The present invention is related to the field of electro-mechanics; more specifically, the invention is related to the field of high reliability motors. Extremely reliable and efficient motors and servos are particularly well suited for aeronautical applications and especially Fly By Wire systems.

Brushless DC (BLDC) motors are synchronous electric motors, which are powered by direct-current (DC) electricity and have an electronic commutation system. Although references herein are mainly to BLDC motors, the same principals of the invention hereof can also be applied to other motors incorporating controllers and angular sensors such as stepper motors, AC motors and servos etc'. BLDC motors are popular in the aircraft industry. The aircraft industry includes a variety of aerial vehicles ranging from the conventional airplanes and helicopters to Unmanned Aerial Vehicles (UAV), Mini Remote Piloted Vehicles (MRPV) and modeling platforms. Recent technology has faded the dichotomy between manned and unmanned aerial vehicles as many once manned vehicles undergo modifications by incorporating technology which may substitute the pilot during some or even the entire flight, such that the attendance of the pilot in such aerial vehicles is no longer imperative. Whether manned or unmanned, Fly By Wire (FBW) systems replace manual control of an aircraft with an electronic interface, the movements of flight controls are converted to electronic signals transmitted by wires, and flight control computers determine how to operate the electromechanical components installed, such as the BLDC motors to provide the expected response.

A FBW aircraft can be lighter than a similar design with conventional controls. The reduced mass is partly due to the lower overall weight of the system components and partly because the natural aerodynamic stability of the aircraft can be relaxed (slightly for a transport aircraft and more for a maneuverable fighter), which means that the stability surfaces that are part of the aircraft structure can therefore be made smaller.

A major concern with FBW systems is reliability. While traditional mechanical or hydraulic control systems usually fail gradually, in FBW systems, the loss of all flight control computers could be simultaneous and immediate, rendering the aircraft uncontrollable. For this reason, most FBW systems incorporate a redundant set of computers, BLDC motors, input and output channels (duplex, triplex, or quadruplex). Alternatively, some systems include mechanical or hydraulic backup systems, but mechanical backup of electronic controls may cancel out many above mentioned advantages of electronic systems. Therefore, modern FBW aircraft generally avoid combining mechanical and electronic controls by installing additional independent FBW channels, thereby reducing the possibility of overall failure. Reducing failure probability is desirable in itself and is also necessary to meet the standards of the independent regulatory and safety authorities, which are responsible for aircraft design, testing and certification prior to operational service.

Highly reliable electronic controls are also important in such applications as satellites and space probes, unmanned and manned maritime vehicles and terrestrial robots.

Various solutions have therefore been offered by the art in order to improve the reliability of FB W systems in general, and BLDC motors and servos in particular.

The solutions offered by the art can be placed in two general categories as follows:

1. Hardware solutions - solutions which are designed to minimize failures due to malfunction of hardware components (for example, short circuits of the stator wire windings or driver terminals, or defective bobina manufacturing).

2. Firmware solutions - solutions which are designed to minimize the effect of failures. For instance, firmware may be used to control redundant components or to adjust the system to compensate for malfunctioning components. Firmware solutions are commonly used to prevent failure of electronic controllers in the event of sensor failure (e.g., errors or loss of sensitivity in the readings of hall sensors, encoders, resolvers, or input channels). A common strategy to increase reliability is to supply redundant duplicates of sensitive components within the BLDC motor wherein the motor is capable of functioning without all of the components, or even supplying redundant sets of BLDC motors wherein the system is capable of functioning with only some of the motors. The number of redundant components is in accordance with the level of reliability that is to be achieved. This is called the common redundancy approach and it has two possible configurations: In the first configuration, when all components are functional (the original condition) all components function simultaneously. Should failure occur in a redundant component within the BLDC motor, the remaining operative components continue to work and are sufficient for the entire system to remain functional (albeit with reduced performance). Alternatively, in the second configuration, in the original condition (when all components are functional) a primary set of components work while a backup set remains idle. If one of the primary components malfunctions, a backup component is activated in its place.

The main drawbacks of this Common Redundancy approach can be categorized as follows:

a. Complexity in operating redundant components and motors simultaneously in the first configuration;

b. Lack of efficient resource allocation in the second configuration (where there are always extra components that are not in use); c. Complexity in detecting malfunctions, determining the malfunction source and responding properly to neutralize or replace the failing component (sometimes necessary in either approach);

d. Sensitivity of each redundant set (motor or system) to a crash of a single component (for example a Hall Effect sensor) which may terminate the operation of an entire set of corresponding components, or (worse) the entire cooperative system.

As a result of the above drawbacks, the Common Redundancy approach increases the overall weight of the system thereby compromising performance. Manufacturing costs of the system are also increased due to the multiplicity of components and their complex control design. Paradoxically, as complexity increases, new reliability problems also arise. The triple modular redundancy (TMR) approach was developed in electronics applications as an alternative to the common redundancy approach. TMR has been applied to some degree to BLDC motors to allow improvement in reliability without sacrificing efficiency. TMR is a fault tolerant form of N-modular redundancy. In TMR, three independent systems perform a process and the combined outputs of the systems are processed by a voting system to produce a single uniform output. If any one of the three systems fails, the other two systems can correct and mask the fault. A drawback of TMR is that if the voter fails then the complete system will fail. This solution shall be referred to herein as the Common Voting solution. Some typical publications which demonstrate the state of the art include:

US Publication 20050174006 to Rabe teaches an improved stator for an electric motor. In one form of the invention, each stator slot in a stator contains only coils of a single phase. Thus, if a short occurs in a single coil, no other phase is present in the slot and the short is limited to the single coil. In another form of the invention, pre-formed coils are constructed, having hollow cores. Each coil is inserted over a stator tooth, and then additional structure is added to form a rim from which the teeth extend, somewhat like spokes on a wheel.

Thus, Rabe teaches a common redundancy approach by replicating independent hardware. Rabe does not provide an efficient overall solution. According to Rabe, if a coil fails, then the motor will continue to function at reduced efficiency. The malfunctioning of an electronic component will lead to failure of a coil or even the entire system.

US Patent 4434389 to Langley, teaches an electric motor which is wound with redundant sets of windings which are energized by independent electric circuits to enable operation of the motor even in the presence of a failure of a winding or a failure of an energization circuit. The motor may be of the permanent magnet form with electronic switching of the winding currents in lieu of switching via a commutator, known as a brushless DC motor, in which case separate sensing devices for sensing the relative position between the moving and stationary members of the motor, such as Hall Effect sensors, are employed with each winding set and energization circuit. The sets of windings, when placed on the stator, are physically spaced apart so as to minimize magnetic coupling therebetween.

Langley employs the common redundancy approach by supplying a few sets of independent wire windings, each winding having an independent dedicated commutation circuit. Langley's system suffers from the drawbacks of the Common Redundancy approach described above. For example, according to Langley, should a single Hall Effect sensor within a certain independent set crash, then that entire set including its corresponding stator windings will become inoperative. In addition, Langley does not provide a simple method for adapting operation of those sets of windings and electric circuits that remain functional in order to counteract the effects of a malfunctioning set of windings.

International Application Publication W09414226(A1) to Hoel depicts a fault tolerant brushless DC motor which includes plural parallel windings, each individually controlled by a respective control module. At least three windings are provided, such that in the event there is a short in one of the windings, the other two windings continue to generate a field to cause the rotor of the motor, having permanent magnets mounted thereon, to rotate. Preferably, at least three windings are provided, such that in the event of a single short, one of the remaining two windings serves to nullify the drag generated by the shorted winding with the other remaining winding generating a sufficient field to cause the rotor of the motor to rotate. Hoel therefore provides plural windings (at least three), such that should a certain winding fail, another winding will be used to nullify the failed winding and the remaining winding will operate the system. This approach requires relatively complex control in order to send specific command signals to each winding in case of a malfunction in one of the windings. Hoel's system suffers from the drawbacks of the Common Redundancy approach described above. For example, according to Hoel, should a single Hall Effect sensor within a certain independent set crash, then that entire set including its corresponding stator windings will become inoperative. Electronic systems are sometimes appreciated by the redundancy of the system as a whole, and not by the redundancy of specific components within the system. For this reason, it is important to provide a motor which may support the redundancy of the system in which it is incorporated as a whole (for example; the motor may include redundant interfaces to redundant communication and control inputs). Moreover, the invention hereof provides a dynamic architecture according to which the required level of redundancy can be determined to each component integrated into the motor. In other words, each component of the motor (e.g., sensors, controllers, coils, bus lines etc') can be designed to sustain a single, a double, a triple and up to an "N" number of failures without causing the entire motor to become inoperative.

It is therefore desirable to provide a redundant motor both hardware wise and firmware wise. It is therefore desirable to provide a redundant motor which continues to operate in case of a hardware failure, without initiating a complex control protocol.

It is further desirable to provide a motor having an efficient redundancy method wherein the number of multiplications of the sets of windings is independent of the number of multiplications of the electronic controllers, their corresponding sensors and firmware.

It is further desirable to provide a motor which can be integrated into a redundant system.

It is further desirable to provide a motor having a dynamic architecture to determine the redundancy level which is to be achieved. It is further desirable to provide a redundant motor method which is adaptable to meet different industry standards or regulatory requirements.

It is further desirable to provide a redundant motor which is relatively inexpensive to manufacture.

Other objects and advantages of the invention will become apparent as the description proceeds. SUMMARY OF THE INVENTION

Many embodiments are possible for a motor with hardware and firmware redundancy.

An embodiment of a motor may include a first individually excitable inductor circuit and a second individually excitable inductor circuit. The embodiment of a motor may also include plurality of sensors for sensing an angular position of a rotor. The first individually excitable inductor circuit may be synchronized to a combined output from a first set of at least three of the sensors, and the second individually excitable inductor circuit may be synchronized to a combined output from a second set of at least three of the sensors. The intersection of said first set and said second set may contain at least one sensor.

In and embodiment of a motor, the second set may be a subset of said first set.

In and embodiment of a motor, the second set may be equal to said second set.

An embodiment of a motor may also include a redundant control structure and the energizing of the first individually excitable inductor circuits may be according to a combined output signal of the redundant control structure.

In and embodiment of a motor, the plurality of sensors may include a Hall sensor array, an encoder or a resolver.

In an embodiment of a motor, each of the individually excitable inductor circuits may include at least one respective inductor and at least one respective driver for energizing the inductor, and at least one controller for synchronizing the driver. In and embodiment of a motor, one driver of may energize a plurality of inductors.

An embodiment of a motor may also include a fuse for preventing backward propagation of a failure.

An embodiment of a method of operating a motor may include supplying at least a three individually excitable inductor circuits including a first and a second individually excitable inductor circuit. Each of the individually excitable inductor circuits may include a corresponding coil and a corresponding controller. The outputs from a first set of at least three angular sensors may be combined into a first combined output and the first individually excitable inductor circuit may be synchronized to the first combined output. Outputs from a second set of at least three angular sensors may be combined into a second combined output and the second individually excitable inductor circuit may be synchronized to the second combined output. There may be at least one angular sensor that is shared between the first set and said second set.

In an embodiment of a method of operating a motor the second set may be a subset of the first set.

In an embodiment of a method of operating a motor the second set may be equal to the first set.

An embodiment of a method of operating a motor may also include integrating control signals from a redundant control structure, and energizing the first coil according to the integrated control signal. BRIEF DESCRIPTION OF THE DRAWINGS

In the drawings:

Fig. 1 is a schematic illustration of a simple embodiment of a redundant servo motor; Fig. 2 is a block diagram of another simple embodiment of a redundant servo motor; Fig. 3 is a schematic illustration of a preferred embodiment of a redundant servo motor; Fig. 4 is a block diagram of a preferred embodiment of a redundant servo motor;

Fig. 5 is a flowchart illustrating a method of driving a redundant servo motor;

Fig. 6 is a preferred embodiment of a hierarchal structured redundant servo-motor with three phase drivers;

Fig. 7 is a schematic illustration of a preferred embodiment of multiple redundant coils installed into a servo motor;

Fig. 8a is a schematic illustration of an alternative embodiment of a servo where sets of redundant coils are arranged into separate motors and connected by gears, Fig 8b is a front projection of said alternative embodiment;

DETAILED DESCRIPTION OF THE INVENTION

For a better understanding of the invention and to show how the same may be carried into effect, reference will now be made, purely by way of example, to the accompanying drawings. With specific reference to the drawings in detail, it is stressed that the particulars shown are by way of example and for purposes of illustrative discussion of preferred embodiments of the present invention only, and are presented for the purpose of providing what is believed to be the most useful and readily understood description of the principles and conceptual aspects of the invention. In this regard, no attempt is made to show structural details of the invention in more detail than is necessary for a fundamental understanding of the invention. From the description taken together with the drawings it will be apparent to those skilled in the art how the several forms of the invention may be embodied in practice. Moreover, it is to be understood that the phraseology and terminology employed herein is for the purpose of description and should not be regarded as limiting the scope of the invention hereof. Fig. 1 is a schematic illustration of a simple embodiment 1 of a redundant brushless

DC servo motor. It is understood that the multiple redundant structure exemplified herein can also be used to ensure reliability of a stepper motor (SM), a permanent magnet stepper motor (PMSM), a DC motor, or a single phase or multiphase AC motors. Embodiment 1 includes a first individually excitable induction circuit consisting of interconnected controller 9a, driver 16a and coil 18a. Embodiment 1 also includes a second individually excitable induction circuit consisting of interconnected controller 9b, driver 16b and coil 18b. Embodiment 1 also includes a third individually excitable induction circuit consisting of interconnected controller 9c, driver 16c and coil 18c. The three induction circuits are individually excitable in that each circuit can be excited to induce a magnetic field independent of the other two circuits.

Embodiment 1 also includes Hall Effect sensor arrays 12a, 12b and 12c. Each Hall Effect sensor array 12a-c includes three separate Hall sensors which sense the angular position of a rotor 20 (the rotor is composed of six alternating polarity permanent magnetic sections [the two polarities represented by filling with either vertical or horizontal lines respectively]). As is well known in the art of brushless magnetic motors, by synchronizing the polarity of inductor coils 18a-c to the angular location of the poles of rotor 20 as indicated by the output of Hall Effect sensor arrays 12a-c, the rotor of embodiment 1 is induced to rotate.

It is understood that since each inductance circuit includes only one controller, one driver and one coil, then if any one component from controllers 9a-c, drivers 16a-c or inductors 18a-c malfunctions, then one inductance circuit will cease to function. Nevertheless, because the three inductance circuits are individually excitable, then even if one circuit malfunctions, rotation of the rotor can be maintained by the remaining two circuits (albeit at reduced performance). Output of all three Hall Effect sensor arrays 12a-c is supplied to all three controllers

9a-c. Thus each controller receives the input of three Hall Effect sensor arrays 12a-c and output of all three Hall sensor arrays 12a-c are shared by all three controllers 9a-c. Each controller 9a-c combines the inputs of all three Hall Effect sensor arrays 12a-c by voting. All of Hall Effect sensor arrays 12a-c should be in agreement, independent of the location of rotor 20. If two of Hall Effect sensor arrays 12a-c are in agreement and one disagrees, then the disagreeing reading is ignored. Thus, if one of Hall Effect sensor array 12a-c malfunctions, the motor will continue to function without loss of performance. Due to the standard architecture of Hall Effect sensor arrays, should a single Hall Effect sensor within the array malfunction, then its corresponding array will become inoperative. In this embodiment 1, the inoperative array is backed-up by two additional Hall Effect sensor arrays and the motor continues to operate without loss of performance and without initiating complex controlling protocols.

Fig. 2 is a block diagram of another simple embodiment of a redundant servo motor (embodiment 2). Embodiment 2 includes three individually excitable induction circuits 25d, 25e, and 25f. Each individually excitable induction circuit 25d, e, and f includes a controller 9d, 9e and 9f respectively; a driver 16d, 16e, and 16f respectively; and a coil 18d, 18e, and 18f respectively.

Embodiment 2 includes six Hall Effect sensor arrays 12d, 12e, 12f, 12g, 12h, and 12j that detect the angular position of the rotor (not shown). Each controller 9d-f is synchronized to combined outputs of at least one Hall Effect sensor array. Controller 9d is synchronized to combined outputs of three Hall Effect sensor arrays (9d-f). Controller 9e is synchronized to the combined outputs of three Hall Effect sensor arrays (sensor arrays 9f-h). The outputs of each set of three sensor arrays are combined by voting. Thus, if a single Hall Effect sensor array of Hall Effect sensor arrays 9d-h malfunctions, it will be overridden by the other Hall Effect sensor arrays and the motor will continue to function without loss of performance.

In individually excitable induction circuit 25d, controller 9d is synchronized to three Hall Effect sensor arrays 12e, 12d and 12f. Thus, according to the angular position of the rotor as reported in the combined outputs of Hall Effect sensor arrays 12d-f, controller 9d commands driver 16d to energize coil 18d to a positive or negative polarity in order to cause the rotor to rotate as is known to those skilled in the art of brushless DC motors and servos.

In individually excitable induction circuit 25e, controller 9e is synchronized to three Hall Effect sensor arrays 12f, 12g and 12h. Thus, according to the angular position of the rotor as reported in the combined outputs of Hall Effect sensor arrays 12f-h, controller 9e commands driver 16e to energize coil 18e to a positive or negative polarity in order to cause the rotor to rotate as is known to those skilled in the art of brushless DC motors and servos.

In individually excitable induction circuit 25f, controller 9f is synchronized to one Hall Effect sensors array 12j. Thus, according to the angular position of the rotor as reported in the combined outputs of Hall Effect sensor array 12j, controller 9f commands driver 16f to energize coil 18f to a positive or negative polarity in order to cause the rotor to rotate as is known to those skilled in the art of brushless DC motors and servos.

It can be seen in Fig. 2 that the output of Hall Effect sensor array 12f is shared by controllers 9d and 9e whereas each output of all other Hall Effect sensor arrays 12d, 12e and 12g, 12h and 12j serves as an input to only one controller. Due to the sharing of a single Hall Effect sensor array 12f each of controllers 9d and 9e receive inputs from three Hall Effect sensor arrays when the overall number of Hall Effect sensor arrays supplying inputs to controllers 9d and 9e is five instead of six as would be used by conventional redundancy methods. In an analogous manner, sharing more sensors can increase the redundancy level, thus enabling uncompromised continuous performance of the motor during more than a single malfunction. The level of redundancy which is to be achieved can therefore be derived from the number of the sensors shared. Alternatively, sharing more sensors can decrease the overall number of sensors which is to be integrated into the system, for instance, should the outputs of Hall Effect sensor arrays 12d-12f be shared by controllers 9d and 9e, then the same level or redundancy would be achieved eliminating the need to incorporate Hall Effect sensor arrays 12g and 12h. It will be appreciated that since each of individually excitable induction circuit 25d-f is individually excitable, a malfunction of a component of one individually excitable induction circuit 25d-f will affect performance of only that individually excitable induction circuit 25d-f.

In an alternative embodiment, fuses or rectifiers or resistors may be included to prevent backward propagation of failure. For example a fuse and rectifier may be included between driver 16p and controller 9p so that failure of driver 16p or coil 18p will not cause a voltage surge to propagate backwards causing failure of any of controllers 9m-z. The fuses or rectifiers or resistors may also be utilized to cut-off over heated components to prevent the overheating from affecting other nearby components.

For example, a short circuit in coil 18d will disable individually excitable induction circuit 25d without affecting individually excitable induction circuits 25f or 25e. Similarly a malfunction in driver 16d or controller 9d will affect only individually excitable induction circuit 25d. In any of the above cases where individually excitable induction circuit 25d fails, individually excitable induction circuits 25e, f continue to function and therefore the servo motor of embodiment 2 continues to function (possibly at reduced performance).

Also shown in Fig. 2 are two power lines 33a and 33b. Power line 33a supplies power to drivers 16d-f and power line 33b supplies power to controllers 9d-f.

In alternative embodiments, each individually excitable induction circuit 25d-f may include three coils in a delta or Y configuration and each driver may include a three phase bridge. In further alternative embodiments, the number of individually excitable induction circuits or sensors may be increased. In alternative embodiments, Hall sensors may be located at a variety of angular locations on the stator of the motor. In such a case, the polarity measured by one of Hall sensors will not be the same as the polarity measured by another of Hall sensors for a given rotor position. Therefore, controllers 9d-f may include sophisticated software for determining the position of the rotor from the variety of sensor readings and also for determining the optimal synchronization with the rotor. Fig. 3 is a schematic illustration of a preferred embodiment of a redundant servo motor. In embodiment 3 a shaft 322 is rotated by a rotor 320 having eight permanent poles (marked N, S) rotate inside of a stator 330. Stator 330 contains twelve independent, redundant coils. Mounted on stator 320 are nine Hall Effect sensors arranged in three Hall Effect sensor arrays 312a, 312b, and 312c of three radially mounted sensors each. It will be understood that output of each Hall Effect sensor array can be processed via voting such that even in the event of a malfunction of a single sensor casing it's respective array to become inoperative, the other two operating arrays will accurately report the position of rotor 320. Mounted on shaft 322 are three encoders 310 and three resolvers 311.

Multiple independent motors such as the motor of Fig. 3 may be used to drive a single shaft. The motors may be all be arranged coaxially and attached directly to a single shaft. Alternatively, multiple motors may be connected together via a gear assembly. Under any conditions, various angular sensors may be connected to individual motors, shafts and gears. Some sensors may send output to all or some of the controllers of a single motor while other sensors may send output to multiple motors. In this way, multiple redundancies are achieved in the case of sensor failure, controller failure, driver failure, coil failure or even failure of a whole motor in a multiple motor assembly.

The redundant coils 318 of embodiment 3 are arranged radially around rotor 320. Alternatively, multiple redundant coils may be packed together in a single slot or multiple coils may be mounted coaxially along the length of a shaft. It is understood that the mechanisms of the motor of embodiment 3 are reinforced in order that the extra stress created by an unsynchronized inductor coil working in opposition to two synchronized coils would not destroy the mechanical system. Instead the two synchronized coils would continue to drive the motor (albeit at reduced performance).

Fig. 4 is a block diagram of a preferred embodiment (embodiment 4) of a redundant servo motor. Embodiment 4 has a hierarchal two-layer structure. In a central layer, three controllers 9m, 9n, 9o receive output from Hall sensor arrays 412m, 412n and 412o respectively. Controllers 9m, 9n, 9o also receive output from encoders 10m, 10η and 10ο respectively. Each controller 9m-o produces an estimate of the angular position of the rotor based on the combined outputs of respective Hall sensor arrays 412m, 412n and 412o and encoders 10m, 10η and 10ο.

In the central layer of embodiment 4 each controller 9m-o also receives control signals through a plurality of communication channel 14m, 14n or 14o. For example, a throttle 481 may produce three independent signals using three independent potentiometers 482m, 482n and 482o and three independent avionic controllers 483m, 483n and 483o. Throttle 481 may be a manual control on a manned vehicle or an RF receiver of an unmanned vehicle. Because each controller 9m-o receives communication from one of the triple redundant avionic controllers 483m-o, there is no single point of failure. In alternative embodiments the control structure (for example communication or control inputs and outputs) of the motor will include redundant structures similar to throttle 481. Thus a failure of a single communication channel or input control device will not lead to systemic failure. In one alternative embodiment all systems of the motor may be redundant such that there is no single point of failure. According to input received each controller 9m-o in the central layer sends instructions to each of twelve individually excitable induction circuits 25g, 25p, 25q, 25r, 25s, 25t, 25u, 25v, 25w, 25x, 25y, and 25z in an execution layer via respective controllers 9g, 9p, 9q, 9r, 9s, 9t, 9u, 9v, 9w, 9x, 9y, 9z. Appropriate instructions to energize coils for accelerating a servo according to a command signal given an angular location of the rotor are well known in the art. Communication from each controller 9m-o in the control layer to the execution layer (e.g. controllers 25g, 25p-z) is via a separate bus line such that bus lines are also redundant and failure of a single bus line will not lead to failure of the system. Each controller 9g, 9p-z receives three independent instructions (one from each controller 9m-o in the central layer). If all of the instructions are in agreement, then each controller 9g, 9p-z instructs a respective driver 16g, 16p-z to energize a respective coil 18g, 18p-z. If the instructions from controllers 9m-o are not exactly compatible then the individual controllers 9g, 9p-z include decision making software/firmware to choose a proper action (for example by voting). It is understood that in this way the control signal outputs of avionic controllers 483m-o are also combined as an input to each individually excitable control circuit 25g, 25p-z.

It is emphasized that in embodiment 4 the controllers 9m-o in the central layer may be relatively sophisticated devices programmed to accept output from a variety of angular sensors of different kinds (e.g., Hall sensors arrays 412m-o and encoders lOm-o) and at different angular locations and integrate the sensor data with signals from user communication channels 14m-o to come up to an optimal synchronization of individually excitable induction circuits 25g, 25p-z. Thus, the two-layer architecture of embodiment 4 allows maximum redundancy and sophisticated control while using relative simple controllers in the high redundancy execution layer. Thus, in embodiment 4, the failure of a single component in or above the central layer (encoders lOm-o, Hall sensor arrays 412m-o, communication channel 14m-o or controllers 9m-o) will not affect performance of the servo (because all of the central layer devices are backed up by a voting scheme). Failure of any device in the execution layer (controllers 9g, 9p-z, drivers 16g, 16p-z, and coils 18g, 18p-z will only cause failure of one coil 18g, 18p-z.

Fig. 5 is a flowchart illustrating a method of driving a redundant servo motor. The first step in the method is supplying 552 at least three individually excitable inductor circuits. Each circuit produces a variable magnetic field to drive a rotor. The inductor circuits may run a single inductor coil or a group of inductor coils (for example three coils in a delta configuration. The inductor circuits are independent in that a malfunction of one circuit does not affect another circuit.

Then the outputs of multiple angular sensors are combined 554 to produce a combined output. For example, the outputs of three Hall sensors may be combined by using a voting mechanism to determine the angle of a rotor of the servo motor. Then command signals from multiple user input devices are integrated 556. For example, a remote accelerator switch may be supplied with three potentiometers. The three potentiometers send three control signals. The integrated signal may result from choosing a majority signal (voting) and thus if one potentiometer fails, the user input is still properly reported and without loss of performance.

According to the user instructions from the user input device and in synchronization with the combined output of the angular sensors, energize 558 each individually excitable inductor circuit. Because the individually excitable inductor circuits are independent, even if one circuit fails and one coil is not properly energized, the others circuits will energize properly and drive the motor.

Fig. 6 is a schematic diagram of a preferred embodiment (embodiment 5) of a redundant servo motor. Embodiment 5 has a hierarchal two-layer structure. In a central layer, three controllers 69p, 69q, 69r receive output from various angular sensors. Particularly controllers 69p, 69q, 69r receive output from Hall Effect sensor arrays 412p, 412q and 412r respectively, from encoders lOp, lOq and lOr and resolvers 411p, 411q and 41lr respectively. Each controller 69p-r produces an estimate of the angular position of the rotor based on the combined outputs of respective angular sensors: Hall sensor arrays 412p-r, resolver 411p-r and encoders lOp-r.

In the central layer of embodiment 5 each controller 69p-r also receives a control signal from a communication channel 14p, 14q and 14r. According to input received each controller 69p-r in the central layer sends instructions to each of three multi-coil individually excitable induction circuits 625a, 625b and 625c in an execution layer via respective controllers 69a-d. Appropriate instructions to energize coils for accelerating a servo according to a command signal given an angular location of the rotor are well known in the art. Each controller 69a-c receives three independent instructions (one from each controller 69p-r in the central layer). If all of the instructions are in agreement, then each controller 69a-c instructs a respective three phase driver 66a, 66b and 66c to energize a respective set of three coils 618a, 618b and 618c. Each three phase driver 66a-c synchronously energizes each coil of one set of three coils 618a-c to rotate a rotor as known in the art. Each of the sets of three coils 618a-c may be in a wye- winding or a delta- winding or other configuration known in the art. In case the instructions from the separate central controllers 69p-r are not exactly compatible, the individual controllers 69a-c of the execution layer include decision making software/firmware to choose a proper action (for example by voting).

Similar to controller 9m-o of embodiment 4, controllers 69p-r in the central layer of embodiment 5 may be relatively sophisticated devices programmed to accept output from a variety of sensors of different kinds and at different angular locations and integrate the sensor data with signals from communication channels 14p-r to come up to an optimal synchronization of multi-coil individually excitable induction circuits 625a-c.

Alternatively, one or more of Hall Effect sensor arrays 412p-r or communication channels 14p-r or encoders ΙΟρ-r or resolvers 411p-r may send output to (be shared by) more than one controller 69p-r. For example, Hall Effect sensor array 412p may send output to controller 69r as well as controller 69p.

Thus, in embodiment 5, the failure of a single component in or above the central layer (encoders ΙΟρ-r, encoders 411p-r, Hall Effect sensor arrays 412p-r, communication channels 14p-r or controllers 69p-r) will not affect performance of the servo (because all of the central layer devices are backed up by a voting scheme). Failure of any device in the execution layer (controllers 69a-c three phase drivers 66a-c and sets of three coils 618a-c) will at most cause failure of one multi-coil individually excitable induction circuits 625a-c.

Alternatively, multi-coil circuits (similar to multi-coil individually excitable induction circuits 625a-c) can be arranged in a simple single layer flat architecture (for example in place of individually excitable induction circuits 25d-f as illustrated in figure 2). In further alternative embodiments, a combination of single phase and multiple phase drivers may be included in a single embodiment. Similarly, in another alternative embodiment some individually excitable induction circuits may be controlled by a hierarchal structure while other individually excitable induction circuits may receive input directly from sensors.

In another alternative embodiment, a single coil may receive power from multiple drivers. For example, a set of four three phase drivers may drive three sets of three coils. Each coil of each set being energized synchronously by all of the drivers combined. As shown schematically in Fig. 6, the number of redundant parts can be increased. Thus in Fig. 6 there are shown potentially m-sets of central controllers and n-sets of individually excitable induction circuits, "m" and "n" can be arbitrarily large, the exact number of "m" and "n" is determined according to the required level of redundancy which is to be achieved over each respective layer. In a similar manner, the number of angular sensors, coils, communication channels, power lines, drivers etc', can be determined independently to meet the required standard of redundancy level of each respective layer. For example, in order to meet a standard of sustaining a single failure at the controllers layer, the number of controllers "m" to be determined is three, and in order to meet the standard of sustaining a double failure by the controllers layer, then the number of controllers "m" to be determined is five, in order to meet the standard of sustaining a triple failure by the controllers layer, then the number of controllers "m" to be determined is seven etc'. Also shown are fuses and rectifiers connecting three phase drivers 66a-66c and controllers 69a-c to power lines P WR 1 -k. The fuses and rectifiers prevent backwards propagation of failure. Communication between components of the servo motor are supplied by bus lines 1 -m. Increasing the number of replicated parts in the execution layer (for example increasing "n," the number of individually excitable induction circuits) increases redundancy and thereby decreases the loss of performance due to the failure of a single or a few parts in the execution layer. Increasing redundancy in the control layer (e.g. by increasing the number of redundant parts that participate in voting, for example increasing "m," the number of central controllers) decreases the probability of system failure (by increasing the number of independent failures that can be sustained without loss of performance or system failure). For example when voting is between three replicate Hall sensor arrays, then the failure of one array will not affect performance but the failure of two arrays may affect performance (or may cause a systemic failure). When voting is between four or five Hall sensor arrays, the failure of two arrays will not affect performance. In the above illustrated architectures, increasing redundancy decreases the failure probability and decreases the loss of performance resulting from a partial failure. Decreasing the failure probability and the reducing consequences of failure makes a system hold to higher performance standards for more demanding applications and higher regulatory standards.

Generally, in order that the system to be failsafe to a redundancy level of the control layer, it is preferable that the redundancy level of the execution layer be at least as great as the redundancy level of the control layer. For example, in embodiment 5, it is preferable that the number "n" of individually excitable induction circuits 625 be at least as large as the number "m" of central controllers 69p-r (e.g. it is preferable that n>m). In such a manner, the level of redundancy of each layer and the redundancy of the system as a whole can be designed in order to meet the required standards.

Fig. 7 illustrates a preferred embodiment for wrapping multiple coils in stator for a redundant servo motor. Multiple individually excitable redundant coils are wrapped into each slot around the stator and drive a single rotor. Fig. 8 illustrates an alternative embodiment where multi-coil individually excitable induction circuits (for example multi-coil individually excitable induction circuits 625a- c) drive multiple rotors connected by gears. Alternatively multi-coil individually excitable induction circuits may be used to drive multiple rotors mounted on a single shaft. Fig 8b is a front projection of said alternative embodiment.

Although the invention has been described in conjunction with specific embodiments thereof, it is evident that many alternatives, modifications and variations will be apparent to those skilled in the art. Accordingly, it is intended to embrace all such alternatives, modifications and variations that fall within the spirit and broad scope of the appended claims. All publications, patents and patent applications mentioned in this specification are herein incorporated in their entirety by reference into the specification, to the same extent as if each individual publication, patent or patent application was specifically and individually indicated to be incorporated herein by reference. In addition, citation or identification of any reference in this application shall not be construed as an admission that such reference is available as prior art to the present invention.