wilamowski-b-m-irwin-j-d-industrial-communication-systems-2011

Functional Safety 21-11
TABLE 21.6
FMEA of Network
Network Failure Failure Mode Description Effect (Hazard)
Data corruption Single bit destroyed EMC effect
destroys bit
Loss
Incorrect sequence
Repetition
Delay
Insertion
Coupling between safety
and non-safety-related
messages
Broken wire or
gateway problem,
wrong routing
Buffering of messages
in a gateway
Wrong network
configuration
Aging of wire or
hard software
problem in
gateway
The gateway cannot
process more than
a single message
at the same time
A non-authorized
message looks like
a safety-related
message
Change of message can
produce malfunction at
receiver side
A safety-related message
is not or in the wrong
sequence or more often
transmitted to the
receiver
The delayed or inserted
message includes an
outdated value
Receiver performs
a non-intended
safety-related action being
triggered from a nonsafety-related
sender
According to [PHO97], the probability of a bit being destroyed on shielded twisted pair cables is p = 10 −5 .
It is assumed that v = 10 safety-related messages are sent every second. The rate of single bit transmission
error U is
U
1
−4
= p * v = 10 /s (21.1)
In other words, every 10,000.s, a single transmission error occurs and the risk of a single bit being
destroyed per second is 10 −4 . The probability that two bits are destroyed within 1.s is 10 −9 , assuming that
probabilities are independent and therefore p 2 is inserted into the aforementioned formula instead of p.
As a result, the safety integrity of a safety measure must be chosen so that the residual failure probability
of a message is at least below 10 −7 h −1 to reach the target SIL3.
Also, failures on node side must be investigated. That is, a hazard analysis and risk analysis has also
to be performed to identify failures on the node itself (Table 21.7). In IEC61508, part 2, a detailed list
is provided that gives information on the various failures in the components of a microcontroller that
must be taken into consideration. Such a hazard analysis is also carried out by means of FMEA.
TABLE 21.7
FMEA of Node Hardware
Hardware
Component Failure Mode Description Effect (Hazard)
Controller Malfunction Due to high temperature, the
ALU of the CPU delivers
wrong values
Memory Wrong values stored Stuck at fault in the volatile
memory results in wrong
values stored
Input device
Output device to
network interface
Output device to
actuator
Wrong data read by
controller
Corrupted messages
sent or received
Failure of output switch
Stuck at failure or shortcut
failure between different
channels
Stochastic and systematic
failures during data transfer
Stuck at failure or shortcut
failure in the output circuit
Wrong operation
of device
Wrong operation
of device
Wrong operation
of device
Wrong operation
of device
Unable to switch off
© 2011 by Taylor and Francis Group, LLC