Method for controlling a redundant actuator having two partial actuators and actuator system having a redundant actuator having two partial actuators

Abstract

The present invention relates to a method for controlling a redundant actuator (20) having two partial actuators, in particular a motor having two separate winding sets, by a control device (10), where a first partial actuator is connected to a first actuator terminal (T3) of the control device (10) and a second partial actuator is connected to a second actuator terminal (T4) of the control device (10). The control device (10) comprises first, second and third converter modules (11, 12, 13), each having a converter (U1, U2, U3). In the first operating state (S1), the first actuator terminal (T3) is connected to the converter (U1) of the first converter module (11), the second actuator terminal (T4) is connected to the converter (U2) of the second converter module (12), and the actuator terminals (T3, T4) are not connected to the converter (U3) of the third converter module (13), which is in standby operating state. A fault in the first converter module (11) is identified, and the control device (10) transitions to a fault operating state (S2) in which the first actuator terminal (T3) is isolated from the converters (U1, U2, U3) of the first, second, and third converter modules (11, 12, 12). In the fault operating state (S2), handshake communication is performed between the first, second, and third converter modules (11, 12, 13) of the control device (10), and the handshake communication negotiates which of the converters (U1, U2, U3) of the converter modules (11, 12, 13) will be connected to the actuator terminals (T3, T4) of the control device (10).

Description

[Technical Field]

[0001] The present invention relates to a method for controlling a redundant actuator having two partial actuators, in particular a motor having two separate winding sets, by a control device, wherein a first partial actuator is connected to a first actuator terminal of the control device and a second partial actuator is connected to a second actuator terminal of the control device, the control device comprising first, second and third converter modules, each having a converter.Furthermore, the present invention relates to an actuator system, in particular for a steer-by-wire system, having a redundant actuator having two partial actuators, in particular a motor having two separate winding sets, and a control device for controlling the redundant actuator, the control device comprising first, second and third converter modules, each having a converter. [Background technology]

[0002] The present invention can be used in the field of automotive engineering, particularly in the field of steer-by-wire systems. In such steer-by-wire systems, there is no mechanical connection between the steering wheel and the steered wheels. All steering commands are recorded by sensors on the steering wheel and electrically transmitted via a control unit to one or more steering actuators that perform the steering movements and transfer them to the wheels. In addition to these steering actuators, such steer-by-wire systems usually have an actuator on the steering wheel for providing a force feedback torque. Such force feedback actuators can give the driver the same steering feel, or haptic feedback, that they use when driving a vehicle with mechanically connected steering and power assistance.

[0003] An actuator system of the type mentioned at the outset is known from DE 10 202 111 2819 A1. This actuator system has two partial actuators and includes a redundant actuator that can be used, for example, as a force feedback actuator. To control this redundant actuator, a control device is used that can control the two partial actuators. The control device includes three converters, one of which can optionally replace one of the other two converters.

[0004] If a higher-level controller is used to regulate the individual converters, this has the disadvantage of requiring additional installation space. In addition, to avoid complete failure of the actuator system in the event of a fault in the higher-level controller, precautions must be taken to ensure that such higher-level controller is also configured redundantly. Such measures can further increase installation space requirements and costs. Summary of the Invention [Problem to be solved by the invention]

[0005] Against this background, the object arises of enabling the adjustment of redundant converter modules of a control unit with little effort and with minimal space requirements. [Means for solving the problem]

[0006] The object is to provide a method for controlling, by a control device, a redundant actuator having two partial actuators, in particular a motor having two separate winding sets, comprising: a first partial actuator connected to a first actuator terminal of the control device, and a second partial actuator connected to a second actuator terminal of the control device; the control device includes first, second, and third converter modules, each of the first, second, and third converter modules having a converter; In a first operating state, the first actuator terminal is connected to the converter of the first converter module, the second actuator terminal is connected to the converter of the second converter module, and the actuator terminal is not connected to the converter of the third converter module, which is in a standby operating state; a fault in the first converter module is identified, the controller transitions to a fault operating state, the first actuator terminal is isolated from the converters of the first, second, and third converter modules, and the second actuator terminal remains connected to the converter of the second converter module; This is achieved by a method in which, in a fault operating state, handshake communication is performed between the first, second, and third converter modules of the control device, and the handshake communication negotiates which of the converters of the converter modules will be connected to the actuator terminals of the control device.

[0007] The method according to the present invention provides handshake communication between the first, second, and third converter modules. If a fault is identified in a converter module (referred to herein as the first converter module) during the first operating state, the control device enters a fault operating state, in which the second partial actuator connected to the second phase connection continues to be controlled by the second converter module. In this regard, the redundant actuator can continue to operate at reduced power. During this fault operating state, handshake communication is performed between all three converter modules of the control device. After the fault operating state ends, negotiation is conducted between the three converter modules in which one or both converter modules are connected to the phase connection of the control device, so that the redundant actuator can then operate despite a fault in one of the converter modules. The handshake communication makes it possible to dispense with a higher-level control unit and enables modular configurations with independent converter modules. These measures enable adjustment of the converter modules of the control unit with little effort and minimal installation space requirements.

[0008] According to an advantageous embodiment of the present invention, the control device of the handshake communication can subsequently transition from the fault operating state, as negotiated by the handshake communication, to a second operating state in which the actuator terminals are connected to the converter module. This second operating state can form an operating state in which the redundant actuator is operated with the same functionality as in the first operating state. However, in the second operating state, the ability of the control device to compensate for further errors may be reduced or such error compensation may no longer be possible.

[0009] According to an advantageous embodiment of the invention, the fault can be identified by the first converter module itself, and particularly preferably, the identified fault is communicated from the first converter module to the other two converter modules.

[0010] According to an alternative advantageous embodiment, each of the three converter modules monitors the other converter modules and can identify a fault in the first converter module. For example, a converter module can send a regular, particularly periodic, signal to each of the other converter modules to indicate that a fault does not exist. If such a signal is absent, the other converter modules can identify that there is a fault in the first converter module.

[0011] According to an advantageous embodiment of the invention, the handshake communication comprises: - a request step in which the first, second and third converter modules each check whether a request message has been received from each other, in particular from all other converter modules.

[0012] The request message allows a converter module to notify other converter modules that it is about to engage in handshake communication. Optionally, a timer with a specified execution time may be started in the request step, allowing subsequent steps of the handshake communication to be initiated only when the timer has expired or request messages have been received from all other converter modules.

[0013] According to an advantageous embodiment of the invention, the handshake communication comprises: - A status exchange step in which the first, second, and third converter modules each determine status information about their operational readiness and communicate the determined status information to each of the other converter modules.

[0014] The operational readiness status information can indicate whether each converter module is ready for operation, whether it is not ready for operation, for example, whether there is a malfunction. Each converter module determines its status information by itself, eliminating the need for a higher-level device to determine it. Exchanging status information between all converter modules ensures that all converter modules are aware of each other's operational status. The exchange of status information is therefore the basis for determining which converter module or converter should be connected to the actuator terminal of the control device. The exchange can be carried out, for example, via separate data lines or a data bus. Since the status information available in the converter modules after the completion of the status exchange step is identical in all converter modules, subsequent decisions can lead to the same results in all converter modules.

[0015] According to an advantageous embodiment of the invention, the handshake communication comprises: - A decision step is included in which the first and second converter modules each determine a command for the third converter module based on status information received from the respective other converter modules, and send the command to the third converter module.

[0016] Based on the status information exchanged between the converter modules in the status exchange step, a decision can be made in the decision step as to which function the third converter module should assume. Preferably, this decision is made independently in the first converter module and the second converter module, and then a corresponding command is sent to the third converter module. If the commands received by the first converter module and the second converter module are identical, the commands can be easily executed in the third converter module. If the commands received by the first converter module and the second converter module are different, the third converter module determines by itself, independently of the first converter module and the second converter module, which of the two commands to execute. For example, it may occur that both the first converter module and the second converter module are not ready to operate, and therefore the first converter module sends a command to the third converter module to take over the function of the first converter module, and the second converter module sends a command to the third converter module to take over the function of the second converter module. In this case, the third converter module preferably determines whether it assumes that function according to predefined criteria.

[0017] According to an advantageous embodiment of the invention, the handshake communication comprises: - a confirmation step in which the third converter module sends a confirmation message to the first and second converter modules.

[0018] The content of the confirmation message is preferably whether the third converter module has executed the command of the first converter module or the second converter module, and each confirmation message can be received by the first converter module and the second converter module, and the first converter module or the second converter module can determine to execute its own corresponding procedure.

[0019] According to an advantageous embodiment of the invention, in the first operating state, the actuator terminals of the control device can be isolated from the converter of the third converter module. Preferably, the third converter module is in an inactive state. In this respect, the third converter module in such a configuration forms a cold reserve in the control device.

[0020] According to an advantageous embodiment of the invention, the partial actuators can act on a common drive element, in particular a common drive shaft. Preferably, the redundant actuator is configured as a force feedback actuator for providing a force feedback torque to the steering wheel and / or as an actuator for adjusting the steering wheel position and / or as an actuator for moving the steering wheel into a retracted position. According to an alternative advantageous embodiment, the redundant actuator can be configured as an actuator on a tie rod.

[0021] According to an advantageous embodiment of the present invention, the first, second, and third converter modules may each have a logic unit for controlling the converter. The converters are preferably configured as converters, in particular B6 converters. The first and second converter modules preferably each further comprise an output switching device capable of selectively establishing or interrupting a connection between the converter and an actuator terminal of the control device. The third converter module preferably further comprises an output switching device capable of selectively establishing or interrupting a connection between the converter of the third converter module and one of the first and second actuator terminals of the control device. Preferably, the output switching device may comprise a bidirectional blocking switch, in particular a bidirectional blocking semiconductor switch.

[0022] According to an advantageous embodiment of the invention, the control device may have two supply network terminals, which may be connected to the inputs of the converter modules via input switching devices. The first and second converter modules preferably each comprise an input switching device capable of selectively establishing or interrupting a connection between the converter module and the supply network terminal of the control device. The third converter module preferably further comprises an input switching device capable of selectively establishing or interrupting a connection between the third converter module and one of the first and second supply network terminals of the control device.

[0023] According to an advantageous embodiment of the invention, the first and second converter modules can be configured identically, in particular the handshake logic of the first and second converter modules controlling the handshake communication can be configured identically. The third converter module preferably has converters configured identically to the outputs of the first and second converter modules. The third converter module preferably has handshake logic controlling the handshake communication and configured differently from the handshake logic of the first and second converter modules.

[0024] According to an advantageous embodiment of the present invention, before each time the entire system is started, a handshake communication is performed between the first, second, and third converter modules of the control device, which allows negotiation of which of the converters of the converter modules will be connected to the actuator terminals of the control device, ensuring that any faults that occur or develop during the start-up phase will lead to the selection of a functional converter module.

[0025] A further object of the present invention is to provide an actuator system, in particular for a steer-by-wire system, having a redundant actuator with two partial actuators, in particular a motor with two separate winding sets, and having a control device for controlling said redundant actuator, the control device comprising first, second and third converter modules, each of the first, second and third converter modules having a converter, the control device comprising: - in a first operating state, a first actuator terminal is connected to a converter of a first converter module, a second actuator terminal is connected to a converter of a second converter module, and no actuator terminal is connected to a converter of a third converter module that is in a standby operating state; - identifying a fault in the first converter module and transitioning to a fault operating state in which the first actuator terminals are isolated from the converters of the first, second, and third converter modules and the second actuator terminals remain connected to the converters of the second converter module; - In a fault operating state, handshake communication is performed between the first, second, and third converter modules of the control device, and the handshake communication is configured to negotiate which of the converters of the converter modules will be connected to the actuator terminals of the control device.

[0026] The same advantages and technical effects can be achieved with an actuator system as already explained in connection with the method according to the invention.

[0027] According to an advantageous embodiment of the invention, the redundant actuator can be configured as an actuator on a tie rod. According to alternative advantageous embodiments of the actuator system, the redundant actuator can be configured as a force feedback actuator for providing a force feedback torque to the steering wheel and / or an actuator for adjusting the steering wheel position and / or an actuator for moving the steering wheel into a retracted position.

[0028] Alternatively or additionally, the advantageous embodiments and features described in connection with the method according to the invention can also be used in the actuator system according to the invention, either individually or in combination.

[0029] Further details and advantages of the invention are explained below with reference to exemplary embodiments shown in the drawings. [Brief explanation of the drawings]

[0030] [Figure 1]1 shows an exemplary embodiment of an actuator system according to the invention in a block diagram. [Figure 2] 2 shows an exemplary embodiment of a control device for the actuator system according to FIG. 1; [Figure 3] 1 shows a flow diagram of an exemplary embodiment of a method according to the present invention for operating an actuator system; [Figure 4] 1 shows a flowchart illustrating the processes in the first and second converter modules during handshake communication. [Figure 5] 10 shows a flowchart illustrating the process in the third converter module during handshake communication. DETAILED DESCRIPTION OF THE INVENTION

[0031] FIG. 1 illustrates, in block diagram form, an embodiment of an actuator system 100 having a redundant actuator 20 and a controller 10 for controlling the actuator 20. The actuator system 100 includes the redundant actuator 20, which in the exemplary embodiment is configured as an electric motor having two separate winding sets. Each separate winding set forms a partial actuator of the redundant actuator 20 and can be controlled independently of each other. The actuator system 100 can be configured for use in a steer-by-wire system, in which case the actuator 20 is an actuator on a tie rod. Alternatively, the actuator 20 can be a force feedback actuator for providing force feedback torque to a steering wheel of the steer-by-wire system.

[0032] The control device 10 is connected to two independent or partially independent supply networks BN1, BN2. When the actuator system 100 is used in a steer-by-wire system, the two supply networks 1, 2 can be configured as DC voltage on-board networks of the vehicle. To connect the control device 10 to the two on-board networks, the control device 10 comprises a first supply network terminal T1 and a second supply network terminal T2.

[0033] The control device 10 further comprises a first actuator terminal T3 and a second actuator terminal T4, via which the control device 10 is connected to a redundant actuator 20. The first actuator terminal T3 is connected to a first partial actuator via a first terminal T5 of the actuator 20, and the second actuator terminal T4 is connected to a second partial actuator via a second terminal T6 of the actuator 20. In an exemplary embodiment, both partial actuators act on a common drive element, for example a common drive shaft.

[0034] As can be seen in the detailed representation of the control device 10 in FIG. 2, the first actuator terminal T3 and the second actuator terminal T4 are multiphase, here three phase.

[0035] The control device 10 comprises a total of three converter modules 11, 12, 13, each having an input switching device E1, E2, E3, a buffer capacitor C1, C2, C3, a converter U1, U2, U3, and an output switching device A1, A2, A3. A further component of the converter modules 11, 12, 13 is a logic unit (not shown) for controlling the function of the respective converter modules 11, 12, 13, in particular the respective input switching device E1, E2, E3, the respective converter U1, U2, U3, and the respective output switching device A1, A2, A3.

[0036] 2, the control device 10 is in a first operating state in which the first actuator terminal T3 is connected to the converter U1 of the first converter module 11, and the second actuator terminal T4 is connected to the converter U2 of the second converter module 12. The output switching device A1 of the first converter module 11 is placed in a conductive state to connect the converter U1 of the first converter module 11 to the first actuator terminal T3. Similarly, the output switching device A2 of the second converter module 12 is placed in a conductive state to connect the converter U2 of the second converter module 12 to the second actuator terminal T4. However, the output switching device A3 of the third converter module 13 isolates the converter U3 of the third converter module 13 from the actuator terminals T3 and T4.

[0037] On the input side, in a first operating state, the input switching devices E1, E2 of the first converter module 11 and the second converter module 12 are in a conducting state, and the input switching device E3 of the third converter module 13 is in an insulating state.

[0038] In a first operating state, the first partial actuator of the redundant actuator 10 is controlled by the first converter module 11 of the control device 10, and the second partial actuator is controlled via the second converter module 12 of the control device 10.

[0039] FIG. 3 shows a flow diagram of an exemplary embodiment of a method according to the invention for operating an actuator system, in which: a first operating state S1, - faulty operating state S2, Second operating state S4 It is shown whether the respective converter U1, U2, U3 of the converter modules 11, 12, 13 is connected to the actuator terminals T3, T4 and is active (=1), or is not connected to the actuator terminals T3, T4 and is inactive (=0), or is connected to the actuator terminals T3, T4 and at the same time a fault is identified in the respective converter module 11, 12, 13 (=lightning symbol).

[0040] In the first operating state S1, the first actuator terminal T3 is connected to the converter U1 of the first converter module 11, and the second actuator terminal T4 is connected to the converter U2 of the second converter module 12. In addition, the converter U3 of the third converter module 13 is in a standby operating state in which the converter U3 of the third converter module 13 is not connected to one of the actuator terminals T3, T4.

[0041] If a fault is identified in the first converter module 11, the control device 10 initially remains in the fault operating state S2 in which the second actuator terminal T4 remains connected to the converter U2 of the second converter module 12, so that the partial actuator connected to the second actuator terminal T4 can continue to operate.

[0042] In this fault operating state S2, handshake communication is performed between the first, second and third converter modules 11, 12, 13, and the handshake communication negotiates which converters U1, U2, U3 of the converter modules 11, 12, 13 will be connected to the actuator terminals T3, T4 of the control device 10 after the fault operating state S2.

[0043] After completing the handshake communication in the fault operating state S2, the control device 10 then transitions from the fault operating state S2 to a second operating state S4 in which the actuator terminals T3 and T4 are connected to the converters U1, U2, and U3 of the converter modules 11, 12, and 13 as negotiated by the handshake communication. In the case shown in FIG. 3, the second converter module 12 and the third converter module 13 are active in the second operating state. The converter U2 of the second converter module is connected to the second actuator output T4, and the converter U3 of the third converter module 13 is connected to the first actuator output T3. At this point, the third converter module 13 in the second operating state S4 assumes the function previously assumed by the first converter module 11 in the first operating state.

[0044] FIG. 4 shows a flow chart illustrating the processes in the first and second converter modules 11, 12 during handshake communication.

[0045] According to the embodiment shown here, the handshake communication starts with a request step 401, in which the first converter module and the second converter module each check whether a request message has been received from the respective other converter module. The first converter module 11 and the second converter module 12 remain in the request step 401 until corresponding request messages have been received from the other two converter modules 11, 12, 13. Optionally, in the request step 401, a timer with a predetermined runtime can be started, allowing subsequent steps of the handshake communication to be started only when the timer has expired or request messages have been received from all other converter modules 11, 12, 13.

[0046] In principle, the request step 401 is optional, so in a variant of the exemplary embodiment it can be omitted.

[0047] The request step 401 is followed by a status exchange step 402 in which the first converter module 11 and the second converter module 12 each determine their operational readiness and communicate corresponding status information to the respective other converter module 11, 12, 13. The status exchange step 402 is divided into a first sub-step 402.1 for determining the status and a second sub-step 402.2 for exchanging status information. The operational readiness status information indicates whether the respective converter module 11, 12 is operational or not, e.g. whether it is faulty.

[0048] In a decision step 403 following the status exchange step 402, the status information received from the other converter modules 11, 12, 13 is evaluated together with their individual status information. The decision step 403 comprises a first check step 403.1 for checking the individual operational readiness and a second check step 403.2 for checking the operational readiness of the other two converter modules 11, 12, 13.

[0049] Depending on the result of the first check step 403.1, i.e. depending on its individual operational readiness, the respective converter module 11, 12 is then deactivated or remains activated, for example, the converter module 11, 12 is deactivated (step 403.7) if the converter module 11, 12 is not ready for operation (=0) and is kept active (step 403.8) if it is ready for operation (=1).

[0050] Depending on the result of the second check step 403.2, i.e. additionally depending on the status information of the other converter modules 11, 12, 13, a command for the third converter module 13 is determined and sent to the third converter module 13. For the first converter module 11, this means, for example, that if the first converter module 11 is not ready for operation and both of the other converter modules 12, 13 are ready for operation, the third converter module 13 is instructed to take over for the first converter module 11 (step 403.3). If the first converter module 11 is not ready for operation and the second converter module 12 is not ready for operation either, the third converter module 13 is instructed to take over for either the first converter module 11 or the second converter module 12 (step 403.4). If the first converter module 11 and the third converter module 13 are ready to operate and the second converter module 12 is not ready to operate, the third converter module 13 is instructed to take over for the second converter module 12 (step 403.6). In all other cases (the third converter module 13 is not ready to operate or both the first converter module 11 and the second converter module 12 are ready to operate), the third converter module is instructed to remain inactive according to step 403.5.

[0051] In a confirmation step 404 following the decision step 403, the third converter module 13 sends a confirmation message to the first converter module 11 and the second converter module 12. The content of the confirmation message is whether the third converter module 13 has executed the respective command of the first converter module 11 or the second converter module 12. The respective confirmation messages are received by the first converter module 11 and the second converter module 12, and can be determined so that the first converter module 11 or the second converter module 12 executes its own corresponding procedure.

[0052] 5 shows a flowchart for explaining the process in the third converter module 13 during handshake communication. In principle, the process in the third converter module 13 is similar to the process in the first converter module 11 and the second converter module 12. However, due to the fact that the third converter module can be connected to either the first actuator output T3 or the second actuator output T4, or neither, there are some differences, which will be explained below.

[0053] According to the embodiment shown here, the handshake communication starts with a request step 401 in which the third converter module 13 checks whether a request message has been received from each of the other converter modules 11, 12. The third converter module 13 remains in the request step 401 until corresponding request messages have been received from the other two converter modules 11, 12. Optionally, in the request step 401 a timer with a predetermined runtime can be started, allowing subsequent steps of the handshake communication to be started only when the timer has expired or when request messages have been received from all other converter modules 11, 12.

[0054] In principle, the request step 401 is optional, so in a variant of the exemplary embodiment it can be omitted.

[0055] The request step 401 is followed by a status exchange step 402 in which the third converter module 13 determines its operational readiness and communicates corresponding status information to the other converter modules 11, 12. The status exchange step 402 is divided into a first sub-step 402.1 for determining the status and a second sub-step 402.2 for exchanging status information. The operational readiness status information indicates whether the respective converter module 11, 12 is operational or not, e.g. whether it is faulty.

[0056] Depending on the result of check step 403.1, i.e., depending on its own operational readiness, the third converter module 13 is either deactivated (step 405.4) or the commands of the other two converter modules 11, 12 are determined in the second check step 405. For example, according to the corresponding commands from the other two converter modules 11, 12, the third converter module 13 is deactivated (step 405.1) and replaces the first converter module 11 (step 405.2) or replaces the second converter module 12 (step 405.3). An exception to this is the situation where both the first and second converter modules 11, 13 are not ready for operation and therefore instruct the third converter module to replace both the first and second converter modules. In this case, the third converter module 13 decides which converter module to replace according to predetermined criteria.

[0057] Finally, in a confirmation step 404, the third converter module 13 sends a confirmation message to the first converter module 11 and the second converter module 12. The content of the confirmation message is whether the third converter module 13 has executed the command of each of the first converter module 11 or the second converter module 12. [Explanation of symbols]

[0058] 10. Measuring equipment 11 First Converter Module 12 Second Converter Module 13 Third Converter Module 20 Actuator 100 Actuation System 401 Request Step 402 Status Exchange Step 402.1 Substeps 402.2 Substeps 403 Decision Step 403.1 Check Step 403.2 Check Step 403.3 Step: Command the first converter module to take over 403.4 Step: Command the first or second converter module to take over 403.5 Step: Command to remain inactive 403.6 Step: Command the second converter module to take over 403.7 Step: First converter module deactivated 403.8 Step: First Converter Module Active 404 confirmation step 405 Check Step 405.1 Step: Third converter module deactivated 405.2 Step: The third converter module replaces the first converter module 405.3 Step: A third converter module replaces the second converter module 405.3 Step: Third converter module deactivated A1 Output Switching Device A2 Output Switching Device A3 Output Switching Device BN1 Supply Network BN2 Supply Network C1 Buffer capacitor C2 buffer capacitor C3 buffer capacitor E1 input switching device E2 Input Switching Device E3 Input Switching Device S1 First operating state S2 Fault operating state S4 Second operating state T1 supply network terminal T2 supply network terminal T3 Actuator Terminal T4 Actuator Terminal T5 Actuator terminal T6 Actuator terminal U1 Converter U2 Converter U3 Converter

Claims

1. A method for controlling a redundant actuator (20) having two partial actuators, in particular a motor having two separate winding sets, by a control device (10), comprising: a first partial actuator is connected to a first actuator terminal (T3) of the control device (10), and a second partial actuator is connected to a second actuator terminal (T4) of the control device (10); the control device (10) comprises first, second and third converter modules (11, 12, 13), each of the first, second and third converter modules (11, 12, 13) having a converter (U1, U2, U3); In a first operating state (S1), the first actuator terminal (T3) is connected to the converter (U1) of the first converter module (11), the second actuator terminal (T4) is connected to the converter (U2) of the second converter module (12), and the actuator terminals (T3, T4) are not connected to the converter (U3) of the third converter module (13) which is in a standby operating state; a fault in the first converter module (11) is identified, the control device (10) transitions to a fault operating state (S2), the first actuator terminal (T3) is isolated from the converters (U1, U2, U3) of the first, second and third converter modules (11, 12, 13), and the second actuator terminal (T4) remains connected to the converter (U2) of the second converter module (12); In the fault operating state (S2), handshake communication is performed between the first, second, and third converter modules (11, 12, 13) of the control device (10), and the handshake communication negotiates which of the converters (U1, U2, U3) of the converter modules (11, 12, 13) will be connected to the actuator terminals (T3, T4) of the control device (10).

2. 2. The method of claim 1, wherein the control device (10) of the handshake communication subsequently transitions from the fault operating state (S2) to a second operating state (S4) in which the actuator terminals (T3, T4) are connected to the converters (U1, U2, U3) of the converter modules (11, 12, 13) as negotiated by the handshake communication.

3. 3. A method according to claim 1 or 2, characterized in that the fault is identified by the first converter module (11) itself.

4. 3. The method according to claim 1, wherein each of the three converter modules (11, 12, 13) monitors the respective other converter modules (11, 12, 13) to identify the fault in the first converter module (11).

5. The handshake communication A method according to any one of claims 1 to 4, characterized in that it includes a request step in which the first, second and third converter modules each check whether a request message has been received from the respective other converter module.

6. The handshake communication A method according to any one of claims 1 to 5, characterized in that it includes a status exchange step in which each of the first, second and third converter modules determines status information about its operational readiness and communicates the determined status information to the respective other converter modules.

7. The handshake communication The method of claim 6, characterized in that it includes a decision step in which the first and second converter modules each determine a command for the third converter module based on the status information received from the respective other converter module and send the command to the third converter module.

8. The handshake communication 8. A method according to claim 7, characterized in that it includes a confirmation step in which said third converter module sends a confirmation message to said first and second converter modules.

9. 9. The method according to claim 1, wherein in the first operating state (S1), the actuator terminals (T3, T4) of the control device (10) are isolated from the converter (U3) of the third converter module (13).

10. 10. Method according to any one of the preceding claims, characterized in that the partial actuators act on a common drive element, in particular a common drive shaft.

11. 11. The method according to any one of claims 1 to 10, characterized in that the first, second and third converter modules (11, 12, 13) each have a logic unit for controlling the converters (U1, U2, U3).

12. 12. Method according to any one of the preceding claims, characterized in that the control device (10) has two supply network terminals (T1, T2).

13. 13. The method according to claim 1, wherein the first converter module (11) and the second converter module (12) are configured identically, in particular the handshake logic of the first and second converter modules (11, 12) that controls the handshake communication are configured identically.

14. An actuator system, in particular for a steer-by-wire system, comprising: A redundant actuator (20) having two partial actuators, in particular a motor having two separate winding sets, and A control device (10) for controlling the redundant actuators (20), the control device (10) comprising first, second and third converter modules (11, 12, 13), each having a converter (U1, U2, U3), the control device (10) in a first operating state (S1), a first actuator terminal (T3) is connected to the converter (U1) of the first converter module (11), a second actuator terminal (T4) is connected to the converter (U2) of the second converter module (12), and the actuator terminals (T3, T4) are not connected to the converter (U3) of the third converter module (13), which is in a standby operating state; - identifying a fault in the first converter module (11) and transitioning to a fault operating state (S2) in which the first actuator terminal (T3) is isolated from the converters (U1, U2, U3) of the first, second and third converter modules (11, 12, 13) and the second actuator terminal (T4) remains connected to the converter (U2) of the second converter module (12); - An actuator system configured to perform handshake communication between the first, second and third converter modules (11, 12, 13) of the control device (10) in the fault operating state (S2), and configured such that the handshake communication negotiates which of the converters (U1, U2, U3) of the converter modules (11, 12, 13) will be connected to the actuator terminals (T3, T4) of the control device (10).

15. The actuator system of claim 14 , wherein the redundant actuator is configured as an actuator on a tie rod.

Images