Guard Module Isolation for Common Cause Failure Protection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Safety controllers face challenges in detecting and excluding common cause failures (CCF), which can remove redundancy from safety-related subsystems, thereby preventing the execution of safety functions.

Innovation Solution

A modular control device with a guard module that forms an independent potential group, allowing it to monitor the operability of input and output modules and confirm their output signals, thereby preventing faults in one potential group from affecting the other.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If safety controllers use redundant channels to provide safety functions, then reliability is improved, but common cause failures can still remove redundancy and prevent safety function execution

Engineering Contradiction:

Improvesafety function executionVSAvoidcommon cause failures

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The control device is divided into separate potential groups (first potential group containing input/output modules, second potential group containing guard module) that are electrically isolated from each other. This segmentation ensures that a common cause failure affecting one potential group cannot propagate to the other group, thereby maintaining redundancy and safety function execution.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The guard module acts as an intermediary between the input/output modules and the actuator. It monitors the operability of modules in the first potential group and only allows output signals to pass through if the monitored modules are operating correctly. This intermediary function prevents faulty signals from reaching the actuator while maintaining system redundancy.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Device complexity

If modules share a common potential group for simplified design, then device complexity is reduced, but faults can propagate across all modules in the group

Engineering Contradiction:

Improvemodular structureVSAvoidfault propagation resistance

Core Design Contradiction:

Device complexityVSReliability

Solution Approach 1:

The electrical potential groups are segmented into at least two separate groups: a first potential group containing input and output modules, and a second potential group containing the guard module. This segmentation maintains modular design simplicity while preventing fault propagation between groups through electrical isolation.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Different parts of the system have different electrical potential characteristics. The input/output modules operate at one potential level while the guard module operates at a different potential level. This local quality difference (different potentials) allows the system to maintain simplicity within each module while providing fault isolation between modules.

Inventive Principle:

Principle #3Local quality

3Ease of manufacture

If the guard module is integrated into the same potential group as input/output modules, then ease of manufacture is improved, but the guard module cannot independently monitor faults

Engineering Contradiction:

Improvemodule integrationVSAvoidindependent monitoring capability

Core Design Contradiction:

Ease of manufactureVSReliability

Solution Approach 1:

The guard module is manufactured as part of the modular control device but is electrically segmented into a separate second potential group. This allows the guard module to be manufactured and integrated alongside other modules while maintaining independent electrical isolation necessary for fault monitoring.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The guard module serves as an intermediary with independent monitoring capability because it operates from a separate second potential group. This independent electrical isolation allows the guard module to objectively monitor the operability of modules in the first potential group without being affected by faults in those modules.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS12222701B2Control device with guard module

Publication Date: 2025.02.11 PILZ GMBH & CO KG

AI summary

A control device for controlling a technical installation includes a guard module. The control device has a modular structure with an input module, which receives an input signal representing a state of the technical installation, and an output module, which outputs an output signal controlling the technical installation based on the input signal. A guard module is integrated into the modular structure to monitor operability of the input module and the output module. The guard module confirms the output signal of the output module based on its monitoring of the input module and the output module. Within the modular structure, the input module and the output module form a first potential group. The guard module forms a second potential group within in the modular structure. The second potential group is independent of the first potential group.