Functional safety in networked industrial environments can have challenges, particularly within a cyber-physical system network of 6-axis robot arms used in automotive assembly. Using a real-time operating system (RTOS) and hypervisor can help with convergence of safety and cybersecurity requirements in such interconnected systems.
Insights
- IEC 61508-1 standard for functional safety outlines the principles, processes and documentation required throughout the safety lifecycle, from the initial design concept to decommissioning, ensuring that the system functions correctly and prevents hazards.
- The processor architectures can include numerous safety features essential for SIL-certified applications compliant with IEC 61508. PikeOS fulfils the requirements of IEC 61508, specifically those described in IEC 61508-3 Annex F, and it is flexible enough to allow communication between partitions if needed, depending on the specific application design.
- Hardware and software stack for safety-critical industrial applications can include a real-time operating system (RTOS) and hypervisor to help.
Modern industrial applications increasingly rely on Electrical/Electronic/Programmable-Electronic (E/E/PE) systems for various tasks, including safety-critical operations in areas such as automotive production. Ensuring the functional safety of these systems, as mandated by standards like IEC 61508 and its industry-specific derivatives, is paramount for operator protection and risk minimization. There are challenges around achieving functional safety in networked industrial environments, particularly within a cyber-physical system network of 6-axis robot arms used in automotive assembly. There is a growing convergence of safety and cybersecurity requirements in such interconnected systems; using a real-time operating system (RTOS) and hypervisor can help.
IEC 61508: Functional safety overview
The IEC 61508 standard is foundational to all functional safety aspects of electrical, electronic and programmable-electronic (E/E/PE) embedded systems in industrial automation. IEC 61508-1 is the first part of the standard that specifies the general requirements for functional safety. It outlines the principles, processes and documentation required throughout the safety lifecycle, from the initial design concept to decommissioning, ensuring that the system functions correctly and prevents hazards. IEC 61508-2 and IEC 61508-3 prescribe suitable measures to prevent systematic hardware and software errors during all project phases.
A key concept within the IEC 61508 standard is the classification by safety integrity levels (SILs), which lays the foundation for ensuring system safety. SILs range from 1 (lowest criticality) to 4 (highly critical). The SIL classification also distinguishes between operation in high-demand mode (safety function triggered regularly) and low-demand mode (safety function triggered less than once per year). IEC 61508 provides precise probability specifications for these modes.
There are several industry-specific variants of the ISO 61508 standard that specifically address certain group safety standards like medical electrical equipment, household appliances, transportation, and more. Within the industrial setting, there are further targeted product safety variants for things like programmable controllers (PLCs) (IEC 61131-6) and emergency stop buttons (ISO 13850). Also, ISO 13849, widely used in various industrial applications, focuses on machine safety. The most specific standard takes precedence.
Along with functional safety, cybersecurity plays a crucial role in modern networked devices, particularly with the advent of Industry 4.0. While different from safety, these two areas closely influence each other, and ensuring functional safety requires a certain level of cybersecurity.
Networked systems introduce attack scenarios that can have serious consequences. Although IEC 61508 touches on the topic of security, it does not make concrete specifications. However, with Directives like NIS2 and the Cyber Resilience Act (CRA) and the specific threat situation, a security architecture is no longer just an accessory, but a legal requirement and is urgently needed.
Both areas, while different, closely influence each other. To illustrate how these concepts are implemented, consider a typical cyber-physical system network of 6-axis robot arms in automotive production.
Industry 4.0: Robotic Arms
Electronically programmable systems, such as articulated robotic arms, are extensively used in the automotive industry for tasks ranging from assembly and welding to painting and quality inspection. These workhorses perform repetitive tasks with high accuracy and speed, reducing human errors and improving product quality, leading to increased efficiency and precision.
With Industry 4.0 in full swing, these once standalone robotic arms are connected via a highly integrated network for efficient coordination and communication. The technical specifications for such a system are extensive. The robot arms require real-time performance to react quickly to sensor information for precise movements, crucial for high-precision assembly and avoiding collisions. Synchronised coordination maximises assembly line efficiency.
Regarding safety requirements according to IEC 61508, the robots must be developed and certified according to the required SILs. This necessitates a comprehensive analysis to identify and mitigate all potential safety risks. A risk scenario, for instance, could be fragments flying through the assembly hall and injuring people in the event of a collision. This mandates safety mechanisms like emergency stop functions, limit sensors to prevent overloading, and potentially a vision application for safe coordination.
Cyber-physical integration relies on advanced control systems and algorithms. Protocols like OPC Unified Architecture (OPC UA) over Time-Sensitive Networking (TSN) and EtherCAT (Ethernet for Control Automation Technology) are used for real-time communication. These protocols also create the foundations for the implementation of cybersecurity resilient systems.
Implementing such a system requires functional safety-compliant hardware and software to meet real-time requirements. Virtualization technology can be leveraged for workload consolidation. The necessary foundation includes a system-on-chip (SoC) with sufficient performance to execute multiple safety-critical processes in parallel and a suitable execution environment to orchestrate this on the software side.
Functional safety at the hardware level: The processor
The processor is a crucial part of a system, especially for the controller, and its complexity requires a proper understanding of its internal workings. This includes knowledge of failure rates, distribution, and how hardware, firmware, and software manage or avoid dangerous faults. Shared silicon parts demand attention to address common cause failures and ensure freedom from interference.
Intel designed the x6000FE series processors specifically for functional safety applications. These processors incorporate several new silicon features to ensure hardware failures are detected and reported in a timely manner, allowing the system to transition to a safe state. These features, known as Intel Silicon Integrity Technologies, include ECC, parities, CRC, error reporting, and on-demand proof test flows that check the health of SoC blocks used by safety-critical applications.
Dedicated mechanisms are included to handle faults on shared parts that could cause common cause failures. A dedicated Intel Safety Island is integrated into the SoC, responsible for orchestrating internal diagnostics, monitoring, collecting, and reporting faulty conditions outside the silicon. It also provides features like error logging. Additional diagnostic software, such as the Pre-OS Checker (POSC), helps achieve the required diagnostic coverage and safety targets for IEC 61508 and ISO 13849. The x6000FE series safety package thoroughly documents these features.
The x6000FE series has been assessed and certified by a third-party agency for single-chip solutions up to SIL 2 according to IEC 61508 and Category 3 Performance Level according to ISO 13849. This certification provides system integrators with confidence when building solutions upon this silicon and comes with a safety package that thoroughly documents all the safety features.
Functional safety at the software level: The execution environment
Many providers offer execution environments that separate the real-time operating system (RTOS) and hypervisor. Some software combines both features. This combination allows several real-time capable applications to run in parallel without interference. This is achieved by separating resources in space and time, reserving memory blocks for predefined application blocks, known as partitions or personalities.
The safety concept of the combined software dictates that partition information must be defined in advance in a master partition, preventing runtime changes. This is an essential prerequisite for deterministic application behavior. For example, partitions could host motor control for a robot arm, communication via OPC Unified Architecture over IEEE Time-sensitive networking (TSN), health monitoring or a vision application. [TSN, IEEE 802.1Q, provides deterministic messaging on Ethernet.]
The critical factor is that the combined RTOS and hypervisor fulfils the requirements of IEC 61508, specifically those described in IEC 61508-3 Annex F. This annex requires temporal and local independence for software running on the same hardware to prevent interference.
Look for a RTOS that is certified at the highest level for software, SIL 3, following IEC 61508. The software should be flexible enough to allow communication between partitions if needed, depending on the specific application design. Beyond safety, the RTOS should have robust security features, meeting requirements of the Common Criteria Security standard at the high EAL 5+ level for various architectures. This framework is used for evaluating and certifying security features. The RTOS can help with most of the higher EAL 6 and 7 levels, including the AVA_VAN class at EAL 7 (vulnerability analysis). Such comprehensive security architecture is designed to prevent attacks resulting from networking and physical access, using an elaborate privilege system that even covers side-channel attacks.
Safety interacts with other system requirements
Fulfilling safety standards like IEC 61508 is a fundamental and demanding undertaking for any safety-critical project. As systems become more networked and complex, safety does not persist in isolation but interacts closely with other system requirements such as cybersecurity and real-time performance. Ongoing market trends will continue to shape the industry, demanding solutions that address this convergence effectively.
Selecting the right components can substantially reduce the time to market and minimize investment risk. The combination of the Intel Atom x6000FE processor series and RTOS and hypervisor software provides ideal building blocks to tackle the challenges of complex safety projects in this evolving landscape. With certifications up to SIL 2 for the hardware and SIL 3 for the software, coupled with advanced cybersecurity features, this platform demonstrates excellence in delivering innovative and competitive solutions while being at the forefront of safety and security trends.
Franz Walkembach is vice president marketing and alliances at Sysgo. Edited by Mark T. Hoske, editor-in-chief, Control Engineering, Arrowfly, [email protected].
Keywords
Functional safety, real-time operating systems, embedded systems
Consider this
Do your hardware and network architectures support safety?
You also might like
Control Engineering provides more on machine safety and on virtualization.
https://www.controleng.com/mechatronics/machine-safety
https://www.controleng.com/digital-transformation/virtualization-cloud-analytics
For more information from Intel and Sysgo, see a joint whitepaper, “Building a functional Safety-compliant Industry Solution for IEC 61508” by Matteo Salardi (Intel) and Franz Walkembach (Sysgo).
