Safety Management Systems SAFETY MANAGER COMMUNICATION BEST PRACTICE GUIDE

Transcription

1 Safety Management Systems SAFETY MANAGER COMMUNICATION BEST PRACTICE GUIDE EP-SM.MAN.6844 ISSUE #2 JANUARY, 2018

2 Document ID Release Issue Date EP-SM.MAN.6844 Issue #2 January, 2018 DISCLAIMER This document contains Honeywell proprietary information. Information contained herein is to be used solely for the purpose submitted, and no part of this document or its contents shall be reproduced, published, or disclosed to a third party without the express permission of Honeywell International Sàrl. While this information is presented in good faith and believed to be accurate, Honeywell disclaims the implied warranties of merchantability and fitness for a purpose and makes no express warranties except as may be stated in its written agreement with and for its customer. In no event is Honeywell liable to anyone for any direct, special, or consequential damages. The information and specifications in this document are subject to change without notice. Copyright Honeywell International Sàrl

3 Table of Contents 1 Communication best practices About network environments and network devices Types of connection Safety Manager and connected devices Terms and definitions Example of Safety Manager connected to an Experion FTE network 6 2 Safety Station Configurations Safety Stations - overview Examples of Physical Network properties Safety Station redundant connection via FTE Safety Station redundant SafeNet connection Separate Safety Station Multiple FTE communities Without SafeNet connection between communities With SafeNet connection between communities 16 3 SafeNet Configurations SafeNet time-out time Ethernet Serial RS485/ RS232 (Low baud rate communication) 22 4 Safety Manager Universal Safety IO 23 5 Experion Advanced Integration (CDA) 26 6 Experion Integration (SCADA) 28 7 Peer Control Data Interface (PCDI) 30 8 FDM Field Device Manager HART communication 32 9 Modbus Configuration ModbusTCP Serial Modbus Slave-Slave communication Packed coils 42

4 Table of Contents (...Continued) 10 Real-time clock synchronization IEC61010 (Ethernet surge protection) Security recommendations and best practices Security Guidelines for (pre-) installing Safety Manager Safety Manager Engineering tools Troubleshooting List of abbreviations Safety Manager Glossary Notices Documentation feedback How to report a security vulnerability Support Training classes 91

5 CHAPTER 1 1 Communication best practices Process control and safeguarding functions in today's process industry are highly automated via computerized systems. One advantage of computerization is the possibility of gathering and exchanging digitized information of process parameters and values. In order to make optimal use of this and to be able to provide adequate information to plant operators, both the process control systems and the safeguarding systems must have communication capabilities to exchange relevant data. This document provides: information about network environments Safety Manager operates in, and typical devices in those network environments, examples of how to connect a community of Safety Managers to each other, and how to connect other devices to Safety Manager, best practices to set up and configure communication. 1.1 About network environments and network devices Types of network Devices need to be connected to each other in order to enable communication. This can be done by connecting any two devices directly, or by including them in a network environment. Inclusion in a network is most commonly applied and assumed in this document. Safety Manager basically operates in two types of network: Ethernet serial Both serve specific goals and support specific applications, depending on the needs and choices of the user. The paragraph below describes some aspects with respect to these choices. Ethernet versus serial communication When starting a project from scratch, Ethernet is the best practice. Ethernet communication is the faster, most flexible and universal. Ethernet communication has several advantages over serial communication. Some of these are: Ethernet communication allows simultaneous communication of multiple connections and protocols via one physical port. With Ethernet for instance it is possible to configure connections to Experion, a PTP/NTP clock source as well as several Safety Stations and

6 Chapter: 1 Communication best practices Modbus TCP connections on one communication channel of an USI module. Ethernet communication also allows multiple Nodes per device type (e.g. multiple Modbus Nodes), to address one Peer and vice versa. The number of connectable nodes is much higher than those for serial communication. Serial communication may be a logical choice for existing plants, if replacing the existing serial communication infrastructure proves to be too costly. Attention: A so-called first contact between Safety Builder and a SM Controller requires a temporary connection, and must be done via RS232 serial connection. The procedure how to do this is included in the Installation and Upgrade Guide, see section Load an application (off-line). Experion Advanced Integration As of release Safety Manager R150, Safety Manager supports Experion Advanced Integration. Within the Experion Fault Tolerant Ethernet (FTE) network topology Safety Manager is a full FTEnode. Both Ethernet channels on an USI module (typically the first module) will be merged in a single logical Ethernet interface. Hence no protocols can be configured on the B-channel of an USI that is connected to an FTE-network Types of connection As mentioned before, devices need to be connected to each other in order to enable communication. Various types of connection exist to achieve this. All types of connection have in common that they must be: physically present (the devices are actually connected), and logically configured (the devices can actually communicate) Safety Manager uses these types of connection: Physical Ethernet (e.g. Ethernet, FTE) Serial (e.g. RS232, RS485) Logical Protocols that support this: Safety Builder, SafeNet, CDA, SCADA, PCDI, ModbusTCP Protocols that support this: Safety Builder, SafeNet, ModbusRTU Safety Manager and connected devices Safety Manager can communicate with the devices listed in the table below. Honeywell 2

7 Chapter: 1 Communication best practices Device Safety Station Additional information Dedicated PC with Safety Builder application (Safety Builder protocol) RUSIO/RUSLS modules (part of Safety Manager) SM Universal Safety IO Note: Safety Manager can control up to a maximum of 28 universal IO modules independent of whether it is a redundant configuration, non-redundant configuration, or a combination of both. Other Safety Managers Experion Servers Experion Process controllers Experion FDM Server In a SafeNet network (SafeNet protocol) This can be done by applying: Experion Advanced Integration (CDA protocol) Experion Integration (SCADA protocol) Peer to peer communication can be done by using: the CDA protocol the PCDI protocol This can be done by applying: Experion Advanced Integration (CDA protocol) Experion Integration (SCADA protocol) PTP and NTP based clocks Safety Historian Third party HMI/DCS devices In case of Experion Integration (SCADA protocol) via Modbus RTU and Modbus TCP/IP Communication with these devices is done by a dedicated module within the Safety Manager Controller; this is the Universal Safety Interface (USI) module. A Safety Manager Controller has one or two USI modules, depending on the number and/or combinations of protocols that need to communicate with that controller. For this purpose each USI module has four ports that can be allocated as required. Honeywell 3

8 Chapter: 1 Communication best practices In case of Ethernet communication it is also necessary to apply specific IP address assignment for devices that are connected to Safety Manager. The paragraphs below provide relevant details. Port allocation Safety Manager supports various protocols that can be allocated in any combination. Some protocols can be allocated to all channels; some can only be allocated to a specific channel. The table below gives an overview. USI Comm module 1 USI Comm module 2 Channel TCP/IP Serial TCP/IP Serial A B C D A B C D Safety Builder x x x x x x x x SafeNet x x x x x x x x Universal Safety IO x Universal Safety IO A.R.T. x x Experion CDA 1) x x Experion SCADA 2) x x PCDI 3) x x x x FDM 3) x x x x Safety Historian x x x x x x Modbus TCP/IP x x x x Modbus RTU x x x x Note: 1. CDA implies FTE. 2. SCADA implies Ethernet (non-fte). 3. Preferable channel A, as this is connected to the FTE network. IP address assignment When assigning IP addresses, gateways and subnet masks, check with your organization's IT network administrator to identify specific addresses that may be used at your facility. While there will be no conflict with Internet networks, your organization may already use one or more private networks. The considerations listed below assist in assigning valid IP address ranges: Honeywell 4

9 Chapter: 1 Communication best practices Only assign IP addresses within the IP address space reserved for private networks. Follow the Experion FTE addressing guidelines when assigning IP addresses as part of an FTE network (for details see the Experion User Guides). When assigning an IP address, take into account that you must assign a unique IP address for each Control Processor. Best practice is not to use 0 or 255 at the end of a Safety Manager Controller IP address. IP addresses of communication interface A and B of the same communication module cannot be in an overlapping subnet. When there is no gateway address available in your network, best practice is to set the gateway the same as the IP-address of channel A Terms and definitions Network device components When discussing network device components, a single component can act more than once in different roles. Each component can act as a Network Node and/or a Network Peer on a single Ethernet channel. Each component can act as Network Master or as Network Slave on a serial communication channel. Network Node A Network Node communicates via a communication channel and is a device component (Safety Manager, CEE controller, Modbus Master, etc.) that initiates, and controls, communication sessions with Peers. A network (e.g. SafeNet or Modbus) can have multiple Nodes per network layer; SafeNet network Nodes can logically connect to up to 62 Peers; SafeNet network Nodes can also act as Peer in the same or adjacent network layers; SafeNet network Nodes have the ability (as an option) to reset Peer systems. Network Peer A Peer communicates via an Ethernet channel and is a device component that responds to a communication initiative from network Nodes, such as other Safety Managers, Modbus devices, CEE controllers, etc. Network Peers may communicate with several Nodes simultaneously via one physical communication channel; A Peer in a SafeNet network may be logically connected to up to 62 Nodes per Safety Manager Controller; A Peer in other networks may be connected to a total of: eight Modbus Nodes and CEE Nodes per Ethernet channel, one Experion server and/or, Honeywell 5

10 Chapter: 1 Communication best practices up to four Safety Stations (running Safety Builder). Network Peers on SafeNet can also act as Node in the same or adjacent network layers. Network Master A network master communicates via a serial communication channel and is a device component (such as a Safety Manager or a Modbus Master) that initiates, and controls, communication sessions with connected slave systems. Networks (e.g. SafeNet or Modbus) can have only one master per network layer; Network masters in a SafeNet network can logically connect to up to 62 slaves, but the RS485 driver standard allows no more than 16 connections per physical network; A network master in a SafeNet network can only act as slave in adjacent network layers; A network master in a SafeNet network has the ability (as an option) to reset slave systems. Network Slave A network slave communicates via a serial communication channel and is a device component that responds to a communication initiative from a network master such as another Safety Manager or a Modbus Master. Network slaves can communicate with either a SafeNet master or a Modbus RTU master; A network slave in a SafeNet network can only act as master in adjacent network layers Example of Safety Manager connected to an Experion FTE network Safety Manager connected to an Experion FTE network Safety Manager can be physically connected to the Experion FTE network by using the Ethernet channels of the USI communication modules. Connection to the FTE provides direct access to other devices in the FTE community: Experion servers Safety Stations CEE controllers (S)NTP clock sources PTPv2 clock sources Safety Manager can act either as a Non-FTE node or as a Full FTE node. Non FTE node As a non-fte node, the Safety Manager resides inside the FTE community as a redundant Controller. Control Processor 1 is connected to the Yellow switches and Control Processor 2 is connected to the Green switches. Honeywell 6

11 Chapter: 1 Communication best practices Figure 1.1 Levels FTE Network (non FTE node) Best practice is to connect the Safety Manager to Level 1. It is not mandatory to use a CF-9 to connect the Safety Manager to the FTE. More detailed information about the FTE philosophy and connection can be found in the Experion Network Best Practices White Paper. Full FTE node As a full FTE node, the Safety Manager resides inside the FTE community as a redundant Controller, where both Control Processors are connected to both the Yellow and the Green legs of the FTE network. Its connection status will be visible in the FTE status screens on the Experion server and stations. Honeywell 7

12 Chapter: 1 Communication best practices Figure 1.2 Levels FTE Network (full FTE node) Honeywell 8

13 CHAPTER 2 2 Safety Station Configurations A Safety Station is a dedicated PC on which the Safety Builder application is installed. Basically, there are two options to establish a physical connection between a Safety Station and Safety Manager. These options are: an Ethernet connection a serial RS232/RS485 connection In both cases the Safety Builder protocol is configured to support communication. Attention: A so-called first contact between Safety Builder and a SM Controller requires a temporary connection, and must be done via RS232 serial connection. The procedure how to do this is included in the Installation and Upgrade Guide, see section Load an application (off-line). Only after Safety Manager has been loaded and an Ethernet connection is configured, you can start using the Ethernet connection for communication with the Safety Station. Best practice is to configure any spare serial channel (if wired to DCOM) with the Safety Builder protocol. In this way a backup communication medium to Safety Manager is provided. 2.1 Safety Stations - overview The table below shows the network types a Safety Station can operate in, and relevant aspect. Safety Manager can communicate with the devices listed in the table below. Network type Ethernet FTE Relevant aspects Preferred type of network. Easy remote and local access to Safety Manager Controller. Safety Station with shared HSE (100Mb Ethernet) link. Safety Station can be part of Experion FTE network. Equivalent to Ethernet. Required in combination with Experion CDA integration. Allocates both Ethernet ports A and B of one USI.

14 Chapter: 2 Safety Station Configurations Network type RS232 1) Relevant aspects Typically used for local access to Safety Manager Controller (at the Controller cabinet). Maximum distance is 15 meter. Only point-to-point connection is supported. Dedicated multidrop network to several Safety Managers. RS485/422 1) Maximum distance is 500 meter. Distances larger than 500 meter can be covered with Fiber Optics extenders. Note: 1. About serial links: To be able to communicate between a Safety Station and a Safety Manager Controller via a serial link, you need to configure the Safety Builder protocol on channel C or D. Safety Stations on an FTE network can connect to multiple Safety Managers by using FTE to access directly connected Safety Managers and to underlying Safety Managers. (Underlying Safety Managers are Safety Managers that are connected via SafeNet to a Safety Manager that is connected to the FTE network) Attention: It is strongly advised to keep data processing networks such as FTE and SafeNet separated from public (office) networks. Best practice is to create a physically fully-separated network for SafeNet Examples of Physical Network properties This section shows examples for the configuration of physical networks that are used to connect a Safety Station to Safety Manager (i.e. the Safety Manager Controller). Only some properties are discussed here. As mentioned before, there are basically two options: Ethernet Serial Network name Try to use a meaningful name for your network. In the example below the differences between Physical Network 01 and Physical Network 02 cannot be determined by their names. You need to open the properties dialog to see that Physical Network 01 is a serial RS232 and Physical Network 02 is an Ethernet connection. As an alternative, you can let the mouse pointer hover over the network symbol in the work area to show the properties for some seconds. Honeywell 10

15 Chapter: 2 Safety Station Configurations Interface (Ethernet) The Safety Builder protocol needs to be configured on channel A or B of the USI module to be able to communicate via an Ethernet link with a Safety Station. See below example. Interface (FTE) Figure 2.1 Network and Controller Properties of Ethernet connections Select Fault Tolerant Ethernet in the Physical Network Properties dialog and attach a Safety Manager Controller. The COM port used shall be either 1A or 2A (and implicitly reserve the B-port). Baud rate Best practice is to set the baud rate of the Ethernet interfaces on the USI module fixed to 100Mb/s full-duplex. Make sure that the connected switch has the same setting. The fastest way to establish communication is to set both sides to fixed 100Mb/s full-duplex. COM port (in case of serial communication) In the example below the COM port that is selected (see Physical Network Properties dialog) is the COM1 port of the Safety Station where Safety Builder has been started on. Honeywell 11

16 Chapter: 2 Safety Station Configurations Figure 2.2 Network and Controller COM Port 2.2 Safety Station redundant connection via FTE There are several ways to connect a Safety Station to Safety Manager. The most logical (preferred) option is to setup the connection via the FTE network. In this case you should follow the FTE best practices. The Safety Station will typically be an FTE-node itself, i.e. use an FTE driver to be able to access both the yellow and green part of the network. Honeywell 12

17 Chapter: 2 Safety Station Configurations Figure 2.3 Safety Station via FTE 2.3 Safety Station redundant SafeNet connection Another option is to connect the Safety Station to the SafeNet network. In this situation, the first Network Interface Card (NIC) is connected to SN1 and the second NIC to SN2. This solution is also known as dual homed, i.e. the PC running the Safety Builder application has two network interfaces, in separate networks. If you use a physically separate redundant network for SafeNet communication, it is also possible to connect the Safety Station to the redundant SN1 and SN2. In this situation the Safety Station contains two Network Interface Cards. Each NIC needs to be configured for its own SafeNet network. Make sure that the subnets (IP-ranges) do not overlap. Honeywell 13

18 Chapter: 2 Safety Station Configurations Attention: Figure 2.4 Redundant Safety Station via SafeNet If there is an overlap in the configuration of your Safety Station s IP-ranges you may experience loss of communication with the Safety Station during an OLM. 2.4 Separate Safety Station Yet another possibility is to create a totally separated network for Safety Builder. In this situation, there is no physical connection to any other network. This is sometimes referred to as an Engineering or Maintenance Network. Honeywell 14

19 Chapter: 2 Safety Station Configurations 2.5 Multiple FTE communities Figure 2.5 Separate Safety Station network There are several ways to implement Safety Stations in a plant. Safe Communication between Safety Managers (SafeNet) should preferably be separated from the Control Network (FTE). This can be achieved in two ways: without SafeNet connection between communities with SafeNet connection between communities Without SafeNet connection between communities Safety Stations are connected to the FTE Network. This is a possible solution, as long as the underlying Safety Managers use SafeNet in the Same FTE community. Honeywell 15

20 Chapter: 2 Safety Station Configurations Figure 2.6 Safety Builder via multiple FTE Communities With SafeNet connection between communities If there are multiple FTE communities and Safety Managers in these different communities are connected via SafeNet with each other, it is not advisable to connect to these Safety Managers via FTE. Honeywell 16

21 Chapter: 2 Safety Station Configurations Figure 2.7 Safety Builder via SafeNet with multiple FTE Communities In these situations the Safety Builder Stations should be connected to the SafeNet environment so that all Safety Stations can access the plant database. Attention: If all Safety Managers are configured in 1 plant, the database of these Safety Managers should be stored on one PC or network drive. This database should be accessible for all Safety Stations. Attention: To achieve maximum availability during the loss of one link, Best practice is to map all odd Safety Stations via SN1 and all even Safety Stations via SN2. Honeywell 17

22 CHAPTER 3 3 SafeNet Configurations Safety Managers can be connected together to form safety-related networks. The protocol used for this network is called SafeNet. SafeNet (SIL 4 TÜV approved communication) is available to Safety Managers for: Distributed processing (e.g. pipelines) Sharing safe data for joint SIS related tasks. SIL 4 TÜV approved communication. Remote management Safety Station The protocol includes timing restrictions and a high level of error detection and recovery, which makes it suitable for exchanging safe information while maintaining optimum availability. Because of this SafeNet is independent of the media type that is used. The SafeNet protocol can also be used in network configurations where large time delays are to be expected, e.g. modem communication, communication over telephone lines, satellite links, etc. For more information see: RS232 (Low baud rate communication). Safety Manager communication network is configured during the configuration of the application, by defining the interconnections between Safety Managers and the parameters of the SafeNet protocol. Attention: SafeNet may be configured on the same USI module that is used for communication with Universal Safety IO modules, e.g. SafeNet on 2A, 2C or 2D, and Universal Safety IO on 2B. Attention: SafeNet may be configured on an FTE-configured USI module. However it is not recommended, because this combines both independent redundant SafeNet connections into a single FTE-network, thus introducing a possible common point of failure. 3.1 SafeNet time-out time All systems within the network monitor the operation of a communication link by means of a timeout.

23 Chapter: 3 SafeNet Configurations The time-out can be set for each individual logical link and must be chosen such that it stays within the Process Safety Time (PST) for the Safety Instrumented Functions (SIFs) involved. Caution: Be aware that intermittent connections or congestion (e.g. due to network storm conditions) may result in a SafeNet communication failure. Specifically when the duration of the disturbance is longer than the configured SafeNet communication time-out. 3.2 Ethernet To avoid any outside influences to a SafeNet network, it is advised to use a physically separated redundant SafeNet Ethernet network for communication between Safety Managers. 3.3 Serial Figure 3.1 Dedicated SafeNet network There are two types of serial communication: RS485/422 and RS RS485/422 The figure below shows an example of a possible solution with RS485 communication if Ethernet communication is not possible for project reasons. Attention: The example only shows the schematic overview for one Control Processor. Honeywell 19

24 Chapter: 3 SafeNet Configurations Cable Layout Figure 3.2 Serial SafeNet network The cable layout between the Safety Manager Master and the FO converters is specified as FS- CCE-485-FO-03/L. In the schematic above it is mentioned as cable RS-485 (1). The cable layout between the FO converter and the Safety Manager Slaves is specified as FS-CCE- 485-FO-02/Lx. In the schematic above it is mentioned as cable RS-485 (2). DCOM settings DCOM has to be configured as follows: Appearance Part Setting Master switch OFF TxD OFF RxD OFF Attention: Honeywell 20

25 Chapter: 3 SafeNet Configurations Because the Westermo converter with Note 2 (see above figure) has Pull up/pull down configured, there is no need to set pull/down resistors on Safety Manager. Safety Manager Slaves: The RS-485/422 connectors are male type connectors. On one of these connectors the cable can be connected. On the other connector an end online terminator of type FS-EOL has to be connected. Safety Manager Master: The RS-485/422 connectors are male type connectors. On one of these connectors the cable FS-CCE /Lx to the Safety Builder can be connected. On one of the other connectors the cable FS-CCE-485-FO-03/Lx to the FO converters has to be connected. Baudrate of 115K2, no encoding In case a baudrate of 115K2 is configured: no encoding is used and the jumper switches must be set as specified below. Switches S1 1. = OFF Data control 2. = ON RS wire 3. = ON 3-6 for selection on time after last transition. Set to 104 micro seconds 4. = ON 5. OFF 6. OFF 7. ON 7-8 for selection databits. Set to ON (7) and OFF (8) 8. OFF Switches S2: 1. OFF 1-6 for selection transparent mode, without any start-bit control 2. OFF 3. OFF 4. OFF Honeywell 21

26 Chapter: 3 SafeNet Configurations 5. OFF 6. OFF 7. ON RS-485 transmitter on-time after last data transmission: 4.4 us 8. OFF Switches S3 Note: see the figure above All OFF No termination and fail-safe Switches S3 Note: see the figure above All ON Termination with fail-safe (4-wire) RS232 (Low baud rate communication) Low baud rate communication is used in those applications where high baud rates are not possible. This may have a number of reasons: The type of cable that is used for communication is not suited for high baud rate communication. There is intermediate equipment that does not support high baud rate communication. The communication takes place over long distances. (In this case intermediate equipment is used in between, as the maximum distance for RS232 communication is only 15m.) The lowest supported baud rate for SafeNet is 19k2. Honeywell 22

27 CHAPTER 4 4 Safety Manager Universal Safety IO Safety Manager (SM) Universal Safety IO or LS (referred to as Universal Safety IO) has its own dedicated network between Safety Manager and the Universal Safety IO modules. Ethernet switches are used to connect multiple Universal Safety IO modules or to create large distances networks. These switches must have a specific configuration to avoid communication failures. Correct Ethernet switch settings: Configuration Correct setting Port LLDP 100Mbit Full duplex Disable Moxa EDS3xx Ethernet switches The module types of Ethernet switches that are allowed to be ordered end with (HPS). These switches have the proper configuration settings by default and cannot be changed. So no manual action is required. Moxa EDS6xx Ethernet switches The Moxa EDS6xx series does not have fixed settings like the EDS3xx series and therefore they must be manually configured before used in a Universal Safety IO network. How to configure the Ethernet switch is described below. Caution: Be aware that changing the switch settings will cause the communication to be disturbed. Even when the RS232 connection is used to change the configuration! Tip: Consider to enable all RJ45 ports to make online addition of RUSIO modules possible. Without a port enabled you are not able to use it for a new RUSIO without disturbing the communication of all RUSIOs on that switch. Change the configuration: 1. Set the PC IP address to and subnet mask to Connect to the Ethernet switch via an Ethernet cable

28 Chapter: 4 Safety Manager Universal Safety IO 3. Open a web browser and go to the IP address Login with admin and password is empty. 5. Go to Basic setting Port. 6. Enable all RJ45 ports to make sure future extensions do not need Ethernet switch changes. 7. Set each port to 100M/full duplex 8. Go to Diagnosis LLDP. 9. Set LLDP to Disable Honeywell 24

29 Chapter: 4 Safety Manager Universal Safety IO Honeywell 25

30 CHAPTER 5 5 Experion Advanced Integration (CDA) Experion Advanced Integration implies the use of the CDA protocol. Configuration is done only in Safety Builder and published to Experion. Note: In case of Experion Advanced Integration the Safety Manager Controller has to be connected to a physical network of type FTE in Network Configurator\Physical View (Safety Builder). Configuration The Experion server and stations (display access) share a common logical connection to the Safety Manager Controller via FTE. Peer controllers (EE s like c300, c200, ACE, etc.) will have to be configured individually. The peer connection is identified by FTE node number / device address. Hence, peer communication with Safety Manager using the CDA protocol is limited to nodes in the same (logical) Ethernet subnet. Attention: Figure 5.1 Experion server on FTE network

31 Chapter: 5 Experion Advanced Integration (CDA) Best practice is to not define a time-out for the Logical Network Connection of the Experion Server. Honeywell 27

32 CHAPTER 6 6 Experion Integration (SCADA) Experion Integration implies the use of the SCADA protocol. Configuration is done in both Safety Builder and Control Builder. Safety Manager performs a Peer function, which means that exchange is initiated by the Experion Server. Upon request Safety Manager provides: SOE Time Synchronization Diagnostic Data Exchange The data exchange between Safety Manager and Experion is realized via predefined marker and register areas. The communication link to Safety Manager applications is made through application points (DI, DO, BI, or BO) with a DCS address assigned. These are allocated to the Safety Manager communication link with Experion. Attention: Experion Integration supported by the SCADA protocol can only be configured on channel A of an USI module. Connect a physical network of type Ethernet to the Experion Server in Network Configurator\Physical View (Safety Builder). Attention: In case of Experion Integration the SM Controller cannot be connected to a physical network of type FTE. Configuration Experion Servers can only access Safety Manager Controllers that are directly connected to the FTE. Safety Manager related data can easily be exchanged between a Safety Manager Controller and the Experion Server. This allows this information to be shared and made available on the Experion Operator stations.

33 Chapter: 6 Experion Integration (SCADA) Attention: Figure 6.1 Experion server on FTE network To avoid communication issues during e.g. OLM, best practice is to set the time-out of the Experion Server Logical Network Properties to 30 seconds or higher. Honeywell 29

34 CHAPTER 7 7 Peer Control Data Interface (PCDI) The Peer Control Data Interface (PCDI) is a Honeywell communication interface for non-safe peer to peer data communication between Experion CEE Controllers and Safety Manager Controllers. The C300 is an Experion CEE controller that can be equipped with a licensed PCDI. With PCDI, the C300 can: Write the states of non-safe inputs with location COM in Safety Manager. Monitor the states of each Safety Manager point that has been assigned a COM output to the CEE controller. Monitor Safety Manager parameters that have been assigned a PLC address to the CEE controller. Attention: PCDI cannot be connected to a physical network of type FTE in the Safety Builder physical view. Configuration PCDI is the protocol used to communicate between the Safety Manager and the C300 controller via an FTE connection. CEE controllers can only access Safety Managers that are directly connected to FTE. The PCDI (Peer Control Data Interface) allows peer-to-peer data exchange between Experion CEE controllers and Safety Managers.

35 Chapter: 7 Peer Control Data Interface (PCDI) Attention: Figure 7.1 PCDI connection via FTE network To avoid communication issues, it is recommended to set the time-out on the PCDI master block in C300 to 5 seconds and in Safety Manager to 10 seconds. You can configure up to 8 PCDI and Modbus TCP/IP channels per USI port. Honeywell 31

36 CHAPTER 8 8 FDM Field Device Manager HART communication Safety Manager supports HART Pass Through communication to allow Field Device Manager (FDM) to communicate with HART enabled devices connected through Universal Safety IO (RUSIO/RUSLS). The Safety Manager FDM specific configuration (HART enabled points, etc.) has to be exported from Safety Builder to the FDM Server Management application. Based on this configuration, FDM will establish a connection with the Safety Manager Controller. Both Ethernet (standalone) and FTE networks are supported, and FDM will typically communicate with one of the running Control Processors (in OLM-scenario, FDM will switch to the redundant CP). Safety Manager reports device and IOTA status changes to FDM and schedules/throttles Hart Pass Through traffic towards the actual field devices, via the RIO-private network and the Universal Safety IO modules (RUSIO/RUSLS). Safety Lock By default, device modification will be blocked for HART Pass Through commands (including all DTM-traffic). Read access to devices is always enabled, but before writing changes the user has to Force Enable the specific IO point through in Safety Builder (Point Viewer or Application Viewer). HART Handheld operation Use of HART Handheld devices in the field is not recommended. Instead it is advised to use FDM Pass through functionality. However, when a HART handheld is to be used, make sure the specific IO point is set to Force Enable through the Safety Builder Application Viewer, and not in use by FDM (device specific window open). Communication from the handheld device with the field device can be hampered by the periodic device health status check by the Universal Safety IO module (RUSIO/RUSLS), and vice-versa, it can cause an EC-72 HART device communication loss diagnostic message in Safety Manager as well. HART Handheld Device Detection This is applicable for Safety Builder version R152.1 and higher. To ensure a fault free operation of the HART Handheld devices, the following items must be set configured/set: 1. FC-RUSIO-3224/FC-RUSLS-3224 module configuration: The option Detect HART handheld need to be enabled. The Detect HART handheld check box is found in the Remote IO Module Properties screen in the Hardware Configurator.

37 Chapter: 8 FDM Field Device Manager HART communication Enabling this feature requires a Safety Manager load; it s important to consider this option when a USIO download in R152.1 or later is planned. By default, this option is disabled. 2. The Force Enable key located on the BKM is ON. When both these items are in place: The channel diagnostics detect when a HART communicator is connected and starts its communication. At that moment, the diagnostic tests that potentially interfere are suspended. When the HART communication stops, after the maximum of two execution cycles, the diagnostic tests are restarted. After 8 hours, a diagnostic is generated to notify users when the HART handheld is still connected. Error-code E-138 -HART handheld device connected too long. (High frequency, low amplitude interference that is similar to a HART FSK signal may incorrectly be treated as HART handheld communication. If this message is reported on a HART detection enabled channel without a HART handheld device connected, you should turn the <Force Enable Key> on the BKM OFF. This will guarantee the detection of channel interference by the system diagnostic routines on modules which have the Detect HART handheld option enabled.) Perform a reset to clear the message HART handheld device connected too long from actual diagnostics. Attention: Check if there is any force active inside the Safety Manager before turning the Force key to the off position; all forces will be cleared with this activity. Handheld devices are normally used by field instrumentation technicians who should coordinate the activities with operations. This may be without the involvement of a safety engineer. For this reason, option 2 may be the best option, including the Force enable key at ON position continuously. It needs to be verified with the end user if this is allowed; It may be required set additional privileges levels on the Safety Builder application to avoid forces can be done by unauthorized people. Scenarios using option 2: To better explain the functionality of option 2, below three scenarios in which an instrument technician is envisioned to use a HART handheld device, while the channel is active are discussed. Normal situation HART communicator is used for a short duration then removed. Diagnostics commence once the HART Handheld is removed, any detected fault will be reported. When the communicator stops communicating for more than several seconds the diagnostics suspended with HART signal detection will recommence and any detected fault will be reported. Honeywell 33

38 Chapter: 8 FDM Field Device Manager HART communication Special situation HART communicator is used for more than 8 hours A diagnostic message is generated - Error-code E HART handheld device connected too long. User removes HART handheld and diagnostics commence, any detected fault will be reported (when the communicator stops communicating for more than several seconds the diagnostics will commence and any detected fault will be reported). To clear the reported diagnostics, perform a reset. Unique situation HART communication or a disturbance exists on the analog value coinciding with a field wire short. The field wire short can exist without being detected due to postponing the diagnostics test. Diagnostics are postponed and certain faults would remain undetected. After 8 hours Safety Manager reports "HART handheld device connected too long". Diagnostics are postponed and certain faults would remain undetected. Switching off the Force key Force disable enables all diagnostic tests and will report detected faults in the diagnostics. To clear the reported diagnostics, perform a reset. Honeywell 34

39 CHAPTER 9 9 Modbus The Modbus protocol is used to communicate between Safety Manager and third party Modbus Devices. Safety Manager supports TCP/IP (slave) and Serial Modbus RTU (slave) communication. Attention: Modbus can be connected to both types of physical network Ethernet and FTE in the Safety Builder physical view. 9.1 Configuration It is only the channel configuration and hardware connection that differs. Which type of solution is chosen depends on the connected third party equipment and/or the user s site philosophy. Always take into account that Safety Manager is a Modbus slave. To establish communication between Safety Manager and third party Modbus slaves, an additional Modbus Master needs to be implemented in the design. Attention: To avoid communication issues, it is recommended to set the time-out of the Modbus logical connection to 15 seconds. You can configure up to 8 PCDI and ModbusTCP channels per USI port. 9.2 ModbusTCP If the third party Modbus Master supports the ModbusTCP protocol, this is the preferred type of communication.

40 Chapter: 9 Modbus Figure 9.1 TCP/IP network connection Safety Manager has two IP-addresses for Modbus communication. One is allocated to channel A or B of Control Processor 1 (CP1) and the other one to Control Processor 2 (CP2) of Safety Manager. In this situation it is expected that the Modbus Master device is capable of communicating to two IP-addresses that respond with the same information. If the Modbus Master is only capable of communicating with just one IP-address, then this is called a single Modbus Master. In that situation, it is not possible to use the above configuration. There will always be an External Communication alarm on CP2, because there is no communication path defined for CP2. In these situations the Modbus TCP/IP protocol should be converted to the serial Modbus RTU protocol. Honeywell 36

41 Chapter: 9 Modbus Figure 9.2 ModbusTCP network to serial port connection 9.3 Serial If the Modbus Master does not support the TCP/IP protocol, Safety Manager can communicate via a serial connection. Depending on the Customer requirements this can be an RS485 (2 or 4 wire) or RS232 connection. If the master communicates with more than one Safety Manager (or other Modbus slave) RS485 communication should be used. Depending on the system requirement a 2 or 4 wire connection needs to be used. Figure 9.3 Serial Modbus connection (redundant) For a single Modbus master Safety Manager only needs one DCOM. Honeywell 37

42 Chapter: 9 Modbus Figure 9.4 Serial Modbus connection (single) 9.4 Modbus Slave-Slave communication If the connected third party device is also a Modbus slave, a Modbus Master device needs to be installed in-between. For this there are several options. TCP/IP (Non redundant Modbus slaves) When a Safety Manager needs to communicate with another Modbus slave, a separate Modbus Master is needed to establish the communication. Safety Manager will generate an alarm when the link between the Modbus Master and Safety Manager is lost. But additional logic needs to be implemented to generate an alarm when the communication from the Modbus Master to the single ModbusTCP slave is lost. Honeywell 38

43 Chapter: 9 Modbus TCP/IP (Redundant Modbus slaves) Figure 9.5 Serial Modbus connection (slave to slave) For full redundant communication to Safety Manager, the monitoring of the communication lines becomes even more important. Safety Manager needs to know which one of the links is incorrect. For this special logic needs to be implemented. In the PM.MAN.6541 document this is explained in more detail. Honeywell 39

44 Chapter: 9 Modbus Figure 9.6 TCP/IP to Serial Modbus connection (slave to slave) RS232/RS485 (Non redundant Modbus slaves) When a Safety Manager needs to communicate with another Modbus slave, a separate Modbus Master is needed to establish the communication. Safety Manager will generate an alarm when the link between to the Modbus Master is lost. But additional logic needs to be implemented to generate an alarm when the communication from the Modbus Master to the TCP/IP Modbus slave is lost. Honeywell 40

45 Chapter: 9 Modbus Figure 9.7 Serial Modbus connection (slave to slave / non-redundant) RS232/RS485 (Redundant Modbus slaves) For full redundant communication to Safety Manager, the monitoring of the communication lines becomes even more important. Safety Manager needs to know which one of the links is incorrect. For this special logic needs to be implemented. In the PM.MAN.6541 document this is explained in more detail. Honeywell 41

46 Chapter: 9 Modbus 9.5 Packed coils Figure 9.8 Serial Modbus connection (slave to slave / redundant) Safety Manager supports the feature of reading and writing packed coils for Modbus communication. This feature allows multiple coils to be packed and accessed with a single Modbus function code. This saves allocation space in Modbus Masters that support packaged coils and also limits the communication load. To avoid additional logic inside Safety Manager for packing and unpacking bits into registers, this option is integrated in the Modbus communication stack of Safety Manager. Most F&G (Fire and Gas) equipment uses this method of transferring detector information. If a Safety Manager receives read or writes register commands, it checks if these register addresses exist in Safety Manager. If no BI (Binary Input) tag numbers are allocated to these addresses, it checks if the addresses exist as DI points. If so, the register value will be written to the digital input signals. For example, if the register address is "1", but this address is not used in Safety Manager, it checks if address 1 is a valid address as coil. If it is, the register value will be written to digital input address 1 thru 16 (a register is 16 bits). Honeywell 42

47 Chapter: 9 Modbus Figure 9.9 Modbus configuration For this reason the best practice is to configure addresses for markers and registers which are not in the same range and have no overlap. Attention: To avoid communication issues, best practice is to set the time-out of the Modbus Logical Network Properties to 15 seconds or higher. Honeywell 43

48 CHAPTER Real-time clock synchronization The real-time clock of Safety Manager has a resolution of 1ms. In order to ensure accurate timestamping of data, the real-time clock of Safety Manager can be synchronized with a reference clock. Safety Manager accepts several external clock sources to synchronize (set) its real-time clock to: NTP/PTP based time servers SafeNet Node Modbus device Experion server Safety Station (S)NTP clock sources Reliable and coordinated time is an important element. Safety Manager can use a high-quality time served from a Network Time Protocol (NTP) or Simple Network Time Protocol (SNTP) Server. The quality of time determines how tightly events from different devices can be correlated, especially with regard to Sequence of Events (SOE). For SOE, therefore, it is recommended that you use a high quality external time source such as a NTP-based time server. The most stringent requirement for time at Level 1 comes from controllers like Safety Manager doing high-resolution, digital (and analog) sequence of events. Each state change is time stamped to a 1 ms resolution. These state changes can be logged for post-mortem analysis. At Level 2, time is a gating factor used in many supervisory functions such as: Event processing System monitoring Time stamping is also used in diagnostic messages. For example, Safety Manager notifies Experion of all abnormal changes in system behavior by means of time-stamped diagnostic messages. Both levels provide important and critical functions to an overall system that is being used to control a plant's processes. System events can be generated from either the hardware side (Level 1) or from the supervisory side (Level 2). Therefore, time synchronization between the two network levels also needs to be coordinated, ideally, using the same source. Clock Sync from FTE Within an FTE community the clock source is available to both Control Processors 1 and 2. This means that both Control Processors will be directly synchronized by this clock.

49 Chapter: 10 Real-time clock synchronization Figure 10.1 FTE Network clock synchronization External clock source on SafeNet Ethernet network In the case the clock source is connected to a redundant SafeNet environment, the clock source is only connected to SN1. This means that only Control Processor 1 is able to synchronize. In this situation Control Processor 2 will be automatically synchronized via the internal link between the two Control Processors. Clock sync via SafeNet protocol Figure 10.2 SafeNet Network clock synchronization In the case a Safety Manager (Peer) is not connected to the network (FTE) that contains the clock source, Safety Manager (peer) will be synchronized by its Node. Honeywell 45

50 Chapter: 10 Real-time clock synchronization Figure 10.3 FTE Network clock synchronization via SafeNet In a network configuration you should consider using the same clock sources and clock source ranking for all Peers in the network. This causes a single Node to determine the network time and prevents Peer systems to drift apart as a result of using different clock sources in different parts of the network. Honeywell 46

51 CHAPTER IEC61010 (Ethernet surge protection) The USI module and the Control Processor should be protected against harmful voltages on the Ethernet lines according the IEC This can simply be achieved by adding an MTL But this is not necessary in all cases. For instance, a fiber optic connection or a correctly wired SDW550 EC will fulfill the same requirement. MTL The MTL (made by MTL Surge Technologies) is a single channel Ethernet surge protector (100BaseT and 10BaseT). When wired between an USI communication module and the field, it gives the USI module and the Control Processor an IEC compliant protection against harmful voltages on the Ethernet lines. The MTL can be used for shielded twisted pair (STP) cables and in IEEE 802.3af compliant networks which apply 48V power on pins 1, 2, 3 and 6. The MTL24571 has universal snap-in provisions for standard DIN EN rails. Westermo SDW550 EC Figure 11.1 Surge protection Safety Manager Controller (MTL) The SDW-550 EC, make Westermo, is a five port 10/100Base Ethernet switch used as interface between USI-0001 communication modules in the Control Processor and the field. The SDW-550 EC has one (24Vdc) power connector and five isolated RJ-45 TX port connectors, divided into two sections. The raised isolation level between the two port sections makes the SDW-550-EC compliant to the IEC

52 Chapter: 11 IEC61010 (Ethernet surge protection) For IEC compliant use, one section (ports 1, 2 and 3) must be connected to the field while the other section (ports 4 and 5) must connect to the CP backplane, thus optimizing power surge protection from the field. Attention: Figure 11.2 Surge protection Safety Manager Controller (SDW 550) The SDW550 cannot be used because it is not the same as the SDW 550 EC. The SDW 550 EC has an additional ground connection. This ground connection is necessary to achieve the protection against harmful voltages on the Ethernet lines between the first section (ports 1, 2, and 3) and the second section (ports 4 and 5). Do not use the SDW550, but use the SDW550 CE instead! Jumper settings The preferred jumper settings are as mentioned in the Hardware Manual. These jumper settings assume that you connect the USI module to port 4 and 5. The jumpers in this case are set to 100Mb / Full Duplex. Port 1, 2 and 3 are set to AUTO. Figure 11.3 Jumper setting Westermo SDW 550 After reading this chapter, you might decide to use a different approach for your project. In that case make sure that you follow the IEC compliant protection against harmful voltages on the Ethernet lines. Best Practice is to set the configuration of your USI channel to 100Mb / Full Duplex on both the switches as in the configuration of the USI module. Honeywell 48

53 Chapter: 11 IEC61010 (Ethernet surge protection) Figure 11.4 Switches Westermo SDW 550 Honeywell 49

54 Chapter: 11 IEC61010 (Ethernet surge protection) Switch configurations Best practice is to configure all ports fixed to: 100Mb/Full Duplex. This should be done on both ends with the DIP-switches inside the Westermo SDW550-CE and in the configuration of Safety Manager. If the Westermo switch is directly connected to a Cisco switch both ends should be configured the same way. Best practice is to set both sides to 100Mb/Full Duplex; however in this situation a cross cable is needed. If the Westermo is connected to a CF9 the setting should be changed to AUTO, as the CF9 inside ports are all auto negotiate and cannot be changed. SDW541 / SDW 532 The SDW541 has 4, RJ-45 and 1 fiber connection and the SDW532 has 3 RJ-45 and 2 fiber connections. When one of these switches is used and only the fiber leaves the cabinet, it is already IEC compliant against harmful voltages on the Ethernet lines. In this case the fiber is functioning as an isolator. Honeywell 50

55 CHAPTER Security recommendations and best practices Security Guidelines Attention: A detailed description of all Safety Controller key switches, loading of software and forcing is provided in the Installation and Upgrade Guide (Document number EP-SM.MAN.6277). Force Enable Key Switch It is strongly recommended to keep the Force Enable key switch in the disabled position whenever forcing is not required. Leaving the Force Enable key in the enabled position will make the Safety Controller more vulnerable to abuse. Force Enable Configuration It is strongly recommended to leave a point's Force Enable to the default 'No' when it is not necessary to force this point or to modify a HART field device parameter during maintenance. Configuring a point with Force Enable will make the Safety Controller user application more vulnerable to abuse. Write Enable Configuration It is recommended to leave a point's Write Enable to the default 'No' (= Disabled) when it is not necessary to write this point during maintenance. It is strongly discouraged to use a write enabled point as part of a SIF. Configuring a point with Write Enable will make the Safety Controller user application more vulnerable to abuse. Remote Reset Configuration It is recommended to leave this setting in the 'Disabled' position when it is not a necessity to reset or startup a Safety Controller remotely via the Safety Builder. Configuring Remote Reset will make the Safety Controller more vulnerable to abuse. The Fault Reset key switch mounted in the Safety Controller cabinet is the preferred secure alternative. Remote Load Configuration It is recommended to leave this setting in the 'Disabled' position when it is not a necessity to shutdown a Safety Controller remotely via the Safety Builder prior to a download.

56 Chapter: 12 Security recommendations and best practices Configuring Remote Load will make the Safety Controller more vulnerable to abuse. The Safety Processor (QPP) key switch is the preferred secure alternative. Sequence of Events An event is permanently removed from the Safety Controller after this event has been successfully read from the controller. When more than one event collector (SOE PC or Experion system) is connected to the Safety Controller, events will scatter between the multiple collectors. It is recommended to block the unintentionally connection of more than one SOE collector. SafeNet SafeNet will drop a connection when communication is lost for the configured time-out or more. It is recommended to configure the shortest time-out possible as this reduces the window for tampering. It is recommended to validate network integrity before (re-)starting SafeNet communication after any unexpected loss of communication. Network Clock Safety Manager uses the network clock to timestamp diagnostic messages and events. An incorrect timestamp cannot result in unsafe operation. It can however confuse operators and maintenance engineers and it can lead to misinterpretation of the sequence of events. It is recommended to configure the clock source time-out as short as possible as this reduces the window for tampering. It is recommended to validate network integrity before (re-)starting a clock after any unexpected loss of communication. NTP devices have a user configured IP address known to the Safety Controller. NTP is therefore more secured compared to PTP. Denial of Service (DoS) Safety Manager communication modules have a built-in overload detection and overload protection. To avoid loss of functionality each of the four communication ports on the modules can be switched off temporarily. This protection is especially effective against network storm and DoS attacks as only the communication on that one port will be temporary dropped. Activation of the overload protection will generate a diagnostic message. It is strongly recommended to validate network integrity as overload can be caused by malware on a connected device or by an attack on the Safety Controller. Safety Controller Redundancy With properly redundant communication configuration the temporary drop of communication does not have to result in DoS for the controller. Please refer to sections 3 t/w 11 for information about redundant communication configurations. Safety Builder Safety Builder provides an extensive on-line toolset and it is important to understand that connecting to any Safety Controller is possible even without the actual project databases. Honeywell 52

57 Chapter: 12 Security recommendations and best practices In a well configured system none of these on-line actions can result in unsafe operation. Unauthorized access can however cause confusion and upset if the Safety Controller is configured with one or more remote operation options enabled, It is therefore strongly recommended to (physically) block all unused Ethernet ports on the Safety Builder network. SafeNet and RUSIO networks For optimized availability it is recommended to isolate and contain RUSIO and SafeNet networks from the open network Security Guidelines for (pre-) installing Safety Manager Attention: A detailed description of all Safety Builder privilege levels, password protections and version control is provided in the System Administration Guide (Document number EP- SM.MAN.6281). Installation It is strongly recommended to install and maintain Safety Builder and Safety Controller separated from the Office Domain. Additional protection against misuse of Modbus TCP To protect Safety Manager against misuse of Modbus TCP ports, it is advised to use the Honeywell Modbus Read-only Firewall. This is a fixed configuration firewall based on deep packet inspection technology. This technology scans every network message, only allowing a very limited set of valid Modbus Read-only commands through to the safety system. These are safe commands that cannot be used by malware to change the functionality of the safety system. The firewall s fixed rule sets remove the possibility of tampering or mis-configuration and significantly reduces the effort required by the plant to maintain the firewall. Virus and Patch management The applications listed below can be installed and run on the same platform: Safety Builder, Application Server Virus & Patch Management. Honeywell supports two anti-virus packages McAfee and Norton. Which package and associated patch server is used is determined by the customer when the network architecture of the total system is designed. It is highly recommended to update the Safety stations on a regular base with operating system and office application (if applicable) updates (Microsoft). It is also highly recommended to install Honeywell certified antivirus and computer security solutions; these also will need to be updated on a regular base. Honeywell 53

58 Chapter: 12 Security recommendations and best practices The usage of a centralized virus and patch management server may be considered. Management of these services will need to be done by competent engineers. Security Guidelines for product administration Safety Manager does not require special actions to administer the product in a secure manner. Honeywell 54

59 CHAPTER Safety Manager Engineering tools Several Safety Manager Engineering tools are available for the user. These tools can be obtained from Honeywell; contact Honeywell SMS or your local Honeywell SMS affiliate. SM2XperionConverter SM2XperionConverter stands for Safety Manager to Experion Database Converter. With this program (tool) you can import Safety Manager details into the Configuration Studio. It supports bulk import of Safety Manager points and other data into Experion. Specifically: SM2XperionConverter creates Quick Builder PNT and HDW files with all Safety Manager points allocated to Experion. With this tool there are two ways of creating the pnt and hdw files for Experion: Using the plant and controller file. Using a point export file. To use this option you first need to export your point database, converting it to an.xls file. Prerequisites You are familiar with the concepts of pntbld and hdwbld files and how you can import them into Experion. For more information about pntbld and hdwbld files, see the Hardware and Point Build Reference in the Experion Knowledge Builder The tool To import Safety Manager points and other data using SM2XperionConverter.exe 1. Run SM2XperionConverter.exe This displays the Safety Manager-Experion Database Converter dialog box. 2. To import the points from a plant and controller file: 1. Click the Safety Manager database tab. 2. Click Select Plant, browse to the appropriate location and select the appropriate plant database file (the file format is filename.cac). 3. Click Select Controller, browse to the appropriate controller and select it. Alternatively, you can export your Safety Manager point database in.xls format, and then export it by clicking the Safety Manager Export file tab, and then clicking Select Export file and choose the.xls file from Point Configurator. 3. Click Config. This displays the Configuration dialog box.

60 Chapter: 13 Safety Manager Engineering tools 4. On the Safety Manager Controller tab: Figure 13.1 Configuration dialog box 1. Choose the controller number of Safety Manager. 2. Choose the appropriate redundancy option. 3. Type the names and parameter details of the controller, channels, time synchronization and area. 5. Click on the Safety Manager SM-Experion Interface tab and type the Safety Manager IP addresses of the channels connected to Experion. 6. In the Experion Area tab, define an area that matches an asset. For more information about Experion assets, see About assignable assets and scope of responsibility in the Experion Knowledge Builder. 7. Click OK to close the Configuration dialog box. 8. Click Point Definition File to create the pnt file. By default, this file is stored in the same folder as the controller and has the same name as the controller with the file extension pnt. 9. Click Hardware Definition File to create the hdw file. By default, this file is stored in the same Honeywell 56

61 Chapter: 13 Safety Manager Engineering tools folder as the controller and has the same name as the controller with the file extension hdw. Figure 13.2 Experion Database converter Import the pnt and hdw files into Quick Builder (via Experion's Configuration Studio). Attention: If SOE is enabled in Safety Manager, only one Experion controller should be SOE-enabled. You need to adjust this setting in Quick Builder after you have imported the pnt and hdw files as it is not possible to do this via the conversion tool. If you get an import error, check that your version of SM2Experion converter is the latest version. SafeNet Time-out Estimator With this tool you can estimate the time-out for all SafeNet links in your Safety Manager Network. SM2SafetyHistorianConverter Safety Manager Database to Safety Historian converter Tool Open the Point Configurator in the Safety Builder and Export the Points. The created XLS file can now be imported in the SM2SafetyHistorianConverter. Press the SELECT button to browse to the location of the exported file. Select the correct SOE device and USI module. Then press the GENERATE button. The newly created.dbf file can now be used to import the SOE Enabled Points into Safety Historian. Honeywell 57

62 CHAPTER Troubleshooting Monitoring Network Safety Builder Com statistics The Communication Status button in Controller Management has tools that assist you in solving communication related issues. Communication Status has the following status tabs: Communication Statistics This tab provides a list of all physical communication links of Safety Manager. The Communication Statistics tab lists the communication statistics available per physical communication channel. Link Status Report This tab provides a list of all logical communication connections of Safety Manager, except SafeNet and NTP/PTP connections. The Link Status Report tab lists the actual diagnostic information available to the logical connections of the Safety Manager Controller. SDW5xx The Westermo SDW5xx switch can be configured in a specific way so that all Ethernet communication packages can be monitored. To achieve this, the port mirror function must be active. With the port mirror function active, the switch will duplicate (copy) all traffic to port 1 for external analysis. This can be used to monitor all traffic through the switch; e.g. with a monitoring tool like Wireshark. Packages may be discarded if the total throughput exceeds the port speed of port 1. You can enable or disable flow control with the DIP-switch. Figure 14.1 Port settings