Search

Future embedded systems and services will be seamlessly connected and will interact on all levels with the infrastructure and cloud. For safety-critical applications this means that it is not sufficient to ensure dependability in a single embedded system, but it is necessary to cover the complete service chain including all involved embedded systems as well as involved services running in the edge or the cloud. However, for the development of such Cyber-Physical Systems-of-Systems (CPSoS) engineers must consider all kinds of dependability requirements. For example, it is not an option to ensure safety by impeding reliability or availability requirements. In fact, it is the engineers’ task to optimize the CPSoS’ performance without violating any safety goals.

Co-working and interaction of automated systems and humans in a warehouse is a significant challenge of progressing industrial systems’ autonomy. Especially, blind corners pose a critical scenario, in which infrastructure-based sensors can provide more safety. The automation of vehicles is usually tied to an argument on improved safety. However, current standards still rely on the awareness of humans to avoid collisions, which is limited at corners with occlusion. Based on the examination of blind corner scenarios in a warehouse, we derive the relevant critical situations. We propose an architecture that uses infrastructure sensors to prevent human-robot collisions at blind corners with respect to automated forklifts. This includes a safety critical function using wireless communication, which sporadically might be unavailable or disturbed. Therefore, the proposed architecture is able to mitigate these faults and gracefully degrades performance if required. Within our extensive evaluation, we use a warehouse simulation to verify our approach and to estimate the impact on an automated forklift’s performance.

Embedded systems, e.g., self-driving systems and advanced driver-assistance systems (ADAS), require computing platforms with high computing power and low power consumption. Multi-/many-core platforms satisfy these requirements effectively. However, for hard real-time applications, multiple demands on shared resources can impede real-time performance, and memory is one resource that can impair the desired performance significantly. Therefore, it is important that memory access timing be deterministic to facilitate predictability. To realize this, the Logical Execution Time (LET) paradigm is currently attracting attention. This paper proposes a theoretical scheduling method for a model applying the LET paradigm to directed acyclic graph (DAG) nodes for a multi-/many-core platform. The proposed method considers communication timing between nodes and generates a schedule that does not cause communication contentions. In addition, the proposed method attempts to distribute tasks and reduce LET intervals to address increased execution times due to the implementation of the LET paradigm. In the evaluation, we observed that the proposed method improved the schedule length by up to 40%.

Computing platforms for embedded systems are increasingly being transformed into multi/many-core platforms because embedded systems have become extensive, complex, and automated. In the case of an autonomous driving system, various applications are simultaneously running, and low power consumption and large-scale calculation are required. Many-core processors with a multiple instruction, multiple data (MIMD) architecture can meet these requirements. This paper proposes a scheduling algorithm for an automotive driving system expressed in a directed acyclic graph (DAG) and we use Kalray MPPA-256 as the target many-core processor. On the basis of the architecture of Kalray MPPA-256, task processing that requires large-scale calculation and intercore communication is performed while avoiding communication contention by using a proposed grouping computational resource. In addition, we propose a scheduling method for a multi-rate DAG which is a DAG with multiple periods. This method generates a DAG task in a hyperperiod and schedules the DAG with dependency on tasks that have been released closely. The formulas for prioritization and processor selection are proposed for various generated tasks in a hyperperiod. Evaluation results show that the proposed algorithm is superior to existing DAG scheduling algorithms with regard to schedulability and deadline miss ratio.

Rising automation levels in the automotive domain demand a shift from the fail-safe to the fail-operational paradigm. Fail-operational architectures and behaviors are inherently more complex and thus require special diligence from a safety engineering point of view. In this work, we present how we tailored and applied a methodology that facilitates the design of fail-operational architectures from early design stages on by enabling informed judgment regarding the gradually evolved architecture's fitness for purpose. The method specifically considers resilience regarding dynamic changes in environmental conditions, including V2X aspects and internal capabilities. In this paper, we summarize our experiences in applying the methodology in a highway pilot case study. Furthermore, we present essential extensions of the methodology for modeling and evaluating the operational design domain.

The application of cyber-physical systems (CPSs) in safety-critical application domain requires rigorous verification of their functional correctness and safety-relevant properties. We propose a practical verification process which enables to conduct safety verification of safety critical CPSs. The verification process consists of (a) a system model construction method, which generates a system model by combining software described in C and plant model code reused from model-based development, (b) a model transformation method, which transforms the plant models including differential algebraic equations (DAE) to approximate models without DAE to reduce verification complexity induced by DAE solver execution, (c) a model simplification framework, which enables the simplification of bond-graph plant models using domain-knowledge-based replacement of complex model components for further verification overhead reductions, and (d) a formal verification based on symbolic execution. We implemented the proposed methods and framework, and successfully applied the proposed verification process for safety verification of automotive brake control systems. The results of the study demonstrate that the verification detects a complex failure condition in a real-world brake control system from the generated system model and that the automated model transformations of the CPS models yield significant verification complexity reductions without impairing the ability to detect unsafe behavior. © 2017 Information Processing Society of Japan.

An autonomous driving system requires the safety and availability of automated driving. For example, an autonomous driving system with automation level 3 requires the functions to request the driver to take over driving and to sustain safe automated driving until the driver accepts the request if a hardware failure occurs. However, there is a demand to continue automated driving if the system maintains sufficient performance for automated driving after the failure occurs. Therefore, we propose a graceful degradation design process to improve the automated driving continuation rate by defining degradation functions against performance limitation and hardware failure. The process integrates and extends ISO/PAS 21448 and ISO26262 and carries out these tasks in the order of system-level, ECU-level, and microcontroller-level degradation design. Furthermore, we propose a framework to calculate worst-case mode switch time (WCMST), which means the time duration from failure detection to degradation processing, by utilizing degradation design results. To evaluate the proposed process and framework, we applied them to the prototype system with automation level 3. The evaluation results showed that the designed system can sustain automated driving against 86.1% of performance degradation factors and that the framework can improve the calculation accuracy of WCMST by 35.3%.

Highly automated and autonomous driving is a major trend and vast amounts of effort and resources are presently being invested in the development of corresponding solutions. However, safety assurance is a concern, as established safety engineering standards and methodologies are not sufficient in this context. In this paper, we elaborate the fundamental safety engineering steps that are necessary to create safe vehicles of higher automation levels. Furthermore, we map these steps to the guidance presently available in existing (e.g., ISO26262) and upcoming (e.g., ISO PAS 21448) standards and point out open gaps. We then outline an approach for overcoming the identified deficiencies by integrating three different safety engineering disciplines. This includes (1) creating a safe nominal behavior specification; (2) dealing with functional insufficiencies, and (3) assuring the related performance wrt. functional safety. We exemplify our proposed methodology with a case study from industry.

Automotive control systems typically have latency requirements for certain cause-effect chains. When implementing and integrating these systems, these latency requirements must be guaranteed e.g. by applying a worst-case analysis that takes all indeterminism and limited predictability of the timing behaviour into account. In this paper, we address the latency analysis for multi-rate distributed cause-effect chains considering staticpriority preemptive scheduling of offset-synchronised periodic tasks. We particularly focus on data age as one representative of the two most common latency semantics. Our main contribution is an Mixed Integer Linear Program-based optimisation to select design parameters (priorities, task-to-processor mapping, offsets) that minimise the data age. In our experimental evaluation, we apply our method to two real-world automotive use cases., Publications Institute of Computer and Network Engineering

The application of cyber-physical systems (CPSs) in safety-critical applications requires rigorous verification of their functional correctness and safety-relevant properties. We propose a practical verification framework which enables to fill the gaps between model-based development and the formal verification process seamlessly connecting them. The verification framework consists of (a) a model transformation method, which automatically transforms the plant models of CPSs including differential algebraic equations (DAE) to equivalent models without DAE to reduce verification complexity induced by DAE solver execution, and (b) a model simplification method, which automatically simplifies bond-graph models by replacing complex bond-graph components with simpler components for further verification overhead reductions. We successfully applied the proposed verification framework for safety verification of an automotive brake control system. The results of the study demonstrate that the automated model transformations of the CPS models yield significant verification complexity reductions without impairing the ability to detect unsafe behavior of the brake control system in a formal verification based on symbolic execution.

Cyber-Physical Systems (CPS) linking computing to physical systems are often used to monitor and controlsafety-critical processes, i.e. processes that bear the potential to cause significant damage or loss in the case of failures. While safety-critical systems have been extensively studied in both the discrete (computing) and analog (control) domains, the developed techniques apply to either one domain or the other. As cyber-physical systems span both domains, the focus on an individual domain leaves a gap on the systemlevel, where complex interactions between the domains can lead to failures that cannot be analyzed by considering only the physical orthe digital part of the integrated CPS. We discuss such a complex failure condition in a real-world brakecontrol system, and demonstrate its detection using a formalverification approach specifically targeting CPS.