Electric Motor Controller Redundancy via Voting Override
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing electric vehicle motor control systems lack robust mechanisms for ensuring the reliability and redundancy of motor control processor modules, which can lead to failures in torque output control and diagnostic accuracy.
Innovation Solution
A controller system comprising a motor control processor module, two main processor monitor modules, a voting control module, and an override control module, utilizing seed-and-key exchanges for fault detection and generating override commands to ensure reliable torque output control, even in the event of module failure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single motor control processor module is used to control torque output, then the device complexity is low, but the reliability is insufficient due to lack of redundancy
Solution Approach 1:
The system segments the motor control processor functionality into multiple independent modules (first MCP module and second MCP module), each capable of independently controlling torque output. This segmentation enables redundancy where if one module fails, the other can take over, thus improving reliability while maintaining manageable complexity through functional division
Solution Approach 2:
The system performs preliminary health monitoring and fault detection through MPM modules that continuously monitor the state of MCP modules before failures occur. The voting control module is pre-configured to switch to override control mode when faults are detected, ensuring continuous operation without waiting for complete system failure
2Reliability
If multiple monitor modules are added to monitor the state of health of the motor control processor, then the reliability is improved through redundancy, but the device complexity increases
Solution Approach 1:
The system merges the monitoring function into integrated MPM modules that are closely coupled with the MCP modules they monitor. These MPM modules perform health monitoring, fault detection, and participate in voting decisions as an integrated unit, reducing the complexity that would arise from separate distributed monitoring components
Solution Approach 2:
The MPM modules continuously provide feedback about the health status of MCP modules to the voting control module. This feedback mechanism enables real-time detection of faults and automatic switching to override control mode when necessary, improving reliability through continuous monitoring without requiring complex manual intervention systems
3Reliability
If a voting control mechanism is implemented to receive fault signals from multiple MPM modules, then the reliability is improved through fault tolerance, but the device complexity increases due to additional control logic
Solution Approach 1:
The voting control mechanism dynamically adjusts the control mode based on real-time fault signals from MPM modules. When no faults are detected, the system operates in normal MCP control mode; when faults are detected, it dynamically switches to override control mode. This dynamic adaptability provides fault tolerance while keeping the control logic manageable through clear mode transitions
4Measurement precision
If seed-and-key exchange is used for fault detection between MPM and MCP modules, then the measurement precision of fault detection is improved, but the loss of time increases due to additional verification steps
Solution Approach 1:
The MPM modules perform seed-and-key exchange verification in advance to detect faults before they affect torque control. By continuously verifying the functionality of MCP modules through cryptographic seed-and-key exchanges, the system identifies faults early and switches to override control mode, preventing failed modules from compromising system operation
Solution Approach 2:
The seed-and-key exchange mechanism serves as a preliminary anti-action against potential faults in the MCP modules. By verifying the cryptographic functionality of MCP modules before they can execute faulty control commands, the system prevents undetected faults from affecting torque output, ensuring measurement precision in fault detection
Data Source
AI summary
A controller for an electric vehicle having an electric motor is provided. The controller includes a motor control processor (MCP) module configured to control torque output of the electric motor. The controller also includes a first main processor monitor (MPM) module and a second MPM module. The first MPM module and the second MPM module are configured to separately determine a state of health of the MCP module, and to generate a first fault signal and a second fault signal, respectively, after determining the MCP module is not functional. The controller further includes a voting control module configured to receive at least one of the first fault signal from the first MPM module, and the second fault signal from the second MPM module, and to generate an override command when it receives both the first fault signal and the second fault signal. The override command overrides the MCP module.