is
only available to personnel approved by the
manufacturer. These values cannot be changed for
operation in SIL mode.
D3.3.2 Manual Correction Factor 1.0
Table 3-2: Safety-critical parameters
CAUTION!
The device configuration must agree with the Safety Application Conditions. For more data, refer
to Safety application conditions (SAC) on page 12 .