One of the biggest challenges for self-driving road vehicles is how to argue that their safety cases are complete. The operational design domain (ODD) of the automated driving system (ADS) can be used to restrict where the ADS is valid and thus confine the scope of the safety case as well as the verification. To complete the safety case there is a need to ensure that the ADS will not exit its ODD. We present four generic strategies to ensure this. Use cases (UCs) provide a convenient way providing such a strategy for a collection of operating conditions (OCs) and further ensures that the ODD allows for operation within the real world. A framework to categorise the OCs of a UC is presented and it is suggested that the ODD is written with this structure in mind to facilitate mapping towards potential UCs. The ODD defines the functional boundary of the system and modelling it with this structure makes it modular and generalisable across different potential UCs. Further, using the ODD to connect the ADS to the UC enables the continuous delivery of the ADS feature. Two examples of dimensions of the ODD are given and a strategy to avoid an ODD exit is proposed in the respective case.

This paper proposes a service-oriented tool-chain with an emphasis on domain-specific views, simulation automation, and process management to support model-based system engineering of aero-engines. In the tool-chain, a domain-specific modeling approach is adopted to facilitate the descriptions of co-design workflows and the related development information. The relevant domain-specific models are the basis for automated creation of a Web-based process management system consolidating and controlling service-oriented technical resources (models, data, and tools). In particular, the system also provides support for automated orchestration of tool operations, model, and simulation configurations. In order to promote the model and tool interoperability, the tool-chain adopts open standards for integrations, including open services for lifecycle collaboration and functional mock-up interface. Finally, through a case study of simulation-based aero-engine performance analysis, we evaluate the flexibility and efficiency of this tool chain by comparing it with a traditional simulation process both qualitatively and quantitatively.

The complexity of automated driving poses challenges for providing safety assurance. Focusing on the architecting of an Autonomous Driving Intelligence (ADI), i.e. the computational intelligence, sensors and communication needed for high levels of automated driving, we investigate so called safety supervisors that complement the nominal functionality. We present a problem formulation and a functional architecture of a fault-tolerant ADI that encompasses a nominal and a safety supervisor channel. We then discuss the sources of hazardous events, the division of responsibilities among the channels, and when the supervisor should take over. We conclude with identified directions for further work.

Automated Driving Systems (ADS) represent a key technological advancement in the area of Cyber-physical systems (CPS) and Embedded Control Systems (ECS) with the aim of promoting traffic safety and environmental sustainability. The operation of ADS however exhibits several uncertainties that if improperly treated in development and operation would lead to safety and performance related problems. This paper presents the design of a knowledge-base (KB) strategy for a systematic treatment of such uncertainties and their system-wide implications on design-space and state-space. In the context of this approach, we use the term Knowledge-Base (KB) to refer to the model that stipulates the fundamental facts of a CPS in regard to the overall system operational states, action sequences, as well as the related costs or constraint factors. The model constitutes a formal basis for describing, communicating and inferring particular operational truths as well as the belief and knowledge representing the awareness or comprehension of such truths. For the reasoning of ADS behaviors and safety risks, each system operational state is explicitly formulated as a conjunction of environmental state and some collective states showing the ADS capabilities for perception, control and actuations. Uncertainty Models (UM) are associated as attributes to such state definitions for describing and quantifying the corresponding belief or knowledge status due to the presences of evidences about system performance and deficiencies, etc. On a broader perspective, the approach is part of our research on bridging the gaps among intelligent functions, system capability and dependability for mission-&safety-critical CPS, through a combination of development- and run-time measures.

Co-simulation has been proposed as a method for facilitating integrated simulation of multi-domain models of Cyber-physical Systems (CPS). To ensure that co-simulations are well-managed, concerns beyond technical mechanisms for co-simulation also need to be addressed during tool-chain development. In this paper, an evolution of two frameworks supporting co-simulation tool-chain development is first introduced. Drawing upon the empirical findings from an initial framework SPIT developed based on model-driven techniques, we develop a service-oriented framework, SPIRIT based on model-driven and tool-integration techniques. Moreover, we propose a 3D viewpoint based method to formalize concept models of co-simulation tool-chains. In order to evaluate the evolution, we use visualizations of related concept models to compare tool-chains developed based on these two frameworks. 

This paper proposes a SPIRIT framework supporting model-based systems engineering (MBSE) tool-chain development of advanced cyber-physical systems (CPS) with emphasis on tool integration, process management, automated verification and validation. The core features of the developed MBSE tool-chain include domain-specific modeling to describe CPS development, service-oriented deployment of technical resources (data, model and tool operations) and process management through IT platforms. The framework has two purposes: to support tool-chain development with a systems engineering approach; to promote interoperability of the whole developed tool-chain through a service-oriented approach. The framework covers social, process, information and technical aspects aiming to integrate various related MBSE techniques with tool-chain development. Based on the framework, an MBSE tool-chain prototype is developed, and the flexibility and interoperability are evaluated through a case study.

With the raise of increasingly advanced driving assistance systems in modern cars, execution platforms that build on the principle of service-oriented architectures are being proposed. Alongside, service oriented communication is used to provide the required adaptive communication infrastructure on top of automotive Ethernet networks. A middleware is proposed that enables QoS aware service-oriented communication between software components, where the prescribed behavior of each software component is defined by Assume/Guarantee (A-G) contracts. To enable the use of COTS components, that are often not sufficiently verified for the use in automotive systems, the middleware monitors the communication behavior of components and verifies it against the components A/G contract. A violation of the allowed communication behavior then triggers adaption processes in the system while the impact on other communication is minimized. The applicability of the approach is demonstrated by a case study that utilizes a prototype implementation of the proposed approach.

Vehicles are being transformed into autonomous machines that assist drivers when accidents are about to occur, inform about traffic conditions, diagnose and upgrade themselves as required, while providing comfort and entertainment functionalities. The evolution of embedded systems technology has provided an important enabler for such new functionalities and improved qualities. In this context it can be noted that an estimated 70% of the innovations over the last 20 years are related to information and communication technologies [3]. Cars are becoming computers on wheels. The impact of introducing embedded system technology into vehicles has had, and is having, a radical effect on vehicle development, production, and maintenance. Automotive embedded systems have over the past decades evolved from single stand-alone computer systems, simple enough to be designed and maintained with a minimum of engineering, to distributed computer systems including several networks, and large numbers of sensors, electrical motors, and points of interactions with humans. These distributed systems are tightly integrated into the vehicle. They provide flexible information transfer and computational capabilities, allowing coordination among actuators, sensors, and human-machine interfaces (HMIs), removal of mechanical parts, and also completely new mechanical designs. Automotive embedded systems is an interesting area where the mechanical and control systems worlds meet with the general IT world represented by entertainment/telematics functionalities and increasing connections to the vehicle external infrastructure and IT systems. The opportunities are thus enormous, but the new technology also requires new competencies, methodologies, processes, and tools that can handle the flip side of the coin; the resulting increase and change in product and development complexity. Competition, customer demands, legislation, and new technologies are driving the introduction of new functionalities in the automotive industry. Many new functions in vehicles span traditional domains and organizations. An example of this is active safety systems that assist the driver by receiving environmental information, interpreting the driver intentions, controlling the vehicle dynamics, and, in case an accident is about to occur, informing an emergency center. The increasing system complexity and related increase in costs for the embedded systems development and maintenance create strong needs for systematic and cost-effective development approaches. Current methods of automotive embedded system development lead to [2,50,70] • Long turnaround time, since the complete behavior can only be tested in the integration phase. • Lack of continuity between requirements deinition, system design, and distributed system implementation; typically involving different people and with little formalized communication. • Suboptimal solutions. The organizational structures still mirror the mechanical architecture, and because of a current lack of a systems-level engineering approach for embedded systems design. © 2009 by Taylor & Francis Group, LLC.