Wilamowski B.M., Irwin J.D. The Industrial Electronics Handbook. Second Edition: Industrial Communication Systems

Подождите немного. Документ загружается.

21-10 Industrial Communication Systems

21.5.2 Hazard and risk analysis

Hazard.and.risk.analysis.is.a.crucial.step.in.every.safety.lifecycle.and.safety.development.of.a.communi-

cation

.system.(see,.e.g.,.VDI2184.[VDI2184])..Hazards.increase.the.risk.of.a.fatality.and.not.only.must.be.

identied.by.a.hazard.and.risk.analysis.but.also.mitigated.by.implementing.safety.measures.according.

to.safety.requirements..As.outlined.before,.there.is.a.magnitude.of.possibilities.(e.g.,.HAZOP.or.FMEA).

of.how.to.carry.out.a.hazard.analysis.

.scope.of.the.hazard.and.risk.analysis.is.the.node.connected.to.the.communication.system..First,.

hazards.resulting.from.failures.on.the.network,.which.are.inuencing.node.safety,.must.be.investigated..

It.is.not.intended.to.ensure.network.safety.in.case.of.a.black-channel.approach.and.hence.not.included.

into.safety.considerations..Second,.the.node.hardware.and.rmware.itself.has.to.be.examined.regarding.

failures..Moreover,.the.risk.caused.by.the.failures.must.be.assessed.and.safety.measures.according.to.the.

target.SIL.have.to.be.specied.

Table

.21.5.lists.typical.network.faults.. e.faults.can.be.categorized.in.three.dierent.groups:.faults.

directly.corresponding.to.human.mistakes.(8,.9),.faults.not.directly.relating.to.human.mistakes.(1–7),.

and.faults.either.directly.or.indirectly.referring.to.human.mistakes.(10).. e.cause.of.such.a.grouping.is.

to.point.out.that.human.mistakes.must.be.considered.during.investigation.of.(network).faults.

.next.step.is.to.identify.the.network.failures.resulting.from.faults.listed.in.Table.21.5..Network.fail-

ures

.can.be.separated.into.stochastic.(i.e.,.hardware.failures).and.systematic.failures..Another.important.

topic.is.to.analyze.the.eect.of.the.failure.(i.e.,.the.hazard).. erefore,.an.FMEA.is.an.appropriate.means.

as.shown.in.Table.21.6.

Risk

.analysis.can.be.performed.by.quantifying.or.qualifying.the.risk..According.to.IEC61508,.stochas-

tic

.or.hardware.failures.can.be.quantied,.others.only.qualied.by.specifying.discrete.levels.such.as.“low,”.

“medium,”.or.“high.”.For.example,.risk.of.a.“bits.being.destroyed”.can.be.calculated.by.the.following..

TABLE 21.5 Typical.Network.Faults

1..Crosstalk . 6..Aging

.Broken.cable . 7..Temperature

.EMC.failure . 8..Human.failure

.Stochastic.failure . 9..Wiring.failure.by.human

.Stuck.at.failure 10..Transmission.of.non-authorized.messages

Source:

. Reinert,.D..and.Schaefer,.M..(Publisher),.Sichere Bussysteme

in der Automation,.Hüthig.Verlag,.Heidelberg,.Germany,.2001,.32.pp..

With.permission.

Safety-related part of node (gray)

A B

Node

Non-safety-related part of node

(black)

Black channel

FIGURE 21.5 Black-channel.concept.

Functional Safety 21-11

According.to.[PHO97],.the.probability.of.a.bit.being.destroyed.on.shielded.twisted.pair.cables.is.p.=.10

−5

It.is.assu

med

.that.v.=.10.safe

ty-related

.mess

ages

.are.sent.ever

.second

. e.rate.of.sing

.bit.tran

smission

erro

.U.is

. U p v

10= =

−

* /s . (21.1)

.othe

.word

.ever

.10,0

.s,.a.singl

.tran

smission

.erro

.occu

.and.the.risk.of.a.singl

.bit.bein

dest

royed

.per.seco

.is.10

−4

.. e.probability.that.two.bits.are.destroyed.within.1.s.is.10

−9

,.assuming.that.

prob

abilities

.are.inde

pendent

.and.ther

efore

.is.inserted.into.the.aforementioned.formula.instead.of.p..

As.a.resu

lt,

.the.safe

.inte

grity

.of.a.safe

.meas

ure

.must.be.chos

.so.that.the.resid

ual

.fail

ure

.prob

ability

of.a.mes

sage

.is.at.lea

.bel

.10

−7

−1

.to.reach.the.target.SIL3.

Also,

.fail

ures

.on.node.side.must.be.inve

stigated.

. at.is,.a.haza

.anal

ysis

.and.risk.anal

ysis

.has.also.

to.be.perf

ormed

.to.iden

tify

.fail

ures

.on.the.node.itse

.(Tab

.21.7

.In.IEC6

1508,

.part.2,.a.deta

iled

.list.

is.prov

ided

.that.give

.info

rmation

.on.the.vari

ous

.fail

ures

.in.the.comp

onents

.of.a.micr

ocontroller

.that.

must.be.tak

.into.con

sideration.

.Suc

.a.haz

ard

.ana

lysis

.is.als

.car

ried

.out.by.mea

.of.FME

TABLE 21.6 FMEA.of.Network

Network.Failure Failure.Mode Description Eect.(Hazard)

Data

.corr

uption Single

.bit.destr

oyed EMC

.eec

destro

.bit

hange

.of.mess

age

.can.

prod

uce

.malf

unction

.at.

receiv

.side

Loss

ncorrect

.seq

uence

Repetition

Broken

.wire.or.

gatewa

.pro

blem,

wron

.rou

ting

Aging

.of.wire.or.

hard.so

ware

prob

lem

.in.

gatewa

.saf

ety-related

.mess

age

isnot.or.in.the.wro

sequen

.or.mor

.oen.

transmi

tted

.to.the.

receiver

Delay

Insertion

Buering

.of.messa

ges

in.a.gate

way

.gatewa

.canno

proces

.mor

.tha

a.single.mess

age

at.the.sam

.time

.dela

yed

.or.inser

ted

messa

.incl

udes

.an.

outd

ated

.value

oupling

.betw

een

.saf

ety

and.non-s

afety-related

messa

ges

Wrong

.netw

ork

conguratio

.non-a

uthorized

messa

.looks.like.

a.saf

ety-related

messa

Receiver

.perf

orms

anon-int

ended

safet

y-related

.action.being.

trigg

ered

.fro

.anon-

afety-related

.sender

TABLE 21.7 FMEA.of.Node.Hardware

Hardware.

Component Failure.Mode Description Eect.(Hazard)

Controller Malfunction Due

.to.high.temp

erature,

.the.

ALU.of.the.CPU.deliv

ers

wron

.values

rong

.opera

tion

of.device

emory Wrong

.values.sto

red Stuck

.at.faul

.in.the.vol

atile

memor

.resu

lts

.in.wro

values.sto

red

Wrong

.opera

tion

of.device

nput

.device

Wrong

.dat

.read.by.

contr

oller

Stuck

.at.fail

ure

.or.sho

rtcut

failur

.betw

een

.dieren

chann

els

Wrong

.opera

tion

of.device

utput.device.to.

network.interface

Corrupted.messages.

sent.or.received

Stochastic.and.systematic.

failures.during.data.transfer

Wrong.operation.

of.device

utput

.device.to.

actua

tor

Failure

.of.out

put

.swit

ch Stuck

.at.fail

ure

.or.sho

rtcut

failur

.in.the.out

put

.circui

Unable

.to.swit

.o

21-12 Industrial Communication Systems

In.literature.such.as.[GIE95].or.[LIG02],.failure.rates.for.standard.hardware.components.are.listed..

Fai

lure

.rat

.are.ava

ilable

.for.resi

stors,

.dio

des,

.tra

nsistors

.or.cap

acitors,

.and.the.lik

.and.are.qua

ntied

in.fai

lure

.in.tim

.(FI

T),

.whi

.equ

als

.a.ris

.of.10

−9

−1

.. ey.are.used.to.perform.the.risk.analysis..For.

exa

mple,

.a.ris

.res

ulting

.fro

.the.inp

.dev

ice

.is.a.comb

ination

.of.fai

lures

.rat

.of.di

erent

.com

ponents

na

lly

.lea

ding

.to.a.qua

ntied

.ris

.val

.for.the.com

plete

.cir

cuit.

. e.sam

.is.tru

.for.the.CPU

.or.non

volatile

.an

.vo

latile

.me

mory.

.Se

.[B

OE04]

.fo

.ex

amples

.on.ho

.to.ca

lculate

.fa

ilures

.ra

tes

.of.ci

rcuits.

.co

nclusion,

.th

.ha

zard

.an

.ri

.an

alysis

.is.th

.ba

.fo

.tw

.ty

pes

.of.re

quirements:

•

. Haz

ards

.sh

all

.be.ad

dressed

.by.ad

equate

.sa

fety function requirements.

•

. e.ris

.res

ulting

.fro

.the.haz

ards

.has.an.imp

act

.on.the.saf

ety integrity requirements.

. e.low

the.re

sidual

.ri

.sh

all

.be

.th

.hi

gher

.an

.st

ricter

.th

.sa

fety

.in

tegrity

.re

quirements

.ar

Both

.req

uirements

.hav

.an.imp

act

.on.the.typ

.of.saf

ety

.mea

sures

.use

.to.rea

.the.tar

get

.SIL

. e.

rs

.de

nes

.wha

.mea

sures

.are.req

uired

.whi

.the.lat

ter

.spe

cies

.the.saf

ety

.per

formance

.of.the.mea

sures

(e.

g.,

.wh

.ty

.of.fa

ults

.ca

.be.de

tected).

21.5.3 Failure Mitigation

Failure. mitigation. comprises. all. activities. in. the. safety. lifecycle. relating. to. the. identication. of.

saf

ety

.fun

ctions

.and.saf

ety

.int

egrity

.req

uirements

.as.wel

.as.der

ivation

.of.saf

ety

.mea

sures

.fro

.the.

req

uirements.

.men

tioned

.bef

ore,

.bot

.typ

.of.req

uirements

.are.a.res

ult

.of.the.haz

ard

.and.ris

.ana

lysis.

.It.is.

sep

arated

.into.two.par

ts:

.net

work

.(cf

.Tab

.21.

.and.nod

.har

dware

.(cf

.Tab

.21.

7).

.Typ

ical

.haz

ards

and.me

asures

.to.de

tect

.th

.ar

.li

sted

.in.Ta

ble

.21

.8.

Table

.21.

.sho

.tha

.eig

.saf

ety

.mea

sures

.are.spe

cied

.to.add

ress

.the.var

ious

.haz

ards

.res

ulting

fro

.net

work

.fai

lures.

. e.mea

sures

.res

ult

.in.a.gen

eric

.saf

ety-related

.mes

sage

.for

mat:

.in.a.spe

cic

.com

munication

.mo

del

.an

.a.re

quired

.ha

rdware

.ar

chitecture.

.in.mos

.cas

es,

.the.sta

ndard

.pro

tocol

.sha

.not.be.alt

ered

.(bl

ack-channel

.app

roach),

.the.saf

ety-

.pro

tocol

.is.embe

dded

.into.the.pay

load

.el

.of.the.com

munication

.pro

tocol.

.And.it.sha

.be.dif

ferent

.fro

.the.sta

ndard

.pro

tocol

.to.red

uce

.the.lik

elihood

.of.cou

pling

.bet

ween

.non

-safety-related

.and.

saf

ety-related

.mes

sages.

.As.sho

.in.Fig

ure

.21.

.the.saf

ety-related

.mes

sage

.has.the.fol

lowing

.str

ucture:

•

. ID (

Identier) consists of length eld and a version eld:

.Ver

sion

.den

otes

.the.ver

sion

.of.the.pro

to-

col.

.It.is.pos

sible

.tha

.di

erent

.typ

.of.saf

ety-related

.mes

sage

.str

uctures

.are.use

. e.ide

ntier

is.a.me

ans

.of.de

tecting

.in

sertion

.of.a.me

ssage

.by.a.fa

ulty

.no

de.

•

. Saf

e address:

. Saf

ety-critical

. and. non

-safety-critical

. ser

vices

. sha

. be. pro

vided

. by. the. sys

tem.

efore,

.saf

ety-

.and.non

-safety-related

.mes

sages

.coe

xist

.in.the.sam

.net

work.

.To.gua

rantee

abs

ence

.of.rea

ction

.bet

ween

.the

.exp

licitly,

.eve

.saf

ety-related

.mes

sage

.inc

ludes

.a.saf

.add

ress.

Dat

.sen

.fro

.a.saf

.out

put

.dat

.poi

.(ca

lled

.pro

ducer)

.to.a.saf

.inp

.dat

.poi

.(ca

lled

.con

sumer)

.is.on

.pr

ocessed

.if.th

.sa

.ad

dress

.of.th

.pr

oducer

.is.kn

own

.to.th

.co

nsumer.

•

. Tim

estamp:

.A.tim

estamp

.is.the.onl

.mea

.to.det

ect

.the.del

.bet

ween

.sen

ding

.at.the.sen

der

side.and.rec

eiving

.at.the.rec

eiver.

.In.cas

.of.eve

nt-triggered

.com

munication

.and.dev

ices

.stor

ing

mes

sages

.tem

porarily

.(e.

g.,

.rou

ters),

.con

gestion

.on.the.net

work,

.or.wro

.rou

ting,

.a.mes

sage

.can.

be.del

ayed

.and.the

refore

.out

dated.

.Add

itionally,

.wro

.seq

uence

.of.a.mes

sage

.and.rep

etition

.of.

the.sam

.mes

sage

.is.det

ected.

.How

ever,

.a.tim

estamp

.mec

hanism

.req

uires

.tim

.syn

chronization

amo

.th

.di

erent

.no

des,

.wh

ich

.is.an.ad

ditional

.e

ort

.to.be.co

nsidered.

•

. Saf

ety-related data:

.Se

nsor

.an

.ac

tuator

.da

.is.emb

edded

.in

.th

.e

ld.

•

. Cyclic redundancy check:. e.measures.mentioned.before.are.implemented.to.detect.systematic.

faults.(faults.that.cannot.be.quantied).. e.CRC.is.a.means.against.stochastic.faults.like.a.bit.

fau

.lea

ding

.to.a.cor

ruption

.of.the.mes

sage,

.and.it.ens

ures

.the.int

egrity

.of.the.saf

ety-related

mes

sage.

.Dep

ending

.on.the.med

ium

.of.the.net

work

.(tw

isted

.pai

.pow

erline,

.…),.di

erent

.CRC.

pol

ynomials

.ha

.to.be.ch

osen

.[K

OO04].

Functional Safety 21-13

TABLE 21.8 Network-Related.Hazards.and.Measures.to.Detect. em

Measures.Hazard

Consecutive.

Number Time.Mark

Time.Out.

(Watchdog)

Acknowledgment.

(Echo)

Identier.for.Sender.

and.Receiver

Data.

Protection

Redundancy.

with.Cross.

Comparison

Dierent.Data.

Protection.for.

Safe/Non-Safe.

Messages

Repetition

✓ ✓ ✓

Loss

✓ ✓ ✓

Insertion

✓

Incorrect.sequence

✓ ✓ ✓

Data.corruption

✓ ✓

✓

Delay

✓

Coupling.between.safety.and.

non-safety-related.messages

✓ ✓ ✓

Source:. BG-PRÜFZERT,. Fachausschuss. Elektrotechnik.. GS-ET-26—Bussysteme für die Übertragung sicherheitsrelevanter Nachrichten.. Prüfgrundsätze,. Köln,.

Deutschland,.Germany,.2002..With.permission.

Application.dependent.

Detection.of.insertion.of.an.invalid.source.only.

Serial.bus.only.

Always.required.

21-14 Industrial Communication Systems

 e.value.of.each.data.point.(sensor.or.actuator.value),.irrespective.of.whether.it.has.changed.or.not,.

is.periodically.sent.to.the.receiver.by.using.a.safety-related.message.. at.mechanism.is.called.heartbeat..

On.the.receiver.side,.a.watchdog.is.used,.which.is.reset.every.time.a.valid.message.has.been.received..As.

a.consequence,.a.malfunction.at.the.sender.side.or.a.fault.in.the.black-channel.(e.g.,.unavailability.of.the.

network.due.to.a.broke.wire.or.a.defect.in.the.standard.network.interface).can.also.be.detected.

.addition,.each.safety-related.message.can.be.duplicated.as.shown.in.Figure.21.6..Just.the.CRC.are.

dierent..At.the.receiver.side,.not.only.the.CRC.are.veried.but.also.the.duplicated.data.is.compared.

bit-by-bit..Such.a.mechanism.increases.the.integrity.of.the.message.and.reduces.the.risk.of.corruption.

to.a.minimum.

Finally,

.every.message.received.by.a.node.is.processed.by.two.safe.controllers..Each.of.them.veries.

the.ID,.the.safe.address,.the.timestamp,.and.the.CRC..Aer.that.they.compare.their.results..Only.if.both.

safe.controllers.agree.on.the.same.positive.result,.action.according.to.the.data.point.value.is.taken..Such.

an.approach.is.called.redundancy.with.cross-comparison.

.using.such.a.safety-related.message.structure.as.shown.in.Figure.21.6,.a.heartbeat.and.redun-

dancy

.with.cross-comparison,.all.faults.mentioned.in.Table.21.8.are.addressed.and.can.be.detected..

Embedding.the.safety-related.message.into.the.data.eld.of.the.standard.industrial.communication.

system.message.format.leaves.the.standard.protocol.unchanged..Consequently,.non-safe.and.safe.nodes.

use.the.same.protocol,.only.the.structure.of.the.data.eld.is.dierent.

Node

.hardware-related.safety.measures.are.outlined.in.detail.in.[HOE86]..Faults.in.the.hardware.

components.as.listed.in.Table.21.9.are.stochastic.faults.. ey.cannot.be.avoided.but.detected.and.han-

dled

.properly..Fault.detection.is.performed.by.means.of.online.and.oine.hardware.self.tests.

.online.tests.that.are.executed.guarantee.a.high.integrity.of.the.hardware.by.revealing.faults.in.the.

dierent.parts.of.the.hardware..Tests.are.separated.into.volatile.memory.(RAM),.nonvolatile.read-only.

memory.(FLASH),.CPU.(controller).tests,.and.test.of.the.input/output.unit..Faults.of.the.communication.

interface.to.the.network.interface.are.tested.by.sending.heartbeats.implicitly.

.general,.volatile.memory.test.algorithms.dier.in.test.eort.and.diagnostic.coverage..A.high.test.

eort.and.a.high.diagnostic.coverage.is.ensured.when.using.the.galloping.pattern.test,.a.low.one.when.

Safe address Safe address

Time stamp Time stamp

Data: n byte Data: n byte

Message part 1 Message part 2

CRC

FIGURE 21.6 Generic.safety-related.message.format.

TABLE 21.9 Node.Hardware-Related.Hazards.and.Measures

Hardware.

Component Eect.(Hazard) Safety.Measure

Controller Wrong

.operation.of.device Use.of.a.1oo2.structure.with.watchdog.and.

cross-checking;.use.of.cyclic.communication.

via.serial.interface.between.both.channels;.

use.of.CPU.test.at.startup.and.during.

operation

Memory Wrong

.operation.of.device Use.of.memory.test.at.startup.and.during.

operation

Input

.device Wrong.operation.of.device Use.of.test.pulses;.use.of.test.pattern.with.

dierent.test.pulses

Output

.device.to.

network.interface

Wrong.operation.of.device Check.of.message.by.independent.channels.

and.comparison.of.check.results

Output

.device.to.

actuator

Unable.to.switch.o Use.of.test.pulses

Functional Safety 21-15

implementing.the.marching.bit.test.[HOE86].. e.level.of.the.diagnostic.coverage.depends.on.the.faults.

rev

ealed

.by.the.tes

.Tes

.wit

.a.hig

.lev

.det

ect

.fau

lts

.acc

ording

.to.the.DC-

fault

.mod

el,

.oth

ers

.onl

det

ect

.st

uck-at

.fa

ults

.[I

EC61508].

Tests

.of.the.non

volatile

.rea

d-only

.mem

ory

.rel

.on.saf

ety

.mea

sures

.lik

.par

ity

.bit

.che

cksums,

.or.

CRC

.whe

reas

.dia

gnostic

.cov

erage

.of.the.rs

.is.low.and.the.las

.is.hig

. e.dat

.stor

.is.spl

.up.in.

blo

cks

.of.equ

.len

gth

.and.eac

.blo

.is.saf

eguarded

.wit

.a.saf

ety

.mea

sure.

.Dur

ing

.ope

ration,

.the.CRC.

or.che

cksum

.of.the.blo

.is.rec

alculated

.and.ver

ied

.wit

.the.stor

.one

.In.cas

.of.equ

ality,

.the.int

eg-

rity

.of.da

.is.gu

aranteed.

.CPU.tes

.con

sists

.of.the.tes

.of.the.reg

isters

.use

.(eq

ual

.to.the.tes

.of.the.vol

atile

.mem

ory),

.the.

sta

.te

st,

.th

.a

.te

st,

.an

.th

.te

.of.th

.CP

U’s

.ar

ithmetic

.lo

gic

.un

.(A

LU):

•

. Sta

ck test:

.Tes

ting

.the.sta

.poi

nter

.wit

hout

.man

ipulation

.of.the.pro

gram

.ow.is.not.pos

sible.

Con

sequently,

.the.sta

.tes

.is.red

uced

.to.the.ver

ication

.of.a.sta

.ove

row,

.whi

.is.the.mos

com

mon

.sta

.fau

lt.

. er

efore,

.a.de

ned

.bit.mas

.is.stor

.at.the.upp

.and.low

.bou

.of.the.

sta

ck.

.It.is.che

cked

.per

iodically,

.if.the.bit.mas

.rem

ains

.unc

hanged.

.In.cas

.of.a.cha

nged

.bit.mas

it.is.ob

vious

.th

.a.st

ack

.ov

erow

.oc

curred

.re

sulting

.in.an.un

dened

.an

.un

safe

.be

havior.

•

. Fla

g test:

.Tes

ting

.the.ag

.is.don

.by.set

ting

.and.res

etting

.the.CPU.ag

.and.ver

ication

.of.the.

res

ults.

.In.ad

dition,

.th

.co

nditional

.ex

ecution

.of.in

structions

.ha

.to.be.ve

ried.

•

. Ari

thmetic logic unit:

. e. tes

. of. the. ALU. sho

uld

. cov

. all. phy

sical

. pat

. wit

hin

. the. CPU

Obv

iously,

.th

.pr

oblem

.is.th

.th

.en

tire

.CP

.la

yout

.is.un

known

.an

.mo

.im

portant,

.too.co

plex

.for.a.com

prehensive

.ana

lysis.

.In.ord

.to.add

ress

.thi

.pro

blem,

.the.ins

truction

.set.of.the.

mic

rocontroller

.is.sep

arated

.int

.com

mand

.cla

sses.

.Com

mand

.cla

sses

.are

.e.g

.the.AND.and.

the.MOV.com

mand.

.For.eve

.com

mand

.cla

ss,

.the.inp

.val

ues

.are.cho

sen

.so.tha

.eve

.bit.of.the.

out

put

.pe

rforms

.a.“1

–0”

.an

.a.“0

–1”

.tr

ansition.

All

.the.saf

ety

.req

uirements

.and.saf

ety

.mea

sures

.res

ult

.in.add

itional

.saf

ety-related

.rm

ware.

.In.mos

cas

es,

.it.is.log

ically

.loc

ated

.abo

.ISO

/OSI

.lay

.7.of.the.sta

ndard

.pro

tocol

.sta

ck.

.And.ano

ther

.con

se-

quence

.is.tha

.mos

tly

.a.dua

.cha

nnel

.har

dware

.arc

hitecture

.(se

.Tab

.21.

.is.req

uired.

.In.oth

.wor

ds,

the.sta

ndard

.har

dware

.of.a.nod

.is.ext

ended

.wit

.a.saf

ety

.con

troller

.to.all

.cro

ss-comparison

.of.dat

acronyms

1oo2. One.out.of.two

. Dir

ect

.cu

rrent

EUC

. Equ

ipment

.un

der

.co

ntrol

FIT

. Fai

lure

.in.ti

FMEA

. Fai

lure

.mo

.an

.e

ect

.an

alysis

FTA

. Fau

.tr

.an

alysis

GSN

. Goa

.st

ructuring

.no

tation

HAZOP

. Haz

ard

.an

.op

erability

.st

udy

SIL

. Saf

ety

.in

tegrity

.le

vel

references

[BOE04].J..Börcsök..Electronic Safety Systems..Hüthig.Verlag,.Heidelberg,.Germany,.2004,.107.pp.

[DS00-58]

.Minis

try

.of.Defen

ce.

.HAZOP.studies.on.system

.cont

aining

.prog

rammable

.elec

tronics.

.U.K..

Defen

.St

andard.

.Def.St

.00-58..Mini

stry

.of.Def

ence,

.Gl

asgow,

.U.K.,.2000.

[GIE95]

.K..Gie

.an

.R..Gie

ck.

.Te

chnische Formelsammlung.

.Gie

.Ver

lag,

.Ger

mering,

.Ger

many,

.1995.

[GS-ET26]

.BG-PR

ÜFZERT,

.Fach

ausschuss

.Elek

trotechnik.

.GS-ET-26—B

ussysteme für die Übertragung

sicherheitsrelevanter Nachrichten.

.Pr

üfgrundsätze,

.Kö

ln,

.Deu

tschland,

.Ger

many,

.2002.

21-16 Industrial Communication Systems

[HOE86]. H.. Hölscher. and. J.. Rader,. Microcomputers in Safety Technique, An Aid to Orientation for

Developer and Manufacturer.

.TÜV.Rh

einland,

.Co

logne,

.Ger

many,

.1986.

[IEC60812]

.Ana

lysis

.tec

hniques

.for.system.reli

ability—Procedure

.for.fail

ure

.mode.and.eec

.ana

lysis

(FMEA)..In

ternational

.Ele

ctrotechnical

.Co

mmission,

.Gen

eva,

.Sw

itzerland,

.2006.

[IEC61025]

.Fau

.tre

.ana

lysis

.(FTA)..Int

ernational

.Elec

trotechnical

.Commi

ssion,

.Gene

va,

.Swi

tzerland,

2006.

[IEC61508]

. Func

tional

. saf

ety

. of. elec

trical/electronic/programmable

. elec

tronic

. saf

ety-related

. system

Int

ernational

.Ele

ctrotechnical

.Co

mmission,

.Gen

eva,

.Sw

itzerland,

.2000.

[Ke

l&04]

.T..Ke

lly

.an

.R..We

aver.

. e.go

.st

ructuring

.no

tation—A

.sa

fety

.ar

gument

.no

tation.

.Co

nference

on Dependable Systems and Networks (DSN).

.Flor

ence,

.It

aly,

.2004.

[KO

O04]

.Ph..Koo

pman

.and.T..Cha

kravarty.

.Cyc

lic

.red

undancy

.code.(CRC).pol

ynomial

.sele

ction

.for.

embe

dded

.netw

orks.

.In.Pro

ceedings of the International Conference on Dependable Systems and

Networks,

.Flor

ence,

.It

aly,

.pp

.145–154,.Jun

.28–Ju

.1,.2004.

[LIG02]

.P..Lig

gesmeyer.

.So

ware Qualität.

.Sp

ektrum

.Akademi

scher

.Ver

lag,

.Heide

lberg,

.Ger

many,

.2002.

[PH

O97]

.Pho

enix

.Con

tact

.(Publi

sher).

.Gru

ndkurs Sensor-Aktor-Feldbustechnik.

.Voge

l-Verlag,

.Würzbur

Germ

any,

.1997.

[REI01]

.D..Reiner

.and.M..Sch

aefer

.(Publi

sher).

.Sic

here Bussysteme in der Automation.

.Hüt

hig

.Verl

ag,

Heidel

berg,

.Ger

many,

.2001,.32.pp

[VDI2184]

. VDI. 2184.. Reli

able

. opera

tion

. and. main

tenance

. of. eld. bus. system

. Verein. Deuts

cher

Ingenieure,.Germany,.2008.

[WRA07]

. P..Wrat

. and. M.. Kiev

iet.

. Sic

herheitstechnik für Komponenten und Systeme.

. Hüt

hig

. Verl

ag,

Heidel

berg,

.Ger

many,

.2007,.150.pp

22-1

22.1 Introduction to Security in Industrial Communication

Modern.industrial.communication.systems.go.far.beyond.small.automated.islands.that.have.been.

in.mind.when.deve

loping

.the.orig

inal

.comm

unication

.prot

ocols.

.Vert

ical

.inte

gration

.and.tran

smis-

sion

.over.the.Inte

rnet

.are.comm

.toda

.but.they.requ

ire

.addi

tional

.secu

rity

.meas

ures

.to.prot

ect

the.asse

ts.

.lite

rature,

.a.mult

itude

.of.secu

rity

.den

itions

.that.are.more.or.less.ambig

uous

.exis

.[R49

,PFL,MEN,

BIS,

I15].

.In.the.cont

ext

.of.indu

strial

.comm

unication,

.secu

rity

.can.be.den

.as.meas

ures

.that.prot

ect

syst

.reso

urces

.agai

nst

.adve

rsaries

.that.inte

ntionally

.try.to.gain.unau

thorized,

.mali

cious

.acce

ss.

. e.

aim.of.such.an.acce

.can.be.mani

fold.

.In.the.eld.of.indu

strial

.comm

unication,

.an.adve

rsary

.may.be.a.

huma

.or.some.piec

.of.mali

cious

.sow

are

.(e.g

.Troj

.hors

.viru

.worm

)

.with.the.inte

ntion

.to.gain.

unau

thorized

.acce

.to.cont

rol

.func

tions,

.i.e.,.func

tions

.that.inte

ract

.with.the.proc

ess

.unde

.cont

rol.

Note.that.this.den

ition

.of.secu

rity

.is.cont

rary

.to.the.den

ition

.of.safe

ty.

.Whil

.secu

rity

.prot

ects

.the.

syst

.agai

nst

.inte

ntional

.acti

ons

.that.may.resu

.in.dama

.to.the.syst

.and.as.a.cons

equence

.may.

also.be.harm

ful

.to.peop

le,

.safe

.meas

ures

.redu

.the.risk.of.unin

tentional

.syst

.stat

.that.do.caus

harm.to.hum

ans.

.actu

.acti

.that.an.adve

rsary

.perf

orms

.to.gain.acce

.to.the.cont

rol

.func

tions

.is.gene

rally

refe

rred

.to.as.a.secu

rity attack.

.A.secu

rity

.atta

.is.only.possi

ble

.if.the.syst

.sue

.vuln

erabilities,

.i.e.,.

aws.and.weak

nesses

.that.may.be.expl

oited.

. e.exis

tence

.of.vuln

erabilities

.lead

.to.secu

rity threats

.that.

can.be.seen.as.the.pote

ntial

.for.viol

ation

.of.secu

rity.

.To.prov

ide

.meas

ures

.that.avoi

.a.viol

ation

.of.the.

syst

em’s

.secu

rity,

.thes

.secu

rity

.thre

ats

.have.to.be.dete

rmined.

.Note.that.a.secu

rity

.atta

.is.die

rent

.to.

Security in Industrial

Communication Systems

22.1. Introduction.to.Security.in.Industrial.Communication...........22-1

22.2

. Plan

ned

.App

roach

.to.Sec

urity:

.Def

ense

.in.Dept

h.....................22-3

22.3

. Secu

rity

.Mea

sures

.to.Cou

nteract

.Net

work

.Att

acks...................22-4

Virtual.Private.Networks. •. Firewalls. •. Cryptography. •. .

DoSPrevention.and.Detection

22.4. Security.Measures.to.Counteract.Device.Attacks......................22-9

Protected.Hardware.and.Security.Token. •. Secure.Soware.

Environments

22.5. State.of.the.Art.in.Automation.Systems.....................................22-12

Security.in.Building.Automation.Systems. •. Security.in.Industrial.

Communication. •. Security.in.IP-Based.Networks. •. Security.

inWireless.Communication.Systems

22.6. Outlook.and.Conclusion..............................................................22-15

Abbreviations.............................................................................................22-15

References...................................................................................................22-16

Wolfgang Granzer

Vienna University

of Tec

hnology

Albert Treytl

Austrian Academy

of Sci

ences

22-2 Industrial Communication Systems

a.security.threat..While.a.security.attack.is.the.actual.action.that.tries.to.violate.the.security.of.a.system,.

a.se

curity

.th

reat

.is.th

.po

tential

.fo

.vi

olation

.of.se

curity

.th

.ma

.ne

ver

.be.ut

ilized

.[R

49].

.to.now

.sec

urity

.has.bee

.neg

lected

.in.the.ind

ustrial

.com

munication

.dom

ain.

.How

ever,

.as.men

tioned

.in.[DZ

U],

.ind

ustrial

.com

munication

.sys

tems

.are.alr

eady

.the.tar

get

.of.sec

urity

.att

acks

.as.rep

orted

inc

idents

.sho

. e.con

sequences

.of.a.suc

cessful

.sec

urity

.att

ack

.on.an.ind

ustrial

.com

munication

.sys

tem

.may.be.man

ifold.

.In.add

ition

.to.a.mal

function

.of.saf

ety

.cri

tical

.ser

vices,

.whi

.are.har

mful

.to.

hum

ans,

.sec

urity

.att

acks

.on.ind

ustrial

.com

munication

.sys

tems

.can.als

.hav

.mas

sive

.eco

nomic

.imp

act.

Con

sider,

.fo

.ex

ample,

.a.po

wer

.pl

ant

.be

ing

.th

.ta

rget

.of.a.se

curity

.at

tack.

Since

.sec

urity

.has.bee

.a.majo

.topi

.in.the.Inf

ormation

.Tec

hnology

.(IT

)

.wor

.for.yea

rs,

.man

.ava

il-

able

.sec

urity

.mec

hanisms

.exi

st.

.How

ever,

.it.is.not.alw

ays

.pos

sible

.to.tri

vially

.map.the

.mec

hanisms

to.the.ind

ustrial

.com

munication

.dom

ain.

. is.is.for.var

ious

.rea

sons.

. e.req

uirements

.reg

arding

.the.

use

.com

munication

.pro

tocol(s)

.may.di

er.

.Ind

ustrial

.com

munication

.sys

tems

.oe

.hav

.rea

l-time

and.saf

ety

.req

uirements

.tha

.can

not

.be.met.by.pro

tocols

.and.the

.ext

ensions

.use

.in.the.IT.wor

ld.

Add

itionally,

.whi

.Int

ernet

.pro

tocol

.(IP

)-based

.net

works

.are.get

ting

.mor

.pop

ular

.in.ind

ustrial

.com

munication

.sys

tems,

.non

-IP-based

.el

dbus

.med

.and.pro

tocols

.are.sti

.use

.at.the.el

.lev

el.

.Sin

mos

.IT.sec

urity

.mec

hanisms

.are.tai

lored

.to.IP.net

works,

.the

.are.of.lim

ited

.use.in.non

-IP-based

.el

busses.

.Fur

thermore,

.in.con

trast

.to.dev

ices

.typ

ically

.fou

.in.the.IT.dom

ain,

.ind

ustrial

.com

munication

sys

tems

.may.con

sist

.of.low

-power

.embe

dded

.dev

ices

.wit

.lim

ited

.sys

tem

.res

ources.

. is.is.esp

ecially

tru

.in.wir

eless

.sen

sor

.net

works.

.Sin

.sec

urity

.mec

hanisms

.are.com

putationally

.int

ensive,

.the

.use.

must.not.exceed.the.available.resources.of.these.embedded.devices.

Industrial

.com

munication

.sys

tems

.are.dis

tributed

.sys

tems

.whe

.the.con

trol

.fun

ctionality

.is.spr

ead

acr

oss

.di

erent

.dev

ices.

.To.int

eract

.wit

.eac

.oth

er,

.the

.dev

ices

.are.int

erconnected

.by.a.com

mon

net

work.

. er

efore,

.an.adv

ersary

.has.two.di

erent

.opp

ortunities

.to.gai

.una

uthorized

.acc

ess

.to.con

trol

fun

ctions:

. e.adv

ersary

.may.try.to.mal

iciously

.int

erfere

.wit

.the.dat

.tha

.is.exc

hanged

.bet

ween

.the.

dev

ices

.(net

work attacks)

.or.the.adv

ersary

.may.dir

ectly

.att

ack

.the.dev

ices

.tha

.imp

lement

.the.con

trol

fun

ctionality

.(de

vice attacks).

Network

.at

tacks

.ca

.be.di

vided

.in

.fo

.cl

asses

.[P

FL]:

•

. Int

erception attacks:

. e. adv

ersary

. tri

. to. gai

. una

uthorized

. acc

ess

. to. con

dential

. dat

exchanged.over.the.network.(e.g.,.network.sning).

•

. Mod

ication attacks:

. e.adv

ersary

.tri

.to.cha

nge

.the.dat

.whi

.it.is.tra

nsmitted

.ove

.the.net

work

.(e

.g.,

.mo

dication

.of.ne

twork

.me

ssages).

•

. Fab

rication attacks:

. e.adv

ersary

.tri

.to.ins

ert

.mal

icious

.dat

.(e.

g.,

.rep

lay

.pre

viously

.sen

.net

work

.me

ssages).

•

. Int

erruption attacks:

. e.adv

ersary

.tri

.to.int

errupt

.the.com

munication

.bet

ween

.dev

ices

.and.

thu

.ma

kes

.da

.un

available

.(e

.g.,

.de

nial-of-service

.(D

oS)

.at

tacks).

Device

.at

tacks,

.on.th

.ot

her

.ha

nd,

.ca

.be.cl

assied

.in

•

. So

ware attacks:

.An.adv

ersary

.may.use.reg

ular

.com

munication

.cha

nnels

.to.exp

loit

.wea

knesses

in.a.de

vice’s

.so

ware.

•

. Phy

sical attacks:

.An.adv

ersary

.may.use.phy

sical

.int

rusion

.or.man

ipulation

.(e.

g.,

.pro

bing

.of.bus.

lin

es,

.re

placement

.of.RO

.ch

ips)

.to.in

terfere

.wi

.a.de

vice.

•

. Sid

e-channel attacks:

.Sid

e-channel

.att

acks

.are.bas

.on.obs

erving

.ext

ernal

.par

ameters

.of.a.dev

ice

suc

.as.cur

rent

.con

sumption

.of.EM.emi

ssions

.tha

.are.mea

surable

.dur

ing

.ope

ration

.to.col

lect

inf

ormation

.ab

out

.it

.in

ternals.

.cou

nteract

.the

.typ

.of.sec

urity

.att

acks,

.di

erent

.sec

urity objectives

.hav

.to.be.gua

ranteed.

Acc

ording

.to.[DZ

U],

.the

.are.int

egrity,

.ava

ilability,

.aut

hentication,

.aut

horization,

.con

dentiality,

.and.

non

-repudiation

.or.tra

ceability,

.whe

reas

.the.rs

.fou

.hav

.a.ver

.hig

.ran

king

.in.ind

ustrial

.com

muni-

cation

.sy

stems.

Security in Industrial Communication Systems 22-3

22.2 Planned approach to Security: Defense in Depth

Security.should.be.a.planned.process.that.comprises.the.complete.system.. e.security policy,.also.called.

secu

rity architecture,

.desc

ribes

.all.secu

rity

.meas

ures

.but.also.all.rele

vant

.orga

nizational

.proc

edures

.and.

the.syst

.envi

ronment

.requ

ired

.to.prot

ect

.a.syst

em.

.It.incl

udes

.the.orga

nization’s

.appr

oach

.to.risk

.a.

form

.stat

ement

.of.rule

.thro

ugh

.whic

.peop

.are.give

.acce

.to.the.orga

nization’s

.asse

ts,

.a.den

ition

of.busi

ness

.and.sec

urity

.goa

ls,

.and.a.des

cription

.of.the.imp

lemented

.sec

urity

.mea

sures.

Security

.is.only.20%.tech

nology

.and.80%.orga

nization

.incl

uding

.pers

onnel,

.proc

ess

.desc

riptions,

.etc..

Rele

vant

.area

.can.be.comp

rehended

.in.the.4.P’s.of.secu

rity:

.Peop

le,

.Poli

cy,

.Proc

esses,

.and.Proc

edures.

 e.set

.and.mai

ntenance

.of.a.sec

urity

.pol

icy

.inc

ludes

.the.fol

lowing

.ste

ps:

. 1..Asse

t and risk analysis

.ident

ifying

.the.valu

.to.be.prot

ected

.(e.g

.info

rmation

.or.hard

ware),

possi

ble

.att

acks,

.and.the.pos

sible

.dam

age

.to.the.sys

tem.

. 2.. rea

t analysis

.is.base

.on.the.risk.anal

ysis

.and.is.assig

ning

.the.impa

.of.dama

ge.

.Wher

eas

.the.

risk.anal

ysis

.is.only.comm

itted

.to.the.iden

tication

.of.risk

.the.thre

.anal

ysis

.is.givi

.a.prio

rity

to.the.impa

.of.risk

.and.assig

.occu

rrence

.prob

abilities

.as.well.as.the.exte

.of.dama

ge.

. e.

resu

lting

.risk.nal

.is.the.prod

uct

.of.caus

.dama

.and.the.prob

ability

.of.the.thre

at.

.In.gene

ral,

for.indu

strial

.comm

unication

.syst

ems,

.a.qual

itative

.risk.asse

ssment

.is.comm

.since.it.is.hard.to.

prec

isely

.det

ermine

.val

ues

.for.dam

age

.and.its.pro

bability.

. 3..Anal

ysis of weaknesses

.trac

king

.vuln

erabilities

.of.the.syst

em.

.In.this.step

.the.syst

.will.be.care

fully

.anal

yzed.

.Base

.on.the.prev

ious

.two.step

.actu

.weak

nesses

.will.be.iden

tied.

.Only.for.

thes

.wea

knesses

.cou

ntermeasures

.mus

.be.desi

gned.

. 4.. Desi

gn and specication of security measures

.deal

ing

.with.the.plan

ning

.and.impl

ementation

.of.

appropriate.countermeasures..Especially.important.in.this.step.is.to.nd.the.trade-o.between.

cons

equences

.of.an.atta

.and.“com

fort.”

.For.exam

ple,

.cons

equences

.coul

.be.a.mone

tary

.loss.

but.also.a.dama

.of.the.imag

.or.an.envi

ronmental

.dama

ge,

.wher

eas

.“com

fort”

.subs

umes

.many.

area

.begi

nning

.from.eci

ent

.data.tran

smission,

.low.inst

allation

.cost

.easy.usab

ility,

.or.soci

acce

ptance.

.Hund

red

.perc

ent

.secu

rity

.is.not.possi

ble.

.Only.an.optim

.with

.this.trad

e-o

.can.

be.foun

.on.the.base.of.a.cert

ain

.appl

ication

.or.appl

ication

.clas

.Anot

her

.impo

rtant

.part.of.this.

phas

.is.the.den

ition

.of.the.syst

.boun

daries

.of.the.secu

rity

.arch

itecture.

.For.exam

ple,

.the.best.

crypto

graphy

.to.prot

ect

.the.tran

smission

.chan

nel

.is.usel

ess,

.if.the.pass

word

.requ

ires

.bein

.so.

comp

lex

.tha

.all.use

.mai

ntain

.a.pap

.cop

.of.the.pas

sword

.ben

eath

.the

.key

board.

.general.procedure.to.design.a.security.policy.is.a.continuous.process.throughout.the.life.time.

of.a.syst

em.

.In.part

icular,

.a.good.secu

rity

.poli

.is.acti

.and.not.only.reac

tive

.in.the.sens

.that.it.fore

sees

.inci

dents

.and.avoi

.bein

.a.pure.reac

tion

.on.atta

cks.

.Adver

saries

.are.favo

red;

.they.can.conc

en-

trate

.on.cert

ain

.vuln

erabilities

.and.do.not.have.to.prote

.the.whol

.syst

em.

.To.all.thes

.proce

dures,

the.princ

iple

.of.Kerck

ho

.shou

.be.appl

ied

.dema

nding

.that.the.comp

lete

.cryp

tographic

.algo

rithm

must.be.publ

.and.the.secu

rity

.shou

.only.rely.on.the.secr

ecy

.of.the.keys.[KER

.No.secu

rity

.by.

obsc

urity.

.Allo

wing

.algo

rithms

.and.proce

dures

.to.be.open.allo

.wide.sprea

.secu

rity

.anal

ysis,

.and.

ther

efore

.redu

ces

.the.risk.of.undi

scovered

.secu

rity

.hole

.Addit

ionally,

.this.princ

iple

.also.redu

ces

.the.

risk.of.insi

der

.atta

cks

.sinc

.the.know

ledge

.of.the.syst

.stru

cture

.oer

.no.adva

ntages

.unle

.the.

prope

.keys.are.know

For

.indu

strial

.auto

mation

.syst

ems

.a.“def

ense-in-depth”

.conc

ept

.is.the.favo

rable

.appr

oach

.to.prot

ect

syst

ems

.sin

.man

.ind

ustrial

.com

munication

.sys

tems

.are.alr

eady

.str

uctured

.in.a.hie

rarchical

.way.fol

lowing

.the.comp

uter-integrated

.manu

facturing

.(CIM

)

.mode

.phil

osophy

.and.also.foll

owing

.the.need.

to.stru

cture

.the.netw

ork.

.Defe

nse

.in.dept

.reli

.on.die

rent

.secu

rity

.laye

.to.prot

ect

.valu

able

.asse

ts:

Usin

.the.famo

.onio

.anal

ogon,

.we.see.that.remo

ving

.the.outm

ost

.(sec

urity)

.laye

.reve

als

.anot

her

layer.and.many.more.remain.to.be.peeled.away.before.the.assets.become.vulnerable..In.the.physical.

worl

.such.a.proc

edure

.is.natu

ral

.(als

.in.indu

strial

.auto

mation)

.havi

.a.fenc

.arou

.the.fact

ory

.area