Launch vehicle engine redundant valve motor assembly control system and method

Abstract

The present application relates to the technical field of space launch vehicle, and discloses a kind of launch vehicle engine redundancy valve motor assembly control system and method, by setting three redundancy control module, distributed main control decision unit and centralized arbitration module, so that the system can still maintain valve control ability when any control channel fails, in the special scene that traditional mode is intermittently interrupted and recovered between link, and high priority channel repeatedly recovers and applies output, prone to mis-switching, in arbitration link, increase shadow following, cross-cycle trajectory correlation determination, phase connection determination, enable state change and state code second-order differential oscillation penalty, recursive takeover accumulation, adaptive takeover threshold, zero vector interval or dead zone boundary alignment switching, takeover verification and failure rollback and other processing actions, can effectively solve the problem of main control jitter and output contention, so as to improve the stability and engineering availability of the system under complex abnormal recovery conditions.

Description

Technical Field

[0001] This invention relates to the field of aerospace launch vehicle technology, and in particular to a control system and method for redundant valve motor assembly of launch vehicle engine. Background Technology

[0002] With the continuous development of the commercial space industry, low cost, large payload capacity, and reusability have become important development directions for the next generation of launch vehicles. In liquid-fueled launch vehicles, the opening regulation of engine fuel main valves, oxidizer valves, or other propellant flow control valves typically relies on highly reliable electric servo control systems. Precise control of valve openings achieves propellant flow control, ensuring that the thrust output of the engine meets mission requirements during different operational phases, including start-up, steady-state operation, throttling, and shutdown. Therefore, engine valve motor assemblies and their control and drive devices have become one of the key single-unit products in the launch vehicle propulsion control system.

[0003] Currently, in the propulsion systems of commercial launch vehicles in China, engine valves are generally driven and controlled by electric servo mechanisms. These systems typically consist of a servo motor, valve actuator, position feedback unit, power drive module, and controller. For a configuration where multiple engines operate in parallel on a first-stage launch vehicle, each engine requires a corresponding valve assembly and servo control link to quickly, stably, and precisely adjust the valve opening according to commands issued by the flight control system. During engine operation, the controller needs to adjust the motor torque and speed in real time based on mission instructions from the onboard computer, integrating feedback signals such as motor angle, valve output shaft angle, current, and voltage, thereby driving the valve to perform opening and closing actions and achieving accurate propellant flow control.

[0004] However, in traditional designs, engine valve servo systems mostly employ a single-channel control architecture, where each valve corresponds to an independent controller and drive module. While this structure is relatively simple to implement, it often lacks a direct backup channel when critical components such as the power drive module, control circuit, position feedback link, or communication interface fail. This can easily lead to loss of valve control capability, further affecting engine propellant flow regulation, and in severe cases, even causing engine malfunction and mission failure. Therefore, the single-channel control architecture presents a significant single point of failure risk in high-reliability launch vehicle mission scenarios.

[0005] With the development of reusable launch vehicles and multi-engine parallel propulsion systems, higher demands are placed on the reliability, fault tolerance, and online fault recovery capabilities of engine valve servo systems. To improve system reliability, redundancy control technology has gained increasing attention in recent years. By introducing hardware or functional redundancy in the control, communication, and output links, a backup channel can take over control when one control channel fails, thus avoiding valve control failure due to a single point of failure. However, existing redundancy schemes still have shortcomings in the engineering implementation of engine valve motor components, especially in the low-cost, high-reliability application scenarios of commercial aerospace, where there are few publicly available reports on the engineering implementation of fully redundant servo systems. Furthermore, during engineering analysis and experimental evaluation, the applicant discovered that even with multi-channel redundancy capabilities, problems that traditional arbitration methods cannot effectively handle may still occur under certain special operating conditions. More specifically, when the LVDS interconnection link between control modules experiences intermittent interruptions and recoveries, or when a high-priority control module experiences repeated fluctuations of recovery, instability, and re-recovery while a lower-priority control module has already achieved stable output, the traditional arbitration method, which relies solely on fixed priorities and simple switching protection times, is prone to misjudging instantaneous recovery as stable recovery. This can lead to problems such as main control jitter, output contention, and discontinuous PWM switching, resulting in torque fluctuations, sudden changes in valve position response, or even malfunctions in the valve motor assembly.

[0006] In other words, while traditional methods can meet basic switching requirements under normal stable operating conditions, they lack sufficiently granular data processing to identify the difference between short-term false recovery and true takeover capability recovery in the aforementioned special recovery scenarios. Therefore, improving the stability of redundant channel takeover has become an urgent technical problem to be solved in the design of launch vehicle engine valve servo systems. Summary of the Invention

[0007] This invention provides a control system and method for redundant valve motor components in a launch vehicle engine, which at least solves the problems of high single-point failure risk in the engine valve servo system in the prior art, as well as the easy occurrence of main control jitter, output contention and discontinuous PWM switching in scenarios where the link between control modules is intermittently abnormal and recovers.

[0008] To achieve the above objectives, a first aspect of the present invention provides a redundant valve motor assembly control system for a launch vehicle engine, the system comprising: The triple redundant control module group includes a first control module, a second control module, and a third control module that communicate with each other. They are connected to the onboard communication interface, the signal acquisition module, and the arbitration module, respectively. They are used to perform parallel execution of control command consistency processing, health status determination, shadow following status update, and position loop, velocity loop, and current loop operations, and generate enable signals, PWM control signals, telemetry data, and arbitration status data corresponding to the channels, respectively. The onboard communication interface is configured to send valve control commands and heartbeat information to the first control module, the second control module and the third control module, and to receive telemetry data selected by the arbitration module and output it to the onboard computer. The signal acquisition module is configured to connect with the valve motor assembly group, the drive module group and the triple redundant control module group. It is used to synchronously acquire the motor rotor angle signal, valve output shaft angle signal, phase current signal and bus voltage signal corresponding to each valve motor assembly, and send the acquisition results within the same sampling period to each control module. The arbitration module is configured to connect to the triple redundant control module group, the drive module group, and the onboard communication interface. It receives the enable signals, PWM control signals, telemetry data, and arbitration status data output by each control module. Based on the arbitration status data, it performs mutual exclusion gating, conflict suppression, and phased takeover switching control on the output of each control module, so that at any given time only the PWM control signal of the on-duty control module is sent to the drive module group, and the telemetry data of the on-duty control module is output through the onboard communication interface. The drive module group is used to drive the corresponding valve motor assembly to operate according to the PWM control signal selected by the arbitration module, so as to adjust the valve opening of the launch vehicle engine.

[0009] A second aspect of the present invention provides a control method for a redundant valve motor assembly of a launch vehicle engine, applied to the control system of the redundant valve motor assembly of a launch vehicle engine as described in any of the preceding claims, comprising the following steps: S1: After the system is powered on, the first control module, the second control module and the third control module are started in parallel. The onboard communication interface sends valve control commands and heartbeat information to each control module. At the same time, the signal acquisition module collects the angle, current and voltage feedback information of each valve motor component. S2: Each control module performs control command consistency processing, shadow following status update, and position loop, speed loop, and current loop operations according to the received valve control command and the feedback information, generating the corresponding enable signal, PWM control signal, telemetry data, and arbitration status data for this channel; S3: Each control module determines the current on-duty control module or candidate takeover control module based on the status interaction results between modules and the health status of this channel, and sends the enable signal, PWM control signal, telemetry data and arbitration status data generated by each module to the arbitration module; S4: The arbitration module performs mutual exclusion selection, conflict suppression and phased takeover switching control based on the information of the on-duty control module, the output status of each channel and the arbitration status data of each channel, outputs a unique and valid PWM control signal to the drive module group, and outputs the telemetry data corresponding to the on-duty control module through the rocket communication interface. S5: The signal acquisition module collects the operational feedback of the valve motor assembly and returns it to each control module to form feedback control. When an abnormal channel is detected, it completes fault isolation, takeover verification, re-judgment, and safety control.

[0010] The beneficial effects of this invention are as follows: By setting up a triple-redundant control module, a distributed master control decision unit, and a centralized arbitration module, the system can maintain valve control capability even when any control channel fails, significantly improving the reliability and fault tolerance of the launch vehicle engine valve servo system. Addressing the problem of erroneous switching in traditional methods under special scenarios of intermittent link interruptions and recovery, and repeated output requests from high-priority channels, the arbitration process incorporates shadow following, cross-cycle trajectory correlation determination, phase connection determination, enable state change and second-order differential oscillation penalty for status codes, recursive takeover accumulation, adaptive takeover threshold, zero vector interval or dead zone boundary alignment switching, post-takeover verification, and failure rollback. This avoids the master control jitter and output contention problems that traditional fixed-priority plus simple delay protection methods cannot effectively solve, thereby improving the system's stability and engineering availability under complex abnormal recovery conditions. Attached Figure Description

[0011] Figure 1 This is a schematic diagram of the structure of the redundant valve motor assembly control system for a launch vehicle engine proposed in an embodiment of the present invention; Figure 2 This is a diagram of the redundancy architecture of the control components in the redundant valve motor assembly control system of the launch vehicle engine proposed in this embodiment of the invention; Figure 3 This is a flowchart illustrating the control method for redundant valve motor assembly of a launch vehicle engine proposed in an embodiment of the present invention.

[0012] Explanation of reference numerals in the attached figures: 1-Valve control actuator; 2-Signal acquisition module; 3-Arbitration module; 4~6-Control module; 7-Power supply module; 8~12-Motor drive module; 13~17-Valve motor assembly; 18-Onboard computer; 19-Main control decision unit; 20-Control processing unit; 21-Sampling processing unit; 22-Communication processing unit. Detailed Implementation

[0013] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0014] like Figure 1 As shown, this invention provides a triple-redundant valve motor assembly servo system. In one specific executable implementation, the system mainly includes one valve control driver 1 and five valve motor assemblies 13-17. The valve control driver 1 integrates a signal acquisition module 2, an arbitration module 3, triple-redundant control modules 4-6, a power supply module 7, and five motor drive modules 8-12. Each motor drive module 8-12 corresponds to one valve motor assembly 13-17 and is used to control the opening and closing of the corresponding engine fuel inlet valve or other propellant regulating valve. This configuration aims to enable one valve control driver 1 to simultaneously control multiple valves corresponding to multiple engines, thereby adapting to the application requirements of multi-engine parallel propulsion systems.

[0015] In this embodiment of the invention, the power supply module 7, control modules 4-6, signal acquisition module 2, and motor drive modules 8-12 can be interconnected via inter-board multi-core connectors, board-to-board high-speed connectors, or equivalent electrical connections. The onboard computer 18 sends shared control commands and heartbeat information to the three control modules 4-6 via three independent communication links. Each control module's communication processing unit 22, in addition to receiving the original control commands for its own channel, also exchanges the current cycle's command value and / or command summary, timestamp, frame number, validity flag, and verification result with the other two control modules via LVDS links. Based on the original control commands for its own channel and the command verification information returned from the other two channels, each control module completes control command consistency processing within its own module and forms the target valve position command for the current cycle. The purpose is to clarify that the implementation of control command consistency processing is primarily the communication processing unit within each control module and its collaborative interaction process, rather than being temporarily aggregated by undefined external units. It should be noted that the so-called parallel deployment of control calculations here does not mean that the three control modules output control results simultaneously. Rather, it means that the three control modules maintain synchronized task progress and synchronized status updates internally, with only the currently active control module outputting the actual drive signal, while the other two control modules maintain a shadow following state to prepare for possible subsequent fault takeover.

[0016] Furthermore, in a specific executable implementation, the motor rotary transformers in the five valve motor assemblies 13-17 output the motor rotor angle signal in real time, and the output shaft rotary transformer outputs the valve output shaft angle signal in real time. The three-phase current of the dual-winding or multi-phase winding of the servo motor is acquired through Hall current sensors, shunt sampling devices, or other equivalent current acquisition devices in the drive module. After acquiring and preprocessing the above-mentioned multiple angle, current, and voltage signals, the signal acquisition module 2 simultaneously sends the sampling results within the same sampling period to the three control modules 4-6. Through this processing method, the three control modules 4-6 use consistent sampling input within the same control period, which helps to reduce the main control decision deviation and switching error caused by inconsistent input data timing.

[0017] In this embodiment of the invention, control modules 4-6 can perform target valve position following, position loop, speed loop, and current loop control operations based on the collected data, generating the corresponding PWM control signal for this channel. In a preferred implementation, the PWM control signal can be an SVPWM wave control signal, which is selected by arbitration module 3 and then sent to the corresponding motor drive modules 8-12. The motor drive modules then output multi-phase high-voltage drive voltage to drive the five valve motor assemblies 13-17 to open and close, thereby changing the engine valve opening and realizing the propellant flow control of the launch vehicle. Throughout the process, the energy flow and signal flow run along multiple redundant paths in the entire power supply, sampling, control, and execution chain, enabling the system to maintain high reliability and control continuity even in the event of a single point of failure or even a local link anomaly.

[0018] It should also be noted that in traditional triple-redundancy systems, more attention is often paid to which is the current master controller, while the description of how to maintain immediate takeover for non-output channels is relatively insufficient. The implementation of this invention takes this into account at the system architecture level. That is, the off-duty control module is not simply shut down, but continuously updates the shadow following state cache without external output. This cache can include at least the target valve position, angle estimate, speed estimate, current loop intermediate value, PWM phase interval, zero vector interval boundary, and telemetry snapshots. Thus, when takeover is needed later, the candidate channel does not resume control from zero, but can call upon the continuously updated internal state, achieving a smoother takeover transition.

[0019] It should also be noted that, in addition to outputting enable signals, PWM control signals, and telemetry data to the arbitration module, each control module also sends arbitration status data to the arbitration module according to the arbitration cycle. The arbitration status data can include two parts: the first part consists of control-related status variables, including the target valve position, angle increment, velocity change, current change, PWM phase interval, zero vector interval start and end boundaries or preset dead zone boundaries, telemetry snapshots, etc., for the current control cycle; the second part consists of channel status variables, including enable status, status code, LVDS heartbeat continuity flag, onboard heartbeat continuity flag, health status flag, output qualification flag, and shadow following status buffer integrity flag, etc. The arbitration module buffers the arbitration status data received over multiple consecutive arbitration cycles, thereby forming various sequence data required for subsequent trajectory consistency, phase alignment, oscillation penalty, recursive takeover accumulation, adaptive takeover threshold, and post-takeover verification.

[0020] like Figure 2As shown, the valve motor assembly control driver is a control system based on a triple-redundancy architecture. Its core consists of three electrically and functionally independent control modules I to III. The hardware of each control module can be implemented using devices such as FPGAs, or a combination of programmable logic devices and peripheral interface circuits. Each control module is fully equipped with a main control decision unit 19, a control processing unit 20, a sampling processing unit 21, and a communication processing unit 22, thus forming a highly symmetrical modular redundancy architecture.

[0021] Specifically, the communication processing unit 22 may include a 1553B bus protocol chip, an RS422 communication interface circuit, LVDS interface logic, or a data transceiver module with equivalent functionality. It is used to receive control commands, transmit telemetry data, and exchange heartbeat information with the onboard computer, and to exchange command verification information and status information with other control modules. In this embodiment, the communication processing unit 22 first extracts the command value and / or command summary, timestamp, frame sequence number, and validity flag from the original control commands received through this channel. Then, it combines this with the corresponding information returned by the other two control modules via LVDS to perform timestamp verification, frame sequence consistency checks, abnormal command masking, and valid command retention to form the target valve position command. In other words, even if the original commands received by the three control modules have frame sequence delays, communication glitches, or incomplete content in individual cycles, a relatively stable and consistent target valve position command can be formed through the collaborative verification process of the communication processing unit 22 within each control module, laying the foundation for subsequent control.

[0022] The sampling processing unit 21 may include an ADC sampling circuit, an RDC decoding circuit, and signal conditioning and conversion circuits with equivalent functions, used to acquire, decode, and time-align multi-source feedback quantities such as motor voltage, current, rotor angle, and output shaft angle. Furthermore, in one executable implementation, the sampling processing unit 21 not only reads the original signal but also performs zero-drift correction, proportional compensation, validity screening, and cross-channel timing alignment on the sampled values. This reduces the risk of misjudgment due to sampling link noise, component drift, or channel delay differences, especially during the master control switching and takeover verification stages, providing a more reliable data foundation for subsequent judgments.

[0023] The control processing unit 20 is used to perform control calculations for the position loop, speed loop, and current loop. Specifically, the target valve position command generated by the communication processing unit, along with feedback information such as angle, current, and voltage output by the sampling processing unit, are input into the control processing unit 20, which calculates the corresponding current loop target, modulation amount, and PWM control signal. In this embodiment of the invention, the control processing unit 20 is also used to continue internal control calculations when the current channel is not the on-duty control module, ensuring that the current channel continuously updates intermediate state quantities synchronized with the task progress. It should be understood that this state maintenance does not generate external drive output, and therefore will not create output competition with the on-duty control module, but it provides sufficient control context preparation for subsequent takeover.

[0024] The master control decision unit 19 is used to make real-time determinations on whether the channel is qualified to output based on the inter-module heartbeat, onboard heartbeat, sampled health status, and the integrity of the shadow following status buffer. It should be noted that simply relying on communication connectivity is insufficient to determine whether a control module is suitable for takeover, because even if communication is restored, if its internal control status has not kept up with the current task progress, or if there is a sudden anomaly in its sampling link, it may lead to discontinuous output after the switchover. Therefore, in this embodiment of the invention, the master control decision does not only consider a single health quantity, but rather integrates multi-source status information to form a more reliable health status indicator.

[0025] Furthermore, after forming the health status flag for this channel, the master control decision unit 19 can also send the LVDS heartbeat continuity flag, the arrow-borne heartbeat continuity flag, the health status flag, the output qualification flag, and the shadow follower status buffer integrity flag to the arbitration module as part of the arbitration status data. In this way, when performing a physical switchover decision, the arbitration module can simultaneously read the communication continuity and health information related to takeover qualification, in addition to reading the control-related status quantities of the candidate channel and the currently active channel.

[0026] In one executable implementation, a health status value can be generated for each control module in each control cycle, and its expression is as follows: ; in, Indicates the first The control module is in the first Health status values ​​within a control cycle; This represents the continuity of LVDS heartbeat communication between this control module and other control modules; This represents the continuity of the 1553B heartbeat communication between the control module and the onboard computer 18. This represents the validity of the sampled data and shadow following state cache of the control module; This represents the amount of penalty for anomalies, used to reflect abnormal situations such as severe sampling out-of-bounds errors, logical conflicts, continuous frame drops, or instability after recovery. , , and The weighting coefficients are used to balance the influence of various status information in the health status determination. It should be noted that the above expression is merely one easily understood and implemented method for forming a health status in this invention. In actual engineering, it can also be implemented using logical combination, hierarchical threshold comparison, or equivalent scoring methods, as long as it can achieve the comprehensive health status determination objective described in this invention.

[0027] When a certain control module If the preset health conditions are met, the channel can be identified as a healthy channel; otherwise, it is identified as an abnormal channel or a restricted channel. Based on this, and combined with preset priority relationships, a preliminary selection result for the on-duty control module can be formed.

[0028] In a triple-redundant control system, each control module is equipped with a distributed master control decision unit. This unit determines in real time whether the current control module is the system's on-duty control module and triggers a reselection of the on-duty control module when an anomaly is detected. Furthermore, in a preferred embodiment, each master control decision unit can input two channels of LVDS heartbeat information, one channel of 1553B heartbeat information, and sampled health status, shadow following status integrity, and communication status information related to this module. It outputs the master control status flag, enable qualification information, and status data for reference by other modules.

[0029] Specifically, the main control decision unit comprehensively judges the status of the control modules based on the following types of information. The first type is LVDS heartbeat information between control modules. The three control modules periodically exchange heartbeat messages through the LVDS interface to determine the interconnection and communication status and operational health of each control module. The second type is 1553B bus heartbeat information. The 1553B remote terminals of each control module periodically exchange heartbeat information with the onboard computer to determine the communication status between the control module and the host onboard computer. The third type is the health status of motor sampling data, used to monitor whether the sampled quantities such as voltage, current, and angle exceed the preset normal range, or whether there are abnormal fluctuations, continuous distortion, or time misalignment. The fourth type is the integrity of the shadow following state buffer, used to characterize whether the current channel has continuously completed internal state updates synchronized with the current task during the non-output phase.

[0030] In practical applications, each control module first records its own LVDS heartbeat status, heartbeat status with the 1553B bus controller, sampled data validity status, shadow follower status buffer integrity, and necessary exception information. Then, they periodically exchange their status information via the LVDS link, enabling each control module to obtain the health status of other control modules. Subsequently, each control module calculates the health status value of each channel and forms a duty control module determination result based on a preset priority relationship. In a preferred embodiment, the priority order of the three control modules can be preset as control module I higher than control module II, and control module II higher than control module III. That is, when control module I is in a normal state, regardless of the states of control modules II and III, control module I is preferentially selected as the duty control module; when control module I is in an abnormal state and control module II is normal, control module II is selected as the duty control module; when both control modules I and II are in an abnormal state but control module III is normal, control module III is selected as the duty control module.

[0031] It's easy to understand that the significance of distributed master control decision-making lies not only in selecting the master controller, but more importantly, in ensuring that the three control modules have as consistent a perception of the system's current state as possible. Without such distributed, consistent decision-making, relying solely on the local judgment of a single module can easily lead to multiple modules simultaneously believing they should output the correct result when a link fails. Therefore, this invention distributes the master control decision-making function within each control module and improves consistency through periodic exchange of state data via LVDS. Furthermore, an arbitration module provides a fallback constraint on the final physical output, thus collectively forming a reliable redundant control mechanism.

[0032] Furthermore, in this embodiment of the invention, the off-duty control module does not simply wait passively, but continuously refreshes the shadow following state cache of this channel based on the current sampling information and the calculation results of the internal control loop. In other words, even if the channel is not currently eligible to output, it will still generate angle estimation increment, speed estimation increment, current loop intermediate quantity, PWM sector position, and zero vector interval information consistent with the current task progress. In this way, when the channel subsequently becomes a candidate takeover channel, the arbitration module can use its existing state cache to determine whether it truly has the conditions for smooth takeover, rather than making a judgment based solely on the single phenomenon of enable signal recovery.

[0033] Under normal circumstances, the control modules exchange status information and command verification information through the LVDS interface and monitor health status through the LVDS heartbeat signal. In addition to sending enable signals, PWM control signals, and telemetry data to the arbitration module, each control module also periodically sends arbitration status data. When the system is operating under normal stable conditions, if only one control module sends a valid enable signal, the arbitration module directly selects that control module's PWM control signal and sends it to the corresponding drive module, and outputs the corresponding telemetry data to the onboard data center via the onboard communication interface. If none of the control modules send valid enable signals, the arbitration module does not output PWM control signals to the drive modules and maintains the system in a preset safe state. For this typical scenario with no contention and no recovery conflicts, the arbitration logic can be relatively simple.

[0034] However, in practical engineering applications, anomalies do not always occur in the form of complete failure or complete recovery. More common and difficult-to-handle situations include: a short-term interruption of the LVDS link followed by recovery, only to experience jitter again; a high-priority control module resuming the transmission of enable signals, but its internal control state has not yet smoothly transitioned to the currently active channel; or a recovered channel, although communication has been restored, still exhibits transient deviations in the correspondence between sampling feedback and control output. In these special recovery scenarios, if the arbitration module still uses a fixed priority plus simple switching protection time, it often prematurely identifies the recovered channel as a takeover channel, leading to frequent switching, master control jitter, and even output contention. Therefore, this invention adds a multi-stage processing procedure for special recovery scenarios to the arbitration module.

[0035] In this embodiment of the invention, when the arbitration module detects that multiple control modules simultaneously send enable signals, or detects that a high-priority control module resumes sending enable signals after the currently active channel has been operating stably, it does not switch directly. Instead, it first places the recovery channel in a shadow-following state. In the shadow-following state, the recovery channel continues to perform internal control calculations, but is not allowed to actually drive the power output link. Simultaneously, the state mirroring unit in the arbitration module begins to cache key information from candidate channels and the currently active channel in parallel over multiple consecutive arbitration cycles.

[0036] Specifically, the cached information can include at least the target valve position, angle increment sequence, speed change sequence, current change sequence, PWM phase interval, zero vector interval start and end boundaries, enable state sequence, and status code sequence for candidate channels and the currently active channel. It's important to understand that this state mirror does not simply store static values ​​at a single moment, but rather forms a time window covering multiple consecutive arbitration cycles. Through this time window, the arbitration module can observe whether the recovery channel's recovery is merely instantaneous or has already formed a stable and seamless internal control evolution process over multiple consecutive cycles. In other words, this embodiment of the invention does not only determine whether the recovery channel has recovered, but further determines whether the recovery channel has recovered to a state where it can be taken over without impact.

[0037] To identify the degree of evolutionary consistency between candidate channels and the currently active channel within a continuous observation window, in this embodiment of the invention, normalized correlation calculations are first performed on the angle increment sequences of the two channels. Specifically, the trajectory consistency coefficient can be formed according to the following expression: ; in, Indicates the first The candidate channel in the first The trajectory consistency coefficient relative to the current shift channel within each arbitration cycle; Indicates the candidate channel in the 1st The angle increment within each arbitration cycle This indicates the current shift's passage is in the [number]th position. Angle increment within an arbitration cycle; and These represent the average angle increments of the candidate channel and the currently active channel within the continuous observation window, respectively. Indicates the length of the continuous observation window; This indicates a positive number to prevent the denominator from being zero. It's important to note that the trajectory consistency coefficient is not simply a comparison of a single instantaneous angle value, but rather a comparison of whether the angle change trends of the candidate channel and the currently active channel are consistent within a continuous time window. If only the instantaneous angles are similar but the change trends are significantly different, the trajectory consistency coefficient will not remain at a high level, thus avoiding the misjudgment of randomly similar values ​​as indicating stable takeover.

[0038] Building upon this, the embodiments of the present invention further consider the phase transition issue of the PWM output. Specifically, the phase transition coefficient can be formed according to the following expression: ; in, This represents the phase connection coefficient between the candidate channel and the currently active channel; and These represent the PWM phase or sector phase corresponding to the candidate channel and the currently active channel, respectively. Since the cosine function naturally reflects high similarity when the phase difference is close to zero, and rapidly reduces the evaluation value when the phase difference is large, the phase alignment coefficient can effectively determine whether the output phase of the candidate channel has entered a suitable range for alignment switching. In other words, even if the candidate channel's health has recovered well, if there is a significant misalignment between its PWM phase range and the currently active channel, the arbitration module will not immediately allow switching, thus preventing output discontinuity during switching.

[0039] In practical applications, a key challenge lies in the fact that a high-priority channel may exhibit repeated changes of recovery, jitter, and re-recovery. Relying solely on whether an enable signal is sent at the current moment, or solely on the heartbeat recovery status within a short window, can easily lead to misjudgment as a takeover opportunity. Therefore, this invention introduces a joint penalty for enable state transitions and second-order status code changes within a continuous observation window to form the oscillation penalty amount for candidate channels. Its expression is, for example: ; in, This represents the oscillation penalty of the candidate channel within a continuous observation window; Indicates the candidate channel in the 1st Enabled state values ​​within each arbitration cycle; Indicates the candidate channel in the 1st The status code value or output status identifier value within each arbitration cycle. It should be noted that the first term of the oscillation penalty reflects the number and intensity of transitions in the candidate channel's enabled state within the continuous observation window. If the candidate channel repeatedly switches between enabled and disabled states, the first term will increase rapidly. The second term reflects the second-order difference of the candidate channel's internal state changes. If its state evolution is not smooth and there are accelerated changes leading to renewed instability after recovery, the second term will also increase rapidly. Therefore, the oscillation penalty does not rely solely on one change but considers both external enabling jitter and internal state evolution jitter simultaneously, making it more suitable for identifying unstable candidate channels in complex recovery scenarios.

[0040] Furthermore, in this embodiment of the invention, trajectory consistency, phase alignment, and oscillation penalty are not used separately, but are combined with the enable continuity of candidate channels and the onboard heartbeat continuity to form an instantaneous takeover evaluation value: ; in, Indicates the candidate channel in the 1st Immediate takeover evaluation value within each arbitration cycle; This indicates the degree to which the candidate channel enable signal remains valid within a continuous observation window; A measure representing the continuity of heartbeat recovery between the candidate channel and the onboard computer; , , , and These are weighting coefficients. It should be noted that the immediate takeover evaluation value itself still serves a comprehensive summary function, but the internally called-up factors... , and It is no longer a simple static weighted quantity, but a complex time-series feature obtained through correlation, phase function, and second-order difference penalty processing. Therefore, compared with the traditional approach that relies solely on heartbeat recovery and priority, the embodiments of the present invention can more accurately distinguish between transient recovery and sustained takeover recovery in special recovery scenarios.

[0041] In addition to observing the recovery stability of the candidate channel itself, this embodiment of the invention also determines the output connection deviation between the candidate channel and the currently active channel. The expression is, for example: ; in, This indicates that the candidate channel and the currently active channel are in the [number]th [position]. Output connection deviation within each arbitration cycle; and These represent the valve output shaft angle or predicted angle value for the candidate channel and the current shift channel, respectively. and These represent the velocity or angle change rate of the candidate channel and the current channel, respectively. and These represent the current quantity or current loop output of the candidate channel and the currently active channel, respectively. , and represents the weighting coefficient. It should be noted that even if a candidate channel has recovered in terms of health and trajectory trend, if its angle, velocity, and current state still differ significantly from the currently active channel, a hasty switch may still cause disruptions. Therefore, the transition deviation is used to constrain whether the candidate channel has approached the current actual output context.

[0042] Furthermore, the embodiments of the present invention are not based on a certain instantaneous period. and Instead of directly deciding whether to take over, a recursive takeover accumulation process is introduced, requiring the candidate channel to remain stable over multiple consecutive arbitration cycles. Its expression is, for example: ; in, Indicates the candidate channel in the 1st Accumulated value of takeover over each arbitration cycle; Indicates the recursive memory factor; This represents the output connection deviation penalty coefficient. It's easy to understand, but it's important to note that the recursive form of the accumulated takeover value allows the system to retain the overall performance of the candidate channel over the previous arbitration cycles, rather than being overly sensitive to instantaneous fluctuations at a single moment. Thus, even if a candidate channel suddenly performs well in a particular cycle, if there was continuous jitter or a large connection deviation in the preceding cycles, its accumulated takeover value will not immediately rise sharply, thereby suppressing instantaneous false takeovers.

[0043] Furthermore, to further improve adaptability to different recovery scenarios, this embodiment of the invention also constructs an adaptive takeover threshold that changes with the current observation window state, the expression of which is, for example: ; in, Indicates the candidate channel in the 1st Adaptive takeover threshold within each arbitration cycle; Indicates the basic takeover threshold; This represents the average output connection deviation within the continuous observation window; and This is the threshold adjustment coefficient. It should be noted that the second term in the adaptive takeover threshold reflects the dispersion of the output connection deviation within the observation window. If the connection deviation between the candidate channel and the currently active channel fluctuates greatly, this term will increase, meaning the system will automatically raise the takeover threshold. The third term directly utilizes the oscillation penalty; when the candidate channel is in an unstable phase of repeated recovery, the threshold will also automatically increase. Therefore, the takeover permission in this embodiment is not based on a fixed single threshold, but can be dynamically adjusted according to the different levels of stability in the recovery scenario, thereby improving robustness in special scenarios.

[0044] In practical applications, the arbitration module only handles the recursive takeover accumulation value of the candidate channel. The adaptive takeover threshold was reached over multiple consecutive arbitration cycles. And the phase connection coefficient Takeover permission is only released when the phase threshold is greater than a preset threshold and the candidate channel output can be aligned to the zero vector interval or preset dead zone boundary of the currently active channel. This means that the takeover conditions in this embodiment of the invention simultaneously require the candidate channel itself to be stable, close to the control context of the currently active channel, have a smooth phase alignment, and not exhibit significant oscillations within a continuous observation window, thereby significantly reducing the possibility of erroneous switching.

[0045] After the takeover authorization is released, this embodiment of the invention does not consider the takeover absolutely reliable, but further establishes a post-takeover verification window. Within the verification window, the system continuously monitors the consistency between the current output channel and the target control requirements. Specifically, a consistency evaluation value can be generated: ; in, Indicates the current output channel is in the [number]th position. Consistency evaluation value within each control cycle; Indicates the target valve position angle; This indicates the feedback of the valve's actual output shaft angle; This indicates the target's velocity or the rate of change of its angle. Indicates the actual velocity or the actual rate of change of angle; Indicates the current loop output or target current. Indicates the actual sampled current; , and , where is the weighting coefficient. The consistency evaluation value is used to characterize whether the actual output still stably follows the target valve position and target control trajectory after takeover.

[0046] To further prevent situations where the average value appears normal but short-term fluctuations are still significant, the embodiments of the present invention can also generate a consistency fluctuation value within the verification window: ; in, This indicates the intensity of fluctuation in the consistency evaluation value within the verification window; This indicates the length of the verification window. It should be noted that if a newly taken-over channel does not continuously deviate from the target within the verification window, but its consistency evaluation value fluctuates significantly, it still indicates that its output has unstable factors. In this case, it should not be immediately regarded as a reliable long-term working channel.

[0047] Furthermore, in embodiments of the present invention, a verification accumulation value can also be formed after takeover: ; in, This represents the accumulated verification value after the takeover; This represents the accumulated memory factors for verification. This represents the decay coefficient of the consistency evaluation value. Due to the exponential function... The validation accumulation value decreases rapidly as the consistency evaluation value increases. Therefore, the validation accumulation value can gradually accumulate consistently consistent takeover behavior into a high validation value, while distinguishing short-term abnormal behavior that recovers quickly from persistently unstable behavior. In other words, the validation accumulation value considers not only the state of the current period, but also the consistency history over several periods after the takeover, which helps to improve the ability to identify transient fluctuations in complex recovery scenarios.

[0048] In practical applications, when the consistency evaluation value Exceeding the preset consistency threshold or consistency fluctuation value within multiple consecutive control cycles Exceeding the preset fluctuation threshold, or verifying the accumulated value When the threshold is lower than the preset verification threshold, the system shuts down the candidate channel output, marks the candidate channel as temporarily prohibited from takeover, and re-executes the on-duty control module determination steps. If all control modules fail to meet the output conditions, the PWM output is shut down, and the valve motor assembly is guided or maintained in a preset safe state. Through this mechanism of re-verification after takeover, the present invention avoids the simplified approach of defaulting to reliability once the switch is successful, as is common in traditional methods. It establishes a takeover logic process of observation, release, alignment, verification, and rollback throughout the recovery scenario.

[0049] like Figure 3 As shown, this invention provides a control method corresponding to the system described above. For ease of understanding, the method is divided into steps S10 to S50 for explanation. It should be noted that although the method steps are presented in a sequential order, some steps may be executed in parallel or overlapped in engineering implementation during the actual control cycle. As long as the overall functionality and processing effect of this invention are satisfied, they should be considered to fall within the protection scope of this invention.

[0050] Step S1: After the system is powered on, the first control module, the second control module and the third control module are started in parallel. The onboard communication interface sends valve control commands and heartbeat information to each control module. At the same time, the signal acquisition module collects the angle, current and voltage feedback information of each valve motor component.

[0051] In this embodiment of the invention, the first control module, the second control module, and the third control module are respectively control module I, control module II, and control module III. After the system is powered on, the three control modules start in parallel. The onboard computer sends control commands and heartbeat information to the three control modules respectively. The signal acquisition module synchronously acquires the motor rotor angle signal, valve output shaft angle signal, phase current signal, and bus voltage signal of each valve motor assembly. It should be noted that this step is not merely a one-time power-on initialization and sampling acquisition; its more important role is to establish a unified data starting point for the three control modules, so that subsequent control command consistency processing, health status determination, shadow following calculation, and master control switching can all be carried out based on the same sampling reference. Furthermore, in one executable implementation, the sampling period can be set to be consistent with the control period, or it can be set to an integer multiple or integer division of the control period, as long as the comparability of the data used by each channel within the same arbitration observation window can be guaranteed.

[0052] Step S2: Each control module performs control command consistency processing, shadow following state update, and position loop, speed loop, and current loop operations according to the received valve control command and the feedback information, generating the corresponding enable signal, PWM control signal, and telemetry data for this channel.

[0053] In this embodiment of the invention, three control modules respectively receive the original control commands for their respective channels, and their respective communication processing units extract the command value and / or command summary, timestamp, frame sequence number, and validity flag. Subsequently, each control module exchanges command verification information for the current period through the LVDS link, enabling each control module to obtain a basis for comparison of three identical commands. Based on the original control commands for their channel and the command verification information returned from the other two channels, each control module performs timestamp verification, frame sequence consistency check, abnormal command masking, and valid command retention to form a target valve position command. If the three commands are consistent, the command is directly adopted as the target valve position; if one command is abnormal, the abnormal command is masked, and the target valve position for the current period is formed based on the remaining valid commands and the historical valid command retention strategy; if a more complex combination of abnormal commands occurs, a target valve position usable in the current period is formed according to a preset degradation strategy. Subsequently, each control module performs time registration with the target valve position and the currently acquired motor rotor angle, valve output shaft angle, current and voltage feedback, and inputs the position loop, speed loop and current loop to perform calculations, generating the corresponding PWM control signal, enable signal and telemetry data for this channel.

[0054] It is important to note that the off-duty control module does not cease operation during this step, but continues its internal control processing in line with the current task progress. In other words, although the off-duty channel does not output PWM control signals externally, it continuously updates status information such as target valve position, angle estimate, speed estimate, current loop intermediate value, PWM phase interval, zero vector interval boundary, and telemetry snapshot. It also encapsulates the angle increment, speed change, current change, PWM phase interval, zero vector interval boundary or preset dead zone boundary, enable state, status code, and telemetry snapshot of the current control cycle into arbitration status data, which is then sent to the arbitration module. This processing action does not affect the system's external output under normal operating conditions. However, in subsequent special recovery scenarios, when a candidate channel needs to request takeover, this continuously updated status data sent to the arbitration module can significantly reduce the control context difference between the candidate channel and the currently on-duty channel, thus providing the necessary conditions for a smooth switchover.

[0055] Step S3: Each control module determines the current on-duty control module or candidate takeover control module based on the status interaction results between modules and the health status of this channel, and sends its generated enable signal, PWM control signal and telemetry data to the arbitration module.

[0056] In this embodiment of the invention, each control module records the LVDS heartbeat communication status of its channel, the 1553B heartbeat communication status with the onboard computer, the validity status of sampled data, the integrity of the shadow following status buffer, the verification result of the received instructions for its channel, and the status of abnormal events, thus forming a health status value for its channel. Subsequently, each control module exchanges the health status value, corresponding status information, and the instruction verification information for the current period via the LVDS link, and forms the on-duty control module's judgment result based on the comparison result of the health status value with a preset threshold and a fixed priority relationship. Simultaneously, each control module sends its channel's enable signal, PWM control signal, telemetry data, and arbitration status data to the arbitration module. It should be noted that the arbitration status data includes not only the control status quantities required for trajectory consistency and phase connection judgment, but also channel status quantities such as health status flags, heartbeat continuity flags, and output eligibility flags, enabling the arbitration module to obtain complete, continuous, and traceable judgment criteria before physical output switching.

[0057] In one executable implementation, when multiple control modules meet the health status conditions, the control module with the highest preset priority is selected as the on-duty control module. If the currently on-duty control module malfunctions, or if a high-priority control module recovers from an abnormal state and regains its takeover potential, that high-priority control module does not necessarily become the on-duty control module immediately. Instead, it participates in subsequent arbitration observation as a candidate takeover control module. In other words, the result of step S3 can be either the directly output on-duty control module or a candidate takeover control module that needs to continue to be observed. This setup appropriately decouples health status determination from physical output switching, avoiding the risks associated with immediate switching once the channel recovers.

[0058] Step S4: The arbitration module performs mutual exclusion selection, conflict suppression, and phased takeover switching control based on the information of the on-duty control module and the output status of each channel, and outputs a unique and valid PWM control signal and telemetry data to the drive module group to drive the corresponding valve motor assembly to control the engine valve opening.

[0059] In this embodiment of the invention, the arbitration module receives enable signals, PWM control signals, telemetry data, and arbitration status data from each control module, and performs mutual exclusion selection and phased takeover processing based on the information of the current control module and the current output status of each channel. In a normal conflict-free scenario, if only one control module sends a valid enable signal, the arbitration module directly selects the PWM control signal of that channel and sends it to the drive module, while simultaneously outputting the corresponding telemetry data via the onboard communication interface. When multiple control modules are detected sending enable signals simultaneously, or when a high-priority control module resumes sending enable signals after the current channel has been working stably, the arbitration module does not switch directly. Instead, it places the restored channel in a shadow following state and forms an angle increment sequence, velocity change sequence, current change sequence, PWM phase interval, zero vector interval start and end boundary, enable status sequence, status code sequence, and heartbeat continuity information between the candidate channel and the current channel based on the arbitration status data received over multiple consecutive arbitration cycles.

[0060] Furthermore, in one executable implementation, the arbitration module generates a trajectory consistency coefficient between the candidate channel and the currently active channel during the observation process, a phase connection coefficient between the two channels, and an oscillation penalty for the candidate channel. Subsequently, the arbitration module generates an immediate takeover evaluation value for the candidate channel, an output connection deviation between the candidate channel and the currently active channel, a recursive takeover accumulation value for the candidate channel, and an adaptive takeover threshold for the current scenario. Only when the candidate channel satisfies the following conditions within multiple consecutive arbitration cycles: the recursive takeover accumulation value is not lower than the adaptive takeover threshold, the phase connection coefficient is not lower than the preset phase threshold, and the output can be aligned to the zero vector interval or the preset dead zone boundary of the currently active channel, does the arbitration module release the takeover permission and complete the physical switch at the alignment moment.

[0061] It should be noted that the shadow following, cross-cycle correlation determination, oscillation penalty, recursive accumulation, adaptive threshold, and phase alignment switching in the above arbitration process are achieved by introducing continuous multi-cycle state evolution information, end-output reference information of the current shift channel, and a secondary verification process after takeover in the recovery scenario. This approach enables the system to identify the difference between truly stable recovery and short-term jitter recovery, thereby avoiding the problem that traditional methods cannot suppress master control jitter in special recovery scenarios.

[0062] Step S50: The signal acquisition module collects the operation feedback of the valve motor assembly and returns it to each control module to form feedback control, and completes fault isolation, takeover verification, re-judgment and safety control when an abnormal channel is detected.

[0063] In this embodiment of the invention, after the arbitration module completes the output selection or candidate channel takeover, the signal acquisition module continues to collect the operational feedback of the valve motor assembly and returns the motor rotor angle, valve output shaft angle, current, and voltage to each control module to form a complete operation process. To determine whether the current output channel is still operating normally, a consistency evaluation value, consistency fluctuation value, and verification accumulation value can be generated within the verification window. When the consistency evaluation value continuously exceeds the threshold, the consistency fluctuation value increases significantly, or the verification accumulation value continuously decreases, it can be determined that although the newly taken-over channel met the observation conditions before takeover, there is still an instability risk after takeover. At this time, the system shuts down its output and re-executes the on-duty control module's determination and arbitration takeover process. If the current abnormal channel is a candidate channel that has just completed takeover, in addition to shutting down its output, it can also be marked as temporarily prohibited from takeover, prohibiting it from directly applying for takeover again for a period of reentry suppression. The purpose of this setting is to avoid a channel with insufficient recovery repeatedly failing to takeover and repeatedly reapplying within a short period, thereby causing continuous system oscillation.

[0064] On the other hand, when all control modules fail to meet the output conditions, the system shuts off the PWM output and directs or maintains the valve in a preset safe state to prevent abnormal control from being continuously applied to the engine valve actuator. Thus, the entire method chain forms a complete operational process from parallel control, master controller selection, complex takeover determination to post-takeover verification and failure rollback.

[0065] In a specific application scenario, the valve control actuator 1 in this embodiment of the invention can be deployed within the valve control loop of a first-stage launch vehicle engine. Each valve motor assembly corresponds to the fuel inlet valve or other propellant flow regulating valve of one engine. During normal flight, the three control modules 4-6 synchronously receive valve control commands issued by the onboard computer 18 and respectively complete target valve position formation, three-loop calculation, and health status determination. The main control decision unit determines the on-duty control module, and the arbitration module 3 selects the PWM control signal and RS422 telemetry data of the on-duty control module. If the sampling link, drive link, or communication link of the on-duty control module malfunctions, the remaining normal control modules can take over while maintaining shadow following status, thereby ensuring uninterrupted valve opening regulation.

[0066] Furthermore, assuming that control module II is currently the on-duty control module, and control module I was previously deemed unable to output due to an LVDS link anomaly, when control module I resumes sending the enable signal after several control cycles, arbitration module 3 will not immediately switch the output to control module I due to its higher priority. Instead, it will first place control module I in a shadow-following state and cache its enable continuity, heartbeat recovery status, sampling feedback changes, three-loop output evolution results, and phase connection information with control module II over several consecutive arbitration cycles. If, within the observation window, the trajectory consistency coefficient of control module I... Although it rose briefly, the oscillation penalty amount Still relatively large, or the accumulated value of recursive takeover. It has not yet stably exceeded the adaptive takeover threshold. If so, the arbitration module 3 will continue to maintain the output of the control module II, and will not switch immediately due to a single recovery of the control module I.

[0067] Furthermore, if control module I maintains high trajectory consistency, good phase connection, and reduced oscillation penalty in subsequent consecutive arbitration cycles, and the output connection deviation between it and control module II is minimized... As it gradually decreases, its recursive cumulative takeover value... It will gradually increase, eventually reaching the adaptive takeover threshold. At this point, after detecting that the current PWM has entered the zero vector range or the preset dead zone boundary, arbitration module 3 releases the takeover permission and completes the physical switch. Since control module I has already performed shadow following, cross-cycle observation, and phase alignment, the impact of the switch on the motor windings and valve actuator is significantly reduced.

[0068] On the other hand, even if control module I successfully takes over, the consistency evaluation value formed within the verification window after takeover may not be satisfactory. Sustained large values, or consistent fluctuation values Significantly increased, or the accumulated verification value formed. If the value continues to decrease, it indicates that although control module I appears to meet the conditions before takeover, there are still unstable factors in the actual output stage after takeover. At this time, the system immediately shuts down the output of control module I and re-executes the on-duty control module determination; if necessary, control module I is marked as temporarily prohibited from takeover to prevent it from repeatedly requesting takeover again in a short period of time. Through this two-stage processing mechanism of continuous judgment before takeover and continuous verification after takeover, the implementation of this invention significantly improves the stability of redundancy switching in complex recovery scenarios.

[0069] It should be noted that the control cycle, arbitration observation window length, verification window length, reentry suppression time, various thresholds, and weighting coefficients in the embodiments of the present invention can all be adjusted according to the characteristics of the servo motor, the inertia of the valve mechanism, the timing requirements of the task, and the system reliability objectives. For example, in one executable implementation, the control cycle can be set to the millisecond level, the arbitration observation window can cover several consecutive control cycles, and the verification window and reentry suppression time can also be flexibly set according to the dynamic response characteristics of the system. However, these specific values ​​do not constitute a limitation on the scope of protection of the present invention.

[0070] Furthermore, the module names in the embodiments of this invention are for illustrative purposes only. Their functions can be implemented by independent hardware modules, by different logical partitions within a single hardware module, or by multiple hardware units working together. The communication links, sampling links, and driving links can also be replaced with functionally equivalent buses, interfaces, or connection methods depending on the specific platform. All equivalent modifications, substitutions, and combinations made based on the technical concept of this invention without departing from its spirit should be considered to fall within the protection scope of this invention.

[0071] It is understood that in the description of this specification, references to the terms "one embodiment," "another embodiment," "other embodiments," or "first embodiment to Nth embodiment," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0072] It should be noted that, in this document, the terms include, encompass, or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that includes a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Without further limitations, an element defined by the statement "including a…" does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0073] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A control system for redundant valve motor assembly of a launch vehicle engine, characterized in that, include: The triple redundant control module group includes a first control module, a second control module, and a third control module that communicate with each other. They are connected to the onboard communication interface, the signal acquisition module, and the arbitration module, respectively. They are used to perform parallel execution of control command consistency processing, health status determination, shadow following status update, and position loop, velocity loop, and current loop operations, and generate enable signals, PWM control signals, telemetry data, and arbitration status data corresponding to the channels, respectively. The shadow following state update includes: when this control module is not identified as the on-duty control module, continuously updating the target valve position, angle estimate, speed estimate, current loop intermediate quantity, PWM phase interval, zero vector interval boundary and telemetry snapshot to form a shadow following state cache for use when taking over control. The onboard communication interface is configured to send valve control commands and heartbeat information to the first control module, the second control module and the third control module, and to receive telemetry data selected by the arbitration module and output it to the onboard computer. The signal acquisition module is configured to connect with the valve motor assembly group, the drive module group, and the triple redundant control module group. It is used to synchronously acquire the motor rotor angle signal, valve actuator output shaft angle signal, phase current signal, and bus voltage signal corresponding to each valve motor assembly, and send the acquisition results within the same sampling period to each control module. The arbitration module is configured to connect to the triple redundant control module group, the drive module group, and the onboard communication interface. It receives the enable signals, PWM control signals, telemetry data, and arbitration status data output by each control module. Based on the arbitration status data, it performs mutual exclusion gating, conflict suppression, and phased takeover switching control on the output of each control module, so that at any given time only the PWM control signal of the on-duty control module is sent to the drive module group, and the telemetry data of the on-duty control module is output through the onboard communication interface. The phased takeover switching control includes: when at least two control modules simultaneously send enable signals or a high-priority control module recovers from an abnormal state and resends an enable signal, maintaining the recovered channel as a candidate channel in a shadow-following state; determining trajectory consistency information, phase connection information, oscillation penalty information, and output connection deviation information between the candidate channel and the currently active channel based on arbitration status data from multiple consecutive arbitration cycles; releasing takeover permission and performing a physical switch when the candidate channel continuously meets the takeover conditions; and revoking takeover and re-determining the active control module when verification fails within the verification window after takeover. The drive module group is used to drive the corresponding valve motor assembly to operate according to the PWM control signal selected by the arbitration module, so as to adjust the valve opening of the launch vehicle engine.

2. The redundant valve motor assembly control system for a launch vehicle engine as described in claim 1, characterized in that, The first control module, the second control module, and the third control module all include: The communication processing unit is configured to receive the original valve control commands and heartbeat information of this channel sent by the onboard computer via the 1553B bus and / or RS422 bus, and to receive the command verification information sent by the other control modules via the LVDS link between the control modules. The instruction verification information includes at least one of the following: instruction value and / or instruction digest received in the current period, timestamp, frame number, validity flag, and verification result; The communication processing unit is also configured to perform timestamp verification, frame sequence consistency verification, abnormal command masking, and valid command retention based on the original valve control command of this channel and the command verification information, and output the target valve position command and telemetry data; The sampling processing unit is configured to decode, correct, and time-align the voltage, current, and angle signals transmitted by the signal acquisition module. The control processing unit is configured to perform position loop, speed loop and current loop operations and generate PWM control signals based on the target valve position command and sampled feedback. The master control decision unit is configured to determine whether the control module is qualified to output externally based on the inter-module status information, onboard heartbeat information, sampled health status, and shadow following status integrity.

3. The redundant valve motor assembly control system for a launch vehicle engine as described in claim 2, characterized in that, The signal acquisition module is configured to synchronously acquire the motor rotary transformer signal, valve actuator output shaft angle signal, dual-winding or multi-phase winding current signal and bus voltage signal of each valve motor assembly, and simultaneously send the sampling results within the same sampling period to each control module in the triple redundant control module group. The control processing unit is configured to continuously update the target valve position, angle estimate, speed estimate, current loop intermediate value, PWM phase interval, zero vector interval boundary, and telemetry snapshot when the current control module is not identified as the on-duty control module, in order to form a shadow following state cache for use during takeover; and to extract at least one of the following from the shadow following state cache: target valve position, angle increment, speed change, current change, PWM phase interval, zero vector interval boundary or preset dead zone boundary, enable state, status code, and telemetry snapshot for the current control cycle, as part of the arbitration status data sent to the arbitration module. The drive module group includes multiple motor drive modules respectively configured to correspond to each valve motor assembly. Each motor drive module is used to convert the PWM control signal output by the arbitration module into a multi-phase drive voltage for the corresponding valve motor assembly.

4. The redundant valve motor assembly control system for a launch vehicle engine as described in claim 2, characterized in that, The main control decision unit is configured to form a health status flag based on the LVDS heartbeat information, channel status information and instruction verification information for control instruction consistency processing that are periodically exchanged between each control module, and combined with the heartbeat information between the corresponding control module and the onboard computer, sampling anomalies and the integrity of the shadow following status cache. When multiple control modules meet the health status indicators, the on-duty control module is determined according to the preset priority. When this control module is not determined to be the on-duty control module, it only maintains internal synchronous calculation, shadow following status update and fault diagnosis. The arbitration module decides whether to allow it to enter the takeover process based on the output qualification indicator and takeover conditions of this channel, instead of the control module directly occupying the external drive output channel. The master control decision unit is also configured to send the health status flag, the onboard heartbeat continuity flag, the LVDS heartbeat continuity flag, and the output qualification flag of this channel to the arbitration module as part of the arbitration status data.

5. The redundant valve motor assembly control system for a launch vehicle engine as described in claim 1, characterized in that, The arbitration module includes: The status mirroring unit is configured to receive arbitration status data sent by each control module according to the arbitration cycle, and when it detects that at least two control modules send enable signals at the same time, or when it detects that a high-priority control module recovers from an abnormal state and resends an enable signal, it puts the recovery channel into shadow following state, and forms and caches the enable continuity, rocket heartbeat continuity, status recovery consistency, angle increment sequence, speed change sequence, current change sequence, PWM phase interval, and zero vector interval or preset dead zone boundary information of the candidate channel and the current channel in multiple arbitration cycles based on the arbitration status data of multiple consecutive arbitration cycles. The continuous observation unit is configured to generate trajectory consistency information, phase connection information, and oscillation penalty information between the candidate channel and the currently active channel based on the cached information. The connection determination unit is configured to determine whether a candidate channel meets the takeover conditions based on the trajectory consistency information, phase connection information, oscillation penalty information, and output connection deviation information between the candidate channel and the currently active channel. The takeover release unit is configured to release takeover permission when the candidate channel continuously meets the takeover conditions; the phase alignment unit is used to adjust the output of the candidate channel to be aligned with the zero vector interval or preset dead zone boundary of the currently active channel after releasing the takeover permission, and then perform a physical switch. The verification rollback unit is configured to maintain the verification window after takeover, rescind the takeover and re-execute the on-duty control module determination when verification fails, and apply re-entry suppression to the verification failure channel.

6. A control method for redundant valve motor assembly of a launch vehicle engine, characterized in that, The control system for redundant valve motor assembly of a launch vehicle engine as described in any one of claims 1 to 5 includes the following steps: S1: After the system is powered on, the first control module, the second control module and the third control module are started in parallel. The onboard communication interface sends valve control commands and heartbeat information to each control module. At the same time, the signal acquisition module collects the angle, current and voltage feedback information of each valve motor component. S2: Each control module performs control command consistency processing, shadow following status update, and position loop, speed loop, and current loop operations according to the received valve control command and the feedback information, generating the corresponding enable signal, PWM control signal, telemetry data, and arbitration status data for this channel; The shadow following state update includes: when this control module is not identified as the on-duty control module, continuously updating the target valve position, angle estimate, speed estimate, current loop intermediate quantity, PWM phase interval, zero vector interval boundary and telemetry snapshot to form a shadow following state cache for use when taking over control. S3: Each control module determines the current on-duty control module or candidate takeover control module based on the status interaction results between modules and the health status of this channel, and sends the enable signal, PWM control signal, telemetry data and arbitration status data generated by each module to the arbitration module; S4: The arbitration module performs mutual exclusion selection, conflict suppression and phased takeover switching control based on the information of the on-duty control module, the output status of each channel and the arbitration status data of each channel, outputs a unique and valid PWM control signal to the drive module group, and outputs the telemetry data corresponding to the on-duty control module through the rocket communication interface. The phased takeover switching control includes: when at least two control modules simultaneously send enable signals or a high-priority control module recovers from an abnormal state and resends an enable signal, maintaining the recovered channel as a candidate channel in a shadow-following state; determining trajectory consistency information, phase connection information, oscillation penalty information, and output connection deviation information between the candidate channel and the currently active channel based on arbitration status data from multiple consecutive arbitration cycles; releasing takeover permission and performing a physical switch when the candidate channel continuously meets the takeover conditions; and revoking takeover and re-determining the active control module when verification fails within the verification window after takeover. S5: The signal acquisition module collects the operational feedback of the valve motor assembly and returns it to each control module to form feedback control. When an abnormal channel is detected, it completes fault isolation, takeover verification, re-judgment, and safety control.

7. The control method for redundant valve motor assembly of a launch vehicle engine as described in claim 6, characterized in that, Step S2 specifically includes: The original control commands received by each control module for this channel are processed by extracting timestamps, extracting frame sequence numbers, and determining validity. The command values ​​and / or command digests, timestamps, frame sequence numbers, validity flags, and verification results are then exchanged between the control modules via the LVDS link. Each control module performs timestamp verification, frame sequence consistency check, abnormal command masking, and valid command retention based on the original control command of this channel and the command verification information returned by other control modules, in order to form the target valve position command; The target valve position command is time-registered with the collected motor rotor angle, valve actuator output shaft angle, current and voltage feedback; Based on the time-registered control commands and feedback data, position loop, speed loop and current loop operations are performed to generate PWM control signals and telemetry data for the corresponding channels; When this channel is not identified as the on-duty control module, it continues to perform three-loop operations and status updates. Without releasing PWM output to the external drive link, it records the angle estimation increment, speed estimation increment, current loop intermediate quantity, PWM sector position, zero vector interval boundary, enable state, status code, and telemetry snapshot of this channel. The recorded status quantities are then encapsulated to form arbitration status data to be sent to the arbitration module.

8. The control method for redundant valve motor assembly of a launch vehicle engine as described in claim 6, characterized in that, Step S3 specifically includes: Each control module records the LVDS heartbeat communication status of its channel, the heartbeat communication status with the onboard computer, the validity status of sampled data, the integrity of the shadow following status buffer, the verification result of the received instructions of its channel, and the status of abnormal events, and forms the health status value of its channel. Each control module exchanges the health status value, corresponding status information, and instruction verification information for control instruction consistency processing through the LVDS link. Based on the comparison result of the health status value and the preset threshold, the on-duty control module or the candidate takeover control module is determined in sequence according to the preset priority. Each control module sends its enable signal, PWM control signal, telemetry data, and arbitration status data, including health status value, heartbeat continuity flag, shadow following related status quantity, enable status and status code, to the arbitration module.

9. The control method for redundant valve motor assembly of a launch vehicle engine as described in claim 6, characterized in that, When multiple control modules are detected sending enable signals simultaneously, or when a high-priority control module is detected resuming sending enable signals during the current shift channel's operation, step S4 specifically includes: The recovery channel is placed in shadow following state. Within the continuous observation window, the angle increment sequence, PWM phase sequence, enable state sequence and status code sequence are extracted from the arbitration status data sent by the candidate channel and the current shift channel to form the trajectory consistency coefficient between the candidate channel and the current shift channel. The phase connection coefficient between the candidate channel and the current channel is calculated sequentially, as well as the oscillation penalty of the candidate channel within the continuous observation window, the instantaneous takeover evaluation value of the candidate channel within the current arbitration cycle, the output connection deviation between the candidate channel and the current channel, the recursive takeover accumulation value of the candidate channel, and the adaptive takeover threshold of the candidate channel. Takeover permission is generated and switching is performed only when the cumulative value of the candidate channel’s recursive takeover reaches the adaptive takeover threshold within multiple consecutive arbitration cycles, the phase connection coefficient is greater than the preset phase threshold, and the candidate channel output can be aligned to the zero vector interval or preset dead zone boundary of the current shift channel. If the conditions are not met, the current channel continues to output, and re-entry suppression is applied to the candidate channels that do not meet the conditions.

10. The control method for redundant valve motor assembly of a launch vehicle engine as described in claim 6, characterized in that, Step S5 specifically includes: Within the verification window after the candidate channel is taken over, the consistency information between the target valve position and the output feedback is continuously collected, and a consistency evaluation value is formed. Based on the aforementioned consistency evaluation value, the consistency fluctuation value within the verification window and the verification accumulation value after takeover are sequentially generated. When the consistency evaluation value exceeds the preset consistency threshold in multiple consecutive control cycles, or the consistency fluctuation value exceeds the preset fluctuation threshold, or the verification accumulation value is lower than the preset verification threshold, the candidate channel output is turned off, the candidate channel is marked as temporarily prohibited from taking over, and the on-duty control module determination steps are re-executed. When all control modules fail to meet the output conditions, the PWM output is turned off and the valve motor assembly is guided or maintained in a preset safe state. When the consistency evaluation value, consistency fluctuation value, and verification accumulation value all meet the preset conditions, the current takeover channel continues to be used as the output of the on-duty control module.

Images