Tttech Auto Ag

Fts Computertechnik Gmbh

Robert Boschgmbh

Tttech Computertechnik Ag

Eric Schmidt

Stefan Poledna

Georg Niedrist

Hermann Kopetz

Christopher Helpa

Stefan Traxler

Wilfried Steiner

Edwin Eberlein

Josef Newald

Bernd Illg

Ulrich Gerstung

Martin Hoefler

Carsten Weich

Felix Forster

Martin HÖFLER

A fault-tolerant computer system (FTCS) for generating safe trajectories for a vehicle. The FTCS includes: a sensor part (SENSE), a primary part (PRIM), a secondary part (SEC), a tertiary part (TER), and a decide part (DECIDE). The PRIM and TER are configured to produce trajectories by interpreting information of the real world as perceived by the SENSE. The SEC is configured to produce a safe space estimate (FSE) by interpreting information of the real world as perceived by SENSE. The DECIDE and/or SEC are configured to execute correctness checks that take trajectories and FSE as inputs, and qualify a trajectory (TRJ) as safe when said TRJ is inside the FSE, and qualify a trajectory (UTRJ) as unsafe when said UTRJ is not inside the FSE.

Fault-tolerant computer system for assisted and autonomous driving

A method for operating a controlled object that is embedded in a changing environment. The controlled object and its environment are periodically observed using sensors. Independent data flow paths ('DFP') are executed based on the data recorded through the observation of the controlled object and its environment. A first DFP determines a model of the controlled object and the environment of the controlled object and carries out a trajectory planning in order to create possible trajectories that, under the given environmental conditions, correspond to a specified task assignment. A second DFP determines a model of the controlled object and of the environment of the controlled object and determines a safe space-time domain ('SRZD') in which all safe trajectories must be located. The results of the first and the second DFP are transmitted to a deciding instance to verify whether at least one of the trajectories is safe.

Fault-tolerant method for operating an autonomous controlled object

A method for transmitting control commands in a computer system, which includes components at least in the form of nodes, actuators and communication systems, wherein the control commands are communicated over the communication systems from the nodes to the actuators, and wherein one or more of the components may fail to operate according their specification. For consistently accepting control commands at the actuators, the nodes and their control commands are assigned priorities, wherein a node and its control commands have the same priority, wherein at least two priorities are used, wherein a high priority node produces high priority control commands and a low priority node produces low priority control commands, and wherein a high priority node is configured to communicate its control commands over at least two communication systems to the actuators and a low priority node is configured to communicate its low priority control commands over at least one communication system to the actuators. An actuator accepts the high priority control commands from the high priority node as long as it receives said high priority control commands on any one of the communication systems, and in this first case, it discards the low priority control commands, and stops to accept said high priority control commands in case said actuator does not receive said high priority control commands from any of the communication systems for a configurable duration, and in the second case, the actuator starts to accept low priority control commands.

Method and computer system to consistently control a set of actuators

A method is provided by which a complex electronic system for controlling a safety-critical technical process, for example driving an autonomous vehicle, can be implemented. A distinction is made between simple and complex software, wherein the simple software is executed on error-tolerant hardware and wherein a plurality of diverse versions of the complex software are implemented simultaneously on independent fault containment units (FCU). A consolidated environmental model is developed from a number of different environmental models and represents the basis for trajectory planning.

Fault-tolerant method and device for controlling an autonomous technical system based on a consolidated model of the environment

The invention relates to a method for operating a controlled object, that is embedded in a changing environment, wherein the controlled object and its environment are periodically observed using sensors, and, in each frame, at least three independent data flow paths (DFPs) are executed based on the data recorded through the observation of the controlled object and its environment. A first DFP determines from the data collected through the observation of the controlled object and its environment via complex software a model of the controlled object and of the environment of the controlled object and conducts a trajectory planning, in order to create one or a plurality of possible trajectories, that, under the given environmental conditions, correspond to a specified task assignment; and a second DFP, from the data collected through the observation of the controlled object and its environment via preferably diversitary, complex software, determines a model of the controlled object and of the environment of the controlled object and specifies a safe space-time domain, SRZD, within which SRZD all safe trajectories must be located; a third DFP determines from the data collected through the observation of the controlled object and its environment a model of the controlled object and its environment and, based on this model, calculates an emergency trajectory, and wherein in normal operation a deciding instance verifies whether the emergency trajectory is located within the safe space-time domain (SRZD).

Fault-tolerant method for recognizing errors in an electronics system for operating a controlled object

An innovative method is provided by which a complex electronic system for controlling a safety-critical technical process, for example driving an autonomous vehicle, can be implemented. A decision is made between simple and complex software, wherein the simple software is implemented on error-tolerant hardware and wherein a plurality of different versions of the complex software are simultaneously implemented in independent fault containment units (FCU) and wherein a result that is to be transmitted to the actuators is selected by a decider from the results of the complex software that is implemented using the simple software.

Fault-tolerant method and device for controlling an autonomous technical system through diversified trajectory planning

A fault-tolerant high-performance computer system is provided for executing control processes for autonomous maneuvering of a vehicle.

Fault-tolerant high-performance computer system for autonomous vehicle maneuvering

A method for monitoring the short-circuiting switching device of a three-phase motor () for driving vehicles, which is fed from a DC voltage source () via a controlled converter (), wherein the short-circuiting switching device () actuated by a control logic () is connected to the inputs of the motor, and the motor currents and/or motor voltages are measured, and a predetermined test pattern, which is different from the voltage/current profiles during operation, is generated with the aid of the controlled converter () during a test phase and is supplied to the motor (), the short-circuiting switching device is actuated for the activation thereof, the current and/or voltage profile is detected during the test phase by opening and closing of short-circuiting contacts and, on the basis of the current and/or voltage distribution in the individual motor phases, the correct open-ing/closing of the short-circuiting contacts is detected and evaluated.

Method and apparatus for monitoring the short-circuiting switching device of a three-phase motor

A method for executing safety-relevant and non-safety-relevant software components on a hardware platform comprising a computer, memory and a monitoring component that operates independently of the computer. The safety-relevant software component erects a memory protection against access of a non-safety-relevant function to at least one area of the memory of the safety-relevant function before execution of the non-safety-relevant software component, so that the non-safety-relevant software component does not have access to the areas of the memory being used for safety-relevant components. After the return from the non-safety-relevant component, the memory protection is deactivated and the monitoring function monitors the safety-relevant function for its proper operation.

Growing community of inventors

Grosskrut, Austria

Eric Schmidt