Programmable Power Module Segmentation for Safety
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Programmable electronic power controllers face challenges in reliably transitioning to emergency operation due to software errors, especially when complex additional functions consume processor resources, leading to system-critical 'common cause' errors, which can prevent safe shutdown of electromechanical actuators in safety-critical systems like wind turbines or electric vehicles.
Innovation Solution
The controller is divided into a basic control for emergency operations and an additional control for non-essential functions, with a control separation point to disconnect the additional control during errors, ensuring the basic control operates independently with reduced complexity and preventing software errors from affecting safety functions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If complex additional functions are integrated into the power controller to enhance functionality and ease of operation, then the ease of operation and adaptability improve, but the reliability deteriorates due to software errors and processor resource consumption
Solution Approach 1:
The control module is segmented into a basic control unit and an additional control unit. The basic control unit handles essential safety-critical functions with a simple, verified software design, while the additional control unit manages complex additional functions. This segmentation isolates software errors to the additional control unit, preventing them from affecting the reliability of the basic control unit while maintaining ease of operation through the additional functions.
2Device complexity
If a single integrated control module is used to reduce device complexity, then the device complexity decreases, but the reliability worsens due to common cause errors affecting the entire system
Solution Approach 1:
The control module is divided into functionally independent basic control and additional control units with separate processing resources. This segmentation prevents common cause errors from affecting the entire system - if the additional control unit fails, the basic control unit continues to operate reliably, maintaining system safety while keeping the overall device complexity manageable through modular design.
3Adaptability or versatility
If processor resources are allocated to complex additional functions, then the adaptability and ease of operation improve, but the reliability deteriorates when processor power is consumed by non-essential functions during emergency situations
Solution Approach 1:
The control system is segmented into a basic control unit with dedicated processing resources for safety-critical functions and an additional control unit for non-essential functions. During emergency situations, the basic control unit maintains full processor availability for reliable emergency operation, while the additional control unit can be deactivated or isolated, preventing resource contention and ensuring adaptability is maintained without compromising reliability.
Data Source
Figure 1
AI summary
The invention describes a programmable electronic power regulator having a power module (10) for controlling at least one connectable actuator (80), a control module (20) for actuating the power module (10) by means of a power module control signal (29), and an internal monitoring module (30) for transferring the control module (20) to emergency operation, the control module (20) having a basic controller (21), an additional controller (23) and a controller disconnection point (22). The basic controller (21) is configured to output the control signals (29) to the power module. The functions for controlling the actuator (80) in an open- and closed-loop manner which are needed for emergency operation in a critical operating state are also implemented in the basic controller (21). The additional controller (23) carries out functions not required for emergency operation in a critical operating state. The controller disconnection point (22) connects the basic controller (21) to the additional controller (23) via a control connection (24, 25) and is configured to receive the error signal (31) from the internal monitoring module (30) and once it has received said signal to at least partially disconnect the control connection (24, 25).