Design industrial systems on a chip that meet stringent global safety standards

Industrial automation, transportation, smart grid, and many other industries require machinery and products to be safe and certified for functional safety. Flexibility and the incremental cost of safety can be a significant decision factor when developing machinery that must be compliant to worldwide safety standards.

Safety imposes new processes to machinery development as well as an increase in complexity for the electronics within these applications, typically resulting in significantly higher hardware costs and increased time to market. An industrial system on a chip can help engineers save up to 18 months of design time in achieving product certification according to IEC 61508. Having prequalified devices, such as FPGAs, means the designer benefits from the flexibility of FPGAs without having to worry about whether or not the parts can be used for safety applications.

Design Challenges

If companies plan to ship their products into countries that require a certificate from a functional safety assessor to prove compliance with the local safety regulations, such as the new machine builder directive (2006/42/EG) that represents a must-meet requirement for products exported to Europe. They must adopt a safety-oriented approach throughout the whole design process to be competitive as well as compliant. Factory operators also require safe operation of machinery to improve productivity, such as maintenance work that can be executed while part of the machine is still in operation, or significantly shortened ramp-down and ramp-up times.

When a company decides to develop a safe product, it must consider safety as a core system functionality. Historically, safety has been added to the system by additional functionality such as redundant controller or communication modules combined with circuitry to monitor the system. These add-on safety components, introduced as an afterthought into the system concepts, incur significantly higher costs and are less flexible and scalable than designing a safe application that is optimized for safety and cost competitiveness, right from the start.

Design challenges for developing a safe application include:

* Adopting a "safe" design methodology and safety concepts

* Accounting for additional project effort (time and technology), resulting in longer

time to market and higher cost of ownership

* Project management, gathering of data for all system components, and

* Documenting the project according to the needs of the safety specification

The key to successful design is the adoption of validated design methodologies and qualified tools and devices as part of the product, and the consideration of safety right from the start of product development.

Typical Application Steps

Without having safety in mind, there are five typical design steps to develop an application including:

* Architecture development

* Component selection

* Application design implementation

* Integration and test

* Release

The first step, the architecture of the product, is shown in Figure 1. For a typical motor-control application such as a drive, the partitioning step separates the system into system control, communication, and real-time motor control functions. For example, the architect selects a software implementation for the control part and for the real-time portion of the system and decides to use a hardware/software approach for the communications portion to support real-time Industrial Ethernet communication protocols.

Figure 1. Architecture Development

The next step is the component selection (See Figure 2). The decision may lead to an implementation where the control software runs on a standard application processor, the real-time motor control portion is implemented on a digital signal processor (DSP), and the communication within the system uses an FPGA-based approach. An FPGA allows flexibility in the system to realize such various Industrial Ethernet standards as Ethernet/IP, EtherCat, PROFINET, or SERCOS III in the same device interchangeably. This flexibility for the communication part of the architecture allows use of a standard hardware platform that can be customized for the specific protocol needs of the end customer very easily.

Figure 2. Component Selection

After deciding on the partition and components, design teams will work on the development of their part of the application independently. Then, they will integrate the components to a full system, test system functionality, and release the product.

Adding Safety

If the design is developed with functional safety as part of the product requirements, additional phases will need to be added to the project, as shown in orange in Figure 3.

Designing a safe application that is able to achieve a functional safety certification such as IEC 61508, project complexity increases significantly. The IEC 61508 specification covers the complete safety life cycle, from developing the application to decommissioning it. To simplify communication with the assessor, companies should follow the procedures and processes outlined in the safety standards, ensuring they clearly understand the objectives, concepts, procedures, and solutions to meet safety requirements.

Project Startup and Risk Analysis

In the project startup and risk analysis phase, the scope for safety is identified based on the general application. The desired and achievable Safety Integrity Level (SIL) is determined, formulated, and documented for the implementation stages, and acts as the basis for risk analysis and assessment. Risk analysis provides the foundation for later measurements, represents an understanding of the product’s boundaries, and closely links to the product’s scope definition. It provides a base for the required SIL, a detailed definition of the safety function, and the framework of the product documentation. This must happen on the component and system levels.

Architecture Development

Next designers develop the architecture to meet functional and safety requirements. They refine the safety requirements and document both specific functions to be realized during operation, maintenance work, and the strategies that must be followed to validate that the safety measures meet requirements.

Safety Requirements Specification

For a safe drive, the project scope might include several aspects such as identifying whether the drive parameters are in the allowed range, or if a safety I/O signals a critical event. The most basic safety feature for drives is “safe torque off” (STO), in which the motor is disconnected from the power supply in a safe way. The procedure also might include communicating to the overall automation system that a safety event occurred and the measures that must be taken within a specified period, such as a sequential shut down of a whole application following a series of steps.

Validation, Verification Plan

Development of the validation plan may include methods of controlled failure insertion to test the system and additional monitors that observe the system to compare the current parameter to a range of predetermined, allowed values.

Component Selection, Component, IP, and Tools Qualification

While component selection is part of a typical project, designers must ensure the components and IP functions are suitable for use in a safe application. It is important to consider the residual error probability, which is used as a basis to calculate the product’s total failure-in-time (FIT) probability and the achievable SIL. This can be accomplished partially through gathering device and design tool data on widely used products that are more likely to be sufficiently free of systematic errors or proven in use (IP, for example), or reports that provide error rates and reliability information for semiconductor products like processors or FPGAs.