Magnetrol E3 Modulevel series User guide

SIL Certified Safety Manual
for E3 Modulevel®
Model E3X-XXXX-SXX
Liquid Level
Displacer Transmitter
This manual complements and is intended to be used with the
Magnetrol®E3 Mod ulevel®Liquid Level Displacer Transmitter
Installation and Operating manual (Bulletin 48- 35).
Safety Function
Th HART®v rsion of th E3 Modul v l®transmitt r will
m asur l v l and transmit a signal proportional to that l v l
within th stat d saf ty accuracy of ±2% of span (or th
m asur d rror publish d in I/O Manual 48-635, which v r
is gr at r). In addition, wh n continuous, automatic diagnos-
tics d t ct that th transmitt r cannot p rform this function,
th output will b driv n to th custom r-sp cifi d out-of-
rang signal (i. ., 3.6 mA or 21 mA).
Th E3 MODULEVEL is c rtifi d for us in low d mand
l v l m asur m nt applications.
Application
Th HART®v rsion of th E3 MODULEVEL l v l trans-
mitt r can b appli d in most proc ss or storag v ss ls, bri-
dl s, and bypass chamb rs up to th transmitt r’s rat d t m-
p ratur and pr ssur . Th E3 MODULEVEL can b us d
in liquids, cl an or dirty, light hydrocarbons to h avy acids
(SG=0.23 to 2.20) to m t th saf ty syst m r quir m nts of
IEC 61508 (Edition 2.0, 2010).
Benefits
• L v l prot ction to SIL 3 as c rtifi d by xida C rtification
p r IEC 61508.
• L v l rang s from 14 to 120+ inch s
(356 to 3048+ mm).
• Proc ss t mp ratur s to +850 °F (+454 °C) for non-st am
applications, +800 °F (+427 °C) for st am applications
• Proc ss pr ssur s to 5150 psi (355 bar).
• Continuous s lf-t st with 22 mA or 3.6 mA fault indica-
tion fully compliant with NAMUR NE 43.
• IS, XP, and Non-Inc ndiv approvals.
• Emission and immunity complianc to EN 61326.
• Two-wir , loop-pow r d transmitt r for l v l,
int rfac , or d nsity m asur m nt.

48-651 SI Certified Safety Manual for E3 Modulevel®
Table of Contents
E3 Modulevel®Displacer Level Transmitter
SIL Manual for E3 Modulevel® E3X-XXXX-SXX
1.0 Introduction ...................................................................3
1.1 Product D scription..................................................3
1.2 Th ory of Op ration.................................................3
1.3 D t rmining Saf ty Int grity L v l (SIL) ..................4
2.0 Applicable Models..........................................................4
3.0 Level Measurin System .................................................4
3.1 Misc llan ous El ctrical Consid rations ....................5
3.1.1 Pollution D gr 2 .........................................5
3.1.2 Ov rvoltag ....................................................5
3.1.3 El ctromagn tic Compatibility.......................5
4.0 Mean Time To Repair (MTTR).....................................5
5.0 Supplementary Documentation......................................6
6.0 General Instructions.......................................................6
6.1 Syst matic Limitations ..............................................6
6.1.1 Application.....................................................6
6.1.2 Environm ntal................................................6
6.1.2.1 Op rating ........................................6
6.1.2.2 Storag .............................................6
6.2 Installation ................................................................7
6.3 Skill L v l of P rsonn l .............................................7
6.4 N c ssary Tools .........................................................7
6.5 Configuration Information .......................................7
6.5.1 G n ral...........................................................7
6.5.2 Configuration.................................................7
6.5.3 Writ Prot cting/Locking ..............................8
6.6 Sit Acc ptanc T sting .............................................8
6.7 R cording R sults......................................................8
6.8 Maint nanc .............................................................8
6.8.1 Diagnostics and R spons Tim s....................8
6.8.2 Troubl shooting .............................................9
7.0 Recurrent Function Tests ...............................................9
7.1 Proof T sting.............................................................9
7.1.1 Introduction...................................................9
7.1.2 Int rval...........................................................9
7.1.3 R cording R sults...........................................9
7.1.4 Sugg st d Proof T st.....................................10
7.1.5 Proof T st Cov rag ......................................10
8.0 Safety Requirements.....................................................11
8.1 Syst m Saf ty Assumptions .....................................11
8.2 Saf ty Function R quir m nts.................................12
8.3 Saf ty Us r Programming and Configuration
R quir m nts ..........................................................12
9.0 Appendices ...................................................................13
9.1 SIL C rtificat .........................................................13
9.2 FMEDA R port: xida Manag m nt Summary ......14
9.3 Sp cific E3 MODULEVEL Valu s..........................15
9.4 R port: Lif tim of Critical Compon nts................15

3
48-651 SI Certified Safety Manual for E3 Modulevel®
1.0 Introduction
1.1 Product Description
Th E3 MODULEVEL is a loop-pow r d, two-wir ,
24 VDC l v l transmitt r that us s simpl buoyancy princi-
pl s in combination with a pr cision rang spring and a
highly accurat LVDT (lin ar variabl diff r ntial trans-
form r) to d t ct and conv rt liquid l v l chang s into a
stabl 4–20 mA output signal.
NOTE: For Safety Instrumented Systems usage, it is assumed that the
4–20 mA output is used as the safety variable.
Th analog output from th E3 MODULEVEL m ts th
NAMUR NE 43 standard (3.8 mA to 20.5 mA usabl ). Th
transmitt r contains s lf-diagnostics and is programm d to
driv th output to a us r-s l ct d failur stat , ith r low or
high, upon int rnal d t ction of a diagnostic indicator. Th
d vic can b quipp d with or without an optional non-
int rf ring graphic liquid crystal display (LCD).
Tabl 1 indicat s th v rsion of th E3 MODULEVEL
transmitt r that has b n c rtifi d for SIL 2/3 applications.
1.2 Theory of Operation
Th E3 MODULEVEL Displac r L v l Transmitt r r li s
on th principl s of buoyancy to conv rt m chanical mov -
m nt to an l ctronic output.
Th mov m nt of th rang spring, as it compr ss s or lon-
gat s bas d on th volum of displac r subm rg d in th
liquid, caus s mov m nt of a sp cial LVDT cor attach d to
th spring. Th LVDT t chnology conv rts th mov m nt
of th LVDT cor within th LVDT to a stabl 4–20 mA
output signal. Th position of th cor , with r sp ct to a
primary and two s condary windings, induc s voltag in
ach winding. Th comparison of th induc d voltag s
within th microproc ssor of th E3 MODULEVEL r sults
in v ry accurat l v l or int rfac l v l output.
Th E3 MODULEVEL can, alt rnativ ly, b s t up to track
th changing d nsity of a liquid ov r a known d nsity rang
and conv rt that into a stabl 4–20 mA output signal. As th
d nsity of th liquid chang s, so do s th mass of th liquid
displac d by th displac r. This r sulting chang in buoyancy
forc on th displac r caus s mov m nt of th LVDT cor
n d d to conv rt th d nsity chang to th 4–20 mA signal.
1 Transmitters:
Model E3 MODULEVEL,
E3X-XXXX-SXX (HART)
Hardware Version (or later)
Analog Board 030-2475-001 + -003 Rev E
Digital Board 030-9145-001 Rev AG
Wiring Board 030-9151-001 Rev Q
Software Version (or later)
Model E3 HT 1.1cA.mot
Table 1
Enhanced E3 MODULEVEL
Model Numbers

448-651 SI Certified Safety Manual for E3 Modulevel®
1.3 Determining Safety Integrity Level (SIL)
Saf ty Instrum nt d Syst m d sign rs using th
E3 MODULEVEL must v rify th ir d sign p r applicabl
standards.
Thr limits must b m t to achi v a giv n SIL l v l:
1. Th PFDAVG numb rs for th ntir Saf ty Instrum nt d
Function (SIF) must b calculat d. Tabl 2 shows th r la-
tionship b tw n th Saf ty Int grity L v l (SIL) and th
Probability of Failur on D mand Av rag (PFDAVG).
2. Archit ctur constraints must b m t for ach subsyst m.
Tabl 3 can b us d to d t rmin th achi vabl SIL as a
function of th Hardwar Fault Tol ranc (HFT) and th
Saf Failur Fraction (SFF) for ach subsyst m in a saf ty
syst m (Typ B–compl x compon nts as p r IEC 61508
Part 2) of which th l v l transmitt r is just on compon nt.
3. All products chos n for us in th SIF must m t th
r quir m nts of IEC 61508 for th giv n SIL Capability
l v l or b justifi d bas d on prov n in us data coll ct d for
ach job.
Th xSIL ntia tool from xida is r comm nd d for d sign
v rification. This automatically ch cks all thr limits and
displays th r sults for any giv n d sign. Th E3 MOD-
ULEVEL is in th xSIL ntia databas . This tool contains
all n d d failur rat , failur mod , SIL Capability and
common caus data as w ll as sugg st d proof t st m thods.
2.0 Applicable Models
This manual is only applicabl to th HART v rsions of
th E3 MODULEVEL transmitt r shown in Tabl 1.
3.0 Level Measuring System
Th diagram at l ft shows th structur of a typical m asuring
syst m incorporating th E3 MODULEVEL transmitt r.
This SIL 2/3 C rtifi d d vic is only availabl with an ana-
log signal (4–20 mA) with HART communications; and,
th m asur m nt signal us d by th logic solv r can b th
analog 4–20 mA signal proportional to th L v l, Int rfac
L v l or D nsity.
• For fault monitoring, th logic unit must r cogniz both
high alarms (≥ 21.5 mA) and low alarms (≤ 3.6 mA).
• If th logic solv r loop us s intrinsic saf ty barri rs, caution
must b tak n to nsur th loop continu s to op rat
prop rly und r th low alarm condition.
Figure 1
Typical System
Table 3
Minimum hardware fault tolerance
Type B sensors, final elements and non-PE logic solvers
SFF
Hardware Fault
Tolerance (HFT)
012
None: <60% Not
Allowed SI 1 SI 2
ow: 60% to <90% SI 1 SI 2 SI 3
Medium: 90% to <99% SI 2 SI 3
High: ≥99% SI 3
Table 2
SIL vs. PFDavg
Safety
Integrity Level
(SIL)
Target Average
probability of failure
on demand (PFDavg)
4≥10-5 to <10-4
3≥10-4 to <10-3
2≥10-3 to <10-2
1≥10-2 to <10-1

5
48-651 SI Certified Safety Manual for E3 Modulevel®
.• Th only unsaf mod is wh n th unit is r ading an
incorr ct l v l within th 4–20 mA rang (> ±2% d viation).
• MAGNETROL d fin s th fault d mod as on in which
th 4–20 mA curr nt is driv n out of rang (i. ., l ss than
3.8 mA or gr at r than 21.5 mA).
• Th 4–20 mA output signal can b configur d for ov r-
rang p r NAMUR NE43.
3.1 Miscellaneous Electrical Considerations
Following ar misc llan ous l ctrical issu s to b consid r d
in a saf ty syst m.
3.1.1 Pollution Degree 2
Th E3 MODULEVEL transmitt r is d sign d for us
in a Cat gory II, Pollution D gr 2 installation, which is
d fin d by a nonconductiv pollution of th sort wh r
occasionally a t mporary conductivity caus d by cond nsation
must b xp ct d.
This is th usual pollution d gr us d for quipm nt b ing
valuat d to IEC/EN 61010.
3.1.2 Overvoltage
Th E3 MODULEVEL has ov rvoltag prot ction p r CE
r quir m nts; this prot ction is to 1000 volts wh n consid-
ring Hi-pot, Fast Transi nts, and Surg . Th r for , th r
should b no unsaf failur mod s up to 1 KV.
Ov rvoltag Cat gory II is a local l v l, cov ring applianc s,
portabl quipm nt, tc., with small r transi nt ov rvoltag s
than thos charact ristic of Ov rvoltag Cat gory III. This
cat gory appli s from th wall plug to th pow r supply iso-
lation barri r (transform r). Th typical plant nvironm nt
is Ov rvoltag Cat gory II, so most quipm nt valuat d to
th r quir m nts of IEC/EN 61010 ar consid r d to
b long in that classification.
3.1.3 Electromagnetic Compatibility
Th E3 MODULEVEl is d sign d to m t th r quir -
m nts of EN 61326 and NAMUR NE21.
4.0 Mean Time To Repair (MTTR)
SIL d t rminations ar bas d on a numb r of factors including
th M an Tim To R pair (MTTR). Th analysis for th E3
MODULEVEL is bas d on a MTTR of 24 hours.

648-651 SI Certified Safety Manual for E3 Modulevel®
5.0 Supplementary Documentation
Th E3 MODULEVEL Installation and Op rating Manual
(Bull tin 48-635) must b availabl for installation of th
m asuring syst m.
Th following El ctronic D vic D scription Fil is r quir d
if HART is us d:
Manufacturer Code 0x56
Model E3 MODULEVEL Device ID OxE3, device revision 2
DD revision 1
For d vic installations in a classifi d ar a, th r l vant
saf ty instructions and l ctrical cod s must b follow d.
6.0 General Instructions
6.1 Systematic Limitations
Th following instructions must b obs rv d to avoid
syst matic failur s:
6.1.1 Application
Th E3 MODULEVEL transmitt r should b locat d for asy
acc ss for s rvic , configuration, and monitoring. Th r should
b suffici nt h adroom to allow installation and r moval of th
transmitt r h ad, and, in cas s of tank top configuration, th
displac r. Sp cial pr cautions should b mad to pr v nt xpo-
sur to corrosiv atmosph r , xc ssiv vibration, shock, or
physical damag . Th E3 MODULEVEL should only b us d
for applications in which buildup of solid mat rials on th
spring or in th nclosing tub is not an issu .
Caution: Operation of all buoyancy type level devices should be
done in such a way as to minimize the action of dynamic
forces on the float or displacer sensing element. Good
practice for reducing the likelihood of damage to the con-
trol is to equalize pressure across the device very slowly.
6.1.2 Environmental
R f r to th E3 MODULEVEL Installation and Op rating
Manual (Bull tin 48-635) for Environm ntal limitations.
6.1.2.1 Operating
Th op rating t mp ratur rang is -40 to +175 °F (-40 to
+80 °C).
6.1.2.2 Storage
Th d vic should b stor d in its original shipping box
and not b subj ct d to t mp ratur s outsid th storag
t mp ratur rang of -50 to +185 °F (-46 to +85 °C).

7
48-651 SI Certified Safety Manual for E3 Modulevel®
6.2 Installation
R f r to th E3 MODULEVEL Installation and Op rating
Manual 48-635 manual for compl t installation instruc-
tions.
• Contains information on th us , changing and r s tting of
th password-prot ction function.
• Provid s m nu s l ction it ms for configuration of th
transmitt r as a l v l s nsing d vic .
• Off rs configuration r comm ndations.
• Input voltag and loop r sistanc must b within th saf
op rating ar a of th d vic .
6.3 Skill Level of Personnel
P rsonn l following th proc dur s of this saf ty manual
should hav t chnical xp rtis qual to or gr at r than that
of a qualifi d Instrum nt T chnician.
6.4 Necessary Tools
No sp cial quipm nt or tools ar r quir d to install
E3 MODULEVEL. Th following it ms ar r comm nd d:
• Wrenches, flan e askets, and flan e boltin
appropriate for process connection(s)
• Flat-blade screwdriver
• Level
• 1⁄8" Allen wrench
• 24 VDC power supply, 23 mA minimum
• Di ital multimeter
• 250 to 450 ohm resistor for HART communication
6.5 Configuration Information
6.5.1 General
Th E3 MODULEVEL can b configur d via th local dis-
play, th HART compatibl handh ld communicator, or a
PC using PACTware and associat d DTM.
6.5.2 Configuration
Ensur th E3 MODULEVEL transmitt r has b n prop r-
ly configur d for th application. Sp cial consid ration
should b giv n to th following configuration param t rs:
User Password: Must b chang d to a sp cific valu oth r
than Z ro.
Failure Alarm: DO NOT choos HOLD for this param t r
as a Fault will not b annunciat d on th curr nt loop.

Analog Output Mode: Ensur this is s t to Enabl d.
Interface Management: Ensur th displac r is compl t ly
imm rs d in liquid.
6.5.3 Write Protecting / Locking
Th E3 MODULEVEL transmitt r is password prot ct d
with a num rical valu b tw n 0 and 255. Aft r th pass-
word has b n succ ssfully nt r d, an xclamation mark (!)
app ars as th last charact r on th first lin of th display.
R f r to th E3 MODULEVEL Installation and Op rating
Manual (Bull tin 48-635) for information on password pro-
t ction.
NOTE: Default Password = 0 = Password disabled.
For an SIS syst m, it is r quir d that, aft r configuration of
th syst m is compl t , a password is utiliz d to pr v nt
inadv rt nt chang s to th d vic .
6.6 Site Acceptance Testing
To nsur prop r op ration aft r installation and configura-
tion, a sit acc ptanc t st should b compl t d. This
proc dur is id ntical to th Proof T st Proc dur d scrib d
in S ction 7.1.4.
6.7 Recording Results
R sults of Sit Acc ptanc T sting must b r cord d for
futur r f r nc .
6.8 Maintenance
Th only maint nanc r quir d is th proof t st.
• R port all failur s to Magn trol®.
• Firmwar can b upgrad d only by factory p rsonn l.
6.8.1 Diagnostics and Response Times
Continuous int rnal diagnostics ar pr s nt within th E3
MODULEVEL transmitt r. In th v nt a Fault is d t ct d,
a m ssag will app ar on th LCD and th output curr nt
will b driv n to 3.6 mA or 22mA d p nding on how th
FAULT param t r is configur d.
A) Start-up Tim :
a. From application of pow r to normal op rat-
ing mod : 5 s conds
b. From application of pow r to Fault mod :
8 s conds or l ss (Assuming a Fault is pr s nt
upon start-up)
848-651 SI Certified Safety Manual for E3 Modulevel®

9
48-651 SI Certified Safety Manual for E3 Modulevel®
B) Diagnostic T st Int rval: 3 s conds
a. This is d fin d as th tim from th normal
op rating mod to th Fault mod upon th
occurr nc of a fault.
C) Saf ty Function R spons Tim :
3 s conds (with Damping=0)
6.8.2 Troubleshooting
R port all failur s to th MAGNETROL T chnical Support
D partm nt.
R f r to th E3 MODULEVEL Installation and Op rating
Manual Bull tin 48-635 for troubl shooting d vic rrors.
To assist in finding rrors should th y occur, at start-up
compl t th Configuration Data Sh t found at th back
of this manual, mak a list of all d vic configuration
param t rs, including th password, and r tain this informa-
tion in a saf plac .
• Firmwar can b upgrad d only by factory p rsonn l.
7.0 Recurrent Function Tests
7.1 Proof Testing
7.1.1 Introduction
Following is th proc dur utiliz d to d t ct Dang rous
Und t ct d (DU) failur s.
7.1.2 Interval
To maintain th appropriat Saf ty Int grity L v l of a
Saf ty Instrum nt d Syst m, it is imp rativ that th ntir
syst m b t st d at r gular tim int rvals (shown as TI in th
appropriat standards). Th suitabl SIL for th E3
MODULEVEL transmitt r is bas d on th assumption that
th nd us r will carry out this t st and insp ction at l ast
onc p r y ar.
NOTE: It is the responsibility of the owner/operator to select the type
of inspection and the time period for these tests.
7.1.3 Recording Results
R sults of th Proof T st should b r cord d for futur
r f r nc .

10 48-651 SI Certified Safety Manual for E3 Modulevel®
Step Action
1Bypass the safety function and take appropriate action to avoid a false trip.
2 Use HART communications to retrieve any diagnostics and take appropriate action.
3Send a HART command to the transmitter to go to the high alarm current output and verify that the
analog current reaches that value. ➀
4Send a HART command to the transmitter to go to the low alarm current output and verify that the
analog current reaches that value. ➁
5Inspect the transmitter for any leaks, visible damage or contamination.
6Perform a two-point calibration ➂of the transmitter over the full working range.
7Remove the bypass and otherwise restore normal operation.
Device λDUPT
(FIT)
Proof Test
Coverage
E3, Single Solenoid, DTT 14 76%
E3, Single Solenoid, ETT 14 77%
7.1.4 Suggested Proof Test
Th sugg st d proof t st for th E3 is d scrib d in th fol-
lowing tabl . Th nd us r must us calibrat d quipm nt
to m asur th output in st ps 3, 4, and 6.
7.1.5 Proof Test Coverage
Th Proof T st Cov rag for th various product configura-
tions is giv n in th following tabl .
➀ This tests for compliance voltage problems such as a low loop power supply voltage or increased wiring resistance. This also
tests for other possible failures.
➁ This tests for possible quiescent current related failures.
➂ If the two-point calibration is performed with electrical instrumentation, this proof test will not detect any failures of the sensor.
Table 8 Proof Test Coverage – E3

11
48-651 SI Certified Safety Manual for E3 Modulevel®
Assumptions for Safety
The user SIF will detect and properly handle annunciation of detected fault conditions signaled by the alarm level
output according to the specific requirements of the SIF.
Proper operation of the Model E3 MODU EVE is dependent on having 11 VDC or greater across the transmitter
terminals during normal operation.
A user SIF integrating the Model E3 MODU EVE current loop output will detect faulted field wiring and other faults
resulting in a current loop value signal outside of the specified range and take proper actions to maintain safety integrity
according to the specific requirements of the SIF.
ocal User Interface will not be relied upon by the end user SIF during normal operation and will be considered
non-interfering to the safety function.
HART communications will not be relied upon by the end user for the SIF normal operation and will be considered non-
interfering to the safety function.
The impact of end user configured damping values is not included in the published safety (function) response time.
(The end user must consider this as part of overall time response of the SIF.)
The end user must take the E3 offline, independently verify all changes to end user configured parameters, and
validate the safety function prior to putting the E3 back online and relying on the product for safety protection.
The end user will enable the User Password to lock out any end user modifiable configuration parameters available via
the ocal User Interface during normal operation.
The end user will enable the user password to lock out any end user modifiable configuration parameters available via the
HART interface during normal operation. The end user will allow HART access only to qualified and trained personnel.
The end user will have proper procedures in place to ensure safe operation over the product life cycle.
The end user will ensure the device is properly installed per the product literature. The proper displacer will be used for
the application with the transmitter properly connected.
The end user must not select HO D for the alarm output.
oop Current mode must be enabled.
8.0 Safety Requirements
This s ction sp cifi s thos saf ty charact ristics allocat d
to th E3 MODULEVEL that ar conditions for its acc pt-
anc as a SIL c rtifi d d vic .
NOTE: This SI evaluation has assumed that the customer will be able
to acknowledge an over- or under-current condition via the
ogic Solver.
8.1 System Safety Assumptions
Th Syst m Saf ty Assumptions provid a list of saf ty r l -
vant assumptions mad on th usag of th product ov r th
saf ty lif cycl of a us r Saf ty Int grity Function, SIF.
Magn trol cannot dir ctly control th us r lif cycl of a SIF
using this product but n ds to hav assumptions on how
th product will b us d. It is important that us rs hav full
knowl dg of th s assumptions to nsur th y ar m t wh n
using th product as part of a SIF. This is to nsur th
product is us d in a mann r consist nt with th saf ty d sign.
This s ction only lists product sp cific assumptions and is
not int nd d to sp cify m asur s r quir d of th nd us r
that ar standard r quir m nts for saf ty applications.

12 48-651 SI Certified Safety Manual for E3 Modulevel®
8.2 Safety Function Requirements
This s ction lists th Saf ty Function R quir m nts that
sp cify what saf ty r l vant functionality is to b p rform d
for impl m ntation of th saf ty int grity function and also
to maintain th d sir d l v l of saf ty int grity. Th s
r quir m nts may also rul out particular functionality for
SIF usag that could l ad to d signs that ar difficult to vali-
dat for d t rministic p rformanc or saf ty int grity.
Safety Function Requirement
Upon application of power and successful initialization, the Model E3 MODU EVE shall enter the Normal Mode
or Faulted Mode of operation.
Upon application of power and successful initialization, the Model E3 MODU EVE shall enter the Normal Mode
operation within 5 seconds.
Upon application of power and successful initialization, the Model E3 MODU EVE shall enter the Faulted Mode
of operation in less than 8 seconds.
The Model E3 MODU EVE shall transition to the Faulted Mode from the Normal Mode within the Diagnostic Test
Interval after a diagnostic event occurs. The safety function will respond to a change from the user’s process with-
in the safety (function) response time.
The Model E3 MODU EVE shall transition to the Faulted Mode from the Normal Mode within the Diagnostic Test
Interval of 3 seconds after a diagnostic event occurs.
The safety function output of the Model E3 MODU EVE shall respond to a change from the user’s process with-
in the safety (function) response time of 3 seconds assuming Damping is set to 0.
The Model E3 MODU EVE may leave the Faulted Mode when all diagnostics are clear.
8.3 Safety User Programming and
Configuration Requirements
Th Saf ty Us r Programming and Configuration
R quir m nts provid th r quir m nts for fi ld configura-
tion of th d vic r quir d to cr at and maintain SIF con-
figurations. Th s r quir m nts should provid th n c s-
sary guidanc to nsur that th ngin ring nvironm nt
will m t both th int nd d mark t and saf ty c rtification
r quir m nts, along with guidanc and us r r strictions doc-
um nt d in th saf ty manual.
Safety User Programming Requirement
Setup, configuration, and maintenance functionality for the Model E3 MODU EVE shall be supported by the
non-interfering HART communications interface.
Setup, configuration and maintenance functionality for the Model E3 MODU EVE shall be supported by the non-
interfering ocal User Interface.

13
48-651 SI Certified Safety Manual for E3 Modulevel®
9.0 Appendices
9.1 SIL Certificate

14 48-651 SI Certified Safety Manual for E3 Modulevel®
9.2 FMEDA Report: exida Management Summary

15
48-651 SI Certified Safety Manual for E3 Modulevel®
9.3 Specific E3 MODULE EL alues
9.4 Report: Lifetime of Critical Components
According to s ction 7.4.9.5 of IEC 61508-2, a us ful lif -
tim , bas d on xp ri nc , should b assum d.
Although a constant failur rat is assum d by probabilistic
stimation m thod, this only appli s provid d that th
us ful lif tim of compon nts is not xc d d. B yond th ir
us ful lif tim th r sult of th probabilistic calculation
m thod is th r for m aningl ss, as th probability of failur
significantly incr as s with tim . Th us ful lif tim is
highly d p nd nt on th subsyst m its lf and its op rating
conditions.
Th assumption of a constant failur rat is bas d on th
bathtub curv . Th r for it is obvious that th PFDavg
calculation is only valid for compon nts that hav this
constant domain and that th validity of th calculation is
limit d to th us ful lif tim of ach compon nt.
Th xp ct d us ful lif of E3 MODULEVEL Mod l
E3X-XXXX-SXX is at l ast 50 y ars.
It is th r sponsibility of th nd us r to maintain and
op rat th Mod l E3X-XXXX-SXX p r manufactur r’s
instructions. Furth rmor , r gular insp ction should indi-
cat that all compon nts ar cl an and fr from damag .
Wh n plant xp ri nc indicat s a short r lif tim than
indicat d by th FMEDA r port, th numb r bas d on
plant xp ri nc should b us d.
Product E3 MODU EVE
Model E3X-XXXX-SXX
SIL SI 2
HFT 0
SFF 90.6%
PFDavg Refer to FMEDA report

BULLETIN: 48-651.0
EFFECTIVE: September 2016
705 Enterprise Street • Aurora, Illinois 60504-8149 • 630-969-4000 • Fax [phone]
[email protected] • www.magnetrol.com
Copyright © 2016 Magnetrol International, Incorporated. All rights reserved. Printed in the USA.
ASSURED QUALITY & SERVICE COST LESS
Disclaimer
Th SIL valu s in this docum nt ar bas d on an FMEDA analysis using xida’s SILVER Tool. MAGNETROL
acc pts no liability whatso v r for th us of th s numb rs or for th corr ctn ss of th standards on which th
g n ral calculation m thods ar bas d.
Magnetrol, Magnetrol logotype and Eclipse are registered trademarks of Magnetrol International, Incorporated.
HART is a registered trademark of the HART Communication Foundation.
PACTware is trademark of PACTware Consortium.
References
• IEC 61508 Edition 2.0,2010
“Functional Saf ty of El ctrical/El ctronic/
Programmabl El ctronic Saf ty R lat d Syst ms”
• ANSI/ISA-84.00.01-2004 Part 1 (IEC 61511-1Mod)
“Functional Saf ty: Saf ty Instrum nt d Syst ms for
th Proc ss Industry S ctor – Part 1 Hardwar and
Softwar R quir m nts”
• ANSI/ISA-84.00.01-2004 Part 2 (IEC 61511-2Mod)
“Functional Saf ty: Saf ty Instrum nt d Syst ms for
th Proc ss Industry S ctor – Part 2 Guid lin s for
th Application of ANSI/ISA84.00.01-2004 Part 1
(IEC 61511-1 Mod) – Informativ ”
• ANSI/ISA-84.00.01-2004 Part 3 (IEC 61511-3Mod)
“Functional Saf ty: Saf ty Instrum nt d Syst ms for
th Proc ss Industry S ctor – Part 3 Guidanc for th
D t rmination of th R quir d Saf ty Int grity L v ls
– Informativ ”
• ANSI/ISA-TR84.00.04 Part 1 (IEC 61511 Mod)
“Guid lin on th Impl m ntation of ANSI/ISA-
84.00.01-2004”
Service Policy
Own rs of MAGNETROL controls may r qu st th
r turn of a control or any part of a control for compl t
r building or r plac m nt. Th y will b r built or r plac d
promptly. Controls r turn d und r our s rvic policy must
b r turn d by pr paid transportation. MAGNETROL
will r pair or r plac th control at no cost to th pur-
chas r (or own r) oth r than transportation if:
1. R turn d within th warranty p riod; and
2. Th factory insp ction finds th caus of th claim to
b cov r d und r th warranty.
If th troubl is th r sult of conditions b yond our con-
trol; or, is NOT cov r d by th warranty, th r will b
charg s for labor and th parts r quir d to r build or
r plac th quipm nt.
In som cas s it may b xp di nt to ship r plac m nt
parts; or, in xtr m cas s a compl t n w control, to
r plac th original quipm nt b for it is r turn d. If
this is d sir d, notify th factory of both th mod l and
s rial numb rs of th control to b r plac d. In such
cas s, cr dit for th mat rials r turn d will b d t rmin d
on th basis of th applicability of our warranty.
No claims for misapplication, labor, dir ct or cons qu n-
tial damag will b allow d.
Return Material Procedure
So that w may ffici ntly proc ss any mat rials that ar
r turn d, it is ss ntial that a “R turn Mat rial
Authorization” (RMA) numb r b obtain d from th
factory prior to th mat rial’s r turn. This is availabl
through a MAGNETROL local r pr s ntativ or by con-
tacting th factory. Pl as supply th following information:
1. Company Nam
2. D scription of Mat rial
3. S rial Numb r
4. R ason for R turn
5. Application
Any unit that was us d in a proc ss must b prop rly
cl an d in accordanc with OSHA standards, b for it is
r turn d to th factory.
A Mat rial Saf ty Data Sh t (MSDS) must accompany
mat rial that was us d in any m dia.
All shipm nts r turn d to th factory must b by pr paid
transportation.
All r plac m nts will b shipp d F.O.B. factory.