Pulsar R80 80GHz FMCW Radar Level Transmitter User Manual

SIL Functional Safety Manual
for Pulsar ® Model R80
Software Version 1. x
Model R80
80GHz FMCW Radar
Level Transmitter

This manual complements and is intended to be used with the Pulsar ®Model R80 Installation and Operating Manual (Bulletin 58-604).

Application
The Pulsar Model R80 (HART® ) Frequency Modulated Continuous Wave (FMCW) level transmitter can be applied in most indoor and outdoor processes or storage vessels. The  Pulsar Model R80 can be used in liquids or slurries to meet the safety system requirements of IEC 61508.

Benefits
The Magnetrol  ® Model R80 (HART) transmitter provides the following benefits to your operation:

• Protection up to SIL2 as independently assessed (hardware assessment) by exida as per IEC 61508. Safe Failure Fraction: 92.3%
• Antenna designs to +400 °F (+200 °C), -14.5 to 1000 psi (-1 to 70 bar)
• IS, XP, and Non-Incendive approvals
• Quick connect/disconnect antenna coupling
• Performance is not process-dependent (changing specific gravity and dielectric have no effect).

Pulsar® Model R80 FMCW Level Transmitter SIL 2 Suitable

Table 1
Pulsar® Model Number

R80-511-aXX (a=0, 1, C or D)| Intrinsically Safe
R80 is energy limited but not isolated from the current loop.
---|---
R80-511-aXX (a=3)| Explosion Proof
R80 is galvanically isolated from the current loop.

 Introduction

1.1 Product Description
The Pulsar® Model R80 Level Transmitter is a loop-powered, 24 VDC level transmitter based on FMCW Radar technology. For Safety Instrumented Systems usage, it is assumed that the 4–20 mA output is used as the primary safety variable. The analog output meets NAMUR NE 43 (3.8 mA to 20.5 mA usable), and the transmitter contains self-diagnostics and can be programmed to send its output to a user-selected failure state, either low or high upon internal detection of a failure. The device can be equipped with or without an LCD display. Table 1 lists the versions of the PULSAR Model R80 that have been considered for the hardware assessment.

1.2 Theory of Operation
The Pulsar R80 is a top-mounted, downward-facing FMCW radar transmitter operating at 80 GHz. It transmits a continuous signal with a constantly changing frequency down toward the liquid. The detected difference in frequencies between the transmitted signal and return echo is a function of the distance.

Table 2
SIL vs. PFDavg

Safety Integrity Level (SIL)| Target Average probability of failure on demand (PFDavg)
---|---
4| ³10-5 to <10-4
3| ³10-4 to <10-3
2| ³10-3 to <10-2
1| ³10-2 to <10-1

1.3 Determining Safety Integrity Level (SIL)
Tables 2 & 3 define the criteria for the achievable SIL against the target mode of operation in Demand Mode Operation.
Safety Instrumented System designers using the Pulsar Model R80 must verify their design per applicable standards, including IEC 61508. Three limits must be met to achieve a given SIL level: PFDavg, Architecture Constraints, and Systematic Capability:

Table 3
Minimum hardware fault tolerance
Type B sensors, final elements, and non-PE logic solvers

1. The PFDavg numbers for the entire Safety Instrumented Function (SIF) must be calculated. Table 2 shows the relationship between the Safety Integrity Level (SIL) and the Average Probability of Failure on Demand (PFDavg). The failure rates of the PULSAR Model R80 Level Transmitter are inputs to the calculation of the PFDavg of the SIF in which it is used.

2. Architecture constraints must be met for each subsystem per the requirement in IEC 61508.
   The use of the Pulsar Model R80 Radar Level Transmitter must be constrained by Table 3 in order to meet the minimum hardware fault tolerance architectural constraints for a SIL 2 safety function.

3. All products chosen for use in a SIF must be developed to at least the Systematic Capability corresponding to the SIF’s SIL, or by documenting an argument that justifies an equivalent systematic capability per the proven in-use requirements in IEC 61508.
   The Eclipse Enhanced Model 705 3X Guided Radar Level Transmitter has been certified as meeting Systematic Capability for SIL 3 (SC3).
   The existential tool from exida is recommended for design SIL verification of a SIF. It contains all needed failure rates, failure mode, SIL Capability, and common cause data as well as suggested proof test methods and can automatically check all three limits and display the results for any given SIF design. The Pulsar Model R80 is in the  xSILentia database.

Level Measuring System

The diagram shows the structure of a typical measuring system incorporating the Magnetrol Pulsar Model R80 FMCW radar transmitter.
This SIL-rated device is only available with an analog signal (4–20 mA) with HART digital communication. (The measurement signal used by the logic solver must be the analog 4– 20 mA signal proportional to the level generated).
For fault monitoring, the logic unit must recognize both high alarms (21.5 mA) and low alarms (3.6 mA). If the logic solver loop uses intrinsic safety barriers, caution must be taken to ensure the loop continues to operate properly under the low alarm condition.
The only unsafe mode is when the unit is reading an incorrect level within the 4–20mA range (> ±2% deviation). MAGNETROL defines a safe failure as one in which the 4–20 mA current is driven out of range (i.e., less than 3.8 mA or greater than 20.5 mA).

2.1 Applicable Models
This manual is applicable to the following Pulsar FMCW
Radar transmitters: R80-511-aXX (a=0, 1, 3, C or D)

2.2 Miscellaneous Electrical Considerations
The following are miscellaneous electrical issues to be considered.
2.2.1 Pollution Degree 3
The Pulsar system is designed for use in Category II, Pollution Degree 3 installations.
The typical pollution degree used for equipment being evaluated to IEC/EN 61010 is nonconductive pollution of the sort where a temporary conductivity caused by condensation might be expected.

2.2.2 Overvoltage
The Magnetrol Model R80 has over-voltage protection per CE requirements. When considering Hi-pot, Fast Transients, and Surge, this protection is to 1000 volts. Therefore, there should be no unsafe failure modes up to 1 VK.
Overvoltage Category II is a local level, covering appliances, portable equipment, etc., with smaller transient overvoltages than that characteristic of Overvoltage Category III. This category applies from the wall plug to the power-supply isolation barrier (transformer). The typical plant environment is Overvoltage Category II, so most equipment evaluated to the requirements of IEC/EN 61010 is considered to belong in that classification.

Mean Time To Repair (MTTR)

SIL determinations are based on a number of factors including the Mean Time To Repair (MTTR). The analysis for the Pulsar Model R80 is typically based on an MTTR of 24
hours.

Supplementary Documentation

The Pulsar Model R80 Installation and Operating Manual Bulletin 58-604 must be available for the installation of the measuring system.
One of the following Electronic Device Description Files is also required if HART is used:
Manufacturer Code 0x0056
Model R80 1.x Device ID 0x56DD, device revision 1,
DD revision 1.
For device installations in a classified area, the relevant safety instructions and electrical codes must be followed.

Instructions

5.1 Systematic Limitations
The following factors must be observed to avoid systematic failures.

5.1.1 Application

Choosing the proper Radar antenna is the most important step in the application decision process. The antenna configuration establishes fundamental performance characteristics. Therefore, the horn antenna for use with the Pulsar Model R80 should be selected as appropriate for the application.
Refer to Installation and Operating Manual 58-604 for more detailed application information and limitations.

5.1.2 Environmental
Refer to Installation and Operating Manual 58-604 for environmental limitations.

5.2 Skill Level of Personnel
Personnel following the procedures of this safety manual
should have technical expertise equal to or greater than that
of a qualified instrument technician.
5.3 Necessary Tools
Following are the necessary tools needed to carry out the prescribed procedures:

• Open wrenches or adjustable wrenches to fit the process connection size and type.
• Flat-blade screwdriver
• Digital Multimeter

5.4 Storage
The device should be stored in its original shipping box and not be subjected to temperatures outside the storage temperature (-50 to +80 °C) shown in the Pulsar Model R80  Installation and Operating Manual and associated specifications.

5.5 Installation
Refer to the Pulsar Model R80 Installation and Operating Manual Bulletin 58-604 for the proper installation instructions.
I/O Manual 58-604 contains information on the use, changing, and resetting of the password protection function.
I/O Manual 58-604 also provides menu selection items for the configuration of the transmitter as a level sensing device and contains configuration recommendations.
This SIL evaluation has assumed that the customer will be able to acknowledge an over or under-current condition via the Logic Solver.
5.6 Configuration
5.6.1 General
The Magnetrol Pulsar Model R80 can be configured via the local display, or via HART compatible handheld terminal or personal computer.
Ensure the parameters have been properly configured for the application.
Special consideration should be given to the following configuration parameters:
DIELECTRIC RANGE: Enter the Dielectric Range for the material to be measured:
Above 10 (Water-based media)
3.0 to 10 (Mid-dielectric media)
1.7 to 3.0 (Most typical hydrocarbons)
Below 1.7 (Light Hydrocarbons like Propane and Butane)
PV ALARM SELECTION : Do NOT choose HOLD for this parameter as a Fault will not be annunciated on the current loop.
LOOP CURRENT MODE : ensure this is set to ENABLED.
PASSWORD: should be changed to a specific value other than Zero. See Section 5.6.2

5.6.2 Write Protecting / Locking
The Pulsar Model R80 is password protected with a numerical password between 0 and 59999 (Default=0=Password disabled).
Refer to the Pulsar Model R80 Installation and Operating Manual Bulletin 58-604 for information on password protection.

5.6.3 Write Enabling / Unlocking
When the alterations to the system are complete, ensure the menu has been locked with the password to prevent inadvertent changes to the device.

5.7 Site Acceptance Testing
To ensure proper operation after installation and configuration a site acceptance test should be completed. This procedure is identical to the Proof Test Procedure described in Section 6.1.4.
5.8 Recording Results
Results of Site Acceptance Testing must be recorded for future reference.

5.9 Maintenance
5.9.1 Diagnostics
Internal diagnostic testing does a complete cycle approximately four times per minute. A message will appear and the Output current will be driven to 3.6 or 22 mA (customer selectable) upon detection of a Diagnostic Failure. The worst- case internal fault detection time is four minutes.

5.9.2 Troubleshooting
Report all failures to Magnetrol.
Refer to the Pulsar Model R80 Installation and Operating Manual Bulletin 58-604 for troubleshooting device errors.

• As there are no moving parts in this device, the only maintenance required is the proof test.
• Firmware can only be upgraded by factory-trained personnel.

Recurrent Function Tests

6.1 Proof Testing
6.1.1 Introduction
Following are the procedures utilized to detect Dangerous Undetected (DU) failures. The procedure will detect approximately 90% of possible DU failures in the Model R80.

6.1.2 Interval
To maintain the Safety Integrity Level of a Safety
Instrumented System, it is imperative that the entire system be tested at regular time intervals (referred to as TI in the appropriate standards). The onus is on the owner/operator to select the type of inspection and the time period for these tests.
The system check must be carried out to prove that the functions meet the IEC specification and result in the desired response of the safety system as a whole.
This system check can be guaranteed when the response height is approached in the filling process; though, if this is not practical, a suitable method of simulating the level of the physical measurement must be used to make the level sensor respond as if the fill fluid were above the alarm/set point level. If the operability of the sensor/transmitter can be determined by other means that exclude all fault conditions that may impair the normal functions of the device, the check may also be completed by simulating the corresponding output signal of the device.

6.1.3 Recording results
Results of the Proof Test should be recorded for future reference.

6.1.4 Proof Test Procedure

1. Bypass the PLC or take other action to avoid a false trip.

2. Inspect the Unit in detail outside and inside for physical damage or evidence of environmental or process leaks.
   a. Inspect the exterior of the Unit housing. If there is any evidence of physical damage that may impact the integrity of the housing and the environmental protection, the unit should be repaired or replaced.
   b. Inspect the interior of the Unit. Any evidence of moisture, from the process or environment, is an indication of housing damage, and the unit should be repaired or replaced.

3. Use the Unit’s DIAGNOSTICS menu to observe Present Status, and review EVENT HISTORY in the Event Log. Up to 20 events are stored. The events will be date and time stamped if the internal clock is set and running. It is suggested that the internal clock be set at the time of commissioning of the unit. If the clock is set at the time of the proof test, event times are calculated.
   a. Choose the menu DIAGNOSTICS / Present Status.
   i. Present Status should be OK.
   b. Choose the menu DIAGNOSTICS / EVENT HISTORY / Event Log
   i. Any FAULT or WARNING messages must be investigated and understood.
   ii. Corrective actions should be taken for FAULT messages.

4. Use the DIAGNOSTICS menu to perform a “CURRENT LOOP TEST”. Choose the menu DIAGNOSTICS / ADVANCED DIAGNOSTICS / TRANSMITTER  TESTS / Analog Output Test to change the output loop current and confirm the actual current matches the value chosen.
   a. Send a HART command to the transmitter (or use the local interface) to go to the high alarm current output, 22mA, and verify that the analog current reaches that value.
   i. This step tests for compliance voltage problems such as low supply voltage or increased wiring resistance.
   ii. This also tests for the current loop control circuitry and adjustment problems.
   b. Send a HART command to the transmitter (or use the local interface) to go to the low alarm current output, 3.6mA, and verify that the analog current reaches that value. i. This step tests for high quiescent current and supply voltage problems.
   ii. This also tests for the current loop control circuitry and adjustment problems.
   c. Exit the “Analog Output Test” and confirm that the output returns to its original state, with the proper loop current as indicated and controlled by the unit.

5. Use the DIAGNOSTICS menu to observe the present Echo Curve. Confirm that the ECHO Waveform is normal. The echo curve is dependent on the type of antenna used, the installation conditions, and the level of the process. Comparison of the present Echo curve to one stored at the time of commissioning the unit gives additional confidence in the normal operation of the unit. The use of DTM and digital communications is necessary for the comparison of echo curves.
   a. Choose the menu DIAGNOSTICS / ECHO CURVES / View Echo Curve
   i. Observe the present Echo Curve, and identify the characteristic portions of the waveform related to the Initial Launch, Process level, and other features.
   ii. Confirm that the Initial Launch appears acceptable. Confirm that Initial Launch is located where expected.
   iii. Confirm that the signal from the process level appears normal and is located as expected.
   iv. Compare to the Echo curve from commissioning in the Initial Launch area.

6. Perform 2 point calibration check of the transmitter by varying level to two points in the process and compare the transmitter display reading and the current level value to a known reference measurement.

7. If the calibration is correct the proof test is complete. Proceed to step 9.

8. If the calibration is incorrect, remove the transmitter and antenna from the process. Inspect the antenna for coating. Clean the antenna, if necessary. Perform a bench calibration check by placing a metal reflector at two points in front of the antenna. Measure the distance between the two points and compare it to the transmitter display and current level readings.
   A a. If the calibration is off by more than 2%, call the factory for assistance.
   b. Re-install the antenna and transmitter.

9. Restore loop to full operation.

 Appendices

7.1 FMEDA Report: Exida Management Summary

Failure Modes, Effects, and Diagnostic Analysis
Project:
Pulsar Model R80
Company:
Magnetrol – Ametek
Aurora, IL
USA
Contract Number: 021/10-073
Report No.: MAG 21;10-073 R001
Version V1, Revision R2, March 11, 2022
Rudolf Chalupa
The document was prepared using her. effort The authors make no warranty of any kind and shall not be liable for any
event for incidental or consequential damages in connection Mth the application of the document.
All rights reserved.

7.2 SIL Declaration of Conformity
Hardware functional safety according to Section 2.4.4 of IEC 61508-2 (Edition 2.0: 2010).
Magnetrol International, Incorporated 705 Enterprise Street, Aurora, Illinois 60504 declares as the manufacturer, that the level transmitter:
FMCW Radar (4-20 mA) Model R80-511x-xxx
is suitable for use in safety-instrumented loops according to IEC 61508 on the condition that “the good practice of engineering rules” as described in the IEC standards, the appropriate parts of IEC 61508, and the following parameters of the instrument are applied.

Product| Model R80-511x-a xx (a=0, 1, C, D)| Model R80-511x-box (a=3 or B)
---|---|---
SIL| 2| 2
Proof Test Interval| 1 Year| 1 Year
Device Type| B| B
SFF| 92.3%| 92.2%
LSD| 0 FIT| 0 FIT
LSU| 77 FIT| 192 FIT
Ltd| 791 FIT| 727 FIT
and| 72 FIT| 78 FIT

7.3 Specific Model R80 Values

Product

|

Pulsar
R80-511-aXX
(a=1 or A)

|

Pulsar
R80-511-aXX
(a=3 or B)

---|---|---
SIL| SIL 2
HFT| 0
SFF| 92.3%| 92.2%

Refer to Section 5 and Appendix D of the Model R80 FMEDA report for PFDavg information.

7.4 Report: Lifetime of Critical Components
According to section 7.4.9.5 of IEC 61508-2, a useful lifetime, based on experience, should be assumed.
Although a constant failure rate is assumed by the probabilistic estimation method, this only applies provided that the useful lifetime* of components is not exceeded. Beyond their useful lifetime, the result of the probabilistic calculation method is therefore meaningless, as the probability of failure significantly increases with time. The useful lifetime is highly dependent on the subsystem itself and its operating conditions.

This assumption of a constant failure rate is based on the bathtub curve. Therefore, it is obvious that the PFDavg calculation is only valid for components that have this constant domain and that the validity of the calculation is limited to the useful life of each component.
It is the responsibility of the end user to maintain and operate the R80 per the manufacturer’s instructions. Furthermore, regular inspection should show that all components are clean and free from damage.
The R80 has an estimated useful lifetime of about 50 years.
When plant experience indicates a shorter useful lifetime than indicated in this appendix, the number based on plant experience should be used.

• Useful lifetime is a reliability engineering term that describes the operational time interval where the failure rate of a device is relatively constant. It is not a term that covers product obsolescence, warranty, or other commercial issues.

References

• IEC 61508-1: 2010-04
• IEC 61508-2: 2010-04
• IEC 61508-3: 2010-04

Disclaimer
Magnetrol accepts no liability whatsoever for the use of these numbers or for the correctness of the standards on which the general calculation methods are based.

ASSURED QUALITY & SERVICE COST LESS

Service Policy
Owners of Magnetrol controls may request the return of control or any part of control for complete rebuilding or replacement. They will be rebuilt or replaced promptly.
Controls returned under our service policy must be returned by prepaid transportation. Magnetrol will repair or replace the control at no cost to the purchaser (or owner) other  than transportation if:

1. Returned within the warranty period; and
2. The factory inspection finds the cause of the claim to be covered under the warranty.

If the trouble is the result of conditions beyond our control; or, is NOT covered by the warranty, there will be charges for labor and the parts required to rebuild or replace the equipment.
In some cases, it may be expedient to ship replacement parts; or, in extreme cases a complete new control, to replace the original equipment before it is returned. If this is desired, notify the factory of both the model and serial numbers of the control to be replaced. In such cases, credit for the materials returned will be determined on the basis of the applicability of our warranty.
No claims for misapplication, labor, or direct or consequential damage will be allowed.

Return Material Procedure
So that we may efficiently process any materials that are returned, it is essential that a “Return Material Authorization” (RMA) number be obtained from the factory prior to the material’s return. This is available through a Magnetrol local representative or by contacting the factory. Please supply the following information:

1. Company Name
2. Description of Material
3. Serial Number
4. Reason for Return
5.  Application

Any unit that was used in a process must be properly cleaned in accordance with OSHA standards before it is returned to the factory.
A Material Safety Data Sheet (MSDS) must accompany material that was used in any media.
All shipments returned to the factory must be by prepaid transportation.
All replacements will be shipped F.O.B. factory.

705 Enterprise Street
• Aurora, Illinois 60504-8149 USA
630.969.4000
• info.magnetrol@ametek.com
• magnetrol.com
Copyright © 2022 AMETEK Magnetrol USA, LLC
BULLETIN: 58-652.0
EFFECTIVE: July 2022

Documents / Resources

| Pulsar R80 80GHz FMCW Radar Level Transmitter [pdf] User Manual
R80, 80GHz FMCW Radar Level Transmitter, R80 80GHz FMCW Radar Level Transmitter
---|---

References

• Magnetrol

Read User Manual Online (PDF format)

Read User Manual Online (PDF format)  >>

Download This Manual (PDF format)

Download this manual  >>