High-integrity actuator controller and control systems

A high-integrity electromechanical actuator control system, comprising:

• a system function controller comprising a plurality of redundant functional control channels, each functional control channel configured to supply digital actuator control commands;
• a plurality of actuator controllers, each actuator controller coupled to receive the digital actuator control commands supplied from at least two of the functional control channels, each actuator controller configured, upon receipt of the actuator control commands, to implement a command voting scheme to verify actuator control command integrity and, upon verifying actuator control command integrity, to generate and supply analog actuator position commands, each actuator controller including a primary channel and a backup channel, each primary channel comprising a first controller, a second controller, and a duty cycle computation circuit, each backup channel comprising a backup controller;
• and
• at least one electromechanical actuator coupled to receive the actuator position commands from at least one of the actuator controllers and configured, upon receipt thereof, to actuate a device,
• wherein:
• the first controller is adapted to receive the digital actuator control commands supplied from two different functional control channels and configured, upon receipt thereof, to supply first digital duty cycle commands,
• the second controller is adapted to receive the digital actuator control commands supplied from two different control channels and configured, upon receipt thereof, to supply second digital duty cycle commands,
• the duty cycle computation circuit is coupled to receive the first digital duty cycle commands and the second digital duty cycle commands and configured, upon receipt of the first and second duty cycle commands to (i) compute an average of the first and second duty cycle commands and (ii) generate and supply primary pulse width modulated (PWM) commutation control signals based on the computed average,
• the backup controller is adapted to receive the digital actuator control commands supplied from two different functional control channels and configured, upon receipt thereof, to generate and supply backup PWM commutation control signals, and
• a motor driver coupled to receive either the primary PWM commutation control signals or the backup PWM commutation control signals and configured, upon receipt thereof, to supply multi-phase motor drive current.

A high-integrity electromechanical actuator control system, comprising:

• a plurality of actuator controllers, each actuator controller adapted to receive digital actuator control commands supplied from at least two different functional control channels, each actuator controller configured, upon receipt of the actuator control commands, to implement a command voting scheme to verify actuator control command integrity and, upon verifying actuator control command integrity, to generate and supply analog actuator position commands, each actuator controller including a primary channel and a backup channel, each primary channel comprising a first controller, a second controller, a duty cycle computation circuit, and a primary shut-off circuit, each backup channel comprising a backup controller and a backup shut-off circuit;
• and
• at least one electromechanical actuator coupled to receive the actuator position commands from at least one of the actuator controllers and configured, upon receipt thereof, to actuate a device,
• wherein:
• the first controller is adapted to receive the digital actuator control commands supplied from two different functional control channels and is configured, upon receipt thereof, to supply first digital duty cycle commands,
• the second controller is adapted to receive the digital actuator control commands supplied from two different control channels and is configured, upon receipt thereof, to supply second digital duty cycle commands,
• the duty cycle computation circuit is coupled to receive the first digital duty cycle commands and the second digital duty cycle commands and is configured, upon receipt of the first and second duty cycle commands to (i) compute an average of the first and second duty cycle commands and (ii) generate and supply primary pulse width modulated (PWM) commutation control signals based on the computed average,
• the primary shut-off circuit is in operable communication with the first controller, the second controller, and the duty cycle computation circuit, the primary shut-off circuit is configured to selectively inhibit supply of the primary PWM commutation control signals, the backup controller is dissimilar to the first and second controllers,
• the backup controller is adapted to receive the digital actuator control commands supplied from two different functional control channels and is configured, upon receipt thereof, to generate and supply backup PWM commutation control signals,
• the backup shut-off circuit is in operable communication with the backup controller, the backup shut-off circuit is configured to selectively inhibit supply of the backup PWM commutation control signals, and
• a motor driver coupled to receive either the primary PWM commutation control signals or the backup PWM commutation control signals and configured, upon receipt thereof, to supply multi-phase motor drive current.