Software and Firmware Based Safety Controllers

(as presented at the Robots 2004 Conference, June 9 and 10, 2004)

Many manufacturing companies are looking for ways to implement safety while maintaining if not even increasing production.  They desire a more robust system that meets the needs of control reliability, but with the added benefits of faster troubleshooting, reduced installation time, and at an affordable cost.  As automation systems have become larger and more sophisticated, new developments in safety control systems have also changed to accommodate these new challenges.  The technology has been developed and proven to effectively and safely monitor the demands of complex or large systems. 

Technological advances have opened up new questions as companies update their production lines to ensure employee safety.  Are safety-related software and firmware-based controllers reliable and a proven technology?  How do they work so they guarantee safety?  How do they prevent tampering or bypassing that could cause a hazard?  Section 6.4 of the ANSI/RIA R15.06-1999 allows safety-related software and firmware-based controllers to be used as long as they meet three criteria: any single safety related failure will lead to a shut down and prevent subsequent operation until corrected, they supply the same degree of safety as hardware/hardwired solutions, and are certified by a Nationally Recognized Testing Laboratory to an approved standard applicable for safety devices.
 
Differences Between a Conventional PLC and Safety-related Software and Firmware-based Controllers

Technology and Responsibility 
With a standard non-safety PLC (Programmable Logic Controller), safety relays are needed  to monitor safety devices.  Multiple and different models of safety relays may be needed to monitor the various devices.  This creates a system with two separate technologies and two different responsibilities, the PLC programming and the safety relay connections.  The PLC programming is typically the responsibility of an engineer, while the wiring of the safety relay is generally the responsibility of maintenance personnel.  The engineer and the electrician must verify their work before the system is guaranteed to monitor the safety devices accurately.  Safety can be compromised if schematics are incorrect, items are missing, or mistakes have been made in the programming and/or wiring. 

A safety-related software and firmware-based controller uses a single technology so everything is controlled by the person designing and programming the system.  The safety controller checks wiring locations and connections, along with the current program.  It also checks the actual hardware to the listed hardware to verify it is in the correct location, monitoring that has been set-up is being used, and that modules are connected and addressed correctly.       

Diagnostics
The diagnostic capabilities of a standard PLC depend upon the accuracy of the programmer.  If all possible hazardous scenarios were not programmed, all errors may not be detected.  This could lead to a hazardous situation.  There are also differences during production.  If a fault is detected, a standard PLC will stop the system but it may not indicate where the fault occurred.  So the maintenance personnel or operators will start to troubleshoot all of the safety relays individually.  The system is all hard-wired so it takes a considerable amount of time to troubleshoot, especially in large or complex systems.  They may continue until the fault is found or until personnel gets frustrated and bypasses all of the safety devices so they can start production again.

Safety-related software and firmware-based controllers have hardware, software, and wiring diagnostics built in.  This guarantees that all safety devices are fully functional by doing a self-test to check all connections for mistakes or loose wires.  The location and type of faults are displayed for quick troubleshooting.  These faults can be found through a fault stack on the safety controller and transmitted to an HMI (Human Machine Interface).  Maintenance personnel are able to resolve problems quickly.  The fault must be corrected and reset before the system is operational so there is less chance for manipulation.  It is another way to guarantee a safe working environment. 

Certification
Safety-based controllers use hardware and software that is tested and certified by nationally recognized third parties, such as BG and TÜV, for safety applications.  These systems are sealed after testing so modifications cannot be made to the firmware and to protect the system’s integrity.  Certified safety blocks are already created and tested so they also simplify programming and reduce set-up time. 

Modifications
Making modifications or additions to a system using a standard PLC with safety relays can be a cumbersome task.  It requires changes to the programming and schematics, additional wiring, and testing of the entire system before it is operational.  Safety-related software and firmware-based controllers simplify changes to the system since they do not require a lot of reworking.  Software is designed so all references to wiring can be quickly located and changed.  Shut down time will be minimal since the safety-based software and firmware-based controller will do its own diagnostic check.

Detecting Changes
Detecting bypassed safety devices on a hard-wired system is easily detectable since there is physical evidence.  However, changes in software can remain invisible and undetected.  Safety-related software and firmware-based controllers prevent unauthorized changes in the safety side of the software through passwords, versions of software limited to diagnostics, and by limiting changes only to off-line programming.  Version revisions are documented with check sums to be certain that added or modified hardware and software changes are listed.  The software will also list any difference between the version on the safety-related software and firmware-based controller and the one on the computer.
 
Safety-based Controllers In-depth

Start-up Test
Safety-related software and firmware-based controllers do more than just test for faults during operation.  They also check the system before operation begins.  To verify that everything is working correctly, it tests the digital circuits of the input modules, does a disable test of the output modules, checks the output image table, the feedback protection between ST (Standard) and FS (Failsafe), and the block run-time control.  The dual port RAM (Random Access Memory) allows for cross checking and the resolving of timing issues. 

CPUs
Extra measures are added in the processor to guarantee that the system shuts down in a safe state if a fault occurs.  A safety-related software and firmware-based controller is designed with redundant and diverse CPUs (Computer Processing Units) to guarantee safety.  Each processor runs independently compiled versions of the program and then stores the result into separate memory locations.  Each processor also has a separate image of the inputs.  The processors complete the same safety related tasks, synchronize, and shut down the system if there are any inconsistencies.  (Note:  Only one processor may complete the tasks for the non-safety related functions.)    
 
Test Pulses
Control reliability could possibly be met if the system was shut down and tested before every cycle.  However, it would be impractical and undesirable to continually shut down a production line to check the functionality of the safety devices.  Safety-related software and firmware-based controllers addresses this by performing a self-diagnostic analysis with test pulses.  Test pulses check for cross shorts, faults to 24-volts, faults to ground, and external wiring faults such as misconnected and damaged wiring.  They are 24-volt lines with short impulse signals of 0-volts.  The signals are short enough so it does not interrupt the functionality of the device.  The signals are sent at precise intervals during every cycle to ensure working capabilities.  If the test pulse signals are not received, the safety-related software and firmware-based controller will shut down the system and send out a failure message to the operator.  It then prevents the systems from restarting until the fault is corrected and reset.  This is how a safety-related software and firmware-based controller meets the “prevent initiation of a successive stroke until the failure is corrected” section of the control-reliability standards.

Conclusion
Software and firmware-based controllers are a reliable and proven technology.  They meet the current standards by guaranteeing safety through redundancy, diversity, and self-monitoring.  Compared to a standard PLC, safety-based systems are designed to be self-monitoring and properly test and detect faults.  Extra safeguards are in place so they are not tampered with or easily bypassed.  To keep production run-time at its highest level, they incorporate diagnostics for more uptime, faster troubleshooting, and quicker installation.