Wind turbine actuator control method and system based on dual controllers

Abstract

Provided are a wind turbine executor control method and system based on a double-controller, the double-controller including a first controller and a second controller that are data-synchronized with each other, output control ports of the first controller and the second controller being connected to controlled components of a wind turbine executor, the wind turbine executor control method including: taking the first controller as a master controller to control the controlled components of the wind turbine executor to run, and taking the second controller as a backup controller to monitor a running state of the first controller in real time; in response to monitoring that the first controller triggers an abnormal condition, dynamically adjusting an abnormality judgment strategy for the first controller based on real-time vibration data of a wind turbine cabin, and performing a false switchover judgment based on the adjusted abnormality judgment strategy; and in response to the false switchover judgment passing, switching the second controller to the master controller to control the running of the controlled components of the wind turbine executor.

Description

Technical Field

[0001] This application relates to the field of wind power, and more specifically, to a wind turbine actuator control method and system based on dual controllers. Background Technology

[0002] Currently, the physical architecture of mainstream thermal control systems typically adopts either a centralized or distributed approach. A centralized thermal control system uses a master controller (e.g., a programmable logic controller (PLC)) to collect temperature signals from each heat-generating component and schedules actuators (e.g., air-cooled actuators, water-cooled actuators) through logic operations. A distributed thermal control system equips each subsystem, such as the generator, gearbox, and converter, with a dedicated controller that operates according to independent logic.

[0003] From an operational perspective, the mainstream control mode is the threshold switching control mode: when the temperature reaches a set threshold, the cooling equipment is activated, and when the temperature drops to the lower limit, the cooling equipment is deactivated. Specifically, multiple temperature thresholds can be set for key components such as generator windings, gearbox oil sump, and converter power modules (e.g., 65℃ (warning), 75℃ (full load start), 85℃ (over-temperature shutdown)). The cooling equipment can be controlled in stages: when the temperature is below the lower limit, the equipment stops completely; as the temperature exceeds the threshold, it is activated step by step; and when the upper warning limit is exceeded, the unit's power reduction or shutdown protection is triggered. The advantage of the above control mode is its simple and reliable logic, and it is not easily affected by signal noise. The disadvantage is that the cooling power output is discontinuous, and the temperature is prone to repeated fluctuations due to system thermal inertia. Under transient conditions, it is prone to oscillations of "starting, stopping, and starting again."

[0004] Taking the cooling system of a wind turbine generator as an example, in actual operation, the vibration spectrum of the nacelle often has multiple resonance peaks in the range of 5Hz to 200Hz, and the effective value of vibration acceleration often exceeds 0.5g. Under this environment, the annual failure rate of a single controller can reach 3%-5%, of which 60% manifest as: I / O module contact chatter, communication bus interruption, CPU program crashes, or watchdog timer false resets. Once the controller fails, the cooling interruption will cause gearbox oil temperature or generator winding over-temperature alarms within 10-30 minutes, thereby triggering the unit to operate at reduced power or to shut down for protection. A single shutdown can result in a loss of power generation ranging from several thousand to tens of thousands of yuan. Summary of the Invention

[0005] One of the purposes of this disclosure is to provide a control method that can significantly improve the reliability of wind turbine actuators.

[0006] According to a first aspect of this disclosure, a wind turbine actuator control method based on dual controllers is provided. The dual controllers include a first controller and a second controller that synchronize data with each other. The output control ports of the first controller and the second controller are respectively connected to the controlled components of the wind turbine actuator. The wind turbine actuator control method includes: using the first controller as the main controller to control the operation of the controlled components of the wind turbine actuator, and using the second controller as a backup controller to monitor the operating status of the first controller in real time; in response to detecting that the first controller triggers an abnormal condition, dynamically adjusting the abnormal judgment strategy for the first controller based on real-time vibration data of the wind turbine nacelle, and performing a fault-prevention switching judgment based on the adjusted abnormal judgment strategy; in response to the fault-prevention switching judgment passing, switching the second controller to the main controller to control the operation of the controlled components of the wind turbine actuator.

[0007] In some embodiments, dynamically adjusting the anomaly determination strategy for the first controller based on real-time vibration data of the wind turbine nacelle may include: dynamically adjusting at least one of the determination window duration for confirming abnormal conditions, the sampling and detection cycle, and the fault confirmation threshold based on real-time vibration data.

[0008] In some embodiments, dynamically adjusting the determination window duration for confirming abnormal conditions may include: determining a target vibration level based on real-time vibration data; matching a preset determination window duration based on the target vibration level; wherein, the greater the vibration intensity corresponding to the target vibration level, the longer the matching determination window duration.

[0009] In some embodiments, the anti-misoperation switching judgment based on the adjusted anomaly judgment strategy may include: reconfirming the abnormal conditions of the first controller using a judgment rule corresponding to the target vibration level, based on the judgment window duration matched to the target vibration level.

[0010] In some embodiments, reconfirming the abnormal conditions of the first controller using a decision rule corresponding to the target vibration level may include: confirming the first controller as abnormal when the target vibration level is the first vibration level and the decision results of multiple cycles within the decision window duration all indicate that the abnormal conditions are met; confirming the first controller as abnormal when the target vibration level is the second vibration level, extending the decision window duration to a preset delay duration and starting a delay timer, continuously monitoring the abnormal conditions of the first controller and the target vibration level during the delay timer, confirming the first controller as abnormal when the delay timer expires and the abnormal conditions continue to be met; and confirming the first controller as normal when the target vibration level decreases and the abnormal conditions no longer continue to be met during the delay timer.

[0011] In some embodiments, the abnormal conditions may include at least one of the following: the synchronous bus communication link between the first controller and the second controller is disconnected; the data packet loss rate between the first controller and the second controller exceeds a first preset threshold; the response of the second controller to the first controller exceeds a preset time; the hardware diagnostic of the first controller is abnormal; the deviation between the actual control output of the first controller and the redundant output calculated by the second controller based on the same input data as the first controller exceeds a second preset threshold.

[0012] In some embodiments, using the first controller as the main controller to control the controlled components of the wind turbine actuator, and using the second controller as a backup controller to monitor the operating status of the first controller in real time, may include: performing a power-on self-test on the first controller and the second controller; in response to the first power-on self-test result of the first controller being greater than the second power-on self-test result of the second controller, using the first controller as the main controller and the second controller as the backup controller; in response to the first power-on self-test result of the first controller being equal to the second power-on self-test result of the second controller and the identification number of the first controller being less than the identification number of the second controller, using the first controller as the main controller and the second controller as the backup controller.

[0013] In some embodiments, switching the second controller to the master controller to control the operation of the controlled components of the wind turbine actuator may include: the second controller sending a control deprivation signal to the hardware enable loop of the first controller to physically disconnect the output control port of the first controller; the second controller unlocking its own output control port and taking over the control of the controlled components of the wind turbine actuator.

[0014] In some embodiments, taking over control of the controlled components of the wind turbine actuator may include: extracting the latest mirror control output value calculated in real time in parallel by the second controller; and sending the latest mirror control output value to the controlled components of the wind turbine actuator.

[0015] In some embodiments, the controlled component of the wind turbine actuator may include a wind turbine cooling device, the output control port of the first controller is connected to the coil control terminal of the first relay, the output control port of the second controller is connected to the coil control terminal of the second relay, and the contacts of the first and second relays are connected to the main control circuit of the wind turbine cooling device.

[0016] According to a second aspect of this disclosure, a wind turbine actuator control system based on dual controllers includes: a vibration sensor for acquiring real-time vibration data of the wind turbine nacelle; a first controller, the output control port of which is connected to a controlled component of the wind turbine actuator and is initially designated as the master controller; and a second controller, which is synchronized with the first controller and its output control port is connected to the controlled component and is initially designated as the backup controller. The second controller is configured to: dynamically adjust an anomaly detection strategy for the first controller based on real-time vibration data in response to detecting an abnormal condition triggered by the first controller, and perform a fault-prevention switching judgment based on the adjusted anomaly detection strategy; and switch the second controller to the master controller to control the operation of the controlled component of the wind turbine actuator in response to the fault-prevention switching judgment passing.

[0017] In some embodiments, the wind turbine actuator control system may further include a temperature sensor, and the controlled component includes a wind turbine heat dissipation device. After the second controller switches to the main controller, it controls the wind turbine heat dissipation device in a closed loop based on the temperature sensed by the temperature sensor.

[0018] The wind turbine actuator control method according to the embodiments of this disclosure effectively avoids controller erroneous switching or oscillation caused by vibration transient impact by introducing vibration-sensing adaptive anti-mis-switching judgment, thereby improving the stability and reliability of the system under harsh operating conditions. Attached Figure Description

[0019] Figure 1 This is a schematic diagram illustrating a wind turbine actuator control system according to an embodiment of the present disclosure.

[0020] Figure 2 This is a schematic diagram illustrating a wind turbine actuator control system according to an embodiment of the present disclosure.

[0021] Figure 3 This is a flowchart illustrating a wind turbine actuator control method according to a first embodiment of the present disclosure.

[0022] Figure 4 This is a flowchart illustrating a control switching process under abnormal conditions according to an embodiment of the present disclosure.

[0023] Figure 5 This is a flowchart illustrating a wind turbine actuator control method according to a second embodiment of the present disclosure.

[0024] Figure 6 This is a schematic diagram illustrating the timing of vibration environment anti-misoperation switching decisions according to an embodiment of the present disclosure. Detailed Implementation

[0025] The following detailed description is provided to aid in obtaining a full understanding of the methods, apparatus, and / or systems described herein. However, the order of operations described herein is merely illustrative and is not limited to those orders set forth herein; equivalent substitutions or changes may be made, except for operations that must occur or be performed in a specific order. Furthermore, for clarity and conciseness, descriptions of content well-known in the art will be omitted or simplified.

[0026] Unless otherwise defined, all terms used herein (including technical and scientific terms) shall have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure pertains upon understanding this disclosure. Unless expressly defined herein, terms (such as those defined in a general dictionary) shall be interpreted as having a meaning consistent with their meaning in the context of the relevant field and in this disclosure, and shall not be interpreted in an idealized or overly formalistic manner.

[0027] Unless otherwise specified, the same reference numerals generally refer to the same elements (e.g., components, steps, and methods). Reference numerals described in previous embodiments that reappear in later embodiments may be omitted. Furthermore, technical features described in different or the same embodiments can be combined in any way, as long as the combined embodiment or technical solution is complete and can solve the technical problems of this application or achieve the technical effects described or not described in this disclosure but which can be determined based on the complete technical solution described above. The embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

[0028] Figure 1 This is a schematic diagram illustrating a wind turbine actuator control system according to an embodiment of the present disclosure. Figure 2 This is a schematic diagram illustrating a wind turbine actuator control system according to an embodiment of the present disclosure.

[0029] Reference Figure 1 and Figure 2 The wind turbine actuator control system based on dual controllers disclosed herein may include a vibration sensor 100, a first controller 200, and a second controller 300.

[0030] The vibration sensor 100 can be installed in various locations inside the wind turbine nacelle. For example, the vibration sensor 100 can be securely installed on the surface of core transmission components such as the main bearing housing, gearbox housing, and generator bearing inside the wind turbine nacelle to collect mechanical vibration acceleration or frequency signals of the nacelle in real time.

[0031] The vibration sensor 100 can transmit the collected vibration signal to the first controller 200 and the second controller 300, thereby enabling real-time assessment of the vibration intensity during the operation of the wind turbine, and dynamically adjusting the judgment window duration, sampling detection cycle and fault confirmation threshold (which will be described in detail later), to accurately identify minor faults and transient impacts.

[0032] The vibration sensor 100 may be a single sensor, but its signal may be simultaneously connected in parallel to the analog input channels of the first controller 200 and the second controller 300.

[0033] Both the first controller 200 and the second controller 300 can use the same model of industrial-grade programmable logic controller (PLC). The first controller 200 and the second controller 300 can have independent power supply modules (each connected to a different UPS power supply circuit) to prevent power failure.

[0034] The first controller 200 and the second controller 300 are not limited to traditional PLCs. The first controller 200 and the second controller 300 can be flexibly implemented using various embedded hardware and software architectures. In addition to programmable logic controllers (PLCs), the first controller 200 and the second controller 300 can also be replaced with field-programmable gate arrays (FPGAs), digital signal processors (DSPs), microcontroller units (MCUs), or various single-chip microcomputers. If necessary, corresponding auxiliary components can also be set, and these auxiliary components can also be part of the controller.

[0035] Furthermore, in specific deployments, the first controller 200, which serves as the main controller, and the second controller 300, which serves as the backup controller, can adopt a homogeneous hardware form (e.g., the same model of PLC as described above), such as a dual PLC or dual MCU architecture, or they can adopt a heterogeneous hardware combination, such as the main controller using a DSP with stronger processing algorithm capabilities, and the backup controller using an FPGA with faster response speed and higher hardware reliability.

[0036] In one example, the first controller 200 and the second controller 300 can be installed in the cabin at a predetermined distance (e.g., at a distance greater than 0.5m), and each can be suspended using a vibration damper. The I / O modules of the first controller 200 and the second controller 300 can be spring terminals or round pin terminals.

[0037] Reference Figure 1 The signal output terminal of the vibration sensor 100 is connected in parallel to the signal input terminals of the first controller 200 and the second controller 300 via independent data acquisition buses.

[0038] The second controller 300 can synchronize data with the first controller 200, and the output control port of the second controller 300 is connected to the controlled component. The second controller 300 can be initially designated as a backup controller. In one example, the first controller 200 and the second controller 300 can communicate bidirectionally via a CAN bus to transmit handshake heartbeat signals, operating status data, and control negotiation commands in real time.

[0039] In one example, the first controller 200 may send a synchronization frame to the second controller 300 every 50ms (for high-frequency critical signals) or 200ms (for general temperature signals). The data packet structure of the synchronization frame may include a frame header, a timestamp (system time), an array of raw sensor values, intermediate variables of the control algorithm (e.g., PID deviation integral, derivative term, fuzzy logic membership degree, etc.), actuator output instructions (switching status), a main controller health status word, cyclic redundancy check (CRC) check, etc.

[0040] Each controller can maintain a 2-byte health status word, with the bit definitions shown in Table 1 below.

[0041] Table 1

[0042] After receiving the synchronization frame from the first controller 200, the second controller 300 first checks the CRC, then stores all data in the local mirror register, and then performs cross-verification using the sensor values ​​it independently collects with the sensor values ​​sent by the first controller 200. If the deviation exceeds a preset threshold, the "inconsistency counter" is incremented, and if it exceeds 10 times / minute, an early warning can be issued (but switching can be avoided).

[0043] The second controller 300 can run the exact same control algorithm as the first controller 200 in the background, calculate its own output instructions, but does not output to the port (the port is prohibited by hardware lock).

[0044] Reference Figure 1 and Figure 2 The fan actuator 500 may include fan cooling equipment (e.g., cooling fan), and the actuator may be an on / off actuator; however, this disclosure is not limited thereto.

[0045] Reference Figure 2 The cooling fan control circuit 510 includes a control power supply L, a control power supply N, a cooling fan motor, and a switching component (which can be one or more) controlled by the dual controllers.

[0046] Reference Figure 2The control power supply L is connected sequentially to the first end of PLC1 contact K1 via wires. The second end of PLC1 contact K1 is connected to the first end of PLC2 contact K2. The second end of PLC2 contact K2 is connected to the input end of the cooling fan motor. The output end of the cooling fan motor is connected to the control power supply N, thus forming a control loop consisting of PLC1 contact K1 and PLC2 contact K2 connected in series. Although Figure 2 Two switching components are shown as part of the first controller 200 and the second controller 300, respectively. However, this disclosure is not limited thereto. The switching components can be independent of these two controllers. For example, the switching components can be relays. The number of switching components and the connection method (parallel connection in addition to series connection) are not specifically limited.

[0047] The output control port of the first controller 200 can be connected to the controlled component of the wind turbine actuator, and the first controller is initially determined to be the master controller.

[0048] Specifically, the digital output port DO of the first controller 200 is connected to the control terminal of contact K1 of PLC1, and is used to drive the contact K1 to close and open according to temperature signals and vibration signals. The digital output port DO of the second controller 200 is connected to the control terminal of contact K2 of PLC2, and is used to drive the contact K2 to close and open according to temperature signals and vibration signals.

[0049] When the system is working, temperature data or signals and vibration data or signals are input in parallel to the first controller 200 and the second controller 300. After processing by the internal algorithm, the first controller 200 and the second controller 300 send control commands to contacts K1 and K2 respectively. Only when contacts K1 and K2 are closed simultaneously can the current path from the control power supply L through contacts K1 and K2 to the cooling fan motor and finally back to the power supply N be fully connected, thereby driving the cooling fan to start running.

[0050] Both PLC contacts K1 and K2 can be normally open contacts. The normally open relay contact K1 of the first controller 200 is connected in series with the normally open contact K2 of the second controller 300, which then controls the fan contactor coil. The fan can only start when both PLC contacts K1 and K2 are closed simultaneously. If either controller output is disconnected, the fan stops. This ensures that if either controller erroneously outputs a "closed" signal due to vibration, the fan will not start unilaterally.

[0051] In one example, after the control handover is completed, the first controller 200 can still output a high level to "close" the switching component. In another example, the two switching components can be connected in parallel. After the control handover is completed, the output of the first controller 200 can be latched, and the output control signal of the second controller 300 closes the switching component, thereby connecting the power supply circuit. However, this is merely an example, and the number of switching components, connection method, and control method of this disclosure are not limited to these.

[0052] Furthermore, the cooling fan is merely an example of a fan actuator; the fan actuator 500 may also include other cooling devices such as an oil pump / water pump 520. The aforementioned switching assembly may be part of the first controller 200 and the second controller 300; however, this is only an example. As mentioned above, the aforementioned switching assembly may also be a relay relay, etc., independent of the first controller 200 and the second controller 300.

[0053] Reference Figure 1 The digital output terminals of the first controller 200 and the second controller 300 can be connected in parallel to the control input terminals of the oil pump (e.g., oil pump contactor coil) and the water pump (e.g., water pump contactor coil), respectively. The main power supply circuits of the oil pump and the water pump can adopt the same dual controller output contact series topology as the cooling fan. The connection method between the first controller 200 and the second controller 300 and these controlled components can be similar.

[0054] The wind turbine actuator control system based on dual controllers disclosed herein may further include a temperature sensor 400. The temperature sensor 400 and vibration sensor 100 can synchronously transmit the real-time monitored temperature and vibration signals to the first controller 200 and the second controller 300. The first controller 200 and the second controller 300 collaboratively issue drive commands according to their respective control strategies. Only when both controllers simultaneously confirm the need to start the corresponding fluid circulation can the series contacts of the corresponding oil pump or water pump close simultaneously to connect the power supply and start the pump. When any controller detects an abnormality or fault, it can individually disconnect the corresponding output contact, achieving hardware-level veto and bypass control of the oil pump, water pump, and fan. However, this is merely an example, and the control method for the wind turbine actuator disclosed herein is not limited to this.

[0055] In addition to switching components, the controlled components of the wind turbine actuator disclosed herein may also include frequency converters, etc. These frequency converters, under the control of the first controller 200 and the second controller 300, can adjust the power supply frequency of the motor to achieve precise control of the motor speed, thereby controlling the operation of the controlled components including the motor. The second controller 300, after switching to the main controller, can perform closed-loop control of the wind turbine cooling equipment based on the temperature sensed by the temperature sensor.

[0056] The second controller 300 can respond to the detection of abnormal conditions triggered by the first controller 200, dynamically adjust the abnormal judgment strategy for the first controller based on real-time vibration data, and perform anti-misoperation switching judgment based on the adjusted abnormal judgment strategy. Furthermore, in response to the successful anti-misoperation switching judgment, it can switch the second controller to the main controller to control the operation of the controlled components of the wind turbine actuator. The following is in conjunction with... Figure 3 and Figure 4 The execution steps of the first controller 200 and the second controller 300 are described in detail.

[0057] Figure 3 This is a flowchart illustrating a wind turbine actuator control method according to a first embodiment of the present disclosure. Figure 4 This is a flowchart illustrating the control handover process under abnormal conditions according to an embodiment of the present disclosure. Figure 5 This is a flowchart illustrating a wind turbine actuator control method according to a second embodiment of the present disclosure. Figure 6 This is a schematic diagram illustrating the timing of vibration environment anti-misoperation switching decisions according to an embodiment of the present disclosure.

[0058] Reference Figure 3 The wind turbine actuator control method disclosed herein may include steps S310, S320, S330, S340 and S350.

[0059] In step S310, the main controller and the backup controller are determined. Specifically, the first controller can be used as the main controller to control the controlled components of the wind turbine actuator, and the second controller can be used as the backup controller to monitor the operating status of the first controller in real time.

[0060] In one example, the primary / standby role can be determined (e.g., arbitration) during the power-on self-test of the first and second controllers. In general, a default first and second controller can be set; for example, if both the first and second controllers test normally, the first controller can be designated as the primary controller, and the second controller as the standby controller.

[0061] In one example, after each device completes its hardware self-test and I / O loop diagnosis, it performs master-slave role arbitration to determine the initial master controller and the slave controller. The master can enable the output port, and the slave can disable the output port (the hardware relay disconnects the output loop).

[0062] In one example, the master controller can perform the following steps at a fixed cycle: collect data from the temperature sensor and store it in a local cache; run a heat dissipation PID / fuzzy control algorithm; and perform closed-loop temperature control.

[0063] In addition, the main controller can calculate multiple digital outputs and multiple analog outputs, and can write the output values ​​to the I / O module, package them into a synchronization frame (including sensor data, intermediate variables, output values, health words, etc.), and send them to the backup controller (Slave) via the CAN bus.

[0064] In one example, after receiving the synchronization frame data, the slave controller can store the mirrored data and run the same algorithm to calculate its own output value (for comparison), perform cross-validation, and update the inconsistency counter.

[0065] In step S320, it can be determined whether the first controller, which is the main controller, has triggered an abnormal condition.

[0066] The standby controller (Slave) can perform fault detection and switching, and can execute fixed switching decision logic.

[0067] In addition to the abnormal master controller status shown in Table 1 (e.g., any one of Bit0, Bit1, Bit2, or Bit5 in the received master controller health status word is 1), abnormal conditions may also include communication interruption conditions, such as the continuous loss of 3 heartbeat / synchronization frames (i.e., no valid data for 150ms) and the output inconsistency between the master controller and the backup controller, such as the output command calculated by the backup controller's own algorithm being inconsistent with the received command and the deviation exceeding 50% (e.g., the master controller outputs the fan at full speed, while the backup controller should calculate to stop) for more than 5 minutes, that is, master controller drift occurs.

[0068] Specifically, abnormal conditions may include: a disconnection of the synchronous bus communication link between the first controller and the second controller; a data packet loss rate between the first controller and the second controller exceeding a first preset threshold; the second controller's response to the first controller exceeding a preset time; a hardware diagnostic malfunction in the first controller; or a deviation between the actual control output of the first controller and the redundant output calculated by the second controller based on the same input data as the first controller exceeding a second preset threshold. The switching process can proceed if any of the above abnormal conditions are met. However, this is merely an example; to prevent interference from vibration, the control method of this disclosure may perform a further determination based on vibration signals.

[0069] In step S330, in response to the detection that the first controller (i.e., the main controller) triggers an abnormal condition, the abnormal judgment strategy for the first controller can be dynamically adjusted based on the real-time vibration data of the wind turbine nacelle.

[0070] In one example, to address momentary communication interruptions or watchdog timer malfunctions caused by vibration, a triaxial MEMS accelerometer (range ±4g, sampling rate 1kHz) can be used during vibration monitoring of the wind turbine nacelle. This accelerometer calculates the effective value of the composite vibration vector every 10ms, and then determines the vibration intensity or level based on this effective value. As an example, the vibration level can be divided into three levels: normal vibration, moderate vibration, and strong vibration. The anomaly detection strategy for the first controller is dynamically adjusted based on real-time vibration data from the wind turbine nacelle, and anti-misoperation switching is performed based on the adjusted anomaly detection strategy. Different anomaly detection strategies can be executed according to the magnitude of the vibration level.

[0071] The anomaly detection strategy here can include various anomaly detection methods. For example, the cutoff frequency and filter order of the signal filter can be dynamically adjusted according to the real-time vibration intensity. Under strong vibration, the digital filter strength can be increased to filter out high-frequency mechanical noise, and under stable operating conditions, the filter delay can be reduced to improve response sensitivity.

[0072] For example, a calculation model that can adaptively switch fault judgment weights can reduce the weight of physically sensitive indicators such as single-communication packet loss or voltage transients under medium to high vibration conditions, and increase the weight of multi-period statistical characteristics and trend terms.

[0073] In addition, anomaly detection strategies may include dynamic switching verification mechanisms, such as upgrading from single CRC verification to continuous multi-frame retransmission and secondary comparison verification when vibration intensifies; and adjusting the decay and acceleration rate of the fault tolerance counter to slow down the accumulation rate of the fault count and accelerate the decay of the recovery count under strong vibration impact.

[0074] For example, based on real-time vibration data, at least one of the following can be dynamically adjusted: the judgment window duration for confirming abnormal conditions, the sampling and detection cycle, and the fault confirmation threshold.

[0075] In step S340, the decision on whether to pass the anti-misoperation switching judgment is determined based on the adjusted anomaly detection strategy. This establishes a closed-loop adaptive adjustment between the vibration environment intensity and the fault-tolerant mechanism of the control algorithm.

[0076] In one example, vibration data (e.g., cabin acceleration data) can be continuously acquired through vibration sensors and vibration levels can be classified. Under no vibration or weak vibration levels, the default basic sampling period and short decision window are used to achieve millisecond-level rapid response and real-time fault switching for abnormal conditions such as communication interruption, data error or controller failure.

[0077] If the real-time vibration data rises to the level of moderate vibration, in order to eliminate high-frequency signal jitter, wiring micro-jitter, and occasional packet loss interference caused by vibration, a judgment window expansion mechanism can be automatically triggered. This expands the originally short diagnosis time to a long window covering multiple consecutive sampling periods. A majority consensus voting algorithm is introduced into the expanded window. This voting algorithm can statistically analyze the communication and operation status of each independent sampling period within the window. Only when the cumulative number of abnormal periods reaches or exceeds a preset statistical absolute majority threshold is it confirmed as a real fault. If the threshold is not reached, the occasional abnormality is zeroed out and judged as vibration noise, thereby significantly improving the anti-maloperation capability under moderate vibration environment.

[0078] When the vibration data reaches the level of strong vibration impact, a delayed secondary confirmation strategy can be initiated to further expand the judgment window and simultaneously start a delay timer. During the timer's operation, continuous dynamic monitoring of the abnormal conditions of the first controller and the vibration data is maintained. If the abnormal conditions continue to be met when the timer expires, the fault is confirmed and control rights are forcibly stripped and switched. If the vibration intensity drops during the delay period and the main controller communication returns to normal, the switching command can be automatically canceled and the timer reset to prevent transient false switching under strong impact.

[0079] In one example, closed-loop iterative resampling of the sampling period can also be implemented (i.e., dynamically adjusting the timer interrupt trigger frequency or data extraction ratio of the next stage using the vibration change rate collected in the previous period). This improves the sampling resolution under strong vibration and relaxes the sampling period in a stable state to reduce the computational power consumption of the algorithm, thereby achieving a balance between safety and fault tolerance and response time.

[0080] Specifically, the target vibration level can be determined based on real-time vibration data; a preset judgment window duration is matched based on the target vibration level, wherein the greater the vibration intensity corresponding to the target vibration level, the longer the matching judgment window duration.

[0081] The error prevention switching judgment based on the adjusted anomaly judgment strategy may include: reconfirming the abnormal conditions of the first controller based on the judgment window duration matched with the target vibration level, using a decision rule corresponding to the target vibration level. Specifically, it may include: in response to the target vibration level being the first vibration level and the judgment results of multiple cycles within the judgment window (or decision window) duration all indicating that the abnormal conditions are met, then confirming that the first controller is abnormal; in response to the target vibration level being the second vibration level, extending the judgment window duration to a preset delay duration and starting a delay timer, during which the abnormal conditions of the first controller and the target vibration level are continuously monitored, in response to the delay timer expiring and the abnormal conditions continuing to be met, then confirming that the first controller is abnormal; in response to the target vibration level not continuously being met during the delay timer period, then confirming that the first controller is not abnormal.

[0082] Reference Figure 6 If the vibration level is less than 0.8g (normal operating condition, normal vibration), the decision window can be 3 cycles (60ms), meaning switching occurs after 3 consecutive frames are lost. If the vibration level is greater than or equal to 0.8g and less than 1.8g (moderate vibration), the decision window can be automatically extended to 10 cycles (200ms). Within the 200ms window, if at least 7 cycles fail to receive a valid frame, it is considered a real fault. If the vibration level is greater than or equal to 1.8g (strong vibration), the decision window can be extended to 30 cycles (600ms), and a delayed confirmation strategy is adopted: after the trigger condition is met, switching does not start immediately, but a delay timer for a predetermined time (e.g., 600ms) is started. When the timer ends, a check is performed again. If the condition is still met, switching occurs. If the vibration subsides and the main controller returns to normal during the delay timer, the switching is automatically canceled.

[0083] If the anti-misoperation switching judgment in step S340 passes, in step S350, the second controller is switched to the main controller to control the operation of the controlled components of the wind turbine actuator.

[0084] If a switchover is triggered, the second controller (i.e., the backup controller) can immediately force the primary controller's output enable loop to disconnect via a hardware signal (a dedicated "primary controller disabled" output point). The backup controller can then unlock its own output ports and apply the most recently calculated output value to the actuators, for example, to control the various controlled components in a cooling fan.

[0085] In another example, the slave controller can update its role to master and broadcast a "switchover complete" message. If the original master controller subsequently recovers and detects the existence of a new master controller, it automatically enters slave mode and begins synchronization. For example, the faulty first controller can be hot-swapped. After the new first controller is inserted, it can perform a self-test, actively listen to the bus, and if it detects an existing master controller, it joins the system as a slave. The new slave can obtain complete operating parameters (such as PID integral values, historical temperature curves, etc.) from the current master through a "data backfill" request, achieving seamless synchronization. However, this is just an example. If the original master controller recovers and detects the existence of a new master controller, it can take over control again. For example, it can synchronize the data of the existing new master, unlock its own output ports, and apply the most recently calculated output value to the actuators.

[0086] The determination of the primary controller and the backup controller can be performed during the power-on self-test (POST). For example, the specific process of using the first controller as the primary controller to control the controlled components of the wind turbine actuator and the second controller as the backup controller to monitor the operating status of the first controller in real time is as follows: Perform a power-on self-test on the first and second controllers. If the first power-on self-test result of the first controller (e.g., self-test score) is greater than the second power-on self-test result of the second controller, then the first controller is designated as the primary controller and the second controller as the backup controller. If the first power-on self-test result of the first controller is equal to the second power-on self-test result of the second controller and the identification number of the first controller is less than the identification number of the second controller, then the first controller is designated as the primary controller and the second controller as the backup controller. The power-on self-test result here refers to the evaluation data generated by the controller after performing a comprehensive diagnosis of its own hardware, communication, and logic status during initialization or operation. This evaluation data can be represented as a binary status identifier or a comprehensive health score calculated by weighting multiple indicators such as CPU load, memory verification, communication packet loss rate, and contact response. This score can intuitively reflect the controller's operational reliability. When the score is lower than a preset threshold, it is judged as abnormal and can be used as the basis for triggering abnormal warnings, reducing weight, or performing control switching. However, this is just an example. The determination method and arbitration method of the main controller and backup controller in this disclosure are not limited to this. Specific examples are shown in Table 2 below.

[0087] Table 2

[0088] During the control switching or handover process, the second controller can send a control deprivation signal to the hardware enable loop of the first controller to physically disconnect the output control port of the first controller. The second controller can unlock its own output control port and take over the control of the controlled components of the wind turbine actuator. Specifically, the first controller can extract the latest mirror control output value calculated in real time by the second controller and send the latest mirror control output value to the controlled components of the wind turbine actuator.

[0089] Reference Figure 4 The control switching process under abnormal conditions according to the embodiments of the present disclosure may include steps S410, S420, S430, S440, S450, S460 and S470.

[0090] In step S410, the main controller performs heat dissipation control and sends heartbeat and synchronization data. Based on the collected temperature and vibration data, the main controller runs the heat dissipation control algorithm, issues commands to drive the heat dissipation actuator, and simultaneously broadcasts heartbeat packets and synchronization data frames periodically to the backup controller via the communication bus, transmitting its own operating status and control parameters to the backup controller in real time to maintain information synchronization between the two controllers.

[0091] In step S420, the standby controller receives synchronization data from the master controller and performs hot backup operation.

[0092] For example, the backup controller can parse the received sensor data and control status in real time and run the same heat dissipation algorithm in parallel in the background to ensure that the algorithm context of the backup controller is completely consistent with that of the main controller, while keeping the output enable off state so as not to interfere with the main controller's control of the wind turbine actuator.

[0093] In step S430, the backup controller continuously monitors the health of the primary controller. The backup controller can detect the heartbeat packet reception interval, communication data frame integrity, and the health status of the primary controller in real time. If the primary controller is detected to be operating normally, the current primary-backup cooperation mode is maintained; if the detected fault characteristics meet the preset preliminary switching conditions, the process proceeds to the next stage of the disturbance environment adaptive window decision stage.

[0094] In step S440, an adaptive window decision for the disturbed environment is performed.

[0095] Specifically, the backup controller can assess the vibration intensity by combining real-time vibration data and dynamically expand the judgment time window and add a secondary confirmation delay accordingly. If it is determined within the expanded window that the abnormality is only caused by transient vibration false triggering or noise interference, the false triggering is ignored and the process returns to step S410; if the abnormality persists after the window expires, the main controller is confirmed to have experienced a real failure.

[0096] In step S450, after confirming that a real fault has occurred in the main controller, the standby controller switches to the main controller and enables it to take over the output.

[0097] For example, the backup controller can upgrade itself to become the main controller, unlock the enabled state of the output control port, and directly take over the control signal output to actuators such as cooling fans and pumps by closing the corresponding contactor or drive bypass control circuit.

[0098] In step S460, the new main controller independently drives the actuator and issues a fault alarm signal from the original main controller.

[0099] The new main controller uses real-time sensor feedback to control the start, stop, and speed of the cooling equipment in a closed loop, ensuring uninterrupted fan cooling. At the same time, it can report the specific fault codes of the original main controller to the host computer or the fan main control system, prompting on-site personnel to intervene in maintenance.

[0100] In step S470, after the original faulty controller is repaired, software reset, or restarted and returns to normal, it automatically enters standby mode.

[0101] For example, once the controller returns to normal, it performs a hardware self-test again. After confirming that its health meets the standards, it actively requests access from the current new master controller, acts as a backup controller to receive data synchronization, and locks the output port, thus restoring the entire system to a dual-controller hot standby redundancy architecture.

[0102] Reference Figure 5 The wind turbine actuator control method according to the second embodiment of the present disclosure may include steps S501, S502, S503, S504, S505, S506, S507, S508, S509 and S510.

[0103] In step S501, the system starts a self-test of the dual controllers after power-on or receiving an initialization command.

[0104] Specifically, the two controllers can run their built-in hardware diagnostics and software logic testing programs to comprehensively evaluate the microprocessor core status, memory read / write verification, bus communication interface connectivity, and external I / O ports, and generate corresponding self-test results.

[0105] In step S502, based on the self-test results of the generated dual controllers, interactive arbitration is conducted via the communication bus to negotiate and determine the primary / backup roles. The controller with the higher score or priority is determined as the primary controller, taking over the dominant control of fan cooling and operation; the controller with a relatively lower score or that is a preset redundant backup is determined as the backup controller, thus completing the allocation of primary and backup roles in the initial state of the system.

[0106] In step S503, the determined main controller takes the lead in controlling the operation of the system. The main controller collects environmental and unit operation data sent by temperature and vibration sensors in real time, inputs the data into the built-in heat dissipation control algorithm for real-time calculation, generates control commands for actuators such as fans, oil pumps, and water pumps, and drives the corresponding relays to operate through the output control port of the main controller, thereby controlling the heat dissipation equipment.

[0107] In step S504, while performing heat dissipation control, the main controller periodically sends heartbeat signals and synchronization data frames to the backup controller via communication buses such as CAN. The heartbeat signals are used to report the status of the main controller to the backup controller in real time, while the synchronization data frames contain the raw sensor data collected by the main controller, the intermediate calculation results of the algorithm, and the current actuator control status, ensuring that the backup controller can grasp the system's operating information in real time.

[0108] In step S505, the backup controller receives the heartbeat signal and synchronization data sent by the main controller and performs hot backup operation. The backup controller uses the synchronized data to run the same heat dissipation control algorithm in parallel, calculates the control result to keep the algorithm state consistent with the main controller, but at this time the output port of the backup controller can be locked, and does not output actual drive signals to external actuators, only serving as a redundancy backup.

[0109] In step S506, the backup controller continuously monitors the health of the main controller. The backup controller determines the status of the main controller by checking whether the heartbeat frame has timed out, whether the CRC check of the synchronization data is abnormal, and whether the self-test result is lower than the safety threshold. If the detection results show that the main controller is normal, the current main / backup operation continues; if an abnormality is detected in the main controller and the trigger condition is met, vibration adaptive decision is made.

[0110] In step S507, in response to an abnormal condition triggered by health monitoring, the system enters the vibration adaptive decision stage. Real-time cabin vibration acceleration collected by vibration sensors can be read, and the decision window duration, sampling period, and fault confirmation threshold are adaptively adjusted according to the vibration intensity. If the decision result indicates that the abnormality is merely a transient disturbance caused by strong vibration impact, the disturbance is ignored and the system returns to step S503; if the abnormality is confirmed as a real fault, a switching command is issued.

[0111] In step S508, after confirming that the main controller has experienced a real fault, the standby controller performs a takeover output action.

[0112] Specifically, the backup controller can unlock its own output port and drive the corresponding takeover contactor or bypass circuit to close, connecting its own control output to the control circuit of actuators such as cooling fans, oil pumps and water pumps, while simultaneously depriving the faulty original main controller of its control authority, thus completing the takeover of control at the hardware and logic levels.

[0113] In step S509, the new master controller, having completed the takeover of control, officially begins to independently drive the actuators.

[0114] Specifically, the new main controller can independently run the heat dissipation algorithm and send drive signals based on the real-time collected temperature sensor data to maintain the normal operation of the heat dissipation system. At the same time, the new main controller sends out fault alarm information of the original main controller through the system bus or the host computer alarm interface to prompt the operation and maintenance personnel to check and maintain the faulty controller.

[0115] In step S510, after the original main controller is troubleshooted or the system is reset and resumes normal operation, it can be automatically downgraded to standby mode.

[0116] Specifically, the restored original main controller performs a self-test again and establishes a connection with the new main controller via the communication bus. It receives synchronization data from the new main controller, locks its own output port, and re-enters the hot backup monitoring state as a backup controller, thereby restoring the system's dual-controller redundancy protection.

[0117] The steps of the wind turbine actuator control methods of the first and second embodiments of this disclosure can be combined with each other to obtain different switching steps and control right determination steps, etc. Furthermore, the steps in the control right switching process according to the embodiments of this disclosure can be combined with relevant steps of the wind turbine actuator control methods of the first and second embodiments to obtain different control flows. The term "dual controller" in this disclosure refers to at least two controllers, but is not limited to having only two controllers.

[0118] According to exemplary embodiments of the present disclosure, a computer-readable storage medium storing computer program instructions and an apparatus including the computer-readable storage medium may be provided, wherein the instructions, when executed by at least one computing device (e.g., a processor or a controller), cause the at least one computing device to perform at least one of the above steps.

[0119] The instructions stored in the aforementioned computer-readable storage medium can be executed in environments deployed in computer devices such as clients, hosts, agent devices, and servers. It should be noted that the aforementioned instructions can also be used to perform additional steps beyond those described above, or to perform more specific processing while executing the aforementioned steps. The details of these additional steps and further processing are already provided in the reference... Figures 1 to 6 As mentioned in the description of the relevant systems and methods, they will not be repeated here to avoid repetition.

[0120] The wind turbine actuator control method based on dual controllers according to embodiments of this disclosure effectively resists the interference of vibration environment on the control system through the heterogeneous redundancy architecture of the main controller and the backup controller and the state arbitration mechanism.

[0121] The wind turbine actuator control method based on dual controllers according to the embodiments of this disclosure can ensure that the wind turbine actuator can still operate stably when any single controller fails.

[0122] The wind turbine actuator control method based on dual controllers according to embodiments of this disclosure can improve system stability and reliability.

[0123] The specific embodiments of this disclosure have been described in detail above. Although some embodiments have been shown and described, those skilled in the art should understand that these embodiments can be combined, modified and improved without departing from the principles and spirit of this disclosure as defined by the claims and their equivalents. Such combinations, modifications and improvements should also be within the protection scope of this disclosure.

Claims

1. A wind turbine actuator control method based on dual controllers, wherein, The dual controllers include a first controller and a second controller that synchronize data with each other. The output control ports of the first controller and the second controller are respectively connected to the controlled components of the wind turbine actuator. The wind turbine actuator control method includes: The first controller is used as the main controller to control the operation of the controlled components of the wind turbine actuator, and the second controller is used as a backup controller to monitor the operating status of the first controller in real time. In response to the detection of abnormal conditions triggered by the first controller, the abnormal judgment strategy for the first controller is dynamically adjusted based on the real-time vibration data of the wind turbine nacelle, and the anti-misoperation switching judgment is performed based on the adjusted abnormal judgment strategy. In response to the successful error prevention switching judgment, the second controller is switched to the main controller to control the operation of the controlled components of the wind turbine actuator.

2. The wind turbine actuator control method based on dual controllers according to claim 1, wherein, The dynamic adjustment strategy for anomaly detection of the first controller based on real-time vibration data of the wind turbine nacelle includes: Based on the real-time vibration data, at least one of the following is dynamically adjusted: the determination window duration for confirming the abnormal conditions, the sampling and detection cycle, and the fault confirmation threshold.

3. The wind turbine actuator control method based on dual controllers according to claim 2, wherein, Dynamically adjust the duration of the judgment window for confirming the abnormal conditions, including: The target vibration level is determined based on the real-time vibration data; The target vibration level is matched with a preset judgment window duration; The greater the vibration intensity corresponding to the target vibration level, the longer the matching judgment window duration.

4. The wind turbine actuator control method based on dual controllers according to claim 3, wherein, The error prevention handover judgment based on the adjusted anomaly detection strategy includes: Based on the decision window duration matched with the target vibration level, the abnormal conditions of the first controller are reconfirmed using the decision rule corresponding to the target vibration level.

5. The wind turbine actuator control method based on dual controllers according to claim 4, wherein, The abnormal conditions of the first controller are reconfirmed using a decision rule corresponding to the target vibration level, including: If the target vibration level is the first vibration level and the judgment results of multiple cycles within the judgment window all indicate that the abnormal condition is met, the first controller is confirmed to be abnormal. In response to the target vibration level being the second vibration level, the determination window duration is extended to a preset delay duration and a delay timer is started. During the delay timer, the abnormal conditions of the first controller and the target vibration level are continuously monitored. In response to the delay timer timing out and the abnormal condition remaining in effect, the first controller is confirmed to be abnormal. In response to the target vibration level decreasing during the delay timer and the abnormal condition no longer remaining in effect, the first controller is confirmed to be normal.

6. The wind turbine actuator control method based on dual controllers according to claim 1, wherein, The abnormal condition includes at least one of the following conditions: The synchronous bus communication link between the first controller and the second controller is disconnected; The data packet loss rate between the first controller and the second controller exceeds a first preset threshold; The second controller's response to the first controller exceeds a preset time; The hardware diagnostics of the first controller are faulty; The deviation between the actual control output of the first controller and the redundant output calculated by the second controller based on the same input data as the first controller exceeds a second preset threshold.

7. The wind turbine actuator control method based on dual controllers according to claim 1, wherein, The first controller is used as the main controller to control the operation of the controlled components of the wind turbine actuator, and the second controller is used as a backup controller to monitor the operating status of the first controller in real time, including: Perform power-on self-tests on the first controller and the second controller; In response to the first power-on self-test result of the first controller being greater than the second power-on self-test result of the second controller, the first controller is designated as the main controller and the second controller is designated as the backup controller. In response to the first power-on self-test result of the first controller being equal to the second power-on self-test result of the second controller and the identity number of the first controller being less than the identity number of the second controller, the first controller is designated as the main controller and the second controller is designated as the backup controller.

8. The wind turbine actuator control method based on dual controllers according to claim 1, wherein, The step of switching the second controller to the main controller to control the operation of the controlled components of the wind turbine actuator includes: The second controller sends a control preemption signal to the hardware enable loop of the first controller to physically disconnect the output control port of the first controller; The second controller unlocks its own output control port and takes over the control of the controlled components of the wind turbine actuator.

9. The wind turbine actuator control method based on dual controllers according to claim 8, wherein, Taking over control of the controlled components of the wind turbine actuator, including: Extract the latest mirror control output value calculated in real time and in parallel by the second controller; The latest mirror control output value is sent to the controlled component of the wind turbine actuator.

10. The wind turbine actuator control method based on dual controllers according to claim 1, wherein, The controlled components of the wind turbine actuator include a wind turbine cooling device. The output control port of the first controller is connected to the coil control terminal of the first relay, and the output control port of the second controller is connected to the coil control terminal of the second relay. The contacts of the first relay and the second relay are connected to the main control circuit of the wind turbine cooling device.

11. A wind turbine actuator control system based on dual controllers, wherein, include: Vibration sensors acquire real-time vibration data of the wind turbine nacelle; A first controller, the output control port of the first controller is connected to the controlled component of the wind turbine actuator, and the first controller is initially determined to be the master controller; The second controller is synchronized with the first controller, and its output control port is connected to the controlled component. The second controller is initially designated as a backup controller. The second controller is configured as follows: In response to the detection of abnormal conditions triggered by the first controller, the abnormal judgment strategy for the first controller is dynamically adjusted based on the real-time vibration data, and the anti-misoperation switching judgment is performed based on the adjusted abnormal judgment strategy. In response to the successful error prevention switching judgment, the second controller is switched to the main controller to control the operation of the controlled components of the wind turbine actuator.

12. The wind turbine actuator control system based on dual controllers according to claim 11, wherein, The wind turbine actuator control system also includes a temperature sensor, and the controlled component includes a wind turbine cooling device. After the second controller switches to the main controller, it controls the wind turbine cooling device in a closed loop based on the temperature sensed by the temperature sensor.

Images