Europaabgeordneter Zu Besuch Bei Endress+Hauser

Technical Article January 2010 ______

Author: Dipl. Ing. (FH) Jessica Nentwich, Product Manager Transmitters, En- dress+Hauser Conducta, Dr. Peter Biechele CEO SafeInTrain GmbH Safety gets the all clear

World's first TÜV-certified SIL2 analytical measuring point heralds the dawn of a new era

SIL – this simple abbreviation is defined as reducing risk to a tolerable level by avoiding the introduction of faults and controlling failures. Thus, SIL instrumentation plays a key role in guaranteeing the safety of staff and ensures maximum safety for processes, plants and the environ- ment.

The world's first TÜV-certified SIL2 analytical measuring point from En- dress+Hauser provides this level of safety, while offering maximum measuring point availability at minimum cost. The measuring point will initially be available with pH glass sensors and the time-tested digital Memosens technology with an inductive plug-in head.

Once again, the Memosens and Liquiline dream-team is setting new standards since obtaining the SIL approval via TÜV imposes higher requirements for development and documentation than obtaining SIL by Proven in Use. The SIL2 pH measuring point was not only developed according to the latest IEC 61508:2010, it also already meets the latest modifications put forward by the standards committee. As such, it is perfectly prepared for the future as SIL is growing in importance as a quality feature, not only in safety-related applications.

Approval according to latest IEC 61508:2010

The IEC 61508-compliant SIL2 pH measuring point consists of three specific parts: the Orbisint CPS11D Memosens pH glass sensor, the CYK10 Memosens cable and the Liquiline M CM42 transmitter. The TÜV Süd testing and inspection authority has confirmed the SIL2 capabilities of this configuration, and has certified that the development is fully compliant with IEC 61508 specifications. In this way, the entire pH measuring point can be used as per SIL2 requirements in a protective function in a system, for example in a protective unit in process control technology, or in a quality measuring point.

01.10_Technical Article SIL2_measuring_point Page 1/6 Technical Article January 2010 ______

The approval constitutes documented evidence of conformity according to IEC 61508. This applies to all the subsystems and communication protocols used. Documentary proof was provided for the following: • Hardware capabilities with regard to SIL2 • Safety management compliance with IEC 61508 • All the certificates regarding the development of the system - par- ticularly the software - which are required for the approval.

This is also in line with the future version of IEC 61508, which deals spe- cifically with the "Proven in Use" issue and outlines the associated short- comings compared to a full approval.

The connection between the Memosens sensor and the transmitter is established by the Memosens protocol. As part of the measuring point approval, TÜV Süd confirmed the protocol as a safe protocol for inhomo- genous redundant applications with requirements up to SIL3.

As the approvals are available for both the individual instruments and for the entire measuring point, customers can choose to either deploy the entire measuring point directly, or just use individual parts of it in combination with other approved subsystems.

The information described in the following sections is general information and does not take the special process of a plant into account. This process has a major effect on the failure rate of the sensor element since the medium is in direct chemical contact with it. The sensor element itself is not an electronic component and is not subject to IEC 61508 approval requirements.

Elegant diagnostics

In addition to the standard diagnostics procedures of a safety-critical system (RAM test, ROM/Flash test, program sequence monitoring, etc. for each subsystem), the measuring point also offers additional elegant diagnostics such as the logical separate measurement of the pH value. Using such a diagnostics system, the pH value is calculated both in the sensor and the transmitter. Both calculations are routed simultaneously through the entire measuring point in a way in which they are logically separate from one another, and then output at the two physically separate current outputs. In this way, a voter must process the two current outputs as a 1oo1D ("1 out of 1 with diagnostics") system. Here, the

01.10_Technical Article SIL2_measuring_point Page 2/6 Technical Article January 2010 ______voter monitors the two signals and triggers the transition to the safe state if the signals of the two current outputs deviate from one another by more than a defined amount X for longer than a defined time T. As in the case of a non-SIL measuring point, the first current output is always used as the safe output signal of the measuring point.

Another safety-related diagnostics feature of the measuring point is the generation and monitoring of a measuring sequence counter in the sensor and transmitter, which provides a simple and efficient way of de- tecting whether the measured values "freezes".

Safety functions: Safe calibration, adjustment and measurement

The measuring point provides three safety functions: • Safe calculation of the pH value and its output at the two current outputs (using the calibration reference values). • Safe limit value monitoring • Safe onsite performance of a two-point calibration and adjustment with high quality E+H DKD accredited pH buffer solutions

Two-point calibration forms part of the safety function, as the selected reference process - here the calibration - plays a key role in calculating the pH values. For two-point calibration and operation in safe mode, the transmitter uses special patented methods to visualize these processes on the display while taking user interaction into account.

In this way, the SIL measuring point can be used like a "normal" measuring point and employed with the same operating sequences. The differ- ences are hidden from the user, and easy and intelligible guidance is provided on the display.

The Liquiline M CM42 can also be deployed directly for monitoring the pH limit value. However, the measuring point is mostly only used to en- sure that the voltage value measured at the sensor is safely transmitted to the current output of the transmitter.

The safe state

During ongoing operation, the measuring point automatically performs self-tests, and reacts to any failures detected by switching to the safe

01.10_Technical Article SIL2_measuring_point Page 3/6 Technical Article January 2010 ______state, which involves outputting the error current as defined by NAMUR NE43 for at least four seconds. This signal must then be recognized by the control system or another downstream unit and react in line with the safety function of the protective function. The failure signal is maintained until onsite operation returns the instrument to the safe operating mode.

Safety manuals and recurrent testing

For the calculations required for the entire protection function of the system, a detailed account of the individual calculated values specified by the IEC 61508/61511 is provided in the safety manuals of the individual parts of the measuring point. These values merely have to be incorporated into the calculations for the safety function of the system. For example, the manuals contain the specific PFD values (for "low-demand applications" as per IEC 61508), SFF values, failure rates (dangerous, safe, etc.), the MTBF for undetected dangerous failures etc.

Thus, the first TÜV-certified SIL2 analytical measuring point in the world is virtually as easy and convenient to use as a conventional Endress+Hauser measuring point with Memosens technology. Naturally, you can benefit from the advantages offered by the robust connection with inductive signal transmission, the digital protocol and the smart sensor head in SIL2 applications. The only condition for safe and convenient pre-calibration in the laboratory is that the lab also uses a SIL2 system.

The SIL concept was implemented in close collaboration with a number of chemical corporations, resulting in a tailor-made, customer-centric solution.

The Endress+Hauser Group

Endress+Hauser is a global leader in measurement instrumentation, services and solutions for industrial process engineering. With over 8,400 employees worldwide, the Group generates annual net sales of more than 1.2 billion euros.

Structure Company-owned sales centers and a network of partners guarantee competent worldwide support. Production centers in eleven countries meet customers’ needs and requirements quickly and effectively. As a successful family-owned business, Endress+Hauser is set for continued independence and self-reliance in the future.

Products Endress+Hauser provides sensors, instruments, systems and services for level, flow, pressure and temperature measurement as well as liquid analysis and data acquisition. The company supports customers with solutions and services in automation engineering, logistics and information technology. Our products set standards in quality and technology.

Industries Customers are primarily from the chemical/petrochemical, food & beverage, wa- ter/wastewater, life science, oil & gas, power & energy, renewable energies, pri- maries & metal, pulp & paper and shipbuilding industries. Endress+Hauser supports its customers to optimize their process engineering procedures while taking into consideration reliability, safety, economic efficiency and environmental protection.

History Founded in 1953 by Georg H Endress (1924 – 2008) and Ludwig Hauser (1895 – 1975), Endress+Hauser has been solely owned by the Endress family since 1975. The company group, headed by Klaus Endress since 1995, has developed from being a specialist in level measurement to a provider of complete solutions for industrial measuring technology and automation, with constant expansion into new territories and markets.

For further information, please visit www.press.endress.com or www.endress.com

01.10_Technical Article SIL2_measuring_point Page 6/6