wilamowski-b-m-irwin-j-d-industrial-communication-systems-2011

Functional Safety 21-9
TABLE 21.4
Safety-Related Communication Systems
Compliant
to Standard
Safe Node Architecture
Safety-Related
Message Format
Safety
Firmware in
the ISO/OSI
Model
CANopen safety IEC61508, SIL 3 Two channel (1oo2) NO—standard
message sent twice;
second time inverted
DeviceNet safety IEC61508, SIL 3 Two channel (2× 1oo1, 1oo2) YES—embedded into
standard protocol
payload field
PROFIsafe IEC61508, SIL 3 Single channel YES—embedded into
standard protocol
payload field
SafetyBUS p EN 954-1, Cat. 4 Two channel (1oo2) YES—embedded into
standard protocol
payload field
SafetyLon IEC61508, SIL 3 Two channel (1oo2) YES—embedded into
standard protocol
payload field
Integrated
into layer 7
Safety layer
above layer 7
Safety layer
above layer 7
Safety layer
above layer 7
Safety layer
above layer 7
non-safe and safe communication systems. Another reason is that the protocol stack of industrial communication
systems is very often standardized and therefore should not to be altered. Table 21.4 gives an
overview of the safety features of some safety-related communication systems.
As already mentioned, the main goal of safety is to avoid systematic faults and detect stochastic faults
leading to hazards such as a corruption of a message. Safety measures like a CRC are required to mitigate
the risk resulting from the hazards. Typically, standard communication systems already include
some measures to detect faults (e.g., a CRC or cross-parity mechanism to ensure data integrity). During
safety consideration, there are two approaches of how to treat the standard communication system:
either take the available fault detection measures into account and add more measures to finally reach
the target safety integrity level. Or the standard communication system with its fault detection measures
is neglected and the system is treated as a black box referred to as black-channel concept.
Safety of control area network (CAN) relies on the fault detection mechanism of standard CAN.
Additionally, to increase integrity and reduce residual failure, probability messages are sent twice and
the second one is inverted. The two standard messages comprise a single safety-related message. To
distinguish safety- and non-safety-related messages, the identifier range in the standard message was
extended. Finally, watchdog functionality is integrated to detect if a safety-related message part or a
complete safety-related message was lost. CANopen Safety meets safety requirements of SIL3 given by
the international standard IEC61508. Since the protocol enhancement was not sufficient to meet the
desired safety level, in addition, a hardware architecture with two channels was chosen.
ProfiSafe or SafetyLon are based on the black-channel concept as shown in Figure 21.5. The network
and the standard protocol, and the standard hardware component (non-safety-related part) of the node
are treated as a black box. Node A inserts a message into the black-channel and Node B receives it. The
idea is that safety measures are required to detect all faults that are possible in the black-channel without
paying attention to existing measures. Typical faults are systematic faults on the network or faults in the
standard hardware component. Any measures of the standard protocol to detect faults like parity bits to
identify message corruption are not considered. The standard protocol is just a means to transport data
somehow from Node A to Node B.
The gray part as shown in Figure 21.5 is the safety-related part. It comprises the safety-related hardware
and firmware. Both are used to increase the safety integrity and consequently reduce the level of
risk to a tolerable target level.
© 2011 by Taylor and Francis Group, LLC