Abstract: A system for data processing and storage in vehicles having a zone-based, central computing in-vehicle communications network architecture, includes a zone control unit (ZCU) that receives electronic messages from one or more sensors or electronic control units (ECUs) located within a zone of the vehicle, the ZCU comprising a protocol data unit (PDU) gating module that converts the electronic messages into a plurality of PDUs, and a switch-based Ethernet network that transmits the plurality of PDUs, using Ethernet protocol frames comprising the plurality of PDUs, to a central computing platform. The central computing platform includes an Ethernet handler module that decomposes the Ethernet protocol frames into individual PDUs for storage in a shared memory. The central computing platform further includes a plurality of parsing modules that are configured to access the individual PDUs from the shared memory and perform data processing on the individual PDUs.

Abstract: A system for data processing and storage in vehicles having a zone-based, central computing in-vehicle communications network architecture, includes a zone control unit (ZCU) that receives electronic messages from one or more sensors or electronic control units (ECUs) located within a zone of the vehicle, the ZCU comprising a protocol data unit (PDU) gating module that converts the electronic messages into a plurality of PDUs, and a switch-based Ethernet network that transmits the plurality of PDUs, using Ethernet protocol frames comprising the plurality of PDUs, to a central computing platform. The central computing platform includes an Ethernet handler module that decomposes the Ethernet protocol frames into individual PDUs for storage in a shared memory. The central computing platform further includes a plurality of parsing modules that are configured to access the individual PDUs from the shared memory and perform data processing on the individual PDUs.

Abstract: Method and system for interfacing a plurality of providers and a plurality of recipients that are independently located with a unified vehicle service framework having a quality of service filter and a broker module. A first cloud unit has at least one of the plurality of providers and the plurality of recipients. A first vehicle and a second vehicle each respectively have another at least one of the plurality of providers and the plurality of recipients. A second cloud unit has yet another at least one of the plurality of providers and the plurality of recipients. The unified vehicle service framework is configured to receive a subscription request and determine whether it is granted based in part on a quality of service score assigned by the quality of service filter. When the subscription request is granted, respective services from plurality of providers are routed through the broker module.

Abstract: A method for dynamically re-allocating controller functions based on minimizing utilization. A lookup table is generated based on functions and mode of operations. Each entry in the lookup table includes a number of executions required for a respective function in a respective mode of operation. Functions for execution to the controllers are assigned based on the number of executions for a function of an entry of a respective mode of operation. A utilization rate is determined for each controller in each mode of operation. Utilization rates of the various modes of operation are compared for each of the controllers. Matching utilization rates are identified between controllers of different modes of operations. A multi-mode re-allocation of function execution in the controller is coordinated by switching a set of pre-allocated functions between different controllers within a respective mode of operation to reduce the utilization rate of at least one controller.

Abstract: A modified dual-duplex fail-operational control system. A primary controller includes a first processing unit and a second processing unit for executing a function. A first comparative module comparing the function results from the first and second processing unit to determine an error the first controller. A second controller includes a first processing unit and second processing unit. The first processing unit executes the function. The second processing unit operating in a non-redundant state and not executing the function while in the non-redundant state. A second comparative module determines whether an error is present in the second controller.

Abstract: A method for fault tolerant controller readiness. Executing functions by a first controller operating in a primary status mode. Operating in a hot standby status mode by a second controller and mirroring the first controller by executing functions to operate as a redundant controller. Operating in a cold standby status mode by at least one backup controller under normal operating conditions. The second controller is reconfigured while operating under normal operating conditions from the hot standby status mode to the primary standby status mode if a failure occurs in the first controller. Reconfiguring the at least one backup controller operating under normal operating conditions from cold standby status mode to hot standby status mode to operate as a redundant controller in response to the reconfiguring the second controller from the hot standby status mode to the primary status mode.

Abstract: A method for dynamically re-allocating controller functions based on minimizing utilization. A lookup table is generated based on functions and mode of operations. Each entry in the lookup table includes a number of executions required for a respective function in a respective mode of operation. Functions for execution to the controllers are assigned based on the number of executions for a function of an entry of a respective mode of operation. A utilization rate is determined for each controller in each mode of operation. Utilization rates of the various modes of operation are compared for each of the controllers. Matching utilization rates are identified between controllers of different modes of operations. A multi-mode re-allocation of function execution in the controller is coordinated by switching a set of pre-allocated functions between different controllers within a respective mode of operation to reduce the utilization rate of at least one controller.

Abstract: A modified dual-duplex fail-operational control system. A primary controller includes a first processing unit and a second processing unit for executing a function. A first comparative module comparing the function results from the first and second processing unit to determine an error the first controller. A second controller includes a first processing unit and second processing unit. The first processing unit executes the function. The second processing unit operating in a non-redundant state and not executing the function while in the non-redundant state. A second comparative module determines whether an error is present in the second controller.

Abstract: A method for fault tolerant controller readiness. Executing functions by a first controller operating in a primary status mode. Operating in a hot standby status mode by a second controller and mirroring the first controller by executing functions to operate as a redundant controller. Operating in a cold standby status mode by at least one backup controller under normal operating conditions. The second controller is reconfigured while operating under normal operating conditions from the hot standby status mode to the primary standby status mode if a failure occurs in the first controller. Reconfiguring the at least one backup controller operating under normal operating conditions from cold standby status mode to hot standby status mode to operate as a redundant controller in response to the reconfiguring the second controller from the hot standby status mode to the primary status mode.

Abstract: An integrated fail-silence and fail-operational control system includes a primary controller controlling features of devices while operating under non-fault operating conditions. A secondary controller includes a fail detector/decider module monitoring faults in the primary controller. The fail detector/decider module determines whether the fault in the primary controller is associated with a fail-silence requirement or a fail-operational requirement. If the fail detector/decider module determines the fault is a fail-silence requirement, then the fail detector/decider module actuates a shutdown command to the primary controller to shut down a feature affected by the fault where the feature becomes non-operational. If the fail detector/decider module determines that the feature associated with the fault is a fail-operational requirement, then the fail detector/decider module signals the primary controller to relinquish controls of the feature to the secondary controller.

Abstract: An integrated fail-silence and fail-operational control system includes a primary controller controlling features of devices while operating under non-fault operating conditions. A secondary controller includes a fail detector/decider module monitoring faults in the primary controller. The fail detector/decider module determines whether the fault in the primary controller is associated with a fail-silence requirement or a fail-operational requirement. If the fail detector/decider module determines the fault is a fail-silence requirement, then the fail detector/decider module actuates a shutdown command to the primary controller to shut down a feature affected by the fault where the feature becomes non-operational. If the fail detector/decider module determines that the feature associated with the fault is a fail-operational requirement, then the fail detector/decider module signals the primary controller to relinquish controls of the feature to the secondary controller.

Abstract: The present disclosure relates to an automated system for use in connection with longitudinal deceleration, longitudinal acceleration, and lateral acceleration functions. The system includes an interface receiving signals from and transmitting signals to a controller. The system also includes a safety kernel system comprising safety kernel software and a set of safety rules. Also disclosed are methods for use in a motion control system in connection with vehicle deceleration, acceleration, and lateral acceleration. The methods in some cases include receiving an initial request into a safety kernel software and determining whether the safety kernel software has received an override. The methods can also include detecting a violation of any primary safeguards defined by the safety kernel software, detecting a violation within a set of secondary safeguards defined by the safety kernel software, and adjusting the initial request to a modified level; and transmitting the modified level to an actuator.

Abstract: The present disclosure relates to an automated system for use in connection with longitudinal deceleration, longitudinal acceleration, and lateral acceleration functions. The system includes an interface receiving signals from and transmitting signals to a controller. The system also includes a safety kernel system comprising safety kernel software and a set of safety rules. Also disclosed are methods for use in a motion control system in connection with vehicle deceleration, acceleration, and lateral acceleration. The methods in some cases include receiving an initial request into a safety kernel software and determining whether the safety kernel software has received an override. The methods can also include detecting a violation of any primary safeguards defined by the safety kernel software, detecting a violation within a set of secondary safeguards defined by the safety kernel software, and adjusting the initial request to a modified level; and transmitting the modified level to an actuator.

Abstract: A method of dynamically reconfiguring a distributed computing architecture having a plurality of processing nodes, where each processing node hosts a respective plurality of virtual machines, includes detecting a fault condition on a first processing node, assessing the criticality of a software function performed by each of the respective virtual machines on the first processing node, and reassigning at least one of the plurality of virtual machines on the first processing node to a second processing node if the at least one virtual machine is deemed critical.

Abstract: A method of dynamically allocating a task or a signal on a statically allocated and embedded software architecture of a vehicle includes identifying a faulty component. The faulty component may include a software component, a hardware component or a signal or communications link between components. Once the faulty component is identified, any tasks performed by or signals associated with the faulty component are identified, and the tasks performed by or the signals associated with the faulty component are re-allocated to an embedded standby component so that performance of the re-allocated task and/or signal for future system operations is performed by the standby component.

Abstract: Systems and methods for reconfiguring ECU tasks for ensuring that a vehicle is operational upon failure of a task or an ECU. A first on-board reconfiguration strategy is generated and executed by an on-board unit of the vehicle to bring the vehicle to a safe state and a second off-line reconfiguration strategy is generated by a remote center unit and then executed by the on-board unit.

Abstract: A computer program product includes a storage medium that stores instructions for execution by a processing circuit for practicing a method for synchronous communication in a control system. Within a first time interval, a first source task is executed to broadcast a first destination task, within a second sequential time interval, the first destination task is communicated over a channel to a first destination, and within a third sequential time interval, the first destination task is consumed. Within the first time interval, a second source task may be executed to broadcast a second destination task, within the second sequential time interval, the second destination task may be communicated over the channel to a second destination, and within the third sequential time interval, the second destination task may be consumed. The first source task is allowed to be scheduled ahead of the second source task, and the second source task is allowed to be scheduled ahead of the first source task.

Abstract: A method of dynamically reconfiguring a distributed computing architecture having a plurality of processing nodes, where each processing node hosts a respective plurality of virtual machines, includes detecting a fault condition on a first processing node, assessing the criticality of a software function performed by each of the respective virtual machines on the first processing node, and reassigning at least one of the plurality of virtual machines on the first processing node to a second processing node if the at least one virtual machine is deemed critical.

Abstract: A method of dynamically allocating a task or a signal on a statically allocated and embedded software architecture of a vehicle includes identifying a faulty component. The faulty component may include a software component, a hardware component or a signal or communications link between components. Once the faulty component is identified, any tasks performed by or signals associated with the faulty component are identified, and the tasks performed by or the signals associated with the faulty component are re-allocated to an embedded standby component so that performance of the re-allocated task and/or signal for future system operations is performed by the standby component.

Abstract: A computer program product includes a storage medium that stores instructions for execution by a processing circuit for practicing a method for synchronous communication in a control system. Within a first time interval, a first source task is executed to broadcast a first destination task, within a second sequential time interval, the first destination task is communicated over a channel to a first destination, and within a third sequential time interval, the first destination task is consumed. Within the first time interval, a second source task may be executed to broadcast a second destination task, within the second sequential time interval, the second destination task may be communicated over the channel to a second destination, and within the third sequential time interval, the second destination task may be consumed. The first source task is allowed to be scheduled ahead of the second source task, and the second source task is allowed to be scheduled ahead of the first source task.