Back to results
US 12,754,526 B2Granted
Control system and method for safe control of a technical system
AssigneeTttech Computertechnik AG
InventorHermann Kopetz
Life of this patent
Estimating the term…
Abstract
The invention is located in the field of computer technology and relates to a subsystem, the decision system, of a distributed fault-tolerant computer architecture for fully autonomous control of a technical system. This control system consists of four subsystems, each of which is an independent hardware/software system and where each of the four subsystems forms a fault-containment unit. The four independent subsystems of the described architecture are a Primary Control System, a Monitoring System (MS), a Fallback System and a Decision System. The present invention ensures even in the event of a fail-silent fault of the decision system, the system is brought to a safe state.
Claims15
A control system for the safe control of a technical system, wherein the control system comprises:
- four mutually independent computer subsystems, a primary control system, PCS, (103), a monitoring system, MS, (104), a fallback system, FBS, (105) and a decision system, DS, (101),
- wherein the PCS (103) calculates setpoint values for the control of the technical system in each time slice and sends the setpoint values in a message (211) to the MS (104) and the DS (101) before the end of the time slice in each case,
- wherein the MS (104) checks the setpoint values it has received from the PCS (103) in each time slice, and transmits the result of this check—TRUE or FALSE—before the end of the time slice in a message (216) to the DS (101),
- wherein the FBS (105) calculates setpoint values in each time slice that can bring the system from a present state to a safe state, and wherein the FBS (105) sends these setpoint values in a message to the DS (101),
- wherein the DS (101) receives one message each from the PCS (103), the MS (104) and the FBS (105) in each time slice and, on the basis of the result of the check by the MS (104), decides whether the setpoint values of the PCS (103) or the FBS (105) are sent to the actuators (102) as selected setpoint values,
- wherein the actuators (102) are intelligent actuators, IA, which have a first input channel (107) and a second input channel (108),
- wherein if the DS (101) is fault-free, the DS (101) sends the selected setpoint values to the first input channel (107) of the IA (102) in a time-controlled message (217) at an a priori determined periodic first time point (222) in each time slice,
- wherein the DS (101) has a fail-silent behaviour, so that if a fault occurs in the DS (101), no message is sent to the IA (102),
- wherein the FBS (105) is configured to send its calculated setpoint values in a time-controlled message (215) to the second input channel (108) of the IA (102) in each time slice at an a priori determined periodic second timepoint_2 (221),
- wherein in each time slice the second timepoint_2 (221) occurs before the first timepoint_1 (222),
- wherein after the first timepoint_1 (222), the IA (102) checks whether the IA (102) has received a message sent by the DS (101) in the present time slice,
- wherein if this is the case, the IA (102) directs the selected setpoint values contained in the message (217) sent by the DS (101) and received by the IA (102) to the system,
- and
- wherein if this is not the case, the IA (102) directs the setpoint values contained in the message (215) sent by the FBS (105) to the second input channel (108) of the IA (102) to the system, and the IA (102) continues to transmit the setpoint values received from the FBS (105) via the second input channel (108) to the system in all subsequent time slices until the control system is reinitialized.
11 more elements
A method for the safe control of a technical system with a control system, wherein the control system comprises four mutually independent computer subsystems, a primary control system, PCS, (103), a monitoring system, MS, (104), a fallback system, FBS, (105) and a decision system, DS, (101), the method comprising:
- calculating, by the PCS (103), setpoint values for the control of the technical system in each time slice and sends the setpoint values in a message (211) to the MS (104) and the DS (101) before the end of the time slice in each case,
- checking, by the MS (104), the setpoint values it has received from the PCS (103) in each time slice, and transmits the result of this check—TRUE or FALSE—before the end of the time slice in a message (216) to the DS (101),
- calculating, by the FBS (105), setpoint values in each time slice that can bring the system from a present state to a safe state, and wherein the FBS (105) sends these setpoint values in a message to the DS (101),
- receiving, by the DS (101), one message each from the PCS (103), the MS (104) and the FBS (105) in each time slice and, on the basis of the result of the check by the MS (104), decides whether the setpoint values of the PCS (103) or the FBS (105) are sent to the actuators (102) as selected setpoint values,
- wherein the actuators (102) are intelligent actuators, IA, which have a first input channel (107) and a second input channel (108),
- wherein if the DS (101) is fault-free, the DS (101) sends the selected setpoint values to the first input channel (107) of the IA (102) in a time-controlled message (217) at an a priori determined periodic first time point (222) in each time slice,
- wherein the DS (101) has a fail-silent behaviour, so that if a fault occurs in the DS (101) no message is sent to the IA (102),
- wherein the FBS (105) is configured to send, in each time slice, its calculated setpoint values in a time-controlled message (215) to the second input channel (108) of the IA (102) at an a priori determined periodic second timepoint_2 (221),
- wherein in each time slice the second timepoint_2 (221) occurs before the first timepoint_1 (222),
- wherein after the first timepoint_1 (222), the IA (102) checks whether the IA (102) has received a message sent by the DS (101) in the present time slice,
- wherein if this is the case, the IA (102) directs the selected setpoint values contained in the message (217) sent by the DS (101) and received by the IA (102) to the system,
- and
- wherein if this is not the case, the IA (102) directs the setpoint values contained in the message (215) sent by the FBS (105) to the second input channel (108) of the IA (102) to the system, and the IA (102) continues to transmit the setpoint values received from the FBS (105) via the second input channel (108) to the system in all subsequent time slices until the control system is reinitialized.
10 more elements
Dependencies are inferred from the claim text.