Safety Considerations Guide for Trident v2 Systems - TUV ...

18 Chapter 2 Application Guidelines
— The application must check the value (of each variable written) for a valid range or
limit before its use.
• If the external computer or operator station is certified to SIL capability 3 according to
IEC 61508, there must be a safety protocol to allow safe communication between the
external system and the application. The communication link is considered a black
channel (a communication channel without available evidence of design or validation)
and it must be assumed that it can corrupt any communication. As a result, the safety
protocol needs to mitigate or protect against the following errors:
— Corruption—Messages may be corrupted due to one or more of the following:
errors within the black channel, errors on the transmission medium, or message
interference.
— Unintended Repetition—An error, fault, or interference causes old un-updated
messages to be repeated at an incorrect point in time.
— Incorrect Sequence—An error, fault, or interference causes the predefined
sequence (for example, natural numbers and time references) associated with
messages from a particular source to be incorrect.
— Loss—An error, fault, or interference causes a message to not be received or not be
acknowledged.
— Unacceptable Delay—Messages may be delayed beyond their permitted arrival
time window due to one or more of the following: errors in the transmission
medium, congested transmission lines, interference, or black channel components
sending messages in such a way that services are delayed or denied (for example:
first in, first outs—FIFOs—in switches, bridges, and routers).
— Insertion—A fault or interference causes a message to be inserted that relates to an
unexpected or unknown source entity.
— Masquerade—A fault or interference causes a message to be inserted that relates to
an apparently valid source entity, resulting in a non-safety-relevant message being
received by a safety-relevant participant, which then incorrecly treats the message
as safety-relevant.
— Addressing—A fault or interference causes a safety-relevant message to be sent to
the wrong safety-relevant participant, which then treats the reception of that
message as correct.
• The Modbus and TSAA protocols currently do not have safety measures for the errors
described above. It is up to the system designer to mitigate against these errors in
accordance with the applicable standards for their industry to meet the required SIL
capability.
The following table describes several measures commonly used to detect deterministic
errors and failures of a communication system. Each safety measure can provide
protection against one or more errors in the transmission. There is at least one
corresponding safety measure, or combination of safety measures, for each error.
Safety Considerations Guide for Trident v2 Systems