Safety Module Segmentation for Level Measurement Cost Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current level, pressure, and density measurement devices often require excessive development and maintenance efforts due to the classification of components as safety-critical, even when they do not directly affect safety functions, leading to unnecessary costs and complexity.
Innovation Solution
The electronic module is designed with a safety-critical area for diagnostic functions and a non-safety-critical area for outsourced components, allowing for reduced development efforts by relocating components that affect safety functions and implementing diagnostic measures to ensure fault detection and correction, thereby maintaining safety functionality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If components that affect safety functions are assigned to the safety-relevant area, then the safety function quality is ensured, but the development and maintenance effort increases unnecessarily
Solution Approach 1:
The electronic module is divided into two distinct areas: a safety-relevant area and a non-safety-relevant area. This segmentation allows components to be classified according to their actual safety impact, placing only essential safety-critical components in the safety-relevant area while moving less critical components to the non-safety-relevant area. The patent implements this by creating separate processing units and memory spaces for each area, enabling independent development and maintenance procedures tailored to the specific safety requirements of each component type.
Solution Approach 2:
Different quality and safety requirements are applied to different parts of the system based on their specific functions. The safety-relevant area implements rigorous safety protocols, formal verification, and fail-safe mechanisms, while the non-safety-relevant area uses standard development practices. This local differentiation of quality standards ensures that safety-critical components receive appropriate scrutiny without subjecting all components to unnecessarily stringent requirements, thereby reducing overall development complexity.
2Reliability
If all components are classified as safety-critical, then the safety function is protected, but the development costs and effort increase significantly
Solution Approach 1:
Instead of applying full safety-critical development procedures to all components, the patent applies safety-critical measures only partially - specifically to those components that genuinely affect safety functions. The diagnostic function implements a risk-based approach where components are assessed and only those requiring safety certification are subjected to the corresponding development rigor. This partial application of safety measures maintains adequate protection while avoiding the excessive costs associated with universal safety-critical classification.
3Device complexity
If components are moved to the non-safety-critical area, then development effort is reduced, but the risk of undetected faults affecting safety increases
Solution Approach 1:
The diagnostic function continuously monitors components in the non-safety-relevant area and provides feedback to the safety-relevant area about their operational status. This feedback mechanism includes checking for errors, validating output signals, and detecting anomalies that could indicate potential safety issues. The system implements a closed-loop monitoring approach where the diagnostic function regularly assesses the health of outsourced components and can trigger safety responses if problems are detected, thereby maintaining reliability without requiring all components to be safety-critical.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
The module (100) has a safety-critical area (101) and a safety-uncritical area (102), which performs a safety-critical transferred function of the module. The transferred function is transferred from the safety-critical area into the safety-uncritical area and affects safety function performed by the module. The safety-critical area performs a diagnostic function to check an execution of the function in the safety-uncritical area. The diagnostic function detects an error in the function. The module takes a measure if the error is detected in the transferred function. An independent claim is also included for a method for measuring and determining a filling level, a pressure and a density of a medium in a container.