WIKA CPT-2 series User guide

Safety Manual
CPT-2x, IPT-2x
CPT-2x, IPT-2x
4 … 20 mA/HART - two-wire
and slave sensors
With SIL qualication

2
Contents
Safety Manual - CPT-2x, IPT-2x
Contents
1 Document language ................................................................................................................ 3
2 Scope ........................................................................................................................................ 4
2.1 Instrument version............................................................................................................ 4
2.2 Area of application ........................................................................................................... 4
2.3 SIL conformity .................................................................................................................. 5
3 Planning.................................................................................................................................... 6
3.1 Safety function ................................................................................................................. 6
3.2 Safe state ......................................................................................................................... 6
3.3 Prerequisites for operation ............................................................................................... 6
4 Safety-related characteristics................................................................................................. 7
4.1 Characteristics acc. to IEC 61508 for process pressure measurement or hydrostatic level
measurement ................................................................................................................... 7
4.2 Characteristics acc. to IEC 61508 for applications with slave sensor................................ 7
4.3 Characteristics acc. to ISO 13849-1 for process pressure measurement or hydrostatic
level measurement ........................................................................................................... 8
4.4 Characteristics acc. to ISO 13849-1 for applications with slave sensor ............................ 8
4.5 Supplementary information .............................................................................................. 9
5 Setup ....................................................................................................................................... 11
5.1 General information........................................................................................................ 11
5.2 Instrument parameter adjustment................................................................................... 11
6 Diagnostics and servicing .................................................................................................... 13
6.1 Behaviour in case of failure ............................................................................................ 13
6.2 Repair ............................................................................................................................ 13
7 Proof test ................................................................................................................................ 14
7.1 General information........................................................................................................ 14
7.2 Test 1: Without checking the process variable ................................................................ 14
7.3 Test 2: With check of the process variable...................................................................... 15
8 Appendix A: Test report......................................................................................................... 16
9 AppendixB:Termdenitions................................................................................................ 17
10 Supplement C: SIL conformity.............................................................................................. 18
Editing status: 2018-06-19

3
1 Document language
Safety Manual - CPT-2x, IPT-2x
1 Document language
DE Das vorliegende Safety Manual für Funktionale Sicherheit ist verfügbar in den Sprachen
Deutsch, Englisch, Französisch und Russisch.
EN The current Safety Manual for Functional Safety is available in German, English, French and
Russian language.
FR Le présent Safety Manual de sécurité fonctionnelle est disponible dans les langues suivantes:
allemand, anglais, français et russe.
RU Данное руководство по функциональной безопасности Safety Manual имеется на
немецком, английском, французском и русском языках.

4
2 Scope
Safety Manual - CPT-2x, IPT-2x
2 Scope
2.1 Instrument version
This safety manual applies to pressure transmitters
CPT-2x, IPT-2x
CPT-2x, IPT-2x Slave-Sensor
Electronics types:
• Two-wire 4 … 20 mA/HART with SIL qualication
• Two-wire 4 … 20 mA/HART with SIL qualication and supplemen-
tary electronics "Additional current output 4 … 20 mA"
• Slave electronics for electronic dierential pressure with SIL
qualication
Valid versions:
• from HW Ver 1.0.0
• from SW Ver 1.0.0
• Slave electronics from HW Ver 1.0.0
If a chemical seal system is used then the inuence to the function
safety must be judged. Particularly additional failure rats must be
taken into account.
2.2 Area of application
The pressure transmitter can be used in a safety-related system
according to IEC 61508 in the modes low demand mode or high de-
mand mode for the measurement of the following process variables:
• Process pressure measurement
• Hydrostatic level measurement
With slave sensor:
• Dierential pressure measurement
• Flow measurement
• Density measurement
• Interface measurement
Due to the systematic capability SC3 this is possible up to:
• SIL2 in single-channel architecture
• SIL3 in multiple channel architecture
The following interface can be used to output the measured value:
• Current output: 4 … 20 mA
The following interfaces are only permitted for parameter adjustment
and for informative use:
• HART
• Display and adjustment module (also via Bluetooth)
• USB Communicator (auch via Bluetooth)
• Current output II1)
1) Only with instrument version with supplementary electronics "Additional cur-
rent output 4 … 20 mA".

5
2 Scope
Safety Manual - CPT-2x, IPT-2x
2.3 SIL conformity
The SIL conformity was independently judged and certied by the
TÜV Rheinland according to IEC 61508:2010 (Ed.2).2)
The certicate is valid for the entire service life of all instruments that
were sold before the certicate expired!
2) Verication documents see appendix

6
3 Planning
Safety Manual - CPT-2x, IPT-2x
3 Planning
3.1 Safety function
The sensor generates on its current output a signal between 3.8 mA
and 20.5 mA corresponding to the process variable. This analogue
signal is fed to a connected processing system to monitor the follow-
ing conditions:
• Exceeding a dened limit value of the process variable
• Falling below a dened limit value of the process variable
• Monitoring of a dened range of the process variable
For the design of the safety function, the following aspects must be
taken into account with regard to the tolerances:
• Due to undetected failures in the range between 3.8 mA and
20.5 mA, an incorrect output signal can be generated which devi-
ates from the real measured value by up to 2 %
• Due to the special application conditions, increased measurement
deviations can be caused (see Technical data in the operating
instructions)
3.2 Safe state
The safe state of the current output depends on the safety function
and the characteristics set on the sensor.
Character-
istics
Monitoring upper limit val-
ue
Monitoring lower limit value
4 … 20 mA Output current ≥ Switching
point
Output current ≤ Switching
point
20 … 4 mA Output current ≤ Switching
point
Output current ≥ Switching
point
Possible fault currents:
• ≤ 3.6 mA ("fail low")
• > 21 mA ("fail high")
3.3 Prerequisites for operation
• The measuring system should be used appropriately taking pres-
sure, temperature, density and chemical properties of the medium
into account. The application-specic limits must be observed.
• The specications according to the operating instructions manual,
particularly the current load on the output circuits, must be kept
within the specied limits
• Existing communication interfaces (e. g. HART, USB) are not used
for transmission of the safety-relevant measured value
• The instructions in chapter "Safety-related characteristics", para-
graph "Supplementary information" must be noted
• All parts of the measuring chain must correspond to the planned
"Safety Integrity Level (SIL)"
Safety function
Safety tolerance
Safe state
Fault signals in case of
malfunction
Instructions and restric-
tions

7
4 Safety-related characteristics
Safety Manual - CPT-2x, IPT-2x
4 Safety-related characteristics
4.1 Characteristics acc. to IEC 61508 for process
pressure measurement or hydrostatic level
measurement
Parameter Value
Safety Integrity Level SIL2 in single-channel architecture
SIL3 in multiple channel architecture3)
Hardware fault tolerance HFT = 0
Instrument type Type B
Mode Low demand mode, High demand mode
SFF > 90 %
MTBF4) 0.50 x 106h (57 years)
Diagnostic test interval5) < 30 min
Failure rates
λSλDD λDU λHλLλAD
0 FIT 1121 FIT 44 FIT 9 FIT 59 FIT 34 FIT
PFDAVG 0.037 x 10-2 (T1 = 1 year)
PFDAVG 0.054 x 10-2 (T1 = 2 years)
PFDAVG 0.106 x 10-2 (T1 = 5 years)
PFH 0.044 x 10-6 1/h
Proof Test Coverag (PTC)
Test type6) Remaining failure rate of danger-
ous undetected failures PTC
Test 1 21 FIT 52 %
Test 2 2 FIT 95 %
4.2 Characteristics acc. to IEC 61508 for
applications with slave sensor
Parameter Value
Safety Integrity Level SIL2 in single-channel architecture
SIL3 in multiple channel architecture7)
CPT-2x, IPT-2x
Device combination
consisting of CPT-2x or
IPT-2x
3) Homogeneous redundancy possible, because systematic capability SC3.
4) Including errors outside the safety function.
5) Time during which all internal diagnoses are carried out at least once.
6) See section "Proof test".
7) Homogeneous redundancy possible, because systematic capability SC3.

8
4 Safety-related characteristics
Safety Manual - CPT-2x, IPT-2x
Parameter Value
Hardware fault tolerance HFT = 0
Instrument type Type B
Mode Low demand mode, High demand mode
SFF > 90 %
MTBF8) 0.39 x 106h (44 years)
Diagnostic test interval9) < 30 min
Failure rates
λSλDD λDU λHλLλAD
0 FIT 1406 FIT 63 FIT 9 FIT 59 FIT 34 FIT
PFDAVG 0.054 x 10-2 (T1 = 1 year)
PFDAVG 0.079 x 10-2 (T1 = 2 years)
PFDAVG 0.154 x 10-2 (T1 = 5 years)
PFH 0.063 x 10-6 1/h
Proof Test Coverag (PTC)
Test type10) Remaining failure rate of danger-
ous undetected failures PTC
Test 1 40 FIT 36 %
Test 2 3 FIT 95 %
4.3 Characteristics acc. to ISO 13849-1
for process pressure measurement or
hydrostatic level measurement
Derived from the safety-related characteristics, the following gures
result according to ISO 13849-1 (safety of machinery):11)
Parameter Value
MTTFd 90 years
DC 97 %
Performance Level 4.35 x 10-8 1/h
4.4 Characteristics acc. to ISO 13849-1 for
applications with slave sensor
Derived from the safety-related characteristics, the following gures
result according to ISO 13849-1 (safety of machinery):12)
CPT-2x, IPT-2x
8) Including errors outside the safety function.
9) Time during which all internal diagnoses are carried out at least once.
10) See section "Proof test".
11) ISO 13849-1 was not part of the certication of the instrument.
12) ISO 13849-1 was not part of the certication of the instrument.

9
4 Safety-related characteristics
Safety Manual - CPT-2x, IPT-2x
Parameter Value
MTTFd 73 years
DC 96 %
Performance Level 6.33 x 10-8 1/h
4.5 Supplementary information
The failure rates of the instruments were determined by an FMEDA
according to IEC 61508. The calculations are based on failure rates of
the components according to SN 29500:
All gures refer to an average ambient temperature of 40 °C (104 °F)
during the operating time. For higher temperatures, the values should
be corrected:
• Continuous application temperature > 50 °C (122 °F) by factor 1.3
• Continuous application temperature > 60 °C (140 °F) by factor 2.5
Similar factors apply if frequent temperature uctations are expected.
• The failure rates are constant. Take note of the useful service life of
the components according to IEC 61508-2.
• Multiple failures are not taken into account
• Wear on mechanical parts is not taken into account
• Failure rates of external power supplies are not taken into account
• The environmental conditions correspond to an average industrial
environment
The values for PFDAVG specied above were calculated as follows for a
1oo1 architecture:
PFDAVG= +λDD x MTTR +
PTC × λDU × T1
2
(1 – PTC) ×
λ
DU
× LT
2
Parameters used:
• T1 = Proof Test Interval
• PTC = 90 %
• LT = 10 years
• MTTR = 8 h
A connected control and processing unit must have the following
properties:
• The failure signals of the measuring system are judged according
to the idle current principle
• "fail low" and "fail high" signals are interpreted as a failure, where-
upon the safe state must be taken on
If this is not the case, the respective percentages of the failure rates
must be assigned to the dangerous failures and the values stated in
chapter Safety-related characteristics“ redetermined!
Device combination
consisting of CPT-2x or
IPT-2x
Determination of the
failure rates
Assumptions of the
FMEDA
Calculation of PFDAVG
Congurationofthepro-
cessing unit

10
4 Safety-related characteristics
Safety Manual - CPT-2x, IPT-2x
Due to the systematic capability SC3, this instrument can also be
used in multiple channel systems up to SIL3, also with a homogene-
ously redundant conguration.
The safety-related characteristics must be calculated especially for
the selected structure of the measuring chain using the stated failure
rates. In doing this, a suitable Common Cause Factor (CCF) must be
considered (see IEC 61508-6, appendix D).
Multiple channel archi-
tecture

11
5 Setup
Safety Manual - CPT-2x, IPT-2x
5 Setup
5.1 General information
Take note of the mounting and installation instructions in the operating
instructions manual.
Setup must be carried out under process conditions.
5.2 Instrument parameter adjustment
The following adjustment units are permitted for parameterization of
the safety function:
• Display and adjustment module
• The DTM suitable for CPT-2x, IPT-2x in conjunction with an
adjustment software according to the FDT/DTM standard, e. g.
PA C Twa r e
• The device description EDD suitable for CPT-2x, IPT-2x
The parameter adjustment is described in the operating instructions
manual.
Wireless connection is also possible with existing Bluetooth function.
The documentation of the device settings is only possible with the full
version of the DTM Collection.
For protection against unwanted or unauthorzed adjustment, the set
parameters must be protected against unauthorized access. For this
reason, the instrument is shipped in locked condition. The PIN in
delivery status is "0000".
The default values of the parameters are listed in the operating
instructions. When shipped with customer-specic parameter set-
tings, the instrument is accompanied by a list of the values diering
from the default values.
To avoid or detect possible errors during parameter adjustment for
unsafe operating environments, a verication procedure is used that
allows the safety-relevant parameters to be checked.
Parameter adjustment proceeds according to the following steps:
• Unlock adjustment
• Change parameters
• Lock adjustment and verify modied parameters
The exact process is described in the operating instructions.
The instrument is shipped in locked condition!
For verication, all modied, safety-relevant and non safety-relevant
parameters are shown.
The verication texts are displayed either in German or, when any
other menu language is used, in English.
Mounting and installation
Tools
Safety-relevant param-
eters
Safe parameterization

12
5 Setup
Safety Manual - CPT-2x, IPT-2x
Warning:
When adjustment is unlocked, the safety function must be considered
as unreliable. This applies until the parameters are veried and the
adjustment is locked again. If the parameter adjustment process is
not carried out completely, the device statuses described in the oper-
ating instructions must be taken into consideration.
If necessary, you must take other measures to maintain the safety
function.
Warning:
In case a reset to "Delivery status" or "Basic adjustment" is carried
out, all safety-relevant parameters must be checked or set anew.
Unsafe device
status
Instrument reset

13
6 Diagnostics and servicing
Safety Manual - CPT-2x, IPT-2x
6 Diagnostics and servicing
6.1 Behaviour in case of failure
The instrument permanently monitored by an internal diagnostic
system. If a malfunction is detected, a failure signal will be outputted
on the safety-relevant output (see section "Safe status").
The diagnosis interval is specied in chapter "Safety-related charac-
teristics".
A fault message coded according to the type of fault is outputted. The
fault messages are listed in the operating instructions.
If failures are detected, the entire measuring system must be shut
down and the process held in a safe state by other measures.
The manufacturer must be informed of the occurrence of a dangerous
undetected failure (incl. fault description).
6.2 Repair
The procedure is described in the operating instructions manual. Note
the instructions for parameter adjustment and setup.
The procedure is described in the operating instructions manual. Note
the instructions for parameter adjustment and setup.
Internal diagnosis
Error messages in case
of malfunction
Electronics exchange
Software update

14
7 Proof test
Safety Manual - CPT-2x, IPT-2x
7 Proof test
7.1 General information
To identify possible dangerous, undetected failures, the safety func-
tion must be checked by a proof test at adequate intervals. It is the
user's responsibility to choose the type of testing. The time intervals
are determined by the selected PFDAVG (see chapter "Safety-related
characteristics").
For documentation of these tests, the test protocol in the appendix
can be used.
If one of the tests proves negative, the entire measuring system must
be switched out of service and the process held in a safe state by
means of other measures.
In a multiple channel architecture this applies separately to each
channel.
• Determine safety function (mode, switching points)
• If necessary, remove the instruments from the safety chain and
maintain the safety function by other means
• Provide an approved adjustment unit
Warning:
During the function test, the safety function must be treated as unreli-
able. Take into account that the function test inuences downstream
connected devices.
If necessary, you must take other measures to maintain the safety
function.
After the function test, the status specied for the safety function must
be restored.
7.2 Test 1: Without checking the process variable
• Instrument can remain in installed condition
• Output signal corresponds to the assigned process variable
• Device status in the menu Diagnosis: "OK"
1. Carry out a re-start (separate the test item at least 10 seconds
from mains voltage)
2. Simulate upper leakage current > 21 mA and check current out-
put (test line resistor)
3. Simulate lower leakage current ≤ 3.6 mA and check current out-
put (test quiescent currents)
Note
Test 1 detects no failures in the probably used slave sensor!
Step 1: Output signal corresponds to the assigned process variable
and the device status in the menu Diagnosis is "OK"
Step 2: Output signal corresponds to > 21 mA
Step 3: Output signal corresponds to ≤ 3.6 mA
Objective
Preparation
Unsafe device
status
Conditions
Procedure
Expected result

15
7 Proof test
Safety Manual - CPT-2x, IPT-2x
See Safety-related characteristics
7.3 Test 2: With check of the process variable
• Instrument can remain in installed condition
• Output signal corresponds to the assigned process variable
• Device status in the menu Diagnosis: "OK"
1. Carry out a re-start (separate the test item at least 10 seconds
from mains voltage)
2. Simulate upper leakage current > 21 mA and check current out-
put (test line resistor)
3. Simulate lower leakage current ≤ 3.6 mA and check current out-
put (test quiescent currents)
4. Reference pressure measurement at 0 % - 50 % - 100 % of the
adjusted measuring range in use (4 mA - 12 mA - 20 mA)
5. If necessary, sensor calibration through service log-in and subse-
quent reference pressure measurement as under point 4
Note
When a slave sensor is used, also this sensor must be checked with a
reference pressure measurement acc. to point 4!
Step 1: Output signal corresponds to the assigned process variable
and the device status in the menu Diagnosis is "OK"
Step 2: Output signal corresponds to > 21 mA
Step 3: Output signal corresponds to ≤ 3.6 mA
Step 4 and 5: Output signal corresponds to the reference pressure
See Safety-related characteristics
Proof Test Coverage
Conditions
Procedure
Expected result
Proof Test Coverage

16
8 Appendix A: Test report
Safety Manual - CPT-2x, IPT-2x
8 Appendix A: Test report
Identication
Company/Tester
Plant/Instrument TAG
Meas. loop TAG
Instrument type/Order code
Instrument serial number
Date, setup
Date of the last proof test
Test reason/Test scope
Setup without checking the process variable
Setup with check of the process variable
Proof test without checking the process variable
Proof test with check of the process variable
Mode
Monitoring of an upper limit value
Monitoring a lower limit value
Range monitoring
Adjusted parameters of the safety function are documented
Ye s
No
Test result (if necessary)
Test point Process variable13) Expected measured
value
Real value Test result
Value 1
Value 2
Value 3
Value 4
Value 5
Conrmation
Date: Signature:
13) e.g.: limit level, level, interface, pressure, ow, density

17
9AppendixB:Termdenitions
Safety Manual - CPT-2x, IPT-2x
9 AppendixB:Termdenitions
SIL Safety Integrity Level (SIL1, SIL2, SIL3, SIL4)
SC Systematic Capability (SC1, SC2, SC3, SC4)
HFT Hardware Fault Tolerance
SFF Safe Failure Fraction
PFDAVG Average Probability of dangerous Failure on Demand
PFH Average frequency of a dangerous failure per hour (Ed.2)
FMEDA Failure Mode, Eects and Diagnostics Analysis
FIT Failure In Time (1 FIT = 1 failure/109h)
λSD Rate for safe detected failure
λSU Rate for safe undetected failure
λSλS = λSD + λSU
λDD Rate for dangerous detected failure
λDU Rate for dangerous undetected failure
λHRate for failure, who causes a high output current (> 21 mA)
λLRate for failure, who causes a low output current (≤ 3.6 mA)
λAD Rate for diagnostic failure (detected)
λAU Rate for diagnostic failure (undetected)
DC Diagnostic Coverage
PTC Proof Test Coverage (Diagnostic coverage for manual proof tests)
T1 Proof Test Interval
LT Useful Life Time
MTBF Mean Time Between Failure = MTTF + MTTR
MTTF Mean Time To Failure
MTTR IEC 61508, Ed1: Mean Time To Repair
IEC 61508, Ed2: Mean Time To Restoration
MTTFdMean Time To dangerous Failure (ISO 13849-1)
PL Performance Level (ISO 13849-1)
Abbreviations

18
10 Supplement C: SIL conformity
Safety Manual - CPT-2x, IPT-2x
10 Supplement C: SIL conformity

19
10 Supplement C: SIL conformity
Safety Manual - CPT-2x, IPT-2x

20
Printing date:
WIKA Alexander Wiegand SE & Co. KG
Alexander-Wiegand-Straße 30
63911 Klingenberg
Germany
Phone [phone]
Fax [phone]
E-mail: [email protected]
www.wika.de
56038-EN-180619
All statements concerning scope of delivery, application, practi-
cal use and operating conditions of the sensors and processing
systems correspond to the information available at the time of
printing.