# US 8,340,793 B2 · Architecture using integrated backup control and protection hardware > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,340,793 B2 - Document ID: US8340793B2 - Status: Granted - Kind: B2 - Application number: 12/791,163 - Filed: 2010-06-01 - Published: 2011-04-14 - Granted: 2012-12-25 - Earliest claimed: 2009-10-09 - Assignees: Hamilton Sundstrand Corporation - Inventors: Jeffry K. Kamenetz; Gregory DiVincenzo; Mark A. Johnston; Jay W. Kokas; Luke T. Orsini; Steven R. Fischer; Jay H. Hartman; Kevin P. Roy; William Betterini - Web page: https://patentgrep.com/patent/US8340793B2 ## CPC - G06F 11/0796: {Safety measures, i.e. ensuring safe condition in the event of error, e.g. for controlling element} - G05B 19/0428: {Safety, monitoring (G05B19/0423 takes precedence)} - G06F 11/2028: {eliminating a faulty processor or activating a spare} - G05B 2219/25471: Replace existing control system with new different system in real time - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G05B: CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS (systems for controlling or regulating non-electric variables G05D; systems for regulating electric or magnetic variables G05F; control devices or systems insofar as characterised by mechanical features only G05G) ## Abstract An electronic control configuration includes at least one secondary microprocessor operable to control a device. The at least one secondary microprocessor assumes protection control of the device responsive to a first type of failure by transmitting a protection control signal to a first effector. The at least one secondary microprocessor assumes backup control of the device responsive to a second type of failure by transmitting a backup control signal to a second effector. The backup control functionality of the at least one secondary microprocessor can be selectively disabled. ## Claims ### Claim 1 An electronic control configuration, comprising: at least one primary microprocessor operable to control a device using a first shaft and a first effector; and at least one secondary microprocessor operable to control the device using a second shaft and a second effector, the at least one secondary microprocessor assuming protection control of the device responsive to a first type of failure by transmitting a protection control signal to the first effector, the at least one secondary microprocessor assuming backup control of the device responsive to a second type of failure by transmitting a backup control signal to the second effector, wherein the backup control functionality of the at least one secondary microprocessor can be selectively disabled. ### Claim 2 (depends on 1) The electronic control configuration of claim 1, wherein the first type of failure is a failure in which at least one primary control microprocessor is able to control the device but requires assistance from the at least one secondary microprocessor to avoid damaging the device, and wherein the second type of failure is a failure in which the at least one primary control microprocessor is unable to control the device and relinquishes control of the device to either another primary control microprocessor or the at least one secondary microprocessor. ### Claim 3 (depends on 2) The electronic control configuration of claim 2, wherein the at least one primary control microprocessor is operable to detect its own failure when the failure is the second type of failure, but is unable to detect its own failure when the failure is the first type of failure. ### Claim 4 (depends on 2) The electronic control configuration of claim 2, wherein first type of failure includes one or more of a temporary memory failure of the at least one primary control microprocessor, or the at least one primary control microprocessor erroneously measuring an operating speed of the device. ### Claim 5 (depends on 2) The electronic control configuration of claim 2, wherein the second type of failure includes a fault of the primary control microprocessor or a loss of a sensor input signal from the device. ### Claim 6 (depends on 2) The electronic control configuration of claim 2, wherein the at least one primary control microprocessor includes a first primary control microprocessor operable to control the device, and a second primary control microprocessor operable to control the device in response to the first primary control microprocessor experiencing the second type of failure. ### Claim 7 (depends on 6) The electronic control configuration of claim 6, wherein the at least one secondary microprocessor includes: a first secondary microprocessor operable to assume protection control of the device if the first primary control microprocessor experiences the first type of failure, and operable to assume backup control of the device if the first and second primary control microprocessors experience the second type of failure; and a second secondary microprocessor operable to assume protection control of the device if the second primary control microprocessor experiences the first type of failure, the second secondary microprocessor having its backup control functionality disabled. ### Claim 8 (depends on 6) The electronic control configuration of claim 6, wherein the at least one secondary microprocessor includes: a first secondary microprocessor operable to assume protection control of the device if the first primary control microprocessor experiences the first type of failure; and a second secondary microprocessor operable to assume protection control of the device if the second primary control microprocessor experiences the first type of failure, wherein either of the first secondary microprocessor or second secondary microprocessor is operable to assume backup control of the device if the first and second primary control microprocessors experience the second type of failure. ### Claim 9 An electronic control configuration, comprising: at least one secondary microprocessor operable to control a device, the at least one secondary microprocessor assuming protection control of the device responsive to a first type of failure by transmitting a protection control signal to a first effector, the at least one secondary microprocessor assuming backup control of the device responsive to a second type of failure by transmitting a backup control signal to a second effector, wherein a backup control functionality of the at least one secondary microprocessor can be selectively disabled; wherein the first type of failure is a failure in which at least one primary control microprocessor is able to control the device but requires assistance from the at least one secondary microprocessor to avoid damaging the device, and wherein the second type of failure is a failure in which the at least one primary control microprocessor is unable to control the device and relinquishes control of the device to either another primary control microprocessor or the at least one secondary microprocessor; and wherein the at least one secondary microprocessor controls the device along a first shaft using the first effector, wherein the at least one primary control microprocessor controls the device along a second shaft using the second effector, wherein each of the first effector and the second effector include at least one of a stepper motor, a torque motor and a dual-coil solenoid. ### Claim 10 (depends on 9) The electronic control configuration of claim 9, wherein the at least one primary control microprocessor and the at least one secondary microprocessor communicate via a serial bus. ### Claim 11 (depends on 1) The electronic control configuration of claim 1, wherein the device is a mechanically-controllable component of a vehicle or a building. ### Claim 12 An electronic control configuration, comprising: a first primary control operable to control a device using a first shaft and a first effector to control the device; a first secondary control operable to assume protection control of the device if the first primary control experiences a first type of failure; a second primary control operable to control the device using a second shaft and a second effector in response to the first primary control experiencing a second type of failure; and a second secondary control operable to assume protection control of the device if the second primary control experiences the first type of failure, at least one of the secondary controls being operable to assume backup control of the device if both the first and second primary controls experience the second type of failure. ### Claim 13 (depends on 12) The electronic control configuration of claim 12, wherein each of the secondary controls have both backup and protection control functionality, and wherein the second secondary control has its backup protection features disabled. ### Claim 14 (depends on 12) The electronic control configuration of claim 12, wherein each of the secondary controls have both backup and protection control functionality, and wherein both of the first secondary control and the second secondary control have their backup protection features enabled. ### Claim 15 (depends on 12) The electronic control configuration of claim 12, wherein the first primary control and the first secondary control correspond to a first control channel, the first secondary control controlling the device along a first shaft using a first winding of a first effector, the first primary control controlling the device along a second shaft using a first winding of a second effector, and wherein the second primary control and the second secondary control correspond to a second control channel, the second secondary control controlling the device along the first shaft using a second winding of the first effector, and the second primary control controlling the device along the second shaft using a second winding of the second effector. ### Claim 16 (depends on 12) The electronic control configuration of claim 12, wherein the device is a mechanically-controllable component of a vehicle or a building. ### Claim 17 A method of electronically controlling a device, comprising: controlling a device using a first primary control microprocessor, a first shaft, and a first effector; assuming protection control of the device using a first secondary microprocessor, the first shaft, and the first effector in response to the first primary control microprocessor experiencing a first type of failure; controlling the device using a second primary control microprocessor, a second shaft, and a second effector in response to the first primary control microprocessor experiencing a second type of failure; assuming protection control of the device using a second secondary microprocessor, the second shaft, and the second effector in response to the second primary control microprocessor experiencing the first type of failure; and assuming backup control of the device using one of the first secondary microprocessor and the second secondary microprocessor in response to the first primary control microprocessor and the second primary control microprocessor experiencing the second type of failure. ### Claim 18 (depends on 17) The method of claim 17, including: disabling a backup control feature of the second secondary microprocessor. ### Claim 19 (depends on 17) The method of claim 17, wherein the first type of failure is a failure in which a primary control is able to control the device but requires assistance from its corresponding secondary control to avoid damaging the device, and wherein the second type of failure is a failure in which a primary control is unable to control the device and relinquishes control of the device to either the other primary control or to its corresponding secondary control. ### Claim 20 (depends on 17) The method of claim 17, wherein said step of assuming backup control of the device is only performed in response to each of the first primary control microprocessor and the second primary control microprocessor experiencing the second type of failure, acknowledging the occurrence of their respective failure, and relinquishing control of the device.