safety_scl.h File Reference

IEC 61784-3 black-channel Safety Communication Layer - the shared primitives (PC_ENABLE_SAFETY_SCL). More...

#include "protocore_config.h"

Go to the source code of this file.

Detailed Description

IEC 61784-3 black-channel Safety Communication Layer - the shared primitives (PC_ENABLE_SAFETY_SCL).

The functional-safety profiles (PROFIsafe / IEC 61784-3-3, CIP Safety / -3-2, FSoE / -3-12, IO-Link Safety) all work the same way: they treat the underlying fieldbus as an untrusted "black channel" and layer their own end-to-end checks on top, so the transport may corrupt, lose, duplicate, delay or reorder frames without defeating the safety function. Three mechanisms do that work, and they are common to every profile:

1. a CRC signature over the safety payload, sized so the residual error rate meets SIL 3,
2. a monitoring / consecutive counter, which turns lost, repeated, inserted and reordered frames into a detectable mismatch, and
3. a receive watchdog, so a silent channel is itself a fault rather than a stale-but-happy reading.

This module lands (2) and (3) plus the fail-safe state machine that combines all three, so each profile's codec composes them instead of reimplementing them.

What this module deliberately does not do: compute the CRC. Every profile defines its own polynomial, width, seed, and the order in which payload / counter / connection identifier are fed into it, and those constants live in paid standards. Encoding a guess here would produce something that looks authoritative and silently fails to detect the very corruptions it exists to catch - the worst possible outcome for a safety layer. So the caller computes its profile's CRC and passes the verdict in as signature_ok. What this module owns is the consequence of that verdict, which genuinely is profile-independent.

Fail-safe latches. Once any check fails the connection enters SclState::FAILSAFE and stays there until an explicit pc_scl_reset. A safety layer must never silently reheal: recovering on its own would let an intermittent fault present as a working connection, which is precisely the failure a SIL rating is meant to exclude. Re-establishing is an operator/application decision.

Pure, with an explicit now (the services/hotswap pattern - it decides, the binding acts), so the whole machine is host-testable against a synthetic clock. Every elapsed-time test is an unsigned difference, so it is wrap-safe across a millis() rollover. No heap, no stdlib.

Author

Douglas Quigg (dstroy0)

Date

2026

Definition in file safety_scl.h.