Why TMR Safety Data Belongs on the DCS HMI
ICS Triplex Trusted controllers provide triple-modular-redundant protection for turbines, compressors, and process units. Operators need to see trip status and system health without compromising the safety function. Honeywell Experion PKS can display this data through a read-only Modbus TCP link.
First, the link is unidirectional from SIS to DCS. Second, the DCS cannot command the safety system. Therefore, IEC 61511 separation principles remain satisfied while improving operator situational awareness.
Step 1: Segregate Safety and Control Networks
Place the ICS Triplex Trusted network on a separate VLAN from Experion PKS. Use a firewall or data diode to enforce one-way traffic. A typical network plan:
- Honeywell Experion PKS network: 10.10.1.0/24
- ICS Triplex Trusted network: 10.20.2.0/24
- Firewall rule: allow TCP 502 only from Trusted to PKS
- No route from PKS to Trusted network
Moreover, disable unused services on the Trusted communication module. This reduces the attack surface. Finally, log all connection attempts at the firewall for security review.
Step 2: Configure Trusted Modbus TCP Server
In the ICS Triplex engineering workstation, enable the Modbus TCP interface on the Trusted communication module. Define a read-only register map for DCS visibility. Typical status registers include:
- 40001: SIS overall healthy status
- 40002: Main turbine trip status
- 40003: Overspeed protection trip
- 40004: Vibration trip status
- 40005: First-out trip cause code
- 40006: Module redundancy status
However, never expose internal logic variables or allow write access. The goal is status visibility only. Therefore, configure the server as read-only and verify with a packet capture.
Step 3: Configure Experion PKS Modbus Client
In Honeywell Control Builder, add a Modbus TCP client function block. Enter the Trusted server IP address and port 502. Use function code 03 to poll holding registers.
Step 1: Set the poll rate to 1,000 ms. Step 2: Map each register to an Experion control parameter or HMI tag. Step 3: Add a communication fault alarm. If the link drops, operators must know immediately that SIS status may be stale.
Step 4: Build Operator Displays
Create a dedicated SIS status display in Experion HMIWeb. Use clear colors and symbols. Show these key items:
- SIS healthy / fault status indicator
- Trip summary with first-out cause
- Module redundancy status for each TMR channel
- Communication link status and last update time
Moreover, add a note reminding operators that all SIS resets and bypasses must be performed at the Trusted engineering station. The DCS display is for information only. Finally, audit the display annually to ensure it matches current safety logic.
Common Mistakes to Avoid
- Allowing bidirectional traffic between DCS and SIS networks.
- Polling the safety controller too fast and affecting its real-time performance.
- Exposing diagnostic variables that reveal internal voting logic.
- Missing communication fault alarms, leading operators to trust stale data.
Finally, involve the site functional safety engineer in the design review. Any SIS-DCS interface requires documented justification under IEC 61511.
Conclusion & Action Advice
Integrating ICS Triplex Trusted with Honeywell Experion PKS through read-only Modbus TCP improves operator awareness while preserving safety independence. Segregate networks, expose only status registers, and add communication fault alarms. Always review the design with the functional safety team and keep the interface documentation up to date.