wilamowski-b-m-irwin-j-d-industrial-communication-systems-2011

21-12 Industrial Communication Systems
In literature such as [GIE95] or [LIG02], failure rates for standard hardware components are listed.
Failure rates are available for resistors, diodes, transistors or capacitors, and the like, and are quantified
in failure in time (FIT), which equals a risk of 10 −9 h −1 . They are used to perform the risk analysis. For
example, a risk resulting from the input device is a combination of failures rates of different components
finally leading to a quantified risk value for the complete circuit. The same is true for the CPU, or nonvolatile
and volatile memory. See [BOE04] for examples on how to calculate failures rates of circuits.
In conclusion, the hazard and risk analysis is the base for two types of requirements:
• Hazards shall be addressed by adequate safety function requirements.
• The risk resulting from the hazards has an impact on the safety integrity requirements. The lower
the residual risk shall be, the higher and stricter the safety integrity requirements are.
Both requirements have an impact on the type of safety measures used to reach the target SIL. The
first defines what measures are required while the latter specifies the safety performance of the measures
(e.g., what type of faults can be detected).
21.5.3 Failure Mitigation
Failure mitigation comprises all activities in the safety lifecycle relating to the identification of
safety functions and safety integrity requirements as well as derivation of safety measures from the
requirements.
As mentioned before, both types of requirements are a result of the hazard and risk analysis. It is
separated into two parts: network (cf. Table 21.6) and node hardware (cf. Table 21.7). Typical hazards
and measures to detect them are listed in Table 21.8.
Table 21.8 shows that eight safety measures are specified to address the various hazards resulting
from network failures. The measures result in a generic safety-related message format: in a specific communication
model and a required hardware architecture.
As in most cases, the standard protocol shall not be altered (black-channel approach), the safetyrelated
protocol is embedded into the payload field of the communication protocol. And it shall be different
from the standard protocol to reduce the likelihood of coupling between non-safety-related and
safety-related messages. As shown in Figure 21.6, the safety-related message has the following structure:
• ID (Identifier) consists of length field and a version field: Version denotes the version of the protocol.
It is possible that different types of safety-related message structures are used. The identifier
is a means of detecting insertion of a message by a faulty node.
• Safe address: Safety-critical and non-safety-critical services shall be provided by the system.
Therefore, safety- and non-safety-related messages coexist in the same network. To guarantee
absence of reaction between them explicitly, every safety-related message includes a safe address.
Data sent from a safe output data point (called producer) to a safe input data point (called consumer)
is only processed if the safe address of the producer is known to the consumer.
• Timestamp: A timestamp is the only means to detect the delay between sending at the sender
side and receiving at the receiver. In case of event-triggered communication and devices storing
messages temporarily (e.g., routers), congestion on the network, or wrong routing, a message can
be delayed and therefore outdated. Additionally, wrong sequence of a message and repetition of
the same message is detected. However, a timestamp mechanism requires time synchronization
among the different nodes, which is an additional effort to be considered.
• Safety-related data: Sensor and actuator data is embedded into that field.
• Cyclic redundancy check: The measures mentioned before are implemented to detect systematic
faults (faults that cannot be quantified). The CRC is a means against stochastic faults like a bit
fault leading to a corruption of the message, and it ensures the integrity of the safety-related
message. Depending on the medium of the network (twisted pair, powerline, …), different CRC
polynomials have to be chosen [KOO04].
© 2011 by Taylor and Francis Group, LLC