wilamowski-b-m-irwin-j-d-industrial-communication-systems-2011

SafetyLon 47-5
In detail, a hardware fault tolerance of 1 results in a required safe failure fraction of 90%–99%. The
safe failure fraction (SFF) defines the percentage of failures that do not result in a dangerous situation.
It is defined as follows:
λSD + λSU + λDD
SFF =
λ + λ + λ + λ
SD SU DD DU
(47.1)
where
λ SD is the safe detected failure
λ SU is the safe undetected failure
λ DD is the dangerous detected failure
λ DU is the dangerous undetected failure
Hence, there must be a trade-off between the quality of the hardware to reduce the inherent risk and the
effort performed to detect dangerous failures. As defined in the formula, λ DU reduces the SFF, whereas
dangerous failures that can lead into a hazardous state can be used to increase the SFF if they are detected.
Hence, it is reasonable to perform hardware self tests (i.e., detecting dangerous faults that therefore result
in non-dangerous failures) in order to increase the SFF. The impacts of the above described facts result in
extensive testing of all components such as input and output, or volatile and nonvolatile memory [8]. In the
following, an example is given on how to design and test the safe input and output logic.
In a standard, non-safe environment a digital input is simply connected to the evaluating device.
Connecting a digital IO directly to a microcontroller is often not suitable for safety-related devices. First,
the hardware inside the device must be protected against hazardous effects from outside, therefore mostly
a galvanic isolation, an optocoupler, is used. Second, additional components are added to setup a testable
input. The input is tested only if it is active, which means that a defined voltage is applied to the input terminal.
It is not necessary to test an input that is in an inactive state because it is per definition the safe state.
Figure 47.3 depicts the principles of a testable input; several elements were omitted in the picture in
order to focus on the functionality. In addition to the first optocoupler, a second one is added. For testing
purpose, this device is able to switch off the signal transmission to the microcontrollers for a very
short period of time. This interruption of the input signal must be detected by the microcontroller.
Field side Safe input internals
Opto coupler 1
Internal
power
supply
Field input
signal
Ground
extern
Input to
CPU
Test input
from
CPU
Opto coupler 2
Ground
intern
FIGURE 47.3
Schematic of safety-related input.
© 2011 by Taylor and Francis Group, LLC