Functional safety type liquid level transmitter

Aiming at the problem that traditional liquid level transmitters are difficult to meet the safety requirements in modern industrial production in terms of hardware design, a design method for a functional safety type liquid level transmitter with a safety integrity level of SIL2 is introduced. In the case where the hardware fault margin is set to a constant value of 0, the method of adding a diagnostic module is adopted. By comparing the dual channel sampling diagnosis of the power module and the watchdog diagnosis of the clock module, the system diagnostic coverage is increased, effectively increasing the safety failure score. After Failure Mode, Effects and Diagnostic Analysis (FMEDA), the results showed that the safety failure score reached 98.3%, meeting the requirements of the target safety integrity level.

2. Structure and safety functions of safety level transmitter:
The requirement for safety functions comes from the analysis of hazards, that is, what must be done to avoid dangerous events; The requirement for security integrity level comes from the assessment of risks, that is, to what extent security functions must be executed to enable residual risks to be accepted. From the composition of security related products, it can be seen that a series of measures need to be taken in the design of hardware and software to increase security functions. The hardware safety integrity level is limited by the hardware failure margin and safety failure score. Hardware failure margin refers to the loss of system safety functions caused by failures exceeding this parameter. In industry, the hardware failure margin is often determined based on the hardware requirements of the equipment; And the safety failure fraction SFF is as shown in equation (1), where ∑ λ_SRefers to the total probability of safety failure, ∑ λ_DRefers to the total probability of dangerous failure, ∑ λ_DDDiagnostic testing
The detected probability of dangerous failure indicates that the safety failure score is related to the diagnosable probability of dangerous failure, which means that the safety failure score can be improved by increasing the diagnostic circuit. In order to ensure the safe and reliable operation of the liquid level transmitter in hardware, it is necessary to diagnose each module of it

SFF =	∑λS	+∑λDD	(1)
	∑λS	+ ∑λD

The safety function of the liquid level transmitter is to accurately measure the liquid level value and transmit the measured data to the subsequent processing module. Its basic functional modules mainly include signal input, A/D conversion, microprocessor data processing, D/A conversion output, power module, and clock module. Under the control of the clock system, the data measured by the sensor is first transmitted to the A/D conversion module through the signal input module, and then transmitted to the microcontroller after A/D conversion. The microcontroller filters the data to calculate the current liquid level value measured by the sensor and the corresponding code value, which is then written into the D/A conversion module. The D/A chip outputs a standard current signal of the corresponding size based on the obtained code value, and the power module provides stable voltage to other modules in this process.

3. Design of Safety Liquid Level Transmitter:
To achieve the target safety integrity level in hardware, liquid level transmitters usually start from two aspects: increasing hardware fault margin through redundant structures to avoid the system entering a dangerous state due to one channel failure; By designing diagnostic circuits to increase safety failure scores, it is possible to detect and take measures in a timely manner before danger occurs, transforming dangerous failures into safety failures. In the case of a fixed hardware fault margin, diagnostic structures are usually designed for each functional module. The module design of the safety liquid level transmitter is shown in Figure 1.


Figure 1 Design diagram of safety level transmitter module
3.1. Basic functional module design:
The basic functions of a liquid level transmitter mainly include signal input, A/D conversion, microprocessor data processing, D/A conversion output, as well as power module and system clock module. This article takes the STM32F103xx enhanced series chip as an example to specifically discuss the hardware design of a secure liquid level transmitter. After the system is powered on, the clock module starts up. Under the clock provided by the system clock, the signal measured by the sensor is sent to the embedded analog-to-digital converter of the microcontroller to perform analog-to-digital conversion on the input signal. The microprocessor performs arithmetic processing on the converted signal and sends the obtained code value to the external D/A module. After * * *, the standard current signal output is obtained.
(1) Power module. The two-wire functional safety transmitter not only needs to supply power to the microprocessor, digital to analog converter D/A, and communication circuit, but also needs to isolate the input and output circuits for safety protection. Therefore, using only the internal power supply of the microcontroller is far from meeting the requirements. This design uses the LT1934 chip produced by Linear Corporation, which has an input voltage range of up to 34V and can be as small as 3 2 V, capable of adjusting various power sources. When inputting 24V DC power, the isolated group outputs 5V and 4mA current, while the non isolated group outputs 5V and 9mA current to meet the power supply needs of other modules;
(2) Clock system. Each module of the microprocessor needs to work under the drive of the clock. STM32 has five clock sources, and usually selects one of the three as the system clock: phase-locked loop frequency doubling output (PLL), 8 MHz RC oscillator (HSI), or high-speed external clock (HSE), which is then divided by an AHB frequency divider and provided to each module for use. Most clock outputs provided to peripherals come with enable controls, and before using the module, a signal must be sent to turn on its corresponding clock. The advantage of this design is that when a peripheral is not in use, its corresponding clock is turned off, reducing the power consumption of the system. It is worth noting that the watchdog circuit uses an internal low-speed clock (LSI), but the window watchdog uses the system clock to pass
Obtained through AHB1 frequency division. Set up A/D modules and off chip D/A modules

Blocks operate at the same frequency;

(3) MCU data processing module. The STM32F103xx enhanced series chips use high-performance ARM Cortex-M3 RISC designed specifically for embedded applications that require high performance, low cost, and low power consumption

［10］	At the same time, the chip is equipped with high-speed memory, including up to 128 kB
pit

The flash memory and 20 kB SRAM hardware of [11] fully meet the design requirements of the liquid level transmitter. In addition, it has rich functional modules, including 2 12 bit ADCs, power supply voltage monitoring, voltage regulator, DMA controller, independent watchdog and window watchdog, 7 timers, 9 communication interfaces (I2C, USART, SPI, CAN, USB), etc. The advantages are self-evident;

(4) A/D module. The STM32F103 enhanced product is embedded with two 12 bit ADCs, each with up to 16 external channels and a conversion voltage range of 0-3 Between 6V, the signal output from the sensor usually needs to be level shifted or amplified before being sent to the ADC. Before using the ADC module, the clock of the PA port must be turned on and PA0 must be set as an analog input. Two ADCs use the same clock frequency, and the data obtained by post sampling conversion is stored in the ADC1_DR register;
(5) D/A module. Due to the absence of embedded D/A in the STM32F103xx enhanced series chips, it is necessary to select a D/A chip as an external device to obtain standard output. This article uses the DAC7750 chip from TI company. This series of chips is a 12 bit analog-to-digital converter that can communicate with microcontrollers through SPI interface. There are 3 sets of output current ranges to choose from, 4-20 mA, 0-20 mA, and 0-24 mA, which meet the requirements of the product. At the same time, DAC7750 also has some self checking functions, including cyclic redundancy check, open circuit alarm, and watchdog circuit current output.

3.2. Diagnostic module design:
This article mainly focuses on hardware design diagnosis of A/D, D/A modules, and clock modules.

(1) Watch dog clock diagnosis. A watchdog is actually a timer circuit, with its input connected to the I/O on the microcontroller. The program controls the timing to transmit high or low levels to this pin, which is commonly known as "feeding the dog"; The other end is connected to the reset pin of the microcontroller. Once the system encounters program runaway or enters a dead loop due to interference, causing the "feeding dog" action to not proceed as scheduled, the watchdog will send a reset level to the microcontroller through the connected reset pin, resetting the microcontroller.
The STM32F103 enhanced series chips come with two watchdog timers, one is an independent watchdog and the other is a window watchdog. Due to the need to diagnose the offset of the crystal oscillator, a window watchdog is selected here. Feeding the watchdog too early or too late will cause the system to reset;
(2) A/D module diagnosis. Due to the embedded two 12 bit analog-to-digital converters (ADCs) in the STM32F103xx enhanced product, a dual ADC mode is used here to synchronously sample the input signal. The converted data is stored in the ADC_JDR1 memory of the A/D interface, where the data converted by ADC1 is stored in the lower 16 bits of the register

ADC2 stores the data in the top 16 bits. The data obtained by ADC2 is used as a reference data and compared with the data obtained by ADC1. If the error between the two data is within an acceptable range, the system is considered safe and the low 16 bits of the register data are transmitted to the MCU for processing; Otherwise, if the ADC malfunctions, it may lead to dangerous system failure, and the software must ensure that the system enters a safe state;

(3) D/A module diagnosis. Add an A/D chip to the system as a diagnostic tool for the D/A module. Given a set value, after D/A conversion

After conversion, use the converted data as input to the A/D module and extract the output signal after A/D conversion. If the data obtained after comparing * * * is the same as the set value, it is considered as the D/A conversion channel 12] No problem, if it is different, it will be judged as invalid. In addition, during the operation of the system, the current output can be monitored in real time by accessing the high-precision resistor inside DAC7750. Once it exceeds the normal output range, the system will issue an alarm.

4. Hardware Security Integrity Level Analysis:
According to the definition of IEC 61508, the liquid level transmitter belongs to Class B safety related subsystems, which means that the failure mode cannot be fully defined. At the same time, according to the system structure of 1001D, its hardware fault margin is 0. According to Table 1, in order for the system to achieve the target safety integrity level SIL2, its safety failure score must be above 90%.

Table 1 Structural Constraints of Class B Safety Related Subsystems

safe failure fraction		Hardware fault margin
	0	1	2
＜ 60%	not allowed	SIL1	SIL2
60% ～ ＜ 90%	SIL1	SIL2	SIL3
90% ～ 99%	SIL2	SIL3	SIL4
≥99%	SIL3	SIL4	SIL4

The FMEDA analysis method used in the article is mainly based on the standards of failure rate prediction, component failure modes and their percentages, and component failure

Pattern exclusion criteria 3	［13］	For complex devices, it is not possible to
	Partial composition

When conducting a detailed analysis of failure modes, failures are usually classified into safe failures, 50% dangerous failures, and 50% dangerous failures. According to the diagnostic measures taken by each module, the diagnostic methods and their corresponding diagnostic coverage rates can be found from IEC 61508-2. This article refers to the military standard GJB/Z 299C-2006 Electronic Equipment Reliability Prediction Manual, and conducts failure mode, failure probability, and failure impact analysis on each component to obtain relative and accurate failure mode and diagnostic coverage evaluation information. The specific data is shown in the FMEDA analysis results in Table 2.

	Table 2	FMEDA analysis results
λs/h	λD/h		λDD/h	λDU/h
1. 52 × 10－ 7	6. 83 × 10－ 8		6. 47 × 10－ 8	3. 6 × 10－ 9

Therefore, the system security failure score

			∑λS	+ ∑λDD
		SFF =				=
			∑λS	+ ∑λD
	1. 52 × 10－7		+ 6. 47 × 10－8		= 98. 3%
	1. 52 × 10－7		+ 6. 83 × 10－8
	Satisfy SFF>90%, therefore, the above liquid level transmitter design scheme
Meet the requirements of hardware functional safety and integrity.