SD00023R/09/EN/15.19
71430719

Products

Solutions

Services

Functional Safety
ManualRIA46

Field indicator

Application
1- to 2-channel transmitter power supply with intrinsically safe current inputs, temperature inputs, limit value monitoring with two changeover contacts, mathematics
functions and 1 to 2 analog outputs designed to satisfy particular safety systems requirements as per IEC 61508:2010.
The measuring system meets the requirements for• functional safety as per IEC 61508:2010• explosion protection (depending on version)• electromagnetic compatibility as per EN 61326 and NAMUR recommendation
NE 21• electrical safety as per IEC/EN 61010-1
Your benefits• Suitable for use in a safety function up to SIL 2 in a safety-related system, independently assessed by Exida in accordance with IEC 61508:2010.

RIA46

Contents
SIL Declaration of Conformity . . . . . . . . . . . . . . . . . . . . .3
General information . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5
Structure of the measuring system . . . . . . . . . . . . . . . .5
System components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Description of application as a safety instrumented system . . 5
Permitted devices types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Supplementary device documentation . . . . . . . . . . . . . . . . . . . . 6

Description of safety requirements and boundary
conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6
Safety function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Safety-related signal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Restrictions for use in safety-related applications . . . . . . . . . 10
Functional safety parameters . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Proof-test interval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Behavior of device when in operation and in the event ofa fault . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Orientation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

Proof tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Proof-test procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

Repair . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Repair . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

Appendix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Commissioning or proof-test protocol . . . . . . . . . . . . . . . . . . . 15

2

Endress+Hauser

RIA46SIL Declaration of Conformity

SIL_00156_02.17

SIL-Konformitätserklärung
Funktionale Sicherheit nach IEC 61508:2010 Beiblatt 1

SIL Declaration of Conformity
Functional Safety according to IEC 61508:2010 Supplement 1

Endress+Hauser Wetzer GmbH+Co. KG, Obere Wank 1, 87484 Nesselwang
erklärt als Hersteller, dass das Gerät
declares as manufacturer, that the device

RIA46
für den Einsatz in sicherheitsrelevanten Anwendungen bis SIL2 nach IEC61508:2010 geeignet ist. In sicherheitsrelevanten
Anwendungen sind die Angaben des Handbuchs zur Funktionalen Sicherheit zu beachten.
is suitable for the use in safety-instrumented systems up to SIL2 according to IEC61508:2010.
In safety instrumented systems the instructions of the Safety Manual have to be followed.

Allgemein / General
Sicherheitsbezogenes Ausgangssignal
Safety related output signal
Fehlersignal
fault signal

Strom / Current
4…20mA

Spannung / Voltage
2…10V

Relais / Relay 6)

3,5mA oder / or 22mA

0V oder / or 11V

Relais stromlos /Relay de-energized

Bewertetes Eingangssignal /Funktion
Input signal / function
Gerätetyp gem. IEC 61508-2
Device type acc. to IEC 61508-2
Betriebsart
Operating mode
Gültige Hardware-Version
valid hardware version
Gültige Firmware-Version
valid firmware version
Handbuch zur Funktionalen
Sicherheit/ Functional safety manual

Strom, Spannung, Temperatur, Widerstandcurrent, voltage, temperature, resistance
Typ A; Low Demand ModeHigh DemandContinuous Mode

01.00.zz oder höher/ or higher
01.03.03 oder höher / or higher
SD00023R/09

;
Art der BewertungType of evaluation;;
Prüfungsunterlagen
Test documents; Typ B

Vollständige entwicklungsbegleitende HW/SW Bewertung inkl.
FMEDA und Änderungsprozess nach IEC 61508-2, 3Complete HW/SW evaluation parallel to development incl.
FMEDA and change request acc. to IEC 61508-2, 3
Bewertung über Nachweis der Betriebsbewährung HW/SW inkl. FMEDA undÄnderungsprozess nach IEC 61508-2, 3
Evaluation of “Proven-in-use” performance for HW/SW incl. FMEDA and change
request acc. to IEC 61508-2, 3
Auswertung von Felddaten HW/SW zum Nachweis "Frühere Verwendung" gem.
DIN EN 61511-1 2005
Evaluation of HW/SW field data to verify „prior use” acc. to
DIN EN 61511-1 2005
Bewertung durch: Endress+Hauser SE+Co. KG / Report Nr.
ASSESS_SIL-ZertVerl-RMA42
Evaluation through: Endress+Hauser SE+Co. KG / report no.
ASSESS_SIL-ZertVerl-RMA42

Entwicklungsdokumente, Testberichte, Datenblätter
development documents, test reports, data sheets

Seite 1 von 2Page 1 of 2

Endress+Hauser

3

RIA46

SIL_00156_02.17

SIL – Integrität / SIL Integrity
Hardware Sicherheitsintegrität
Hardware safety integrity

Einkanaliger Einsatz /Single channel use; SIL 2 fähig / capable

SIL 3 fähig / capable

FMEDA
Empfohlenes Intervall fürWiederholungsprüfungen /recommended proof test interval

T1 = 1 Jahr / year

Sicherheitsbezogenes
Ausgangssignal
Safety related output signal

Strom / Current
4…20mA

Anzahl Eingänge /number of inputs

1

MTBFtot 3) / Jahre / years

2

Spannung / Voltage
2…10V
1

2

Relais / Relay 6)

1

2

95

58

89

60

73

56

SFF

84,4 %

84,9 %

84,6 %

82,4 %

83,3 %

82,7 %

λSD2) 4)

0 FIT

0 FIT

0 FIT

0 FIT

0 FIT

0 FIT

λSU

2) 4)

λDD2) 4)

0 FIT

0 FIT

0 FIT

0 FIT

445 FIT521 FIT559 FIT841 FIT584 FIT751 FIT234 FIT266 FIT

λDU2) 4)103 FIT149 FIT106 FIT

160 FIT

158 FIT

167 FITPFDavg 1) 4) T1 = 1 Jahr / year

4,51 x10-4

6,53 x10-4

4,64 x10-4

7,01 x 10-4

6,92 x10-4

7,31 x10-4

0,4 sec

0,4 sec

0,4 sec

0,4 sec

5 sec

5 sec

5 sec

5 sec

0,4 sec
5 sec

0,4 sec
5 sec

Fehlerreaktionszeit
Fault reaction time 5)1) Die Werte entsprechen SIL 2 nach ISA S84.01. PFD-Werte für andere T1-Werte siehe Handbuch zur Funktionalen Sicherheit. /The values comply with SIL 2 according to ISA S84.01. PFD values for other T1-values see Functional Safety Manual.
2) Gemäß Exida Bericht Nr. E+H 08/02-49. / According to Exida report no. E+H 08/02-49.
3) Gemäß Siemens SN29500, einschließlich Fehlern, die außerhalb der Sicherheitsfunktion liegen. /According to Siemens SN29500, including faults outside the safety function.
4) Gültig für gemittelte Umgebungstemperaturen bis zu +40 °C (+104 °F) Bei einer durchschnittlichen Dauereinsatztemperatur nahe
+50 °C sollte ein Faktor von 1,3 berücksichtigt werden. /Valid for average ambient temperature up to +40 °C (+104 °F) For continuous operation at ambient temperature close to +50 °C(+122 °F), a factor of 1,3 should be applied.
5) Zeit zwischen Fehlererkennung und Fehlerreaktion. Die Zeit beträgt maximal 0,4 Sekunden. Bei Verwendung von RTD oder
Thermoelement als Eingangssignal beträgt die Zeit zur Erkennung eines Leitungsbruches maximal 5 Sekunden. /Maximum time between error recognition and error response. The maximum time is 0,4 sec. If a RTD or a thermocouple input signal
is used the fault reaction time is up to 5 sec for cable open recognition.
6) Die Werte gelten für ein Gerät mit der Option Zulassung für Ex-Bereich. Bei einem Gerät ohne Zulassung für Ex-Bereich, darf ein
Relais-Ausgang nicht als sicherheitsbezogenes Signal verwendet werden. /Values are valid for a device with the option certification hazardous area. The relay output must not be used as a safety related signal
at a device without the option certification hazardous area.

Nesselwang, 22.01.2019
Endress+Hauser Wetzer GmbH+Co. KG________________________________
Harald Hertweck
Managing Director_________________________________
i.V. Robert Zeller
Head of department FEC

Seite 2 von 2Page 2 of 2

4

Endress+Hauser

RIA46

General information
General information on functional safety (SIL) is available at:www.de.endress.com/SIL (German) or www.endress.com/SIL (English) and in the Competence Brochure CP01008Z11EN "Functional safety - SIL safety instrumented systems in the process industry".

Structure of the measuring system
System components

The measuring system's devices are shown in the following diagram (example).

Sensor(z.B.
(e.g.
Sensorthermometer)
Thermometer)

Field display unit
Feldanzeiger(e.g. RIA46)
RIA46)(z.B.

Logic unit
Logikeinheit(e.g. SPS)
PLC)
(z.B.

Actuator
Aktor(e.g. Ventil)
valve)(z.B.

PFDavg
10%
PFD
avg≤≤10%a0011540-en

Proportion of "average probability of a dangerous failure on demand of a safety function" (PFDAVG) accounted for by process transmitterIn this documentation, the RIA46 is regarded as part of a safety function.
The sensor, process transmitter, logic unit and actuator together form a safety-related system that performs a safety function. The "average probability of a dangerous failure on demand of a safety-related
system" (PFDavg) is spread across the sensor, field display unit, logic unit and actuator subsystems.

Description of application asa safety instrumented system

Logic unit (e.g. PLC,
limit signal transmitter, ...)

Actuator

a0011542-en

Example of a "differential pressure" application

Powered by the RIA46 field display unit, the sensors generate an analog signal that is proportional tothe measured value (4 to 20 mA or 2 to 10 V). Mathematics functions are used to create a new process
variable. The field display unit sends the analog signals that are proportional to the new process variable to a logic unit located downstream, a PLC for example. Limit value monitoring can also be performed directly with the RIA46 via two changeover contacts.
Permitted devices types

Endress+Hauser

The information on functional safety contained in this manual relates to the device versions listed
below and are valid as of the specified software and hardware version.
Valid hardware version (electronics): from 01.00.xx
Valid firmware/software version: from 01.03.03 or higher
If changes are made to the device, a modification process compliant with IEC 61508 is applied. Unlessotherwise indicated, all subsequent versions can also be used for safety instrumented systems.

5

RIA46

Valid device versions for safety-related use:
FeatureDesignation

Version010

ApprovalAll

020

Input; output

All

530

Additional approvals

D1

The table indicates the required versions. All other versions can be selected as desired.
Supplementary device documentation

Documentation

Contents

Comment

Technical Information
TI00142R/09(Field display unit RIA46)• Technical data
• Information on accessories

Operating Instructions
BA00274R/09(Field display unit RIA46)• Identification• Installation• Wiring• Operation• Commissioning• Maintenance• Accessories• Troubleshooting• Technical data
• Appendix: menu diagrams

Safety instructions depending on
the selected version of "Certificate"• Safety, installation and operating
instructions for devices that aresuitable for use in hazardous
areas or for overfill prevention(WHG, German Water Resources
Act).

Additional safety instructions (XA,
XB, XC, ZE, ZD) are supplied withcertified device versions. Pleaserefer to the nameplate for the relevant safety instructions.

Description of safety requirements and boundary conditions
Safety function

An analog output or limit relay can be used if deployed as part of a safety function.
One device can be used to implement several independent safety functions.
All inputs and outputs that do not form part of a safety function may still be used.
The use of non-safety-related inputs and outputs does not have a modifying effect on the safety function.
The following table shows which settings are permitted or prohibited when the RIA46 is used in a safety-related application:
Configuring the input signal:

6

Setup menu
Analog in 1*
Analog in 2*

Possible settings

Setting for safety function

Signal type*

4 to 20 mA

permitted

0 to 20 mA

not permitted

0 to 10 V

not permitted

2 to 10 V

permitted

Endress+Hauser

RIA460 to 5 V

not permitted

1 to 5 V

not permitted±1V

not permitted± 10 Vnot permitted± 30 Vnot permitted± 100 mV

not permitted

30 to 3000 Ohm

not permitted

RTD/resistor
2-wire/3-wire/4-wirepermitted

Thermocouple

permitted

Fixed value

not permitted

invalidpermitted

On

permitted

Off

not permittedExpert menu
Input**
Analog in 1**
Analog in 2**
Failure mode**

Namur NE43**

Configuring the current or voltage output:
Setup menu
Analog Out 1*
Analog Out 2*

Possible settings

Setting for safety function

Assignment*

Analog Input 1

permitted

Analog Input 2

permitted

Calc Value 1

permitted

Calc Value 2

permitted

4 to 20 mA

permitted

2 to 10 V

permitted

0 to 20 mA

not permitted

0 to 10 V

not permitted

0 to 5 V

not permitted

1 to 5 V

not permitted

Fixed value

not permittedMin

permitted

Maxpermitted

Signal type*

Expert menu
Input**
Analog Out 1**
Analog Out 2**
Failure mode**

Configuring the relays for limit value monitoring:

Endress+Hauser

Setup menu
Relay 1*
Relay 2*

Possible settings

Setting for safety function

Assignment*

Analog input 1*

permitted

Analog input 2*

permitted

Calc value 1*

permitted

Calc value 2*

permitted

7

RIA46Function*Off

not permittedMin

permitted

Maxpermitted

Gradient

permitted

OutBandpermitted

InBandpermitted

Operation mode**

norm closed

permitted

norm opened

not permitted

Failure mode**

norm closed

permitted

norm opened

not permittedExpert menu
Output**Relay 1**
Relay 2***) Displayed in Setup menu of device software**) Displayed in Expert menu of device software
For further information, refer to the supplementary device documentation.
In addition, only certain settings are permitted for some parameters. If the setting of one of theseparameters is not a permitted setting, safe operation of the device is no longer guaranteed.
Function group (menu path)

Setting

Expert → Application → Calc value 1/2 → Failure mode

Invalid

Expert → Diagnostics → Simulation → Simulation AO1/2

OffExpert → Diagnostics → Simulation → Simu relay 1/2

Off

NOTICE‣

When using relays, only the "explosion protection" device option may be used as a safety-related
output signal.

Safety function
Example 1: Level monitoring with differential pressure measurement
Safety function 1
Safety function 2
Process value:(no safety function)

8

Calc value (Input 1, Input 2) -> Relay 1 max. level (overfill prevention)
Calc value (Input 1, Input 2) -> Relay 2 min. level (dry running protection)
Calc value (Input 1, Input 2) -> Output 1 (level)

Endress+Hauser

RIA463

4

Input 1

Output 1

Input 2

Output 2

Level

Relay 1High Alarm

Relay 2

Low Alarm

1
2
A0032914

1:

Safety function 1

2:

Safety function 2

3:

Process transmitter4:

Output 1 - Process value, not part of the safety function. Output 2 is not used

Example 2: Level monitoring of two tanks
Safety function 1
Safety function 2
Process value:(no safety function)

Input 1 -> Relay 1 max. level tank 1
Input 2 -> Relay 2 max. level tank 2
Input 1 -> Output 1 (level tank 1),
Input 2 -> Output 2 (level tank 2)

4
53
Input 1

Output 1

Level Tank 1

Input 2

Output 2

Level Tank 2

Relay 1High Alarm
Tank 1

Relay 2High Alarm
Tank 21
2A0032916

1:

Safety function 1

2:

Safety function 2

3:

Process transmitter4:

Output 1 - Process value, not part of the safety function.

5:

Output 2 - Process value, not part of the safety function.

Example 3: Continuous level monitoring of one tank
Safety function 1
Process value:(no safety function)

Endress+Hauser

Input 1 -> Output 1 continuous level value tank 1 to safety PLC with actuator
Input 1 -> Relay 1 (lamp for full tank),
Input 1 -> Relay 2 (lamp for empty tank)9

RIA463

2
Input 1

Output 1

Input 2

Output 2

1

Safety PLC

Actuator

4

Relay 1

Lamp tank
full

Relay 2

Lamp tankempty
A0032918

1:

Safety function 1

2:

Process transmitter

3:

Input 1 -> Output 1 continuous level value tank 1 to safety PLC with actuator

4:

Relay 1 (lamp for full tank), Relay 2 (lamp for empty tank)

Example 4: Level monitoring of one tank with 2 channels (NOT PERMITTED!)
Safety function 1 (2 channels for Input 1 -> Relay 1 max. level tank 1
homogeneous redundancy):
Input 2 -> Relay 2 max. level tank 1

2

1

Input 1

Output 1

Input 2

Output 2
Relay 1High Alarm
Tank 1

Relay 2High Alarm
Tank 1
A0032918

1:

Safety function 1

2:

Process transmitter

Safety-related signal

The safety-related signal is the analog output signal 4 to 20 mA or 2 to 10V or the limit relay.
All safety measures refer exclusively to the output signal.
The safety-related output signal or limit relay is supplied to a downstream logic unit, e.g. a programmable logic controller or a limit signal transmitter, where it is monitored for the following events:• A specified limit has been overshot• A fault has occurred, e.g. error current as per NE 43 (≤ 3.6 mA, ≥ 21 mA, interruption or short-circuit in signal line)

Restrictions for use in safetyrelated applications• The measuring system must be used in accordance with the application, and attention must be paid
to the ambient conditions.
• Follow the instructions for critical process situations and installation conditions in the Operating Instructions ("Installation conditions" section in BA00274R/09).
• The application-specific limits must be complied with.
• The specifications in the Operating Instructions must not be exceeded. The accuracy of the safetyrelated output signal 4 to 20 mA or 2 to 10 V is ± 1% of the measuring range.
• Device start-up time: After the device start-up, the safety functions are available following an initialization period of 20 seconds.
• The device must be locked after parameter configuration.
• A complete function test of the safety-related functions must be carried out during commissioning.

10

Endress+Hauser

RIA46Functional safety parameters

The table shows the specific functional safety parameters:

Parameter as per IEC 61508

Value, version 1

Value, version 2

Value, version 3

Safety function

Current output
1 input

Current output
2 inputs

Voltage output
1 input

SIL

2

2

2

HFT

0

0

0

Device type

B

B

B

Operating modeLow demand modeLow demand modeLow demand mode

MTTR

24 hours

24 hours

24 hours

1 year

1 yearRecommended proof-test interval T1 1 year
SFF

84.4 %

84.9 %

84.6 %

λSD

0 FIT

0 FIT

0 FIT

λSU

0 FIT

0 FIT

0 FIT

λDD

559 FIT841 FIT584 FITλDU

103 FIT149 FIT106 FITλTotal *1

662 FIT

990 FIT690 FIT4.51 x 10-4

6.53 x 10-4

4.64 x 10-4

PFDavg (for T1= 1 year) *2

MTBF *1

95 years

58 years

89 yearsFault response time *3

0.4 s / 5 s

0.4 s / 5 s

0.4 s / 5 s

Parameter as per IEC 61508

Value, version 4

Value, version 5

Value, version 6

Safety function

Voltage output
2 inputs

Limit relay
1 input

Limit relay
2 inputs

SIL

2

2

2

HFT

0

0

0

Device type

B

B

B

Operating modeLow demand modeLow demand modeLow demand mode

MTTR

24 hours

24 hours

24 hours

1 year

1 yearRecommended proof-test interval T1 1 year
SFF

82.4 %

83.3 %

82.7 %

λSD

0 FIT

0 FIT

0 FIT

λSU

0 FIT

445 FIT521 FITλDD

751 FIT234 FIT266 FITλDU

160 FIT

158 FIT

167 FITλTotal *1

911 FIT756 FIT971 FIT7.01 x 10-4

6.9 x 10-4

7.3 x 10-4

60 years

78 years

56 years

0.4 s / 5 s

0.4 s / 5 s

0.4 s / 5 s

PFDavg (for T1= 1 year) *2

MTBF *1
Fault response time

*1
*2
*3

*3

* This value takes into account all failure types. Failure rates of electronic components in accordance with Siemens SN29500.
(see "Management Summary - optional")
Where the average temperature when in continuous use is in the region of 50°C, a factor of 1.3 should be taken into account. For further information, see "Management Summary - optional".
Time between fault detection and fault response. The time is max. 0.4 seconds. When an RTD or thermocouple is used as the input signal, themaximum time needed to detect a cable open circuit is 5 seconds

Endress+Hauser

11

RIA46

Proof-test interval
PFDAVG vs. proof-test interval

Current output

Voltage output

Relay output

1,20E-02
1,00E-02

PFD AVG

8,00E-03
6,00E-03
4,00E-03
2,00E-03
0E+00
1

2

3

4

6

5

7

8

9

10

Years
A0023232-EN

Proof-test interval as a function of PFDavg

Dangerous undetected failures in this scenario
An incorrect output signal that deviates from the actual measured value by more than 1% but is still in
the range of 4 to 20 mA or 2 to 10 V is considered a dangerous, undetected failure.
Operating life of electrical components
The underlying failure rates of electrical components apply within the useful operating life as per
IEC 61508-2:2010, section 7.4.9.5. Note 3.
The operating life of the device is determined mainly by the electrolyte capacitors and the ambient
temperature. Due to the use of high-quality capacitors, the operating life of the device is 20 years; thisassumes an average ambient temperature of 40°C. At higher ambient temperatures, the operating life
is shorter.
Behavior of device when in
operation and in the event ofa fault

The device monitors its inputs as well as its own internal functionalities by means of comprehensive
monitoring mechanisms in the device software.
In the event that the device's self-diagnosis function detects a fault, the device reacts as follows:• Status output (open collector) opens• Red LED lights up• Limit relay de-energizes (if activated)• Analog output issues fault signal (e.g. <3.6mA in failure mode: minimum)• Display switches to failsafe mode → color of channel aﬀected changes to red and an error is displayed• Display switches automatically between the active channels and the error display

Installation

All relay outputs used as a safety function must be protected with a 2 A fuse. Alternatively, it is also
possible to use a thermomagnetic device circuit breaker or electronic limiter or a miniature circuit
breaker with tripping characteristic "Z".

Orientation

The permitted orientations of the device are described in the supplementary device documentation.

Operation

Device behavior when switched on
After it is switched on, the device runs through a diagnostic phase lasting a maximum 20 seconds. During this time, the current output is set to error current ≤ 3.6 mA, the voltage output is set to 0 V, andthe limit relays are de-energized.
Communication via the CDI interface is not possible during the diagnostic phase.
The output signal can only be regarded as safe on successful completion of the diagnostic function.
Behavior of device in the event of alarms and warnings
Analog output:
A fault exists at the output when the assigned input or mathematics channel delivers an error status.
The failsafe mode of the output can be configured. The following options can be configured:

12

Endress+Hauser

RIA46

Setting

Current output

Voltage output

Min< 3.6 mA (3.5 mA)1)

0V

Max

> 21 mA (22 mA)

11 V

1)

actual output value

Limit relay:
A fault exists when the assigned input or mathematics channel delivers an error status. The limit relays
are de-energized in the event of a fault.
Alarm and warning messages:
The alarm and warning messages output in the form of error codes provide additional information andare not part of the safety function.
The following table shows the correlation between the error code and the resulting input current/voltage:
Error code*

Meaning

Input current

Input voltage

F041

Sensor/cable open circuit≤ 2 mAn/a

F045

Sensor error

2 < x ≤ 3.6 mA≥ 21 mA

n/a

F101

Range undershoot≥ 2 mA> 3.6 mA ≤ 3.8 mA (as per
Namur)<1V

F102

Range overshoot> 20.5 mA < 21 mA (as per
Namur)≥ 21 mA (as per Namur)> 11 V*) The error codes are listed in the "Diagnosis list" section of Operating Instructions BA00274R/09.
Device configuration
When using the devices in PCS safety instrumented systems, the device configuration must meet thefollowing two requirements:
1. Confirmation concept:
Proven, independent verification of the safety-related parameters entered2.

Locking concept:
Device locking once configuration is complete (as required by DIN EN 61511-1 §11.6.4 and NE
79 §3)

Device configuration procedure
Device configuration is described in Operating Instructions BA00274R/09.
Inspection
NOTICEAn inspection of the entire safety function is necessary.
‣ Once all of the parameters have been entered, the safety function must be checked before performing the locking sequence!
‣ When the device is used as part of a safety function, the complete safety function must be checked
after each modification to the device, e.g. a change in the parameter settings.

Endress+Hauser

13

RIA46

Locking! CAUTION
The operation of the device must be locked.
‣ Once all of the parameters have been entered and the safety function has been checked, the operation of the device must be locked. This is because a change in the measuring system or in theparameters could compromise the safety function. (→ "Access protection" section of Operating
Instructions BA00274R/09).

The configuration software must be locked as follows:• The device must be locked against access by unauthorized persons;
A user code protects the configured parameters: enter 4-digit code: select digit with ‘+’ or ‘-’andpress "E" to confirm the individual digit;
once the digit has been confirmed, the cursor moves to the next position, or skips back to the ‘System’
menu item once the fourth digit has been entered.
The lock symbol appears on the display.
• Setup → System → Overfill protect: Select German WHG.
The device status must be changed if the device is configured via the CDI interface using the FieldCare
PC software, i.e. WHG must be disabled so that parameters can be changed.

MaintenanceNo special repair or maintenance work is required on the device.

Proof tests
Safety functions must be tested at appropriate intervals to ensure that they are functioning correctly
and are safe.
The time intervals must be specified by the operator.
The "Proof-test interval as a function of PFDavg" diagram (Seite 12) can be used for this purpose.
Proof testing of the device can be performed as follows:
Proof-test procedure

1.

Bypass the logic unit or take other appropriate measures to prevent an undesirable reaction in theprocess.

2.

Simulate several defined limit values across the entire input range and verify that the output or
limit relay assume a safe state.
A safe state means, for example, that < 3.6mA is present at the current output for at least 4 sec.,or that the limit relay is de-energized (see also failsafe mode).

3.

Restore the complete operational capability of the loop.

4.

Disable the logic unit bypass or restore normal operation in some other way. This test detects approx. 99% of all possible "λDU“ (dangerous undetected) failures of field display unit RIA46.

If one of the test criteria from the test sequences described above is not satisfied, the device may nolonger be used as part of a safety instrumented system.
The purpose of a proof test is to detect random device failures. This test does not cover the impact ofsystematic faults on the safety function, which must be assessed separately. Systematic faults can becaused by operating conditions or corrosion, for example.

RepairRepair

All repairs to the device must be carried out by Endress+Hauser only.
Please refer to the "Return" section of the associated Operating Instructions.
In the event of failure of a SIL-labeled E+H device operated in a safety function, the "Declaration of Hazardous Material and Decontamination" must be returned with the defective device and must include thenote "Used as SIL device in safety instrumented system".
The "Declaration of Hazardous Material and Decontamination" can be found in the appendix at the endof this Functional Safety Manual.

14

Endress+Hauser

RIA46

AppendixCommissioning or proof-test
protocolSystem-specific data
Company
Measuring points / TAG no.
SystemDevice type / order code
Serial number of device
Name
Date
Password (if device-specific)
Signature

Device-specific commissioning parameters
Empty value
Full value
Proof-test protocol
Test stage

Analog output / limit relay
Set point

Jumper current input

Actual value

Current: <3.6 mA or > 21 mA
Voltage: 0.0 V or 11.0 V
Relay: de-energizedConnect multimeter (accuracy class 1) to current/voltage output
Imprint a current value of x mA on current output
Read the current/voltage value at the output and record it (set point, e.g. x mA +/- 0.1 mA)

Endress+Hauser15www.addresses.endress.com