Abstract: In embodiments of an autonomous vehicle platform and safety architecture, safety managers of a safety-critical system monitor outputs of linked components of the safety-critical system. The linked components comprise at least three components, each of which is configured to produce output indicative of a same event independent from the other linked components by using different input information than the other linked components. The safety managers also compare the outputs of the linked components to determine whether each output indicates the occurrence of a same event. When the output of one linked component does not indicate the occurrence of an event that is indicated by the outputs of the other linked components, the safety managers identify the one linked component as having failed. Based on this, the outputs of the other linked components are used to carry out operations of the safety-critical system without using the output of the failed component.

Abstract: In embodiments of an autonomous vehicle interface system, system nodes are each implemented as a distributed node for independent data processing of low-level sensor data and/or high-level system data. The high-level system data is abstracted from the low-level sensor data, providing invariance to system configuration in higher-level processing algorithms. The autonomous vehicle interface system includes at least one real-time bus for data communications of the low-level sensor data and the high-level system data between the system nodes. The system also includes an application programming interface (API) configured for access by the system nodes to the low-level sensor data and the high-level system data that is published on the real-time bus and accessible via the API.

Abstract: In embodiments of an autonomous vehicle platform and safety architecture, safety managers of a safety-critical system monitor outputs of linked components of the safety-critical system. The linked components comprise at least three components, each of which is configured to produce output indicative of a same event independent from the other linked components by using different input information than the other linked components. The safety managers also compare the outputs of the linked components to determine whether each output indicates the occurrence of a same event. When the output of one linked component does not indicate the occurrence of an event that is indicated by the outputs of the other linked components, the safety managers identify the one linked component as having failed. Based on this, the outputs of the other linked components are used to carry out operations of the safety-critical system without using the output of the failed component.