wilamowski-b-m-irwin-j-d-industrial-communication-systems-2011

21-14 Industrial Communication Systems
ID Safe address Time stamp Data: n byte
CRC
1
ID Safe address Time stamp
Message part 1 Message part 2
Data: n byte
CRC
2
FIGURE 21.6
Generic safety-related message format.
The value of each data point (sensor or actuator value), irrespective of whether it has changed or not,
is periodically sent to the receiver by using a safety-related message. That mechanism is called heartbeat.
On the receiver side, a watchdog is used, which is reset every time a valid message has been received. As
a consequence, a malfunction at the sender side or a fault in the black-channel (e.g., unavailability of the
network due to a broke wire or a defect in the standard network interface) can also be detected.
In addition, each safety-related message can be duplicated as shown in Figure 21.6. Just the CRC are
different. At the receiver side, not only the CRC are verified but also the duplicated data is compared
bit-by-bit. Such a mechanism increases the integrity of the message and reduces the risk of corruption
to a minimum.
Finally, every message received by a node is processed by two safe controllers. Each of them verifies
the ID, the safe address, the timestamp, and the CRC. After that they compare their results. Only if both
safe controllers agree on the same positive result, action according to the data point value is taken. Such
an approach is called redundancy with cross-comparison.
By using such a safety-related message structure as shown in Figure 21.6, a heartbeat and redundancy
with cross-comparison, all faults mentioned in Table 21.8 are addressed and can be detected.
Embedding the safety-related message into the data field of the standard industrial communication
system message format leaves the standard protocol unchanged. Consequently, non-safe and safe nodes
use the same protocol, only the structure of the data field is different.
Node hardware-related safety measures are outlined in detail in [HOE86]. Faults in the hardware
components as listed in Table 21.9 are stochastic faults. They cannot be avoided but detected and handled
properly. Fault detection is performed by means of online and offline hardware self tests.
The online tests that are executed guarantee a high integrity of the hardware by revealing faults in the
different parts of the hardware. Tests are separated into volatile memory (RAM), nonvolatile read-only
memory (FLASH), CPU (controller) tests, and test of the input/output unit. Faults of the communication
interface to the network interface are tested by sending heartbeats implicitly.
In general, volatile memory test algorithms differ in test effort and diagnostic coverage. A high test
effort and a high diagnostic coverage is ensured when using the galloping pattern test, a low one when
TABLE 21.9
Node Hardware-Related Hazards and Measures
Hardware
Component Effect (Hazard) Safety Measure
Controller Wrong operation of device Use of a 1oo2 structure with watchdog and
cross-checking; use of cyclic communication
via serial interface between both channels;
use of CPU test at startup and during
operation
Memory Wrong operation of device Use of memory test at startup and during
operation
Input device Wrong operation of device Use of test pulses; use of test pattern with
different test pulses
Output device to
network interface
Output device to
actuator
Wrong operation of device
Unable to switch off
Check of message by independent channels
and comparison of check results
Use of test pulses
© 2011 by Taylor and Francis Group, LLC