Method for dual-controller cooperative redundancy control of engine

Abstract

The invention provides a dual-controller cooperative redundancy control method for an engine, which comprises a main ECS and a standby ECS which are mutually redundant hot backup, and the main ECS and the standby ECS are mutually monitored and switched during working according to the following control method: when the system is normal, the main ECS controls the engine to operate; when the main ECS breaks down, the main ECS is switched to the standby ECS to continuously control the engine to operate; and when both the main ECS and the standby ECS fail, the engine is stopped. According to the method for controlling the engine in the cooperative redundancy mode through the double controllers, automatic switching can be carried out when the main control right breaks down, manual switching can be carried out when no fault exists, continuous operation can be carried out without shutdown under serious faults, and higher availability is achieved.

Description

Technical Field

[0001] The invention belongs to the technical field of intelligent control of marine diesel engines, and in particular relates to a method for coordinated redundant control of an engine by dual controllers. Background Art

[0002] The domestic marine diesel engine control field has increasingly strengthened its requirements for autonomous control. Compared with traditional mechanical control systems, the main disadvantage of ECS is its poor system reliability. However, the ship power system requires higher reliability of the ship engine in terms of maintenance and support. In response to this requirement, the thermal redundant control technology of marine ECS has emerged. The redundant design of foreign marine diesel engine ECS has been used, but due to foreign technology blockade, its technical details have not been announced. Summary of the invention

[0003] In view of this, the present invention aims to propose a method for dual-controller collaborative redundant engine control to achieve the purpose of continuous operation of the diesel engine system without stopping in the event of a serious fault, thereby improving the availability and reliability of the system in the event of a serious fault.

[0004] To achieve the above object, the technical solution of the present invention is achieved as follows:

[0005] A method for controlling an engine with dual controllers in a coordinated redundant manner includes a main ECS and a standby ECS that are mutually redundant hot backups. The main ECS and the standby ECS monitor each other during operation. The switching control method is as follows:

[0006] When the system is normal, the main ECS controls the engine operation;

[0007] When the main ECS fails, the main ECS switches to the standby ECS to continue controlling the engine operation;

[0008] When both the main ECS and the backup ECS fail, the engine shuts down.

[0009] Furthermore, the hardware circuit design of the main ECS and the standby ECS is completely the same, and the hardware resource configuration of the main ECS and the standby ECS is as follows: redundant design is performed for sensors that may cause parking, and they are connected to the main ECS and the standby ECS respectively; other sensors are only connected to the main ECS.

[0010] Furthermore, the specific control method for switching between the master ECS and the standby ECS is as follows:

[0011] First, the fault-free dual-machine state: In this state, both the main ECS and the standby ECS are fault-free and the communication between the main and standby is normal. The control and regulation functions of the diesel engine are completed by the main ECS by default. The output pulse width of the actuator is calculated by the main ECS, and the control quantity is transmitted to the standby ECS through the bus. The main ECS controls one actuator coil and the standby ECS controls the output of another actuator coil. When both the main ECS and the standby ECS are normal, they can be switched manually. When the system is powered off, the main ECS works by default when it is powered on again.

[0012] Second, single-machine state: In the dual-machine state, if the master ECS or the backup ECS detects a serious fault, the automatic switching mechanism is triggered and the single-machine control state is entered. This state can be divided into two types: when the backup ECS fails, the control right is switched from the backup ECS to the master ECS; when the master ECS fails, the control right is switched from the master ECS to the backup ECS;

[0013] Third, both machines are faulty: In this state, both the main ECS and the standby ECS have serious faults or bus communication faults, resulting in the inability to complete the control function. The engine shuts down until the next time the system is powered on and the fault is eliminated; in the dual-machine fault state, both automatic and manual switching of the system are prohibited; if the bus communication is abnormal, the state before the communication interruption remains unchanged.

[0014] Furthermore, the specific method for the main ECS and the standby ECS to monitor each other during operation is as follows: when the cooling water temperature, lubricating oil pressure, rotation speed, and fuel rack position of the main ECS and the standby ECS deviate from each other, the system alarms; for important sensors whose failure will affect the normal operation of the engine but will not cause shutdown, when the sensor of the main ECS fails, the sensor of the standby ECS is used to participate in control and alarm; for serious failures that will cause shutdown, the control function is automatically switched to another set of ECS; when the communication between the main and standby is abnormal, the deviation comparison alarm is canceled, the current control state is kept unchanged, and the automatic and manual switching functions are prohibited.

[0015] Furthermore, during the switching process between the main ECS and the standby ECS, a displacement compensation algorithm is introduced to correct the position loop PID calculation.

[0016] Furthermore, during the switching process between the main ECS and the standby ECS, a displacement compensation algorithm is introduced to correct the position loop PID calculation in the following specific method:

[0017] When the control authority changes, in order to reduce the speed fluctuation, it is necessary to maintain the actuator rack position stable and not change suddenly, that is, the calculated output pulse width does not change greatly; the input of the incremental position loop PID is based on the output pulse width calculated last time and the actual rack position, and the output pulse width is calculated, while receiving the displacement and output pulse width of another controller transmitted from the bus; when this machine is the main ECS and the current control authority is in the main ECS, the input of the position loop PID is the rack position collected by this machine and the output pulse width calculated last time, while the standby ECS without control authority also calculates the control parameters, and the input of the position loop PID is the rack position collected by the standby ECS + the deviation from the second sensor and the output pulse width calculated last time, and the calculation result is transmitted to the main ECS through the bus; when the control authority changes, the input is the expected actuator rack position and the rack position collected by the second sensor; after the control authority is changed to the standby ECS, the input of the position loop PID is the rack position collected by the standby ECS and the output pulse width calculated last time.

[0018] Furthermore, the method of dual-controller collaborative redundant engine control can be applied to military or civilian inline pump diesel engines.

[0019] Compared with the prior art, the method of dual controller coordinated redundant engine control of the present invention has the following advantages:

[0020] (1) The method of dual-controller coordinated redundant engine control described in the present invention has the characteristics of high reliability and stable control, and is suitable for power systems with high maintenance and guarantee difficulties.

[0021] (2) The method of the dual-controller collaborative redundant control engine described in the present invention uses the same strategy for the primary and standby ECSs, runs the same software, and distinguishes resource configuration and functions through parameter settings. The software has high compatibility and is more flexible to use.

[0022] (3) The method of the dual controller cooperative redundant control of the engine described in the present invention can automatically switch the main control right when there is a fault, and manually switch it when there is no fault. It can continue to run without stopping in the event of a serious fault, and has higher availability.

[0023] (4) The method of the dual controller cooperative redundant control of the engine described in the present invention uses a compensation algorithm to correct the fuel supply gear rod position, so that the engine speed is stable and has no jumps during the switching process, with small speed fluctuations, and is stable and reliable. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The accompanying drawings constituting a part of the present invention are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the accompanying drawings:

[0025] Figure 1A principle block diagram of a method for controlling an engine with dual controllers in a coordinated redundant manner according to an embodiment of the present invention;

[0026] Figure 2 A schematic diagram of a master-slave switching state machine according to an embodiment of the present invention;

[0027] Figure 3 A schematic diagram of a collaborative redundancy control method according to an embodiment of the present invention;

[0028] Figure 4 It is a schematic diagram of an output continuous stable compensation algorithm of an actuator during a switching process according to an embodiment of the present invention. DETAILED DESCRIPTION

[0029] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments may be combined with each other.

[0030] In the description of the present invention, it should be understood that the terms "center", "longitudinal", "lateral", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", and the like are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, features defined as "first", "second", and the like may explicitly or implicitly include one or more of the features. In the description of the present invention, unless otherwise specified, "multiple" means two or more.

[0031] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood by specific circumstances.

[0032] The present invention will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0033] A method for controlling an engine with dual controllers in a coordinated redundant manner can be applied to military or civilian inline pump diesel engines. Figures 1 to 4As shown, it includes a main ECS and a standby ECS that are redundant hot backups for each other. The main ECS and the standby ECS monitor each other when working. When the system is normal, the main ECS completes the control function. When the main ECS fails, the standby ECS takes over the main ECS and continues to control the engine operation.

[0034] The hardware circuit design of the main ECS and the standby ECS are exactly the same, and both can control the output of the actuator in terms of resource configuration. Some important sensors such as cooling water temperature, lubricating oil pressure, throttle, fuel rack position, speed sensor, etc. are designed redundantly and connected to the main and standby ECS respectively. Other sensors that have relatively low impact on engine operation are only connected to the main ECS.

[0035] Hardware resource configuration of the main ECS and the standby ECS: In order to ensure the continuous and stable operation of the engine, the faults occurring in the engine electronic control system are divided into serious faults and general faults. Important sensor failures that may cause the engine to stop, such as speed and fuel rack position sensor failures, are defined as serious faults. Important sensors that may affect the normal operation of the engine but will not cause shutdowns, such as cooling water temperature, lubricating oil pressure, throttle, etc., are defined as general faults when the sensors of the main ECS fail; other sensors that will not affect the operation of the engine are defined as non-important sensors. Important sensors should be designed with redundancy, and resources should be configured for both the main ECS and the standby ECS. Non-important sensors only need to be configured in the main ECS. In terms of resource configuration, both the main and standby ECS can control the output of the actuator. The resource configuration diagram of the method of dual-controller collaborative redundant control of the engine is shown in the figure. Figure 1 shown.

[0036] The main ECS and the standby ECS rely on bus communication to transmit redundant sensor information, engine operating parameters and other data to each other. When the bus communication is normal, the main and standby redundant sensors monitor each other during operation: when the cooling water temperature, lubricating oil pressure, speed, fuel rack position, etc. of the main ECS and the standby ECS deviate (the deviation exceeds the limit compared with the value of the second sensor), the system alarms; for important sensors that will affect the normal operation of the engine but will not cause shutdown, such as cooling water temperature, lubricating oil pressure, throttle, etc., when the sensor of the main ECS fails (such as open circuit / short circuit failure), the sensor of the standby ECS is used for control and an alarm is issued; for serious faults that will cause direct shutdown, such as speed and fuel rack position sensor failures, the control function is automatically switched to another set of ECS. When the communication between the main and standby is abnormal, the deviation comparison alarm is cancelled, the current control state is kept unchanged, and the automatic and manual switching functions are prohibited. The mutual monitoring strategy between the main ECS and the standby ECS is shown in Table 1.

[0037] Table 1 Mutual monitoring strategy between the active ECS and the standby ECS

[0038]

[0039]

[0040] To achieve the above functions, the dual controller collaborative redundant control strategy has three working states. The state jump control of the active / standby switching is as follows: Figure 2 As shown:

[0041] (1) Fault-free dual-machine state: In this state, both the main ECS and the standby ECS are fault-free and the communication between the main and standby is normal. The control and regulation functions of the diesel engine are completed by the main ECS by default. The output pulse width of the actuator is calculated by the main ECS, and the control quantity is transmitted to the standby ECS through the bus. The main ECS controls one actuator coil and the standby ECS controls the output of another actuator coil. Manual switching is possible when both the main ECS and the standby ECS are normal. When the system is powered off, the main ECS is defaulted to work when it is powered on again.

[0042] (2) Single-machine state: In the dual-machine state, if the main ECS or the backup ECS detects a serious fault, the automatic switching mechanism is triggered and the single-machine control state is entered. For example, the speed sensor or displacement sensor fails. This state can be divided into two types: when the backup ECS fails, the control right is switched from the backup ECS to the main ECS; when the main ECS fails, the control right is switched from the main ECS to the backup ECS.

[0043] (3) Both machines are faulty: In this state, both the main ECS and the standby ECS have serious faults or bus communication faults, resulting in the inability to complete the control function. The engine stops until the next time the system is powered on and the fault is detected and eliminated. In the state of both machines being faulty, both automatic and manual switching of the system is prohibited. If the bus communication is abnormal, the state before the communication interruption remains unchanged.

[0044] The main ECS and the standby ECS are connected to one actuator coil respectively and drive the actuator to work at the same time. To ensure the same output of the two coils, the main ECS with control right performs double closed-loop PID control to calculate the output result of the actuator and transmits the final result to the standby ECS through the bus, and the standby ECS directly outputs it. After the control right is switched, the standby ECS calculates the output result of the actuator and outputs it.

[0045] In order to ensure that the engine speed is stable and without fluctuation during the switching process and before and after the control of the main ECS and the standby ECS, a displacement compensation algorithm is introduced to correct the position loop PID calculation.

[0046] In actual use, the dual redundant displacement sensors of the actuator may produce mechanical deviations over time, resulting in slight differences in the displacements collected by the two sensors. Normal operation is not affected, but during the switching of the primary and standby control rights, the sudden change of the input signal can easily lead to discontinuous output of the actuator, thus causing engine speed fluctuations. In order to reduce the fluctuations, a displacement compensation algorithm is introduced to correct the position loop PID calculation, including the following:

[0047] In order to reduce speed fluctuations when the control authority changes, it is necessary to maintain the actuator rack position stable and without sudden changes, that is, the calculated output pulse width does not undergo large sudden changes. The input of the incremental position loop PID calculates the output pulse width based on the last calculated output pulse width and the actual rack position, and at the same time receives the displacement and output pulse width of another controller transmitted from the bus. When this machine is the main ECS and the current control authority is in the main ECS, the input of the position loop PID is the rack position collected by this machine and the output pulse width calculated last time. The standby ECS without control authority also calculates control parameters at the same time. The input of the position loop PID is the rack position collected by this machine (that is, the standby ECS) + the deviation from the second sensor and the output pulse width calculated last time. The calculation result is transmitted to the main ECS through the bus; when the control authority changes, the input is the expected actuator rack position and the rack position collected by the second sensor; after the control authority is changed to the standby ECS, the input of the position loop PID is the rack position collected by the standby ECS and the output pulse width calculated last time. The schematic diagram of the actuator output continuous stability compensation algorithm is shown in the figure. Figure 4 shown.

[0048] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for controlling an engine with dual controllers in a coordinated redundant manner, characterized in that: The main ECS and the backup ECS are redundant hot backups of each other. The main ECS and the backup ECS monitor each other during operation. The control method for switching is as follows: When the system is normal, the main ECS controls the engine operation; When the main ECS fails, the main ECS switches to the standby ECS to continue controlling the engine operation; When both the main ECS and the backup ECS fail, the engine shuts down.

2. The method of dual controller coordinated redundant engine control according to claim 1, characterized in that: The hardware circuit design of the main ECS and the backup ECS is exactly the same. The hardware resource configuration of the main ECS and the backup ECS is as follows: redundant design is performed for sensors that may cause parking, and they are connected to the main ECS and the backup ECS respectively; other sensors are only connected to the main ECS.

3. The method of dual controller coordinated redundant engine control according to claim 1, characterized in that: The specific control method for switching between the master ECS and the standby ECS is as follows: First, the fault-free dual-machine state: In this state, both the main ECS and the standby ECS are fault-free and the communication between the main and standby is normal. The control and regulation functions of the diesel engine are completed by the main ECS by default. The output pulse width of the actuator is calculated by the main ECS, and the control quantity is transmitted to the standby ECS through the bus. The main ECS controls one actuator coil and the standby ECS controls the output of another actuator coil. When both the main ECS and the standby ECS are normal, they can be switched manually. When the system is powered off, the main ECS works by default when it is powered on again. Second, single-machine state: In the dual-machine state, if the active ECS or standby ECS detects a serious fault, the automatic switching mechanism is triggered and the system enters the single-machine control state. This status can be divided into two types: when the standby ECS fails, the control is switched from the standby ECS to the active ECS; when the active ECS fails, the control is switched from the active ECS to the standby ECS; Third, both machines are faulty: In this state, both the main ECS and the standby ECS have serious faults or bus communication faults, resulting in the inability to complete the control function. The engine shuts down until the next time the system is powered on and the fault is eliminated; in the dual-machine fault state, both automatic and manual switching of the system are prohibited; if the bus communication is abnormal, the state before the communication interruption remains unchanged.

4. The method of dual controller coordinated redundant engine control according to claim 1, characterized in that: The specific method of mutual monitoring between the main ECS and the standby ECS during operation is as follows: when the cooling water temperature, lubricating oil pressure, speed, and fuel rack position of the main ECS and the standby ECS deviate from each other, the system alarms; for important sensors whose failure will affect the normal operation of the engine but will not cause shutdown, when the sensor of the main ECS fails, the sensor of the standby ECS is used to participate in control and alarm; for serious failures that will cause shutdown, the control function is automatically switched to another ECS; when the communication between the main and standby is abnormal, the deviation comparison alarm is canceled, the current control state is kept unchanged, and the automatic and manual switching functions are prohibited.

5. The method of dual controller coordinated redundant engine control according to claim 1, characterized in that: During the switching process between the main ECS and the standby ECS, a displacement compensation algorithm is introduced to correct the position loop PID calculation.

6. The method of controlling an engine with dual controllers in a coordinated redundant manner according to claim 5, characterized in that: During the switching process between the main ECS and the standby ECS, the displacement compensation algorithm is introduced to correct the position loop PID calculation as follows: In order to reduce speed fluctuations when the control right changes, it is necessary to maintain the actuator rack position stable and without sudden changes, that is, the calculated output pulse width does not undergo large sudden changes; the input of the incremental position loop PID calculates the output pulse width based on the last calculated output pulse width and the actual rack position, and at the same time receives the displacement and output pulse width of another controller transmitted from the bus; When this machine is the main ECS and the current control right is in the main ECS, the input of the position loop PID is the gear rod position collected by this machine and the output pulse width calculated last time, while the standby ECS without control right also calculates the control parameters. The input of the position loop PID is the gear rod position collected by the standby ECS + the deviation from the second sensor and the output pulse width calculated last time, and the calculation result is transmitted to the main ECS through the bus; when the control right changes, the input is the expected actuator gear rod position and the gear rod position collected by the second sensor; after the control right is changed to the standby ECS, the input of the position loop PID is the gear rod position collected by the standby ECS and the output pulse width calculated last time.

7. A method for controlling an engine with dual controllers in a coordinated redundant manner according to claims 1 to 6, characterized in that: It can be applied to military or civilian inline pump diesel engines.

Images