Platforms for Functional Safety With modular hardware architectures for future-proof functional safety

Related Vendors

MicroSys Electronics GmbH

FAULHABER Drive Systems

Wuxi InfiMotion Technology Co., Ltd.

Functional safety reduces the risk of injury and damage in the interaction between humans and technology. Certification-friendly modules and a dedicated hardware platform can simplify the development of safe, automated machines and systems.

*Engineer Peter Kemptner is an independent marketing service provider and specialist editor in Salzburg/Austria.

Devices, vehicles, machines, and systems are highly automated today, exchanging data and interacting with each other, sometimes completely autonomously. The Internet of Things accelerates this trend. Nevertheless, there is always direct or indirect interaction between humans and machines.

A crucial prerequisite for the use of automated systems is their safe operation. Therefore, functional safety (Functional Safety; short: Fusa) plays a central role in all technical sectors, from power plants and transport systems to industrial facilities, medical technology, and household and entertainment devices.

Gallery

Gallery with 5 images

To reduce the risk of injuries and damage, Fusa must prevent malfunctions due to design, production, or documentation errors, operational exceptional situations, and misoperations, and put the system into a safe state. To minimize the risk of injury, machinery and equipment manufacturers restrict human access to the moving components of complex machines. A breach of protection by opening doors or covers, as well as activating an emergency stop switch, leads to the shutdown of the system.

Safer and more productive

For a long time, safety circuits were implemented through hard wiring in relay technology. These were completely independent of the control electronics and made it difficult to have flexible reactions beyond a sudden system shutdown. Additionally, their lack of flexibility made it difficult to modify or expand the protected systems. Increasingly complex machines and systems, often modularly constructed and changeable during operation, require a more differentiated response to various protection breaches. Moreover, it is not always simple to fence in machines or systems. This option is not available especially for mobile work machines or transport systems, while their increasing degree of automation raises the safety requirements for their control systems.

As a result, freely programmable safety controllers have now become standard. Along with these, advanced safety-oriented sensing technology forms the basis for both user-friendly and effective safety engineering. Devices such as 360° laser scanners and Time-of-Flight (ToF) cameras enable more secure detection of objects and people, serving as the foundation for the safe operation of Automated Guided Vehicles (AGVs) and Autonomous Mobile Robots (AMRs).

In modern Fusa concepts, data exchange with I/O modules, sensors, and actuators is carried out via data buses. In Ethernet-based networks, the Black-Channel principle is commonly applied, where potential sources of error in the transmission path are intercepted by safety data protocols. At the telegram level, for example, data is duplicated and protected by checksums or cryptographic measures. This allows messages to be confirmed and the transmission path to be periodically checked for function.

With safety more freedom

This allows safety-oriented controls and I/O modules for connecting sensors to be placed anywhere in the system. Additionally, today's electric drives offer numerous alternatives to mere shutdown with safety-oriented functions according to EN 61800-5-2, such as Safe Torque Off (STO), Safe Direction (SDI), Safe Limited Speed (SLS), and Safe Limited Acceleration (SLA).

The use of these softer mechanisms to protect personnel helps, among other things, to avoid damages caused by abrupt safety shutdowns. A safe state without complete shutdown facilitates setup operations and enabled the development of collaborative industrial robots, known as cobots. These are sufficiently safe to work hand in hand with human colleagues, even without separate protective devices.

Through the common bus, the non-safe control unit can also query the current state of the safety sensors. This allows for easy commissioning or diagnostics during fault conditions. Moreover, in the event of safety-related shutdowns, problematic plant conditions in the pre or post sequences can be prevented through appropriate process adjustments. A parametrizable and thus modifiable Fusa programming can also allow for needs-based changes to the configuration of modular machines or systems, enabling them to meet the challenges of Industry 4.0.

Safety through availability

While it is common practice for industrial machines and plants to bring them into a defined state with reduced hazard potential, such a state often does not exist at all in other applications. Consider an engine or control failure in a flying airplane, a brake failure in a train, or a steering malfunction in an automobile.

Such cases require a different form of safety, namely protection against system failure through high availability. This so-called fault tolerance is usually achieved through redundantly configured computer systems. This can range from a simple duplication of computing channels with information redundancy—both having access to input/output data—to multiple redundant-dissimilar systems with 5-15 control computers, featuring various fallback levels and emergency operating modes in the aviation sector.

Dissimilarity in computing channels is particularly sought after in applications with very high hazard potential, such as in aviation, but also for applications in the highest safety levels, SIL3 and SIL4, in industrial and railway applications. To address single-event upsets, memory errors, or particularly difficult-to-resolve error cascades, as well as common-cause failures, different processors are typically used in the redundant computing channels. This also protects against batch errors from a manufacturer, which must be considered when target failure rates are below 10^-9 or 10^-10 per operating hour.

Modular Safety

For the safety-oriented design of machines or systems for industrial production, commercially available safety systems certified according to IEC 61508 from established automation system manufacturers are suitable. For many other tasks, as well as for the development and manufacturing of these Safety CPUs, it is necessary to approach it from a different hardware level.

As a more economical and less risky alternative to a complete redevelopment from the semiconductor up, the use of System-on-Modules (SoMs) is often advantageous. These modules offer the benefit that system manufacturers do not need to grapple with the complex processor-proximate issues and those reaching deep into physics given today's clock rates when developing electronic assemblies. This allows them to focus on software development and managing manageable interfaces at the module boundaries during system development.

The Bavarian manufacturer Microsys Electronics, as a Gold Partner of the European processor manufacturer NXP, develops and produces SoMs based on its processor technology. "Modern multicore processors from NXP like the S32G are not only very powerful but are better suited than many others for the development of safe control systems due to their specific architecture," explains Jörg Stollfuß, Field Application Engineer at Microsys Electronics. "On this basis, we created easy-to-integrate modules with a certification-friendly design as an alternative to proprietary Fusa developments at the board level."

The Miriac SoMs from Microsys come with all the necessary provisions to avoid hardware-related barriers on the path to certification, when paired with appropriate external circuitry and software. This includes features such as separate monitoring of the power supply, which also enables the implementation of an independent watchdog timer. Additionally, Microsys installs components in the Miriac SoMs that are qualified according to the strict automotive standard AEC-Q100 to cover increased demands on the manufacturing quality of semiconductors. However, the application-specific software significantly influences the certifiability of computer systems. Therefore, unlike safety-oriented sensors, SoMs are not available as pre-certified generic safety elements.

Application Ready Platform

The multi-core processor architecture of modern processors does not readily allow for the parallel execution of safe and non-safe applications (mixed-criticality) on a single processor. Furthermore, due to the various common-cause failure potentials and the general base failure rate of complex semiconductors, it is even less suitable for constructing redundant systems or multi-channel systems for highly secure applications based on a single processor.

Therefore, Microsys developed the hardware for a task-specific, but not customer-specific, control platform as a ready-to-install complete system, initially primarily for mobile work machines. The core product is a carrier board that, besides the central Miriac MPX-LX2160A, has three M.2 slots that can be used for up to three SSD storage modules or one to two Hailo-8 AI processor modules. Optionally, an expansion with a Miriac MPX-S32G274A or Miriac MPX-S32G399A is considered. In this way, it can achieve very high computing power for complex tasks or alternatively maintain an independent, dissimilar internal computation channel. This setup can achieve the safety level SIL 3.

A new enclosure has also been developed that transforms the electronics into a ready-to-install complete system. Dust and waterproof to IP 68 standards, it serves not only to protect the installed electronics but also for heat dissipation. Microsys has managed to limit the power consumption of the fully equipped unit to 60 watts, despite the extremely high processing power and variety of interfaces, and dissipate it completely passively, enabling the device to operate without fans or other active cooling systems.

"With this Autonomous Control Unit based on the SoM module Miriac MPX-LX2160A, Microsys not only offers manufacturers of mobile work machines a ready-to-install, modularly expandable hardware platform for the automation of their products," confirms Ina S. Schindler, Managing Director of Microsys Electronics. "Therefore, they can fully concentrate on the development of the software."

This article was first published on our sister website