Abstract: A computer-implemented method may include obtaining, from a system using a middleware component of the system, run-time evidence of the system; applying the obtained run-time evidence to a Directed Acyclic Graph (DAG) Bayesian network to determine marginal probabilities for one or more nodes of the DAG Bayesian network, wherein the DAG Bayesian network comprises a plurality of nodes each representing states and faults of the system, wherein each node includes a parameterized conditional probability distribution, and wherein one or more of the nodes of the plurality of nodes specify a list of one or more safety goals and a safety value; determining which nodes representing faults have probabilities exceeding their specified safety value; and determining one or more risk mitigation techniques to activate for the determined nodes representing faults with probabilities exceeding their respective safety value.

Abstract: A system to evaluate functional safety in an integrated circuit. The system includes a first circuit to execute an operation to cause to system to perform a function, where the function associated with a specified safety integrity level. The system also includes second circuit to capture trace data at an interface to the first circuit or at internal signals without inhibiting performance of the function, where the trace data comprising information that is used to determine whether the system can perform the function with an indicated level of functional safety and transmit the trace data to a safety evaluation circuit.

Abstract: A system to evaluate functional safety in an integrated circuit. The system includes a first circuit to execute an operation to cause to system to perform a function, where the function associated with a specified safety integrity level. The system also includes second circuit to capture trace data at an interface to the first circuit or at internal signals without inhibiting performance of the function, where the trace data comprising information that is used to determine whether the system can perform the function with an indicated level of functional safety and transmit the trace data to a safety evaluation circuit.

Abstract: A gateway having an architecture authorizing a bidirectional communication between applications located in different domains and presenting a high assurance level of protection. The gateway uses a virtualization platform and comprises a set of functional blocs configured to authorize secure bidirectional flow of data along two different paths between first and second domains, said set of functional blocs being decomposed into a plurality of elementarily evaluable components each one of which having a specified function and being adapted to communicate with other predefined elementarily evaluable components.

Abstract: Methods, systems, and apparatus, including computer programs encoded on non-transitory computer storage medium(s), are directed to improving completeness of map information and data related to maps created through sensor data. Map completeness can be improved by determining object completeness and coverage completeness of a generated map and reducing amount of unknown areas of the generated map.

Abstract: A virtualization platform that provides a systematic, transparent and local testing of components hosted by the virtualization platform in their integrated context. The virtualization platform comprises integrated interceptor modules connected to the components via communication channels, each interceptor module being interposed in the communication channel connecting two components, and an integrated analyzing device connected to the interceptor modules and comprising a control device and a testing device. The control device is configured to put each interceptor module in an operational mode selected out of a set of predetermined operational modes including a testing mode. The testing device is configured to locally test the components connected to the interceptor modules being put in the testing mode.

Abstract: A circuit is designed to be executed in a predeterminable operating mode of a plurality of operating modes. The circuit includes a first functional unit and a second functional unit. The first functional unit is designed as a static functional unit that in each of the plurality of operating modes of the circuit carries out a consistent function. The second functional unit is designed as an adaptable functional unit that is designed to be configured, prior to the circuit being put into service, according to a first configuration of a plurality of different configurations and during the operating time of the circuit to maintain the first configuration so that the first configuration of the second functional unit defines the predeterminable operating mode of the circuit. This makes it possible to reduce the verification expenditure for the circuit because verification can be limited to the adaptable functional unit.

Abstract: A computing system and a method are specified. The computing system has a plurality of components which are configured to use a resource exclusively jointly, an activity monitoring unit which records a number of activities of a component on the resource and an interrupting unit which is configured to interrupt access of the components for use of the resource when the number of activities of the component reaches an activity threshold, so that an assignment strategy can assign the exclusively jointly used resource to another component.

Abstract: The invention relates to a method for synchronizing local clocks in a distributed computer network, where said computer network consists of a number of components that are connected to each other via bi-directional communication links, characterized in that a) an a priori configured set of components of the network generates synchronization messages and sends these synchronization messages to the network, and b) an a priori configured set of components consumes the generated synchronization messages, and c) one or more message-relaying components in between a component that generates a synchronization message and the component that consumes the synchronization message will add a delay value to the synchronization message reflecting the delay imposed by the message-relaying component, d) a component that is configured to consume a synchronization message will delay a received synchronization message upon reception for a duration that is calculated by an a priory configured value for the maximum transmission

Abstract: A computer system includes at least two COTS processor cores and an evaluating device connected to the at least two COTS processor cores for evaluating output signals output by means of the at least two COTS processor cores. The evaluating device includes a comparator for pair-wise comparison of the respective generated output signals with each other. The comparator also outputs a comparison signal corresponding to the respective comparison of the output signals.

Abstract: The goal of the present invention is to improve the useful data efficiency and reliability in the use of commercially available ETHERNET controllers, in a distributed real time computer system, by a number of node computers communicating via one or more communication channels by means of TT ETHERNET messages. To achieve this goal, a distinction is made between the node computer send time (KNSZPKT) and the network send time (NWSZPKT) of a message. The KNSZPKT must wait for the NWSZPKT, so that under all circumstances, the start of the message has arrived in the TT star coupler at the NWSZPKT, interpreted by the clock in the TT star coupler. The TT star coupler is modified, so that a message arriving from a node computer is delayed in an intelligent port of the TT star coupler until the NWSZPKT can send it precisely at the NWSZPKT into the TT network.

Abstract: A circuit is designed to be executed in a predeterminable operating mode of a plurality of operating modes. The circuit includes a first functional unit and a second functional unit. The first functional unit is designed as a static functional unit that in each of the plurality of operating modes of the circuit carries out a consistent function. The second functional unit is designed as an adaptable functional unit that is designed to be configured, prior to the circuit being put into service, according to a first configuration of a plurality of different configurations and during the operating time of the circuit to maintain the first configuration so that the first configuration of the second functional unit defines the predeterminable operating mode of the circuit. This makes it possible to reduce the verification expenditure for the circuit because verification can be limited to the adaptable functional unit.

Abstract: A virtualization platform that provides a systematic, transparent and local testing of components hosted by the virtualization platform in their integrated context. The virtualization platform comprises integrated interceptor modules connected to the components via communication channels, each interceptor module being interposed in the communication channel connecting two components, and an integrated analyzing device connected to the interceptor modules and comprising a control device and a testing device. The control device is configured to put each interceptor module in an operational mode selected out of a set of predetermined operational modes including a testing mode. The testing device is configured to locally test the components connected to the interceptor modules being put in the testing mode.

Abstract: A gateway having an architecture authorizing a bidirectional communication between applications located in different domains and presenting a high assurance level of protection. The gateway uses a virtualization platform and comprises a set of functional blocs configured to authorize secure bidirectional flow of data along two different paths between first and second domains, said set of functional blocs being decomposed into a plurality of elementarily evaluable components each one of which having a specified function and being adapted to communicate with other predefined elementarily evaluable components.

Abstract: The invention relates to a method for synchronizing local clocks in a distributed computer network, where said computer network consists of a number of components that are connected to each other via bi-directional communication links, characterized in that a) an a priori configured set of components of the network generates synchronization messages and sends these synchronization messages to the network, and b) an a priori configured set of components consumes the generated synchronization messages, and c) one or more message-relaying components in between a component that generates a synchronization message and the component that consumes the synchronization message will add a delay value to the synchronization message reflecting the delay imposed by the message-relaying component, d) a component that is configured to consume a synchronization message will delay a received synchronization message upon reception for a duration that is calculated by an a priory configured value for the maximum transmission de

Abstract: A method for synchronizing local clocks in a distributed computer network includes a number of components that are connected to each other via bi-directional communication links. An a priori configured set of components generates synchronization messages and sends these messages to the network. An a priori configured set of components consumes the generated messages. One or more message-relaying components in between a component that generates a synchronization message and the component that consumes the message adds delay value to the message reflecting the delay imposed by the message-relaying component. A component that is configured to consume a synchronization message delays a received synchronization message upon reception for a duration that is calculated by an a priori configured value for the maximum transmission delay minus the value of the sum of all delay values added to the received message before further usage of the message in the synchronization process.

Abstract: One embodiment comprises a network that includes a plurality of bi-directional links and a plurality of nodes. Each node is communicatively coupled to two neighbor nodes and to two skip nodes using the plurality of bi-directional links. Three neighboring nodes of the plurality of nodes form a triple modular redundant (TMR) set having a first end node, a second end node, and a center node, the first end node configured to transmit output data in a first direction and the second end node configured to transmit output data in a second direction.

Abstract: A computing system and a method are specified. The computing system has a plurality of components which are configured to use a resource exclusively jointly, an activity monitoring unit which records a number of activities of a component on the resource and an interrupting unit which is configured to interrupt access of the components for use of the resource when the number of activities of the component reaches an activity threshold, so that an assignment strategy can assign the exclusively jointly used resource to another component.

Abstract: A method for synchronizing local clocks in a distributed computer network, wherein end systems and switches of the network executes the method as a synchronization state machine, which uses three different frame types. The states in the state machine belong to an unsynchronized or to a synchronized set of states. All end systems being configured as Synchronization Master periodically send coldstart frames in one of the unsynchronized states, all end systems being configured as Synchronization Master react to the reception of a coldstart frame by sending a coldstart acknowledgment frame a first timeout after the reception of the coldstart frame on all replicated communication channels. First timeout is reset when a consecutive coldstart frame is received before the coldstart acknowledge is sent, and all Synchronization Masters react to the reception of a coldstart acknowledgment frame by starting a second timeout and enter a synchronized state when the second timeout expires.

Abstract: The goal of the present invention is to improve the useful data efficiency and reliability in the use of commercially available ETHERNET controllers, in a distributed real time computer system, by a number of node computers communicating via one or more communication channels by means of TT ETHERNET messages. To achieve this goal, a distinction is made between the node computer send time (KNSZPKT) and the network send time (NWSZPKT) of a message. The KNSZPKT must wait for the NWSZPKT, so that under all circumstances, the start of the message has arrived in the TT star coupler at the NWSZPKT, interpreted by the clock in the TT star coupler. The TT star coupler is modified, so that a message arriving from a node computer is delayed in an intelligent port of the TT star coupler until the NWSZPKT can send it precisely at the NWSZPKT into the TT network.