The Operational Design Domain (ODD) is a representative model of the real world in which an Automated Driving System (ADS) is intended to operate. The definition of the ODD is a crucial part of the development process for such an artificial intelligence (AI)-enabled system. This is due to the fact that the ODD is the basis for several critical development activities, like defining system-level requirements, test & verification, and building a well-founded safety case for an AI-based ADS. Since an inadequately defined ODD poses a major safety concern for the entire development, an ODD must be defined completely and consistently during the development process. In this work, we present an approach for the ODD definition and maintenance during the development of safety-critical AI-based ADS functionalities and provide evidences to argue the sufficient completeness and consistency. We demonstrate the feasibility of our approach by an industrial use case of a fully automated system in the railway domain.

The manufacturing industry is currently facing a need for more dynamic modes of production. To meet this demand, this work presents an architecture that flexibly connects products, processes, and resources. This work also proposes stateful capability-skill ontology that allows abstract production steps to be dynamically matched to machines on the shop floor. Unlike previous work, state information is directly encoded into the ontology's structure, which simplifies the capability-skill matching process. With an architectural analysis of the work-in-progress approach, its suitability and utility for scheduling tasks is assessed. The initial results show that the proposed approach can provide efficient, reliable, and interoperable scheduling for various scenarios, whereas resource usage and retroactive capability decomposition are identified as potential weaknesses.

The Operational Design Domain (ODD) consists of operating conditions under which an Automated Driving System (ADS) feature is intended to be deployed and should satisfy safety and performance requirements. Creating human-interpretable and monitorable ODD specifications for ADS features, comprising black-box and non-deterministic Machine Learning (ML) components, is complicated owing to the unknown impact of possibly infinite operational contexts on system requirement fulfillment. Furthermore, these ML components may be updated to address unforeseen operational contexts encountered after feature deployment, thus necessitating further updates to the ODD. This paper proposes a novel approach for online ODD identification, i.e., discovering operating conditions wherein the ADS feature satisfies system requirements using fuzzy behavior oracles. Our data-driven approach involves human-interpretable representation of operational contexts, facilitating the semi-automatic generation of conditional ODD statements and updates to ODD post-feature deployment. The feasibility of our approach is validated with a case study on a Lane Change Assist ADS feature, which exhibits a 55% improvement in scalability, allowing its deployment in a broader ODD.

Autonomous systems are deployed in various contexts, which makes the role of the surrounding environment and operational context increasingly vital, e.g., for autonomous driving. To account for these changing operating conditions, an autonomous system must adapt its behavior to maintain safe operation and a high level of autonomy. Machine Learning (ML) components are generally being introduced for perceiving an autonomous system’s environment, but their reliability strongly depends on the actual operating conditions, which are hard to predict. Therefore, we propose a novel approach to learn the influence of the prevalent operating conditions and use this knowledge to optimize reliability of the perception through self-adaptation. Our proposed approach is evaluated in a perception case study for autonomous driving. We demonstrate that our approach is able to improve perception under varying operating conditions, in contrast to the state-of-the-art. Besides the advantage of interpretability, our results show the superior reliability of ML-based perception.

With the rise of Industry 4.0, businesses are increasingly turning to Machine Learning to leverage data for improving quality and productivity. However, one open challenge when embracing Machine Learning in this context is the integration of cloud infrastructures, as well as the heterogeneity of data, interfaces, and protocols in the production environment. To address this, we are developing a framework that aims to simplify the adoption of Machine Learning techniques for heterogeneous industrial automation systems. One of the core features of this framework is the ability to handle data about production devices – a scenario that is naturally suited to the use of Asset Administration Shells. However, the implementation of a system that uses Asset Administration Shells comes with its own set of challenges, such as the abstraction of details from users and the representation of device topologies. Thus, this paper introduces the concepts and implementation of a Metadata Manager component in the aforementioned framework that uses Asset Administration Shells as its basis. We further examine the Metadata Manager’s current structure with unit testing, derive planned extensions, and discuss future directions from the Industry 4.0 perspective.

The evolution towards autonomous driving involves operating safely in open-world environments. For this, autonomous vehicles and their Autonomous Driving System (ADS) are designed and tested for specific, so-called Operational Design Domains (ODDs). When moving from prototypes to real-world mobility solutions, autonomous vehicles, however, will face changing scenarios and operational conditions that they must handle safely. Within this work, we propose a fuzzy-based approach to consider changing operational conditions of autonomous driving based on smaller ODD fragments, called $\mu$ ODDs. By this, an ADS is enabled to smoothly adapt its driving behavior for meeting safety during shifting operational conditions. We evaluate our solution in simulated vehicle following scenarios passing through different $\mu$ ODDs, modeled by weather changes. The results show that our approach is capable of considering operational domain changes without endangering safety and allowing improved utility optimization.

Modern Cyber-Physical Systems (CPS) must increasingly adapt to changing contexts, like smart cars to changing driving conditions. Thus, design approaches are facing a rapidly growing number of network runtime configurations. With recent approaches this problem can be solved for design space exploration (DSE) by analyzing the network performance of single configurations which are intended to represent the entire runtime variability space. This technique can be applied for DSE since the latter only intends to find an optimized system setup. Yet it does not meet the requirements of network verification, since it does not necessarily find the worst-case for all applications. To solve this, we developed an integrated model, which allows describing runtime variability in the network performance model with a 0-1 linear-fractional program. Thus, we can cover entire runtime variability spaces without analyzing every single network runtime configuration. Although the approach utilizes heuristics, it still guarantees worst-case results. We can show that in comparison to state-of-the-art methods our approach scales for large automotive systems with multiple network configurations. Moreover, our evaluation results highlight the superior capabilities of our method with respect to accuracy and computation time.

To deal with fail-operational (FO) requirements in today's safety-critical networked embedded systems (SCNES), engineers have to resort to concepts such as redundancy, monitoring, and special shutdown procedures. Hardware-based redundancy approaches are not applicable to many embedded systems domains (e.g., automotive systems), because of prohibitive costs. In this scenario, adaptability concepts can be used to fulfill these FO requirements while enabling optimized resource utilization. However, the applicability of such concepts highly depends on the support for the engineering during system development. We propose an approach to cope with the challenges of fail-operational behavior of SCNES in which engineers are supported by design concepts for realizing safety, reliability, and adaptability requirements through the use of architectural patterns. The approach allows expressing FO concepts at the software architecture level. This lowers the effort for developing SCNES by utilizing generic patterns for general and reoccurring mechanisms.

Today's vehicles are evolving towards smart cars, which will be able to drive autonomously and adapt to changing contexts. Incorporating self-adaptation in these cyber-physical systems (CPS) promises great benefits, like cheaper software-based redundancy or optimised resource utilisation. As promising as these advantages are, a respective proportion of a vehicle's functionality poses as safety hazards when confronted with fault and failure situations. Consequently, a system's safety has to be ensured with respect to the availability of multiple software applications, thus often resulting in redundant hardware resources, such as dedicated backup control units. To benefit from self-adaptation by means of creating efficient and safe systems, this work introduces a safety concept in form of a generic adaptation mechanism (GAM). In detail, this generic adaptation mechanism is introduced and analysed with respect to generally known and newly created safety hazards, in order to determine a minimal set of system properties and architectural limitations required to safely perform adaptation. Moreover, the approach is applied to the ICT architecture of a smart e-car, thereby highlighting the soundness, general applicability, and advantages of this safety concept and forming the foundation for the currently ongoing implementation of the GAM within a real prototype vehicle.

The complexity of modern vehicular embedded systems is constantly rising. In addition, distributed embedded systems like automobiles often implement safety-relevant applications which have a high demands on safety and reliability. This poses a great challenge for the design of these systems. Self-adaptation may overcome these challenges and enhance the flexibility and robustness of automotive embedded systems. To design such systems in an efficient way, an adaptive system has to be verified and validated even in early stages of the development process. Co-simulation enables such an approach. In this paper, we outline a concept for iterative virtual prototyping of the entire automotive in-vehicle network including hardware components, software functions and interconnection networks. Furthermore, we present an approach to simulate self-adaptive behavior of the automotive embedded system.