FY01102T/09/EN/01.23-00
71639662
2023-04-24

Products

Solutions

Functional Safety Manual
iTHERM ModuLine TM131,
iTHERM ModuLine TM151

Services

iTHERM ModuLine TM131, iTHERM ModuLine TM151

Table of contents

Table of contents
1

Declaration of Conformity . . . . . . . . . . . 4

5.2

1.1
1.2

Safety-related characteristic values . . . . . . . . . . 6
Use as a safe measuring system . . . . . . . . . . . . 8
1.2.1 Code number for TM131/TM151
with TMT82/TMT162 . . . . . . . . . . . . . 8

5.3
5.4
5.5

Device behavior when safety function isrequested . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Safe states . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Behavior of device in the event of an alarm
and warnings . . . . . . . . . . . . . . . . . . . . . . . . . 19
Alarm and warning messages . . . . . . . . . . . . . 20

2

About this document . . . . . . . . . . . . . . . . 9

2.1
2.2

Document function . . . . . . . . . . . . . . . . . . . . . 9
Symbols used . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2.2.1 Safety symbols . . . . . . . . . . . . . . . . . . 9
2.2.2 Symbols for certain types of
information and graphics . . . . . . . . . 10
Supplementary device documentation . . . . . . . 10
2.3.1 Further applicable documents . . . . . . 10
2.3.2 Technical Information (TI) . . . . . . . . 10
2.3.3 Brief Operating Instructions (KA) . . . . 11
2.3.4 Operating Instructions (BA) . . . . . . . . 11
2.3.5 Safety Instructions (XA) . . . . . . . . . . . 11
2.3.6 Functional Safety Manual (FY) . . . . . . 11

6

Proof testing . . . . . . . . . . . . . . . . . . . . . . 20

6.1
6.2
6.3
6.4

Test sequence A . . . . . . . . . . . . . . . . . . . . . . . 21
Test sequence B . . . . . . . . . . . . . . . . . . . . . . . 21
Test sequence C . . . . . . . . . . . . . . . . . . . . . . . 21
Verification criterion . . . . . . . . . . . . . . . . . . . 21

7

Repair and error handling . . . . . . . . . . 22

7.1
7.2
7.3
7.4
7.5

Maintenance . . . . . . . . . . . . . . . . . . . . . . . . .
Repair . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Modification . . . . . . . . . . . . . . . . . . . . . . . . .
Decommissioning . . . . . . . . . . . . . . . . . . . . .
Disposal . . . . . . . . . . . . . . . . . . . . . . . . . . . .

3

Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

8

Appendix . . . . . . . . . . . . . . . . . . . . . . . . . 23

3.1

Permitted device types . . . . . . . . . . . . . . . . . . 11
3.1.1 Ordering features . . . . . . . . . . . . . . . 12
Identification marking . . . . . . . . . . . . . . . . . . 13
Safety function . . . . . . . . . . . . . . . . . . . . . . . 13
3.3.1 Safety-related output signal . . . . . . . . 13
3.3.2 Safe measurement . . . . . . . . . . . . . . 13
Basic conditions for use in safety-related
applications . . . . . . . . . . . . . . . . . . . . . . . . . . 14
3.4.1 Safety-related failures according to
IEC/EN 61508 . . . . . . . . . . . . . . . . . 14
3.4.2 Restrictions for safety-related use . . . 15
Dangerous undetected failures in this
scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Safety measured error . . . . . . . . . . . . . . . . . . 16
Useful lifetime of electrical components . . . . . 16

8.1

Structure of the measuring system . . . . . . . . . 23
8.1.1 System components . . . . . . . . . . . . . . 23
8.1.2 Description of use as a safety
instrumented system . . . . . . . . . . . . . 24
8.1.3 Measurement function . . . . . . . . . . . 25
8.1.4 Limit value monitoring . . . . . . . . . . . 26
Commissioning or proof test report . . . . . . . . 26
8.2.1 Test Report - Page 1 - . . . . . . . . . . . . 27
8.2.2 Test Report - Page 2 - . . . . . . . . . . . . 28
8.2.3 Test Report - Page 3 - . . . . . . . . . . . . 29
8.2.4 Parameter settings for the SIL mode . . 30

2.3

3.2
3.3
3.4

3.5
3.6
3.7

4

Commissioning (installation andconfiguration) . . . . . . . . . . . . . . . . . . . . 17

4.1
4.2
4.3
4.4
4.5

Requirements for personnel . . . . . . . . . . . . . . 17
Installation . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Commissioning . . . . . . . . . . . . . . . . . . . . . . . 17
Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Parameter configuration for safety-related
applications . . . . . . . . . . . . . . . . . . . . . . . . . . 18
4.5.1 Adjustment of the measuring point . . 18
4.5.2 Locking in Expert mode . . . . . . . . . . . 18
4.5.3 Unlocking a SIL device . . . . . . . . . . . . 18

5Operation . . . . . . . . . . . . . . . . . . . . . . . . . 19

5.1

Device behavior during power-up . . . . . . . . . . 19

Endress+Hauser

8.2

22
22
23
23
23

3

Declaration of Conformity

iTHERM ModuLine TM131, iTHERM ModuLine TM151

1

Declaration of Conformity
This declaration only applies to the measurement of the sensor temperature itself. As
already mentioned in Section 1.2 →  8, the transmitters must be combined with
an appropriate sensor; see Section 3.1.1, Feature 110: →  12.
The customer is responsible for avoiding systematic faults between processtemperature and sensor temperature. An assessment must be carried out todetermine an appropriate combination of features from Section 3.1 →  11.
As mentioned in Section 6.4 →  21, systematic faults are not covered by thisdocument. In addition, dynamic faults (delay between process and sensor
temperature) must be taken into account separately.
Section 4.1 on mounting requirements from the Operating Instructions must be
observed.
Detailed information:
Operating Instructions iTHERM ModuLine: BA01915T

4

Endress+Hauser

iTHERM ModuLine TM131, iTHERM ModuLine TM151

Declaration of Conformity

A0054578

Endress+Hauser

5Declaration of Conformity

iTHERM ModuLine TM131, iTHERM ModuLine TM151

1.1

Safety-related characteristic values

A0054579

6

Endress+Hauser

iTHERM ModuLine TM131, iTHERM ModuLine TM151

Declaration of Conformity

A0054580

Endress+Hauser

7Declaration of Conformity

iTHERM ModuLine TM131, iTHERM ModuLine TM151

1.2

Use as a safe measuring system

To implement a safe measuring system, you must combine the temperature transmitterwith a suitable sensor (see Section 3.1.1 →  12). The code numbers required for thesystem design for one year can be found in the following tables.

1.2.1

Code number for TM131/TM151 with TMT82/TMT162

Single channel operation
Transmitter

Sensor

Thermocouple

RTD
2/3 wire

l du
l dd
l su
l sd

ldd

l su

l sd

SFF

PFD

258 FIT129 FIT

4 FIT

91%

1.8 · 10-4

Sensor +Field
Transmitter

SensorSensor +Field
Transmitter

SensorSensor +Field
Transmitter

SensorField
Transmitter

2180 FIT

2220 FIT

Sensor +6 FIT

46 FIT

119 FIT

159 FIT109 FIT149 FIT

94 FIT

352 FIT

1881 FIT

2139 FIT

891 FIT1149 FIT 17820 FIT 18078 FIT

0 FIT

129 FIT

0 FIT

129 FIT

0 FIT

129 FIT

0 FIT

129 FIT

0 FIT

4 FIT

0 FIT

4 FIT

0 FIT

4 FIT

0 FIT

4 FIT

SFF

94% 94% / 91%

94% 94% / 91%

89% 89% / 91%

89% 89% / 91%

PFD

2.0 · 10-4

7.0 · 10-4

6.5 · 10-4

9.7 · 10-3

139 FIT634 FIT129 FIT
0 FIT1976 FIT 2016 FIT
7524 FIT 7782 FIT
0 FIT
129 FIT
0 FIT
4 FIT

l du
l dd
l su
l sd
SFF
PFD

RTD
4 wirel du
40 FIT

l du
l dd
l su
l sd
SFF
PFD

9 FIT
39 FIT
0 FIT
0 FIT

49 FIT
297 FIT129 FIT
4 FIT

181 FIT779 FIT
0 FIT
0 FIT

221 FIT1037 FIT
129 FIT
0 FIT

99 FIT376 FIT
0 FIT
0 FIT

81% 81% / 91%

81% 81% / 91%

79% 79% / 91%

79% 79% / 91%

2.1 · 10-4

9.7 · 10-4

6.1 · 10-4

8.8 · 10-3

6 FIT
44 FIT
0 FIT
0 FIT

46 FIT
302 FIT129 FIT
4 FIT

129 FIT871 FIT
0 FIT
0 FIT

169 FIT1129 FIT
129 FIT
4 FIT

74 FIT426 FIT
0 FIT
0 FIT

114 FIT684 FIT129 FIT
4 FIT

1486 FIT
8514 FIT
0 FIT
0 FIT

1526 FIT
8772 FIT
129 FIT
4 FIT

87% 87% / 91%

87% 87% / 91%

85% 85% / 91%

85% 85% / 91%

2.0 · 10-4

7.4 · 10-4

5.0 · 10-4

6.7 · 10-3

A

SFF
HFT
< 60%
60% - < 90%
90% - < 99%
>99%

0
SIL1
SIL2
SIL3
SIL3

1
SIL2
SIL3
SIL4
SIL4

B
2
SIL3
SIL4
SIL4
SIL4

0
--SIL1
SIL2
SIL3

1
SIL1
SIL2
SIL3
SIL4

2
SIL2
SIL3
SIL4
SIL4

1 FIT = 1·10-9 h
PFD< 2.5 · 10-3
> 2.5 · 10-3
> 1 · 10-2
A0054243

8

Endress+Hauser

iTHERM ModuLine TM131, iTHERM ModuLine TM151

About this document

Two channel operation

Sensor

l du
l dd
l su
l sd

l du

ldd

l su

l sd

SFF

PFD

40 FIT

258 FIT129 FIT

4 FIT

91%

1.8 · 10-4

Sensor +Transmitter

SensorSensor +Transmitter

SensorSensor +Transmitter

SensorSensor +Transmitter

3160 FIT

3200 FIT

11 FIT

51 FIT

70 FIT

110 FIT

158 FIT

198 FIT

189 FIT447 FIT

3786 FIT

4044 FIT

1842 FIT

2100 FIT 36840 FIT 37098 FIT

0 FIT

129 FIT

0 FIT

129 FIT

0 FIT

129 FIT

0 FIT

129 FIT

0 FIT

4 FIT

0 FIT

4 FIT

0 FIT

4 FIT

0 FIT

4 FIT

SFF

95% 95% / 91%

98% 98% / 91%

92% 92% / 91%

92% 92% / 91%

PFD

2.2 · 10-4

4.8 · 10-4

8.7 · 10-4

1.4 · 10-2

l du
l dd
l su
l sd
SFF
PFD

l du
l dd
l su
l sd
SFF
PFD

8 FIT

48 FIT

154 FIT194 FIT

84 FIT

124 FIT

88 FIT346 FIT

1662 FIT

2024 FIT

866 FIT1124 FIT 17328 FIT 17586 FIT

1672 FIT

1712 FIT

0 FIT

129 FIT

0 FIT

129 FIT

0 FIT

129 FIT

0 FIT

129 FIT

0 FIT

4 FIT

0 FIT

4 FIT

0 FIT

4 FIT

0 FIT

4 FIT

92% 92% / 91%

92% 92% / 91%

91% 91% / 91%

91% 91% / 91%

2.1 · 10-4

8.5 · 10-4

5.4 · 10-4

7.5 · 10-3

9 FIT
139 FIT
0 FIT
0 FIT

49 FIT
397 FIT129 FIT
4 FIT

184 FIT2776 FIT
0 FIT
0 FIT

224 FIT3034 FIT
129 FIT
4 FIT

121 FIT1354 FIT
0 FIT
0 FIT

161 FIT 2416 FIT 2456 FIT
1612 FIT 27084 FIT 27342 FIT
129 FIT
0 FIT
129 FIT
4 FIT
0 FIT
4 FIT

94% 94% / 91%

94% 94% / 91%

92% 92% / 91%

92% 92% / 91%

2.2 · 10-4

9.8 · 10-4

7.0 · 10-4

1.1 · 10-2

A

SFF
HFT
< 60%
60% - < 90%
90% - < 99%
>99%

0
SIL1
SIL2
SIL3
SIL3

1
SIL2
SIL3
SIL4
SIL4

B
2
SIL3
SIL4
SIL4
SIL4

0
--SIL1
SIL2
SIL3

1
SIL1
SIL2
SIL3
SIL4

2
SIL2
SIL3
SIL4
SIL4

1 FIT = 1·10-9 h
PFD< 2.5 · 10-3
> 2.5 · 10-3
> 1 · 10-2
A0053692

2

About this document

2.1

Document function

This supplementary Safety Manual applies in addition to the Operating Instructions,Technical Information and ATEX Safety Instructions. The supplementary device
documentation must be observed during installation, commissioning and operation. The
requirements specific to the protection function are described in this safety manual.
General information on functional safety (SIL) is available at:www.endress.com/SIL

2.2

Symbols used

2.2.1

Safety symbols

DANGER

This symbol alerts you to a dangerous situation. Failure to avoid this situation will result inserious or fatal injury.
WARNING

This symbol alerts you to a dangerous situation. Failure to avoid this situation can result inserious or fatal injury.

Endress+Hauser

9About this document

iTHERM ModuLine TM131, iTHERM ModuLine TM151

CAUTION

This symbol alerts you to a dangerous situation. Failure to avoid this situation can result inminor or medium injury.
NOTICE

This symbol contains information on procedures and other facts which do not result inpersonal injury.

2.2.2

Symbols for certain types of information and graphics

Tip
Indicates additional information
Reference to documentation
Reference to graphic
Notice or individual step to be observed
1. , 2. , 3.
Series of steps

Result of a step
1, 2, 3, ...
Item numbers
A, B, C, ...
Views

2.3

Supplementary device documentation
For an overview of the scope of the associated Technical Documentation, refer to thefollowing:• Device Viewer (www.endress.com/deviceviewer): Enter the serial number from thenameplate• Endress+Hauser Operations app: Enter serial number from nameplate or scanmatrix code on nameplate.

The following document types are available in the download area of the Endress+Hauser
website (www.endress.com/downloads):

2.3.1

Further applicable documents• BA01915T, Modular thermometers• TI01373T, TM131• TI01707T, TM151• XA00044R, TM1x1• XA01799T, TM1x1• XA01817T, TM111 + TM131• SD01172T/FY01105T, TMT82• SD01632T/FY01106T, TMT162• SD02427T, TM131

2.3.2

Technical Information (TI)

Planning aid
The document contains all the technical data on the device and provides an overview of
the accessories and other products that can be ordered for the device.
10

Endress+Hauser

iTHERM ModuLine TM131, iTHERM ModuLine TM151

2.3.3

DesignBrief Operating Instructions (KA)

Guide that takes you quickly to the 1st measured value
The Brief Operating Instructions contain all the essential information from incoming
acceptance to initial commissioning.

2.3.4

Operating Instructions (BA)Your reference guide
These Operating Instructions contain all the information that is required in various phasesof the life cycle of the device: from product identification, incoming acceptance andstorage, to mounting, connection, operation and commissioning through totroubleshooting, maintenance and disposal.

2.3.5

Safety Instructions (XA)

Depending on the approval, the following Safety Instructions (XA) are supplied with thedevice. They are an integral part of the Operating Instructions.
The nameplate indicates the Safety Instructions (XA) that are relevant to the device.

2.3.6

Functional Safety Manual (FY)

Depending on the SIL approval, the Functional Safety Manual (FY) is an integral part of
the Operating Instructions and applies in addition to the Operating Instructions, Technical
Information and ATEX Safety Instructions.
The different requirements that apply for the protective function are described in the
Functional Safety Manual (FY).

3

Design3.1

Permitted device types

The details pertaining to functional safety in this manual relate to the device versions
listed below and are valid as of the specified firmware and hardware versions.
Unless otherwise specified, all subsequent versions can also be used for safety functions.
A modification process according to IEC 61508 is applied for device changes.
Valid device versions for safety-related use:

Endress+Hauser

11Design

iTHERM ModuLine TM131, iTHERM ModuLine TM151

3.1.1

Ordering features

Product root: TM131-

Product root: TM151-

Feature: 010 "Approval"
Version: all

Feature: 010 "Approval"
Version: all

Feature: 020 "Thermowell"
Version: all

Feature: 020 "Thermowell"
Version: all

Feature: 030 "Thermometer structure"
Version: all

Feature: 030 "Thermometer structure"
Version: all

Feature: 050 "Process connection; material"
Version: all

Feature: 040 "Thermowell material"
Version: all

Feature: 060 "Thermowell diameter; material"
Version: all

Feature: 050 "Process/thermowell connection"
Version: all

Feature: 070 "Shape of tip"
Version: all

Feature: 060 "Immersion length U"
Version: all

Feature: 080 "Immersion length U"
Version: all

Feature: 070 "Geometry of parts in contact withmedium"Version: all

Feature: 090 "Removable extension neck, length E"
Version: all
Feature: 100 "Thermowell lagging, length T"
Version: all
Feature: 110 "Sensor type; measuring range;material"
Version: all except Y
Feature: 130 "Sensor standard; classification"
Version: all
Feature: 140 "Electrical connection"
Version: only 2E, 2G, 3D, 3F
Feature: 150 "Terminal head; material; degree ofprotection"
Version: all
Feature: 170 "Cable entry terminal head"
Version: all
Feature: 480 "Device model"
Version: all
Feature: 560 "Second transmitter (mounted)"
Version: only 2E, 2G, 3D, 3F
Feature: 570 "Service"
Version: all
Feature: 580 "Test, certificate, declaration"
Version: all
Feature: 590 "Additional approval"
Version: only LA
Feature: 600 "Additional option"
Version: all
Feature: 610 "Accessory mounted"
Version: all
Feature: 630 "Thermometer calibration"
Version: all
Feature: 640 "Calibration points >= 0 oC"
Version: all
Feature: 650 "Calibration points <= 0 oC"
Version: all
Feature: 850 "Firmware version"
Version: none
Feature: 895 "Marking"Version: all

12

Feature: 080 "Thermowell lagging, length T"
Version: all
Feature: 090 "Removable extension neck, length E"
Version: all
Feature: 100 "Sensor type; measuring range;material"
Version: all except Y
Feature: 110 "Sensor standard; classification"
Version: all
Feature: 120 "Electrical connection"
Version: only 2E, 2G, 3D, 3F
Feature: 130 "Terminal head; material; degree ofprotection"
Version: all
Feature: 140 "Cable entry terminal head"
Version: all
Feature: 480 "Device model"
Version: all
Feature: 500 "Additional design options"
Version: all
Feature: 520 "Special Root Diameter D1"
Version: all
Feature: 530 "Special Tip Diameter D2"
Version: all
Feature: 540 "Special Bore Diameter Di"
Version: all
Feature: 545 "Special Tip Thickness B"
Version: all
Feature: 550 "Thermometer Connection Ge1"
Version: all
Feature: 560 "Second transmitter (mounted)"
Version: only 2E, 2G, 3D, 3F
Feature: 570 "Service"
Version: all
Feature: 580 "Test, certificate, declaration"
Version: all
Feature: 590 "Additional approval"
Version: only LA
Feature: 600 "Additional option"
Version: all

Endress+Hauser

iTHERM ModuLine TM131, iTHERM ModuLine TM151

Product root: TM131-

DesignProduct root: TM151Feature: 610 "Accessory mounted"
Version: all
Feature: 630 "Thermometer calibration"
Version: all
Feature: 640 "Calibration points >= 0 oC"
Version: all
Feature: 650 "Calibration points <= 0 oC"
Version: all
Feature: 850 "Firmware version"
Version: none
Feature: 895 "Marking"Version: all

Valid firmware version:• TMT162 from 04.01.00 or higher• TMT82 from 01.02.00 or higher
Valid hardware version (electronics):• TMT162 from 04.01.00 or higher• TMT82 head transmitter from 01.00.07 or higher• TMT82 DIN rail transmitter from 01.00.04 or higher

3.2

Identification marking

SIL-certified devices are marked with the SIL logo

3.3

on the nameplate.

Safety function

The device's safety function is that of carrying out safe measurement. The safety function
involves measuring the temperature of a medium.

3.3.1

Safety-related output signal

The device's safety-related signal is the 4 to 20 mA analog output signal as per NAMUR
NE43. All safety measures refer to this signal exclusively.
In addition, the device also communicates via HART® for information purposes andcomprises all the HART® features with additional device information. HART®
communication is not part of the safety function.
The safety-related output signal is fed to a downstream logic unit, e.g. a programmable
logic controller or a limit signal transmitter, where it is monitored for the following:• Overshooting and/or undershooting of a specified limit value• To establish the occurrence of a fault, e.g. failure current (≤ 3.6 mA, ≥ 21 mA), signal
cable disconnection or short-circuit
In the event of a fault, it must be ensured that the equipment under control achieves
or maintains a safe state.

3.3.2

Safe measurement

The transmitter's safety function comprises a transmitted current output signal that is
proportional to the temperature value.
All safety functions can be used in combination with all sensor configurations from the"Structure of the measuring system" section→  23. Note here that only the measured

Endress+Hauser

13

Design

iTHERM ModuLine TM131, iTHERM ModuLine TM151

value of one sensor or the output of a function (e.g. the averaging or differential function)
can ever be displayed via the current output.

3.4

Basic conditions for use in safety-related applications

The measuring system must be used correctly for the specific application, taking into
account the medium properties and ambient conditions. Carefully follow instructions
pertaining to critical process situations and installation conditions from the Operating
Instructions. The application-specific limits must be observed. The specifications in the
Operating Instructions and the Technical Information must not be exceeded.

3.4.1

Safety-related failures according to IEC/EN 61508
I [mA]
2
1

3
A

4
B

3
C
t
A0034924

A
B
C

High alarm ≥ 21 mA
SIL error range ±2%
Low alarm ≤3.6 mA

No device error• No error• Implications for the safety-related output signal: none
• Impact on the measurement uncertainty:
1 – Within the specification, For detailed information, see TI/BAλS (Safe)• Safe failure• No impact on the safety-related output signal:
2 – Moves within the specified SIL error range• Output signal enters the safe state• Impact on the measurement uncertainty:
2 – Moves within the specified SIL error range
3 – Has no effectλDD (Dangerous detected)• Dangerous failure which can be detected• Impact on the safety-related output signal: results in a failure mode at the output signal• Impact on the measurement uncertainty:
3 – Has no effect14

Endress+Hauser

iTHERM ModuLine TM131, iTHERM ModuLine TM151

DesignλDU (Dangerous undetected)• Dangerous failure which cannot be detected• Implications for the safety-related output signal: can be outside the defined error range• Impact on the measurement uncertainty:
4 – May be outside the specified error range

3.4.2

Restrictions for safety-related use

Basic conditions and restrictions for the device:
Sensors, wiring scheme and temperature ranges• StrongSens resistance sensor• Temperature range –50 to +400 °C, 4-wire connection• Range of validity of accuracy classes:
Class B: –50 to +400 °C
Class A: –30 to +300 °C
Class AA: 0 to +150 °C• Wire wound (WW) resistance sensor• Temperature range –200 to +400 °C,
Single sensor element, 4-wire connection,
Double sensor element, 2x3-wire connection,• Range of validity of accuracy classes:
Class B: –200 to +400 °C
Class A: –100 to +400 °C
Class AA: –50 to +250 °C• Thermocouple type J
Single or double elements 0 to +600 °C• Thermocouple type K or N
Single or double elements 0 to +800 °C• Acceleration from vibrations at the measuring element, maximum 2g
The following restriction also applies for safety-related use:
• Strong, pulse-like EMC interference on the power supply line can cause transient (<1 s)deviations in the output signal (≥±1 %). For this reason, filtering with a time constant of≥ 1 s should be performed in the downstream logic unit.
• The specified error range (safety measured error, ) is sensor-specific and is definedaccording to FMEDA (Failure Modes, Effects and Diagnostic Analysis) on delivery. It
already includes all influencing factors described in the Technical Information TI (nonlinearity, non-repeatability, hysteresis, zero drift, temperature drift). The safety-related
failures are classified into different categories according to IEC/EN 61508 (see thefollowing table). The table shows the implications for the safety-related output signal
and the measurement uncertainty.
Response times:• The information regarding typical response times is based on a measurement according
to DIN EN 60751 in water with a flow velocity of 0.4 m/s.
• The response time t90 is indicated. This is the time the temperature sensor needs toindicate 90 % of the temperature increase.
• The total response time comprises the response time of the temperature sensor
including the thermowell and the response time of the temperature transmitter, and isindicated in the Operating Instructions (Supplementary Documentation ) of thetransmitters and thermometers ("Technical data" section).
Comments:
These are typical values from standard design (according to DIN 43772, for example) andshould be used as reference values.
Prior to using the thermometer, the user must check whether the entire response time forthe particular application guarantees the safe shutdown of the entire system.

Endress+Hauser

15

Design

iTHERM ModuLine TM131, iTHERM ModuLine TM151

3.5

Dangerous undetected failures in this scenario

An incorrect output signal that deviates from the value specified in this manual but is stillin the range of 4 to 20 mA, is considered a "dangerous, undetected failure".

3.6

Safety measured error

Permitted temperature ranges for resistance sensors in conjunction with SIL:
Temperature ranges
Sensor typeClass BClass AClass AA

Pt100 (TF)
iTHERM® StrongSens–50 to +400 °C(–58 to +752 °F)–30 to +300 °C(–22 to +572 °F)

0 to 150 °C(–58 to +302 °F)

Wire wound sensor(WW)–200 to 400 °C(–328 to 752 °F)–100 to 400 °C(–328 to 742 °F)–50 to 250 °C(–58 to 482 °F)

Permitted temperature ranges for thermocouples in conjunction with SIL:
Sensor type according to IEC 60584 / ASTM E230 / ANSI MC96.1

Class 1 and 2 / special and standard

J (Fe-CuNi)

0 to 600 °C (32 to 1 112 °F)

K (NiCr-NiAl)
N (NiCrSi-NiSi)

0 to 800 °C (32 to 1 472 °F)

Detailed information:• Technical Information iTHERM ModuLine TM131: TI01373T• Technical Information iTHERM ModuLine TM151: TI01707T
Detailed information:• Functional Safety Manual TMT82: SD01172T/FY01105T• Functional Safety Manual TMT162: SD01632T/FY01106T
These values do not take into account deviations caused by EMC. In the event of nonnegligible EMC interference, an additional deviation of 1% from the span must be added to
the values above.
Validity of data for safety measured error:• Total permitted temperature range of the transmitter in the SIL mode
• Defined range of the supply voltage• Limited safety measuring range of sensor element• Accuracy includes all linearization and rounding errors• Observe the minimum measuring span of each sensor.
• Values are 2σ values, i.e. 95.4 % of all measured values are within the specifications

3.7

Useful lifetime of electrical components

The established failure rates of electrical components apply within the useful lifetime as
per IEC 61508-2:2010 section 7.4.9.5 note 3.
In accordance with DIN EN 61508-2:2011 section 7.4.9.5 (national footnote N3),
appropriate measures taken by the manufacturer and operator can extend the useful
lifetime.

16

Endress+Hauser

iTHERM ModuLine TM131, iTHERM ModuLine TM151

Commissioning (installation and configuration)

However, the useful lifetime may be significantly shorter if the device is operated at higher
temperatures or outside specifications.
Detailed information:• Functional Safety Manual TMT82: SD01172T/FY01105T• Functional Safety Manual TMT162: SD01632T/FY01106T
As the maximum application temperature influences the drift behavior of the sensors, a
recalibration should be performed or the inserts should be replaced at defined intervals forreliable and accurate temperature measurement. Typical intervals are listed in thefollowing table:
Max. application temperature

Resistance thermometer

Thermocouple

200 °C (392 °F)

5 years

5 years

400 °C (752 °F)

2 years

2 years

600 °C (1 112 °F)-

2 years

800 °C (1 472 °F)-

1 year

The testing intervals indicated here are suggestions. Special conditions at the place of use
may require the user to significantly shorten the application duration.

4

Commissioning (installation andconfiguration)

4.1

Requirements for personnel

The personnel for installation, commissioning, diagnostics and maintenance must fulfill
the following requirements:‣ Trained, qualified specialists must have a relevant qualification for this specific function
and task.
‣ Personnel must be authorized by the plant owner/operator.
‣ Be familiar with federal/national regulations.
‣ Before starting work: personnel must read and understand the instructions in the
manual and supplementary documentation as well as the certificates (depending on
the application).
‣ Personnel must follow instructions and comply with general policies.
The operating personnel must fulfill the following requirements:‣ Personnel are instructed and authorized according to the requirements of the task by
the facility's owner-operator.

‣ Personnel follow the instructions in this manual.

4.2

Installation

The mounting and wiring of the device and the permitted orientations are described in the
Operating Instructions pertaining to the device.
Correct installation is a prerequisite for safe operation of the device.

4.3

Commissioning

The commissioning of the device is described in the Operating Instructions pertaining to
the device.
Endress+Hauser

17Commissioning (installation and configuration)

iTHERM ModuLine TM131, iTHERM ModuLine TM151

Prior to operating the device in a safety instrumented system, verification must be
performed by carrying out a test sequence as described in Section 6 Proof testing.

4.4

Operation

The operation of the device is described in the Operating Instructions pertaining to thedevice.
Detailed information:• Functional Safety Manual TMT82: SD01172T/FY01105T• Functional Safety Manual TMT162: SD01632T/FY01106T

4.5

Parameter configuration for safety-related
applications

4.5.1

Adjustment of the measuring point

Adjustment of the measuring point is described in the Operating Instructions.
Check that the factory settings for the parameters are correct to suit the desired measuring
range and correct if necessary.
Detailed information:• Functional Safety Manual TMT82: SD01172T/FY01105T• Functional Safety Manual TMT162: SD01632T/FY01106T
Device protection
The devices can be protected against external influences as follows:• Hardware write protection• Software write protection
The use of these methods is described in the following documents.
Detailed information:• Functional Safety Manual TMT82: SD01172T/FY01105T• Functional Safety Manual TMT162: SD01632T/FY01106T

4.5.2

Locking in Expert mode

The procedure for activating SIL locking on a device is described in the following
documents.
Detailed information:• Functional Safety Manual TMT82: SD01172T/FY01105T• Functional Safety Manual TMT162: SD01632T/FY01106T

4.5.3

Unlocking a SIL device

When SIL locking is active on a device, the device is protected against unauthorized
operation by means of a locking code and, as an additional option, by means of a hardware
write protection switch. The device must be unlocked to change parameter configuration.

LCAUTION‣ Unlocking the device deactivates diagnostic functions, and the device may not be able

to carry out its safety function when unlocked. Therefore, independent measures must
be taken to ensure that there is no risk of danger while the device is unlocked.

18

Endress+Hauser

iTHERM ModuLine TM131, iTHERM ModuLine TM151

Operation

The procedure for unlocking the device is described in the following documents.
Detailed information:• Functional Safety Manual TMT82: SD01172T/FY01105T• Functional Safety Manual TMT162: SD01632T/FY01106T

5

Operation

5.1

Device behavior during power-up

The behavior of the device when powered up is described in the relevant Operating
Instructions.
Detailed information:• Functional Safety Manual TMT82: SD01172T/FY01105T• Functional Safety Manual TMT162: SD01632T/FY01106T

5.2

Device behavior when safety function is requested

The device outputs a current value corresponding to the limit value to be monitored. Thisvalue must be monitored and processed further in a connected logic unit.
Detailed information:• Functional Safety Manual TMT82: SD01172T/FY01105T• Functional Safety Manual TMT162: SD01632T/FY01106T

5.3

Safe states

The system adopts the safe state depending on the error detected. The behavior of thedevice is described in the corresponding Safety Manuals:
Detailed information:• Functional Safety Manual TMT82: SD01172T/FY01105T• Functional Safety Manual TMT162: SD01632T/FY01106T
Safe state / output current:• I ≤ 3.6 mA (Low alarm)or• I ≥ 21.5 mA (High alarm)

5.4

Behavior of device in the event of an alarm andwarnings

The output current on alarm can be set to a value of ≤ 3.6 mA or ≥ 21 mA. In some cases(e.g. failure of power supply, a cable open circuit and faults in the current output itself,
where the failure current ≥ 21 mA cannot be set), output currents ≤ 3.6 mA can occur
irrespective of the configured failure current.
In some other cases (e.g. short circuit of cabling), output currents ≥ 21 mA occur
irrespective of the configured failure current.
For alarm monitoring, the downstream logic unit must therefore be able to detect HI
alarms (≥ 21 mA) and LO alarms (≤ 3.6 mA).

Endress+Hauser

19

Proof testing

iTHERM ModuLine TM131, iTHERM ModuLine TM151

5.5

Alarm and warning messages

The behavior of the device in the event of an alarm and warnings is described in therelevant Operating Instructions.
Detailed information:• Functional Safety Manual TMT82: SD01172T/FY01105T• Functional Safety Manual TMT162: SD01632T/FY01106T
Additional information is provided by the alarm and warning messages in the form oferror codes and associated plain text messages. The relationship between the error codeand diagnostic behavior is described in the table in the "Diagnostics and troubleshooting"chapter in the corresponding transmitter operating instructions.
Detailed information:• Operating Instructions iTEMP TMT82: BA01028T, Section 12.2.2• Operating Instructions iTEMP TMT162: BA01801T, Section 9.3

6

Proof testing
The safety-related functionality of the device in the SIL mode must be verified duringcommissioning, when changes are made to safety-related parameters, and also at
appropriate time intervals. This enables this functionality to be verified within theentire safety instrumented system. The time intervals must be specified by theoperator.

LCAUTION
The safety function is not guaranteed during a proof test
Suitable measures must be taken to guarantee process safety during the test.
‣ The safety-related output signal 4 to 20 mA must not be used for the safety
instrumented system during testing.
‣ A completed test must be documented; the reports provided in the Appendix can beused for this purpose (see Section 8.2).
‣ The operator specifies the test interval and this must be taken into account when
determining the probability of failure PFDavg of the sensor system.
If no operator-specific proof testing requirements have been defined, the following is apossible alternative for testing the transmitter depending on the measured variable used
for the safety function.
For information on the test procedures for the transmitters, refer to the associated safety
documents.
Detailed information:• Functional Safety Manual TMT82: SD01172T/FY01105T• Functional Safety Manual TMT162: SD01632T/FY01106T
The following inspections are recommended at regular intervals for the device:
Component: terminal head
Visual inspection of the head and gaskets for damage and wear
Component: insert
The insulation resistance of the measuring circuit in relation to the protection fitting must
be measured every 12 months (only for non-grounded sensors in the case ofthermocouples; in the case of several sensors the insulation check must also be performed
between the individual circuits). The minimum insulation resistance at room temperature
should be 100 MΩ at 100 V.

20

Endress+Hauser

iTHERM ModuLine TM131, iTHERM ModuLine TM151

Proof testing

Component: thermometer thermowell• Visual inspection of the thermowell and extension neck for damage, leaks, corrosion andwear.
• Visual inspection of sealing points for leaks.

6.1

Test sequence A

Proof testing procedure
The procedure for performing the proof test is described in the following documents.
Detailed information:• Functional Safety Manual TMT82: SD01172T/FY01105T• Functional Safety Manual TMT162: SD01632T/FY01106T

6.2

Test sequence B

Proof testing procedure
The procedure for performing the proof test is described in the following documents.
Detailed information:• Functional Safety Manual TMT82: SD01172T/FY01105T• Functional Safety Manual TMT162: SD01632T/FY01106T

6.3

Test sequence C

Proof testing procedure
The procedure for performing the proof test is described in the following documents.
Detailed information:• Functional Safety Manual TMT82: SD01172T/FY01105T• Functional Safety Manual TMT162: SD01632T/FY01106T

6.4

Verification criterion

If one of the test criteria from the test sequences described above is not fulfilled, thedevice may no longer be used as part of a safety instrumented system.
• The purpose of proof-testing is to detect dangerous undetected device failures (λDU).
• This test does not cover the impact of systematic faults on the safety function, whichmust be assessed separately.
• Systematic faults can be caused, for example, by process material properties, operating
conditions, build-up or corrosion.
• As part of the visual inspection, for example, ensure that all of the seals and cable
entries provide adequate sealing and that the device is not visibly damaged.

Endress+Hauser

21

Repair and error handling

iTHERM ModuLine TM131, iTHERM ModuLine TM151

7

Repair and error handling

7.1

Maintenance

Maintenance instructions and instructions regarding calibration may be found in the
Operating Instructions pertaining to the device.
Alternative monitoring measures must be taken to ensure process safety duringconfiguration, proof-testing and maintenance work on the device.

7.2

RepairRepair means restoring functional integrity by replacing defective components.
Components may be repaired/replaced by the customer's technical staff if original spareparts from Endress+Hauser are used (they can be ordered by the end user) and theappropriate installation instructions are followed.
A proof test must always be performed after every repair.
Spare parts are grouped into logical kits with the associated replacement instructions.
Document the repair with the following information:• Serial number of the device• Date of the repair• Type of repair• Person who performed the repair
Sensor with or without process connection
Device inspection following repair: proof test, test sequence A or B
Seal sets for the sensor
Device inspection following repair: proof test, test sequence A or B
Display
Device inspection following repair: visual inspection to establish if all parts are present andmounted correctly and to verify that the device is in the "OK" state.
Electronic insert (transmitter)
Device inspection following repair: proof test, test sequence A or B
Housing coverDevice inspection following repair: visual inspection to establish if all parts are present andmounted correctly and to verify that the device is in the "OK" state.
Cable gland
Device inspection following repair: proof test, test sequence A or B
Seal kits for housing covers
Device inspection following repair: visual inspection to establish if all parts are present andmounted correctly and to verify that the device is in the "OK" state.
Securing clamps, housing
Device inspection following repair: visual inspection to establish if all parts are present andmounted correctly and to verify that the device is in the "OK" state.
Installation Instructions are supplied with the original spare part and can also beaccessed in the Download Area at www.endress.com
Send in replaced components to Endress+Hauser for fault analysis.
When returning the defective component, always enclose the "Declaration ofHazardous Material and Decontamination" with the note "Used as SIL device in asafety instrumented system.
Information on returns: http://www.endress.com/support/return-material
22

Endress+Hauser

iTHERM ModuLine TM131, iTHERM ModuLine TM151

7.3

Appendix

Modification

Modifications are changes to SIL devices that are already delivered or installed.
Modifications to SIL devices by the user are not permitted.

7.4

Decommissioning

When decommissioning, the requirements according to IEC 61508-1:2010 section 7.17
must be observed.

7.5

Disposal

In accordance with the European Directive 2012/19/EC on Waste Electrical andElectronic Equipment (WEEE), our products may not be disposed of as unsorted
municipal waste and can be returned to Endress+Hauser for disposal under our General
Terms and Conditions or individually agreed conditions.

8

Appendix

8.1

Structure of the measuring system

8.1.1

System components

An example of the devices in the measuring system is shown in the following graphic.

Endress+Hauser

23

Appendix

iTHERM ModuLine TM131, iTHERM ModuLine TM151

PLC

FieldCare

Commubox

1

2

3

4

5
A0035235

1
1
2

3

4

5

Example of application, measuring point layout with additional Endress+Hauser components
Installed iTHERM ModuLine thermometer with HART® communication protocol
RIA15 loop-powered process indicator - The process indicator is integrated in the current loop and displays
the measuring signal or HART® process variables in digital form. The process indicator does not require an
external power supply, It is powered directly from the current loop. More detailed information on this isprovided in the device documentation.
RN Series active barrier - The active barrier (24 VDC, 30 mA) has a galvanically isolated output for supplying
voltage to loop-powered transmitters. The universal power supply works with an input supply voltage of 20 to
250 V DC/AC, 50/60 Hz, which means that the active barrier can be used in all international power grids.
More detailed information on this is provided in the device documentation.
Communication examples: HART® Communicator (handheld terminal), FieldXpert, Commubox FXA195 for
intrinsically safe HART® communication with FieldCare via the USB interface, Bluetooth® technology with
SmartBlue App.
FieldCare is an FDT-based plant asset management tool from Endress+Hauser.

An analog signal (4 to 20 mA) in proportion to the relevant sensor value is generated in
the thermometer with a transmitter. This is sent to a downstream logic unit (e.g. PLC, limit
signal transmitter) where it is monitored to determine whether it is above or below a
specified limit value.
For fault monitoring, the logic unit must recognize both HI alarms (≥21 mA) and LO
alarms (≤3.6 mA).
NOTICE‣ The optional display is not part of the safety function. Neither the hardware nor thesoftware of the display has a verifiable influence on the defined safety functions of thetransmitter.

8.1.2

Description of use as a safety instrumented system

The device applies the resistance sensor RTD and thermocouple TC measuring
principles. These resistance thermometers use a Pt100 temperature sensor according toIEC 60751. The temperature sensor is a temperature-sensitive platinum resistor with aresistance of 100 Ω at 0 °C (32 °F) and a temperature coefficient α =0.003851 °C-1.
Thermocouples are comparatively simple, robust temperature sensors which use theSeebeck effect for temperature measurement: When two electrical conductors made ofdifferent materials are connected at a point, a weak electrical voltage can be measured
between the two open conductor ends if there are temperature gradients along the
conductors. This voltage is called thermoelectric voltage or electromotive force (emf.). Its
magnitude depends on the type of conducting materials and the temperature difference

24

Endress+Hauser

iTHERM ModuLine TM131, iTHERM ModuLine TM151

Appendix

between the "measuring point" (the junction of the two conductors) and the "cold junction"(the open conductor ends).
Accordingly, thermocouples primarily only measure differences in temperature. The
absolute temperature at the measuring point can be determined from these if theassociated temperature at the cold junction is known or is measured separately andcompensated for. The material combinations and associated thermoelectric voltage/
temperature characteristics of the most common types of thermocouple are standardizedin the IEC 60584 and ASTM E230/ANSI MC96.1 standards. The device's safety-related
signal is the analog 4 to 20 mA output signal in accordance with NAMUR NE43. All safetymeasures refer to this signal exclusively. In addition, the device also communicates via
HART® for information purposes and comprises all the HART® features with additional
device information.

1
8
2
7

3
T

T

P

6

4
5
F

A0040018

2

Example of the measuring arrangement

1
2
3
4
5
6
7
8

Pressure sensor
iTHERM ModuLine TM131/TM151 thermometer
Finished productFlow sensor
Fuel
Starting material
iTHERM ModuLine TM131/TM151 thermometer
Furnace

In safety instrumented systems, the device can be used in this arrangement for MAX
temperature and range monitoring.
Correct installation is a prerequisite for safe operation of the device.

8.1.3

Measurement function

Galvanic isolation
When two sensors are connected to the transmitter, make sure the sensors are
galvanically isolated from one another; this does not apply to grounded
thermocouples, however.

Endress+Hauser

25

Appendix

iTHERM ModuLine TM131, iTHERM ModuLine TM151

Two-channel functions
Two sensors can be connected to the transmitter and the transmitter can be operated in
the following safe functions:• Averaging function
The measured values M1, M2 of the two sensors are output as an arithmetic average(M1+M2)/2.
• Difference function
The measured values M1, M2 of the two sensors are output as a difference (M1-M2).
• Backup function
If one of the sensor fails, the transmitter automatically switches to the other measuring
channel. For this the sensor types must be identical, e.g. two 3-wire RTD Pt100 sensors.
The backup function is used to increase availability or improve the diagnostic
capabilities.
The following sensor types are therefore permitted in the SIL mode:• 2x thermocouple (TC)• 2x RTD, 3-wire• Sensor drift function
If redundant sensors are used, the long-term drift of a sensor can be detected, forinstance. This is a diagnostic measure as the signal of the second sensor is only used forthis diagnostic. If identical sensors are used, the backup function can also be used.
The configured drift/difference limit value should be at least twice the safety accuracy
value.
SIL 3 configuration: homogeneous redundancy
Two temperature transmitters with one sensor per transmitter are required for a SIL 3
measuring point. The measured values of the two transmitters are evaluated in a logic unit
using a safe voter.

8.1.4

Limit value monitoring

The safety function is used to monitor the measured value. In the SIL mode, a failure
current or saturation current is output in the event of a measurement outside a userdefined measuring range (Xmin to Xmax). This current depends on the configuration ofthe "Diagnostic behavior" parameter (alarm, warning).
Detailed information:• Functional Safety Manual TMT82: SD01172T/FY01105T• Functional Safety Manual TMT162: SD01632T/FY01106T

8.2

Commissioning or proof test report

The following device-specific test report acts as a print/master template and can be
replaced or supplemented any time by the customer's own SIL reporting and testing
system.

26

Endress+Hauser

iTHERM ModuLine TM131, iTHERM ModuLine TM151

8.2.1

Appendix

Test Report - Page 1 -Company/contact person
TesterDevice information
SystemMeasuring points/TAG No.
Device type/order code
Serial number
Firmware version
Access code (if individual to each device)
SIL checksum

Verification information
Date/time
Performed by

Verification result
Overall result
 Passed FailedComment

Date

Endress+Hauser

Signature

Signature of tester

27

Appendix

iTHERM ModuLine TM131, iTHERM ModuLine TM151

8.2.2

Test Report - Page 2 -Type of safety function
 Safe measurement

Commissioning check Device parameter configuration via SIL mode activation (SiMA) Commissioning check, test sequence A
 Commissioning check, test sequence B

Proof testing Test sequence A Test sequence B
 Test sequence C

Proof test report
Test stage

Set point

Actual value

Result1 Terminal head Pass Fail Not applicable

2 Insert

 Pass Fail Not applicable

3 Thermometer thermowell Pass Fail Not applicable

4 Lower range value adjustment, sensor 1

 Pass Fail

5 Upper range value adjustment, sensor 1

 Pass Fail

6 Lower range value adjustment, sensor 2

 Pass Fail Not applicable

7 Upper range value adjustment, sensor 2

 Pass Fail Not applicable

8 Current value alarm

 Pass Fail9 Restart via HART Pass Fail Not applicable

10 Restart via plug-in display

 Pass Fail Not applicable

28

Endress+Hauser

iTHERM ModuLine TM131, iTHERM ModuLine TM151

8.2.3

Appendix

Test Report - Page 3 -Protocol for commissioning check
Test stage

Set point

Actual value

Result1 Lower range value adjustment, sensor 1

 Passed Failed

2 Upper range value adjustment, sensor 1

 Passed Failed

3 Lower range value adjustment, sensor 2

 Passed Failed
 Not applicable

4 Upper range value adjustment, sensor 2

 Passed Failed
 Not applicable

5 Two-channel function, sensor drift

 Passed Failed
 Not applicable

6 Two-channel function, backup

 Passed Failed
 Not applicable

7 Channel assignment, current output

 Passed Failed
 Not applicable

8 Out of range category

 Passed Failed
 Not applicable

9 RJ / preset value

 Passed Failed
 Not applicable

10 Current value alarm

 Passed Failed

11 Restart via HART Passed Failed
 Not applicable

12 Restart via plug-in display

 Passed Failed
 Not applicableEndress+Hauser

29

Appendix

iTHERM ModuLine TM131, iTHERM ModuLine TM151

8.2.4

Parameter settings for the SIL mode

Parameter nameFactory settingEnter access code0

Lower measuring range (4 mA)

0Upper measuring range (20 mA)

100

Failure current

22.5 mA

Failsafe modeLow alarm

Sensor type 1

Pt100 IEC60751

Sensor type 2

No sensor

Upper sensor limit 1+850 °C

Lower sensor limit 1–200 °C

Upper sensor limit 2-

Lower sensor limit 2-

Sensor offset 1

0

Sensor offset 2

0

Connection type 1

4-wire (RTD)

Connection type 2

2-wire (TC)30

Set value

TestedEndress+Hauser

*71639662*
71639662

www.addresses.endress.com