# Functional Safety Networks and Protocols in the Industrial Internet of Things Era
## 4 The Fail Safe over EtherCAT Protocol Implemented on WiFi
### Safety Function Response Time  
SFRT is an interesting index to assess the performance of safety critical automation systems that uses functional safety networks. It represents the time that elapses between the detection of an error and the transition of the system into a safe state. In the context of the IEC 61784-3 International Standard, the SFRT indicator has been specifically introduced by one of the protocols within the specifications, namely ProfiSAFE [25]. In particular, it is defined as \"the worst-case time to reach the safe state of the system in the presence of errors or failures in the safety functions or in the communication medium itself\". With respect to the reaction time shown in Equation (1), SFRT represents a more comprehensive index, since it explicitly includes the case of errors in the communication system. Although its specific formulation is related to ProfiSAFE, it has been subsequently characterized by [26; 27] for other protocols. In the following, we provide an analytical description of SFRT for FSoE.  
In ProfiSAFE, SFRT is calculated under the hypothesis that during the transmission of a safety PDU there may be at most a single faulty device in the safety network. This means that the procedure of reaching the safe state by a system has to consider, in the worst case, also the possibility of a fault in one of the devices of the network. The detection of such fault is made possible by watchdog timers used by the safety devices. Thus, since ProfiSAFE is based on a master-slave protocol, if a slave does not respond to the query of the master within a timeout, then the master marks that slave as faulty and moves to the next one. Conversely, if a slave is not polled by the master within a timeout, then it enters the safe state.  
Let us assume the safety network is composed by one master and \(n\) slave devices. If a slave detects a fault, then the maximum time to reach the safe state is given by  
\[SFRT=WCDT+WDTout^{max} \tag{2}\]  
where \(WCDT\) is the Worst Case Delay Time, i.e., the maximum time requested by the communication between the master and the slaves with the exception of the faulty slave. The contribution of this latter to SFRT is given by the term \(WDTout^{max}\), which represents the maximum value of the watchdog timeout among the slaves, formally expressed as  
\[WDTout^{max}=\max_{i=1,2,\ldots,n}(WDTout_{i}). \tag{3}\]  
Moving to FSoE, if a slave detects a fault, in the worst case, it will notify it to the master after a cycle time (this happens when the fault detection occurs just after the slave has been polled by the master and, hence, it has to wait for another cycle before it is polled again). Similarly, another cycle is necessary for the transmission of the safety messages by  
Figure 2: Basic FSoE frame.  
the master to all the other slaves. However, to calculate the SFRT, it has to be taken into account that one of the slaves can be faulty. Hence, we have  
\[SFRT_{FSoE}=T_{C}^{max}+\sum_{\begin{subarray}{c}i=1\\ i\
eq j\end{subarray}}^{n}T_{p_{i}}^{max}+\max_{i=1,2,...,n}(WDTout_{i}) \tag{4}\]  
where \(T_{C}^{max}\) is the maximum FSoE cycle time, \(T_{p_{i}}^{max}\) is the maximum polling time of the \(i\)-th slave, and \(j\) accounts for the faulty slave. Clearly, the first two terms in Equation (4) account for the term \(WCDT\) in Equation (2).