Vega VEGAPULS 61 User guide

Safety Manual
VEGAPULS series 60
4…20 mA/HART
Radar

Contents
1Functional safety
1.1In general . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.2Planning ............................. 5
1.3Instrument parameter adjustment . . . . . . . . . . . 7
1.4Setup ............................... 9
1.5Reaction during operation and in case of failure.9
1.6Recurring function test . . . . . . . . . . . . . . . . . . . 9
1.7Safety-related characteristics . . . . . . . . . . . . . . 10
2VEGAPULS series 60 -4…20 mA/HART
Contents
31338-EN-070510

1Functional safety
1.1Ingeneral
This safety manual applies to measuring systems consisting of
the VEGAPULS series 60 radar sensor in two-wire and four-
wire versions 4…20 mA/HART:
VEGAPULS 61,62,63,65,66,67,68
Valid hardware and software versions:
Serial number of the
electronics
Sensor software
VEGAPULS 61,62,63,
65,66
>13978716 from rev.3.22
VEGAPULS 61,62,63
with increased sensitiv-
ity
>14165303 from rev.3.25
VEGAPULS 67,68 >14165303 from rev.3.25
The measuring system can be used for level measurement of
liquids and solids which meet the specific requirements of the
safety technology.
This is possible up to SIL2in a single channel architecture
(1oo1D), and up to SIL3in a multiple channel,diverse
redundant architecture.
The use of the measuring system in a multiple channel,
homogeneous redundant architecture is excluded.
The SIL declaration of conformity can be downloaded from our
homepage in the Internet.
Further abbreviations and terms are stated in IEC 61508-4.
SIL Safety Integrity Level
HFT Hardware Fault Tolerance
SFF Safe Failure Fraction
PFD
avg
average Probability of dangerous Failure on Demand
PFH Probability of a dangerous Failure per Hour
FMEDA Failure Mode,Effects and Diagnostics Analysis
λ
sd
Rate for safe detected failure
λ
su
Rate for safe undetected failure
Scope
Area of application
SIL conformity
Abbreviations,terms
VEGAPULS series 60 -4…20 mA/HART 3
Functional safety
31338-EN-070510

λ
dd
Rate for dangerous detected failure
λ
du
Rate for dangerous undetected failure
DC
S
Diagnostic Coverage of safe failures;DC
S
=λ
sd
/(λ
sd
+λ
su
)
DC
D
Diagnostic Coverage of dangerous failures;DC
D
=λ
dd
/(λ
dd
+λ
du
)
FIT Failure InTime (1FIT =1failure/10
9
h)
MTBF Mean Time Between Failure
MTTF Mean Time ToFailure
MTTR Mean Time ToRepair
lIEC 61508 (also available as DIN EN)
-Functional safety of electrical/electronic/programmable
electronic safety-related systems
lIEC 61511-1
-Functional safety -safety instrumented systems for the
process industry sector -Part 1:Framework,defini-
tions,system,hardware and software requirements
Failure limit values for a safety function,depending on the SIL
class (of IEC 61508-1,7.6.2)
Safety integrity level Low demand mode High demand mode
SIL PFD
avg
PFH
4≥10
-5
…<10
-4
≥10
-9
…<10
-8
3≥10
-4
…<10
-3
≥10
-8
…<10
-7
2≥10
-3
…<10
-2
≥10
-7
…<10
-6
1≥10
-2
…<10
-1
≥10
-6
…<10
-5
Safety integrity of hardware for safety-related subsystems of
type B(IEC 61508-2,7.4.3)
Safe failure fraction Hardware fault
tolerance
SFF HFT =0HFT =1(0)HFT =2
<60 %not permitted SIL1SIL2
60 %…<90 %SIL1SIL2SIL3
90 %…<99 %SIL2SIL3(SIL4)
≥99 %SIL3(SIL4) (SIL4)
Relevant standards
Safety requirements
4VEGAPULS series 60 -4…20 mA/HART
Functional safety
31338-EN-070510

According to IEC 61511-1,paragraph 11.4.4,the failure
tolerance HFT can be reduced by one for proven-in-use
subsystems if the following conditions are met:
lThe instrument is proven in use
lOnly process-relevant parameters can be modified on the
instrument (e.g.measuring range,current output in case of
failure …)
lThe modification of these process-relevant parameters is
protected (e.g.password, …)
lThe safety function requires less than SIL4
The assessment of the modification management was part of
the proof for "Proven in use".
1.2Planning
The measuring system generates on the current output a
signal between 3.8mAand 20.5mAcorresponding to the
level.
This analogue signal is transmitted to a connected processing
unit to monitor the following conditions:
lExceeding a preset level
lFalling below a preset level
When the switching point set on the processing unit is
reached,a signal is outputted.
The safe state depends on the mode:
Monitoring upper level Monitoring lower
level
Safe state Exceeding the switching
point
Falling below the
switching point
Output current in safe
state
>switching point (-1%)<switching point (+1%)
Failure current "fail low" <3.6mA<3.6mA
Failure current "fail high" >21.5mA>21.5mA
The current tolerance ±1%refers to the full measuring range
of 16 mA.
Asafe failure is present when the measuring system switches
to the defined safe state or the fault mode without the process
demanding it.
Proven in use
Safety function
Safe state
Fault description
VEGAPULS series 60 -4…20 mA/HART 5
Functional safety
31338-EN-070510

If the internal diagnosis system detects a failure,the measuring
system goes into fault mode.
Adangerous undetected failure exists if the measuring system
switches neither to the defined safe condition nor to the failure
mode when the process requires it.
If the measuring system delivers output currents of "fail low"or
"fail high",it can be assumed that there is a malfunction.
The processing unit must therefore interpret such currents as a
malfunction and output a suitable fault signal.
If this is not the case,the corresponding portions of the failure
rates must be assigned to the dangerous failures.The stated
values in chapter "Safety-relevant characteristics"can thus
worsen.
The processing unit must correspond to the SIL level of the
measurement chain.
If the demand rate is only once a year,then the measuring
system can be used as safety-relevant subsystem in "low
demand mode"(IEC 61508-4,3.5.12).
If the ratio of the internal diagnostics test rate of the measuring
system to the demand rate exceeds the value 100,the
measuring system can be treated as if it is executing a safety
function in the mode with low demand rate (IEC 61508-2,
7.4.3.2.5).
An associated characteristic is the value PFD
avg
(average
Probability of dangerous Failure on Demand). It is dependent
on the test interval T
Proof
between the function tests of the
protective function.
Number values see chapter "Safety-related characteristics".
If the "low demand rate"does not apply,the measuring system
as safety-relevant subsystem in "high demand mode"should
be used (IEC 61508-4,3.5.12).
The fault tolerance time of the complete system must be higher
than the sum of the reaction times or the diagnostics test
periods of all components in the safety-related measurement
chain.
An associated characteristic is the value PFH (failure rate).
Number values see chapter "Safety-related characteristics".
Configuration of the process-
ing unit
Low demand mode
High demand mode
6VEGAPULS series 60 -4…20 mA/HART
Functional safety
31338-EN-070510

The following assumptions form the basis for the implemen-
tation of FMEDA:
lFailure rates are constant,wear of the mechanical parts is
not taken into account
lFailure rates of external power supplies are not taken into
account
lMultiple errors are not taken into account
lThe average ambient temperature during the operating
time is 40 °C(104 °F)
lThe environmental conditions correspond to an average
industrial environment
lThe lifetime of the components is around 8to 12 years
(IEC 61508-2,7.4.7.4,remark 3)
lThe repair time (exchange of the measuring system)after
an nondangerous malfunction is eight hours (MTTR =8h)
lThe processing unit can interprete "fail low"and "fail high"
failures as errors and trigger a suitable error message
lExisting communication interfaces (e.g.HART,I²C-Bus)
are not used for transmission of safety-relevant information
The measuring system should be used appropriately taking
pressure,temperature,density,dielectric value and chemical
properties of the medium into account.
Instructions to critical process and vessel situations are
described in the operating instructions manual.
The user-specific limits must be kept.The specifications of the
operating instructions manual must not be exceeded.
1.3Instrument parameter adjustment
Since the plant conditions influence the safety of the
measuring system,the instrument parameters must be set
according to the application.
The following tools are allowed:
lthe DTM suitable for VEGAPULS in conjunction with an
adjustment software according to the FDT/DTM standard,
e.g.PACTware™
lIndicating and adjustment module
Note:
Make sure that DTM-Collection 10/2005 or a newer version is
used.
Assumptions
General instructions and re-
strictions
Adjustment tools
VEGAPULS series 60 -4…20 mA/HART 7
Functional safety
31338-EN-070510

In the adjustment software,the parameter "Sensor according
to SIL"must be selected in the menu level "Basic adjustment".
If the indicating and adjustment module is used,the parameter
"SIL"must be actived in the menu level "Service".
The parameter adjustment of the interference current influen-
ces the safety-related characteristics.For safety-relevant
applications only the following interference currents are
permitted:
lfail low =<3.6mA(default value)
lfail high =22 mA
The damping of the output signal must be adapted to the
process safety time.
Measured value transmission via HART signal as well as
HART multidrop mode is not permitted.
The effectivity of the set parameters must be checked in a
suitable way.
lAfter connecting the instrument,the output signal jumps to
the set interference current (at the end of the switch on
phase)
lInmode "Simulation",the signal current can be simulated
independent of the actual level
To avoid unwanted or unauthorized modification,the set
parameters must be protected against unintentional access:
lactivate the password protection in the adjustment
software
lActivate the PIN on the indicating and adjustment module
The access by means of HART handheld or similar is not
permitted.
Protecting against unintentional or unauthorized adjustment
can be done,e.g.by sealing the housing cover.
Caution:
After a reset of the values,all parameters must be checked or
readjusted.
Create a measurement loop
Reaction in case of failure
Damping of the output signal
Inadmissible modes
Inspection possibilities
Access locking
8VEGAPULS series 60 -4…20 mA/HART
Functional safety
31338-EN-070510

1.4Setup
Take note of the mounting and installation instructions of the
operating instructions manual.
In the setup procedure,a check of the safety function by
means of an initial filling is recommended.
1.5Reaction during operation and in case of
failure
The adjustment elements or device parameters must not be
modified during operation.
If modifications have to be made during operation,carefully
observe the safety functions.
Fault signals that may appear are described in the appropriate
operating instructions manual.
If faults or error messages are detected,the entire measuring
system must be shut down and the process held in a safe state
by other measures.
An exchange of the electronics is easily possible and is
described in the operating instructions manual.
If due to a detected failure the electronics or the complete
sensor is exchanged,the manufacturer must be informed (incl.
a fault description).
1.6Recurring function test
The recurring function test is used to check the safety function,
to detect possible non-detectable dangerous faults.The
function of the measuring system must be checked in
adequate intervals.
The operator is responsible for choosing the type of check.
The time intervals depend on the selected PFD
avg
value
according to chart and diagram in paragraph "Safety-related
characteristics".
With high demand rate,a recurring function test is not
requested in IEC 61508.The function of the measuring system
is demonstrated by the frequent use of the system.In double
channel architectures it is a good idea to verify the redundancy
through recurring function tests at appropriate intervals.
Mounting and installation
In general
VEGAPULS series 60 -4…20 mA/HART 9
Functional safety
31338-EN-070510

The test must be carried out in a way that verifies the flawless
operation of the safety functions in conjunction with all system
components.
This is ensured by a controlled reaching of the response height
during filling.Iffilling up to the response height is not possible,
then a response of the measuring system must be triggered by
a suitable simulation of the level or the physical measuring
effect.
The methods and procedures used during the tests must be
stated and their suitability must be specified.The tests must be
documented.
If the function test proves negative,the entire measuring
system must be switched out of service and the process held
in a safe state by means of other measures.
In the double channel architecture 1oo2Dthis applies
separately to both channels.
1.7Safety-related characteristics
The failure rates of the electronics,the mechanical parts of the
transmitter as well as the process fitting are determined by an
FMEDA according to IEC 61508.The calculations are based
on component failure rates according to SN 29500.All values
refer to an average ambient temperature during the operating
time of 40 °C(104 °F).
For a higher average temperature of 60 °C(140 °F), the failure
rates should be multiplied by a factor of 2.5.Asimilar factor
applies if frequent temperature fluctuations are expected.
The calculations are also based on the specifications stated in
chapter "Planning".
After 8to 12 years,the failure rates of the electronic
components will increase,whereby the derived PFD and PFH
values will deteriorate (IEC 61508-2,7.4.7.4,note 3).
Applies to overfill and dry run protection:
λ
sd
0FIT
λ
su
461 FIT
λ
dd
1129 FIT
λ
du
358 FIT
DC
S
0%
Basics
Service life
Failure rates
10 VEGAPULS series 60 -4…20 mA/HART
Functional safety
31338-EN-070510

DC
D
75 %
MTBF =MTTF +MTTR 0.45x10
6
h
VEGAPULS 61,62,63
E013 (no measured value available)2…20 min
depending on the
application
E042/E043 (hardware error)<2min
E036/E037 (no executable sensor software)<25 h
VEGAPULS 65,66
E013 (no measured value available)2…8min
depending on the
application
E042/E043 (hardware error)<2min
E036/E037 (no executable sensor software)<15 h
VEGAPULS 68 and VEGAPULS 61,62,63 with increased
sensitivity
E013 (no measured value available)2…36 min
depending on the
application
E042/E043 (hardware error)<4min
E036/E037 (no executable sensor software)<80 h
Single channel architecture 1oo1D
SIL SIL2
HFT 0
Sensor type Type B
Applies to overfill and dry run protection:
SFF 81 %
PFD
avg
T
Proof
=1year
T
Proof
=5years
<0.157x10
-2
<0.779x10
-2
Fault reaction time
Specific characteristics
VEGAPULS series 60 -4…20 mA/HART 11
Functional safety
31338-EN-070510

PFH <0.358x10
-6
/h
The chronological sequence of PFD
avg
is nearly linear to the
operating time over a period up to 10 years.The above values
apply only to the T
Proof
interval after which a recurring function
test must be carried out.
1 5 10 TProof
PFDavg
1
2
3
4
Fig.1:Chronological sequence of PFD
avg
(figures see above charts)
1PFD
avg
=0
2PFD
avg
after 1year
3PFD
avg
after 5years
4PFD
avg
after 10 years
Multiple channel architecture
If the measuring system is used in a multiple channel
architecture,the safety-relevant characteristics of the selected
structure of the meas.chain must be calculated specifically for
the selected application according to the above failure rates.
Asuitable Common Cause Factor must be taken into account.
The measuring system must only be used in a diversitary
redundant architecture!
Time-dependent process of
PFD
avg
Specific characteristics
12 VEGAPULS series 60 -4…20 mA/HART
Functional safety
31338-EN-070510

VEGAPULS series 60 -4…20 mA/HART 13
Functional safety
31338-EN-070510

14 VEGAPULS series 60 -4…20 mA/HART
Functional safety
31338-EN-070510

VEGAPULS series 60 -4…20 mA/HART 15
Functional safety
31338-EN-070510

VEGA Grieshaber KG
AmHohenstein 113
77761 Schiltach
Germany
Phone [phone]
Fax [phone]
E-mail:[e-mail]
www.vega.com
ISO 9001
All statements concerning scope of delivery,application,
practical use and operating conditions of the sensors and
processing systems correspond to the information avail-
able at the time of printing.
©VEGA Grieshaber KG,Schiltach/Germany 2007
Subject to change without prior notice 31338-EN-070510