## 4 Creating a Dual Architecture from sPLCs
### The Safety Integrity against Systematic Failures
#### 4.2.2 Safety Function Model  
With the help of the dual architecture, the safety function commonly called \"Muting\" can be implemented. Its task is to protect a moving object against the effects of technology located in a dangerous zone (usually, it is about protecting a person after entering the dangerous part of the technology). The detailed specification of the \"Muting\" function was taken from the freely available PLCopen safety documentation [24]. More detailed information regarding the \"Muting\" function is also provided in ref. [25]. The safety function \"Muting\" can be characterized simply by the fact that, based on the sensors located in front of the light curtain (LC), it evaluates whether the light curtain was interrupted by a person or by moving material. In the event of a human interruption, it is necessary to put the device generating the potential danger into a safe state. In the event of material interruption, this is a normal working state, and the operation of the device does not need to be interfered with (muting of the light curtain is in progress). Figure 6 shows a status diagram describing the operation of the \"Muting\" safety function. The state diagram is placed in the template according to Figure 4. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Output** & **Data Type** & **Description** \\ \hline diag\_code & INT & Diagnostic information about the status of the comparator. It expresses the status of the comparator using an integer. \\ comp\_A & BOOL & Comparison results in comparator A. If the value is _true_, the comparison was successful, and if the value is _false_, the comparison was unsuccessful. \\ comparator & BOOL & The overall result of the comparison applies to the safety function, which is to perform its activity based on this output. \\ wait & BOOL & An instruction to the safety function to suspend its execution unless the safety function is in the same state in the second PLC. \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Comparator output interface. After running, the function is in the _Do_Not_Execute_ state, which is also the initialization state. If a _false_ value is sent from the comparator to the _wait_ input, the function goes into the _Execute_ state, where the initialization state is _Safe_state_, in which the values of all function outputs are set to _false_. If a _true_ value is sent from the comparator to the _comparator_ input, the function goes into the _Recovery_ state, in which the _ACK_REQ_ output is set to _true_, and a _true_ value is expected at the _recovery_ input. If a _true_ value is detected at the _recovery_ input, the function goes into the _Standby_ state, in which the current state of the light curtain is checked, and the _ACK_REQ_ output is set to _false_. If the light curtain is interrupted, the function goes into the _LC_interrupted_ state, from which, if the light curtain is not interrupted, the function goes to the _Recovery_ state, in which the _ACK_REQ_ output is set to _true_ again. That is, the recovery request is active, and the function can return to the active state after a failure. From the _Standby_ state, if the light curtain is unbroken, the function goes into the _LC_free_ state. In this state, output \(Q\) is set to _true_, and the function is waiting for the \"Muting\" sequence to start. In this state, the light curtain may be interrupted. If this happens, the function goes into the state _LC_interrupted_ when output \(Q\) is set to the value of _false_. The sequence can start by detecting a positive edge on input \(MS1\) or \(MS2\) or both inputs simultaneously. In the case of an incorrect \"Muting\"  
Figure 6: State diagram of the “Muting” safety function. sequence, the compound condition, which is written at the transition in Figure 6, the function enters the _Error_Muting_ state, which is a safe state in which the outputs are set to _false_. From this state, the function enters the _Recovery_ state when a _false_ value is detected at the _MSI_ or _MS2_ input.