Complete HW/SW assessment in the context of development including (only 1 version can be selected) FMEDA and change process according to IEC 61508-2, 3 Assessment of evidence for proven-in-use HW/SW including FMEDA and change process according to IEC 61508-2, 3 Endress+Hauser...
Page 6
7.3 · 10 Up to 99 % Up to 99 % MTBF 56 years 58 years 47 years 48 years Diagnostic test interval 30 min 30 min Fault response time 30 s 30 s Process safety time 50 h 50 h Endress+Hauser...
Page 7
ISO 13849/IEC 62061 also includes soft errors (sporadic bit errors in data memories). Note The measuring device has been developed for use in "Low Demand" and "High Demand" mode. Explanation Our in-house quality management system saves information on safety-related systematic errors that will become known in the future. Endress+Hauser...
The document is part of the Operating Instructions and serves as a reference for application- specific parameters and notes. • General information about functional safety: SIL • General information about SIL is available: In the Downloads area of the Endress+Hauser website: www.endress.com/SIL Using this document 3.2.1...
For an overview of the scope of the associated Technical Documentation, refer to the following: • W@M Device Viewer (www.endress.com/deviceviewer): Enter the serial number from nameplate • Endress+Hauser Operations App: Enter the serial number from the nameplate or scan the 2D matrix code (QR code) on the nameplate Endress+Hauser...
Page 11
Promass A 500 (8A5C**-…) TI01375D Promass E 500 TI01282D Promass F 500 TI01222D Promass H 500 TI01283D Promass I 500 TI01284D Promass O 500 TI01285D Promass P 500 TI01286D Promass Q 500 TI01287D Promass S 500 TI01288D Promass X 500 TI01289D Endress+Hauser...
The details pertaining to functional safety in this manual relate to the device versions listed below and are valid as of the specified software and hardware versions. Unless otherwise specified, all subsequent versions can also be used for safety functions. A modification process according to IEC 61508 is applied for any device modifications. Endress+Hauser...
Page 13
Integrated ISEM electronics Transmitter housing Sensor connection housing Cable, sensor connection Electrical connection Measuring tube mat., wetted surface Process connection Calibration flow Device model Display operating language Sensor option Customer-specific configuration Application package Suitability for custody transfer measurement Service Endress+Hauser...
Only for devices with approval for custody transfer Additional selection of further approvals is possible. SIL label on the nameplate Order code: Ser. no.: Ext. ord. cd.: Date: A0031473 SIL logo Endress+Hauser...
Is within the specified tolerance range Safe, undetectable failure present λ Dangerous detected: Device assumes a signal on alarm Dangerous but detectable failure present (diagnosis in device) λ Dangerous undetected: May be outside the specified tolerance Dangerous, undetectable failure range present Endress+Hauser...
An incorrect output signal that deviates from the value specified in the Operating Instructions but is still in the range of 4 to 20 mA, is considered a dangerous, undetected failure. Information on measured error→ 18 For detailed information on the maximum measured error, see the Operating Instructions. → 11 Endress+Hauser...
Page 17
Pay attention to the medium properties and the environmental conditions. ‣ Carefully follow instructions pertaining to critical process situations and installation conditions. Detailed information on: • Installation • Electrical connection • Medium properties • Environment • Process Operating Instructions and Technical Information → 11 Endress+Hauser...
Page 18
No special measures need to be taken into consideration for single-phase, liquid media with properties similar to water. Further information on the suitability of the measuring device for safety-related operation is available from your Endress+Hauser sales center. 5.2.4 Information on measured errors When the measured value is transmitted via the 4–20 mA current output, the measuring...
≥ 21 mA) output currents of ≤ 3.6 mA occur irrespective of the configured failure current. In some other cases (e.g. short circuit of cabling), output currents of ≥ 21 mA occur irrespective of the configured failure current. Endress+Hauser...
On completion of parameter configuration, the SIL mode of the device must be enabled with a SIL locking code. Endress+Hauser...
Page 21
If the order option cannot be accessed in the measuring device, the function cannot be retrofitted during the life cycle of the device. If you have any questions please contact your Endress+Hauser service or sales organization. Ways to check function availability in the measuring device:...
Page 22
= Density Vol. flow A0015325-EN In the Setup menu → Advanced setup submenu, select the SIL confirmation wizard. Select Set write protection parameter. Enter the SIL locking code 7452. The device first checks the preconditions listed under item 1. Endress+Hauser...
Page 23
The diagnostic behavior is set in such a way that the measuring device is set to the safe state when an error occurs. This means that the diagnostic messages listed in the graphic are set to alarm and the current output adopts the configured failsafe mode → 19. Endress+Hauser...
Page 24
• 831 Sensor temperature too low diagnostic message • 834 Process temperature too high diagnostic message • 835 Process temperature too low diagnostic message • 913 Medium unsuitable diagnostic message Expert Sensor Process parameter Density Flow Temperature Flow damping damping damping override A0043346-EN Endress+Hauser...
Page 25
Proline Promass 500 Use in protective systems Expert Sensor Sensor adjustment Variable adjustment Mass flow Mass flow Volume flow Volume flow Density offset Density factor offset factor offset factor A0023070-EN Expert Sensor External compensation Temperture mode Internal measured value A0031477-EN Endress+Hauser...
Page 26
Use in protective systems Proline Promass 500 Expert Output Communication Current HART output 1 configuration Start-up HART mode address Min. A0015328-EN Endress+Hauser...
Page 27
Pressure value Zero point A0031475-EN This parameter is only displayed if the "Gas" option is selected in the "Medium" parameter. For detailed information on the parameters in the graphic, see the Operating Instructions.→ 11 Endress+Hauser...
Page 28
If the SIL locking code has been entered correctly, the message "End of sequence" appears on the display. Press the key to confirm. The SIL mode is now activated. Recommendation: A0029675 1 Proline 500 – digital Endress+Hauser...
Page 29
Set this switch to the OFF position where necessary. Hardware write protection disabled. Enter the user-specific release code if necessary. In the Setup menu → Advanced setup submenu, select the Deactivate SIL wizard. Select Reset write protection parameter. Endress+Hauser...
Page 30
Proline Promass 500 Enter the SIL locking code 7452. If the SIL locking code has been entered correctly, the message "End of sequence" appears on the display. Press the key to confirm. The SIL mode is now deactivated. Endress+Hauser...
The operator also specifies the procedure for proof-testing. NOTE! In accordance with IEC 61511, an independent proof test of the subsystems→ 33, e.g. sensor, is permitted as an alternative to testing the safety function of the entire system. Endress+Hauser...
Page 32
0.001 0.0005 A0031609 4 Option CA "4-20mA HART Ex-i", option CB "4-20mA Ex-i + Wireless HART" Mission time in years - Average probability of dangerous failure on demand Limit value for average probability of failure 1oo1 Single-channel architecture Endress+Hauser...
Page 33
It is advisable to perform a visual inspection on site. ‣ As part of the visual inspection of the transmitter, ensure that all of the electronics compartment cover seals and cable entries are providing adequate sealing. Under IEC 61508 the sensor is synonymous with the entire flowmeter. Endress+Hauser...
Page 34
For proof testing, use only the Current output simulation parameter (→ 36) and the Value current output parameter (→ 36), as these are the only parameters approved for testing the safety-related characteristics. In the Value current output parameter, select the defined default values one after the other. Endress+Hauser...
Page 35
The deviation should not exceed ±1 % / ±300 µA. ‣ Note data relating to measured error→ 18. Connecting the test Re-activate the locked SIL mode→ 21. Deactivate bypassing of safety function of process control system. Endress+Hauser...
Page 36
Enter the current value for • 1. Default 3.59 mA output 1 to n 1 to n simulation simulation. value: Select parameter, the On option 4.0 mA. is selected. • 2. Default value: Select 20.0 mA. 3.59 to 22.5 mA Endress+Hauser...
Page 37
For information on the required measured error for the device, see the "Performance characteristics" section of the Operating Instructions ‣ Carefully follow the information in the section on "Restrictions for use in safety-related applications – information on measured errors" → 16. Endress+Hauser...
Page 38
If one of the test criteria from the test sequences described above is not fulfilled, the device may no longer be used as part of a protective system. ‣ Take measures to reduce systematic errors. Detailed information on: • Orientation • Medium properties • Operating conditions Operating Instructions→ 11 Endress+Hauser...
Page 39
The amount of deviation between the measured density and the reference value must not exceed the measured error specified for the safety function. ‣ Follow the information in the section on "Restrictions for use in safety-related applications – information on measured errors" → 16. Endress+Hauser...
Page 40
If one of the test criteria from the test sequences described above is not fulfilled, the device may no longer be used as part of a protective system. ‣ Take measures to reduce systematic errors. Detailed information on: • Orientation • Medium properties • Operating conditions Operating Instructions→ 11 Endress+Hauser...
Page 41
Test step - Part 2 - Testing of current output 1 The Simulation submenu (Diagnostics → Simulation) enables you to simulate, without a real flow situation, various process variables in the process and the device alarm mode and to verify downstream signal chains (switching valves or closed-control loops). Endress+Hauser...
Page 42
External verification taking the example of a passive current output Automation system with current input (e.. g. PLC) Power supply unit Ammeter Transmitter Connect the ammeter to the transmitter by looping it in series into the circuit. Connect the power supply unit. Endress+Hauser...
Page 43
Enter the current value for • 1. Default 3.59 mA output 1 to n 1 to n simulation simulation. value: Select parameter, the On option 4.0 mA. is selected. • 2. Default value: Select 20.0 mA. 3.59 to 22.5 mA Endress+Hauser...
On completion of the verification, the SIL mode must be enabled again . The Heartbeat Verification application package is available as an order option and can be retrofitted on all measuring devices. Please contact your Endress+Hauser service or sales organization to retrofit the device. Life cycle Requirements for the personnel...
7.6.1 Replacing device components The following components may be replaced by the customer' s technical staff if genuine spare parts are used and the appropriate installation instructions are followed: • Sensor • Transmitter without a sensor • Display module Endress+Hauser...
Installation Instructions: see the Download Area at www.endress.com. The replaced component must be sent to Endress+Hauser for the purpose of fault analysis if the device has been operated in a protective system and a device error cannot be ruled out. In this case, always enclose the "Declaration of Hazardous Material and Decontamination"...
This is sent to a downstream automation system where it is monitored to determine whether it falls below or exceeds a specified limit value. The safety function (mass flow, volume flow or density monitoring) is implemented in this way. Endress+Hauser...
SIL mode must be enabled again. ‣ Activation of the SIL mode → 21. Notes on the redundant use of multiple sensors This section provides additional information regarding the use of homogeneously redundant sensors e.g. 1oo2 or 2oo3 architectures. Endress+Hauser...
01.01.zz (HART; from delivery date October 1, sensor generation A) 2017) SD01729D/06/xx/02.17 Changes: Operating Instructions for the 01.01.zz (HART; from delivery date October 1, device → 11 2017) SD01729D/06/xx/01.16 First version 01.00.zz (HART; from delivery date August 2, 2016) Endress+Hauser...
Need help?
Do you have a question about the HART Proline Promass 500 and is the answer not in the manual?
Questions and answers