Redundant Actuator Control via Synchronized Output Modules
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In redundant control systems, particularly in PCS7 systems, the interruption or failure of a control computer or field bus leads to a complete redundancy failure due to the actuator receiving the sum of frozen and current output values, resulting in uncontrollable and undefined behavior of redundant output modules during power supply removal, hindering rapid changeover.
Innovation Solution
A redundant control system where two output modules are interconnected via a communication link to exchange information about commands for outputting substitute values, ensuring that both modules receive the command before implementing it, thereby preventing the actuator from receiving an unintended sum of output values, and using decoupling diodes to manage digital and analog outputs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If output modules output substitute values upon bus fault detection, then system reliability is improved, but the actuator may receive unintended sum of frozen and current output values causing harmful effects
Solution Approach 1:
The output modules exchange information about command receipt via communication link, creating a feedback mechanism that ensures both modules receive the command before implementing substitute value output, preventing unintended summing of output values
Solution Approach 2:
A communication link acts as an intermediary between the two output modules, coordinating their operation to ensure synchronized command implementation and prevent harmful effects from unsynchronized output
2Device complexity
If power supply is removed from redundant output modules, then device complexity is reduced, but changeover time increases due to uncontrollable and undefined behavior
Solution Approach 1:
The control system coordinates the power supply removal of redundant output modules in advance, ensuring that only one module is powered at a time during normal operation, and the standby module is already prepared to take over immediately upon fault detection, eliminating undefined behavior during changeover
Data Source
AI summary
A method and redundant control system for an actuator in which two redundant control computers are connected via buses to a respective peripheral station containing an interface module and at least one periphery module, wherein the actuator is connected to mutually decoupled signal outputs of two periphery modules, each forming an output module, of the two peripheral stations, where output values generated by the two redundant control computers for the actuator are transmitted by the interface modules to the output modules, wherein upon detection of a bus fault, the respective interface module transmits a command to all downstream output modules to output substitute values, and where output modules to which the actuator is connected exchange information about receipt of the command via a communication link and implement it only if another output module concerned has also received the command so as to prevent failure modes in redundant operation.