How can a SIL 3 E-stop ride the same ordinary Ethernet as the rest of the plant and still be trusted? PROFIsafe wraps the safe value in an envelope carrying a running sequence number, a CRC checksum, and an F-address — all watched against an F-monitoring time. Tamper with any of them below and watch the channel slam to the safe state.
A safety telegram travels from the F-CPU to the F-device each cycle, carrying the safe data plus its protective wrapper. It's supposed to arrive intact, in order, on time. Use the buttons to corrupt the CRC, delay it past the watchdog, or replay an old sequence number — and watch the receiver refuse it and go safe. PROFIsafe trusts nothing it can't verify.
Notice the asymmetry: a good telegram just passes quietly, but the first hint of trouble — bad checksum, stale number, late arrival — forces the safe state and latches there until a human acknowledges. Safety is allowed to be paranoid; that's the design.
Together these cover the recognised failure modes of a network — corruption, loss, repetition, resequencing, delay and masquerade — which is how a "black channel" (any ordinary Ethernet) can carry safety up to SIL 3 / PL e without the network itself being safety-rated.
The CRC already detects corruption. So why also carry a consecutive number on every safety telegram?