Redundant steering actuators should be selected on the basis of the steering capability that remains after a fault. Two motors, two controllers, or two power inputs can improve fault tolerance, but their value depends on whether a failure can be contained and whether the surviving path can still control the vehicle within defined limits. For quality and safety teams, the decisive evidence is a demonstrated connection between the fault, the system response, and the vehicle behavior that follows.

A credible evaluation therefore starts with a vehicle-level requirement: what steering performance must remain available, for how long, and under which operating conditions? An architecture that supports a controlled stop may be suitable for one application but insufficient for another that requires continued operation. Until that distinction is settled, comparing actuator redundancy by hardware count or nominal output provides little basis for selection.

Define the required behavior after failure before comparing hardware. In a steer-by-wire system without a mechanical connection between the steering wheel and road wheels, a failure of the road-wheel actuation path requires an explicit response. The steering-wheel feedback actuator and the road-wheel actuator also serve different functions. Preserving steering feel does not establish that road-wheel control remains available, so specifications and safety reviews should identify which function each redundant element supports.

The requirement should describe more than whether the wheels can still move. Relevant measures include available rack force or steering torque, achievable steering rate, position-control accuracy, response delay, and the duration of operation after the fault. Their acceptable limits depend on vehicle speed, axle load, tire characteristics, road conditions, and the maneuver needed to reach an acceptable state. A single statement such as “reduced steering assistance available” leaves too much unresolved.

Low-speed maneuvering and higher-speed directional control can place different demands on the surviving actuator path. Parking may require substantial force, while a rapid correction can make response time and steering rate particularly important. Teams should establish the operating envelope for each required degraded mode rather than assume that passing the highest-load condition proves acceptable performance everywhere else.

The driver’s role also needs definition. A warning and a request to stop can form part of the response, but they do not replace the steering authority needed during recognition and reaction. Where an automated driving function is involved, responsibility for maintaining control and initiating the fallback maneuver must be assigned across the steering system and vehicle controller. The actuator supplier cannot establish that outcome independently of vehicle integration.

Trace the complete actuation paths and expose their shared elements. A useful architecture review follows the command from its source through communications, control electronics, power conversion, motor, transmission, and rack or steering linkage. It then follows the feedback signals and electrical supplies in the opposite direction. Each path should show what remains functional when another element fails, including the mechanisms used to detect and isolate that failure.

Two motor windings supplied by separate inverters may provide useful electrical redundancy while sharing a rotor, housing, bearing arrangement, and mechanical output. Two separate motors can still converge through a common transmission or rack. These arrangements are not interchangeable. They create different opportunities for fault containment and different exposures to mechanical seizure, unwanted torque, thermal interaction, or a common environmental event.

Mechanical resistance deserves particular attention. If a failed motor or transmission remains coupled to the steering mechanism, the healthy channel may have to overcome its drag. A seized shared component may prevent movement altogether. Where a design uses a disconnect device, reviewers should examine its engagement conditions, response time, diagnostic coverage, and failure behavior. The safety argument should explain which mechanical failures are accommodated and how other credible failures are addressed.

Electrical separation requires similar scrutiny. Two supply pins do not establish independent power availability if both depend on the same fuse, connector, ground connection, upstream converter, or vulnerable harness route. Separate controllers may share a regulator, clock source, reset mechanism, or thermal environment. A common enclosure may expose both channels to water ingress or excessive temperature. Physical and functional boundaries must support the claimed independence.

At this stage, an architecture diagram is useful only if it shows shared dependencies as clearly as duplicated equipment. It should identify where faults can propagate, where isolation occurs, and which resources the surviving channel needs. This gives quality and safety reviewers a practical way to challenge a redundancy claim before detailed performance comparisons begin.

Sensing and communications can undermine otherwise capable actuator hardware. Duplicate position sensors may share a target, supply, connector, or processing chain. A disagreement between two readings can reveal a problem without identifying the trustworthy signal. Evaluation should establish how the system checks plausibility, handles uncertain feedback, and prevents an erroneous measurement from driving both channels toward an unsafe command.

The same reasoning applies to command delivery. Redundant communication links offer limited protection if a common controller generates an incorrect command or both links depend on one gateway. Reviewers should distinguish loss of communication, delayed or stale information, and validly transmitted but incorrect data. Each can require a different response. The actuator’s local behavior during communication loss must also be compatible with the vehicle’s fallback strategy.

Assess the transition into degraded operation, not just the capacity afterward. A supplier may demonstrate that either channel can steer alone, yet the interval between fault occurrence and stable single-channel control can still determine acceptability. Detection, decision, isolation, and control reconfiguration all consume time. During that interval, the system may experience missing torque, opposing torque, a steering disturbance, or a temporary reduction in control accuracy.

The allowable interval should come from the vehicle safety analysis and operating conditions. A diagnostic response that is adequate in one maneuver may be too slow in another. Evidence should cover both the time taken to respond and the resulting road-wheel behavior. An internal fault flag with a short timestamp is insufficient if the faulty power stage continues producing torque or the mechanical system remains disturbed after detection.

Fault isolation must also work against the failure being considered. Disabling a command does not necessarily stop current through a damaged power device. Opening an isolation element introduces its own electrical and mechanical behavior. In systems where both channels contribute during normal operation, loss of one channel changes load sharing and thermal conditions. The remaining channel must accept that change without exceeding its available capability or triggering a secondary shutdown.

Residual performance should be assessed using the electrical supply and temperature available after the fault. A healthy channel may already be hot from normal duty, while the initiating fault may have reduced supply voltage or affected cooling. The relevant result is the performance sustainable throughout the required fallback period, including any thermal derating. A brief peak-output demonstration cannot establish that duration.

For component selection, request a defined degraded-operation envelope. It should connect output capability to supply voltage, temperature, operating duration, and relevant loading conditions, with assumptions made explicit. Vehicle integration then needs to establish that speed restrictions, maneuver limits, or other fallback actions keep demand inside that envelope. If the vehicle cannot reliably enforce those restrictions, they cannot carry the safety argument.

Require validation that connects faults to vehicle consequences. A useful supplier evidence package links safety requirements, architecture assumptions, failure analysis, diagnostic behavior, and verification results. Its purpose is to make the claimed behavior traceable. Reviewers should be able to select a fault and follow the reasoning through detection and isolation to the steering performance that remains, including any conditions under which that claim no longer applies.

Fault-injection coverage should reflect the architecture’s vulnerabilities. Relevant cases may include an open circuit, short circuit, sensor bias or freeze, corrupted feedback, interrupted communications, controller reset, and loss of an electrical supply. Mechanical loading and faults that cause resisting or unintended torque need appropriate representation. Testing only clean channel shutdowns can leave important questions about partial failures and interacting channels unanswered.

The timing and conditions of injection matter as much as the fault list. A fault introduced at standstill with a cool actuator and nominal supply cannot represent every required maneuver. Validation should examine demanding points in the intended operating envelope, such as load reversals, sustained steering demand, supply disturbances, and thermal limits. Existing faults also deserve attention: an undetected failure in a standby path can remove the protection expected when the active path subsequently fails.

Bench testing, simulation, hardware-in-the-loop testing, and vehicle testing provide different evidence. Controlled environments help repeat faults and examine internal behavior; vehicle-level work establishes how disturbances affect directional control and driver or automated-system response. The validation plan should explain how these methods connect, including how simulated faults represent physical failure behavior. No single method should be credited with proving effects it cannot adequately reproduce.

Production quality then determines whether the assessed design is delivered consistently. Safety-relevant characteristics may include winding isolation, sensor alignment, connector integrity, sealing, fastening, and the correct hardware-software configuration. End-of-line testing should be evaluated against the faults it can actually detect. A unit that functions normally may still contain a defect that compromises channel independence or remains hidden until degraded operation is needed.

Supplier assessment should therefore examine traceability and change control alongside test results. Changes to power electronics, motor materials, sensing, software, manufacturing processes, or sub-suppliers can affect fault response without changing the actuator’s advertised rating. The review process needs clear triggers for reassessing safety assumptions and repeating relevant validation. Service diagnostics and replacement procedures should likewise preserve the configuration and redundancy on which the vehicle’s safety case depends.

A practical selection decision can be organized around four questions:

• Does the surviving actuation path deliver the required steering performance throughout the specified fallback period?
• Can credible faults be detected and contained before their vehicle effects become unacceptable?
• Are shared electrical, sensing, communication, software, and mechanical dependencies explicitly addressed?
• Does the evidence cover the intended vehicle integration, production configuration, and operating conditions?

An actuator with lower nominal output may be the stronger candidate if its residual capability, isolation behavior, and validation are better matched to the vehicle requirement. Conversely, a high-output dual-channel design may remain unsuitable when a shared dependency defeats both channels. Selection should remain conditional wherever the supporting evidence depends on an unproven vehicle assumption. Before release, that assumption needs an owner, a verification method, and a result that demonstrates the required steering behavior.