GB/T 47698-2026Industrial internet - Specification for the safety integrity assessment of collaborative manufacturing platforms (English PDF)

7.1 General Requirements

7.1.1 The expected functions to be performed by the collaborative manufacturing platform should be identified and clearly defined.

7.1.2 Based on the functions defined by the collaborative manufacturing platform, the platform should be divided into modules, and the specific unit modules included in each function should be clearly defined.

Note 1: A trade-off needs to be struck regarding the granularity of the functional module decomposition. If the granularity is too large, the coupling between security functions will be stronger, potentially leading to the corresponding modules only being able to... Achieve higher SIL targets. Note

2.The platform's internal functions, external interfaces, operating assumptions, and user manuals must be clearly described, and the collaborative manufacturing platform itself must be clearly listed. Specific items in the security integrity risk assessment include, for example, fault detection items in the platform's operating hardware environment, software self-test functions, and security input. Items such as security output items and cybersecurity threat items are described in documents such as architecture design and security requirements specifications.

7.1.3 The safety status, failure conditions, internal functions, external interfaces, operating assumptions, and usage conditions of all modules should be analyzed and determined. Items, etc.

7.1.4 Match all identified security functions of the collaborative manufacturing platform with the participating modules.

7.2 Safety Criticality Classification Criteria Each security function should be classified into security criticality levels for its respective functional module. Based on the mode of impact, security criticality can be categorized into... There are 3 levels, see Table 1.

7.3 Safety Criticality Classification Process and Methods

7.3.1 The safety criticality classification process is shown in Figure 5.

7.3.2 Safety criticality assessments should be conducted based on the hierarchical process shown in Figure

5.Hypothetical analysis assessment methods can be used, assuming deviations from the established criteria, and then analyzing the results. To assess whether it will lead to danger, the safety criticality assessment process is shown in Figure 6. Figure

7.4 Determination of Module Security Integrity Requirements

7.4.1 The SIL for each safety function should be determined according to Chapter 6, as well as the safety criticality of each module within the safety function, in accordance with the specifications in Table 2. Define the SIL requirements that each module should meet.

7.4.2 The premise for meeting the requirements of Table 2 is that different modules have sufficient independence. If the independence between two or more modules is difficult to achieve... If valid proof is obtained, then all associated modules should meet the highest SIL requirement.

7.4.3 In accordance with the requirements of GB/T 20438.1-2017, GB/T 20438.2-2017, and GB/T 20438.3-2017, determine the module's... Its security and integrity requirements include the security-related performance requirements of the module and execution time limits.

8.1 General Requirements

8.1.1 An evaluation should be conducted on all modules assigned SIL requirements to confirm that each module has correctly implemented its component safety functions. Yes, and it meets the corresponding safety and integrity requirements.

8.1.2 In accordance with the requirements of GB/T 20438.2-2017, the security-related modules of the collaborative manufacturing platform should be inspected from at least the following aspects. Security integrity capability assessment. hardware security integrity, system security integrity, behavior when a fault is detected, and secure data communication.

8.1.3 It should be assessed whether the platform has implemented sufficient information security protection measures, including.

a) Information security protection designs were developed based on typical industrial or sectoral requirements; Note

1.Such as the requirements of graded protection, and the requirements of industrial control information security standards such as GB/T 42456.

b) It should be analyzed whether the failure of different information security attacks may have a negative impact on security functions, and it should be determined whether all security functions have been adequately protected. Appropriate protection; Note

2.Consider using appropriate threat/vulnerability analysis methods.

c) It should be analyzed whether the designed information security protection measures themselves may have unacceptable negative impacts on the execution of security functions.

8.2 Hardware Security Integrity Assessment Conduct hardware security integrity assessments in accordance with the requirements of sections

7.4.5 of GB/T 20438.2-2017.

Note. During the hardware security integrity assessment, it is necessary to consider that the collaborative manufacturing platform hardware may be a computer server, and the detection of its random failures is also important. Control may need to rely more on software.

8.3 Systemic Security Integrity Assessment

8.3.1 Conduct system security and integrity testing in accordance with the requirements of

7.4.7 of GB/T 20438.2-2017 and GB/T 20438.3-2017. Sexual assessment.

8.3.2 Based on compliance with 8.3.1, the following points should be emphasized in the design of collaborative manufacturing platform software.

a) Has the software code been tested and proven to comply with the relevant security coding standards? For any code that does not comply with the standards, sufficient [security measures should be taken]? Explain the rationale behind it.

b) In addition to the security function code, does the software itself have sufficient security mechanisms in place, such as defensive programming, code processing, etc. Program sequence monitoring, etc.; the ability of these security mechanisms to control software errors and random hardware failures should be analyzed and evaluated. Whether it is sufficient, for example, whether the corresponding diagnostic coverage has been achieved.

c) Design independence between different SIL modules or between security- and non-security-related modules; analysis of the impact of low-SIL modules on high-SIL modules. Do security-related modules, and non-security-related modules, have any unacceptable negative impacts on security-related modules?

8.3.3 Based on compliance with 8.3.1, the following points should be emphasized in the evaluation of collaborative manufacturing platform software verification.

a) Have software failure analyses been conducted on SIL2, SIL3, and SIL4 modules to demonstrate their effectiveness against reasonably foreseeable errors? Protective measures for each part;

b) Has the software code undergone sufficient testing, including static and dynamic testing? Does the dynamic testing meet the requirements? Test coverage as specified in GB/T 20438.3-2017;

c) Whether the tools involved in software development have undergone sufficient applicability verification.

8.4 Evaluation of behavior when a fault is detected

8.4.1 Conduct an assessment of the behavior when a fault is detected in accordance with section

7.4.8 of GB/T 20438.2-2017.

8.4.2 Assessments should be conducted on a per-function basis for each safety feature of the collaborative manufacturing platform to confirm its performance under various fault detection conditions. The block state, output status, action or duration, and additional constraints meet the requirements.

9.2.1 Inspection

9.2.1.1 Inspection is the foundation for assessing the security integrity of an industrial internet collaborative manufacturing platform. Inspection activities are conducted to confirm whether it complies with [the requirements of the platform]. Relevant standards, design requirements, and safety specifications, including document review, configuration review, and on-site inspection.

9.2.1.2 Document review should include the following activities.

a) Check whether the platform architecture design, security function specifications, hardware/software technical documents, interface definitions, etc., are complete and clearly defined. SIL requirements and safety measure design;

b) Review network security management documents, emergency plans, change management processes, personnel training records, etc., to confirm the compliance of the security management mechanism. Sex and effectiveness;

c) Verify previous assessment reports, incident analysis reports, and the implementation of corrective measures to confirm that historical issues have been closed-loop resolved.

9.2.1.3 The configuration check should include the following activities.

a) Check whether the equipment selection, network architecture, and security configuration of software components (such as operating systems and industrial control software) meet the design requirements. Please check whether there are any high-risk vulnerabilities, unauthorized hardware access, or software modifications.

b) Whether network security equipment meets the requirements for isolation, protection, and auditing; whether communication protocols have enabled data encryption, identity authentication, and integrity checks. Security mechanisms such as integrity checks.

9.2.1.4 On-site inspections should include the following activities.

a) Conduct on-site inspections to verify that the installation and wiring of industrial control equipment comply with safety regulations, and that environmental conditions (such as temperature, humidity, and power supply stability) are adequate. Meets equipment operating requirements;

b) Check the operation logs and maintenance records to confirm whether the personnel's operation procedures are standardized and whether there is any risk of unauthorized access or misoperation.

9.2.2 Analysis

9.2.2.1 Analysis is a systematic approach to identify potential hazards, assess risk levels, and verify the effectiveness of safety measures; it is essential for platform security. A necessary basis for integrity assessment.

9.2.2.2 The analysis should include the following activities.

a) Use methods such as HAZOP and FMEA to perform risk and failure mode analysis to identify hazardous events (such as data tampering, communication interruption). The transmission routes and scope of impact of [various pathogens], etc., should be analyzed, and their probability of occurrence and severity of consequences should be assessed.

b) Based on the safety criticality classification results, analyze the direct impact of the failure of C3-level modules on the overall safety function, and the impact of the failure of C2-level modules... Risk of failure when the block is combined with other components;

c) Calculate the average failure probability of each module and verify whether it meets the target SIL level;

d) Analyze the impact of network attacks (such as denial-of-service attacks, malicious code injection, etc.) on functional safety, and evaluate information security protection measures. Whether to avoid negative impacts on functional safety.

9.2.3 Testing

9.2.3.1 If on-site testing of the collaborative manufacturing platform is required, the environmental conditions specified in

5.2.2 should be analyzed in detail before conducting on-site testing. Environmental constraints were considered to confirm that the action would not affect the normal production process.

9.2.3.2 Tests may include the following types.

a) Functional testing. Verify the compliance of safety-related functions with normal/abnormal operating conditions;

b) Penetration testing. Simulating network attacks to verify the effectiveness of the information security protection system;

c) Fault insertion test. Verify that it meets the corresponding fault detection capabilities and behavioral guidelines after a fault is detected;

d) Stress testing. Evaluate system stability under high load conditions;

e) Recovery test. Verify the system's ability to enter a safe state after a failure occurs.