Endress+Hauser Liquiline M CM42 - Description of the Application as a Safety Related System

Functional Safety Manual
for the Memosens transmitter Liquiline M CM42 SIL
Version: Page:
2.0 7 of 72
Alle Recht
e vorbehalten. Das Kopieren dieses Dokuments und die Verwendung von Teilen aus diesem Dokument ist
ohne schriftliche Genehmigung der Endress+Hauser Conducta GmbH+Co. KG nicht erlaubt.
All rights reserved. Passing on and copying of this document, use and communication of its contents not
permitted without written authorization from Endress+Hauser Conducta GmbH+Co. KG.
a PLC rated SIL2 or higher), which in turn uses maybe some actors to realize the safety
function.
The Liquiline M CM42 display is not safe and therefore all operations using the display
as an interface to the user are specially secured. It has been shown, that the display
hardware and software is reactionless to the CM42 system.
The transmitter is always only a part of the complete safety function. The transmitter is
a compliant item according to IEC 61508.
1.2 Description of the application as a safety related system
To use the Liquiline M CM42 safety related system, you need for example a safe
Memosens sensor and a safe Memosens cable of Endress+Hauser Conducta GmbH &
Co. KG. The display (GUI) hardware and software of the CM42 is reactionless for the
safety function of the transmitter.
The transmitter must be connected to a safe PCS by using both analogue current
outputs. The voter can for example be realized by safe function blocks inside a PLC or
by a hardware based 2oo2 voter.
The logic component must be able to handle LO- and HI-alarms (N 3.6mA,
O 21.0mA).
The CM42 system has several modes of operation:
1. Classic mode
2. SIL mode – Active safe state mode (referred to as "active safe state")
3. SIL mode – SIL measurement mode
4. SIL mode – Passive safe state mode (referred to as "passive safe state")
In Classic mode the system behaves almost like a traditional well-known CM42 system.
It is NOT executing any safety related functions and can therefore NOT be used in a
safety chain in this mode!
In Active safe state mode the system produces the error current on the current outputs
and waits for a manual switch to the SIL measurement mode or the Classic mode.
In SIL measurement mode the system is executing the safety function SAF1 or SAF2
(see later on). Only in this mode, the system operates in a safe manner and only in this
mode you can start a safe calibration or adjustment (SAF3/SAF4 – see later on).
In Passive safe state mode the system is staying in the safe state until you restart/reset
the system physically.
Attention
:
The transmitter must be switched to the SIL measurement mode, only then the safety
function is active. Without switching the system to SIL measurement mode, the system