Functional Safety as a 415 ms Budget

The most useful way to think about functional safety in a mobile robot drive is as a timing budget that propagates backward from a collision. Most teams treat it as a documentation exercise that happens after the hardware is fixed. It is the opposite. One number derived from how fast the machine moves and how far away an obstacle can be determines how often you must run diagnostics, which determines how much processing headroom your MCU needs, which determines the part you should have selected months earlier.

Where the number comes from

For autonomous mobile robots, ISO 3691-4 gives maximum speeds and distances to objects. Working from those, TI estimates that the overall process safety time needs to be less than 415 milliseconds ^[1]. That is the total time available from a fault occurring to the machine reaching a safe state.

The diagnostic time interval must be less than 10 percent of it. That puts the maximum for a full diagnostic sweep at 41.5 milliseconds ^[1].

Everything downstream follows. You must detect a fault, decide, and act inside 415 ms, and you must look often enough that no fault hides for longer than 41.5 ms. For a humanoid the geometry differs, but the method is identical: derive process safety time from the physics of your machine first, then let it size the electronics.

There is a corollary for anyone coming from automotive. Systems designed to ISO 26262 typically run diagnostics at system startup, while industrial systems running around the clock require continuous diagnostics during normal operation ^[2]. In an AMR the hazards are unpredictable, so diagnostics need to run continuously ^[1]. Startup only self test does not satisfy the requirement.

The architectural fork: redundancy or diagnostics

ISO 13849-1 gives you designated architectures, and choosing between two of them is the most consequential decision in the safety design. ISO 3691-4 requires a minimum of PL d, and either architecture below reaches it ^[1].

Category 2, HFT equal to 0. Single channel with monitoring, no duplicated hardware. In exchange it requires 90 percent average diagnostic coverage ^[1].

Category 3, HFT equal to 1. Dual channel with comparison. Physical redundancy tolerates a single fault, which relaxes both the diagnostic coverage demand and the timing constraints on the diagnostics ^[1].

You are trading silicon area against processing load. For a size constrained joint or a compact AMR drive, Category 2 is usually right, and its cost is the 90 percent coverage figure plus the compute to sustain it inside 41.5 ms.

Type A and Type B decide your safe failure fraction

Type A devices are simple, with well understood failure modes. Type B devices are complex enough that not all failure modes can be determined, and the MCU is a Type B device ^[1].

For SIL 2 at HFT equal to 0, the requirements diverge sharply ^[1]:

The practical consequence: choosing a simpler part where a simpler part will do reduces the evidence you have to produce. Vendor documentation supporting a Type A classification is worth real money in an assessment, because it lowers the safe failure fraction you must demonstrate.

The relaxation most teams miss

Diagnostic subsystems do not have to meet the same level as the function they monitor. Under the CNB-M-11.059 amendment to IEC 61508, the diagnostic path for a SIL 2 system needs to reach only SIL 1, and for a Type A diagnostic device the minimum safe failure fraction is 0 percent ^[1]. A Type B diagnostic device still needs 60 percent, as the table shows.

That is easy to overlook and substantial. Your watchdog, voltage supervisors and built in self test do not need the pedigree of the primary safety channel. Budget them accordingly instead of over specifying the whole monitoring chain to the system level.

Mapping Performance Level to SIL

Two standards, two vocabularies, one underlying probability of dangerous failure per hour ^[1]:

Category 2 with Performance Level d is the AMR case TI works through, and the same procedure applies to any other machine that requires Category 2 at PL d ^[1]. Note that Performance Level a has no SIL correspondence at all, which is worth knowing before someone claims one.

Which safety functions the drive actually owns

ISO 3691-4 assigns minimum Performance Levels to specific safety functions, and the motor drive implements them through IEC 61800-5-2 subfunctions ^[1]. A condensed view of TI's table:

Safe torque off, the function that prevents force producing power from reaching the motor ^[3], appears in nearly every row. That is why it dominates the conversation about integrated gate drivers, and why proving your safe state is worth designing for early.

One separation principle to verify

To make sure that a loss of function does not also take out the diagnostics, TI states that voltage supervision and the watchdog question and answer function cannot sit in the same IC ^[1]. In our reading that means an external voltage supervisor alongside a PMIC that already carries a watchdog. We have not independently verified the exact clause and its scope against the current ISO 13849-1 text, and the boundary matters for parts selection. Confirm it with your assessor rather than treating it as settled.

The method, in one line

Derive process safety time from your machine's physics. Take a tenth of it as the diagnostic interval. Pick an architecture, which sets your diagnostic coverage target. Classify your parts, which sets your safe failure fraction. Then size the MCU. Doing it in the other order is how safety becomes a schedule risk.

References

1. Texas Instruments, Simplifying Robotics Motor Drive Safety Assessments, SPRAD98, May 2023.
2. Texas Instruments, Choosing a Position Sensor in Motor Control, SLYT867, Analog Design Journal 2Q 2025.
3. Texas Instruments, Design Smaller Safe Torque Off (STO) Systems Using Integrated 3-Phase Smart Gate Drivers, SLVAF31, March 2021.