Multi-stage voting control

1. A control system comprising:

an actuator device responsive to a voted command, wherein the control system is in communication with the actuator device, and comprising a multi-stage voting system, configured to determine the voted command for the actuator device;

a set of controllers providing a set of commands to the multi-stage voting system;

a monitor controller providing a monitor command to the multi-stage voting system;

wherein the multi-stage voting system comprises logic in the control system with a first stage that compares the set of commands to each other, and a second stage that compares at least one of the set of commands to the monitor command; and

wherein the multi-stage voting system delivers the voted command to the actuator device based on the comparisons made in the first and second stages, the actuator device effecting an operation in response to the voted command.

2. The control system of claim 1 wherein:

the set of commands includes a first command and a second command; and

the first stage is configured to evaluate whether the first and second commands are in agreement with one another.

3. The control system of claim 1 wherein:

the set of commands includes a first command, a second command, and a third command;

the first stage is configured to evaluate whether the first, second and third commands are in agreement with one another;

wherein when all of the first, second and third commands agree with one another, the first stage is configured to deliver a first output command to the second stage; and

wherein when only two of the first, second and third commands agree with one another, the first stage is configured to deliver a second output command to the second stage, the second output command differing from the first output command.

4. The control system of claim 3 wherein:

the second stage is configured to evaluate whether the first output command agrees with the monitor command; and

when the first output command and the monitor command do not agree with one another, the second stage is configured to deliver a degraded command effecting a change in operation of the actuator device relative to that effected from the first and second output commands.

5. The control system of claim 3 wherein:

the second stage is configured to evaluate whether the first output command agrees with the monitor command; and

when the first output command and the monitor command do not agree with one another, the second stage is configured to deliver a predetermined command to the actuator device, wherein the predetermined command is retrieved from a computer readable storage device or media of the control system and is configured to match an operational need of the actuator device.

6. The control system of claim 3 wherein:

the second stage is configured to evaluate whether the first output command agrees with the monitor command within a threshold; and

wherein the threshold is configured to allow variation between the first output command and the monitor command, in evaluating whether the first output command agrees with the monitor command.

7. The control system of claim 1 wherein:

the set of commands includes a first command and a second command;

the first stage is configured to evaluate whether the first and second commands are in agreement with one another;

the second stage is configured to determine whether the first command and the second command are in agreement with the monitor command; and

the second stage is configured to issue the second command as the voted command when the first command does not agree with the monitor command and the second command does agree with the monitor command.

8. The control system of claim 7 wherein:

the second stage is configured to issue an alternative command as the voted command when the first command does not agree with the second command, or when the first command does not agree with the monitor command and the second command does not agree with the monitor command.

9. A method of operating a control system to issue a voted command to an actuator device comprising:

providing a first controller, a second controller and a monitor controller wherein the second controller is substantially identical to the first controller;

receiving a first signal from the first controller wherein the first signal represents a first command;

receiving a second signal from the second controller, wherein the second signal represents a second command;

receiving a monitor signal from the monitor controller, wherein the monitor controller is configured different from the first and second controllers, wherein the monitor signal represents a third command;

processing, by a processor, the first and second signals using a multi-stage voting system, wherein the multi-stage voting system includes a first stage and a second stage;

comparing, by the processor in the first stage, the first signal to the second signal;

comparing, by the processor in the second stage, the monitor signal to at least one of the first signal or the second signal; and

issuing, when the monitor signal agrees with the first or second signal, a command signal as the voted command from the multi-stage voting system to the actuator device, wherein the command signal corresponds to at least one of the first or second signals.

10. The method of claim 9 comprising:

configuring the first controller with a first program;

configuring the second controller with the first program; and

configuring the monitor controller with a second program that is different from the first program.

11. The method of claim 9 comprising:

executing the first stage in a first stage voting module of the processor; and

executing the second stage in a second stage voting module of the processor.

12. The method of claim 11 comprising:

providing a command signal from the first stage voting module to the second stage voting module, wherein the command signal represents agreement between the first command and the second command; and

issuing an alternative signal from the multi-stage voting system to the actuator device when the first signal does not agree with the second signal, or when the monitor signal is not in agreement with the first or second signal, wherein the alternate signal represents a predetermined command based on an operational need of the actuator device.

13. The method of claim 11 comprising:

providing a third controller;

receiving a third signal from the third controller wherein the third signal represents a fourth command;

comparing, by the processor, the first, second and third signals with one another;

when all of the first, second and third signals agree with one another, issuing a first command signal from the first stage voting module to the second stage voting module; and

when only two of the first, second and third signals agree with one another, issuing a second command signal from the first stage voting module to the second stage voting module, wherein the second command signal is different than the first command signal.

14. The method of claim 13 comprising:

issuing an alternative signal from the second stage voting module to the actuator device when the second command signal is issued, wherein the alternative signal is predetermined and stored in the control system.

15. The method of claim 11 comprising:

providing a third controller;

receiving a third signal from the third controller wherein the third signal represents a fourth command;

comparing, by the processor, the first, second and third signals with one another; and

issuing an alternative signal from the second stage voting module to the actuator device when none of the first, second and third signals agree with one another, wherein the alternative signal is predetermined and stored in the control system.

16. The method of claim 9 comprising:

comparing, by the processor, the first signal to the monitor signal;

comparing, by the processor, the second signal to the monitor signal, when the monitor signal does not agree with the first signal; and

issuing, by the processor, an alternative command to the actuator device when the first signal does not agree with the second signal or when the monitor signal does not agree with the second signal, wherein the alternative signal is predetermined and stored in the control system.

17. The method of claim 9 comprising:

providing a sensor device; and

providing a signal from the sensor device to both the first and second controllers.

18. The method of claim 9 comprising:

providing an autonomous vehicle;

providing the actuator device to actuate a vehicle system of the autonomous vehicle;

providing a sensor device on the autonomous vehicle; and

operating the vehicle system by the actuator device in response to an input signal from the sensor device, wherein the input signal is processed by the processor through the multi-stage voting system.

19. The method of claim 18 comprising:

providing a third controller;

receiving a third signal from the third controller to the multi-stage voting system, wherein the first, second and third signals are determined based on the input signal;

comparing, by the processor, the first, second and third signals with one another;

when all of the first, second and third signals agree with one another, issuing a first output signal from the first stage to the second stage; and

when only two of the first, second and third commands agree with one another, issuing a second output signal from the first stage to the second stage, wherein the second output signal is different than the first output command.

20. A control system with multi-stage voting for an autonomous vehicle comprising:

a vehicle system operating at least one function of the autonomous vehicle;

an actuator device communicating with the vehicle system to actuate the vehicle system;

wherein the control system is in communication with the actuator device, and comprising a multi-stage voting system configured to determine a voted command for the actuator device, the voted command established for control of the autonomous vehicle;

a set of controllers receiving first inputs from the autonomous vehicle and providing a set of command signals to the multi-stage voting system, wherein the controllers in the set of controllers are substantially identical;

a monitor controller receiving second inputs from the autonomous vehicle and providing a monitor signal to the multi-stage voting system;

wherein the multi-stage voting system comprises logic in the control system that has a first stage that compares the set of command signals to each other, and a second stage that compares at least one command signal in the set of command signals to the monitor signal; and

wherein the multi-stage voting system delivers the voted command to the actuator device based on the comparisons made in the first and second stages.