Analog Input Ternary State Mapping for Safe-State Fault Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data communication mechanisms in machines fail to meet functional safety standards, particularly in noisy environments, leading to potential catastrophic failures due to undetectable errors, which are exacerbated when scaled across fleets of machines.
Innovation Solution
Implementing multiple microcontrollers with application processors to ensure redundant processing and encoding of safety messages, using ternary state translation and fault indicators to detect bit overwrite errors, commanding machines to safe states upon error detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple microcontrollers with redundant processing are implemented, then reliability of safety message transmission is improved, but device complexity increases
Solution Approach 1:
The system divides the safety message transmission task into separate handling by multiple microcontrollers (first and second microcontrollers), each processing specific bytes of the message. This segmentation allows redundant verification without requiring a completely duplicated system, reducing complexity while maintaining reliability.
Solution Approach 2:
The patent implements redundant processing by having multiple microcontrollers independently verify the same safety message using identical verification logic. Each microcontroller compares received bytes against expected values, creating a copied verification process that ensures reliability without full system duplication.
2Measurement precision
If encoding and fault indicator verification are performed on all message bytes, then measurement precision of error detection is improved, but loss of time in processing increases
Solution Approach 1:
The verification process applies different levels of checking to different parts of the message. Critical bytes (including fault indicator bytes) undergo strict verification against expected values, while other bytes are processed with standard protocols. This localized quality approach ensures high precision for error detection where it matters most without uniformly processing all bytes at maximum detail.
Solution Approach 2:
The system performs preliminary verification of message bytes against pre-stored expected values before full processing. By checking for obvious errors early in the reception process, the system can quickly identify and reject corrupted messages without completing full processing, reducing time loss while maintaining detection precision.
3Reliability
If strict functional safety standards are enforced across all communication channels, then reliability is improved, but productivity of machine operations decreases
Solution Approach 1:
The verification system is designed to handle multiple message types and communication scenarios using the same core verification logic. The microcontrollers can verify both safety-critical messages and standard communication messages through the same byte-comparison mechanism, allowing functional safety standards to be enforced universally without creating separate complex verification paths that would reduce productivity.
Solution Approach 2:
The system includes self-verification capabilities where microcontrollers automatically verify received messages against stored expected values without requiring external validation. This self-service approach ensures functional safety compliance is maintained autonomously, eliminating the need for additional external verification steps that would reduce operational productivity.
Data Source
AI summary
A safety module having a plurality of microcontrollers receives an analog input and determines a value of the analog input. The microcontrollers each determine a respective ternary state of the device by identifying, from three candidate ranges of values, a range of values in which the value falls, wherein at least two of the plurality of microcontrollers uses different candidate ranges of values, determining, based on the identified range, a ternary state corresponding to the range, and assigning the determined ternary state as the respective ternary state. The safety module determines whether the ternary states from the two microcontrollers map to a fault state, and, where they do, cause a command a command to be output to the device to enter a safe state.