Wilamowski B.M., Irwin J.D. The Industrial Electronics Handbook. Second Edition: Industrial Communication Systems

Подождите немного. Документ загружается.

20-8 Industrial Communication Systems

references

. 1.. Chow,.M.-Y.,.Network-based.control.and.application,.Proceedings of the 2007 IEEE International

Symposium on Industrial Electronics (ISIE07),

.Vig

.Sp

ain,

.Jun

.4–7,.2007.

. 2.. Cho

.M.-Y.,.Time.sensi

tive

.netw

ork-based

.cont

rol

.system

.and.app

lications,

.IEEE Tr

ansactions on

Industrial Electronics Newsletter,

.52(2),.13–15,.Jun

.2005.

. 3.. Lee

.K.C

.Lee

.S.,.and.Lee

.M.H

.QoS

-based

.rem

ote

.con

trol

.of.net

worked

.con

trol

.sys

tems

.via.Pro

bus

tok

.pas

sing

.pro

tocol,

.IEE

E Transactions on Industrial Informatics,

.1(3

.183

–191,

.Aug

ust

.200

. 4.. Lee

.K.C

.Lee

.S.,.and.Lee

.M.H

.Wor

.cas

.com

munication

.del

.of.rea

l-time

.ind

ustrial

.swi

tched

Eth

ernet

. wit

. mul

tiple

. lev

els,

. IEE

E Transactions on Industrial Electronics,

. 53(

5),

. 166

9–1676,

Oct

ober

.200

. 5.. Daoud

.R.M.,.Els

ayed,

.H.M.,.and.Amer

.H.H.,.Gigab

.Eth

ernet

.for.red

undant

.netw

orked

.cont

rol

system

.IEEE In

ternational Conference on Industrial Technology,

.2,.869–873,.De

cember

.2004.

. 6.. Luo,.R.C.,.Su,.K.L.,.Shen,.S.H.,.and.Tsa

.K.H.,.Netw

orked

.inte

lligent

.rob

ots

.thro

ugh

.the.Int

ernet:

Iss

ues

.an

.op

portunities,

.Pr

oceedings of the IEEE,

.91(3),.371–382,.Ma

rch

.2003.

. 7.. Daoud

. R.M.,. Amer

. H.H.,. El-Da

kroury,

. M.A.,. El-So

udani,

. M.,. Els

ayed,

. H.M.,. and. Salle

. Y.,.

Wire

less

.vehic

.communic

ation

.for.trac.cont

rol

.in.urban.are

as,

.Pro

ceedings of

.IECON

2006,

.Par

is,

Fran

ce,

.pp

.748–753,

.No

vember

.2006.

. 8.. Cerv

in,

.A.,.Henri

ksson,

.D.,.Linco

ln,

.B.,.Eker

.J.,.and.Arzen.K.E..How.does.cont

rol

.timing.ae

perf

ormance?

.IEEE Co

ntrol Systems Magazine,

.23(3),.16–30,.2003.

. 9.. Lozo

ya,

.C.,.Mar

tí,

.P.,.Vel

asco,

.M.,.and.Fuert

es,

.J.M..Ana

lysis

.and.design.of.netw

orked

.cont

rol

.loops.

with.synchronization.at.the.actuation.instants,.Proceedings of the 34th Annual Conference of the IEEE

Industrial Electronics Society (IECON08),

.Orl

ando,

.FL,.No

vember

.2008.

. 10.. Liu

.G.P.,.Xia,.Y.,.Chen,.J.,.Rees,.D.,.and.Hu,.W.,.Netw

orked

.pre

dictive

.cont

rol

.of.system

.wit

rando

.netw

ork

.dela

.in.bot

.for

ward

.and.fee

dback

.cha

nnels,

.IEEE Tr

ansactions on Industrial

Electronics,

.54(3),.1282–1297,.2007.

. 11.. Mar

tí,

.P.,.Vel

asco,

.M.,.and.Bini,.E.. e.opt

imal

.boun

dary

.and.regul

ator

.design.pro

blem

.for.even

driven

.cont

rollers,

.Pro

ceedings of the 12th International Conference on Hybrid Systems: Computation

and Control (HSCC09),

.San.Fra

ncisco,

.CA,.Ap

ril

.2009.

. 12.. Zhan

.W.,. Branic

ky,

. M.,. and.Phil

lips,

.S.,. Sta

bility

.of.netw

orked

.cont

rol

.system

.IEEE Co

ntrol

Systems Magazine,

.21(1),.84–99,.Fe

bruary

.2001.

. 13.. Hes

panha,

.J.,.Nag

hshtabrizi,

.P.,.and.Xu,.Y.,.A.sur

vey

.of.rec

ent

.res

ults

.in.net

worked

.con

trol

.sys

tems,

Pro

ceedings of IEEE, Special Issue on Technology of Networked Control Systems,

.95(1),. 137–162,.

Jan

uary

.2007.

21-1

21.1 Introduction

Industrial.communication.systems.take.over.more.and.more.critical.tasks.. e.criticality.of.the.tasks.can.be.

of.vari

ous

.type

.One.of.the.most.comm

.requ

irements

.is.the.achi

evement

.of.a.cert

ain

.leve

.of.avai

lability,

in.orde

.to.redu

.time

.when.a.syst

.is.not.prod

uctive.

. ere

fore,

.a.cert

ain

.leve

.of.avai

lability

.is.econ

omi-

cally

.nece

ssary.

.As.soon.as.such.syst

ems

.take.over.tasks.that.are.crit

ical

.for.the.safe

.of.peop

.or.the.envi

ronment,

.avai

lability

.alon

.is.not.enou

gh,

.but.it.is.also.nece

ssary

.to.achi

eve

.a.cert

ain

.leve

.of.safe

.inte

grity.

 e.foll

owing

.are.the.typi

cal

.safe

.func

tions

.in.the.eld.of.indu

strial

.comm

unication

.syst

ems

.[WRA

07]:

•

. Emer

gency

.stop.of.an.engi

ne:

.In.case.of.an.emer

gency

.(e.g

.an.oper

ator

.can.be.hurt

.an.engi

has.to.stop.imm

ediately.

•

. Unex

pected

.star

ting

.of.an.engi

.(saf

.torqu

.o):.In.case.of.main

tenance

.acti

vities,

.it.shal

.not.

be.possible.that.the.engine.starts.unexpectedly.

•

. Safe. redu

ced

. velo

city:

. It. shal

. be. guar

anteed

. that. the. maxi

mum

. safe. leve

. of. velo

city

. is. not.

exce

eded.

.Exc

eeding

.mus

.be.det

ected

.and.vel

ocity

.red

uced.

All

.safe

.func

tions

.redu

.the.like

lihood

.of.a.pers

.bein

.hurt

. e.requ

irements

.to.be.met.by.such.

safe

.func

tions

.are.spec

ied

.in.stan

dards

.that.are.eith

.gene

ric,

.spec

ic

.for.a.doma

.such.as.indu

trial

.comm

unication

.syst

ems,

.or.appl

ication

.depe

ndent.

.All.of.them.have.in.comm

.that.they.spec

ify

a.life

cycle

.mode

.wher

.a.haza

.and.risk.anal

ysis,

.a.safe

.requ

irements

.spec

ication,

.a.safe

.anal

ysis,

and.saf

ety

.val

idation

.are.the.cru

cial

.act

ivities.

21.2 the Meaning of Safety

Safety.is.a.property.that.is.generally.highly.desired.by.the.public..Safety.consciousness.is.a.property.that.

is.cont

inuously

.incr

easing,

.and.the.dema

nds

.that.socie

.puts.on.techn

ical

.syst

ems

.rega

rding

.thei

.safe

is.incr

easing

.at.the.same.rate.. e.term.safe

.can.be.inte

rpreted

.very.broa

dly.

.Safe

.is.used.in.vario

Functional Safety

21.1. Introduction..................................................................................... 21-1

21.2

. e.Mea

ning

.of.Saf

ety.................................................................... 21-1

21.3

. Safe

.Stan

dards............................................................................... 21-2

Overview.of.Safety.Standards. •. Basics.of.IEC61508

21.4. e.Safety.Lifecycle.and.Safety.Methods.....................................21-4

Generic.Lifecycle. •. HAZOP. •. FMEA. •. Fault.Tree.

Analysis. •. Safety.Cases

21.5. Safety.Approach.for.Industrial.Communication.System..........21-8

Overview.of.Safety-Related.Systems. •. Hazard.and.Risk.

Analysis. •. Failure.Mitigation

Acronyms................................................................................................... 21-15

References................................................................................................... 21-15

Thomas Novak

SWARCO Futurit

Verk

ehrssignalssysteme

GmbH

Andreas Gerstinger

Vienna University

of Tec

hnology

21-2 Industrial Communication Systems

contexts,.such.as.electrical.safety,.personal.safety,.safety.on.the.streets,.system.safety,.or.functional.safety..

In.this.chap

ter,

.we.are.excl

usively

.conc

erned

.with.the.latt

er.

.use.the.den

itions

.acco

rding

.to.[IEC

61508].

.Safe

.is.den

.as.“fre

edom

.from.unac

ceptable

.risk.

of.harm

.”

.and.func

tional

.safe

.is.the.part.of.the.over

all

.safe

.that.rela

tes

.to.the.corr

ect

.func

tioning

of.some.syst

.(e.g

.a.cont

rol

.syst

.or.an.indu

strial

.comm

unication

.syst

em)

.to.main

tain

.safe

ty.

The.func

tions

.that.need.to.be.perf

ormed

.corr

ectly

.in.orde

.to.achi

eve

.safe

.can.henc

.be.clas

sied

.as.

safe

.rel

ated.

Generally,

.safe

.is.not.an.abso

lute

.prop

erty.

.To.stat

.that.the.risk.rela

ted

.to.a.spec

ic

.syst

.has.been.

redu

ced

.to.zero.is.gene

rally

.not.a.real

istic

.stat

ement.

.Risk

—measured

.as.a.combi

nation

.of.prob

ability

and.seve

rity

.of.an.unde

sired

.even

t—is

.some

thing

.that.we.are.conf

ronted

.with.cont

inuously.

. e.cruc

ial

ques

tion

.is.the.risk.acce

ptability.

.What.leve

.of.risk.are.we.will

ing

.to.acce

pt.

. is.comp

lex

.ques

tion

.will.

not.be.delv

.into.here

.but.it.shou

.be.said.that.this.depe

nds

.on.soci

ety,

.on.time

.and.on.the.doma

in.ques

tion.

.Luck

ily,

.for.indu

strial

.comm

unication

.and.cont

rol

.syst

ems,

.this.ques

tion

.has.alre

ady

.been.

pose

.and.ans

wered

.man

.tim

es,

.suc

.tha

.ref

erence

.can.be.mad

.to.the

.res

ults.

Safety

. shou

. not. be. conf

used

. with. secu

rity:

. Secu

rity

. is. conc

erned

. with. the. prot

ection

. agai

nst

inte

ntional

.atta

cks,

.in.orde

.to.safe

guard

.inte

grity,

.con

dentiality,

.and.avai

lability

.of.serv

ices.

.Safe

is.conc

erned

.with.the.avoi

dance

.of.unin

tended

.acci

dents

.invo

lving

.harm.to.peop

.and.the.envi

ron-

ment.

.A.comm

.deno

minator

.is.that.both.disc

iplines—safety

.and.secu

rity—have

.the.goal.of.avoi

ding

unwa

nted

.even

ts.

. is.also.make

.it.hard.to.dete

rmine

.the.succ

ess

.of.safe

.(and.secu

rity)

.meas

ures,

since.they.were.successful.if.something.unwanted.does.not.happen.

.basic.conc

ept

.in.safe

.engi

neering

.is.the.conc

ept

.of.a.haza

rd.

.A.haza

.is.den

.as.a.“pot

ential

sour

.of.harm

”

.[IEC

61508].

.If.all.haza

rds

.are.iden

tied

.and.corr

ected

.and.adeq

uate

.meas

ures

.are.take

to.cont

rol

.and.miti

gate

.the.haza

rds,

.safe

.is.achi

eved.

. is.is.the.reas

.why.the.iden

tication

.of.haz-

.has.to.be.done.at.the.very.begi

nning

.of.syst

.deve

lopment.

.Typi

cal

.haza

rds

.for.indu

strial

.com-

unication

.sys

tems

.wou

.be.the.los

.or.cor

ruption

.of.a.mes

sage.

.impo

rtance

.of.haza

rds

.and.thei

.iden

tication

.befo

.they.actu

ally

.caus

.an.acci

dent

.also.high

lights

.the.proa

ctive

.natu

.of.safe

ty.

.Safe

.engi

neering

.is.conc

erned

.with.pred

icting

.unwa

nted

.even

befo

.the

.hap

pen,

.not.(on

ly)

.to.lea

.fro

.fai

lures.

21.3 Safety Standards

In.order.to.guarantee.the.achievement.of.a.well-dened.goal,.in.our.case.sucient.safety,.standardiza-

tion

.play

.an.impo

rtant

.role

.Stand

ardization

.help

.to.make.syst

ems

.inte

roperable

.and.comp

arable.

. e.

goal.of.safe

.stan

dards

.is.to.devi

.gene

rally

.appl

icable

.rule

.and.reco

mmendations,

.in.orde

.to.be.able.

to.bui

ld,

.ope

rate,

.and.mai

ntain

.a.saf

ety-related

.sys

tem.

21.3.1 Overview of Safety Standards

The.general.problem.with.standards.is.that.they.must.achieve.a.compromise.between.general.appli-

cability

.and.prac

tical

.usef

ulness

.for.spec

ific

.syst

ems

.givi

.conc

rete

.guid

ance.

.A.high

-level

.stan

dard

.may.be.appl

icable

.to.a.wide.rang

.of.syst

ems,

.but.in.orde

.to.be.appl

icable

.to.such.a.larg

.grou

of.syst

ems,

.it.must.make. seve

ral

.gene

ralizations,

.whic

.make.the.stan

dard

.less.unde

rstandable

for.the.engi

neers

.buil

ding

.a.syst

.in.a.spec

ific

.doma

in.

.Stan

dards

.that.cont

ain

.a.lot.of.spec

ific

info

rmation

.are.on.the.othe

.hand.only.appl

icable

.for.a.smal

.numb

.of.syst

ems

.and.appl

ications.

In.orde

.to.hand

.this.comp

romise,

.stan

dards

.are.ofte

.clas

sified

.as.gene

ric,

.doma

.spec

ific,

.and.

appl

ication

.spec

ific.

Standards

.are.abun

dant,

.and.ther

.is.no.exce

ption

.in.the.doma

.of.safe

ty-critical

.and.safe

ty-related

syst

ems.

.A.sele

ction

.of.some.stan

dards

.that.are.all.conc

erned

.with.safe

ty-related

.syst

ems

.can.be.foun

in.Figu

.21.1

.Bear.in.mind.that.this.is.sure

.not.a.comp

rehensive

.gur

.but.it.illu

strates

.the.prol

ifera-

tion

.of.saf

ety

.sta

ndards.

Functional Safety 21-3

For.our.purposes,.we.will.consider.only.one.of.the.standards:.IEC61508.[IEC61508].. is.standard.

is.generic,.i.e.,.it.is.not.geared.toward.a.specic.application.domain,.but.still.it.contains.enough.con-

crete

.guidance.to.be.useful..Several.domains.have.derived.domain-specic.versions.of.this.standard,.

as.can.be.seen.in.Figure.21.1.. e.principles.of.IEC61508.are.reected.in.all.these.domain-specic.

extensions.

21.3.2 Basics of IEC61508

IEC61508.applies.to.electrical,.electronic,.programmable.electronic.safety-related.systems.. e.gen-

eral

.assumption.is.that.there.is.some.equipment.under.control.(EUC),.which.has.an.inherent.risk..In.

order.to.reduce.this.risk,.a.safety-related.system.controls.the.risk.of.the.EUC..For.example,.in.a.fac-

tory,

.some.heavy.machines.may.be.the.EUC.. e.uncontrolled.EUC.may.pose.a.risk.to.the.operator,.

and.a.safety-related.industrial.communication.system.can.be.used.to.reduce.the.risk.of.this.EUC..

The.safety-related.system.must.be.functionally.safe,.i.e.,.it.must.function.correctly,.and.shall.not.fail.

in.a.dangerous.way.

Depending

.on.the.necessary.risk.reduction,.the.safety-related.

system.is.classied.as.being.in.one.of.four.so-called.safety.integrity.

levels.(SILs).. e.SILs.are.dened.in.terms.of.accepted.failure.rates.

regarding.dangerous.failures.per.hour.(see.Table.21.1).

.a.SIL1.system,.it.is.accepted.that.the.system.fails.in.a.danger-

ous

.way.less.frequently.than.every.10

.h,.whereas.in.a.SIL4.system,.

a.dangerous.failure.is.allowed.not.more.oen.than.every.10

.h.. e.

SIL.that.a.system.must.achieve.is.determined.by.a.risk.analysis,.

which.is.performed.at.the.beginning.of.the.system.lifecycle.

Power drive

systems

Process

industry

Nuclear power

plants

Automotive

Safety of

machinery

IEC 61800

Def Stan 00-54 (UK)

Def Stan 00-56 (UK)

Def Stan 00-55 (UK)

DEF 5679 (AUS)

Military

IEC 61511

IEC 61513

ISO 26262:2011

IEC 62061

EN 13849-1

Railways

CENELEC EN 50126

CENELEC EN 50128

CENELEC EN 50129

CENELEC EN 50159

Yellow Book (UK)

AREMA Standards (USA)

NASA Standards

ACTIVE

CANCELLED

In work

ESA Standards

... and many more ...

Aircraft/air traffic control

ARP4754 (USA)

ESARRs (EU)

EATMP (EU)

CAP 670 (UK)

RTCA DO-178C (USA)

RTCA DO-254 (USA)

RTCA DO-178B (USA)

ED12B (Europe)

RTCA DO-278 (USA)

ED109 (Europe)

EN 954-1

IEC 61508:2009

IEC 61508

Generic

MIL STD 882C (USA)

MIL STD 882D (USA)

FIGURE 21.1 Safety.standards.quagmire.

TABLE 21.1 Safety.Integrity.Levels

SIL Dangerous.Failure.per.Hour

≥10

−9

.to.<10

−8

≥10

−8

.to.<10

−7

≥10

−7

.to.<10

−6

≥10

−6

.to.<10

−5

21-4 Industrial Communication Systems

Depending.on.the.required.SIL,.there.are.constraints.regarding.the.system.architecture..For.example,.

the.higher.the.SIL,.the.more.fault.tolerance.is.required,.which.is.reected.in.the.number.of.redundancies.

a.system.must.possess.

Depending

.on.the.SIL,.the.methods.used.for.the.design.and.development.of.the.system.are.also.

dierent.. e.higher.the.SIL,.the.more.rigorous.are.the.methods.that.must.be.used.. is.is.especially.

crucial.for.the.soware,.since.the.used.methods.play.an.important.role.in.the.achieved.soware.quality..

Soware.developed.with.more.rigorous.methods.are.less.likely.to.contain.undetected.faults.

.addition.to.architecture.constraints.and.required.methods,.the.standard.calls.for.adequate.docu-

mentation

.to.be.produced.. e.documentation.is.necessary.in.order.to.be.able.to.verify.if.the.system.

has.actually.achieved.the.claimed.SIL.. e.“proof.of.safety,”.oen.in.the.form.of.a.so-called.safety.case,.

summarizes.all.this.evidence.. e.safety.case.must.then.be.approved.by.some.regulatory.agency.before.

the.system.goes.into.operation.

21.4 the Safety Lifecycle and Safety Methods

 is.section.introduces.the.safety.lifecycle.and.then.presents.some.of.the.methods.that.may.be.used.

during.this.lifecycle.

21.4.1 Generic Lifecycle

 e.safety.lifecycle.species.what.has.to.be.done.in.the.course.of.the.life.of.a.system.from.the.safety.point.

of.view,.from.initial.conception.until.the.disposal..All.safety.standards.specify.such.a.lifecycle,.with.the.

principles.being.comparable.in.all.of.them..For.this.reason,.we.will.present.here.a.generic.safety.lifecycle.

(Figure.21.2).

.rst.step,.the.hazard.and.risk.analysis.starts.with.an.identication.of.the.hazards.the.system.may.

pose..At.this.time,.there.should.already.be.a.rough.requirements.specication.of.the.system,.and.the.

major.functions.should.be.dened..Based.on.this.information,.the.potential.hazards.should.be.identi-

ed.

. is.step.is.crucial:.all.theoretical.hazards.have.to.be.identied,.otherwise.it.is.impossible.to.devise.

the.right.methods.and.countermeasures.for.them..Hazards.that.are.not.identied.at.this.step.will.not.

be.considered.adequately.during.the.remainder.of.the.safety.lifecycle.and.may.later.pose.a.risk.during.

system.operation..Aer.the.identication.of.the.hazards,.the.hazards.must.be.classied.according.to.

their.severity.and.probability,.so.that.the.resulting.risk.can.be.determined.

.next.step.in.the.safety.lifecycle.of.Figure.21.2.is.the.safety.requirements.specication..Based.on.

the.results.of.the.risk.analysis,.it.is.generally.necessary.to.dene.requirements.to.ensure.that.the.risks.

are.mitigated.to.a.level.so.that.they.are.acceptable.. e.safety.requirements.can.be.of.various.types.. ey.

can.either.be.functional.requirements,.which.require.an.additional.implementation.of.some.kind,.or.

they.may.be.nonfunctional.requirements,.such.as.the.requirement.to.perform.a.certain.specic.analysis,.

or.the.requirement.to.use.certain.processes.during.the.development..For.example,.a.functional.safety.

requirement.in.a.communication.system.may.specify.a.checksum.with.certain.failure.detection.and/or.

correction.properties..A.nonfunctional.safety.requirement.may.specify.the.need.to.perform.a.common-

mode

.failure.analysis.on.the.design.of.the.system.. e.specied.safety.requirements.should.be.included.

in.the.requirement.specication.of.the.complete.system.

.third.step.in.the.safety.lifecycle.consists.of.the.performance.of.all.the.safety.analyses.. ese.analy-

ses

.can.be.of.various.types,.and.some.of.them.will.be.described.in.the.following.sections..In.general,.the.

Safety requirements

specification

Safety analyses

Safety validation

Hazard and risk

analysis

FIGURE 21.2 Generic.safety.lifecycle.

Functional Safety 21-5

safety.engineer.looks.at.the.system.in.its.present.stage.(this.may.be.only.the.documented.architecture.

and.desi

gn,

.or.the.ful

.imp

lemented

.sys

tem,

.dep

ending

.on.the.sta

.of.the.dev

elopment)

.and.ana

lyses

pot

ential

.sce

narios

.tha

.lea

.to.haz

ards.

.Mos

.ana

lyses

.in.thi

.sta

.are.con

cerned

.wit

.fau

lts

.and.fai

ures

.th

.ma

.oc

cur.

. e

.an

alyses

.pr

esent

.a.co

.of.th

.wo

.of.a.sa

fety

.en

gineer.

Safety

.val

idation,

.as.the.na

.ste

.sum

marizes

.all.the.res

ults

.and.evi

dences.

.Dur

ing

.thi

.pha

se,

.it.has.

to.be.sho

.tha

.all.haz

ards

.are.mit

igated

.and.tha

.all.saf

ety

.req

uirements

.hav

.bee

.met

. is.is.usu

ally

.don

.in.the.for

.of.a.“sa

fety

.cas

e.”

.A.saf

ety

.cas

.is.a.sou

.and.rig

orous

.arg

ument,

.whi

.cle

arly

dem

onstrates

.su

cient

.saf

ety

.of.a.sys

tem

.in.a.giv

.con

text.

. e.saf

ety

.cas

.doc

ument

.ref

erences

.and.

use

.all.pre

viously

.obt

ained

.res

ults

.in.ord

.to.con

struct

.thi

.pro

of.

.All.the

.bui

lding

.blo

cks,

.whi

.are.

nec

essary

.for.thi

.pro

of,

.are.usu

ally

.cal

led

.“ev

idences.”

.A.not

ation

.how.suc

.a.saf

ety

.cas

.can.be.con

structed

.is.pr

esented

.la

ter

.in.th

.se

ction.

.saf

ety

.lif

ecycle

.gen

erally

.con

tinues

.unt

.the.end.of.lif

.of.the.sys

tem.

. e.ful

.lif

ecycle

.can.be.

fou

.in.[I

EC61508].

.Ho

wever,

.fo

.br

evity,

.we.ha

.co

ncentrated

.on.th

.ma

jor

.st

ages.

All

.met

hods

.tha

.are.sho

.in.the.fol

lowing

.sec

tions

.are.to.be.use

.dur

ing

.the.saf

ety

.lif

ecycle.

.Are

erence

.to.the.rel

evant

.sta

.of.the.lif

ecycle

.as.sho

.in.Fig

ure

.21.

.wil

.be.mad

.Gen

erally,

.the.pro

ject

saf

ety

.man

ager

.is.res

ponsible

.for.the.con

duct

.of.the.ana

lyses

.and.exe

cutes

.them.tog

ether

.wit

.the.

pro

ject

.saf

ety

.eng

ineer

.and.rel

evant

.tea

.memb

ers.

.In.sma

ller

.pro

jects,

.the.rol

.of.saf

ety

.man

agement

and.saf

ety

.eng

ineering

.can.be.comb

ined.

.In.lar

ger

.pro

jects,

.the

.may.be.mor

.tha

.one.saf

ety

.eng

ineer.

.met

hods

.pre

sented

.her

.are.onl

.a.sel

ection

.of.pos

sible

.met

hods.

.[IE

C61508],

.par

.7,.ann

exes

.A,.

B,.and.C.contain.a.comprehensive.list.of.methods.with.brief.descriptions.and.further.references.

21.4.2 HaZOP

Hazard.and.Operability.Study.(HAZOP).is.a.method.to.identify.hazards..It.should.therefore.be.used.

at.the.ver

.beg

inning

.of.the.saf

ety

.lif

ecycle,

.dur

ing

.the.haz

ard

.and.ris

.ana

lysis

.pha

se.

.Alt

hough

.thi

met

hod

.ori

ginates

.fro

.the.pro

cess

.ind

ustry,

.it.is.ver

.gen

eric

.and.can.the

refore

.be.app

lied

.bro

adly.

For.ele

ctronic

.sy

stems,

.it.is.st

andardized

.in.[D

S00-58].

.int

ention

.of.the.HAZ

.is.to.ana

lyze

.all.pos

sible

.fun

ctions

.of.a.giv

.sys

tem

.and.exa

mine

all.cre

dible

.mal

functions

.or.dev

iations

.fro

.the.cor

rect

.fun

ction.

.In.ord

.to.ide

ntify

.all.pot

ential

haz

ards,

.thi

.met

hod

.sug

gests

.the.use.of.a.giv

.set.of.gui

.wor

.tha

.sha

.be.app

lied

.to.fun

ctions

(Ta

ble

.21.

2).

All

.the

.gui

.wor

.sha

.be.sys

tematically

.app

lied

.to.all.fun

ctions.

.It.rem

ains

.to.be.dec

ided

.wha

the.“fu

nctions”

.of.a.sys

tem

.are

.Basi

cally,

.the.fun

ctions

.sho

uld

.be.de

ned

.in.a.sys

tem

.des

cription

.or.

TABLE 21.2 HAZOP.Guide.Words

No is.is.the.complete.negation.of.the.design.intention..No.part.of.the.intention.is.achieved.

and.nothing.else.happens.

More is

.is.a.qu

antitative

.incr

ease.

Less is

.is.a.qu

antitative

.decr

ease.

.we

.as

All

.th

.design.int

ention

.is.achie

ved

.tog

ether

.wi

.addit

ions.

Part

.of

Only

.so

.of.th

.design.int

ention

.is.achie

ved.

Reverse e

.logic

.op

posite

.of.th

.int

ention

.is.achie

ved.

Other

.th

an Complete

.su

bstitution,

.wh

ere

.no.pa

.of.th

.or

iginal

.int

ention

.is.achie

ved

.bu

.so

mething

quit

.dier

ent

.ha

ppens.

Early Something

.ha

ppens

.ea

rlier

.th

.expe

cted

.re

lative

.to.clo

.tim

Late Something

.ha

ppens

.la

ter

.th

.expe

cted

.re

lative

.to.clo

.tim

Before Something

.ha

ppens

.bef

ore

.it.is.expe

cted,

.re

lating

.to.or

der

.or.se

quence.

Aer Something

.ha

ppens

.a

.it.is.expe

cted,

.re

lating

.to.or

der

.or.se

quence.

Source:

. Ministry. of. Defence,. HAZOP Studies on Systems Containing Programmable Electronics,. U.K..

Defence.Standard,.Def.Stan.00-58,.Ministry.of.Defence,.Glasgow,.U.K.,.2000,.Part.1,.p..14..With.permission.

21-6 Industrial Communication Systems

a.requirements.document.. erefore,.such.documentation.should.be.available..It.also.remains.to.be.

dec

ided

.at.whi

.gra

nularity

.the.ana

lysis

.is.car

ried

.out

.A.hig

h-level

.sys

tem

.fun

ction

.can.usu

ally

.be.

div

ided

.into.a.numb

.of.sub

-functions,

.whi

.can.in.tur

.be.div

ided

.into.mor

.sub

-functions.

. e.

low

.the.lev

.at.whi

.the.ana

lysis

.is.con

ducted,

.the.mor

.eo

.is.req

uired,

.but.the.mor

.ben

et

.can.

be.gai

ned

.fro

.the.ana

lysis.

. e.rig

.lev

.of.the.ana

lysis

.sho

uld

.be.dec

ided

.at.the.beg

inning.

.It.wil

gen

erally

.alw

ays

.be.a.com

promise

.bet

ween

.rig

.and.ec

iency.

.A.goo

.sta

rting

.poi

.for.the.ana

lysis

.is.

the.hi

ghest-level

.re

quirements

.de

scription

.of.a.sy

stem.

HAZOP

.sho

uld

.als

.be.con

ducted

.as.a.tea

.act

ivity.

. is.mea

.tha

.the.tea

.sho

uld

.inc

lude

.not.

onl

.saf

ety

.pro

fessionals

.but.als

.eng

ineers,

.sys

tem

.desi

gners,

.so

ware

.eng

ineers,

.or.eve

.end.use

rs.

One.per

son

.sha

.tak

.the.lea

.and.mod

erate

.the.HAZ

.ses

sions.

. is.lea

.wil

.gen

erally

.be.tak

.ove

by.the.saf

ety

.man

ager

.or.eng

ineer.

. e.HAZ

.ses

sions

.sho

uld

.be.pla

nned

.wel

.in.adv

ance,

.and.it.is.

imp

ortant

.to.kee

.the.foc

.and.not.to.get.side

tracked

.into.lon

.dis

cussions,

.whi

.do.not.con

tribute

to.the.goa

.Als

.so.fac

tors

.suc

.as.su

cient

.bre

aks

.and.an.ade

quate

.env

ironment

.are.cru

cial

.to.the.

suc

cess

.of.th

.se

ssions.

Finally,

.the.res

ults

.are.doc

umented

.in.a.tab

ular

.for

mat.

. e.mai

.out

puts

.are.the.haz

ards,

.aga

inst

whi

.ade

quate

.saf

ety

.req

uirements

.hav

.to.be.spe

cied.

.In.the.cou

rse

.of.the.rem

ainder

.of.the.saf

ety

lif

ecycle,

.it.mu

.be.sh

own

.th

ese

.ha

zards

.ar

.un

der

.co

ntrol.

21.4.3 FMEa

 e.Failure.Modes.and.Eects.Analysis.(FMEA).is.a.method.that.systematically.analyzes.all.failure.modes.

of.com

ponents

.and.det

ermines

.the.asso

ciated

.ris

.and.pot

ential

.mit

igations.

.It.is.a.bot

tom-up

.app

roach,

whi

.sta

rts

.on.the.com

ponent

.lev

.and.aims.to.det

ermine

.the.eec

.of.fai

lure

.mod

.on.the.sys

tem

.fun

tions.

.For.a.saf

ety

.eng

ineer,

.it.is.esse

ntial

.to.det

ermine

.the.saf

ety

.imp

act

.of.the.ana

lyzed

.fai

lure

.mod

es.

.int

ernational

.sta

ndard,

.whi

.com

prehensively

.des

cribes

.the.met

hod

.as.a.tec

hnique

.for.sys

tem

rel

iability,

.is.ava

ilable

.in.[IE

C60812].

. e.met

hod

.con

sists

.of.ana

lyzing

.all.com

ponents

.or.ite

.of.a.

sys

tem

.and.ll

ing

.out.of.all.the.col

umns

.of.a.giv

.tab

le.

.It.sta

rts

.fro

.the.com

ponent

.lev

el,

.and.hen

is.a.typ

ical

.“bo

ttom-up”

.met

hod.

. e.hea

dings

.of.suc

.a.pos

sible

.FME

.tab

.are.giv

.in.Tab

.21.

.an.

exa

mple

.wi

.be.sh

own

.in.Ta

ble

.21

.6.

Similar

.to.HAZ

OP,

.an.FME

.is.bes

.per

formed

.as.a.gro

.act

ivity,

.sinc

.div

erse

.exp

ertise

.is.nee

ded

to.re

cord

.al

.in

formation

.ne

cessary.

21.4.4 Fault tree analysis

Whereas.FMEA.has.its.origins.in.reliability.engineering,.fault.tree.analysis.[IEC61025].is.a.typical.safety.

eng

ineering

.tec

hnique.

.It.is.in.man

.way

.com

plementary

.to.an.FME

.and.the

refore

.sho

uld

.not.be.con

sidered

.as.an.alt

ernative,

.but.as.ano

ther

.nec

essary

.met

hod

.to.be.use

.dur

ing

.the.saf

ety

.ana

lysis

.pha

se.

It.is.a.top-

down

.met

hod,

.whi

.sta

rts

.fro

.the.und

esired

.eve

nts,

.in.our.cas

.it.sta

rts

.wit

.the.haz

ards.

It.is.the

.ana

lyzed,

.wha

.the.con

tributing

.fac

tors

.to.a.haz

ard

.cou

.be,.and.thi

.is.the

.pre

sented

.in.the.

for

.of.log

.gat

es.

.For.exa

mple,

.if.the.com

munication

.sys

tem

.and.the.bac

kup

.com

munication

.sys

tem

mus

.fai

.for.a.haz

ard

.to.occ

ur,

.thi

.is.rep

resented

.by.an.“an

d”

.gat

.If.one.wan

.to.say.tha

.the.com

munication

.sys

tem

.fai

.whe

.the.pow

.sup

ply

.fai

.or.whe

.the.med

ium

.fai

ls,

.thi

.is.rep

resented

.by.

an.“or

”

.gat

. is.tre

.is.the

.con

structed

.unt

.one.rea

ches

.the.basi

.eve

nts,

.whi

.can

not

.be.spl

.up.

fur

ther.

. e.ex

ample

.ju

.de

scribed

.is.sh

own

.in.Fi

gure

.21

.3.

TABLE 21.3 FMEA.Table.Header

Item.ID

Description.

and.

Function

Failure.

Mode

Possible.

Causes Eect

Detection.

Method Mitigation Severity Probability

Safety.

Impact

Functional Safety 21-7

Probabilities.can.then.be.assigned.to.the.basic.events..If.this.is.done.completely,.it.is.possible.to.

calculate.the.numerical.probability.for.the.hazard.on.the.top..Several.tools.are.available,.which.aid.in.the.

construction.of.such.fault.trees,.and.which.can.perform.these.calculations.automatically.

21.4.5 Safety Cases

A.safety.case.shall.show.that.the.safety.requirements.and.objectives.are.met..Simply.said,.it.shall.show.

that.“the.system.is.acceptably.safe.for.its.intended.use.”.In.order.to.prove.this.statement,.structured.

textual.arguments.can.be.made.up,.which.show.that.this.claim.is.true..However,.textual.arguments.can.

become.very.long.and.dicult.to.read..Especially,.it.can.become.hard.to.verify.if.the.line.of.argumenta-

tion

.is.sound.and.the.safety.objectives.are.really.met.

For

. this. reason,. [Kel&04]. suggests. a. clearly. dened. notation. for. safety. cases,. called. the. Goal.

Structuring.Notation.(GSN)..GSN.is.already.used.widely.and.is.likely.to.be.standardized.in.the.near.

future.. e.basic.elements.of.the.notation.are.goals,.strategies,.and.solutions.. e.goals.contain.some.

propositional.statement.that.shall.be.shown.to.be.true.. e.strategies.contain.arguments.on.how.this.

proof.can.be.made.. e.solutions.are.the.evidences.that.contain.the.necessary.information.to.show.the.

truth.of.the.goal..An.example.is.shown.in.Figure.21.4.

.example.contains.a.claim.that.a.system.is.safe.. e.argument.is.made.over.the.hazard.mitiga-

tion.

.It.is.suggested.that.if.all.hazards.are.found.and.they.are.mitigated,.the.system.is.safe.by.denition..

Finally,.this.argument.requires.two.subgoals,.namely.that.all.hazards.are.identied.and.that.all.hazards.

TOP 1

GATE 1

Failure of

medium

Failure of

power supply

EVENT 1 EVENT 2

GATE 2

Hazard: total

communication

failure

Main

communication

system failure

Backup

communication

system failure

FIGURE 21.3 Fault.tree.example.

21-8 Industrial Communication Systems

are.mitigated.. is.is.shown.by.reference.to.the.hazard-identication.document.(such.as.a.HAZOP.

analysis).and.to.the.hazard.log.(which.contains.a.log.of.all.hazards.and.why.and.how.they.are.mitigated).

.GSN.notation.is.likely.to.be.used.in.the.safety.validation.phase..It.shall.enhance.the.readability.

of.the.safety.case.and.shall.ease.the.identication.of.weaknesses.in.the.arguments..Ideally,.the.regulator.

or.certier.of.a.system.can.read.this.notation.and.can.then.decide.if.a.system.may.go.into.operation.

21.5 Safety approach for Industrial Communication System

Safety-related.industrial.communication.systems.are.accomplished.by.enhancing.the.standard.commu-

nication

.protocol.and/or.adapting.the.hardware.of.the.standard.nodes..Such.systems.have.to.be.imple-

mented

.in.a.way.so.that.systematic.failures.(failures.where.the.fault.can.be.clearly.identied.[IEC61508]).

and.stochastic.failures.(failures.that.occur.randomly.and.where.various.faults.can.be.the.reason.for.a.

single.failure.[IEC61508]).are.detected.during.the.operation,.leading.to.hazards.and.resulting.from.node.

or.network.faults.

21.5.1 Overview of Safety-related Systems

What.all.safety-related.industrial.communication.systems.have.in.common.is.that.the.standard.non-safe.

system.is.used.and.safety-related.functions.are.integrated..Most.of.the.communication.systems.adhere.

to.the.requirements.of.SIL3.specied.in.[IEC61508]..Predominantly,.the.communication.systems.use.

a.two-channel.architecture.realized.by.a.one-out-of-two.(1oo2).architecture,.meaning.that.such.archi-

tecture

.consists.of.two.independent.channels.that.execute.a.given.task,.but.have.to.agree.on.the.result.

unanimously..Furthermore,.safety-related.industrial.communication.systems.use.a.safety-related.message.

format.including.a.cyclic.redundancy.check.(CRC),.a.timestamp,.or.sequence.number.. at.message.is.

embedded.into.the.payload.eld.of.the.non-safety-related.protocol..Finally,.the.safety-related.rmware.

is.very.oen.placed.above.layer.7.of.the.ISO/OSI.reference.model.to.guarantee.compatibility.between.

Definition of

{System}

{System} is safe in a

given {Environment}

Definition of

“safe”

Argument over

hazard identification

and mitigation

All hazards are

identified

All identified hazards

are mitigated

Hazard log

Goal

Context

Strategy

Justification

Evidence

Hazard

identification

document

If all hazards are found and

their risk is acceptable, the

system is safe by definition

Definition of

{Environment}

Sn2

Sn1

FIGURE 21.4 Goal.structuring.notation.example.

Functional Safety 21-9

non-safe.and.safe.communication.systems..Another.reason.is.that.the.protocol.stack.of.industrial.com-

munication

.syst

ems

.is.very.oen.stan

dardized

.and.ther

efore

.shou

.not.to.be.alte

red.

.Tabl

.21.4.give

.an.

over

view

.of.the.safe

.feat

ures

.of.some.safe

ty-related

.comm

unication

.syst

ems.

.alre

ady

.ment

ioned,

.the.main.goal.of.safe

.is.to.avoi

.syst

ematic

.faul

.and.dete

.stoch

astic

.faul

lead

ing

.to.haza

rds

.such.as.a.corr

uption

.of.a.mess

age.

.Safe

.meas

ures

.like.a.CRC.are.requ

ired

.to.miti

gate

.the.risk.resu

lting

.from.the.haza

rds.

.Typi

cally,

.stan

dard

.comm

unication

.syst

ems

.alre

ady

.incl

ude

some.meas

ures

.to.dete

.faul

.(e.g

.a.CRC.or.cros

s-parity

.mech

anism

.to.ensu

.data.inte

grity).

.Duri

safe

.consi

deration,

.ther

.are.two.appr

oaches

.of.how.to.trea

.the.stan

dard

.comm

unication

.syst

em:

eith

.take.the.avai

lable

.faul

.dete

ction

.meas

ures

.into.acco

unt

.and.add.more.meas

ures

.to.nal

.reac

the.targ

.safe

.inte

grity

.leve

.Or.the.stan

dard

.comm

unication

.syst

.with.its.faul

.dete

ction

.mea-

ures

.is.neg

lected

.and.the.sys

tem

.is.tre

ated

.as.a.bla

.box.ref

erred

.to.as.bla

ck-channel

.con

cept.

Safety

.of.cont

rol

.area.netw

ork

.(CAN

)

.reli

.on.the.faul

.dete

ction

.mech

anism

.of.stan

dard

.CAN..

Addi

tionally,

.to.incr

ease

.inte

grity

.and.redu

.resid

ual

.fail

ure,

.prob

ability

.mess

ages

.are.sent.twic

.and.

the.seco

.one.is.inve

rted.

. e.two.stan

dard

.mess

ages

.comp

rise

.a.singl

.safe

ty-related

.mess

age.

.To.

dist

inguish

.safe

ty-

.and.non-

safety-related

.mess

ages,

.the.iden

tier

.rang

.in.the.stan

dard

.mess

age

.was.

exte

nded.

.Fina

lly,

.watc

hdog

.func

tionality

.is.inte

grated

.to.dete

.if.a.safe

ty-related

.mess

age

.part.or.a.

comp

lete

.safe

ty-related

.mess

age

.was.lost

.CANo

pen

.Safe

.meet

.safe

.requ

irements

.of.SIL3.give

.by.

the.inte

rnational

.stan

dard

.IEC6

1508.

.Sinc

.the.proto

col

.enha

ncement

.was.not.suc

ient

.to.meet.the.

desir

.saf

ety

.lev

el,

.in.add

ition,

.a.har

dware

.arc

hitecture

.wit

.two.cha

nnels

.was.cho

sen.

ProSafe

.or.SafetyLon.are.based.on.the.black-channel.concept.as.shown.in.Figure.21.5.. e.network.

and.the.stan

dard

.proto

col,

.and.the.stan

dard

.hard

ware

.comp

onent

.(non

-safety-related

.part

)

.of.the.node.

are.trea

ted

.as.a.blac

.box..Node.A.inse

rts

.a.mess

age

.into.the.blac

k-channel

.and.Node.B.rece

ives

.it.. e.

idea.is.that.safe

.meas

ures

.are.requ

ired

.to.dete

.all.faul

.that.are.possi

ble

.in.the.blac

k-channel

.with

out

payi

.atte

ntion

.to.exis

ting

.meas

ures.

.Typi

cal

.faul

.are.syst

ematic

.faul

.on.the.netw

ork

.or.faul

.in.the.

stan

dard

.hard

ware

.comp

onent.

.Any.meas

ures

.of.the.stan

dard

.proto

col

.to.dete

.faul

.like.pari

.bits.to.

iden

tify

.mess

age

.corr

uption

.are.not.consi

dered.

. e.stan

dard

.proto

col

.is.just.a.mean

.to.tran

sport

.data.

some

how

.fro

.Nod

.A.to.Nod

.B.

.gray.part.as.show

.in.Figu

.21.5.is.the.safe

ty-related

.part

.It.comp

rises

.the.safe

ty-related

.hard

ware

.and.rmw

are.

.Both.are.used.to.incr

ease

.the.safe

.inte

grity

.and.cons

equently

.redu

.the.leve

.of.

risk.to.a.tole

rable

.tar

get

.lev

el.

TABLE 21.4 Safety-Related.Communication.Systems

Compliant.

toStandard Safe.Node.Architecture

Safety-Related.

Message.Format

Safety.

Firmware.in.

the.ISO/OSI.

Model

CANopen

.saf

ety IEC61508,

.SIL.3 Tw

.cha

nnel

.(1oo2) NO—s

tandard

messa

.sent.twice;.

secon

.time.invert

Integrated

into.lay

Dev

iceNet

.saf

ety IEC61508,

.SIL.3 Tw

.cha

nnel

.(2×.1oo1,.1oo2) YES—em

bedded

.into.

stan

dard

.pro

tocol

paylo

.eld

Saf

ety

.lay

abov

.lay

PRO

FIsafe IEC61508,

.SIL.3 Sin

gle

.cha

nnel YES—embedded

.into.

stan

dard

.pro

tocol

paylo

.eld

Saf

ety

.lay

abov

.lay

Safet

yBUS

.p EN.954-1,.Cat..4 Tw

.cha

nnel

.(1oo2) YES—emb

edded

.into.

stan

dard

.pro

tocol

paylo

.eld

Saf

ety

.lay

abov

.lay

Safet

yLon IEC61508,

.SIL.3 Tw

.cha

nnel

.(1oo2) YES—emb

edded

.into.

stan

dard

.pro

tocol

paylo

.eld

Saf

ety

.lay

abov

.lay