A vehicle communication system includes a switching hub incorporated in a vehicle and including a switch IC and an external CPU. The switch IC includes an internal CPU and performs a transfer process of transferring information to a communication device. The external CPU is provided outside the switch IC and connected to the switch IC, and has higher information processing capability than the internal CPU. The external CPU can perform a transfer order process of ordering to transfer information to the communication device and perform a security process of securing the security of the information to be transferred when the transfer order process is performed. The internal CPU monitors the operation of the external CPU and when the external CPU is abnormal, performs the transfer order process instead of the external CPU.

In a predictive path planning functionality for a transportation vehicle data describing a roadway are acquired by one or more sensors disposed on the transportation vehicle and analyzed. One or more predicted paths are predicted with at least one neural network. Data describing a reference path taken by the transportation vehicle are acquired. The one or more predicted paths are evaluated to detect one or more errors in the predicting operation wherein the one or more errors include an indication that the one or more predicted paths of the path planning system deviate from the reference path.

A device for controlling an automated driving operation of a vehicle may have at least two brake systems, at least two steering systems, an engine controller, a first automated drive controller, a second automated drive controller, a surroundings sensor assembly, and inertial sensors. A third automated drive controller at least controls the vehicle into a standstill. The device is configured such that the automated driving operation is initiated and/or maintained only when the brake systems, steering systems, and at least two of the automated drive controllers are functional and such that the automated driving operation is interrupted if only one of the automated drive controllers is functional and/or if one of the brake systems and/or steering systems is not functional and/or if the engine controller is not functional, in which case the still functional automated drive controller assumes control of the vehicle and guides the vehicle into a standstill.

A method for redundant control in a distributed automation system, preferably a real-time automation system, for operating a client device of the distributed automation system is discussed. The method includes using the client device to monitor for the occurrence of a fault in communication between the client device and a first computing infrastructure that is part of the distributed automation system and operates the client device. The method may also include using the client device, once the fault occurs, to instruct a second computing infrastructure of the distributed automation system to operate the client device.

An example operation includes one or more of receiving, by a transport, a request, determining, by the transport, a device associated with the request, responsive to the device being unrecognized, preparing a response with a portion including faulty data based on a characteristic of the transport, sending, by the transport, the response, and responsive to receiving an acknowledgment message from the device, based on a parsing of the faulty data by the device, indicating, by the transport, the faulty data to the device.

An embodiment method of operating a CAN bus comprises coupling a first device and second devices to the CAN bus via respective CAN transceiver circuits, and configuring the respective CAN transceiver circuits to set the CAN bus to a recessive level during transmission of messages via the CAN bus by the respective first device or second devices.

The present invention relates to a semiconductor device having a first processor element configured to receive a first interrupt request signal, a second processor element configured to receive a second interrupt request signal, a first priority determination circuit configured to receive a plurality of interrupt signals and to output the first interrupt request signal to the first processor element, a second priority determination circuit configured to receive the plurality of interrupt signals and to output the second interrupt request signal to the second processor element, a checker circuit configured detect failures of the first priority determination circuit and the second priority determination circuit, and a control circuit configured to select one of the first priority determination circuit or the second priority determination circuit as a circuit to be checked. The control circuit selects the circuit to be checked based on the first interrupt request signal and the second interrupt request signal.

A fault check circuit, including a first channel comparator to output a first channel comparator output signal indicating whether a first channel digital signal is outside of a first channel threshold range, wherein the first channel digital signal is A/D converted from a first channel analog signal; a second channel comparator to output a second channel comparator output signal indicating whether a second channel digital signal is outside of a second channel threshold range, wherein the second channel digital signal is A/D converted from a second channel analog signal; and an alarm generator circuit to combine the first and second channel comparator output signals, and output a fault check signal, wherein the first and second channel comparators and the alarm generator circuit are implemented in hardware, and the fault check circuit performs a fault check without software intervention.

A fault management system for functional safety of an automotive grade chip includes: an out-of-chip system and an automotive-grade chip, where the automotive-grade chip includes a processor, a system controller, a system configuration module, a fault management device, and an on-chip function module; and the fault management device is configured with a fault classification management model.

A method is provided for diagnosing a failure on an aircraft that includes aircraft systems and monitors configured to report effects of failure modes of the aircraft systems. The method includes receiving a fault report that indicates one or more of the monitors that reported the effects of a failure mode in an aircraft system of the aircraft systems, and accessing a fault pattern library that describes relationships between possible failure modes and patterns of those of the monitors configured to report the effects of the possible failure modes. The method also includes diagnosing the failure mode of the aircraft system from the one or more of the monitors that reported, and using the fault pattern library and a greedy selection algorithm, determining a maintenance action for the failure mode; and generating a maintenance message including at least the maintenance action.