IEC 61784-3-2:2007

IEC 61784-3-2 ®
Edition 1.0 2007-12
INTERNATIONAL
STANDARD
NORME
INTERNATIONALE
colour
inside
Industrial communication networks – Profiles –
Part 3-2: Functional safety fieldbuses – Additional specifications for CPF 2

Réseaux de communication industriels – Profils –
Partie 3-2: Bus de terrain de sécurité fonctionnelle – Spécifications
supplémentaires pour CPF 2
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form
or by any means, electronic or mechanical, including photocopying and microfilm, without permission in writing from
either IEC or IEC's member National Committee in the country of the requester.
If you have any questions about IEC copyright or have an enquiry about obtaining additional rights to this publication,
please contact the address below or your local IEC member National Committee for further information.

Droits de reproduction réservés. Sauf indication contraire, aucune partie de cette publication ne peut être reproduite ni
utilisée sous quelque forme que ce soit et par aucun procédé, électronique ou mécanique, y compris la photocopie et les
microfilms, sans l'accord écrit de la CEI ou du Comité national de la CEI du pays du demandeur.
Si vous avez des questions sur le copyright de la CEI ou si vous désirez obtenir des droits supplémentaires sur cette
publication, utilisez les coordonnées ci-après ou contactez le Comité national de la CEI de votre pays de résidence.

IEC Central Office Tel.: +41 22 919 02 11
3, rue de Varembé Fax: +41 22 919 03 00
CH-1211 Geneva 20 info@iec.ch
Switzerland www.iec.ch
About the IEC
The International Electrotechnical Commission (IEC) is the leading global organization that prepares and publishes
International Standards for all electrical, electronic and related technologies.

About IEC publications
The technical content of IEC publications is kept under constant review by the IEC. Please make sure that you have the
latest edition, a corrigenda or an amendment might have been published.

Useful links:
IEC publications search - www.iec.ch/searchpub Electropedia - www.electropedia.org
The advanced search enables you to find IEC publications The world's leading online dictionary of electronic and
by a variety of criteria (reference number, text, technical electrical terms containing more than 30 000 terms and
committee,…). definitions in English and French, with equivalent terms in
It also gives information on projects, replaced and additional languages. Also known as the International
withdrawn publications. Electrotechnical Vocabulary (IEV) on-line.

IEC Just Published - webstore.iec.ch/justpublished Customer Service Centre - webstore.iec.ch/csc
Stay up to date on all new IEC publications. Just Published If you wish to give us your feedback on this publication
details all new publications released. Available on-line and or need further assistance, please contact the
also once a month by email. Customer Service Centre: csc@iec.ch.

A propos de la CEI
La Commission Electrotechnique Internationale (CEI) est la première organisation mondiale qui élabore et publie des
Normes internationales pour tout ce qui a trait à l'électricité, à l'électronique et aux technologies apparentées.

A propos des publications CEI
Le contenu technique des publications de la CEI est constamment revu. Veuillez vous assurer que vous possédez
l’édition la plus récente, un corrigendum ou amendement peut avoir été publié.

Liens utiles:
Recherche de publications CEI - www.iec.ch/searchpub Electropedia - www.electropedia.org
La recherche avancée vous permet de trouver des Le premier dictionnaire en ligne au monde de termes
publications CEI en utilisant différents critères (numéro de électroniques et électriques. Il contient plus de 30 000
référence, texte, comité d’études,…). termes et définitions en anglais et en français, ainsi que
Elle donne aussi des informations sur les projets et les les termes équivalents dans les langues additionnelles.
publications remplacées ou retirées. Egalement appelé Vocabulaire Electrotechnique
International (VEI) en ligne.
Just Published CEI - webstore.iec.ch/justpublished
Service Clients - webstore.iec.ch/csc
Restez informé sur les nouvelles publications de la CEI.
Just Published détaille les nouvelles publications parues. Si vous désirez nous donner des commentaires sur
Disponible en ligne et aussi une fois par mois par email. cette publication ou si vous avez des questions
contactez-nous: csc@iec.ch.
IEC 61784-3-2 ®
Edition 1.0 2007-12
INTERNATIONAL
STANDARD
NORME
INTERNATIONALE
colour
inside
Industrial communication networks – Profiles –

Part 3-2: Functional safety fieldbuses – Additional specifications for CPF 2

Réseaux de communication industriels – Profils –

Partie 3-2: Bus de terrain de sécurité fonctionnelle – Spécifications

supplémentaires pour CPF 2
INTERNATIONAL
ELECTROTECHNICAL
COMMISSION
COMMISSION
ELECTROTECHNIQUE
PRICE CODE
INTERNATIONALE
CODE PRIX XH
ICS 25.040; 35.100.05 ISBN 978-2-8322-0888-5

– 2 – 61784-3-2 © IEC:2007
CONTENTS
FOREWORD . 11
INTRODUCTION . 13
1 Scope . 16
2 Normative references . 16
3 Terms, definitions, symbols, abbreviated terms and conventions . 17
3.1 Terms and definitions . 17
3.1.1 Common terms and definitions . 17
3.1.2 CPF 2: Additional terms and definitions . 21
3.2 Symbols and abbreviated terms. 22
3.2.1 Common symbols and abbreviated terms . 22
3.2.2 CPF 2: Additional symbols and abbreviated terms . 22
3.3 Conventions . 23
4 Overview of FSCP 2/1 (CIP Safety™) . 23
4.1 General . 23
4.2 FSCP 2/1 . 23
5 General . 24
5.1 External documents providing specifications for the profile . 24
5.2 Safety functional requirements . 25
5.3 Safety measures . 25
5.4 Safety communication layer structure . 26
5.5 Relationships with FAL (and DLL, PhL) . 26
5.5.1 General . 26
5.5.2 Data types . 26
6 Safety communication layer services . 27
6.1 Introduction . 27
6.2 Connection object . 27
6.2.1 General . 27
6.2.2 Class attribute extensions . 27
6.2.3 Service extensions . 28
6.2.4 Explicit message response format for SafetyOpen and SafetyClose . 28
6.3 Connection Manager object . 29
6.3.1 General . 29
6.3.2 ForwardOpen for safety . 29
6.3.3 Safety network segment . 31
6.3.4 Originator rules for calculating the connection parameter CRC . 33
6.3.5 SafetyOpen processing flowcharts . 33
6.3.6 Checks required by Multipoint producers with existing connections . 36
6.3.7 Electronic key usage for safety . 36
6.3.8 RPI vs. API in safety connections . 36
6.3.9 Application path construction for safety . 36
6.3.10 Safety Validator connection types . 38
6.3.11 Application reply data in a successful SafetyOpen response . 39
6.3.12 Unsuccessful SafetyOpen response . 40
6.3.13 ForwardClose for safety . 43
6.4 Identity object . 43
6.4.1 General . 43

61784-3-2 © IEC:2007 – 3 –
6.4.2 Changes to common services . 43
6.5 Link objects . 44
6.5.1 DeviceNet object changes . 44
6.5.2 TCP/IP Interface object changes . 44
6.6 Safety Supervisor object. 45
6.6.1 General . 45
6.6.2 Safety Supervisor class attributes . 45
6.6.3 Subclasses . 46
6.6.4 Safety Supervisor instance attributes . 46
6.6.5 Semantics . 49
6.6.6 Subclasses . 55
6.6.7 Safety Supervisor common services . 55
6.6.8 Safety Supervisor behavior . 66
6.7 Safety Validator object . 73
6.7.1 General . 73
6.7.2 Class attributes . 73
6.7.3 Instance attributes . 74
6.7.4 Class services . 80
6.7.5 Instance services . 80
6.7.6 Object behavior . 81
6.8 Connection Configuration Object . 84
6.8.1 General . 84
6.8.2 Class attribute extensions . 84
6.8.3 Instance attributes, additions and extensions. . 84
6.8.4 Instance attribute semantics extensions or restrictions for safety . 86
6.8.5 Special Safety Related Parameters – (Attribute 13) . 91
6.8.6 Object-specific services . 95
6.8.7 Common service extensions for safety . 95
6.8.8 Object behavior . 97
7 Safety communication layer protocol . 98
7.1 Safety PDU format . 98
7.1.1 Safety PDU encoding . 98
7.1.2 Safety CRC . 108
7.2 Communication protocol behavior . 109
7.2.1 Sequence of safety checks . 109
7.2.2 Connection termination . 109
7.2.3 Cross checking error . 109
7.3 Time stamp operation . 110
7.4 Protocol sequence diagrams . 111
7.4.1 General . 111
7.4.2 Normal safety transmission . 111
7.4.3 Lost, corrupted and delayed message transmission . 112
7.4.4 Lost, corrupted or delayed message transmission with production
repeated . 115
7.4.5 Point-to-point ping . 117
7.4.6 Multipoint ping on CP 2/3 Safety . 118
7.4.7 Multipoint ping on CP 2/2 safety networks . 119
7.4.8 Multipoint ping – retry with success . 120
7.4.9 Multipoint ping – retry with timeout . 121

– 4 – 61784-3-2 © IEC:2007
7.5 Safety protocol definition . 122
7.5.1 General . 122
7.5.2 High level view of a safety device . 122
7.5.3 Safety Validator object . 123
7.5.4 Relationship between SafetyValidatorServer and
SafetyValidatorClient . 123
7.5.5 SafetyValidatorClient function definition . 124
7.5.6 SafetyValidatorServer function definition . 132
7.6 Safety message and protocol data specifications. 142
7.6.1 Mode octet . 142
7.6.2 Time Stamp Section . 143
7.6.3 Time Coordination Message . 143
7.6.4 Time correction message . 144
7.6.5 Safety data production . 144
7.6.6 Producer dynamic variables . 151
7.6.7 Producer per consumer dynamic variables . 153
7.6.8 Consumer data variables . 155
7.6.9 Consumer input static variables . 157
7.6.10 Consumer dynamic variables . 157
8 Safety communication layer management . 159
8.1 Overview . 159
8.2 Definition of the measures used during connection establishment . 160
8.3 Originator-Target relationship validation . 163
8.4 Detection of mis-routed connection requests . 164
8.5 SafetyOpen processing . 164
8.6 Ownership management . 165
8.7 Bridging different physical layers . 166
8.8 Safety connection establishment . 167
8.8.1 Overview . 167
8.8.2 Basic facts for connection establishment . 167
8.8.3 Configuring safety connections . 168
8.8.4 Network time expectation multiplier . 169
8.8.5 Establishing connections . 171
8.8.6 Recommendations for consumer number allocation . 173
8.8.7 Recommendations for connection establishment . 174
8.8.8 Ownership establishment . 174
8.8.9 Ownership use cases . 175
8.8.10 PID/CID usage and establishment . 178
8.8.11 Proper PID/CID usage in multipoint and point-to-point connections . 178
8.8.12 Network supported services . 180
8.8.13 FSCP 2/1 Safety device type . 181
8.9 Safety configuration process . 185
8.9.1 Introduction to safety configuration . 185
8.9.2 Configuration goals . 185
8.9.3 Configuration overview . 186
8.9.4 User configuration guidelines . 187
8.9.5 Configuration process SIL3 justification . 188
8.9.6 Device functions for tool configuration . 189
8.9.7 Password security . 189

61784-3-2 © IEC:2007 – 5 –
8.9.8 SNCT interface services . 189
8.9.9 Configuration lock . 189
8.9.10 Effect of configuration lock on device behavior . 190
8.9.11 Configuration ownership . 191
8.9.12 Configuration mode . 191
8.9.13 Measures used to ensure integrity of configuration process . 191
8.9.14 Download process . 193
8.9.15 Verification process . 196
8.9.16 Verification process . 199
8.9.17 Configuration error analysis . 200
8.10 Electronic Data Sheets extensions for safety . 203
8.10.1 General rules for EDS based safety devices . 203
8.10.2 EDS extensions for safety . 204
9 System requirements . 208
9.1 Indicators and switches . 208
9.1.1 General indicator requirements . 208
9.1.2 LED indications for setting the device UNID . 208
9.1.3 Module Status LED . 209
9.1.4 Indicator warning . 209
9.1.5 Network Status LED . 209
9.1.6 MACID determination . 211
9.1.7 Reset switch . 212
9.2 Installation guidelines . 213
9.3 Safety function response time . 213
9.3.1 Overview . 213
9.3.2 Network time expectation . 213
9.3.3 Equations for calculating network reaction times . 214
9.4 Duration of demands . 216
9.5 Constraints for calculation of system characteristics . 216
9.5.1 Number of nodes . 216
9.5.2 Network PFH . 216
9.5.3 Bit Error Rate (BER) . 218
9.6 Maintenance . 219
9.7 Safety manual . 219
10 Certification . 219
Annex A (informative) Additional information for functional safety communication
profiles of CPF 2 . 220
A.1 Hash function example code . 220
Bibliography . 232

Table 1 – Communications errors and detection measures matrix . 25
Table 2 – New class attributes . 27
Table 3 – Service extensions . 28
Table 4 – SafetyOpen and SafetyClose response format . 28
Table 5 – Safety network segment identifier . 31
Table 6 – Safety network segment definition . 31
Table 7 – Safety network segment router format . 33

– 6 – 61784-3-2 © IEC:2007
Table 8 – Multipoint producer parameter evaluation rules . 36
Table 9 – ForwardOpen setting options for safety connections . 38
Table 10 – Network connection parameters for safety connections . 39
Table 11 – CP 2/3 Safety target application reply (size: 10 octets) . 40
Table 12 – SafetyOpen target application reply (size: 16 octets) . 40
Table 13 – New and extended error codes for safety . 41
Table 14 – SafetyOpen error event guidance table . 42
Table 15 – Identity object common service changes . 43
Table 16 – New DeviceNet object instance attribute . 44
Table 17 – New TCP/IP Interface object Instance Attribute . 44
Table 18 – Safety Supervisor class attributes . 45
Table 19 – Safety Supervisor instance attributes . 46
Table 20 – Device status attribute state values . 50
Table 21 – Exception status attribute format . 50
Table 22 – Common exception detail attribute values . 51
Table 23 – Exception detail format summary . 52
Table 24 – Summary of device behavior for various CFUNID values . 54
Table 25 – Safety Supervisor common services . 56
Table 26 – Safety Supervisor object specific services . 56
Table 27 – Configure_Request message structure . 58
Table 28 – Validate_Configuration message structure. 58
Table 29 – Validate_Configuration success message structure . 58
Table 30 – Validate_Configuration error code . 59
Table 31 – Validate_Configuration extended codes . 59
Table 32 – Set_Password message structure . 61
Table 33 – Reset_Password message structure . 61
Table 34 – Configuration_Lock/Unlock message structure . 62
Table 35 – Mode_Change message structure . 62
Table 36 – Safety_Reset message structure . 63
Table 37 – Safety Supervisor safety reset types . 63
Table 38 – Attribute bit map parameter . 63
Table 39 – Reset processing rules for rest types . 64
Table 40 – Propose_TUNID service . 64
Table 41 – Apply_TUNID service . 65
Table 42 – Safety Supervisor events . 67
Table 43 – State event matrix for Safety Supervisor . 68
Table 44 – Configuration owner control vs. device state . 71
Table 45 – State mapping of Safety Supervisor to Identity object . 72
Table 46 – Safety Supervisor object event mapping . 72
Table 47 – Identity object event mapping . 73
Table 48 – Safety Validator class attributes . 74
Table 49 – Safety Validator instance attributes . 74
Table 50 – Safety Validator state assignments . 77

61784-3-2 © IEC:2007 – 7 –
Table 51 – Safety Validator type, bit field assignments . 77
Table 52 – Multipoint producer SafetyOpen parameter evaluation rules . 79
Table 53 – Safety Validator class services . 80
Table 54 – Safety Validator instance services . 80
Table 55 – Safety Validator Get_Attributes_All service data . 81
Table 56 – Safety Validator state event matrix . 83
Table 57 – State mapping between Safety Supervisor and Safety Validator objects . 84
Table 58 – Connection configuration object class attribute extensions . 84
Table 59 – Connection Configuration Object instance attribute additions/extensions . 85
Table 60 – Connection flag bit definitions. 87
Table 61 – O-to-T connection parameters . 88
Table 62 – T-to-O connection parameters . 89
Table 63 – Data map formats . 90
Table 64 – Data map format 0 . 91
Table 65 – Data map format 1 . 91
Table 66 – Target device’s SCCRC values . 93
Table 67 – Target device’s SCTS values . 94
Table 68 – Time correction connection parameters for multipoint connection . 94
Table 69 – Connection Configuration Object-specific services . 95
Table 70 – Get_Attributes_All Response service data (added attributes ) . 96
Table 71 – Set_Attributes_All Request service data (added attributes) . 96
Table 72 – State Mapping between Safety Supervisor and the CCO objects . 97
Table 73 – Connection sections and PDU formats. 99
Table 74 – Mode octet variables . 100
Table 75 – Time Stamp variables . 102
Table 76 – Time Coordination message variables . 103
Table 77 – Time Correction Message variables . 105
Table 78 – CRC polynomials used . 108
Table 79 – Connection sections and message formats . 109
Table 80 – Data reception - Link triggered . 134
Table 81 – Time_Correction reception - Link triggered . 135
Table 82 – Data reception - Application triggered. 135
Table 83 – Time_Correction reception - Application triggered . 135
Table 84 – Consuming application – Safety data monitoring . 136
Table 85 – Producer connection status determination . 145
Table 86 – Consuming safety connection status . 155
Table 87 – Connection establishment errors and measures to detect errors . 160
Table 88 – SNN Date/Time allocations . 161
Table 89 – SNN legal range of time values . 161
Table 90 – Safety connection parameters . 169
Table 91 – SafetyOpen summary . 171
Table 92 – Originator/Target service mapping . 182
Table 93 – Unsupported originator/target service types . 182

– 8 – 61784-3-2 © IEC:2007
Table 94 – Configuration goals . 186
Table 95 – Configuration owner control vs. device state . 191
Table 96 – Errors and detection measures . 200
Table 97 – Parameter class keywords . 205
Table 98 – New Connection Manager section keywords for safety . 205
Table 99 – Connection Manager field usage for safety . 206
Table 100 – Connection parameter field settings for safety . 207
Table 101 – LED indications for setting UNID . 208
Table 102 – Module Status LED . 209
Table 103 – Network status LED states . 210
Table 104 – Connection reaction time type – producing/consuming applications . 214

Figure 1 – Relationships of IEC 61784-3 with other standards (machinery) . 13
Figure 2 – Relationships of IEC 61784-3 with other standards (process) . 14
Figure 3 – Relationship of Safety Validators . 24
Figure 4 – Communication layers . 26
Figure 5 – ForwardOpen with safety network segment . 30
Figure 6 – Safety network target format . 32
Figure 7 – Target Processing SafetyOpen with no configuration data (Form 2
SafetyOpen) . 34
Figure 8 – Target Processing for SafetyOpen with configuration data (Form 1
SafetyOpen) . 35
Figure 9 – Applying device configuration . 59
Figure 10 – Configure and Validate processing flowcharts . 60
Figure 11 – UNID handling during “Waiting for TUNID” . 66
Figure 12 – Safety Supervisor state diagram . 67
Figure 13 – Configuration, testing and locked relationships . 71
Figure 14 – Safety connection types . 78
Figure 15 – Safety Validator state transition diagram . 82
Figure 16 – Connection Configuration Object state diagram . 97
Figure 17 – Connection Configuration Object data flow . 98
Figure 18 – Format of the mode octet . 99
Figure 19 – 1 or 2 octet data section . 100
Figure 20 – 3 to 250 octet data section format . 101
Figure 21 – Time Stamp section format . 102
Figure 22 – Time Coordination message encoding . 103
Figure 23 – Time Correction message encoding . 104
Figure 24 – 1 or 2 octet point-to-point PDU encoding . 106
Figure 25 – 1 or 2 Octet multipoint PDU encoding . 106
Figure 26 – 1 or 2 Octet, multipoint, Format 2 safety connection format . 107
Figure 27 – 3 to 250 Octet Point-to-point PDU encoding . 107
Figure 28 – 3 to 248 Octet Multipoint PDU encoding . 107
Figure 29 – 3 to 248 Octet, Multipoint, safety connection format . 108

61784-3-2 © IEC:2007 – 9 –
Figure 30 – Time stamp sequence . 110
Figure 31 – Sequence diagram of a normal producer/consumer safety sequence . 111
Figure 32 – Sequence diagram of a normal producer/consumer safety sequence
(production repeated) . 112
Figure 33 – Sequence diagram of a corrupted producer to consumer message . 113
Figure 34 – Sequence diagram of a lost producer to consumer message . 114
Figure 35 – Sequence diagram of a delayed message . 115
Figure 36 – Sequence diagram of a corrupted producer to consumer message with
production repeated . 116
Figure 37 – Sequence diagram of a connection terminated due to delays . 117
Figure 38 – Sequence diagram of a failure of safety CRC check . 117
Figure 39 – Sequence diagram of a point-to-point ping - normal response . 118
Figure 40 – Sequence diagram of a successful multipoint ping, CP 2/3 safety . 119
Figure 41 – Sequence diagram of a successful multipoint ping, CP 2/2 safety . 120
Figure 42 – Sequence diagram of a multipoint ping retry . 121
Figure 43 – Sequence diagram of a multipoint ping timeout . 121
Figure 44 – Safety device reference model entity relation diagram . 122
Figure 45 – Two devices interchanging safety data via a SafetyValidatorClient and a
SafetyValidatorServer . 123
Figure 46 – Safety production data flow . 124
Figure 47 – Consume
...