Functional safety concerns the correct operation of safety-related functions implemented by electrical/electronic/programmable electronic (E/E/PE) systems so that hazards are prevented or mitigated even in the presence of certain faults. In robots, examples of safety functions include:

• Emergency stop that removes power or torque from actuators.
• Speed and separation monitoring for collaborative robots.
• Safe torque off (STO) that forces drives into a non-torque state.

At an abstract level, a safety function can be modeled as a mapping \( f \) from system states to a binary decision:

\[ f : \mathcal{X} \to \{0,1\}, \quad f(x) = \begin{cases} 1 & \text{''safe action commanded''}, \\ 0 & \text{''no safety action''}. \end{cases} \]

Here \( \mathcal{X} \subset \mathbb{R}^n \) is the state space of the robot (joint positions, velocities, sensor readings, etc.). A basic safety requirement can be expressed as an invariance condition of a safe set \( S \subset \mathcal{X} \):

\[ x(0) \in S \;\Rightarrow\; x(t) \in S \text{ for all } t \ge 0 \quad \text{under the closed-loop dynamics with safety function } f. \]

Functional safety engineering asks: given imperfect components and failures, what is the probability that this requirement is violated over time?

flowchart TD
  H["Identify hazards in robot cell"] --> R["Quantify risk (probability * severity)"]
  R --> SREQ["Derive safety function requirements"]
  SREQ --> ARCH["Choose architecture (1oo1, 1oo2, 2oo3, diagnostics)"]
  ARCH --> IMPL["Implement in sensors, logic, actuators"]
  IMPL --> VER["Verify mathematically & by test"]
  VER --> OPN["Operate & monitor field data"]
  OPN --> FB["Feed back into next design iteration"]
        

A simple quantitative notion of risk is the expected loss. Suppose a robot has potential hazards \(H_1,\dots,H_m\). Let \( L_i > 0 \) be a numerical severity (e.g. cost or harm index) of hazard \( H_i \), and \( p_i = \mathbb{P}(H_i \text{ occurs in mission}) \) its probability. Then the total risk can be modeled as

\[ R_{\text{tot}} = \sum_{i=1}^m p_i L_i = \mathbb{E}[L], \]

where \( L \) is a random loss variable that equals \( L_i \) if hazard \( H_i \) occurs and \(0\) otherwise.

A safety function reduces risk by lowering the probability of hazardous events. If \( p_i^{\text{no-safety}} \) and \( p_i^{\text{with-safety}} \) are the corresponding probabilities, the risk reduction factor (RRF) for hazard \( H_i \) is

\[ \text{RRF}_i = \frac{p_i^{\text{no-safety}}}{p_i^{\text{with-safety}}}. \]

Functional safety standards often specify target ranges for this reduction. Mathematically, we therefore need models of \( p_i^{\text{with-safety}} \) that depend on component reliability and redundancy.

Consider a single-channel safety function (1oo1: one-out-of-one) implemented by one sensing-logic-actuation chain. Let \( T \) be the random time to a dangerous failure of this chain, and define the reliability function

\[ R(t) = \mathbb{P}(T > t), \]

the probability that no dangerous failure has occurred up to mission time \( t \). A widely used model assumes a constant dangerous failure rate \( \lambda_D > 0 \), which implies an exponential distribution for \( T \). The differential equation for \( R(t) \) is

\[ \frac{\mathrm{d}}{\mathrm{d}t} R(t) = -\lambda_D R(t), \quad R(0) = 1. \]

Solving this linear ODE gives

\[ R(t) = \exp(-\lambda_D t), \qquad F(t) := 1 - R(t) = 1 - \exp(-\lambda_D t), \]

where \( F(t) \) is the cumulative probability that a dangerous failure has occurred by time \( t \). The mean time to dangerous failure (MTTDF) is

\[ \text{MTTDF} = \int_0^{\infty} R(t)\,\mathrm{d}t = \int_0^{\infty} \exp(-\lambda_D t)\,\mathrm{d}t = \frac{1}{\lambda_D}. \]

This simple exponential model underlies many quantitative safety calculations for robot components (encoders, drives, safety PLCs, etc.).

Redundancy introduces multiple channels that jointly implement a safety function. Suppose we have \( n \) channels with independent identical reliability \( R_c(t) \) each, and define a binary variable \( X_i(t) \in \{0,1\} \) indicating whether channel \(i\) is still functioning at time \(t\).

A \(k\)-out-of-\(n\) architecture declares the system functional if at least \( k \) channels are functioning, i.e.

\[ \varphi(x_1,\dots,x_n) = \begin{cases} 1 & \text{if } \sum_{i=1}^n x_i \ge k, \\ 0 & \text{otherwise.} \end{cases} \]

Under independence and identical \( R_c(t) \), the system reliability is the tail of a binomial distribution:

\[ R_{\text{sys}}(t) = \sum_{i=k}^n \binom{n}{i} R_c(t)^i \bigl(1 - R_c(t)\bigr)^{n-i}. \]

Important special cases:

• 1oo1 (no redundancy).

  \[ R_{1\text{oo}1}(t) = R_c(t). \]

• 1oo2 (one-out-of-two). Only one channel must work (typical for safety: any channel that trips is enough). Then

  \[ R_{1\text{oo}2}(t) = 1 - \bigl(1 - R_c(t)\bigr)^2 = 2 R_c(t) - R_c(t)^2. \]

• 2oo2 (two-out-of-two). Both channels must work (common for high-availability voting). Then

  \[ R_{2\text{oo}2}(t) = R_c(t)^2. \]

For \( 0 < R_c(t) < 1 \), we can prove that redundancy in a 1oo2 architecture always increases reliability relative to 1oo1:

\[ R_{1\text{oo}2}(t) - R_{1\text{oo}1}(t) = \bigl(2 R_c - R_c^2\bigr) - R_c = R_c (1 - R_c) \ge 0. \]

Similarly, a 2oo2 architecture reduces reliability in the sense that

\[ R_{2\text{oo}2}(t) - R_{1\text{oo}1}(t) = R_c^2 - R_c = R_c (R_c - 1) \le 0. \]

In safety engineering, one must decide whether the architecture is optimized for safety trip reliability (often 1oo2) or production availability (architectures that reduce spurious trips). The same mathematics applies, but the definition of system success or failure changes.

flowchart LR
  A1["Single channel (1oo1)"] -->|fail if channel fails| HF1["High P(failure)"]
  A2["Redundant 1oo2"] -->|fail only if both fail| HF2["Lower P(failure)"]
  A3["Majority 2oo3"] -->|fail only if 2 or 3 fail| HF3["Even lower P(failure)"]
        

Not all failures are equally harmful. Let us decompose the total failure rate \( \lambda \) of a component into:

• \( \lambda_{S} \): rate of safe failures (lead to a safe state).
• \( \lambda_{DD} \): rate of dangerous, detected failures.
• \( \lambda_{DU} \): rate of dangerous, undetected failures.

Then \( \lambda = \lambda_S + \lambda_{DD} + \lambda_{DU} \). Two important quantities are:

Safe Failure Fraction (SFF).

\[ \text{SFF} = \frac{\lambda_S + \lambda_{DD}}{\lambda_S + \lambda_{DD} + \lambda_{DU}}. \]

Diagnostic Coverage (DC).

\[ c = \frac{\lambda_{DD}}{\lambda_{DD} + \lambda_{DU}}. \]

If we define the dangerous failure rate (before diagnostics) as \( \lambda_D = \lambda_{DD} + \lambda_{DU} \), then the residual dangerous undetected rate is

\[ \lambda_{DU} = (1 - c)\,\lambda_D. \]

For a mission of duration \( T_{\text{mission}} \) with an exponential model, the approximate probability of an undetected dangerous failure during the mission is

\[ p_{\text{DU}} \approx \lambda_{DU} T_{\text{mission}} \quad \text{for } \lambda_{DU} T_{\text{mission}} \ll 1. \]

The corresponding contribution to expected loss for a hazard of severity \( L \) is approximately

\[ R_{\text{res}} \approx \lambda_{DU} T_{\text{mission}} L. \]

Redundant architectures plus diagnostics aim to make \( \lambda_{DU} \) so small that the residual risk \( R_{\text{res}} \) falls into an acceptable region.

Consider a robot with a safety function that stops motion when a human presses an emergency stop button. The safety function is periodically tested every \( T_I \) hours (proof test interval). We assume a low-demand mode: demands are rare compared to tests, and failures are revealed or repaired at each test.

Let \( \lambda_D \) be the constant dangerous failure rate of the safety channel. Let \( T \) be the time of dangerous failure, and let \( U \) be the time of demand, modeled as uniformly distributed over \([0,T_I]\). For a 1oo1 system, the average probability of failure on demand (PFD) over the interval is

\[ \text{PFD}_{\text{avg}}^{1\text{oo}1} = \frac{1}{T_I} \int_0^{T_I} \mathbb{P}(T \le u)\,\mathrm{d}u = \frac{1}{T_I} \int_0^{T_I} \bigl(1 - \mathrm{e}^{-\lambda_D u}\bigr)\,\mathrm{d}u. \]

Evaluating the integral,

\[ \text{PFD}_{\text{avg}}^{1\text{oo}1} = 1 - \frac{1}{\lambda_D T_I} \bigl(1 - \mathrm{e}^{-\lambda_D T_I}\bigr). \]

For small \( \lambda_D T_I \), using the series \( \mathrm{e}^{-x} = 1 - x + \tfrac{x^2}{2} - \dots \), we obtain

\[ \text{PFD}_{\text{avg}}^{1\text{oo}1} \approx \frac{\lambda_D T_I}{2}. \]

Now consider a 1oo2 architecture with two independent channels of equal failure rate \( \lambda_D \). The system fails dangerously on demand if both channels have failed before \( U \). The per-demand failure probability at time \(u\) is approximately \( \mathbb{P}(T_1 \le u, T_2 \le u) \approx (\lambda_D u)^2 \) for small \( \lambda_D u \). Thus

\[ \text{PFD}_{\text{avg}}^{1\text{oo}2} \approx \frac{1}{T_I} \int_0^{T_I} (\lambda_D u)^2\,\mathrm{d}u = \frac{\lambda_D^2 T_I^2}{3}. \]

Comparing:

\[ \frac{\text{PFD}_{\text{avg}}^{1\text{oo}2}}{\text{PFD}_{\text{avg}}^{1\text{oo}1}} \approx \frac{\tfrac{\lambda_D^2 T_I^2}{3}}{\tfrac{\lambda_D T_I}{2}} = \frac{2}{3} \lambda_D T_I. \]

Since \(\lambda_D T_I \ll 1\) in well-designed systems, the 1oo2 architecture reduces the dangerous failure probability by roughly an order of magnitude (or more), depending on the numbers. This kind of calculation is central in sizing redundancy for robotic safety functions.

In Python, we can prototype reliability calculations using scientific libraries such as numpy, which are already common in robotics software stacks (e.g. within ROS 2 nodes written with rclpy). Below is a small module implementing exponential reliability and \(k\)-out-of-\(n\) redundancy.

import math
from typing import Iterable

def reliability_exponential(lambda_d: float, t: float) -> float:
    """
    Reliability R(t) = P(T > t) for an exponential time-to-dangerous-failure
    with rate lambda_d (per hour, for example).
    """
    if lambda_d < 0.0 or t < 0.0:
        raise ValueError("lambda_d and t must be non-negative")
    return math.exp(-lambda_d * t)

def k_out_of_n_reliability(Rc: float, n: int, k: int) -> float:
    """
    Reliability of a k-out-of-n architecture with identical,
    independent channels each with reliability Rc at time t.
    """
    if not (0.0 <= Rc <= 1.0):
        raise ValueError("Rc must be in [0, 1]")
    if k < 1 or k > n:
        raise ValueError("Need 1 <= k <= n")
    # Binomial tail sum
    R_sys = 0.0
    for i in range(k, n + 1):
        comb = math.comb(n, i)
        R_sys += comb * (Rc ** i) * ((1.0 - Rc) ** (n - i))
    return R_sys

def pfd_avg_1oo1(lambda_d: float, T_I: float) -> float:
    """
    Average probability of failure on demand for 1oo1 with exponential failures.
    Exact expression.
    """
    if lambda_d < 0.0 or T_I <= 0.0:
        raise ValueError("lambda_d must be non-negative and T_I > 0")
    if lambda_d == 0.0:
        return 0.0
    return 1.0 - (1.0 - math.exp(-lambda_d * T_I)) / (lambda_d * T_I)

def pfd_avg_1oo1_approx(lambda_d: float, T_I: float) -> float:
    """
    Low-demand approximation PFD_avg ~= lambda_d * T_I / 2.
    """
    return 0.5 * lambda_d * T_I

def pfd_avg_1oo2_approx(lambda_d: float, T_I: float) -> float:
    """
    Low-demand approximation for 1oo2: PFD_avg ~= lambda_d^2 * T_I^2 / 3.
    """
    return (lambda_d ** 2) * (T_I ** 2) / 3.0

if __name__ == "__main__":
    # Example: compare 1oo1 and 1oo2 for a safety channel
    lambda_d = 1e-6      # dangerous failures per hour
    T_I = 8760.0         # proof test interval: 1 year

    Rc = reliability_exponential(lambda_d, T_I)
    R_1oo1 = k_out_of_n_reliability(Rc, n=1, k=1)
    R_1oo2 = k_out_of_n_reliability(Rc, n=2, k=1)

    print("Component reliability Rc(T_I) =", Rc)
    print("R_1oo1(T_I) =", R_1oo1)
    print("R_1oo2(T_I) =", R_1oo2)

    pfd1_exact = pfd_avg_1oo1(lambda_d, T_I)
    pfd1_approx = pfd_avg_1oo1_approx(lambda_d, T_I)
    pfd2_approx = pfd_avg_1oo2_approx(lambda_d, T_I)

    print("PFD_avg 1oo1 (exact)  =", pfd1_exact)
    print("PFD_avg 1oo1 (approx) =", pfd1_approx)
    print("PFD_avg 1oo2 (approx) =", pfd2_approx)
      

These functions can be wrapped into a ROS 2 safety analysis node that periodically recomputes risk measures based on updated failure rate estimates from field data.

In C++ (commonly used with ROS 2 via rclcpp), the same formulas can be implemented with the standard library. Such utilities can live in a small safety analysis library linked into safety-related nodes.

#include <cmath>
#include <iostream>
#include <stdexcept>

double reliabilityExponential(double lambda_d, double t) {
    if (lambda_d < 0.0 || t < 0.0) {
        throw std::invalid_argument("lambda_d and t must be non-negative");
    }
    return std::exp(-lambda_d * t);
}

double kOutOfN(double Rc, int n, int k) {
    if (Rc < 0.0 || Rc > 1.0) {
        throw std::invalid_argument("Rc must be in [0,1]");
    }
    if (k < 1 || k > n) {
        throw std::invalid_argument("Need 1 <= k <= n");
    }

    auto comb = [](int n_, int r_) -> double {
        if (r_ < 0 || r_ > n_) return 0.0;
        if (r_ == 0 || r_ == n_) return 1.0;
        double c = 1.0;
        for (int i = 1; i <= r_; ++i) {
            c *= static_cast<double>(n_ - r_ + i) / static_cast<double>(i);
        }
        return c;
    };

    double R_sys = 0.0;
    for (int i = k; i <= n; ++i) {
        double c = comb(n, i);
        R_sys += c * std::pow(Rc, i) * std::pow(1.0 - Rc, n - i);
        ;
    }
    return R_sys;
}

int main() {
    double lambda_d = 1e-6;
    double T_I = 8760.0;

    double Rc = reliabilityExponential(lambda_d, T_I);
    double R1 = kOutOfN(Rc, 1, 1);
    double R2 = kOutOfN(Rc, 2, 1);

    std::cout << "Rc(T_I)  = " << Rc << "\n";
    std::cout << "R_1oo1   = " << R1 << "\n";
    std::cout << "R_1oo2   = " << R2 << "\n";
    return 0;
}
      

In Java (for example, within a ROSJava-based supervisory application), we can write:

public final class Reliability {

    public static double reliabilityExponential(double lambdaD, double t) {
        if (lambdaD < 0.0 || t < 0.0) {
            throw new IllegalArgumentException("lambdaD and t must be non-negative");
        }
        return Math.exp(-lambdaD * t);
    }

    public static double kOutOfN(double Rc, int n, int k) {
        if (Rc < 0.0 || Rc > 1.0) {
            throw new IllegalArgumentException("Rc must be in [0,1]");
        }
        if (k < 1 || k > n) {
            throw new IllegalArgumentException("Need 1 <= k <= n");
        }
        double Rsys = 0.0;
        for (int i = k; i <= n; ++i) {
            double c = comb(n, i);
            Rsys += c * Math.pow(Rc, i) * Math.pow(1.0 - Rc, n - i);
        }
        return Rsys;
    }

    private static double comb(int n, int r) {
        if (r < 0 || r > n) return 0.0;
        if (r == 0 || r == n) return 1.0;
        double c = 1.0;
        for (int i = 1; i <= r; ++i) {
            c *= (double)(n - r + i) / (double)i;
        }
        return c;
    }

    public static void main(String[] args) {
        double lambdaD = 1e-6;
        double TI = 8760.0;

        double Rc = reliabilityExponential(lambdaD, TI);
        double R1 = kOutOfN(Rc, 1, 1);
        double R2 = kOutOfN(Rc, 2, 1);

        System.out.println("Rc(T_I)  = " + Rc);
        System.out.println("R_1oo1   = " + R1);
        System.out.println("R_1oo2   = " + R2);
    }
}
      

Such platform-independent utilities can be part of a higher-level safety analysis layer that is invoked during commissioning or design-time rather than at control-loop rate.

MATLAB and Simulink are widely used in control and robotics. The core reliability computations can be implemented as MATLAB functions and then called from Simulink via a MATLAB Function block within a safety analysis model.

function R_sys = kOutOfNRel(Rc, n, k)
%KOUTOFNREL Reliability of a k-out-of-n architecture
%   Rc : scalar reliability of a single channel at time t
%   n  : total number of channels
%   k  : minimum number of working channels required

    arguments
        Rc (1,1) double {mustBeGreaterThanOrEqual(Rc,0), mustBeLessThanOrEqual(Rc,1)}
        n  (1,1) double {mustBeInteger, mustBePositive}
        k  (1,1) double {mustBeInteger, mustBePositive}
    end

    if k < 1 || k > n
        error('Need 1 <= k <= n');
    end

    R_sys = 0.0;
    for i = k:n
        c = nchoosek(n,i);
        R_sys = R_sys + c * Rc.^i .* (1.0 - Rc).^(n-i);
    end
end

% Example usage:
lambdaD = 1e-6;    % dangerous failures per hour
TI      = 8760.0;  % proof test interval (hours)
Rc      = exp(-lambdaD * TI);

R_1oo1  = kOutOfNRel(Rc, 1, 1);
R_1oo2  = kOutOfNRel(Rc, 2, 1);
disp([R_1oo1, R_1oo2])
      

In Simulink, one can:

• Create a model that includes blocks representing sensor, logic, and actuator channels.
• Use Switch or Logic blocks to model 1oo2 or 2oo3 voting.
• Add a MATLAB Function block that calls kOutOfNRel during design-time sweeps over parameters \((\lambda_D, T_I, n, k)\).

Combined with the Robotics System Toolbox, these reliability estimates can be linked to workspace variables describing specific robot hardware configurations.

In this lesson, we formalized functional safety for robotic systems using concepts from reliability theory and expected loss. We derived exponential reliability models for single safety channels, generalized to \(k\)-out-of-\(n\) redundancy, and proved basic properties about reliability improvement (1oo2) and trade-offs (2oo2). Diagnostic coverage and safe failure fraction were introduced to separate safe, dangerous-detected, and dangerous-undetected failures and to estimate residual risk. Quantitative examples for emergency stop functions showed how redundancy may reduce the average probability of failure on demand by orders of magnitude. Finally, we sketched Python, C++, Java, and MATLAB/Simulink implementations suitable for use in robotics safety analysis tools and higher-level supervisory software.