# Functional Safety Networks and Protocols in the Industrial Internet of Things Era
## 2 Functional Safety Networks and Protocols  
The most popular Functional Safety Networks are defined by the IEC 61784-3 International Standard [15] with specific reference to the Communication Profile Families (CPFs) introduced by the fieldbus standardization framework.  
Table 1 lists the CPFs for which functional safety protocols have been defined along with their commercial names.  
The functional safety protocols defined by IEC 61784-3 have been designed assuming the underlying communication system behaves like a _black channel_. With such an approach, the safety nodes are not aware of the channel features, nor of the industrial network they rely on, with the exception of the service primitives necessary for data transmission.  
Additional FSNs are available. Two of them, namely OPC UA Safety and CANOpen Safety, are noteworthy. OPC UA Safety [16] has been recently defined in agreement with the guidelines of IEC 61784-3, even though it is not (yet) included in such standard. CANOpen Safety [17] is a popular European Standard, designed with a different approach, referred to as _white channel_ from that of IEC 61784-3.  
A pictorial representation of the two approaches is provided in Figure 1, where on the left side, the communication (black) channel, as seen by the safety communication layer, begins at the boundary with the application layer. With such an approach, although each of the functional safety protocols of IEC 61784-3 has been designed for a specific network, in principle, it could be implemented on whatever network.  
Conversely, the white channel approach, as can be seen in Figure 1, right side, assumes that the functional safety protocol is well aware of the underlying communication system and makes use of its services and protocols, in all layers, to implement the safety functions.  
Regardless of the channel approach, functional safety protocols have to deal with several types of communication errors. The most typical ones, as specified by IEC 61784-3, are corruption, loss and delay of the transmitted safety messages. To tackle such impairments, the protocols adopt some countermeasures, the most effective being the use of  
\begin{table}
\begin{tabular}{l l l} \hline \hline
**CPF** & **Commercial Name** & **Functional Safety Protocol** \\ \hline
1 & FOUNDATION Fieldbus & FF-SIS \\
2 & Common Industrial Protocol (CIP) & CIP Safety \\
3 & PROFIBUS \& PROFINET & PROFIsafe \\
6 & INTERBUS & INTERBUS Safety \\
8 & CC-Link & CC-Link Safety \\
12 & EtherCAT & Fail Safe over EtherCAT (FSoE) \\
13 & Ethernet POWERLINK & Ethernet POWERLINK Safety \\
14 & EPA & EPASafety \\
16 & SERCOS & CIP Safety \\
17 & RAPIEnet & RAPIEnet Safety \\
18 & SafetyNET p & SafetyNET p \\ \hline \hline \end{tabular}
\end{table}
Table 1: Communication Profile Families (CPF) and Functional Safety Protocols defined by IEC 61784-3.  
Figure 1: Functional Safety Protocols: Black and White Channel Approach.  
enforced CRC, message numbering and timestamping. The complete list of errors and countermeasures can be found in the standard documents.  
When a functional safety network is used (in a plant, machinery, equipment, etc.), it definitely contributes to the risk analysis that has to determine the overall Safety Integrated Level (SIL). In particular, IEC 61508 recommends that the adopted communication facilities may influence with a maximum percentage of 1% the average frequency of dangerous failures per hour of the safety functions (assuming that every single error could lead to a dangerous failure). This reflects on the performance figures that FSNs have to provide, in terms of residual error probability per hour (REP). Clearly, the higher the SIL, the lower the REP. In general, REP is strictly related to the communication behavior and depends on  
* The bit error rate of the underlying channel;
* The number of safety messages transmitted per hour;
* The countermeasures against errors adopted by the functional safety protocols.