Redundant mechatronic system and method for operating

Abstract

Redundant mechatronic system, wherein: - the redundant mechatronic system (2) is designed as a two-channel system and is connected or connectable to a mechanical arrangement for the delivery of varying mechanical power, - both channels each have a power supply (12.1, 12.2) or a common power supply is connected upstream of both channels, - both channels each contain a control circuit (11.1, 11.2) and are controllable by means of at least one control unit (13), - the control unit (13) acts on the control circuits (11.1, 11.2) such that the control circuits (11.1, 11.2) each switch an electrical power specified by the control unit (13) and obtained from the power supply (12.1, 12.2) to each winding set (10.1, 10.2) of at least one electrically operated actuator in order to generate the mechanical power, - the two channels are operated in parallel during normal operation. suchthat each channel provides half of the currently available mechanical power, - each of the two channels is designed such that, in the event of failure of the other channel, it alone provides the maximum mechanical power required to fulfill a function of the mechanical arrangement, wherein the redundant mechatronic system (2) has arrangements connected to the control unit (13) by means of which overloads in the channels and / or the components of the channels and / or in the mechanical arrangement can be detected by the control unit (13), - when an overload is detected by means of the control unit (13), a reduction factor (Rf) counteracting the overload can be determined and applied by means of the control unit (13), - the reduction factor (Rf) is dimensioned such that, when the reduction factor (Rf) is applied by the control unit (13), the maximum available system power of both channels is sufficient to fulfill the function,- the channel power can be controlled by the control unit (13) using the reduction factor (Rf) as a control variable, such that the respective current channel power counteracts the overload, characterized in that, by means of the control unit (13) of the redundant mechatronic system (2), the reduction factor (Rf) can be set in the mechanical arrangement when an overload occurs, such that when applied by the control unit (13), the power is reduced in one channel and increased in the other channel by the same amount, alternating over time.

Description

The subject matter of the invention is a redundant mechatronic system according to the preamble of the main claim and a method for operating the redundant mechatronic system.The mechatronic system is generally considered to be the functional integration of a mechanical-electrical system in which sensors record signals, processors process information and actuators are used to influence a frequently mechanical basic system. A mechatronic system therefore usually has a mechanical basic structure. Sensors which detect the state of this framework and the system environment pass the signals to an information processing unit. There, the sensor signals are processed and manipulated variables are generated according to established rules. Actuators use these manipulated variables in order to influence the behavior of the mechanical basic system.Mechatronic systems of this type are used in many technical fields, in particular also in motor vehicles. Here, an application takes place, for example, in connection with so-called assistance systems and in connection with electrically controlled accelerator, brake and steering systems ("Xby-Wire"). In such systems, but in particular in the course of the recent development of autonomously or semi-autonomously driving motor vehicles, the requirement arises for the redundancy of such mechatronic systems.In connection with electrically controlled gas, brake and steering systems ("Xby-Wire"), a redundant mechatronic system of this type is described in DE 2004 051 078 A1. From this publication it is known to design throttle, brake and steering systems in such a way that two spatially separated electric motors are used with two separate control units and two separate gear mechanisms, which control the corresponding control element of the vehicle in parallel. It is further provided that in the event of failure of one of the two electric motors, the other electric motor takes over 100 percent of its power. In this case, it can be provided that both electric motors run simultaneously, so that in the event of a functional failure of one of the servomotors, no additional activation times are required, because the other motor or motors of the group run in parallel.A similar redundantly constructed mechatronic system is also described in DE 10 2008 014 876 B3 and WO 2017 / 158680 A1.Common to the redundant mechatronic systems discussed above is that they contain a collecting solution when a fault occurs in one channel, in such a way that they apply the entire required output power of the mechatronic system via the other channel. However, this is not necessary in most fault cases because often only temporary overloads are involved, such as an overtemperature at a component of the system, an excessively high current in an electrical component of the system or an excessively high torque at a mechanical component of the system. In such cases, it is not expedient to switch off the channel concerned and take over only the load by the other channel. Especially since the alone acting subsystem makes it more likely to overload and thus to completely fail the system, for example as a result of a temperature being exceeded.In connection with a single-channel steering system with power assistance, it is further known from JP 2017-193197 A to preset a first maximum current and a second smaller maximum current for driving the motor component in the steering system and to measure the temperature in the steering system by means of a sensor by means of the control unit. If the temperature is below a predefined temperature range, the control unit releases the first maximum current as permitted, the control unit releases the second maximum current as permitted in the predefined temperature range, and if the temperature is above the predefined temperature range, the control unit reduces the current to zero, i.e. the power assistance system is switched off. Although such a steering system can handle a large portion of occurring overtemperatures without the power assistance system completely switching off, this is, however, subject to a marked loss of comfort because the power assistance system falls back to a significantly noticeably lower level. There is no redundancy with regard to servo assistance.U.S. Pat. No. 9,985,567 B2 and DE 11 2014 006 003 T5 disclose a drive device for an electric motor and a control method therefor. DE 10 2017 110 753 A1 discloses a device for fault-tolerant operation of a technical system. DE 10 2016 221 250 A1 discloses a method for operating an on-board power supply system.While avoiding the disadvantages of the prior art mentioned above, it is therefore an object of the invention to specify a two-channel redundant mechatronic system which remains functional in the event of temporarily occurring overloads and in which the load is divided between the two channels of the redundant mechatronic system according to their respective current capacity. Furthermore, the object is to specify a method for operating such a redundant mechatronic system.The object with respect to the redundant mechatronic system is achieved by an arrangement according to claim 1, advantageous embodiments and refinements thereof are characterized in the dependent claims, a method for operating the redundant mechatronic system is characterized in claims 4 and 5, advantageous embodiments and refinements thereof are characterized in the claim dependent thereon.The starting point was a redundant mechatronic system which is embodied in two channels and is connected or connectable to an electrical energy supply for the purpose of the power supply and is connected or connectable to a mechanical arrangement for delivering a mechanical power. The term mechatronic system is understood to mean a system of the type mentioned at the beginning. Such mechatronic systems are available, for example, in electrically controlled accelerator, brake and steering systems, specifically both in servo systems supporting the driver of a vehicle and in autonomous or semi-autonomous systems of a vehicle. In such systems, one or more components are contained in each of the two channels and the power of each channel is controllable by means of at least one control unit. As is customary today, the control unit is a computer-assisted control which implements control and regulation sequences by control programs and communicates for this purpose with the components by subjecting them to control and / or regulation signals and inquiring their states. The components can be energy supplies, simple or complex control circuits and actuators. The control unit acts on the control circuits arranged in each of the two channels in such a way that the control circuits each switch through an electrical power, which is predetermined by the control unit and is related to the energy supply, to a respective winding set of the at least one electrically operated actuator. The control unit is connected to arrangements which determine the failure of a channel. Both channels of the mechatronic system are operated in parallel in normal operation in such a way that each channel provides half the mechanical power currently to be output and each of the two channels is designed in such a way that it can provide at least the maximum required power for fulfilling a function of the mechanical arrangement.It is proposed to configure the mechatronic system such that arrangements connected to the control unit are provided, by means of which overloads in the channels and / or the components of the channels and / or in the mechanical arrangement can be detected by the control unit. The overloads can be both thermal and electrical and mechanical overloads, which are detected with current, voltage, temperature, force or torque sensors, or with the aid of computer models, which simulate the time profile of the thermal, electrical or mechanical load in a control unit and thus determine an overload. Furthermore, the control unit is designed such that it detects this when an overload occurs and determines a reduction factor which counteracts the overload and applies it. The reduction factor is dimensioned such that the system power available after application of the reduction factor is sufficient to fulfil the function. On the basis of the reduction factor, the control unit controls the respective channel powers in such a way that the respective current channel power counteracts the overload.The redundant mechatronic system is further advantageously designed such that, by means of the control unit, when an overload occurs in one of the two channels and / or on one or more of the components in one of the two channels, it determines the reduction factor such that, when it is used by the control unit, the channel power in the overloaded channel is reduced by an amount defined by the reduction factor and is increased by the same amount in the non-overloaded channel. The process can be reset and executed again in a predetermined time pattern. Overall, the continuous or alternating reduction of the channel power continues until the control unit no longer detects any overload. The described embodiment of the redundant mechatronic system advantageously achieves the effect that, in the event of an overload occurring in one of the two channels, the respective channel is protected without completely switching it off. In the case of a thermal fault, i.e. an excessively high temperature in one channel, this means that the channel concerned is given the possibility of cooling by the power reduction, while the other channel heats up only moderately because it is operated within its specification.According to the invention, it is provided that the redundant mechatronic system determines the reduction factor by means of the control unit when an overload occurs in the mechanical arrangement such that, when it is used by the control unit, the power is reduced in one channel in a temporally alternating manner by an amount defined by the reduction factor and is increased in the other channel by the same amount. This process is repeated in a predetermined time pattern and, with the channels changed, is repeated overall until the control unit no longer detects any overload. This procedure achieves optimized thermal protection for the components of the channels and of the actuator, because these alternately receive the possibility of cooling.In a further advantageous embodiment of the redundant mechatronic system, it is provided that, when an overload occurs in both channels, a reduction factor for each channel can be defined by the control unit in such a way that, when it is used by the control unit, on the one hand, the power in both channels, controlled by the control unit, is reduced by an amount determined by the respective reduction factor. On the other hand, the reduction factors are dimensioned such that, when they are used by the control unit, the currently available system power, i.e. the power of both channels together, is sufficient to carry out the function. The process can be reset and executed again in a predetermined time pattern. Overall, the continuous or alternating reduction of the channel power continues until the control unit no longer detects any overload.A development of the redundant mechatronic system advantageously provides for the channels to be designed in such a way that each channel can provide the maximum required power for fulfilling the function and that both channels together can additionally provide the power for fulfilling an additional function of the mechanical arrangement. For this purpose, the control unit is designed such that, in the event of an overload occurring, it deactivates the additional function at least when the system power available overall through the power reduction is not sufficient to fulfil the function and the additional function. An additional function is understood to mean that the function is carried out in a certain comfortable manner. For example, if the function is a steering motion of a vehicle at a standstill, the additional function is, for example, to execute the function in a predetermined short time. The execution of the function together with the additional function therefore always requires more power than the execution of the function per se.A further advantageous embodiment of the redundant mechatronic system provides for the control unit to be designed such that it determines the reduction factor as a function of the type and / or degree of the overload that has occurred. Thus, a categorization of the overload is to some extent introduced, wherein the category of the overload determines the response of the redundant mechatronic system. In this way, it is ensured that the system always responds adequately to faults.Since in most cases the power which a channel provides is determined by the current level through the drive circuit of the actuator, the reduction of the power in a channel is effected by a reduction of the current intensity for driving the associated actuator and an increase of the power in a channel is effected by an increase of the current intensity for driving the associated actuator under the control of the control unit. In the case of pulsed actuation of the actuators, it is alternatively possible to bring about the reduction in the power in a channel by a reduction in the pulse width of the current for driving the actuator and the increase in the power in a channel by an increase in the pulse width of the current for driving the actuator controlled by the control unit.For optimized execution of the basic function and, if applicable, of the additional function, it is advantageous to design the system such that the control unit controls the control circuits such that, when switching a power from one channel to the other channel, the currently required power is available at any time of the switching, i.e., without interruption. For this purpose, it can be provided that the switchover takes place in the manner of an overlapping symmetrical ramp function. This means that the current through the drive circuit of one channel ramps down by a predetermined amount, while the current in the other channel simultaneously ramps up in an equal amount.The redundant mechatronic system can advantageously be used as part of a power steering system supporting the steering movement of the driver, a steer-by-wire system or, in the case of an autonomously driving vehicle, as part of the steering system in such a vehicle. The latter system carries out steering movements under the control of an autonomous vehicle computer without steering interventions by a driver. Of course, it is also possible to use the redundant mechatronic system, for example, as a servo brake system, brake-by-wire system, brake system in an autonomously driving vehicle, servo accelerator system, electronic accelerator pedal, accelerator system in an autonomously driving vehicle or outside the vehicle technology in other technical fields.A method for operating the redundant mechatronic system advantageously provides that the control unit periodically queries the arrangements for detecting overloading in the channels and / or in the mechanical arrangement. As mentioned above, the arrangements for detecting overloads can likewise be sensors or computer models simulating the load situation. If an overload occurs in one of the channels, the control unit determines a reduction factor for the affected channel and, with the aid of the reduction factor, determines a reduction variable for the current channel power of the overloaded channel. For example, if current level is the determining variable for the power, the reduction variable is a variable by which the current level is to be reduced. By appropriate actuation of the drive circuit by means of the control unit, the reduced power is connected to the winding system of the actuator connected to the drive circuit. The actuator can be, for example, a double motor, in which a winding system is assigned to a channel in each case. Of course, two independent motors are also conceivable, which act on a common drive train and together with this form the actuator. Since the system power is not sufficient to carry out the function due to the power reduction in the overloaded channel, the control unit determines an increase variable for the non-overloaded channel with the aid of the reduction factor, the increase variable corresponding in terms of amount to the reduction variable and, by actuating the control circuit, switches the power increased by the increase variable to the winding system of the actuator connected to the control circuit. The power reduction in the one channel and the power increase in the other channel can be carried out continuously or repeatedly in a time pattern and is then ended by the control unit if it no longer detects any overload.The method allows the function to be carried out without any problem in the event of a channel-related overload, relieving the overloaded channel, without switching off the overloaded channel. This also has an advantageous effect on the thermal state of the non-overloaded channel, because it does not have to be operated at its specification limit in full load.A further method aspect for operating the redundant mechatronic system provides that the control unit periodically queries the arrangements for detecting an overload in the channels and / or in the mechanical arrangement. Here, too, as mentioned above, the arrangements for detecting overloads can equally be sensors or computer models simulating the load situation. If the control unit detects an overload in the mechanical arrangement, it determines a reduction factor for both channels. This is the same for both channels. The control unit then carries out a reduction in the channel power in one of the channels on the basis of the channel power provided for carrying out the function, in that it determines a reduced power from the reduction factor and switches on the reduced power to the winding system of the actuator connected to the latter by appropriate actuation of the actuation circuits. At the same time, the control unit derives an increased power from the reduction factor by applying, for example, the reduction factor with the opposite sign, starting from the channel power provided for the execution of the function. The control unit then switches the increased power to the winding system of the actuator connected to it by appropriate actuation of the actuation circuits. Within a predetermined time, the control unit resumes the change and executes the change again in a predetermined time pattern with a change of the channels. The process is repeated by the control unit as long as the overload is detected.The above methods advantageously ensure that when a temporary overload occurs, the channel load is asymmetrically effected. In practice, this means that the redundant mechatronic system can be operated in a thermally safe area regardless of the type of temporary overload that occurs.In a development of the above-described methods, it can be provided that, when an overload occurs, the control unit checks whether, after the power reduction has been carried out, both channels together can provide the power for the function and additionally the power for fulfilling an additional function of the mechanical arrangement. In order to determine the feasibility of the additional functions, the control unit compares the currently required total system power of the two channels of the mechatronic system with the system power which is actually available after the power reduction. If the total system power required exceeds the available system power, the controller deactivates the auxiliary function, otherwise it executes the auxiliary function. This can ensure that the additional function can be executed in many cases despite overloading of a channel or of the mechanical arrangement.If a reduction factor is mentioned above, this term should not be understood only in the mathematical sense. A reduction factor may be a factor, percentage, amount, or mathematical or empirical function.As can be seen from the above, the proposed redundant mechatronic system is able to adequately counter both the occurrence of temporary overloads and the complete failure of a channel.Further embodiments and advantages of the invention are explained in more detail below with reference to the drawings. The following are shown: FIG. 1 shows an autonomous steering system with a redundant mechatronic system as a drive into a motor vehicle (simplified partial illustration) FIG. 2 is a diagrammatic illustration of a first mode of operation of the redundant mechatronic system FIG. 3 is a diagrammatic representation of a second mode of operation of the redundant mechatronic systemFIG. 1 shows a simplified partial illustration of an autonomous steering system in a motor vehicle 1 (partial illustration). A redundant mechatronic system 2 is shown, which drives a vehicle steering 4 via a drive shaft 3. This consists of a pinion 7 driven by the drive shaft 3 and acting on a toothed rack 8. The rack 8 in turn acts on tie rods 5 pivoted to both ends of the rack 8. The tie rods 5 are rotatably fastened by their second end to steering levers of the wheel suspension 17 and transmit the movements of the rack 8 to the steered wheels 6 fastened to the wheel suspension 17.The redundant mechatronic system 2 has two channels, wherein the first channel consists of a first power supply 12.1 of a first drive circuit 11.1 and a first winding set 10.1 of a dual electric motor 9. The second channel similarly comprises a second energy supply 12.2, a second drive circuit 11.2 and a second winding set 10.2 of the dual electric motor 9. The redundant mechatronic system 2 is controlled by a control unit 13 which is connected in terms of control technology to the first control circuit 11.1 of the first channel and to the second control circuit 11.2 of the second channel. The control unit 13 is further connected to an external vehicle computer 16 and has connections to sensors 14, each of which is assigned to each of the energy supplies 12.1, 12.2, to each of the control circuits 11.1, 11.2 and to each of the winding sets 10.1, 10.2 of the dual electric motor 9 and the temperature of which taps off, so that a thermal overload can be detected separately in each of the two channels in a component-related manner. A torque sensor 15 detects a measured value for the torque at the drive shaft 3 and is likewise connected to the control unit 13. By means of the torque sensor 15, an overload in the steering system itself is detectable. As explained above, the redundant mechatronic system 2 is designed such that each of the two channels can completely take over the fulfilment of the function (in the example the execution of a steering movement) in each case in the event of failure of the other channel.For the further explanation of the mode of operation of the redundant mechatronic system 2, it is initially assumed that a temperature has built up in the first drive circuit 11.1, which represents a thermal overload. The control unit 13, which periodically interrogates the sensors 14, 15 during operation of the arrangement, detects this circumstance as an overload in the first channel.The reaction to detecting the overload is explained in more detail below with the aid of FIG. 2. For this purpose, the power curve in the two channels is shown in the illustration. The upper illustration in FIG. 2 shows the power profile P K1 in the first channel and the lower illustration in the drawing shows the power profile P K2 in the second channel, in each case with respect to the time t.In response to the detection of the overload mentioned above at the time TA, the control unit 13 determines a reduction factor Rf, which in the example is 40%, from the type (overtemperature in the first drive circuit 11.1) and possibly the level of the overtemperature when a corresponding temperature measurement is provided. Starting from the power P N1 necessary at this point in time for executing the function, the control unit 13 reduces this power P N1 by the power ΔP to the reduced power P R1, with the aid of the reduction factor Rf, by correspondingly reducing the current intensity which flows via the drive circuit 11.1. At the same time, the control unit, using the reduction factor Rf with the opposite sign, determines an increase factor Ef for the second channel and increases the power P N2 necessary at this time for executing the function by the power ΔP to the increased power P E2, by correspondingly increasing the current intensity with which the drive circuit 11.2 applies to the second winding system 10.2. The above-described state is maintained until the control unit no longer detects an increased temperature at time T E by interrogating the sensor 14 in the drive circuit 11.1.As can be seen from FIG. 2, the power reduction in the first channel required due to the thermal overloading of the first drive circuit 11.1 is completely compensated for by the power increase in the second channel. The first control circuit is thereby given the possibility of cooling down, while the components in the second channel heat up only insignificantly, since the second channel is operated within its specification.A further example of the mode of operation of the redundant mechatronic system is shown in FIG. 3. The upper illustration in FIG. 3 shows the power profile P K12 in the first channel and the lower illustration in the drawing shows the power profile P K22 in the second channel, in each case with respect to the time t.In this example, it is assumed that the control unit 13 detects too high a torque via the torque sensor 15 at time T A2. Too high a torque can be caused, for example, by the fact that the steered wheels stand on a base which greatly inhibits a steering movement and a steering movement is carried out when the vehicle is at a standstill.In response to detecting the overload mentioned above at time T A2 the control unit 13 determines a reduction factor Rf 2 from the type of overload (torque-over in the steering), which is 50% in the example. Starting from the power P N12 necessary at this point in time for executing the function, the control unit 13 reduces this power P N12 by the power ΔP 2 to the reduced power P R12 with the aid of the reduction factor Rf 2 by correspondingly reducing the current intensity that flows via the drive circuit 11.1. At the same time, using the reduction factor Rf 2 with the opposite sign, the control unit determines an increase factor Ef 2 for the second channel and increases the power P N22 necessary at this time for executing the function by the power ΔP 2 to the increased power P E22, by correspondingly increasing the current intensity with which the drive circuit 11.2 acts on the second winding system 10.2. After a time ΔT is decreased, the control unit 13 decreases the changes performed and, again after a time ΔT is decreased, the control unit 13 performs the changes again by changing channels, so that now the power P N12 in the first channel is increased by the power ΔP 2 to the increased power P E22 and the power P N22 in the second channel is reduced by the power ΔP to the reduced power P R22. The above-described process is repeated until the control unit 13 does not detect an increased torque by inquiring the torque sensor 15 at the time T E2.In contrast to the example described above in connection with FIG. 3, it is also possible to proceed in such a way that the control unit 13 sets the increase factor Ef 2 to be greater than the reduction factor Rf 2. As a result, the system power is increased in a pulsating manner, so that a possible obstacle which inhibits the steering movement can be overcome. The increase factor Ef 2 can be increased at most until the maximum channel power is reached.Finally, it should be pointed out that, in the examples according to FIGS. 2 and 3, for the sake of illustration, the power P N1 necessary for carrying out the function has been assumed to be constant; this need not be the case. Rather, it is likely that the power P N1, P N12 required to execute the function varies, because the steering movements predefined by the vehicle computer 16 are also different depending on the situation. In this case, the power reductions -ΔP, -AP 2 or ΔP also vary, of course. Power Increases +ΔP, +ΔP 2.

Claims

Redundant mechatronic system, wherein - the redundant mechatronic system (2) is configured in two channels and is connected or connectable to a mechanical arrangement for delivering a varying mechanical power, - both channels each have an energy supply (12.1, 12.2) or a common energy supply is connected upstream of both channels, - both channels each contain a drive circuit (11.1, 11.2) and can be controlled by means of at least one control unit (13), - the control unit (13) acts on the drive circuits (11.1, 11.2) such that the drive circuits (11.1, 11.2) each pass an electrical power, which is specified by the control unit (13) and is related to the energy supply (12.1, 12.2), to a respective winding set (10.1, 10.2) of at least one electrically operated actuator in order to generate the mechanical power, - the two channels are operated in parallel in normal operation, such that each channel provides half of the mechanical power currently to be output, - each of the two channels is designed such that, in the event of failure of the respective other channel, it provides the maximum required mechanical power alone for fulfilling a function of the mechanical arrangement, wherein the redundant mechatronic system (2) has arrangements connected to the control unit (13), by means of which overloads in the channels and / or the components of the channels and / or in the mechanical arrangement can be detected by the control unit (13), - in the event of an overload being detected by the control unit (13), a reduction factor (Rf) counteracting the overload can be defined and applied by the control unit (13), - the reduction factor (Rf) is dimensioned such that, when the reduction factor (Rf) is applied by the control unit (13), the maximum available system power of both channels is sufficient for fulfilling the function, the channel power can be controlled by the control unit (13) using the reduction factor (Rf) as a control variable in such a way that the respective current channel power counteracts the overload, characterized in that the reduction factor (Rf) can be defined by the control unit (13) of the redundant mechatronic system (2) when an overload occurs in the mechanical arrangement in such a way that, when it is used by the control unit (13), the power is reduced in one channel and increased in the other channel by the same amount in a temporally alternating manner.Redundant mechatronic system according to one of the preceding claims, characterized in that the control unit (13) of the redundant mechatronic system determines the reduction factor (Rf) as a function of the type and / or the degree of overload that has occurred.Redundant mechatronic system according to one of the preceding claims, characterized in that the redundant mechatronic system (2) is part of a servo steering system or a steer-by-wire system or part of a steering system in an autonomously driving vehicle.Method for operating the redundant mechatronic system according to one of the preceding claims, characterized in that the control unit (13) - periodically queries the arrangements for detecting overloads in the channels and / or in the mechanical arrangement, - determines a reduction factor (Rf) in the event of an overload occurring in one of the channels, - determines a reduction variable for the current channel power of the overloaded channel with the aid of the reduction factor (Rf) and, by appropriate control of the control circuits (11.1), switches the reduced power (P R1) to the winding system (10.1) of the actuator of the overloaded channel connected to the latter, a step-up quantity (Ef) corresponding in magnitude to the step-down quantity for the current channel power of the non-overloaded channel is determined with the aid of the step-down factor (Rf), and by appropriate actuation of the control circuits (13), the power (P E2) increased by the step-up quantity is switched onto the winding system (10.2) of the actuator of the non-overloaded channel connected to it, the change in the channel power is maintained as long as the overload is detected.Method for operating the redundant mechatronic system according to one of Claims 2 or 3, characterized in that the control unit (13) - interrogates the arrangements for detecting overloads in the channels and / or in the mechanical arrangement cyclically, - determines a reduction factor (Rf 2) for both channels in the event of an overload occurring in the mechanical arrangement, for one of the channels, a reduced power (P R12) is determined based on the power of the channel provided for carrying out the function using the reduction factor (Rf 2) and, by appropriate actuation of the control circuits (11.1) in the one channel, the reduced power (P R12) is switched on to the winding system (10.1) of the actuator connected to the control circuit (11.1), simultaneously for the other channel, starting from the channel power provided for the execution of the function, using the reduction factor (Rf 2) an increase factor (Ef2), and using the latter, an increased power (P E22) is determined and, by appropriate actuation of the actuation circuits (11.2), in the one channel, the increased power (P E22) is switched on to the winding system (10.2) of the actuator connected to the actuation circuit (11.2), - the change is reduced again within a predetermined time period (ΔT), - the channels change in a time pattern predetermined by the time period (ΔT) and the change is carried out again, - the process is repeated as long as the overload is detected.Method according to Claim 4 or 5, characterized in that, when an overload occurs, the control unit (13) checks whether, after the power reduction has been carried out, both channels together can provide the power for the function and additionally the power for fulfilment of an additional function of the mechanical arrangement, and the control device (13) is designed such that it deactivates the additional function at least if the system power available overall by the power reduction is not sufficient for fulfilment of the additional function.

Images