Abstract: An error detection test device for a subscriber station of a serial bus system. The error detection test device has an evaluation module for evaluating which bit of a signal must be interrupted so that the receivers of the resulting signal in which the at least one bit is interrupted can check the function of an error detection mechanism, the signal being processed by a protocol control unit while the subscriber station is in operation in order to be able to be transmitted as a frame onto a bus of the bus system or, after a frame has been received from the bus, to decode the signal from the frame, and an output terminal for outputting a switching signal to the protocol control unit to interrupt the at least one bit. The evaluation module generates the switching signal based on the at least one bit evaluated by the evaluation module.

Abstract: A method for generating an output data stream from an input data stream, a processing unit receives a first input data stream including a first data set, and this processing unit receives, from a further processing unit, a second set of metadata, which describes a second data set of a second input data stream of this further processing unit, the processing unit outputs or does not output, as a function of the second set of metadata, an output data set of the output data stream generated from the first data set.

Abstract: A method for protecting data integrity through an embedded system having a main processor core and a security hardware module. The method includes the following: the main processor core generates transmit data, the security hardware module calculates a transmit message authentication code from the transmit data, the main processor core links the transmit data and the transmit message authentication code to form a transmit message, and the main processor core transmits the transmit message to a receiver.

Abstract: A method for the coexistence of software having different safety levels in a multicore processor which has at least two processor cores (2, 3). A memory range (4, 5) is associated with each processor core (2, 3) and a plurality of software (SW1, SW2) is processed on one of the processor cores (2, 3) having a predefined safety level. The plurality of software (SW1, SW2) is processed having a predefined safety level only on the processor core (2, 3) with which the same safety level is associated, in which during the processing of the plurality of software (SW1, SW2), the processor core (2, 3) accesses only the protected memory range (4, 5) which is permanently associated with this processor core (2, 3).

Abstract: A coupling device for coupling a software component, which transmits a setting command for setting an actuator on a control system of a motor vehicle, to the control system, the coupling device including a monitoring unit, which is designed to carry out an assessment for each setting command as to whether its implementation will transfer the motor vehicle into a dangerous state, the coupling device being further designed to transmit, as a function of this assessment, a monitored setting command corresponding to the setting command to an implementation unit, the implementation unit being designed to control the actuator.

Abstract: A communication module for controlling a motor vehicle, which is configured for receiving vehicle-independent commands and converting these received commands into a target trajectory of the motor vehicle, and transmitting this target trajectory to an implementation module which is configured for associating a sequence of control commands for components of the motor vehicle with this transmitted target trajectory.

Abstract: A method for protecting data integrity through an embedded system having a main processor core and a security hardware module. The method includes the following: the main processor core generates transmit data, the security hardware module calculates a transmit message authentication code from the transmit data, the main processor core links the transmit data and the transmit message authentication code to form a transmit message, and the main processor core transmits the transmit message to a receiver.

Abstract: A method for generating an output data stream from an input data stream, a processing unit receives a first input data stream including a first data set, and this processing unit receives, from a further processing unit, a second set of metadata, which describes a second data set of a second input data stream of this further processing unit, the processing unit outputs or does not output, as a function of the second set of metadata, an output data set of the output data stream generated from the first data set.

Abstract: A system with a first computer unit and with a second computer unit, wherein the first computer unit comprises a first interface to enable connection to at least one sensor and to at least one actuator, wherein the second computer unit comprises a second interface to enable connection to at least one sensor and to at least one actuator, wherein the first and the second computer units can be connected to each other by means of a further interface, wherein the actuator comprises an interface, wherein depending on the first or on the second operating state the interface determines whether a control command for a driving function is adopted by the first or the second computer unit, so that in the first operating state only the first computer unit can activate the actuator and in a second operating state only the second computer unit can activate the actuator.

Abstract: A communication module for controlling a motor vehicle, which is configured for receiving vehicle-independent commands and converting these received commands into a target trajectory of the motor vehicle, and transmitting this target trajectory to an implementation module which is configured for associating a sequence of control commands for components of the motor vehicle with this transmitted target trajectory.

Abstract: A system with a first computer unit and with a second computer unit, wherein the first computer unit comprises a first interface to enable connection to at least one sensor and to at least one actuator, wherein the second computer unit comprises a second interface to enable connection to at least one sensor and to at least one actuator, wherein the first and the second computer units can be connected to each other by means of a further interface, wherein the actuator comprises an interface, wherein depending on the first or on the second operating state the interface determines whether a control command for a driving function is adopted by the first or the second computer unit, so that in the first operating state only the first computer unit can activate the actuator and in a second operating state only the second computer unit can activate the actuator.

Abstract: A coupling device for coupling a software component, which transmits a setting command for setting an actuator on a control system of a motor vehicle, to the control system, the coupling device including a monitoring unit, which is designed to carry out an assessment for each setting command as to whether its implementation will transfer the motor vehicle into a dangerous state, the coupling device being further designed to transmit, as a function of this assessment, a monitored setting command corresponding to the setting command to an implementation unit, the implementation unit being designed to control the actuator.

Abstract: A method is described for monitoring a data memory in which an error detection method is used to detect and/or correct incorrect data words stored in memory lines of the data memory, an address of the data memory at which a data word evaluated as incorrect by the error detection method is stored being written to an auxiliary memory and being made available to a checking program.

Abstract: A method for the coexistence of software having different safety levels in a multicore processor which has at least two processor cores (2, 3). A memory range (4, 5) is associated with each processor core (2, 3) and a plurality of software (SW1, SW2) is processed on one of the processor cores (2, 3) having a predefined safety level. The plurality of software (SW1, SW2) is processed having a predefined safety level only on the processor core (2, 3) with which the same safety level is associated, in which during the processing of the plurality of software (SW1, SW2), the processor core (2, 3) accesses only the protected memory range (4, 5) which is permanently associated with this processor core (2, 3).

Abstract: A memory protection unit includes at least a first access control unit and a second access control unit programmed for controlling an access to a memory device. Further a method to operate a processing system comprising multiple processing devices and multiple memory protection units associated to the multiple processing devices. The access to the memory by a processing device is approved if first access control unit and second access control unit of the memory protection associated to the processing device approves the access and access is rejected if first access control unit or second access control unit rejects the access. The first access control unit is programmable by the associated processing device alone and the programming of the second access control unit is readable by an additional processing device which is to be used in a system with multiple programming devices, not the associate processing device.

Abstract: In a method for operating a communication system having a plurality of nodes which have access to a shared channel, a transmission process for transmitting a message via the channel is monitored for bit errors, and when a bit error occurs, a signaling message is transmitted via the channel in order to signal the bit error. In order to allow communications processes between the nodes to be controlled as a function of a bit error rate of the channel, a signaling rate of the signaling messages is measured and a bit error rate of the channel is determined as a function of the signaling rate.

Abstract: A method is described for monitoring a data memory in which an error detection method is used to detect and/or correct incorrect data words stored in memory lines of the data memory, an address of the data memory at which a data word evaluated as incorrect by the error detection method is stored being written to an auxiliary memory and being made available to a checking program.

Abstract: A cyclical time-based communication system, for the transmission of data (DATA) between users, comprising a databus and users connected thereto. The data transmission occurs within cyclical repeating timeframes, each with at least two timeslots. Each timeslot is provided for the transmission of a message (Ni). A message (Ni) comprises at least part of the data (DATA) and each message (Ni) is provided with a code (ID). The bandwidth available for data transmission may be better utilized, if the code (ID) is placed within the message (Ni), each message (Ni) is additionally provided with time information concerning the timeslot which may be extracted from the code, and at least one of the timeslots may be used for transmission of various messages in various cycles. In a preferred embodiment the information relating to the current cycle comprises an ordinal number. In the simplest case the number has two values 0 and 1.

Abstract: In order to detect a faulty error correcting unit (2) in an embedded system, wherein the error correcting unit (2) receives output data from a data source (20) and determines, whether the received data are incorrect, and wherein if the received data are incorrect, the error correcting unit (2) is expected to correct at least one error within the received data, output the corrected data and manipulate an error vector (4), a method and a system (Ia) are suggested that enable to compare the output data of the error correcting unit (2) with at least one reference data, wherein the at least one reference data originate at least indirectly from the data source (20). Both, the error vector (4) and the result of the comparison are input to a plausibility test in order to decide, whether the error correcting unit (2) is faulty. According to the result of the plausibility test, a failure vector (7) is manipulated in order to indicate whether a failure in the error correcting unit (2) is detected.

Abstract: A method for testing a memory and a control device having means for a memory test. A destination address of the memory is selected in the process, dependent addresses of the memory are determined from the destination address, and user data at the destination address and the dependent addresses are backed up. Furthermore, the destination address and the dependent addresses are described by test patterns, via which a signature is formed. The backed-up user data of the destination address and the dependent addresses are then restored. Finally, the determined signature is compared with the known setpoint value. In the event of a deviation between the signature and the setpoint value, suitable protective mechanisms are initiated.