Johannes Schlatow

Response-Time Analysis for Task Chains in Communicating Threads

When modelling software components for timing analysis, we typically encounter functional chains of tasks that lead to precedence relations. As these task chains represent a functionally-dependent sequence of operations, in real-time systems, there is usually a requirement for their end-to-end latency. When mapped to software components, functional chains often result in communicating threads. Since threads are scheduled rather than tasks, specific task chain properties arise that can be exploited for response-time analysis. As a core contribution, this paper presents an extension of the busy-window analysis suitable for such task chains in static-priority preemptive systems. We evaluated the extended busy-window analysis in a compositional performance analysis using synthetic test cases and a realistic automotive use case showing far tighter response-time bounds than current approaches.

Contract-based dynamic task management for mixed-criticality systems

The use of models is becoming increasingly prominent in the development processes for safety and time critical systems (e.g. in automotive or aerospace). However, oftentimes the models of a component, its implementation properties and execution parameters are only loosely coupled. This missing association complicates system maintainability and becomes an issue with increasing system flexibility. This paper presents a runtime environment closely coupling design-time component models with the execution parameters of the specific component also enabling runtime monitoring of implementation properties. Together with a previously published admission control scheme, this enables tight coupling of component-wise design-time modelling, system analysis and runtime configuration, enabling software flexibility also in mixed-criticality systems.

An Extensible Autonomous Reconfiguration Framework for Complex Component-Based Embedded Systems

We present a framework based on constraint satisfaction that adds self-integration capabilities to component-based embedded systems by identifying correct compositions of the desired components and their dependencies. This not only allows autonomous integration of additional functionality but can also be extended to ensure that the new configuration does not violate any extra-functional requirements, such as safety or security, imposed by the application domain.

Formal timing analysis of CAN-to-Ethernet gateway strategies in automotive networks

Due to increased bandwidth and scalability demands, Ethernet technology is finding its way into recent in-vehicle networks. Tomorrow’s heterogeneous networks will feature legacy buses [e.g. controller area network (CAN) or FlexRay] as well as high-speed Ethernet devices, connected by switches and gateways. As Ethernet offers significantly larger frame sizes than CAN, the efficient transmission of CAN data over an Ethernet backbone depends heavily on the way this data is multiplexed into Ethernet frames. This article focuses on the timing impact introduced by various CAN/Ethernet multiplexing strategies at the gateways. We present a formal analysis method to derive upper bounds on end-to-end latencies for complex multiplexing strategies, which is key for the design of safety-critical real-time systems. We capture complex inter-domain signal paths spanning multiple buses, gateways, and switches and show the applicability in a realistic automotive setup.

Specifying a middleware for distributed embedded vehicle control systems

The software of electric / electronic vehicle control systems is static in current series vehicles. Most of the systems do not allow maintenance or functional updates, especially in the field of driver assistance systems. Main causes are the testing effort for a software release and the wide variety of different configurations in different vehicle models. In this paper we take a closer look at the requirements for a middleware which allows such updates, verifies new software versions, and adds reconfiguration mechanisms for singular control units and distributed sets of control units. To derive the requirements we consider the general vehicular context with limitations in space, electric power, processing power, and costs together with four exemplary road vehicle control applications (cruise control, automatic parking, stability control, force feedback), and a full x-by-wire target vehicle for implementing these applications. The analysis of these three different sources of requirements results in desired middleware functionalities and requirements, especially concerning runtime timings and update timings. The requirements cover an update functionality with integrated verification, the exchange of applications on singular control units, and the degradation of functionality by switching between control units.

Self-aware systems for the internet-of-things

The IoT will host a large number of co-existing cyber-physical applications. Continuous change, application interference, environment dynamics and uncertainty lead to complex effects which must be controlled to give performance and application guarantees. Application and platform self-configuration and self-awareness are one paradigm to approach this challenge. They can leverage context knowledge to control platform and application functions and their interaction. They could play a dominant role in large scale cyber-physical systems and systems-of-systems, simply because no person can oversee the whole system functionality and dynamics. IoT adds a new dimension because Internet based services will increasingly be used in such system functions. Autonomous vehicles accessing cloud services for efficiency and comfort as well as to reach the required level of safety and security are an example. Such vehicle platforms will communicate with a service infrastructure that must be reliable and highly responsive. Automated continuous self-configuration of data storage might be a good basis for such services up to the point where the different self-x strategies might affect each other, in a positive or negative form. This paper contains three contributions from different domains representing the current status of self-aware systems as they will meet in the Internet-of-Things and closes with a short discussion of upcoming challenges.

Using Multi-Viewpoint Contracts for Negotiation of Embedded Software Updates

In this paper we address the issue of change after deployment in safety-critical embedded system applications. Our goal is to substitute lab-based verification with in-field formal analysis to determine whether an update may be safely applied. This is challenging because it requires an automated process able to handle multiple viewpoints such as functional correctness, timing, etc. For this purpose, we propose an original methodology for contract-based negotiation of software updates. The use of contracts allows us to cleanly split the verification effort between the lab and the field. In addition, we show how to rely on existing viewpoint-specific methods for update negotiation. We illustrate our approach on a concrete example inspired by the automotive domain.

Self-awareness in autonomous automotive systems

Self-awareness has been used in many research fields in order to add autonomy to computing systems. In automotive systems, we face several system layers that must be enriched with self-awareness to build truly autonomous vehicles. This includes functional aspects like autonomous driving itself, its integration on the hardware/software platform, and among others dependability, real-time, and security aspects. However, self-awareness mechanisms of all layers must be considered in combination in order to build a coherent vehicle self-awareness that does not cause conflicting decisions or even catastrophic effects. In this paper, we summarize current approaches for establishing self-awareness on those layers and elaborate why self-awareness needs to be addressed as a cross-layer problem, which we illustrate by practical examples.

Response-Time Analysis for Task Chains with Complex Precedence and Blocking Relations

For the development of complex software systems, we often resort to component-based approaches that separate the different concerns, enhance verifiability and reusability, and for which microkernel-based implementations are a good fit to enforce these concepts. Composing such a system of several interacting software components will, however, lead to complex precedence and blocking relations, which must be taken into account when performing latency analysis. When modelling these systems by classical task graphs, some of these effects are obfuscated and tend to render such an analysis either overly pessimistic or even optimistic. We therefore firstly present a novel task (meta-)model that is more expressive and accurate w.r.t. these (functional) precedence and mutual blocking relations. Secondly, we apply the busy-window approach and formulate a modular response-time analysis on task-chain level suitable but not restricted to static-priority scheduled systems. We show that the conjunction of both concepts allows the calculation of reasonably tight latency bounds for scenarios not adequately covered by related work.