Applications

A Safety Core deployment runs one or two reference applications. Each application is a decision maker (SDM) that turns trusted perception events into commands for a machine, sent as 64-byte UDP packets to a command receiver. In production the receiver is the machine’s controller (PLC). For testing, the Debian package ships a reference command receiver for each application.

The decision logic, the packet layout and the full command set are in Decision Maker.

Forklift safety function

What it protects. A forklift loads and unloads pallets into a trailer. Its safety function is switched off (muted) only while the forklift is inside the trailer, no person is inside the trailer, and no person is in the restricted region of interest (ROI) at the trailer door. In every other case the safety function stays on (unmuted).

What it sends.

When the SDM detects a fault it sends UNMUTE followed by SW_ERROR, and keeps doing so until an operator releases it. See Release a latched safe state.

What the command receiver shows. The console shows the latch, clear and release events. Each command received goes to the receiver’s log file, /tmp/cmdrx.log by default, as a line such as Received ATL command: 0x02 - MUTE (ALLOW OPERATION). With the VST overlay turned on, the receiver also forwards each command to VST, which draws the state on the video.

Perception it needs. A 2D VSS Warehouse profile with a tripwire tripwire-id-1 and an ROI roi-id-1 that restricts Person. The demo dataset of the Quick Deployment has both.

Where the SDM runs. On the host CPU of an x86-64 server or the CCPLEX of an IGX Thor, or on the Functional Safety Island of an IGX Thor. See SDM on FSI.

Proximity Monitoring

Proximity Monitoring is a preview.

What it protects. People working near machines. The SDM watches the distance between each person and each tracked machine, and slows or stops the machine as the distance shrinks. The shipped configurations cover these pairs:

What it sends. The most severe pair decides the command.

When the SDM detects a fault it sends STOP followed by SW_ERROR, and keeps doing so until an operator releases it.

What the command receiver shows. The receiver collects commands in 100 ms windows. For each window that received commands, it applies the most severe one and prints a line such as [EVAL] Action: SLOW DOWN | window: 3 cmd(s) [STOP=0 REDUCE=3 NORMAL=0]. A change of action is marked *** STATE CHANGE ***.

Perception it needs. A VSS Warehouse profile whose behavior analytics reports proximity between the selected machine class and Person on the mdx-frames topic, with a detection range of at least 2 m. Robot pairs need a scene that contains those robots.

Where the SDM runs. On the host CPU of an x86-64 server or the CCPLEX of an IGX Thor, or on the Functional Safety Island of an IGX Thor.

Two decision makers

One Safety Core can run two SDMs against the same perception feed, for example the forklift safety function and Proximity Monitoring together (--app atl,pxc), or two trailer bays (--app atl,atl). Each SDM has its own configuration, log and command receiver port, and latches and is released on its own. Two SDMs run only on the host CPU or CCPLEX, not on the Functional Safety Island. See Running more than one decision maker.