wilamowski-b-m-irwin-j-d-industrial-communication-systems-2011

47-10 Industrial Communication Systems
Power up
No failure
Run
Safety critical failure
Start safety-related
configuration
Safety critical
failure
Fail safe
Stop safe-related
configuration
Safety-related configuration
Safety critical
failure
Modify
FIGURE 47.8
Node state machine.
the earliest-deadline-first scheduling mechanism [13]. Second, static scheduling eases synchronization
between safety chips mandatory for the close cooperation between the safety chips. Both chips start at
the same time with the execution of function in the same order.
The state machine controls the behavior of the node. According to inputs received, it decides to
which state to switch to. In a SafetyLon node four states are specified as illustrated in Figure 47.8.
After a reset the node is in POWER UP state and runs through the start-up procedure. For example,
the hardware is tested, the hardware interfaces are initialized and configuration parameters are
copied from the flash memory to the RAM due to performance reasons. In case of no error, the
node enters the RUN state where the node is operating. If safety-critical failures are detected, the node
switches to FAIL SAFE state. In this state, the functionality of the node is limited to a minimum
that does not jeopardize safety. The fail safe state is only left when the critical fault was eliminated
by an operator. MODIFY state is used to configure the node (e.g., to make a safe binding). In this
state, the node provides only such functionality necessary to execute configuration requests and
send the responses.
47.6 the SafetyLon Tools
SafetyLon provides two types of tools: a development tool called application builder that gives the user
the possibility to configure the user-application (e.g., specifying the safe and non-safe network variable
types). Moreover, a SafetyLon management tool makes the safety-related commissioning, configuration
of the firmware and user-application, maintenance of the safety-related application, and decommissioning
of nodes or removal of bindings possible.
The development tool is a non-safe tool that gets a script file as input (see Figure 47.9) which among
LonWorks specific parameters includes
• The type of EN 14908 controller
• The name and type of non-safe network variables and the name and type of safe network variables
Additionally, the application builder interfaces with the LonMark device resource API where the
format and size of the network variables is taken from.
The output of the application builder are plain text c- and header-files containing all information
required to run the user-application as intended (e.g., a file with the network variable table
that holds the SafetyLon message as well as the safety-related payload of the message). The files are
© 2011 by Taylor and Francis Group, LLC