A hot backup redundancy control system with power-on / off protection and a control method thereof

Abstract

The application discloses a kind of hot backup redundancy control systems and control method with power-on and power-off protection, belong to embedded motor servo control technical field.System includes redundancy control unit group, signal isolation buffer circuit, diode isolation combining module, single motor drive unit and motor winding isolation circuit;Adopt control unit A / B machine full redundancy, motor drive unit single common partial redundancy architecture, isolation buffer circuit configuration resistance discharge path, can quickly release integrated circuit parasitic capacitor charge, avoid power-on and power-off and the motor jitter and drive misoperation caused by abnormal level during double-machine switching.Aiming at single-winding motor, the winding isolation is simplified by removing the winding isolation, and for the main and standby double-winding motor, a single-pole double-throw power relay is used to realize the winding time-sharing physical isolation.The application considers redundancy fault tolerance and fault seamless hot switching capability, greatly reduces the number of drive hardware, reduces size and weight, and reduces cost.

Description

Technical Field

[0001] This invention relates to the fields of embedded intelligent control, power electronic drive and motor servo control technology, specifically a hot backup redundant control system and control method with power failure protection. Background Technology

[0002] With the rapid development of artificial intelligence, embedded microcontrollers, and power electronics technologies, intelligent equipment with autonomous computing, environmental perception, and intelligent decision-making capabilities is being deployed on a large scale. Among these, intelligent robots and unmanned vehicles are directly related to personal safety. In high-risk industries such as aerospace, petrochemicals, and nuclear power, critical electronic control devices are highly susceptible to equipment damage, production stoppages, significant economic losses, and even serious safety accidents if they experience control failures, motor shutdowns, or malfunctions. To improve the reliability of control systems and reduce the risk of single points of failure, redundancy and fault-tolerant design have become standard technologies in high-end embedded control equipment. Current mainstream redundancy solutions in the industry are mainly divided into two types: single-machine internal redundancy and system-level redundancy. Single-machine redundancy integrates two completely equivalent hardware circuits, A and B, within the same servo controller. Each circuit includes a microcontroller-based control unit and a corresponding motor drive unit, forming a dual-machine architecture that serves as a backup for each other. Under normal operating conditions, only one control and drive unit (either A or B) is powered on and operates, while the other remains in a cold backup state. When the working machine experiences program abnormalities, hardware damage, or communication failures, the system switches to the backup machine to take over control. System redundancy, on the other hand, involves configuring two independent servo controllers with completely identical structure and functions, operating on the same principle as single-machine redundancy. In practical applications, external motors are mainly divided into two categories: single-winding structure and main-backup dual-winding structure. A single-winding motor receives driving energy from a single winding, with both motors A and B connected to this winding simultaneously. A main-backup dual-winding motor has independent main windings and backup windings, which are respectively connected to the drive circuits of motors A and B. To solve the problem of induced electromotive force generated by the motor windings cutting magnetic lines of force, existing solutions all add winding isolation circuits to prevent the induced electromotive force from forming a series path when one motor is powered on and the other is powered off, causing false triggering and abnormal operation of the unpowered circuit.

[0003] In practical engineering applications, the upper-level control system is often already configured with redundancy. However, the motor servo controller is constrained by factors such as installation space, overall lightweight design, and equipment manufacturing cost. If the traditional dual-machine full-set redundancy design is continued, it will result in the motor drive hardware being stacked with redundancy multiple times. Not only will the overall size and weight be difficult to control and unable to meet the requirements of lightweight installation, but it will also bring about the practical contradiction of excessive hardware redundancy and high overall cost. At the same time, the inherent parasitic capacitance of integrated circuits will generate abnormal levels during the power-on, power-off, and dual-machine switching of the controller, which can easily induce generator drive malfunctions and slight jitter. Therefore, we propose a hot-backup redundant control system and control method with added power failure protection. Summary of the Invention

[0004] The purpose of this invention is to provide a hot backup redundant control system and control method with added power failure protection, which solves the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a hot-backup redundant control system with power-off protection, comprising a redundant control unit group, two signal isolation buffer circuits, a diode isolation combining module, a single motor drive unit, a motor winding isolation circuit, and an external motor assembly; the redundant control unit group includes an A-machine control unit and a B-machine control unit with hardware circuitry and embedded programs completely identical, both of which communicate with the upper-level control system via an internal bus; the signal output terminals of the A-machine control unit and the B-machine control unit are respectively connected to one signal isolation buffer circuit; the output terminals of the two signal isolation buffer circuits are connected to the diode isolation combining module, and the output terminal of the diode isolation combining module is connected to the single motor drive unit; the single motor drive unit is electrically connected to the external motor assembly via the motor winding isolation circuit.

[0006] In a preferred embodiment of the present invention, the signal isolation buffer circuit adopts SN74ALVC164245 or SN74ALVC162245 level conversion integrated circuit; each signal isolation buffer circuit is configured with resistors R1~R3 ​​and R7~R9 to form a parasitic capacitance discharge path at the input port of the integrated circuit, and is configured with resistors R4~R6 to form a signal discharge path at the output terminal of the diode isolation combiner module.

[0007] In a preferred embodiment of the present invention, the diode isolation and combining module utilizes the unidirectional conduction characteristic of diodes to isolate and combine the control signals output from the two signal isolation buffer circuits into a single control signal input to a single motor drive unit, thereby achieving that the control signals of machines A and B do not backflow or interfere with each other.

[0008] In a preferred embodiment of the present invention, the motor winding isolation circuit adopts a single-pole double-throw power relay; the stationary contact of the relay is connected to a single motor drive unit, and the two sets of moving contacts are respectively connected to the main and backup dual windings of the external motor. At any given time, only one set of moving contacts is connected to the stationary contact, thereby realizing physical isolation between the dual windings.

[0009] In a preferred embodiment of the present invention, when the external motor assembly is a single-winding structure, a single motor drive unit is directly connected to the motor winding in a one-to-one correspondence, eliminating the need for winding isolation circuits and eliminating winding magnetic coupling induction series current paths.

[0010] In a preferred embodiment of the present invention, when the external motor assembly has a main and backup dual winding structure, the two windings of the same motor are respectively connected to the two moving contacts of a single-pole double-throw power relay, and an isolation circuit is configured between the winding and the relay to suppress magnetic coupling induction interference between the windings.

[0011] This invention also relates to a hot backup redundancy control method with added power failure protection, comprising the following steps: S1. Redundant synchronous standby: The A unit control unit and the B unit control unit are powered on synchronously, receive instructions from the upper control system in real time, and synchronously collect motor Hall, potentiometer and current feedback signals. Under normal conditions, the A unit is the main working unit and outputs control signals, while the B unit is a hot backup unit for standby monitoring. S2. Signal Isolation and Charge Discharge: The control signals of machines A and B respectively enter the signal isolation buffer circuit to achieve electrical isolation. During power-on and power-off and dual-machine switching, the parasitic capacitance charge of the integrated circuit is quickly released through the resistor discharge path, and the clamping signal is a stable low level. S3, Redundant signal combining: The two isolated control signals are combined into a single drive control signal by the diode isolation combining module; S4. Motor drive operation: A single motor drive unit receives control signals and amplifies the power to drive an external motor to run smoothly according to a closed-loop control algorithm. S5. Seamless fault switching: When the main working machine fails, the upper control system automatically switches to the output signal of the B machine control unit, and continues to control the single motor drive unit after isolation, discharge and recirculation. S6. Dual-winding time-shaping: For motors with main and backup dual windings, the main winding or backup winding is turned on in a time-sharing manner by a single-pole double-throw power relay to achieve isolated alternating operation of the dual windings.

[0012] In a preferred embodiment of the present invention, in step S2, the parasitic capacitance charge at the input port of the isolation buffer circuit is released through resistors R1~R3 ​​and R7~R9, and the residual charge at the output terminal of the diode isolation combining module is released through resistors R4~R6, thereby preventing unexpected high levels from causing erroneous motor drive output and motor jitter.

[0013] In a preferred embodiment of the present invention, in step S5, the entire process of hot backup switching between machines A and B does not require power outage or shutdown, and does not change the working state of a single motor drive unit, thus achieving disturbance-free redundant fault-tolerant control.

[0014] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention employs a partially redundant architecture with a fully redundant control unit and a shared single-unit motor drive unit. This effectively reduces the hardware configuration of the motor drive unit by half. When the external motor has a single-winding structure, the winding isolation circuit can also be omitted, significantly simplifying the overall hardware circuit layout and substantially reducing the overall size and weight of the equipment. This perfectly meets the lightweight and miniaturization design requirements of aerospace, intelligent equipment, and other scenarios. The simplification of hardware components also effectively reduces the overall manufacturing cost, enhancing the product's market competitiveness. Furthermore, by adding an isolation buffer circuit with a resistive discharge path, it can effectively mitigate the impact of power-on, power-off, and dual-machine switching. During the process, the parasitic capacitance charge of the integrated circuit port is quickly discharged, the clamping signal level is stabilized, and the motor drive erroneous output and slight motor jitter caused by abnormal levels are completely avoided, ensuring the smoothness and control accuracy of the servo control process. This invention retains the dual-machine redundancy fault tolerance capability of the control unit while simplifying hardware and reducing costs and weight. It can realize seamless hot switching under fault conditions, ensuring the continuous and reliable operation of the control system. It can also be compatible with both single-winding and main-standby dual-winding motor structures. It has a wide range of applications and strong versatility. The circuit structure is simple and highly integrated, effectively reducing the probability of hardware failure and the difficulty of later maintenance. Attached Figure Description

[0015] Other features, objects, and advantages of the present invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings: Figure 1 This is a block diagram of the hot backup redundancy control system for a single-winding motor in this invention. Figure 2 This is a block diagram of the hot backup redundancy control system for the main and backup dual-winding motors in this invention. Figure 3 This is a schematic diagram of the isolation buffer and diode combining circuit with added power-off protection of the present invention. Detailed Implementation

[0016] To make the technical means, creative features, objectives and effects of this invention easier to understand, the invention will be further described below in conjunction with specific embodiments.

[0017] This invention discloses a hot backup redundant control system and control method with power failure protection. The overall system mainly consists of a redundant control unit group, two-way signal isolation buffer circuit, diode isolation combining module, single motor drive unit, motor winding isolation circuit and external motor components, forming a complete hardware architecture.

[0018] The redundant control unit group consists of an A-machine control unit and a B-machine control unit with identical hardware circuitry and embedded programs. Both A-machine and B-machine control units establish communication links with the upper-level redundant control system through an internal bus. They can independently receive motion control, start / stop, speed adjustment, and position commands from the upper level, while simultaneously acquiring real-time status information from Hall sensors, potentiometers, and motor current to complete current closed-loop and position closed-loop calculations. The signal output terminals of the A-machine and B-machine control units are each connected one-to-one to a signal isolation buffer circuit. The outputs of both signal isolation buffer circuits are connected to a diode isolation combiner module. The output terminal of the diode isolation combiner module is configured with only a single motor drive unit, abandoning the traditional dual-drive fully redundant architecture. The single motor drive unit is then connected to an external motor assembly via a motor winding isolation circuit to achieve servo drive control.

[0019] This system boasts core functionalities and practical application effects: It employs a partially redundant architecture with fully redundant control units and single-reusable drive units. This architecture enables hot backup and fault tolerance for dual control units, seamless and uninterrupted switching during faults, ensuring continuous and uninterrupted motor servo control, meeting the high safety requirements of applications such as intelligent robots, autonomous driving, aerospace, and energy and chemical industries. Furthermore, by streamlining hardware configuration, it reduces the number of motor drive units, supporting power devices, heat dissipation structures, and peripheral circuits by half, significantly reducing the overall controller size and weight, making it suitable for applications requiring lightweight, miniaturized equipment and limited installation space. Simultaneously, the system features full-process power-on and power-off level protection, effectively suppressing abnormal levels caused by parasitic capacitance of integrated circuits during power-on, power-off, and dual-machine switching. This eliminates motor mis-triggers, minor jitters, and positioning deviations at the source, significantly improving servo control stability and accuracy. The system is compatible with both single-winding and dual-winding motor structures, offering strong versatility, simple hardware wiring, reduced hardware failure probability and maintenance costs, and outstanding engineering adaptability and market application value.

[0020] In this embodiment, the signal isolation buffer circuit uses the SN74ALVC164245 or SN74ALVC162245 level conversion integrated circuit. The chip is small in size, low in cost, and has excellent level adaptability and electrical isolation performance. Adding this circuit will hardly increase the overall size and manufacturing cost. Each isolation buffer circuit is equipped with resistors R1 to R3 and R7 to R9 to form a parasitic capacitance discharge path at the input port of the integrated circuit, and resistors R4 to R6 to form a signal discharge path at the output of the diode isolation combiner module. During power-on, power-off and dual-machine switching, the parasitic capacitance stored in the chip port can be quickly discharged, forcing the link signal to remain stable at a low level, avoiding abnormal high levels that cause motor drive erroneous output and motor jitter.

[0021] The diode isolation and combining module utilizes the unidirectional conduction characteristic of diodes to isolate and combine the two control signals of machine A and machine B after isolation and buffering into a single control signal and send it to a single motor drive unit. This effectively prevents the signals of the two machines from backflowing and interfering with each other, and ensures that any control unit can independently and stably control the back-end drive circuit. Example 1: Adaptation conditions for single-winding motors

[0022] The external motor assembly adopts a single winding structure layout. Each set of single motor drive units and a single motor winding are directly connected in a one-to-one correspondence manner for wiring and installation. There is no need to configure additional winding isolation circuits, eliminating the isolation devices and isolation wiring required by traditional fully redundant architectures, and completely eliminating the latent path of winding magnetic coupling induction from the hardware structure.

[0023] Under this operating condition, the redundant control signals of machines A and B are isolated, buffered, discharged by resistors, and combined by diodes, and then directly drive the single-winding motor through a single motor drive unit. The control unit retains the dual-machine hot backup redundancy capability, and the drive unit adopts a single shared design. Under the premise of ensuring the control reliability remains unchanged, the hardware circuit is simplified to the greatest extent, and the overall size and weight of the machine are reduced. The structure is simple and the failure rate is low, making it suitable for general industrial servo and multi-motor array control scenarios. Example 2: Adaptation of Main and Backup Dual-Winding Motors

[0024] The external motor assembly adopts a main and backup dual winding structure, with the same motor having independent main and backup windings; the motor winding isolation circuit uses a single-pole double-throw power relay, with the relay's stationary contacts fixedly connected to a single motor drive unit, and two sets of moving contacts respectively connected to the motor's main winding and backup winding. A dedicated isolation circuit is configured between the winding and the relay to effectively reduce magnetic coupling induction interference between windings.

[0025] This operating condition strictly adheres to the logic that only one set of moving and stationary contacts are connected at any given time, achieving complete physical isolation between the main and backup windings. This prevents the motor windings from cutting magnetic lines of force and generating induced electromotive force, thus avoiding crosstalk interference. By issuing commands from the control system, the relay contacts are controlled to switch in a time-sharing manner, allowing the main and backup windings to work alternately. This allows for normal servo operation and automatic switching to another winding when a fault occurs in one winding. It offers a higher level of redundancy protection and is suitable for critical control applications with extremely high requirements for operational safety and fault tolerance, such as aerospace, high-risk chemical industry, and autonomous driving.

[0026] Hot backup redundancy control method with power failure protection Based on the system architecture of the two embodiments described above, the control method of the present invention is uniformly applicable and specifically includes the following detailed steps: S1. Redundant Synchronous Standby and Synchronous Sampling Initialization: The A and B machine control units power on synchronously to complete hardware self-tests and program initialization, entering a long-term hot backup standby state. Both machines maintain real-time communication with the upper-level redundant control system via an internal bus, continuously receiving control commands such as start / stop, speed adjustment, and position setting; synchronously acquiring motor Hall position signals, potentiometer angle feedback signals, and motor bus current and phase current sampling signals, and executing current closed-loop and position closed-loop control algorithms in parallel. The system defaults to setting A as the master machine; under normal operating conditions, only A outputs valid control signals. B performs synchronous calculations and monitors the operating status throughout the process, remaining in a hot backup standby state without outputting drive signals, ensuring instantaneous and seamless takeover during fault switching.

[0027] S2. Signal electrical isolation and power-off charge discharge protection: The control signals output by machines A and B are independently connected to the signal isolation buffer circuits of their respective channels. Electrical isolation between the two machines is achieved using a dedicated level conversion chip, blocking crosstalk interference between them. During power-on, normal power-off, and the moment of switching between machines A and B, parasitic capacitance at the integrated circuit port accumulates charge and generates a false high level. At this time, R1-R3 and R7-R9 form an input discharge path, quickly releasing the parasitic charge at the input of the isolation buffer chip. Then, R4-R6 form an output discharge path, releasing the residual charge at the diode junction, forcing the entire control link signal to be stably clamped at a low level, completely eliminating drive malfunctions, instantaneous motor jitter, and positioning drift caused by abnormal levels.

[0028] S3. Redundant Signal Unidirectional Isolation and Combining: After isolation buffering, level clamping, and charge discharge conditioning, the two independent control signals from machines A and B are combined and connected to the diode isolation and combining module. Utilizing the unidirectional cutoff characteristic of the diode, the two signals do not reverse current or affect each other. Only the control signal of the currently active machine is reliably turned on, merging into a single, stable standard drive signal, which is then sent to the back-end single motor drive unit. This perfectly adapts to the architecture mode of dual control units sharing a single drive.

[0029] S4. Power Drive Amplification and Smooth Closed-Loop Operation of the Motor: The single motor drive unit receives the combined standard control signal, which undergoes internal signal shaping, logic decoding, power amplification, and inversion processing to convert the weak current control signal into high-power drive energy. The drive energy is directly delivered to the single-winding motor or, after selection by a power relay, to the dual-winding motor, depending on the operating condition. The system relies on a dual closed-loop control algorithm to adjust the motor speed and angle in real time, achieving smooth start-stop, precise positioning, and uniform speed servo tracking, with smooth operation throughout without shocks or disturbances.

[0030] S5. Online Fault Detection and Seamless Hot Backup Switching: The upper-level control system monitors key parameters such as the power supply status, program heartbeat, communication link, and sampling data validity of the A and B machine control units in real time. When a fault such as hardware damage, program crash, communication interruption, or sampling abnormality is detected in the main machine, the main machine signal output is immediately locked, and the control command is instantly switched to the backup machine. The signal still passes through isolation buffer, charge discharge, and diode combining in sequence to control the original single motor drive unit. The entire switching process does not require power outage or machine shutdown for reset, and the drive unit operates continuously without interruption, achieving seamless and disturbance-free redundancy and fault tolerance.

[0031] S6. Dual-winding time-sharing isolation switching control: For the main and backup dual-winding motor operating condition in Example 2, the control system outputs a control signal to drive the single-pole double-throw power relay to reliably switch contacts according to the preset switching strategy or winding fault judgment command. This strictly ensures that only one winding (main or backup) is engaged at any given time, achieving physical isolation and time-sharing switching of the two windings. This avoids winding mutual inductance interference and induced electromotive force crosstalk problems, and also enables periodic switching of the main and backup windings to extend their lifespan and automatic disconnection of faulty windings, further improving system operational safety and service life.

[0032] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or basic characteristics. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, it is intended that all variations falling within the meaning and scope of equivalents of the claims be included within the present invention.

[0033] Furthermore, it should be understood that although this specification describes embodiments, not every embodiment contains only one independent technical solution. This narrative style is merely for clarity. Those skilled in the art should consider the specification as a whole, and the technical solutions in each embodiment can also be appropriately combined to form other embodiments that can be understood by those skilled in the art.

Claims

1. A hot-backup redundant control system with power failure protection, characterized in that: The system includes a redundant control unit group, two signal isolation buffer circuits, a diode isolation combining module, a single motor drive unit, a motor winding isolation circuit, and an external motor assembly. The redundant control unit group comprises an A-machine control unit and a B-machine control unit with identical hardware circuitry and embedded programs. Both the A-machine control unit and the B-machine control unit communicate with the upper-level control system via an internal bus. The signal output terminals of the A-machine control unit and the B-machine control unit are each connected to a corresponding signal isolation buffer circuit. The output terminals of the two signal isolation buffer circuits are connected to the diode isolation combining module, and the output terminal of the diode isolation combining module is connected to the single motor drive unit. The single motor drive unit is electrically connected to the external motor assembly via the motor winding isolation circuit.

2. The hot backup redundant control system with power failure protection according to claim 1, characterized in that: The signal isolation buffer circuit uses SN74ALVC164245 or SN74ALVC162245 level conversion integrated circuit; each signal isolation buffer circuit is configured with resistors R1~R3 ​​and R7~R9 to form the parasitic capacitance discharge path of the integrated circuit input port, and is configured with resistors R4~R6 to form the signal discharge path of the diode isolation combiner module output.

3. A hot backup redundant control system with power failure protection according to claim 1, characterized in that: The diode isolation and combining module utilizes the unidirectional conduction characteristic of diodes to isolate and combine the control signals output from the two signal isolation buffer circuits into a single control signal input to a single motor drive unit, thereby ensuring that the control signals of machines A and B do not backflow or interfere with each other.

4. A hot backup redundant control system with power failure protection according to claim 1, characterized in that: The motor winding isolation circuit uses a single-pole double-throw power relay; the stationary contact of the relay is connected to a single motor drive unit, and the two sets of moving contacts are respectively connected to the main and backup dual windings of the external motor. At any given time, only one set of moving contacts is connected to the stationary contact, thus achieving physical isolation between the dual windings.

5. A hot backup redundant control system with power failure protection according to claim 1, characterized in that: When the external motor assembly has a single winding structure, each motor drive unit is directly connected to the motor winding in a one-to-one correspondence, eliminating the need for winding isolation circuits and eliminating the winding magnetic coupling induction series current path.

6. A hot backup redundant control system with power failure protection according to claim 1, characterized in that: When the external motor assembly has a main and backup dual winding structure, the two windings of the same motor are respectively connected to the two sets of moving contacts of a single-pole double-throw power relay. An isolation circuit is configured between the winding and the relay to suppress magnetic coupling induction interference between the windings.

7. A hot backup redundancy control method with added power failure protection, applicable to the hot backup redundancy control system with added power failure protection as described in any one of claims 1-6, characterized in that: Includes the following steps: S1. Redundant synchronous standby: The A unit control unit and the B unit control unit are powered on synchronously, receive instructions from the upper control system in real time, and synchronously collect motor Hall, potentiometer and current feedback signals. Under normal conditions, the A unit is the main working unit and outputs control signals, while the B unit is a hot backup unit for standby monitoring. S2. Signal Isolation and Charge Discharge: The control signals of machines A and B respectively enter the signal isolation buffer circuit to achieve electrical isolation. During power-on and power-off and dual-machine switching, the parasitic capacitance charge of the integrated circuit is quickly released through the resistor discharge path, and the clamping signal is a stable low level. S3, Redundant signal combining: The two isolated control signals are combined into a single drive control signal by the diode isolation combining module; S4. Motor drive operation: A single motor drive unit receives control signals and amplifies the power to drive an external motor to run smoothly according to a closed-loop control algorithm. S5. Seamless fault switching: When the main working machine fails, the upper control system automatically switches to the output signal of the B machine control unit, and continues to control the single motor drive unit after isolation, discharge and recirculation. S6. Dual-winding time-shaping: For motors with main and backup dual windings, the main winding or backup winding is turned on in a time-sharing manner by a single-pole double-throw power relay to achieve isolated alternating operation of the dual windings.

8. A hot backup redundancy control method with added power failure protection according to claim 7, characterized in that: In step S2, the parasitic capacitance charge at the input port of the isolation buffer circuit is released through resistors R1~R3 ​​and R7~R9, and the residual charge at the output terminal of the diode isolation combining module is released through resistors R4~R6, so as to prevent unexpected high levels from causing erroneous motor drive output and motor jitter.

9. A hot backup redundancy control method with added power failure protection according to claim 7, characterized in that: In step S5, the entire hot backup switching process between machines A and B does not require power outages or shutdowns, and does not change the working state of a single motor drive unit, thus achieving disturbance-free redundant fault-tolerant control.

Images