Dip Goswami

A hybrid approach to cyber-physical systems verification

We propose a performance verification technique for cyber-physical systems that consist of multiple control loops implemented on a distributed architecture. The architectures we consider are fairly generic and arise in domains such as automotive and industrial automation; they are multiple processors or electronic control units (ECUs) communicating over buses like FlexRay and CAN. Current practice involves analyzing the architecture to estimate worst-case end-to-end message delays and using these delays to design the control applications. This involves a significant amount of pessimism since the worst-case delays often occur very rarely. We show how to combine functional analysis techniques with model checking in order to derive a delay-frequency interface that quantifies the interleavings between messages with worst-case delays and those with smaller delays. In other words, we bound the frequency with which control messages might suffer the worst-case delay. We show that such a delay-frequency interface enables us to verify much tigher control performance properties compared to what would be possible with only worst-case delay bounds.

Time-triggered implementations of mixed-criticality automotive software

We present an automatic schedule synthesis framework for applications that are mapped onto distributed time-triggered automotive platforms where multiple Electronic Control Units (ECUs) are synchronized over a FlexRay bus. We classify applications into two categories (i) safety-critical control applications with stability and performance constraints, and (ii) time-critical applications with only deadline constraints. Our proposed framework can handle such mixed constraints arising from timing, control stability, and performance requirements. In particular, we synthesize schedules that optimize control performance and respects the timing requirements of the real-time applications. An Integer Linear Programming (ILP) problem is formulated by modeling the ECU and bus schedules as a set of constraints for optimizing both linear or quadratic control performance functions.

Co-design of cyber-physical systems via controllers with flexible delay constraints

In this paper, we consider a cyber-physical architecture where control applications are divided into multiple tasks, spatially distributed over various processing units that communicate via a shared bus. While control signals are exchanged over the communication bus, they have to wait for bus access and therefore experience a delay. We propose certain (co-)design guidelines for (i) the communication schedule, and (ii) the controller, such that stability of the control applications is guaranteed for more flexible communication delay constraints than what has been studied before. We illustrate the applicability of our design approach using the FlexRay dynamic segment as the communication medium for the processing units.

Modular scheduling of distributed heterogeneous time-triggered automotive systems

This paper proposes a modular framework that enables a scheduling for time-triggered distributed embedded systems. The framework provides a symbolic representation that is used by an Integer Linear Programming (ILP) solver to determine a schedule that respects all bus and processor constraints as well as end-to-end timing constraints. Unlike other approaches, the proposed technique complies with automotive specific requirements at system-level and is fully extensible. Formulations for common time-triggered automotive operating systems and bus systems are presented. The proposed model supports the automotive bus systems FlexRay 2.1 and 3.0. For the operating systems, formulations for an eCos-based non-preemptive component and a preemptive OSEKtime operating system are introduced. A case study from the automotive domain gives evidence of the applicability of the proposed approach by scheduling multiple distributed control functions concurrently. Finally, a scalability analysis is carried out with synthetic test cases.

Optimizing hierarchical schedules for improved control performance

Embedded control systems typically consist of several control loops, with different parts of each control application being mapped onto different processors that communicate over one or more communication buses. In such setups, the system architecture and scheduling policies have a significant impact on control performance. In this paper we show how to optimally choose the parameters of hierarchical schedules on the communication bus in order to improve multiple control performance metrics.

Relaxing Signal Delay Constraints in Distributed Embedded Controllers

Embedded systems often involve transmitting feedback signals between multiple control tasks that are implemented on different electronic control units communicating via a shared bus. For ensuring stability and control performance, such designs require all control signals to be delivered within a specified deadline, which is ensured through appropriate timing or schedulability analysis. In this brief, we study controller design that allows control feedback signals to occasionally miss their deadlines. In particular, we provide analytical bounds on deadline misses such that the control loop retains its stability and meets its control performance requirements. We argue that such relaxation allows us to 1) use lower quality communication resources (e.g., event-triggered instead of time-triggered communication) and 2) provide more flexibility-e.g., use simulation-in communication timing analysis since analytical worst-case delay bounds for real-life communication protocols are often pessimistic. We illustrate this approach using the FlexRay communication protocol for distributed automotive control systems.

Challenges in automotive cyber-physical systems design

Systems with tightly interacting computational (cyber) units and physical systems are generally referred to as cyber-physical systems. They involve an interplay between embedded systems, control theory, real-time systems and software engineering. A very good example of cyber-physical systems design arises in the context of automotive architectures and software. Modern high-end cars have 50-100 processors or electronic control units (ECUs) that communicate over a network of buses such as CAN and FlexRay. In such complex settings, traditional control-theoretic approaches - where control engineers are only concerned with high-level plant and controller models - start breaking down. This is because implementation-level realities such as message delay, jitter, and task execution times are not adequately considered when designing the controller. Hence, it is becoming necessary to adopt a more holistic, cyber-physical systems design approach where the semantic gap between high-level control models and their actual implementations on multiprocessor automotive platforms is quantified and consciously closed. In this paper we give several examples on how this may be done and the current research challenges in this area that are being faced by the academia and the industry.

Automotive Cyber–Physical Systems: A Tutorial Introduction

This tutorial gives an introduction to novices in CPS and particularly highlights the basics of control theory with respect to automotive applications. The authors furthermore describe the “semantic gap” between control models and their implementation and conclude that a new CPS-oriented design approach is required.

Task- and network-level schedule co-synthesis of Ethernet-based time-triggered systems

In this paper, we study time-triggered distributed systems where periodic application tasks are mapped onto different end stations (processing units) communicating over a switched Ethernet network. We address the problem of application level (i.e., both task- and network-level) schedule synthesis and optimization. In this context, most of the recent works [10], [11] either focus on communication schedule or consider a simplified task model. In this work, we formulate the co-synthesis problem of task and communication schedules as a Mixed Integer Programming (MIP) model taking into account a number of Ethernet-specific timing parameters such as interframe gap, precision and synchronization error. Our formulation is able to handle one or multiple timing objectives such as application response time, end-to-end delay and their combinations. We show the applicability of our formulation considering an industrial size case study using a number of different sets of objectives. Further, we show that our formulation scales to systems with reasonably large size.

Re-engineering cyber-physical control applications for hybrid communication protocols

In this paper, we consider a cyber-physical architecture where multiple control applications are divided into multiple tasks, spatially distributed over various processing units that communicate over a bus implementing a hybrid communication protocol, i.e., a protocol with both time-triggered and event-triggered communication schedules (e.g., FlexRay). In spite of efficient utilization of communication bandwidth (BW), event-triggered protocols suffer from unpredictable temporal behavior, which is exactly the opposite in the case of their time-triggered counterparts. In the context of communication delays experienced by the control-related messages exchanged over the shared communication bus, we observe that a distributed control application is more prone to performance deterioration in transient phases compared to in the steady-state. We exploit this observation to re-engineer control applications to operate in two modes, in order to optimally exploit the bi-modal (time- and event-triggered) characteristics of the underlying communication medium. Depending on the state (transient or steady) of the system, both, the control inputs and the communication schedule are now switched. Using a FlexRay-based case study, we show that such a design provides a good trade-off between control performance and bus utilization.