ENSURING FUNCTIONAL SAFETY REQUIREMENT SATISFACTION FOR OUPUT DETERMINATION AND OUTPUT OF SAFETY MESSAGES

1 . A method comprising:

obtaining, by an output controller having a first microcontroller and a second microcontroller, a pair of safety state inputs;

at each of the first microcontroller and the second microcontroller:

determining, by a software application controller, whether the pair of safety state inputs both show an unasserted state;

responsive to determining that the pair of safety state inputs both show an unasserted state, determining a normal state;

responsive to determining that the pair of safety state inputs do not both show an unasserted state, determining a safe state;

outputting, to a hardware abstraction layer of a hardware controller, a software command reflecting either a normal state or a safe state; and

converting the software command to a hardware command using the hardware abstraction layer, the hardware command maintaining the state of voltage of a circuit where the software command reflects a normal state, and the hardware command switching the voltage state to a safety state where the binary software command reflects a safe state;

comparing readback output values from the first microcontroller and the second microcontroller; and

generating an output based on the comparison of the readback output values.

2 . The method of claim 1 , wherein readback output values from the first microcontroller include a normal state, wherein readback output values from the second microcontroller include a safety state, and wherein the output is associated with a command to enter a safe state.

3 . The method of claim 1 , wherein the comparing of the readback output values from the first microcontroller and the second microcontroller is a first comparison, and wherein the method further comprises:

performing a second comparison by comparing values associated with the determination made by the software controller for the first microcontroller with the readback output value from the first microcontroller; and

additionally determining whether the output is to be associated with a command to enter the safe state based on the second comparison.

4 . The method of claim 3 , further comprising:

performing a third comparison by comparing values as associated with the state determined by each microcontroller with one another; and

additionally determining whether the output is to be associated with a command to enter the safe state based on the third comparison.

5 . The method of claim 4 , wherein the first comparison, the second comparison, and the third comparison are performed with respect to fault indicator values.

6 . The method of claim 4 , wherein the results of the first comparison, the second comparison, and the third comparison result are expected to result in result values each having a hamming distance of 4 from one another, and wherein an overwrite error is detected where a result has a value other than one expected in the result values.

7 . The method of claim 1 , wherein determining that the pair of safety state inputs do not both show an unasserted state comprises one or more of:

determining that the pair of safety state inputs both show an asserted state;

determining that one of the pair of safety state inputs show an asserted state;

determining that one of the pair of safety state inputs show a safety state; and

determining that the pair of safety state inputs both show a safety state.

8 . The method of claim 1 , wherein the output controller is a zone controller that controls the state of two or more devices in a facility.

9 . The method of claim 8 , wherein the zone controller transmits outputs to devices based on information in a mapping table.

10 . A non-transitory computer-readable medium comprising memory with instructions encoded thereon, the instructions, when executed by one or more processors, causing the one or more processors to perform operations, the instructions comprising instructions to:

obtain, by an output controller having a first microcontroller and a second microcontroller, a pair of safety state inputs;

at each of the first microcontroller and the second microcontroller:

determine, by a software application controller, whether the pair of safety state inputs both show an unasserted state;

responsive to determining that the pair of safety state inputs both show an unasserted state, determine a normal state;

responsive to determining that the pair of safety state inputs do not both show an unasserted state, determine a safe state;

output, to a hardware abstraction layer of a hardware controller, a binary software command reflecting either a normal state or a safe state; and

convert the binary software command to a hardware command using the hardware abstraction layer, the hardware command maintaining the state of voltage of a circuit where the binary software command reflects a normal state, and the hardware command switching the voltage state to a safety state where the binary software command reflects a safe state;

compare readback output values from the first microcontroller and the second microcontroller; and

generate an output based on the comparison of the readback output values.

11 . The non-transitory computer-readable medium of claim 10 , wherein readback output values from the first microcontroller include a normal state, wherein readback output values from the second microcontroller include a safety state, and wherein the output is associated with a command to enter a safe state.

12 . The non-transitory computer-readable medium of claim 10 , wherein the comparing of the readback output values from the first microcontroller and the second microcontroller is a first comparison, and wherein the instructions further comprise instructions to:

perform a second comparison by comparing values associated with the determination made by the software controller for the first microcontroller with the readback output value from the first microcontroller; and

additionally determine whether the output is to be associated with a command to enter the safe state based on the second comparison.

13 . The non-transitory computer-readable medium of claim 12 , the instructions further comprising instructions to:

perform a third comparison by comparing values as associated with the state determined by each microcontroller with one another; and

additionally determine whether the output is to be associated with a command to enter the safe state based on the third comparison.

14 . The non-transitory computer-readable medium of claim 13 , wherein the first comparison, the second comparison, and the third comparison are performed with respect to fault indicator values.

15 . The non-transitory computer-readable medium of claim 13 , wherein the results of the first comparison, the second comparison, and the third comparison result are expected to result in result values each having a hamming distance of 4 from one another, and wherein an overwrite error is detected where a result has a value other than one expected in the result values.

16 . The non-transitory computer-readable medium of claim 10 , wherein determining that the pair of safety state inputs do not both show an unasserted state comprises one or more of:

determining that the pair of safety state inputs both show an asserted state;

determining that one of the pair of safety state inputs show an asserted state;

determining that one of the pair of safety state inputs show a safety state; and

determining that the pair of safety state inputs both show a safety state.

17 . The non-transitory computer-readable medium of claim 10 , wherein the output controller is a zone controller that controls the state of two or more devices in a facility.

18 . The method of claim 17 , wherein the zone controller transmits outputs to devices based on information in a mapping table.

19 . A system comprising:

memory with instructions encoded thereon; and

one or more processors that, when executing the instructions, are caused to perform operations comprising:

obtaining, by an output controller having a first microcontroller and a second microcontroller, a pair of safety state inputs;

at each of the first microcontroller and the second microcontroller:

determining, by a software application controller, whether the pair of safety state inputs both show an unasserted state;

responsive to determining that the pair of safety state inputs both show an unasserted state, determining a normal state;

responsive to determining that the pair of safety state inputs do not both show an unasserted state, determining a safe state;

outputting, to a hardware abstraction layer of a hardware controller, a software command reflecting either a normal state or a safe state; and

converting the binary software command to a hardware command using the hardware abstraction layer, the hardware command maintaining the state of voltage of a circuit where the software command reflects a normal state, and the hardware command switching the voltage state to a safety state where the software command reflects a safe state;

comparing readback output values from the first microcontroller and the second microcontroller; and

generating an output based on the comparison of the readback output values.

20 . The system of claim 19 , wherein readback output values from the first microcontroller include a normal state, wherein readback output values from the second microcontroller include a safety state, and wherein the output is associated with a command to enter a safety state.