Embedded Systems & Product Development Consultancy · London, UK

Detection algorithms and safety-critical firmware for a device manufactured at over a million units

A home safety technology company was developing a networked multi-sensor alarm for rented homes: smoke, heat and carbon monoxide detection in one sealed unit, with a 10-year battery, obstruction monitoring and remote inspection. We designed the obstruction-detection algorithm and took it onto the device, contributed firmware across the sensing subsystems, supported the custom sensor ASIC work with Microchip, and worked on safety-critical verification and production test as the product moved to mass manufacture.

At a glance

Industry: Consumer & Smart Home
Client: A home safety technology company
Location: Warwickshire, United Kingdom
Our role: Feasibility study, obstruction-detection algorithm, sensor firmware, low-power design, ASIC documentation and software reference manual, IEC 61508 verification, production test jigs
Platform: Silicon Labs EFR32 with Micrium OS; STMicroelectronics time-of-flight sensors; custom Microchip sensor ASIC
Key technologies: C, Micrium OS, 868 MHz and Thread mesh radio, time-of-flight ranging, Python, 3D modelling, LDRA, IEC 61508, Git, JIRA
Services: Embedded software & firmware · Architecture & technical advisory · Testing & verification · Production readiness
Outcome: Launched to the mass market, with more than one million units manufactured

The challenge

A smoke alarm in a rented home has to work for ten years on one battery with nobody looking after it. Rules for these homes go further: under DIN 14676-1 Type C the alarm is inspected remotely, so it has to check itself, including whether anything within 50 cm is stopping smoke from reaching it, and report the result over the radio. The same unit also had to detect heat and carbon monoxide, measure indoor temperature and humidity, and talk to the other alarms in the home so that one alarm sets them all off.

The product had to meet EN 14604 for smoke alarms and EN 50291-1 for carbon monoxide alarms, and its software had to be developed and verified to IEC 61508. At over a million units, every design decision also carried a cost in battery life, components, test time on the production line and returns from the field.

Our role

We joined at the six-month planning and evaluation stage, where a cross-functional team of more than 50 people assessed the software, hardware and sensor technology before the design was committed. From there we designed the obstruction-detection algorithm and took it from simulation onto the device, contributed firmware to several of the sensing subsystems, worked on the low-power design, supported the custom sensor ASIC with documentation and a software reference manual, built production test jigs, and carried out the safety-critical review and verification work in LDRA.

System architecture

The alarm is built around a Silicon Labs EFR32 running Micrium OS, with the firmware written in C. The EFR32’s radio is configurable for 868 MHz or Thread mesh, so the same hardware can interlink with the other alarms in a home and report its self-test results for remote inspection.

Sensing: an optical smoke chamber and an electrochemical CO sensor, both driven and measured by a custom sensor ASIC developed with Microchip; a thermistor heat sensor; and a temperature and humidity sensor for indoor-climate readings.
Obstruction monitoring: three STMicroelectronics time-of-flight distance sensors, arranged to cover 360° around the alarm.
User interface: distinct sounder patterns for smoke and CO, alarm, fault and ventilation LEDs, an assistance light that works in the dark, and a test button.
Power: a sealed lithium battery for a 10-year life, with the system asleep most of the time and waking on a schedule or an event.

Obstruction detection, from 3D model to firmware

An alarm can only detect smoke that reaches it. Furniture, shelves or boxes placed close to it, or a cover over it, can stop that happening, and in a rented home nobody may notice. So the alarm checks the space around itself.

We developed the mathematical algorithm that uses the three time-of-flight sensors to find objects around the alarm, estimate how far away they are and how much of the surrounding volume they occupy, and decide whether they count as an obstruction. We first modelled the sensor geometry and typical room situations in 3D and simulated the algorithm in Python, so it could be tested against many cases before any code ran on the device. Once its behaviour was right in simulation, we implemented it in C on the EFR32 and checked it against the same cases on real hardware. Because the check runs from a battery that has to last ten years, it is scheduled rather than continuous, and the sensors are powered only while they measure.

Feasibility and low-power design

During the feasibility stage we assessed sensor options and measurement approaches against detection performance and their power cost over a 10-year battery life. Low-power work carried on through development: keeping the processor and sensors asleep between measurements, grouping radio activity, and measuring current on real hardware to check the budget.

Working with Microchip on the sensor ASIC

The smoke chamber and the CO sensor are managed by a custom ASIC developed with Microchip. We worked with Microchip on the software side: testing the ASIC’s behaviour from firmware, improving its documentation, and writing the software reference manual that describes how the firmware configures and reads it.

Safety-critical verification with LDRA

The firmware was developed to IEC 61508, with the LDRA tool suite used across the cycle:

Code review: static analysis of the C code against the project’s coding rules.
Quality review: quality and complexity metrics tracked for each module.
Design review: checking that the code follows its design and requirements.
Test verification: tests traced to requirements, with structural coverage measured.
Unit testing: unit tests for the safety-relevant modules, run and recorded in LDRA.

Production test

For manufacture we designed test jigs and the Python software behind them. On every assembled device a jig loads the firmware, calibrates the sensors and runs the unit and functional tests, recording the result for traceability. Board bring-up and fault finding used oscilloscopes, logic analysers and JTAG debuggers.

Results

Launched to the mass market, with more than one million units manufactured.
An obstruction-detection algorithm taken from 3D simulation to firmware on the device.
Firmware developed and verified to IEC 61508 with LDRA.
Improved documentation and a software reference manual for the custom Microchip sensor ASIC.
Production test jigs for firmware loading, calibration and testing at volume.