Safe communication between autonomous units over radio, designed for SIL 3

The task

When several autonomous units perform one movement together, each of them has to know at all times whether the others are still in. As long as they are connected by cable, that is solved. Once they stand free, each with its own controller and its own power supply, the communication itself becomes a safety function: if it fails, the movement has to stop, and at all units at once.

What was required was a protocol that exchanges safety-related data between the units to IEC 61784-3 and is designed for SIL 3. The transport was to be radio, and the reaction time must not depend on how many units are involved.

The solution

The protocol follows the black-channel principle: the transport only carries, the safety lies in the endpoints. Each unit checks in its own safety controller whether a message is complete, current and from the expected counterpart. The radio controller in between reads from a message only what it needs for forwarding and generates none of its own. The safety argument therefore does not rest on the radio technology.

The units form a ring. Each receives from its predecessor, checks, adds its own share and passes on. The messages are built so that their size does not grow with the number of units; one pass around the whole ring takes 200 milliseconds, with up to 24 units, the limit set by the radio channel. If a message stays away, all units detect it within that time and enter the safe state. A movement starts only once the ring is complete and every unit has confirmed the group.

We specified and developed the protocol with the requirements for integrity, timeliness and addressing, the firmware of the communication endpoints and the transport profile for radio, with the boundary of what the transport may and may not do.