Dual-redundancy rudder system and control method thereof

Abstract

The invention discloses a dual-redundancy rudder system and a control method thereof, and relates to the technical field of rudder system.The dual-redundancy rudder system and the control method thereof achieve redundancy backup of communication, driving and hardware through a dual-redundancy controller and a dual-redundancy steering engine which are in signal connection, and control instructions issued by an upper computer are received, so that redundancy backup of communication, driving and hardware is achieved. The dual-redundancy controller determines which cooperation the communication redundancy channel, the driving redundancy channel and the steering engine brake needs to make when the steering engine executes actions, so that control over the dual-redundancy steering engine is achieved, and even if any module in the dual-redundancy controller and the dual-redundancy steering engine breaks down, the corresponding redundancy channel cannot work, and the dual-redundancy controller and the dual-redundancy steering engine cannot work. And the corresponding redundancy channel in the other redundancy backup can be immediately switched to be used, so that the steering engine can still normally execute the set action, and the safety is greatly improved.

Description

Technical Field

[0001] This application relates to the field of rudder system control technology, specifically to a dual-redundant rudder system and its control method. Background Technology

[0002] A servo system is an automatic control system consisting of a motor, servo controller, multiple sensors, and necessary mechanical support mechanisms. The servo system is the execution structure of the control systems for drones, missiles, and other similar devices. By deflecting the control surfaces, it changes the control torque acting on the servo, thus controlling the servo's flight attitude.

[0003] In recent years, the low safety of single-redundant rudder systems, which are characterized by "everything is normal if everything is normal; but a single failure can paralyze the entire aircraft," has become increasingly difficult to adapt to ever-changing application scenarios. Developing a highly reliable and safe rudder system that "allows failures to occur, but does not allow failures to lead to serious consequences" is urgently needed. Summary of the Invention

[0004] The main objective of this application is to provide a dual-redundant rudder system and its control method, aiming to solve the problem of low safety in the existing single-redundant rudder system.

[0005] To achieve the above objectives, the technical solutions adopted in the embodiments of this application are as follows: In a first aspect, embodiments of this application provide a dual-redundant rudder system, including: A dual-redundancy controller is used to implement dual-redundancy backup for communication and hardware control. Dual-redundant servo motors are used to achieve dual-redundant backup of the drive. The dual-redundant servo is connected to the dual-redundant controller via signal. The dual-redundant controller is used to receive control commands from the host computer and, based on the control commands, determine the drive redundancy channel, communication redundancy channel, and servo brake required for the servo to perform actions, so as to control the dual-redundant servo to perform actions.

[0006] In one possible implementation of the first aspect, each redundancy backup of the dual-redundancy controller includes: The signal connections are sequentially made between the first isolator, CPU, isolation circuit, drive circuit, and MOS switch, and between CPUs with different redundancy backups. The first isolator is used to receive and transmit control commands issued by the host computer. The CPU is used to parse the control commands and generate control signals. The isolation circuit is used to isolate the CPU from other circuits. The drive circuit is used to receive control signals and amplify the power. The MOS switch is used to control the connection and disconnection of the dual-redundant servo motor.

[0007] In one possible implementation of the first aspect, each redundancy backup of the dual-redundancy controller further includes: The signal acquisition circuit and adjustment circuit are connected. The adjustment circuit is connected to the dual-redundant servo motor signal, and the acquisition circuit is connected to the CPU signal. The adjustment circuit is used to convert the physical signals of the dual-redundant servo into digital signals that the CPU can recognize. The acquisition circuit is used to acquire the digital signals and send the acquired data to the CPU for processing.

[0008] In one possible implementation of the first aspect, each redundancy backup of the dual-redundancy controller further includes: The power supply module is used to supply power to the first isolator, isolation circuit, drive circuit, adjustment circuit, and acquisition circuit.

[0009] In one possible implementation of the first aspect, each redundancy backup of the dual-redundancy controller further includes: The control power supply is connected to the power module signal. The power module is a DC-DC power module. The control power supply is used to input primary power to the DC-DC power module. The DC-DC power module is used to convert the primary power into the target power required by each module.

[0010] In one possible implementation of the first aspect, each redundancy backup of the dual-redundancy controller further includes: The drive power supply is connected to the signal of the MOS switch and is used to provide the gate drive voltage for the MOS switch.

[0011] Secondly, embodiments of this application provide a control method for a dual-redundant rudder system, used to control a dual-redundant rudder system as provided in any of the first aspects above, comprising the following steps: The dual-redundant controller receives control commands from the host computer. Based on the control commands, determine the drive redundancy channels, communication redundancy channels, and servo brakes required for the servo motor to execute actions; Based on the drive redundancy channel, communication redundancy channel, and servo brake, control the dual-redundant servo to perform actions.

[0012] In one possible implementation of the second aspect, the drive redundancy channel, communication redundancy channel, and servo brake required for the servo motor to perform actions are determined according to the control command, including: Based on the primary and backup marker command frames in the control commands, determine the communication redundancy channels required for the servo motor to execute actions.

[0013] In one possible implementation of the second aspect, the drive redundancy channel, communication redundancy channel, and servo brake required for the servo motor to perform actions are determined according to the control command, including: If no dual-redundant servo failure is detected, the drive redundancy channel within the same redundancy backup is determined as the channel required for the servo to perform the action, based on the determined communication redundancy channel. In the event of a dual-redundant servo failure, based on the established communication redundancy channel, the drive redundancy channels with different redundancy backups are determined as the channels required for the servo to perform actions.

[0014] In one possible implementation of the second aspect, the drive redundancy channel, communication redundancy channel, and servo brake required for the servo motor to perform actions are determined according to the control command, including: Based on the control command satisfying the brake opening condition, the state of the servo brake required for the servo to perform the action is determined to be open; wherein, the brake opening condition is that any master control command or backup control command in the control command requires the servo brake to be opened. If the control command does not meet the conditions for brake opening, the state of the servo brake required for the servo to perform the action is determined to be closed.

[0015] Compared with the prior art, the beneficial effects of this application are: This application proposes a dual-redundant servo system and its control method. The system achieves redundancy backup in communication, drive, and hardware through a dual-redundant controller and a dual-redundant servo connected by a signal. By receiving control commands from the host computer, it determines which coordination between the communication redundancy channel, drive redundancy channel, and servo brake is required for the servo to perform its actions, thereby achieving control of the dual-redundant servo. Even if any module in the dual-redundant controller or the dual-redundant servo fails, causing the corresponding redundancy channel to malfunction, it can immediately switch to the corresponding redundancy channel in the other redundancy backup to ensure that the servo can still perform the predetermined actions normally, greatly improving safety. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of the dual-redundant rudder system provided in the embodiments of this application; Figure 2 This is a schematic diagram of the electronic device structure of the hardware operating environment involved in the embodiments of this application; Figure 3 A flowchart illustrating the control method for a dual-redundant rudder system provided in an embodiment of this application; The diagram is labeled as follows: 101-Processor, 102-Communication bus, 103-Network interface, 104-User interface, 105-Memory. Detailed Implementation

[0017] It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit this application. Those skilled in the art should understand that the division of the various functional modules in the embodiments is merely a logical functional division. In actual applications, all or part of these modules can be integrated onto one or more actual carriers, and these modules can be implemented entirely in software through processing unit calls, entirely in hardware, or in a combination of software and hardware.

[0018] See attached document Figure 1 Embodiments of this application provide a dual-redundant rudder system, comprising: A dual-redundancy controller is used to implement dual-redundancy backup for communication and hardware control. Dual-redundant servo motors are used to achieve dual-redundant backup of the drive. The dual-redundant servo is connected to the dual-redundant controller via signal. The dual-redundant controller is used to receive control commands from the host computer and, based on the control commands, determine the drive redundancy channel, communication redundancy channel, and servo brake required for the servo to perform actions, so as to control the dual-redundant servo to perform actions.

[0019] In this embodiment, a dual-redundant controller and a dual-redundant servo motor connected by a signal achieve redundancy backup in three aspects: communication, drive, and hardware. By receiving control commands from the host computer, it determines which coordination between the communication redundancy channel, drive redundancy channel, and servo motor brake is required for the servo motor to perform its actions, thereby achieving control of the dual-redundant servo motor. Even if any module in the dual-redundant controller or the dual-redundant servo motor fails, causing the corresponding redundancy channel to become inoperable, it can immediately switch to the corresponding redundancy channel in the other redundancy backup to ensure that the servo motor can still perform the predetermined actions normally, greatly improving safety.

[0020] In one embodiment, each redundancy backup of the dual-redundancy controller includes: The signal connections are sequentially made between the first isolator, CPU, isolation circuit, drive circuit, and MOS switch, with signal connections between CPUs with different redundancy backups.

[0021] In practice, dual redundancy is equivalent to setting up two identical systems: one as the primary system and the other as a backup system, as shown in the attached diagram. Figure 1 As shown, in this embodiment of the application, the upper part of the modules is described as one system and the lower part of the modules as another system. The CPU is marked as the main CPU and the backup CPU. The modules in the redundancy of the main CPU are marked with the suffix "0" and the modules in the redundancy of the backup CPU are marked with the suffix "1" for easy distinction in description.

[0022] The first isolator is used to receive and transmit control commands issued by the host computer. For example, an RS422 isolator can be used to realize RS422 communication. While maintaining data communication, it protects the equipment from damage caused by ground potential difference, common-mode noise and transient high voltage, realizes interface conversion and driving, and enhances communication reliability.

[0023] The CPU, or Central Processing Unit, is used to parse control instructions and generate control signals. Through its internal components such as controllers, arithmetic logic units (ALUs), and registers, it repeatedly fetches instructions from memory, parses instructions, performs calculations, and writes the results back at extremely high speed, thereby driving the entire system to complete the specified tasks.

[0024] The isolation circuit isolates the CPU from other circuits, eliminates ground potential differences and ground loop interference, establishes a safe electrical distance, and prevents interference with signals transmitted from the CPU. The drive circuit receives control signals and amplifies them. The signals from the CPU are weak, so the amplification provides sufficient current and voltage to control the system load, ensuring the servo motor functions normally.

[0025] MOS switches are used to control the connection and disconnection of dual-redundant servos. MOS switches are voltage-controlled electronic switches, which essentially use a small voltage signal to control the on / off state of a large current circuit. The CPU controls the servo by controlling the switching frequency of the MOS switches.

[0026] Signal connections between the two CPUs can be established directly via wires, as shown in the attached diagram. Figure 1 As shown, the main CPU and the backup CPU are directly connected. In actual use, both CPUs are set in a control box, which is very close to each other and has very little signal interference, so they can be directly connected.

[0027] In one embodiment, each redundancy backup of the dual-redundancy controller further includes: The signal acquisition circuit and adjustment circuit are connected. The adjustment circuit is connected to the dual-redundant servo motor signal, and the acquisition circuit is connected to the CPU signal. In the specific implementation process, the adjustment circuit is used to convert the physical signals of the dual-redundant servo into digital signals that the CPU can recognize. The analog signals such as position signals and current signals required by the servo system can be collected by the sensors set on the dual-redundant servo. However, considering the issue of whether they can be recognized, the adjustment circuit needs to adjust, correct or stabilize these signals within a certain range to facilitate CPU processing. Then, the acquisition circuit collects these recognizable digital signals and converts the analog physical signals into digital electrical signals that the CPU can understand and process. That is, the acquisition circuit is used to collect digital signals and send the collected data to the CPU for processing.

[0028] In one embodiment, each redundancy backup of the dual-redundancy controller further includes: The power supply module is used to supply power to the first isolator, isolation circuit, drive circuit, adjustment circuit, and acquisition circuit.

[0029] In practical implementation, the power supply module is an indispensable part, providing stable power support for various functional modules. However, the power requirements of different modules are usually different. Therefore, the power supply module can be set as a DC-DC power supply module. That is, the control power supply connected to the power supply module signal is a DC-DC power supply module. The control power supply is used to input primary power to the DC-DC power supply module, and the DC-DC power supply module is used to convert the primary power into the target power required by each module.

[0030] In practical implementation, the control power supply is the primary power supply of the aircraft or equipment, such as 28V DC. A DC-DC power module performs voltage conversion and isolation, transforming the primary power supply into stable, clean low-voltage DC power (such as ±15V, 5V, 3.3V, etc.) required by various modules (such as the CPU, acquisition circuit, and drive circuit). Two independent control power supplies input to power modules with different redundancies, supplying power to two separate channels, achieving power redundancy and preventing system failure due to a single point of power supply failure.

[0031] In one embodiment, each redundancy backup of the dual-redundancy controller further includes: The drive power supply connected to the MOS switch signal.

[0032] In practical implementation, the driving power supply can be understood as a special power supply specifically designed to serve the gate of a MOSFET, providing a gate drive voltage sufficient for the MOSFET to quickly and completely turn on and off. The gate of a MOSFET contains parasitic capacitance. Switching a MOSFET is essentially a process of rapidly charging and discharging this capacitance. Turning on involves rapidly charging the gate capacitance, causing the voltage difference to rise from 0V to the turn-on threshold; turning off involves rapidly discharging the gate capacitance, causing the voltage difference to drop from the turn-on threshold back to 0V. A driving power supply with sufficient voltage margin and low impedance characteristics can stabilize the gate voltage, making it less susceptible to noise interference, thereby improving the system's anti-interference capability and reliability.

[0033] See attached document Figure 2 , attached Figure 2This is a schematic diagram of the electronic device structure of the hardware operating environment involved in the embodiments of this application. The electronic device may include: a processor 101, such as a central processing unit (CPU), a communication bus 102, a user interface 104, a network interface 103, and a memory 105. The communication bus 102 is used to realize the connection and communication between these components. The user interface 104 may include a display screen and an input unit such as a keyboard. Optionally, the user interface 104 may also include a standard wired interface and a wireless interface. The network interface 103 may optionally include a standard wired interface and a wireless interface (such as a Wi-Fi interface). The memory 105 may be a storage device independent of the aforementioned processor 101. The memory 105 may be a high-speed random access memory (RAM) or a stable non-volatile memory (NVM), such as at least one disk storage device. The processor 101 may be a general-purpose processor, including a central processing unit, a network processor, etc., or it may be a digital signal processor, an application-specific integrated circuit, a field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component.

[0034] Those skilled in the art will understand that the appendix Figure 2 The structure shown does not constitute a limitation on the electronic device and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0035] As attached Figure 2 As shown, the memory 105, which serves as a storage medium, may include an operating system, a network communication module, a user interface module, and a dual-redundant rudder system.

[0036] In the appendix Figure 2 In the electronic device shown, the network interface 103 is mainly used for data communication with the network server; the user interface 104 is mainly used for data interaction with the user; the processor 101 and the memory 105 in this application can be set in the electronic device. The electronic device calls the dual-redundant rudder system stored in the memory 105 through the processor 101 and executes the control method of the dual-redundant rudder system provided in the embodiment of this application.

[0037] Based on the hardware device described in the foregoing embodiments and the same inventive concept as in the foregoing embodiments, embodiments of this application also provide a control method for a dual-redundant rudder system, as shown in the appendix. Figure 3 As shown, controlling the dual-redundant rudder system provided in this application embodiment includes the following steps: S10: Dual-redundant controller receives control commands from the host computer; S20: Based on the control command, determine the drive redundancy channel, communication redundancy channel, and servo brake required for the servo to perform the action; S30: Controls the dual-redundant servo motor to perform actions based on the drive redundancy channel, communication redundancy channel, and servo brake.

[0038] The working principle and beneficial effects of the embodiments of this application can be found in the foregoing description of the dual-redundant rudder system. The method steps of this embodiment are actually a functional description of the dual-redundant rudder system based on signal flow. In general, the switching of the communication redundancy channel is determined by the command of the input rudder system, the switching of the rudder brake is determined by the command of the input rudder system, the switching of the drive redundancy channel is jointly determined by the communication redundancy determination result and the rudder fault status, and the operating status of the rudder brake is jointly determined by the brake switching command and the detected brake current value.

[0039] The operation of the servo system is determined by servo commands and feedback, servo fault status, brake status, and system drive status. If the servo system has received a brake release command from the flight controller, the servo is fault-free, the brake release time exceeds the manufacturer-specified brake engagement time, the servo system drive module power supply has reached a stable state, and there is a deviation between the servo feedback displacement and the control displacement sent by the flight controller, then the servo drive will output power to achieve dual-redundant servo motion control and complete the target mission.

[0040] In one embodiment, determining the drive redundancy channel, communication redundancy channel, and servo brake required for the servo motor to perform an action according to control commands includes: Based on the primary and backup marker command frames in the control commands, determine the communication redundancy channels required for the servo motor to execute actions.

[0041] In practice, the host computer sends instruction frames with primary and backup markers through different communication channels of the dual-redundant controller to switch communication redundancy channels. For example, if the flight control system sends the primary control command through the first communication channel and the backup control command through the second communication channel, the servo system determines that the hardware control module is in charge, and the servos are driven by the first drive module. Conversely, if the flight control system sends the primary control command through the second communication channel and the backup control command through the first communication channel, the servo system determines that the hardware control module is in charge, and the servos are driven by the second drive module.

[0042] In one embodiment, determining the drive redundancy channel, communication redundancy channel, and servo brake required for the servo motor to perform an action according to control commands includes: If no dual-redundant servo failure is detected, the drive redundancy channel within the same redundancy backup is determined as the channel required for the servo to perform the action, based on the determined communication redundancy channel. In the event of a dual-redundant servo failure, based on the established communication redundancy channel, the drive redundancy channels with different redundancy backups are determined as the channels required for the servo to perform actions.

[0043] In practice, if no servo malfunction is detected, the servo will be driven by the first drive module when the first communication channel receives the master control command, and the servo will be driven by the second drive module when the second communication channel receives the master control command. If a servo malfunction is detected in a drive module, the servo system will decide to have the other drive module continue to drive the servo without switching communication.

[0044] In one embodiment, determining the drive redundancy channel, communication redundancy channel, and servo brake required for the servo motor to perform an action according to control commands includes: Based on the control command satisfying the brake opening condition, the state of the servo brake required for the servo to perform the action is determined to be open; wherein, the brake opening condition is that any master control command or backup control command in the control command requires the servo brake to be opened. If the control command does not meet the conditions for brake opening, the state of the servo brake required for the servo to perform the action is determined to be closed.

[0045] In practice, the rudder system, based on the brake switch signals in the master control commands and backup control commands issued by the flight control system through the communication channel, comprehensively judges and opens or closes the brake via inter-board communication. Specifically, if either the master or backup control command requests the brake to be opened, the brake is opened; otherwise, the brake is closed. The brake's operating status information is fed back to the flight controller via the communication channel. This brake operating status information is determined by combining the current value monitored by the brake current sensor in the controller module with the braking commands issued by the flight controller. Specifically, if the brake current is detected to be below a certain threshold and the flight control braking command requests closure, the brake is reported as closed; otherwise, the brake is reported as open.

[0046] It should be noted that each step in the control method of the dual-redundant rudder system in this embodiment corresponds one-to-one with each functional module in the dual-redundant rudder system in the previous embodiment. Therefore, the specific implementation method of this embodiment can refer to the previous implementation method, and will not be repeated here.

[0047] Based on the same inventive concept as in the foregoing embodiments, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when loaded and executed by a processor, implements the control method of the dual-redundant rudder system provided in the embodiments of this application.

[0048] Based on the same inventive concept as in the foregoing embodiments, embodiments of this application also provide an electronic device, including a processor and a memory, wherein, Memory is used to store computer programs; The processor is used to load and execute computer programs to enable electronic devices to perform control methods for dual-redundant rudder systems as provided in the embodiments of this application.

[0049] In some embodiments, the computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, flash memory, magnetic surface memory, optical disk, or CD-ROM; or it may be a device including one or any combination of the above-mentioned memories. The computer may be a variety of computing devices, including smart terminals and servers.

[0050] In some embodiments, executable instructions may take the form of a program, software, software module, script, or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a standalone program or as a module, component, subroutine, or other unit suitable for use in a computing environment.

[0051] As an example, executable instructions may, but do not necessarily, correspond to files in the file system. They may be stored as part of a file that holds other programs or data, for example, in one or more scripts in a Hyper Text Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple collaborative files (e.g., a file that stores one or more modules, subroutines, or code sections).

[0052] As an example, executable instructions can be deployed to execute on a single computing device, or on multiple computing devices located in one location, or on multiple computing devices distributed across multiple locations and interconnected via a communication network.

[0053] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0054] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0055] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as read-only memory / random access memory, magnetic disk, optical disk) and includes several instructions to cause a multimedia terminal device (which may be a mobile phone, computer, television receiver, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0056] In summary, the dual-redundant servo system and its control method provided in this application embodiment achieve redundancy backup in three aspects: communication, drive, and hardware through a dual-redundant controller and a dual-redundant servo connected by a signal. By receiving control commands from the host computer, the system determines which coordination between the communication redundancy channel, the drive redundancy channel, and the servo brake is required for the servo to perform its actions, thereby achieving control of the dual-redundant servo. Even if any module in the dual-redundant controller or the dual-redundant servo fails, causing the corresponding redundancy channel to malfunction, it can immediately switch to the corresponding redundancy channel in the other redundancy backup to ensure that the servo can still perform the predetermined actions normally, greatly improving safety.

[0057] The above description is only a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A dual-redundant rudder system, characterized in that, include: A dual-redundancy controller is used to implement dual-redundancy backup for communication and hardware control. Dual-redundant servo motors are used to achieve dual-redundant backup of the drive. The dual-redundant servo is signal-connected to the dual-redundant controller. The dual-redundant controller is used to receive control commands issued by the host computer and, based on the control commands, determine the drive redundancy channel, communication redundancy channel, and servo brake required for the servo to perform actions, so as to control the dual-redundant servo to perform actions.

2. The dual-redundant rudder system according to claim 1, characterized in that, Each redundancy backup of the dual-redundancy controller includes: The signal connections are sequentially made between the first isolator, CPU, isolation circuit, drive circuit, and MOS switch, and between CPUs with different redundancy backups. The first isolator is used to receive and transmit the control command issued by the host computer, the CPU is used to parse the control command and generate a control signal, the isolation circuit is used to isolate the CPU from other circuits, the drive circuit is used to receive the control signal and amplify the power, and the MOS switch is used to control the connection and disconnection of the dual-redundant servo motor.

3. The dual-redundant rudder system according to claim 2, characterized in that, Each redundancy backup of the dual-redundancy controller also includes: The signal acquisition circuit and adjustment circuit are connected, wherein the adjustment circuit is connected to the dual-redundant servo signal, and the acquisition circuit is connected to the CPU signal; The adjustment circuit is used to convert the physical signal of the dual-redundant servo into a digital signal that the CPU can recognize, and the acquisition circuit is used to acquire the digital signal and send the acquired data to the CPU for processing.

4. The dual-redundant rudder system according to claim 3, characterized in that, Each redundancy backup of the dual-redundancy controller also includes: The power supply module is used to supply power to the first isolator, the isolation circuit, the drive circuit, the adjustment circuit, and the acquisition circuit.

5. The dual-redundant rudder system according to claim 4, characterized in that, Each redundancy backup of the dual-redundancy controller also includes: A control power supply is connected to the power module via a signal. The power module is a DC-DC power module. The control power supply is used to input primary power to the DC-DC power module. The DC-DC power module is used to convert the primary power into the target power required by each module.

6. The dual-redundant rudder system according to claim 2, characterized in that, Each redundancy backup of the dual-redundancy controller also includes: A drive power supply connected to the signal of the MOS switch, the drive power supply being used to provide the gate drive voltage for the MOS switch.

7. A control method for a dual-redundant rudder system, characterized in that, A method for controlling a dual-redundant rudder system as described in any one of claims 1-6 includes the following steps: The dual-redundant controller receives control commands from the host computer. Based on the control command, determine the drive redundancy channel, communication redundancy channel, and servo brake required for the servo motor to execute the action; Based on the drive redundancy channel, the communication redundancy channel, and the servo brake, the dual-redundancy servo is controlled to perform actions.

8. The control method for the dual-redundant rudder system according to claim 7, characterized in that, The step of determining the drive redundancy channel, communication redundancy channel, and servo brake required for the servo motor to execute actions according to the control command includes: Based on the primary marker instruction frame and the backup marker instruction frame in the control command, determine the communication redundancy channel required for the servo motor to perform the action.

9. The control method for the dual-redundant rudder system according to claim 8, characterized in that, The step of determining the drive redundancy channel, communication redundancy channel, and servo brake required for the servo motor to execute actions according to the control command includes: If no fault of the dual-redundant servo is detected, the drive redundancy channel within the same redundancy backup is determined as the channel required for the servo to perform the action, based on the determined communication redundancy channel. If a fault is detected in the dual-redundant servo motor, the drive redundancy channels with different redundancy backups are determined as the channels required for the servo motor to perform actions, based on the determined communication redundancy channels.

10. The control method for the dual-redundant rudder system according to claim 7, characterized in that, The step of determining the drive redundancy channel, communication redundancy channel, and servo brake required for the servo motor to execute actions according to the control command includes: Based on the control command satisfying the brake opening condition, the state of the servo brake required for the servo motor to perform the action is determined to be open; wherein, the brake opening condition is that any master control command or backup control command in the control command requires the servo brake to be opened; If the control command does not meet the brake opening conditions, the state of the servo brake required for the servo motor to perform the action is determined to be closed.

Images