Safety Manual
Guided Wave Radar
SITRANS LG240, LG250, LG260 and LG270
Two-wire 4 … 20 mA/HART
With SIL qualication
2SITRANS LG240, LG250, LG260 and LG270 - Safety Manual
47313-EN-170420
3
SITRANS LG240, LG250, LG260 and LG270 - Safety Manual
47313-EN-17042047313-EN-170420
Contents
1 Scope
1.1 Instrument version ............................................................................................................ 4
1.2 Area of application ........................................................................................................... 4
1.3 SIL conformity .................................................................................................................. 4
2 Planning
2.1 Safety function ................................................................................................................. 6
2.2 Safe state ......................................................................................................................... 6
2.3 Prerequisites for operation ............................................................................................... 6
3 Safety-related characteristics
3.1 Characteristics acc. to IEC 61508 .................................................................................... 7
3.2 Characteristics acc. to ISO 13849-1 ................................................................................. 7
3.3 Characteristics acc. to IEC 61508 for versions with approval Ex-d-ia/XP-AIS ................... 8
3.4 Characteristics acc. to ISO 13849-1 for versions with approval Ex-d-ia/XP-AIS ............... 8
3.5 Supplementary information .............................................................................................. 9
4 Setup
4.1 General information ........................................................................................................ 10
4.2 Instrument parameter adjustment ................................................................................... 10
5 Diagnostics and servicing
5.1 Behaviour in case of failure ............................................................................................ 12
5.2 Repair ............................................................................................................................ 12
6 Proof test
6.1 General information ........................................................................................................ 13
6.2 Test 1: Without checking the process variable ................................................................ 13
6.3 Test 2: With check of the process variable ...................................................................... 14
7 Appendix A: Test report
8 AppendixB:Termdenitions
9 Supplement C: SIL conformity
Editing status: 2017-04-07
4SITRANS LG240, LG250, LG260 and LG270 - Safety Manual
47313-EN-170420
1 Scope
1.1 Instrument version
This safety manual applies to TDR sensors
SITRANS LG240, LG250, LG260, LG270
Electronics types:
• Two-wire 4 … 20 mA/HART with SIL qualication
• Two-wire 4 … 20 mA/HART with SIL qualication and supplemen-
tary electronics "Additional current output 4 … 20 mA"
Valid versions:
• from HW Ver 1.0.0
• from SW Ver 1.0.0
Probe types:
• Only original probes of the manufacturer must be used!
For versions with Ex-d-ia/XP-AIS approval the separe safety-related
characteristics are valid (see chapter Safety-related characteristics)!
Corresponding type code: SITRANS LG2*0.*D/I/V/P****A*****
1.2 Area of application
The transmitter can be used in a safety-related system according to
IEC 61508 in the modes low demand mode or high demand mode for
the measurement of the following process variables:
• Point level detection
• Level measurement in liquids and bulk solids
• Interface measurement in liquids
Due to the systematic capability SC3 this is possible up to:
• SIL2 in single-channel architecture
• SIL3 in multiple channel architecture
The following interface can be used to output the measured value:
• Current output: 4 … 20 mA
The following interfaces are only permitted for parameter adjustment
and for informative use:
• HART®
• Display and adjustment module
• USB Communicator
• Current output II1)
1.3 SIL conformity
The SIL conformity was independently judged and certied by the
TÜV Rheinland according to IEC 61508:2010 (Ed.2).2)
1) Only with instrument version with supplementary electronics "Additional cur-
rent output 4 … 20 mA".
2) Verication documents see appendix.
5
SITRANS LG240, LG250, LG260 and LG270 - Safety Manual
47313-EN-170420
The certicate is valid for the entire service life of all instruments that
were sold before the certicate expired!
6SITRANS LG240, LG250, LG260 and LG270 - Safety Manual
47313-EN-170420
2 Planning
2.1 Safety function
The sensor generates on its current output a signal between 3.8 mA
and 20.5 mA corresponding to the process variable. This analogue
signal is fed to a connected processing system to monitor the follow-
ing conditions:
• Exceeding a dened limit value of the process variable
• Falling below a dened limit value of the process variable
• Monitoring of a dened range of the process variable
For the design of the safety function, the following aspects must be
taken into account with regard to the tolerances:
• Due to undetected failures in the range between 3.8 mA and
20.5 mA, an incorrect output signal can be generated which devi-
ates from the real measured value by up to 2 %
• Increased measurement deviations can occur at the boundaries of
the measuring range (see Technical Data in the operating instruc-
tions)
2.2 Safe state
The safe state of the current output depends on the safety function
and the characteristics set on the sensor.
Character-
istics
Monitoring upper limit val-
ue
Monitoring lower limit value
4 … 20 mA Output current ≥ Switching
point
Output current ≤ Switching
point
20 … 4 mA Output current ≤ Switching
point
Output current ≥ Switching
point
Possible fault currents:
• ≤ 3.6 mA ("fail low")
• > 21 mA ("fail high")
2.3 Prerequisites for operation
• The measuring system should be used appropriately taking pres-
sure, temperature, density and chemical properties of the medium
into account. The application-specic limits must be observed.
• The specications according to the operating instructions manual,
particularly the current load on the output circuits, must be kept
within the specied limits
• Existing communication interfaces (e. g. HART, USB) are not used
for transmission of the safety-relevant measured value
• The instructions in chapter "Safety-related characteristics", para-
graph "Supplementary information" must be noted
• All parts of the measuring chain must correspond to the planned
"Safety Integrity Level (SIL)"
Safety function
Safety tolerance
Safe state
Fault signals in case of
malfunction
Instructions and restric-
tions
7
SITRANS LG240, LG250, LG260 and LG270 - Safety Manual
47313-EN-170420
3 Safety-related characteristics
3.1 Characteristics acc. to IEC 61508
Parameter Value
Safety Integrity Level SIL2 in single-channel architecture
SIL3 in multiple channel architecture3)
Hardware fault tolerance HFT = 0
Instrument type Type B
Mode Low demand mode, High demand mode
SFF > 90 %
MTTR 8 h
MTBF = MTTF + MTTR4) 0.3 x 106 h (35 years)
Diagnostic test interval5) < 30 min
Failure rates
λSλDD λDU λHλLλAD λAU
0 FIT 2154 FIT 158 FIT 9 FIT 60 FIT 32 FIT 19 FIT
PFDAVG 0.133 x 10-2 (T1 = 1 year)
PFDAVG 0.196 x 10-2 (T1 = 2 years)
PFDAVG 0.382 x 10-2 (T1 = 5 years)
PFH 0.158 x 10-6 1/h
Proof Test Coverag (PTC)
Test type6) Remaining failure rate of danger-
ous undetected failures PTC
Test 1 11 FIT 93 %
Test 2 4 FIT 98 %
3.2 Characteristics acc. to ISO 13849-1
Derived from the safety-related characteristics, the following gures
result according to ISO 13849-1 (safety of machinery):7)
Parameter Value
MTTFd 47 years
DC 93 %
Performance Level 1.58 x 10-7 1/h
3) Homogeneous redundancy possible, because systematic capability SC3.
4) Including errors outside the safety function.
5) Time during which all internal diagnoses are carried out at least once.
6) See section "Proof test".
7) ISO 13849-1 was not part of the certication of the instrument.
8SITRANS LG240, LG250, LG260 and LG270 - Safety Manual
47313-EN-170420
3.3 Characteristics acc. to IEC 61508 for versions
with approval Ex-d-ia/XP-AIS
Parameter Value
Safety Integrity Level SIL2 in single-channel architecture
SIL3 in multiple channel architecture8)
Hardware fault tolerance HFT = 0
Instrument type Type B
Mode Low demand mode, High demand mode
SFF > 90 %
MTTR 8 h
MTBF = MTTF + MTTR9) 0.29 x 106 h (33 years)
Diagnostic test interval10) < 30 min
Failure rates
λSλDD λDU λHλLλAD λAU
11 FIT 2154 FIT 167 FIT 41 FIT 92 FIT 32 FIT 21 FIT
PFDAVG 0.141 x 10-2 (T1 = 1 year)
PFDAVG 0.206 x 10-2 (T1 = 2 years)
PFDAVG 0.404 x 10-2 (T1 = 5 years)
PFH 0.167 x 10-6 1/h
Proof Test Coverag (PTC)
Test type11) Remaining failure rate of danger-
ous undetected failures PTC
Test 1 20 FIT 88 %
Test 2 4 FIT 98 %
3.4 Characteristics acc. to ISO 13849-1 for
versions with approval Ex-d-ia/XP-AIS
Derived from the safety-related characteristics, the following gures
result according to ISO 13849-1 (safety of machinery):12)
Parameter Value
MTTFd 46 years
DC 93 %
Performance Level 1.67 x 10-7 1/h
8) Homogeneous redundancy possible, because systematic capability SC3.
9) Including errors outside the safety function.
10) Time during which all internal diagnoses are carried out at least once.
11) See section "Proof test".
12) ISO 13849-1 was not part of the certication of the instrument.
9
SITRANS LG240, LG250, LG260 and LG270 - Safety Manual
47313-EN-170420
3.5 Supplementary information
The failure rates of the instruments were determined by an FMEDA
according to IEC 61508. The calculations are based on failure rates of
the components according to SN 29500:
All gures refer to an average ambient temperature of 40 °C (104 °F)
during the operating time. For higher temperatures, the values should
be corrected:
• Continuous application temperature > 50 °C (122 °F) by factor 1.3
• Continuous application temperature > 60 °C (140 °F) by factor 2.5
Similar factors apply if frequent temperature uctations are expected.
• The failure rates are constant. Take note of the useful service life of
the components according to IEC 61508-2.
• Multiple failures are not taken into account
• Wear on mechanical parts is not taken into account
• Failure rates of external power supplies are not taken into account
• The environmental conditions correspond to an average industrial
environment
The values for PFDAVG specied above were calculated as follows for a
1oo1 architecture:
PFDAVG = + λDD x MTTR +
PTC × λ
DU
× T1
2
(1 – PTC) ×
λ
DU
× LT
2
Parameters used:
• T1 = Proof Test Interval
• PTC = 90 %
• LT = 10 years
• MTTR = 8 h
A connected control and processing unit must have the following
properties:
• The failure signals of the measuring system are judged according
to the idle current principle
• "fail low" and "fail high" signals are interpreted as a failure, where-
upon the safe state must be taken on
If this is not the case, the respective percentages of the failure rates
must be assigned to the dangerous failures and the values stated in
chapter Safety-related characteristics“ redetermined!
Due to the systematic capability SC3, this instrument can also be
used in multiple channel systems up to SIL3, also with a homogene-
ously redundant conguration.
The safety-related characteristics must be calculated especially for
the selected structure of the measuring chain using the stated failure
rates. In doing this, a suitable Common Cause Factor (CCF) must be
considered (see IEC 61508-6, appendix D).
Determination of the
failure rates
Assumptions of the
FMEDA
Calculation of PFDAVG
Congurationofthepro-
cessing unit
Multiple channel archi-
tecture
10 SITRANS LG240, LG250, LG260 and LG270 - Safety Manual
47313-EN-170420
4 Setup
4.1 General information
Take note of the mounting and installation instructions in the operating
instructions manual.
Setup must be carried out under process conditions.
When locking the adjustment, the instrument checks the data of the
measurement loop and decides on the basis of the evaluation results
if it is necessary to check the level.
Hence the following actions must be carried out at the time of every
startup:
• Unlock adjustment
• If necessary, change parameters
• Lock adjustment and verify modied parameters, if necessary
4.2 Instrument parameter adjustment
The following adjustment units are permitted for parameterization of
the safety function:
• Display and adjustment module
• The DTM suitable for SITRANS LG2*0 in conjunction with an
adjustment software according to the FDT/DTM standard, e. g.
PA C Twa r e
• The device description EDD suitable for SITRANS LG2*0
The parameter adjustment is described in the operating instructions
manual.
The documentation of the device settings is only possible with the full
version of the DTM Collection.
For protection against unwanted or unauthorzed adjustment, the set
parameters must be protected against unauthorized access. For this
reason, the instrument is shipped in locked condition. The PIN in
delivery status is "0000".
The default values of the parameters are listed in the operating in-
structions. When shipped with customer-specic parameter settings,
the instrument is accompanied by a list of the values diering from the
default values.
To avoid or detect possible errors during parameter adjustment for
unsafe operating environments, a verication procedure is used that
allows the safety-relevant parameters to be checked.
Parameter adjustment proceeds according to the following steps:
• Unlock adjustment
• Change parameters
• Lock adjustment and verify modied parameters
The exact process is described in the operating instructions.
The instrument is shipped in locked condition!
Mounting and installation
Function test
Tools
Safety-relevant param-
eters
Safe parameterization
11
SITRANS LG240, LG250, LG260 and LG270 - Safety Manual
47313-EN-170420
For verication, all modied, safety-relevant and non safety-relevant
parameters are shown.
The verication texts are displayed either in German or, when any
other menu language is used, in English.
Warning:
When adjustment is unlocked, the safety function must be considered
as unreliable. This applies until the parameters are veried and the
adjustment is locked again. If the parameter adjustment process is
not carried out completely, the device statuses described in the oper-
ating instructions must be taken into consideration.
If necessary, you must take other measures to maintain the safety
function.
Warning:
In case a reset to "Delivery status" or "Basic adjustment" is carried
out, all safety-relevant parameters must be checked or set anew.
Unsafe device
status
Instrument reset
12 SITRANS LG240, LG250, LG260 and LG270 - Safety Manual
47313-EN-170420
5 Diagnostics and servicing
5.1 Behaviour in case of failure
The instrument permanently monitored by an internal diagnostic
system. If a malfunction is detected, a failure signal will be outputted
on the safety-relevant output (see section "Safe status").
The diagnosis interval is specied in chapter "Safety-related charac-
teristics".
A fault message coded according to the type of fault is outputted. The
fault messages are listed in the operating instructions.
If failures are detected, the entire measuring system must be shut
down and the process held in a safe state by other measures.
The manufacturer must be informed of the occurrence of a dangerous
undetected failure (incl. fault description).
5.2 Repair
The procedure is described in the operating instructions manual. Note
the instructions for parameter adjustment and setup.
The procedure is described in the operating instructions manual. Note
the instructions for parameter adjustment and setup.
Internal diagnosis
Error messages in case
of malfunction
Electronics exchange
Software update
13
SITRANS LG240, LG250, LG260 and LG270 - Safety Manual
47313-EN-170420
6 Proof test
6.1 General information
To identify possible dangerous, undetected failures, the safety func-
tion must be checked by a proof test at adequate intervals. It is the
user's responsibility to choose the type of testing. The time intervals
are determined by the selected PFDAVG (see chapter "Safety-related
characteristics").
For documentation of these tests, the test protocol in the appendix
can be used.
If one of the tests proves negative, the entire measuring system must
be switched out of service and the process held in a safe state by
means of other measures.
In a multiple channel architecture this applies separately to each
channel.
• Determine safety function (mode, switching points)
• If necessary, remove the instruments from the safety chain and
maintain the safety function by other means
• Provide an approved adjustment unit
Warning:
During the function test, the safety function must be treated as unreli-
able. Take into account that the function test inuences downstream
connected devices.
If necessary, you must take other measures to maintain the safety
function.
After the function test, the status specied for the safety function must
be restored.
6.2 Test 1: Without checking the process variable
• Instrument can remain in installed condition
• Output signal corresponds to the assigned process variable
• Device status in the menu Diagnosis: "OK"
Distance from the sensor reference point to the level
• > 1000 mm with LG270.**4***A***** with reference distance
750 mm
• > 750 mm with LG270.**4***A***** with reference distance
500 mm
• > 500 mm with LG270.**4***A***** with reference distance
260 mm
• > 300 mm with LG2*0.******A***** without reference distance
1. Carry out a re-start (separate the test item at least 10 seconds
from mains voltage)
2. Press the menu item "Start proof test" in the menu Diagnosis on
the adjustment unit
Step 1: Output signal corresponds to the assigned process variable
and the device status in the menu Diagnosis is "OK"
Objective
Preparation
Unsafe device
status
Conditions
Procedure
Expected result
14 SITRANS LG240, LG250, LG260 and LG270 - Safety Manual
47313-EN-170420
Step 2: Adjustment unit signals "Test successful"
See Safety-related characteristics
6.3 Test 2: With check of the process variable
• Instrument can remain in installed condition
• Output signal corresponds to the assigned process variable
• Device status in the menu Diagnosis: "OK"
Distance from the sensor reference point to the level
• > 1000 mm with LG270.**4***A***** with reference distance
750 mm
• > 750 mm with LG270.**4***A***** with reference distance
500 mm
• > 500 mm with LG270.**4***A***** with reference distance
260 mm
• > 300 mm with LG2*0.******A***** without reference distance
1. Carry out a re-start (separate the test item at least 10 seconds
from mains voltage)
2. Press the menu item "Start proof test" in the menu Diagnosis on
the adjustment unit
3. Carry out the function test according to the operating instructions
just like during initial operation.
Step 1: Output signal corresponds to the assigned process variable
and the device status in the menu Diagnosis is "OK"
Step 2: Adjustment unit signals "Test successful"
Step 3: Successful function test
See Safety-related characteristics
Proof Test Coverage
Conditions
Procedure
Expected result
Proof Test Coverage
15
SITRANS LG240, LG250, LG260 and LG270 - Safety Manual
47313-EN-170420
7 Appendix A: Test report
Identication
Company/Tester
Plant/Instrument TAG
Meas. loop TAG
Instrument type/Order code
Instrument serial number
Date, setup
Date of the last proof test
Test reason/Test scope
Setup without checking the process variable
Setup with check of the process variable
Proof test without checking the process variable
Proof test with check of the process variable
Mode
Monitoring of an upper limit value
Monitoring a lower limit value
Range monitoring
Adjusted parameters of the safety function are documented
Ye s
No
Test result (if necessary)
Test point Process variable13) Expected measured
value
Real value Test result
Value 1
Value 2
Value 3
Value 4
Value 5
Conrmation
Date: Signature:
13) e.g.: limit level, level, interface, pressure, ow, density
16 SITRANS LG240, LG250, LG260 and LG270 - Safety Manual
47313-EN-170420
8 AppendixB:Termdenitions
SIL Safety Integrity Level (SIL1, SIL2, SIL3, SIL4)
SC Systematic Capability (SC1, SC2, SC3, SC4)
HFT Hardware Fault Tolerance
SFF Safe Failure Fraction
PFDAVG Average Probability of dangerous Failure on Demand
PFH Average frequency of a dangerous failure per hour (Ed.2)
FMEDA Failure Mode, Eects and Diagnostics Analysis
FIT Failure In Time (1 FIT = 1 failure/109 h)
λSD Rate for safe detected failure
λSU Rate for safe undetected failure
λSλS = λSD + λSU
λDD Rate for dangerous detected failure
λDU Rate for dangerous undetected failure
λHRate for failure, who causes a high output current (> 21 mA)
λLRate for failure, who causes a low output current (≤ 3.6 mA)
λAD Rate for diagnostic failure (detected)
λAU Rate for diagnostic failure (undetected)
DC Diagnostic Coverage
PTC Proof Test Coverage (Diagnostic coverage for manual proof tests)
T1 Proof Test Interval
LT Useful Life Time
MTBF Mean Time Between Failure
MTTF Mean Time To Failure
MTTR Mean Time To Restoration (Ed.2)
MRT Mean Repair Time
MTTFdMean Time To dangerous Failure (ISO 13849-1)
PL Performance Level (ISO 13849-1)
Abbreviations
17
SITRANS LG240, LG250, LG260 and LG270 - Safety Manual
47313-EN-170420
9 Supplement C: SIL conformity
Notes
18 SITRANS LG240, LG250, LG260 and LG270 - Safety Manual
47313-EN-170420
Notes
19
SITRANS LG240, LG250, LG260 and LG270 - Safety Manual
47313-EN-170420
Siemens Canada Limited
PD PA PI LW
1954 Technology Drive
P.O. Box 4225
Peterborough, ON
K9J 7B1, Canada
email: techpubs.smpi@siemens.com
www.siemens.com/processautomation
Subject to change without prior notice
Rev. 2.0
© Siemens AG 2017
For more information
www.siemens.com/level
www.siemens.com/weighing
