Magnetrol Pulsar R96 Instructions for use

Pulse Burst Radar
Level Transmitter
SIL Safety Manual for
Pulsar Model R96
Software v1.x
This manual complements and is intended to be used with
the Pulsar®Model R9 Installation and Operating manual
(Bulletin 58- 02 dated January 2015 or later).
Applic tion
The PULSAR Model R96 (HART®) Pulse Burst level
transmitter can be applied in most metal and concrete
process or storage vessels. The PULSAR Model R96 can
be used in liquids or slurries to meet the safety system
requirements of IEC 61508/IEC 61511-1.
Benefits
The Magnetrol®Model R96 (HART) transmitter pro-
vides the following benefits to your operation:
• Protection up to SIL2 (Safe Failure Fraction = 92.7%)
as independently assessed (hardware assessment) by
exida as per IEC 61508/ IEC 61511-1.
• Antenna designs to +400 °F (+200 °C)
750 psig (51.7 bar)
• IS XP and Non-Incendive approvals
• Quick connect / disconnect antenna coupling
• Performance not process dependent (changing specific
gravity and dielectric have no effect).
Functional Safety Manual

58-650 ulsar®Model R96 SIL Functional Safety Manual
T ble of Contents
1.0 I troductio ...................................................................3
1.1 Product Description..................................................3
1.2 Theory of Operation.................................................3
1.3 Determining Safety Integrity Level............................3
2.0 Level Measuri g System .................................................4
2.0.1 FOUNDATION fieldbus™..................................4
2.1 Applicable Models.....................................................4
2.2 Miscellaneous Electrical Considerations ....................4
2.2.1 Pollution Degree 2 .........................................4
2.2.2 Overvoltage ....................................................5
3.0 Mea Time To Repair (MTTR).....................................5
4.0 Suppleme tary Docume tatio ......................................5
5.0 I structio s ....................................................................5
5.1 Systematic Limitations ..............................................5
5.1.1 Application.....................................................5
5.1.2 Environmental................................................6
5.2 Skill Level of Personnel .............................................6
5.3 Necessary Tools .........................................................6
5.4 Storage ......................................................................6
5.5 Installation ................................................................6
5.6 Configuration ...........................................................7
5.6.1 General...........................................................7
5.6.2 Configuration.................................................7
5.6.3 Write Protecting / Locking.............................7
5.6.4 Write Enabling / Unlocking ...........................8
5.7 Site Acceptance Testing .............................................8
5.8 Recording results.......................................................8
5.9 Maintenance ..............................................................8
5.9.1 Diagnostics.....................................................8
5.9.2 Troubleshooting .............................................8
6.0 Recurre t Fu ctio Tests ...............................................9
6.1 Proof Testing.............................................................9
6.1.1 Introduction...................................................9
6.1.2 Interval...........................................................9
6.1.3 Recording Results...........................................9
6.1.4 Proof Test Procedure.....................................10
7.0 Appe dices ................................................................... 11
7.1 SIL Declaration of Conformance ............................11
7.2 FMEDA Report- Management Summary ..............12
7.3 Specific Model R96 values ......................................14
7.4 PFD graph ..............................................................15
7.5 Report- Lifetime of Critical components.................15
Pulsar®Model R96 Pulse Burst Radar Level Tra smitter
SIL 2 Capable

3
58-650 ulsar®Model R96 SIL Functional Safety Manual
1.0 Introduction
1.1 Product Description
The Pulsar®Model R96 Pulse Burst Radar Level
Transmitter is a loop-powered 24 VDC level transmitter
based on Pulse Burst Radar technology. For Safety
Instrumented Systems usage it is assumed that the 4–20 mA
output is used as the primary safety variable. The analog
output meets NAMUR NE 43 (3.8 mA to 20.5 mA
usable). The transmitter contains self-diagnostics and is pro-
grammed to send its output to a user-selected failure state
either low or high upon internal detection of a failure. The
device can be equipped with or without an LCD display.
Table 1 lists the versions of the PULSAR Model R96 that
have been considered for the hardware assessment.
1.2 Theory of Oper tion
PULSAR Model R96 is a top-mounted downward-looking
pulse burst radar operating at 6 GHz. Unlike true pulse
devices that transmit a single sharp (fast rise-time) waveform
of wide-band energy PULSAR Model R96 emits short bursts
of 6 GHz energy and measures the transit time of the signal
reflected off the liquid surface. Distance is calculated utiliz-
ing the equation: Distance = C ×Transit time/2 then devel-
oping the Level value by factoring in application-specific
configuration.
The PULSAR Model R96 is classified as a Type B device
according to IEC 61508.
1.3 Determining S fety Integrity Level (SIL)
Tables 2 & 3 define the criteria for the achievable SIL
against the target mode of operation in Demand Mode
Operation.
Table 2 shows the relationship between the Safety Integrity
Level (SIL) and the Probability of Failure on Demand
Average (PFDavg).
Table 3 can be used to determine the achievable SIL as a
function of the Hardware Fault Tolerance (HFT) and the
Safe Failure Fraction (SFF) for the complete safety system
(type B – complex components as per IEC 61508 Part 2) of
which the level transmitter is one component.
Model R96, R96-511*-*** (HART)
Table 3
Minimum hardware fault tolerance
Type B sensors, final elements and non-PE logic solvers
SFF
Hardware Fault
Tolerance (HFT)
012
None: <60% Not
Allowed SIL 1 SIL 2
Low: 60% to <90% SIL 1 SIL 2 SIL 3
Medium: 90% to <99% SIL 2 SIL 3
High: ≥99% SIL 3
Table 2
SIL vs. PFDavg
Table 1
Pulsar®Model umber
Safety
Integrity Level
(SIL)
Target Average
probability of failure
on demand (PFDavg)
4≥10-5 to <10-4
3≥10-4 to <10-3
2≥10-3 to <10-2
1≥10-2 to <10-1

458-650 ulsar®Model R96 SIL Functional Safety Manual
2.0 Level Me suring System
The diagram shows the structure of a typical measuring
system incorporating the MAGNETROL PULSAR Model
R96 Pulse Burst radar transmitter.
This SIL rated device is only available with an analog signal
(4–20 mA) with HART communications. The measure-
ment signal used by the logic solver must be the analog 4–
20 mA signal proportional to the level generated.
For fault monitoring the logic unit must recognize both
high alarms (≥21.5 mA) and low alarms (≤3.6 mA). If the
logic solver loop uses intrinsic safety barriers caution must
be taken to ensure the loop continues to operate properly
under the low alarm condition.
The only unsafe mode is when the unit is reading an incor-
rect level within the 4-20mA range (> ±2% deviation).
MAGNETROL defines a safe failure as one in which the
4-20 mA current is driven out of range (i.e. less than 3.8
mA or greater than 20.5 mA).
2.0.1 FOU DATIO fieldbus™
Although the PULSAR Model R96 is available with
FOUNDATION fieldbus™output it does not presently meet
the FF-SIS standard.
2.1 Applic ble Models
This manual is only applicable to the following PULSAR
Pulse Burst Radar Transmitter:
R96-511x-xxx (SIL 2 HFT 0)
2.2 Miscell neous Electric l Consider tions
Following are miscellaneous electrical issues to be considered.
2.2.1 Pollution Degree 2
The PULSAR system is designed for use in Category II
Pollution Degree 2 installations.
A nonconductive pollution of the sort where occasionally a
temporary conductivity caused by condensation must be
expected. This is the usual pollution degree used for equip-
ment being evaluated to IEC/EN 61010.
Actuator
PACTware
HART Modem
Pulsar®Model R96
Logic
Unit
Figure 1
Typical System

5
58-650 ulsar®Model R96 SIL Functional Safety Manual
2.2.2 Overvoltage
The MAGNETROL Model R96 has over-voltage protec-
tion per CE requirements. When considering Hi-pot Fast
Transients and Surge this protection is to 1000 volts.
Therefore there should be no unsafe failure modes up to 1 KV.
Overvoltage Category II is a local level covering appliances
portable equipment etc. with smaller transient overvoltages
than those characteristic of Overvoltage Category III. This
category applies from the wall plug to the power-supply iso-
lation barrier (transformer). The typical plant environment
is Overvoltage Category II so most equipment evaluated to
the requirements of IEC/EN 61010 are considered to
belong in that classification.
3.0 Me n Time To Rep ir (MTTR)
SIL determinations are based on a number of factors includ-
ing the Mean Time To Repair (MTTR). The analysis for the
PULSAR Model R96 is based on a MTTR of 24 hours.
4.0 Supplement ry Document tion
The PULSAR Model R96 Installation and Operating
Manual Bulletin 58-602 must be available for installation of
the measuring system.
One of the following Electronic Device Description Files is
also required if HART is used:
Manufacturer Code 0x56
Model R96 1.x Device ID 0x56DE device revision 1
DD revision 1.
For device installations in a classified area the relevant safety
instructions and electrical codes must be followed.
5.0 Instructions
5.1 System tic Limit tions
The following must be observed to avoid systematic failures.
5.1.1 Application
Choosing the proper Pulse Burst Radar antenna is the most
important decision in the application process. The antenna
configuration establishes fundamental performance charac-
teristics. Horn and dielectric rod are the two basic configura-
tions. The antenna for use with the PULSAR Model R96
should be selected as appropriate for the application.

See Section 2.3. of Installation and Operating Manual
58-602 for more detailed application information and
limitations.
5.1.2 Environmental
See Section 3.6 of Installation and Operating Manual
58-602 for environmental limitations.
5.2 Skill Level of Personnel
Personnel following the procedures of this safety manual
should have technical expertise equal to or greater than that
of a qualified Instrument Technician.
5.3 Necess ry Tools
Following are the necessary tools needed to carry out the
prescribed procedures:
• Open-wrenches or adjustable wrench to fit the process con-
nection size and type.
•Antenna 2" (50 mm)
•Transmitter 11⁄2" (38 mm)
•Torque wrench is highly desirable
• Flat-blade screwdriver
• Digital multimeter
• 24 VDC power supply 23 mA minimum
5.4 Stor ge
The device should be stored in its original shipping box
and not be subjected to temperatures outside the storage
temperature (-50 °C to +80 °C) shown in the PULSAR
Model R96 Installation and Operating Manual and associ-
ated specifications.
5.5 Inst ll tion
Refer to the PULSAR Model R96 Installation and
Operating Manual Bulletin 58-602 for the proper installa-
tion instructions.
658-650 ulsar®Model R96 SIL Functional Safety Manual

Section 2.6 of I/O Manual 58-602 contains information on
the use changing and resetting of the password protection
function.
Section 2.6 of I/O Manual 58-602 provides menu
selection items for configuration of the transmitter as a
level sensing device. This section also contains
Configuration recommendations.
This SIL evaluation has assumed that the customer will be
able to acknowledge an over or under current condition via
the Logic Solver.
5.6 Configur tion
5.6.1 General
The MAGNETROL PULSAR Model R96 can be config-
ured via the local display or via HART compatible hand-
held terminal or personal computer.
5.6.2 Configuration
Ensure the parameters have been properly configured for
the application.
Special consideration should be given to the following con-
figuration parameters:
DIELECTRIC RANGE: Enter the Dielectric Range for the
material to be measured.
Below 1.7 (Light Hydrocarbons like ropane and Butane) —
(stillwell only)
1.7 to 3.0 (Most typical hydrocarbons)
Above 10 (Water-based media)
PV ALARM SELECTION: Do NOT choose HOLD for
this parameter as a Fault will not be annunciated on the
current loop.
LOOP CURRENT MODE: ensure this is set to ENABLED.
PASSWORD: should be changed to a specific value other
than Zero. See Section 5.6.3
5.6.3 Write Protecting / Locking
The PULSAR Model R96 is password protected with a
numerical password between 0 (Default=0=Password dis-
abled) and 59999.
Refer to section 2.6 of the PULSAR Model R96 Installation
and Operating Manual Bulletin 58-602 for information on
password protection.
7
58-650 ulsar®Model R96 SIL Functional Safety Manual

5.6.4 Write Enabling / Unlocking
Refer to section 2.6 of the PULSAR Model R96 Installation
and Operating Manual Bulletin 58-602 for information on
password protection.
When the alterations to the system are complete insure the
menu has been locked with the password to prevent inad-
vertent changes to the device.
5.7 Site Accept nce Testing
To ensure proper operation after installation and configura-
tion a site acceptance test should be completed. This proce-
dure is identical to the Proof Test Procedure described in
Section 6.1.4.
5.8 Recording Results
Results of Site Acceptance Testing must be recorded for
future reference.
5.9 M inten nce
5.9.1 Diagnostics
Internal diagnostic testing does a complete cycle approxi-
mately 4 times per second. A message will appear and the
Output current will be driven to 3.6 or 22 mA (customer
selectable) upon detection of a Diagnostic Failure.
5.9.2 Troubleshooting
Report all failures to MAGNETROL.
Refer to Section 3.3 of the PULSAR Model R96
Installation and Operating Manual Bulletin 58-602 for
troubleshooting device errors. To assist in finding errors
should they occur complete the Configuration Data Sheets
included at the end of the Operating Manual. Be sure to
include all device information including the password.
Retain this information in a safe place.
• As there are no moving parts in this device the only main-
tenance required is the proof test.
• Firmware can only be upgraded by factory personnel.
858-650 ulsar®Model R96 SIL Functional Safety Manual

6.0 Recurrent Function Tests
6.1 Proof Testing
6.1.1 Introduction
Following are the procedures utilized to detect
Dangerous Undetected (DU) failures. The procedure
will detect approximately 98.1% of possible DU failures
in the Model R96-511*-***.
6.1.2 Interval
To maintain the Safety Integrity Level of a Safety
Instrumented System it is imperative that the entire system
be tested at regular time intervals (referred to as TI in the
appropriate standards). The SIL for the Model R96 is based
on the assumption that the operator will carry out these
tests and inspection at least once (1x) per year. The onus is
on the owner/operator to select the type of inspection and
the time period for these tests.
The system check must be carried out to prove that the
functions meet the IEC specification and result in the
desired response of the safety system as a whole.
This system check can be guaranteed when the response
height is approached in the filling process; though if this is
not practical a suitable method of simulating the level of
the physical measurement must be used to make the level
sensor respond as if the fill fluid were above the alarm/set
point level. If the operability of the sensor/transmitter can
be determined by other means that exclude all fault condi-
tions that may impair the normal functions of the device
the check may also be completed by simulating the corre-
sponding output signal of the device.
6.1.3 Recording results
Results of the Proof Test should be recorded for future
reference.
9
58-650 ulsar®Model R96 SIL Functional Safety Manual

6.1.4 Proof Test Procedure
A suggested proof test is described below. This test will
detect approximately 85% of possible DU failures in
Model R96-511*-*** of the PULSAR Model R96 Pulse
Burst Radar Level Transmitter.
1. Bypass the safety PLC or take other appropriate action to
avoid a false trip.
2. Send a HART command to the transmitter to go to the
high alarm current output and verify that the analog current
reaches that value.
This tests for compliance voltage problems such as low
power supply voltage or increased loop wiring resistance.
This also tests for other possible failures in the current
loop circuitry.
3. Send a HART command to the transmitter to go to the low
alarm current output and verify that the analog current
reaches that value.
This tests for possible quiescent current related failures.
4. Reduce the level in the vessel. The Status parameter should
say “OK” and the level reading should be equal to the value
in the “Bottom Blocking Distance” parameter.
5. Perform a two-point calibration check of the transmitter by
applying level at two points and compare the transmitter
display reading and the current level value to a known refer-
ence measurement.
6. If the calibration is correct the proof test is complete.
Proceed to step 11.
7. If calibration is incorrect remove the transmitter and antenna
from the process. Inspect the antenna for buildup or clog-
ging. Clean the antenna if necessary.
Perform a bench verification by aiming the antenna at two
different distances from a target (such as a wall). First set
the device to measure Distance. Then compare the trans-
mitter display and loop current readings to the actual dis-
tances.
8. If the calibration is off by more than 2% call the factory for
assistance.
9. If the calibration is correct the proof test is complete.
Return the transmitter to level mode. Proceed to step 10.
10. Re-install the transmitter and antenna.
11. Restore the loop to full operation.
12. Remove the bypass from the safety PLC or otherwise restore
normal operation.
10 58-650 ulsar®Model R96 SIL Functional Safety Manual

11
58-650 ulsar®Model R96 SIL Functional Safety Manual
7.0 Appendices
7.1 SIL Decl r tion of Conformity
Functional safety according to IEC 61508/IEC 61511
Magnetrol International Incorporated 705 Enterprise
Street Aurora Illinois 60504 declares as the manufacturer
that the level transmitter:
Pulse Burst Radar (4-20 mA) Model R96-511x-xxx
is suitable for the use in safety instrumented systems accord-
ing to IEC 61511-1 if the safety instructions and following
parameters are observed:
(FIT = Failure in Time (1×10-9 failures per hour))
Product Model R96-511x-xxx
SIL 2
roof Test Interval 1 Year
Device Type B
SFF 92.7%
FDavg ➀8.47E-04
λSD 0 FIT
λSU 63 FIT
λDD 972 FIT
λDU 81 FIT
➀As determined in compliance with ANSI/ISA-84.01
clause 9.2.3 for 1oo1 system.

12 58-650 ulsar®Model R96 SIL Functional Safety Manual
7.2 FMEDA Report: Exid M n gement Summ ry

13
58-650 ulsar®Model R96 SIL Functional Safety Manual

14 58-650 ulsar®Model R96 SIL Functional Safety Manual
7.3 Specific Model R96 V lues
Proof Test Interval
(months)
PFD avg.
(SIL 2)
0 5.47E-04
6 6.97E-04
12 8.47E-04
18 9.98E-04
24 1.15E-03
30 1.30E-03
36 1.45E-03
42 1.60E-03
48 1.75E-03
54 1.90E-03
60 2.05E-03
66 2.20E-03
72 2.35E-03
78 2.50E-03
84 2.65E-03
90 2.80E-03
96 2.95E-03
102 3.10E-03
108 3.25E-03
114 3.40E-03
120 3.56E-03
roduct ULSAR
Model R96-511x-xxx
SIL SIL 2
HFT 0
SFF 92.7%
FDavg 8.47E-04
roof Test Interval Annually
(refer to table below for
other periods)
Specific Model R96

15
58-650 ulsar®Model R96 SIL Functional Safety Manual
7.5 Report: Lifetime of Critic l Components
Although a constant failure rate is assumed by the proba-
bilistic estimation method this only applies provided that
the useful lifetime of components is not exceeded. Beyond
their useful lifetime the result of the probabilistic calcula-
tion method is therefore meaningless as the probability of
failure significantly increases with time. The useful lifetime
is highly dependent on the component itself and its operat-
ing conditions—temperature in particular (e.g. electrolyte
capacitors can be very sensitive).
This assumption of a constant failure rate is based on the
bathtub curve which shows the typical behavior for elec-
tronic components.
Therefore it is obvious that the PFDAVG calculation is only
valid for components that have this constant domain and
that the validity of the calculation is limited to the useful
lifetime of each component.
The table below shows which components are contributing
to the dangerous undetected failure rate and therefore to the
PFDAVG calculation and what their estimated useful lifetime is.
As there are no aluminum electrolytic capacitors used the
tantalum electrolytic capacitors are the limiting factors with
regard to the useful lifetime of the system. The tantalum
electrolytic capacitors that are used in the PULSAR Model
R96 have an estimated useful lifetime of about 50 years.
According to section 7.4.7.4 of IEC 61508-2 a useful life-
time based on experience should be assumed. According to
section 7.4.7.4 note 3 of IEC 61508 experiences have
shown that the useful lifetime often lies within a range of 8
to 12 years for transmitters.
Useful lifetime of electrolytic capacitors contributing to λDU
Type Useful life at +40 °C
Capacitor (electrolytic – Tantalum electrolytic,
solid electrolyte
Approximately 500,000 hours
7.4 PFD Gr ph
PFDAVG(t) PULSAR Model R96
9.00E-03
8.00E-03
7.00E-03
6.00E-03
5.00E-03
4.00E-03
3.00E-03
2.00E-03
1.00E-03
0.00E+00
012345678910
Years
Probability
R96-511*-***

BULLETI : 58-650.0
EFFECTIVE: March 2016
705 Enterprise Street • Aurora, Illinois 60504-8149 • 630-969-4000 • Fax [phone]
[email protected] • www.magnetrol.com
Copyright © 2016 Magnetrol International, Incorporated. All rights reserved. Printed in the USA.
Service Policy
Owners of MAGNETROL controls may request the
return of a control or any part of a control for complete
rebuilding or replacement. They will be rebuilt or replaced
promptly. Controls returned under our service policy
must be returned by prepaid transportation. MAG-
NETROL will repair or replace the control at no cost to the
purchaser (or owner) other than transportation if:
1. Returned within the warranty period; and
2. The factory inspection finds the cause of the claim to
be covered under the warranty.
If the trouble is the result of conditions beyond our con-
trol; or is NOT covered by the warranty there will be
charges for labor and the parts required to rebuild or
replace the equipment.
In some cases it may be expedient to ship replacement
parts; or in extreme cases a complete new control to
replace the original equipment before it is returned. If this
is desired notify the factory of both the model and serial
numbers of the control to be replaced. In such cases cred-
it for the materials returned will be determined on the
basis of the applicability of our warranty.
No claims for misapplication labor direct or consequen-
tial damage will be allowed.
Retur Material Procedure
So that we may efficiently process any materials that are
returned it is essential that a “Return Material
Authorization” (RMA) number be obtained from the
factory prior to the material’s return. This is available
through a MAGNETROL local representative or by con-
tacting the factory. Please supply the following information:
1. Company Name
2. Description of Material
3. Serial Number
4. Reason for Return
5. Application
Any unit that was used in a process must be properly
cleaned in accordance with OSHA standards before it is
returned to the factory.
A Material Safety Data Sheet (MSDS) must accompany
material that was used in any media.
All shipments returned to the factory must be by prepaid
transportation.
All replacements will be shipped F.O.B. factory.
ASSURED QUALITY & SERVICE COST LESS
• ANSI/ISA-84.00.01-2004 Part 3 (IEC 61511-3Mod)
“Functional Safety: Safety Instrumented Systems for the
Process Industry Sector – Part 3 Guidance for the
Determination of the Required Safety Integrity Levels –
Informative”
• ANSI/ISA-TR84.00.04 Part 1 (IEC 61511 Mod)
“Guideline on the Implementation of ANSI/ISA-
84.00.01-2004”
Disclaimer
The SIL values in this document are based on an FMEDA analysis using exida’s SILVER Tool. MAGNETROL accepts
no liability whatsoever for the use of these numbers of for the correctness of the standards on which the general
calculation methods are based.
Refere ces
• ANSI/ISA-84.00.01-2004 Part 1 (IEC 61511-1Mod)
“Functional Safety: Safety Instrumented Systems for
the Process Industry Sector – Part 1 Hardware and
Software Requirements”
• ANSI/ISA-84.00.01-2004 Part 2 (IEC 61511-2Mod)
“Functional Safety: Safety Instrumented Systems for
the Process Industry Sector – Part 2 Guidelines for the
Application of ANSI/ISA84.00.01-2004 Part 1 (IEC
61511-1 Mod) – Informative”