Safety Sensor Evaluation Using Virtual Reference Path
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer systems for evaluating safety-critical sensor variables often fail to detect CPU errors, particularly when internal errors in parallel or inverted computational paths result in identical but false results, leading to undetected errors and potential safety-critical consequences.
Innovation Solution
A computer system that includes a micro-controller, at least two sensors, and a comparator independent of the computer, where the second sensor variable bypasses the computer, allowing for direct comparison with a reference variable calculated using a function that considers the relationship between the sensor variables, ensuring the computer's integrity without relying on intricate CPU tests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If two different micro-controller chips or parallel computational paths are used to verify CPU safety, then safety integrity level is improved, but device complexity and cost increase
Solution Approach 1:
The patent creates a virtual copy of the sensor variable processing path through mathematical functions. Instead of duplicating hardware (micro-controller chips or computational paths), the system uses a first function to transform the sensor variable and a second function to transform the output variable, creating a virtual reference path that can be compared against the actual computational path without requiring additional physical hardware
Solution Approach 2:
The patent replaces the mechanical/hardware-based verification system (parallel computational paths or dual micro-controllers) with a software/mathematical verification system. The functional relationships (first function and second function) substitute for physical duplicate processing paths, achieving the same safety verification goal through computational mathematics rather than hardware replication
2Reliability
If parallel or inverted computational paths are used, then verification capability is improved, but CPU errors can remain undetected when the CPU computes incorrectly in the same manner in both paths
Solution Approach 1:
The patent introduces asymmetry into the verification process by using two different mathematical functions (first function and second function) with different transformation characteristics. The first function transforms the sensor variable to an output variable, while the second function transforms the output variable to a reference variable. This asymmetric functional relationship ensures that errors affecting both computational paths in the same manner will be detected, because the mathematical transformations differ in nature and sensitivity to various error types
3Reliability
If additional hardware is used to verify functional safety in parallel computational paths, then safety verification is improved, but device complexity and cost increase
Solution Approach 1:
The patent makes the existing computer system universal by enabling it to perform both the primary computational function (processing sensor variables through the first function) and the verification function (calculating reference variables through the second function). The same computer system executes both computational paths software-based, eliminating the need for separate dedicated verification hardware while maintaining comprehensive safety verification capability
Data Source
AI summary
A computer system for safety critical sensor variables includes first and second sensors which respectively output first and second sensor variables, a computer, and an independent comparator. The computer calculates an output variable from the first sensor variable by a first function. The computer calculates a comparison variable from the output variable by a second function. The comparison variable and the second sensor variable are applied to the input of the comparator. The second sensor variable is not an input variable of the computer and differs from the first sensor variable in terms of its qualitative value. By calculations of the computer and, if appropriate, of the comparator, an expected comparison variable for the second sensor variable is determined from the calculated output variable, and the correspondence of the two variables is checked by the comparator. Specific internal errors of the computer can thereby be discovered.