Functional Safety for Robotics: What SIL 2/3 Means for Your BOM

Published: June 13, 2026 | Category: Robotics

Functional safety in robotics is often discussed as a software or certification topic, but procurement decisions influence whether a safety architecture can actually meet its target integrity level. Safety-rated MCUs, watchdogs, power supervisors, sensors, isolated interfaces, relays, feedback resistors, capacitors, connectors, and redundant channels all affect the final failure-detection capability of a robot controller.

For purchasing engineers and sourcing managers, the important question is not simply whether a component is labeled “SIL capable.” The real issue is whether the complete hardware architecture, diagnostic concept, component qualification, lifecycle plan, and documentation support the safety target defined by the machine or system design.

This guide explains what SIL 2 and SIL 3 mean at the BOM level for robotics and industrial automation. It also clarifies the relationship between IEC 61508, ISO 13849, and hardware categories, and shows how procurement teams can reduce risk when sourcing safety MCUs, redundant sensors, passives, isolation devices, and safety-related power components.

SIL and PL Are Related, but They Are Not the Same Thing

IEC 61508 defines Safety Integrity Levels, commonly expressed as SIL 1 through SIL 4, for safety-related electrical, electronic, and programmable electronic systems. ISO 13849 uses Performance Levels, from PL a through PL e, for safety-related parts of machinery control systems.

In robotics and factory automation, both frameworks may appear in specifications. Procurement teams should avoid treating SIL and PL as interchangeable labels. Their risk models and architecture rules are different, even though some performance targets can be broadly comparable.

As a rough engineering reference, SIL 2 is often associated with safety performance around PL d, while SIL 3 is often associated with PL e. However, the actual mapping depends on the application, architecture, diagnostic coverage, common-cause failure controls, and applicable machinery standard.

The procurement implication is important: a component that supports SIL 3 in one certified subsystem does not automatically make the complete robot controller SIL 3.

Functional Safety Is a System Property

No single MCU, resistor, or relay can make a robot safe by itself. Functional safety depends on the complete chain from hazard detection to safe-state actuation.

A typical robotic safety function may involve:

• Safety input sensor

• Signal conditioning

• Safety MCU or dual controllers

• Diagnostic monitoring

• Independent watchdog

• Power supervision

• Safe output driver

• Contactor or motor-disable path

• Feedback monitoring

If one part of that chain can fail dangerously without detection, the total diagnostic coverage can be compromised.

Procurement teams should therefore ask engineering which BOM lines are “safety relevant” rather than assuming only the main processor requires special treatment.

Safety MCU Selection: What Procurement Should Look For

Safety MCUs often include architectural features specifically intended to detect random hardware faults. Common features include dual lockstep CPU cores, ECC-protected memory, clock monitoring, voltage supervision, built-in self-test, redundant timers, and safety-management modules.

TI Hercules Families

Texas Instruments' Hercules RM4x and TMS570 families are widely used in high-reliability embedded control. Their architecture includes lockstep processing and hardware safety mechanisms designed to support functional-safety development.

For procurement teams, the main advantage is maturity. These families have been used across automotive, industrial, and other safety-oriented applications for many years, and supporting safety documentation is well established.

However, exact device selection still matters. Flash size, package, peripheral set, temperature grade, and safety collateral differ across the family.

NXP Safety MCU Platforms

NXP offers safety-focused microcontrollers and processors for automotive and industrial applications, including Cortex-R-based platforms designed around high diagnostic coverage and fault-containment features.

These devices can provide more performance than older safety MCU families, but procurement should evaluate lifecycle maturity, package availability, software ecosystem, and the exact safety documentation provided for the target device.

STM32 Safety Packages

Some STM32 families can be used in functional-safety designs with manufacturer-provided safety manuals, FMEDA-related support, self-test libraries, or certified software packages. This approach differs from using an MCU with dedicated lockstep hardware.

The procurement trade-off is cost versus engineering effort. A mainstream MCU with a safety package may be attractive for SIL 2-class architectures, but the design team may need to implement more diagnostics in software and prove more of the safety case themselves.

Hardware Lockstep vs Software Diagnostics

Lockstep architectures run redundant processor logic and compare results to detect faults. This can provide strong diagnostic coverage for CPU execution faults without requiring the application software to implement every comparison manually.

Software-based approaches can also achieve high diagnostic coverage, but they usually require more development, test, and documentation effort.

For sourcing teams, this affects total project cost. A lower-cost MCU may require:

• More software development

• More self-test routines

• Additional watchdog hardware

• More validation time

• More certification evidence

The cheapest processor is therefore not always the lowest-cost safety solution.

Diagnostic Coverage Is an Architecture Metric

Diagnostic coverage describes how effectively dangerous hardware failures are detected. Higher safety targets generally require stronger fault detection and greater independence between safety channels.

Procurement teams should avoid reducing this to a single universal percentage. The required metrics depend on the standard, architecture, failure-rate assumptions, and safety analysis used by the project.

What matters for BOM planning is that diagnostic coverage usually requires additional hardware:

• Redundant sensors

• Dual-channel inputs

• Cross-checking between processors

• Independent watchdogs

• Output feedback

• Power-rail monitoring

• Fault-tolerant communication

This means a SIL 2 or SIL 3 design frequently contains more components than a non-safety controller, and those extra line items also need lifecycle and sourcing plans.

ISO 13849 Categories and Robotics Hardware

ISO 13849 categories describe architectural characteristics of safety-related control systems. Category 3 and Category 4 architectures are common references in higher-performance machinery safety designs.

Category 3 generally uses redundancy so that a single fault does not lead to loss of the safety function, while some faults are detected. Category 4 adds stronger fault detection so that faults are detected in time to prevent loss of the safety function.

Procurement should not treat “dual channel” as sufficient evidence of Category 3 or Category 4. The channels must be designed with suitable independence, monitoring, and common-cause failure controls.

Redundant Sensors: Two Parts Are Not Automatically Redundant

Robotic safety functions often rely on redundant position, speed, torque, current, or limit sensing. Simply installing two identical sensors does not guarantee robust redundancy if both can fail from the same cause.

Engineering may use:

• Diverse sensor technologies

• Separated power rails

• Independent signal paths

• Cross-monitoring

• Diagnostic test pulses

• Different physical mounting locations

Procurement should preserve approved sensor manufacturer, revision, and qualification requirements. A low-cost substitute may alter offset behavior, failure mode, temperature drift, or diagnostic capability.

Safety Passives: Why Resistors Matter

Resistors in safety-related feedback and sensing networks can affect whether faults are detectable. For example, a resistor used in a current-sense or voltage-divider path may create a dangerous undetected condition if it fails open or short.

Engineering may address this through:

• Redundant resistor networks

• Series or parallel fault-tolerant arrangements

• Diagnostic current injection

• Components with documented reliability data

• Designs where a single resistor failure drives the circuit to a safe state

Procurement should not assume there is a universal “safety resistor” category for every function. The important requirement is that the selected component and circuit topology support the failure assumptions used in the safety analysis.

Capacitors in Safety-Related Circuits

Capacitors can fail short, open, or with degraded capacitance. In safety-related filtering, timing, isolation, or power circuits, these failure modes may affect diagnostic behavior.

Different applications require different qualification categories. X- and Y-class capacitors are intended for specific mains-safety applications. AEC-Q200 qualification applies to automotive passive-component stress testing. Neither label automatically makes a capacitor suitable for every robotic safety function.

For MLCCs used in harsh mechanical or thermal environments, flex cracking and board stress should be considered. Procurement may need to preserve:

• Dielectric type

• Package size

• Voltage rating

• Soft-termination requirement

• Automotive qualification where specified

• Approved manufacturer list

Watchdogs and Supervisors Are Safety Components Too

An external watchdog or power supervisor is often one of the most important secondary components in a safety controller. If the MCU locks up or a power rail leaves the valid operating range, the supervisor may force a safe reset or disable output stages.

Key procurement parameters include:

• Independent clock source

• Window watchdog capability

• Voltage thresholds

• Reset behavior

• Fault output

• Diagnostic testability

• Temperature range

A simple watchdog with the same package may not provide the same independence or diagnostic behavior as the approved device.

Safe Output Drivers and Contactors

Safety-related motor shutdown often requires independent output paths that can remove torque or disable power even if the main control processor fails.

Depending on the robot architecture, this may involve:

• Dual safe-torque-off channels

• Isolated gate-disable signals

• Redundant contactors

• Feedback contacts

• Safety relays

• Protected high-side or low-side drivers

Procurement should treat these devices as safety-related components and preserve the exact coil voltage, contact rating, diagnostic feedback, and approved manufacturer requirements.

Isolation Components Need Functional-Safety Review

Digital isolators, optocouplers, isolated amplifiers, and isolated gate drivers can appear in safety-related paths. Their failure modes, isolation ratings, lifetime, and diagnostic behavior need to be understood.

Procurement should compare:

• Working voltage

• Isolation lifetime

• Propagation delay

• CMTI

• Failure behavior

• Safety certification

• Package creepage

• Temperature grade

An isolator with a similar pinout may still require re-analysis if its failure mode differs from the original device.

Functional-Safety BOM Comparison

Safety Documentation Must Follow the Component

Safety-related parts should be sourced with the documentation required by the engineering and certification process.

Depending on the component and program, that may include:

• Safety manual

• FMEDA data

• Failure-rate data

• Certification report

• PCN history

• Product lifecycle information

• Qualification data

• Lot and date-code traceability

Procurement should preserve the exact manufacturer part number used in the safety analysis. A commercial-grade variant with the same silicon but different qualification or documentation may not be interchangeable for the safety case.

Component EOL Is More Expensive in Safety-Certified Designs

A part substitution in a normal industrial product may require engineering validation. In a safety-certified product, it can also trigger safety-case review, updated calculations, new testing, customer approval, or recertification.

This makes lifecycle management especially important.

High-risk safety components should be monitored for:

• NRND status

• EOL notices

• Process changes

• Package changes

• Fab transfers

• Firmware or safety-documentation revisions

Procurement should qualify alternates early when possible rather than waiting until the original device disappears.

Do Not Substitute Safety Components from Distributor Cross-References Alone

A distributor cross-reference can be useful for identifying candidates, but it is not proof that two safety components are equivalent.

Engineering should compare:

• Electrical characteristics

• Failure modes

• Diagnostic mechanisms

• Safety documentation

• Temperature range

• Package

• Lifecycle status

• Certification impact

For a safety-related BOM, every substitution should be treated as an engineering change.

What to Include in a Functional-Safety RFQ

A professional RFQ should clearly state that the component is used in a safety-related design.

• Full manufacturer part number

• Required SIL or PL context

• Required safety documentation

• Temperature grade

• Package

• Quantity and annual forecast

• Target delivery date

• Acceptable date-code range

• Required traceability

• Whether alternates may be proposed

• Whether redesign or requalification is acceptable

For larger robotics projects, submitting the complete safety-related BOM can be more effective than sourcing one MCU. Watchdogs, sensors, isolators, relays, current monitors, and passives may all be part of the same safety function.

Common Procurement Mistakes

Mistake 1: Assuming “SIL capable” means the final system meets SIL 2 or SIL 3. Safety integrity is a system property.

Mistake 2: Treating SIL 2 and PL d as exact equivalents. The standards use different models and architectural requirements.

Mistake 3: Replacing a lockstep MCU with a mainstream MCU without re-evaluating diagnostics. The software and hardware safety burden may change significantly.

Mistake 4: Assuming AEC-Q200 passives are automatically safety-rated. Qualification and functional-safety suitability are different concepts.

Mistake 5: Ignoring watchdog, isolation, and output-driver lifecycle. The safety MCU is only one part of the safety chain.

Mistake 6: Approving substitutes based only on electrical equivalence. Failure behavior and safety documentation matter.

How Aurora Components Supports Functional-Safety BOM Sourcing

Aurora Components Co., Limited supports OEMs, EMS providers, robotics companies, automation teams, and procurement departments sourcing electronic components for safety-related industrial, robotic, motion-control, and factory-automation applications.

Functional-safety BOMs can include safety MCUs, watchdogs, supervisors, redundant sensors, isolated drivers, digital isolators, relays, contactors, current sensors, resistors, capacitors, and power devices from multiple manufacturers. A shortage or EOL event affecting one of these parts can trigger a costly safety requalification effort.

Aurora Components can assist with BOM sourcing, hard-to-find components, shortage requirements, obsolete and EOL parts, alternate sourcing, and multi-manufacturer cross-reference research. Customers should define all required safety documentation, traceability, inspection, qualification, and lifecycle requirements before order placement.

If your robotics or automation project is targeting SIL 2, SIL 3, PL d, or PL e, send the exact part numbers or complete safety-related BOM for sourcing review.

Specifying functional-safety components for robotics? Submit your BOM / RFQ to Aurora Components.

Website: www.auroraic.com
Email: info@auroraic.com