Safety concept

Uncompromising road approval

Our safety concept meets all relevant safety standards for automobiles, mechanical engineering, and agricultural and construction machinery. We offer a fail-safe, multi-redundant architecture with no single point of failure, ensuring fully fail-operational performance. Patented safety concepts and qualitative evaluations guarantee the highest reliability. TÜV SGS certified, we meet the highest automotive safety level (ASIL D)—even twice over. Our architecture reduces the probability of failure to less than 1 in 1 billion operating hours and complies with the highest aviation standards. Continuous monitoring and evaluation ensure operation in accordance with ISO 26262.

We make no compromises on safety     

This comprehensive safety concept has been reviewed and approved by TÜV SGS, ensuring compliance with the highest standards for functional safety according to ISO 26262:2018 (ASIL-D), ISO 61508 (SIL-Level 3), and other relevant norms. Our architecture meets ASIL D in each control unit half, even in the unlikely event of a half failure, reducing the probability of failure to less than 1 per 1 billion operating hours, in line with aviation and automotive industry requirements.
 

Zusätzlich erfüllen wir die Anforderungen folgender Normen:

ECE R10:2017ECE R13:2016
ECE R79:2018ECE R89:2007
ECE R116:2012ECE R131:2014
ISO 25119-2:2019ISO 19014-1:2018
EN 1175:2020General Safety Regulation (GSR2)
VW 81000 Class 5VW 80000 Class 5
Cybersecurity Engineering  according to ISO/SAE 21434 and SAE J 3061:2016Our systems can obtain a general operating permit (ABE) for all types of vehicles and construction machinery and are homologation-capable

1. General Redundancy and Error Detection Mechanisms:

  • Multiple redundant elements: All elements, including motors, power supplies, and control modules, are at least doubled, while less reliable components are up to eight times redundant to ensure operation in case of a failure.
  • Intermediate and end-to-end monitoring of main functions: The system continuously monitors essential functions to immediately detect operational errors.
Ultimate Safety Through Redundancy: How NX NextMotion Protects You

When it comes to vehicle safety, we believe: more is better—more layers of safety, more checks, more reliability. That's why our NX NextMotion system goes beyond the usual to ensure your safety on the road. Let us introduce one of the main pillars of our safety design: redundancy.

What is Redundancy?

Imagine you are walking on a tightrope. Now imagine there are not just one, but multiple safety nets beneath you. Even if one fails, the next one catches you. This is exactly the concept of redundancy in our system. It means that every critical component in the vehicle has a backup—and sometimes more than one! Even during the extreme effects of a massive solar storm that could disrupt everything from power grids to satellites, your vehicle would continue to operate reliably. Our technology ensures that you reach your destination safely, even in chaotic conditions.

Multiple Layers of Safety

In the NX NextMotion system, all essential components such as motors, power supplies, and control units are redundant. And for components with lower reliability, like software-controlled functions or position sensors and electronic control units (CPUs), we take it even further, utilizing up to eight-fold redundancy for main functions such as steering and braking. This means up to 16 cores across four processors work together to ensure every decision made by your vehicle system is accurate, reliable, and safe. These CPUs continuously communicate and check each other's work, and if one CPU shows issues, it is immediately outvoted by the others. This way, if any of the 5,000 components in our system has a problem, the others immediately take over to guarantee seamless and safe operation.

Continuous Real-Time Monitoring

But redundancy alone isn’t enough. We monitor everything in real-time. Our system continuously checks to ensure that all components are working together perfectly—as if you had a team of experts ensuring that everything is running smoothly around the clock. Because what good is redundancy if availability isn't ensured? Our real-time monitoring ensures that redundancy and availability go hand-in-hand, so your system is always ready—no outages, no compromises.

Safety Reserves in Power Supply

Even our power supply is designed with safety in mind. A galvanically isolated backup battery is always active in parallel, in case the main power supply fails. This keeps the system operational and functional, guaranteeing your safety at all times.

Why is this Important?

In the complex world of autonomous driving and advanced vehicle systems, even the smallest error can have serious consequences. That’s why we designed the NX NextMotion system to be fail-safe. With multiple layers of redundancy and continuous real-time monitoring, we make sure you’re always protected, no matter what.

This isn’t just about meeting safety standards—it’s about exceeding them. It’s about giving you the peace of mind to enjoy the ride, knowing your vehicle is prioritizing your safety in every possible way.

2. Full Self-Test During Startup:

Comprehensive system self-test: Nearly 5000 components are thoroughly tested at every startup to ensure that the hardware and its dependencies function correctly before the vehicle is operational.

  • The self-test includes the interactions of components and ensures that communication, power supply, sensor accuracy, actuator readiness, and signal integrity are properly maintained.
  • If an error is detected during the self-test, the system identifies the exact cause, logs it, and evaluates its criticality.
  • Based on this assessment, the system will either switch to a safe mode or prevent operation, depending on the error's criticality.
Self-Test Assistant: How NX NextMotion Checks Nearly 5,000 Components Every Startup

In a world where technology plays an increasingly critical role in our safety, we at Arnold NextG ask ourselves a vital question: How can we ensure that everything is functioning perfectly before you even begin to drive? The answer? A comprehensive self-test of nearly 5,000 components conducted every time the vehicle starts.

What is a Self-Test?

Think of your car as a finely tuned orchestra, where each instrument must play in harmony. Before the music begins (or in our case, before you drive off), we conduct a full dress rehearsal. This is the self-test: the system checks every critical component—sensors, actuators, processors, power supplies—to ensure that everything is perfectly aligned. If something is amiss, the system detects the issue before it can affect your journey.

5,000 Components in Seconds
  • The NX NextMotion system is equipped with state-of-the-art technology, and all these components are tested during every startup sequence. We test nearly 5,000 individual components to ensure everything is functioning correctly. Don’t worry—this happens within seconds, so you won’t even notice it.
  • Sensors: From brakes to steering, sensors measure every important movement and position in the vehicle. If a sensor isn’t responding correctly, the system is immediately alerted.
  • Actuators: These components execute commands (like braking or steering), and our self-test ensures that they are always ready for action.
  • Processors: As the "brains" of the vehicle, our CPUs are continually checked at startup for safety, accuracy, and functionality.
Dependency Testing in Real-Time

It’s not just about testing parts in isolation. During startup, the NX NextMotion system tests how components work together. It ensures that communication between different parts—such as brake sensors and the central processing unit—functions flawlessly. This level of dependency testing is critical to identifying potential issues before they can occur.

What Happens If Something is Wrong?
  • Suppose one of these 5,000 components fails the test. Don’t worry—we’ve planned for that too. Depending on the severity of the issue, the system will either:
  • Log the issue: If it’s a non-critical problem, the system will store it for future maintenance, so it doesn’t affect your drive.
  • Switch to safe mode: For more serious issues, the system can activate a safety mode that limits certain functions until the problem is resolved.
  • Prevent operation: If the issue is critical, the system will prevent the vehicle from operating until the error is fixed. Your safety is our top priority.
  • Precise Error Location: Our diagnostic system tells you exactly what and where the problem is.
How Does This Keep Things Safe?
  • The comprehensive self-test isn’t just about detecting problems—it’s designed to prevent them. Through regular checks, the system identifies even the smallest issues and addresses them before they can impact your drive. It’s like having a full team of mechanics checking your car before every drive—without you ever needing to pop the hood.
  • This means your vehicle is 100% ready to get you safely to your destination the moment you start driving.

3. Redundant Error Memory Concept (Complete Diagnostic Logging):

Comprehensive diagnostics for each error or warning: Every detected error or warning from the previous operational cycle is stored in a redundant error memory system.

  • This system logs all errors and warnings from each cycle, capturing complete diagnostic data, including component behavior and interdependencies.
  • These logged data enable the system to reference them immediately during the current cycle, allowing quick decisions for degraded or safe operational modes.
  • These diagnostic data are accessible for troubleshooting and maintenance, facilitating preventive maintenance and performance analysis.
  • Thanks to optional Over-the-Air (OTA) functionality, diagnostic data can be read remotely and securely in real-time.
Redundant Error Diagnosis and Storage: How NX NextMotion Never Forgets an Error?

Imagine a vehicle that not only keeps track of everything that happens during the drive but also remembers every small issue from the last time you drove. That’s exactly what our NX NextMotion system does, thanks to its redundant error memory concept. This means your car doesn’t just detect and fix issues; it also logs them, learns from them, and ensures that nothing is overlooked.

What is Redundant Error Storage?
  • Think of it like a black box recorder for your vehicle. Every time you drive, the system monitors and logs all issues—from minor warnings to critical errors. But we go a step further: these data are stored redundantly, meaning they are backed up in multiple locations. Even if part of the system is damaged or loses power, the recording is securely stored elsewhere.
  • It’s like having multiple copies of an important document—you can always retrieve the information, no matter what happens.
Why Redundancy is Important?
  • In a high-tech vehicle, simply storing diagnostic data isn’t enough. What if part of the memory fails? This is where redundancy comes in. The NX NextMotion system ensures that all error data are stored in multiple locations within the system, guaranteeing:
  • No data loss, even if one memory unit fails.
  • Technicians can retrieve previous logs during maintenance to get a full history of what happened during each drive.
  • It’s a bit like having multiple safes, each containing a copy of the same important document. If one safe breaks, the others are still there to protect the information.
The Benefits of Complete Diagnostic Logging
  • Preventive Maintenance: By storing every fault or warning, the vehicle can recognize patterns. This enables preventive maintenance, meaning problems can be fixed before they lead to a breakdown.
  • Faster Repairs: When you bring your vehicle in for maintenance, the mechanic has access to the full diagnostic history. This makes troubleshooting faster and more accurate, ensuring that the problem is properly fixed.
  • Increased Safety: The system learns from every error, warning, or fault and uses these data over time to improve the vehicle’s response to potential problems.
  • Optional OTA Capability: Application-specific diagnostic logs are continuously sent to central systems, enabling early detection and resolution of potential issues. This supports continuous diagnostics and preventive maintenance by providing real-time diagnostic information and updates with the latest software versions.
  • Cybersecurity: All OTA diagnostic and flash processes are protected by the latest encryption and security protocols to ensure maximum data security and system integrity.
Always Ready to React and Heal

Suppose you had a small issue during your last drive—a sensor error or a brief communication loss between components. At the next startup, the system remembers what happened and conducts additional tests in the affected areas to ensure they’re working correctly. If the issue persists, the system escalates the warning, so you’re always aware of what’s going on under the hood.

More Than Just Error Codes

Most systems simply throw an error code when there’s a problem and then forget it once the issue is resolved. Not with NX NextMotion. Our redundant error storage ensures that, even after an error is fixed, the information remains available for future analysis. This allows us to build a full performance and error history of the system, making your vehicle smarter and safer with every drive.

 

Why is this Important?
  • In a complex system like the one driving the NX NextMotion, you don’t want anything to be overlooked. That’s why we developed this advanced logging system—it doesn’t just detect errors but stores and protects them, using them to make your vehicle even more reliable. With redundant storage and complete diagnostic data, nothing is overlooked, forgotten, or neglected.
  • Whether it’s a minor glitch or a critical fault, NX NextMotion ensures that your vehicle always learns, adapts, and stays one step ahead—because safety never takes a break

4. Power Supply and Management:

  • Galvanically isolated and redundant power supply with backup battery for all critical electrical devices.
  • Voltage or current regulation: Monitors both input and output power with redundancy in case of a failure.
  • Monitoring of internal system power supply.
Always Powered, Always Protected: How NX NextMotion's Redundant Power System Keeps You Safe

When you're on the road, you don’t want to constantly think about whether your car’s power supply is functioning correctly—you just want it to work. That’s where the NX NextMotion system comes in. Designed with redundancy in mind, it ensures that if one power source fails, a backup solution is always ready. Think of it as your vehicle's personal safety net, always on and ready.

What Does Redundant Power Supply Mean?

Simply put, redundant power supply means there’s more than one power source for all critical systems in your vehicle. It’s like having two batteries for your phone—when one runs out, the other takes over without you noticing.

At Arnold NextG, we developed the NX NextMotion system with multi-layered power redundancy. This means there are always two independent voltage sources active simultaneously. If the main power source fails, your vehicle doesn’t stop—it seamlessly switches over to the secondary power source, without interruption. This ensures that you can continue driving safely or stop in a controlled manner, even in case of a power issue.

Constant Monitoring for Peace of Mind

The NX NextMotion system doesn’t just rely on backup batteries—it constantly monitors the status of the power supply. From startup to shutdown, it checks voltage, energy flow, and power consumption. If something is off, the system intervenes immediately to keep you safe.

  • Normal Operation: The NX NextMotion system continuously monitors both voltage sources, always supplying the vehicle with the most reliable source of power. This ensures that the system is always optimally and reliably powered.
  • Minor Disruptions: If the system detects a minor irregularity, like a brief voltage dip, the issue is logged, but the journey continues uninterrupted.
  • Backup Activation: In the rare case of a major issue, the system automatically switches to the backup power source, so all safety-critical functions remain operational.
What Happens During a Power Issue?

Power issues aren’t always dramatic, but they can have serious consequences if not properly managed. That’s why the NX NextMotion system responds immediately, depending on the severity of the issue:

  • Small Power Fluctuations: These are logged for future analysis but don’t affect your drive. The system adapts automatically to keep everything running.
  • Main Power Supply Failure: If the main power source fails, the system switches to the backup battery to ensure that brakes, steering, and other essential functions stay operational.
  • Critical Power Failure: In the unlikely event that one of the power sources fails, the system seamlessly and dynamically takes over with the other power source while simultaneously reducing non-essential functions to conserve energy. Critical systems, such as brakes and steering, remain fully active, so you can continue driving safely and reach a workshop.
Safe to the Last Drop of Power

What makes the NX NextMotion system special is that it doesn’t just monitor power—it manages it. The system knows exactly how much energy is available and allocates it where it’s needed most. Even in the event of a complete power failure, the system provides enough power to bring the vehicle to a safe stop, avoiding unpleasant surprises.

Practical Benefits:
  • No Power Failures: With a redundant power system, you’ll never be stranded due to a power issue.
  • Seamless Transitions: The system dynamically selects the best power source, so you don’t have to worry about sudden power loss.
  • Smart Energy Management: Even if power reserves run low, the NX NextMotion system prioritizes critical systems while using energy efficiently to ensure your safety.
Why This is Important?

When it comes to vehicle safety, we believe there can never be too many safety nets. That’s why the NX NextMotion system features not just one but multiple layers of power protection. With continuous monitoring and seamless switching between power sources, we ensure that you’re always protected, no matter what happens. Your safety is our top priority.

5. Signaling and User Interaction:

  • LEDs and buzzer: Redundant systems (four LEDs and one buzzer) signal warnings independently, enhancing both acoustic and visual redundancy.
  • Error signaling: Different error levels (diagnostic, critical, severe, highly critical) are signaled through LED colors, buzzer sounds, and display messages.
Clear Signals for Safe Driving: How NX NextMotion Keeps You Informed

Your vehicle does a lot of work in the background to keep you safe. But what happens if something goes wrong? The NX NextMotion system was designed not only to detect and fix problems but also to communicate them to you in real-time. Through a combination of lights, sounds, and warnings, the system ensures that you always know what’s happening under the hood and what steps you need to take.

Signaling You Can Rely On

Think of your vehicle as a highly efficient team. If something goes wrong, you need the right signals to understand what’s going on and how to react. The NX NextMotion system uses multiple signaling layers to keep you informed. We designed this system with redundancy, so if one signal doesn’t get through, another delivers the message.

  • Visual Signals (LED lights): Your vehicle uses a series of LED indicators on the dashboard, which light up in different colors depending on the severity of the problem.
  • Audible Signals (Buzzer): To ensure you don’t miss anything, the system also uses warning sounds to get your attention, especially in critical situations.
  • Clear Messages: In addition to lights and sounds, the system displays easy-to-read messages on the dashboard that tell you exactly what’s happening and what actions you should take.
Redundant Signaling for Extra Safety

We don’t rely on just one method to keep you informed. In fact, the system is designed so that redundancy ensures you’re always alerted, even if one part of the signaling system has an issue. For example, the LEDs and buzzer work independently. If one component fails, the other will still alert you.

It’s like having multiple alarms—if one doesn’t ring, the others make sure you’re still awakened.

Monitoring Every Warning and Error: Understanding Criticality Levels

Once you start your vehicle, the NX NextMotion system goes into full diagnostic mode, monitoring thousands of components. Every sensor, actuator, and processor is watched, and if something goes wrong—even for a fraction of a second—the system logs it. Each error’s criticality is classified into different levels, so the system can respond appropriately based on severity:

  1. Diagnostic (Low Severity): These are minor, non-critical issues, like a slight misreading of a sensor, that don’t impact vehicle performance. The system logs the error, and operation continues.

    System Response: None. The error is logged for maintenance.

    Driver Notification: No immediate action required, error code saved for future reference.

     

  2. Warning (Medium Severity): When redundancy is affected, but core functions still work, like if one of three redundant sensor lines fails, the system continues to work with the remaining two but signals the error.

    System Response: Vehicle remains operational, but the error is logged.

    Driver Notification: Yellow light on the dashboard; the system advises visiting a workshop soon.

     

  3. Error (Moderate Severity): An escalation from warning, indicating more redundancy has been lost, but the vehicle can still drive safely with restrictions.

    System Response: Some functions may be limited, such as reduced speed or performance.

    Driver Notification: Yellow light and warning sound; driver is advised to check the vehicle soon.

     

  4. Serious Error (High Severity): Significant loss of function, like two out of three critical components failing. The vehicle switches to restricted mode for safe operation.

    System Response: Speed limits (e.g., max 60 km/h) and active braking applied as needed.

    Driver Notification: Red lights and audio alerts; driver is instructed to stop the vehicle safely at the earliest opportunity.

     

  5. Critical Error (Very High Severity): Failure of vital functions, such as both power supplies, triggers an immediate safe stop response.

    System Response: The vehicle will be brought to a stop within a safe timeframe (e.g., 2-3 minutes).

    Driver Notification: Red lights and continuous warning sound; driver is instructed to stop the vehicle as soon as possible.

     

  6. Highly Critical Error (Extreme Severity): The most severe category, where the vehicle can no longer guarantee safe operation, such as an impending total power failure or complete sensor failure.

    System Response: Emergency braking to bring the vehicle to an immediate halt. Continued driving is impossible until the issue is resolved.

    Driver Notification: Red warning lights, continuous alarms.

A Signal for Every Situation

The NX NextMotion system is designed to ensure that you’re never left in the dark. Whether it’s a minor sensor misreading or a critical issue, the system uses a combination of lights, sounds, and messages to let you know exactly what’s happening and how serious the situation is.

And because we equipped the system with redundant signaling, you can trust that you’ll always get the message, even if part of the system isn’t functioning perfectly.

Why is this Important?

Knowing what’s going on in your vehicle is essential to feeling safe. With NX NextMotion, you don’t have to guess what’s happening—you’ll know.

You’ll always have the information you need to make the right decisions, giving you peace of mind while you drive, no matter what road conditions lie ahead.

6. Safety Measures in Critical Systems:

  • Fail-operational concepts for drive-by-wire: Independent processing and control channels ensure operation in the event of any single failure.
  • Fully fail-operational—redefined by our Safety-by-Wire® technology—means that the system continues to function without limitations despite an error, maintaining the highest safety level, ASIL D. Even if a component fails, critical functions such as braking and steering remain fully operational, providing you with complete control and maximum safety, no matter what happens.
Always in Control: How NX NextMotion Manages Errors and Keeps You Safe

No one likes surprises—especially not behind the wheel. That’s why the NX NextMotion system was designed with advanced error management and a degradation strategy to keep you safe, even if something unexpected happens. But what does this mean for you? Simply put, if something goes wrong, your vehicle has a plan to handle it, ensuring that you remain in control.

Error Management: Detect, React, Protect

Errors can happen, but how a system responds to them makes all the difference. The NX NextMotion system continuously monitors every part of the vehicle—from sensors and motors to steering and brakes. If something goes wrong, the system immediately detects the issue and takes the right steps to protect you.

  • Detect: The system is constantly on the lookout for potential problems. If it detects something unusual—such as a sensor malfunction or power issue—it intervenes before you even notice.
  • React: Once an issue is identified, the system adapts. For example, if a brake sensor fails, the system relies on other working components to ensure brake performance isn’t compromised.
  • Protect: When necessary, the system limits certain functions to keep everything safe. This might mean reducing speed or limiting acceleration, allowing you to stop or continue driving safely.
Degradation Strategy: Continue Driving Safely

Even in more serious situations, the NX NextMotion system has a plan. It uses a degradation strategy, meaning the vehicle can continue operating at a reduced capacity while keeping you safe. Instead of shutting down completely, the system ensures that critical functions like steering and brakes remain fully operational, though with restrictions to minimize risks.

  • Example: If one of the main power sources fails, the system switches to a backup battery and limits non-essential functions. Critical systems—like brakes and steering—remain active, so you can safely drive to a workshop.

This approach allows you to keep driving with additional safety precautions. It’s like the power-saving mode on your smartphone—it keeps the device working in a controlled way to save power and protect the system.

What Happens in Critical Situations?

When the system detects a more severe issue, driver safety takes top priority. The NX NextMotion system can automatically initiate emergency measures, such as a controlled deceleration, to bring the vehicle to a safe stop if needed.

  • Controlled Operation: If the system detects that an issue may escalate, it calculates how long the vehicle can continue to operate safely. Before this time runs out, the driver is advised to bring the vehicle to a safe stop. If the driver doesn’t respond, they can still drive at a maximum speed of 10 km/h indefinitely.
  • Emergency Braking: In the rare case of an impending total failure, the system activates emergency braking to bring the vehicle to an immediate halt, protecting both you and your surroundings.
Why is this Important?

The road isn’t always predictable, and the same goes for technology. But with NX NextMotion’s error management and degradation strategy, you can be confident that your vehicle is prepared for the unexpected. Whether it’s a minor disruption or a serious problem, the system is designed to respond intelligently and keep you safe in every situation.

So you’re not just driving—you’re protected, even when conditions get challenging.

7. System Condition and Health Monitoring:

  • Health concept: Each core sends a signal indicating whether latent errors have been detected.
  • Decision concept: The cores monitor the validity of received values and downgrade their trustworthiness in case of errors. Reliability decisions are based not only on majority votes, but a qualified minority can be chosen if it provides the most reliable data. Our sophisticated algorithms—our secret ingredient—ensure that the system always makes the best decision to maximize your safety.
NX NextMotion’s Secret Ingredient: How We Keep Your Vehicle Safe

Every great system has a secret ingredient—a unique algorithm that ensures everything runs smoothly, reliably, and above all, safely. For the NX NextMotion system, this secret ingredient is not only its ability to continuously check and cross-verify every component in the vehicle but also its ability to always make the best decision. Even if a component fails, our system precisely selects the most reliable data sources to ensure everything functions exactly as it should—for your maximum safety. It’s like a recipe so precise that nothing is left to chance.

A System That Checks Itself

In your vehicle, countless sensors, processors, and motors work together to keep you safe. But what happens if one of these parts fails? This is where our secret ingredient comes in. The NX NextMotion system not only monitors the road and your driving behavior—it constantly checks itself to make sure everything under the hood is working perfectly.

  • Self-Testing Everywhere: Every critical component in the vehicle—from brakes to steering sensors—regularly performs self-tests to ensure it’s working properly. If something is off, the component immediately sends a signal that says, “Attention, there’s an issue!”
  • Dual Backup Solutions for Reliability: We’ve built multiple backup systems for critical components, so if one part shows signs of trouble, another is immediately ready to take over seamlessly. This ensures the car continues to drive safely, even with minor issues.
A Recipe for Redundancy

The NX NextMotion system is built with redundancy at every level. This means we don’t rely on just one sensor or processor to do the job. Each main function—whether it’s steering, braking, or acceleration—is handled by multiple components working together.

  • Multiple Cores, Unified Decision: Every processor in the system collaborates with other processors, constantly comparing results to ensure they’re all aligned. If one processor encounters an issue, the others take over, and the system ensures only the most reliable data are used.
What Happens If Something Goes Wrong?

Even with the best recipe, sometimes an ingredient goes bad. Perhaps a sensor starts giving strange readings, or a processor isn’t responding as quickly as it should. The NX NextMotion system doesn’t panic—it adjusts the recipe. If part of the system starts acting up, it quickly decides how much trust to place in that component:

  • Minor Issues: If it’s a small problem, the system continues to use the component but relies more heavily on the backup components.
  • Serious Issues: If the problem is more severe, the system takes that component out of operation entirely and relies only on the fully functional parts.

Either way, the system ensures the vehicle drives safely and always uses the best “ingredients.”

Continuous Self-Checks for Maximum Safety

The best part of the NX NextMotion system’s secret ingredient? It’s always running in the background to ensure everything is functioning perfectly. The system doesn’t wait for problems to arise—it’s constantly performing its own tests to make sure all systems are running smoothly. Every sensor, processor, and motor is checked in real-time to detect potential issues before they become real problems.

  • Continuous Self-Tests: Every critical component in the vehicle continuously sends signals to confirm that everything is working as planned. These self-tests run continuously to keep everything in peak condition.
  • Selecting the Best Data: The system doesn’t rely on just one source of information. It compares the results of multiple sensors and processors to ensure only the most reliable data are used to keep you safe.
Why is this Important?

You may not see the “secret ingredient” in action, but it’s always there, making sure your vehicle remains safe. The NX NextMotion system’s ability to continuously self-check and adapt means you can trust that your car is in perfect working order, even if something goes wrong.

It’s like having a master chef under the hood, ensuring that every component in your vehicle is perfectly in sync, so you can drive with confidence and peace of mind.

8. Error Management and Degradation Strategy:

  • Error criticality levels: Errors are classified as diagnostic, warning, severe error, critical error, and highly critical error, each with its impacts on vehicle performance and driver notifications.
  • Degradation strategy: If the driver or operator does not respond to multiple safety-critical errors, our custom-developed strategy intervenes to ensure safe continued operation or a controlled emergency shutdown of the system. For example, if multiple errors occur, maximum speed is gradually reduced to ensure safe continued operation.
Error Management and Degradation Strategy: How NX NextMotion Manages Errors and Keeps You Safe

Even the best systems can encounter problems, but how an error is managed makes all the difference. In the NX NextMotion system, we’ve implemented comprehensive error management and a degradation strategy to ensure that your vehicle remains safely operational, even if an error occurs.

Error Criticality Levels

Not all errors are equally severe, which is why the NX NextMotion system classifies errors into different criticality levels. These classifications determine how the system responds to an error and how it impacts vehicle performance and driver notifications:

  1. Diagnostic (Lowest Severity): Non-critical issues that don’t immediately impact vehicle safety. The system logs these errors for later review, and the drive continues as normal.

    System Response: Error is logged, but no immediate action is taken.

    Driver Notification: None, or only a notification for driver information.

  2. Warning (Low Severity): When an error occurs that might have long-term impacts but poses no immediate risk. The system notifies the driver that maintenance is required.

    System Response: Error is logged, but the operation remains unrestricted.

    Driver Notification: Yellow warning signal on the dashboard; the system advises visiting a workshop soon.

  3. Error (Moderate Severity): The system has detected an error that could affect essential functions but retains enough redundancy to operate the vehicle safely.

    System Response: Some functions are limited, such as reduced speed or performance.

    Driver Notification: Yellow warning light and audible signals; driver is advised to check the vehicle soon.

  4. Serious Error: The system has detected an error that significantly impacts critical functions, but enough redundancy remains to allow safe operation for a limited period.

    System Response: Functions are limited, reduced speed (e.g., max 60 km/h) or performance.

    Driver Notification: Red warning light and audible signals; driver is instructed to visit a workshop as soon as possible.

  5. Critical Error (High Severity): If multiple safety functions fail, the system significantly restricts vehicle operation to ensure safety.

    System Response: Speed and acceleration are heavily restricted (e.g., max 10 km/h).

    Driver Notification: Red warning lights and repeated audible alerts; driver is advised to stop the vehicle safely.

  6. Highly Critical Error (Very High Severity): In the extremely unlikely event of multiple failures adding up to a highly critical error affecting fundamental safety functions, like loss of power supply and multiple sensors, the system initiates emergency measures.

    System Response: Vehicle is safely decelerated; further operation after stopping is impossible until the error is resolved.

    Driver Notification: Red alert and audible warnings; system advises the driver to stop the vehicle within two minutes, or an emergency stop is triggered.

Degradation Strategy: Safety First

If the system detects a serious error, the degradation strategy ensures that safety functions are prioritized. This means that the vehicle can continue operating in a reduced, secure system mode until the error is fixed or resolved.

Why is this Important?

Errors are inevitable in technology, but the NX NextMotion system ensures that your vehicle responds intelligently to maintain safety in any situation. With differentiated error handling and a solid degradation strategy, the system remains safely operational for as long as possible.

9. Dual ASIL D and the Dual-Lane Concept:

  • Eight cores per side (A and B): Each lane contains eight cores, totaling 16, providing complete redundancy for critical functions such as steering, braking, and acceleration.
  • Two ASIL D paths: Using two ASIL D lanes significantly increases availability, allowing continued operation even if one lane fails.
  • Absolutely no single points of failure: The system is designed so that no single failure could ever lead to a complete system failure. If one lane fails, the other lane assumes all safety-critical tasks.
  • Future-proof architecture: The dual-lane architecture with eight cores and two processors per side, plus four spare cores, provides high flexibility for future scalability. This ensures seamless compatibility with new technologies and advanced safety features. Looking ahead to the next generation, the architecture is already designed to be hardware-ready for high-volume production—with two fully independent processors to guarantee maximum safety and performance.
Why Two ASIL D and the Dual-Lane Concept?

In designing the NX NextMotion system, safety and availability were top priorities. Although it would technically be possible to achieve ASIL D (Automotive Safety Integrity Level D) with a single microprocessor per side, we chose to use two ASIL D paths with eight processing cores per side in a dual-lane concept. Here are the reasons: Increased Availability, Safe Driving in Degradation Mode and Redundancy for Critical Tasks

Increased Availability

By using two ASIL D paths, we significantly increase the system’s availability. Even in the event of multiple errors, the vehicle can continue operating in fail-operational mode for an extended period. This enables maximum uptime and minimizes downtime.

Safe Driving in Degradation Mode

The dual-lane concept enables safe operation in degradation mode. Should a critical component fail, the system can switch to the backup lane, allowing the vehicle to continue operating safely, though at a reduced capacity. This gives the driver more time to reach a workshop, even if it is far away.

Redundancy for Critical Tasks

Each lane is equipped with eight processing cores, providing full redundancy for critical tasks such as braking, steering, and acceleration. This ensures that both lanes can independently perform these functions at the highest safety standard, far exceeding ASIL D requirements.

Future-Proof System

By integrating two lanes with eight processing cores each, we’ve created a system architecture that is not only safe but also scalable. This configuration allows for future software and hardware upgrades, ensuring the system is always ready for new safety features while maintaining its integrity over time. Looking toward the next generation, we designed the architecture to be mass-production ready. The two independent processors per lane provide a redundant and high-performance platform that ensures safety, efficiency, and cost-effectiveness for mass production. Our vision of future-proof technology is already being realized today!

Why is this Important?

With the dual-lane concept using two ASIL D paths and eight processing cores per side, the NX NextMotion system doesn’t just meet industry standards—it exceeds them. This system is essentially aerospace-grade. It offers maximum availability, extended safe operation in degradation mode, and future-proof scalability. This approach prioritizes safety and ensures that your vehicle maintains optimal performance and reliability under all conditions.

10. Our Safety Logic: The Double Safety Net for Maximum Reliability

Our NX NextMotion System incorporates two FPGAs (Field Programmable Gate Arrays)—one per lane—to ensure the highest level of safety. These serve as external safety monitoring instances that keep an eye on the entire system at all times. If an error occurs anywhere in the system, the Safety Logic ensures that the optimal part of the system takes control.

  • Continuous monitoring: Both FPGAs continuously check sensors, processors, and motors for errors and immediately intervene if issues arise.
  • Double protection: In case of a failure, the second FPGA takes over to ensure uninterrupted safety.
FPGA: The Double Safety Net – How Two FPGAs Provide Ultimate Protection

In a state-of-the-art system like NX NextMotion, one layer of safety isn’t enough. That’s why we’ve incorporated a double safety net with two Field Programmable Gate Arrays (FPGAs)—one FPGA unit on each side of the system. These FPGAs act as external safety monitors, ensuring that your vehicle is always ready to protect you with the highest precision, no matter what happens.

What Do the Two FPGAs Do?

Think of the two FPGAs as a pair of ever-watchful security guards, each monitoring one side of the system. Their job is to constantly monitor all critical components—from sensors to processors to motors—and intervene immediately if any issues arise.

  • Continuous Monitoring on Both Sides: Each FPGA is responsible for continuously checking the status of components on its side. Sensors, motors, and processors regularly send signals to the FPGA to confirm they’re working properly. If an error is detected on one side, the FPGA immediately switches to backup components to keep everything running smoothly.
  • Error Management: If a critical issue occurs on one side, the FPGA takes control to ensure the system responds appropriately. The two FPGAs work together to reorganize operations, allowing the vehicle to continue running safely even in the event of multiple errors or to bring it to a safe stop.
Intelligent Decision-Making

The two FPGAs in the NX NextMotion system act as decision-makers in critical situations. Each side of the system has multiple redundant processing cores responsible for critical tasks like steering and braking. If one of these cores shows signs of failure, the FPGAs step in to activate the most reliable path within the system.

  • Quality Over Quantity Decisions: The FPGAs don’t randomly choose cores or select based on majority votes. They evaluate the reliability of each path based on past performance to ensure the system always operates with the most trustworthy data.
Why Two FPGAs Are Important

By integrating two FPGAs into the NX NextMotion system, we double the protection. While the main components handle daily operations, the FPGAs are always in the background, ready to act as ultimate safety guards. If a problem arises on one side of the system, the other side is prepared to maintain operations without interruption.

This double safety net ensures that your vehicle is equipped for any situation. The FPGAs continuously monitor the system’s status, intervene when necessary, and make real-time decisions to ensure everything runs smoothly.

Always Ready, Always Protected

With two independent FPGAs, the NX NextMotion system guarantees that safety is never compromised. No matter what happens, you’re protected by a powerful and intelligent backup system that keeps your vehicle reliable and safe at all times.

Mathias Koch
Vice President Business and Corporate Development