CIP Safety

In the intricate world of industrial automation, ensuring safety and maintaining efficient communication are paramount. The integration of sophisticated machinery and advanced technologies necessitates stringent safety measures to protect both personnel and assets. This is where the importance of functional safety and communication protocols becomes evident, serving as the backbone of safe and seamless operations in industrial settings.

Communication protocols play a vital role in this ecosystem, enabling the real-time exchange of safety-critical information across various components of an industrial automation system. These protocols ensure connectivity between machines, devices, and systems, facilitating greater visibility and control over operations. By allowing for the integration of multiple safety systems onto a single network, communication protocols like CIP Safety reduce the need for multiple communication lines and diminish the risk of human error, thus contributing significantly to the overall safety of industrial automation environments.

The history of CIP Safety, a protocol designed to ensure fail-safe communication between nodes in a safety network, traces its roots back to the early 2000s. This innovative approach was introduced by the ODVA (Open DeviceNet Vendor Association), aiming to enhance safety in industrial environments. CIP Safety is part of the broader Common Industrial Protocol (CIP) framework, which facilitates interoperability across various industrial networks such as Ethernet/IP, DeviceNet, and ControlNet.

CIP Safety provides a robust safety communication protocol that could coexist with other application layer standards like CIP Motion and CIP Security This adaptability allowed for seamless integration and increased flexibility within industrial environments, enabling the mixing of safety devices and standard devices on the same network.

The adoption of CIP Safety grew as industries recognized its potential to significantly improve operational safety. It provides high integrity safety services and diagnostics in the application layer without requiring special communications hardware. This feature set ensures transmission integrity by detecting errors and allowing devices to take appropriate actions, thereby maintaining safety up to Safety Integrity Level (SIL) 3 according to IEC 61508 standards.

The Common Industrial Protocol (CIP) revolutionizes the integration of safety functionalities into industrial networks by leveraging a standardized, Ethernet-based platform. This innovation is particularly embodied in CIP Safety which extends the capabilities of the standard CIP framework by incorporating high-integrity safety services and diagnostics in the application layer. CIP Safety is designed to provide fail-safe communication between nodes on a safety network. This protocol ensures the integrity of safety-related data transmission, allowing for the coexistence of safety and standard devices on the same network or wire, thereby enhancing flexibility and integration within industrial automation applications. CIP Safety has been certified by TÜV Rheinland as a black channel protocol, meaning its safety integrity is not dependent on the physical media, allowing it to be communicated over various wired and wireless systems.

Redundancy is a fundamental principle for functional safety and therefore also for CIP Safety. It refers to the duplication of critical elements within the communication system to ensure fault tolerance and reliability. Specifically, CIP Safety employs Class 1 connections, characterized by redundancy and deterministic behaviour, to ensure that safety-critical messages are transmitted reliably and redundantly across the network. In case of a communication failure or loss of data integrity, redundant communication paths are utilized to ensure that safety-related information reaches its destination. Moreover, the protocol ensures that all outputs revert to a safe state in case of closed communication or loss of connectivity, minimizing the risk of accidents or injuries.

CIP Safety supports a comprehensive array of safety applications designed to prevent accidents, protect personnel, and ensure the safe operation of industrial machinery and processes. Among these critical safety functions are:

Implementing CIP Safety in industrial networks offers multiple advantages as follows:

Compatibility and interoperability

Its adherence to well-established industry standards IEC 61508 and ISO 13849 not only simplifies integration efforts but also facilitates the seamless exchange of safety-critical data between devices from various manufacturers, thereby streamlining the implementation process. 

Simplified architecture

By integrating safety functions (safety I/O blocks, safety interlock switches, light curtains, and safety controllers) into the existing industrial network infrastructure, CIP safety eliminates the need for separate safety networks or dedicated wiring. This reduction in complexity leads to lower system costs and simplifies the design, installation, and maintenance processes. 

Deterministic communication

Each piece of CIP Safety data is produced with a timestamp, enabling safety consumers to ascertain the age of the data they receive. This feature is crucial for ensuring that the data used in safety decisions is current and reliable. Furthermore, the inclusion of producer identifiers and consumer identifiers in each data production ensures that each message is delivered to and received by the correct consumer, thereby mitigating the risk of miscommunication or data misdirection. 

Scalability

Facilitates expansion or modification of safety systems due to its support for various network structures such as bus, star, and ring topologies as industrial operations evolve, accommodating changes with minimal disruption to existing processes.  

Reliability

CIP Safety employs Safety CRCs (Cyclic Redundancy Checks) or checksums for all safety transfers. This method is crucial for verifying the integrity of the information being transferred, ensuring that the data has not been altered or corrupted during transmission. 

Enhanced diagnostic capabilities

CIP Safety offers robust diagnostic capabilities to ensure system reliability and safety. It facilitates end-to-end diagnostics and monitoring of safety-related data by using cyclical heartbeat mechanisms and safety signatures to detect failures. The protocol enables real-time diagnostics, allowing for the identification of communication errors, device errors, and potential system malfunctions. These diagnostic features enhance the system's ability to perform predictive maintenance, reduce downtime, and ensure compliance with stringent safety standards. 

In oil and gas facilities, where the handling and processing of hazardous substances are routine, the importance of ensuring the safety of personnel and assets cannot be overstated. The implementation of CIP Safety plays a crucial role in this context, enabling the execution of critical safety functions such as emergency shutdown systems, fire and gas detection, and safety interlocks. These measures are essential for preventing accidents and mitigating risks associated with critical operations. Furthermore, the advent of remote monitoring and control technologies has significantly enhanced the safety and efficiency of these operations. With assets often scattered across vast and remote locations, CIP Safety facilitates real-time monitoring and control of safety-critical equipment and processes. The integration of safety-rated sensors and actuators with CIP Safety protocols allows for remote diagnostics, maintenance, and shutdown capabilities, thereby bolstering operational safety and efficiency. 

In the realm of industrial automation, the CIP Safety protocol emerges as an indispensable enabler, offering crucial functionalities such as monitored standstill. In this setup, sensors integrated into the safety control system detect human operators near robots and prompt an immediate halt if necessary. This proactive measure is fundamental in averting potential accidents and fostering a secure working environment where humans and machines coexist harmoniously. Equally critical are emergency stop actions, initiated by human operators to swiftly deactivate equipment in the event of an emergency, thereby safeguarding personnel. Furthermore, the integration of advanced safety functions such as speed and proximity monitoring, collision detection, and safe stop mechanisms into collaborative robots (cobots) further enhances their capacity to operate safely alongside humans. Leveraging technologies like force feedback, low-inertia servo motors, elastic actuators, and collision detection systems, cobots are tailored to limit power and force capabilities to levels deemed safe for human interaction.  

Hilscher's netX technology platform, consisting of the netX SoCs, associated firmware and extensive protocol stacks, supports the development of devices that have to fulfil high functional safety requirements. The firmware supports the date exchange services for the required safety-relevant applications. These include, for example, Safety over EtherCAT, CIP Safety or PROFISAFE. The netX acts as a black channel for the safety system. 

On the hardware side, as with non-safety devices, the netX forms the interface to the fieldbus or real-time Ethernet systems. The safety frames are treated like I/O data and forwarded to the safety-relevant application. The corresponding application firmware for the netX 90 can be implemented on the application side of the controller, for example. It retrieves the data packets from the dual port memory (DPM) and forwards them to a defined interface. On the safety side, two redundant CPUs then receive the data via a galvanically isolated serial interface for further processing.