Watchdog Timer Circuit for Motor Drive Functional Safety
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for implementing functional safety in industrial drives require separate processors for non-functional safety and functional safety-related tasks, leading to certification bottlenecks and increased complexity.
Innovation Solution
The proposed solution involves a computing device with a non-certified processor running both non-functional safety and functional safety software using alternating logic, with a watchdog timer circuit configured to receive periodic refresh signals for detecting failures and triggering safe states, such as stopping the motor, without the need for additional certified processors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If separate functional safety certified processors are used for FS and non-FS functions, then functional safety reliability is improved, but device complexity and certification bottlenecks increase
Solution Approach 1:
The patent merges FS and non-FS functions into a single processor by implementing alternating logic modes. The processor switches between FS mode (executing safety-critical code with inverted logic) and non-FS mode (executing standard control code), eliminating the need for separate certified processors while maintaining functional safety integrity through logical separation rather than physical separation.
Solution Approach 2:
The patent introduces dynamic switching between different operational modes (FS mode and non-FS mode) within the same processor. The system dynamically changes the logic inversion state based on the operational phase, allowing the processor to adapt its behavior to meet different safety requirements at different times without requiring multiple static processor configurations.
2Device complexity
If a single functional safety certified processor is used for both FS and non-FS functions, then device complexity is reduced, but certification bottlenecks increase for non-FS functionalities
Solution Approach 1:
The patent segments the operational timeline into distinct FS phases and non-FS phases, with each phase using appropriate logic inversion settings. This temporal segmentation allows the same processor to be certified for FS functions while executing non-FS functions during designated periods, as the safety-critical separation is maintained through time-based partitioning rather than requiring separate hardware certifications.
Solution Approach 2:
The system employs periodic switching between FS mode and non-FS mode, where the processor alternates between executing safety-critical code with inverted logic and standard control code with normal logic. This periodic action allows a single processor to satisfy certification requirements for FS functions while maintaining flexibility to execute diverse non-FS functionalities during non-critical periods.
3Adaptability or versatility
If alternating logic modes are used in a single processor, then certification flexibility is improved, but detection of logical errors becomes more difficult
Solution Approach 1:
The patent implements feedback mechanisms through watchdog timers that monitor the processor's operational mode and logic inversion state. The system continuously checks whether the processor is executing in the expected mode (FS or non-FS) and verifies that logic inversion is applied correctly. Any deviation from the expected state triggers an error condition, providing immediate feedback to detect logical errors despite the complexity of alternating modes.
Solution Approach 2:
The system applies preliminary error prevention by using inverted logic modes during FS phases, which causes any logical errors to manifest as obviously incorrect results (e.g., safety parameters becoming unsafe). This preliminary anti-action makes error detection easier because errors in inverted logic mode produce detectable anomalies that contradict the expected safety behavior, allowing quick identification despite the alternating mode complexity.
Data Source
Figure 1A
Figure 1B~2A
Figure 2B~2C
AI summary
According to an aspect, there is provided a functional safety, FS, watchdog timer circuit for a computing device of a frequency converter controlling a motor. The FS watchdog timer circuit is configured to trigger a safe state of the frequency converter in response to a timer of the FS watchdog timer circuit expiring. Moreover, the FS watchdog timer circuit is configured to reset the timer in response to receiving a first refresh signal from the computing device running FS software using non-inverted logic as well as in response to receiving a second refresh signal from the computing device running the FS software using inverted logic.