A method for controlling a communication system of a vehicle includes selecting, by a main controller, a specific sub-controller to wake-up during an ignition-off state of the vehicle from among a plurality of sub-controllers. The main controller transmits a message including information about a time when the wake-up is scheduled and a specific task to be performed after the wake-up to the selected specific sub-controller if the ignition-off state of the vehicle is maintained. The selected sub-controller is caused to wake up at the wake-up time transmitted from the main controller and to perform the specific task during the ignition-off state of the vehicle. A corresponding communication system of the vehicle is also provided.

A device access apparatus for a client-server system is described, wherein the device access apparatus is used to access components of a field bus network. The device access apparatus includes a general application that is installable on a server and configured to interchange data with the components of the field bus network. The device access apparatus also includes a device driver that is installable on a client and a communication proxy that is installable on the server that are configured to set up a data connection between the server and the client. The data connection is used to transmit data between the device driver and one of the components of the field bus network that is associated with the device driver. The communication proxy is configured to monitor data traffic on the data connection between the client and the server and detect errors in the data transmission.

In one embodiment, a system for operating an autonomous driving vehicle (ADV) includes a number of modules. These modules include at least a perception module to perceive a driving environment surrounding the ADV and a planning module to plan a path to drive the ADV to navigate the driving environment. The system further includes a bus coupled to the modules and a sensor processing module communicatively coupled to the modules over the bus. The sensor processing module includes a bus interface coupled to the bus, a sensor interface to be coupled to a first set of one or more sensors mounted on the ADV, a message queue to store messages published by the sensors, and a message handler to manage the messages stored in the message queue. The messages may be subscribed by at least one of the modules to allow the modules to monitor operations of the sensors.

In an anomaly detection by an electronic control unit connected to an other electronic control unit via a communication network, a data frame is received from the other electronic control unit, and a reception interval is calculated between a first data frame and a second data frame received immediately before the first data frame. A determination value for determining whether the data frame is anomalous is updated by adding a predetermined value to the determination value when the reception interval is equal to or less than a threshold value, and the data frame is determined to be anomalous when the determination value exceeds a limit value.

A Controller Area Network (CAN) system, method, and circuit are provided with a dual mode bus line termination circuit connected between signal lines of a serial bus and optimized for both differential and single-ended communication modes over the serial bus, where the dual mode bus line termination circuit includes first and second resistance termination paths connected in parallel between first and second bus wires of the serial bus to provide an odd mode termination impedance (R.sub.ODD) that matches an impedance of the serial bus when operating in the differential communication mode, and to also provide an even mode termination impedance (R.sub.EVEN) that matches an impedance of the serial bus when operating in the single-ended communication mode.

A bus system, a method for operating a bus system and a participant of a bus system are provided. The participant includes a timer and a transceiver circuit. The transceiver circuit is configured to receive a data packet having a time stamp value via a bus. The timer is configured for synchronization, based on the time stamp value. The timer is configured to change the time stamp value. The transceiver circuit is configured to transmit the data packet with the changed time stamp value via the bus.

In one embodiment, a computing system of an autonomous vehicle may receive a first set of data packets on one or more networks. The computing system may analyze the data packets to determine, for each packet, one or more of an authenticity, a validity, or a correctness of the data packet. The computing system may perform a first action for the first set of data packets based on the analysis. The first action may include signaling a safety driver of the autonomous vehicle to take over manual control of the vehicle in response to the data packets failing to satisfy the one or more of the authenticity, the validity, or the correctness criteria.

A method for a determination of the optimal duration of a time slot for computational actions in a time-triggered controller. The controller includes a sensor subsystem, a computational subsystem, an actuator subsystem, and a time-triggered communication system. The time-triggered communication system is placed between the sensor subsystem, the computational subsystem, the actuator subsystem, and a monitor subsystem. An anytime algorithms is executed in the computational subsystem. A plurality of execution slot durations of the anytime algorithms is probed during the development phase, starting from the minimum execution slot duration, increasing this slot duration by the execution slot granularity until the maximum execution slot duration is reached. In each of the execution slot durations, a multitude of frames is executed in a destined application environment. In each frame the computational subsystem calculates imprecise anticipated values of observable state variables by interrupting execution of the anytime algorithm at the end of the provided execution slot duration, using data received from the sensor subsystems at the beginning of the frame.

A method for averting a manipulation on a CAN bus using a first node connected to the bus by a CAN controller includes a secured transmit module of the first node monitoring the bus; the transmit module recognizing transmission processes of the CAN controller in a normal operation of the first node; the transmit module recognizing a message transmitted impermissibly on the bus in a manner deviating from the normal operation; and, in the event the transmit module recognizes the message, the transmit module initiating countermeasures provided against the manipulation.

A secure hardware-based module or Security Electronic Control Unit (SECU) for a Controller Area Network (CAN) prevents an attacker from sending malicious messages through the CAN bus to take over control of a vehicle. The SECU shares a unique key and counter with each ECU on the CAN bus. When a legitimate ECU sends a message, it first compresses the message and then generates a MAC of the counter and a secret key. The counter is increased by one for each transmitted message. The ECU then fits the compressed message and the MAC into one CAN frame and sends it onto the CAN bus. The SECU performs the message verification on behalf of the intended receiver(s) of the message. If the verification passes, the receiver(s) simply decompress the message and use it as a normal CAN message. If the verification fails, the SECU will corrupt the CAN frame before it is fully received by the intended receiver(s). The corrupted CAN frame will be ignored by the intended receiver(s) as if it was never received. Therefore, a malicious message generated by an attacker will inflict no damage on the system.