Functional safety minimizes the risk of injuries and damages in human-machine interactions, redundancy and multi-channel data processing ensure high availability and prevent catastrophic malfunctions. While obtaining certification for safety-relevant control systems remains the responsibility of systems manufacturers, they can obtain certification-friendly System-on-Modules and an application-ready hardware platform from MicroSys to help them develop application specific safe solutions for highly automated machinery and plant faster.

Safety increases Productivity

For several decades, Safety circuitry involved hard-wired solenoid switches and was fully independent of the equipment’s control system. This hampered flexible reactions beyond a sudden system shutoff. The circuitry’s lack of flexibility also made it difficult to modify or expand the protected equipment. Increasingly complex, often modular machines with the ability to rearrange during operations to adapt to changeable requirements require differentiated reactions to various protection violations. Moreover, fencing in production lines or cells is not always easy. For mobile machines or transport systems in particular, this is no feasible option at all, while their rising degree of automation causes the safety requirements imposed on their control systems to skyrocket.

Consequently, programmable safety controllers have become the standard. Connected to advanced safe sensors, these allow designing both user-friendly and effective safety systems. Time-of-Flight (ToF) cameras and 360° Laser scanners, for instance, facilitate safe person and object recognition as the foundation for safe autonomous guided vehicle (AGV) or autonomous mobile robot (AMR) operation.

In state-of-the-art FuSa concepts, the safe PLC exchanges data with I/O modules, sensors and actors via field busses. Albeit in Ethernet-based networks, data usually travel via the “Black Channel”. Safety data protocols eliminate potential sources of error along the transmission path, for instance by keeping data in the telegrams redundant and protecting them by checksums or encryption. This allows acknowledging messages and periodically validating the correct function of the transmission path.

Safety enhances freedom

This also makes it possible to place safety PLCs and I/O modules connecting the sensors anywhere in the system. Furthermore, current electric drives come with safe functionality according to EN 61800-5-2 such as Safe Torque Off (STO), Safe Direction, Safely Limited Speed (SLS) or Safely Limited Acceleration (SLA), offering a variety of alternatives to a shutdown.

Availability is Safety

While it is good practice to get industrial machinery into a defined state with a reduced hazard potential, in many other applications there is no such state. Consider an engine or tailplane failure in a flying airplane, failing brakes in a train or a malfunctioning steering in an automobile.

Cases like these require a different form of safety, that is to say, high availability as protection against system failure. So-called failsafe systems are usually designed using redundant computer systems. Their architectures reach from a simple duplication of processing channels with information redundancy (both processors have access to input and output data) to multiple redundant dissimilar systems with 5-15 computers, various fallback levels, and emergency operation modes in aviation.

Dissimilarity of processing channels is particularly well sought after in applications with a very high risk potential such as aviation, but also for applications in industrial and rail applications requiring high safety levels (SIL3, SIL4). In order to counteract single event upsets, memory failure, common-cause failures or cascading errors that are difficult to resolve, different processor types are typically used for the redundant processing channels. This also protects against faulty batches. In view of target failure rates below 10-9 or 10-10 per operating hour, this should also be considered.

Modular Safety

Off-the-shelf safety systems from many automation system manufacturers are certified according to IEC 61508 and a good choice for the safe design of industrial plant or machines. For many other tasks and for the design and production of such Safety CPUs, it is necessary to start from a different hardware level.

MicroSys miriac® SoMs have all prerequisites preventing hitting hardware-related obstacles during the certification process, appropriate external circuitry and software provided. This includes features like separate power supply monitoring that also facilitates implementing an independent watchdog timer. For the miriac®-SoMs, MicroSys exclusively uses components qualified to the strict AEC-Q100 automotive standard to cover elevated requirements in terms of the manufacturing quality of the semiconductors. As the application software has a main influence on the certifiability of computer systems, however, other than safety sensors, SoMs are not available as pre-certified safety elements.

What makes the electronics a ready-to-install comprehensive system is the specifically designed enclosure. Rated IP68 for dust and water resistance, it serves not only to protect the electronics but also for heat dissipation. In spite of the extremely high performance and the multitude of interfaces, MicroSys managed to keep the power consumption of the fully equipped unit below 60 W, so the passive device comes without fans or other active cooling.

“With this Autonomous Control Unit based on the miriac® MPX-LX2160A SoM, MicroSys offers a ready-to-install, modular and scalable hardware platform for the automation not only of mobile machinery”, MicroSys Managing Director Ina S. Schindler confirms. “System design engineers can fully concentrate their focus on software design.”