Is it a machine or a system?

Paul,


The scope of the question you have raised is quite wide, and I may have misunderstood what you mean by "distributed system".


This a summary of my approach and understanding... 


Being from a control and automation background I would tend to always use the term distributed control system (DCS). This will normally be a highly complex networked and distributed computer control and automation system that could be running in continuous or batch mode or both. Even if the wider system has multiple parallel production streams, each with an identical distributed control system, there will still normally be just one upper level supervisory [database] system interfacing with an internet based ordering system or other higher level business management tasking and production scheduling system. In the final analysis there is one big distributed control system. The term SCADA (Supervisory Control and Data Acquisition) is often used for smaller systems in this class. 


These are generally very complex control systems, classed as safety related systems at best. As such they cannot be directly relied on to guarantee operator or maintenance staff safety. If a crane moving in a crane isle is fitted with a sensor to detect obstacles, including a person in its path, then this safety system should operate completely independent of the main distributed control system, including its failure modes. There is no need to distribute the safety function because the crane motor, braking system and obstacle detection system are located in the same device. 


The safety systems (including hardware interlocks emergency stop isolation etc) are simple systems that provide the physical constraints to what the DCS can do. They are normally defined independently of the DCS, so that difficult to resolve questions in regard to operating context don't apply. [Context is more relevant to active safety systems required for aircraft fly by wire systems (keep going best endeavor until you land), rather than passive fail-safe systems that generally apply in manufacturing facilities or automated warehouses.]


Similar ideas can apply to layered cyber security protections as well. For example, if there are hardware settings which if altered maliciously or otherwise could lead to the damage of hardware and thus significant cost and downtime, then I think consideration should be made to fully partitioning these hardware limits/constraints to make them independent of changes/bugs/failures to the DCS control space.


James

Paul,


The scope of the question you have raised is quite wide, and I may have misunderstood what you mean by "distributed system".


This a summary of my approach and understanding... 


Being from a control and automation background I would tend to always use the term distributed control system (DCS). This will normally be a highly complex networked and distributed computer control and automation system that could be running in continuous or batch mode or both. Even if the wider system has multiple parallel production streams, each with an identical distributed control system, there will still normally be just one upper level supervisory [database] system interfacing with an internet based ordering system or other higher level business management tasking and production scheduling system. In the final analysis there is one big distributed control system. The term SCADA (Supervisory Control and Data Acquisition) is often used for smaller systems in this class. 


These are generally very complex control systems, classed as safety related systems at best. As such they cannot be directly relied on to guarantee operator or maintenance staff safety. If a crane moving in a crane isle is fitted with a sensor to detect obstacles, including a person in its path, then this safety system should operate completely independent of the main distributed control system, including its failure modes. There is no need to distribute the safety function because the crane motor, braking system and obstacle detection system are located in the same device. 


The safety systems (including hardware interlocks emergency stop isolation etc) are simple systems that provide the physical constraints to what the DCS can do. They are normally defined independently of the DCS, so that difficult to resolve questions in regard to operating context don't apply. [Context is more relevant to active safety systems required for aircraft fly by wire systems (keep going best endeavor until you land), rather than passive fail-safe systems that generally apply in manufacturing facilities or automated warehouses.]


Similar ideas can apply to layered cyber security protections as well. For example, if there are hardware settings which if altered maliciously or otherwise could lead to the damage of hardware and thus significant cost and downtime, then I think consideration should be made to fully partitioning these hardware limits/constraints to make them independent of changes/bugs/failures to the DCS control space.


James