4.6.1 The data communication link should be continuously
self-checking, for detecting failures on the link itself and data
communication failure on nodes and should give an alarm in the event
of an abnormal condition.
4.6.2 When the same data communication link is
used for two or more essential functions, this link should be redundant.
Redundant data communication links should be routed with as much separation
as practical.
4.6.3 Switching between redundant links should
not disturb data communication or continuous operation of functions.
4.6.4 To ensure that data can be exchanged between
various systems, standardized interfaces should be used.