Fts Computertechnik Gmbh

Tttech Auto Ag

Tttech Computertechnik Ag

Robert Boschgmbh

Honeywell International Inc.

Tttech Industrial Automation Ag

Stefan Poledna

Hermann Kopetz

Eric Schmidt

Georg Niedrist

Christopher Helpa

Wilfried Steiner

Guenther Bauer

Ulrich Gerstung

Martin Schwarz

Felix Forster

Martin Hoefler

Wolf Wessel

Brendan Hall

Michael Paulitsch

Joachim Berger

Edwin Eberlein

Dieter Seher

Martin Grosser

Josef Newald

Michael Kirschner

Bernd Illg

Harald Angelow

Karl-Heinz Schmidt

Stefan Traxler

Carsten Weich

Dieter Hall

Salvador Rodriguez Lopez

Wolfgang Dittrich

Wilfred Steiner

Martin Glück

Andreas Wolf

Bernhard Leiner

Werner Zimmerman

Wolfgang Bittinger

Martin HÖFLER

A method and system to generate safe control data to control and/or to supervise a local machine, wherein a local software application is executed on a safe hardware device and executes calculations based input data to generate said safe control data, wherein a software application is executed on a hardware external to the safe device and sends a request to the cloud application to execute one or more defined calculations and said specific input data, which is to be used by the at least one cloud application for the execution of the one or more defined calculations, wherein the control data is determined to be safe or unsafe, and wherein if the control data are not received timely they will not be used to control and/or supervise the local machine.

Method to generate safe control data for a local machine

The invention relates to a real-time computer system for controlling a technical device, the real-time computer system comprising data acquisition components which are independent of each other, as well as non-secure data processing components for processing sensor data. A time server as well as a first communication system and a second communication system independent of it are provided, the time server periodically sending global time signals to the communication systems. Each data acquisition component has two communication controllers, wherein each data acquisition component is connected by two communication controllers via a communication line to the first communication system, and is connected by another communication controller to the second communication system via a communication line, such that each data acquisition component can transmit its sensor data to each of the two communication systems.

Real-time computer system and method for controlling a system or a vehicle

A method for integrating infrastructure software functions and automotive applications on an automotive electronic control unit (ECU) device. The ECU device includes a hardware architecture and a software architecture, wherein the hardware architecture includes two or more system-on-chips, at least two of which each comprise two or more processing cores and means to communicate with at least one other system-on-chip. The hardware architecture includes memory and means to communicate with other ECU devices. The software architecture includes one, two, or more virtual machine monitors, each of which executes one, two, or more virtual machines. At least two of said virtual machines each execute an operating system, which executes one, two, or more tasks, and the execution of two or more of the tasks uses the time-triggered paradigm. The tasks are tasks of automotive applications from at least two different automotive domains and are tasks of infrastructure software functions.

Method, device, and real-time network for highly integrated automotive systems

A method to generate configuration data to enable and/or to enhance real-time communication in a cyber-physical system or in a cyber-physical system of systems. The system includes components connected to each other by a communication infrastructure. The components each execute at least one application, which applications exchange information with at least one application being executed on another component. The components are configured to send and/or receive said information according to configuration data: The first configuration data for two or more of the components, on each of which at least one application is executed, is generated by execution of a publish-subscribe protocol, which is executed by two or more of the components, for which the first configuration data are provided. The first configuration data is used as input to a process that produces second configuration data, wherein (i) first and second configuration data are not equal, and (ii) the two or more components, on each of which at least one application is executed, use said second configuration data as configuration data for their real-time communication.

Configuration synthesis utilizing information extraction from service oriented architectures

A method to maneuver a supervised vehicle based on an output of a software in development, wherein the software in development is part of an ASIL-classified function, and the software in development has not completed a software development process for ASIL classification of the ASIL-classified function. A safe device includes a safety monitor, wherein the safety monitor is implemented according to specific software development requirements, which are requirements for the ASIL classification of the ASIL-classified function. The safety monitor (i) monitors the output of the software in development, and (ii) classifies the output as either safe or unsafe, wherein the safe device executes a safety mechanism if the safety monitor classifies the output as unsafe, wherein the safety mechanism causes the supervised vehicle not to maneuver in accordance with the output, and if the safety monitor classifies the output as safe, the supervised vehicle is maneuvered based on the output.

Safety monitor for advanced driver assistance systems

A fault-tolerant computer system (FTCS) for generating safe trajectories for a vehicle. The FTCS includes: a sensor part (SENSE), a primary part (PRIM), a secondary part (SEC), a tertiary part (TER), and a decide part (DECIDE). The PRIM and TER are configured to produce trajectories by interpreting information of the real world as perceived by the SENSE. The SEC is configured to produce a safe space estimate (FSE) by interpreting information of the real world as perceived by SENSE. The DECIDE and/or SEC are configured to execute correctness checks that take trajectories and FSE as inputs, and qualify a trajectory (TRJ) as safe when said TRJ is inside the FSE, and qualify a trajectory (UTRJ) as unsafe when said UTRJ is not inside the FSE.

Fault-tolerant computer system for assisted and autonomous driving

A method for operating a controlled object that is embedded in a changing environment. The controlled object and its environment are periodically observed using sensors. Independent data flow paths ('DFP') are executed based on the data recorded through the observation of the controlled object and its environment. A first DFP determines a model of the controlled object and the environment of the controlled object and carries out a trajectory planning in order to create possible trajectories that, under the given environmental conditions, correspond to a specified task assignment. A second DFP determines a model of the controlled object and of the environment of the controlled object and determines a safe space-time domain ('SRZD') in which all safe trajectories must be located. The results of the first and the second DFP are transmitted to a deciding instance to verify whether at least one of the trajectories is safe.

Fault-tolerant method for operating an autonomous controlled object

The invention relates to a method for detecting faults that occur or are present in an operating system of a computer, wherein an in particular independent audit task () is carried out during the run time before a starting time () of the requested application task (), wherein the control registers define the properties of the run time environment of the requested application task () and have reading access to the contents and validate these contents. Furthermore, the invention relates to a computer, on which such a method is carried out.

Method for fault detection in an operating system

The invention relates to a device for integrating software components of a distributed real-time software system, said components being run on target hardware and on a development system, wherein the target hardware comprises computing nodes, and the development system comprises one or more computers. The device is designed as an expanded development system in which the computing nodes of the target hardware are connected to the computers of the development system via one or more time-controlled distributor units, wherein the expanded development system has a sparse global time of known precision, and wherein the computing nodes of the target hardware are connected to the computers of the development system via the one or more time-controlled distributor units such that the data content of a TT message template of a TT platform of the target hardware can be provided both by a simulation process of the development system as well as by an operative process of the target hardware in a timely manner.

Device and method for integrating software components into a distributed time-controlled real-time system

The invention relates to a method for debugging software components of a distributed real-time software system, wherein the target hardware comprises computer nodes and the development system comprises one or more computers. According to the invention, an enhanced development system is formed, in which enhanced development system the computer nodes of the target hardware are connected to the computers of the development system via one or more time-controlled distributer units, wherein the enhanced development system has a sparse global time of known precision, wherein the computer nodes of the target hardware exchange messages with the computers of the development system via one or more distributer units, and wherein, in a frame, a software component on the target hardware and, temporally parallel thereto, a software component in the development system are supplied with the same input data and executed, wherein the activation signals are triggered at the start of the two executions of the software component in the same space tick of the global time, and wherein the software component executed in the development system is enhanced in such a way that, during its execution, selected intermediate results are written on an external data memory.

Method for debugging software components in a distributed, time-controlled real time system

A method is provided by which a complex electronic system for controlling a safety-critical technical process, for example driving an autonomous vehicle, can be implemented. A distinction is made between simple and complex software, wherein the simple software is executed on error-tolerant hardware and wherein a plurality of diverse versions of the complex software are implemented simultaneously on independent fault containment units (FCU). A consolidated environmental model is developed from a number of different environmental models and represents the basis for trajectory planning.

Fault-tolerant method and device for controlling an autonomous technical system based on a consolidated model of the environment

The invention relates to a method, in particular a time controlled error-tolerant method, for periodically transporting real-time data in a computer system, in particular in a distributed computer system, said computer system comprising node computers (-), in particular a plurality of node computers (-), and distributor units (), in particular a plurality of distributor units (). The node computers and the distributor units have access to a global time, and real-time data is transported by means of messages, preferably by means of time-controlled real-time messages. The topology of the computer system corresponds to an intree, and node computers (-), are arranged on the leaves of the intree. One or more sensors (-) is assigned to each node computer (-), and the node computers (-) arranged on the leaves of the intree transmit sensor data in the payload of messages in the direction of a control center () located at the root of the intree at points in time, preferably at synchronized points in time. The payload of one or more incoming messages in a distributor unit is transported out of the distributor unit with an outgoing message, and an individual time plan is generated a priori for each distributor unit, wherein the time plan contains a periodically repeating starting time () for transmitting a message () going out of the respective distributor unit, said starting time being calculated a priori from&#x2014;the a priori known time of arrival of a controlling payload to be transported, which is specified a priori for example, of one of the incoming messages, in particular a time-critical payload to be transported of one of the incoming messages, &#x2014;minus the a priori known lead-time interval ([]) of the outgoing message (), &#x2014;plus at least one time interval ()] required to copy a data element of the controlling payload, in particular the time-critical payload of the incoming message (), into a data element of the payload of the outgoing message (); and the payloads of the incoming messages are copied into the payload of the outgoing message by carrying out the a priori generated time plan.

Method and computer system for quickly transmitting time-controlled real-time messages

The invention relates to a method for operating a controlled object, that is embedded in a changing environment, wherein the controlled object and its environment are periodically observed using sensors, and, in each frame, at least three independent data flow paths (DFPs) are executed based on the data recorded through the observation of the controlled object and its environment. A first DFP determines from the data collected through the observation of the controlled object and its environment via complex software a model of the controlled object and of the environment of the controlled object and conducts a trajectory planning, in order to create one or a plurality of possible trajectories, that, under the given environmental conditions, correspond to a specified task assignment; and a second DFP, from the data collected through the observation of the controlled object and its environment via preferably diversitary, complex software, determines a model of the controlled object and of the environment of the controlled object and specifies a safe space-time domain, SRZD, within which SRZD all safe trajectories must be located; a third DFP determines from the data collected through the observation of the controlled object and its environment a model of the controlled object and its environment and, based on this model, calculates an emergency trajectory, and wherein in normal operation a deciding instance verifies whether the emergency trajectory is located within the safe space-time domain (SRZD).

Fault-tolerant method for recognizing errors in an electronics system for operating a controlled object

The invention relates to a method for forcing fail-silent behavior of a periodically functioning, distributed real-time computer system, which real-time computer system comprises at least two redundant NSCFCUs. At the beginning of a frame, the at least two redundant NSCFCUs () are supplied with the same input data, wherein each of the redundant NSCFCUs calculates a result, preferably by means of a deterministic algorithm, particularly from the input data, and wherein this result is packed into a CSDP with an end-to-end signature, and wherein the CSDPs of the NSCFCUs () are transmitted to an SCFCU (), and wherein the SCFCU () checks whether the bit patterns of the received CSDPs are identical, and, if disparity of the bit patterns is found, prevents further transmission of the CSDPs, particularly those CSDPs in which disparity was found. Furthermore, the invention relates to a periodically functioning, distributed real-time computer system.

Distributed real-time computer system and method for forcing fail-silent behavior of a distributed real-time computer system

The invention relates to a method for periodic transmission of real time data in a computer system, particularly a distributed computer system, which computer system is comprised of node computers (-), particularly an appreciable number of node computers (-), and distributor units (-), particularly an appreciable number of distributor units (-), wherein the node computers (-) and the distributor units (-) have access to a global time, and wherein real time data are transmitted by means of time-triggered real time messages, wherein selected distributor units () form a central structure of distributor units; and wherein during a periodic communication round (PCR), in the error-free case, at least two copies of each real time message to be sent are transmitted via at least two independent routes through the central structure, by executing a satisfying or an optimal time plan, from a start distributor unit in the central structure to a target distributor unit in the central structure; such that in the error case, error handling can begin immediately after an error detection time point contained in the time plan, preferably in the optimal time plan.

Growing community of inventors

Klosterneuburg, Austria

Stefan Poledna