wilamowski-b-m-irwin-j-d-industrial-communication-systems-2011

Profisafe 46-3
Safety
application
Safety
application
Standard
application
Standard
application
Profisafe
layer
Profisafe
layer
Standard protocol
Standard data
Standard protocol
Black
channel
Safety data
Profinet, Profibus
FIGURE 46.3 Black channel approach. (Adapted from PROFIsafe—Safety technology for PROFIBUS and
PROFINET—System description, PROFIBUS Nutzerorganisation e.V. PNO, 2007.)
while EN 50159-1 defines the requirements needed to support safe communication between safetyrelated
equipment. Many of the solutions employed by Profisafe are based on EN 50159-1 proposals,
the “black channel” principle being the most relevant example. Nowadays, Profisafe is part of a series
of standards related to fieldbus systems—IEC 61158 [4] and its companion IEC 61784 [5]. Within
this series, the IEC 61784-3 [6] defines a set of profiles to support safe communication in fieldbus
networks. Profisafe is standardized as IEC 61784-3-3 [7], resulting from additional specifications
proposed within IEC 61784-3 to encompass Profibus and Profinet networks. According to its developers
[1], it is certified for use in safety-related applications up to SIL 3 (Safety Integrity Level, IEC
61508 or IEC 62061) or PL “e” (Performance Level, ISO 13849-1). This certification is also extended
to wireless networks such as IEEE 802.11 and Bluetooth, but with additional security requirements
(see Section 46.3.4).
46.1.2 Black Channel Principle
The “black channel” principle is based on the following requirement: the transmission of safety data
is performed independently of the characteristics of the transmission system, e.g., medium, topology,
communication stack, network devices, etc., and without trusting the internal safety mechanisms
provided by it. In order to achieve this goal, its implementation is undertaken as an additional layer—
the safety layer—on top of the application layer. The safety layer considers that safety data are subject
to various threats (i.e., errors), and for each one defines a set of defense measures in order to protect
this data [3] (see Section 46.2.2). In the Profisafe case, the safety layer is implemented as a safety
profile (Figure 46.3). Therefore, safety data are encapsulated in standard Profinet or Profibus frames,
jointly with standard data, and transmitted in accordance with the usual rules defined by the communication
protocol.
46.2 Profisafe Communication
From the beginning, the Profisafe solution was subject to certain design constraints: compatibility with
existing Profibus/Profinet physical layers, interoperability with existing devices, and compatibility
with existing modular devices. Any solution must attempt to guarantee the error-free delivery of data,
or the detection of data with errors, between communicating devices, such as a PLC (F-Host) and an I/O
© 2011 by Taylor and Francis Group, LLC