Special

What is Functional Safety (FUSA)?

A new acronym is making its rounds. Fusa, or you sometimes read about Fusa-Ready products. You can read what's behind it here.

Fusa stands for Functional Safety - a property of devices and systems to be safe. Safe in the sense of safety that no one is harmed in the event of malfunctions. So Functional Safety is actually nothing new. Except that safety is already supported in many semiconductors, software libraries and development tools.

What standards and security levels apply?

IEC 61508: The Basic Standard

The foundation of functional safety is IEC 61508. It applies across all industries to safety-related electronic systems and describes the entire life cycle, from risk analysis to decommissioning.

At the core of the standard are the Safety Integrity Levels (SIL 1 through 4). These levels specify how reliably a safety function must operate. The required SIL is determined by the risk analysis. SIL 1 represents the lowest risk, while SIL 4 represents the highest. With each level, the permissible probability of failure decreases by a factor of ten. At the same time, the requirements for the development process, documentation, and testing increase. In practice, SIL 1 through 3 are common; SIL 4 is rare.

Specific standards exist for individual industries. Most are based on or aligned with IEC 61508:

Automotive: ISO 26262 with levels ASIL A through D
Mechanical engineering: EN ISO 13849-1 with performance levels PL a through e or IEC 62061 with SIL 1 through 3
Rail: EN 50126, EN 50129, and for software, EN 50128 or its successor EN 50716, with SIL 1 through 4
Process industry: IEC 61511 with SIL levels

The standard and classification determine the architecture, component selection, and development effort. This should therefore be clarified early in the project.

safe is safe

Embedded Systems with safety

An embedded system with safety usually consists of redundant function blocks that are monitored or monitor each other. If a circuit fails, clever system design and a little probability calculation ensure that the system switches to a safe state.

For example, if you press the emergency stop button, the system must come to a safe stop. If the connection to the emergency stop button is faulty for whatever reason, the system must detect this and also stop the plant.

Ginzinger Embedded Hardware Software Integration

Comprehensive Risk Analysis for Functional Safety

With functional safety systems, it is always necessary to conduct a comprehensive analysis:

What could go wrong?
What is the probability that something will go wrong?
How high is the potential threat—that is, how many people could be injured or even killed?
What countermeasures should be implemented to ensure “safety”?

Failures can occur anywhere: during development, due to chip failures during operation, as a result of operator error, or due to external influences. In Fusa systems, such failures must under no circumstances pose a threat to life or limb.

Risk Analysis Methods

There are established methods for answering these questions:

FMEA (Failure Mode and Effects Analysis): It examines, step by step, how individual components or functions can fail and what consequences this has for the overall system.
HAZOP (Hazard and Operability Study): A team uses keywords such as “more,” “less,” or “none” to determine which deviations from normal operation lead to hazards. This method originates from the process industry.
FMEDA (Failure Modes, Effects, and Diagnostic Analysis): An extension of FMEA for electronics. It calculates failure rates and assesses how many faults the diagnostic system detects. This makes it possible to verify whether the hardware achieves the required SIL.

Safety and Security: The difference

In German, both are called “Sicherheit,” but they refer to different things. Safety protects people and the environment from the system itself—for example, from a machine that fails to stop in the event of a malfunction. Security, on the other hand, protects the system from attacks, tampering, and unauthorized access. The two are interrelated: A connected device can only be safe if it is also secure. If an attack on the control system is successful, safety functions could, in the worst-case scenario, be compromised.

Control mechanism

Fusa-Ready components

With a machine, this is still manageable. With a high-speed train, a car or an airplane in motion, you have to apply higher standards. Such systems cannot simply be stopped. In the event of a fault, they must continue to function and, if necessary, brake in an orderly manner or land safely. Fusa-Ready components already offer integrated mechanisms to make systems safe. These can be microcontrollers with two or more independent cores.

But they can also be turnkey software libraries to meet the requirements of safe communication, for example. While safety used to be something special, it is increasingly becoming a standard feature of many applications. That is why component manufacturers are now offering more and more functional safety ready products.

FAQ functional safety

As soon as a malfunction in your electronic systems could endanger people or the environment—for example, in emergency stop, monitoring, or braking functions—the risk assessment will determine whether and to what extent functional safety is required. Clarify this early in the project.

This usually requires a great deal of effort, as there is a lack of evidence from the development phase and diagnostic mechanisms. It often makes more sense to offload the safety function to an additional component that monitors the existing system.

ISO 9001 governs processes within a company but does not address specific hazards. FuSa assesses the risks associated with a specific product and establishes measurable objectives for its safety functions. A quality management system provides a solid foundation but does not replace FuSa.