Electromechanical controller for vehicles having a main processing module and a safety processing module

A driving system for a vehicle, the driving system comprising:

• one or more sensors configured to collect one or more command inputs;
• a controller comprising:
• a main processing module having one or more processors and at least one memory, the main processing module being configured to process the one or more command inputs to generate a command output value for the vehicle;
• an actuator drive receiving the command output value from the main processing module and converting the command output value for compatibility with one or more electromechanical actuators;
• and
• a safety processing module having one or more processors and at least one memory, the safety processing module being configured to process the one or more command inputs to generate an expected command output value;
• an actuator of the one or more electromechanical actuators, the actuator configured to change a driving condition of the vehicle based on the command output value converted by the actuator drive;
• and
• a safety shutdown switch configured to receive a control signal generated by the safety processing module;
• wherein the safety processing module is independent of the main processing module, and the safety processing module is configured to generate the expected command output separately and independently of the main processing module;
• wherein there is no direct communication between the safety processing module and the main processing module;
• wherein the safety processing module compares the expected command output value with the command output value generated by the main processing module by retrieving directly from the actuator drive the command output value generated by the main processing module, and generates the safety control signal when a difference between the expected command output value and the command output value is greater than a predefined tolerance;
• and
• wherein the safety control signal activates the safety shutdown switch to return the actuator to a fail-safe state.

A method for controlling a vehicle, the method comprising:

• collecting command inputs;
• generating an actual command output value by a main processing module for changing a driving condition of the vehicle;
• converting the actual command output value by an actuator drive for compatibility with an electromechanical actuator;
• generating an expected command output value by a safety processing module for determining whether the vehicle is operating properly, wherein the expected command output value is generated by the safety processing module separately and independently of the actual command output value generated by the main processing module, and wherein there is no direct communication between the safety processing module and the main processing module;
• retrieving directly from the actuator drive the actual command output value;
• comparing the actual command output value with the expected command output value;
• and
• returning the electromechanical actuator to a fail-safe state when the actual command output value is outside a predefined range of the expected command output value.