Introduction to the SafeAssure Kit for Industrial Functional Safety Applications

Size: px

Start display at page:

Download "Introduction to the SafeAssure Kit for Industrial Functional Safety Applications"

Wesley Bryan
6 years ago
Views:

1 Introduction to the SafeAssure Kit for Industrial Functional Safety Applications FTF-AUT-F0411 Mark O Donnell Product Manager Peter Schuller Marketing Manager (MicroSys) A P R TM External Use

2 Industrial Functional Safety External Use 1

Functional Safety Defined Functional safety is the absence of unreasonable risk due to hazards caused by malfunctioning behavior of electrical/electronic systems Hazards: Potential source of harm

3 Functional Safety Defined Functional safety is the absence of unreasonable risk due to hazards caused by malfunctioning behavior of electrical/electronic systems Hazards: Potential source of harm Harm: Physical injury or damage to the health of people Failures are main impairments to safety Systematic: Failures, related in a deterministic way to a certain cause, that can only be eliminated by a change of the design or manufacturing process, operational procedures, documentation or other relevant factors Random: Failures that can occur unpredictably during the lifetime of a hardware element and that follow a probability distribution External Use 2

4 What is Functional Safety? Functional safety refers to the ability to avoid the risk of physical injury due to incorrect system operation in response to system inputs. Control!!! External Use 3

2006/42/EC Machine Directive (Legal document incorporated across member states of EU) Harmonized standards supersede all others from end of 2011 onwards (see Official Journal of the European Union

5 2006/42/EC Machine Directive (Legal document incorporated across member states of EU) Harmonized standards supersede all others from end of 2011 onwards (see Official Journal of the European Union for list) European Union United States of America Cites IEC up to SIL 3 EN ISO /-2 (PLa PLe) EN IEC (SIL1 SIL3) This relates to electronic and micro processors EN IEC External Use 4

6 Machine Directive: European Impact Only? EEA European Economic Area (EU + Iceland, Liechtenstein & Norway) External Use 5

7 Certification Groups Around The World UL ANSI EN GOST R GB JIS NR AS Russian GOSSTANDART GB = Guobiao, Chinese for "National Standard JIS = Japanese Industrial Standard UL = Underwriters Laboratory External Use 6

8 Application of Various Safety Standards IEC IEC IEC ISO ISO Process Machinery Automotive External Use 7

9 ISO vs. IEC Cat Category IEC Machine ISO IEC SIL Safety Integrity Level PL Performance Level External Use 8

10 ISO vs. IEC SIL and PL are comparable Both are probabilistic measures for failure rates ISO IEC PFH PL a PL b/pl c SIL PL d SIL PL e SIL SIL External Use 9

11 ISO vs. IEC ISO categories have demands for architectural provisions Category Channels Inputs Outputs DC Monitoring Monitoring - 3, Monitoring 10-7 Category 2 Inputs are single-channel architecture Must be testable May be dual-channel (redundant) but very cost-intensive for sensors and wiring Category 3 and 4 No test functions required for inputs (simpler design), but dual-channel sensors/wiring required External Use 10

12 Industrial Functional Safety at Freescale External Use 11

Broad Portfolio S08 MCUs 16/32-bit DSCs 32-bit

MQX RTOS CodeWarrior IDE Freemaster analysis tool

Mark Leading IP Analogue Wireless IP Low power

(Qorivva) Reference designs & demos Freescale

13 Broad Portfolio S08 MCUs 16/32-bit DSCs 32-bit Kinetis MCUs 32-bit Qorivva MCUs QorIQ Processors MQX RTOS CodeWarrior IDE Freemaster analysis tool Bare metal stacks, drivers, libraries 3 rd Parties Mark Leading IP Analogue Wireless IP Low power Enablement Memory technology SafeAssure Program (Qorivva) Reference designs & demos Freescale Tower System Product Longevity Design Support Quality External Use 12

systems Functional safety Connected home Portable medical Factory

14 Several Platforms Key to Making the World a Healthier, Safer Place Active safety systems Advanced driver assistance Radar, vision systems Functional safety Connected home Portable medical Factory automation systems We See a Healthier, Safer Population External Use 13

15 Industrial Automation & Control Energy Factory Transport Buildings Infrastructure Generation Transmission Distribution Production Facility monitoring Switchgear Rail systems Mobility and logistics Industrial vehicles Control Elevators HVAC Water treatment Oil and gas M2M communication Industrial Scalability, Security, Safety, Connectivity External Use 14

Qorivva Means Designed for Automotive Built on industry-leading Power Architecture technology, Qorivva MCUs offer performance leadership Unprecedented Scalability The Qorivva portfolio offers

16 Qorivva Means Designed for Automotive Built on industry-leading Power Architecture technology, Qorivva MCUs offer performance leadership Unprecedented Scalability The Qorivva portfolio offers scalable solutions for powertrain, body and chassis & safety applications, enabling streamlined tools and development environments Qorivva MCUs built on Power Architecture Innovation With our newest MCUs built on 55 nm process technology, you get tripleand quad-core devices that significantly improve power efficiency and quality, plus configurable peripheral sets to design exactly what you need High-Quality Portfolio Choose from hundreds of 32-bit Power Architecture MCUs with peripheral sets optimized for a full range of automotive applications and a focus on quality and longterm reliability Scalable, highly integrated solutions built on the industry s most powerful automotive architecture External Use 15

17 Automotive Grade for Challenging Environment Largest portfolio with automotive qualification grade High temperature for space constraint applications Fuel, oil, water pumps, sensor and actuators AEC Q C 135 C+ Low PPM All Freescale Automotive MCU are certified AEC Q100 All Freescale Automotive MCU support up to 125 C ambient temperature Extended temperature up to 135 C+ ambient on several product lines (S08SG, S12G, S12ZV, Qorivva) Benefit of one of the lowest PPM level in the industry targeting zero defects performance External Use 16

Challenges for Complex Industrial Control Applications Advanced control algorithms Safety regulations Harsh conditions Quality and reliability Improved efficiency Reduced development time Lower

18 Challenges for Complex Industrial Control Applications Advanced control algorithms Safety regulations Harsh conditions Quality and reliability Improved efficiency Reduced development time Lower system cost Component longevity New Image to go here Motion control, power generation, clinical medical, aerospace and defense, motor drives, renewable energy, robotics and more External Use 17

Qorivva Means Unmatched MCU Performance Get up to >1500 DMIPS the most powerful core for MCUs today enabling single-chip design for complex algorithms Easy Development Make development a snap with

19 Qorivva Means Unmatched MCU Performance Get up to >1500 DMIPS the most powerful core for MCUs today enabling single-chip design for complex algorithms Easy Development Make development a snap with run-time software, reference designs and tools for rapid prototyping, advanced debug and system modeling Qorivva MCUs For Industrial built on Power Architecture Assured Safety, Quality & Reliability Meets medical, industrial and transportation requirements to ease safety approvals and durability mandates Market- Leading Integration Get up to 4 MB* embedded flash and a rich set of analog, connectivity and timing peripherals to support complex real-time control *90nm Unmatched performance and ruggedized safety features for almost anything that moves External Use 18 18

20 SafeAssure Program External Use 19

21 Functional Safety. Simplified. Simplifies the process of system compliance, with solutions designed to address the requirements of automotive and industrial functional safety standards Reduces the time and complexity required to develop safety systems that comply with ISO and IEC standards Supports the most stringent Safety Integrity Levels (SILs),enabling designers to build with confidence Zero defect methodology from design to manufacturing to help ensure our products meet the stringent demands of safety applications External Use 20

SafeAssure Approach: The Four Key Elements ISO 26262 Automotive industry standard, adaptation

ASILB, ASIL C, ASILD Pub date: Target end 2011 Microcontrollers Lockstep cores, ECC on

control Analog and Power Management Voltage monitors, external error monitor, advanced

PSI5 safety data links Organization Safety is an integral part of the Freescale worldwide

requirements management, architecture & design, verification & validation Quality Management

3 Functional Safety Standards Automotive ISO 26262 Safety Hardware Safety Support Safety

Industry standard, applicable to electrical / electronic / programmable electronic

ago People Regional functional safety experts Documentation Safety application notes / safety

drivers Software Partnerships Partnering with leading third-party software providers for

up with safety analysis done at each step of the process Assessments / Audits Safety

22 SafeAssure Approach: The Four Key Elements ISO Automotive industry standard, adaptation of IEC for electrical/electronic systems within road vehicles Integrity levels ASIL A, ASILB, ASIL C, ASILD Pub date: Target end 2011 Microcontrollers Lockstep cores, ECC on memories Redundant functions, internal monitors, built in self test, fault collection & control Analog and Power Management Voltage monitors, external error monitor, advanced watchdog, built in self test Sensors Timing checker, digital scan of signal chains, DSI3 or PSI5 safety data links Organization Safety is an integral part of the Freescale worldwide organization Project Management Configuration & change management, quality management, requirements management, architecture & design, verification & validation Quality Management ISO TS Certified Quality Management System Hardware - Zero defects Software SPICE Level 3 Functional Safety Standards Automotive ISO Safety Hardware Safety Support Safety Process Industrial IEC Safety Software Freescale Quality Foundation IEC Generic Industry standard, applicable to electrical / electronic / programmable electronic safetyrelated systems Integrity levels SIL 1, SIL 2, SIL 3, SIL 4 Pub date: More than 10 years ago People Regional functional safety experts Documentation Safety application notes / safety manual / FMEDA Automotive Software AUTOSAR OS & MCAL Core self test Device self test; complex drivers Software Partnerships Partnering with leading third-party software providers for automotive and industrial Safety Analysis Selected products defined & designed from the ground up with safety analysis done at each step of the process Assessments / Audits Safety confirmation measures Continuous Improvement Process evaluation, assessments / audits and gap-analysis exist to ensure processes are continually optimized External Use 21

23 First ISO Certified MCU: Qorivva MPC5643L Certified by exida an independent accredited assessor Certificate issued based on a successful assessment of the product design and applied development and production processes against all requirements and work product definitions of ISO identified as applicable to an MCU part MPC5643L MCU certified for use for all Automotive Safety Integrity Levels (ASIL), up to and including the most stringent level, ASIL D Released on 6 th September, 2012 External Use 22

24 Evolution of Functional Safety Standards Aeronautic DO 178 DO 178A DO 178B ARP 4754 ARP 4761 DO 254 DO 178C ARP 4754A Rail Transport EN IEC EN 5012X EN Generic Standard IEC61508 IEC IEC Edition 2 Industrial Automation IEC IEC IEC ISO IEC Edition 2 Automotive (IEC 61508) ISO Medical IEC Edition 3 External Use 24

25 Functional Safety Standards Focus Functional Safety is the absence of unreasonable risk due to hazards caused by malfunctioning behavior of electrical / electronic systems ISO IEC ISO Automotive Industry standard, adaptation of IEC for electrical / electronic systems within road vehicles Generic Industry standard, applicable to electrical / electronic / programmable electronic safety-related systems. One of two European Standards to achieve compliance with the Machinery Directive 2206/42/EC Safety Integrity Levels ASIL A, ASILB, ASIL C, ASIL D Publication date 15 Nov 2011 Safety Integrity Levels SIL 1, SIL 2, SIL 3, SIL 4 Publication date Ed. 2.0 Apr 2010 Ed More than 10 years ago Performance Levels a, b, c, d, e Categories B, 1, 2, 3, 4 Freescale has strengthened its product development cycle, making functional safety an integral part of the process. External Use 25

26 miriac-ek5744 from MicroSys External Use 26

27 EK5744 Overview Partnership by Freescale and MicroSys Comprehensive SafeAssure kit Based on Freescale solutions Qorivva MPC5744P MCU MC33907 System Basis Chip Standards addressed IEC (2010) ISO (2008) IEC (2005) standards Takes the risk out of your safety project! External Use 27

Typical Safety Designs for Higher Safety Claims Fully redundant architecture Two CPUs/CPU cores Two digital/analog inputs per sensor value Digital outputs are monitored Diversity

28 Typical Safety Designs for Higher Safety Claims Fully redundant architecture Two CPUs/CPU cores Two digital/analog inputs per sensor value Digital outputs are monitored Diversity Time diversity Space diversity Diversity in hardware and/or software Different CPUs/architectures Different applications on CPU cores Eliminate common cause failure External Use 28

29 Consequences of Redundant Design Development costs Additional hardware design costs Additional software design and implementation costs Synchronization between channels needed (complexity) Runtime costs Synchronization points in software Slows down execution Unit costs Additional hardware items (CPU, RAM, flash, synchronization, etc.) Because of runtime costs may require more expensive CPU(s) External Use 29

30 EK5744 Design Diversity (goal: eliminate random common cause errors) Space: Two lockstep cores running same application in different areas of RAM/flash Time: Delayed lockstep Redundant inputs Monitored outputs Performance No explicit synchronization required (delayed lockstep) Cost Single application High performance MCU Single MCU (dual-core) External Use 30

EK5744 Benefits Low risk in your own design Design blueprints Ready-to use documentation Lower cost in development Build on proven hardware design Ready-to use safety firmware Single application

31 EK5744 Benefits Low risk in your own design Design blueprints Ready-to use documentation Lower cost in development Build on proven hardware design Ready-to use safety firmware Single application design and implementation Focus on functional requirements of application Safety requirements delegated to safety firmware Unit Costs Single or dual-channel inputs as needed Very little overhead for two CPU channels with single MCU (full computing power) External Use 31

32 EK5744 Facts Safe I/O (up to SIL2, PL d, cat. 3) Testable digital inputs Testable analog inputs Digital outputs with read-back function May be combined for redundant I/O (dual channel architecture) Industry standard I/O IEC conforming TÜV SÜD to review capabilities of safety kit (assessment) External Use 32

33 EK5744 Options Full Device Custom Design, Software Development Services Support Consultation Services EK5744 Certification Kit Safe Assure Kit miriac EK5744 External Use 33

34 Safe Assure Kit miriac EK5744 EK5744 device in box for DIN rail mount Power supply Wind River dab C/C++ compiler (evaluation version) Firmware Startup code Test functions Input/output drivers Reference manual Required C/C++ compiler (full version for Wind River diab or GCC) Debugger (isystem, Lauterbach) External Use 34

35 EK5744 Certification Kit Hardware design Source code for firmware Test code for firmware Documentation for hardware designs and software Test results Copy of assessment report from TÜV (planned) Copy of TÜV certificate (planned) External Use 35

36 EK5744 Support/Consultation Services Support in certification Reviews Documentation Hardware design Software design Source code Consultation services Hardware design Software architecture Software design Specifically tailored for your project needs External Use 36

37 EK5744-Based Custom Device You can choose from Complete hardware design Software architecture, software design Software implementation Complete device including housing and planned TÜV certificate External Use 37

38 Summary External Use 38

39 miriac-ek5744 Partnership by Freescale and MicroSys Comprehensive SafeAssure kit Based on Freescale SafeAssure products Qorivva MPC5744P MCU MC33907 System Basis Chip KITs will address IEC 61508, ISO & IEC Standards (Legislation requires compliance in EEA) TÜV SÜD will review the KIT 1 st KIT that will provide an industrial safety solution using an MCU with an integrated safety architecture (MPC5744P) External Use 39

SafeAssure Analog Product: MC33907, MC33908 SBCs ISO 26262 ASIL D Safety measures of analog architecture and development process (ISO 26262) helps to reduce effort and time on ECU functional safety

and fail safe state machine High HW diagnostic to cover SPF, LT, CCA Secured SBC & MCU SW interactions Multiples registers to help SW diagnostics, including safe state machine Safety mechanisms to

40 SafeAssure Analog Product: MC33907, MC33908 SBCs ISO ASIL D Safety measures of analog architecture and development process (ISO 26262) helps to reduce effort and time on ECU functional safety assessment FCCU (dual core lock step) monitoring Integrated Safety Architecture (ISA) Saves development effort and time as no additional SW required (only 1 main MCU) Independant voltage monitoring and fail safe state machine High HW diagnostic to cover SPF, LT, CCA Secured SBC & MCU SW interactions Multiples registers to help SW diagnostics, including safe state machine Safety mechanisms to secure SPI Advanced watchdog challenger to secure MCU timing monitoring Safety enablement provided by Freescale Application recommendations to combine MC33907 and MPC5643L Safety manual, FMEDA and complete ecosystem to ease development, save time External Use 40

SafeAssure MCU Product: MPC5744P ISO 26262 ASIL D Safety assessment of MCU architecture and development process (ISO 26262) Helps to reduce effort and time on ECU functional safety assessment

41 SafeAssure MCU Product: MPC5744P ISO ASIL D Safety assessment of MCU architecture and development process (ISO 26262) Helps to reduce effort and time on ECU functional safety assessment Integrated Safety Architecture (ISA) Saves development effort and time as no complex diagnostic SW required CPU processing power available for running applications High diagnostic coverage in HW to detect random faults SW deliverables provided by Freescale and partners Enable support for ASIL D applications with minimized performance degradation smcal & sos, Se lf tests, SW safety manual Safety enablement provided by Freescale Safety manual FMEDA System-level Application Note External Use 41

42 Next Steps SafeAssure KIT is planned to be available end Q3 14 Kits will be orderable from Freescale.com (miriac-ek5744) Support will be from Freescale at MPC5744P and MC33907 level, and from MicroSys at system level Other KITs are being discussed Additional FTF papers FTF-IND-F0061, Industrial Control with QorIQ FTF-AUT-F0350, Safety Implementation for Power System Basis Chips External Use 42

43 Freescale Semiconductor, Inc. External Use

Functional Safety: What It Is, Why It s Important And How to Comply

Functional Safety: What It Is, Why It s Important And How to Comply November 11, 2010 Copyright 1995-2010 Underwriters Laboratories Inc. All rights reserved. No portion of this material may be reprinted