Abstract: A method for integrating infrastructure software functions and automotive applications on an automotive electronic control unit (ECU) device. The ECU device includes a hardware architecture and a software architecture, wherein the hardware architecture includes two or more system-on-chips, at least two of which each comprise two or more processing cores and means to communicate with at least one other system-on-chip. The hardware architecture includes memory and means to communicate with other ECU devices. The software architecture includes one, two, or more virtual machine monitors, each of which executes one, two, or more virtual machines. At least two of said virtual machines each execute an operating system, which executes one, two, or more tasks, and the execution of two or more of the tasks uses the time-triggered paradigm. The tasks are tasks of automotive applications from at least two different automotive domains and are tasks of infrastructure software functions.

Abstract: A method and a fault-tolerant computer architecture (FCTA) for fail-safe trajectory planning for a moving entity (MOV). The method and FCTA uses a commander (COM), a monitor (MON), and a safe envelope generating stage (ENV). Based on sensor input, the commander (COM) and the monitor (MON) produce real-time images of objects (OBJ1, OBJ2) detected. A trajectory planning stage (TRJ-PLN) generates trajectories (COM-TRJ1, COM-TRJ2), and the safe envelope generating stage (ENV) generates a safety envelope. The commander (COM) provides the one or more trajectories (COM-TRJ1, COM-TRJ2) to the monitor (MON) and the decision subsystem (DECIDE). A trajectory verification stage (TRJ-VRFY) verifies a trajectory (COM-TRJ1, COM-TRJ2) generated by the commander (COM) only if said trajectory (COM-TRJ1, COM-TRJ2) is completely located inside said safety envelope. A moving entity (MOV) uses a trajectory (COM-TRJ1, COM-TRJ2) generated by the commander (COM) only when said trajectory is verified by the monitor (MON).

Abstract: A method to select one trajectory, the so-called Selected Trajectory (ST), out of a set of trajectories (T1-T3) to be used by an autonomous or semi-autonomous ground vehicle (GV), wherein the method includes the following steps: (i) assessing said set of trajectories (T1-T3) with one, two, or a multitude of verification modules (VM1-VM4) and returning Quality Assessments (Q11-Q43) for each of the trajectories (T1-T3); (ii) ranking said trajectories (T1-T3) with a Ranking Scheme (RS), wherein the Quality Assessments (Q11-Q43) are taken into account when ranking the trajectories (T1-T3), and (iii) selecting exactly one trajectory, the Selected Trajectory (TR), based on the rank of the trajectories (T1-T3).

Abstract: Methods and computer systems for establishing an interactive consistency property between receivers of messages. Messages are transmitted to receivers by a sender over a communication network including disjoint communication paths for connecting receivers and sender. Switches include local clocks. Local clocks of non-faulty switches are synchronized to each other with a maximum error (precision), and receivers detect switch failures. Redundant copies of a message are forwarded by sender to each receiver across different disjoint communication paths. A switch of each disjoint path is configured such that redundant copies are forwarded to each receiver with a temporal distance between disjoint paths. That distance is selected such that all non-faulty receivers receive redundant copies in the same receive order, when the switches and communication links of the disjoint paths exhibit no failure.

Abstract: A method for transmitting control commands in a computer system, which includes components at least in the form of nodes, actuators and communication systems, wherein the control commands are communicated over the communication systems from the nodes to the actuators, and wherein one or more of the components may fail to operate according their specification. For consistently accepting control commands at the actuators, the nodes and their control commands are assigned priorities, wherein a node and its control commands have the same priority, wherein at least two priorities are used, wherein a high priority node produces high priority control commands and a low priority node produces low priority control commands, and wherein a high priority node is configured to communicate its control commands over at least two communication systems to the actuators and a low priority node is configured to communicate its low priority control commands over at least one communication system to the actuators.

Abstract: A method for transmitting real-time messages in a computer network (100), in particular real-time computer network, wherein said network comprises two or more computing nodes (21, 22, 23, 24, 25, 26) and one or more star couplers (1, 2, 3, 4), wherein said nodes are interconnected via at least one star coupler, wherein each node is connected to at least one star coupler via at least one of the communication links (50), and wherein the nodes exchange messages (M1, M2) with one another and with the at least one star coupler, and wherein star couplers, which are synchronized to a global time base (C), transmit a first non-empty set (SSET) of real-time messages according to a synchronized communication paradigm, and/or wherein computing nodes, which are synchronized to the global time base, transmit said first non-empty set of real-time messages according to the synchronized communication paradigm, wherein a star coupler, which is not synchronized to a global time base, and/or a computing node, which is not synch

Abstract: A method for integrating infrastructure software functions and automotive applications on an automotive electronic control unit (ECU) device. The ECU device includes a hardware architecture and a software architecture, wherein the hardware architecture includes two or more system-on-chips, at least two of which each comprise two or more processing cores and means to communicate with at least one other system-on-chip. The hardware architecture includes memory and means to communicate with other ECU devices. The software architecture includes one, two, or more virtual machine monitors, each of which executes one, two, or more virtual machines. At least two of said virtual machines each execute an operating system, which executes one, two, or more tasks, and the execution of two or more of the tasks uses the time-triggered paradigm. The tasks are tasks of automotive applications from at least two different automotive domains and are tasks of infrastructure software functions.

Abstract: A method is provided to detect and handle failures in the communication in a network, including a sender (201, 203) and a receiver (202, 501, 502, 503), where communication between the sender and the receiver is message-oriented. The method includes: (a) the sender sending a message (M101, M101-C, M102-C) to the receiver; (b) the sender monitoring the transmission process of the message inside the sender and/or monitoring the message; (c) the sender executing a correctness check of (i) the message, e.g., its contents, and/or (ii) the transmission process of the message inside the sender; and (d) after the correctness check(s) has/have been completed, the sender informs the receiver of the result of the correctness check(s), wherein (e) the receiver of the message marks the message as being faulty and/or discards the message if the result of a correctness check indicates that the message and/or transmission process is faulty.

Abstract: A method for transmitting control commands in a computer system, which includes components at least in the form of nodes, actuators and communication systems, wherein the control commands are communicated over the communication systems from the nodes to the actuators, and wherein one or more of the components may fail to operate according their specification. For consistently accepting control commands at the actuators, the nodes and their control commands are assigned priorities, wherein a node and its control commands have the same priority, wherein at least two priorities are used, wherein a high priority node produces high priority control commands and a low priority node produces low priority control commands, and wherein a high priority node is configured to communicate its control commands over at least two communication systems to the actuators and a low priority node is configured to communicate its low priority control commands over at least one communication system to the actuators.

Abstract: A method for transmitting real-time messages in a computer network (100), in particular real-time computer network, wherein said network comprises two or more computing nodes (21, 22, 23, 24, 25, 26) and one or more star couplers (1, 2, 3, 4), wherein said nodes are interconnected via at least one star coupler, wherein each node is connected to at least one star coupler via at least one of the communication links (50), and wherein the nodes exchange messages (M1, M2) with one another and with the at least one star coupler, and wherein star couplers, which are synchronized to a global time base (C), transmit a first non-empty set (SSET) of real-time messages according to a synchronized communication paradigm, and/or wherein computing nodes, which are synchronized to the global time base, transmit said first non-empty set of real-time messages according to the synchronized communication paradigm, wherein a star coupler, which is not synchronized to a global time base, and/or a computing node, which is not synch

Abstract: The invention relates to a method for transmitting messages in a computer network of a real-time system comprising components in the form of computing nodes and star couplets. A first group of components sends, relays or receives time-controlled messages according to a communication schedule, and a second group of components does not communicate according to a communication schedule. For example, the computing node 104 does not execute a communication schedule, i.e. the computing node 104 does not send time-controlled messages. Instead, the computing node 104 reacts to receiving a message 1-201a by sending a message 1-104a in response. According to the invention, the message 1-201a is sent in a time-controlled manner, for example by a star coupler 201. The computing node 104 receives the message 1-201a at time 17-104a and reacts to receiving the message 1-201a by sending the message 1-104a at time 17-104b to the star coupler 201. The star coupler 201 receives the message 1-104a at time 14-201b.

Abstract: A method and a fault-tolerant computer architecture (FCTA) to improve the performance in fail-safe trajectory planning for a moving entity (MOV). The method and FCTA uses a commander (COM), a monitor (MON), and a safe envelope generating stage (ENV). Based on sensor data input, the commander (COM) and the monitor (MON) produce as output real-time images (COM-OBJ1, COM-OBJ2, MON-OBJ1, MON-OBJ2) of objects (OBJ1, OBJ2) detected due to the monitoring of one or more sensors. A trajectory planning stage (TRJ-PLN) generates trajectories (COM-TRJ1, COM-TRJ2), and the safe envelope generating stage (ENV) generates a safety envelope. A trajectory verification stage (TRJ-VRFY) verifies a trajectory (COM-TRJ1, COM-TRJ2) generated by the commander (COM) only if said trajectory (COM-TRJ1, COM-TRJ2) is completely located inside said safety envelope. A moving entity (MOV) uses a trajectory (COM-TRJ1, COM-TRJ2) generated by the commander (COM) only when said trajectory is verified by the monitor (MON).

Abstract: A method and a fault-tolerant computer architecture (FCTA) for fail-safe trajectory planning for a moving entity (MOV). The method and FCTA uses a commander (COM), a monitor (MON), and a safe envelope generating stage (ENV). Based on sensor input, the commander (COM) and the monitor (MON) produce real-time images of objects (OBJ1, OBJ2) detected. A trajectory planning stage (TRJ-PLN) generates trajectories (COM-TRJ1, COM-TRJ2), and the safe envelope generating stage (ENV) generates a safety envelope. The commander (COM) provides the one or more trajectories (COM-TRJ1, COM-TRJ2) to the monitor (MON) and the decision subsystem (DECIDE). A trajectory verification stage (TRJ-VRFY) verifies a trajectory (COM-TRJ1, COM-TRJ2) generated by the commander (COM) only if said trajectory (COM-TRJ1, COM-TRJ2) is completely located inside said safety envelope. A moving entity (MOV) uses a trajectory (COM-TRJ1, COM-TRJ2) generated by the commander (COM) only when said trajectory is verified by the monitor (MON).

Abstract: An information exchange between at least two processes (FEED_PROC-1, FEED_PROC-2, CONSUME_PROC-1) communicating with each other using at least one queue (QUEUE-001) uses a placement plan for determining the order in which messages are placed into the queue. The information feeding processes (FEED_PROC-1, FEED_PROC-2) place pieces of information (MESG-001, MESG-002) into the queue (QUEUE-001), from where an information consuming process (CONSUME_PROC-1) sequentially consumes the pieces of information. The placement plan describes, for at least one possible value of identifying information contained in each of the pieces of information, a respective position (POS-001, POS-002) in the queue (QUEUE-001), such that the pieces of information (MESG-001, MESCG-002) or respective references thereto are placed into the queue according to positions in the queue (QUEUE-001) corresponding to the respective values of the identifying information in the pieces of information.

Abstract: Methods and computer systems for establishing an interactive consistency property between receivers of messages. Messages are transmitted to receivers by a sender over a communication network including disjoint communication paths for connecting receivers and sender. Switches include local clocks. Local clocks of non-faulty switches are synchronized to each other with a maximum error (precision), and receivers detect switch failures. Redundant copies of a message are forwarded by sender to each receiver across different disjoint communication paths. A switch of each disjoint path is configured such that redundant copies are forwarded to each receiver with a temporal distance between disjoint paths. That distance is selected such that all non-faulty receivers receive redundant copies in the same receive order, when the switches and communication links of the disjoint paths exhibit no failure.

Abstract: A method to improve the quality of service in a computer network consisting of nodes and starcouplers and/or access points and wireless and/or wired connections, by changing a current configuration (CUR_CONF) of the computer network to a new configuration (NEW_CONF) of the computer network, whereby—the computer network in the current configuration (CUR_CONF) communicates one message or a multitude of messages (1101a, 1101b, 1101c, 1102a, 1102b) and—a monitor (M) observes at least some traffic pattern (TP) that the message or multitude of messages (1101a, 1101b, 1101c, 1102a, 1102b) generate and—an extractor (E) formulates the traffic pattern (TP) of the message or multitude of messages (1101a, 1101b, 1101c, 1102a, 1102b) and—the extractor (E) following said analysis generates one or many traffic parameters (T_PAR) to the message or multitude of messages (1101a, 1101b, 1101c, 1102a, 1102b) and—an optimizer (O) uses the traffic parameters (T_PAR) to generate the new configuration (NEW_CONF) and/or to generate r

Abstract: Method for monitoring a computer vision system (CVS), said computer vision system (CVS) being part of a vehicle control system (VCS) of a vehicle (1000) that is used to maneuver said vehicle (1000) in 3D-space (3000), said computer vision system (CVS) being configured to monitor a surrounding area of the vehicle in real time and said computer vision monitor (CVM) monitoring the behavior of the computer vision system (CVS), comprising the steps of a.) providing the computer vision monitor (CVM) with information concerning a position (LM_POS) of at least one landmark (2000) in the 3D-space (3000), wherein said information is provided by a source, said source being independent of the computer vision system (CVS), b.) providing the computer vision monitor (CVM) with information concerning a current position (CUR_POS) of the vehicle (1000), c.) selecting based on steps a.) and b.) at least one landmark which falls within the range of vision of the computer vision system (CVS), d.

Abstract: The invention relates to a method for transmitting messages in a computer network, and to a computer network of this type. The computer network comprises computing nodes (101-105), said computing nodes (101-105) being interconnected via at least one star coupler (201) and/or at least one multi-hop network (1000), wherein each computing node (101-105) is connected via at least one communication line (110) to the at least one star coupler (201) and/or the at least one multi-hop network (1000), and wherein the computing nodes (101-105) exchange Ethernet messages with one another and with the at least one star coupler (201) and/or the at least one multi-hop network (1000).

Abstract: An information exchange between at least two processes (FEED_PROC-1, FEED_PROC-2, CONSUME_PROC-1) communicating with each other using at least one queue (QUEUE-001) uses a placement plan for determining the order in which messages are placed into the queue. The information feeding processes (FEED_PROC-1, FEED_PROC-2) place pieces of information (MESG-001, MESG-002) into the queue (QUEUE-001), from where an information consuming process (CONSUME_PROC-1) sequentially consumes the pieces of information. The placement plan describes, for at least one possible value of identifying information contained in each of the pieces of information, a respective position (POS-001, POS-002) in the queue (QUEUE-001), such that the pieces of information (MESG-001, MESCG-002) or respective references thereto are placed into the queue according to positions in the queue (QUEUE-001) corresponding to the respective values of the identifying information in the pieces of information.

Abstract: The invention concerns a method for the transmission of messages in a computer network, wherein the computer network comprises nodes (101, 102, 103, 104, 101a, 101b, 102a), which are connected to each other by communication lines (110), e.g.