The state of functionalsafety in Industry 4.0
VC KumarEmbedded Processing,
Texas Instruments

Industry 4.0, or the fourth industrial revolution,
typically refers to the evolution of the
manufacturing industry to become “digitized”– to harness the power of collecting and using
information in real time to create smart factories.
The goal is to sense and share factory, equipment and product status in real time withintelligent and self-aware machines (like robots) to drive increased efficiency and flexibility.

Figure 1. Functional safety standards in industrial applications.

The digitization of the factory combines

The implementation of Industry 4.0 in a factorycommunications, information technology (IT)or system must include [2]:(including cloud storage and interaction), data and• Interoperability: people, machines, devices andphysical elements. Machines interact with humans

sensors that connect and communicate with one

as well as products and other machines. Integrated

another.

sensing delivers decision-critical data, and real-time• Information transparency: the systems create a

information processing and communication drive

virtual copy of the physical world through sensor

profound changes in the entire industrial ecosystem.

data to contextualize information.

This “connected everything” environment enables• Technical assistance: both the ability of thecompanies to collect, store and use large
amounts of data simultaneously; greatly enhances

systems to support humans in making decisions

manufacturing processes; and creates a fully digitaland solving problems, and the ability to assist

value chain [1].

humans with tasks too difficult or unsafe for them.

The state of functional safety in Industry 4.0

I2

December 2018• Decentralized decision-making: the ability ofinference, impacting component providers such as

cyberphysical systems to make simple decisions

semiconductor manufacturers.

on their own and become as autonomous as

IEC 61508 measures the confidence of safety

possible.

implementation in a system via safety integrity

This trend toward autonomous machine decision-levels (SILs), which indicate the relative level of risk

making and operation as well as increased human-

reduction that a safety function provides. There aremachine interaction in potentially dangerous factory

four levels defined by the standard, from 1 through 4.

environments means that functional safety is

Level 1 is the lowest level and level 4 is the highest.

becoming more important in Industry 4.0.

Smart factory systems typically conform to SIL-2 orThis white paper will focus on what functional safety

SIL-3. Systems that have catastrophic, large-scale
failure consequences (such as nuclear reactors)means for processors in factory floor automation
subsystems and explore some of the options toconform to SIL-4.

enable functional safety.

IEC 61508 also addresses hardware fault
tolerance (HFT) requirements. HFT is the ability ofFunctional safety requirements for
Industry 4.0 in smart factories

a component or subsystem to continue deliveringa required safety-instrumented function in the

Functional safety is a part of an overall safety

presence of one or more dangerous faults instructure that depends on a system or equipment

hardware. A hardware fault tolerance of 1 means

to operate correctly in response to its inputs. In

that, for example, there are two components inother words, functional safety is the ability to detecta system and the architecture is such that thea potentially dangerous condition and activate

dangerous failure of one of the two components

a protective or corrective device or mechanism

does not prevent the safety action from occurring [4].

to prevent hazardous events from arising, orDifferent industries/applications have adapted

providing mitigation to reduce the consequence

IEC 61508 for their specific functional safetyof the hazardous event [3]. Two main standards

requirements through additional derived standards.

govern the requirements for and implementation of

The most common in factory automation include

functional safety in factory automation: International

IEC 61131-6 for safe programmable logic controllers

Electrotechnical Commission (IEC) 61508 and(PLCs), IEC 62061 for industrial machinery,International Organization for Standardization (ISO)IEC 61800-5-2 for variable speed drives and IEC

13849. Figure 1 shows the standard landscape in

61511 for industrial process control. All of thesesome common industrial applications.

standards have adopted the SIL methodology tomeasure safety levels.

IEC 61508 and derived standards infactory automation

ISO 13849 in factory automation

IEC 61508 covers the complete life cycle of safety

For industrial machinery safety, ISO 13849 issystems and demands a ground-up approach,the successor to the older machinery European

starting from the design/development stage. It is

standard (EN) 954-1 functional safety standard,

purposefully generic and covers a broad swath

and covers safety requirements (including software)of the smart factory value chain, from factorythrough the life cycle of safety-related machinery

systems to equipment manufacturers – and by

The state of functional safety in Industry 4.0

and their components in control systems. The

I

3December 2018

Safety systems requirements flow
to processing/communication
subsystems

process identifies the parts in the system that
perform safety functions as well as the necessary
safety performance level (PL) for the system. Eachrelevant component then needs to perform at a

A typical factory automation safety-related

level equal to or greater than the requirement forsystem consists of sensors (a data collection

the whole system, which when combined with thesubsystem), a logic subsystem (data processing

architectural category of the component (category

and communication, local or to the network)[Cat] levels 1 through 4) arrives at a comprehensive

and actuators (a control subsystem). Of course,

set of safety requirements [5].

software implementations are a key piece. The logic

Performance levels (PL) go from a to e (in increasing

subsystems typically have microcontrollers (MCUs)

order of reliability). Category designations (Cat) go

and/or processors and their design/architecturefrom B, then 1 through 4 (on a scale of increasing

plays a role in the system’s safety architecture.

safety requirements). Typical industrial machinery

Designing a system where the processor takes

systems are Cat3 or Cat4, PLd and in somefunctional safety requirements into consideration,

instances PLe.

both from a hardware and software standpoint,

For specific applications, such as with IEC 61508,

greatly reduces the cost and complexity ofadditional standards will refer to ISO 13849 anddesigning a functionally safe system.

provide further clarification and guidance (suchAs an example, for functionally safe (FS) PLCs, IEC

as for correlating categories and PLs). Examples

61131 is a product-specific implementation of the

include ISO 10218 and American National

requirements of IEC 61508 [7]. Processor vendors

Standards Institute (ANSI)/Robotic Industries

should consider the functional safety and safety integrity

Association (RIA) R15.06 (2012) for industrial robots

requirements of an FS PLC system outlined in IEC

and robot systems.

61131, in conjunction with their customer requirements.

IEC 62061 vs. ISO 13849
In industrial machinery systems that are electronic

Processor/system-on-chiparchitectures for functional safetyor programmable-electronic, there is no clear

Depending on the application, safety requirements,

distinction or guideline on whether to use ISO

and the amount and complexity of data, there are

62061 or ISO 13849 for functional safety. The

various ways to implement a safety system with achoice will depend on the end user requirements

controller or processor. The biggest priorities for(PL or SIL methodology preference) and/or pastsafety architecture designers are:design methodologies and comfort levels. For• Targeted safety level.

systems that are not electronic/electrical, ISO 13849• Simplicity of solution (previous design

may be more appropriate [6].

experience, time to market).

Both IEC 62061 and ISO 13849 have published• Product cost (integration, form factor).

reports/addenda to the main standard (IEC/• Product application and testability/diagnostic

technical report [TR] 62061-1 and ISO TR 23849)

capability.

that can help in making a decision between them.

• Certification time/cost.

The state of functional safety in Industry 4.0

I4

December 2018

Functional safety architectures

The trend toward digitization and increased datacollection/processing and communication (including

Two of the most common architectures

over networks) means that functional safety

implemented to detect random faults are single-

architecture and implementation are also evolving.

and dual-channel systems.

Functional safety addresses two categories ofSingle-channel systems are typically the simplest

faults: systematic and random. These faults become

to implement and use existing processing, memory

failures when a fault results in a loss of safetyand data communication paths in the system.

function or violates a safety goal.

However, the reliability and diagnostic ability of most

Systematic faults arise from errors in design/

implementations are limited by the fact that thedevelopment, manufacturing or operational

diagnostic functions run on the same data/power/

processes. Examples of systematic faults include

clock lines as the main system. Simplicity has adesign bugs coupled with a failure to verify

price, and the safety and performance levels of suchdesigned functionality, manufacturing test escapes

systems are typically limited to SIL-2 or below andor operating a product outside of guaranteed

Cat-2 systems with PLc or below.

parameters. Faults in software are also considered

Dual-channel architectures provide two completely

systematic, as software is fully deterministic.

independent data/logic processing andManaging systematic faults is possible throughcommunication, voltage and clock paths throughout

the implementation of robust processes thatthe system. Not only is there independent

include checks and balances in development,

redundancy, but it’s possible to execute andmanufacturing and operation – it’s best if they’recompare any necessary safety functions on both

performed from the ground up.

channels. It’s extremely unlikely that the same error

Random faults, on the other hand, can occur

will occur on both. However, if the results between

unpredictably during the lifetime of a component,

the channels don’t match and an error is detected

requiring a focus on diagnostics and safety

on one of them, both systems can be brought safely

mechanisms to detect and manage. Examples of

to a safe state.

random faults include the temporary corruption of

Dual-channel architectures are more expensive tostatic random access memory (SRAM) data due to

implement than single-channel architectures anda soft error, or brownout conditions due to voltage

more complex to design, but can achieve higher

glitches shorting adjacent signals in an integrated

SILs/PLs. SIL-3 and Cat-3/Cat-4 PLd and PLe

circuit (IC) package.

systems typically use this approach.

Mechanisms for functional safety detect faults during

The move toward integration

normal operation, executing within the fault-tolerant
time interval of the targeted system. This puts a

Traditional dual-channel safety system designs

premium on periodically executed or continuously

included two separate processing ICs (not on

operating diagnostics over those that can be

the same piece of silicon). In most industrial

executed only upon system startup or shutdown. As

applications, this is still true. The main processing

control-loop timing requirements are tighter in moreelement is increasingly responsible for not justmodern systems, safety mechanisms may needsafety diagnostic and compare functions but also

parallel and continuously operating diagnostics.

The state of functional safety in Industry 4.0

for some combination of data analysis, control andI

5

December 2018

The evolution of processor
capabilities in a digitized factorycommunication functions. The “checker” processing
element is a separate chip with its own data, clock
and power paths.

Given the ever-increasing complexity of factoryWith the trend toward miniaturization and lower

automation systems, next-generation processors

cost, over the past five years there has been aare integrating more system-level requirements

corresponding movement toward the integration of

on-chip. This includes high-speed communication

safety functions, driven first within the automotive

interfaces, multiple processor cores to handle theindustry. Both processing elements are integrated

data processing (with real-time cores to perform

on the same piece of silicon.

tight control-loop functions) and security functions

An example of this approach is the Hercules™ MCU

on the same piece of silicon.

platform from Texas Instruments (TI). The Hercules

Having multiple types of processing cores (such

MCUs functional safety architecture concept is

as Arm Cortex-A, Cortex-R5F and Cortex-M) andcalled a “safe island” approach. The basic concept

implementing the right functional safety capabilities

involves a balance between the application of(isolated power and clock domains for different

hardware and software diagnostics to manage

cores, hardware diagnostic functions) can givefunctional safety while balancing cost concerns. In

system designers a lot of flexibility in implementing

the safe island approach, a core set of elements are

their safety architecture, either by:allocated to continuously operating hardware safety• Using one of the processing cores on-chip formechanisms. This core set of elements – including

safety functions (with an external checker) while

power/clock/reset, a central processing unit (CPU)partitioning the rest of the processor to perform(in this case, an Arm® Cortex®-R5F real-time

control, processing and/or communications.

MCU core), flash memory, SRAM and associated• Implementing a safety island on the processor

interconnect – guarantees the functionally correctwith two processing cores and saving additional

execution of software.

printed circuit board (PCB) space and bill-of-

In addition to the elements noted above, softwarematerials cost.

executing on these elements can provide software-

The safety island concept offers more integration on a

based diagnostics for other device elements suchsingle piece of silicon, a lower failure-in-time (FIT) rate

as peripherals. This concept has been proven(vs. multiple ICs) and lowers PCB footprint. But at the

viable through multiple generations of safety-criticalsame time, it can also complicate the unambiguous

products in the automotive passenger vehicle spacedetermination of dependent and common-cause[8]. Combined in a system with a complementary

failure modes, a key requirement for functional safety.

power-management IC (PMIC), this approach

Simplicity is often favored in safety certifications;enables safety levels as high as SIL-3. Meeting an

therefore, it is important to balance the need for cost,

HFT equal to 1 or SIL-4 with this approach would

footprint and safety certification efforts.

require two Hercules controllers or the use ofaugmented traditional dual-channel solutions.

The state of functional safety in Industry 4.0

I6

December 2018

TI’s new AM65x family of Sitara™ processors offers

Deliverables from the IC vendor that can help

factory automation vendors the flexibility to choose

include:the best architecture for their system. It offers• Documentation:

multiple processing cores for both performanceo A component safety manual detailing theand real-time processing needs. It is also includes

product safety architecture and recommended

the necessary safety architecture and diagnostic

usage.

features to enable functional safety systems foro A safety analysis report summary, with a

Industry 4.0 factories. The AM65x supports bothsummary of the FIT rate along with failure

an independent dual-channel approach with anmodes, effects and diagnostic analysis (FMEDA)

external checker processor/MCU, as well as anat the component level for IEC 61508.

integrated safety island option with the lockstep

o A detailed safety analysis report, with full

approach and an external PMIC (Figures 2, 3 and 4).

details of all safety analysis executed down to
the module (IP) level for IEC 61508, as well as

Making certification easiera software tool for customizing the analysis

System-/equipment-level certification can benefit

results to the specific application.

from component-level certification and/or FIT/failureo A safety report summarizing compliance toinjection data to reduce cycle time and certification

IEC 61508.

complexity. Again, a system that needs to meet ao A third-party assessment of development flow

certain safety or performance level must have all
safety-critical components meet or exceed thatin accordance with IEC 61508.

level. This includes information to address botho Component-level certification.

systemic and random fault scenarios.

3-6 Axis power board(s)

AM65x

ARM
ARM
Cortex A53(Position
speed loops)

ARM
ARM
Cortex A53(industrial comms/
industry 4.0 services)

Diagnostics

MII/RGMII

Eth PHY
1000 Mbit

RGMII

ICSSG0 IEP1ICSSG1 IEP0ICSSG2 IEP0

2 MB
MSMC RAM

Eth PHY
100/1000
Mbit

ICSSG0 PWMs

ICSSG0ICSSG2

IEP0 timer

IEP1

NAVSS

Multi-protocol
industrial
ethernet

MCU island

Gigabit
Ethernet

SDDF x18

3-6 x trip
6-12 PWM
6-12 PWM
6-12 PWM

Driver (x3-6)

9-18 DATA
2-6 CLKΔΣ
modulation(x9-18)

M
x
3-6

GPIO
ARM
Cortex R5F(Safe
Channel A)

UART

ARM
Cortex R5F(Current
loop)

ICSSG1IEP164 KB TCM 64 KB TCM
512 KB L3 SRAM
UART

Safety MCU(Safe Channel B)

Encoder interface
x3-6

OSPI

Boot
(Opt. secure)

Encoder
RS485(x3-8)

Optional

Figure 2. AM65x – Centralized smart servo drive.
The state of functional safety in Industry 4.0

I7

December 2018

AM65xARM
Cortex A53(Safe Channel A)

ARM
Cortex A53(Motioncontrol)

ARM
Cortex A53(industrial comms/
industry 4.0 services)

ARM
Cortex A53(Position
speed loops)

3-6 Axis power board(s)ICSSG0 PWMs
ICSSG0 IEP1

3-6 x trip
6-12 PWM
6-12 PWM
6-12 PWM

ICSSG1 IEP0ICSSG2 IEP0

Driver (x3-6)

2 MB
MSMC RAM

Diagnostics

Eth PHY
100/1000
Mbit

MII/RGMII

Eth PHY
100/1000
Mbit

MII/RGMII

Eth PHY
1000 Mbit

ICSSG0ICSSG2

IEP0 timer

IEP1

NAVSS

Multi-protocol
industrial
ethernetΔΣmodulation(x9-18)

M
x
3-6

UART

ARM
Cortex R5F(Current
loop)

ICSSG1IEP164 KB TCM 64 KB TCM
512 KB L3 SRAM

Gigabit
Ethernet

2-6 CLKSDDF x18
GPIO

ARM
Cortex R5F(Safe
Channel B)

MCU island

RGMII

9-18 DATA

OSPI

UART

Encoder
RS485(x3-6)

Encoder interface
x3-6

Boot
(Opt. secure)

Figure 3. AM65x – Integrated robot CPU board.

AM65x

ARM
Cortex A53
1.1 GHz (PLC
processing)

ARM
Cortex A53
1.1 GHz(Comms)ARM
ARM
Cortex A53
Cortex A53
1.1 GHz
1.1 GHz (PLC
(Systemprocessing) management)

512 KB L2 SRAM

512 KB L2 SRAM

DDR3/4/LPDDR4 EMIF
USB
UART/SPI/
GPIO

PCIe

PCIe

2 MB
MSMC RAM

PRU-ICSS-Gb 0
CBASS

CBASS

(Control-level/
backplanecomms)

NAVSS

SerdesCBASS

MCU island
DMSC(Security and PM)
RTI/WDT

RGMII

1000 Mbit
PHY(Field-levelcomms)

RGMII

1000 Mbit
PHY

PRU-ICSS-Gb 0

RGMII

1000 Mbit
PHY

RGMII

1000 Mbit
PHY

PRU Cores

PRU Cores(Cloud and/or
supervisorycomms)ARM Cortex
R5F (Safe
Channel A)

ARM Cortex
R5F (Safe
Channel B)

64 KB TCM

64 KB TCM

UART/SPI/OSPI/I2C

512 KB L3 SRAM

ESM

Figure 4. AM65x – Safe PLC - PLC Controller CPU.

The state of functional safety in Industry 4.0

I8

December 2018• Software:

Summaryo A safety compliance support package according

Industry 4.0 is driving increased needs for functional

to IEC 61508, including software documentation

safety. Component-level needs are increasing andand testing to assist in compliance witharchitectures are evolving to meet the future needs

functional safety standards. The packageof a digitized smart factory. Processor vendors

includes safety requirements documents, code

have a key role to play to support the demanding

review and coverage reports, unit test results

needs of new products, approaching safety fromand software safety manuals – and ideally also

the ground up and offering innovative and flexible

includes unit test capability using tools such as aarchitectures, as well as a support infrastructure

Liverpool Data Research Associates (LDRA) unit.

to enable system-level certifications. TI has beeno Safety tool documentation and qualificationa leader in delivering processing solutions foraccording to IEC 61508 that assists in theapplications demanding functional safety, and thequalification to functional safety standards,

AM65x family will continue that trend.

including a tool classification report, tool
qualification plan and report, tool safety manual,and test automation unit.
o A safety diagnostic library that provides
interfaces and a framework for initializing andenabling safety diagnostics/features, fault
injection to allow the testing of application
fault handling, a handler callback routine, andprofiling for measuring time spent in diagnostic
test/fault handling.
o Development tools assessed and/or certified
as suitable for use with IEC 61508, including
integrated development environments andcompilers and Joint Test Action Groupemulators/traces.
The AM65x family of industrial processors will havethis comprehensive design support package.

References
1. Accenture. 2018. Industry X.0.
2. Marr, Bernard. 2016. “What Everyone Must Know
About Industry 4.0.”
3. International Electrotechnical Commission. 2018.
Functional Safety.
4. Generowicz, Mirek. 2015. “Achieving Compliancein Hardware Fault Tolerance.”
5. Nix, Doug. 2017. “ISO 13849-1 Analysis – Part 3:
Architectural Category Selection.”
6. TÜV SÜD. 2018. “SIL or PL? What is thedifference?”
7. PLCopen. 2018. Introduction into IEC 61131-6
functional safety.
8. Texas Instruments. 2011. “Hercules™
Microcontrollers: Real-time MCUs for safetycritical products.”

Important Notice: The products and services of Texas Instruments Incorporated and its subsidiaries described herein are sold subject to TI’s standard terms andconditions of sale. Customers are advised to obtain the most current and complete information about TI products and services before placing orders. TI assumes
no liability for applications assistance, customer’s applications or product designs, software performance, or infringement of patents. The publication of information
regarding any other company’s products or services does not constitute TI’s approval, warranty or endorsement thereof.
The platform bar is a trademark of Texas Instruments. All other trademarks are the property of their respective owners.
© 2018 Texas Instruments Incorporated

SPRY329

IMPORTANT NOTICE AND DISCLAIMER
TI PROVIDES TECHNICAL AND RELIABILITY DATA (INCLUDING DATA SHEETS), DESIGN RESOURCES (INCLUDING REFERENCEDESIGNS), APPLICATION OR OTHER DESIGN ADVICE, WEB TOOLS, SAFETY INFORMATION, AND OTHER RESOURCES “AS IS”
AND WITH ALL FAULTS, AND DISCLAIMS ALL WARRANTIES, EXPRESS AND IMPLIED, INCLUDING WITHOUT LIMITATION ANYIMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT OF THIRDPARTY INTELLECTUAL PROPERTY RIGHTS.
These resources are intended for skilled developers designing with TI products. You are solely responsible for (1) selecting the appropriate
TI products for your application, (2) designing, validating and testing your application, and (3) ensuring your application meets applicablestandards, and any other safety, security, regulatory or other requirements.
These resources are subject to change without notice. TI grants you permission to use these resources only for development of an
application that uses the TI products described in the resource. Other reproduction and display of these resources is prohibited. No license
is granted to any other TI intellectual property right or to any third party intellectual property right. TI disclaims responsibility for, and you
will fully indemnify TI and its representatives against, any claims, damages, costs, losses, and liabilities arising out of your use of theseresources.
TI’s products are provided subject to TI’s Terms of Sale or other applicable terms available either on ti.com or provided in conjunction withsuch TI products. TI’s provision of these resources does not expand or otherwise alter TI’s applicable warranties or warranty disclaimers for
TI products.
TI objects to and rejects any additional or different terms you may have proposed. IMPORTANT NOTICE
Mailing Address: Texas Instruments, Post Office Box 655303, Dallas, Texas 75265
Copyright © 2022, Texas Instruments Incorporated