Modern cyber-physical systems (CPSs) employ an increasingly large number of software control loops to enhance their autonomous capabilities. Such large task sets and their dependencies may lead to deadline misses caused by platform-level timing uncertainties, resource contention, etc. To ensure the schedulability of the task set in the embedded platform in the presence of these uncertainties, there exist co-design techniques that assign task periodicities such that control costs are minimized. Another line of work exists that addresses the same platform schedulability issue by skipping a bounded number of control executions within a fixed number of control instances. Considering that control tasks are designed to perform robustly against delayed actuation (due to deadline misses, network packet drops etc.) a bounded number of control skips can be applied while ensuring certain performance margin. Our work combines these two control scheduling co-design disciplines and develops a strategy to adaptively employ control skips or update periodicities of the control tasks depending on their current performance requirements. For this we leverage a novel theory of automata-based control skip sequence generation while ensuring periodicity, safety and stability constraints. We demonstrate the effectiveness of this dynamic resource sharing approach in an automotive Hardware-in-loop setup with realistic control task set implementations.

We consider the problem of securing a given control loop implementation of a cyber-physical system (CPS) in the presence of Man-in-the-Middle attacks on data exchange between plant and controller over a compromised network. To this end, there exists various detection schemes which provide mathemat¬ical guarantees against such attacks for the theoretical control model. However, such guarantees may not hold for the actual control software implementation. In this article, we propose a formal approach towards synthesizing attack detectors with varying thresholds which can prevent performance degrading stealthy attacks while minimizing false alarms.

Given the widespread deployment of cyber-physical systems and their safety-critical nature, reliability and security guarantees offered by such systems are of paramount importance. While the security of such systems against sensor attacks have garnered significant attention from researchers in recent times, improving the reliability of a control software implementation against transient environmental disturbances need to be investigated further. Scalable formal methods for verification of actual control performance guarantee offered by software implementations of control laws in the face of sensory faults have been explored in recent work [20]. However, the formal verification of the improvement of system reliability by incorporating sensor fault mitigation techniques like Kalman filtering [29] and sensor fusion [18, 52] remains to be explored. Moreover, system designers face complex tradeoff choices for deciding upon the usage of fault and attack mitigation techniques and scheduling them on available system resources as they incur extra computation load. In the present work, our contributions are threefold. We formally analyze the actual performance guarantee of control software implementations enabled with additional fault mitigation techniques. We consider task-level models of such implementations enabled with security and fault tolerance primitives and construct a timed automata-based model which checks for schedulability on heterogeneous multi-core platforms. We leverage these methodologies in the context of a novel Design-Space-Exploration (DSE) framework that considers target reliability and security guarantees for a control system and computes schedulable design options while considering well-known platform-level security improvement and fault mitigation techniques. We validate our contributions over several case studies from the automotive domain.

Embedded control systems are an important and often safety-critical class of applications that need to operate reliably even in the presence of faults. We show that intermittent fault scenarios caused by wear-out effects due to a higher density and a smaller geometry of the embedded electronic components may become a reliability concern for real-time embedded control applications. To mitigate the effects of such intermittent faults, we propose a novel fault-tolerant controller design method such that the resulting controllers ensure closed loop stability (i.e., guarantee safety) with only possibly degraded performance under such fault scenarios. In order to measure the amortized performance offered by the software implementations of such fault-tolerant controllers, we provide a program analysis methodology that statically estimates the quality of control guaranteed by the C code implementation of the fault-tolerant control law. This combination of fault-tolerant controller design followed by performance feedback computed using a formal analysis is illustrated with a case study from the automotive domain.

Development of highly reliable embedded control systems is typically performed following the model driven engineering paradigm. Such systems involve software controlled interaction of mechanical subsystems. The aging of the overall system depends on the physical aging or reliability decay of the underlying mechanical components. The reliability of such components degrade according to their rate of usage which again is governed by the software control logic and input environment. Such dependencies of component reliabilities make the problem of deriving system level reliability degradation using exact methods combinatorially intractable. Given the fact that model driven system design advocates the usage of initial high level system models, methods for early stage lifetime reliability and reliability degradation estimation based on such initial models should definitely aid in robust high assurance engineering of such software controlled physical systems. The present work proposes SERD, a lightweight, scalable simulation framework for embedded control systems. It can accommodate active as well as quiescent reliability decay rates of underlying mechanical components. It uses path based reliability modeling to estimate the reliability degradation of component based systems that are controlled by software logic. Its efficacy is further demonstrated using a thorough case study.