IEC 61784-3-2:2016

IEC 61784-3-2 ®
Edition 3.0 2016-07
INTERNATIONAL
STANDARD
NORME
INTERNATIONALE
colour
inside
Industrial communication networks – Profiles –
Part 3-2: Functional safety fieldbuses – Additional specifications for CPF 2

Réseaux de communication industriels – Profils –
Partie 3-2: Bus de terrain de sécurité fonctionnelle – Spécifications
supplémentaires pour CPF 2
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form
or by any means, electronic or mechanical, including photocopying and microfilm, without permission in writing from
either IEC or IEC's member National Committee in the country of the requester. If you have any questions about IEC
copyright or have an enquiry about obtaining additional rights to this publication, please contact the address below or
your local IEC member National Committee for further information.

Droits de reproduction réservés. Sauf indication contraire, aucune partie de cette publication ne peut être reproduite
ni utilisée sous quelque forme que ce soit et par aucun procédé, électronique ou mécanique, y compris la photocopie
et les microfilms, sans l'accord écrit de l'IEC ou du Comité national de l'IEC du pays du demandeur. Si vous avez des
questions sur le copyright de l'IEC ou si vous désirez obtenir des droits supplémentaires sur cette publication, utilisez
les coordonnées ci-après ou contactez le Comité national de l'IEC de votre pays de résidence.

IEC Central Office Tel.: +41 22 919 02 11
3, rue de Varembé Fax: +41 22 919 03 00
CH-1211 Geneva 20 info@iec.ch
Switzerland www.iec.ch
About the IEC
The International Electrotechnical Commission (IEC) is the leading global organization that prepares and publishes
International Standards for all electrical, electronic and related technologies.

About IEC publications
The technical content of IEC publications is kept under constant review by the IEC. Please make sure that you have the
latest edition, a corrigenda or an amendment might have been published.

IEC Catalogue - webstore.iec.ch/catalogue Electropedia - www.electropedia.org
The stand-alone application for consulting the entire The world's leading online dictionary of electronic and
bibliographical information on IEC International Standards, electrical terms containing 20 000 terms and definitions in
Technical Specifications, Technical Reports and other English and French, with equivalent terms in 15 additional
documents. Available for PC, Mac OS, Android Tablets and languages. Also known as the International Electrotechnical
iPad. Vocabulary (IEV) online.

IEC publications search - www.iec.ch/searchpub IEC Glossary - std.iec.ch/glossary
The advanced search enables to find IEC publications by a 65 000 electrotechnical terminology entries in English and
variety of criteria (reference number, text, technical French extracted from the Terms and Definitions clause of
committee,…). It also gives information on projects, replaced IEC publications issued since 2002. Some entries have been
and withdrawn publications. collected from earlier publications of IEC TC 37, 77, 86 and

CISPR.
IEC Just Published - webstore.iec.ch/justpublished

Stay up to date on all new IEC publications. Just Published IEC Customer Service Centre - webstore.iec.ch/csc
details all new publications released. Available online and If you wish to give us your feedback on this publication or
also once a month by email. need further assistance, please contact the Customer Service
Centre: csc@iec.ch.
A propos de l'IEC
La Commission Electrotechnique Internationale (IEC) est la première organisation mondiale qui élabore et publie des
Normes internationales pour tout ce qui a trait à l'électricité, à l'électronique et aux technologies apparentées.

A propos des publications IEC
Le contenu technique des publications IEC est constamment revu. Veuillez vous assurer que vous possédez l’édition la
plus récente, un corrigendum ou amendement peut avoir été publié.

Catalogue IEC - webstore.iec.ch/catalogue Electropedia - www.electropedia.org
Application autonome pour consulter tous les renseignements
Le premier dictionnaire en ligne de termes électroniques et
bibliographiques sur les Normes internationales,
électriques. Il contient 20 000 termes et définitions en anglais
Spécifications techniques, Rapports techniques et autres
et en français, ainsi que les termes équivalents dans 15
documents de l'IEC. Disponible pour PC, Mac OS, tablettes
langues additionnelles. Egalement appelé Vocabulaire
Android et iPad.
Electrotechnique International (IEV) en ligne.

Recherche de publications IEC - www.iec.ch/searchpub
Glossaire IEC - std.iec.ch/glossary
La recherche avancée permet de trouver des publications IEC 65 000 entrées terminologiques électrotechniques, en anglais
en utilisant différents critères (numéro de référence, texte, et en français, extraites des articles Termes et Définitions des
comité d’études,…). Elle donne aussi des informations sur les publications IEC parues depuis 2002. Plus certaines entrées
projets et les publications remplacées ou retirées. antérieures extraites des publications des CE 37, 77, 86 et

CISPR de l'IEC.
IEC Just Published - webstore.iec.ch/justpublished

Service Clients - webstore.iec.ch/csc
Restez informé sur les nouvelles publications IEC. Just
Published détaille les nouvelles publications parues. Si vous désirez nous donner des commentaires sur cette
Disponible en ligne et aussi une fois par mois par email. publication ou si vous avez des questions contactez-nous:
csc@iec.ch.
IEC 61784-3-2 ®
Edition 3.0 2016-07
INTERNATIONAL
STANDARD
NORME
INTERNATIONALE
colour
inside
Industrial communication networks – Profiles –

Part 3-2: Functional safety fieldbuses – Additional specifications for CPF 2

Réseaux de communication industriels – Profils –

Partie 3-2: Bus de terrain de sécurité fonctionnelle – Spécifications

supplémentaires pour CPF 2
INTERNATIONAL
ELECTROTECHNICAL
COMMISSION
COMMISSION
ELECTROTECHNIQUE
INTERNATIONALE
ICS 25.040.40, 35.100.05 ISBN 978-2-8322-3480-8

– 2 – IEC 61784-3-2:2016  IEC 2016
CONTENTS
FOREWORD. 12
0 Introduction . 14
0.1 General . 14
0.2 Patent declaration . 16
1 Scope . 17
2 Normative references . 17
3 Terms, definitions, symbols, abbreviated terms and conventions . 19
3.1 Terms and definitions . 19
3.1.1 Common terms and definitions . 19
3.1.2 CPF 2: Additional terms and definitions . 24
3.2 Symbols and abbreviated terms . 24
3.2.1 Common symbols and abbreviated terms . 24
3.2.2 CPF 2: Additional symbols and abbreviated terms. 25
3.3 Conventions . 26
4 Overview of FSCP 2/1 (CIP Safety™) . 26
4.1 General . 26
4.2 FSCP 2/1 . 26
5 General . 27
5.1 External documents providing specifications for the profile . 27
5.2 Safety functional requirements . 28
5.3 Safety measures . 28
5.4 Safety communication layer structure . 29
5.5 Relationships with FAL (and DLL, PhL) . 30
5.5.1 General . 30
5.5.2 Data types . 30
6 Safety communication layer services . 30
6.1 Introduction . 30
6.2 Connection object . 31
6.2.1 General . 31
6.2.2 Class attribute extensions . 31
6.2.3 Service extensions . 31
6.2.4 Explicit message response format for SafetyOpen and SafetyClose . 32
6.3 Connection Manager object . 32
6.3.1 General . 32
6.3.2 ForwardOpen for safety . 33
6.3.3 Safety network segment . 35
6.3.4 Originator rules for calculating the connection parameter CRC . 38
6.3.5 SafetyOpen processing flowcharts . 38
6.3.6 Checks required by Multipoint producers with existing connections . 41
6.3.7 Electronic key usage for safety . 42
6.3.8 RPI vs. API in safety connections . 42
6.3.9 Application path construction for safety . 42
6.3.10 Safety Validator connection types . 43
6.3.11 Application reply data in a successful SafetyOpen response . 46
6.3.12 Unsuccessful SafetyOpen response . 48
6.3.13 ForwardClose for safety . 50

6.4 Identity object . 50
6.4.1 General . 50
6.4.2 Changes to common services . 50
6.4.3 Extensions for CP 16/3 devices . 51
6.5 Link objects . 51
6.5.1 DeviceNet object changes . 51
6.5.2 TCP/IP Interface object changes . 52
6.5.3 SERCOS III Link object . 52
6.6 Safety Supervisor object. 53
6.6.1 General . 53
6.6.2 Safety Supervisor class attributes . 54
6.6.3 Subclasses . 54
6.6.4 Safety Supervisor instance attributes . 54
6.6.5 Semantics . 58
6.6.6 Subclasses . 64
6.6.7 Safety Supervisor common services . 64
6.6.8 Safety Supervisor behavior . 75
6.7 Safety Validator object . 82
6.7.1 General . 82
6.7.2 Class attributes . 82
6.7.3 Instance attributes . 83
6.7.4 Class services . 88
6.7.5 Instance services . 89
6.7.6 Object behavior . 89
6.8 Connection Configuration Object . 92
6.8.1 General . 92
6.8.2 Class attribute extensions . 92
6.8.3 Instance attributes, additions and extensions. . 92
6.8.4 Instance attribute semantics extensions or restrictions for safety . 95
6.8.5 Special Safety Related Parameters – (Attribute 13) . 99
6.8.6 Object-specific services . 105
6.8.7 Common service extensions for safety . 105
6.8.8 Object behavior . 107
7 Safety communication layer protocol . 108
7.1 Safety PDU format . 108
7.1.1 Safety PDU encoding . 108
7.1.2 Safety CRC . 120
7.2 Communication protocol behavior . 121
7.2.1 Sequence of safety checks . 121
7.2.2 Connection termination . 121
7.2.3 Cross checking error . 121
7.3 Time stamp operation . 122
7.4 Rollover counts in the EF . 123
7.5 Protocol sequence diagrams . 123
7.5.1 General . 123
7.5.2 Normal safety transmission . 123
7.5.3 Lost, corrupted and delayed message transmission . 124
7.5.4 Lost, corrupted or delayed message transmission with production
repeated . 127

– 4 – IEC 61784-3-2:2016  IEC 2016
7.5.5 Point-to-point ping . 129
7.5.6 Multipoint ping on CP 2/3 Safety . 130
7.5.7 Multipoint ping on CP 2/2 safety networks . 131
7.5.8 Multipoint ping – retry with success . 132
7.5.9 Multipoint ping – retry with timeout . 133
7.6 Safety protocol definition . 134
7.6.1 General . 134
7.6.2 High level view of a safety device . 134
7.6.3 Safety Validator object . 134
7.6.4 Relationship between SafetyValidatorServer and SafetyValidatorClient . 135
7.6.5 Extended Format time stamp rollover handling . 135
7.6.6 SafetyValidatorClient function definition . 140
7.6.7 SafetyValidatorServer function definition . 148
7.7 Safety message and protocol data specifications . 161
7.7.1 Mode octet . 161
7.7.2 Time Stamp Section . 162
7.7.3 Time Coordination Message . 162
7.7.4 Time correction message . 163
7.7.5 Safety data production . 163
7.7.6 Producer dynamic variables . 171
7.7.7 Producer per consumer dynamic variables . 173
7.7.8 Consumer data variables . 174
7.7.9 Consumer input static variables . 176
7.7.10 Consumer dynamic variables . 177
8 Safety communication layer management . 179
8.1 Overview . 179
8.2 Definition of the measures used during connection establishment . 179
8.3 Originator-Target relationship validation . 183
8.4 Detection of mis-routed connection requests . 183
8.5 SafetyOpen processing . 184
8.6 Ownership management . 184
8.7 Bridging different physical layers . 185
8.8 Safety connection establishment . 187
8.8.1 Overview . 187
8.8.2 Basic facts for connection establishment . 187
8.8.3 Configuring safety connections . 187
8.8.4 Network time expectation multiplier . 189
8.8.5 Establishing connections . 190
8.8.6 Recommendations for consumer number allocation . 193
8.8.7 Recommendations for connection establishment . 194
8.8.8 Ownership establishment . 194
8.8.9 Ownership use cases . 195
8.8.10 PID/CID usage and establishment . 198
8.8.11 Proper PID/CID usage in multipoint and point-to-point connections . 198
8.8.12 Network supported services . 200
8.8.13 FSCP 2/1 safety device type . 201
8.9 Safety configuration process . 205
8.9.1 Introduction to safety configuration . 205
8.9.2 Configuration goals . 205

8.9.3 Configuration overview . 206
8.9.4 User configuration guidelines . 207
8.9.5 Configuration process SIL3 justification . 208
8.9.6 Device functions for tool configuration . 209
8.9.7 Password security . 209
8.9.8 SNCT interface services . 209
8.9.9 Configuration lock . 209
8.9.10 Effect of configuration lock on device behavior . 210
8.9.11 Configuration ownership . 211
8.9.12 Configuration mode . 211
8.9.13 Measures used to ensure integrity of configuration process . 211
8.9.14 Download process . 213
8.9.15 Verification process . 216
8.9.16 Verification process . 218
8.9.17 Configuration error analysis . 219
8.10 Electronic Data Sheets extensions for safety . 223
8.10.1 General rules for EDS based safety devices . 223
8.10.2 EDS extensions for safety . 224
8.11 Requirements for CP 2/2 . 229
8.11.1 EPI rules for safety messages that travel over CP 2/2 . 229
8.11.2 Default safety I/O service . 229
8.11.3 Duplicate IP detection . 229
8.11.4 Priority for safety connections . 229
8.12 Requirements for CP 2/3 . 230
8.12.1 Allocation of CP 2/3 identifiers . 230
8.12.2 Additional requirements . 232
8.13 CP 16/3 requirements . 232
8.13.1 General architecture for CPF 2 on CP 16/3 . 232
8.13.2 Baseline FSCP 2/1 on CP 16/3 device . 233
8.13.3 Supported objects and services in CP 16/3 devices . 234
8.13.4 Transport layer requirements . 234
8.13.5 FSCP 2/1 and the CP 16/3 device model . 237
8.13.6 UNID assignment on CP 16/3 . 238
9 System requirements . 241
9.1 Indicators and switches . 241
9.1.1 General indicator requirements . 241
9.1.2 LED indications for setting the device UNID . 241
9.1.3 Module Status LED . 241
9.1.4 Indicator warning . 242
9.1.5 Network Status LED . 242
9.1.6 Switches . 243
9.2 Installation guidelines . 245
9.3 Safety function response time . 246
9.3.1 Overview . 246
9.3.2 Network time expectation . 246
9.3.3 Equations for calculating network reaction times . 247
9.4 Duration of demands . 249
9.5 Constraints for calculation of system characteristics . 249
9.5.1 Number of nodes . 249

– 6 – IEC 61784-3-2:2016  IEC 2016
9.5.2 Network PFH . 249
9.5.3 Bit Error Rate (BER) . 252
9.6 Maintenance . 253
9.7 Safety manual . 253
10 Assessment . 253
Annex A (informative) Additional information for functional safety communication
profiles of CPF 2 . 254
A.1 Hash function example code . 254
A.2 … . 268
Annex B (informative) Information for assessment of the functional safety
communication profiles of CPF 2 . 269
Bibliography . 270

Figure 1 – Relationships of IEC 61784-3 with other standards (machinery) . 14
Figure 2 – Relationships of IEC 61784-3 with other standards (process) . 15
Figure 3 – Relationship of Safety Validators . 27
Figure 4 – Communication layers . 30
Figure 5 – ForwardOpen with safety network segment . 34
Figure 6 – Safety network target format . 36
Figure 7 – Target Processing SafetyOpen with no configuration data (Form 2
SafetyOpen) . 39
Figure 8 – Target Processing for SafetyOpen with configuration data (Form 1
SafetyOpen) . 40
Figure 9 – Originator logic to determine which format to use . 41
Figure 10 – Applying device configuration . 68
Figure 11 – Configure and Validate processing flowcharts . 69
Figure 12 – UNID handling during “Waiting for TUNID” . 75
Figure 13 – Safety Supervisor state diagram . 76
Figure 14 – Configuration, testing and locked relationships . 80
Figure 15 – Safety connection types . 86
Figure 16 – Safety Validator state transition diagram . 90
Figure 17 – Logic for Auto-detecting format type . 104
Figure 18 – Connection Configuration Object state diagram . 107
Figure 19 – Connection Configuration Object data flow . 108
Figure 20 – Format of the mode octet . 109
Figure 21 – 1 or 2 octet data section, Base Format . 110
Figure 22 – 1 or 2 octet data section, Extended Format . 111
Figure 23 – 3 to 250 octet data section format, Base Format . 111
Figure 24 – 3 to 250 octet data section format, Extended Format . 112
Figure 25 – Time Stamp section format, Base Format . 113
Figure 26 – BF Time Coordination message encoding . 114
Figure 27 – EF Time Coordination message encoding . 114
Figure 28 – BF Time Correction message encoding . 115
Figure 29 – EF Time Correction message encoding . 115

Figure 30 – 1 or 2 octet point-to-point PDU encoding . 117
Figure 31 – 1 or 2 Octet multipoint PDU encoding . 117
Figure 32 – 1 or 2 Octet, multipoint, Format 2 safety connection format . 118
Figure 33 – 3 to 250 Octet Point-to-point PDU encoding . 118
Figure 34 – 3 to 248 Octet Multipoint PDU encoding . 119
Figure 35 – 3 to 248 Octet, Multipoint, safety connection format . 119
Figure 36 – CRC Calculation order for Extended Format messages . 120
Figure 37 – Time stamp sequence . 122
Figure 38 – Sequence diagram of a normal producer/consumer safety sequence . 123
Figure 39 – Sequence diagram of a normal producer/consumer safety sequence
(production repeated). 124
Figure 40 – Sequence diagram of a corrupted producer to consumer message . 125
Figure 41 – Sequence diagram of a lost producer to consumer message . 126
Figure 42 – Sequence diagram of a delayed message . 127
Figure 43 – Sequence diagram of a corrupted producer to consumer message with
production repeated . 128
Figure 44 – Sequence diagram of a connection terminated due to delays . 129
Figure 45 – Sequence diagram of a failure of safety CRC check . 129
Figure 46 – Sequence diagram of a point-to-point ping – normal response . 130
Figure 47 – Sequence diagram of a successful multipoint ping, CP 2/3 safety . 131
Figure 48 – Sequence diagram of a successful multipoint ping, CP 2/2 safety . 132
Figure 49 – Sequence diagram of a multipoint ping retry . 133
Figure 50 – Sequence diagram of a multipoint ping timeout . 133
Figure 51 – Safety device reference model entity relation diagram . 134
Figure 52 – Two devices interchanging safety data via a SafetyValidatorClient and a
SafetyValidatorServer . 135
Figure 53 – Point-to-point, originating consumer. target producer . 137
Figure 54 – Point-to-point, originator producer, target consumer . 138
Figure 55 – Multi-point, originator consumer, target producer . 139
Figure 56 – Safety production data flow . 140
Figure 57 – Consumer safety data monitoring . 149
Figure 58 – SafetyValidatorServer – application triggered . 150
Figure 59 – Target ownership . 183
Figure 60 – SafetyOpen forms . 184
Figure 61 – Connection ownership state chart . 185
Figure 62 – SafetyOpen UNID mapping . 185
Figure 63 – Common CPF 2 application layer . 186
Figure 64 – End-to-End routing example . 186
Figure 65 – Sources for safety related connection parameters . 189
Figure 66 – Parameter mapping between originator and target . 190
Figure 67 – CP 2/3 Safety connection establishment in targets for Form 2a SafetyOpen . 192
Figure 68 – General sequence to detect configuration is required . 193
Figure 69 – PID/CID exchanges for two originator scenarios . 198
Figure 70 – Seed generation for multipoint connections . 199

– 8 – IEC 61784-3-2:2016  IEC 2016
Figure 71 – PID/CID runtime handling . 200
Figure 72 – Connection categories and supported services . 203
Figure 73 – Recommended connection types . 204
Figure 74 – Logic-to-logic supported services . 204
Figure 75 – Recommended connection types for logic to logic . 205
Figure 76 – Configuration data transfers . 206
Figure 77 – Protection measures in safety devices . 208
Figure 78 – Configuration, testing and locked relationships . 210
Figure 79 – Originator's configuration data . 212
Figure 80 – SNCT to device download process . 214
Figure 81 – SNCT Downloads to originators that perform Form 1 configuration . 215
Figure 82 – Protection from locking and ownership . 217
Figure 83 – Example of read back and comparison of original and printout . 217
Figure 84 – Diverse display without full data read back . 218
Figure 85 – Verification process including all alternatives . 219
Figure 86 – Baseline FSCP 2/1 on CP 16/3 device . 233
Figure 87 – FSCP 2/1 Adaptation Layer and SMP interaction . 236
Figure 88 – FSCP 2/1 Adaptation . 237
Figure 89 – CP 16/3 device model . 238
Figure 90 – Adding a standard module to a modular device . 240
Figure 91 – Safety device NodeID processing logic . 245
Figure 92 – Safety function response time . 246
Figure 93 – Safety function response time components . 248
Figure 94 – Network protocol reliability block diagram (RBD) . 249
Figure 95 – Network PFH summary . 251
Figure 96 – Extended Format PFH summary . 252

Table 1 – Communications errors and detection measures matrix . 29
Table 2 – New class attributes . 31
Table 3 – Service extensions . 32
Table 4 – SafetyOpen and SafetyClose response format . 32
Table 5 – Safety network segment identifier . 35
Table 6 – Safety network segment definition . 35
Table 7 – Safety network segment router format . 37
Table 8 – Safety Network Segment Extended Format . 37
Table 9 – Multipoint producer parameter evaluation rules . 42
Table 10 – ForwardOpen setting options for safety connections . 44
Table 11 – Network connection parameters for safety connections . 46
Table 12 – CP 2/3 Safety target application reply (size: 10 octets) . 46
Table 13 – EF CP 2/3 Safety target application reply (size: 14 octets) . 47
Table 14 – SafetyOpen target application reply (size: 18 octets) . 47
Table 15 – EF SafetyOpen target application reply (size: 22 octets) . 48
Table 16 – New and extended error codes for safety . 48

Table 17 – SafetyOpen error event guidance table . 49
Table 18 – Identity object common service changes . 51
Table 19 – Identity object extensions for CP 16/3 devices . 51
Table 20 – New DeviceNet object instance attribute . 51
Table 21 – New TCP/IP Interface object instance attribute . 52
Table 22 – SERCOS III Link object class attributes . 52
Table 23 – SERCOS III Link object instance attributes . 53
Table 24 – SERCOS III Link Object Common Services .
...