Magnetrol E3 Modulevel series User guide

SIL Certified Safety Manual
for E3 Modulevel®
Model E3X-XXXX-SXX
Liquid Level
Displacer Transmitter
This manual complements and is intended to be used with the
Magnetrol®E3 Mod ulevel®Liquid Level Displacer Transmitter
Installation and Operating manual (Bulletin 48- 35).
Safety Function
Th HART®v rsion of th E3 Modul v l®transmitt r will
m asur l v l and transmit a signal proportional to that l v l
within th stat d saf ty accuracy of ±2% of span (or th
m asur d rror publish d in I/O Manual 48-635, which v r
is gr at r). In addition, wh n continuous, automatic diagnos-
tics d t ct that th transmitt r cannot p rform this function,
th output will b driv n to th custom r-sp cifi d out-of-
rang signal (i. ., 3.6 mA or 21 mA).
Th E3 MODULEVEL is c rtifi d for us in low d mand
l v l m asur m nt applications.
Application
Th HART®v rsion of th E3 MODULEVEL l v l trans-
mitt r can b appli d in most proc ss or storag v ss ls, bri-
dl s, and bypass chamb rs up to th transmitt r’s rat d t m-
p ratur and pr ssur . Th E3 MODULEVEL can b us d
in liquids, cl an or dirty, light hydrocarbons to h avy acids
(SG=0.23 to 2.20) to m t th saf ty syst m r quir m nts of
IEC 61508 (Edition 2.0, 2010).
Benefits
• L v l prot ction to SIL 3 as c rtifi d by xida C rtification
p r IEC 61508.
• L v l rang s from 14 to 120+ inch s
(356 to 3048+ mm).
• Proc ss t mp ratur s to +850 °F (+454 °C) for non-st am
applications, +800 °F (+427 °C) for st am applications
• Proc ss pr ssur s to 5150 psi (355 bar).
• Continuous s lf-t st with 22 mA or 3.6 mA fault indica-
tion fully compliant with NAMUR NE 43.
• IS, XP, and Non-Inc ndiv approvals.
• Emission and immunity complianc to EN 61326.
• Two-wir , loop-pow r d transmitt r for l v l,
int rfac , or d nsity m asur m nt.

48-651 SI Certified Safety Manual for E3 Modulevel®
Table of Contents
E3 Modulevel®Displacer Level Transmitter
SIL Manual for E3 Modulevel® E3X-XXXX-SXX
1.0 Introduction ...................................................................3
1.1 Product D scription..................................................3
1.2 Th ory of Op ration.................................................3
1.3 D t rmining Saf ty Int grity L v l (SIL) ..................4
2.0 Applicable Models..........................................................4
3.0 Level Measurin System .................................................4
3.1 Misc llan ous El ctrical Consid rations ....................5
3.1.1 Pollution D gr 2 .........................................5
3.1.2 Ov rvoltag ....................................................5
3.1.3 El ctromagn tic Compatibility.......................5
4.0 Mean Time To Repair (MTTR).....................................5
5.0 Supplementary Documentation......................................6
6.0 General Instructions.......................................................6
6.1 Syst matic Limitations ..............................................6
6.1.1 Application.....................................................6
6.1.2 Environm ntal................................................6
6.1.2.1 Op rating ........................................6
6.1.2.2 Storag .............................................6
6.2 Installation ................................................................7
6.3 Skill L v l of P rsonn l .............................................7
6.4 N c ssary Tools .........................................................7
6.5 Configuration Information .......................................7
6.5.1 G n ral...........................................................7
6.5.2 Configuration.................................................7
6.5.3 Writ Prot cting/Locking ..............................8
6.6 Sit Acc ptanc T sting .............................................8
6.7 R cording R sults......................................................8
6.8 Maint nanc .............................................................8
6.8.1 Diagnostics and R spons Tim s....................8
6.8.2 Troubl shooting .............................................9
7.0 Recurrent Function Tests ...............................................9
7.1 Proof T sting.............................................................9
7.1.1 Introduction...................................................9
7.1.2 Int rval...........................................................9
7.1.3 R cording R sults...........................................9
7.1.4 Sugg st d Proof T st.....................................10
7.1.5 Proof T st Cov rag ......................................10
8.0 Safety Requirements.....................................................11
8.1 Syst m Saf ty Assumptions .....................................11
8.2 Saf ty Function R quir m nts.................................12
8.3 Saf ty Us r Programming and Configuration
R quir m nts ..........................................................12
9.0 Appendices ...................................................................13
9.1 SIL C rtificat .........................................................13
9.2 FMEDA R port: xida Manag m nt Summary ......14
9.3 Sp cific E3 MODULEVEL Valu s..........................15
9.4 R port: Lif tim of Critical Compon nts................15

3
48-651 SI Certified Safety Manual for E3 Modulevel®
1.0 Introduction
1.1 Product Description
Th E3 MODULEVEL is a loop-pow r d, two-wir ,
24 VDC l v l transmitt r that us s simpl buoyancy princi-
pl s in combination with a pr cision rang spring and a
highly accurat LVDT (lin ar variabl diff r ntial trans-
form r) to d t ct and conv rt liquid l v l chang s into a
stabl 4–20 mA output signal.
NOTE: For Safety Instrumented Systems usage, it is assumed that the
4–20 mA output is used as the safety variable.
Th analog output from th E3 MODULEVEL m ts th
NAMUR NE 43 standard (3.8 mA to 20.5 mA usabl ). Th
transmitt r contains s lf-diagnostics and is programm d to
driv th output to a us r-s l ct d failur stat , ith r low or
high, upon int rnal d t ction of a diagnostic indicator. Th
d vic can b quipp d with or without an optional non-
int rf ring graphic liquid crystal display (LCD).
Tabl 1 indicat s th v rsion of th E3 MODULEVEL
transmitt r that has b n c rtifi d for SIL 2/3 applications.
1.2 Theory of Operation
Th E3 MODULEVEL Displac r L v l Transmitt r r li s
on th principl s of buoyancy to conv rt m chanical mov -
m nt to an l ctronic output.
Th mov m nt of th rang spring, as it compr ss s or lon-
gat s bas d on th volum of displac r subm rg d in th
liquid, caus s mov m nt of a sp cial LVDT cor attach d to
th spring. Th LVDT t chnology conv rts th mov m nt
of th LVDT cor within th LVDT to a stabl 4–20 mA
output signal. Th position of th cor , with r sp ct to a
primary and two s condary windings, induc s voltag in
ach winding. Th comparison of th induc d voltag s
within th microproc ssor of th E3 MODULEVEL r sults
in v ry accurat l v l or int rfac l v l output.
Th E3 MODULEVEL can, alt rnativ ly, b s t up to track
th changing d nsity of a liquid ov r a known d nsity rang
and conv rt that into a stabl 4–20 mA output signal. As th
d nsity of th liquid chang s, so do s th mass of th liquid
displac d by th displac r. This r sulting chang in buoyancy
forc on th displac r caus s mov m nt of th LVDT cor
n d d to conv rt th d nsity chang to th 4–20 mA signal.
1 Transmitters:
Model E3 MODULEVEL,
E3X-XXXX-SXX (HART)
Hardware Version (or later)
Analog Board 030-2475-001 + -003 Rev E
Digital Board 030-9145-001 Rev AG
Wiring Board 030-9151-001 Rev Q
Software Version (or later)
Model E3 HT 1.1cA.mot
Table 1
Enhanced E3 MODULEVEL
Model Numbers

448-651 SI Certified Safety Manual for E3 Modulevel®
1.3 Determining Safety Integrity Level (SIL)
Saf ty Instrum nt d Syst m d sign rs using th
E3 MODULEVEL must v rify th ir d sign p r applicabl
standards.
Thr limits must b m t to achi v a giv n SIL l v l:
1. Th PFDAVG numb rs for th ntir Saf ty Instrum nt d
Function (SIF) must b calculat d. Tabl 2 shows th r la-
tionship b tw n th Saf ty Int grity L v l (SIL) and th
Probability of Failur on D mand Av rag (PFDAVG).
2. Archit ctur constraints must b m t for ach subsyst m.
Tabl 3 can b us d to d t rmin th achi vabl SIL as a
function of th Hardwar Fault Tol ranc (HFT) and th
Saf Failur Fraction (SFF) for ach subsyst m in a saf ty
syst m (Typ B–compl x compon nts as p r IEC 61508
Part 2) of which th l v l transmitt r is just on compon nt.
3. All products chos n for us in th SIF must m t th
r quir m nts of IEC 61508 for th giv n SIL Capability
l v l or b justifi d bas d on prov n in us data coll ct d for
ach job.
Th xSIL ntia tool from xida is r comm nd d for d sign
v rification. This automatically ch cks all thr limits and
displays th r sults for any giv n d sign. Th E3 MOD-
ULEVEL is in th xSIL ntia databas . This tool contains
all n d d failur rat , failur mod , SIL Capability and
common caus data as w ll as sugg st d proof t st m thods.
2.0 Applicable Models
This manual is only applicabl to th HART v rsions of
th E3 MODULEVEL transmitt r shown in Tabl 1.
3.0 Level Measuring System
Th diagram at l ft shows th structur of a typical m asuring
syst m incorporating th E3 MODULEVEL transmitt r.
This SIL 2/3 C rtifi d d vic is only availabl with an ana-
log signal (4–20 mA) with HART communications; and,
th m asur m nt signal us d by th logic solv r can b th
analog 4–20 mA signal proportional to th L v l, Int rfac
L v l or D nsity.
• For fault monitoring, th logic unit must r cogniz both
high alarms (≥ 21.5 mA) and low alarms (≤ 3.6 mA).
• If th logic solv r loop us s intrinsic saf ty barri rs, caution
must b tak n to nsur th loop continu s to op rat
prop rly und r th low alarm condition.
Figure 1
Typical System
Table 3
Minimum hardware fault tolerance
Type B sensors, final elements and non-PE logic solvers
SFF
Hardware Fault
Tolerance (HFT)
012
None: <60% Not
Allowed SI 1 SI 2
ow: 60% to <90% SI 1 SI 2 SI 3
Medium: 90% to <99% SI 2 SI 3
High: ≥99% SI 3
Table 2
SIL vs. PFDavg
Safety
Integrity Level
(SIL)
Target Average
probability of failure
on demand (PFDavg)
4≥10-5 to <10-4
3≥10-4 to <10-3
2≥10-3 to <10-2
1≥10-2 to <10-1

5
48-651 SI Certified Safety Manual for E3 Modulevel®
.• Th only unsaf mod is wh n th unit is r ading an
incorr ct l v l within th 4–20 mA rang (> ±2% d viation).
• MAGNETROL d fin s th fault d mod as on in which
th 4–20 mA curr nt is driv n out of rang (i. ., l ss than
3.8 mA or gr at r than 21.5 mA).
• Th 4–20 mA output signal can b configur d for ov r-
rang p r NAMUR NE43.
3.1 Miscellaneous Electrical Considerations
Following ar misc llan ous l ctrical issu s to b consid r d
in a saf ty syst m.
3.1.1 Pollution Degree 2
Th E3 MODULEVEL transmitt r is d sign d for us
in a Cat gory II, Pollution D gr 2 installation, which is
d fin d by a nonconductiv pollution of th sort wh r
occasionally a t mporary conductivity caus d by cond nsation
must b xp ct d.
This is th usual pollution d gr us d for quipm nt b ing
valuat d to IEC/EN 61010.
3.1.2 Overvoltage
Th E3 MODULEVEL has ov rvoltag prot ction p r CE
r quir m nts; this prot ction is to 1000 volts wh n consid-
ring Hi-pot, Fast Transi nts, and Surg . Th r for , th r
should b no unsaf failur mod s up to 1 KV.
Ov rvoltag Cat gory II is a local l v l, cov ring applianc s,
portabl quipm nt, tc., with small r transi nt ov rvoltag s
than thos charact ristic of Ov rvoltag Cat gory III. This
cat gory appli s from th wall plug to th pow r supply iso-
lation barri r (transform r). Th typical plant nvironm nt
is Ov rvoltag Cat gory II, so most quipm nt valuat d to
th r quir m nts of IEC/EN 61010 ar consid r d to
b long in that classification.
3.1.3 Electromagnetic Compatibility
Th E3 MODULEVEl is d sign d to m t th r quir -
m nts of EN 61326 and NAMUR NE21.
4.0 Mean Time To Repair (MTTR)
SIL d t rminations ar bas d on a numb r of factors including
th M an Tim To R pair (MTTR). Th analysis for th E3
MODULEVEL is bas d on a MTTR of 24 hours.

648-651 SI Certified Safety Manual for E3 Modulevel®
5.0 Supplementary Documentation
Th E3 MODULEVEL Installation and Op rating Manual
(Bull tin 48-635) must b availabl for installation of th
m asuring syst m.
Th following El ctronic D vic D scription Fil is r quir d
if HART is us d:
Manufacturer Code 0x56
Model E3 MODULEVEL Device ID OxE3, device revision 2
DD revision 1
For d vic installations in a classifi d ar a, th r l vant
saf ty instructions and l ctrical cod s must b follow d.
6.0 General Instructions
6.1 Systematic Limitations
Th following instructions must b obs rv d to avoid
syst matic failur s:
6.1.1 Application
Th E3 MODULEVEL transmitt r should b locat d for asy
acc ss for s rvic , configuration, and monitoring. Th r should
b suffici nt h adroom to allow installation and r moval of th
transmitt r h ad, and, in cas s of tank top configuration, th
displac r. Sp cial pr cautions should b mad to pr v nt xpo-
sur to corrosiv atmosph r , xc ssiv vibration, shock, or
physical damag . Th E3 MODULEVEL should only b us d
for applications in which buildup of solid mat rials on th
spring or in th nclosing tub is not an issu .
Caution: Operation of all buoyancy type level devices should be
done in such a way as to minimize the action of dynamic
forces on the float or displacer sensing element. Good
practice for reducing the likelihood of damage to the con-
trol is to equalize pressure across the device very slowly.
6.1.2 Environmental
R f r to th E3 MODULEVEL Installation and Op rating
Manual (Bull tin 48-635) for Environm ntal limitations.
6.1.2.1 Operating
Th op rating t mp ratur rang is -40 to +175 °F (-40 to
+80 °C).
6.1.2.2 Storage
Th d vic should b stor d in its original shipping box
and not b subj ct d to t mp ratur s outsid th storag
t mp ratur rang of -50 to +185 °F (-46 to +85 °C).

7
48-651 SI Certified Safety Manual for E3 Modulevel®
6.2 Installation
R f r to th E3 MODULEVEL Installation and Op rating
Manual 48-635 manual for compl t installation instruc-
tions.
• Contains information on th us , changing and r s tting of
th password-prot ction function.
• Provid s m nu s l ction it ms for configuration of th
transmitt r as a l v l s nsing d vic .
• Off rs configuration r comm ndations.
• Input voltag and loop r sistanc must b within th saf
op rating ar a of th d vic .
6.3 Skill Level of Personnel
P rsonn l following th proc dur s of this saf ty manual
should hav t chnical xp rtis qual to or gr at r than that
of a qualifi d Instrum nt T chnician.
6.4 Necessary Tools
No sp cial quipm nt or tools ar r quir d to install
E3 MODULEVEL. Th following it ms ar r comm nd d:
• Wrenches, flan e askets, and flan e boltin
appropriate for process connection(s)
• Flat-blade screwdriver
• Level
• 1⁄8" Allen wrench
• 24 VDC power supply, 23 mA minimum
• Di ital multimeter
• 250 to 450 ohm resistor for HART communication
6.5 Configuration Information
6.5.1 General
Th E3 MODULEVEL can b configur d via th local dis-
play, th HART compatibl handh ld communicator, or a
PC using PACTware and associat d DTM.
6.5.2 Configuration
Ensur th E3 MODULEVEL transmitt r has b n prop r-
ly configur d for th application. Sp cial consid ration
should b giv n to th following configuration param t rs:
User Password: Must b chang d to a sp cific valu oth r
than Z ro.
Failure Alarm: DO NOT choos HOLD for this param t r
as a Fault will not b annunciat d on th curr nt loop.

Analog Output Mode: Ensur this is s t to Enabl d.
Interface Management: Ensur th displac r is compl t ly
imm rs d in liquid.
6.5.3 Write Protecting / Locking
Th E3 MODULEVEL transmitt r is password prot ct d
with a num rical valu b tw n 0 and 255. Aft r th pass-
word has b n succ ssfully nt r d, an xclamation mark (!)
app ars as th last charact r on th first lin of th display.
R f r to th E3 MODULEVEL Installation and Op rating
Manual (Bull tin 48-635) for information on password pro-
t ction.
NOTE: Default Password = 0 = Password disabled.
For an SIS syst m, it is r quir d that, aft r configuration of
th syst m is compl t , a password is utiliz d to pr v nt
inadv rt nt chang s to th d vic .
6.6 Site Acceptance Testing
To nsur prop r op ration aft r installation and configura-
tion, a sit acc ptanc t st should b compl t d. This
proc dur is id ntical to th Proof T st Proc dur d scrib d
in S ction 7.1.4.
6.7 Recording Results
R sults of Sit Acc ptanc T sting must b r cord d for
futur r f r nc .
6.8 Maintenance
Th only maint nanc r quir d is th proof t st.
• R port all failur s to Magn trol®.
• Firmwar can b upgrad d only by factory p rsonn l.
6.8.1 Diagnostics and Response Times
Continuous int rnal diagnostics ar pr s nt within th E3
MODULEVEL transmitt r. In th v nt a Fault is d t ct d,
a m ssag will app ar on th LCD and th output curr nt
will b driv n to 3.6 mA or 22mA d p nding on how th
FAULT param t r is configur d.
A) Start-up Tim :
a. From application of pow r to normal op rat-
ing mod : 5 s conds
b. From application of pow r to Fault mod :
8 s conds or l ss (Assuming a Fault is pr s nt
upon start-up)
848-651 SI Certified Safety Manual for E3 Modulevel®

9
48-651 SI Certified Safety Manual for E3 Modulevel®
B) Diagnostic T st Int rval: 3 s conds
a. This is d fin d as th tim from th normal
op rating mod to th Fault mod upon th
occurr nc of a fault.
C) Saf ty Function R spons Tim :
3 s conds (with Damping=0)
6.8.2 Troubleshooting
R port all failur s to th MAGNETROL T chnical Support
D partm nt.
R f r to th E3 MODULEVEL Installation and Op rating
Manual Bull tin 48-635 for troubl shooting d vic rrors.
To assist in finding rrors should th y occur, at start-up
compl t th Configuration Data Sh t found at th back
of this manual, mak a list of all d vic configuration
param t rs, including th password, and r tain this informa-
tion in a saf plac .
• Firmwar can b upgrad d only by factory p rsonn l.
7.0 Recurrent Function Tests
7.1 Proof Testing
7.1.1 Introduction
Following is th proc dur utiliz d to d t ct Dang rous
Und t ct d (DU) failur s.
7.1.2 Interval
To maintain th appropriat Saf ty Int grity L v l of a
Saf ty Instrum nt d Syst m, it is imp rativ that th ntir
syst m b t st d at r gular tim int rvals (shown as TI in th
appropriat standards). Th suitabl SIL for th E3
MODULEVEL transmitt r is bas d on th assumption that
th nd us r will carry out this t st and insp ction at l ast
onc p r y ar.
NOTE: It is the responsibility of the owner/operator to select the type
of inspection and the time period for these tests.
7.1.3 Recording Results
R sults of th Proof T st should b r cord d for futur
r f r nc .

10 48-651 SI Certified Safety Manual for E3 Modulevel®
Step Action
1Bypass the safety function and take appropriate action to avoid a false trip.
2 Use HART communications to retrieve any diagnostics and take appropriate action.
3Send a HART command to the transmitter to go to the high alarm current output and verify that the
analog current reaches that value. ➀
4Send a HART command to the transmitter to go to the low alarm current output and verify that the
analog current reaches that value. ➁
5Inspect the transmitter for any leaks, visible damage or contamination.
6Perform a two-point calibration ➂of the transmitter over the full working range.
7Remove the bypass and otherwise restore normal operation.
Device λDUPT
(FIT)
Proof Test
Coverage
E3, Single Solenoid, DTT 14 76%
E3, Single Solenoid, ETT 14 77%
7.1.4 Suggested Proof Test
Th sugg st d proof t st for th E3 is d scrib d in th fol-
lowing tabl . Th nd us r must us calibrat d quipm nt
to m asur th output in st ps 3, 4, and 6.
7.1.5 Proof Test Coverage
Th Proof T st Cov rag for th various product configura-
tions is giv n in th following tabl .
➀ This tests for compliance voltage problems such as a low loop power supply voltage or increased wiring resistance. This also
tests for other possible failures.
➁ This tests for possible quiescent current related failures.
➂ If the two-point calibration is performed with electrical instrumentation, this proof test will not detect any failures of the sensor.
Table 8 Proof Test Coverage – E3