13 Safety Bus Manual — P/N LS10177-000HI-E:B 02/21/2019Introduction Control Board RedundancySingle ground faults on the communication links aren’t detected by the system: any number ofground faults in different communication links does not influence correct operation of the system.Two ground faults on the same link, one on positive and one on negative, may result in a link fail-ure, still allowing the system to fully operate correctly using ring communication.Communication circuits not having ground fault monitoring to be installed in conduit within 20 ft(6.096 m) and in the same room.2.4 Control Board RedundancyTwo control boards (inserted in different racks, when possible) can be used for higher system avail-ability. The two boards are both Masters when managing bus events, while one is a Master and theother is a Slave for ring diagnostics. In the event of failure of one of the two boards, the entire buswill continue to operate without interruption.2.5 Communication ProtocolThe Safety Bus communication protocol is a point-to-point protocol based on the CAN field bus. Inaddition to Layers OSI 1 and 2, set in the CAN standard for bit rate and security, additional mecha-nisms have been implemented in the Safety Bus to guarantee secure data transmission in Layers 2and 7. In particular, mechanisms for detecting possible transmission/reception errors have beenadded:• Sequential number of messages• Message transmission timeout• Message echoing through acknowledgment• Unique ID for transmitter and receiver• Data integrity using an additional CRC in the data packetThe data exchange between the control boards and modules is based on the Token Ring concept, inwhich the data packets are transferred from one node to the other serially. Each node along the ringrepeats and regenerates transmission towards the following node. The access method (MAC) is atoken. The token is a particular packet that travels around the ring to indicate that the ring is avail-able. A module that intends to transmit must wait for the token to arrive, seize it and then transmitthe data to the control board. The token travels continuously around the ring, even if the moduleshave no data to transmit. It is initially generated by the control board, which is the network monitor,and is repeated by all the modules along the ring. In order to guarantee rapid response to alarms andevents, a priority mechanism has been introduced over the token, so a token seized by one modulecan be seized by another module with a higher priority.Figure 2.3 System Architecture with Duplex Configuration