This paper presents a control/scheduling co-design framework that integrates 5G Configured Grant (CG) scheduling with networked control systems (NCS) design. The objective is to minimize the hyperperiod induced by multiple, applicationspecific sampling periods, which determines the schedule table size and memory footprint at the base station, subject to control quality and wireless resource limits. Hyperperiod minimization under control and resource constraints is nontrivial due to the combinatorial nature of discrete sampling period choices. To address this challenge, we propose a two-stage Hyperperiod-Minimization-oriented Period Assignment (HMPA) method. In the first stage, HMPA performs a feasibility-oriented period search within candidate period sets constructed from restricted primes and exponents, which bound the hyperperiod. In the second stage, a hyperperiod refinement procedure exploits remaining resource slack to further reduce the hyperperiod while preserving feasibility. Experiments demonstrate the efficiency of the proposed framework in terms of finding solutions with significantly reduced hyperperiods.

Cyber-physical systems are getting increasingly connected to cellular and wireless networks. As a prominent example, the automotive industry has witnessed a rapid increase in embedded software and electronics, and lately also increased connectivity to cellular communication networks. This trend enables the deployment of applications on network edge computers, offering opportunities for reduced embedded hardware footprint and increased expandability of new applications. Put differently, the traditional automotive platform comprising embedded networked processors expands to the cellular network and edge computing services in its environment. For real-time applications, which are very common in the automotive domain, the aforementioned trend gives rise to completely new challenges in that mobility and the underlying cellular network impact the temporal properties and the design and implementation decisions of the application. In this paper, we address the problem of synthesizing task allocation of real-time applications in the embedded-edge compute continuum, with key considerations for mobility and minimization of embedded compute utilization. We present an exact SMT-based solution as well as efficient heuristics with extensive experimental evaluations.

Ethernet communication technology is growing in deployments across many real-time embedded systems. Through the IEEE 802.1 standardization group, Ethernet has been enhanced with several protocols and traffic scheduling policies, commonly known as Time-Sensitive Networking (TSN). Timetriggered communication is a common approach in TSN, but unfortunately not able to meet timing constraints for applications with very stringent real-time requirements. Past work has addressed this issue by combining time-aware scheduling with frame preemption, another key TSN standard. While frame preemption enhances schedulability, it comes with additional hardware cost for endpoints and switches. To reconcile the requirements of low-cost, real-time applications, this paper addresses the joint problem of minimizing hardware preemption cost and scheduling real-time communications across packetswitched Ethernet networks. We propose a monolithic SMT solution as well as efficient heuristic approaches to minimize cost and synthesize preemptable time-triggered network schedules. The proposed approaches have been evaluated through extensive experiments.

The fifth-generation (5G) technology standard in telecommunications is expected to support ultra-reliable low latency communication to enable real-time applications such as industrial automation and control. 5G configured grant (CG) scheduling features a pre-allocated periodicity-based scheduling approach, which reduces control signaling time and guarantees service quality. Although this enables 5G to support hard real-time periodic traffics, synthesizing the schedule efficiently and achieving high resource efficiency, while serving multiple communications, are still an open problem. In this work, we study the trade-off between scheduling flexibility and control overhead when performing CG scheduling. To address the CG scheduling problem, we first formulate it using satisfiability modulo theories (SMT) so that an SMT solver can be used to generate optimal solutions. To enhance scalability, we propose two heuristic approaches. The first one as the baseline, Co1, follows the basic idea of the 5G CG scheduling scheme that minimizes the control overhead. The second one, CoU, enables increased scheduling flexibility while considering the involved control overhead. The effectiveness and scalability of the proposed techniques and the superiority of CoU compared to Co1 have been evaluated using a large number of generated benchmarks as well as a realistic case study for industrial automation.

research-article Share on Introduction to the Special Issue on Automotive CPS Safety & Security: Part 2 Authors: Samarjit Chakraborty The University of North Carolina at Chapel Hill, Chapel Hill, United States The University of North Carolina at Chapel Hill, Chapel Hill, United States 0000-0002-0503-6235View Profile , Somesh Jha University of Wisconsin-Madison, Madison, United States University of Wisconsin-Madison, Madison, United States 0000-0001-5877-0436View Profile , Soheil Samii Linköping University, Linkoping, Sweden Linköping University, Linkoping, Sweden 0000-0002-9572-1091View Profile , Philipp Mundhenk Robert Bosch GmbH, Renningen, Germany Robert Bosch GmbH, Renningen, Germany 0000-0001-6132-3901View Profile Authors Info & Claims ACM Transactions on Cyber-Physical SystemsVolume 8Issue 2Article No.: 10pp 1–17https://doi.org/10.1145/3650210Published:15 May 2024Publication History 0citation71DownloadsMetricsTotal Citations0Total Downloads71Last 12 Months71Last 6 weeks42 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Publisher SiteGet Access

One might argue that automotive and allied domains like robotics serve as the best possible examples of what “cyber-physical systems” (CPS) are. Here, the correctness of the underlying electronics and software (or cyber) components are defined by the dynamics of the vehicle or the robot, viz., the physical components of the system. This shift in perspective on how electronics and software should be modeled and synthesized, and how their correctness should be defined, has led to a tremendous volume of research on CPS in recent times [7, 8, 43, 56]. At the same time, the volume of electronics and software in modern cars has also grown tremendously. Today, high-end cars have more than 100 control computers or electronic control units (ECUs) embedded in them, that run hundreds of millions of lines of software code implementing a range of diverse functions. These functions span across engine and brake control, to the body and entertainment domains. Cars are also equipped with a variety of cameras, radars, and lidar sensors that are used to perceive the external world and take the appropriate control actions as a part of driver assistance features that are common today. As such features continue to accelerate the evolution and adoption of fully autonomous vehicles, the role of electronics and software in the automotive domain is increasing at an unprecedented pace, and modern automobiles are now aptly referred

5G is expected to support ultra-reliable low latency communication to enable real-time applications such as industrial automation and control. 5G configured grant (CG) scheduling features a pre-allocated periodicity-based scheduling approach which reduces control signaling time and guarantees service quality. Although this enables 5G to support hard real-time periodic traffics, efficiently synthesizing the schedule and achieving high resource efficiency while serving multiple traffics, is still an open problem. To address this problem, we first formulate it using satisfiability modulo theories (SMT) so that an SMT-solver can be used to generate optimal solutions. For enhancing scalability, two efficient heuristic approaches are proposed. The experiments demonstrate the effectiveness and scalability of the proposed technique.

Deep neural network (deepnet) applications play a crucial role in safety-critical systems such as autonomous vehicles (AVs). An AV must drive safely towards its destination, avoiding obstacles, and respond quickly when the vehicle must stop. Any transient errors in software calculations or hardware memory in these deepnet applications can potentially lead to dramatically incorrect results. Therefore, assessing and mitigating any transient errors and providing robust results are important for safety-critical systems. Previous research on this subject focused on detecting errors and then recovering from the errors by re-running the network. Other approaches were based on the extent of full network duplication such as the ensemble learning-based approach to boost system fault-tolerance by leveraging each model’s advantages. However, it is hard to detect errors in a deep neural network, and the computational overhead of full redundancy can be substantial.We first study the impact of the error types and locations in deepnets. We next focus on selecting which part should be duplicated using multiple ranking methods to measure the order of importance among neurons. We find that the duplication overhead for computation and memory is a trade-off between algorithmic performance and robustness. To achieve higher robustness with less system overhead, we present two error protection mechanisms that only duplicate parts of the network from critical neurons. Finally, we substantiate the practical feasibility of our approach and evaluate the improvement in the accuracy of a deepnet in the presence of errors. We demonstrate these results using a case study with real-world applications on an Nvidia GeForce RTX 2070Ti GPU and an Nvidia Xavier embedded platform used by automotive OEMs.

Time-Sensitive Networking (TSN) is a set of IEEE 802.1 technologies that support real-time and reliable Ethernet communication, commonly used in automotive and industrial automation systems. Time-aware scheduling is adopted in TSN to achieve high temporal predictability. In this paper, we demonstrate that such a scheduling solution alone does not always meet all timing requirements and must be combined with network preemption support. We propose an SMT-based synthesis method for preemptive time-triggered scheduling and routing in TSN. Our experiments demonstrate that schedulability is improved significantly when using frame preemption compared to a standard time-triggered message scheduling approach.

Security for outsourced control applications can be provided if the physical plant is enabled with a mechanism to verify the control signal received from the cloud. Recent developments in modern cryptography claim the applicability of verifiable computation techniques. Such techniques allow a client to check the correctness of a remote execution. This article delivers a proof of concept for applicability of the verifiable computation scheme to control applications over the cloud. We showcase the practicality of verifiable computation on physical plants with different timing demands and deliver a real-life example using a watertank system as the client and Microsoft Azure as the cloud. We show the effectiveness of the verifiable computation scheme on cloud-based implementation of advanced control methods, such as Model Predictive Control.

Due to their real-time constraints and high predictability requirements, safety-critical automotive applications are often implemented using time-triggered communication scheduling, which is supported in the Time-Sensitive Networking (TSN) standards. Applications and network communications are assigned Automotive Safety Integrity Levels (ASILs) based on the ISO 26262 standard for functional safety in automotive systems. ISO 26262 outlines, for each ASIL, requirements on coverage of random hardware errors and systematic errors. Prior research has addressed routing and scheduling for time-triggered messages in TSN in the context of random hardware errors and optimization of reliability metrics. However, no work to date has considered the functional safety aspects of addressing systematic errors. Specific to systematic errors, the ISO 26262 standard defines ASIL decomposition as a vehicle to decompose functions into independent components, each with a lower safety requirement than that of the original function. Since the cost of a component is increasing with its ASIL, decomposition can lower the total cost while still meeting the original safety requirements. In this paper, we propose an ASIL decomposition based technique to introduce redundant communication with lower-ASIL components in Ethernet systems with TSN-based time-triggered communication. The ASIL-aware routing and scheduling of messages are determined such that all safety requirements and end-to-end deadlines are satisfied and, at the same time, the total cost of the employed switches is minimized. Extensive experiments have been conducted to evaluate the efficiency of the proposed framework.

Feedback control loops are ubiquitous in any autonomous system. The design flow for any controller starts by determining a control strategy, while abstracting away all implementation details. However, when designing controllers for autonomous systems, there is significant computation associated with the perception modules. For example, this involves vision processing using deep neural networks on multicore CPU+accelerator platforms. Such computation can be organized in many different ways, with each choice resulting in very different sensor-to-actuator delays and tradeoffs between cost, delay, and accuracy. Further, each of these choices requires the control strategy to be designed accordingly. It is not possible for a control designer to enumerate and account for all of these choices manually, or abstract them away as "implementation details" as done in traditional controller design. In this paper we outline this problem and discuss how automated controller-synthesis techniques could help in addressing it.

Time-sensitive Networking (TSN) on Ethernet is a promising communication technology in the automotive and industrial automation industries due to its real-time and high-bandwidth communication capabilities. Time-triggered scheduling and static routing are often adopted in these areas due to high requirements on predictability for safety-critical applications. Deadline-constrained routing and scheduling in TSN have been studied extensively in past research. However, scheduling and routing with reliability requirements in the context of transient faults are not yet studied. In this work, we propose an Satisfiability Modulo Theory-based technique to perform scheduling and routing that takes both reliability constraints and end-to-end deadline constraints into consideration. Heuristics have been applied to improve the scalability of the solution. Extensive experiments have been conducted to demonstrate the efficiency of our proposed technique.

Editor's notes: The cross-layer approach presented in this article involves co-designing a feedback controller's parameters together with the schedule of an Ethernet network used for communicating state information and control signals.-Samarjit Chakraborty, University of North Carolina at Chapel Hill

Hardware accelerators such as GP-GPUs, Tensor Cores, and Deep-Learning Accelerators (DLA) are increasingly being used in real-time settings such as autonomous vehicles (AVs). In such deployments, any software errors and process failures in hardware systems can lead to critical faults in AVs. Therefore, assessing and mitigating hardware accelerator faults are critical requirements for safety-critical systems. Past work on this subject focused on simulated and injected software and hardware faults to understand and analyze the behavior of the software stack and the entire system. However, programming errors and process failures caused when using software frameworks must also be considered. In this paper, we present experiments which show that widely used deep-learning frameworks are vulnerable to programming mistakes and errors. We first focus on memory-related programming errors caused by applications using deep-learning frameworks that facilitate high-performance inferencing. We next find that a reset to recover from any fault imposes significant time penalties in reloading a pre-trained deep neural network model. To reduce these fault recovery times, we propose fault recovery mechanisms that checkpoint and resume the network based on the inference stage when an error is detected. Finally, we substantiate the practical feasibility of our approach and evaluate the improvement in recovery times 1 1 A demo video clip demonstrating our recovery algorithm has been uploaded to Youtube: https://www.youtube.com/watch?v=xwUYdJdA5oM.. We use a case-study with real-world applications on an Nvidia GeForce GTX 1070 GPU and an Nvidia Xavier embedded platform, which is commonly used by multiple automotive OEMs.

Modern automobiles with driving-assist features are inherently safety-critical. Strict safety requirements and the introduction of self-driving capabilities have increased the demands on the computing and communication systems within automobiles. The AUTomotive Open System ARchitecture (AUTOSAR) Adaptive platform aims to meet these industry requirements by supporting high-performance computing devices and high-bandwidth communication technologies. The AUTOSAR Adaptive platform leverages Scalable service-Oriented MiddlewarE over IP (SOME/IP), an automotive middleware solution, that supports the exchange of control messages across various devices of different sizes and operating systems. Typically, in order to guarantee the safe execution of software, automobiles employ redundancy for crucial software tasks to tolerate permanent crash faults. The Adaptive AUTOSAR standard does not specify any fault-tolerance requirements. In this paper, we highlight some gaps in the current AUTOSAR Adaptive Platfrom standard (version 18.10) and provide suggestions to address them. We present our framework to support fault-tolerant execution using different replication strategies for the AUTOSAR Adaptive Platform. We analyze the fault detection and recovery-time bounds of our solution for applications using SOME/IP. We validate our model experimentally and present our evaluation results.

Modern hardware accelerators such as GP-GPUs and DSPs are commonly being used in real-time settings such as high-performance multimedia systems and autonomous vehicles. In fact, the throughput of a wide variety of computationally demanding tasks from 3D graphics and rendering to image processing and deep learning can benefit from such specialized hardware. Such heterogeneity can affect the performance of applications running simultaneously on the same accelerator. Prior studies on resource sharing and scheduling on hardware accelerators have not attempted to account for this context. In this work, we provide a portable tagging-based cooperative scheduler and resource monitor for use by heterogeneous applications sharing a single hardware accelerator in a soft real-time environment. We also offer practical insight into how various types of applications use the hardware accelerators differently. We substantiate the feasibility of our approach and evaluate the improvement of various scheduling policies over a proprietary scheduler in several case-studies with real-world applications on 2 NVIDIA platforms: a GeForce GTX 1070 GPU and an Xavier embedded platform 1 . Although we focus on GPUs in this paper, our underlying observations and framework can also be used for sharing execution on other types of hardware accelerators. 1 The video demo has been uploaded to https://youtu.be/pziS1btsr9c

Switched Ethernet has been, and will also be increasingly common in current and future real-time and embedded systems. The IEEE 802.1 working group has recently developed standards and technologies, commonly referred to as Time-Sensitive Networking (TSN), to enhance switched Ethernet with timeliness and dependability. We address, for the first time, the synthesis problem for the TSN frame preemption standards IEEE 802.3br-2016 and 802.1Qbu-2016 by introducing two new configuration parameters: flow to queue and queue to Express/Preemptable MAC interface assignments. We present an optimization framework to determine these configuration parameters with reliability as the optimization goal. Our proposed framework is shown to outperform commonly used priority-assignment as well as intuitive approaches.

Due to the advent of active safety features and automated driving capabilities, the complexity of embedded computing systems within automobiles continues to increase. Such advanced driver assistance systems (ADAS) are inherently safety-critical and must tolerate failures in any subsystem. However, fault-tolerance in safety-critical systems has been traditionally supported by hardware replication, which is prohibitively expensive in terms of cost, weight, and size for the automotive market. Recent work has studied the use of software-based fault-tolerance techniques that utilize task-level hot and cold standbys to tolerate fail-stop processor and task failures. The benefit of using standbys is maximal when a task and any of its standbys obey the placement constraint of not being co-located on the same processor. We propose a new heuristic based on a “tiered” placement constraint, and show that our heuristic produces a better task assignment that saves at least one processor up to 40% of the time relative to the best known heuristic to date. We then introduce a task allocation algorithm that, for the first time to our knowledge, leverages the run-time attributes of cold standbys. Our empirical study finds that our heuristic uses no more than one additional processor in most cases relative to an optimal allocation that we construct for evaluation purposes using a creative technique. We also extend our heuristic to support mixed-criticality systems which allow for overload operation. We have designed and implemented our software fault-tolerance framework in AUTOSAR, an automotive industry standard. We use this implementation to provide an experimental evaluation of our task-level fault-tolerance features. Finally, we present an analysis of the worst-case behavior of our task recovery features.

Increasing internet connectivity poses an existential threat for cyber-physical systems. Securing these safety-critical systems becomes an important challenge. Cyber-physical systems often comprise several control applications that are implemented on shared platforms where both high and low criticality tasks execute together (to reduce cost). Such resource sharing may lead to complex timing behaviors and, in turn, counter-intuitive timing anomalies that can be exploited by adversaries to destabilize a critical control system, resulting in irreversible consequences. We introduce the butterfly attack, a new attack scenario against cyber-physical systems that carefully exploits the sensitivity of control applications with respect to the implementation on the underlying execution platforms. We illustrate the possibility of such attacks using two case-studies from the automotive and avionic domains.