Transport-neutral
The same data encoding runs over raw Ethernet and over dual-port RAM between the two processors of one module.
Software
GA SafeTP
Safe communication between redundant controller modules
What it is
SafeTP (Safe Transport Protocol) is our in-house transport protocol that keeps the processing modules of a safety controller in step with one another. A redundant controller computes several times in parallel – and keeping those parallel paths aligned is exactly what SafeTP does.
It cyclically exchanges input and output states, output commands, status and health data (including checksums and which unit is currently leading), the state of the running application program, and the connection data of the Modbus fieldbus link.
Because this data drives outputs and carries safety decisions, a wrong message is never merely a data problem. Whether it came from an attacker or from a random bit error makes no difference to its effect. SafeTP therefore protects in two directions at once: against deliberate manipulation (security) and against random transmission faults (functional safety).
Functional safety
SafeTP is designed as a safe communication layer over a black channel: the underlying network does not itself have to be safety-related, because every protective measure acts end-to-end between the modules. The classic transmission errors of EN 50159 are addressed explicitly.
| Transmission error | Detected by |
|---|---|
| Corruption (bit errors, truncation) | Cryptographic authentication tag over header and payload |
| Unintended repetition | Freshness counters with a replay window |
| Incorrect sequence | Telegram counter, freshness counters, timestamp monotonicity |
| Loss | Gap detection plus receive supervision on every transport path |
| Unacceptable delay | Timestamp evaluated against a learned transit-time baseline |
| Insertion and masquerade | Source and destination addresses bound into the authentication tag |
| Addressing errors | Vendor, channel and address checked against the receiver's expectation |
What matters is not only detection but the reaction: a telegram that fails any check is never delivered in the first place. If a peer falls silent, the three-state receive supervision (start-up → healthy → timeout) reports the loss to the application, which then treats that peer's data as invalid and can take the controller to its safe state.
Cyber security
Every telegram carries a keyed authentication tag over header and payload, making origin and integrity verifiable; injected or altered telegrams are rejected. A pair of key-generation and running counters prevents captured telegrams from being replayed, and because source, destination and channel identifier are sealed along with the payload, a valid telegram cannot be diverted onto another connection either.
Keys are provisioned in the field through a protected maintenance command into a dedicated, reboot-stable storage area and can be rotated – there is no built-in factory key. Validation is deliberately ordered from cheap to expensive, so a flood of forged telegrams is rejected early and at low cost.
This makes SafeTP part of our readiness effort for the EU Cyber Resilience Act (Regulation (EU) 2024/2847).
Design and characteristics
Redundant paths per connection
A logical peer can be reachable over two physical paths; if the preferred one fails, the second carries on – each path is supervised separately so that one outage cannot mask another.
Four communication directions
Unit ↔ unit, processor ↔ processor within a unit, the A ↔ B core pair of a module, and main module ↔ I/O extension – each with its own channel identifier, so the data streams cannot become confused with one another.
Cyclic, with no interrupt coupling
Processing is driven from the cyclic program run, which keeps the timing behaviour predictable.
Built for diagnosis
Throughput, error and timeout counters, and the security state of every individual connection – down to whether the correct key is installed – can be read from the engineering tool. Key material never leaves the device; only a key check value does.
Positioning
SafeTP is part of the MPU-M1 module firmware and is designed for controllers up to SIL 3 according to IEC 61508. The detailed technical treatment is given in the protocol description, the functional-safety concept and the cyber-security concept of the product documentation.
Questions about this product?
Our project engineers are happy to advise you on selection and dimensioning.