Tttech Auto Ag

Tttech Computertechnik Ag

Fts Computertechnik Gmbh

Honeywell International Inc.

Titech Auto Ag

Fault Tolerant Systems Fts-computertechnik Ges.m.b.

Ittech Computertechnik Aktiengesellschaft

Tttech Industrial Automation Ag

Hermann Kopetz

Stefan Poledna

Eric Schmidt

Georg Niedrist

Christopher Helpa

Wilfried Steiner

Günther Bauer

Brendan Hall

Michael Paulitsch

Matthias Wachter

Martin Schwarz

Martin Hoefler

Stefan Traxler

Mehmed Ayhan

Martin Glück

Andreas Wolf

Matthias Wächter

The invention relates to a real-time computer system for controlling a technical device, the real-time computer system comprising data acquisition components which are independent of each other, as well as non-secure data processing components for processing sensor data. A time server as well as a first communication system and a second communication system independent of it are provided, the time server periodically sending global time signals to the communication systems. Each data acquisition component has two communication controllers, wherein each data acquisition component is connected by two communication controllers via a communication line to the first communication system, and is connected by another communication controller to the second communication system via a communication line, such that each data acquisition component can transmit its sensor data to each of the two communication systems.

Real-time computer system and method for controlling a system or a vehicle

The architecture includes four largely independent subsystems which are arranged hierarchically and each form an isolated Fault-Containment Unit (FCU). At the top of the hierarchy is a secure subsystem, the Fault-Tolerant Decision Subsystem, which executes simple software on fault-tolerant hardware. The other three subsystems are insecure because they contain complex software executed on non-fault-tolerant hardware. Experience has shown that it is difficult to find all design errors in a complex software system and to prevent an intrusion. The redundancy and diversity inherent in this architecture masks every error&#x2014;even a Byzantine error&#x2014;of an insecure subsystem in such a way that no safety-critical failure can occur.

Method for controlling a technical apparatus

The invention is part of the field of computer technology. It describes the architecture of a secure automation system and a method for safe autonomous operation of a technical apparatus, in particular a motor vehicle. The architecture disclosed herein solves the problem that any Byzantine error in one of the complex subsystems of a distributed real-time computer system, regardless of whether the error was triggered by a random hardware failure, a design error in the software or an intrusion, must be recognized and controlled in such a way that no security-relevant incident occurs. The architecture includes four largely independent subsystems which are arranged hierarchically and each form an isolated Fault-Containment Unit (FCU). At the top of the hierarchy is a secure subsystem, which executes simple software on fault-tolerant hardware. The other three subsystems are insecure because they contain complex software executed on non-fault-tolerant hardware.

Method for controlling and automatically restarting a technical apparatus

The invention relates to a method for providing a fault-tolerant global time via a time server in a distributed real-time computer system, wherein the time server comprises four components which are connected to one another via a bi-directional communication channel. At a priori defined periodic, internal synchronization times, each of the four components transmits an internal synchronization message, which is simultaneously transmitted to the other three components, from which each internal computer of a component determines a correction term for the tick counter contained in its component and corrects the reading of the local tick counter by this correction term.

Fault-tolerant time server for a real-time computer sytem

The invention relates to a method for providing a fault-tolerant global time and for the fault-tolerant transport of time-controlled messages in a distributed real-time computer system which comprises external computers and a fault-tolerant message distribution unit, FTMDU. The FTMDU comprises at least four components which supply the global time to the external computers by means of periodic external synchronization messages, wherein the external computers each set their local clock to the received global time, wherein each external sender of a time-controlled message transmits two message copies of the message to be sent via two different communication channels to two different components of the FTMDU at periodic sending times defined a priori in timetables, wherein these two message copies are delivered within the FTMDU via two independent communication paths to those two components of the FTMDU which are connected to an external receiver of the message via communication channels.

Fault-tolerant distribution unit and method for providing fault-tolerant global time

A distributed maintainable real-time computer system is provided, wherein the real-time computer system includes at least two central computers and one, two or a plurality of peripheral computers. The central computers have access to a sparse global time, have identical hardware and identical software, but different startup data, wherein each functional central computer periodically sends time-triggered multi-cast life-sign messages to the other central computers according to a time plan a priori defined in its startup data, and wherein the peripheral computers () can exchange messages () with the central computers (), and wherein at all times one central computer is in the active state and the other central computers are in the non-active state, and wherein after the apparent absence of a life-sign message of the active central computer expected at a planned reception time, that non-active functioning central computer which has the shortest start-up timeout takes over the function of the active central computer, and wherein each central computer () consists of three independent subsystems, an application computer (), a storage medium having the startup data () characteristic of the central computer () and an internal monitor (), wherein the internal monitor () periodically checks the correct functioning of the application computer (), and wherein upon detection of an error the monitor () initiates a hardware reset and a restart of the application computer (), and wherein preferably the active central computer initiates a maintenance action after an apparent absence of the life-sign messages expected at the planned reception times from a non-active central computer, which action can lead to the repair or replacement of a permanently failed central computer.

Maintainable distributed fail-safe real-time computer system

A method and a fault-tolerant computer architecture (FCTA) for fail-safe trajectory planning for a moving entity (MOV). The method and FCTA uses a commander (COM), a monitor (MON), and a safe envelope generating stage (ENV). Based on sensor input, the commander (COM) and the monitor (MON) produce real-time images of objects (OBJ, OBJ) detected. A trajectory planning stage (TRJ-PLN) generates trajectories (COM-TRJ, COM-TRJ), and the safe envelope generating stage (ENV) generates a safety envelope. The commander (COM) provides the one or more trajectories (COM-TRJ, COM-TRJ) to the monitor (MON) and the decision subsystem (DECIDE). A trajectory verification stage (TRJ-VRFY) verifies a trajectory (COM-TRJ, COM-TRJ) generated by the commander (COM) only if said trajectory (COM-TRJ, COM-TRJ) is completely located inside said safety envelope. A moving entity (MOV) uses a trajectory (COM-TRJ, COM-TRJ) generated by the commander (COM) only when said trajectory is verified by the monitor (MON).

Method and fault tolerant computer architecture for reducing false negatives in fail-safe trajectory planning for a moving entity

A fault-tolerant computer system (FTCS) for generating safe trajectories for a vehicle. The FTCS includes: a sensor part (SENSE), a primary part (PRIM), a secondary part (SEC), a tertiary part (TER), and a decide part (DECIDE). The PRIM and TER are configured to produce trajectories by interpreting information of the real world as perceived by the SENSE. The SEC is configured to produce a safe space estimate (FSE) by interpreting information of the real world as perceived by SENSE. The DECIDE and/or SEC are configured to execute correctness checks that take trajectories and FSE as inputs, and qualify a trajectory (TRJ) as safe when said TRJ is inside the FSE, and qualify a trajectory (UTRJ) as unsafe when said UTRJ is not inside the FSE.

Fault-tolerant computer system for assisted and autonomous driving

A method for operating a controlled object that is embedded in a changing environment. The controlled object and its environment are periodically observed using sensors. Independent data flow paths ('DFP') are executed based on the data recorded through the observation of the controlled object and its environment. A first DFP determines a model of the controlled object and the environment of the controlled object and carries out a trajectory planning in order to create possible trajectories that, under the given environmental conditions, correspond to a specified task assignment. A second DFP determines a model of the controlled object and of the environment of the controlled object and determines a safe space-time domain ('SRZD') in which all safe trajectories must be located. The results of the first and the second DFP are transmitted to a deciding instance to verify whether at least one of the trajectories is safe.

Fault-tolerant method for operating an autonomous controlled object

A method for a determination of the optimal duration of a time slot for computational actions in a time-triggered controller. The controller includes a sensor subsystem, a computational subsystem, an actuator subsystem, and a time-triggered communication system. The time-triggered communication system is placed between the sensor subsystem, the computational subsystem, the actuator subsystem, and a monitor subsystem. An anytime algorithms is executed in the computational subsystem. A plurality of execution slot durations of the anytime algorithms is probed during the development phase, starting from the minimum execution slot duration, increasing this slot duration by the execution slot granularity until the maximum execution slot duration is reached. In each of the execution slot durations, a multitude of frames is executed in a destined application environment. In each frame the computational subsystem calculates imprecise anticipated values of observable state variables by interrupting execution of the anytime algorithm at the end of the provided execution slot duration, using data received from the sensor subsystems at the beginning of the frame.

Method and apparatus for determination of slot-duration in time-triggered control system

The invention relates to a method for detecting faults that occur or are present in an operating system of a computer, wherein an in particular independent audit task () is carried out during the run time before a starting time () of the requested application task (), wherein the control registers define the properties of the run time environment of the requested application task () and have reading access to the contents and validate these contents. Furthermore, the invention relates to a computer, on which such a method is carried out.

Method for fault detection in an operating system

The invention relates to a device for integrating software components of a distributed real-time software system, said components being run on target hardware and on a development system, wherein the target hardware comprises computing nodes, and the development system comprises one or more computers. The device is designed as an expanded development system in which the computing nodes of the target hardware are connected to the computers of the development system via one or more time-controlled distributor units, wherein the expanded development system has a sparse global time of known precision, and wherein the computing nodes of the target hardware are connected to the computers of the development system via the one or more time-controlled distributor units such that the data content of a TT message template of a TT platform of the target hardware can be provided both by a simulation process of the development system as well as by an operative process of the target hardware in a timely manner.

Device and method for integrating software components into a distributed time-controlled real-time system

The invention relates to a method for debugging software components of a distributed real-time software system, wherein the target hardware comprises computer nodes and the development system comprises one or more computers. According to the invention, an enhanced development system is formed, in which enhanced development system the computer nodes of the target hardware are connected to the computers of the development system via one or more time-controlled distributer units, wherein the enhanced development system has a sparse global time of known precision, wherein the computer nodes of the target hardware exchange messages with the computers of the development system via one or more distributer units, and wherein, in a frame, a software component on the target hardware and, temporally parallel thereto, a software component in the development system are supplied with the same input data and executed, wherein the activation signals are triggered at the start of the two executions of the software component in the same space tick of the global time, and wherein the software component executed in the development system is enhanced in such a way that, during its execution, selected intermediate results are written on an external data memory.

Method for debugging software components in a distributed, time-controlled real time system

A method is provided by which a complex electronic system for controlling a safety-critical technical process, for example driving an autonomous vehicle, can be implemented. A distinction is made between simple and complex software, wherein the simple software is executed on error-tolerant hardware and wherein a plurality of diverse versions of the complex software are implemented simultaneously on independent fault containment units (FCU). A consolidated environmental model is developed from a number of different environmental models and represents the basis for trajectory planning.

Fault-tolerant method and device for controlling an autonomous technical system based on a consolidated model of the environment

The invention relates to a method, in particular a time controlled error-tolerant method, for periodically transporting real-time data in a computer system, in particular in a distributed computer system, said computer system comprising node computers (-), in particular a plurality of node computers (-), and distributor units (), in particular a plurality of distributor units (). The node computers and the distributor units have access to a global time, and real-time data is transported by means of messages, preferably by means of time-controlled real-time messages. The topology of the computer system corresponds to an intree, and node computers (-), are arranged on the leaves of the intree. One or more sensors (-) is assigned to each node computer (-), and the node computers (-) arranged on the leaves of the intree transmit sensor data in the payload of messages in the direction of a control center () located at the root of the intree at points in time, preferably at synchronized points in time. The payload of one or more incoming messages in a distributor unit is transported out of the distributor unit with an outgoing message, and an individual time plan is generated a priori for each distributor unit, wherein the time plan contains a periodically repeating starting time () for transmitting a message () going out of the respective distributor unit, said starting time being calculated a priori from&#x2014;the a priori known time of arrival of a controlling payload to be transported, which is specified a priori for example, of one of the incoming messages, in particular a time-critical payload to be transported of one of the incoming messages, &#x2014;minus the a priori known lead-time interval ([]) of the outgoing message (), &#x2014;plus at least one time interval ()] required to copy a data element of the controlling payload, in particular the time-critical payload of the incoming message (), into a data element of the payload of the outgoing message (); and the payloads of the incoming messages are copied into the payload of the outgoing message by carrying out the a priori generated time plan.

Growing community of inventors

Baden, Austria

Hermann Kopetz