1TECHNOLOGY OVERVIEW SERIESCIP Safety:
Wireless Functional Safety

AT A GLANCEThis white paper addresses how to apply
functional safety communication, like the
CIP Safety distinctive network service on the
EtherNet/IP network, over wireless/cablelesscommunication networks on moving andremote equipment. The advantages for
wireless networks are discussed, followedby principles for functional safety. Industrial
communication networks, particularly
EtherNet/IP, are reviewed in both wired andwireless contexts. The diagnostic
capabilities of CIP Safety are introduced,
followed by the procedures for deploying a
successful wireless network using CIP
Safety.

TECHNOLOGY OVERVIEW: CIP SAFETY™ (PUB00343R1)

2

Introduction
The last 15 years have seen unprecedented growth in industrial connectivity. This has
been driven by increasing demand for system performance while being supplied byconsumer and IT communication technologies that brought costs down. At home and in
the office, we have built up an expectation of how well wireless should perform. And thathas led wireless communications to become the first-choice connection method at homeand for many communications at the office. Wireless solutions are becoming morecommon in industrial environments and for good reason. These are some of the many
places that wireless industrial communications are enabling more effective production:
•
•
•
•
•
•
•
•
•

Modular and flexible plant design
Remote process instrumentation
Data collection on legacy equipment
Automated guided vehicles (AGV)
Automated mobile robotics (AMR)
Independent cart technology (ICT)
Automated storage and retrieval systems (ASRS)
Predictive analytics for moving machinery
Reducing cabling for hygienic design

With each new advance in technology, wireless communications achieve better
performance, so there are likely to be even more cases that can be enabled. There aresome organization cultural and technical barriers that must be addressed at companies
adopting wireless communications within operational environments, such as achieving
employee safety.

What About Safety?
Safety is particularly important for mobile equipment, moving machinery, reconfigurable
plants and anywhere where humans are in immediate proximity to dangerous items in
the industrial control system. These applications present unique challenges for industrial
communications, such as how to communicate industrial information wirelessly and how
to keep employees safe while interacting with mobile machinery. Wirelesscommunications have been making steady improvements and many applications can beaccomplished today with functional safety as part of the design.
How can safety work over wireless? First, it makes sense to consider functional safety
requirements generally, and how those work over industrial communications. There aremany standards related to functional safety in different contexts. The common themes
for industrial control systems are:••••

Reduce the risk of a component failure or system failure
Quantify the risk of failure after reductions are in place
Detect when failures occur
Ensure that failures always lead to a safe stateThis is done by using good design practices, applying oversized components,
performing statistical analysis of failure modes and running diagnostics regularly among
other techniques. Modern standards for safety system design, such as IEC 61508 andIEC 62061 specify how to apply those techniques to electronics in the system, while IEC
TECHNOLOGY OVERVIEW: CIP SAFETY™ (PUB00343R1)

3

13849 adds in electromechanical systems. How do those good principles apply tosomething like networked communications, especially wirelessly?

Foundations of EtherNet/IP
We will begin with examining how standard industrial communications work. It is helpful toreview the OSI model and the TCP/IP model for communications to understand how
different parts of the communication system work together for the EtherNet/IP™ industrial
communication network.
1. Data that must be communicated between two
devices is generated in the higher, or application
layer, using the Common Industrial Protocol, or
CIP™ protocol. This is the same layer thatfamiliar functions like HTTP and SMTP exist in.
2. In the transport layer, the CIP information is
encapsulated. In the case of EtherNet/IP, that isa TCP or UDP header.
3. In the network layer, logical addressing
information is added. In the case of EtherNet/IP,
that is the Internet Protocol (IP) information; thepacket is now ready for network access.
4. In the datalink layer and the physical layer, the packets are converted to thetransmission media, sometimes with additional measures to avoid packet
collisions. Combined these may be called network access layers.
This hierarchical organization is important because the critical user data for CIP iscompleted in the first step, independent of the transport, network, datalink or physicallayers. With that independence different networks are possible, as well as different
transmission media.
That means you can use one protocol, EtherNet/IP, for communications over copper,
fiber and wireless, through Layer 2 switches and Layer 3 routers. Next, we will
examine how those communications work over wired links.

Wired EtherNet/IP
When using different network access layer implementations of EtherNet/IP, there are key
differences to consider. Different transmission speeds, packet per second limitations andcollision detection/prevention mechanisms may be in place. Further, the quality of thephysical media is important to consider. These differences can be demonstrated to asmall degree with fixed media like copper wiring:
Datalink and/or
Max throughput
physical layer variant
speed
10BASE-T1S (SPE)10 Mbit/s
10BASE-T1L (APL)

10 Mbit/s

100BASE-TX (Fast)

100 Mbit/s

1000BASE-T (Gig)1000 Mbit/s

TypicalCollision detection and prevention Quality of physical media
latency
170 us ±Point-to-point half/full-duplex, or
15 m, 2 wire, Powered,
15 us
half-duplex multi-drop (CSMA/CD)
18 AWG twisted-pair
185 us ±Point-to-point only, full-duplex
1000 m, 2 wire, Powered,
15 us
24 AWG twisted-pair[1000 m]85 us ± 15
Full-duplex
100 m, 4 wire, Cat 5us
60 us ± 10
Full-duplex
100 m, 8 wire, Cat 5e
us

TECHNOLOGY OVERVIEW: CIP SAFETY™ (PUB00343R1)

4

Fi

One advantage of fixed systems is that theirreliability is highly predictable. While there aredifferent speeds shown, the achievable net data
rate can be impacted by a limited number offactors. The primary impact for reductions inthroughput is based on lost, dropped or damaged
packets. This can be measured by packet loss andthe bit error rate (BER). With Ethernet
communications, the higher levels of the OSImodel are designed to detect errors in the lower
levels. The errors referenced here are primarily
physical layer errors.

FIBER-OPTIC MEDIA

EtherNet/IP can also be deployed over fiber-optic
network links, which can significantly increase thedata throughput and the distance between nodes. Fibercan increase the speed or the distance between nodes
by an order of magnitude or more, but if both are
increased the gains are more modest; there is atradeoff associated with distance and throughput withfiber.

Packet loss can occur when cables are broken,
collisions occur, or switch firmware mishandles thepacket. These are all rare events when full-duplex
communications are used, however the lack of fullduplex communications can increase the packet
collisions; this is mitigated by the CSMA/CD protocol.
This protocol allows each transmitter to listen to theshared media before starting to transmit. When acollision is detected, the two (or more) guilty
transmitters stop transmitting and wait a random timeinterval before trying again.
Individual bit issues when using physical media usually arise from interference on thetransmission media. For copper, that can be electromagnetic interference. The different
grades of cables, shielding, twisting, and distance are all part of strict requirements
around the physical media to reduce the risk of electromagnetic interference.
Sometimes, electromagnetic interference cannot be avoided, or long distances must be
employed; fiber-optic transmission presents an effective, but costlier solution. The mostcommon bit errors in fiber come from dirty connectors, crushed media, and imperfectionsin the fiber.

Wireless EtherNet/IP
For wireless (or cableless) communications, the two dominant methods use radio
frequency or optical means. Most of this paper will be focused on radio frequency, sinceradio frequency products for the industrial space are more available than optical products.
When considering using wireless communications, the same metrics can be applied as
wired communications.
Wireless medium
Zigbee (802.15.4)
Bluetooth(802.15.1)
Wi-Fi 3 (802.11g)
Wi-Fi 4 (802.11n)
Wi-Fi 5 (802.11ac)
Wi-Fi 6 (802.11ax)
5G

Max throughput
speed
0.25 Mbit/s
1-2 Mbit/s

Typical latency

Type

Distance

40-350 ms
40-100 ms

10-20 m2-5 m

3-54 Mbit/s
72-600 Mbit/s
433-6,933 Mbit/s
600-9,608 Mbit/s
100-20,000 Mbit/s

1-4 ms
1-4 ms
1-4 ms
1 ms
1 ms

Mesh
Point-topoint
WLAN
WLAN
WLAN
WLAN
Large Area

TECHNOLOGY OVERVIEW: CIP SAFETY™ (PUB00343R1)

5

35-100 m
35-100 m
35-50 m35-50 mWide
Area

Note that the latency is many orders of magnitude more than wired transmission. Basedon the statistics above, there are fundamental differences between the different
technologies available, which will dictate how they can be applied. The specifications
shown can be misleading for industrial applications that may not be able to use the fullcapabilities. Even when multiple technologies are available, there should be some aspectsof the application that can help you decide which to use – see later sections on choosing
wireless technologies.
The factors driving the differences between transmission methods are separate from thatof wired media, but the same metrics can be examined. For example, the bit error rate canbe used to characterize wireless communications. For radio frequency transmissions
between two devices there are many different factors contributing to the bit error rate,
including:•••Distance
Obstacles
Interference

The radio waves from the transmitting devices lose strength exponentially as they
propagate away from the transmitter. Even when two devices are physically close to eachother, if their transmitting equipment and receiving equipment are focused for a narrowtransmission field but not aligned to each other, the communications could be transmitted
without being received. Similarly, obstacles can block the signal or weaken it. Finally, thegeometry of a structure, the material composition and even the paint finishes can generateinterference with the signal.
The interferences mentioned mean that wireless networks are reconfiguring much more
frequently than typical wired networks. As signal strength changes, wireless devices will
hop to another transmitter, which can create packet timeouts. In an office Wi-Fi
environment, walking between your desk and a conference room with your laptop will likely
trigger the transition to a new access point, however that transition does not change yourproductivity for the day. It happens fast enough not to interrupt your work. Industrial
communications that transition could take long enough to disrupt the process if the devices
and network are not configured properly. The amount of motion will impact how often
reconfiguration happens, so you should consider these four different movement profiles:
1.
2.
3.
4.

Fully fixed point-to-point
Movement around a fixed point
Movement on a fixed pattern
Irregular movement

In any of these cases, proper antenna design and a site survey must be considered forreliable wireless performance, as well as the impact of what roaming between basestations will do to the performance of the system.

Fully Fixed Point-to-Point
Fully fixed point-to-point transmission is very useful when there isno easy way to get communications between the two stations,such as through the walls of a fully sealed vessel or where adding
cable ducts could cause challenges for personnel and forklifts.
There is a single point-to-point connection between the wirelessstations.

TECHNOLOGY OVERVIEW: CIP SAFETY™ (PUB00343R1)

6

Movement Around a Fixed Point
Transmission for movement around a fixed point could be best
characterized as monitoring rotating equipment. A single pointto-point connection is likely to be used, however the geometry
and obstacles between those points may be changing. These
applications do not usually need long-range transmission, but
the constant movement may influence antenna design so that it
can cover the path of the moving parts. Wirelesscommunications offer a lower-maintenance solution compared tothe traditional answer, sliprings.

Movement on a Fixed Pattern
Movement on a fixed pattern can take a few forms. The simplest
form could be an automated storage and retrieval system(AS/RS) or gantry crane – out and back on a straight line. A more
complex pattern could be an automated guided vehicle (AGV)
following an embedded path in the floor, a roller coaster following
the fixed rails of the ride or a monorail transport system in an
automotive factory. Each example has different considerations:•••

Any of these may be a long enough distance that multiple
radio base stations would be required for a system like WiFi to work across its entire range.
Another option to consider if the path is a single continuous
loop is radiating cables, also known as leaky feeders or
leaky coax. These coaxial cables with engineered
modifications to the outer shield create a tunnel of signal tofollow curvilinear paths without creating excess radio noise
outside of the path.
Straight systems can sometimes use infrared or laserbased optical communications, although that requires
maintaining line-of-sight between the transmitter andreceiver.

Irregular Movement
More intelligence in devices is contributing to an increase inirregular movement, such as autonomous mobile robots (AMR).
Another example of irregular movement would be humans with awireless communication device that is part of the automation
system, such as a wireless teach pendant or emergency stop
device. Keep in mind that a tablet computer used for dashboards
is likely not going to cause the process to stop if communications
are lost, so it should be considered more like an IT asset than an
OT asset. For this case and the other cases in this section, it islikely that multiple base stations will be required to cover the space adequately.
TECHNOLOGY OVERVIEW: CIP SAFETY™ (PUB00343R1)

7

More Transmitting Devices Will Mean More
Planning
Each of the examples shown so far considered a single wireless bridge. Realistically, yourapplication is likely to have many wireless bridges, each following the planned motion. Fora wired network, that is of little concern – full-duplex communication means that each link
is an independent network connection. With wireless, the air between stations represents
a commonly shared media. Not only do wireless networks often have more constrained
operating parameters than wired networks, they also behave differently as the network
becomes congested. How does that happen? On each frequency, only one device within
the transmission range can be transmitting at a time. If two devices begin talking
simultaneously, both will stop, wait a random amount of time, then attempt to transmit
again. Even though wireless transmitters spread their communications across manyfrequencies to reduce interferences, too many transmitters on too small of a frequency
range will produce more collisions and reduce the overall effective throughput of the
network. In these conditions, transmitting longer bursts of data is slightly more efficientfrom a pure measurement of throughput like bits per second (hence features like packet
aggregation in 802.11n), however those benefits for raw throughput come at the cost oflatency. For industrial applications latency is usually more important than throughput.
This problem plagued early wireless technologies, but modern wireless technologies like
5G and Wi-Fi 6 (802.11ax) have been specifically tailored to higher device densities by
increasing the available transmission frequencies and improving the efficiency of
frequencies with scheduling.

Applying CIP Safety to Wireless Applications
Both wired and wireless communication networks have complexity, from the device to theswitch, router, through all the network media, and to another device. It would be a
massive undertaking to try to make an entire communication network meet the principles
of functional safety, and any change to any part of the network could require revalidation.
While this idea is a theoretical possibility, functional safety over communication networks
instead follow a concept called the “black channel principle”, which is laid out in IEC
61508.
The black channel principle stipulates that two safety devices must have enoughintelligence in themselves, and enough diagnostics in their communications, that theentire communication network has zero impact on the ability of the device to detectcommunication errors. Even though Ethernet communication networks have considerable
error detection built into them, none of that may be used to satisfy any part of the safetyfunction.

TECHNOLOGY OVERVIEW: CIP SAFETY™ (PUB00343R1)

8

CIP Safety™ devices create a logical connection to each other, independent of the
network technologies being used. In the devices, common errors are mitigated withvarious techniques, as described in IEC
61784-3-2. Time stamps are used withtime expectation to detect if packets are
lost, delayed, repeated or transmitted
out of order. Unique device identifiers
are used to authenticate thecommunication between two safety
devices. Additional diagnostics andchecks are included to validate that themessages are not corrupted in transit
and all these features are separate fromstandard communication methods.
When these mitigations are put together as CIP Safety, a single connection between two
devices, wired or wireless, can be used for communications certified up to SIL 3 per IEC
61508 and up to Category 4/PLe per ISO 13849-1.

Security for Wireless Applications
It is especially important to acknowledge security if you are considering a wirelessinstallation, since it has a different attack surface than wired networks. Traditional
physical media networks have defined access points, such as cables and switches, whichmust be protected from access. It is relatively easy to add physical security to a
traditionally wired network; if you prevent someone from plugging into the network bylocking doors, you can maintain access control.
Wireless adds another dimension since anyone nearby has potential access. Luckily, thepossibility for eavesdropping has been addressed for every wireless system throughencryption. Any wireless system – whether deployed for home use, office use oroperations use – should activate the security features available. This will typicallyauthenticate transmitting devices, encrypt traffic between nodes and provide mechanisms
to lock the configuration. Wireless networks may be more susceptible to denial-of-service(DoS) attacks because the media is the air rather than a cable in a protected facility.
Additionally, there are decisions you can make throughout the design process that can
reduce the risk of stray signals being sent outside of your intended area, such as aradiating cable and smart placement of the antennae.
Additional methods should be considered for protecting all industrial traffic from end
device-to-end device, such as CIP Security™. That adds protection over wired links that
may not have integrity or confidentiality today.

TECHNOLOGY OVERVIEW: CIP SAFETY™ (PUB00343R1)

9

Plan and Build Your Wireless EtherNet/IP
Installation
There are best practices to follow as
you are planning, designing andimplementing your wireless system.
The graphic shown to the rightdemonstrates how different
technologies can be applied for
different use cases. While notcomprehensive of technologies orapplications, this can be a guideline
for where to start. This also shows
how the distribution of packets can bedramatically changed by the specificfeatures implemented, as shown with
the Wi-Fi example.

Which Technology Will
Work Best?
For motion control and very high-speed reaction
times, wired networking is recommended between
the controller and the device. It is possible to dosome coordination of servo axes on different sides
of a wireless bridge, if both of their respective
controllers are local to the drives and if there issuitably small network latency and clock jitter forthe time synchronization. Wireless technology
available today, such as Wi-Fi (see sidebar), canbe used for this with careful tuning of the system.
However, Wi-Fi 6 and private 5G systems should
improve the reliability of this type of deployment.
Public cellular systems like 4G LTE are unlikely to
succeed due to long round-trip times, and private
4G LTE implementations never took hold in themarket. Bluetooth and ZigBee systems areunlikely to succeed in these applications.
For time-critical safety and I/O applications, there
are slightly more options. While the individual
devices will use the safety protocol to detect
failures in communications and bring the system toa safe state, it is still important to use a reliablenetwork to get the appropriate uptime without
nuisance trips. Wired networks and Wi-Fi systems
have been proven for these applications whenproperly used. The latest revision of Bluetooth has
increased its applicability to industrial control
applications, including safety protocols.

Wi-Fi: What are the different
versions?

There are many different versions of Wi-Fi
that have been developed. Here are the mostcommon designations you’ll find:
Early Wi-Fi (802.11a/b/g)
Clocking in at up to 54 Mbit/s, thesestandards are suitable for many industrial
applications.
Current Wi-Fi (802.11n/ac)
Called Wi-Fi 4 and Wi-Fi 5, each of theserevisions focused on improving throughput;
the bulk capacity increases benefitedconsumer use cases, such as file transfer
and web traffic. There is not typically abenefit to using these for industrial control
traffic but they can still be useful for otherplant data; in rare cases, some of thesefeatures can work against industrial control
reliability.
Wi-Fi 6 (802.11ax)
New additions are targeted at improving
industrial applications and the Internet ofThings (IoT). This includes connecting tomore devices per area, lower latency, better
time determinism and higher overall speed.

TECHNOLOGY OVERVIEW: CIP SAFETY™ (PUB00343R1)

10

While 5G and Wi-Fi 6 are still emerging at the time of this writing, preliminary testingshows that safety protocols work well over those new technologies. Be sure to compare
your requirements against the capabilities of the technology you are investigating.
For other data monitoring applications, if you can tolerate higher latency, the full range of
wireless technologies are available including cellular and mesh networks.

Determine Your Needs – Traffic Rate,
Latency, Power Consumption, Distance
You must understand what your needs for wireless will be before you start choosing
technology. There are a few different characterizations that should be applied, but thefirst to consider will be the wireless traffic requirements. You should try to predict what will
be going across the wireless bridge: what kinds of packets (big or small), how many
packets per second will be transmitted and your application information, such as control
loop times and safety reaction time limits that will need to be accounted for. Vendor tools
can help you to illustrate what those requirements will look like for your application.
With the basic information about what needs to be transmitted, review what kind of
motion path is being considered, how many devices are transmitting wirelessly and how
far the transmissions need to go. This is a good time to also consider the environmental
factors that are involved, such as heat, humidity, shock and vibration.
Power consumption may influence the technology you choose. Certain wirelesstechnologies are optimized for lower power consumption so that they can be effectively
used with batteries – others are not. Is there sufficient power where your wireless bridge
will be located? Many applications that use wireless power have access to significant
power, either through electrified rails or wireless inductive power transfer; both options
can be coupled with rechargeable batteries. Some applications, particularly for periodic
data collection, may employ single-use batteries designed for many years of operation.
Your process for choosing a wireless communication technology must include power
consumption analysis if batteries are the primary power source.
The following table helps to explain the potential impact that traffic rate, latency, power
consumption, and distance may have on a wired versus wireless decision:
Traffic
High

Latency
Low

Power Consumption Distance Recommended Wired or Wireless
High
Short
Likely Wired
Application
Medium Medium
MediumMedium→Dependent
Low
High
Low
Long
Likely WirelessAll factors mentioned can influence your decision for what kind of technology to use,along with which specific product characteristics are required for your antennae.

TECHNOLOGY OVERVIEW: CIP SAFETY™ (PUB00343R1)

11

Perform a Site Survey
Each facility can be different and bring unique challenges to implementing a wirelesssystem. How a facility was constructed and arranged will change where devices must beplaced because different surface finishes and geometries reflect and dampen radio
waves. During the site survey, wireless equipment should be placed around the site tomeasure signal strength based on the placement and number of the wireless devices. It
is important to perform site surveys. Your partner for wireless equipment will often haveservices to assist with the site survey.

Commissioning and TuningYour wireless partner should help commission and tune the system so you reach thedesired level of uptime. Since missed or delayed packets can lead to the safety function
being activated, you want to make sure that packets are making it across the wirelessbridge as expected. In addition to tuning the control system, there are likely settings in thewireless devices that can be optimized to confirm that the frequent, small CIP Safety
packets are prioritized over other traffic that may be on the wireless link. These settings
may have small differences between vendors.
Implementing the following will help optimize and prioritize CIP Safety packets over an
EtherNet/IP network:
1. A fully switched network. This will eliminate collisions and improve the deterministic
behavior of the data network.
2. Quality of Service (QoS) traffic prioritization. QoS prioritization allows time critical traffic
to have preferential handling over supervisory traffic.
3. Logical segmentation of the network. VLANs improve security and contain broadcast
messaging.
4. IGMP snooping. This will control multicast messages that can slow the performance ofthe network hosts. It also exponentially reduces the amount of traffic on the network,
reducing the chance for congestion and consequent packet loss.

Please see ODVA Pub 35 Network Infrastructure for EtherNet/IP and PUB 110 CIP Safety:
Safety Networking for Today and Beyond for more details.
TECHNOLOGY OVERVIEW: CIP SAFETY™ (PUB00343R1)

12

Successful Use Cases
New designs are possible utilizing wireless communications and you should be assessing
if your traditional constraints are still applicable. Plan for a multi-party collaboration
between the wireless device vendor, the equipment builder and the end user. Wirelessdeployments continue to come down in cost while increasing capabilities. CIP Safety has
been deployed already to hundreds of installations and the list continues to grow.
Author: Oliver C. Haya

CIP, CIP Safety, CIP Security, and EtherNet/IP are trademarks of ODVA, Inc.
Trademarks not belonging to ODVA, Inc. are property of their respective companies

TECHNOLOGY OVERVIEW: CIP SAFETY™ (PUB00343R1)

13