wilamowski-b-m-irwin-j-d-industrial-communication-systems-2011

21-10 Industrial Communication Systems
Safety-related part of node (gray)
Node
A
B
Black channel
Non-safety-related part of node
(black)
FIGURE 21.5
Black-channel concept.
21.5.2 Hazard and Risk Analysis
Hazard and risk analysis is a crucial step in every safety lifecycle and safety development of a communication
system (see, e.g., VDI2184 [VDI2184]). Hazards increase the risk of a fatality and not only must be
identified by a hazard and risk analysis but also mitigated by implementing safety measures according
to safety requirements. As outlined before, there is a magnitude of possibilities (e.g., HAZOP or FMEA)
of how to carry out a hazard analysis.
The scope of the hazard and risk analysis is the node connected to the communication system. First,
hazards resulting from failures on the network, which are influencing node safety, must be investigated.
It is not intended to ensure network safety in case of a black-channel approach and hence not included
into safety considerations. Second, the node hardware and firmware itself has to be examined regarding
failures. Moreover, the risk caused by the failures must be assessed and safety measures according to the
target SIL have to be specified.
Table 21.5 lists typical network faults. The faults can be categorized in three different groups: faults
directly corresponding to human mistakes (8, 9), faults not directly relating to human mistakes (1–7),
and faults either directly or indirectly referring to human mistakes (10). The cause of such a grouping is
to point out that human mistakes must be considered during investigation of (network) faults.
The next step is to identify the network failures resulting from faults listed in Table 21.5. Network failures
can be separated into stochastic (i.e., hardware failures) and systematic failures. Another important
topic is to analyze the effect of the failure (i.e., the hazard). Therefore, an FMEA is an appropriate means
as shown in Table 21.6.
Risk analysis can be performed by quantifying or qualifying the risk. According to IEC61508, stochastic
or hardware failures can be quantified, others only qualified by specifying discrete levels such as “low,”
“medium,” or “high.” For example, risk of a “bits being destroyed” can be calculated by the following.
TABLE 21.5
Typical Network Faults
1. Crosstalk 6. Aging
2. Broken cable 7. Temperature
3. EMC failure 8. Human failure
4. Stochastic failure 9. Wiring failure by human
5. Stuck at failure 10. Transmission of non-authorized messages
Source: Reinert, D. and Schaefer, M. (Publisher), Sichere Bussysteme
in der Automation, Hüthig Verlag, Heidelberg, Germany, 2001, 32 pp.
With permission.
© 2011 by Taylor and Francis Group, LLC