## 4 Creating a Dual Architecture from sPLCs
### The Safety Integrity against Systematic Failures
#### 4.2.2 Safety Function Model
After starting the correct \"Muting\" sequence, the function goes to the _Muting_evaluation_ macro state. From the macro state _Muting_evaluation_, the function can go into the state _Expired_time_, in which all outputs of the function are set to the value of _false_ when the maximum duration of muting time, _Muting_time_, is exceeded. From the _Muting_evaluation_ macro state, the function can go into the _LC_interrupted_ state when the light curtain is interrupted at a time when \"Muting\" is not in progress. In the _Muting_evaluation_ macro state, the function can reach the _Muting_Start_1 state after detecting a rising edge at the _MS1_ input, and at the same time, the value must be _false_ at the _MS2_ input. After transitioning into this state, the allowed time of discrepancy starts to count, after which the function goes into the _Expired_discrepancy_time_ state and then to the _Expired_time_ state, which is a safe state in which all outputs of the function are set to _false_. From this state, the function enters the _Recovery_ state after detecting a _false_ value on the _MSI_ or _MS2_ input. The function behaves in the same way as in the second case, when the \"Muting\" sequence starts by detecting a positive edge at the _MS2_ input, and at the same time the _MSI1_ input has the value of _false_, the function goes into the _Muting_Start_2 state, in which the countdown of the allowed _discrepancy_time_ starts. After it expires, the function goes into the _Expired_discrepancy_time_ state and subsequently into the _Expired_time_ state, in which all outputs of the function are set to the value _false_. From the _Muting_Start_1 state, the function can reach the _Muting_Error_ state due to an incorrect \"Muting\" sequence. If the \"Muting\" function is not enabled, the value is _false_ at the _enable_Muting_ input. Likewise, the function can transform from the _Muting_Start_2_ state to the _Muting_Error_ state after a bad \"Muting\" sequence. If the \"Muting\" function is not enabled, the value is _false_ at the _enable_Muting_ input. From the _Muting_Start_1_ state, after detecting a leading edge at the _MS2_ input and at the same time, if the value of the _MSI_ input is _true_, the function goes into the _Muting_active_ state, where the _MUTING_ output is set to the value of _true_. Even from the _Muting_Start_2_ state, the function can go into the _Muting_active_ state when a rising edge is detected at the _MS1_ input, and at the same time, the value is true at the _MS2_ input. From the _Muting_active_ state, the function goes into the _LC_free_ state after detecting a false value on the _MSI_ or _MS2_ input. In the _LC_free_ state, the _MUTING_ output is set to _false_. The function can go from any state into the safe state _Safe_state_ after detecting a _false_ value at the _comparator_ input. Likewise, the function can go from any state into the _Do not execute_ state when a _true_ value is detected on the _wait_ input. We created the model of the \"Muting\" safety function (Figure 6) in the Matlab Stateflow software tool. After creation, the function was simulated in the Matlab Simulating tool, which made it possible to perform various test scenarios and compare the results with the expected results. Given that all test scenarios were successful, we were able to proceed with the implementation of the function in a dual architecture based on sPLCs.