wilamowski-b-m-irwin-j-d-industrial-communication-systems-2011

21-8 Industrial Communication Systems
C1
Definition of
{System}
C2
Definition of
{Environment}
G1
{System} is safe in a
given {Environment}
S1
Argument over
hazard identification
and mitigation
C3
Definition of
“safe”
J1
If all hazards are found and
their risk is acceptable, the
system is safe by definition
J
G2
All hazards are
identified
Sn1
Hazard
identification
document
G3
All identified hazards
are mitigated
Sn2
Hazard log
Goal
Context
Strategy
Justification
J
Evidence
FIGURE 21.4
Goal structuring notation example.
are mitigated. This is shown by reference to the hazard-identification document (such as a HAZOP
analysis) and to the hazard log (which contains a log of all hazards and why and how they are mitigated).
The GSN notation is likely to be used in the safety validation phase. It shall enhance the readability
of the safety case and shall ease the identification of weaknesses in the arguments. Ideally, the regulator
or certifier of a system can read this notation and can then decide if a system may go into operation.
21.5 Safety Approach for Industrial Communication System
Safety-related industrial communication systems are accomplished by enhancing the standard communication
protocol and/or adapting the hardware of the standard nodes. Such systems have to be implemented
in a way so that systematic failures (failures where the fault can be clearly identified [IEC61508])
and stochastic failures (failures that occur randomly and where various faults can be the reason for a
single failure [IEC61508]) are detected during the operation, leading to hazards and resulting from node
or network faults.
21.5.1 Overview of Safety-Related Systems
What all safety-related industrial communication systems have in common is that the standard non-safe
system is used and safety-related functions are integrated. Most of the communication systems adhere
to the requirements of SIL3 specified in [IEC61508]. Predominantly, the communication systems use
a two-channel architecture realized by a one-out-of-two (1oo2) architecture, meaning that such architecture
consists of two independent channels that execute a given task, but have to agree on the result
unanimously. Furthermore, safety-related industrial communication systems use a safety-related message
format including a cyclic redundancy check (CRC), a timestamp, or sequence number. That message is
embedded into the payload field of the non-safety-related protocol. Finally, the safety-related firmware
is very often placed above layer 7 of the ISO/OSI reference model to guarantee compatibility between
© 2011 by Taylor and Francis Group, LLC