Functional Safety Manual
for the Memosens transmitter Liquiline M CM42 SIL
Version:
Page:
2.0
7
of
72
A
ll
e
R
ec
h
te
v
o
rb
eh
al
te
n
.
D
as
K
o
p
ie
re
n
d
ie
se
s
D
o
k
u
m
en
ts
u
n
d
d
ie
V
er
w
en
d
u
n
g
v
o
n
T
ei
le
n
au
s
d
ie
se
m
D
o
k
u
m
en
t
is
t
o
h
n
e
sc
h
ri
ft
li
ch
e
G
en
eh
m
ig
u
n
g
d
er
E
n
d
re
ss
+
H
au
se
r
C
o
n
d
u
ct
a
G
m
b
H
+
C
o
.
K
G
n
ic
h
t
er
la
u
b
t.
A
ll
ri
gh
ts
re
se
rv
ed
.
P
as
si
n
g
o
n
an
d
co
p
yi
n
g
o
f
th
is
d
o
cu
m
en
t,
u
se
an
d
co
m
m
u
n
ic
at
io
n
o
f
it
s
co
n
te
n
ts
n
o
t
p
er
m
it
te
d
w
it
h
o
u
t
w
ri
tt
en
au
th
o
ri
za
ti
o
n
fr
o
m
E
n
d
re
ss
+
H
au
se
r
C
o
n
d
u
ct
a
G
m
b
H
+
C
o
.
K
G
.
a PLC rated SIL2 or higher), which in turn uses maybe some actors to realize the safety
function.
The Liquiline M CM42 display is not safe and therefore all operations using the display
as an interface to the user are specially secured. It has been shown, that the display
hardware and software is reactionless to the CM42 system.
The transmitter is always only a part of the complete safety function. The transmitter is
a compliant item according to IEC 61508.
1.2
Description of the application as a safety related system
To use the Liquiline M CM42 safety related system, you need for example a safe
Memosens sensor and a safe Memosens cable of Hauser Conducta GmbH &
Co. KG. The display (GUI) hardware and software of the CM42 is reactionless for the
safety function of the transmitter.
The transmitter must be connected to a safe PCS by using both analogue current
outputs. The voter can for example be realized by safe function blocks inside a PLC or
by a hardware based 2oo2 voter.
The logic component must be able to handle LO- and HI-alarms (
N
3.6mA,
O
21.0mA).
The CM42 system has several
modes of operation
:
1.
Classic mode
2.
SIL mode – Active safe state mode (referred to as "active safe state")
3.
SIL mode – SIL measurement mode
4.
SIL mode – Passive safe state mode (referred to as "passive safe state")
In Classic mode
the system behaves almost like a traditional well-known CM42 system.
It is NOT executing any safety related functions and can therefore NOT be used in a
safety chain in this mode!
In Active safe state mode
the system produces the error current on the current outputs
and waits for a manual switch to the SIL measurement mode or the Classic mode.
In SIL measurement mode
the system is executing the safety function SAF1 or SAF2
(see later on). Only in this mode, the system operates in a safe manner and only in this
mode you can start a safe calibration or adjustment (SAF3/SAF4 – see later on).
In Passive safe state
mode the system is staying in the safe state until you restart/reset
the system physically.
Attention
:
The transmitter must be switched to the SIL measurement mode, only then the safety
function is active. Without switching the system to SIL measurement mode, the system
