I'd be very interested in hearing more about this! I've recently re-designed the safety system for my company's product, and I chose to keep it purely hardware based (using safety relays) rather than involving any software, purely because it's so much harder to guarantee that software will be failsafe.

And all of those will have a software component.

I've written a bit more about how it worked in another comment.

The big thing to keep in mind here is that an ST is a very limited machine when it comes to IO and that just about every port was already occupied so I somehow had to make this work safely without having additional ports for e-stop i/o in the budget.

If I had to do it again in the present I would never have consented to using such an I/O hamstrung platform to begin with and I would use an FPGA to do all the control logic.

That's very reasonable :-)

I've worked on very safety-critical systems before. It's fun!

For one thing, you get to do things right. Sure, there are deadlines, but nobody dares to tell you to leave things half-baked. If it takes time, then it take time. Shoo, manager.

For another, you must dive deep into the behaviour of your embedded (mechanical/electrical/software) system and understand all its corner cases, even in the face of faults ("OK, so we're doing this operation, and now a cosmic ray hits and a crucial bit flips in RAM -- do we have a detection and safe reaction?")

Apart from the fun-ness, realise you're not in it alone. You'll be supported by a bunch of your fellow engineers double-checking your work, testing the system, etc., so your confidence in the system is quite high.

I like it.

Did that scare you at the time, or was it immediately clear it was the good kind of creative?

It's this kind of subtle interaction between hardware and software where it is super easy to make a stupid mistake and to end up regretting it the rest of your life. Making sure that machine stayed off when it had to was super important, some of those servos were the size of buckets and would happily rip your arm off when powered up, the chuck on the largest machine that we did was 6 meters, to cut wheels for harbor cranes. Really nothing to fuck up with.

Testing it was a long and labor intensive process with a first stage in simulation, then a second stage on a machine with all motors powered off except for the servos, then a run in 'air' but with a turning spindle and finally two real runs, one in aluminum and one in steel.

The electronics were tested separately, we found that one of the early mobile phones (ATF-3) was really good at getting latches to trip that shouldn't trip.

I learned a lot on that job, but it wasn't fun to work with the guy that ran that company, I wrote about this here:

https://jacquesmattheij.com/the-start-up-from-hell

Apologies for the missing images, I still have to do some re-routing of my old gallery.