Redundant control system

Abstract

The invention relates to a redundant control system (1) comprising at least one primary controller (2), one secondary controller (3), one primary actuator (4), and one secondary actuator (5), wherein the primary actuator (4) and the secondary actuator (5) each have at least one controller (6, 8) and at least one actuator (7, 9), wherein the redundant control system (1) is configured such that the primary controller (2) transmits a primary control input (11) to the primary actuator (4), and the secondary controller (3) transmits a secondary control input (12) to the secondary actuator (5), wherein the primary controller (6) generates a control signal (13) at least for the primary actuator (7), and the secondary controller (8) generates a control signal (14) at least for the secondary actuator (9), wherein in the fault-free case only the control signal (13) of the primary controller (6) is implemented, wherein a control signal (13) is generated by the actuators (7, 8, 9).9) The set manipulated variable (18) is fed back to the primary controller (6) and the secondary controller (8), wherein the primary actuator (2) and the secondary actuator (3) are connected via data transmission and each has a self-diagnostic function, wherein the secondary controller (8) has an integral component, wherein a deviation of the manipulated variable (18) from a setpoint manipulated variable is integrated, wherein, under a predefined switching condition, at least the primary controller (6) is deactivated and the secondary controller (8) is activated and takes over the control task taking into account the integrated integral component.

Description

[0001] The invention relates to a redundant control system according to the preamble of claim 1.

[0002] Redundant control systems have diverse applications. One example is the steering system in a motor vehicle. Various approaches exist for building a redundant control system.

[0003] In one approach, the redundant control system comprises a primary controller, a secondary controller, a primary actuator, and a secondary actuator. Both the primary and secondary actuators each have a controller and at least one actuator. The primary controller provides a primary position setting for the primary actuator, and the secondary controller provides a secondary position setting for the secondary actuator. Under fault-free operation, the primary and secondary position settings are independent but identical. The primary controller then generates a control signal for at least the primary actuator, and the secondary controller generates a control signal for at least the secondary actuator, but under fault-free operation, only the control signal from the primary controller is implemented.This control signal then either controls only the primary actuator or it controls both the primary and secondary actuators. The secondary actuator is passive, meaning its generated control signal is not implemented. The primary and secondary actuators are connected via data transmission. Furthermore, both the primary and secondary actuators have self-diagnostic functionality. A control variable set by the primary actuator (and optionally by the secondary actuator) is fed back to both the primary and secondary actuators. If the primary actuator detects a fault through its self-diagnostic function, it shuts down and informs the secondary actuator. The secondary actuator then activates the secondary actuator and takes over the control task.Depending on the type of error, the secondary actuator can then perform the control task alone, or it can also access the primary actuator in addition.

[0004] The generic DE 10 2018 108 597 A1 shows such a redundant control system.

[0005] The invention is based on the technical problem of improving such a redundant control system.

[0006] The solution to the technical problem is achieved through a redundant control system with the features of claim 1. Further advantageous embodiments of the invention are set forth in the dependent claims.

[0007] The redundant control system comprises at least one primary controller, one secondary controller, one primary actuator, and one secondary actuator, wherein the primary actuator and the secondary actuator each have at least one controller and at least one actuator, wherein the redundant control system is configured such that the primary controller transmits a primary control input to the primary actuator and the secondary controller transmits a secondary control input to the secondary actuator, wherein the primary controller generates a control signal at least for the primary actuator and the secondary controller generates a control signal at least for the secondary actuator, wherein in the fault-free case only the control signal of the primary controller is implemented, and wherein a control variable set by the actuators is fed back to the primary controller and the secondary controller.wherein the primary actuator and the secondary actuator are connected via data technology and each has a self-diagnostic function, wherein the secondary controller has an integral component, wherein a deviation of the manipulated variable from a setpoint manipulated variable is integrated, wherein, under a given switching condition, at least the primary controller is deactivated and the secondary controller is activated and takes over the control task taking into account the integrated integral component.

[0008] This means the secondary controller is pre-charged and can reduce the accumulated control deviation more quickly after switching over. The integral component of the secondary controller can be permanently enabled, or it can be activated only when a control deviation of the primary actuator is detected.

[0009] In one embodiment, the second controller is designed to reduce the integrated integral component again if the second controller has not taken over the control task after a predetermined time.

[0010] In another embodiment, the redundant control system is a steering system in a motor vehicle, in particular a steer-by-wire steering system.

[0011] In another embodiment, the redundant control system is designed such that, in fault-free operation, the secondary actuator is also used to generate the manipulated variable. This allows the actuators to be designed with lower overall power requirements.

[0012] In another embodiment, the primary actuator and the secondary actuator are electric motors that are wound as independent stator windings on a common stator, with the stator windings operating on a common rotor.

[0013] In another embodiment, the steering system is a steering system of an autonomously driving motor vehicle.

[0014] The invention is explained in more detail below with reference to preferred embodiments. The figures show: Fig. 1 a schematic block diagram of a redundant control system, Fig. 2 a schematic representation of a rule deviation and Fig. 3 a schematic block diagram of a redundant control system for a steer-by-wire steering system.

[0015] In the Fig. Figure 1 shows a schematic block diagram of a redundant control system 1. The redundant control system 1 has a primary controller 2 and a secondary controller 3. Furthermore, the redundant control system 1 has a primary actuator 4 and a secondary actuator 5. The primary actuator 4 has a primary controller 6 and at least one primary actuator 7. The secondary actuator 5 has a secondary controller 8 and at least one secondary actuator 9. The primary actuator 4 and the secondary actuator 5 are connected via a data link 10. The primary controller 3 transmits a primary control input 11 to the primary actuator 4. Similarly, the secondary controller 3 transmits a secondary control input 12. The controllers 6 and 8 then determine a primary control signal 13 and a secondary control signal 14 from the control inputs 11 and 12.In this scenario, the secondary controller 8 is passively switched on during fault-free operation, meaning the secondary control signal 14 is ignored. The primary control signal 13 is transmitted to the primary actuator 7, which then generates a manipulated variable 15 to implement the primary control input 11. The control input 11, 12 can be, for example, a steering angle, a braking force, or a speed. The manipulated variable 15 acts on an element 17 (e.g., a rack or pushrod) to physically implement the control input. An actual manipulated variable 18 is then detected, determined, or estimated and fed back to the two controllers 6, 8. It can be configured that, during fault-free operation, the control task is implemented exclusively via the primary actuator 7.Alternatively, the control task can be performed by the primary actuator 7 and the secondary actuator 9, which then also generates a manipulated variable 16. For this purpose, the second actuator 9 receives its input from the primary controller 6 via data connection 10. Both the primary actuator 4 and the secondary actuator 5 have a self-diagnostic function. In the event of a fault in the primary actuator 4, it switches off and informs the secondary actuator 5 via data connection 10. The secondary actuator 5 then activates the secondary controller 8, which takes over the control task. A certain amount of time elapses between the occurrence of a fault and the shutdown of the primary controller 6 and the transfer to the secondary controller 8, during which a correspondingly large control deviation can accumulate.To enable the secondary controller 8 to counteract the control deviation more quickly in the event of a fault and when taking over the control task, it integrates the deviations as soon as the fault occurs and preloads an integrator component. When the switchover to the secondary controller 8 then takes place, it performs the control task with the preloaded integrator component, so that the control deviation is corrected much more quickly.

[0016] This will be shown schematically using the following: Fig. Figure 2 explains the situation, with the situation for the primary controller 6 shown on the left and the situation for the secondary controller 8 on the right. At time t0, a fault occurs in the primary control unit 4 (e.g., in the actuator 7). This leads to a control deviation. X is, for example, a rack or pushrod position used to set a steering angle in order to follow a target trajectory. The actual manipulated variable 18 is shown as a dashed line and the target manipulated variable 15 as a solid line. At time t1, the primary controller 6 switches off and informs the secondary controller 8. At time t0, the second controller 8 begins to integrate the control deviation, thus preloading an integral component of its control structure. This integrated integral component is indicated by the area between the curves.At time t1, when the secondary controller 8 takes over the control task, the controller 8, due to the integrated components, adjusts more quickly back to the setpoint, as symbolized by the arrows. For this purpose, the secondary actuator 9, for example, generates additional torques.

[0017] In the Fig.Figure 3 shows the implementation of the redundant control system 1 for a steer-by-wire steering system 20, with only the steering gear module depicted. The steer-by-wire steering system 20 comprises a primary control unit 21 with a primary position controller 22 and primary power electronics 23. The steer-by-wire steering system 20 also includes a secondary control unit 24 with a secondary position controller 25 and secondary power electronics 26. Furthermore, an electric motor is provided, which has primary stator windings 27 and secondary stator windings 28 wound on a common stator. A common rotor 29 is provided, which is connected to a rack 30 or a pushrod. The rotor 29 also has a rotor position sensor 31, which detects a rotor angle φ from which the rack position can be determined. The data connection 10 between the two control units 21, 24 is indicated by a double arrow.Further shown are a primary power supply U1 and an independent secondary power supply U2. Also shown is a connection upstream of the power electronics 23 and 26, allowing the primary position controller 22 to also control the secondary power electronics 26, and vice versa. The secondary position controller 25 operates analogously to the secondary controller 8 and integrates any deviation. Reference symbol list 1 Control system 2 primary control 3 secondary control 4 primary actuator 5 secondary actuator 6 primary controllers 7 primary actuator 8 secondary controllers 9 secondary actuator 10 Data connection 11 primary setting requirement 12 secondary setting 13 primary control signal 14 secondary control signal 15 Setpoint control variable 16 Control variable 17 Element 18 Actual control variable 20 Steer-by-Wire steering system 21 primary control unit 22 primary position controller 23 primary power electronics 24 secondary control unit 25 secondary position controllers 26 secondary power electronics 27 primary stator winding 28 secondary stator windings 29 Rotor 30 Rack and pinion 31 Rotor position sensor U1 primary power supply U2 secondary power supply φ Rotor angle

Claims

[1] Redundant control system (1) comprising at least one primary controller (2), one secondary controller (3), one primary actuator (4) and one secondary actuator (5), wherein the primary actuator (4) and the secondary actuator (5) each have at least one controller (6, 8) and at least one actuator (7, 9), wherein the redundant control system (1) is configured such that the primary controller (2) transmits a primary control input (11) to the primary actuator (4) and the secondary controller (3) transmits a secondary control input (12) to the secondary actuator (5), wherein the primary controller (6) generates a control signal (13) at least for the primary actuator (7) and the secondary controller (8) generates a control signal (14) at least for the secondary actuator (9), wherein in the fault-free case only the control signal (13) of the primary controller (6) is implemented, wherein a control signal (13) is provided by the actuators (7,9) the set actual control variable (18) is fed back to the primary controller (6) and the secondary controller (8), wherein the primary actuator (4) and the secondary actuator (5) are connected via data transmission and each has a self-diagnostic function, wherein, under a predefined switching condition, at least the primary controller (6) is deactivated and the secondary controller (8) is activated, , characterized by , that the secondary controller (8) has an integral component, whereby a deviation of the actual manipulated variable (18) from a setpoint manipulated variable (15) is integrated and the secondary controller (8) takes over the control task taking into account the integrated integral component. [2] Redundant control system (1) according to claim 1, characterized by , that the secondary controller (8) is designed to reduce the integrated integral component again if the secondary controller (8) has not taken over the control task after a given time. [3] Redundant control system (1) according to claim 1 or 2, characterized by , that the control system (1) is a steering system in a motor vehicle. [4] Redundant control system (1) according to claim 3, characterized by , that the steering system is a steer-by-wire steering system (20). [5] Redundant control system (1) according to any of the preceding claims, characterized by , that the control system (1) is designed such that in error-free operation the secondary actuator (9) is used in addition to generating the manipulated variable (16). [6] Redundant control system (1) according to any of the preceding claims, characterized by , that the primary actuator (7) and the secondary actuator (9) are electric motors wound as independent stator windings (27, 28) on a common stator, the stator windings (27, 28) operating on a common rotor (29). [7] Redundant control system (1) according to any one of claims 3 to 6, characterized by that the steering system is a steering system of an autonomously driving vehicle.

Images