Why DCS and SIS Must Stay Separate
Functional safety standards such as IEC 61511 require separation between basic process control systems and safety instrumented systems. The Foxboro I/A Series runs normal process control. The Triconex system handles emergency shutdown.
However, operators still need to see SIS status on the DCS HMI. Modbus TCP can carry read-only status data without compromising safety independence. First, data flows one way from SIS to DCS. Second, the DCS cannot write back to the SIS. Therefore, separation remains intact.
Step 1: Segregate the Networks
Place the Foxboro DCS and Triconex SIS on separate Ethernet subnets. Use a unidirectional data diode or a firewall with strict rules. A typical design:
- Foxboro DCS network: 10.1.1.0/24
- Triconex SIS network: 10.2.2.0/24
- Firewall allows only TCP port 502 from SIS to DCS
- No return path from DCS to SIS is permitted
Moreover, document the cybersecurity risk assessment. Treat any SIS-DCS link as a potential attack vector. Therefore, keep the connection read-only and monitored.
Step 2: Configure Triconex Modbus TCP Server
In Triconex TriStation 1131, enable the Modbus TCP slave interface on the safety controller Ethernet module. Define holding registers that expose safe status information only.
Typical SIS status registers include:
- 40001: Overall SIS healthy status
- 40002: Emergency shutdown valve 1 position
- 40003: High-high pressure trip status
- 40004: Burner management trip status
- 40005: Voting module fault status
- 40006: Last trip cause code
However, never expose internal SIS logic or allow configuration access. The Modbus server should be read-only for DCS consumption. Finally, test that writing from the DCS side is blocked by the firewall.
Step 3: Configure Foxboro Modbus TCP Client
In Foxboro Control Core Services, add a Modbus TCP client block. Enter the Triconex server IP and port 502. Use function code 03 to read holding registers.
Map each register to a Foxboro control block parameter or an HMI display tag. Set the poll rate to once per second. A faster rate is unnecessary for status monitoring. Moreover, add a communication fault alarm so operators know if the link fails.
Step 4: Build Operator Displays
Create a dedicated SIS status display in Foxboro Vision or FoxView. Use clear colors and labels. Show these items:
- SIS healthy / fault status
- Trip summary with first-out indication
- Communication link status
- Last update timestamp
Finally, add a note stating that all SIS actions must be performed from the Triconex engineering station, not the DCS. This preserves the operator safety culture.
Conclusion & Action Advice
Connecting Foxboro I/A Series to Triconex SIS over read-only Modbus TCP gives operators visibility without breaking safety independence. Segregate networks, expose only status registers, and enforce one-way data flow. Test the firewall rules and train operators to use the SIS engineering station for any safety-related actions.