Reliable logging with time sync.

Document and validate toolchains.

MTBF, safety incidents, and coverage.

Clear contracts and monitoring.

HMI design for situational awareness.

Robotics Topic 16: Safety-Critical Software for Robots |…

Q: Which standards apply?

ISO/IEC and domain-specific safety standards.

Q: How to assure determinism?

Real-time OS and bounded latencies.

Q: How to handle faults?

Detection, graceful degradation, and recovery.

Architectures

Redundant controllers and watchdogs provide backup processing in case of primary system failure, ensuring continued operation or safe shutdown.

Deterministic middleware and isolation prevent unpredictable interference between software components, crucial for predictable behavior and safety guarantees.

Fail-operational vs fail-safe designs represent a key architectural choice: fail-operational systems continue to function with degraded performance during faults, while fail-safe systems prioritize immediate safety by entering a defined safe state.

жива демонстрація · пов'язана симуляція● LIVE

Testing and Certification

Standards, verification techniques, Hardware-in-the-Loop (HIL) tests, and comprehensive documentation are essential for demonstrating compliance with relevant safety regulations.

Rigorous testing protocols, including fault injection and stress testing, validate the system's ability to withstand unexpected conditions and maintain safe operation.

Detailed documentation outlining design choices, test results, and verification activities is critical for audits and regulatory approvals, ensuring traceability throughout the development lifecycle.

Example

Example: Emergency Stop Path – This involves a clearly defined path to quickly halt robot movement in response to a safety trigger, minimizing potential harm.

Design redundant sensing and logic – Utilizing multiple sensors and implementing fault-tolerant control algorithms enhances the system’s ability to detect and respond to hazards accurately.

Verify latency and reliability – Thoroughly assessing the time it takes for commands to execute and the consistency of sensor readings is paramount for ensuring timely safety responses.

Frequently asked questions

Which standards apply?

ISO/IEC 61508 and IEC 62366 are commonly applied, alongside domain-specific safety standards relevant to the robot’s intended application.

How to assure determinism?

Employing Real-Time Operating Systems (RTOS) with guaranteed scheduling and bounded latencies is fundamental for achieving deterministic behavior.

How to handle faults?

Implement robust fault detection mechanisms, design graceful degradation strategies to maintain functionality during partial failures, and establish recovery procedures for restoring normal operation.

Logs?

Utilize reliable logging with accurate time synchronization to capture detailed system events for analysis, debugging, and compliance verification.

Tool qualification?

Document and validate the entire toolchain used in development, ensuring traceability and minimizing potential sources of error or vulnerability.

Cybersecurity?

Implement security hardening measures and establish a process for delivering secure updates to protect against unauthorized access and malicious attacks.

Updates?

Maintain versioned releases of the software, accompanied by thorough testing and validation procedures to ensure compatibility and stability.

Metrics?

Track key performance indicators such as Mean Time Between Failures (MTBF), safety incident rates, and code coverage to monitor system reliability and identify areas for improvement.

Interfaces?

Establish clear contracts between software components and implement monitoring mechanisms to detect communication errors or unexpected behavior.

Human factors?

Design Human-Machine Interfaces (HMIs) that provide operators with sufficient situational awareness, enabling them to effectively monitor the robot’s operation and respond appropriately.

Try it live

Everything above runs in your browser — open Inverse Kinematics (FABRIK) and change the parameters while it is running. Nothing is installed, nothing is uploaded, the whole model lives in one tab.

▶ Open Inverse Kinematics (FABRIK) simulation