I have newer heard about Jay Electronique.
But the interesting this is that it conforms to "PL e EN13849 and SIL 3 EN61508"
https://en.wikipedia.org/wiki/Safety_integrity_levelThis basically means that the MTBFd (Mean time to Failure dangerous) has to be better than 1 out of 10E?7 hour,.
And it can be used in situations where Functional Safety is needed to safeguard human lives, and where a failure of the system could kill a person.
If such a system contains electronics, and/or software, then it has to fulfill EN61508 according to the MD directive. (European, but other parts of the world have similar laws )
This would require a two channel system, with a high DC (diagnostic coverage), basically you need to analyze the effect of a failure any component in the system.
And you need to make sure that any dangerous fault in on channel is detected, and the system is brought into a safe state. Or the fault is so unlikely to occur within its mission time, that it can be covered with the budget of one fault pr. 10E?7 hour.
If the product have a mission time of say 10 years, then it have to be replaced even if it appear to be functional.
You can run both safety channels trough a single radio module that is not SIL rated, provided that you have a system that fail safe in case of 'stuck bit's'.
I.e detects if the radio module is just replaying the same messages, despite having lost the link.
If you have a CPU in the system, then you need to document that you can detect any memory cell or register getting flipped due to a glitch/radiation from space...
This has to be detected within the safe process time.
You either need two CPU's running lock-step (comparing results), or use a safety CPU like the TI TMS570
EN61508 also covers software.
Generally you can't use dynamic allocated objects in the system, and you cant have any unbound loops.
You need to be able to calculate the WCET (Worst Case Execution Time), you basically need to know how many clock cycles a control loop takes, when it runs the longest path.
(A variant of the Turing Halting Problem).