Passive Fault-Tolerant Drive Mechanism for Deep Space Camera Lens Covers Based on Planetary Differential Gearing   

Abstract

In order to protect the high-sensitivity optical lens of the “magnetic field and velocity field imager” in extreme deep space environments, this paper proposes a new type of dual redundant planetary differential lens cover drive mechanism. In view of the critical vulnerability that traditional single-motor direct drive is prone to sudden mechanical jamming and catastrophic single-point failure (SPF) in severe tasks such as Jupiter exploration, this study constructs a “dual input single output (DISO)” rigid decoupling architecture from the perspective of physical topology. Through theoretical analysis and kinematic modeling, the adaptive decoupling mechanism of the two-degree-of-freedom (2-DOF) system under unilateral mechanical stalling is revealed. Dynamic analysis shows that in the nominal dual-motor synergy mode, the system shows a significant “kinematic load-sharing effect”, thus greatly reducing the sliding friction and gear wear rate. In addition, under the severe dynamic fault injection scenario (maximum gravity deviation and sudden jam superposition of a single motor), the cold standby motor is activated and the dynamic takeover is quickly performed. The high-fidelity transient simulation based on ADAMS verifies that although the fault will produce transient global torque spikes and pulsed internal gear contact forces at the moment, all extreme dynamic loads remain well within the structural safety margin. The output successfully achieved a smooth transition, which is characterized by a non-zero-crossing velocity recovery. This research provides an innovative theoretical basis and a practical engineering paradigm for the design of high-reliability fault-tolerant mechanisms in deep space exploration.

1. Introduction

1.1. Background and Engineering Challenges

Accurately measuring the solar vector magnetic field and the line-of-sight velocity field is of great scientific significance for revealing the potential mechanisms such as coronal heating, solar wind acceleration dynamics and the origin of space weather phenomena [1,2]. Despite the continuous efforts in the past decades, from ground solar vector magnetic field observation [3] to empirical estimation of the sun’s dipole magnetic axis using satellite data [4], which has greatly expanded our understanding of the topology of the solar magnetic field, traditional observations are inevitably affected by the earth’s atmospheric turbulence and solar scattering light. Restriction [2]. Therefore, using the high-resolution “magnetic field and velocity field imager” as the core payload of the deep space probe has become an essential approasch to break through the limit of space-time resolution [5,6,7].

In the established mission profile, the probe plans to conduct a Jupiter flyby, which will expose the entire scientific payload to an extremely harsh deep space environment. In addition to ultra-high vacuum and extreme thermal cycling, strong space radiation and highly destructive micrometeors and interstellar dust [8,9] also pose a serious threat to extremely sensitive optical polarization lenses. In order to prevent the optical components of the imager from suffering irreversible contamination or degradation during the long-term non-operational cruising phase, it is of great engineering significance to equip the instrument with a highly reliable [10] lens cover drive mechanism.

The traditional lens cover drive mechanism mainly relies on a single motor to drive directly. In the above-mentioned extreme and unpredictable deep space environment, the motor as the core power source is very prone to sudden “rotor mechanical jamming” caused by internal bearing lubrication failure (such as cold welding) and stator–rotor interference induced by thermal deformation or particulate intrusion [11]. In this single-drive mechanism architecture, the mechanical jam of the motor will immediately cause a catastrophic single-point failure (SPF) [12], causing the lens cover to fail to unfold and permanently obstructing the extremely important solar observation optical payload. Therefore, from the perspective of physical architecture design, fundamentally avoiding the bottleneck of system paralysis caused by single-motor mechanical jamming is a critical engineering challenge that needs to be addressed in the field of contemporary aerospace machinery.

1.2. State-of-the-Art and Limitations

In order to improve the reliability of deep space mechanisms, researchers and aerospace engineers have extensively explored redundant drive technology. The current redundancy strategy can be roughly divided into the following two categories:

1.2.1. Electrical-Level Component Redundancy

In high-reliability fields such as aerospace, the most common redundancy method at present is to achieve electrical backup by increasing the number of phases or windings in a single motor. For example, in order to meet the strict fault tolerance requirements of the satellite antenna drive system, Fu et al. [13] designed a dual-redundant two-phase hybrid stepper motor (HSM), which is equipped with two independent stator windings, which effectively reduces the impact of single electronic component failure. In order to further improve fault tolerance and slot utilization, Liu et al. [14] proposed a three-layer multi-phase (such as five-phase, nine-phase) winding structure theory based on unconventional slot pole combination, which achieved significantly reduced torque ripple. In response to the problems of space utilization and torque density, Liu et al. [15] developed a permanent magnetic claw-pole motor (PMCPM) with a dual-stator structure, which significantly improves the radial space utilization rate through the design of hybrid magnetic cores.

Regarding the redundancy control strategy, Milićević et al. [16] conducted in-depth research on double three-phase (six-phase) motors based on the vector control principle. Their work realizes the independent control of the direct-axis (d-axis) and quadrature-axis (q-axis) components between the two sets of windings, so that the motor has a highly flexible power flow and torque distribution ability in both drive and power generation modes. At the same time, Hwang et al. [17] addressed the problem that traditional double-winding motors are prone to overheating and thermal failure in failure mode by introducing a thermal fault-tolerant asymmetric double-winding (ADW) motor design.

1.2.2. Mechanical-Level Series–Parallel Switching Redundancy

In the field of mechanical transmission and drive, multi-motor coupling and redundant driving technology has also attracted wide attention, especially in the field of high-precision servo systems and heavy robots.

In order to overcome the inherent backlash in mechanical transmission and improve the output accuracy, the multi-motor parallel direct drive architecture is widely used. For example, Liu et al. [18] designed a mechanical structure based on dual-motor load to solve the problem of excess torque and gear backlash in the steering gear electric load simulator. By combining cross-coupling control and the error symbol robust integral control strategy, the dual-motor system can maintain high load tracking accuracy even when motor parameters are asymmetrical. For the drive control of heavy robot joints, Sun et al. [19] proposed a variable bias torque control method suitable for dual-motor parallel drive systems. By applying bias torque dynamically based on real-time motor current monitoring, the method realizes the reasonable distribution of torque between the two motors and the smooth transition of anti-backlash control in the servo cycle, thus significantly reducing the steady-state error and static energy consumption.

1.2.3. Differential Gear-Based Redundancy

In terms of complex electromechanical coupling configuration design, Ma et al. [20] and Li et al. [21] proposed systematic design and control methods based on double-row planetary gears and multi-mode power split for hybrid and heavy-duty special vehicles, respectively. These methods effectively improve torque shock mitigation and transmission efficiency during the switching of multiple power sources. At the level of structural optimization and reliability enhancement, Xu et al. [22] constructed a multi-objective optimization framework for planetary gear trains considering manufacturing, material, and load uncertainties, which significantly enhances the comprehensive robustness of transmission equipment under complex working conditions. Furthermore, in the field of aerospace redundant transmissions with high-reliability requirements, Tao et al. [23] designed a single-backup redundant drive mechanism based on a differential gear train for aerospace deployment mechanisms, optimizing parameters with the goal of minimizing volume and moment of inertia. Yu et al. [24] further proposed a three-redundancy mechanical composite differential transmission system. Through multidisciplinary variable coupling optimization, this system ensures automatic switching and continuous stable power output under the parallel input of multiple power units.

1.2.4. Topological Limitations of Existing Technologies

Although the above electrical and mechanical redundancy schemes perform well under specific operating conditions, they expose critical limitations when faced with the severe failure mode of the deep space actuator—the motor mechanical jam.

• Kinematic strong coupling causing “interlocking paralysis”: The traditional dual-motor parallel scheme [18,19] is essentially a single-degree-of-freedom (1-DOF) rigid motion coupling. If one of the motors is mechanically stuck (the speed drops to zero), the other motor that runs normally will inevitably stop due to the shared output gear, resulting in the instantaneous paralysis of the entire transmission chain.
• Shared rotor leading to complete electrical redundancy failure: The existing double-winding or multi-phase motor [13,14,15,16,17] achieves physical isolation at the stator level, but the physical output shaft (rotor) is still single-phase. Once a mechanical jam occurs, regardless of how flawlessly the redundant stator windings operate, they cannot drive the rigid stuck rotor. This inability to fundamentally eliminate the defect of single-point failure (SPF) is a key shortcoming.

Therefore, how to achieve automatic fault isolation and seamless dynamic takeover without relying on any extra clutch mechanisms remains an unaddressed engineering bottleneck.

1.3. Proposed Method and Paper Organization

In view of the limitations of the existing series and parallel redundancy mechanisms in managing mechanical jamming, this paper breaks the traditional paradigm and introduces the planetary differential gear system with two degrees of freedom (2-DOF) into the field of deep space camera lens cover drive.

Specifically, we have proposed a new type of “dual input single output (DISO)” differential drive architecture. The architecture uses the inherent motion coupling characteristics of the planetary gear system to ensure the uniform distribution of speed and load between the two motors under nominal operating conditions. More importantly, in the extreme case of sudden mechanical jamming in any drive chain, the system relies on the adaptive downgrade of its physical topology (from F = 2 to F = 1). This allows the normal motor on the other side to achieve a rapid and seamless takeover without complex clutch intervention, which structurally isolates the failed branch and mitigates the propagation of single-point faults.

2. Drive System Design and Working Principle

2.1. Mechanical Configuration and Core Transmission Parameters

2.1.1. Mechanical Configuration

In order to meet the strict aerospace requirements of the deep space camera lens cover drive mechanism—especially for high reliability, large torque output and structural compactness—this study proposes a new type of two-degree-of-freedom (2-DOF) actuator based on dual-motor drive and planetary gear differential coupling.

As shown in Figure 1a, the complete protective structure is mounted externally outside the space imager. Macroscopic components include the space camera lens, deployable lens cover, connecting rod arm and core drive mechanism gearbox. In order to deeply clarify the power flow inside the gearbox, Figure 1b provides a high-fidelity internal cross-section view, in which the drive system is visually classified by different color schemes. The first transmission branch, including motor 1, right worm gear and planetary gear, is presented in an orange scheme. The second movement path is composed of motor 2, the left worm and the internal connecting rod (the connecting rod is rigidly connected to the left worm to form a planet carrier), highlighted in green. Finally, the power converges to the output shaft and displays it in light blue, thus driving the lens cover.

2.1.2. Key Structural Parameters of the Transmission System

In order to ensure that the dual-motor differential drive system can be compactly integrated into the side wall of the space imager shell and meet the torque and speed requirements required for the smooth unfolding of the cover plate, the core transmission components (i.e., worm gear pairs and planetary gear system) are carefully matched. Considering the strict anti-vibration requirements inherent in the space environment [25], the input stage utilizes a right-rotating worm gear mechanism with reverse self-locking characteristics. For specific core design parameters, please refer to

Table 1. Core structural parameters of the transmission system.

Subsystem	Parameter	Symbol	Value
Worm Gear Pair	Number of starts of worm	$z_1$	1
	Number of teeth of worm	$z_2$	40
	Transmission ratio	$i_w$	40
	Lead angle	$\gamma$	3.18 deg (°)
Planetary Gear Train	Module	$m_p$	0.5 mm
	Number of teeth of sun gear	$z_s$	32
	Number of teeth of planetary gear	$z_p$	16
	Number of teeth of ring gear	$z_r$	64
	Characteristic parameter	$k$	2

.

2.2. Kinematic Topological Principle and Power Flow Analysis

In order to clearly clarify the principle of dual-input single-output mechanical and electrical coupling and the transmission path of the rotational speed, a schematic diagram of the transmission mechanism is constructed, as shown in Figure 2.

As shown in Figure 2, the system consists of two input branches:

•

Ring Gear Branch (Blue): Motor 1 drives the inner ring gear of the differential transmission device through the right worm.

•

Planet Carrier Branch (Red): The motor 2 drives the planet carrier of the differential transmission device through the left worm.

•

Output Terminal (Black): the kinematic speed synthesis from two independent channels.

Under condition 1 (nominal collaborative working mode), the system controls the two motors to run at the same time and drive the lens cover forward. Observing the power flow to the arrow in Figure 2, we can intuitively see the unique kinematic characteristics of the differential mechanism: in order to produce the forward (clockwise) rotation of the output axis shown in the figure, the planet carrier branch provides co-directional input, while the ring gear branch must provide reverse (counterclockwise) input. Therefore, in the process of opening the lens cover together, motor 1 and motor 2 must rotate in the opposite direction. This counter-rotating input configuration lays the physical foundation for the construction of the differential kinematic model in the following chapters.

2.3. Degree of Freedom Analysis and Decoupling Characteristics

In order to verify whether the proposed system can achieve “dual-motor coupling” and “single-motor independent” drive from the perspective of mechanism, degree of freedom (DOF) analysis is indispensable [26].

The core motion composite unit of the system is the plane planetary gear system. According to the Kutzbach–Grubler criterion of the plane mechanism [27]:

$$F=3n-2p_L-p_H$$

(1)

Among them, n indicates the number of moving links; p_L indicates the number of low-level kinematic pairs (rotating joints); p_H indicates the number of advanced kinematic pairs (gear meshing).

The system uses three uniformly distributed planetary gears to achieve load distribution and radial force balance. However, in the kinematic topology, the trajectory of the second and third planetary gears and their related motion pairs completely overlaps with the trajectory of the first planetary gear. According to the principle of mechanism, these constitute typical redundant constraints. When calculating the actual degree of freedom of the mechanism, the components and movement pairs that introduce these redundant constraints must be eliminated, and only one basic transmission chain must be retained.

After removing redundant constraints, the basic motion chain consists of the following parts:

•

Moving links (n = 4): sun gear (output), inner gear ring (input 1), planet carrier (input 2) and a basic planetary gear.

•

Lower pairs (p_L = 4): three rotating vices connecting the central part and the frame, and one rotating vice connecting the planetary gear and the planet carrier.

•

Higher pairs (p_H = 2): two gear meshing (sun gear—planetary gear meshing and inner gear ring—planetary gear meshing).

Substitute these determined parameters into Formula (1) to obtain:

$$F=3\times 4-2\times 4-2=2$$

(2)

The analysis results strictly prove that the planetary gear system is a differential mechanism with two degrees of freedom (2-DOF). This means that the deterministic motion of the output end (sun gear) must only be determined by two independent input ends (gear ring and planet carrier).

Combined with the reverse self-locking characteristics of the front-stage worm gear, this dual-degree-of-freedom configuration gives the system the inherent fault tolerance of mechanical failure. Under normal working conditions, the two motors act as active driving components at the same time to realize dual-degree-of-freedom motion synthesis. However, if one of the motors is mechanically stuck, the worm gear on that side will immediately lock itself and fix the corresponding planetary input end (ring gear or planet carrier). The degree of freedom of the system will be reduced from F = 2 to F = 1. In this downgrade state, the remaining normal motor continues to drive the lens cover stably as the only kinematic input, thus structurally isolating the failed branch and mitigating the risk of motion interference.

3. Dynamics Analysis and Modeling

3.1. Kinematic Modeling: Formulation of the Differential Velocity Equation

As qualitatively explained in Section 2.2 (Figure 2), the topological connection and differential steering characteristics of the system have been established. In order to further quantitatively evaluate the decoupling characteristics of the dual-motor drive system in normal mode and fault mode, this section derived its precise kinematic equation based on the Willis theory [28] of the planetary gear system.

Incorporating the node definitions from the preceding schematic, let the input angular velocities of motor 1 and motor 2 be denoted as ${\omega }_{m1}$ and ${\omega }_{m2}$, respectively. The angular velocities of the internal ring gear and the planet carrier are designated as ${\omega }_r$ and ${\omega }_c$. Given the reduction ratios of the two worm gear pairs, $i_1$ and $i_2$, the rotational speed mapping for the two input stages is expressed as:

$${\omega }_r={\displaystyle \frac{{\omega }_{m1}}{i_1}}$$

(3)

$${\omega }_c={\displaystyle \frac{{\omega }_{m2}}{i_2}}$$

(4)

According to the Willis kinematic equation for planetary gear trains [29], the angular velocity of the sun gear ${\omega }_{out}$, alongside those of the ring gear and planet carrier, satisfies the following linear superposition relationship:

$${\omega }_{out}=(1+k){\omega }_c-k{\omega }_r$$

(5)

where k represents the characteristic parameter of the planetary gear set, defined as the ratio of the number of teeth on the internal ring gear z_r to that on the sun gear z_s (i.e., k = z_r/z_r).

Substituting the first-stage reduction relationships into the Willis equation yields the generalized differential velocity equation for this dual-motor redundant drive system:

$${\omega }_{out}={\displaystyle \frac{1+k}{i_2}}{\omega }_{m2}-{\displaystyle \frac{k}{i_1}}{\omega }_{m1}$$

(6)

Based on the actual structural design parameters of the space imager lens cover presented in this study, the characteristic parameter of the planetary gear train is set to k = 2. Assuming a symmetrical structure for the two-stage worm gear drives, the reduction ratios are identical, taking $i_1=i_2=40$. Substituting these values into Equation (6) yields:

$${\omega }_{out}={\displaystyle \frac{1+2}{40}}{\omega }_{m2}-{\displaystyle \frac{2}{40}}{\omega }_{m1}=0.075{\omega }_{m2}-0.05{\omega }_{m1}$$

(7)

The above equation mathematically reveals the characteristics of the two degrees of freedom of the mechanism. The angular velocity of the output end (lens cover) is determined by the input linear combination of the two motors, and the weights are 0.075 and −0.05 respectively. When any motor has a sudden mechanical jam (for example, ${\omega }_{m1}=0$), the specific branch will change from the active drive part to the fixed constraint part due to the one-way self-locking effect of the worm gear. At this time, the equation becomes ${\omega }_{out}=0.075{\omega }_{m2}$. This shows that there is no singularity or dead point in the kinematic transmission chain. The motor that works normally can continuously and accurately control the opening and closing of the lens cover.

3.2. Dynamic Modeling: Torque Allocation Analysis Under Dual-Motor Actuation

After establishing the system kinematic mapping, it is also necessary to build a dynamic model to evaluate the torque distribution characteristics in the process of dual-motor cooperative driving.

Let the equivalent moment of inertia of the lens cover assembly (including the output shaft) be $J_{load}$, and the comprehensive external resistance torque in the space environment (incorporating bearing friction, hinge resistance, etc.) be $T_{load}$. According to Newton’s second law of motion [30], the total driving torque $T_{sun}$ required by the output shaft to overcome inertia and resistance is:

$$T_{sun}=J_{load}·{\ddot{\theta }}_{out}+T_{load}$$

(8)

where ${\ddot{\theta }}_{out}$ denotes the angular acceleration of the lens cover.

Assuming the negligible internal inertia of the planetary gears, and based on the static equilibrium conditions of the planetary gear train, the load torque $T_{sun}$ exerted on the sun gear must be balanced jointly by the input torque from the ring gear $T_{ring}$ and the planet carrier $T_{carrier}$. The proportion of torque distributed to each component is strictly governed by the geometric parameter k:

$$T_{ring}=k·T_{sun}$$

(9)

$$T_{carrier}=(1+k)·T_{sun}$$

(10)

By introducing the mechanical transmission efficiencies of the two worm gear stages, ${\eta }_1$ and ${\eta }_2$, the torque distributed to the ring gear and planet carrier can be traced back to the motor terminals. Consequently, the generalized output torque equations for motor 1 ($T_{m1}$) and motor 2 ($T_{m2}$) are derived as:

$$T_{m1}={\displaystyle \frac{T_{ring}}{i_1·{\eta }_1}}={\displaystyle \frac{k·(J_{load}·{\ddot{\theta }}_{out}+T_{load})}{i_1·{\eta }_1}}$$

(11)

$$T_{m2}={\displaystyle \frac{T_{carrier}}{i_2·{\eta }_2}}={\displaystyle \frac{(1+k)·(J_{load}·{\ddot{\theta }}_{out}+T_{load})}{i_2·{\eta }_2}}$$

(12)

Through the previous quantitative derivation, it can be seen that the 2-degree-of-freedom differential drive system shows obvious “load asymmetry”. Define the torque distribution ratio of the dual-motor drive branch as:

$$\lambda ={\displaystyle \frac{T_{m2}}{T_{m1}}}={\displaystyle \frac{1+k}{k}}=1.5$$

(13)

This conclusion is of important engineering significance: when driving the same output load $T_{sun}$, due to the dynamic force arm characteristics of the planet carrier, the output torque required by motor 2 is always 1.5 times that of motor 1 (assuming k = 2). Therefore, in the design of spacecraft motor selection and control algorithms, the load must not be simply regarded as “1:1” evenly divided. On the contrary, the branch containing motor 2 (which has higher performance requirements) must be used as the boundary condition for calculating the peak torque of the system. This lays a solid theoretical foundation for verifying the subsequent ADAMS simulation output curve.

It should be noted that the analytical torque distribution equations derived above are based on a quasi-static assumption, which neglects the rotational inertia of the planetary gears. While sufficient for steady-state operation, this simplified model does not capture the transient inertia torques ($I·\alpha$) generated during severe dynamic shocks, which will be rigorously evaluated via the 3D solid dynamic simulations in Section 4.

3.3. Reliability Assessment

3.3.1. Reliability Block Diagram (RBD) Construction

In reliability engineering, the logical architecture of the system determines its failure mode [31,32].

• Traditional Single-Motor System: As shown in Figure 3a, this architecture is a typical series model. In this configuration, a single point failure (SPF) of any component on the critical drive chain (whether it is the motor, reducer or the transmission shaft) will inevitably cause the lens cover to fail to deploy.
• Proposed Dual-Redundant Differential System: In contrast, the reliability block diagram of the proposed system is depicted in Figure 3b. Physically, the two motors and their corresponding worm gear pairs constitute two independent drive branches. Kinematically, rooted in the “mechanical decoupling” characteristic substantiated earlier, the mechanical jamming of any single branch does not obstruct power transmission from the healthy one. Consequently, from a logical reliability perspective, these two drive branches constitute an Active Parallel Redundancy model. Let the operational reliability of a single drive branch (comprising the motor and its corresponding worm gear pair) be defined as R_m, and the reliability of the central planetary gear and output shaft assembly as R_p. Given that the planetary gear is a purely passive mechanical component, and its susceptibility to spatial cold welding and radiation is significantly lower than that of active motor assemblies, its reliability is generally considered to be exceptionally high (R_p ≈ 1).

3.3.2. Mathematical Modeling and Comparative Calculation of Reliability

To quantitatively visualize the benefit of the proposed mechanism, comparative calculations were conducted. To accurately evaluate the proposed architecture, we introduce a time-variant reliability model combining the Weibull distribution with Physics-of-Failure (PoF) principles, specifically accounting for deep space thermal cycling and space radiation.

1. Dynamic Reliability of the Motor Branch (R_m(t)):

As active electromechanical assemblies, the motors are highly susceptible to environmental degradation. Their time-dependent reliability is modeled using a two-parameter Weibull distribution:

$$R_m(t)=\exp \left[-{\left({\displaystyle \frac{t}{{\eta }_{m,env}}}\right)}^{{\beta }_m}\right]$$

(14)

where ${\beta }_m$ is the shape parameter representing the wear-out failure mode (${\beta }_m>1$), and ${\eta }_{m,env}$ is the characteristic life adjusted for the deep space environment. Based on PoF theory, ${\eta }_{m,env}$ degrades due to extreme thermal cycling fatigue and cumulative radiation damage:

$${\eta }_{m,env}={\displaystyle \frac{{\eta }_{m0}}{A{F}_{TC}·A{F}_{Rad}}}$$

(15)

Here, ${\eta }_{m0}$ is the baseline characteristic life under nominal ground conditions. The acceleration factor for thermal cycling ($A{F}_{TC}$) is described by the Coffin–Manson equation:

$$A{F}_{TC}={\left({\displaystyle \frac{\Delta T}{\Delta T_{ref}}}\right)}^c$$

(16)

where $\Delta T$ is the actual thermal cycling amplitude in the space mission profile, $\Delta T_{ref}$ is the reference amplitude, and c is the fatigue ductility exponent for the motor’s internal solder joints and windings. Furthermore, the radiation degradation factor ($A{F}_{Rad}$) accounts for the continuous breakdown of stator insulation and Hall sensors, defined as a function of the accumulated Total Ionizing Dose (TID) over time t:

$$A{F}_{Rad}=1+k_{rad}·D_{TID}(t)$$

(17)

where $k_{rad}$ is the radiation sensitivity coefficient.

2. Dynamic Reliability of the Planetary Gearset (R_p(t)) and CCF Consideration

Unlike the active motors, the passive planetary gear train is largely immune to electrical radiation damage, and its failure is primarily governed by long-term mechanical wear and contact fatigue. Its reliability is expressed as:

$$R_p(t)=\exp \left[-{\left({\displaystyle \frac{t}{{\eta }_p}}\right)}^{{\beta }_p}\right]$$

(18)

Because the two drive branches geometrically converge at the planetary gearset, this central node represents a critical Common-Cause Failure (CCF) path. If the planetary differential jams (e.g., due to space cold welding), the entire system paralyzes. Therefore, ${\eta }_p$ must be engineered to be orders of magnitude higher than ${\eta }_{m,env}$ through robust physical mitigations, such as aerospace-grade solid lubrication (e.g., $Mo{S}_2$ sputtering), hermetic sealing against interstellar dust, and extreme mechanical over-designing (as validated by the low dynamic contact stresses in Section 4.3).

3. System-Level Comparative Degradation Analysis

Substituting the time-variant component reliabilities into the logical architecture, the dynamic reliability of the traditional single-motor system is:

$$R_{single}(t)=R_m(t)·R_p(t)$$

(19)

In contrast, the system-level reliability of the proposed dual-redundant differential mechanism is:

$$R_{sys}(t)=\left[1-{(1-R_m(t))}^2\right]·R_p(t)$$

(20)

From a mathematical perspective, as the mission duration t increases, intense thermal cycling and radiation cause the motor reliability $R_m(t)$ to decay exponentially. In the traditional configuration, $R_{single}(t)$ drops sharply synchronously. However, in the proposed architecture, the redundant term $\left[1-{(1-R_m(t))}^2\right]$ introduces a profound non-linear buffering effect. This theoretical model strictly proves that the 2-DOF differential topology significantly flattens the system’s degradation curve, fundamentally extending the effective, high-confidence service life of the space imager’s lens cover.

4. Dynamic Simulation and Results Analysis

In order to comprehensively verify the kinematic accuracy, dynamic torque distribution principle and transient takeover recovery ability under single-point failure of the proposed two-degree-of-freedom (2-DOF) differential drive mechanism, this paper uses Adams software to simulate transient dynamics for a variety of operating conditions.

4.1. Simulation Model Setup and Boundary Conditions

The 3D CAD solid models were imported into the Adams 2024 software environment. To endow the virtual prototype with realistic physical attributes matching stringent spacecraft material standards, the gear transmission shaft assemblies were assigned the properties of high-strength alloy steel 40CrNiMoA (density $\rho =7.85\times {10}^{-6}{ \mathrm{kg}/\mathrm{mm}}^3$, $E=2.06\times {10}^5 \mathrm{MPa}$, Poisson’s ratio $\nu =0.3$). Concurrently, the housing and the main body of the lens cover were defined as 7075-T6 aluminum alloy.

4.1.1. Joints and Constraints

Governed by the previously established topological relationships of the mechanism, kinematic constraints were applied as follows:

•

Fixed Joints: Fixed constraints were applied between the ground and stationary reference components, such as the drive mechanism’s base housing and the motor stators.

•

Revolute Joints: Revolute joints were designated at the interfaces connecting the left/right motor rotors to the housing, the worms to the housing, the worm gears to the central support shafts, the planet carrier to the central shaft, and the three planetary gears to the planet carrier.

•

Motions: Angular velocity drives, defined via the STEP function, were applied to the input revolute joints of the two motors.

•

Gravity Setting: Deep space cameras must undergo rigorous ground assembly, alignment, and life-cycle verification under a 1 g gravitational environment prior to launch. The global gravitational acceleration in the simulation was set to 9.8 m/s². The gravity vector was oriented vertically downward and perpendicular to the output shaft, deliberately simulating a severe operational scenario regarding maximum static torque.

4.1.2. Contact Mechanics Model

To accurately capture the transient dynamic shocks occurring during gear meshing, the power transmission within the worm gear pairs and the planetary set (sun-to-planet and ring-to-planet) did not rely on idealized constraint equations (Gear Joints). Instead, 3D solid contacts were defined utilizing the IMPACT collision function model based on Hertzian contact theory [33].

The contact force calculation model incorporates both an elastic restoring force and a normal damping force. Integrating the material properties of steel-to-steel meshing, the core contact parameters were defined as presented in

Table 2. Core parameters of the ADAMS IMPACT contact mechanics function.

Parameter	Symbol	Value
Stiffness	K	$1.0\times {10}^5 \mathrm{N}/\mathrm{mm}$
Force Exponent	e	1.5
Damping	C	$10.0 \mathrm{Ns}/\mathrm{mm}$
Penetration Depth	d	0.1 mm

.

The parameters defining the IMPACT function in Table 2 are meticulously established based on theoretical mechanics and numerical convergence criteria.

Derivation of Contact Stiffness (K)

The contact stiffness K was analytically derived based on Hertzian line-contact theory and the ISO 6336 standard [34] for gear mesh stiffness. For the involute profiles of two contacting steel gears, the equivalent stiffness is governed by the material’s elastic properties and the effective face width b. Given the selected 40CrNiMoA alloy (Elastic Modulus $E=2.06\times {10}^5 \mathrm{MPa}$, Poisson’s ratio $\nu =0.3$), the specific theoretical mesh stiffness c’ for robust aerospace gears typically ranges from 14 to $20 \mathrm{N}/(\mathrm{mm}·\mathsf{\mu }\mathrm{m})$. Considering the effective face width of the planetary gears in this mechanism ($b=6 \mathrm{mm}$), the theoretical composite stiffness $K=c^{\prime }·b$ falls within the range of $0.84\times {10}^5$ to $1.2\times {10}^5 \mathrm{N}/\mathrm{mm}$. Consequently, a nominal physics-based value of $1\times {10}^5 \mathrm{N}/\mathrm{mm}$ was adopted. This mathematically ensures that the elastic deformation simulated during dynamic meshing matches the actual material response.

Convergence Study of Penetration Depth (d) and Damping

Furthermore, a numerical convergence study was conducted to determine the optimal damping coefficient (c) and penetration depth (d). In the ADAMS GSTIFF integrator, the IMPACT model applies a continuous cubic step function for damping over the distance d. If d is set too small (e.g., $d<0.01 \mathrm{mm}$), the instantaneous damping force gradient becomes exceptionally steep upon contact. This ill-conditions the Jacobian matrix, forcing the solver to drastically reduce the integration step size until it stalls. Conversely, an excessively large d (e.g., $d>0.5 \mathrm{mm}$) artificially smoothens the impact, underestimating the authentic high-frequency transient shocks generated during the 4000°/s² emergency takeover (Case 3). Through local sensitivity analysis, setting the penetration depth to $d=0.1 \mathrm{mm}$ with a damping of $10 \mathrm{N}·\mathrm{s}/\mathrm{mm}$ was confirmed to provide the optimal mathematical boundary. This specific threshold guarantees stable solver convergence without stalling, while preserving high physical fidelity of the transient contact force peaks.

4.1.3. Friction Coefficient Setting

Space robotic arms and deployment mechanisms are very prone to cold welding failure in a vacuum environment, which usually requires solid lubrication (such as ${\mathrm{MoS}}_2$ coating) or special aerospace-grade perfluoropolyether (PFPE) grease. In order to ensure that the simulation results are closely approximate actual in-orbit physical states, Coulomb friction is introduced in all rotating joints and contact pairs. Based on the empirical data of aerospace space lubrication, the friction coefficient and transition speed established in ADAMS are detailed in

Table 3. Setting parameters for the spatial Coulomb friction model.

Parameter	Symbol	Value
Static Coefficient	${\mu }_s$	0.15
Dynamic Coefficient	${\mu }_d$	0.08
Stiction Transition Velocity	$v_s$	0.1 mm/s
Friction Transition Velocity	$v_d$	1.0 mm/s

.

4.1.4. Modeling Assumptions and Environmental Factors

To ensure the dynamic simulation accurately reflects physical realities while maintaining computational efficiency, the following boundary assumptions regarding gear backlash and thermal effects were established:

•

Gear Backlash Assumption: In space precision mechanisms, an appropriate backlash is essential to prevent mechanical binding caused by lubrication accumulation or thermal expansion. Instead of using idealized zero-backlash constraint equations, the 3D solid models imported into ADAMS incorporated a nominal manufacturing backlash clearance (approximately 0.03 mm to 0.05 mm at the gear meshes). This physical gap is captured by the IMPACT contact model and is the primary cause of the transient velocity dip and contact force spikes observed during the emergency takeover phase, as the gears must cross the backlash zone to re-engage.

•

Thermal Deformation Assumption: The current dynamic model is constructed under an isothermal assumption, representing the baseline ground-testing environment. In extreme deep space missions, severe thermal gradients can alter gear center distances and mesh stiffness. To mitigate potential thermal jamming at the engineering design level, the materials chosen—70CrNiMoA alloy steel for the transmission components and 7075-T6 aluminum alloy for the housing—were selected considering their Coefficients of Thermal Expansion (CTEs). The structural design reserves sufficient thermal margins within the backlash to accommodate dimensional variations.

4.2. Kinematic Simulation Analysis Under Nominal and Fault Modes

Before extracting the simulation curve, we designed a matrix containing four typical verification scenarios, covering three cases of nominal dual-motor cooperative work, static cold standby and dynamic fault injection (as shown in

Table 4. Simulation test matrix for the transient dynamics of the lens cover drive system.

Case No.	Operating Mode	Motor 1 Status (Ring Gear Branch)	Motor 2 Status (Planet Carrier Branch)
Case 1	Nominal Dual-Motor Synergy	Active (Synchronized)	Active (Synchronized)
		(Speed/Load Sharing)	(Speed/Load Sharing)
Case 2-A	Single-Motor Cold Standby A	Active (Independent)	Locked (Self-Locking)
		(Full Output Required)	(Worm Gear Holding)
Case 2-B	Single-Motor Cold Standby B	Locked (Self-Locking)	Active (Independent)
		(Worm Gear Holding)	(Full Output Required)
Case 3	Dynamic Fault Injection and Takeover	Normal (0~2.4 s)	Standby (0~2.45 s)
		Jammed (t = 2.4 s)	Takeover (t = 2.45 s)

). This method aims to comprehensively evaluate the performance boundary and fault-tolerant takeover ability of the 2-degree-of-freedom differential mechanism. In all scenarios, the absolute on/off target rotation speed of the lens cover is uniformly set to 30°/s.

For these four scenarios, the specific dynamic simulation and performance evaluation goals are summarized as follows:

•

For Case 1 (Baseline Reference Group): The goal is to verify the kinematic response and load distribution effect under optimal conditions, so as to quantitatively analyze the positive impact of the dual-motor coordination mode on reducing the wear of core moving components (such as bearings and gear pairs) and extending the in-orbit service life.

•

For Case 2 (Extreme Single-Motor Group): This paper aims to verify the kinematic feasibility of independently driving the lens cover by relying only on the ring gear branch (Case 2-A) or the planet carrier branch (Case 2-B). In addition, this paper also tries to extract the extreme speed and torque output requirements of a single motor under severe cold standby conditions without auxiliary power.

•

For Case 3 (Extreme Overlap Worst-Case Scenario): This experiment aims to evaluate the dynamic impact tolerance and thermal backup emergency rescue ability of the system under real physical boundary conditions. Specifically, considering the specific bending angle design of the rocker arm connecting the output shaft and the lens cover, the kinematic center of mass analysis shows that when t = 2.4 s (corresponding to the unfolding angle of about 72°, the overall center of gravity of the system is at the farthest horizontal position from the axis of rotation. At this time, the static gravity bias torque borne by the system reaches its global maximum value. This study deliberately sets the injection point of the single-point mechanical jamming fault here, forcing the “transient high-frequency impact torque generated by the emergency takeover of the single motor” to be superimposed on the “maximum static gravity load of the system”, so as to construct the absolute worst case of the dynamic test.

4.2.1. Verification of Output Response Consistency

First of all, a comparative analysis is made of the response characteristics of the terminal actuator under Case 1 (dual motor coordination), Case 2-A (motor 1 drive only) and Case 2-B (motor 2 drive only). The angular displacement and angular velocity curve of the lens cover rotating around the output axis are extracted, and the simulation results are shown in Figure 4a.

The results show that the angular displacement curve of the lens cover in the three driving modes is highly consistent. Whether it is driven by a dual-motor differential integrated drive or independently by a single motor, the lens cover strictly follows the predetermined trajectory, accurately reaches the specified 150° unfolded position at $t=5 \mathrm{s}$, and returns to the closed position at $t=11 \mathrm{s}$.

The speed fluctuation rate is always below 0.5% during the whole process. No motion stagnation or trajectory deviation was observed in the single-motor mode. These results verify the correctness of the theory of “two degrees of freedom adaptive degradation” explained in Section 2.3 from the perspective of simulation, proving that the mechanism has excellent performance in hot and cold standby switching.

4.2.2. Comparison of Input Speed Requirements

In order to further quantify the advantages of dual-motor cooperation mode in reducing system load, this paper extracts and compares the angular velocity requirements of motor rotors in three nominal scenarios, as shown in Figure 4b.

The simulation data clearly reveals the significant kinematic load-sharing effect:

•

Dual-motor cooperative mode (Case 1): In order to achieve the output speed of 30°/s, the absolute speed of motor 1 and motor 2 is maintained at a moderate level of 240°/s.

•

Single motor independent mode (Case 2): When only driven by motor 2 (motor 1 locked), the required speed soars to 400°/s. On the contrary, when only driven by motor 1 (motor 2 is locked), due to the limitation of the differential transmission ratio, the significant peak of the required speed reaches 600°/s.

Comparative analysis shows that compared with single-motor 1 independent drive, dual-motor coordinated operation can reduce the speed requirement of a single motor by 60%. The significant reduction in rotational speed directly translates into the reduction in secondary friction loss (friction work $W_f\propto \omega$) of motor bearings and worm gears, while suppressing vibration and noise. This strongly shows that during the extended service life of the spacecraft, the dual-motor coordinated operation as the main operating mode can not only provide redundancy safety, but also effectively extend the fatigue life of the core moving parts.

4.2.3. Transient Kinematic Response Under Dynamic Fault Injection

The previous sections verify the feasibility of the system in steady-state mode. This section extracts and analyzes the transient kinematic response under Case 3 (dynamic fault injection). The dynamic takeover ability and motion stability of the differential architecture under sudden single-point mechanical failure are further evaluated.

Consistent with the previous prediction of mass center kinetics, at the moment of $t=2.4 \mathrm{s}$ (at this time, the lens cover unfolds to about 72°, and the system bears the maximum gravity bias), the main motor suddenly has a mechanical jamming failure. Under this condition, the angular velocity curve of the motor drive end and the output end of the lens cover is shown in Figure 5.

• Adaptive reconstruction of cold standby wake-up and drive terminal;

In the motor speed curve in Figure 5a, the fault takeover and speed reconstruction process in the cold standby mode can be observed. In the period of 0~2.4 s, the system runs in the main mode of a single motor, independently driven by motor 1 (gear ring branch), and its input speed is maintained at 600°/s. At the same time, the motor 2 (planet carrier branch) maintains a completely stationary cold standby state (0°/s).

At the moment of $t=2.4 \mathrm{s}$, the motor 1 has a sudden mechanical failure, causing its speed to plummet to zero. At the same time, the system control logic executes instantaneous switching; the normal motor 2 is activated and dynamic takeover is realized through the independent input channel of the planet carrier. Its speed soared from 0 to 400°/s in a very short time. This extreme step change in the input-end velocity gradient practically corroborates the mathematical relationship of the differential velocity equation derived from the degradation mode in Section 3.1.

2.

Output seamless switching and motion stability verification.

Whether the rapid velocity redistribution of the input end and the cold start shock will lead to the interruption of the output end is the core indicator for evaluating the fault tolerance mechanism. It can be seen from the output angular velocity curve of the lens cover in Figure 5b that the lens cover maintains a uniform opening speed of 30°/s before the failure of $t=2.4 \mathrm{s}$.

At the moment of fault injection, due to the transient loss of the main drive force, the take-up of transmission chain backlash, and the acceleration delay of the cold backup motor, the angular velocity of the output shaft will have a transient decrease. However, thanks to the mechanical inertia of the system and the extremely high transient angular acceleration response of the motor 2, the speed fluctuation will never cross the zero point (non-zero intersection). During the whole failover process, the lens cover will neither stagnate nor reverse. After a short adjustment period of about 0.2 s, the output speed quickly converged and steadily recovered to the nominal value of 30°/s. This verifies the transmission ability of the mechanism under extreme “cold wake-up” conditions.

It is important to clarify from an electromechanical perspective that the extremely rapid velocity jump of motor 2 (from 0 to 400°/s in under 0.1 s) observed in the simulation is governed by an idealized kinematic STEP function. In a real physical space actuator, such an instantaneous acceleration would be constrained by the motor’s winding inductance (limiting current slew rate), back-electromotive force, and the current-limiting threshold of the servo controller. This idealized step function was deliberately implemented in the ADAMS environment to construct an absolute worst-case mechanical boundary condition. By enforcing an artificially high angular acceleration that exceeds the physical limits of standard motor drivers, the simulation deliberately maximizes the transient inertial impact forced onto the transmission chain. Consequently, because the subsequent dynamic analysis (Section 4.3.2) proves that the physical gear structure can safely endure the extreme contact forces generated by this idealized, ultra-harsh shock, it is guaranteed to possess a substantial safety margin against the much softer, current-limited ramp-up profiles (e.g., S-curve acceleration) that would be executed by the actual spacecraft motor controller.

4.3. Transient Dynamic Torque and Internal Contact Force Analysis

In order to verify the torque distribution law of the dual-motor differential mechanism and its impact resistance under sudden single-point mechanical failure, this section extracts and compares the external drive torque and planetary gear contact force response curves under the benchmark condition (Case 1) and the fault dynamic takeover condition (Case 3).

4.3.1. Load Sharing Effect in Nominal Operation

First, analyze the steady-state dynamic performance under Case 1 (dual-motor cooperative mode). In the even unfolding stage of the lens cover (0~5 s), the total drag moment to be overcome mainly comes from gravity bias and hinge friction. With the increase in the nonlinearity of the effective gravity arm, the total driving torque reaches the global maximum value of steady-state gravity torque at $t=2.4 \mathrm{s}$ (corresponding to the unfolding angle of about 72°).

As shown in Figure 6a, the simulation results show that thanks to the differential structure, the total load torque is reasonably distributed to the two branches of the ring gear and the planet carrier, and the output torque of the two motors is stable at a lower rated level. The dynamic contact force between planetary gears and ring gear is also stable. This favorable load-distribution characteristic significantly reduces the fatigue wear rate of the system during long-term in-orbit operation.

4.3.2. Transient Mechanical Excitation and Strength Verification Under Extreme Overlap

The core of this section is the quantitative evaluation of dynamic response characteristics under absolutely strict boundary conditions (Case 3). As shown in Figure 6b, at the moment of failure injection, there is a sudden torque spike at the external drive end of the system, and there is nonlinear contact excitation in the internal transmission chain.

At this time, the system will face extreme dynamic load superposition. The center of mass of the lens cover is located at the farthest point of its horizontal direction (the maximum static gravity deviation), and the motor 1 suddenly gets stuck. Motor 2 takes over urgently in a very short time, generating a transient angular acceleration of up to 4000°/s².

The simulation curve accurately captures this coupling shock phenomenon:

•

External torque response: A steep global torque peak appears at the driving end of the normal motor (motor 2) to overcome the huge transient inertial torque, whose peak significantly reaches 80.99 N·mm.

•

Internal contact force response: Because the ring gear is instantly locked and turned into a fixed base, the violently accelerated planetary gear will produce an extremely short pulse contact force peak at the meshing interface. Specifically, the transient impact force reaches the maximum value of 78.56 N at the annular gear–planet gear meshing, and the maximum value of 78.86 N at the solar gear–planet gear meshing.

Although these transient peaks are significantly higher than the steady-state level, rigorous numerical verification confirms that the extreme torque is always within the maximum allowable overload range of the motor. At the same time, based on the Hertz contact theory, the maximum stress generated by these contact force peaks on the tooth surface is strictly lower than the yield limit of the selected high-strength alloy steel 40CrNiMoA (maintaining a sufficient safety factor). After a brief oscillation attenuation of about 0.1 s, all mechanical indicators quickly returned to stability and entered the stable state of single motor drive.

Importantly, because the ADAMS model incorporates the true mass and rotational inertia of the 40CrNiMoA gears, the peak contact force of 78.86 N inherently accounts for the massive transient inertia torque induced by the 4000°/s² angular acceleration. The fact that this combined dynamic stress remains far below the yield limit confirms that the physical structure can safely absorb the inertial shock that was theoretically simplified in the Section 3.2 quasi-static model.

The results of the joint dynamic simulation strongly prove that even in the extreme superposition of “maximum static load + extreme dynamic inertia”, this 2-degree-of-freedom differential architecture also has a sufficient motor output margin and highly reliable gear structure strength.

4.4. Cross-Validation with Deep Space Environmental Factors

While the ADAMS transient dynamic model primarily evaluates kinematic decoupling and mechanical stress boundaries, its simulation outcomes provide crucial cross-validation for the time-variant reliability PoF models established in Section 3.3.2 under extreme deep space environments:

1. Margin for Thermal Deformation: As modeled by the Coffin–Manson equation in Section 3.3, severe spatial thermal cycling induces secondary thermal stresses and dimensional backlash variations. Although the current ADAMS model is isothermal, the dynamic simulation (Section 4.3.2) proves that even under a severe operational scenario, the peak contact forces (78.86 N) generate stresses far below the yield limit of the 40CrNiMoA alloy. This massive structural safety margin acts as a robust physical buffer to absorb un-simulated thermal deformations without inducing mechanical binding.

2. Mitigation of Radiation-Induced Degradation: Space radiation (TID) severely accelerates the degradation of motor stator insulation, directly diminishing the maximum torque output capacity over time. The nominal load-sharing dynamic simulation (Figure 6a) demonstrates that the dual-motor synergistic mode drastically reduces the required operating torque for each individual motor. Consequently, even if cumulative radiation causes a significant drop in the motors’ performance ceiling late in the Jupiter mission, the actual power demand remains well within the degraded operational envelope.

3. Overcoming Degraded Lubrication: To combat vacuum cold-welding, the physical system relies on solid lubrication (e.g., $Mo{S}_2$), which typically exhibits higher friction resistance than liquid lubricants, especially after prolonged inactivity. The simulation explicitly incorporated elevated spatial Coulomb friction coefficients (Table 3). The successful seamless takeover and non-zero-crossing velocity recovery observed in Figure 5 explicitly verify that the differential mechanism possesses sufficient dynamic reserve power to instantly overcome the high stiction of degraded solid lubrication in a deep space vacuum.

5. Conclusions

5.1. Main Conclusions

In response to the strict requirements of the magnetic field and velocity field imager lens cover for high reliability and long service life in extreme space environments, this study proposes a new type of dual redundancy drive mechanism based on the principle of planetary gear differential. Through theoretical modeling, parameter optimization and multi-condition dynamic simulation, the kinematic feasibility and fault tolerance of the mechanism are verified. The main conclusions are summarized as follows:

•

Planetary differential architecture design and decoupling theory:

This paper designs a “dual input single output (DISO)” planetary differential drive topology. Based on the Kutzbach–Grubler criterion, it is proved that the system has two degrees of freedom (2-DOF). The derived velocity equations theoretically clarify the adaptive decoupling mechanism of the system: when the either input channel is mechanically stuck (${\omega }_{mi}=0$), the degree of freedom of the system is adaptively downgraded to F = 1. The remaining motor can independently control the output shaft by the set speed ratio, so as to eliminate the propagation path of single-point fault at the physical level.

• Analysis of the advantages of life extension in dual-motor cooperative mode:

Kinematic analysis shows that in the nominal dual-motor coordinated operation mode, the speed required for a single motor is greatly reduced. It is 40%-60% of the speed required in the independent drive mode of a single motor. This significant “kinematic load-sharing effect” effectively reduces the sliding friction speed and wear rate in the gear transmission chain, thus confirming the superiority of the configuration as the main operating mode of long-term orbital tasks.

• Verification of dynamic takeover ability and motion stability in extreme and worst cases:

Through ADAMS, a high-fidelity virtual prototype containing Hertz contact and nonlinear friction is established, so that transient dynamic simulation can be carried out for the “extreme worst case” in the process of lens cover unfolding. The results show that even at the moment when the system is subjected to the maximum global static gravity bias torque (that is, the single motor suddenly has mechanical jamming), the cold backup motor can quickly complete the dynamic takeover. Although the inertial torque peak will be generated instantly during the failure, the peak value is always strictly controlled within the structural safety margin. In addition, the angular velocity fluctuation of the output axis has never exceeded zero, which is characterized by “a seamless takeover with a non-zero-crossing velocity dip”. This fully confirms that the mechanism has excellent reliability in the extreme superposition of “maximum static load + transient dynamic load”.

5.2. Summary of Innovations

In view of the critical vulnerability that traditional single-motor or simple parallel mechanisms are prone to single-point failure in extreme deep space environments, this paper introduces the planetary differential gear system into the lens cover drive field. A rigid physically coupled DISO architecture has been constructed. By using the passive redundancy characteristics inherent in the differential mechanism, the propagation path of mechanical lag failure is structurally isolated at the physical topology level of the physical topology.

5.3. Future Work

While this study establishes a solid theoretical foundation and provides rigorous dynamic simulation verification for the proposed dual-redundant differential mechanism, it is limited by the current lack of physical experimental validation. For aerospace mechanisms, simulation alone is insufficient to demonstrate full engineering feasibility. Currently, the “Phase-II” experimental verification is actively underway. Future work will focus on the following key areas:

•

Prototyping and physical testing: Develop a 1:1 ratio of high-fidelity physical prototypes, and conduct strict vibration tests and life cycle assessment in a thermal vacuum chamber (TVAC) environment. The empirical data extracted from these tests is crucial for further association and updating the parameters of the friction model.

•

Thermo-mechanical coupled co-simulation: Acknowledging the limitations of the current isothermal dynamic model, future research will integrate Finite Element Analysis (FEA) with Multi-Body Dynamics (MBD) to perform transient thermo-mechanical coupled simulations. This will explicitly quantify the impact of extreme spatial thermal gradients on gear backlash evolution, thermal deformation, and meshing efficiency.

•

Control strategy optimization: In view of the transient torque peak observed at the moment of failover, future research will explore the active flexible control strategy based on the torque observer. This move aims to further suppress mechanical shocks and improve the dynamic stability of the entire electromechanical system.