When machines need not only a "brake" but also the ability to "anticipate danger" – The next decade of industrial safety
We all know cars must have brakes (functional safety). But what if the brakes work fine, yet the driver fails to brake due to misjudging road conditions or a mud-covered sensor? That's no longer "brake failure", but rather the system's inability to make correct decisions in complex environments.
Core goal: When random hardware failures or systematic faults occur, the system can enter a safe state.
Example: Robot motor overheats → automatic shutdown; PLC output shorts → power cut.
Standards: IEC 61508 / ISO 13849
Real-life analogy: Car airbags and seatbelts – they protect you in a crash but don't actively prevent the crash.
Core goal: Avoid hazards caused by functional limitations, environmental interference, perception shortcomings – i.e., non-failure reasons.
Example: Autonomous driving camera dazzled by bright light → system slows down and prompts takeover; sensor covered by mud → automatically switches to backup sensor.
Standard: ISO 21448 (SOTIF)
Real-life analogy: Automatic Emergency Braking (AEB) and blind-spot monitoring – actively predicting and avoiding potential dangers.
Robots, autonomous vehicles, drones no longer rely on human supervision. They must make decisions in unknown, dynamic environments. Hardware may be fine, but they might "mis-see" or "mis-think".
Cameras can be disrupted by rain/fog, radar has blind spots, LiDAR is affected by reflectivity. Relying on a single sensor inevitably leaves "unexpected" vulnerabilities.
In industrial settings, changing light, electromagnetic interference, dust, reflective surfaces... can all cause misjudgment. Traditional functional safety tests don't cover these.
Redundancy means providing multiple backups for critical components (sensors, processors, actuators). When one fails or returns abnormal data, another immediately takes over or cross-validates.
In industrial settings, redundancy can include:
Self-diagnostics means hardware monitors its own health in real time, issuing warnings or automatic repairs before anomalies escalate. It doesn't wait for failure but actively detects signs of "about to break".
E.g., monitoring chip temperature, voltage, current, communication error rate. When temperature exceeds a threshold but not yet critical, proactively reduce frequency and issue alarm.
Two redundant modules send test data to each other and compare results. Mismatch indicates one has failed.
Automatically checks memory, communication interfaces, safety circuits at each power-up. Locks machine if anomaly found, preventing operation while faulty.
Real-life analogy: Like a smartwatch monitoring heart rate and blood oxygen, vibrating when abnormalities are detected. Self-diagnostics shifts industrial hardware from "reactive repair" to "proactive maintenance".
Take an industrial robot as an example:
This means future industrial hardware without built-in redundancy and self-diagnostics will struggle to pass safety certifications for high-end markets (automotive, medical, nuclear, heavy-duty robotics).
Q: Does redundancy double the cost?
A: For critical safety components, the added cost of redundancy is far lower than the losses from an accident. Moreover, as chip integration improves, dual-core lockstep and on-chip redundancy have become much cheaper. Many applications only need redundancy at key nodes, not full system duplication.
Q: Do self-diagnostics cause false alarms or frequent shutdowns?
A: Good designs use multi-level thresholds: warning (just alert), degraded operation (speed/function limit), and safe stop (last resort). This avoids "cry wolf" false alarms while ensuring real risks aren't missed.
Q: Will SOTIF completely replace functional safety?
A: No. They are complementary. Functional safety handles "how to stay safe if hardware breaks", while SOTIF handles "how to avoid hazards even when hardware is fine but environment/algorithm cause issues". High-safety-level systems of the future will need both.
Functional safety ensures industrial hardware "can handle failures when they occur"; SOTIF aims to make hardware "avoid failures in the first place". Redundancy and self-diagnostics are the two pillars enabling this transformation.
In future factories, machines will not only work autonomously but also "feel" if they're tired, if the environment is messy, if teammates show anomalies. This is a smarter, more humane safety philosophy – safety isn't just a bottom line, but an active awareness embedded in every microsecond decision.