Multi-mode engine throttle control redundancy management system and method

Abstract

The invention belongs to the technical field of engine throttle control, and discloses a multi-mode engine throttle control redundancy management system and method. The interface module 1 is directly connected with the driving module 1 through a bus 1, and the interface module 2 is directly connected with the driving module 2 through a bus 2; the interface module 1 is directly connected with the interface module 2 through the bus 3; the interface module 1 is directly connected with the redundancy control module 1 through the bus 4 to judge the software fault of the redundancy control module 1; the interface module 2 is directly connected with the redundancy control module 2 through the bus 5 to judge a software fault of the redundancy control module 2; the redundancy control module 1 and the redundancy control module 2 carry out dual-redundancy cross transmission through the bus 6; the redundancy control module 1, the redundancy control module 2, the driving module 1 and the driving module 2 are directly connected through a bus 7.

Description

Technical Field

[0001] This invention belongs to the field of engine throttle control technology, and relates to a multi-mode engine throttle control redundancy management system and method. Background Technology

[0002] To meet the availability requirements of the engine integrated processing system's throttle control and ensure stable and reliable system operation, traditional single-redundancy control methods cannot meet the availability requirements of engine throttle control.

[0003] To ensure stable and reliable engine throttle control, three control modes are set up: system operation, single fault, and direct chain. Multiple monitoring methods are used to achieve redundant switching control of the system and improve system availability. Summary of the Invention

[0004] The purpose of this invention is to propose a multi-mode engine throttle control redundancy management system and method, which adopts multiple monitoring methods to realize system redundancy switching control, provides the system with availability for engine throttle control, and ensures stable and reliable engine throttle control.

[0005] The technical solution of this invention is: On one hand, the present invention provides a multi-mode engine throttle control redundancy management system, the system comprising: interface module 1, interface module 2, redundancy control module 1, redundancy control module 2, drive module 1, and drive module 2; Interface module 1 is directly connected to driver module 1 via bus 1, and interface module 2 is directly connected to driver module 2 via bus 2; Interface module 1 is directly connected to interface module 2 via bus 3; Interface module 1 is directly connected to redundancy control module 1 via bus 4 to determine software faults in redundancy control module 1; Interface module 2 is directly connected to redundancy control module 2 via bus 5 to determine software faults in redundancy control module 2; Redundancy control module 1 and redundancy control module 2 perform dual-redundancy cross-transmission via bus 6; Redundancy control module 1, redundancy control module 2, drive module 1, and drive module 2 are directly connected via bus 7.

[0006] On the other hand, the present invention also provides a multi-mode engine throttle control redundancy management method, comprising the following steps: Step 1: Redundancy control module 1 and redundancy control module 2 select their own redundancy control status based on the number of system power-ups; Step 2: Redundancy control module 1 and redundancy control module 2 select the controllable state based on the dual redundancy cross transmission fault state, the other party's redundancy fault state, their own redundancy fault state, and the other party's redundancy controllable state. Step 3: Drive module 1 and drive module 2 perform drive control based on the controllable state of redundancy control module 1 and redundancy control module 2; Step 4: Drive module 1 and drive module 2 determine the direct chain control mode based on the fault status of redundancy control module 1 and redundancy control module 2, software fault status, communication fault status, and interface module communication fault status. Step 5: Redundancy control module 1 and redundancy control module 2 determine the system working mode based on their own redundancy fault status, the other party's redundancy fault status, and the effective status of the direct chain control mode reported by the drive module.

[0007] Furthermore, step one includes: Step 1.1: If the redundancy control module 1 has no power-on self-detection fault, use the number of power-on times recorded by the redundancy control module 1 to set the in-control state; Step 1.2: If the power-on self-detection fault of the redundancy control module 1 is valid and the power-on self-detection fault of the redundancy control module 2 is not valid, the number of power-on times recorded by the redundancy control module 2 is used to set the in-control state. Step 1.3: If the conditions in steps 1.2 and 1.2 are not met, the number of power-on cycles remains at the initial value of 0. Step 1.4: Set the redundancy control state according to the number of power-on cycles; When the number of power-on cycles is odd, the redundancy control module 1 channel is set to "in control"; when the number of power-on cycles is even, the redundancy control module 2 channel is set to "in control".

[0008] Furthermore, step two includes: When the redundancy fault status sent by the other redundancy control module through dual redundancy cross transmission is "fault", and this redundancy control module has no redundancy fault, and the control status sent by the other redundancy control module through dual redundancy cross transmission is "out of control", the control status of this redundancy control module is set to "in control".

[0009] Furthermore, step two also includes: When the redundancy control module detects a cross-transmission fault status between dual redundancies as "fault" and the redundancy control module has no redundancy fault, the in-control status of the redundancy control module is set to "in-control".

[0010] Furthermore, step two also includes: When the redundancy fault status of this redundancy control module is "fault", the on-control status of this redundancy control module will be set to "out of control".

[0011] Furthermore, step three includes: Step 3.1: Drive module 1 receives the control status of redundancy control module 1 and redundancy control module 2 and performs drive control. When the control status of redundancy control module 1 is "in control", drive module 1 executes the instruction of redundancy control module 1 to perform drive control; otherwise, drive control is not performed. Step 3.2: Drive module 2 performs drive control by receiving the control status of redundancy control module 1 and redundancy control module 2. When the control status of redundancy control module 2 is "in control", drive control is performed by executing the instructions of redundancy control module 2; otherwise, drive control is not performed.

[0012] Furthermore, step four includes: Step 4.1: If any of the following fault states is "fault": bus communication failure between this driver module and the corresponding redundancy control module, fault of the redundancy control module corresponding to this driver module, or software fault of the redundancy control module corresponding to this driver module, set the relevant fault state of this driver module to "fault". Step 4.2: When this driver module receives any of the following fault states as "fault": bus fault between the other driver module and the corresponding redundancy control module, redundancy control module fault corresponding to the other driver module, or software fault state of redundancy control module corresponding to the other driver module, it sets the relevant fault state of the other driver module to "fault". Step 4.3: If the relevant fault status of this driver module is "fault" and the relevant fault status of the other driver module is "fault" and the corresponding interface module communication is fault-free, this driver module sets the direct link working mode to be effective, and this driver module directly uses the instructions sent by the corresponding interface module for drive control; otherwise, this driver module sets the direct link working mode to be invalid.

[0013] Furthermore, step five includes: Step 5.1: If neither redundancy control module 1 nor redundancy control module 2 has a redundancy fault, the system operating mode is working. Step 5.2: If either the redundancy fault status of redundancy control module 1 or redundancy control module 2 is "fault", the system operating mode is one-fault operation. Step 5.3: If the direct chain control mode reported by driver module 1 and driver module 2 is valid, the system working mode is direct chain.

[0014] The advantages of this invention are: the multi-mode engine throttle control redundancy management method of this invention, by adding an interface module and a drive module for communication and cross-linking, increases the system's direct chain control mode, improves the redundancy of the engine throttle control system, thereby improving the system's availability, ensuring stable and reliable operation of the system, and thus improving the safety of the engine integrated processing system. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. The drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 This is a control block diagram for multi-mode engine throttle control redundancy management. Detailed Implementation

[0017] The present invention will be further described in detail below with reference to the embodiments and accompanying drawings, but the embodiments of the present invention are not limited thereto.

[0018] This embodiment uses the following steps to verify the multi-mode engine throttle control redundancy management method: Step 1, according to Figure 1 As shown, the redundancy control module 1 and redundancy control module 2 of the engine integrated processing system select their own redundancy control state based on the number of times the system is powered on; Specifically, the control state selection step includes: Step 1.1: If the redundancy control module 1 has no power-on self-detection fault, use the number of power-on cycles recorded by the redundancy control module 1 to set the in-control state; for example, if the redundancy control module 1 has no power-on self-detection fault, use the number of power-on cycles recorded by the redundancy control module 1 to set the in-control state. Step 1.2: If the power-on self-detection fault of the redundancy control module 1 is invalid and the power-on self-detection fault of the redundancy control module 2 is not invalid, the number of power-on cycles recorded by the redundancy control module 2 is used to set the in-control state; for example, if the power-on self-detection fault of the redundancy control module 1 is invalid and the power-on self-detection fault of the redundancy control module 2 is not invalid, the number of power-on cycles recorded by the redundancy control module 2 is used to set the in-control state. Step 1.3: Otherwise, the number of power-on cycles remains at the initial value of 0; Step 1.4: Set the redundancy control status based on the number of power-on cycles. When the number of power-on cycles is odd, set the redundancy control module 1 channel's control status to "Controlled"; when the number of power-on cycles is even, set the redundancy control module 2 channel's control status to "Controlled". For example, when the number of power-on cycles is 3, set the redundancy control module 1 channel's control status to "Controlled".

[0019] Step Two, according to Figure 1 As shown, redundancy control module 1 and redundancy control module 2 select the controllable state based on the dual redundancy cross transmission fault state, the other party's redundancy fault state, their own redundancy fault state, and the other party's redundancy controllable state. Step 2.1: When the redundancy fault status sent by the other party through dual redundancy cross transmission is "fault", and this redundancy has no redundancy fault, and the control status sent by the other party through dual redundancy cross transmission is "out of control", set the control status of this redundancy to "in control"; for example, when the redundancy fault sent by redundancy control module 2 through dual redundancy cross transmission is valid, and redundancy control module 1 has no redundancy fault, and the control status sent by redundancy control module 2 through dual redundancy cross transmission is "out of control", redundancy control module 1 will set the control status to "in control"; Step 2.2: When the redundancy detects a cross-transmission fault status between the two redundancies as "fault" and the redundancy has no redundancy fault, the redundancy control module 1 sets the redundancy control status to "in control". For example, when the redundancy control module 1 detects a cross-transmission fault status between the two redundancies as "fault" and the redundancy control module 1 has no redundancy fault, the redundancy control module 1 sets the redundancy control status to "in control". Step 2.3: When the redundancy fault status of this redundancy is "fault", set the redundancy in-control status to "out of control"; for example, when the redundancy fault status of redundancy control module 1 is "fault", redundancy control module 1 will set the in-control status to "out of control".

[0020] Step 3, according to Figure 1 As shown, drive module 1 and drive module 2 perform drive control according to the controllable state of redundancy control module 1 and redundancy control module 2; Step 3.1: Drive module 1 performs drive control by receiving the control status of redundancy control module 1 and redundancy control module 2. When the control status of redundancy control module 1 is "in control", drive module 1 executes the instructions of redundancy control module 1 to perform drive control. For example, when drive module 1 receives the control status of redundancy control module 1 as "in control", drive module 1 executes the instructions of redundancy control module 1 to perform drive control. Step 3.2: Drive module 2 performs drive control by receiving the control status of redundancy control module 1 and redundancy control module 2. When the control status of redundancy control module 2 is "in control", drive module 2 executes the instructions of redundancy control module 1 to perform drive control. For example, when drive module 2 receives the control status of redundancy control module 2 as "in control", drive module 2 executes the instructions of redundancy control module 2 to perform drive control. Step 3.3: Otherwise, no control is performed.

[0021] Step 4, according to Figure 1 As shown, drive module 1 and drive module 2 determine the direct chain control mode based on the fault status, software fault status, communication status, and interface module communication status of redundancy control module 1 and redundancy control module 2. Step 4.1: When any of the following fault states is "fault": bus fault between this driver module and redundancy, redundancy fault corresponding to this driver module, or redundancy software fault corresponding to this driver module, set the relevant fault state of this driver module to "fault". For example, when the bus fault state between driver module 1 and redundancy is "fault", set the relevant fault state of driver module 1 to "fault". Step 4.2: When any of the following fault states is "fault": bus fault between the other party's driver module and the redundancy, redundancy fault corresponding to the other party's driver module, or redundancy software fault corresponding to the other party's driver module, set the relevant fault state of the other party's driver module control to "fault". For example, when the fault state of the redundancy control module 2 corresponding to driver module 2 is "fault", set the relevant fault state of driver module 2 control to "fault". Step 4.3: If the relevant fault status controlled by this driver module is "fault" and the relevant fault status controlled by the other driver module is "fault", the driver module sets the direct chain working mode to be effective, and the driver module directly uses the instructions sent by the corresponding interface module to perform drive control; for example, if the relevant fault status controlled by driver module 1 is "fault" and the relevant fault status controlled by driver module 2 is "fault", driver module 1 sets the direct chain working mode to be effective, and driver module 1 directly uses the instructions sent by interface module 1 to perform drive control. Step 4.4 Otherwise, the driver module sets the direct chain working mode to invalid.

[0022] Step 5, according to Figure 1 As shown, redundancy control module 1 and redundancy control module 2 determine the system working mode based on their own redundancy fault status, the other party's redundancy fault status, and the effective status of the direct chain control mode reported by the drive module. Step 5.1: If neither redundancy control module 1 nor redundancy control module 2 has a redundancy fault, the system operating mode is "operating". For example, if neither redundancy control module 1 nor redundancy control module 2 has a redundancy fault, redundancy control module 1 sets the system operating mode to "operating". Step 5.2: If either the redundancy fault status of redundancy control module 1 or redundancy control module 2 is "fault", the system operating mode is one-fault operation; for example, if the redundancy fault status of redundancy control module 1 is "fault", redundancy control module 1 sets the system operating mode to one-fault operation. Step 5.3: If the direct chain control mode reported by drive module 1 and drive module 2 is valid, the system working mode is direct chain. For example, if the direct chain control mode reported by drive module 1 is valid, the redundancy control module 1 sets the system working mode to direct chain.

[0023] The above detailed embodiments are a description of the present invention. It should not be considered that the specific embodiments of the present invention are limited to these descriptions. For those skilled in the art, several simple deductions and substitutions can be made without departing from the concept of the present invention, and all of these should be considered to fall within the protection scope of the present invention.

Claims

1. A multi-mode engine throttle control redundancy management system, characterized in that, The system includes: interface module 1, interface module 2, redundancy control module 1, redundancy control module 2, driver module 1, and driver module 2; Interface module 1 is directly connected to driver module 1 via bus 1, and interface module 2 is directly connected to driver module 2 via bus 2; Interface module 1 is directly connected to interface module 2 via bus 3; Interface module 1 is directly connected to redundancy control module 1 via bus 4 to determine software faults in redundancy control module 1; Interface module 2 is directly connected to redundancy control module 2 via bus 5 to determine software faults in redundancy control module 2; Redundancy control module 1 and redundancy control module 2 perform dual-redundancy cross-transmission via bus 6; Redundancy control module 1, redundancy control module 2, drive module 1, and drive module 2 are directly connected via bus 7.

2. A multi-mode engine throttle control redundancy management method, characterized in that, The method is implemented based on the system described in claim 1, and includes the following steps: Step 1: Redundancy control module 1 and redundancy control module 2 select their own redundancy control status based on the number of system power-ups; Step 2: Redundancy control module 1 and redundancy control module 2 select the controllable state based on the dual redundancy cross transmission fault state, the other party's redundancy fault state, their own redundancy fault state, and the other party's redundancy controllable state. Step 3: Drive module 1 and drive module 2 perform drive control based on the controllable state of redundancy control module 1 and redundancy control module 2; Step 4: Drive module 1 and drive module 2 determine the direct chain control mode based on the fault status of redundancy control module 1 and redundancy control module 2, software fault status, communication fault status, and interface module communication fault status. Step 5: Redundancy control module 1 and redundancy control module 2 determine the system working mode based on their own redundancy fault status, the other party's redundancy fault status, and the effective status of the direct chain control mode reported by the drive module.

3. The multi-mode engine throttle control redundancy management method according to claim 2, characterized in that, Step one includes: Step 1.1: If the redundancy control module 1 has no power-on self-detection fault, use the number of power-on times recorded by the redundancy control module 1 to set the in-control state; Step 1.2: If the power-on self-detection fault of the redundancy control module 1 is valid and the power-on self-detection fault of the redundancy control module 2 is not valid, the number of power-on times recorded by the redundancy control module 2 is used to set the in-control state. Step 1.3: If the conditions in steps 1.2 and 1.2 are not met, the number of power-on cycles remains at the initial value of 0. Step 1.4: Set the redundancy control state according to the number of power-on cycles; When the number of power-on cycles is odd, the redundancy control module 1 channel is set to "in control"; when the number of power-on cycles is even, the redundancy control module 2 channel is set to "in control".

4. The multi-mode engine throttle control redundancy management method according to claim 3, characterized in that, Step two includes: When the redundancy fault status sent by the other redundancy control module through dual redundancy cross transmission is "fault", and this redundancy control module has no redundancy fault, and the control status sent by the other redundancy control module through dual redundancy cross transmission is "out of control", the control status of this redundancy control module is set to "in control".

5. The multi-mode engine throttle control redundancy management method according to claim 3, characterized in that, Step two also includes: When the redundancy control module detects a cross-transmission fault status between dual redundancies as "fault" and the redundancy control module has no redundancy fault, the in-control status of the redundancy control module is set to "in-control".

6. The multi-mode engine throttle control redundancy management method according to claim 3, characterized in that, Step two also includes: When the redundancy fault status of this redundancy control module is "fault", the on-control status of this redundancy control module will be set to "out of control".

7. The multi-mode engine throttle control redundancy management method according to claim 3, characterized in that, Step three includes: Step 3.1: Drive module 1 receives the control status of redundancy control module 1 and redundancy control module 2 and performs drive control. When the control status of redundancy control module 1 is "in control", drive module 1 executes the instruction of redundancy control module 1 to perform drive control; otherwise, drive control is not performed. Step 3.2: Drive module 2 performs drive control by receiving the control status of redundancy control module 1 and redundancy control module 2. When the control status of redundancy control module 2 is "in control", drive control is performed by executing the instructions of redundancy control module 2; otherwise, drive control is not performed.

8. The multi-mode engine throttle control redundancy management method according to claim 7, characterized in that, Step four includes: Step 4.1: If any of the following fault states is "fault": bus communication failure between this driver module and the corresponding redundancy control module, fault of the redundancy control module corresponding to this driver module, or software fault of the redundancy control module corresponding to this driver module, set the relevant fault state of this driver module to "fault". Step 4.2: When this driver module receives any of the following fault states as "fault": bus fault between the other driver module and the corresponding redundancy control module, redundancy control module fault corresponding to the other driver module, or software fault state of redundancy control module corresponding to the other driver module, it sets the relevant fault state of the other driver module to "fault". Step 4.3: If the relevant fault status of this driver module is "fault" and the relevant fault status of the other driver module is "fault" and the corresponding interface module communication is fault-free, this driver module sets the direct link working mode to be effective, and this driver module directly uses the instructions sent by the corresponding interface module for drive control; otherwise, this driver module sets the direct link working mode to be invalid.

9. The multi-mode engine throttle control redundancy management method according to claim 8, characterized in that, Step five includes: Step 5.1: If neither redundancy control module 1 nor redundancy control module 2 has a redundancy fault, the system operating mode is working. Step 5.2: If either the redundancy fault status of redundancy control module 1 or redundancy control module 2 is "fault", the system operating mode is one-fault operation. Step 5.3: If the direct chain control mode reported by driver module 1 and driver module 2 is valid, the system working mode is direct chain.

Images