Systems and methods for safety-enabled control

1. A system comprising:

a safety subsystem configured to:

during a first time period:

receive a first input value from an input source;

generate a first safety condition based on the first input value; and

output the first safety condition; and

during a second time period succeeding the first time period:

receive a second input value from the input source;

generate a second safety condition based on the second input value; and

output the second safety condition; and

a command gate configured to:

during the first time period:

receive a first unvalidated control value from a control system distinct from the input source;

receive the first safety condition from the safety subsystem;

validate the first unvalidated control value as a first safe control value based on the first safety condition; and

output the first safe control value to a system under control; and

during the second time period:

receive a second unvalidated control value from the control system;

receive the second safety condition from the safety subsystem;

transform the second unvalidated control value into a second safe control value based on the second safety condition; and

output the second safe control value to the system under control.

2. The system of claim 1 , wherein the safety subsystem is further configured to:

during the first time period:

receive a first watchdog signal from the control system; and

generate the first safety condition based on the first input value and the first watchdog signal; and

during the second time period:

receive a second watchdog signal from the control system; and

generate the second safety condition based on the second input value and the second watchdog signal.

3. The system of claim 1 :

wherein the safety subsystem is further configured to, during a third time period succeeding the second time period:

receive a third input value from the input source;

generate a third safety condition based on the third input value; and

output the third safety condition; and

wherein the command gate is further configured to, during the third time period:

receive a third unvalidated control value from the control system;

receive the third safety condition from the safety subsystem; and

discard the third unvalidated control value based on the third safety condition.

4. The system of claim 1 , wherein the safety subsystem is further configured to:

during the first time period:

detect a first operating mode of the system under control; and

generate the first safety condition based on the first input value and the first operating mode; and

during the second time period:

detect a second operating mode of the system under control; and

generate the second safety condition based on the second input value and the second operating mode.

5. The system of claim 4 :

wherein the safety subsystem is further configured to:

during the first time period, generate a first control validation window based on the first input value and the first operating mode; and

during the second time period, generate a second control validation window based on the second input value and the second operating mode; and

wherein the command gate is further configured to:

during the first time period, validate the first unvalidated control value as the first safe control value based on the first control validation window; and

during the second time period, transform the second unvalidated control value into the second safe control value based on the second control validation window.

6. The system of claim 1 , wherein the safety subsystem is further configured to:

during the first time period:

detect a first set of link metrics for a first communication interface; and

generate the first safety condition based on the first input value and the first set of link metrics; and

during the second time period:

detect a second set of link metrics for the first communication interface; and

generate the second safety condition based on the second input value and the second set of link metrics.

7. The system of claim 6 , wherein the safety subsystem is further configured to:

during the first time period:

detect a first operating mode based on the first set of link metrics; and

generate the first safety condition based on the first input value and the first operating mode; and

during the second time period:

detect a second operating mode based on the second set of link metrics; and

generate the second safety condition based on the second input value the second operating mode.

8. The system of claim 6 , further comprising:

the first communication interface characterized by a first interface type; and

a second communication interface characterized by a second interface type different from the first interface type.

9. The system of claim 1 , wherein:

the safety subsystem is further configured to output safety information to the command gate, the safety information comprising a set of unsafe command values; and

the command gate configured to validate the first unvalidated control value as the first safe control value comprises the command gate configured to validate the first unvalidated control value as the first safe control value based on:

the second safety condition; and

the set of unsafe command values.

10. The system of claim 1 , wherein:

the safety subsystem is further configured to output safety information to the command gate, the safety information comprising a set of transformation rules; and

the command gate configured to validate the first unvalidated control value as the first safe control value comprises the command gate configured to transform the second unvalidated control value into the second safe control value based on:

the second safety condition; and

the set of transformation rules.

11. A system comprising:

a safety subsystem configured to:

during a first time period:

generate a first safety condition based on a first set of link metrics corresponding to a communication interface; and

output the first safety condition; and

during a second time period succeeding the first time period:

generate a second safety condition based on a second set of link metrics corresponding to the communication interface; and

output the second safety condition; and

a command gate configured to:

during the first time period:

receive a first unvalidated control value from a control system;

receive the first safety condition from the safety subsystem;

validate the first unvalidated control value as a first safe control value based on the first safety condition; and

output the first safe control value to a system under control; and

during the second time period:

receive a second unvalidated control value from the control system;

receive the second safety condition from the safety subsystem;

transform the second unvalidated control value into a second safe control value based on the second safety condition; and

output the second safe control value to the system under control.

12. The system of claim 11 , wherein the safety subsystem is further configured to:

during the first time period:

detect a first operating mode based on the first set of link metrics; and

generate the first safety condition based on the first operating mode; and

during the second time period:

detect a second operating mode based on the second set of link metrics; and

generate the second safety condition based on the second operating mode.

13. The system of claim 11 :

wherein the safety subsystem is further configured to:

during the first time period, generate a first control validation window based on the first set of link metrics; and

during the second time period, generate a second control validation window based on the second set of link metrics; and

wherein the command gate is further configured to:

during the first time period, validate the first unvalidated control value as the first safe control value based on the first control validation window; and

during the second time period, transform the second unvalidated control value into the second safe control value based on the second control validation window.

14. The system of claim 11 :

wherein the safety subsystem is further configured to, during a third time period succeeding the second time period:

generate a third safety condition based on a third set of link metrics corresponding to the communication interface; and

output the third safety condition; and

wherein the command gate is further configured to, during the third time period:

receive a third unvalidated control value from the control system;

receive the third safety condition from the safety subsystem; and

discard the third unvalidated control value based on the third safety condition.

15. The system of claim 11 , wherein the safety subsystem is further configured to detect the first set of link metrics comprising:

a link status;

a link quality;

a signal strength;

an average message error rate; and

an average message latency.

16. A system comprising:

a safety subsystem configured to:

detect an operating mode of a system under control;

generate a safety condition based on the operating mode;

generate a control validation window based on the safety condition and the operating mode;

output the safety condition and the control validation window; and

a command gate configured to:

receive a unvalidated control value from a control system;

receive the control validation window from the safety subsystem;

generate a safe control value based on the unvalidated control value and the control validation window; and

output the safe control value to the system under control.

17. The system of claim 16 , wherein the safety subsystem is further configured to generate the control validation window comprising:

a valid window layer characterized by a first control value boundary; and

a stop window layer characterized by a second control value boundary distinct from the first control value boundary.

18. The system of claim 17 , wherein the command gate is further configured to validate the unvalidated control value as the safe control value in response to detecting an intersection between the unvalidated control value and the valid window layer.

19. The system of claim 16 , wherein the command gate is further configured to transform the unvalidated control value into the safe control value:

in response to detecting an absence of the unvalidated control value from the valid window layer; and

in response to detecting an intersection between the unvalidated control value and the stop window layer.

20. The system of claim 16 :

wherein the safety subsystem is further configured to generate the control validation window comprising a warning window layer characterized by a third control value boundary distinct from the first control value boundary and the second control value boundary; and

wherein the command gate is further configured to send a notification to the system under control:

in response to detecting an absence of the unvalidated control value from the valid window layer; and

in response to detecting an intersection between the unvalidated control value and the warning window layer.