1. art and entertainment
2. music
3. musical instruments
4. guitars

Functional Safety Manual
Proline Promass 200
Coriolis mass flow measuring system using 2-wire technology 
with 4–20 mA output signal
Application
Monitoring of maximum and/or minimum flow or density in systems which are required to comply with particular safety system requirements as per IEC/EN 61508.
The measuring device fulfils the requirements concerning:
• Functional safety as per IEC/EN 61508
• Explosion protection (depending on the version)
• Electromagnetic compatibility as per
EN 61326-3-2 and NAMUR recommendation NE 21
• Electrical safety as per IEC/EN 61010-1
SD00147D/06/EN/02.12
71188887

Valid as of version
V 01.02.zz (Device software)
Your benefits
• For flow monitoring (Min., Max., range) up to SIL 2
(single-channel architecture) or SIL 3 (multichannel
architecture with homogeneous redundancy). Independently assessed and certified by TÜV as per 
IEC/EN 61508
• Alternatively, suitable for density monitoring also
(Min., Max., range)
• Continuous measurement
• Measurement is virtually independent of product
properties
• Permanent self-monitoring
• Easy installation and commissioning
• Proof-test possible without removal of the measuring
device
Proline Promass 200
Table of contents
SIL Certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Structure of the measuring system with Promass 200 . 4
System components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Description of use as a protective system . . . . . . . . . . . . . . . . . . . . 4
Permitted device types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
SIL label on the transmitter nameplate . . . . . . . . . . . . . . . . . . . . . 5
Supplementary device documentation . . . . . . . . . . . . . . . . . . . . . . 6
Description of the safety requirements and boundary
conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Safety function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Restrictions for use in 
safety-related applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Functional safety indicators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Behavior of device during operation and in case of a fault . . . . . . 11
Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Commissioning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Proof-test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Proof-testing the measuring system . . . . . . . . . . . . . . . . . . . . . . . 16
Repairs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Repairs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Appendix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Notes on the redundant use of multiple sensors . . . . . . . . . . . . . 19
2
Endress+Hauser

Proline Promass 200
SIL Certificate
A0015717
Endress+Hauser
3

Proline Promass 200
!
Introduction
Note!
General information on functional safety (SIL) is available at: 
www.endress.com/SIL and in Competence Brochure CP002Z "Functional Safety in the Process Industry - Risk
Reduction with Safety Instrumented Systems" (available in the download section of the Endress+Hauser website: www.endress.com  Download  Document code: CP002Z).
Structure of the measuring system with Promass 200
System components
4
1
2
3
A0015443
System components
1
2
3
4
Pump
Measuring device
Valve
Automation system
An analog signal (4–20 mA) proportional to the flow rate or the density is generated in the transmitter. This is
sent to a downstream automation system where it is monitored to determine whether it falls below or exceeds
a specified limit value.
Description of use as a protective system
!
The measuring device can be used in protective systems to monitor (Min., Max. and range) the following:
• Mass flow
• Volume flow
• Density
Note!
The device must be correctly installed to guarantee safe operation.
A
B
C
4
Min.
Max.
20
[mA]
A0015277
Monitoring options in protective systems
A
B
C
Min. alarm
Max. alarm
Range monitoring
= Safety function activated
= Permitted operating status
4
Endress+Hauser

Proline Promass 200
Permitted device types
The details pertaining to functional safety in this manual relate to the device versions listed below and are valid
as of the specified software and hardware versions.
Unless otherwise specified, all subsequent versions can also be used for safety functions. A modification process
according to IEC/EN 61508 is applied for any device modifications.
Valid device versions (extended order code) for safety-related use:
Feature
Designation
Selected option
Order code
8E2B (Promass E 200)
8F2B (Promass F 200)
000
Nominal diameter
08, 15, 25, 40, 50
010
Approval
All
020
Output
A, B, C 1
030
Display; Operation
All
040
Housing
All
050
Electrical connection
All
060
Measuring tube material; Finish All
070
Process connection
All
080
Calibration flow
All
500
Display operating language
All
540
Application package
All
–
1
570
Service
All
580
Test; Certificate
All
590
Additional approval
LA (= SIL)
Additional selection of further approvals is possible.
600
Sensor options
All
610
Accessories mounted
All
620
Accessories enclosed
All
850
Firmware version
SIL-enabled firmware, e.g. 01.02.zz (HART)
895
Tagging
All
In devices with 2 outputs, only current output 1 (terminals 1 and 2) is suitable for safety functions.
Where necessary, output 2 (terminals 3 and 4) can be connected for non-safety related purposes.
Valid firmware version: As of 01.02.zz
Valid hardware version (electronics): As of delivery date 01.07.2012
SIL label on the transmitter
nameplate
Made in Switzerland, 4153 Reinach
Promass 200
Order code:
8E2B25-1234/567
12345678901
Ser. no.:
8E2B25-AACABAAD2S1+
Ext. ord. cd.:
#LA#
12...30 V DC / 2-wire
4...20 mA HART
4...20 mA
IP66 / 67 NEMA 4X
M20x1.5 / M16x1.5
Ta: -40...+60 °C
FW: 01.02.00
T Ta + 20 K
Dev.Rev.: 3
i
ex works
1
Patents
Date:
2012-07
i
322540-0001
A0015323
SIL label on the transmitter nameplate
1
Endress+Hauser
SIL logo
5

Proline Promass 200
Supplementary device documentation
!
Note!
The following document types are available:
• On the CD-ROM delivered with the device
• In the download section of the Endress+Hauser website: www.endress.com Download
• Additional Safety Instructions are supplied with certified device versions. Refer to the nameplate to see which
Safety Instructions are relevant for the device version in question.
Standard documentation
Document type
Code
Contents
Technical Information
Promass E 200: TI01009D
Promass F 200: TI01060D
– Technical data
– Instructions on accessories
Operating Instructions (HART)
Promass E 200: BA01027D
Promass F 200: BA01112D
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
Basic safety instructions
Product description
Incoming acceptance and product identification
Storage, transport
Installation
Electrical connection
Operating options
Integrating the device via HART protocol
Commissioning
Troubleshooting
Repairs
Maintenance
Accessories
Return
Disposal
Overview of operating menu
Description of device parameters
Brief Operating Instructions
Promass E 200: KA00050D
Promass F 200: KA01122D
–
–
–
–
–
–
–
Basic safety instructions
Product description
Incoming acceptance and product identification
Storage, transport
Installation
Electrical connection
Commissioning
Device-specific additional documentation
Document type
Approval
Code
Contents
Safety instructions
ATEX II2G Ex d
XA00143D
ATEX II2G Ex i
XA00144D
ATEX II3G
XA00145D
Safety, installation and operating
instructions for devices, which are
suitable for use in potentially explosive atmospheres.
CCSAUS
Ex d
XA00151D
CCSAUS
Ex i
XA00152D
Information on the Pressure Equipment Directive
6
SD00142D
Endress+Hauser

Proline Promass 200
Description of the safety requirements and boundary conditions
Safety function
The measuring device's permitted safety functions are:
– Monitoring maximum or minimum mass flow or mass flow range
– Monitoring maximum or minimum volume flow or volume flow range for liquid media
– Monitoring maximum or minimum density or density range for liquid media
The safety functions are based on simultaneous and continuous measurement of the mass flow and density of
a liquid.
Safety-related output signal
The measuring device's safety-related signal is the 4 to 20 mA analog output signal.
All safety measures refer to this signal exclusively.
In devices with 2 outputs (feature 020, option B or C of the extended order code ä 5), only current output
1 (terminals 1 and 2) is suitable for safety functions. Where necessary, output 2 (terminals 3 and 4) can be
connected for non-safety related purposes.
The device additionally communicates via HART and contains all HART features with additional device information.
The safety-related output signal is fed to a downstream automation system where it is monitored for the following:
– Overshooting and/or undershooting a specified limit value of the flow rate or medium density
– The occurrence of a fault, e.g. error current ( 3.6 mA,  21 mA), interruption or short-circuit of the signal
line).
Restrictions for use in 
safety-related applications
Do not exceed the values specified in the device documentation "Supplementary device documentation"
(ä 6).
Suitability of the measuring device
Carefully select the nominal diameter of the measuring device in accordance with the application's expected
flow rates. The maximum flow rate during operation must not exceed the specified maximum value for the
sensor. In safety-related applications, it is also recommended to select a limit value for monitoring the minimum
flow rate that is not smaller than 5% of the specified maximum value of the sensor.
The measuring device must be used correctly for the specific application, taking into account the medium
properties and ambient conditions. Carefully follow instructions pertaining to critical process situations and
installation conditions from the device documentation.
Please pay particular attention to the following:
• It is very important to avoid the occurrence of air, gas bubble formation or two-phase mixtures in the measuring pipe as they can lead to increased measurement errors.
• For liquids that readily boil and in the case of suction conveying: Ensure that the vapor pressure is not undershot and that the liquid does not start to boil.
• Please ensure that there is never any outgassing of the gases naturally contained in many liquids. Sufficiently
high system pressure prevents the occurrence of these effects.
• Ensure that no cavitation occurs as it can affect the vibration and operating life of the measuring pipes.
• In case of gaseous media at high flow rates turbulences can occur, e.g. due to a half-closed valve. This may
result in fluctuating measured values.
• Avoid applications that cause buildup or corrosion in the measuring pipe.
In general, there are no specific requirements for single-phase, liquid media with properties similar to those of
water.
!
Endress+Hauser
Note!
Please contact your Endress+Hauser sales office for further information.
7

Proline Promass 200
Information on measurement accuracy
When the measured value is being transmitted via the 4–20 mA current output, the measuring device's measured error is made up of the contribution of the digitally determined measured value (Q, ) and that of the
analog current output (i). These contributions, which are listed in the device documentation, apply under reference operating conditions and can depend on the sensor version ordered. If process or ambient conditions
are different, there are additional contributions, e.g. temperature or pressure, which are also listed.
Depending on the current scaling configured (parameter 4mA and 20mA) the following measured error can
be expected as the result at the current output:
Mass flow or volume flow measurement (deviation Q specified as a percentage in relation to measured value Q)
Q · (DQ [%] / 100) ·
16 mA
+ Di
Q20 mA – Q4 mA
A0015267
Density (deviation  specified as absolute value)
16 mA
+ Di
Dr · r
20 mA – r4 mA
A0015268
Guidelines for minimal measured errors:
• Where process pressure is high: Set the typical process pressure in the device.
• When measuring the mass flow or volume flow: for minimal measured errors, carry out zero point adjustment under process conditions.
• The volume flow is calculated in the device from the mass flow and density. For minimal error of the measured volume flow: Carry out field density calibration under process conditions.
• Limit value monitoring: Depending on the process dynamics, the current value of the unfiltered 4–20 mA
output signal can temporarily exceed the specified tolerance range. The device can optionally provide damping of the current output via parameters, which only affects the measured value output. Device-internal diagnostics or output of an error current ( 3.6 mA or  21 mA) are not affected by this damping.
Power supply for the 4–20 mA interface
Overvoltages (> 30 V) at the 4–20 mA interface (caused by a fault in the supply unit for example) can result in
a leak current in the device's input protection circuit. This may lead to falsification of the output signal by more
than the specified error or the minimum error current (3.6 mA) can no longer be set due to the leak current.
Therefore, a 4–20 mA power supply unit either with voltage limitation or voltage monitoring at  30 V must
be used.
8
Endress+Hauser

Proline Promass 200
Functional safety indicators
Characteristic as per IEC/EN 61508
Safety function
Output option A, B
Output option C
Monitoring of mass flow or volume flow or density
(Min., Max., range)
SIL
SIL 2 (single-channel architecture 1oo1),
SIL 3 (multichannel architecture with homogeneous redundancy, e.g. 1oo2,
2oo3)
HFT
0
Device type
B
Mode of operation
Low demand mode, High demand mode
SFF
98,01 %
98,67 %
Recommended time interval for prooftesting T 1
3 years
3 years
sd
1403 FIT
1403 FIT
su
808 FIT
dd
1099 FIT
923 FIT
67 FIT
51 FIT
3377 FIT
3800 FIT
PFDavg for T1 = 1 year 2) (single-channel
architecture)
0,293 · 10-3
0,222 · 10-3
PFDavg for T1 = 3 year 2) (single-channel
architecture)
0,882 · 10-3
0,665 · 10-3
0,335 · 10-7 · 1/h
0,253 · 10-7 · 1/h
56,0 years
46,6 years
du
tot
1
PFH
MTBF 1)
Diagnostic test interval 3)
1423 FIT
30 min
4)
30 s
Characteristic as per EN ISO 13849 /
EN 62061
Value
Fault response time
MTTFd 5)
97,9 years
117,3 years
1)
This value takes into account all failure types of the electronic components as per Siemens SN29500.
Valid for averaged ambient temperatures up to 40 °C (104 °F).
3)
All diagnostic functions are carried out at least once during this time.
4) Maximum time between fault detection and fault response.
5)
MTTFd also includes Soft-Errors (sporadic bit errors in data memory).
2
PFDavg in single-channel system as a function of the proof-test interval with 100 % detection rate of all dangerous undetected failures:
1oo1
PFDav
avg
1.00E-03
A, B
C
0.50E-03
0.00E+00
0
1
2
3 years
A0015269-EN
Proof-test interval
Endress+Hauser
9

Proline Promass 200
Dangerous undetected failures in this scenario:
An incorrect output signal that deviates from the real measured value but is still in the range of 4 to 20 mA, is
considered a dangerous, undetected failure.
For more detailed information, please refer to the information on measurement accuracy (ä 8) in conjunction with the "Performance characteristics" section from Operating Instructions BA01027D, BA01112D.
Useful lifetime of electric components
The established failure rates of electrical components apply within the useful lifetime as per 
IEC/EN 61508-2, section 7.4.7.4, note 3.
!
Note!
The manufacturer and plant owner/operator must take appropriate measures to achieve a longer service life as
per DIN EN 61508-2, note NA4.
The device's year of manufacture is coded in the first character of the serial number (table below).
Example: Serial no. E5ABBF02000  Year of manufacture 2011
10
ASCII character
Meaning
ASCII character
Meaning
ASCII character
Meaning
D
2010
K
2015
R
2020
E
2011
L
2016
S
2021
F
2012
M
2017
T
2022
H
2013
N
2018
V
2023
J
2014
P
2019
W
2024
Endress+Hauser

Proline Promass 200
Behavior of device during
operation and in case of a fault
Behavior of device during power-up
Once switched on, the device runs through a start-up phase of approx. 20 seconds. The current output is set
to error current during this time. This current is  3.6 mA in the initial seconds of this start-up phase. After
that, depending on the setting of the failure mode parameter, the current is:
– At the Min. value:  3.6 mA
– At the Max. value:  21 mA
No communication is possible via the CDI interface or via the HART protocol during the start-up phase.
Behavior of device during operation
The device outputs a current value which corresponds to the limit value to be monitored. This value must be
monitored and processed further in an attached automation system.
Device response in the event of alarms or warnings
Error current
In the event of an alarm, the output current can be configured to a value of  3.6 mA or  21 mA.
In some cases (e.g. a cable open circuit or faults in the current output itself, where the error current 21 mA
cannot be set), output currents of  3.6 mA occur irrespective of the configured error current.
In some other cases, (e.g. short-circuit of the line) output currents of  21 mA occur irrespective of the
configured error current.
For alarm monitoring, the downstream automation system must be able to recognize both maximum alarms
( 21 mA) and minimum alarms ( 3.6 mA).
Alarm and warning messages
The alarm and warning messages output on the device display or in the operating tool in the form of diagnostic
events and the associated event text are additional information.
Please refer to the Operating Instructions for an overview of diagnostic events (BA01027D, BA01112D Section
"Overview of diagnostic events").
!
Endress+Hauser
Note!
When SIL locking is active on the device, additional diagnostics are activated. If a diagnostic event occurs and
the SIL locking is then deactivated, the error message remains while the error persists, even if the diagnostic
event is no longer active in the unlocked state.
In this case, the device must be briefly disconnected from the power supply (e.g. by plugging out the terminals).
When the device is then restarted, a self-check is carried out, and the diagnostics event is reset where applicable.
11

Proline Promass 200
Installation
Installation and wiring
Installation and wiring of the device is described in the Operating Instructions, Section "Supplementary device
documentation" (ä 6).
Orientation
The permitted orientations of the device are described in the Operating Instructions: Section "Supplementary
device documentation" (ä 6). They depend, among other things, on the process conditions and the
medium used.
Commissioning
Commissioning of the device is described in the Operating Instructions: Section "Supplementary device documentation" (ä 6).
Operation
Configuration of the measuring point
Either the device display or an operating tool (e.g. FieldCare) is used to carry out basic configuration of the
measuring point. The user is guided through the "Setup" menu with the help of a wizard. This user interface
is described in the Operating Instructions: Section "Supplementary device documentation" (ä 6).
After the operating language has been selected, the following can be configured:
• Define the medium
• Configure the outputs
• Define output behavior
• Configure measured value display
• Set the low flow cut off
• Configure partial filled pipe detection
A large number of configuration parameters are available through the "Diagnostics" and "Expert" submenus for
further configuration of the measuring device in special applications. For more detailed information, please refer
to the "Description of device parameters" documentation: "Supplementary device documentation" (ä 6).
Parameter configuration for safety-related applications
To activate SIL mode, the device must run through an operating sequence, during which the device can be
operated by means of the device display or operating tool (e.g. FieldCare). While running through the commissioning sequence here, critical parameters are either set automatically by the device to standard values or transferred to the display/operating tool to enable verification of the setting.
On completion of parameter configuration, the device must be locked with a locking code.
!
Note!
The SIL commissioning sequence is only visible on the device display and external operating tools for SILlabeled devices. For this reason, SIL locking can only be activated on these devices.
Additional information on SIL labeling:
• Permitted device types (ä 5)
• SIL label on the transmitter nameplate (ä 5)
12
Endress+Hauser

Proline Promass 200
Activating SIL mode (= locking)
When SIL mode is activated, all safety-related parameter settings are shown to the operator individually and
must be confirmed explicitly. Parameter settings not permitted in SIL mode are reset to their default values
where necessary. A locking code is then entered to lock the device software to ensure that parameters cannot
be changed. Non-safety-related parameters remain unchanged.
Activation process:
1.
Check preconditions.
Setup
Partial filled
pipe detection
Current output 1
Assign
current output 1
= Mass flow
= Vol. flow
= Density
or
or
Current span
Assign
process variable
Failure mode
= Min.
= Max.
= 4...20 mA
or
= 4...20 mA NAMUR or
= 4...20 mA US
= Off
= Density
or
or
A0015325-EN
2.
Call up "Setup  Advanced setup  SIL confirmation".
3.
Enter locking code (7452).
!
Note!
The device first checks the preconditions listed under item 1. The activation sequence is not continued
if these conditions are not met.
4.
Note: The device automatically sets the following parameters to their default values:
Setup
Current output 1
Low flow cut off
Partial filled
pipe detection
Measuring mode
(4 mA value)
Assign
process variable
Response time
part. filled p. d.
=
Forward flow
=
Off
=
0
A0015326-EN
Diagnostics
Simulation
Assign simulat.
process variable
Simulation
current output 1
=
Off
=
Off
A0015327-EN
Endress+Hauser
13

Proline Promass 200
Expert
System
Sensor
Diagnostic
handling
Process
parameter
Event level
Event no.
830 to 835
Density
damping
Flow
damping
Flow
override
=
Alarm
=
0
=
0
=
Off
Sensor
Sensor
adjustment
Variable
adjustment
Mass flow
offset
Mass flow
factor
Volume flow
offset
Volume flow
factor
Density offset
Density factor
=
0
=
1
=
0
=
1
=
0
=
1
Output
Communication
Current output 1
HART
configuration
Start-up mode
HART
address
=
Min.
=
0
A0015328-EN
5.
14
To check that values are displayed correctly, the following string appears on the device display or operating tool: 0123456789+-.
The user must confirm that the values are displayed correctly.









Endress+Hauser

Proline Promass 200
6.
The device displays the current settings for the following parameters one after another for the user to confirm each of them:
Installation
direction
Assign
Current output 1
Current span
4 mA value
20 mA value
Damping
Failure mode
Select
medium
Select
gas type
(only for medium Gas)
Reference
sound velocity
Temp. coeff.
sound velocity
(only for medium Gas
and gas type Others)
(only for medium Gas
and gas type Others)
Low value
part. filled p. d.
High value
part. filled p. d.
Response time
part. filled p. d.
(only for assign
process variable ¹ Off)
(only for assign
process variable ¹ Off)
(only for assign
process variable ¹ Off)
Pressure
compensation
Pressure
value
Zero point
adjustment
Partial filled
pipe detection
(only for pressure
compensation Fixed)
A0015329-EN
7.
!
Enter locking code (7452).
Note!
The device is then locked to ensure that parameters cannot be changed inadvertently and is ready for operation.
When SIL locking is active all communication possibilities become like service interface; hart protocol and
display are limited. After the activation of SIL locking only the reading of the respective parameters is possible.
A change of the process-relevant settings is no longer possible.
8.
Recommendation: Check the position of the hardware write protection switch (dip switch marked "WP"
on main electronics), and set this switch to "On" if necessary.
Deactivating SIL mode (= unlocking)
When SIL locking is active on a device, the device is protected against unauthorized operation by means of a
locking code and, where necessary, by means of a hardware write protection switch. The device must be
unlocked in order to change parameters, for proof-tests as well as to reset self-holding diagnostic messages.
"
Caution!
Unlocking the device deactivates diagnostic functions, and the device may not be able to carry out its safety
function when unlocked. Therefore, independent measures must be taken to ensure that there is no risk of
danger while the device is unlocked.
To unlock, proceed as follows:
!
Maintenance
Endress+Hauser
1.
Check the position of the hardware write protection switch and set this switch to "Off" if necessary.
2.
Select "Setup Advanced setup Deactivate SIL.
3.
Enter the locking code (7452).
Note!
The "End of sequence" message indicates that the device was successfully unlocked.
Please refer to the relevant Operating Instructions: "Supplementary device documentation" (ä 6) for
instructions on maintenance. Alternative monitoring measures must be taken to ensure process safety during
configuration, proof-testing and maintenance work on the device.
15

Proline Promass 200
Proof-test
Proof-testing the measuring
system
Check the operativeness of safety functions at appropriate intervals. The operator must determine the time
interval and take this into account when determining the probability of failure PFDavg of the sensor system. The
functional test must be carried out in such a way that it verifies correct operation of the safety device in conjunction with all of the other components. Each test must be fully documented.
The accuracy of the measured value must first be checked in order to test the safety function (Min., Max.,
range). This involves approaching the configured limit values upon which the safety function (including actuator) should be activated.
During the proof-test, alternative monitoring measures must be taken to ensure process safety.
A proof-test of the device can be performed in the following steps:
1.
Preparation
Deactivate SIL mode (ä 15).
2.
Checking seals
Ensure that all of the electronics compartment cover seals and cable entries are providing an adequate
sealing.
3.
Checking the digital measured value gas and liquid for mass flow
One of the following tests must be carried out depending on the measured variable to be monitored and
the available equipment:
a. Test sequence A – Checking the digital measured value with a calibration rig
Mass flow
The measuring device is recalibrated using a calibration rig that is certified in accordance with ISO
17025. This can be done on an installed device using a mobile calibration rig or using factory
calibration if the device has been disassembled. The amount of deviation between the measured flow
rate and the set point must not exceed the maximum measured error specified in the Operating
Instructions.
b. Test sequence B – Checking the digital measured value using the installed totalizer
Mass flow
A measuring vessel is filled with the medium at a flow rate which approximately corresponds to the
limit value to be monitored. A calibrated scales is used to determine the change in the overall mass
in the measuring vessel before and after filling which is then compared with the totalizer installed in
the device. The amount of deviation must not exceed the maximum measured error specified in the
Operating Instructions. For range monitoring, this test must be carried out separately for the upper
and lower limit value.
4.
Checking the digital measured value liquid for volume, density
One of the following tests must be carried out depending on the measured variable to be monitored and
the available equipment:
a. Test sequence C – Checking the digital measured value with a calibration rig
Density and volume flow
The measuring device is recalibrated using a calibration rig that is certified in accordance with ISO
17025. This can be done on an installed device using a mobile calibration rig or using factory
calibration if the device has been disassembled. The amount of deviation between the measured flow
rate and the set point must not exceed the maximum measured error specified in the Operating
Instructions.
b. Test sequence D – Checking the digital measured value using the installed totalizer
Volume flow
A calibrated measuring vessel is filled with the medium at a flow rate which approximately
corresponds to the limit value to be monitored. The change in the volume in the measuring vessel is
read off before and after filling and compared with the totalizer installed in the measuring device. The
amount of deviation must not exceed the maximum measured error specified in the Operating
Instructions. For range monitoring, this test must be carried out separately for the upper and lower
limit value.
c. Test sequence E – Checking the digital measured value using liquids of known density
Density
The device's measuring pipes are filled with at least two different liquids of known density one after
the other. The digital density measured value determined in each case is compared with the actual
density of the measurement liquid. The amount of deviation must not exceed the maximum
measured error specified in the Operating Instructions.

16
Endress+Hauser

Proline Promass 200
!
Endress+Hauser
5.
Checking the temperature measurement
The medium temperature is required by the device for compensation of measured values and for diagnostic purposes. The medium temperature determined digitally by the device is compared with the measured value of a calibrated thermometer. The amount of deviation must not exceed 2 °C (4 °F).
6.
Checking the 4–20 mA current output
Using the current simulation option available in the operating menu, set the current output of the device
to the values 3.6 mA, 4.0 mA, 20.0 mA and 22.0 mA one after another and compare with the measured
values of a calibrated, external current measuring device.
7.
Checking the safety function
Correct activation of the safety function - including actuator - must be checked by outputting suitable
current values on the 4–20 mA interface per current simulation (just below and above the switch point).
For range monitoring, this test must be carried out separately for the upper and lower limit value.
8.
Completing the proof-test
Switch the 4–20 mA current output to measured value output (if necessary) and reactivate locked SIL
mode (ä 13).
Note!
98 % of dangerous, undetected failures are detected using these test sequences. If one of the test criteria from
the test sequences described above is not fulfilled, the device may no longer be used as part of a protective
system.
The influence of systematic faults on the safety function are not covered by the test and must be examined
separately. Systematic faults can be caused, for example, by medium properties, operating conditions, build-up
or corrosion.
17

Proline Promass 200
Repairs
Repairs
Repairs on the devices must always be carried out by Endress+Hauser. Safety functions cannot be guaranteed
if repairs are carried out by anybody else.
Exception:
The following components can be replaced by the customer if original replacement parts are used, the person
responsible for doing so has been trained beforehand by Endress+Hauser and if the relevant installation instructions are followed:
•
•
•
•
•
•
•
•
•
•
•
Calibrated sensor component
Replacing a transmitter without sensor
Display module
Main electronic module
I/O modules
Terminals for I/O modules
Electronics compartment cover
Seal sets for electronics compartment cover
Securing clamps for electronics compartment cover
Pressure compensation vent
Cable glands
The replaced components must be sent to Endress+Hauser for the purpose of fault analysis. Once the components have been replaced, a proof-test must be carried out (ä 16).
In the event of failure of a SIL-labeled Endress+Hauser device, which has been operated in a safety function,
the "Declaration of Contamination and Cleaning" with the corresponding note "Used as SIL device in
protection system" must be enclosed when the defective device is returned.
Please refer to the Section "Return" in the Operating Instructions: "Supplementary device
documentation" (ä 6).
18
Endress+Hauser

Proline Promass 200
Appendix
Notes on the redundant use of
multiple sensors
This section provides additional information regarding the use of homogeneously redundant sensors e.g. 1oo2
or 2oo3 architectures.
The common cause factors  and D indicated below are minimum values for the device.These must be used
when designing the sensor subsystem:
• Minimum value  for homogeneously redundant use: 2 %
• Minimum value D for homogeneously redundant use: 1 %
The device meets the requirements for SIL 3 in homogeneously redundant applications.
When installing identical sensors, i.e. the same type and nominal diameter, the sensors must not be connected
directly flange to flange but at different locations in the pipe. This is to prevent the sensors from affecting each
other acoustically.
The following must be taken into account when proof-testing:
If a fault is detected in one of the redundantly operated devices, the other devices must be checked to see if
the same fault exists.
Endress+Hauser
19

Instruments International
Endress+Hauser
Instruments International AG
Kaegenstrasse 2
4153 Reinach
Switzerland
Tel.+41 61 715 81 00
Fax+41 61 715 25 00
www.endress.com
[email protected]
SD00147D/06/EN/02.12
71188887
FM+SGML 10.0 ProMoDo