If a Non-Secure Parameter Reference contributes to a safety-critical control action, special consideration is needed in SIS module logic to validate the parameter value. The configurer should not allow the safety function to be compromised based on the value of a Non-Secure Parameter Reference.
An example of safety-critical use is a batch safety application that reads the active phase or recipe in order to apply the appropriate trip limits for the current state of the process. It is important to validate the value read into the SIS module by some independent means. An example of independent confirmation of the current process state is inferring the state by using process inputs from SIS channels or CHARMs, or using operator input from a secure write operation to confirm the state. If the value of the Non-Secure Parameter Reference cannot be validated by an independent method, the most conservative trip limit values should be applied.
A Non-Secure Parameter Reference has a value and a status. Normally the status is that of the referenced parameter. If there is a communication issue, the status of the Non-Secure Parameter Reference becomes BadNoComm. If the source parameter has Bad status or the logic solver is not able to read its value, the Non-Secure Parameter Reference has Bad status. Therefore, SIS module logic should take appropriate action when the status is Bad if the use is safety-critical.
The Limit function block can be used downstream from a Non-Secure Parameter Reference to limit its value within a valid range. The block has an option parameter (LIMIT_OPT) that determines the output value when the input is outside the valid range. Choices include clamping the value at the limit, using the last value prior to limit violation, and using a configurable default value.