Abstract: In embodiments of an autonomous vehicle platform and safety architecture, safety managers of a safety-critical system monitor outputs of linked components of the safety-critical system. The linked components comprise at least three components, each of which is configured to produce output indicative of a same event independent from the other linked components by using different input information than the other linked components. The safety managers also compare the outputs of the linked components to determine whether each output indicates the occurrence of a same event. When the output of one linked component does not indicate the occurrence of an event that is indicated by the outputs of the other linked components, the safety managers identify the one linked component as having failed. Based on this, the outputs of the other linked components are used to carry out operations of the safety-critical system without using the output of the failed component.

Abstract: In embodiments of an autonomous vehicle platform and safety architecture, safety managers of a safety-critical system monitor outputs of linked components of the safety-critical system. The linked components comprise at least three components, each of which is configured to produce output indicative of a same event independent from the other linked components by using different input information than the other linked components. The safety managers also compare the outputs of the linked components to determine whether each output indicates the occurrence of a same event. When the output of one linked component does not indicate the occurrence of an event that is indicated by the outputs of the other linked components, the safety managers identify the one linked component as having failed. Based on this, the outputs of the other linked components are used to carry out operations of the safety-critical system without using the output of the failed component.

Abstract: Technologies are provided for detecting anomalous data at runtime in an autonomous vehicle component that is indicative of a byzantine fault, and providing real-time remediation. Input and output data streams of the vehicle component can be analyzed to generate a normal operational model for the vehicle component. Using the model, deviations from a known steady state of operation of the vehicle component can be detected and flagged as potential faults. The vehicle component can then be isolated and/or restarted. Additionally or alternatively, a specification can be defined that specifies allowed component interactions in the autonomous vehicle system. The specification can be used to generate tests that can be used to validate the functional correctness of the vehicle components. The specification can be used at run-time to detect component interactions that are not allowed. Such a disallowed component interaction can be detected using the specification and flagged as a potential fault.

Abstract: A fail-safe signal injection system includes a fail-safe system controller that receives a control command and initiates to bypass a first system to inject a control signal into a second system responsive to the control command. The fail-safe signal injection system also includes a signal injection circuit implemented to inject the control signal into the second system responsive to power applied to the signal injection circuit, the signal injection circuit further implemented to fail-safe without the power applied, and thus operates to pass a control input from the first system through to the second system. The signal injection circuit includes a fail-safe isolation circuit designed to pass the control input from the first system through to the second system when driven for fail-safe pass through, and bypass the first system to inject the control signal into the second system when driven to isolate the first system from the second system.

Abstract: In embodiments of an autonomous vehicle interface system, system nodes are each implemented as a distributed node for independent data processing of low-level sensor data and/or high-level system data. The high-level system data is abstracted from the low-level sensor data, providing invariance to system configuration in higher-level processing algorithms. The autonomous vehicle interface system includes at least one real-time bus for data communications of the low-level sensor data and the high-level system data between the system nodes. The system also includes an application programming interface (API) configured for access by the system nodes to the low-level sensor data and the high-level system data that is published on the real-time bus and accessible via the API.

Abstract: In embodiments of an autonomous vehicle platform and safety architecture, safety managers of a safety-critical system monitor outputs of linked components of the safety-critical system. The linked components comprise at least three components, each of which is configured to produce output indicative of a same event independent from the other linked components by using different input information than the other linked components. The safety managers also compare the outputs of the linked components to determine whether each output indicates the occurrence of a same event. When the output of one linked component does not indicate the occurrence of an event that is indicated by the outputs of the other linked components, the safety managers identify the one linked component as having failed. Based on this, the outputs of the other linked components are used to carry out operations of the safety-critical system without using the output of the failed component.

Abstract: In embodiments of an autonomous vehicle interface system, system nodes are each implemented as a distributed node for independent data processing of low-level sensor data and/or high-level system data. The high-level system data is abstracted from the low-level sensor data, providing invariance to system configuration in higher-level processing algorithms. The autonomous vehicle interface system includes at least one real-time bus for data communications of the low-level sensor data and the high-level system data between the system nodes. The system also includes an application programming interface (API) configured for access by the system nodes to the low-level sensor data and the high-level system data that is published on the real-time bus and accessible via the API.

Abstract: In embodiments of an autonomous vehicle interface system, system nodes are each implemented as a distributed node for independent data processing of low-level sensor data and/or high-level system data. The high-level system data is abstracted from the low-level sensor data, providing invariance to system configuration in higher-level processing algorithms. The autonomous vehicle interface system includes at least one real-time bus for data communications of the low-level sensor data and the high-level system data between the system nodes. The system also includes an application programming interface (API) configured for access by the system nodes to the low-level sensor data and the high-level system data that is published on the real-time bus and accessible via the API.

Abstract: In embodiments of an autonomous vehicle platform and safety architecture, safety managers of a safety-critical system monitor outputs of linked components of the safety-critical system. The linked components comprise at least three components, each of which is configured to produce output indicative of a same event independent from the other linked components by using different input information than the other linked components. The safety managers also compare the outputs of the linked components to determine whether each output indicates the occurrence of a same event. When the output of one linked component does not indicate the occurrence of an event that is indicated by the outputs of the other linked components, the safety managers identify the one linked component as having failed. Based on this, the outputs of the other linked components are used to carry out operations of the safety-critical system without using the output of the failed component.

Abstract: In embodiments of an autonomous vehicle interface system, system nodes are each implemented as a distributed node for independent data processing of low-level sensor data and/or high-level system data. The high-level system data is abstracted from the low-level sensor data, providing invariance to system configuration in higher-level processing algorithms. The autonomous vehicle interface system includes at least one real-time bus for data communications of the low-level sensor data and the high-level system data between the system nodes. The system also includes an application programming interface (API) configured for access by the system nodes to the low-level sensor data and the high-level system data that is published on the real-time bus and accessible via the API.