Safe communication between autonomous units over radio, designed for SIL 3

The task

When several autonomous units perform one movement together, each of them has to know at all times whether the others are still taking part. As long as they are connected by cable, that is solved. Once they stand free, each with its own controller and its own power supply, the communication itself becomes a safety function: if it fails, the movement has to stop, at every unit at the same time.

The client needed a protocol that exchanges safety-related data between the units to IEC 61784-3 and is designed for SIL 3. The transmission path was to be radio, and the reaction time was not to depend on how many units are involved.

The solution

The protocol follows the black-channel principle: the transmission path only carries the data, and safety lies in the endpoints. Each unit checks in its own safety controller whether a message is complete, current and from the expected sender. The radio controller in between reads from a message only what it needs for forwarding and generates no messages of its own. The safety argument therefore does not depend on the radio technology.

The units form a ring. Each receives from its predecessor, checks the message, adds its own part and passes it on. The messages are structured so that their size does not grow with the number of units; one pass around the whole ring takes 200 milliseconds, with up to 24 units, the limit set by the radio channel. If a message fails to arrive, all units detect it within that time and enter the safe state. A movement starts only once the ring is complete and every unit has confirmed the group.

We specified and developed the protocol, with its requirements for integrity, timeliness and addressing, the firmware of the communication endpoints and the transport profile for radio, which defines what the transmission path may and may not do.