PRINCIPLES OF SAFETY BUS SYSTEMS PART II. Börcsök J 1,2,Ugljesa E. 2, Holub P. 1,2

Transcription

1 PRINCIPLES OF SAFETY BUS SYSTEMS PART II Börcsök J 1,2,Ugljsa E. 2, Holub P. 1,2 HIMA GmbH+CoKG, Brühl, Grmany 1 Univrsity of Kassl, Computr architctur & Systm programming, Grmany 2 Abstract: This papr is th scond part of principls of safty bus systms. In th first part th rquirmnts and spcifications wr dtaild to b considrd and fulfilld to dsign safty bus systms. Th scond part introducs data intgrity in mor dtail and compars mathmatically diffrnt architcturs of safty-bus-systms. Copyright 2006 USTARTH Kywords: Protocol, Safty, Safty-bus, Functional-safty, Data intgrity, Markov modl 1 INTRODUCTION Part I and part II of th papr principls of safty bus systms giv a dtaild ovrviw of th rquirmnts and spcifications for th dsign and implmntations of safty bus systms following th standard of IEC Whilst th first part givs a mor practical ovrviw of th dsign and aspcts to b considrd, th scond part xplains in mor dtail data intgrity and valuats mathmatically diffrnt architcturs of safty bus systms, introducd in part I. 2 DATA INTEGRITY For th qualitativ stimation from safty rlvant procdurs of th data in th following th standard IEC is applid (IEC/EN 61508). Although this standard maks nithr qualitativ nor quantitativ prrquisits for th valuation of transmission rrors, it is applicabl bcaus of th rquirmnt to th probability of failur by th hardwar. In a safty-rlatd controllr a random hardwar fault lads finally to a random failur, which can b transmittd also to a transmission rror. [(Börcsök, J.,2004), (Börcsök, J.,2004a), (Börcsök, J.,2003)] If on rgards transmission rrors similar to th random hardwar faults, th probabilitis of failurs on dmandd in th IEC can b applid to th transmission rrors as shown in Tabl 1. A comparison of diffrnt dfinitions of th Safty Intgrity Lvl ar prsntd in Tabl 3. Tabl1 Dfinition of Safty Intgrity Lvl According to IEC SIL Low dmand mod of opration (Avrag probability of failur to prform its dsign function on dmand) to < to < to < to < to < to < to < to < 10-5 or continuous mod of opration (Probability of a dangrous failur pr hour) Tabl 2: Ovrviw about th rquirmnts of procss to bus systms Application / Opration mod Raction tim Typical amount of data Exampl Low dmand mod 150 ms 1 Byt Safty off Snsor/Actuator mod mod Low dmand mod offlin mod offlin 150 ms ms As long as ndd Tolranc tim of th procss 100 ms 1 Byt 1 Byt som mgabyt som kilobyt Admittanc Lasr scannr Fingr Light barrirs Softwar updat Switching of aras of lasr scannrs within th raction tim Not: Th xact tims ar to b dtrmind by an application dpndnt risk valuation with considration of th appropriat standards.

2 Th rquirmnts indicatd in Part I of th papr Safty bus systms rquir among othr things for a univrsal safty systm that th mod of opration in continuous or high dmand mod. Tabl 1 and Tabl 2 show th valus for this mod of opration according th IEC [ (Börcsök, J.,2004), (Börcsök, J.,2004a), (IEC/EN 61508)] As alrady mntiond in th first part, th IEC rgards th probability of failur of th complt hardwar / systm according to a quantitativ modl. A similar modl has now to b st up for transmission rrors, so that th probability of a dangrous fault of th systm can b calculatd. Mthods for bus systms ar partially vry complx, so that som prrquisits ar mad, which guarant that a bus systm supplis only a contribution of 1 % to th failur of th safty function. Dviating from this 1 % is possibl, sinc it concrns only an approximat valu hr. Such dviating is possibl, if a complt quantification of a controllr is possibl including transmission systm. Th qualitativ masurs for fault control from on of th prvious sctions contribut to th dcras of th probability of failur. (Börcsök, J.,2004) Using th appropriat bus architctur and th data mchanisms approach turnd out to b a good for quantification. In th following as a function of th bus architctur, diffrnt mthods for calculation ar dscribd, which hav th failur rat (lambda) as initial valu. Th failur rat is th numbr of th safty rlvant transmission rrors pr hour. All modls us th approach of Gauss, which is concrnd with normal distributd probabilitis of bit rror and whit nois. During th transmission of information th probability, that a bit is falsifid, is normal distributd, which is gnrally calld bit rror probability p. (Börcsök, J.,2004a) Th approach with longr mssags is to b rgardd as worst cas. Tabl 4 shows xampls of th bit rror probability p. It will b shown that p influncs failur rat of th bus systm strongly. Without proof th calculation has to b basd on th worst valu p Tabl 3: Dfinition of th Safty Intgrity Lvl of IEC Catgory (EN 954-1) Rquirmnt class (DIN V 19250) SIL (IEC 61508) Dscription Control Systms according th B stat of th art/provn in us 2 2 / 3 1 Tst Singl fault dtction tolranc with partial fault 4 5 / 6 3 Slf monitoring / 8 4 Not rlvant for machin Tabl 4: Exampls of probabilitis of bit failurs dpnding of th transmission mdium Probability of bit Transmission mdium failurs p > 10-3 Transmission path 10-4 Unscrnd data lin 10-5 Scrnd twistd-pair tlphon circuit Digital tlphon circuit (ISDN) 10-9 Coaxial cabl in local dfind application Fibr optic cabl First a mssag with only on bit is rgardd with safty-rlvant information (Börcsök, J.,2003). Th bus systm is laid out byond that still without backup procssing. It will now b shown that a simpl rdundancy dos not promis always succss. It is transfrrd ovr unscrnd twistd-pair cabl, i.. th bit rror probability is at 10-4 and th data transmission rat lis at v 100/s. Thn th rat of transfr rrors without rdundancy amounts to: U p v 10 2 / s (1) This mans that on transmission rror occurs at approximatly vry 100 sconds. Assuming indpndnc of probabilitis, th probability of two corruptd bits (rdundancy) is givn by p In this cas th amount of transmission rrors at unchangd v 100/s is: U rd 6 p' v 10 / s (2) Computing th rciprocal on can s that on transmission rror can occur ach 11,6 days, which is crtainly intolrabl. This lads to th fact that mor mthods for rduction of th singl bit rror probability ar ncssary. Th intgrity of a mssag not only dpnds on th singl bit rror probability. Espcially th probability of corruption of a whol mssag, th so-calld rsidual rror probability is important. This rror probability is th summation of th singl bit rror probabilitis, which also dpnds on th combinatoric according to th amount of rgardd singl bit rrors. Th rsidual rror probability is n ( ) ( ) ( n p A p p ) R 1 d n, (3) with th binomial cofficint

3 A n, n n!! ( n )! (4) whr n is th mssag lngth, p is th singl bit rror probability and d is th hamming distanc of th data mthod implmntd in th controllr. For th cas no data mthods ar implmntd, d is st to 1. A bttr data mthod rsults in a highr valu for d. 3 METHODS FOR CALCULATING THE RESIDUAL ERROR PROBABILITY First th data for th modls A and D is rgardd (Börcsök, J.,2004), with which th backup procssing of th transmission layr ar not considrd, as shown in Fig. 1. A B application is rgardd as sufficint masur against coincidntal hardwar rrors in th bus protocol dvic. That is in this modl th data of th commrcial bus systm is compltly usd. If only on nod th data mchanism fails, an uncovring of th rror is only possibl ovr on comparator, which is not sufficint to fulfil th rquirmnts of th catgory 4 of EN For th rquirmnts of th catgory 3 it is sufficint. Bus systms lik th CAN bus guarant, bcaus of thir structur, that othr participants xamin ach mssag in a sparat hardwar, an accumulation by rrors can b managd. Th consqunc of rdundant bus nods is also a rdundant transmission of mssags. All mssags ar thus transmittd twic and xamind ovr th comparator. It is possibl to say, that transmission fails only whn th rdundant mssag has xact th sam rrors. Th probability of mssag falsification is givn by th rsidual rror probability R KOM of th usd bus systm. Th disturbanc of both mssags can b rgardd as random, so that th rsidual rror probability of th rdundant systm R rd ( p ) is givn by 2 ( p) R R rd (6) C D Fig. 1: Architc. of bus-systms for safty tch. Hr is th commrcial bus systm rgardd to b not saf. Thus all masurs must tak plac for data in th safty rlatd controllr. Th rmaining rror rat rsults from th rsidual rror probability R(p) of th suprvising safguarding procssing, th data transmission rat n of th saftyrlvant mssags and th 1 %-rul. Byond that th numbr of m of th participants in a safty function is to b rgardd. Bus systms ar frly configurabl and assum hr th maximum xtnt of participants on th safty bus systm. With m participants m-1 mssags will b transfrrd. Th rat normalizd on on hour rsults in th quation blow (,V,m, p) 3600 R( p) v 100 ( m 1) R (5) Th arising valu can b compard now with Tabl 2. Aftrwards th paramtrs and R(p) must b varid dpnding upon rquird SIL (Tabl 1). Now, th data for th modls B and C (Fig.1) is rgardd, with which th individual channl of th transmission layrs is not rgardd as safty rlatd. It bcoms th qualitativ rquirmnt of th two-channl hardwar rlatd to th bus nods with th combind quantitativ computation of. Th individual transmission layr is not rgardd sufficintly as saf. Howvr, th combination of rdundant bus nods with cross-wis comparison of th mssags in th safty Th paramtr R is usd for th rprsntation of th singl probabilitis. With this, th calculation of is possibl and with variation th paramtrs v and m, th rquird SIL can b achivd. Nxt, th data for th modls A and D is dscribd, with which th bus systm has a portion of safty, which applis for xampl to fild bus systms. Normally, fild busss ar contrary to snsor-actuatorbusss quippd on systm lvl with applications, which rquir largr arithmtic prformancs or shortr rspons tims, whrby th amount of data is constant. In a fact bus protocol dvics ar vry xpnsiv. Thus bus nods oftn ralizd as singl-channl. Unfortunatly, th mthod of calculating is gtting mor complicatd. Th IEC uss th Markov- Modls for calculation. A condition for this is a rliabl commrcial bus systm, so that th additional xpnditur dos not xcd th framwork. Basd on th transmission quality of th commrcial bus systm, th rmaindr for raching a crtain catgory or a crtain SIL is to b ralizd in th safty controllr. For th protocol, dvics proofs valuations hav to b don and/or th hardwar rliability λ of th protocol dvic is to b includd into th calculation. Dpnding on IEC (EN ) th Markov analysis of this modl can b attributd to thr substantial transition probabilitis.

4 transmission rror ( brakdown) condition OK transmission cod (TC)-rror (bus-chckr) participants. This fraction varis bcaus of diffrnt mchanisms in componnts involvd and uninvolvd. Th mchanism of a falsification by hardwar rrors within th componnts involvd (x1) is anothr than th mchanism of th dstruction of a mssag by indiffrnt componnts (x2). Thus th fractions x1 and x2 of th dangrous failurs diffr. x1 can b stimatd by a failur mod and ffct analysis (FMEA). It applis now: dangr ( x λf + x2 λs ) RUS 1 (10) Fig 2 Markov-Modl for singl-channl bus nods and additional suprvising data intgrity Th protocol dvic can fail in thr diffrnt causs of failur, as sn in Figur 2. Firstly, th transmission hardwar can fail, so that on mssag or svral mssags ar falsifid. Furthr, it can com to bit falsifications bcaus of lctromagntic influncs (), which ar not rcognizd by th data communication quipmnt. Finally, ach mssag is passd from th data communication quipmnt on to th safty systm, bcaus only th bus-chckr faild. From Tabl 1/Tabl 2 on can slct at rquird SIL th appropriat targt valu for, t arg t. Th rmaining rror rat rsults from th individual transitions,, TC in this simplifid Markov modl, as shown in Figur 2. Th rsult is th rmaining rror rat with th 1 %-rul: SYS + + TC < 100 t arg t (7) corrsponds to th rat of th hardwar faults, which causd by hardwar failurs in th transmission layr a mssag is falsifid. Failurs can only b dtctd by functional data mchanisms in th saf application. In this cas th maximum rror probability R US, which dpnds on th bit rror probability, of ths mchanisms must b known. Thrfor, consists of ithr of th probability that th hardwar of th bus protocol componnts fails and / or of th rsidual rror probability of th safty transmission mchanism in th safty application. calculats itslf as follows: λ R (8) λ is thrby th sum of all failur rats of th bus protocol componnts of th safty-rlvant participants pr hour. In this modl against IEC a dirct linar connction btwn λ and th avrag actual working tim, up to th failur (MTTF Man Tim To Failurs) can b stablishd. US λ 1/ MTTF (9) An improvmnt of can b achivd, if λ is rgardd mor xactly. It is distinguishd btwn th actual communication partnrs and th othr bus Thrby stands F for th hardwar probability of failur of th two actual communicating safty-rlvant participants, S for th hardwar probability of failur maximally x actual not communicating saftyrlvant participant. x1 stands for th portion of th dangrous rrors by th componnts uninvolvd, x2 for th portion of th dangrous rrors by th indiffrnt componnts. x1 and x2 ar in th rang btwn 0 and 100 %. R US is th maximum rsidual rror probability for th safty masurs in th application. Transint transmission rrors by xtrnal influncs such as ar dscribd by th middl branch in Figur 2. It is assumd hr th corrct function of th bus protocol componnt and th additional data mchanisms in th application. That mans, that th rsidual rror probability of commrcial protocols and th rsidual rror probability of th additional data mchanism ar to b considrd. Ths two probabilitis can b multiplid with ach othr, only if thy ar indpndnt. Thus th data mchanisms of th bus and of th saf application must b indpndnt from ach othr that must b provn approximatly by simulation or considration of th mathmatical limit valu. A furthr paramtr is th frquncy f W, with which mssags on a bus systm ar disturbd. To applis: f R R (11) W UB R UB dsignats th rsidual rror probability of th commrcial bus systm and R US th maximum rsidual rror probability of th data in th saf application. Hardwar faults of standard data safguarding mchanisms in th bus protocol componnt ar dscribd in Figur 2 by th right branch. Undr this condition th additional mchanism will work as th only rror dtction. Sinc this last spcifid mchanism is now compltly alon on itslf, th probability riss that it is confrontd with incorrct mssags. Thr is ithr a crtain probability that mssags arriv falsifid at th saf application or th probability that th rror is rcognizd in th safty controllr. In cas of failur of th mchanism on th bus thrfor th frquncy such dtctd rrors will incras, that can b dtrmind for xampl by a prmannt masurmnt by mans of countrs and timr. If th frquncy is wll-known, with which th functional standard data safguard mchanism dtcts th failurs in th additional data mchanism ar rcognizd, a ris can b dtrmind and aftr a crtain tim T th systm can b brought into th saf stat. R considrs alrady gnral hardwar faults. It US

5 is assumd, that th bus protocol componnt is still abl to snd and rciv, but th data is dfctiv. It is only ralistic at a small fraction k of th hardwar faults. Thus ariss for th critical failur of standard protocols: TC R UB k T (12) k is th rlationship of th hardwar faults of th standard data safguard mchanism to th ntir hardwar faults of th bus protocol componnt and should b st in th cas of doubt to 1. T is th tim intrval, in which a wll-dfind maximum numbr of falsifid mssags on th transmission systm may not b xcdd, without th saf guarding layr introducs th saf condition. 4 SUMMARY This papr compriss th mathmatical dscription for th papr principls of safty bus systms Part I. It dtaild data intgrity following th IEC and spcifid mathmatically diffrnt modl architcturs for safty bus systms. REFERENCES Börcsök, J.,( 2004) Elktronic Safty Systms, Hüthig Börcsök, J.(2004a) Principls of Safty Rlatd Bus-Systm and Protocols. FF-SIS Mting in Hannovr 2004 Börcsök, J.:, Safty rlatd Bus-Systms, Conf. Foundation Fildbus End Usrs Council Austr. Incor., Austr DIN VDE 0801: (1998) Funkt. Sichrhit, sichrhits- Bzognnr lktr./lktron./prog. lktronischr Systm (E/E/PES), (IEC 65A/255/CDV: 1998), DIN V (1998): Grundlgnd Sichrhitsbtrachtungn für MSR-Schutzinricht., Buth, Brlin DIN VDE 0801/A1: Grundsätz für Rchnr in Systmn mit Sichrhitsaufgabn, Buth IEC (2001): Softwar für Rchnr mit sichrhitskrit. Bdutung, 12/2001 IEC/EN 61508: Int. Standard Func. safty: Saftyrlatd Systm, Gnva, Intr. Elctrotch. Com