Motor Control Lockstep Monitoring for Independent Safety Shutdown
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing motor control systems in vehicles lack independence between control and diagnosis mechanisms, leading to potential risks when intermediate steps fail and fail to meet functional safety standards like ISO 26262, especially in complex multi-layer systems.
Innovation Solution
A motor control system with a multi-core processing module, including a main function core and a lockstep monitoring core, that implements safety monitoring and independent control by limiting control permissions when failures occur, and a safety logic module to trigger safety controls, ensuring timely and effective safety measures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a serial architecture is adopted for motor control system, then device complexity is reduced, but reliability deteriorates because when any intermediate step fails, the system cannot timely and effectively ensure control state
Solution Approach 1:
The patent divides the motor control system into multiple independent control paths (first control path with first control unit, second control path with second control unit) that can operate autonomously. Each control path has its own processing resources and can independently execute control algorithms, ensuring that failure in one path does not affect the other path's reliability
Solution Approach 2:
Different control units are assigned specialized functions with optimized local characteristics. The first control unit handles primary control tasks while the second control unit provides redundant monitoring and backup control capabilities, allowing each component to operate at its optimal performance level while maintaining overall system reliability
2Device complexity
If control and diagnosis share common resources, then device complexity is reduced, but reliability deteriorates because when shared resources fail, the diagnosis mechanism fails
Solution Approach 1:
The patent separates diagnosis resources from control resources by allocating independent processing units, memory, and communication interfaces for diagnosis functions. This segmentation ensures that diagnosis operations can be performed independently without being affected by control resource failures, maintaining diagnostic reliability even under fault conditions
Solution Approach 2:
An intermediary interface layer is introduced between control resources and diagnosis resources, allowing controlled access and data exchange while maintaining resource isolation. This intermediary enables diagnosis functions to monitor control operations without sharing critical control resources, preventing resource contention and failure propagation
3Reliability
If functional safety monitoring is enhanced with lockstep cores, then reliability is improved, but device complexity increases
Solution Approach 1:
The patent implements lockstep monitoring by creating identical copies of critical control logic in separate processing cores. These duplicate cores execute the same control algorithms simultaneously, and their outputs are compared to detect errors. This copying approach provides comprehensive safety monitoring while maintaining manageable complexity through systematic duplication of proven design modules
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present invention provides a motor control system and a vehicle. The motor control system (1) includes a motor drive module (10), a multi-core processing module (20), and a safety logic module (30). The multi-core processing module (20) includes a main function core (21) and a lockstep monitoring core (22). The main function core (21) is configured to obtain sampling data, and when any one of the sampling data, a running status of the main function core (21), a motor control signal, and a running status of a motor is abnormal, the lockstep monitoring core (22) outputs a safety trigger signal; and the safety logic module (30) is configured to output an instruction for prohibiting execution of the motor control signal to the motor drive module (10) when receiving the safety trigger signal.