wilamowski-b-m-irwin-j-d-industrial-communication-systems-2011

SafetyLon 47-3
is linked to the safety-related firmware and the output is another binary. Such a binary is flashed into a
node and must reside unchanged in the node. A change of the binary in the field is explicitly not allowed
and requires safe tools for development.
After making the node ready for operation, they are installed in the field and standard tools are used
to setup a network. The next step is to configure the nodes, so that a safety-related application can be
performed. The following parameters are required to configure SafetyLon.
• Safe address (node): Each node is assigned a safe address to prevent a node from masquerade.
The safe address identifies a SafetyLon uniquely so that parameters are sent to the intended node.
• Binding* parameters: This allows exchange of a safety-related data.
• SafetyLon user-application identifier: Each user-application gets a unique ID. According to the
ID it is possible to get detailed information on the functionality and the set of safety-related data
points to be configured.
The parameters are transferred to the corresponding node in a three-step process:
1. The management unit sends a request to a node. The node returns its safe address and a transaction
ID. The management unit verifies the safe address.
2. The management unit uses the safe address and the transaction to send the configuration parameter
to the node. The node stores the configuration parameter temporarily, reads the data back
and returns it to the management unit.
3. The management unit checks if the sent and received data are equal. If so, it sends a request to the
node to store the parameter permanently and use it for communication purpose.
Following a successful configuration (idle mode as shown in Figure 47.1), the nodes have to be commissioned
in order to get them ready for performing safety-related applications [3]. First, the configuration
parameters are validated. This refers to checking if the nodes used in the safety-related application
perform as expected (test mode). In case of a successful validation, the user has to confirm it (pre-run
and wait mode). Next, the nodes are waiting to be activated. Such a mode is implemented to allow a
coordinated start-up of a network. In run mode, the node performs its functionality according to the
safety-related firmware and SafetyLon user-application. In that mode, the safety-related data transfer
among the nodes is handled.
The mode is left in two cases: first, if a safety-critical failure has occurred. Then the safe mode is
entered. In case of a recoverable failure, the node leaves the safe mode, otherwise the node remains in
that state until an operator checks the failure cause.
DSF
compared
Test
Idle
Modification finished
DSF compared
Operator
confirmation
Modify
Safe
Communication
failure solved
Failure
detection
Modification
of data
Run
Operator
confirmation
Pre-run
Device reset
Operator
confirmation
Device reset or
PC confirmation
Wait
FIGURE 47.1
Safety-related overall state diagram.
* Binding means that a logic connection between two or among many network variables is established.
© 2011 by Taylor and Francis Group, LLC