A dual three-phase motor redundant control system

Abstract

The application discloses a dual three-phase motor redundancy control system, comprising: an upper controller, used for outputting a working mode instruction to a first digital controller and a second digital controller; an FPGA, electrically connected with the two digital controllers, used for making any digital controller a current effective digital controller; the first digital controller, electrically connected with a first group of three-phase windings and a second group of three-phase windings respectively; the second digital controller, electrically connected with the first group of three-phase windings and the second group of three-phase windings respectively; when the first digital controller or the second digital controller is determined as the current effective digital controller, a control instruction is sent based on the working mode instruction received from the upper controller and the two groups of three-phase windings, and the two groups of three-phase windings are synchronously controlled. In the application, when any digital controller is invalid, the remaining controller can be used to control the two sets of three-phase windings at the same time, so that the stable operation of all the three-phase windings is ensured.

Description

Technical Field

[0001] This invention relates to the fields of motor drive and embedded control technology, and in particular to a dual three-phase motor redundant control system. Background Technology

[0002] Dual three-phase permanent magnet synchronous motors have two sets of three-phase stator windings and can be driven by two sets of three-phase inverters. Due to the physical separation of the windings and power channels, dual three-phase motors are widely used in high-reliability electric drive applications. However, redundancy in the motor windings and power devices does not necessarily mean that the control system has the same level of fault tolerance. Failure in any critical component, such as the control chip, power supply, clock, sampling interface, communication interface, or PWM output interface, may lead to drive control interruption.

[0003] One existing approach uses a single digital controller to control all windings. While this approach is simple in structure, the controller and its power supply or peripheral circuitry constitute a significant single point of failure. When the controller program malfunctions, the clock is lost, the power supply is abnormal, or the PWM output is faulty, both sets of windings of the dual three-phase motor cannot be controlled normally.

[0004] Another existing approach uses two digital controllers to control one set of three-phase windings in a dual three-phase motor. When one digital controller fails, the other can continue to control the remaining three-phase windings, but the number of available windings and inverter capacity decreases, leading to a decline in output torque, dynamic performance, or thermal margin. In safety-critical applications such as steering, braking, and aerodynamics, retaining only partial output capacity may be insufficient to maintain the intended function.

[0005] Therefore, a control system is needed to solve the problem in the existing technology that when a digital controller fails, only the operation of the remaining three-phase windings can be guaranteed, and the operation of all three-phase windings cannot be guaranteed. Summary of the Invention

[0006] In view of this, the present invention provides a dual three-phase motor redundancy control system, the main purpose of which is to solve the problem that the operation of all three-phase windings cannot be guaranteed when a digital controller fails.

[0007] To address the aforementioned problems, this application provides a dual three-phase motor redundancy control system, comprising: The host controller is used to output operating mode commands to the first digital controller and the second digital controller. A field-programmable gate array (FPGA) is electrically connected to the first digital controller and the second digital controller, and is used to control the first digital controller or the second digital controller as the currently active digital controller. The first digital controller is electrically connected to the first group of three-phase windings and the second group of three-phase windings respectively. When it is determined to be the currently effective digital controller, it sends control commands to the first group of three-phase windings and the second group of three-phase windings based on the working mode command received from the upper controller, so as to perform synchronous control on the first group of three-phase windings and the second group of three-phase windings. The second digital controller is electrically connected to the first group of three-phase windings and the second group of three-phase windings respectively. When it is determined to be the currently effective digital controller, it sends control commands to the first group of three-phase windings and the second group of three-phase windings based on the working mode command received from the upper controller, so as to perform synchronous control on the first group of three-phase windings and the second group of three-phase windings.

[0008] Optionally, the system further includes: a signal distribution unit; The host controller is electrically connected to the first digital controller and the second digital controller through the signal distribution unit; The host controller is used to send working mode instructions to the signal distribution unit; The signal distribution unit is used to forward the operating mode command to the first digital controller and the second digital controller based on the independent first signal channel and the second signal channel.

[0009] Optionally, the system further includes: a first three-phase inverter and a second three-phase inverter; The first digital controller is electrically connected to the first set of three-phase windings through the first three-phase inverter and electrically connected to the second set of three-phase windings through the second three-phase inverter; the first digital controller is also used to send a PWM sequence to the first three-phase inverter and the second three-phase inverter based on the operating mode command received from the upper controller when it is determined to be the currently effective digital controller; The second digital controller is electrically connected to the first three-phase winding via the first three-phase inverter and to the second three-phase winding via the second three-phase inverter; the second digital controller is used to send a PWM sequence to the first three-phase inverter and the second three-phase inverter based on the operating mode command received from the upper controller when it is determined to be the currently effective digital controller; The first three-phase inverter and the second three-phase inverter are used to receive PWM sequences sent by the first digital controller or the second digital controller, and convert the PWM sequences into control commands to perform synchronous control on the first group of three-phase windings and the second group of three-phase windings.

[0010] Optionally, the FPGA is further configured to: acquire the operating information of the first digital controller and the second digital controller, perform fault monitoring on the first digital controller and the second digital controller based on the operating information, obtain fault monitoring results including fault categories, and output controller switching instructions or set the current state of the system based on the fault monitoring results.

[0011] Optionally, the system further includes: a PWM hardware interlock unit; The PWM hardware interlock unit includes: a first channel gate corresponding to the output channel of the first digital controller, a second channel gate corresponding to the output channel of the second digital controller, and a signal receiving terminal; The signal receiving end of the PWM hardware interlock unit is electrically connected to the FPGA. The PWM hardware interlock unit is used to: receive a controller switching command sent by the FPGA; based on the controller switching command, use the first channel gating to open the output channel of the first digital controller and use the second channel gating to block the output channel of the second digital controller, so as to control the first digital controller as the currently valid digital controller and control the second digital controller as the currently invalid digital controller; or based on the controller switching command, use the first channel gating to block the output channel of the first digital controller and use the second channel gating to open the output channel of the second digital controller, so as to control the first digital controller as the currently invalid digital controller and control the second digital controller as the currently valid digital controller.

[0012] Optionally, the system further includes: a control state synchronization unit; The control state synchronization unit is electrically connected to the first digital controller and the second digital controller; The control state synchronization unit is used to receive target control state data sent by the currently valid digital controller and forward the target control state data to the currently invalid digital controller, so that the currently invalid digital controller can perform consistency verification and state data alignment processing based on the target control state data and local control state data.

[0013] Optionally, the fault categories include: hard fault categories and soft fault categories; When the fault category is a soft fault category, the FPGA determines whether the predetermined controller switching conditions are met based on the cumulative information of the soft faults. If the controller switching conditions are not met, the current state of the system is set based on the soft fault category. If the controller switching conditions are met, a takeover preparation signal is sent to the currently inactive digital controller. When the fault category is a hard fault category, the FPGA is used to send a takeover preparation signal to the currently inactive digital controller; The currently invalid digital controller is used to perform state data alignment processing based on the takeover preparation signal, according to the target control state data received from the currently valid digital controller and the local control state data.

[0014] Optionally, the FPGA is further configured to: receive health confirmation information sent by the currently invalid digital controller, and send a controller switching command to the PWM hardware interlock unit based on the health confirmation information.

[0015] Optionally, the system further includes a gate drive unit; The output terminal of the gate drive unit is electrically connected to the input terminals of the first three-phase inverter and the second three-phase inverter; The input terminal of the gate drive unit is electrically connected to the output terminals of the first digital controller and the second digital controller; The gate drive unit is used to receive the PWM sequence sent by the currently active digital controller, convert the PWM sequence into a voltage drive signal, and send it to the first three-phase inverter and the second three-phase inverter.

[0016] Optionally, the system further includes: a power supply unit; the power supply unit includes: A plurality of power supply branches are provided, each of which is electrically connected to the first digital controller, the second digital controller, and the FPGA, for supplying power to the first digital controller, the second digital controller, and the FPGA.

[0017] The dual three-phase motor redundancy control system in this application connects two digital controllers simultaneously to two sets of three-phase windings (the first set of three-phase windings and the second set of three-phase windings). When any digital controller fails, the remaining controller can be used to control both sets of three-phase windings simultaneously, ensuring the stable operation of all three-phase windings. By setting a field-programmable gate array (FPGA), it is possible to control any digital controller as the currently effective digital controller, preventing two digital controllers from simultaneously outputting control commands to two sets of three-phase windings, thus avoiding control conflict problems.

[0018] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0019] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings: Figure 1 This is a schematic diagram of a dual three-phase motor redundant control system architecture according to an embodiment of this application; Figure 2 This is a schematic diagram of a redundant control system architecture for a dual three-phase motor, which is another embodiment of this application. Detailed Implementation

[0020] Various embodiments and features of this application are described herein with reference to the accompanying drawings.

[0021] It should be understood that various modifications can be made to the embodiments described herein. Therefore, the above description should not be considered as limiting, but merely as an example of embodiments. Other modifications within the scope and spirit of this application will be apparent to those skilled in the art.

[0022] The accompanying drawings, which are included in and form part of this specification, illustrate embodiments of the present application and, together with the general description of the present application given above and the detailed description of the embodiments given below, serve to explain the principles of the present application.

[0023] These and other features of this application will become apparent from the following description of preferred forms of embodiments given as non-limiting examples, with reference to the accompanying drawings.

[0024] It should also be understood that although this application has been described with reference to some specific examples, those skilled in the art can certainly implement many other equivalent forms of this application.

[0025] The above and other aspects, features and advantages of this application will become more apparent when taken in conjunction with the accompanying drawings and in view of the following detailed description.

[0026] Specific embodiments of this application are described thereafter with reference to the accompanying drawings; however, it should be understood that the claimed embodiments are merely examples of this application, which can be implemented in various ways. Well-known and / or repeated functions and structures are not described in detail to avoid unnecessary or redundant details that could obscure the application. Therefore, the specific structural and functional details claimed herein are not intended to be limiting, but merely to serve as a representative basis for teaching those skilled in the art to use this application in a variety of substantially any suitable detailed structures.

[0027] This specification may use the phrases “in one embodiment,” “in another embodiment,” “in yet another embodiment,” or “in other embodiments,” all of which may refer to one or more of the same or different embodiments according to this application.

[0028] This application provides a dual three-phase motor redundancy control system, such as... Figure 1 As shown, it includes: a host controller, a field-programmable gate array (FPGA), a first digital controller, and a second digital controller.

[0029] Specifically, the output terminal of the host controller is electrically connected to the input terminals of the first controller and the second digital controller, and is used to output working mode instructions to the first digital controller and the second digital controller. The field-programmable gate array (FPGA) is electrically connected to the first digital controller and the second digital controller, and is used to control the first digital controller or the second digital controller to be the currently active digital controller. The first digital controller is electrically connected to the first group of three-phase windings and the second group of three-phase windings respectively. When it is determined to be the currently effective digital controller, it sends control commands to the first group of three-phase windings and the second group of three-phase windings based on the working mode command received from the upper controller, so as to perform synchronous control on the first group of three-phase windings and the second group of three-phase windings. The second digital controller is electrically connected to the first group of three-phase windings and the second group of three-phase windings respectively. When it is determined to be the currently effective digital controller, it sends control commands to the first group of three-phase windings and the second group of three-phase windings based on the working mode command received from the upper controller, so as to perform synchronous control on the first group of three-phase windings and the second group of three-phase windings.

[0030] The dual three-phase motor redundancy control system in this embodiment connects two digital controllers to two sets of three-phase windings (the first set of three-phase windings and the second set of three-phase windings) simultaneously. When any digital controller fails, the remaining controller can be used to control both sets of three-phase windings simultaneously, ensuring the stable operation of all three-phase windings. By setting a field-programmable gate array (FPGA), it is possible to control any digital controller as the currently effective digital controller, preventing two digital controllers from simultaneously outputting control commands to two sets of three-phase windings, thus avoiding control conflict problems.

[0031] Based on the above embodiments, another embodiment of this application provides a dual three-phase motor redundancy control system, such as... Figure 2 As shown, it includes: The host controller 111 is electrically connected to the first digital controller 101 and the second digital controller 102 through the signal distribution unit 104; The host controller is used to send a working mode instruction to the signal distribution unit; the signal distribution unit is used to forward the working mode instruction to the first digital controller and the second digital controller based on the independent first signal channel and the second signal channel. The first digital controller 101 is electrically connected to the first three-phase inverter 107-1 in the dual inverter 107 and the first set of three-phase windings 108-1 in the dual three-phase motor 108. The first digital controller is also electrically connected to the second set of three-phase windings 108-2 in the dual three-phase motor 108 through the second three-phase inverter 107-2 in the dual inverter 107. The first digital controller 101 is used to send PWM sequences to the first three-phase inverter 107-1 and the second three-phase inverter 107-2 based on the operating mode command forwarded by the signal distribution unit when it is determined to be the currently effective digital controller. The second digital controller 102 is electrically connected to the first three-phase inverter 107-1 in the dual three-phase motor 108 via the first three-phase inverter 107-1 in the dual inverter 107, and the second digital controller is also electrically connected to the second three-phase winding 108-2 in the dual three-phase motor 108 via the second three-phase inverter in the dual inverter 107. The second digital controller 102 is used to send PWM sequences to the first three-phase inverter 107-1 and the second three-phase inverter 107-2 based on the operating mode command forwarded by the signal distribution unit when it is determined to be the currently effective digital controller. The first three-phase inverter 107-1 and the second three-phase inverter 107-2 are used to receive the PWM sequence sent by the currently active digital controller (the first digital controller or the second digital controller), and convert the PWM sequence into control commands to perform synchronous control on the first group of three-phase windings and the second group of three-phase windings.

[0032] The field-programmable gate array (FPGA) 103 is used to acquire the operating information of the first digital controller and the second digital controller, perform fault monitoring on the first digital controller and the second digital controller based on the operating information, obtain fault monitoring results including fault categories, and output controller switching instructions to the PWM hardware interlock unit 106 or set the current state of the system based on the fault monitoring results.

[0033] The PWM hardware interlock unit 106 includes: a first channel gating corresponding to the output channel of the first digital controller, a second channel gating corresponding to the output channel of the second digital controller, and a signal receiving terminal. The signal receiving terminal of the PWM hardware interlock unit is electrically connected to the FPGA 103. The PWM hardware interlock unit is used to: receive a controller switching command sent by FPGA 103; based on the controller switching command, use the first channel gating to open the output channel of the first digital controller and use the second channel gating to block the output channel of the second digital controller, so as to control the first digital controller as the currently valid digital controller and control the second digital controller as the currently invalid digital controller; or based on the controller switching command, use the first channel gating to block the output channel of the first digital controller and use the second channel gating to open the output channel of the second digital controller, so as to control the first digital controller as the currently invalid digital controller and control the second digital controller as the currently valid digital controller.

[0034] In this embodiment, the system further includes a control state synchronization unit 105. The control state synchronization unit is electrically connected to the first digital controller 101 and the second digital controller 102. The control state synchronization unit 105 receives target control state data sent by the currently active digital controller and forwards the target control state data to the currently inactive digital controller, so that the currently inactive digital controller can perform consistency verification and state data alignment processing based on the target control state data and its local control state data. In this embodiment, the control state data includes any one or more of the following: current regulator integral, speed regulator integral, position regulator integral, rotor position estimate, speed estimate, flux linkage or back EMF observation status, reference voltage vector, PWM modulation sector, and fault status.

[0035] In this embodiment, a control state synchronization unit is set up to transmit control state data containing a sequence number and a check code between the two digital controllers. The control state data includes at least one of the following: current regulator integral, speed or position regulator integral, rotor position estimate, speed estimate, flux linkage or back EMF observation status, reference voltage vector, sector or modulation status, and fault status. The hot standby controller / currently invalid digital controller can perform consistency verification based on its own parallel calculation results and the received state data, and perform state alignment when the deviation meets preset conditions.

[0036] In this embodiment, when the FPGA determines the fault category of the digital controller, the fault category can include both hard fault categories and soft fault categories. Specifically, when the fault category is a soft fault category, the FPGA determines whether a predetermined controller switching condition is met based on the accumulated information of the soft faults. If the controller switching condition is not met, the current state of the system is set based on the soft fault category. If the controller switching condition is met, a takeover preparation signal is sent to the currently inactive digital controller. When the fault category is a hard fault category, the FPGA sends a takeover preparation signal to the currently inactive digital controller. The currently inactive digital controller performs state data alignment processing based on the takeover preparation signal, according to the target control state data of the currently active digital controller forwarded by the control state synchronization unit, and the local control state data.

[0037] In this embodiment, the system further includes: a gate drive unit 110; the output terminal of the gate drive unit 110 is electrically connected to the input terminals of the first three-phase inverter 107-1 and the second three-phase inverter 107-2; the input terminal of the gate drive unit 110 is electrically connected to the output terminals of the first digital controller 101 and the second digital controller 102; the gate drive unit 110 is used to receive the PWM sequence sent by the currently active digital controller, convert the PWM sequence into a voltage drive signal, and send it to the first three-phase inverter and the second three-phase inverter.

[0038] In this embodiment, the system further includes a sensor group 112, which includes a plurality of first sensors and a plurality of second sensors. The detection terminals of each of the first sensors are respectively connected to the first group of three-phase windings, and the output terminals of each of the first sensors are electrically connected to the first digital controller and the second digital controller. Each of the first sensors is used to detect the phase current, bus voltage, rotor position, speed, temperature and power module fault signal of the first group of three-phase windings, and send the above information to the two digital controllers. Each of the second sensors has its detection terminal connected to the second set of three-phase windings, and its output terminal electrically connected to the first and second digital controllers. Each second sensor detects the phase current, bus voltage, rotor position, speed, temperature, and power module fault signal of the second set of three-phase windings, and sends this information to the two digital controllers. Thus, the two digital controllers can independently calculate the control quantity based on the same control objective and the same motor state at any given time.

[0039] Therefore, the FPGA can perform fault monitoring on the first digital controller and the second digital controller based on the operating information, obtain fault monitoring results including fault categories, and output controller switching instructions or set the current state of the system based on the fault monitoring results.

[0040] The hard fault criteria include at least one of the following: undervoltage or overvoltage power supply, clock loss, PWM output violating preset complementary relationship or dead-time constraint, continuous reset, and heartbeat exceeding the hard timeout threshold. When a hard fault is established, the FPGA directly issues a blocking and controller switching command.

[0041] Soft fault criteria include at least one of the following: abnormal task execution time, increased communication error rate, continuously increasing control state differences, sampled values ​​exceeding a reasonable rate of change, intermittent heartbeat loss, and abnormal power supply voltage change trends. That is, when the predetermined controller switching conditions are met based on accumulated soft fault information, the FPGA issues a blocking and controller switching command; conversely, when the predetermined controller switching conditions are not met, the current state of the dual three-phase motor redundant control system is set. For example, the FPGA sequentially places the system into a normal state, a warning state, a pre-switching state, or a switching state based on the duration, frequency, weight, or accumulated reliability of the soft fault, and sets different entry and exit thresholds to form hysteresis. In this embodiment, the soft fault criteria use different state entry and exit thresholds to form hysteresis, and in the pre-switching state, health verification and control state data alignment processing are performed on the backup digital controller.

[0042] In this embodiment, the dual three-phase motor redundancy control system further includes a power supply unit 109. The power supply unit comprises several power supply branches, each electrically connected to the first digital controller, the second digital controller, and the FPGA, for supplying power to these components. Specifically, there are three power supply branches. Each power supply branch is equipped with at least one of the following: independent current limiting, electronic fuse, circuit breaker, reverse connection protection, or isolation power supply, to ensure that a short circuit in any chip or its peripheral circuit does not reduce the power supply to other control units.

[0043] In this embodiment, when the FPGA determines that the fault type of the currently valid digital controller is a hard fault, or a soft fault and the accumulated soft fault information meets the controller switching conditions, it can first enter a pre-switching state. That is, the FPGA can first send a takeover preparation signal to the currently invalid digital controller. The currently invalid digital controller, based on the takeover preparation signal, receives the target control state data of the currently valid digital controller forwarded by the control state synchronization unit. The currently invalid digital controller performs state data alignment processing based on the target control state data and local control state data. After completing the data alignment processing and confirming its own good health status, the currently invalid digital controller determines that the takeover conditions are met and sends health confirmation information to the FPGA. Thus, the FPGA receives the health confirmation information sent by the currently invalid digital controller and then sends a controller switching command to the PWM hardware interlock unit 106 to execute the formal controller switchover. In this embodiment, if the currently invalid digital controller / hot standby controller does not meet the takeover conditions, the system maintains the current channel, limits output, or enters a safe shutdown state.

[0044] In this embodiment, the PWM hardware interlock unit includes PWM gate channels corresponding to two digital controllers and a single-bit valid selection logic. The first gate enable and the second gate enable cannot be valid at the same time. When the selection state is uncertain, the FPGA is reset, or the interlock logic detects a conflict, the PWM hardware interlock unit sets the gate drive input to a predetermined safe level.

[0045] When a controller switch is formally initiated, the FPGA first disables the PWM gating channel corresponding to the currently active digital controller. After confirming that the input of the gate drive unit is at a safe level, it waits for a preset blanking interval. After the preset blanking interval is reached, it can further wait for the PWM cycle boundary, zero vector interval, or reference voltage vector to meet the preset conditions of the safe vector window before enabling the PWM gating channel corresponding to the hot standby controller / currently inactive digital controller. That is, after receiving the controller switch command, the PWM hardware interlock unit 106 uses the first channel gating to open the output channel of the first digital controller and uses the second channel gating to block the output channel of the second digital controller, thereby controlling the first digital controller as the currently active digital controller and the second digital controller as the currently inactive digital controller; or, based on the controller switch command, it uses the first channel gating to block the output channel of the first digital controller and uses the second channel gating to open the output channel of the second digital controller, thereby controlling the first digital controller as the currently inactive digital controller and the second digital controller as the currently active digital controller. In this embodiment, enabling the backup PWM channel (the output channel of the second digital controller) also requires meeting at least one of the following safety vector window conditions: PWM cycle boundary, both inverters being in a preset zero vector state, or the reference voltage vector difference between the two digital controllers being less than a preset value. In this embodiment, the PWM hardware interlock unit has a selectable state latching or default channel holding function, ensuring that when the FPGA fault monitoring and control arbitration unit experiences a reset, clock failure, or power supply abnormality, it retains the most recently verified valid PWM channel or the default main PWM channel.

[0046] In this embodiment, the first digital controller 101 and the second digital controller 102 can be DSPs, microcontrollers with motor control peripherals, or other real-time processors. In this embodiment, both use the same type of DSP and are respectively configured with a six-phase current sampling interface, a rotor position interface, a communication interface, and two sets of three-phase PWM modules. Both the first digital controller 101 and the second digital controller 102 are configured with predetermined control programs, both including current loops, speed loops or position loops, coordinate transformation, dual three-phase voltage command generation, and PWM modulation functions.

[0047] In this embodiment, the first digital controller 101 and the second digital controller 102 are respectively able to generate all the switching control signals required by the first three-phase inverter and the second three-phase inverter.

[0048] In this embodiment, torque, speed, position, or operating mode commands from the host controller 111 are simultaneously transmitted to the two digital controllers via the signal distribution unit 104. Phase current, bus voltage, rotor position, speed, temperature, and power module fault signals output by the sensor group 112 are also simultaneously transmitted to the two digital controllers. Therefore, the two digital controllers can independently calculate control quantities at any given time based on the same control objective and the same motor state.

[0049] Upon normal power-up, FPGA 103 completes a self-test and checks the startup completion flags of the two digital controllers. If both digital controllers are functioning normally, the first digital controller 101 is selected as the currently active controller according to a preset priority, and the second digital controller 102 is selected as the hot standby controller / currently inactive controller; alternatively, the primary and standby roles can be rotated based on cumulative running time, temperature, or health status.

[0050] In this embodiment, the switching process for the digital controller specifically includes the following: Step S1: After the system is powered on, the first digital controller 101 and the second digital controller 102 respectively complete the self-test of the program, memory, clock, ADC, PWM and communication interface, and send a start-up completion flag to the FPGA 103.

[0051] In step S2, the FPGA selects the currently active digital controller based on a preset priority or health status, and configures the PWM hardware interlock unit 106 to enable only the output channel of the currently active digital controller. The two digital controllers synchronously acquire the control commands and feedback signals forwarded by the signal distribution unit and output by the host computer, and execute the complete dual three-phase motor redundancy control algorithm in parallel.

[0052] In step S3, the FPGA periodically acquires the heartbeat, task time limit, PWM, power supply, clock, sampling, and communication health information of the currently active digital controller, and performs hard fault determination and soft fault confidence update. The two digital controllers periodically exchange control state data and calculate state differences.

[0053] Step S4: When the confidence level of a soft fault reaches the warning or pre-switching threshold, the FPGA sends a takeover preparation command to the backup controller / currently invalid digital controller; the backup controller / currently invalid digital controller completes status data alignment and returns a health acknowledgment to the FPGA. When a hard fault is established or the confidence level of a soft fault reaches the switching threshold, the FPGA sends a main channel blocking command / controller switching command.

[0054] Step S5: The PWM hardware interlock unit 106 deactivates the currently active channel (i.e., the output channel of the currently active digital controller) and confirms that the gate drive input is at a safe level. After a preset blanking interval and the safety vector window condition is met, it enables the backup controller channel (i.e., the output channel of the currently inactive digital controller).

[0055] Step S6: The standby controller / currently invalid digital controller takes over all PWM control of the two three-phase inverters. During the verification cycle, the FPGA checks the health status of the standby controller and whether the current, speed, or position response is within the preset range. Upon successful verification, the primary / standby roles are updated; upon failure, the drive is blocked, and rollback, output limitation, or safe shutdown is performed based on the status of the available controllers.

[0056] By employing the control system described in this application, in a speed control verification scenario, the first digital controller 101 controls the dual three-phase motor from 0 to 2 seconds. At 2 seconds, a control loop fault of the first digital controller is simulated. After detecting the fault, the FPGA switches control to the second digital controller 102 according to the aforementioned disconnect-then-reconnect procedure. Since the second digital controller 102 had synchronously sampled, performed parallel calculations, and maintained control state alignment before the fault occurred, the motor speed did not continuously run out of control after taking over, verifying the feasibility of this architecture continuing to control all windings under a single digital controller fault.

[0057] Compared with the scheme where two controllers control one set of three-phase windings respectively, the system in this application can independently control all two sets of windings of the dual three-phase motor. Therefore, after a single digital controller fails, the backup digital controller can still take over the complete six-phase drive channel, avoiding the inevitable loss of half of the winding control capability due to the failure of the control core.

[0058] By setting up an independent FPGA unit, fault diagnosis and control arbitration can be achieved using the FPGA. Fault diagnosis and switching authority are separated from the monitored digital controller, which can reduce the risk of switching failure caused by fault controllers failing to report actively, communication bus abnormalities, or dual controllers waiting for each other.

[0059] By utilizing FPGAs to monitor both hard and soft faults, it is possible to achieve fault classification, cumulative reliability, and hysteresis state machine. This can simultaneously ensure rapid blocking of severe faults and anti-interference confirmation of gradual anomalies, reducing the possibility of erroneous switching caused by transient disturbances.

[0060] By setting up a control state synchronization unit, it is possible to ensure that the two digital controllers operate in parallel and that the control state is mirrored. Before taking over, the hot standby controller / currently inactive digital controller already has integral quantities, estimates, and modulation states that match the current operating conditions, which can reduce control interruptions and output shocks caused by reinitialization.

[0061] By setting up a PWM hardware interlock unit, it is possible to achieve break-before-connect, blanking interval, and safe vector window switching, which can reduce the risk of bridge arm shoot-through and current surge caused by two PWM sources simultaneously driving power devices or switching in unfavorable switching states.

[0062] By using independent power supply, current limiting or fuse isolation, and selective state retention after FPGA failure, control chip failure, power supply failure and some peripheral circuit failures can be isolated, so that the system can maintain drive function or enter a controllable degraded state under a single failure.

[0063] The above embodiments are merely exemplary embodiments of this application and are not intended to limit this application. Those skilled in the art can make various modifications or equivalent substitutions to this application within the scope and nature of this application, and such modifications or equivalent substitutions should also be considered to fall within the scope of protection of this application.

Claims

1. A dual three-phase motor redundancy control system, characterized in that, include: The host controller is used to output operating mode commands to the first digital controller and the second digital controller. A field-programmable gate array (FPGA) is electrically connected to the first digital controller and the second digital controller, and is used to control the first digital controller or the second digital controller as the currently active digital controller. The first digital controller is electrically connected to the first group of three-phase windings and the second group of three-phase windings respectively. When it is determined to be the currently effective digital controller, it sends control commands to the first group of three-phase windings and the second group of three-phase windings based on the working mode command received from the upper controller, so as to perform synchronous control on the first group of three-phase windings and the second group of three-phase windings. The second digital controller is electrically connected to the first group of three-phase windings and the second group of three-phase windings respectively. When it is determined to be the currently effective digital controller, it sends control commands to the first group of three-phase windings and the second group of three-phase windings based on the working mode command received from the upper controller, so as to perform synchronous control on the first group of three-phase windings and the second group of three-phase windings.

2. The system as described in claim 1, characterized in that, The system also includes: a signal distribution unit; The host controller is electrically connected to the first digital controller and the second digital controller through the signal distribution unit; The host controller is used to send working mode instructions to the signal distribution unit; The signal distribution unit is used to forward the operating mode command to the first digital controller and the second digital controller based on the independent first signal channel and the second signal channel.

3. The system as described in claim 1, characterized in that, The system also includes: a first three-phase inverter and a second three-phase inverter; The first digital controller is electrically connected to the first set of three-phase windings through the first three-phase inverter and electrically connected to the second set of three-phase windings through the second three-phase inverter; the first digital controller is also used to send a PWM sequence to the first three-phase inverter and the second three-phase inverter based on the operating mode command received from the upper controller when it is determined to be the currently effective digital controller; The second digital controller is electrically connected to the first three-phase winding via the first three-phase inverter and to the second three-phase winding via the second three-phase inverter; the second digital controller is used to send a PWM sequence to the first three-phase inverter and the second three-phase inverter based on the operating mode command received from the upper controller when it is determined to be the currently effective digital controller; The first three-phase inverter and the second three-phase inverter are used to receive PWM sequences sent by the first digital controller or the second digital controller, and convert the PWM sequences into control commands to perform synchronous control on the first group of three-phase windings and the second group of three-phase windings.

4. The system as described in claim 1, characterized in that, The FPGA is also used to: acquire the operating information of the first digital controller and the second digital controller, perform fault monitoring on the first digital controller and the second digital controller based on the operating information, obtain fault monitoring results including fault categories, and output controller switching instructions or set the current state of the system based on the fault monitoring results.

5. The system as described in claim 4, characterized in that, The system also includes: a PWM hardware interlock unit; The PWM hardware interlock unit includes: a first channel gate corresponding to the output channel of the first digital controller, a second channel gate corresponding to the output channel of the second digital controller, and a signal receiving terminal; The signal receiving end of the PWM hardware interlock unit is electrically connected to the FPGA. The PWM hardware interlock unit is used to: receive a controller switching command sent by the FPGA; based on the controller switching command, use the first channel gating to open the output channel of the first digital controller and use the second channel gating to block the output channel of the second digital controller, so as to control the first digital controller as the currently valid digital controller and control the second digital controller as the currently invalid digital controller; or based on the controller switching command, use the first channel gating to block the output channel of the first digital controller and use the second channel gating to open the output channel of the second digital controller, so as to control the first digital controller as the currently invalid digital controller and control the second digital controller as the currently valid digital controller.

6. The system as described in claim 5, characterized in that, The system also includes: a control state synchronization unit; The control state synchronization unit is electrically connected to the first digital controller and the second digital controller; The control state synchronization unit is used to receive target control state data sent by the currently valid digital controller and forward the target control state data to the currently invalid digital controller, so that the currently invalid digital controller can perform consistency verification and state data alignment processing based on the target control state data and local control state data.

7. The system as described in claim 4, characterized in that, The fault categories include: hard fault categories and soft fault categories; When the fault category is a soft fault category, the FPGA determines whether the predetermined controller switching conditions are met based on the cumulative information of the soft faults. If the controller switching conditions are not met, the current state of the system is set based on the soft fault category. If the controller switching conditions are met, a takeover preparation signal is sent to the currently inactive digital controller. When the fault category is a hard fault category, the FPGA is used to send a takeover preparation signal to the currently inactive digital controller; The currently invalid digital controller is used to perform state data alignment processing based on the takeover preparation signal, according to the target control state data received from the currently valid digital controller and the local control state data.

8. The system as described in claim 7, characterized in that, The FPGA is also used to: receive health confirmation information sent by the currently invalid digital controller, and send a controller switching command to the PWM hardware interlock unit based on the health confirmation information.

9. The system as described in claim 5, characterized in that, The system also includes a gate drive unit; The output terminal of the gate drive unit is electrically connected to the input terminals of the first three-phase inverter and the second three-phase inverter; The input terminal of the gate drive unit is electrically connected to the output terminals of the first digital controller and the second digital controller; The gate drive unit is used to receive the PWM sequence sent by the currently active digital controller, convert the PWM sequence into a voltage drive signal, and send it to the first three-phase inverter and the second three-phase inverter.

10. The system as claimed in claim 1, characterized in that, The system further includes: a power supply unit; the power supply unit includes: A plurality of power supply branches are provided, each of which is electrically connected to the first digital controller, the second digital controller, and the FPGA, for supplying power to the first digital controller, the second digital controller, and the FPGA.

Images