Method for controlling a redundant actuator with two partial actuators, and actuator system with a redundant actuator having two partial actuators
Patent Information
- Application Number
- EP2024707683
- Authority / Receiving Office
- EP · EP
- Patent Type
- Applications
- Current Assignee / Owner
- Priority Date
- 2023-03-14
- Filing Date
- 2024-02-14
- Publication Date
- 2026-01-21
AI Technical Summary
Existing steer-by-wire systems with redundant actuators require additional installation space and effort due to the need for a higher-level control unit to coordinate converter modules, which increases the complexity and space requirement, especially in cases of malfunction.
A method for controlling a redundant actuator with two partial actuators using a control device with three converter modules, where handshake communication between the modules allows for negotiation and reconfiguration of connections to maintain operation even if one module malfunctions, eliminating the need for a higher-level control unit and enabling a modular design with reduced space requirements.
This approach allows for efficient coordination and continued operation of the redundant actuator with reduced performance during malfunctions, minimizing space and installation effort, and ensures the actuator system can operate with minimal disruption by dynamically reconfiguring converter module connections.
Smart Images
Figure DE2024100124_19092024_PF_FP_ABST
Abstract
Description
[0001] Method for controlling a redundant actuator with two partial actuators and actuator system with a redundant actuator having two partial actuators
[0002] The invention relates to a method for controlling a redundant actuator having two partial actuators, in particular a motor having two separate winding sets, by means of a control device, wherein a first partial actuator is connected to a first actuator connection of the control device and a second partial actuator is connected to a second actuator connection of the control device, wherein the control device comprises a first, a second and a third converter module, each of which has a converter. Furthermore, the invention relates to an actuator system, in particular for a steer-by-wire system, having a redundant actuator having two partial actuators, in particular a motor having two separate winding sets, and having a control device for controlling the redundant actuator, wherein the control device comprises a first, a second and a third converter module, each of which has a converter.
[0003] The invention can be applied in the field of automotive engineering, particularly in the field of steer-by-wire systems. In such steer-by-wire systems, there is no mechanical connection between the steering wheel and the steered wheel. All steering commands are received by sensors on the steering wheel and transmitted electrically via a control unit to one or more steering actuators, which execute the steering movements and transmit them to the wheels. In addition to these steering actuators, such steer-by-wire systems typically have an actuator for providing a force feedback torque on the steering wheel. Such force feedback actuators can provide the driver with the same steering feel, or the same haptic feedback, that they are accustomed to when driving a vehicle with a mechanically connected steering system and power assistance.
[0004] An actuator system of the type mentioned above is known from DE 10 2021 112 819 A1. This actuator system comprises a redundant actuator with two sub-actuators and can be used, for example, as a force feedback actuator. A control unit is used to control this redundant actuator, which can control both sub-actuators. The control unit comprises three converters, one of which can optionally replace one of the other two converters.
[0005] Using a higher-level control unit to coordinate the individual converters has the disadvantage of requiring additional installation space. Furthermore, precautions would have to be taken to ensure that such a higher-level control unit is also redundant to prevent a total failure of the actuator system in the event of a malfunction in the higher-level control unit. Such measures can further increase the installation space requirements and complexity.
[0006] Against this background, the task arises of enabling the coordination of redundant converter modules of the control unit with little effort and with little installation space requirement.
[0007] The object is achieved by a method for controlling a redundant actuator having two partial actuators, in particular a motor having two separate winding sets, by means of a control device, wherein a first partial actuator is connected to a first actuator connection of the control device and a second partial actuator is connected to a second actuator connection of the control device, wherein the control device comprises a first, a second and a third converter module, each having a converter, wherein in a first operating state the first actuator connection is connected to the converter of the first converter module and the second actuator connection is connected to the converter of the second converter module and the actuator connections are not connected to the converter of the third converter module, which is in a standby state,wherein a malfunction is detected in the first converter module and the control device enters a fault operating state in which the first actuator connection is isolated from the converters of the first, second and third converter modules and the second actuator connection continues to be connected to the converter of the second converter module, wherein in the fault operating state, a handshake communication takes place between the first, second and third converter modules of the control device, wherein the handshake communication is used to negotiate which converter(s) of the converter modules are to be connected to the actuator connections of the control device.
[0008] The method according to the invention provides handshake communication between the first, second, and third converter modules. If a malfunction is detected in a converter module—referred to here as the first converter module—in the first operating state, the control device enters the fault operating state, in which the second partial actuator connected to the second phase terminals continues to be controlled by the second converter module. In this respect, the redundant actuator can continue to operate at reduced power.In this fault operating state, handshake communication takes place between all three converter modules of the control unit. Negotiation takes place between the three converter modules as to which one or both converter modules will be connected to the phase terminals of the control unit after the fault operating state has ended, so that the redundant actuator can continue to operate despite the malfunction in one of the converter modules. Handshake communication eliminates the need for a higher-level control unit and enables a modular design with independent converter modules. These measures allow the control unit's converter modules to be coordinated with minimal effort and space requirements.
[0009] According to an advantageous embodiment of the invention, the control device of the handshake communication subsequently transitions from the fault operating state to a second operating state, in which the actuator connections are connected to the converter module(s) as negotiated by means of the handshake communication. This second operating state can form an operating state in which the redundant actuator is operated with an identical function as in the first operating state. In the second operating state, however, the ability of the control device to compensate for further errors may be reduced, or such error compensation may no longer be possible.
[0010] According to an advantageous embodiment of the invention, the malfunction is detected by the first converter module itself. Particularly preferably, the detected malfunction is communicated from the first converter module to the other two converter modules.
[0011] According to an alternative, preferred embodiment, each of the three converter modules monitors the respective other converter modules and detects the malfunction in the first converter module. For example, it can be provided that the converter modules send regular, in particular periodic, signals to the respective other converter modules indicating that no malfunction is present. If such a signal is absent, the other converter modules can detect that a malfunction is present in the first converter module.
[0012] According to an advantageous embodiment of the invention, it is provided that the handshake communication comprises: - a request step in which the first, second and third converter module each checks whether a request message has been received from the respective other, in particular all other, converter modules.
[0013] Using the request message, an inverter module can signal to the other inverter modules that it intends to perform a handshake communication. Optionally, a timer with a specified runtime can be started in the request step, and subsequent steps of the handshake communication are only initiated when either the timer has expired or a request message has been received from all other inverter modules.
[0014] According to an advantageous embodiment of the invention, the handshake communication comprises:
[0015] - a status exchange step in which the first, second and third inverter modules each determine status information of their operational readiness and transmit the determined status information to the respective other inverter modules.
[0016] The operational readiness status information can indicate whether the respective inverter module is operational or not operational (e.g., defective). Because the respective inverter modules determine the status information themselves, determination by a higher-level device is not required. By exchanging status information between all inverter modules, it can be ensured that all inverter modules are aware of the operational readiness status of the others. The exchange of status information therefore forms the basis for deciding which inverter module(s) or inverter should be connected to the actuator connections of the control device. The exchange can take place, for example, via separate data lines or a data bus.Since the status information available in the inverter modules after completion of the status exchange step is identical in all inverter modules, the subsequent decision can lead to the same result in all inverter modules.
[0017] According to an advantageous embodiment of the invention, the handshake communication comprises:
[0018] - a decision step in which the first and second converter modules each determine a command for the third converter module based on the status information received from the respective other converter modules and send it to the third converter module.
[0019] Based on the status information exchanged between the converter modules in the status exchange step, a decision can be made in the decision step as to which function the third converter module should assume. This decision is preferably made independently in the first and second converter modules, and then a corresponding command is sent to the third converter module. If the commands received by the first and second converter modules are identical, the command can be implemented without further ado in the third converter module. If the commands received by the first and second converter modules differ, the third converter module decides independently and independently of the first and second converter modules which of the two commands it will implement.For example, it may happen that both the first and second converter modules are not ready for operation, and therefore the first converter module sends the command to the third converter module to take over the function of the first converter module, and the second converter module sends the command to the third converter module to take over the function of the second converter module. In this case, the third converter module decides which function to assume, preferably based on a predefined criterion.
[0020] According to an advantageous embodiment of the invention, the handshake communication comprises:
[0021] - a confirmation step in which the third inverter module sends a confirmation message to the first and second inverter modules.
[0022] The content of the confirmation message preferably indicates whether the third converter module has implemented the respective command from the first or second converter module or not. The respective confirmation message can be received by the first and second converter modules and evaluated in such a way that the first or second converter module implements its own corresponding procedure.
[0023] According to an advantageous embodiment of the invention, in the first operating state, the actuator connections of the control device are isolated from the converter of the third converter module. Preferably, the third converter module is in a non-active state. In this respect, the third converter module in such an embodiment forms a cold reserve within the control device.
[0024] According to an advantageous embodiment of the invention, the partial actuators act on a common drive element, in particular a common drive shaft. The redundant actuator is preferably designed as a force feedback actuator for providing a force feedback torque on a steering wheel and / or as an actuator for adjusting a steering wheel position and / or as an actuator for moving a steering wheel into a stowed position. According to an alternative advantageous embodiment, the redundant actuator is designed as an actuator on a tie rod.
[0025] According to an advantageous embodiment of the invention, it is provided that the first, second and third converter modules each have a logic unit for controlling the converter. The converter is preferably designed as an inverter, in particular as a B6 inverter. Preferably, the first and the second converter module each further comprise an output switching device by means of which a connection between the converter and an actuator connection of the control device can be selectively established or interrupted. Preferably, the third converter module further comprises an output switching device by means of which a connection between the converter of the third converter module and one of the first and the second actuator connection of the control device can be selectively established or interrupted.It is preferably provided that the output switching device has bidirectionally blocking switches, in particular bidirectionally blocking semiconductor switches.
[0026] According to an advantageous embodiment of the invention, the control device has two supply network connections. The supply network connections can be connected to inputs of the converter modules via input switching devices. Preferably, the first and second converter modules each comprise an input switching device, by means of which a connection between the converter module and a supply network connection of the control device can be selectively established or interrupted. Preferably, the third converter module further comprises an input switching device, by means of which a connection between the third converter module and one of the first and second supply network connections of the control device can be selectively established or interrupted.
[0027] According to an advantageous embodiment of the invention, it is provided that the first converter module and the second converter module are designed identically, in particular, a handshake logic controlling the handshake communication of the first and second converter modules is designed identically. The third converter module preferably has a converter that is designed identically to the respective power units of the first and second converter modules. The third converter module preferably comprises a handshake logic controlling the handshake communication, which is designed differently from the respective handshake logic of the first and second converter modules.According to an advantageous embodiment of the invention, prior to each start-up of the entire system, a handshake communication takes place between the first, second, and third converter modules of the control device. The handshake communication is used to negotiate which converter(s) of the converter modules should be connected to the actuator connections of the control device. This ensures that any malfunctions that occur or develop during the start-up phase lead to the selection of functional converter modules.
[0028] A further subject of the invention is an actuator system, in particular for a steer-by-wire system, with a redundant actuator having two partial actuators, in particular a motor having two separate winding sets, and with a control device for controlling the redundant actuator, wherein the control device comprises a first, a second and a third converter module, each of which has a converter, wherein the control device is configured to
[0029] - in a first operating state, to connect the first actuator connection to the converter of the first converter module and the second actuator connection to the converter of the second converter module and not to connect the actuator connections to the converter of the third converter module which is in a standby state,
[0030] - to detect a malfunction in the first converter module and to switch to a fault operating state in which the first actuator connection is isolated from the converters of the first, second and third converter modules and the second actuator connection is still connected to the converter of the second converter module, to carry out a handshake communication between the first, second and third converter modules of the control device in the fault operating state, wherein the handshake communication is used to negotiate which converter or converters of the converter modules are to be connected to the actuator connections of the control device.
[0031] The actuator system can achieve the same advantages and technical effects as have already been described in connection with the method according to the invention.
[0032] According to an advantageous embodiment of the invention, the redundant actuator is designed as an actuator on a tie rod. According to an alternative advantageous embodiment of the actuator system, the redundant actuator is designed as a force feedback actuator for providing a force feedback torque on a steering wheel and / or as an actuator for adjusting a steering wheel position and / or as an actuator for transferring a steering wheel into a stowed position.
[0033] Alternatively or additionally, the advantageous embodiments and features described in connection with the method according to the invention can also be used - individually or in combination - in the actuator system according to the invention.
[0034] Further details and advantages of the invention will be explained below with reference to the exemplary embodiment illustrated in the drawings. Herein:
[0035] Fig. 1 shows an embodiment of an actuator system according to the invention in a schematic block diagram;
[0036] Fig. 2 shows an embodiment of a control device of the actuator system according to Fig. 1;
[0037] Fig. 3 is a flow chart of an embodiment of a method according to the invention for operating an actuator system;
[0038] Fig. 4 is a flowchart explaining the processes in the first and second converter modules during a handshake communication; and
[0039] Fig. 5 is a flowchart explaining the processes in the third inverter module during a handshake communication.
[0040] Fig. 1 shows a block diagram of an embodiment of an actuator system 100 with a redundant actuator 20 and a control device 10 for controlling the actuator 20. The actuator system 100 comprises a redundant actuator 20, which in the embodiment is designed as an electric motor with two separate winding sets. The separate winding sets each form a sub-actuator of the redundant actuator 20 and can be controlled independently of one another. The actuator system 100 can be configured for use in a steer-by-wire system. In this case, the actuator 20 is an actuator on a tie rod. Alternatively, the actuator 20 can be a force feedback actuator for providing a force feedback torque to a steering wheel of the steer-by-wire system. The control device 10 is connected to two independent or semi-independent supply networks BN1, BN2.When using the actuator system 100 in a steer-by-wire system, the two supply networks 1, 2 can be configured as DC voltage on-board electrical systems of a vehicle. To connect the control device 10 to the two on-board electrical systems, the control device 10 comprises a first supply network connection T1 and a second supply network connection T2.
[0041] The control device 10 further comprises a first actuator connection T3 and a second actuator connection T4, via which the control device 10 is connected to the redundant actuator 20. The first actuator connection T3 is connected to the first sub-actuator via a first connection T5 of the actuator 20, and the second actuator connection T4 is connected to the second sub-actuator via a second connection T6 of the actuator 20. In the exemplary embodiment, both sub-actuators act on a common drive element, for example, a common drive shaft.
[0042] As can be seen from the detailed illustration of the control device 10 in Fig. 2, the first actuator connection T3 and the second actuator connection T4 are multi-phase, here three-phase.
[0043] The control device 10 comprises a total of three converter modules 11, 12, 13, each of which has an input switching device E1, E2, E3, a buffer capacitor C1, C2, C3, a converter U1, U2, U3 and an output switching device A1, A2, A3. A further component of the converter modules 11, 12, 13 is a logic unit (not shown in the drawings) for controlling the functions of the respective converter module 11, 12, 13, in particular the respective input switching device E1, E2, E3, the respective converter U1, U2, U3 and the respective output switching device A1, A2, A3.
[0044] According to the illustration in Fig. 2, the control device 10 is in a first operating state in which the first actuator connection T3 is connected to the converter U1 of the first converter module 11 and the second actuator connection T4 is connected to the converter U2 of the second converter module 12. To connect the converter U1 of the first converter module 11 to the first actuator connection T3, the output switching device A1 of the first converter module 11 is placed in a conductive state. Likewise, the output switching device A2 of the second converter module 12 is placed in a conductive state for connecting the converter U2 of the second converter module 12 to the second actuator connection T4. The output switching device A3 of the third converter module, in contrast, isolates the converter U3 of the third converter module 13 from the actuator connections T3, T4.
[0045] On the input side, in the first operating state, the input switching devices E1, E2 of the first and second converter modules 11, 12 are in a conductive state and the input switching device E3 of the third converter module 13 is in an insulating state.
[0046] In the first operating state, the first partial actuator of the redundant actuator 10 is controlled by the first converter module 11 of the control device 10 and the second partial actuator via the second converter module 12 of the control device 10.
[0047] In Fig. 3 a flow chart of an embodiment of a method according to the invention for operating an actuator system is shown, wherein for the states
[0048] - first operating state S1 ,
[0049] - Fault operating state S2,
[0050] - second operating state S4 is specified whether the respective inverters U1, U2, U3 of the inverter modules 11, 12, 13 are connected to an actuator connection T3, T4 and are active (=1), are not connected to an actuator connection T3, T4 and are inactive (=0) or are connected to an actuator connection T3, T4 and at the same time a malfunction is detected in the respective inverter module 11, 12, 13 (=lightning symbol).
[0051] In the first operating state S1, the first actuator connection T3 is connected to the converter U1 of the first converter module 11, and the second actuator connection T4 is connected to the converter U2 of the second converter module 12. Furthermore, the converter U3 of the third converter module 13 is in a standby state in which the converter U3 of the third converter module 13 is not connected to one of the actuator connections T3, T4.
[0052] If a malfunction is detected in the first converter module 11, the control device 10 initially remains in the fault operating state S2, in which the second actuator connection T4 remains connected to the converter U2 of the second converter module 12, so that the partial actuator connected to the second actuator connection T4 can continue to be operated.
[0053] In this fault operating state S2, a handshake communication takes place between the first, second and third converter modules 11, 12, 13, wherein the handshake communication is used to negotiate which converter(s) U1, U2, U3 of the converter modules 11, 12, 13 are to be connected to the actuator connections T3, T4 of the control device 10 following the fault operating state S2.
[0054] After completion of the handshake communication in the fault operating state S2, the control device 10 then transitions from the fault operating state S2 to a second operating state S4, in which the actuator connections T3, T4 are connected to the converter(s) U1, U2, U3 of the converter modules 11, 12, 13, as negotiated by means of the handshake communication. In the case shown in Fig. 3, the second and third converter modules 12, 13 are active in the second operating state. The converter U2 of the second converter module is connected to the second actuator output T4, and the converter U3 of the third converter module 13 is connected to the first actuator output T3. In this respect, the third converter module 13 assumes the function in the second operating state S4 that the first converter module 11 had in the first operating state.
[0055] Fig. 4 shows a flow chart to explain the processes in the first and second converter modules 11, 12 during a handshake communication.
[0056] According to the exemplary embodiment shown here, the handshake communication begins with a request step 401, in which the first and second converter modules each check whether a request message has been received from the respective other converter modules. The first and second converter modules 11, 12 remain in the request step 401 until corresponding request messages have been received from the other two converter modules 11, 12, 13. Optionally, it can be provided that a timer with a predetermined runtime is started in the request step 401 and subsequent steps of the handshake communication are only initiated when either the timer has expired or a request message has been received from all other converter modules 11, 12, 13.
[0057] The request step 401 is basically optional, so that in a modification of the embodiment it can be omitted.
[0058] In a status exchange step 402 following the request step 401, the first and second converter modules 11, 12 each determine their operational readiness and transmit corresponding status information to the other converter modules 11, 12, 13. The status exchange step 402 is divided into a first sub-step 402.1 for determining the status and a second sub-step 402.2 for exchanging the status information. The operational readiness status information indicates whether the respective converter module 11, 12 is operational or not operational, for example, defective.
[0059] In a decision step 403 following the status exchange step 402, the status information received from the other converter modules 11, 12, 13 is evaluated together with the converter's own status information. The decision step 403 comprises a first check step 403.1 for checking the converter's own operational readiness and a second check step 403.2 for checking the operational readiness of the other two converter modules 11, 12, 13.
[0060] Depending on the result of the first test step 403.1, i.e., depending on its own operational readiness, the respective converter module 11, 12 is then either deactivated or remains activated. For example, the converter module 11, 12 is deactivated (step 403.7) if the converter module 11, 12 is not operational (=0) and remains active if it is operational (=1) (step 403.8).
[0061] Depending on the result of the second test step 403.2, i.e., additionally depending on the status information of the other converter modules 11, 12, 13, a command for the third converter module 13 is determined and sent to the third converter module 13. With regard to the first converter module 11, this means, for example, that if the first converter module 11 is not ready for operation and both other converter modules 12, 13 are ready for operation, the third converter module 13 is commanded to replace the first converter module 11 (step 403.3). If the first converter module 11 is not ready for operation and the second converter module 12 is also not ready for operation, the third converter module 13 is commanded to replace either the first or the second converter module 11, 12 (step 403.4).If the first and third converter modules 11, 13 are operational and the second converter module 12 is not operational, the third converter module 13 is commanded to replace the second converter module 12 (step 403.6). In all other cases (the third converter module 13 is not operational or both the first and second converter modules 11, 12 are operational), the third converter module is commanded to remain inactive according to step 403.5.
[0062] In a confirmation step 404 following decision step 403, the third converter module 13 sends a confirmation message to the first and second converter modules 11, 12. The content of the confirmation message is whether or not the third converter module 13 has implemented the respective command from the first or second converter module 11, 12. The respective confirmation message can be received by the first and second converter modules 11, 12 and evaluated in such a way that the first and second converter modules 11, 12 implement their own corresponding procedure.
[0063] Figure 5 shows a flowchart explaining the processes in the third converter module 13 during handshake communication. Fundamentally, the processes in the third converter module 13 are similar to those in the first and second converter modules 11, 12. However, due to the fact that the third converter module can be connected to either the first or second actuator output T3, T4, or none at all, there are some differences, which are explained below.
[0064] According to the exemplary embodiment shown here, the handshake communication begins with a request step 401, in which the third converter module 13 checks whether a request message has been received from the other converter modules 11, 12. The third converter module 13 remains in the request step 401 until corresponding request messages have been received from the other two converter modules 11, 12. Optionally, it can be provided that a timer with a predetermined runtime is started in the request step 401 and subsequent steps of the handshake communication are only initiated when either the timer has expired or a request message has been received from all other converter modules 11, 12.
[0065] The request step 401 is basically optional, so that in a modification of the embodiment it can be omitted.
[0066] In a status exchange step 402 following the request step 401, the third converter module 13 determines its operational readiness and transmits corresponding status information to the other converter modules 11, 12. The status exchange step 402 is divided into a first sub-step 402.1 for determining the status and a second sub-step 402.2 for exchanging the status information. The operational readiness status information indicates whether the respective converter module 11, 12 is operational or not operational, for example, defective.
[0067] Depending on the result of a test step 403.1, i.e., depending on its own operational readiness, the third converter module 13 is then either deactivated (step 405.4), or the commands of the other two converter modules 11, 12 are evaluated in a second test step 405. For example, the third converter module 13 is deactivated according to a corresponding command from the other two converter modules 11, 12 (step 405.1), replaces the first converter module 11 (step 405.2), or replaces the second converter module 12 (step 405.3). An exception is the situation when both the first and the second converter module 11, 13 are not ready for operation and therefore command the third converter module to replace both the first and the second converter module. In this case, the third converter module 13 decides which converter module it will replace according to a predetermined criterion.
[0068] Finally, in the confirmation step 404, the third converter module 13 sends a confirmation message to the first and second converter modules 11, 12. The content of the confirmation message is whether the third converter module 13 has implemented the respective command of the first or second converter module 11, 12 or not.
[0069] List of reference symbols
[0070] 10 Control device
[0071] 11 first converter module
[0072] 12 second converter module
[0073] 13 third converter module
[0074] 20 Actuator
[0075] 100 actuator system
[0076] 401 request step
[0077] 402 Status exchange step
[0078] 402.1 Substep
[0079] 402.2 Substep
[0080] 403 Decision step
[0081] 403.1 Test step
[0082] 403.2 Test step
[0083] 403.3 Step: Command to replace first converter module
[0084] 403.4 Step: Command to replace first or second converter module
[0085] Step 403.5: Command to remain inactive
[0086] 403.6 Step: Command to replace second converter module
[0087] 403.7 Step: first converter module deactivated
[0088] 403.8 Step: first converter module active
[0089] 404 Confirmation step
[0090] 405 Test step
[0091] 405.1 Step: third converter module deactivated
[0092] 405.2 Step: third converter module replaces first converter module
[0093] 405.3 Step: third converter module replaces second converter module
[0094] 405.3 Step: third converter module deactivated
[0095] A1 Output switching device
[0096] A2 Output switching device
[0097] A3 Output switching device
[0098] BN1 supply network
[0099] BN2 supply network
[0100] C1 buffer capacity
[0101] C2 buffer capacity
[0102] C3 buffer capacity
[0103] E1 Input switching device
[0104] E2 Input switching device E3 Input switching device
[0105] 51 first operating state
[0106] 52 Error operating state
[0107] S4 second operating state
[0108] T 1 supply network connection
[0109] T2 supply network connection
[0110] T3 actuator connection
[0111] T4 actuator connection
[0112] T5 Actuator connection
[0113] T6 Actuator connection
[0114] U1 inverter
[0115] U2 converter
[0116] U3 inverter
Claims
Patent claims 1. Method for controlling a redundant actuator (20) having two partial actuators, in particular a motor having two separate winding sets, by means of a control device (10), wherein a first partial actuator is connected to a first actuator connection (T3) of the control device (10) and a second partial actuator is connected to a second actuator connection (T4) of the control device (10), wherein the control device (10) comprises a first, a second and a third converter module (11, 12, 13), which each have a converter (U1, U2, U3), wherein in a first operating state (S1) the first actuator connection (T3) is connected to the converter (U1) of the first converter module (11) and the second actuator connection (T4) is connected to the converter (U2) of the second converter module (12), and the actuator connections (T3, T4) are not connected to the converter (U3) of the third converter module (13) which is in a standby state,wherein a malfunction is detected in the first converter module (11) and the control device (10) transitions to a fault operating state (S2) in which the first actuator connection (T3) is isolated from the converters (U1, U2, U3) of the first, second and third converter modules (11, 12, 13) and the second actuator connection (T4) continues to be connected to the converter (U2) of the second converter module (12), wherein in the fault operating state (S2) a handshake communication takes place between the first, second and third converter modules (11, 12, 13) of the control device (10), wherein the handshake communication is used to negotiate which converter(s) (U1, U2, U3) of the converter modules (11, 12, 13) are to be connected to the actuator connections (T3, T4) of the control device (10).
2. Method according to claim 1, characterized in that the control device (10) of the handshake communication subsequently changes from the fault operating state (S2) into a second operating state (S4) in which the actuator connections (T3, T4) are connected to the converter(s) (U1, U2, U3) of the converter modules (11, 12, 13) as negotiated by means of the handshake communication.
3. Method according to one of the preceding claims, characterized in that the malfunction is detected by the first converter module (11) itself.
4. Method according to one of claims 1 or 2, characterized in that each of the three converter modules (11, 12, 13) monitors the respective other converter modules (11, 12, 13) and detects the malfunction in the first converter module (11).
5. Method according to one of the preceding claims, characterized in that the handshake communication comprises: - a request step in which the first, second and third inverter modules each check whether a request message has been received from the other inverter modules.
6. Method according to one of the preceding claims, characterized in that the handshake communication comprises: - a status exchange step in which the first, second and third inverter modules each determine status information of their operational readiness and transmit the determined status information to the respective other inverter modules.
7. The method according to claim 6, characterized in that the handshake communication comprises: - a decision step in which the first and second converter modules each determine a command for the third converter module based on the status information received from the respective other converter modules and send it to the third converter module.
8. The method according to claim 7, characterized in that the handshake communication comprises: - a confirmation step in which the third inverter module sends a confirmation message to the first and second inverter modules.
9. Method according to one of the preceding claims, characterized in that in the first operating state (S1) the actuator connections (T3, T4) of the control device (10) are isolated from the converter (U3) of the third converter module (13). REVISED SHEET (RULE 91) ISA / EP 10. Method according to one of the preceding claims, characterized in that the partial actuators act on a common drive element, in particular a common drive shaft.
11. Method according to one of the preceding claims, characterized in that the first, second and third converter modules (11, 12, 13) each have a logic unit for controlling the converter (U1, U2, U3).
12. Method according to one of the preceding claims, characterized in that the control device (10) has two supply network connections (T1, T2).
13. Method according to one of the preceding claims, characterized in that the first converter module (11) and the second converter module (12) are designed identically, in particular a handshake logic of the first and second converter module (11, 12) controlling the handshake communication is designed identically.
14. Actuator system, in particular for a steer-by-wire system, with a redundant actuator (20) having two partial actuators, in particular a motor having two separate winding sets, and with a control device (10) for controlling the redundant actuator (20), wherein the control device (10) comprises a first, a second and a third converter module (11, 12, 13), each having a converter (U1, U2, U3), wherein the control device (10) is configured to - in a first operating state (S1), to connect the first actuator connection (T3) to the converter (U1) of the first converter module (11) and the second actuator connection (T4) to the converter (U2) of the second converter module (12) and not to connect the actuator connections (T3, T4) to the converter (U3) of the third converter module (13) which is in a standby state, - to detect a malfunction in the first converter module (11) and to enter a fault operating state (S2) in which the first actuator connection (T3) is isolated from the converters (U1, U2, U3) of the first, second and third converter modules (11, 12, 13) and the second actuator connection (T4) is still connected to the converter (U2) of the second converter module (12), - in the fault operating state (S2), to carry out a handshake communication between the first, second and third converter modules (11, 12, 13) of the control device (10), wherein the handshake communication is used to negotiate which converter(s) (U1, U2, U3) of the converter modules (11, 12, 13) are to be connected to the actuator connections (T3, T4) of the control device (10).
15. Actuator system according to claim 14, characterized in that the redundant actuator is designed as an actuator on a tie rod.