23.03.2017 Views

wilamowski-b-m-irwin-j-d-industrial-communication-systems-2011

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

47-4 Industrial Communication Systems<br />

Maintenance (e.g., removing a safe address of a network variable) and decommissioning of the<br />

node is performed when the node is in modify mode. The node is set to that mode explicitly by the<br />

management unit. The same three-step process as described before on outlining the configuration<br />

process is used.<br />

Such detailed processes for configuration, commissioning, maintenance, and decommissioning<br />

are required and several steps have to be authorized by a user because the tool running at the management<br />

unit is a non-safety-related tool. The advantage is that a standard PC with COTS software<br />

can be used.<br />

47.4 the Hardware<br />

Node hardware designed for a safety-related automation technology has to follow special design rules.<br />

It must be designed in a way to satisfy the requirements caused by a SIL defined in IEC 61508 [1]. As<br />

a design goal of SafetyLon is to reach a SIL3 compliant system, a two-channel architecture (1oo2) was<br />

chosen for the node hardware additional to the EN 14908 chip (Neuron chip or LC3020) as illustrated<br />

in Figure 47.2 [6].<br />

The term 1oo2 (speak: one out of two) indicates that two independent channels perform the same<br />

actions and finally compare the result. In case of SafetyLon, the 1oo2 is realized by two hardware channels.<br />

The result of both channels must be equal that an action such as setting an output can take place.<br />

In case of a mismatch of both channels, the system has to take predefined actions such as discarding<br />

a message or entering a safe state.<br />

IEC 61508 [7] defines different ways of reaching a SIL 3 compliant system as shown in Table 47.1.<br />

There is a trade-off possible between the safe failure fraction (i.e., number of failures not resulting in<br />

a dangerous situation) and the hardware architecture.<br />

SafetyLon node<br />

Safety-related input/output unit<br />

fail safe unit<br />

LON<br />

EN 14908<br />

chip<br />

UART<br />

Safety<br />

chip 1<br />

Standard<br />

<strong>communication</strong><br />

interface<br />

Safety<br />

chip 2<br />

FIGURE 47.2<br />

SafetyLon node hardware architecture.<br />

TABLE 47.1<br />

Hardware<br />

Safety Integrity of Deployed<br />

Safe Failure Fraction<br />

Hardware Fault Tolerance a<br />

0 1 2<br />

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!