Modern Safety-critical Systems Research Articles

Resilience of Reed-Solomon Codes against Single-Frequency Electromagnetic Disturbances: Fault Mechanisms and Fault Elimination through Symbol Inversion

Modern safety-critical systems depend heavily on communication networks while operating in increasingly polluted electromagnetic environments. Forward Error Correction codes are increasingly being used in safety-critical applications; however, vulnerabilities can still be caused by undetected corrupted data. Within this paper, the effectiveness of primitive Reed–Solomon Codes under single-frequency electromagnetic disturbances is assessed. Additionally, the impact of various parameters including the message length, the Reed–Solomon Codes’ symbol size, and the amplitude of the induced voltages are also investigated. Simulations show that, at harmonics and some certain ratios of the bit-rate frequency, the susceptibility of Reed–Solomon Codes relative to this type of disturbance increases substantially. In worse-case scenarios, the rate of undetected corrupted data at these ratios could increase to values above 80%. It is shown that the main reason that Reed–Solomon Codes fail to detect such errors is due to the repetitive nature of code words’ symbols, as well as a special relation among the symbol size, the channel’s bit-rate, and the disturbance frequency. Accordingly, this paper proposes to add an extra inversion layer to the communication protocol to enhance the resiliency of these codes against single-frequency electromagnetic disturbances. Finally, it is shown that the proposed layer substantially mitigates the ratio of undetected corrupted data under the considered electromagnetic environment. By using the proposed approach, the rate of undetected corrupted data at the frequencies of concern decreased to values near 0%.

CGST: Provably Secure Lightweight Certificateless Group Signcryption Technique Based on Fractional Chaotic Maps

In recent years, there has been a lot of research interest in analyzing chaotic constructions and their associated cryptographic structures. Compared with the essential combination of encryption and signature, the signcryption scheme has a more realistic solution for achieving message confidentiality and authentication simultaneously. However, the security of a signcryption scheme is questionable when deployed in modern safety-critical systems, especially as billions of sensitive user information is transmitted over open communication channels. In order to address this problem, a lightweight, provably secure certificateless technique that uses Fractional Chaotic Maps (FCM) for group-oriented signcryption (CGST) is proposed. The main feature of the CGST-FCM technique is that any group signcrypter may encrypt data/information with the group manager (GM) and have it sent to the verifier seamlessly. This implies the legitimacy of the signcrypted information/data is verifiable using the public conditions of the group, but they cannot link it to the conforming signcrypter. In this scenario, valid signcrypted information/data cannot be produced by the GM or any signcrypter in that category alone. However, the GM is allowed to reveal the identity of the signcrypter when there is a legal conflict to restrict repudiation of the signature. Generally, the CGST-FCM technique is protected from the indistinguishably chosen ciphertext attack (IND-CCA). Additionally, the computationally difficult Diffie-Hellman (DH) problems have been used to build unlinkability, untraceability, unforgeability, and robustness of the projected CGST-FCM scheme. Finally, the security investigation of the presented CGST-FCM technique shows appreciable consistency and high efficiency when applied in real-time security applications.

Resilience of Error Correction Codes Against Harsh Electromagnetic Disturbances: Fault Elimination for Triplication-Based Error Correction Codes

Modern safety-critical systems rely heavily on robust communication channels. Even though these communication channels can be protected by error detection and correction codes, vulnerabilities caused by false negatives still exist. These false negatives can be caused by harsh electromagnetic disruptions and are detrimental to overall safety. This article considers the construction and structure of triplication-based error correction codes to find the most electromagnetic interference (EMI)-resilient code. Each code is tested and simulated in terms of the occurrence rate of false negatives under single-frequency disturbances. It is found that a code with inversion is significantly more robust to these disturbances. Furthermore, a systematic fault injection is also performed to search for vulnerabilities within the code itself. The systematic approach allows us to reverse engineer the expected vulnerabilities to real-world disturbances.

Job-shifting: An algorithm for online admission of non-preemptive aperiodic tasks in safety critical systems

Abstract Modern safety critical systems require certification in order to guarantee correct operation before system deployment. The certification process requires rigorous verification and validation, the efforts for which can be greatly reduced by using resource partitioning. However, Lackorzynski et al. demonstrated that bandwidth reservation for event-triggered (ET) activities in partitioned systems may lead to significant bandwidth loss. In contrast, the online admission of ET activities can prevent bandwidth losses. However, the state-of-the-art approaches for online admission of ET activities fail to fulfill the requirements of safety critical systems as they do not support (i) partitioning, (ii) the industrial mixed-criticality task model or (iii) non-preemptive task execution. In this paper, we present job-shifting algorithm for online admission of non-preemptive aperiodic tasks in partitioned time-triggered environment. Our approach circumvents the bandwidth loss issue with partitioning, and provides guarantees similar to the bandwidth reservation technique such that the certification process of safety critical systems need not be modified. Our approach can be implemented on top of variety of hypervisors and can provide lower response-times for aperiodic tasks. Through evaluation, we demonstrate that our approach efficiently utilizes processor bandwidth and only incurs small scheduling overheads.

Quality and Cost of Deterministic Network Calculus

Networks are integral parts of modern safety-critical systems and certification demands the provision of guarantees for data transmissions. Deterministic Network Calculus (DNC) can compute a worst-case bound on a data flow's end-to-end delay. Accuracy of DNC results has been improved steadily, resulting in two DNC branches: the classical algebraic analysis and the more recent optimization-based analysis. The optimization-based branch provides a theoretical solution for tight bounds. Its computational cost grows, however, (possibly super-)exponentially with the network size. Consequently, a heuristic optimization formulation trading accuracy against computational costs was proposed. In this article, we challenge optimization-based DNC with a new algebraic DNC algorithm. We show that: no current optimization formulation scales well with the network size and algebraic DNC can be considerably improved in both aspects, accuracy and computational cost. To that end, we contribute a novel DNC algorithm that transfers the optimization's search for best attainable delay bounds to algebraic DNC. It achieves a high degree of accuracy and our novel efficiency improvements reduce the cost of the analysis dramatically. In extensive numerical experiments, we observe that our delay bounds deviate from the optimization-based ones by only 1.142% on average while computation times simultaneously decrease by several orders of magnitude.

Quality and Cost of Deterministic Network Calculus

Networks are integral parts of modern safety-critical systems and certification demands the provision of guarantees for data transmissions. Deterministic Network Calculus (DNC) can compute a worst-case bound on a data flow's end-to-end delay. Accuracy of DNC results has been improved steadily, resulting in two DNC branches: the classical algebraic analysis (algDNC) and the more recent optimization-based analysis (optDNC). The optimization-based branch provides a theoretical solution for tight bounds. Its computational cost grows, however, (possibly super-)exponentially with the network size. Consequently, a heuristic optimization formulation trading accuracy against computational costs was proposed. In this paper, we challenge optimization-based DNC with a novel algebraic DNC algorithm. We show that: (1) no current optimization formulation scales well with the network size and (2) algebraic DNC can be considerably improved in both aspects, accuracy and computational cost. To that end, we contribute a novel DNC algorithm that transfers the optimization's search for best attainable delay bounds to algebraic DNC. It achieves a high degree of accuracy and our novel efficiency improvements reduce the cost of the analysis dramatically. In extensive numerical experiments, we observe that our delay bounds deviate from the optimization-based ones by only 1.142% on average while computation times simultaneously decrease by several orders of magnitude.

Research on the Safety Mechanism of Complex System Dynamic Reconfiguration Process

On the premise of ensuring reliable and successful operation of modern safetycritical system, dynamic reconfiguration technology is often needed for the expected or unexpected malfunction. However, with the progress of integration and informatization extent in modern systems, the emerging complicated behavior and dynamic feature of dynamic reconfiguration process also brings some challenges for the application work. To promote the effective embedding of dynamic reconfiguration strategy, the safety mechanism of reconfiguration process is discussed in this paper, while some advises are finally provided based on the state of art of safety theory and technology.

A methodological approach for checking safety-critical systems software

The complexity of modern safety-critical systems together with the absence of appropriate software verification tools is one reason for the large number of errors in the design and implementation of these systems. A methodological approach named formal compositional verification approach that uses model checking techniques to verify safety-critical systems software is presented. This approach facilitates decomposition of complex safety-critical systems software into independently verified individual software components, and establishes a compositional method to verify these systems using state-of-the-art model checkers. Our objective in this paper is to facilitate the description of a safety-critical system software as a collection of verified software components, allowing the software verification of complex safety-critical systems. An application on a real-life software project in the field of mobile phone communication is discussed to demonstrate the applicability of the proposed approach.

A methodological approach for checking safety-critical systems software

The complexity of modern safety-critical systems together with the absence of appropriate software verification tools is one reason for the large number of errors in the design and implementation of these systems. A methodological approach named formal compositional verification approach that uses model checking techniques to verify safety-critical systems software is presented. This approach facilitates decomposition of complex safety-critical systems software into independently verified individual software components, and establishes a compositional method to verify these systems using state-of-the-art model checkers. Our objective in this paper is to facilitate the description of a safety-critical system software as a collection of verified software components, allowing the software verification of complex safety-critical systems. An application on a real-life software project in the field of mobile phone communication is discussed to demonstrate the applicability of the proposed approach.

Integrating model checking with HiP-HOPS in model-based safety analysis

The ability to perform an effective and robust safety analysis on the design of modern safety–critical systems is crucial. Model-based safety analysis (MBSA) has been introduced in recent years to support the assessment of complex system design by focusing on the system model as the central artefact, and by automating the synthesis and analysis of failure-extended models. Model checking and failure logic synthesis and analysis (FLSA) are two prominent MBSA paradigms. Extensive research has placed emphasis on the development of these techniques, but discussion on their integration remains limited. In this paper, we propose a technique in which model checking and Hierarchically Performed Hazard Origin and Propagation Studies (HiP-HOPS) – an advanced FLSA technique – can be applied synergistically with benefit for the MBSA process. The application of the technique is illustrated through an example of a brake-by-wire system.

Integrated Design-Stage Failure Analysis of Software-Driven Hardware Systems

Software-driven hardware configurations account for the majority of modern safety-critical complex systems. The often costly failures of such systems can be attributed to software specific, hardware specific, or software/hardware interaction failures. The understanding of how failures propagate in such complex systems might provide critical information to designers, because, while a software component may not fail in terms of loss of function, a software operational state can cause an associated hardware failure. The least expensive phase of the product life cycle to address failures is during the design stage. This research presents a means to evaluate how a combined software/hardware system behaves and how such failures propagate to result in potential failures downstream, during the conceptual design stage. In particular, this paper proposes the use of high-level system modeling and model-based reasoning approaches to model failure propagation in combined software-hardware systems, introducing the Function-Failure Identification and Propagation (FFIP) analysis framework to help formalize the design of safety-critical systems. The fact that the hardware and software designers do not share the same background, knowledge, methods, or language contributes significantly to software/hardware interaction failures. A high-level systems analysis method, such as FFIP, is geared toward the unification of language and modeling concepts and may help to more seamlessly bridge such a gap. The technique is applied to the design of the Reaction Control System Jet Selection of the NASA space shuttle to evaluate failure propagation within the Reaction Control System Jet selection, specifically for the redundancy management system. The paper concludes with the extensions and mappings to the software domain that are required for a truly integrated methodology.

Applying System Theory to Transient Fault Tolerance and Safety Enhancement of Tunnel Construction Wireless Monitoring and Control System

Transient faults are hard to be detected and located due to their unpredictable nature and short duration, and they are the dominant causations of system failures, which makes it necessary to consider transient fault-tolerant design in the development of modern safety-critical industrial system. In this paper an approach based on system theory is proposed to tolerate the transient faults in tunnel construction wireless monitoring and control systems (TCWMCS), in which the effects of transient faults are expressed by dysfunction of interactions among software applications. After analyzing the dysfunctional interactions of the system by the operational process model and educing the causes of dysfunction in the functional control diagram, a safety enhancement way was proposed for the designers, in which effictive safety constraints were set up to tolerate the transient faults. The experiment evaluation indicated that the effects of transient faults could be exposed by the causal factors of dysfunctional interactions and system safety could be enhanced by the enforcement of appropriate constraints.

Transient Fault Tolerance and System Safety Enhancement Based on System Theory

Transient faults are hard to be detected and located due to their unpredictable nature and short duration, and they are the dominant causations of system failures, which makes it necessary to consider transient fault-tolerant design in the development of modern safety-critical industrial system. In this paper an approach based on system theory is proposed to tolerate the transient faults in tunnel construction wireless monitoring and control systems (TCWMCS), in which the effects of transient faults are expressed by dysfunction of interactions among software applications. After analyzing the dysfunctional interactions of the system by the operational process model and educing the causes of dysfunction in the functional control diagram, a safety enhancement way was proposed for the designers, in which effictive safety constraints were set up to tolerate the transient faults. The experiment evaluation indicated that the effects of transient faults could be exposed by the causal factors of dysfunctional interactions and system safety could be enhanced by the enforcement of appropriate constraints.

Assessment of performance and dependability in embedded control systems: Methodology and case study

Abstract Distributed and embedded control systems play an increasing role in modern safety-critical systems, and there is a pressing need to investigate the impact of different design decisions on system performance and safety integrity. In this paper, a methodology for the measurement and estimation of such attributes is presented. The methodology integrates statistical fault-injection testing with the application of on-line, model-based performance monitoring of the embedded control system under test. The methodology is particularly suited to late-phase system testing in which “hardware-in-the-loop” (HIL) simulation techniques are employed. The methodology is illustrated in an extended case study, in which the performance and dependability of eight possible designs for an automotive control system are compared. It is concluded that the methodology is a useful adjunct to the available testing and analysis techniques for such systems.

A framework to integrate software behavior into dynamic probabilistic risk assessment

Software plays an increasingly important role in modern safety-critical systems. Although, research has been done to integrate software into the classical probabilistic risk assessment (PRA) framework, current PRA practice overwhelmingly neglects the contribution of software to system risk. Dynamic probabilistic risk assessment (DPRA) is considered to be the next generation of PRA techniques. DPRA is a set of methods and techniques in which simulation models that represent the behavior of the elements of a system are exercised in order to identify risks and vulnerabilities of the system. The fact remains, however, that modeling software for use in the DPRA framework is also quite complex and very little has been done to address the question directly and comprehensively. This paper develops a methodology to integrate software contributions in the DPRA environment. The framework includes a software representation, and an approach to incorporate the software representation into the DPRA environment SimPRA. The software representation is based on multi-level objects and the paper also proposes a framework to simulate the multi-level objects in the simulation-based DPRA environment. This is a new methodology to address the state explosion problem in the DPRA environment. This study is the first systematic effort to integrate software risk contributions into DPRA environments.

Integrating Software into PRA: A Test‐Based Approach

Probabilistic risk assessment (PRA) is a methodology to assess the probability of failure or success of a system's operation. PRA has been proved to be a systematic, logical, and comprehensive technique for risk assessment. Software plays an increasing role in modern safety critical systems. A significant number of failures can be attributed to software failures. Unfortunately, current probabilistic risk assessment concentrates on representing the behavior of hardware systems, humans, and their contributions (to a limited extent) to risk but neglects the contributions of software due to a lack of understanding of software failure phenomena. It is thus imperative to consider and model the impact of software to reflect the risk in current and future systems. The objective of our research is to develop a methodology to account for the impact of software on system failure that can be used in the classical PRA analysis process. A test-based approach for integrating software into PRA is discussed in this article. This approach includes identification of software functions to be modeled in the PRA, modeling of the software contributions in the ESD, and fault tree. The approach also introduces the concepts of input tree and output tree and proposes a quantification strategy that uses a software safety testing technique. The method is applied to an example system, PACS.

Enforcing security and safety models with an information flow analysis tool

Existing security models require that information of a given security level be prevented from ``leaking'' into lower-security information. High-security applications must be demonstrably free of such leaks, but such demonstration may require substantial manual analysis. Other authors have argued that the natural way to enforce these models automatically is with information-flow analysis, but have not shown this to be practicable for general purpose programming languages in current use. Modern safety-critical systems can contain software components with differing safety integrity levels, potentially operating in the same address space. This case poses problems similar to systems with differing security levels; failure to show separation of data may require the entire system to be validated at the higher integrity level. In this paper we show how the information flow model enforced by the SPARK Examiner provides support for enforcing these security and safety models. We describe an extension to the SPARK variable annotations which allows the specification of a security or safety level for each state variable, and an extension to the SPARK analysis which automatically enforces a given information flow policy on a SPARK program.