Time-triggered Architecture Research Articles

Moving target defense for the security and resilience of mixed time and event triggered cyber–physical systems

Memory corruption attacks such as code injection, code reuse, and non-control data attacks have become widely popular for compromising safety-critical Cyber–Physical Systems (CPS). Moving target defense (MTD) techniques such as instruction set randomization (ISR), address space randomization (ASR), and data space randomization (DSR) can be used to protect systems against such attacks. CPS often use time-triggered architectures to guarantee predictable and reliable operation. MTD techniques can cause time delays with unpredictable behavior. To protect CPS against memory corruption attacks, MTD techniques can be implemented in a mixed time and event-triggered architecture that provides capabilities for maintaining safety and availability during an attack. This paper presents a mixed time and event-triggered MTD security approach based on the ARINC 653 architecture that provides predictable and reliable operation during normal operation and rapid detection and reconfiguration upon detection of attacks. We leverage a hardware-in-the-loop testbed and an advanced emergency braking system (AEBS) case study to show the effectiveness of our approach.

A Flexible Communication Protocol With Guaranteed Determinism for Distributed, Safety-Critical Real-Time Systems

Dependable, safety-critical real-time (SCRT) systems are becoming increasingly important and complex. Examples of such systems are autonomous or self-driving cars which are poised to revolutionise the transport industry. A critical part of these SCRT systems is the network communication protocol that is used by components in an SCRT system to exchange data. Communication protocols for SCRT systems are required to exhibit predictable, worst-case execution times and thus have to be designed in a more static and less flexible way. To ensure this predictability, current state-of-art communication protocols for SCRT systems are based on the Time-Triggered Architecture (TTA), where static and equal-length time-slots are used for all nodes to access the communication channel, irrespective of the size of their transmission payload. This determinism forms the basis of predictable timing, behaviour and fault tolerance. However, this determinism comes at the cost of poor channel and bandwidth utilisation, which hinders the development of SCRT systems. In this paper, we propose a more flexible approach, INCUS+, that allocates the slot length of a node based on its transmission requirements in a Time Division Multiple Access (TDMA) round. We achieve this while retaining the level of dependability required for SCRT systems and ensuring fail-silence. We validate this through formal verification of the timing parameters for the transmission windows of all participating nodes as well as independent bus guardians. Our design exhibits a significant improvement in bandwidth and channel utilisation, as we demonstrate in an autonomous vehicle case study.

Control Performance Optimization for Application Integration on Automotive Architectures

Automotive software implements different functionalities as multiple control applications sharing common platform resources. Although such applications are often developed independently, the control performance of the resulting system depends on how these applications are integrated. A key integration challenge is to efficiently schedule these applications on shared resources with minimal control performance degradation. We formulate this problem as that of scheduling multiple distributed periodic control tasks that communicate via messages with non-zero jitter. The optimization criterion used is a piecewise linear representation of the control performance degradation as a function of the end-to-end latency of the application. The three main contributions of this article are: 1) a constraint programming (CP) formulation to solve this integration problem optimally on time-triggered architectures; 2) an efficient heuristic called Flexi; and 3) an experimental evaluation of the scalability and efficiency of the proposed approaches. In contrast to the CP formulation, which for many real-life problems might have unacceptably long running times, Flexi returns nearly optimal results (0.5 percent loss in control performance compared to optimal) for most problems with more acceptable running times.

Combined compression of multiple correlated data streams for online-diagnosis systems

Online fault-diagnosis is applied to various systems to enable an automatic monitoring and, if applicable, the recovery from faults to prevent the system from failing. For a sound decision on occurred faults, typically a large amount of sensor measurements and state variables has to be gathered, analyzed and evaluated in real-time. Due to the complexity and the nature of distributed systems all this data needs to be communicated among the network, which is an expensive affair in terms of communication resources and time. In this paper we present compression strategies that utilize the fact that many of these data streams are highly correlated and can be compressed simultaneously. Experimental results show that this can lead to better compression ratios compared to an individual compression of the data streams. Moreover, the algorithms support real-time constraints for time-triggered architectures and enable the data to be transmitted by means of shorter messages, leading to a reduced communication time and improved scheduling results. With an example data set we show that, depending on the parameters of the compression algorithm, more than one third of the bits (34.3%) in the data communication can be saved while only on about 0.2% of all data values a slight loss of accuracy occurs. This means 99.8% of the data values can be correctly delivered without any loss but with a significant reduction of bandwidth demands.

A Novel Network Scheduling Approach Based on Genetic Algorithm for Autonomous Underwater Vehicle Control

Autonomous Underwater Vehicle (AUV) is one type of important equipments for conducting ocean exploration missions. The AUV control system typically employs a common communication network to connect various function nodes such as Doppler meter, compass/inertial navigation unit, sonar, water depth sensor, main propulsion, and rudder motor. Each of these function nodes has its own information transmission requirements that need to be served by the limited bandwidth of the common communication network. In order to obtain a good control performance, an elaborate information transmission schedule in the communication network should be planned in such a way that all information transmission requirements in the AUV control system can be satisfied with as less network-induced delay and data packet dropout as possible. This paper proposes a novel network scheduling approach based on the Genetic Algorithm (GA) and the time-triggered architecture for meeting information transmission requirements in the Controller Area Network (CAN) of the AUV control system. The proposed network scheduling approach divides the whole transmission period into a serial of time slices with equal lengths, and defines a large cycle consisting of multiple time slices. For the periodical information transmission, the transmission schedule in one large cycle is determined by solving one nonlinear integer optimization problem with the Genetic Algorithm. This GA-based network scheduling approach maximizes the available bandwidth of each single time slice in all the periodic time slices of the whole schedule period, and aims to achieve a balanced information transmission in the CAN network. Meanwhile, the available bandwidth in each time slice of the whole schedule period is then allocated for the event-triggered information transmission. In this way, the proposed network scheduling approach satisfies the transmission requirements of both periodical and event-triggered information in the AUV. Finally, simulation experiments demonstrate the performance of the proposed GA-based network scheduling approach, and verify its performance improvement on an AUV heading motion control using TrueTime toolbox.

Loosely Time-Triggered Architectures

Loosely Time-Triggered Architectures (LTTAs) are a proposal for constructing distributed embedded control systems. They build on the quasi-periodic architecture, where computing units execute nearly periodically , by adding a thin layer of middleware that facilitates the implementation of synchronous applications. In this article, we show how the deployment of a synchronous application on a quasi-periodic architecture can be modeled using a synchronous formalism. Then we detail two protocols, Back-Pressure LTTA, reminiscent of elastic circuits, and Time-Based LTTA, based on waiting. Compared to previous work, we present controller models that can be compiled for execution, a simplified version of the Time-Based protocol and optimizations for systems using broadcast communication. We also compare the LTTA approach with architectures based on clock synchronization.

Computation and Communication Evaluation of an Authentication Mechanism for Time-Triggered Networked Control Systems.

In modern networked control applications, confidentiality and integrity are important features to address in order to prevent against attacks. Moreover, network control systems are a fundamental part of the communication components of current cyber-physical systems (e.g., automotive communications). Many networked control systems employ Time-Triggered (TT) architectures that provide mechanisms enabling the exchange of precise and synchronous messages. TT systems have computation and communication constraints, and with the aim to enable secure communications in the network, it is important to evaluate the computational and communication overhead of implementing secure communication mechanisms. This paper presents a comprehensive analysis and evaluation of the effects of adding a Hash-based Message Authentication (HMAC) to TT networked control systems. The contributions of the paper include (1) the analysis and experimental validation of the communication overhead, as well as a scalability analysis that utilizes the experimental result for both wired and wireless platforms and (2) an experimental evaluation of the computational overhead of HMAC based on a kernel-level Linux implementation. An automotive application is used as an example, and the results show that it is feasible to implement a secure communication mechanism without interfering with the existing automotive controller execution times. The methods and results of the paper can be used for evaluating the performance impact of security mechanisms and, thus, for the design of secure wired and wireless TT networked control systems.

FROM CAMAC TO WIRELESS SENSOR NETWORKS AND TIME-TRIGGERED SYSTEMS AND BEYOND: EVOLUTION OF COMPUTER INTERFACES FOR DATA ACQUISITION AND CONTROL. PART I

The objective of this paper is to present a historical overview of design choices for data acquisition and control systems, from the first developments in CAMAC, through the evolution of their designs operating in VMEbus, Firewire and USB, to the latest developments concerning distributed systems using, in particular, wireless protocols and time-triggered architecture. First part of the overview is focused on connectivity aspects, including buses and interconnects, as well as their standardization. More sophisticated designs and a number of challenges are addressed in the second part, among them: bus performance, bus safety and security, and others.

Formal Verification of Fault-Tolerant Startup Algorithms for Time-Triggered Architectures: A Survey

Time-triggered architectures form an important component of many distributed computing platforms for safety-critical real-time applications such as avionics and automotive control systems. TTA, FlexRay, and TTCAN are examples of such time-triggered architectures that have been popular in recent times. These architectures involve a number of algorithms for synchronizing a set of distributed computing nodes for meaningful exchange of data among them. The algorithms include a startup algorithm whose job is to integrate one or more nodes into the group of communicating nodes. The startup algorithm runs on every node when the system is powered up, and again after a failure occurs. Some critical issues need to be considered in the design of the startup algorithms, for example, the algorithms should be robust under reasonable assumptions of failures of nodes and channels. The safety-critical nature of the applications where these algorithms are used demands rigorous verification of these algorithms, and there have been numerous attempts to use formal verification techniques for this purpose. This paper focuses on various formal verification efforts carried out for ensuring the correctness of the startup algorithms. In particular, the verification of different startup algorithms used in three time-triggered architectures, TTA, FlexRay, and TTCAN, is studied, compared, and contrasted. Besides presenting the various verification approaches for these algorithms, the gaps and possible improvements on the verification efforts are also indicated.

Optimized implementation of synchronous models on industrial LTTA systems

Abstract Synchronous models are used to specify embedded systems functions in a clear and unambiguous way and allow verification of properties using formal methods. The implementation of a synchronous specification on a distributed architecture must preserve the model semantics to retain the verification results. Globally synchronized time-triggered architectures offer the simplest implementation path, but can be inefficient or simply unavailable. In past work, we defined a mapping of synchronous models on a general class of distributed asynchronous architectures, for which the only requirement is a lower bound on the rate of activation of tasks. In this paper, we set tighter requirements on task execution rates, and we include a realistic modeling of communication delays, task scheduling delays and schedulability conditions, discussing the timing characteristics of an implementation on a system with a Controller Area Network (CAN). Next, the semantics preservation conditions are formulated as constraints in an architecture optimization problem that defines a feasible task model with respect to timing constraints. An automotive case study shows the applicability of the approach and provides insight on the software design elements that are critical for a feasible implementation.

Ensuring fault-tolerant computations in distributed control systems

This paper demonstrates that the fault tolerance of distributed control systems (DCSs) can be improved by scheduling of processes representing functional segments with guaranteed operation of the mechanisms of process reexecution and parallel execution based on checkpoints. Moreover, we suggest the methodological approach to assessing the fault tolerance level of DCSs, which proceeds from the probabilistic modeling of systems having the time triggered architecture (TTA). Finally, we derive numerical formulas for qualitative and quantitative estimation of the fault tolerance level for different modifications of DCSs at the design stage.

From dataflow specification to multiprocessor partitioned time-triggered real-time implementation

Our objective is to facilitate the development of complex time-triggered systems by automating the allocation and scheduling steps. We show that full automation is possible while taking into account the elements of complexity needed by a complex embedded control system. More precisely, we consider deterministic functional specifications provided (as often in an industrial setting) by means of synchronous data-flow models with multiple modes and multiple relative periods. We first extend this functional model with an original real-time characterization that takes advantage of our time-triggered framework to provide a simpler representation of complex end-to-end flow requirements. We also extend our specifications with additional non-functional properties specifying partitioning, allocation, and preemptability constraints. Then, we provide novel algorithms for the off-line scheduling of these extended specifications onto partitioned time-triggered architectures a la ARINC 653. The main originality of our work is that it takes into account at the same time multiple complexity elements: various types of non-functional properties (real-time, partitioning, allocation, preemptability) and functional specifications with conditional execution and multiple modes. Allocation of time slots/windows to partitions can be fully or partially provided, or synthesized by our tool. Our algorithms allow the automatic allocation and scheduling onto multi-processor (distributed) systems with a global time base, taking into account communication costs. We demonstrate our technique on a model of space flight software system with strong real-time determinism requirements.

Time-Triggered Implementations of Dynamic Controllers

Bridging the gap between model-based design and platform-based implementation is one of the critical challenges for embedded software systems. In the context of embedded control systems that interact with an environment, a variety of errors due to quantization, delays, and scheduling policies may generate executable code that does not faithfully implement the model-based design. In this article, we show that the performance gap between the model-level semantics of linear dynamic controllers, for example, the proportional-integral-derivative (PID) controllers and their implementation-level semantics, can be rigorously quantified if the controller implementation is executed on a predictable time-triggered architecture. Our technical approach uses lifting techniques for periodic time-varying linear systems in order to compute the exact error between the model semantics and the execution semantics. Explicitly computing the impact of the implementation on overall system performance allows us to compare and partially order different implementations with various scheduling or timing characteristics.

인공심장의 예측 가능한 제어를 위한 실시간 소프트웨어 설계 구조의 개선

실시간 소프트웨어 설계 구조 중의 하나인 시간 구동 구조 (TTA: Time-Triggered Architecture)는 미리 정해진 시간에 따라 특정 태스크를 수행하기 때문에 소프트웨어의 동작을 예측하기 쉽지만 이의 적용을 위해서는 시스템의 시간 제약성을 만족시키는 설계 과정이 필수적이다. 반면 이벤트 구동 구조 (ETA: Event-Triggered Architecture)는 외부의 이벤트가 발생함에 따라 대응되는 태스크를 수행하는 방식으로 소프트웨어의 구조가 직관적이고 이벤트에 대한 반응 시간이 빠르며 확장이 용이하다. 그러나 이 구조는 다양한 이벤트 발생 상황에 대한 시스템 동작의 예측이 어려워서 높은 안전도가 필요한 시스템 구현에 많이 사용되고 있지 않다. 많은 관련 연구에서 높은 안전도가 필요한 안전 지향 시스템에 TTA를 적용 할 것을 권장되지만, 실제 구현에 있어서는 이의 적용에 필요한 실시간성 분석에 많은 노력이 소요되고, 소프트웨어 공학기술 적용에 대한 인식 부족으로 TTA의 적용이 많지 않은 실정이다. 본 논문은 인간의 생명과 직결되어 이에 따른 실시간성과 안전성이 요구되는 인공심장 제어 시스템에 내장된 소프트웨어 구조를 TTA 기반으로 개선한 연구를 기술한다. 본 연구에서는 인터럽트 측정 소프트웨어를 구현하여 기존에 내장된 실시간 소프트웨어가 가진 태스크의 시간적 속성을 파악하고 RMA (Rate-Monotonic Analysis) 실시간 분석 기법을 통해 시스템의 실시간성을 만족할 수 있도록 설계를 개선하였다. 또한, 이를 바탕으로 인공심장 제어 소프트웨어의 구현을 개선하여 다양한 실험을 통해 개선된 TTA 기반의 소프트웨어를 탑재한 인공심장 시스템은 시스템의 동작 예측도를 획기적으로 높여주면서 기존의 인공심장 시스템과 동일하게 동작함을 확인하였다. Time-Triggered Architecture (TTA), one of real-time software design paradigms which executes tasks in timely manner, has long been advocated as being better suited in fore-sighting system behavior than event-triggered architecture (ETA). To gain this valuable feature of TTA, however, precise task designing process is mandatory. Alternatively, ETA tries to execute tasks whenever paired events are occurred. It provides intuitive and flexible basement to add/remove tasks and, moreover, better response time performance. However ETA is difficult to analyze because system behavior might be different depending on the order of interrupts detected by the system. Many previous researches recommended TTA when developing safety-critical real-time systems, but cost problem of task designing process and insufficient consensus for applying rigorous software engineering practice are still challenging in practice. This paper describes software refactoring process which applying TTA approach into ETA based embedded software in artificial heart system. We implemented dedicated interrupt monitoring program to capture existing tasks' real-time characteristics. Based on the captured information, proper task designing process is done. Real-time analysis using RMA (Rate-Monotonic Analysis) verified that new design guarantees timeliness of the system. Empirical experiments revealed that revised design is as efficient, when measured in terms of system's external output, as the old design and enhances predictability of the system behavior as well.

Systematic test of time-triggered communication architectures using a component-based approach

Since several years the automotive industry strives for dealing with the fast growing system complexity, the increasing safety requirements and the increasing cost constraints of electronic components. In this work, we focus on two approaches: the time-triggered architecture which precisely specifies the system and its components both in the value and in the time domain, and component-based development which provides a framework for describing the system structure in a formalized way. We discuss in this paper the relationships between these two concepts and review methods for performing analysis and validation on top of component-based development frameworks. This combination is illustrated by a method for layered test and diagnosis for FlexRay communication architectures.

A time-triggered object tracking subsystem for advanced driver assistance systems

Multi-sensor object tracking is an important feature for advanced driver assistance systems in future automobiles. Most state-of-the-art systems cannot guarantee deterministic processing of the sensor values due to unsynchronized sensing and processing units. To overcome this shortcoming we propose a paradigm shift towards a time-triggered system architecture providing a deterministic bus system, synchronized nodes, and a global time-base. The paradigm shift is supported by results of a simulation of different synchronization and scheduling approaches which suggest that although non-time-triggered approaches perform well in scenarios with low process noise, the time-triggered model becomes advantageous in potentially dangerous scenarios with high dynamics. In order to validate the results of the simulation for real life scenarios, we analyzed test drives derived from a testbed featuring a Volkswagen Touran being equipped with a laser scanner, a stereo camera system, a FlexRay communication system, an object tracking subsystem and a differential GPS system as reference.

Design and reliability prediction of a distributed landing gear control system

PurposeProper function of landing gear plays a crucial role in the safe operation of an airplane. Traditional landing gear control system utilizes centralized control technology. The relatively heavy wire harness and low reliability accompanied with this technology make it logical to transfer from traditional control to real‐time distributed control. This paper aims to look into a new landing gear control system based on time‐triggered architecture (TTA).Design/methodology/approachIn this paper, a new landing gear control system based on TTA is proposed. The reliability of the proposed system is investigated using a combination of Markov analysis and MIL‐HDBK‐217 methods.FindingsThe results show that by integration of TTP/C and TTP/A technologies, the advantages of both are achieved. A very high level of reliability is obtained. This increases the confidence when adopting distributed landing gear control technology.Originality/valueThe paper presents a new landing gear control system based on TTA, the reliability of which is very high.

On the Design of Distributed Time-Triggered Embedded Systems

The cognitive constraints of the human mind must drive the decisions in architecture and methodology design in order that the systems we build are comprehensible. This paper presents a methodology for the design of time-triggered embedded systems that leads to understandable artifacts. We lift the design process to a higher level of abstractionto the level of computational components that interact solely by the exchange of messages. The time-triggered architecture makes it possible to specify the temporal properties of component interfaces precisely and provides temporally predictable message communication, such that the precise behavior of a large design can be studied in the early phases of a design on the basis of the component interface specifications. This paper shows how the cognitive simplification strategies of abstraction, partitioning and segmentation are supported by the time-triggered architecture and its associated design methodology to construct evolvable embedded systems that can be readily understood and modified.

Applying time-triggered architectures in reliable embedded systems: challenges and solutions

Since the mid 1990s, researchers in the Embedded Systems Laboratory at the University of Leicester have developed a range of techniques and tools which support the creation and maintenance of reliable, resource-constrained embedded systems. Central to this work has been a focus on systems with a time-triggered architecture. This paper provides a review of some of this work.

Implementing Synchronous Models on Loosely Time Triggered Architectures

Synchronous systems offer a clean semantics and an easy verification path at the expense of often inefficient implementations. Capturing design specifications as synchronous models and then implementing the specifications in a less restrictive platform allow to address a much larger design space. The key issue in this approach is maintaining semantic equivalence between the synchronous model and its implementation. We address this problem by showing how to map a synchronous model onto a loosely time-triggered architecture that is fairly straightforward to implement as it does not require global synchronization or blocking communication. We show how to maintain semantic equivalence between specification and implementation using an intermediate model (similar to a Kahn process network but with finite queues) that helps in defining the transformation. Performance of the semantic preserving implementation is studied for the general case as well as for a few special cases.