Dual-Controller Load State Validation With Feedback-Diverse Cross-Checks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current functional safety systems lack effective methods to independently monitor and validate the state of loads, such as emergency stop buttons and line break sensors, with high diagnostic coverage and fault detection accuracy, especially in diverse and transient electrical environments.
Innovation Solution
A feedback-diverse, dual-controller-architecture system with two discrete modules and inter-module logic that cross-checks encoded output values from each module to validate load states, detect faults, and handle safe and fault conditions, using clamper circuits, voltage dividers, and analog-to-digital converters to process and encode voltage signals within specific ranges.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single-controller architecture is used to monitor load states, then the device complexity is reduced, but the diagnostic coverage and fault detection accuracy are insufficient
Solution Approach 1:
The system divides the monitoring function into two independent modules, each with its own controller (first controller and second controller). Each module independently monitors the load state through separate signal paths, enabling redundant verification and achieving >99% diagnostic coverage through cross-checking of encoded output values.
Solution Approach 2:
The patent creates a redundant copy of the monitoring system with a second module that mirrors the first module's functionality. Both modules process feedback signals independently and generate encoded output values that are cross-checked by inter-module logic, ensuring fault detection accuracy without requiring a single complex controller.
2Measurement precision
If redundant monitoring channels are implemented to improve fault detection, then the diagnostic coverage increases, but the device complexity and circuit requirements increase
Solution Approach 1:
The system uses voltage range encoding to represent load states. The voltage divider converts feedback voltages into distinct ranges (first voltage range for functional state, second voltage range for safe state, third voltage range for fault state). This parameter-based encoding allows the inter-module logic to detect faults by comparing encoded values without requiring complex circuitry.
Solution Approach 2:
The inter-module logic acts as an intermediary that receives encoded output values from both controllers and performs cross-checking. This mediator component simplifies the overall system by centralizing the comparison function, allowing the redundant channels to work together without requiring direct complex interconnections between all components.
3Reliability
If transient electrical voltage suppression is added to protect against electrical transients, then the system reliability improves, but the device complexity and component count increase
Solution Approach 1:
The first clamper and second clamper are positioned in the signal path before the feedback signal reaches the voltage divider and controllers. These clammers suppress transient electrical voltages inbound from the load beforehand, protecting downstream components from voltage spikes and transients without requiring additional protection circuits throughout the system.
Solution Approach 2:
The clamping circuitry performs preliminary action by bounding the feedback signal to within a logic voltage range before further processing. This preliminary signal conditioning ensures that transient voltages are suppressed early in the signal path, preventing potential damage and eliminating the need for repeated protection measures later in the circuit.
Data Source
AI summary
A feedback-diverse, dual-controller-architecture functional safety system includes: a first module; a second module; and an inter-module logic.