Safety Considerations Guide for Trident v2 Systems - TUV ...

24 Chapter 2 Application Guidelines
If new data is not received within the time-out period (equal to half of the process-tolerance
time), the application on the receiving node should be able to determine the action to take. The
specific actions depend on the unique safety requirements of your process. The following
sections summarize actions typically required by Peer-to-Peer send and receive functions.
Note Due to a lack of information on the reliability and safety of switched or public networks,
Invensys recommends that switched or public networks not be used for safety-critical
Peer-to-Peer communication between Triconex controllers.
Sending Node
Actions typically required in the logic of the sending application are:
• The sending node must set the SENDFLG parameter in the send call to true (1) so that
the sending node sends new data as soon as the acknowledgment for the last data is
received from the receiving node.
• The SEND function block (TR_USEND) must include a diagnostic integer variable that
is incremented with each new send initiation so that the receiving node can check this
variable for changes every time it receives new data. This new variable should have a
range of 1 to 65,535 where the value 1 is sent with the first sample of data. When this
variable reaches the limit of 65,535, the sending node should set this variable back to 1
for the next data transfer. This diagnostic variable is required because the
communication path is not triplicated like the I/O system.
• The number of SEND functions in an application must be less than or equal to five
because the controller only initiates five SEND functions per scan. To send data as fast
as possible, the SEND function must be initiated as soon as the acknowledgment for the
last data is received from the receiving node.
• The sending application must monitor the status of the RECEIVE (TR_URCV) and
TR_PORT_STATUS functions to determine whether there is a network problem that
requires operator intervention.
Receiving Node
Actions typically required in the logic of the receiving application are:
• To transfer safety-critical data, the basic rule is that the receiving node must receive at
least one sample of new data within the maximum time-out limit. If this does not
happen, the application for the receiving node must take one or more of the following
actions, depending on requirements:
— Use the last data received for safety-related decisions.
— Use default values for safety-related decisions in the application.
— Check the status of the TR_URCV and TR_PORT_STATUS functions to see whether
there is a network problem that requires operator intervention.
• The receiving node must monitor the diagnostic integer variable every time it receives
new data to determine whether this variable has changed from last time.
Safety Considerations Guide for Trident v2 Systems