Search

Future embedded systems and services will be seamlessly connected and will interact on all levels with the infrastructure and cloud. For safety-critical applications this means that it is not sufficient to ensure dependability in a single embedded system, but it is necessary to cover the complete service chain including all involved embedded systems as well as involved services running in the edge or the cloud. However, for the development of such Cyber-Physical Systems-of-Systems (CPSoS) engineers must consider all kinds of dependability requirements. For example, it is not an option to ensure safety by impeding reliability or availability requirements. In fact, it is the engineers’ task to optimize the CPSoS’ performance without violating any safety goals.

Co-working and interaction of automated systems and humans in a warehouse is a significant challenge of progressing industrial systems’ autonomy. Especially, blind corners pose a critical scenario, in which infrastructure-based sensors can provide more safety. The automation of vehicles is usually tied to an argument on improved safety. However, current standards still rely on the awareness of humans to avoid collisions, which is limited at corners with occlusion. Based on the examination of blind corner scenarios in a warehouse, we derive the relevant critical situations. We propose an architecture that uses infrastructure sensors to prevent human-robot collisions at blind corners with respect to automated forklifts. This includes a safety critical function using wireless communication, which sporadically might be unavailable or disturbed. Therefore, the proposed architecture is able to mitigate these faults and gracefully degrades performance if required. Within our extensive evaluation, we use a warehouse simulation to verify our approach and to estimate the impact on an automated forklift’s performance.

Computing platforms for embedded systems are increasingly being transformed into multi/many-core platforms because embedded systems have become extensive, complex, and automated. In the case of an autonomous driving system, various applications are simultaneously running, and low power consumption and large-scale calculation are required. Many-core processors with a multiple instruction, multiple data (MIMD) architecture can meet these requirements. This paper proposes a scheduling algorithm for an automotive driving system expressed in a directed acyclic graph (DAG) and we use Kalray MPPA-256 as the target many-core processor. On the basis of the architecture of Kalray MPPA-256, task processing that requires large-scale calculation and intercore communication is performed while avoiding communication contention by using a proposed grouping computational resource. In addition, we propose a scheduling method for a multi-rate DAG which is a DAG with multiple periods. This method generates a DAG task in a hyperperiod and schedules the DAG with dependency on tasks that have been released closely. The formulas for prioritization and processor selection are proposed for various generated tasks in a hyperperiod. Evaluation results show that the proposed algorithm is superior to existing DAG scheduling algorithms with regard to schedulability and deadline miss ratio.

Rising automation levels in the automotive domain demand a shift from the fail-safe to the fail-operational paradigm. Fail-operational architectures and behaviors are inherently more complex and thus require special diligence from a safety engineering point of view. In this work, we present how we tailored and applied a methodology that facilitates the design of fail-operational architectures from early design stages on by enabling informed judgment regarding the gradually evolved architecture's fitness for purpose. The method specifically considers resilience regarding dynamic changes in environmental conditions, including V2X aspects and internal capabilities. In this paper, we summarize our experiences in applying the methodology in a highway pilot case study. Furthermore, we present essential extensions of the methodology for modeling and evaluating the operational design domain.

An autonomous driving system requires the safety and availability of automated driving. For example, an autonomous driving system with automation level 3 requires the functions to request the driver to take over driving and to sustain safe automated driving until the driver accepts the request if a hardware failure occurs. However, there is a demand to continue automated driving if the system maintains sufficient performance for automated driving after the failure occurs. Therefore, we propose a graceful degradation design process to improve the automated driving continuation rate by defining degradation functions against performance limitation and hardware failure. The process integrates and extends ISO/PAS 21448 and ISO26262 and carries out these tasks in the order of system-level, ECU-level, and microcontroller-level degradation design. Furthermore, we propose a framework to calculate worst-case mode switch time (WCMST), which means the time duration from failure detection to degradation processing, by utilizing degradation design results. To evaluate the proposed process and framework, we applied them to the prototype system with automation level 3. The evaluation results showed that the designed system can sustain automated driving against 86.1% of performance degradation factors and that the framework can improve the calculation accuracy of WCMST by 35.3%.

Highly automated and autonomous driving is a major trend and vast amounts of effort and resources are presently being invested in the development of corresponding solutions. However, safety assurance is a concern, as established safety engineering standards and methodologies are not sufficient in this context. In this paper, we elaborate the fundamental safety engineering steps that are necessary to create safe vehicles of higher automation levels. Furthermore, we map these steps to the guidance presently available in existing (e.g., ISO26262) and upcoming (e.g., ISO PAS 21448) standards and point out open gaps. We then outline an approach for overcoming the identified deficiencies by integrating three different safety engineering disciplines. This includes (1) creating a safe nominal behavior specification; (2) dealing with functional insufficiencies, and (3) assuring the related performance wrt. functional safety. We exemplify our proposed methodology with a case study from industry.

Automotive control systems typically have latency requirements for certain cause-effect chains. When implementing and integrating these systems, these latency requirements must be guaranteed e.g. by applying a worst-case analysis that takes all indeterminism and limited predictability of the timing behaviour into account. In this paper, we address the latency analysis for multi-rate distributed cause-effect chains considering staticpriority preemptive scheduling of offset-synchronised periodic tasks. We particularly focus on data age as one representative of the two most common latency semantics. Our main contribution is an Mixed Integer Linear Program-based optimisation to select design parameters (priorities, task-to-processor mapping, offsets) that minimise the data age. In our experimental evaluation, we apply our method to two real-world automotive use cases., Publications Institute of Computer and Network Engineering

Most automotive control systems have been developed by combining legacy Electronic Control Units (ECUs) with newly developed ECUs. We need to plan the product line to utilize as many legacy ECUs as possible to lower development costs of new vehicles. However, we must develop several new gateway ECUs per new vehicle because gateway ECUs depend on the placement of other ECUs and their combinations within the whole system. The reusable gateway ECUs are needed to lower development cost. However, there is a problem in that the worst case execution time (WCET) of relay processing may be impaired in typical methods that are synchronized with the communication cycle of time-triggered networks. Therefore, we propose a Dynamic Activation Timing Configuration (DATC) for product line development, which can dynamically calculate the activation timing of relay processing from the information on message routing, slot assignment, and time-triggered network. The gateway ECUs with DATC can be dynamically adjusted to new vehicles and improve the WCET of relay processing.