Methods and systems for redundant safety control in by-wire control systems
A redundant safety controller configured to monitor communications between at least one controller and a by-wire control system. The at least one controller has a first hardware architecture and is configured to manage operation of the by-wire control system. The redundant safety controller has a second hardware architecture. The first hardware architecture is different from the second hardware architecture. The at least one controller is configured to implement a first instruction set architecture. The redundant safety controller is configured to implement a second instruction set architecture. The first instruction set architecture is different from the second instruction set architecture. The redundant safety controller is configured to determine whether the at least one controller has failed and assume management of the operation of the by-wire control system based on the determination.
1 . A redundant safety control system for a by-wire control system in a vehicle, comprising:
a redundant safety controller configured to:
monitor communications between at least one controller and the by-wire control system, the by-wire control system comprising a braking by-wire system including a front right wheel brake actuator and a rear left wheel brake actuator configured to be powered by a first power grid of the vehicle and a front left wheel brake actuator and a rear right wheel brake actuator configured to be powered by a second power grid of the vehicle, wherein:
the at least one controller has a first hardware architecture and is configured to manage operation of the by-wire control system and be powered by the first and second power grids;
the redundant safety controller has a second hardware architecture and is configured to be powered by one of the first power grid and the second power grid, wherein the first hardware architecture is different from the second hardware architecture;
the at least one controller is configured to implement a first instruction set architecture; and
the redundant safety controller is configured to implement a second instruction set architecture, wherein the first instruction set architecture is different from the second instruction set architecture;
determine whether the at least one controller has failed; and
assume management of the operation of the by-wire control system based on the determination.
2 . The system of claim 1 , wherein:
the at least one controller is communicatively coupled to the front right wheel brake actuator, the rear left wheel brake actuator, the front left wheel brake actuator, and the rear right wheel brake actuator via a first communication network; and
the redundant safety controller is communicatively coupled to the front right wheel brake actuator, the rear left wheel brake actuator, the front left wheel brake actuator, and the rear right wheel brake actuator via a second communication network, wherein:
the first communication network is a first type of communication network:
the second communication network is a second type of communication network; and
the first type of communication network is different from the second type of communication network.
3 . The system of claim 2 , wherein the first type of communication network is an Ethernet network and the second type of communication network is a controller area network (CAN).
4 . The system of claim 1 , wherein the braking by-wire system comprises a brake pedal emulator and wherein:
the brake pedal emulator is communicatively coupled to the at least one controller via a first communication channel and configured to transmit brake pedal emulator data via the first communication channel; and
the brake pedal emulator is communicatively coupled to the redundant safety controller via a second communication channel and configured to transmit the brake pedal emulator data via the second communication channel.
5 . The system of claim 1 , wherein the at least one controller is communicatively coupled to the redundant safety controller via a third communication channel and configured to exchange data via the third communication channel.
6 . The system of claim 1 , wherein:
the by-wire control system further comprises a steering by-wire system comprising:
a first hand wheel actuator and a first road wheel actuator configured to be powered by the first power grid of the vehicle; and
a second hand wheel actuator and a second road wheel actuator configured to be powered by the second power grid of the vehicle.
7 . The system of claim 6 , wherein:
the at least one controller is communicatively coupled to the first hand wheel actuator, the second hand wheel actuator, the first road wheel actuator, and the second road wheel actuator via a third communication network; and
the redundant safety controller is communicatively coupled to the first hand wheel actuator, the second hand wheel actuator, the first road wheel actuator, and the second road wheel actuator via a fourth communication network, wherein:
the third communication network is a third type of communication network:
the fourth communication network is a fourth type of communication network; and
the third type of communication network is different from the fourth type of communication network.
8 . The system of claim 7 , wherein the third type of communication network is an Ethernet network and the fourth type of communication network is a controller area network (CAN).
9 . The system of claim 6 , wherein the steering by-wire system comprises:
a first steering angle sensor (SAS) configured to be communicatively coupled to the first hand wheel actuator;
a second SAS configured to be communicatively coupled to the second hand wheel actuator; and
a tertiary SAS configured to be communicatively coupled to the first and second hand wheel actuators.
10 . A vehicle including a redundant safety control system comprising:
a by-wire control system, the by-wire control system comprising a steering by-wire system including a first hand wheel actuator and a first road wheel actuator configured to be powered by a first power grid of the vehicle and a second hand wheel actuator and a second road wheel actuator configured to be powered by a second power grid of the vehicle;
at least one controller configured to manage operation of the by-wire control system and be powered by the first and second power grids; and
a redundant safety controller configured to:
monitor communications between the at least one controller and the by-wire control system and be powered by one of the first power grid and the second power grid, wherein:
the at least one controller has a first hardware architecture and is configured to manage operation of the by-wire control system;
the redundant safety controller has a second hardware architecture, wherein the first hardware architecture is different from the second hardware architecture;
the at least one controller is configured to implement a first instruction set architecture;
the redundant safety controller is configured to implement a second instruction set architecture, wherein the first instruction set architecture is different from the second instruction set architecture;
determine whether the at least one controller has failed; and
assume management of the operation of the by-wire control system based on the determination.
11 . The vehicle of claim 10 , wherein:
the by-wire control system further comprises a braking by-wire system comprising:
a front right wheel brake actuator and a front left wheel brake actuator configured to be powered by the first power grid of the vehicle; and
a rear right wheel brake actuator and a rear left wheel brake actuator configured to be powered by the second power grid of the vehicle.
12 . The vehicle of claim 11 , wherein:
the at least one controller is communicatively coupled to the front right wheel brake actuator, the rear left wheel brake actuator, the front left wheel brake actuator, and the rear right wheel brake actuator via a first communication network; and
the redundant safety controller is communicatively coupled to the front right wheel brake actuator, the rear left wheel brake actuator, the front left wheel brake actuator, and the rear right wheel brake actuator via a second communication network, wherein:
the first communication network is a first type of communication network:
the second communication network is a second type of communication network; and
the first type of communication network is different from the second type of communication network.
13 . The vehicle of claim 12 , wherein the first type of communication network is an Ethernet network and the second type of communication network is a CAN.
14 . The system of claim 11 , wherein the braking by-wire system comprises a brake pedal emulator and wherein:
the brake pedal emulator is communicatively coupled to the at least one controller via a first communication channel and configured to transmit brake pedal emulator data via the first communication channel; and
the brake pedal emulator is communicatively coupled to the redundant safety controller via a second communication channel and configured to transmit the brake pedal emulator data via the second communication channel.
15 . The system of claim 10 , wherein the at least one controller is communicatively coupled to the redundant safety controller via a third communication channel and configured to exchange data via the third communication channel.
16 . The system of claim 10 , wherein:
the at least one controller is communicatively coupled to the first hand wheel actuator, the second hand wheel actuator, the first road wheel actuator, and the second road wheel actuator via a third communication network; and
the redundant safety controller is communicatively coupled to the first hand wheel actuator, the second hand wheel actuator, the first road wheel actuator, and the second road wheel actuator via a fourth communication network, wherein:
the third communication network is a third type of communication network:
the fourth communication network is a fourth type of communication network; and
the third type of communication network is different from the fourth type of communication network.
17 . The system of claim 10 , wherein the steering by-wire system comprises:
a first steering angle sensor (SAS) configured to be communicatively coupled to the first hand wheel actuator;
a second SAS configured to be communicatively coupled to the second hand wheel actuator; and
a tertiary SAS configured to be communicatively coupled to the first and second hand wheel actuators.
18 . A method for implementing redundant safety control in a vehicle comprising:
monitoring, by a redundant safety controller, communications between at least one controller and a by-wire control system, the by-wire control system being a braking by-wire system comprising a front right wheel brake actuator and a rear left wheel brake actuator configured to be powered by a first power grid of the vehicle and a front left wheel brake actuator and a rear right wheel brake actuator configured to be powered by a second power grid of the vehicle, wherein:
the at least one controller has a first hardware architecture and is configured to manage operation of the by-wire control system and be powered by the first and second power grids;
the redundant safety controller has a second hardware architecture and is configured to be powered by one of the first power grid and the second power grid, wherein the first hardware architecture is different from the second hardware architecture;
the at least one controller is configured to implement a first instruction set architecture;
the redundant safety controller is configured to implement a second instruction set architecture, wherein the first instruction set architecture is different from the second instruction set architecture;
determining, by the redundant safety controller, whether the at least one controller has failed; and
assuming management of the operation of the by-wire control system, by the redundant safety controller, based on the determination.
19 . The method of claim 18 , wherein:
the at least one controller is communicatively coupled to the front right wheel brake actuator, the rear left wheel brake actuator, the front left wheel brake actuator, and the rear right wheel brake actuator via a first communication network; and
the redundant safety controller is communicatively coupled to the front right wheel brake actuator, the rear left wheel brake actuator, the front left wheel brake actuator, and the rear right wheel brake actuator via a second communication network, wherein:
the first communication network is a first type of communication network:
the second communication network is a second type of communication network; and
the first type of communication network is different from the second type of communication network.
20 . The method of claim 19 , wherein the first type of communication network is an Ethernet network and the second type of communication network is a controller area network (CAN).