I have blogged previously on industrial functional safety, intrinsic safety (explosion-proofing), and industrial cybersecurity, and now I get to talk about a new reference design that brings all three together.
Some have doubted you can deliver 500mW to the field and meet intrinsic safety requirements. Hopefully that doubt is now eliminated, as Analog Devices has released a reference design for a “Complete Ethernet-APL field device Platform” with an intrinsic safety review completed by Bureau Veritas showing it's good for use in zone 0. By reference design, I don’t just mean schematics and layouts; you can buy the evaluation kit and try it out for yourself.
Figure 1: The two PCBs that make up the reference design
Shown above are the two PCBs that make up the reference design. For those who are not used to seeing round PCBs, this is to suit a common form factor in the process industries, called DIN B, used for temperature transmitters and has a 44mm diameter. I believe it is mounted by a central screw down the middle, which gives equal compression all the way round and gives reliable sealing.
Figure 2: Block diagram of the reference design.
The main features of the reference design are:
- Designed and certified to EX ia IIC Ga by Bureau Veritas
- 10Mbps Ethernet two-wire connection supplying signals and power with a field range of up to 200 meters for a spur connection
- A path to IEC 62443 compliance using the MAX32690 120MHz microcontroller
- A path to functional safety certification using safety certified semiconductor devices
- Tested for Ethernet-APL compliance
All of this is facilitated by the long range and power provided in an intrinsically safe way by the Ethernet APL 2-WISE compliant connection, see IEC TS 63444 and IEC TS 60079-47.
Figure 3: Intrinsically safe protection classes from IEC TS 63444 table 8
Power class A offers a guaranteed minimum of 540mW, 9V, and 55.56mA, see table 5 of IEC TS 63444.
With Ethernet APL, both power and Ethernet are carried on the same two wires with a spur length of up to 200m, making it competitive with traditional 4/20mA connections but with a proper modern high-speed bi-directional interface.
Figure 4: Ethernet APL trunk and spur connection diagram per IEC 63444
For intrinsic safety, the diodes (including signal, Zener, and diode bridges) and resistors do heavy lifting. However, the LT8440 (triplicated to meet the requirements for EX ia) takes care of all the Ethernet APL power conditioning. The output of the LT8440 supplies the limited power of up to 500mW to the rest of the design.
Figure 5: An extract from the intrinsic safety certification
The full cert can be downloaded here. A detailed circuit analysis for intrinsic safety is available here.
The Ethernet connection is provided by the ADIN1100 industrial grade Ethernet chip, with three series capacitors on the inputs that meet the intrinsic safety requirements.
With 500mW available, you can implement a proper 120MHz ARM Cortex M4 including cyber security features such as an AES-128/192/256/SHA-2 Engine, a PUF (physically unclonable function), a true random number generator, and secure key storage. Who said level 0 devices can’t implement cyber security!
While the main goal of this reference design was intrinsic safety, thought was also given to how SIL 2 low demand requirements would be met. The main functionality to be provided is field temperature measurement, which can be done using the ADFS7124 ADC, which is optimized for 2-Wire, 3-Wire or 4-Wire RTD connections. For functional safety, the ADFS7124 is certified for use in applications with requirements up to SC3 (certified by TUV Rheinland). This allows the safe capture of the measurement data.
The MAX42500 is rated for use in applications up to SIL 3 (certified by TUV Nord) and monitors the on-board power supply voltages using seven highly accurate windowed power supply monitors. In addition, it features a windowed watchdog timer with a challenge response mode, which means that it is not sufficient for the MAX32690 to just “kick” the watchdog but that the MAX32690 must be able to do calculations for CRC math. This could be important if you decided to use an STL (software test library) to achieve diagnostic coverage on the MAX32690.
For the processor, the functional safety of the MAX32690 is shown by an available IEC 61508-2:2010 Table F.1 “checklist” showing that all the right measures for a SIL 2 design were taken during the design of the semiconductor. Even with the Annex F checklist, it is still a class 0 semiconductor (new terminology from IEC 61508 version 3) and so has restrictions on the use of on-chip diagnostics to detect on-chip failures, and so an STL may be required to achieve SIL 2.
Safety-rated communications would be achieved using a black channel architecture implemented on the MAX32690 according to IEC 61784-3 and one of its compliant protocols such as ProfiSAFE.
Further functional safety protection is provided by the single-chip temperature sensor, the MAX6613, which is specified over the temperature range of -55 °C (-67F) to 130 °C (266F).
In future blogs, I may look at key aspects of this design in more technical detail. This blog is more like an introduction. For now, you can find all the schematics and code for this design here.
Related Blogs
- EthernetAPL Introduction
- Black Channel Safety Communications
- An Introduction to IEC 62443
- What Functional Safety People can Learn from Intrinsic Safety
- Functional Safety for Power
For all previous blogs in this series, see here.
For the full suite of ADI blogs on the EngineerZone platform, see here.
For the full range of ADI products, see here.