Dual-Clock Safety Controller for Precise Clock Error Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing safety controllers, such as lock-step controllers, face challenges in precisely determining response times and detecting clock errors due to shared clock sources, leading to potential uncontrolled system operation and delayed error detection.
Innovation Solution
A safety controller system utilizing two separate clock generators with one clock signal serving as a common clock for synchronous program execution and the other as a reference, with counters to detect frequency deviations and trigger precise interrupts for timely error detection and shutdown.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Stability of the object's composition
If a common clock source is used for both processor cores to ensure synchronous execution, then synchronization is improved, but clock error detection capability deteriorates
Solution Approach 1:
The patent segments the clock source into two independent parts: a common clock signal for synchronous execution and a separate reference clock signal for error detection. This allows the system to maintain synchronization while independently monitoring for clock errors, resolving the contradiction between synchronization stability and error detection capability.
Solution Approach 2:
The patent introduces a reference clock signal as an intermediary element that mediates between the common clock source and the error detection mechanism. The reference clock serves as an independent benchmark against which the common clock can be compared, enabling error detection without compromising synchronous execution.
2Reliability
If mutual monitoring with role swapping is implemented to detect clock errors, then error detection capability is improved, but response time precision deteriorates
Solution Approach 1:
The patent implements preliminary action by continuously monitoring the common clock signal against the reference clock signal in real-time, rather than waiting for mutual monitoring cycles. This continuous preliminary monitoring enables immediate detection of clock errors and precise determination of response times, eliminating the delays inherent in periodic mutual monitoring approaches.
3Reliability
If waiting times are introduced during safety loop execution for monitoring, then error detection thoroughness is improved, but productivity deteriorates
Solution Approach 1:
The patent achieves continuous monitoring of the clock signal without introducing waiting times into the safety loop execution. The separate reference clock signal enables continuous error detection to run parallel to the main program execution, maintaining both thoroughness and productivity without the need for periodic waiting or halting of the safety loop.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present invention relates to a safety controller 1 having a first controller 10 having a first clock generator 11 for generating a first clock signal 30, a separate second controller 20 having a second clock generator 21 for generating a second clock signal 40, wherein the first clock signal 30 is output to a first input 13 of the first controller 10 and to a first input 23 of the second controller 20, and the second clock signal 40 is output to a second input 14 of the first controller 10 and to a second input 24 of the second controller 20. In addition, the present invention relates to a method for operating a safety controller.