wilamowski-b-m-irwin-j-d-industrial-communication-systems-2011

Ethernet POWERLINK 39-7
data of the next EPL cycle on both connections and make use of the alternative transmission path. If the
ring is reestablished, the MN will detect the obvious collision and logically unlock the ring topology
again directly.
39.6 Security Aspects
The functional principle of POWERLINK, when operating in EPL mode, clearly separates the real-time
domain from any non-real-time (office) one. The access to the POWERLINK real-time domain is granted
by dedicated gateway functionality of the network. These gateways typically provide a basic NAT (network
address translation) mechanism and therefore hides the POWERLINK IP address from being accessed
without having the exact knowledge about the gateway configuration. This principle provides basic
security measures already by design, though most gateway products could include further firewall
functionality on top.
39.6.1 POWERLINK Safety
POWERLINK safety is a protocol for a so-called one channel safe data transmission up to safety
integrity level (SIL) 3. The protocol has been specified in 2007 by the Safety Working Group of EPSG,
and the first products compliant with the specification have been certified by the TÜV Rheinland
Group in 2008.
POWERLINK safety works according to the “Black Channel” principle, meaning that the safety
measures are completely independent of the underlying protocol. As a restriction, however, the underlying
protocol has to provide security measures for the network. Obviously, POWERLINK safety has
been developed in order to optimize its integration with the EPL protocol (in this direction, both the
domain separation and the high cyclic update rate revealed particularly helpful). Nonetheless, it may
be employed effectively on top of any other protocol as well. POWERLINK safety allows to implement
safety network management (SNMT) techniques, a safe configuration manager (SCM) for network
participant and the safe exchange of process information via safe process data objects (SPDO). With
POWERLINK safety, it is possible to exchange devices and they will be automatically booted and configured
by the system without any user intervention. The SCM is responsible for parametrization and
configuration of all safety nodes in the network. Its main functionality is to verify during boot-up of
the network if the current parameter set of each node matches the expected parameters as configured
by the users. In the case there is a mismatch, the SCM downloads the expected parameter set to the
device and reboots it. All safety parameters are stored on a database on the SCM. For any given safe
configuration of the system, the SCM is able to identify wrongly plugged modules by comparing
the vendor ID and the product code of any booting device with the centrally located database. A mismatch
would prevent the device from booting, and the protocol may then indicate the failure to the
application layer.
POWERLINK safety devices can be used in a mixed mode with both safe and nonsafe devices connected
to the same network infrastructure. This is often referred to as integrated safety technology.
The communication model of the POWERLINK safety protocol is based on the well-known producer/
consumer technique. Every safe node can be producer and/or consumer of any safety-related information.
The unique identifier of safe nodes as well as safe data is provided by the safety address (SADR).
POWERLINK safety systems can be freely set up in every possible topology provided by the transport
media. Each POWERLINK safety network requires one single SCM. The number of safety nodes for one
SCM is limited to a maximum of 1023. This is then referred to as one safety domain (SD). For a huge
safety network, a maximum of 1023 SDs can be connected via safety domain gateways (SDGs). From the
point of view of one SD, the SDG appears simply as a safety node.
Data transmission of safety-related data is provided by the dedicated safety frame format. The
maximum data that can be transferred with one frame is 254 byte. Each user data are duplicated and
© 2011 by Taylor and Francis Group, LLC