Dual Judgment Circuit for Fail-Safe Electronic Control Unit
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In electronic throttle systems, existing fail-safe functions can inadvertently release the motor from a suspended state due to erroneous reset commands from a faulty microprocessor, leading to improper control of the throttle valve, even after an abnormal state is detected.
Innovation Solution
The implementation of a dual-judgment signal system where the first judging signal remains active upon detection of an abnormal state and is not reset by the microprocessor, while the second judging signal remains active regardless of the microprocessor's judgment data, ensuring the motor remains in a forced idle state even if the releasing mechanism fails.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single judgment circuit is used to detect abnormal states and generate lock signals, then the device complexity is reduced, but the reliability of the fail-safe function deteriorates because the microprocessor can inadvertently reset the lock signal when faulty
Solution Approach 1:
The single judgment circuit is divided into two independent judgment circuits (first judgment circuit and second judgment circuit). Each circuit independently monitors the microprocessor and generates lock signals. This segmentation ensures that if one circuit is affected by microprocessor faults, the other circuit can still maintain the abnormal state detection and prevent inappropriate motor control.
2Ease of operation
If the lock signal is designed to be reset by a reset command from the microprocessor, then the ease of operation is improved, but the reliability deteriorates because a faulty microprocessor can accidentally transmit reset commands to release the motor from suspended state
Solution Approach 1:
The system applies preliminary anti-action by having the second judgment circuit specifically designed to ignore reset commands from the microprocessor. When the second judgment circuit detects an abnormal state, it generates a lock signal that cannot be reset by microprocessor commands. This preemptive design prevents the possibility of a faulty microprocessor from inadvertently releasing the motor from its suspended state.
3Reliability
If the judgment circuit maintains the lock signal active once abnormal state is detected, then the reliability of fail-safe function is improved, but the ease of operation worsens because the system cannot be reset even when the microprocessor transmits pass data
Solution Approach 1:
The system segments the reset functionality into two independent paths: one for normal operation (first judgment circuit responding to reset commands) and one for enhanced fail-safe (second judgment circuit ignoring reset commands). This segmentation allows the system to maintain reliability while preserving reset capability for normal operations through the first judgment circuit.
Data Source
AI summary
A first judgment circuit and a second judgment circuit are adapted to set a judging signal high when a judgment data sent from a microprocessor indicates failure. The high level judging signal triggers a forced idle command connected to a motor driver, to be high level whereby the motor is forcibly suspended. Subsequently, when a reset command is accidentally transmitted by the microprocessor due to an unexpected fault, a first judging signal from the first judgment circuit is reset to low level. However, a second judging signal from the second judgment circuit remains high level. As a result, the forced idle command stays high level.