Chips, modules and equipment for factory automation, process control, machinery, power grids and energy systems, from the application scope and hazard and threat analysis through a functional safety lifecycle to IEC 61508 and a secure development process to IEC 62443, safety analysis and fault insertion, EMC, electrical safety and hazardous area type testing, independent assessment and certification, to production, field support, vulnerability handling, long-life supply and end of support.
Industrial and energy electronics lifecycle: 12 stages, 12 gates of its own and 5 hand-offs to the Product lifecycle, from Concept & Application Scope to Long-Life Supply, Obsolescence & End of Life.
12 stages, 12 gates of its own and 5 hand-offs to the Product lifecycle, 3 of the gates technical readiness reviews (TR). Each stop opens its stage; each sign opens its gate. Point at a stop or tab to it to read what the stage is for. What the codes mean
In collaboration with The Digital Electronics Blog (opens in a new tab)
A dashed sign with a TR tag is a technical readiness review gate.
An outlined sign with an arrow is a hand-off: the gate is owned by the Product lifecycle, where this lifecycle hands its work on.
In collaboration with The Digital Electronics Blog (opens in a new tab)
Defining the industrial or energy application the product serves, such as factory automation, process control, machinery, power grid and substation equipment, inverters, drives or energy storage, with its operating environment, the markets and certification schemes it must enter, the safety and security functions it may carry, and the supply life customers expect, so the overall scope of the safety lifecycle and the compliance plan are fixed before design starts.
Concept approval gate, owned by the Product lifecycle (Concept approval)TR1: Technology feasibility gateTR1, technical readiness reviewScope and compliance plan agreed gate, owned by the Product lifecycle (Plan approval and development commit)
An outlined sign with an arrow is a hand-off: the gate is owned by the Product lifecycle, where this lifecycle hands its work on.
Identifying the hazards of the equipment under control and the threats to the product and the system it sits in, estimating the risk of each, and deciding how much risk reduction the product must provide: a target safety integrity level under IEC 61508, a performance level under ISO 13849 for machinery, and target security levels for the zones and conduits it belongs to under IEC 62443.
Writing the requirements the product will be verified against: the safety functions with their integrity, response and safe state requirements, the security capabilities each target security level calls for, and the electrical safety, EMC, environmental, explosion protection and interoperability requirements of each target market, with every requirement traced to its source.
Choosing the hardware and software architecture that meets the requirements: redundancy and voting, hardware fault tolerance, diagnostics and their coverage, safe states and reaction times, isolation and insulation coordination, the partition between chips, boards and software, and the security architecture with its trust anchor, secure boot, update path and defence in depth.
Designing the chips, boards and power stages to the safety concept: diagnostics, watchdogs, monitors and redundant channels in silicon and on the board, isolation barriers with the creepage and clearance the insulation concept requires, EMC-aware layout, and components chosen for the temperature, life and supply the application needs.
Developing the embedded firmware and software to the integrity level it carries and under a secure development process: software safety requirements, architecture and partitioning, coding to a defined standard, unit and integration testing, qualification of the tools used, and secure coding, dependency control and secure update support.
Showing that the design meets its requirements before type testing: failure modes, effects and diagnostic analysis with hardware metrics, dependent and common cause failure analysis, fault insertion testing, hardware and software verification against the traceability matrix, and security verification through vulnerability scanning, fuzzing and penetration testing.
Testing representative units of the final design against the market and safety requirements: safety validation of every safety function, EMC emissions and immunity including the immunity levels expected for safety functions, electrical safety type tests, environmental and mechanical tests, explosion protection tests where the product is for hazardous areas, and interoperability and conformance tests for the communication protocols it supports.
Type test readiness gateValidation and type tests passed gate
Having the product and its development process judged: the functional safety assessment, by an independent assessor or an accredited certification body at the independence the integrity level requires, the security certification of the development process or the component where customers ask for it, product safety certification or listing, hazardous area certification, and the declarations of conformity for each market.
Functional safety assessment passed gateCertificates and declarations issued gate
Releasing the certified design for manufacture under control: production test including the routine safety tests the product standard requires, a control plan for the characteristics that matter to safety and certification, factory inspections by certification bodies, serialisation and traceability, and the datasheet and long-term supply commitment customers rely on.
Supporting customers who build the product into safety instrumented systems, machinery, substations and plants, and keeping it safe and secure in service for many years: integration support against the safety manual, proof test and maintenance guidance, field failure and return analysis, vulnerability handling and security updates, and every modification assessed for its effect on the safety and security case and the certificates.
Keeping parts available for the long service lives of industrial and energy installations, watching components, processes and tools for obsolescence, notifying customers of changes, managing last-time buys and redesigns, and ending support in a way that leaves customers able to maintain, replace or decommission installed systems safely.
Last-time buy gate, owned by the Product lifecycle (Last-time buy)End of support gate, owned by the Product lifecycle (End of support)
The full lifecycle detail, with its charts, flows, tables and every section, is for registered members. Registration is free and takes a minute. You come back to this page afterwards.