Wilamowski B.M., Irwin J.D. The Industrial Electronics Handbook. Second Edition: Industrial Communication Systems

Подождите немного. Документ загружается.

Prosafe 46-5

(Virtual)

consecutive

number

Remedy:

Error type:

Repetition

Deletion

Insertion

Resequencing

Data corruption

Delay

Masquerade (standard

message mimics failsafe)

Revolving memory

failures within switches

Time out

with receipt

Code name for

sender and

receiver

Data

consistency

check

FIGURE 46.5 Error.types.and.safeguards..(Adapted.from.Specication.PROFIsafe—Prole.for.safety.technology,.

Version.1.30,.June.2004,.Order.No:.3.092,.PROFIBUS.International.)

Receive pointer

Send pointer

FIGURE 46.6 Possible.queuing.problems.in.switches..(Adapted.from.Specication.PROFIsafe—Prole.for.safety.

technology,.Version.1.30,.June.2004,.Order.No:.3.092,.PROFIBUS.International.)

F-PLC

Device

F-Device

Cyclic communication Acyclic communication

FIGURE 46.7 Prosafe.cyclic/acyclic.communication..(Adapted.from.Stripf,.W..and.Barthel,.H.,.Comprehensive.

safety.with.PROFIBUS.DP.and.PROFINET.IO—Training.for.“PROFIsafe.certied.designers.”)

46-6 Industrial Communication Systems

standard.tasks.may.also.be.assigned.to.different.controllers.and.networks.as.shown.in.Figure.46.8..

Any.so-called.acyclic.communications.between.devices.and.controllers.or.supervisors.such.as.program-

ming

.devices.are.intended.for.conguration,.parameterization,.diagnosis,.and.maintenance.purposes.

46.2.4 Cyclic Communication PDU

 e.PDU.(protocol.data.unit).structure.of.the.Probus.I/O.data.exchange.message.is.exactly.the.same.

whether.or.not.there.is.any.safety.data.in.the.message.. is.structure.has.separate.data.areas.assigned.

to.each.module.in.a.modular.slave.device,.facilitating.the.intermixing.of.safety.and.standard.modules.

as.shown.in.Figure.46.9,.where.the.safety.modules.map.onto.the.Prosafe.data.areas.in.the.PDU..Data.

associated.with.a.safety.module.are.contained.within.an.area.of.the.PDU.assigned.only.to.that.safety.

module.and.aects.no.other.data.areas.

.has.been.illustrated.here,.standard.and.safety.devices.may.be.intermixed.on.the.same.network.and.

standard.and.safety.modules.may.be.intermixed.within.the.same.modular.slave.device.. e.only.change.

required.within.the.standard.I/O.data.exchange.PDU.structure.was.to.include.error-detection.informa-

tion

.within.the.data.area.associated.with.a.safety.module..No.changes.were.made.to.the.data.areas.of.

standard.modules.. is.isolated.area.of.change.allowed.the.same.implementations.of.Prosafe.across.

Probus-DP,.Probus-PA,.and.Pronet.(Figure.46.10).

.detailed.structure.of.the.safety.data.and.how.it.aects.the.desired.error-detection.solutions.will.

be.described.in.the.following.sections.. e.data.structure.supports.the.checks.required.to.detect.all.the.

error.types.listed.in.Figure.46.5..Figure.46.11.shows.the.general.format.of.the.safety.data.while.Figures.

46.12.and.46.13,.respectively,.show.the.details.of.the.control.byte.sent.in.the.safety.data.from.the.control-

ler

.and.the.status.byte.in.the.safety.data.returned.from.the.device/module.

.mechanisms.used.for.error.detection,.i.e.,.consecutive.numbering,.timeout.with.receipt,.code.

name.for.sender/receiver,.and.data.consistency.check.(cyclic.redundancy.check,.CRC),.will.be.briey.

discussed.in.the.following.sections.

Safety PLC Standard PLC

DP-DP coupler

FIGURE 46.8 Split.assignment.of.safety.and.standard.tasks.

Head

module

Data

Safety

module

Safety

data

Safety

data

Safety

data

Safety

data

Normal

data

Normal

data

Normal

data

Safety

module

Safety

module

Safety

module

Normal

module

Normal

module

Normal

module

FIGURE 46.9 Intermixed.standard.and.safety.I/O.modules.

Prosafe 46-7

46.2.5 Virtual Consecutive Number

Only.the.V2-mode.(virtual).consecutive.number.will.be.described.here..For.a.description.of.the.V1-mode,.

see.[9].. e.consecutive.numbering.uses.a.range.that.is.big.enough.to.detect.any.error.caused.by.message.

storing.network.elements,.e.g.,.switches.for.Pronet,.links.or.repeaters.for.Probus.. e.receiver.uses.

the.consecutive.number.to.monitor.whether.the.sender.and.the.communication.channel.are.still.alive..

PN IO/

Link

RS485

Actuator

PA device

Intrinsic safety

(Ex-i)

MBP-IS

With barriers: RS485-IS

e.g., for high speed ESD valves

PN IO

F-host

F-

Device

controller

Local bus

Remote I/O

PROFINET IO transmission

Data transmission for explosion-proof areas

High speed data transmission

Fail-safe digital input

Fail-safe digital output

Fail-safe analog input

Device according process automation device model (IEC 61804)

PA device model acc.

IEC 61804:

- Physical block

- Function block(s)

- Transducer block

PN IO

MBP-IS

RS485

F-DI

F-DO

F-AI

PA Device

DP-PA

Link

FIGURE 46.10 Prosafe.is.protocol-independent.. (Adapted.from.Stripf,. W..and.Barthel,. H.,. Comprehensive.

safety.with.PROFIBUS.DP.and.PROFINET.IO—Training.for.“PROFIsafe.certied.designers.”)

Normal

I/O data

Normal

I/O data

Normal

I/O data

F-input/output data

Control/status

byte

CRC2

Maximum 12/123 octets 1 octet 3/4 octets

Normal

I/O data

Normal

I/O data

Safety

I/O data

FIGURE 46.11 General.safety.data.format.

46-8 Industrial Communication Systems

 econsecutive.number.is.used.in.an.acknowledgment.mechanism.for.monitoring.the.propagation.

times.between.sender.and.receiver.. e.value.“0”.is.reserved.for.the.rst.run.and.for.a.communication.

error.reaction.. e.V2-mode.uses.24.bit.counters.for.consecutive.numbering,.counting.in.a.cyclic.mode.

from.1…0.× FFFFFF.and.wrapping.over.back.to.1.at.the.end..Using.the.consecutive.number,.a.receiver.

can.see.whether.or.not.it.received.the.messages.completely.and.within.the.correct.sequence..When.it.

returns.a.message.with.the.consecutive.number.as.an.acknowledgment.to.the.sender,.the.sender.will.be.

assured.of.the.same..In.V2-mode,.the.24.bit.consecutive.number.is.not.actually.transmitted.in.the.safety.

data..A.toggle.bit.is.implemented.as.an.“increment.counter.command/counter.incremented.response”.

handshake.between.the.controller.and.the.device,.as.shown.in.Figure.46.14.

.consecutive.number.is.not.actually.transmitted.in.the.safety.data.but,.aer.being.incremented,.is.

used.in.calculating.the.CRC2.as.shown.in.Figure.46.15.. us,.reception.of.safety.data.with.an.appropri-

ate

.toggle.bit.state.and.a.valid.CRC2.indicates.the.message.is.in.the.proper.sequence.

Fail-safe

values (FV)

to be

activated

Use

F_WD_Time_2

(Redundancy)

Reset

Vconsnr_d

Operator

acknowledge

requested

iParameter

assignment

deblocked

Bit0Bit1Bit2Bit3Bit4Bit5Bit6Bit7

Toggle bit

Toggle_h Toggle_FV Use_TO2 R_cons_nr OA_Req iPar_EN

resres

– –

FIGURE 46.12 Control.byte.sent.to.device/module.

Bit7 Bit6 Bit5 Bit4 Bit3 Bit2 Bit0Bit1

Device_FaultCE_CRCWD_TimeoutFV_ActivatedToggle_dcons_nr_R–

F-Device has

new iParameter

values assigned

Failure exists

in F-Device or

F-Module

Communi-

cation fault:

CRC

Communi-

cation fault:

WD_Timeout

Fail-safe

values (FV)

activated

Toggle BitVconsnr_d

has been

reset

res

iPar_OK

FIGURE 46.13 Status.byte.returned.from.device/module.

F-Host consecutive no.

(Vconsnr_h)

0 1 2 3 4

43210

Toggle_h

(from F-Host)

Toggle_d

(from F-Device)

F-Device consecutive no.

(Vconsnr_d)

FIGURE 46.14 Toggle.bit.functionality..(Adapted.from.Stripf,.W..and.Barthel,.H.,.Comprehensive.safety.with.

PROFIBUS.DP.and.PROFINET.IO—Training.for.“PROFIsafe.certied.designers.”)

Prosafe 46-9

46.2.6 time-Out with receipt

In.safety.technology,.it.not.only.matters.that.a.message.transfers.the.correct.process.signals.or.val-

ues.

.Additionally,.the.updated.actual.values.must.arrive.within.a.fault.tolerance.time..Recognition.

of.a.timeout.enables.the.respective.F-Device.to.automatically.initiate.any.necessary.safety.reac-

tions,

.for.example,.stopping.a.motor..For.monitoring.the.time,.the.F-Devices.use.a.watchdog.timer.

that. is. restarted. whenever. new. Profisafe. messages. with. incremented. consecutive. numbers. are.

received.

46.2.7 Code Name for Sender/receiver

 e.1:1.relationship.between.the.F-Host.and.a.F-Device.facilitates.the.detection.of.misdirected.message.

frames,.e.g.,.an.inserted.or.masquerading.message.. e.sender.and.receiver.must.have.an.identication.

scheme.(code.name).that.is.unique.in.the.network.that.can.be.used.for.verifying.the.authenticity.of.a.

Prosafe.message..Prosafe.uses.an.“F-Address”.as.a.code.name..CRC1.is.constructed.from.this.code.

name,.the.assigned.SIL,.and.the.watchdog.time.as.shown.in.Figure.46.16.

46.2.8 Data Consistency Check

Once.the.F-Parameters.(code.name,.SIL,.watchdog.time).have.been.transferred.to.the.F-Device,.these.

identical.parameters.are.utilized.in.identical.calculations.in.both.the.F-Host.and.in.the.F-Device/

F-Module

.for.producing.a.2-octet.CRC1.. is.CRC1.signature.provides.the.initial.value.for.CRC2..

Subsequently,.this.CRC1,.the.F.I/O.data,.the.status.or.control.byte,.and.the.corresponding.consecu-

tive

.number.(host.or.device).are.used.for.producing.another.CRC2.signature.within.the.F-Host.as.

shown.in.Figure.46.17..In.the.F-Device,.the.identical.CRC.signature.is.generated.and.the.signatures.

are.compared.

Synchronization Via “toggle” bit

F-input data

Status byte

CRC2

1 Octet

Vconsnr_d

24 bit consecutive no.

Include

Vconsnr_d

in CRC2

calculation

CRC signature

3 Octets for ≤

4 Octets for >

12 Octets input data

Change Toggle_d

0 1 or 1 0 when

incremented

(F-Device)

Consecutive

number

(not transmitted)

Status byte,

0,1 ... 0 × FFFFFF

3/4 Octets

Reset

Increment

Toggle_h

(Bit 5 of

Control byte)

R_cons_nr

(Bit 5 of

Control byte)

Across

F_Parameter,

F-Input data,

Status byte,

Voncsnr_h

Maximum 12/123 Octets

FIGURE 46.15 F-Device.(virtual).consecutive.number..(Adapted.from.Stripf,.W..and.Barthel,.H.,.Comprehensive.

safety.with.PROFIBUS.DP.and.PROFINET.IO—Training.for.“PROFIsafe.certied.designers.”)

46-10 Industrial Communication Systems

46.2.9 Detected Safety Data Failures

 e.ultimate.purpose.of.Prosafe.is.to.prevent.a.system.failure.caused.by.an.undetected.communication.

error..In.order.to.determine.when.the.system.may.be.in.a.state.in.which.there.is.an.increasing.probability.

of.a.communication.error.going.undetected,.an.SIL.monitor.is.implemented.in.the.F-Host..Every.cor-

rupted

.message.(CRC2.or.virtual.consecutive.number.fault).detected.by.the.F-Host.or.F-Device.will.be.

counted.during.a.congurable.SIL.monitor.time.period.(T).. e.SIL.monitor.time.period.depends.upon.

the.SIL.value.of.the.system.and.the.CRC2.length,.which.depends.upon.the.amount.of.safety.data.being.

transferred..If.12.or.fewer.bytes.of.safety.data.are.being.transferred,.a.3-octet.(24.bit).CRC2.is.used,.

F-Parameters:

Dened and constant

Identical in F-Host and F-Device

Codename

SIL

WD_Time

Build

CRC1

2 Octets

Initial

value for

CRC2

FIGURE 46.16 CRC1.generation:.F-Host.and.F-Device..(Adapted.from.Stripf,.W..and.Barthel,.H.,.Comprehensive.

safety.with.PROFIBUS.DP.and.PROFINET.IO—Training.for.“PROFIsafe.certied.designers.”)

F-Output dataVconsnr_hCRC1

Consecutive

number

(F-Host)

Consecutive

number

(not trans-

mitted)

0,1...0 × FFFFF

Control byte

1 octet3 octets2 octets

Toggle bit

CRC2

3 or 4 octets

Across

F-Parameter,

F-Output data,

Control byte,

and Vconsnr_h

Max. 12 or 123 octets

CRC2

generation

FIGURE 46.17 CRC2.generation:.F-Host.and.F-Device..(Adapted.from.Stripf,.W..and.Barthel,.H.,.Comprehensive.

safety.with.PROFIBUS.DP.and.PROFINET.IO—Training.for.“PROFIsafe.certied.designers.”)

Prosafe 46-11

while.a.4-octet.(32.bit).CRC2.is.used.for.13–123.bytes.. e.monitor.will.cause.the.fail-safe.values.to.be.

set.when

ever

.more.than.one.such.faul

.is.dete

cted,

.i.e.,.one.dete

cted

.corr

upted

.mess

age

.can.be.toler

ated.

A.seco

.corr

upted

.mess

age

.dete

cted

.with

.time.T.indi

cates

.a.seri

ous

.caus

.e.g.,.exce

ssive

.EMI,.hard

ware

.fai

lures,

.etc

.tha

.req

uires

.imm

ediate

.att

ention.

46.3 Deployment

Prosafe.would.not.be.complete.if.there.were.only.a.specication.of.the.safety.communication.protocol..

For.F-D

evices

.que

stions

.wou

.be.rai

sed

.abo

.vol

tage

.pro

tection,

.ins

tallation

.rul

es,

.and.sec

urity.

46.3.1 Power Supplies and Electrical Safety

 e.eldbus.standards.IEC.61158.and.IEC.61784-1,.IEC.61784-2.require.all.devices.within.the.network.

to.comp

.with.the.lega

.requ

irements

.of.that.coun

try

.wher

.they.are.depl

oyed.

. ese.meas

ures

.are.

call

.PELV.(pro

tected

.extr

a-low

.volt

age)

.and.limi

.the.perm

itted

.volt

ages

.in.case.of.one.fail

ure

.to.

rang

.that.are.not.dang

erous

.for.huma

ns.

.Due.to.this.norm

ally

.lega

.requ

irement,

.it.is.possi

ble

.to.limi

the.prot

ection

.eor

.with

.an.F-De

vice

.or.an.F-Ho

st.

.It.is.also.possi

ble

.to.use.the.same.24.V.powe

.sup-

lies

.for.stan

dard

.and.F-De

vices/F-Hosts.

.In.both.case

.the.powe

.supp

lies

.shal

.prov

ide

.PELV.due.to.

lega

.req

uirements.

46.3.2 Increased Immunity

For.each.safety.application,.the.corresponding.SRS.(safety.requirements.specication).shall.dene.elec-

tromagnetic

.immu

nity

.limi

.(see.IEC.6100

0-1-1

.[10]

)

.whic

.are.requ

ired

.to.achi

eve

.elec

tromagnetic

comp

atibility.

. ese.limi

.shou

.be.deri

ved

.taki

.into.acco

unt

.both.the.elec

tromagnetic

.phen

omena

(see.IEC.6100

0-2-5

.[11]

)

.and.the.requ

ired

.safe

.inte

grity

.leve

ls.

.For.gene

ral

.indu

strial

.appl

ications,

.the.

IEC.6132

6-3-1

.[12].den

.immu

nity

.requ

irements

.for.equi

pment

.perf

orming

.or.inte

nded

.to.perf

orm

safe

ty-related

.fun

ctions.

46.3.3 Installation Guidelines

It.is.the.goal.of.Prosafe.to.integrate.safety.communication.into.the.standard.Probus.and.Pronet.

netw

orks

.with.mini

mal

.impa

.on.the.exis

ting

.inst

allation

.guid

elines.

.All.F-De

vices

.shal

.be.cert

ied

acco

rding

.to.IEC.6150

.and.in.the.case.of.proc

ess

.autom

ation

.acco

rding

.to.IEC.6151

.[13]

. ey.shal

be.test

.and.appr

oved

.for.Pro

safe

.conf

ormity

.by.PI.(Pro

bus

.Inte

rnational)

.Test.Labo

ratories.

.All.

othe

.stan

dard

.devi

ces

.with

.a.Pro

safe

.netw

ork

.shal

.prov

.conf

ormity

.to.Pro

bus

.or.Pro

net

.via.a.PI.

cert

icate

.or.equi

valent

.evid

ence.

.For.Pro

bus,

.no.spur

.or.bran

.line

.are.perm

itted.

.For.Pro

net

.less.

than.100.swit

ches

.in.a.row,.only.one.F-Ho

.per.sub.modu

.and.no.singl

e-port

.rout

ers

.are.perm

itted

.to.

sepa

rate

.Pro

safe

.isl

ands

.(ch

aracterized

.by.uni

que

.F-A

ddresses).

Probus

.and.Pro

net

.both.spec

ify

.the.use.of.shie

lded

.cabl

.and.doub

le-sided

.conn

ection

.of.the.

shie

.with.the.conn

ector

.housi

.for.best.elec

tromagnetic

.immu

nity.

.As.a.cons

equence,

.equi

potential

bond

ing

.is.usua

lly

.requ

ired.

.If.this.is.not.possi

ble,

.ber.optic

.may.be.used

.Even.with.shie

lded

.cabl

es,

unac

ceptable

.signa

.nois

.may.be.intr

oduced

.onto.the.data.line

.of.a.devi

.if,.for.exam

ple,

.the.inte

rme-

diate

.DC.link.of.a.freq

uency

.inve

rter

.is.not.lte

ring

.well.enou

gh.

.Othe

.sour

ces

.of.unac

ceptable

.signa

qual

ity

.may.be.due.to.missi

.term

inating

.resis

tors

.and.the.like

. is.is.not.a.safe

.issu

.but.an.avai

ability

.issu

.Suc

ient

.avai

lability

.of.the.cont

rol

.func

tions

.is.a.prec

ondition

.of.safe

ty.

.Safe

.func

tions

on.equi

pment

.with.insu

cient

.avai

lability

.may.caus

.nuis

ance

.trip

.and.as.a.cons

equence

.may.tempt.

prod

uction

.man

agers

.to.eve

ntually

.rem

ove

.the

.saf

ety

.fun

ctions

.(“Bh

opal

.ee

ct”).

Prosafe

.has.been.the.enab

ling

.tech

nology

.for.many.safe

.devi

ces,

.espe

cially

.for.driv

.with.inte

grated

.safe

ty.

.Nowa

days

.driv

.can.prov

ide

.safe.stat

.with

out

.deen

ergizing

.the.motor

.For.exam

ple,

.the.

46-12 Industrial Communication Systems

new.safety.feature.“SOS”.(Safe.Operating.Stop).holds.the.motor.under.closed.loop.control.in.a.certain.

position.. is.new.possibility.requires.a.paradigm.shi.for.the.user..In.earlier.times,.pushing.an.emer-

gency

.stop.button.caused.the.power.lines.to.be.physically.disconnected.from.the.motor.and,.therefore,.

there.was.no.electrical.danger.for.a.person.exchanging.the.motor.

.new.IEC.60204-1.[14].provides.concepts.on.how.to.protect.against.electrical.shock.(emergency.

switch-o).with.lockable.motor.protection.circuit.breakers,.main.circuit.breakers,.and.main.isolators.

with.fuses..Figure.46.18.demonstrates.these.concepts..It.also.shows.the.recommended.5-wire.power.

line.connections.(TN-S).with.separated.N.and.PE.lines.and.the.shielded.cables.between.drives.and.

motors.. e.IEC.60204-1.is.a.valuable.source.for.many.other.safety.issues.complementing.the.Prosafe.

technology.

46.3.4 Wireless transmission and Security

More. and. more. applications. such. as. AGV. (automated. guided. vehicles),. rotating. machines,. gantry.

robots,.and.teach.panels.use.wireless.transmission.in.Probus.and.Pronet.networks..Prosafe,.with.its.

error-detection.mechanism.for.bit.error.probabilities.up.to.10

−2

,.is.approved.for.both.“Black.Channels.”.

However,. the. security. issues. below.must. be. considered. in. addition.. With. Pronet. being. based. on.

Industrial.Ethernet.as.an.open.network.and.in.the.context.of.wireless.transmission,.the.issue.of.security.

has.been.raised.

.published.[15].the.concept.of.building.so-called.security.zones.which.can.be.considered.to.be.

closed.networks.(Figure.46.19).. e.only.possibility.to.cross.open.networks.such.as.Industrial.Ethernet.

Backbones.from.one.security.zone.to.another.is.via.security.gates.. e.security.gates.use.generally.

accepted.mechanisms.such.as.VPN.(virtual.private.network).and.Firewalls.to.protect.themselves.from.

intrusion..Prosafe.networks.always.shall.be.located.inside.security.zones.and.protected.by.security.

gates.if.connections.to.open.networks.cannot.be.avoided..For.wireless.transmission,.the.IEEE.802.11i.

standard.provides.sucient.security.measures.for.Prosafe.networks..Only.the.infrastructure.mode.is.

permitted;.the.ad.hoc.mode.shall.not.be.used.

Main rack

Power

supply

Subrack

–

Remote IO

(Safety)

Shielding

Central

earth

ground

Motor protection circuit breaker, lockable

Main circuit breaker, lockable

Main isolator (with fuses), lockable

24 V

“Emergency stop”

Equipotential bonding

FIGURE 46.18 Emergency.switching.o.concept.

Prosafe 46-13

Internet

Firewall

VPN

Security gate

PROFIsafe Island

Firewall

Security gate

Production PC

with security VPN

Client software

VPN

Security zone

PROFINET IO

PROFIBUS DP

Service PC

with security VPN

Client software

Industrial ethernet backbone

FIGURE 46.19 Security.concept.for.“closed”.and.“open”.networks.

Actuation

Worst case

delay time (input)

Input

delay

Device_WD

F_WD_Time 1

F-Host_WD

F_WD_Time 2

Total worst case delay time = TWCDT

Safety function response time (TWCDT + ΔT of the longest “Watchdog Time”)

Device_WD

Longest

ΔT_WD

Bus

delay

Bus

delay

Processing

delay

Output

delay

Safe state

Fixed

Processing duration

denes

minimum

time triggered

scan rate

Fixed

Worst case

delay time (bus)

Worst case

delay time (bus)

Worst case

delay time (process.)

Worst case

delay time (output)

FIGURE 46.20 Safety.function.response.time.(SFRT).

46-14 Industrial Communication Systems

46.3.5 response time

Usually.the.response.times.of.normal.control.functions.are.fast.enough.for.safety.functions.as.well..

How

ever,

.som

.tim

e-critical

.saf

ety

.app

lications

.nee

.SFR

.(sa

fety

.fun

ction

.res

ponse

.tim

es)

.to.be.con

sidered

.mor

.tho

roughly.

.Pre

sses

.tha

.are.pro

tected

.by.lig

.cur

tains

.are.exa

mples.

.A.mac

hine

.desi

gner

wan

.to.kno

.ver

.ear

.at.wha

.min

imum

.dis

tance

.the.lig

.cur

tain

.sha

.be.mou

nted

.awa

.fro

.the.

haz

ardous

.pre

ss.

.It.is.com

mon

.agr

eement

.tha

.a.han

.mov

.at.a.max

imum

.of.2.m/s

. e.min

imum

dis

tance

.d.to.be.con

sidered

.the

.is.d.=.2.m/s.×.SFR

.if.the.res

olution

.of.the.lig

.cur

tain

.is.hig

.eno

ugh

to.de

tect

.a.sin

gle

.n

ger

.(E

.99

.[1

6]).

.Ot

herwise

.co

rrection

.su

mmands

.ar

.ne

eded.

.mod

.in.Fig

ure

.46.

.is.use

.to.exp

lain

.the.de

nition.

. e.mod

.con

sists

.of.an.inp

.F-D

evice,

a.Pro

safe

.bus.tra

nsmission,

.sign

.pro

cessing

.in.an.F-H

ost,

.ano

ther

.Pro

safe

.bus.tra

nsmission,

.and.

an.out

put

.F-D

evice

.eac

.wit

.its.own.sta

tistical

.cyc

.tim

. e.max

imum

.tim

.for.a.saf

ety

.sign

.to.

pas

.thr

ough

.thi

.cha

.is.cal

led

.TWC

.(tot

.wor

st-case

.del

.tim

.con

sidering

.tha

.all.par

.req

uire

the

.par

ticular

.max

imum

.cyc

.tim

es.

.In.cas

.of.saf

ety

.the.con

siderations

.go.eve

.fur

ther:

. e.sign

cou

.be.del

ayed

.eve

.mor

.if.one.of.the.par

.jus

.fai

.at.tha

.poi

.in.tim

. us

.a.del

.tim

.nee

.to.

be.add

.for.tha

.par

ticular

.par

.whi

.rep

resents

.the.max

imum

.di

erence

.bet

ween

.its.wat

chdog

.tim

and.its.wor

st-case

.del

.tim

.(th

ere

.is.no.nee

.to.con

sider

.mor

.tha

.one.fai

lure

.at.one.tim

e).

.Eve

ntually,

TWC

.pl

.th

.de

lta

.ti

.co

mprise

.th

.SF

RT.

Each

.and.eve

.F-D

evice

.sha

.pro

vide

.inf

ormation

.abo

.its.wor

st-case

.del

.tim

.as.req

uired

.in.the.

Pro

safe

.sp

ecication

.in.or

der

.fo

.th

.en

gineering

.too

.to.es

timate

.th

.SF

RTs.

acronyms

AGV. Automated.guided.vehicle

COTS

. Com

mercial,

.o

-the-shelf

CRC

. Cyc

lic

.re

dundancy

.ch

eck

IEC

. Int

ernational

.El

ectrotechnical

.Co

mmission

ISO

. Int

ernational

.Or

ganization

.fo

.Sta

ndardization

I/O

. Inp

ut/output

PDU

. Pro

tocol

.da

.un

PELV

. Pro

tected

.ex

tra-low

.vo

ltage

. Pro

bus

.In

ternational

. Per

formance

.le

vel

PLC

. Pro

grammable

.lo

gic

.co

ntroller

SIL

. Saf

ety

.in

tegrity

.le

vel

SFRT

. Saf

ety

.fu

nction

.re

sponse

.ti

SOS

. Saf

.Op

erating

.Stop

. Saf

ety

.re

quirements

.sp

ecication

TWCDT

. Tot

.wo

rst-case

.de

lay

.ti

VPN

. Vir

tual

.pr

ivate

.ne

twork

references

. 1.. PROFIsafe—Safety.technology.for.PROFIBUS.and.PROFINET—System.description,.PROFIBUS.

Nutzer

organisation

.e.V

.PN

.2007.

. 2.. IEC.615

08,

.Func

tional

.saf

ety

.of.ele

ctrical/electronic/programmable

.ele

ctronic

.saf

ety-related

sys

tems—All

.par

ts.

. 3.. EN.501

59-1,

.IEC.622

80-1,

.Rai

lway

.app

lications—Communication,

.sig

nalling

.and.pro

cessing

sys

tems—Part

.1:.Saf

ety-related

.com

munication

.in.clo

sed

.tra

nsmission

.sys

tems.

. 4.. IEC.61158,.In

dustrial

.comm

unication

.net

works—Fieldbus

.sp

ecications—All

.pa

rts.