Redundant Processor Safety Module for EV Charging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Electric vehicle charging stations face challenges in ensuring safe operation and compliance with safety regulations due to the potential for dangerous current transfer, requiring effective supervisory systems to manage and verify the integrity of charging processes.
Innovation Solution
A safety supervisory module (SSM) with redundant processors controls the flow of current and includes a charge circuit interrupting device (CCID) that monitors differential current, performs self-tests, and provides automatic retry capabilities to ensure safe operation by inhibiting or opening the circuit in case of faults, ensuring both processors must agree to close contacts for electricity transfer.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a supervisory circuit is implemented to test ground fault and ensure safety compliance, then safety reliability is improved, but device complexity increases
Solution Approach 1:
The supervisory circuit is divided into separate functional modules: ground fault testing module, contactor control module, and processor modules. Each module independently performs specific safety functions, making the complex system manageable and maintainable while ensuring comprehensive safety coverage
Solution Approach 2:
A contactor is introduced as an intermediary device between the supervisory circuit and the power delivery path. The contactor acts as a safety gatekeeper that physically interrupts power flow when faults are detected, providing a reliable safety mechanism without requiring complex direct control of the power lines
2Reliability
If redundant processors are used to control contactor closure, then safety reliability is improved, but device complexity increases
Solution Approach 1:
Each processor is equipped with dedicated self-test capabilities and fault detection circuits specific to its function. The processors have differentiated roles in the safety control logic, with each independently verifying specific safety conditions before allowing contactor closure, ensuring localized safety verification without requiring full system complexity duplication
Solution Approach 2:
The redundant processors continuously monitor each other's status and the system state through feedback signals. Each processor provides feedback on its operational status and receives feedback from the other processor and from safety sensors, creating a closed-loop verification system that ensures both processors are functioning correctly before permitting power delivery
3Productivity
If automatic retry capability is implemented after fault assertion, then productivity is improved, but safety reliability may worsen
Solution Approach 1:
Before allowing automatic retry operations, the system performs preliminary safety verification checks to ensure that the fault condition has been resolved. The processors verify that safety conditions are met and that the fault is not persistent before permitting retry attempts, preventing unsafe operations while maintaining productivity
Solution Approach 2:
The automatic retry mechanism operates periodically with defined intervals and attempt limits. After a fault is asserted, the system waits for a predetermined time period, then attempts retry a specific number of times with spacing between attempts. This periodic approach balances productivity recovery with safety by not immediately retrying potentially unsafe conditions
Data Source
AI summary
A safety supervisory module (SSM) of an electric vehicle charging station that controls flow of current from the electric vehicle charging station to an electric vehicle. The SSM includes a set of two or more processors to control operation of a contactor control circuitry of the SSM to open and close a set of contacts of a set of power supply lines to control flow of current from the charging station to an electric vehicle. Each processor independently determines whether an unsafe condition exists and asserts a relay enable signal to the contactor control circuitry only when an unsafe condition does not exist. The contactor control circuitry generates a current to energize a relay to close the set of contacts responsive to the relay enable signal being asserted by each and every processor of the set of processors, and inhibits closure of the set of contacts or opens the set of contacts to prevent electricity from flowing between the charging station and an electric vehicle when any of the set of processors is not asserting the relay enable signal.