Abstract: A functional architecture pattern has a first software module, an operating system module, a first board support package, and a first microcomputer. The functional architecture pattern further has a second software module, a second board support package, and a second microcomputer that are logically separated from the first software module, the operating system module, the first board support package, and the first microcomputer. The first software module is developed according to quality management standards, while the operating system module, both first and second board support packages, and the third software module are developed according to safety integrity levels standards so as to make a logical split-off on three levels between the first software module software and the second software module.

Abstract: A functional architecture pattern has a first software module, an operating system module, a first board support package, and a first microcomputer. The functional architecture pattern further has a second software module, a second board support package, and a second microcomputer that are logically separated from the first software module, the operating system module, the first board support package, and the first microcomputer. The first software module is developed according to quality management standards, while the operating system module, both first and second board support packages, and the third software module are developed according to safety integrity levels standards so as to make a logical split-off on three levels between the first software module software and the second software module.

Abstract: A process for decomposing safety software involves the steps of providing a first software module associated with a first logical unit, providing a second software module associated with a second logical unit, instructing the first software module to implement a first safety goal based on a quality management level, and instructing the second software module to implement a second safety goal based on a safety integrity level, where the second software module uses at least one input and at least one output of the second logical unit to determine if the second safety goal is satisfied. Consequently, the second software module uses a result of the first software module to determine if the first safety goal has been completed, and the second software module uses at least one algorithm to verify an operational status of the first logical unit.

Abstract: A process for decomposing safety software involves the steps of providing a first software module associated with a first logical unit, providing a second software module associated with a second logical unit, instructing the first software module to implement a first safety goal based on a quality management level, and instructing the second software module to implement a second safety goal based on a safety integrity level, where the second software module uses at least one input and at least one output of the second logical unit to determine if the second safety goal is satisfied. Consequently, the second software module uses a result of the first software module to determine if the first safety goal has been completed, and the second software module uses at least one algorithm to verify an operational status of the first logical unit.

Abstract: A method and apparatus for a power dissipation management system for a vehicle where a thermal condition of a plurality of driveline components is determined. The quantity of energy for each driveline component can absorb is determined based upon its thermal condition. A braking signal to one or more of the driveline components is provided based upon the quantity of energy each component can absorb.

Abstract: A method and apparatus for a power dissipation management system for a vehicle where a thermal condition of a plurality of driveline components is determined. The quantity of energy for each driveline component can absorb is determined based upon its thermal condition. A braking signal to one or more of the driveline components is provided based upon the quantity of energy each component can absorb.