Where a technical evaluator decides.
Safety is not achieved in the specification. It is achieved at the interface to the field, in the way an output is asserted and an input is believed.
Diagram: the output path showing both nodes asserting, the voting in the output domain, and the readback with cross-comparison. A second panel shows the input path with independent acquisition and cross-comparison.
Outputs: asserted by both, or not at all.
The custom vital I/O interface gives each node a bus that memory-maps registers into that node’s address space. On the output side the composite paradigm applies: the output is really asserted only when both nodes assert their registers.
Registers can be redounded, or coded with a different key in each node, so that a bus error is detected at a very early stage rather than at the point where it matters.
Inputs: read twice, believed once.
Each node reads the value independently and uses it only after a successful cross-comparison between nodes. The comparison is not a formality bolted on at the end; it is the condition under which the value enters the application at all.
What backs it up.
- Controlled power supply: each node monitors the other node’s supply and can interrupt the supply of the whole system
- Hardware diversity as a deliberate strategy, with the device families named
- Full insulation strategy on the I/O
- Embedded diagnostics on every channel, under periodic test
- A system-level state machine: bootstrap, hardware check, configuration load, normal operation, and safe state on any error
NEAT / VITAL I/O / OUTPUT VOTINGSafe state means safe, and it stays that way.
On a hazardous failure the system enters the safe state: the failure is recorded in mass memory and every safety-related software component stops. Retention is what makes it a safe state rather than a pause. On restart the presence of the recorded failure is checked, and it prevents the application from being loaded and executed at all.