Redundant sensor system with fault detection and mitigation

A sensor system comprising:

• a first module including a first sensor configured to produce a first sense signal in response to a physical stimulus and a first processing circuit configured to receive the first sense signal and produce a first processed signal representative of the first sense signal;
• a first fault detection circuit electrically coupled with the first module, the first fault detection circuit being configured to determine from the first processed signal whether the first module is faulted, wherein the first fault detection circuit prevents output of the first processed signal when the first module is faulted and the first fault detection circuit enables output of the first processed signal when the first module is not faulted;
• a second module including a second sensor configured to produce a second sense signal in response to the physical stimulus and a second processing circuit configured to receive the second sense signal and produce a second processed signal representative of the second sense signal;
• a second fault detection circuit electrically coupled with the second module, the second fault detection circuit being configured to determine from the second processed signal whether the second module is faulted, wherein the second fault detection circuit prevents output of the second processed signal when the second module is faulted and the second fault detection circuit enables output of the second processed signal when the second module is not faulted, wherein each of the first and second fault detection circuits is configured to identify one of a plurality of possible states of a corresponding one of the first and second modules in response to the corresponding one of the first and second processed signals, the plurality of possible states including a non-faulted state, an underflow state, an overflow state, and an error state;
• and
• a signal processing unit electrically coupled to each of the first and second fault detection circuits and configured to produce a first output signal when both of the first and second processed signals are received, the first output signal being a combination of the first and second processed signals, and the signal processing unit being further configured produce a second output signal when only one of the first and second processed signals is received, the second output signal utilizing the first processed signal or the second processed signal from a non-faulted one of the first and second modules, wherein:
• when the non-faulted state is identified, the corresponding one of the first and second fault detection circuits enables output of the corresponding one of the first and second processed signals;
• when the error state is identified, the corresponding one of the first and second fault detection circuits prevents output of the corresponding one of the first and second processed signals;
• and
• when either of the underflow and overflow states is identified, the corresponding one of the first and second fault detection circuits at least temporarily prevents output of the corresponding one of the first and second processed signals.

A sensor system comprising:

• a first module including a first sensor configured to produce a first sense signal in response to a physical stimulus and a first processing circuit configured to receive the first sense signal and produce a first processed signal representative of the first sense signal;
• a first fault detection circuit electrically coupled with the first module, the first fault detection circuit being configured to determine from the first processed signal whether the first module is faulted, wherein the first fault detection circuit prevents output of the first processed signal when the first module is faulted and the first fault detection circuit enables output of the first processed signal when the first module is not faulted, the first fault detection circuit comprising:
• a first comparator configured to compare the first processed signal with a first upper threshold limit, produce a first digital value when the first processed signal is less than the first upper threshold limit, and produce a second digital value when the first processed signal is greater than the first upper threshold limit;
• and
• a second comparator configured to compare the first processed signal with a first lower threshold limit, produce the first digital value when the first processed signal is greater than the first lower threshold limit, and produce the second digital value when the first processed signal is less than the first lower threshold limit;
• and
• a second module including a second sensor configured to produce a second sense signal in response to the physical stimulus and a second processing circuit configured to receive the second sense signal and produce a second processed signal representative of the second sense signal;
• a second fault detection circuit electrically coupled with the second module, the second fault detection circuit being configured to determine from the second processed signal whether the second module is faulted, wherein the second fault detection circuit prevents output of the second processed signal when the second module is faulted and the second fault detection circuit enables output of the second processed signal when the second module is not faulted;
• the second fault detection circuit comprising:
• a third comparator configured to compare the second processed signal with a second upper threshold limit, produce the first digital value when the second processed signal is less than the second upper threshold limit, and produce the second digital value when the second processed signal is greater than the second upper threshold limit;
• and
• a fourth comparator configured to compare the second processed signal with a second lower threshold limit, produce the first digital value when the second processed signal is greater than the second lower threshold limit, and produce the second digital value when the second processed signal is less than the second lower threshold limit;
• and
• a signal processing unit electrically coupled to each of the first and second fault detection circuits and configured to produce a first output signal when both of the first and second processed signals are received, the first output signal being a combination of the first and second processed signals, and the signal processing unit being further configured produce a second output signal when only one of the first and second processed signals is received, the second output signal utilizing the first processed signal or the second processed signal from a non-faulted one of the first and second modules.

A method for testing a sensor system having independent first and second modules, the first module including a first sensor configured to produce a first sense signal in response to a physical stimulus and a first processing circuit configured to receive the first sense signal and produce a first processed signal representative of the first sense signal, the second module including a second sensor configured to produce a second sense signal in response to the physical stimulus and a second processing circuit configured to receive the second sense signal and produce a second processed signal representative of the second sense signal, and the method comprising:

• determining from the first processed signal whether the first module is faulted, wherein the determining from the first processed signal whether the first module is faulted comprises identifying one of a plurality of possible states of the first module in response to the first processed signal, the plurality of possible states including a non-faulted state, an underflow state, an overflow state, and an error state;
• determining from the second processed signal whether the second module is faulted, wherein the determining from the second processed signal whether the second module is faulted comprises identifying one of the plurality of possible states of the second module in response to the second processed signal;
• combining the first and second processed signals to produce a first output signal when neither of the first of the first and second modules is faulted, wherein the combining operation is performed in response to identifying that both of the first and second modules is in the non-faulted state;
• producing a second output signal by utilizing only the first processed signal or the second processed signal from a non-faulted one of the first and second modules when the other of the first and second modules is faulted, wherein the producing operation is performed when one of the first and second modules is in the underflow state, the overflow state, and the error state;
• and
• following the performing the producing operation when one of the first and second modules is in the underflow state or the overflow state, the method further comprises:
• ascertaining that the one of the first and second modules has returned to the non-faulted state;
• and
• performing the combining operation in response to ascertaining that the one of the first and second modules has returned to the non-faulted state.

A method for testing a sensor system having independent first and second modules, the first module including a first sensor configured to produce a first sense signal in response to a physical stimulus and a first processing circuit configured to receive the first sense signal and produce a first processed signal representative of the first sense signal, the second module including a second sensor configured to produce a second sense signal in response to the physical stimulus and a second processing circuit configured to receive the second sense signal and produce a second processed signal representative of the second sense signal, and the method comprising:

• determining from the first processed signal whether the first module is faulted, wherein the determining from the first processed signal whether the first module is faulted comprises:
• comparing the first processed signal with a first upper threshold limit;
• comparing the first processed signal with a first lower threshold limit;
• identifying a non-faulted state of the first module when the first processed signal is within the first upper and lower threshold limits;
• and
• identifying one of an underflow state, an overflow state, and an error state of the first module when the first processed signal is outside of at least one of the first upper and lower threshold limits, wherein the underflow state, the overflow state, and the error state indicates the first module is at least temporarily faulted;
• and
• determining from the second processed signal whether the second module is faulted, wherein the determining from the second processed signal whether the second module is faulted comprises:
• comparing the second processed signal with a second upper threshold limit;
• comparing the second processed signal with a second lower threshold limit;
• identifying the non-faulted state of the second module when the second processed signal is within the second upper and lower threshold limits;
• and
• identifying one of the underflow state, the overflow state, and the error state when the second processed signal is outside of at least one of the second upper and lower threshold limits, wherein the underflow state, the overflow state, and the error state indicates the second module is at least temporarily faulted.