A fault diagnosis and redundancy control method for an aviation dual-redundancy servo system

Abstract

The present application relates to a kind of fault diagnosis and redundancy control method of aviation dual-redundancy servo system, belong to aviation redundancy control technical field, solve the problem of insufficient real-time of fault diagnosis, limited fault identification mode, cannot fast fault isolation in prior art.System includes first redundancy circuit, second redundancy circuit, inter-redundancy communication circuit and redundancy allocation circuit;Inter-redundancy communication circuit is used to realize the communication between first redundancy circuit and second redundancy circuit;Method includes: first redundancy circuit and second redundancy circuit are respectively obtained the operating parameter of respective redundancy circuit;Based on the operating parameter, controller judges whether the redundancy of first redundancy circuit and second redundancy circuit fails, and generates corresponding fault status word;Through inter-redundancy communication circuit, the fault status word is synchronized between first redundancy circuit and second redundancy circuit, and redundancy control strategy is executed based on the fault status word of synchronization.

Description

Technical Field

[0001] This invention relates to the field of aviation redundancy control technology, and in particular to a fault diagnosis and redundancy control method for an aviation dual-redundancy servo system. Background Technology

[0002] With the increasing popularity of the multi-electric / all-electric aircraft concept, electric servos are being used more and more widely in the field of aerospace servo actuation. To meet the reliability requirements of long-endurance aircraft operation, redundant configurations of systems or components are often adopted, and redundant electric servos are attracting more and more attention in the field of aerospace servo systems. Redundant electric servos provide redundancy configurations for controllers and drives, etc. When one redundancy fails, the system can switch to another redundancy to continue working, enabling the system to operate without derating or with slight derating under fault conditions, greatly improving the mission reliability of onboard servo systems.

[0003] For redundant electric servo systems, fault diagnosis and redundancy control algorithms are crucial components of the control software, impacting system functionality and reliability. Electric servo systems are complex, with numerous fault types. Comprehensive and timely fault identification is fundamental for redundancy control, but it also presents technical challenges. Based on fault diagnosis results, a rapid and orderly redundancy control strategy is key to system fault removal and return to normal operation.

[0004] The existing solutions have the following problems: some existing motor fault diagnosis methods can only identify faults offline or require a long calculation period, which cannot meet the real-time requirements; existing online motor fault diagnosis methods often identify faults by single signals such as current and displacement sensors, which can identify a limited number of fault modes and cannot cover all common fault modes that may occur in the on-board servo system; existing redundancy control strategies cannot quickly achieve rapid fault isolation. Summary of the Invention

[0005] Based on the above analysis, the embodiments of the present invention aim to provide a fault diagnosis and redundancy control method for an aviation dual-redundancy servo system, in order to solve the problems of insufficient real-time performance of existing fault diagnosis, limited fault identification modes, and inability to quickly isolate faults.

[0006] On one hand, embodiments of the present invention provide a fault diagnosis and redundancy control method for an aviation dual-redundancy servo system, the aviation dual-redundancy servo system including a first redundancy circuit, a second redundancy circuit, an inter-redundancy communication circuit, and a redundancy allocation circuit.

[0007] The first redundancy circuit includes a first controller, and the second redundancy circuit includes a second controller; the redundancy communication circuit is used to realize communication between the first redundancy circuit and the second redundancy circuit; the output terminals of both the first redundancy circuit and the second redundancy circuit are connected to the redundancy adjustment circuit; the method includes:

[0008] The first redundancy circuit and the second redundancy circuit acquire the operating parameters of their respective redundancy circuits.

[0009] Based on the operating parameters, the controller determines whether the redundancy of the first redundancy circuit and the second redundancy circuit has failed, and generates the corresponding fault status word.

[0010] The fault status word is synchronized between the first and second redundancy circuits via an inter-redundancy communication circuit. Based on the synchronized fault status word, a redundancy control strategy is executed, including:

[0011] If no fault is detected in either the first redundancy circuit or the second redundancy circuit, the motor drive signal of the first controller will be output normally, the motor drive signal of the second controller will be set to zero, and the control redundancy adjustment circuit of the second controller will cut off the second redundancy circuit.

[0012] If the first redundancy circuit fails and the second redundancy circuit does not detect a fault, the motor drive signal of the second controller will be output normally, the motor drive signal of the first controller will be set to zero, and the control redundancy adjustment circuit of the first controller will cut off the first redundancy circuit.

[0013] If both the first redundancy circuit and the second redundancy circuit detect a fault, the motor drive signal of the first controller and the motor drive signal of the second controller are simultaneously set to zero. The first controller and the second controller control redundancy adjustment circuit simultaneously cut off the first redundancy circuit and the second redundancy circuit, and the aviation dual servo system stops outputting.

[0014] As a further improvement to this application, the motor drive signal of the second controller is set to zero by:

[0015] The power supply to the second redundancy circuit is cut off, and the first controller controls the redundancy adjustment circuit to connect the first redundancy circuit to the three-phase windings of the motor.

[0016] Setting the motor drive signal of the first control controller to zero includes:

[0017] The power supply to the first redundancy circuit is cut off, and the second controller controls the redundancy adjustment circuit to connect the second redundancy circuit to the three-phase winding of the motor, while the first redundancy circuit is disconnected from the three-phase winding of the motor.

[0018] As a further improvement to this application, the operating parameters include:

[0019] Position sensor feedback signal, motor Hall sensor signal, bus current transient sampling value, bus current RMS value, bus voltage sampling value, operating status parameters, host computer communication parameters, and redundancy communication parameters.

[0020] As a further improvement to this application, the controller determines whether a fault has occurred in the first redundancy circuit and the second redundancy circuit in the following ways:

[0021] When any operating parameter of the first redundancy circuit and the second redundancy circuit exceeds the preset parameter threshold, the error counting is activated.

[0022] If any consecutive error count exceeds a preset number, the redundancy circuit is determined to be faulty.

[0023] As a further improvement of this application, if the continuous error count of the position sensor feedback signal exceeds the first preset number N1, it is determined that the position sensor of the redundancy circuit has failed.

[0024] If the continuous error count of the motor Hall sensor signal reaches the second preset number N2, then the motor Hall sensor in the redundancy circuit is determined to be faulty.

[0025] If the consecutive error count of the transient sampling value of the bus current reaches the third preset number N3, then the driver or motor three-phase winding of the redundancy circuit is determined to be short-circuited.

[0026] If the effective value of the bus current is continuously counted to the fourth preset number N4, the redundancy circuit is determined to be locked or short-circuited.

[0027] If the consecutive error count of the bus voltage sampling value reaches the fifth preset number N5, then the power system of the redundancy circuit is determined to be faulty.

[0028] If the continuous error count of the operating status parameters reaches the sixth preset number N6, then the driver or motor three-phase winding of the redundancy circuit is determined to be open circuit fault.

[0029] If the consecutive error count of the host computer communication parameters reaches the seventh preset number N7, then the host computer communication link of the redundancy circuit is determined to be faulty.

[0030] If the consecutive error count of the inter-redundancy communication parameters reaches the eighth preset number N8, then the inter-redundancy communication circuit is determined to be faulty.

[0031] As a further improvement to this application, the generation of the corresponding fault status word includes:

[0032] If the position sensor of the arbitrary redundancy circuit fails, the corresponding fault status word 1 will be set.

[0033] If the motor Hall sensor in the arbitrary redundancy circuit fails, the corresponding fault status word 2 will be set.

[0034] If a short circuit fault occurs in the driver or motor three-phase winding of the arbitrary redundancy circuit, the corresponding fault status word 3 will be set.

[0035] If the arbitrary redundancy circuit is stalled or short-circuited, the corresponding fault status word 4 will be set.

[0036] If the power supply system of the arbitrary redundancy circuit fails, the corresponding fault status word 5 will be set.

[0037] If the driver or motor of the arbitrary redundancy circuit has an open circuit fault, the corresponding fault status word 6 will be set.

[0038] If the host computer communication link of the arbitrary redundancy circuit fails, the corresponding fault status word 7 will be set.

[0039] If the communication circuit between redundancies fails, the corresponding fault status word 8 will be set.

[0040] As a further improvement of this application, the redundancy control circuit includes a Hall signal isolation circuit, a contactor, a first three-phase electrical interface, and a second three-phase electrical interface. The control terminal of the contactor is connected to a first controller and a second controller to receive control signals from the first controller and the second controller. The contactor includes main contacts and auxiliary contacts. One end of the main contact is connected to the first three-phase electrical interface, and the other end is connected to the three-phase winding of the motor. One end of the auxiliary contact is connected to the Hall signal isolation circuit, and the other end is connected to Hall level ground. The first three-phase electrical interface is used to receive the three-phase electrical signal output by the first redundancy circuit, and the second three-phase electrical interface is used to receive the three-phase electrical signal output by the second redundancy circuit. When the first redundancy circuit is working, it controls the main contacts and auxiliary contacts of the contactor to close simultaneously. When the second redundancy circuit is working, it controls the main contacts and auxiliary contacts of the contactor to open simultaneously.

[0041] As a further improvement of this application, the input terminal of the Hall signal isolation circuit is connected to the motor Hall signal interface, and the output terminal includes a first Hall signal interface and a second Hall signal interface. The first Hall signal interface is connected to the first redundancy circuit, and the second Hall signal interface is connected to both the second redundancy circuit and the auxiliary contact of the contactor.

[0042] As a further improvement of this application, the redundancy communication circuit includes a first isolated transceiver circuit and a second isolated transceiver circuit; one end of the first isolated transceiver circuit is connected to the first controller, and the other end is connected to one end of the second isolated transceiver circuit; the other end of the second isolated transceiver circuit is connected to the second controller; the first isolated transceiver circuit and the second isolated transceiver circuit communicate with each other through the CAN communication protocol to transmit their own operating parameters.

[0043] As a further improvement of this application, the first redundancy circuit includes a first motor drive module, and the second redundancy circuit includes a second motor drive module; the first motor drive module includes a first motor Hall signal acquisition circuit, a first logic circuit, a first drive circuit, and a first three-phase inverter bridge circuit connected in sequence.

[0044] The second motor drive module includes a second motor Hall signal acquisition circuit, a second logic circuit, a second drive circuit, and a second three-phase inverter bridge circuit connected in sequence.

[0045] The input terminal of the first motor Hall signal acquisition circuit is connected to the first Hall signal interface; the input terminal of the second motor Hall signal acquisition circuit is connected to the second Hall signal interface; the output terminal of the first three-phase inverter bridge circuit is connected to the first three-phase power interface; and the output terminal of the second three-phase inverter bridge circuit is connected to the second three-phase power interface.

[0046] Compared with the prior art, the present invention can achieve at least one of the following beneficial effects:

[0047] 1. This invention monitors the operating parameters of each component in an aviation dual-redundant servo system and starts an error counter when the detected operating parameters exceed a preset threshold. If the continuous error count exceeds a preset number, the corresponding redundancy circuit is determined to have failed. This invention can monitor the system's operating status in real time, detect faults in a timely manner, and prevent further deterioration of faults, thus improving the real-time performance of detection. By setting different preset counts and thresholds, it can flexibly adapt to different working environments and requirements, enhancing the system's adaptability.

[0048] 2. This invention designs a comprehensive fault diagnosis strategy for various common fault modes that may occur in electric servo systems. By separately judging sensor faults, motor Hall sensor faults, short circuit faults in the three-phase windings of the driver or motor, stall or short circuit faults, power system faults, open circuit faults in the three-phase windings of the driver or motor, upper computer communication link faults, and redundancy communication circuit faults, it can comprehensively monitor and accurately diagnose various common fault modes of electric servo systems, ensuring that corresponding measures can be taken in a timely manner when faults occur, thus improving the fault diagnosis capability and reliability of the system.

[0049] 3. This invention optimizes the redundancy control strategy. When neither the first nor the second redundancy circuit detects a fault, the motor drive signal of the first controller outputs normally, the motor drive signal of the second controller is set to zero, and the second controller controls the redundancy allocation circuit to cut off the second redundancy circuit. When the first redundancy circuit fails but the second redundancy circuit does not detect a fault, the motor drive signal of the second controller outputs normally, the motor drive signal of the first controller is set to zero, and the first controller controls the redundancy allocation circuit to cut off the first redundancy circuit. When both the first and second redundancy circuits detect a fault, the motor drive signals of both the first and second controllers are simultaneously set to zero, and the redundancy allocation circuit is controlled to simultaneously cut off both the first and second redundancy circuits, causing the aviation dual-servo system to stop outputting. This allows for rapid and orderly redundancy switching or system output shutdown based on fault diagnosis results, effectively isolating faults and ensuring the safe operation of the system.

[0050] In this invention, the above-described technical solutions can be combined with each other to achieve more preferred combinations. Other features and advantages of this invention will be set forth in the following description, and some advantages may become apparent from the description or be learned by practicing the invention. The objects and other advantages of this invention can be realized and obtained from what is particularly pointed out in the description and drawings. Attached Figure Description

[0051] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts.

[0052] Figure 1 This is a schematic flowchart of a fault diagnosis and redundancy control method for an aviation dual-redundancy servo system provided in an embodiment of the present invention.

[0053] Figure 2 This is a schematic diagram of the process for generating a corresponding fault status word according to an embodiment of the present invention;

[0054] Figure 3 This is a schematic diagram of an aviation dual-redundant servo system provided in an embodiment of the present invention;

[0055] Figure 4 This is a schematic diagram of a redundancy allocation circuit structure provided in an embodiment of the present invention;

[0056] Figure 5 This is a schematic diagram of a motor drive module structure provided in an embodiment of the present invention. Detailed Implementation

[0057] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, which form part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not intended to limit the scope of the present invention.

[0058] Example 1

[0059] like Figure 1 As shown. A specific embodiment of the present invention discloses a fault diagnosis and redundancy control method for an aviation dual-redundancy servo system. The aviation dual-redundancy servo system includes a first redundancy circuit, a second redundancy circuit, an inter-redundancy communication circuit, and a redundancy allocation circuit. The first redundancy circuit includes a first controller, and the second redundancy circuit includes a second controller. The inter-redundancy communication circuit is used to realize communication between the first redundancy circuit and the second redundancy circuit. The output terminals of both the first redundancy circuit and the second redundancy circuit are connected to the redundancy allocation circuit. The method 100 includes:

[0060] Step 101: The first and second redundancy circuits acquire their respective operating parameters. These operating parameters include: position sensor feedback signals, motor Hall sensor signals, transient bus current sampling values, effective bus current values, bus voltage sampling values, operating status parameters, host computer communication parameters, and inter-redundancy communication parameters. The position sensor feedback signal, collected by the position sensor, is used to monitor the motor rotor's position information and provides motor position feedback to the controller.

[0061] The motor Hall sensor signal is acquired by the motor Hall sensor and is used to detect the magnetic pole position of the motor rotor, providing the controller with the motor commutation signal to determine whether the motor is operating normally. The transient bus current sampling value is the instantaneous value of the motor bus current acquired in real time by a current sensor, used to monitor current changes during motor operation and promptly detect current anomalies. The effective value of the bus current is calculated from the transient bus current sampling value, reflecting the average current level during motor operation, used to determine the motor load and whether overcurrent faults exist. The bus voltage sampling value is the motor bus voltage value acquired by a voltage sensor, used to monitor whether the power supply voltage is normal and promptly detect voltage anomalies. Operating status parameters include information such as the operating mode and control signal output status of the aviation dual-redundant servo system, reflecting the current operating status of the system and the execution of control logic. Host computer communication parameters are relevant parameters for communication with the host computer, such as communication data and communication status, used to assess whether the communication between the system and the host computer is normal. The redundancy communication parameters are the redundancy communication circuit parameters used for communication between the first redundancy circuit and the second redundancy circuit. They are used to determine whether the redundancy communication is normal and to ensure that information such as fault status words can be synchronized in a timely manner.

[0062] Step 102: Based on the operating parameters, the controller determines whether the redundancy of the first redundancy circuit and the second redundancy circuit has failed, and generates the corresponding fault status word.

[0063] The controller determines whether the first redundancy circuit and the second redundancy circuit have failed in the following ways: when any operating parameter of the first redundancy circuit and the second redundancy circuit exceeds a preset parameter threshold, an error counter is started; if any consecutive error count exceeds a preset number, the redundancy circuit is determined to have failed.

[0064] like Figure 2 As shown. If the consecutive error count of the position sensor feedback signal exceeds the first preset number N1, then the position sensor in the redundancy circuit is determined to be faulty.

[0065] If the continuous error count of the motor Hall sensor signal reaches the second preset number N2, then the motor Hall sensor in the redundancy circuit is determined to be faulty.

[0066] If the consecutive error count of the transient sampling value of the bus current reaches the third preset number N3, then the driver or motor three-phase winding of the redundancy circuit is determined to be short-circuited.

[0067] If the effective value of the bus current is continuously counted to the fourth preset number N4, the redundancy circuit is determined to be locked or short-circuited.

[0068] If the consecutive error count of the bus voltage sampling value reaches the fifth preset number N5, then the power system of the redundancy circuit is determined to be faulty.

[0069] If the continuous error count of the operating status parameters reaches the sixth preset number N6, then the driver or motor three-phase winding of the redundancy circuit is determined to be open circuit fault.

[0070] If the consecutive error count of the host computer communication parameters reaches the seventh preset number N7, then the host computer communication link of the redundancy circuit is determined to be faulty.

[0071] If the consecutive error count of the inter-redundancy communication parameters reaches the eighth preset number N8, then the inter-redundancy communication circuit is determined to be faulty.

[0072] The preset number of failures (N1-N8) is determined by analyzing historical fault data and experimental settings. This involves analyzing fault data accumulated during the system's historical operation to statistically analyze the frequency, duration, and characteristics of various faults, thereby establishing a reasonable preset number of failures. Alternatively, various fault scenarios can be simulated to observe the system's response under different preset number of failures, thus determining the appropriate preset number of failures.

[0073] The corresponding fault status word generated includes:

[0074] If the position sensor of the arbitrary redundancy circuit fails, the corresponding fault status word 1 will be set.

[0075] If the motor Hall sensor in the arbitrary redundancy circuit fails, the corresponding fault status word 2 will be set.

[0076] If a short circuit fault occurs in the driver or motor three-phase winding of the arbitrary redundancy circuit, the corresponding fault status word 3 will be set.

[0077] If the arbitrary redundancy circuit is stalled or short-circuited, the corresponding fault status word 4 will be set.

[0078] If the power supply system of the arbitrary redundancy circuit fails, the corresponding fault status word 5 will be set.

[0079] If the driver or motor of the arbitrary redundancy circuit has an open circuit fault, the corresponding fault status word 6 will be set.

[0080] If the host computer communication link of the arbitrary redundancy circuit fails, the corresponding fault status word 7 will be set.

[0081] If the communication circuit between redundancies fails, the corresponding fault status word 8 will be set.

[0082] A fault status word is a binary data structure used to record and identify the operating status of various parts of a system. It typically consists of multiple bits, each corresponding to the fault state of a specific component or functional module within the system. In a dual-redundant servo system for aviation, the fault status word is used to record whether faults have occurred in components such as position sensors, motor Hall sensors, drivers, motor three-phase windings, power systems, host computer communication links, and inter-redundant communication circuits. Each bit in the fault status word is predefined, corresponding to a specific component or function in the system. The first bit indicates whether the position sensor is faulty, the second bit indicates whether the motor Hall sensor is faulty, and so on. When a fault is detected in a component, the corresponding bit is set to 1, indicating that the component is faulty; when the fault is resolved or the system returns to normal, the corresponding bit is reset to 0, indicating that the component has returned to normal.

[0083] Step 103: Synchronize the fault status word between the first redundancy circuit and the second redundancy circuit through the redundancy communication circuit, and execute the redundancy control strategy based on the synchronized fault status word.

[0084] Specifically, the redundancy control strategy based on synchronous fault status words includes:

[0085] Step 1031: If neither the first redundancy circuit nor the second redundancy circuit detects a fault, the motor drive signal of the first controller is output normally, and the motor drive signal of the second controller is set to zero.

[0086] Specifically, setting the motor drive signal of the second controller to zero includes:

[0087] The power supply to the second redundancy circuit is cut off, and the first controller controls the redundancy adjustment circuit to connect the first redundancy circuit to the three-phase windings of the motor.

[0088] When neither the first nor the second redundancy circuit detects a fault, the system is in normal operating condition. At this time, the first controller acts as the main controller, outputting its motor drive signal normally to drive the motor. Simultaneously, the power supply to the second redundancy circuit is cut off, and its motor drive signal is set to zero, not participating in motor drive. After receiving the control command from the first controller, the redundancy adjustment circuit adjusts its internal switching state, connecting the first redundancy circuit to the three-phase windings of the motor. Under normal circumstances, the system is driven by only the first redundancy circuit, while the second redundancy circuit remains in standby mode, ready to take over when needed.

[0089] Step 1032: If the first redundancy circuit fails and the second redundancy circuit does not detect a fault, the motor drive signal of the second controller is output normally, and the motor drive signal of the first controller is set to zero.

[0090] Specifically, setting the motor drive signal of the first control controller to zero includes:

[0091] The power supply to the first redundancy circuit is cut off, and the second controller controls the redundancy adjustment circuit to connect the second redundancy circuit to the three-phase winding of the motor, while the first redundancy circuit is disconnected from the three-phase winding of the motor.

[0092] When the first redundancy circuit fails and the second redundancy circuit does not detect a fault, the system needs to perform redundancy switching to ensure the continuous and stable operation of the motor. At this time, the second controller outputs its motor drive signal normally, taking over the motor drive from the first redundancy circuit. Simultaneously, the power supply to the first redundancy circuit is cut off, the motor drive signal of the first controller is reset to zero, and the output stops. The redundancy adjustment circuit adjusts its internal switching state according to the control commands sent by the second controller, so that the second redundancy circuit connects to the three-phase windings of the motor, while the first redundancy circuit disconnects from the three-phase windings, allowing the second redundancy circuit to smoothly take over the operation of the first redundancy circuit.

[0093] Step 1033: If both the first redundancy circuit and the second redundancy circuit detect a fault, the motor drive signal of the first controller and the motor drive signal of the second controller are simultaneously set to zero.

[0094] If both the first redundancy circuit and the second redundancy circuit detect a fault, the power supply to both circuits will be cut off simultaneously, their respective motor drive signals will be set to zero, and the output of all motor drive signals will be stopped. The aviation dual servo system will then stop outputting, thus avoiding potential risks caused by the fault.

[0095] Compared with existing technologies, the fault diagnosis and redundancy control method for an aviation dual-redundancy servo system provided in this embodiment monitors the operating parameters of each component in the aviation dual-redundancy servo system and starts an error counter when the detected operating parameters exceed a preset threshold. If the continuous error count exceeds a preset number, the corresponding redundancy circuit is determined to have failed. This method can monitor the system's operating status in real time, detect faults in a timely manner, and prevent further deterioration of the faults, thus improving the real-time performance of the detection. By setting different preset counts and thresholds, it can flexibly adapt to different working environments and requirements, enhancing the system's adaptability.

[0096] A comprehensive fault diagnosis strategy was designed to address various common fault modes that may occur in electric servo systems. By identifying sensor faults, motor Hall sensor faults, short circuit faults in the three-phase windings of the driver or motor, stall or short circuit faults, power system faults, open circuit faults in the three-phase windings of the driver or motor, upper computer communication link faults, and redundancy communication circuit faults, the system can comprehensively monitor and accurately diagnose various common fault modes of electric servo systems. This ensures that corresponding measures can be taken in a timely manner when faults occur, thereby improving the system's fault diagnosis capability and reliability.

[0097] By optimizing the redundancy control strategy, when no fault is detected in either the first or second redundancy circuit, the motor drive signal of the first controller outputs normally, the motor drive signal of the second controller is set to zero, and the second controller controls the redundancy allocation circuit to cut off the second redundancy circuit. When the first redundancy circuit fails but no fault is detected in the second redundancy circuit, the motor drive signal of the second controller outputs normally, the motor drive signal of the first controller is set to zero, and the first controller controls the redundancy allocation circuit to cut off the first redundancy circuit. When both the first and second redundancy circuits detect faults, the motor drive signals of both the first and second controllers are simultaneously set to zero, and the redundancy allocation circuit is controlled to simultaneously cut off both the first and second redundancy circuits, causing the aviation dual-servo system to stop outputting. This allows for rapid and orderly redundancy switching or system output shutdown based on fault diagnosis results, effectively isolating faults and ensuring the safe operation of the system.

[0098] Example 2

[0099] like Figure 3 As shown in the figure, a specific embodiment of the present invention discloses an aviation dual-redundancy servo system. The aviation dual-redundancy servo system includes a first redundancy circuit, a second redundancy circuit, an inter-redundancy communication circuit, and a redundancy adjustment circuit. The first redundancy circuit includes a first controller, and the second redundancy circuit includes a second controller. The inter-redundancy communication circuit is used to realize communication between the first redundancy circuit and the second redundancy circuit. The output terminals of the first redundancy circuit, the second redundancy circuit, and the second redundancy circuit are all connected to the redundancy adjustment circuit.

[0100] The first redundancy circuit includes a first controller, which acquires the operating parameters of its own redundancy circuit, determines whether a fault has occurred in its own redundancy based on the operating parameters, and generates a corresponding fault status word. During normal system operation, the first redundancy circuit serves as the main working redundancy, and its motor drive signal is output normally.

[0101] The second redundancy circuit includes a second controller, which acquires the operating parameters of its own redundancy circuit, determines whether a fault has occurred in its own redundancy based on the operating parameters, and generates a corresponding fault status word. In the system default state, it is in hot backup mode, and its motor drive signal is set to zero under normal circumstances. When the first redundancy circuit fails, the second redundancy circuit can take over the operation.

[0102] The redundancy communication circuit is used to enable communication between the first redundancy circuit and the second redundancy circuit, ensuring that they can synchronize fault status words and other information in real time. Through the redundancy communication circuit, the first controller and the second controller can promptly understand the fault status of the other redundancy, thereby making corresponding control decisions.

[0103] The redundancy adjustment circuit is connected to the output terminals of the first redundancy circuit and the second redundancy circuit, and switches or cuts off the redundancy circuit according to the controller's instructions.

[0104] When neither the first nor the second redundancy circuit detects a fault, the system is in normal operating condition. At this time, the first controller acts as the main controller, outputting its motor drive signal normally to drive the motor. Simultaneously, the power supply to the second redundancy circuit is cut off, and its motor drive signal is set to zero, not participating in motor drive. After receiving the control command from the first controller, the redundancy adjustment circuit adjusts its internal switching state, connecting the first redundancy circuit to the three-phase windings of the motor. Under normal circumstances, the system is driven by only the first redundancy circuit, while the second redundancy circuit remains in standby mode, ready to take over when needed.

[0105] If the first redundancy circuit fails but the second redundancy circuit does not detect a fault, the second controller outputs the motor drive signal normally, while the first controller sets the motor drive signal to zero. The power supply to the first redundancy circuit is cut off, and the second controller controls the redundancy adjustment circuit to connect the second redundancy circuit to the motor's three-phase windings, while the first redundancy circuit is disconnected from the motor's three-phase windings. When the first redundancy circuit fails but the second redundancy circuit does not detect a fault, the system needs to perform redundancy switching to ensure the motor's continuous and stable operation. At this time, the second controller outputs the motor drive signal normally, taking over the motor drive from the first redundancy circuit. Simultaneously, the power supply to the first redundancy circuit is cut off, and the first controller's motor drive signal is set to zero, stopping its output. The redundancy adjustment circuit adjusts its internal switching state according to the control commands sent by the second controller, connecting the second redundancy circuit to the motor's three-phase windings and disconnecting the first redundancy circuit from the motor's three-phase windings, allowing the second redundancy circuit to smoothly take over the operation of the first redundancy circuit.

[0106] If both the first redundancy circuit and the second redundancy circuit detect a fault, the power supply to both circuits will be cut off simultaneously, their respective motor drive signals will be set to zero, and the output of all motor drive signals will be stopped. The aviation dual servo system will then stop outputting, thus avoiding potential risks caused by the fault.

[0107] Furthermore, the redundancy adjustment circuit includes a Hall signal isolation circuit, a contactor, a first three-phase electrical interface, and a second three-phase electrical interface. The control terminal of the contactor is connected to the first controller and the second controller to receive control signals from the first controller and the second controller. The contactor includes main contacts and auxiliary contacts. One end of the main contact is connected to the first three-phase electrical interface, and the other end is connected to the three-phase winding of the motor. One end of the auxiliary contact is connected to the Hall signal isolation circuit, and the other end is connected to Hall level ground. The second three-phase electrical interface is directly connected to the motor winding interface. The first three-phase electrical interface is used to receive the three-phase electrical signal output by the first redundancy circuit, and the second three-phase electrical interface is used to receive the three-phase electrical signal output by the second redundancy circuit. When the first redundancy circuit is working, it controls the main contacts and auxiliary contacts of the contactor to close simultaneously. When the second redundancy circuit is working, it controls the main contacts and auxiliary contacts of the contactor to open simultaneously.

[0108] like Figure 4 As shown, the input of the Hall signal isolation circuit is connected to the motor Hall signal interface, and the output includes a first Hall signal interface and a second Hall signal interface. The first Hall signal interface is connected to the first motor drive module, and the second Hall signal interface is connected to both the second motor drive module and the auxiliary contact of the contactor. Both the first and second Hall signal interfaces include an H+ interface, an H- interface, a Sa interface, an Sb interface, and a Sc interface; wherein, the H+ interface, Sa interface, Sb interface, and Sc interface are connected in series with a reverse diode, and the H- interface is connected in series with a forward diode.

[0109] The H+ and H- interfaces are the power supply interfaces for the Hall sensor, while the Sa, Sb, and Sc interfaces are the output signal interfaces. The Hall sensor generates different level signals on the Sa, Sb, and Sc interfaces by sensing changes in the magnetic field of the motor rotor. Connecting diodes in series in the Hall sensor interface circuit enables power and signal isolation between the first and second circuits, preventing the Hall signal of the first circuit from being pulled low by the contactor when the Hall signal of the second drive module is pulled low.

[0110] The contactor's main contacts control the opening and closing of the first three-phase power output to the motor winding interface, while the auxiliary contacts control the validity of the second Hall signal. When the first redundancy circuit is active, the contactor's main and auxiliary contacts are closed, the first controller outputs a drive signal to the motor winding, and the Hall signal input of the second redundancy circuit is forcibly grounded. Under this Hall signal logic, the output of the second redundancy circuit is disabled, and its three-phase power output interface is in a high-impedance state. When the second redundancy circuit is active, the contactor's main and auxiliary contacts are open, the drive signal output by the first redundancy circuit cannot be transmitted to the motor winding, and the Sa, Sb, and Sc interfaces of the second Hall signal interface are disconnected from the Hall level ground.

[0111] The first three-phase power interface is used to connect the three-phase power output of the first redundancy circuit. The three-phase power (U, V, W phases) is used to generate a rotating magnetic field to drive the motor rotor. The first three-phase power interface connects the first redundancy circuit and the redundancy adjustment circuit. The three-phase power signal output from the first three-phase power interface is transmitted to the motor winding interface (U', V', W') through the main contacts of the contactor in the redundancy adjustment circuit, thereby driving the motor to run. When redundancy switching is required, the contactor in the redundancy adjustment circuit, under the control of the first controller or the second controller, opens the main contacts. The second motor drive module outputs a three-phase power signal, which is transmitted to the motor winding interface (U', V', W') through the contactor, ensuring the motor operation and realizing the dual-redundancy control function.

[0112] Furthermore, the redundancy communication circuit includes a first isolated transceiver circuit and a second isolated transceiver circuit; one end of the first isolated transceiver circuit is connected to the first controller, and the other end is connected to one end of the second isolated transceiver circuit; the other end of the second isolated transceiver circuit is connected to the second controller; the first isolated transceiver circuit and the second isolated transceiver circuit communicate with each other through the CAN communication protocol to transmit their own operating parameters.

[0113] The first and second isolated transceiver circuits communicate via the CAN communication protocol to achieve bidirectional information transmission. The status parameters of the first controller are encoded and sent through the first isolated transceiver circuit. This information, after being transmitted via the CAN communication protocol, is received by the second isolated transceiver circuit and then transmitted to the second controller. The corresponding status parameters of the second controller are then sent to the first controller through the second isolated transceiver circuit.

[0114] When the first redundancy circuit fails, the first controller encodes the fault information using the CAN communication protocol and sends it to the second controller via the first isolation transceiver circuit. The second controller's second isolation transceiver circuit receives the fault information from the first controller and sends it back to the second controller. The first normally closed switch circuit of the first controller then opens, cutting off external power supply to the first controller.

[0115] When the second redundancy circuit fails, the second controller sends the fault information to the first controller via the second isolation transceiver circuit after encoding it using the CAN communication protocol. After the first controller receives the fault information sent by the second controller, the second normally closed switch circuit of the second controller is opened, and the power supply from the external power source to the power supply circuit of the second controller is cut off.

[0116] like Figure 5 As shown. The first redundancy circuit also includes a first motor drive module, and the second redundancy circuit includes a second motor drive module; the first motor drive module includes a first motor Hall signal acquisition circuit, a first logic circuit, a first drive circuit, and a first three-phase inverter bridge circuit connected in sequence; the second motor drive module includes a second motor Hall signal acquisition circuit, a second logic circuit, a second drive circuit, and a second three-phase inverter bridge circuit connected in sequence.

[0117] The input terminal of the first motor Hall signal acquisition circuit is connected to the first Hall signal interface; the input terminal of the second motor Hall signal acquisition circuit is connected to the second Hall signal interface; the output terminal of the first three-phase inverter bridge circuit is connected to the first three-phase power interface; and the output terminal of the second three-phase inverter bridge circuit is connected to the second three-phase power interface.

[0118] The output of either the first or second motor drive module is transmitted to the motor windings via a redundancy adjustment circuit to drive the aircraft servo motor. When the first redundancy circuit is active, the three-phase power output from the first three-phase inverter bridge circuit of the first motor drive module is transmitted to the motor windings through the first three-phase power interface and the contactor main contacts of the redundancy adjustment circuit, driving the motor. When the second redundancy circuit is active, the three-phase power output from the second three-phase inverter bridge circuit of the second motor drive module is transmitted to the motor windings through the second three-phase power interface, driving the motor.

[0119] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware, and the program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.

[0120] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A fault diagnosis and redundancy control method for an aviation dual-redundancy servo system, characterized in that, The aviation dual-redundant servo system includes a first redundancy circuit, a second redundancy circuit, an inter-redundancy communication circuit, and a redundancy allocation circuit. The first redundancy circuit includes a first controller, and the second redundancy circuit includes a second controller; the redundancy communication circuit is used to realize communication between the first redundancy circuit and the second redundancy circuit. The output terminals of both the first redundancy circuit and the second redundancy circuit are connected to the redundancy adjustment circuit; the method includes: The first redundancy circuit and the second redundancy circuit acquire the operating parameters of their respective redundancy circuits. Based on the operating parameters, the controller determines whether the redundancy of the first redundancy circuit and the second redundancy circuit has failed, and generates the corresponding fault status word. The fault status word is synchronized between the first and second redundancy circuits via an inter-redundancy communication circuit. Based on the synchronized fault status word, a redundancy control strategy is executed, including: If no fault is detected in either the first redundancy circuit or the second redundancy circuit, the motor drive signal of the first controller will be output normally, and the motor drive signal of the second controller will be set to zero. If the first redundancy circuit fails and the second redundancy circuit does not detect a fault, the motor drive signal of the second controller will be output normally, and the motor drive signal of the first controller will be set to zero. If both the first redundancy circuit and the second redundancy circuit detect a fault, the motor drive signal of the first controller and the motor drive signal of the second controller are simultaneously set to zero, and the aviation dual servo system stops outputting.

2. The method according to claim 1, characterized in that, The method further includes: Setting the motor drive signal of the second controller to zero includes: The power supply to the second redundancy circuit is cut off, and the first controller controls the redundancy adjustment circuit to connect the first redundancy circuit to the three-phase windings of the motor. Setting the motor drive signal of the first control controller to zero includes: The power supply to the first redundancy circuit is cut off, and the second controller controls the redundancy adjustment circuit to connect the second redundancy circuit to the three-phase winding of the motor, while the first redundancy circuit is disconnected from the three-phase winding of the motor.

3. The method according to claim 1, characterized in that, The operating parameters include: Position sensor feedback signal, motor Hall sensor signal, bus current transient sampling value, bus current RMS value, bus voltage sampling value, operating status parameters, host computer communication parameters, and redundancy communication parameters.

4. The method according to claim 3, characterized in that, The controller determines whether the first redundancy circuit and the second redundancy circuit have failed in the following ways: When any operating parameter of the first redundancy circuit and the second redundancy circuit exceeds the preset parameter threshold, the error counting is activated. If any consecutive error count exceeds a preset number, the redundancy circuit is determined to be faulty.

5. The method according to claim 4, characterized in that, If the consecutive error count of the position sensor feedback signal exceeds the first preset number N1, it is determined that the position sensor of the redundancy circuit has failed. If the continuous error count of the motor Hall sensor signal reaches the second preset number N2, then the motor Hall sensor in the redundancy circuit is determined to be faulty. If the consecutive error count of the transient sampling value of the bus current reaches the third preset number N3, then the driver or motor three-phase winding of the redundancy circuit is determined to be short-circuited. If the effective value of the bus current is continuously counted to the fourth preset number N4, the redundancy circuit is determined to be locked or short-circuited. If the consecutive error count of the bus voltage sampling value reaches the fifth preset number N5, then the power system of the redundancy circuit is determined to be faulty. If the continuous error count of the operating status parameters reaches the sixth preset number N6, then the driver or motor three-phase winding of the redundancy circuit is determined to be open circuit fault. If the consecutive error count of the host computer communication parameters reaches the seventh preset number N7, then the host computer communication link of the redundancy circuit is determined to be faulty. If the consecutive error count of the inter-redundancy communication parameters reaches the eighth preset number N8, then the inter-redundancy communication circuit is determined to be faulty.

6. The method according to claim 5, characterized in that, The corresponding fault status word generated includes: If the position sensor of the arbitrary redundancy circuit fails, the corresponding fault status word 1 will be set. If the motor Hall sensor in the arbitrary redundancy circuit fails, the corresponding fault status word 2 will be set. If a short circuit fault occurs in the driver or motor three-phase winding of the arbitrary redundancy circuit, the corresponding fault status word 3 will be set. If the arbitrary redundancy circuit is stalled or short-circuited, the corresponding fault status word 4 will be set. If the power supply system of the arbitrary redundancy circuit fails, the corresponding fault status word 5 will be set. If the driver or motor of the arbitrary redundancy circuit has an open circuit fault, the corresponding fault status word 6 will be set. If the host computer communication link of the arbitrary redundancy circuit fails, the corresponding fault status word 7 will be set. If the communication circuit between redundancies fails, the corresponding fault status word 8 will be set.

7. The method according to claim 1, characterized in that, The redundancy adjustment circuit includes a Hall signal isolation circuit, a contactor, a first three-phase power interface, and a second three-phase power interface; the control terminal of the contactor is connected to the first controller and the second controller to receive control signals from the first controller and the second controller; the contactor includes main contacts and auxiliary contacts, one end of the main contacts is connected to the first three-phase power interface, and the other end is connected to the three-phase winding of the motor; One end of the auxiliary contact is connected to the Hall signal isolation circuit, and the other end is connected to the Hall level ground. The first three-phase electrical interface is used to receive the three-phase electrical signal output by the first redundancy circuit, and the second three-phase electrical interface is used to receive the three-phase electrical signal output by the second redundancy circuit. When the first redundancy circuit is working, it controls the main contacts and auxiliary contacts of the contactor to close simultaneously. When the second redundancy circuit is working, it controls the main contacts and auxiliary contacts of the contactor to open simultaneously.

8. The method according to claim 7, characterized in that, The input of the Hall signal isolation circuit is connected to the motor Hall signal interface, and the output includes a first Hall signal interface and a second Hall signal interface. The first Hall signal interface is connected to the first redundancy circuit, and the second Hall signal interface is connected to both the second redundancy circuit and the auxiliary contact of the contactor.

9. The method according to claim 1, characterized in that, The redundancy communication circuit includes a first isolation transceiver circuit and a second isolation transceiver circuit; one end of the first isolation transceiver circuit is connected to the first controller, and the other end is connected to one end of the second isolation transceiver circuit. The other end of the second isolated transceiver circuit is connected to the second controller; The first and second isolated transceiver circuits communicate via the CAN communication protocol to transmit their own operating parameters to each other.

10. The method according to claim 9, characterized in that, The first redundancy circuit includes a first motor drive module, and the second redundancy circuit includes a second motor drive module; the first motor drive module includes a first motor Hall signal acquisition circuit, a first logic circuit, a first drive circuit, and a first three-phase inverter bridge circuit connected in sequence. The second motor drive module includes a second motor Hall signal acquisition circuit, a second logic circuit, a second drive circuit, and a second three-phase inverter bridge circuit connected in sequence. The input terminal of the first motor Hall signal acquisition circuit is connected to the first Hall signal interface; the input terminal of the second motor Hall signal acquisition circuit is connected to the second Hall signal interface; the output terminal of the first three-phase inverter bridge circuit is connected to the first three-phase power interface; and the output terminal of the second three-phase inverter bridge circuit is connected to the second three-phase power interface.

Images