Today’s vehicles are evolving towards smart cars, which will be able to drive autonomously and adapt to changing contexts. Incorporating self-adaptation in these cyber-physical systems (CPS) promises great benefits, like cheaper software based redundancy or optimised resource utilisation. As promising as these advantages are, a respective proportion of a vehicle’s functionality poses as safety hazards when confronted with faultand failure situations. Consequently, a system’s safety has to been sured with respect to the availability of multiple software applications, thus often resulting in redundant hardware resources, such as dedicated backup control units. To benefit from self-adaptation by means of creating efficient and safe systems, this work introduces a safety concept in form of a generic adaptation mechanism (GAM). In detail, this generic adaptation mechanism is introduced and analysed with respect to generally known and newly created safety hazards, in order to determine a minimal set of system properties and architectural limitations required to safely perform adaptation. Moreover, the approach is applied to the ICT architecture of a smart e-car, thereby highlighting the soundness, general applicability, and advantages of this safety concept and forming the foundation for the currently ongoing implementation of the GAM within a real prototype vehicle

No abstract

Simulations are commonly used to validate the design of autonomous systems. However, as these systems are increasingly deployed into safety-critical environments with aleatoric uncertainties, and with the increase in components that employ machine learning algorithms with epistemic uncertainties, validation methods which consider uncertainties are lacking. We present an approach that evaluates signal propagation in logical system architectures, in particular environment perception-chains, focusing on effects of uncertainty to determine functional limitations. The perception based autonomous driving systems are represented by connected elements to constitute a certain functionality. The elements are based on (meta-)models to describe technical components and their behavior. The surrounding environment, in which the system is deployed, is modeled by parameters that are derived from a quasi-static scene. All parameter variations completely define inputstates for the designed perception architecture. The input-states are treated as random variables inside the model of components to simulate aleatoric/epistemic uncertainty. The dissimilarity between the modelinput and -output serves as measure for total uncertainty present in the system. The uncertainties are propagated through consecutive components and calculated by the same manner. The final result consists of input-states which model uncertainty effects for the specified functionality and therefore highlight shortcomings of the designed architecture.

No abstract

The availability of functionality is a crucial aspect of missionand safety-critical systems. This is for instance demonstrated by the pursuit to automate road transportation. Here, the driver is not obligated to be part of the control loop, thereby requiring the underlying system to remain operational even after a critical component failure. Advances in the field of mixed-criticality research have allowed to address this topic of fail-operational system behaviour more efficiently. For instance, general purpose computing platforms may relinquish the need for dedicated backup units, as their purpose can be redefined at runtime. Based on this, a deterministic and resource-efficient reconfiguration mechanism is developed, in order to address safety concerns with respect to availability in a generic manner. To find a configuration for this mechanism that can ensure all availability-related safety properties, a design-time method to automatically generate schedules for different modes of operations from declaratively defined requirements is established. To cope with the inherent computational complexity, heuristics are developed to effectively narrow the problem space. Subsequently, this method's applicability and scalability are respectively evaluated qualitatively within an automotive case study and quantitatively by means of a tool performance analysis.