Funktionale Sicherheit IEC & IEC 62443

Transcription

1 Funktionale Sicherheit IEC & IEC Seite 1

2 PROFIsafe trifft New York PROFIsafe Senior Safety Expert Siemens AG, DF FA AS E&C-PRM3 Seite 2

3 Roosevelt Island Picture on courtesy of Pomagalski Seite 3

4 What about Functional Safety and IT Security Both can be designated over the same term: Sicherheit in German Sécurité in French Both can have significant impacts on: Productivity Availibity of the plant or machine Costs People Seite 5

5 Main differences Safety protects people against machine or plant Malfunction of machine or plant safe reaction through limit monitoring Mostly dedicated to internal malfunction of systems high self diagnostic coverage Possible misuse of systems if reasonably possible to avoid dangerous situation during operation Security protects machine or plant against people Intentional misuse of system or applicative means stop the CPU, incorrect behaviour of functions Mostly dedicated to external malfunction of systems diagnostic coverage generally not implemented Focussed on misuse of systems create a dangerous or not specified situation Seite 6

6 Functional Safety Seite 7 7

7 Target of Functional Safety People Plants Earth Automation and functional safety to protect... Seite 8

8 Typical application areas Process: People, Plants, Earth Factory: People and machinery Batches Production lines Low demand High demand Reaction time 0,1...1s Reaction time ms Burners IEC VDI 2180 NE 97 TÜV IEC 62061/ISO NFPA79 IFA Mobility Seite 9

9 Example of dangerous machine Seite 10

10 Risk reduction according IEC Residual risk Acceptable risk Equipment Under Control risk Increasing Risk Required risk reduction Effective risk reduction Covered with E/E/PE systems Covered with other technologies (not electrical Mechanical, Hydraulical ) Covered with external means and measures. Seite 11

11 3-step method according to EN ISO START Safe mechanical design Has the risk been adequately reduced? NO Technical measures Has the risk been adequately reduced? NO User information about residual risks YES YES Has the risk been adequately reduced? NO Renewed risk assessment YES END Seite 12

12 Determination of required PL acc. ISO Risk graph for determining the required PL r for safety function (s) Starting point for risk reduction estimation 1. S severity of injury S1 slight (normally reversible injury) S2 serious (normally irreversible injury or death) 2. F frequency and/or exposure to hazard F1 seldom-to-less-often and/or exposure time is short F2 frequent-to-continuous and/or exposure time is long 3. P possibility of avoiding hazard or limiting harm P1 possible under specific conditions P2 scarcely possible S1 S2 F1 F2 F1 F2 P1 P2 P1 P2 P1 P2 P1 P2 PL r a b c d e Seite 13

13 Determination of required SIL acc. IEC pinch one's finger door monitoring, switch OFF XY axis SIL2 Extent of damage: Permanent, loss of fingers: Se 3 Frequency, duration >1 hour up to 1 day and occurrence probability high, Fr 5 and Pr4 Avoidance possible, rarely: Av 3 Seite 14

14 Structure of systems and Safety evaluation Sub-system integrity Sensor Safety PLC Actuator SIL claim limit: 2 / PL d PFH D1 = 2*10-7 / h SIL / PL adequation SIL claim limit: 3 / PL e SIL claim limit: 3 / PL e PFH D2 = 1*10-8 / h PFH D3 = 3*10-8 / h Remark: values only as example SIL CL SYS <= (SIL CL Sub-system ) lowest è SIL claim limit: 2 PL SYS <= (PL sub-system)lowest Probability of failure PL d PFH D = PFH D PFH Dn + P TE è PFH D = (20+1+3)*10-8 < 10-6 System reaches: SIL 2 / PL d Seite 15 P TE = Probability of Transmission Error

15 The way to a safe machine Machine Documentation Safety-Plan Riskanalysis Specific. Safety Plan, Verificationsplan Risk analysis Specification, Manuals Realisation Selectt devices Data sheets, Mounting Programm Wiring diagramms Softwaredocumentation Test Test reports Verification Validation CE Verification reports MD conform Documentation Seite 16

16 The vision Safety controller (F-Host) conventional, e.g. E-Stop Safety input / output Standard controller Task2: Integration into the standard controller Task1: Integration of Safety Communication DP/PA Seite 17 Limit switch Laser scanner Light curtains Robots Drives Standard input / output Same features like with standard devices, e.g. device/module replacement at runtime

17 PROFIsafe objectives Safety related communication to protect people A safety function is performed through a control system using specific safety related devices PROFIBUS, PROFINET, IO Link Black channel principle Correct transmission of safety related information Door position, E-Stop, limited speed Detection of alteration of telegrams To avoid malfunction of machine Systematic and random failures approach Seite 18

18 PROFIsafe in real life Linked machines / linked plants Production lines Wireles communication Controller ßà Controller Controller ßà Device (mobile panel) Remote and / or maintenance station Monitoring and Engineering functions Seite 19

19 PROFIsafe Islands Example Ropeways: Station <-> Cabine Production PC with Security Client Software Internet Firewall Service PC with Security Client Software Maintenance Firewall VPN Industrial Ethernet Backbone Local VPN VPN Remote S Security Gate Security Zone S Security Gate Security Zone PROFINET IO PROFINET IO Commissioning Local PROFIBUS DP PROFIBUS DP Remote Customer services PROFIsafe Island PROFIsafe Island Remote Seite 20

20 Safety & Security Seite 23 23

21 IEC Part The hazards, hazardous events and hazardous situations of the EUC and the EUC control system shall be determined under all reasonably foreseeable circumstances (including fault conditions, reasonably foreseeable misuse and malevolent or unauthorised action). This shall include all relevant human factor issues, and shall give particular attention to abnormal or infrequent modes of operation of the EUC. If the hazard analysis identifies that malevolent or unauthorised action, constituting a security threat, as being reasonably foreseeable, then a security threats analysis should be carried out. NOTE 1 For reasonably foreseeable misuse see of IEC NOTE 2 For guidance on hazard identification including guidance on representation and analysis of human factor issues, see reference [11] in the bibliography. NOTE 3 For guidance on security risks analysis, see IEC series. NOTE 4 Malevolent or unauthorised action covers security threats. NOTE 5 The hazard and risk analysis should also consider whether the activation of a safety function due to a demand or spurious action will give rise to a new hazard. In such a situation it may be necessary to develop a new safety function in order to deal with this hazard. Seite 24

22 New considerations ISA and IEC standard in work IEC Functional Security Management SL (Security Level) No security function but SL vectors One value in vector corresponds to one attack Plant specific evaluation Principles similar to IEC Functional Safety Management SIL (Safety Integrity Level) One safety function for one risk (harm) One SIL for one safety function Machine specific evaluation Seite 25

23 Risk reduction according IEC Residual risk Acceptable risk Equipment Under Control risk Increasing Risk Required risk reduction Effective risk reduction Covered with E/E/PE systems Covered with other technologies (not electrical Mechanical, Hydraulical ) Covered with external means and measures. Security measures not excluded! Seite 26

24 IEC TC44 Decision modified Machine safety Risk analysis including security threats Safety: OEM, Machine builder Security threats relevant for safety considerations Safety required F-Measures including security measures and requirements to the environment n Legal requirement Machine Directive Machine builder PL/SIL, * Basic security for new systems Risk analysis only during design phase Transition CE Mark or FAT Security Risk analysis Security: System integrator, Final user Security required Security-Measures and if necessary consequences for safety risk analysis n Free application ISA 99 / IEC Final user SL Risk analysis to be done periodically or as required Seite 27

25 IEC TC44 Plenary London September 2012, confirmed Clearwater 2014 Decision TC 44 considers that security threats identified by the machine manufacturer related to accessible interfaces of electrical devices should be recorded in the documentation accompanying the machine. A risk analysis of the security threats to the machine should be taken by the user who can then take measures to avoid them at the system level. This information should be taken into consideration by TC 44 convenors and will be conveyed to TC 65. Seite 29

26 Practical consequences: Safety related communication to protect people The machine manufacturer identifies accessible interfaces of electrical devices like USB, LAN, WLAN or others interfaces. The machine manufacturer identifies possible type of access (data display, modification/alteration, insertion) regarding type of data (user software, recepts, ) The machine manufacturer describes the results in the information for use of the machine. The device manufacturer describes the security level of these interfaces (SL vector) and internal or external measures to improve the SL (technical data, security handbook ). Final user decides which external measures are requested for his own plant Seite 30

27 Security: Principles similar to IEC ISA and IEC standard in work: IEC Functional Security Management SL (Security Level) No security function but SL vectors One value in vector corresponds to one attack Plant specific evaluation Seite 31

28 Practical work flow Practical work flow: Final user defines the target SL vector from plant specific risk analysis. Resulting measures are implemented from Final User or through designated OEM. Examples of possible measures Inherent secure (no sensible interfaces or no access) Only allowed people can access sensible interfaces (organisational measures, e.g. security guards) Activation of complementary security measures in devices Use of external protection measures Evaluation of achieved SL vector Final user has to perform this workflow cyclically Seite 32

29 Security Management Security Management Process Industrial IT Security Services Risk analysis with definition of mitigation measures Setting up of policies and coordination of organizational measures 1 Risk analysis Security Management Products & Systems Coordination of technical measures Regular / event-based repetition of the risk analysis 4 Validation & improvement 2 Policies, Organizational measures 3 Technical measures Security Management is essential for a well thought-out security concept. Seite 33

30 Security Levels Security levels provide a qualitative approach to addressing security for a zone SL 1 Protection against casual or coincidental violation SL 2 SL 3 SL 4 Protection against intentional violation using simple means with low resources, generic skills and low motivation Protection against intentional violation using sophisticated means with moderate resources, IACS specific skills and moderate motivation Protection against intentional violation using sophisticated means with extended resources, IACS specific skills and high motivation Seite 34

31 Seven dimensions of the SL vector SLs are based on the seven foundational requirements (FRs) for security IAC Identification and authentication control UC Use control SI System integrity DC Data confidentiality RDF Restricted data flow TRE Timely response to events RA Resource availability Seite 35

32 Security Levels vectors: types SL-C CAPABILITY A particular component or system is capable of being configured by an asset owner or system integrator to protect against a given type of threat. SL-T TARGET The asset owner or system integrator has determined through a risk assessment that they need to protect this particular zone, system or component against this level of threat. SL-A ACHIEVED The asset owner, system integrator, product supplier and/or any combination of these has configured the zone, system or component to meet the particular security requirements defined for that SL. Seite 36

33 IEC TC44 Decision modified Machine safety Risk analysis including security threats relevant for safety considerations SILr / PLr Safety required n Machine Manufacturer: Related to effects: death F-Measures including security measures and requirements to the environment Security threats SIL/PL SL-C Security Risk analysis Delivery to final user CE Mark or FAT Device Manufacturer SL-C Vector for devices: PLCs, DCs, PDS/SR SL-T Security required n Final User Related to causes Security-Measures and if necessary consequences for safety risk analysis OEM SL-A Seite 37

34 A solution is a deployed control system to fulfill the protection requirements of a plant Plant environment Asset owner specifies Required protection level of the plant IEC ISA-99 System integrator deploys the control system to Solution Part 3-2 Zones and Conduits Product supplier develops Independent of plant environment Seite 39 PLCs HMIs PC devices Control system as a combination of Network devices Software Part 3-3 System requirements Series Series 4 Components

35 Asset owner IEC / ISA-99 General Policies and procedures System Component 1-1 Security Terminology, management concepts and models process of the asset owner 1-2 Master glossary of terms and Profile abbreviations of ISO System security compliance Patch management metrics process of the asset owner 2-1 Requirements for an IACS security management system Profile of ISO / Patch management in the IACS environment 2-4 Requirements for IACS solution suppliers 3-1 Security technologies for IACS 3-2 Security levels for zones and conduits 3-3 System security requirements and Security levels 4-1 Product development requirements Functional requirements for the the output of the risk 4-2 Technical assessment security requirements for IACS products of the asset owner Definitions Metrics Requirements placed on security organization and processes of the plant owner and suppliers Requirements to achieve a secure system Requirements to secure system components Functional requirements Processes / procedures Seite 40

36 System integrator IEC / ISA-99 General Policies and procedures System Component 1-1 Terminology, concepts and models 1-2 Master glossary of terms and Patch management abbreviationsprocess of the system integrator 1-3 System security compliance 1-3 System security compliance metrics metrics 2-1 Requirements for an IACS security management system Profile of ISO / Patch management in the IACS environment 3-1 Security technologies for IACS 3-2 Security levels for zones and conduits 3-3 System security requirements and Security levels 4-1 Product development requirements Functional requirements for the the output of the risk 4-2 Technical assessment security requirements for IACS products of the system integrator Security documentation, policies and procedures of the system integrator Definitions Metrics 2-4 Requirements for IACS solution suppliers Requirements placed on security organization and processes of the plant owner and suppliers Requirements to achieve a secure system Requirements to secure system components Functional requirements Processes / procedures Seite 41

37 Product supplier IEC / ISA-99 General Policies and procedures System Component 1-1 Terminology, concepts and models 1-2 Master glossary of terms and Patch management abbreviationsprocess of the system and component supplier 1-3 System security compliance metrics Security documentation, policies and procedures of the system and component supplier Definitions Metrics 2-1 Requirements for an IACS security management system Profile of ISO / Patch management in the IACS environment 2-4 Requirements for IACS solution suppliers Requirements placed on security organization and processes of the plant owner and suppliers 3-1 Development Security technologies process for of the IACS component supplier 3-2 Security levels for zones and conduits 3-3 System security requirements and Security levels Functional requirements placed on the Requirements system to a supplier secure system 4-1 Product development requirements 4-2 Technical security requirements for IACS products Functional requirements placed on the component supplier Requirements to secure system components Functional requirements Processes / procedures Seite 42

38 Thank You! Seite 44 44