As vehicles migrate from CAN to Ethernet to support communication-heavy applications, factory-installed static cryptographic keys are exposed to a broader attack surface. Such static keys are no longer secure in the long term throughout a vehicle’s long lifecycle. Thus, we propose an on-demand key distribution system considering the hierarchical zonal E/E architecture. In our scheme, upon receiving a new master key from a server by a central vehicle computer, newly derived keys are distributed to zone controllers, and in turn to low-level ECUs in a hierarchical manner. We specifically focus on isolating each zone by securing the derivation and distribution of sub-master keys between the central computer and zone controllers by leveraging the hardware-level security of trusted execution environment (TEE). We implement a prototype on NVIDIA Jetson platforms, where the overheads of cryptographic operations and end-to-end delays are evaluated. Our experiments show that in a complex zonal architecture, the entire set of keys in a vehicle can be renewed in 480 ms, which is shorter than the engine starting time.

Virtual simulation is becoming an essential part of the development of autonomous driving vehicles. Even with the recent advancements for virtual simulation frameworks, less efforts have been made to enable timing-accurate multi-vehicle simulations. In this regard, we present a virtual simulation environment for truck platooning scenarios, where the simulation engine has to calculate the dynamics and environment change of multiple trucks. In such multi-vehicle simulations, the computation for simulation easily exceeds the given simulation hardware's computing capacity, making real-time simulations difficult to achieve. As a solution, we provide a synchronous multi-agent simulation framework that can synchronize the simulation engine's progress with the algorithm computations of each truck. Our synchronous simulation framework guarantees deterministic simulation results, however, at the cost of increased simulation running time. To alleviate the synchronization overhead, we also propose a shared memory-based massive data interface. Our method is implemented and evaluated based on the CARLA autonomous driving simulator.

To satisfy the growing network bandwidth requirement of data-intensive automotive applications (e.g., autonomous driving), Ethernet is recently employed as the backbone of in-vehicle networks. Besides its high bandwidth, Ethernet-based systems require a much more complex software architecture than conventional networks (e.g., controller area network), leading to a system prone to unknown security vulnerabilities. This study reveals one of such attacks that obstruct safety-critical data flows between networked computers. In this attack, malicious applications generate garbage packets that are crammed into Linux transmit queues, blocking other important outgoing network packets. As a solution to this cram attack, we reserve a hidden transmit queue that can be used only by authorized applications through the trusted execution environment (TEE) of recent automotive application processors. For the evaluation, SOME/IP-based systems are implemented based on OP-TEE (an open source TEE), which successfully demonstrates our solution.

We introduce Phalanx, a failure-resilient truck pla- tooning system, where trucks in a platoon protect each other from sensor failures despite the lack of redundant sensors. For that, we first emulate the failed sensors by collectively utilizing other sensors across the platoon. If the failed sensor cannot be emulated, the control system is instantaneously reconfigured to a cooperative protection mode using only the live sensors. We take a scenario-based approach considering six scenarios with single and dual failures of the essential sensors (i.e., lidar, encoder, and camera) for platooning control. For each scenario, we present a protection method that enables the safe maneuvering of platoons. For the evaluation, Phalanx is implemented using our scale truck testbed instrumented with fault injection modules, demonstrating safe platooning controls for the failure scenarios.

The increasing computing demands of autonomous driving applications have driven the adoption of multicore processors in real-time systems, which in turn renders energy optimizations critical for reducing battery capacity and vehicle weight. A typical energy optimization method targeting traditional real-time systems finds a critical speed under a static deadline, resulting in conservative energy savings that are unable to exploit dynamic changes in the system and environment. We capture emerging dynamic deadlines arising from the vehicle’s change in velocity and driving context for an additional energy optimization opportunity. In this article, we extend the preliminary work for uniprocessors [ 66 ] to multicore processors, which introduces several challenges. We use the state-of-the-art real-time gang scheduling [ 5 ] to mitigate some of the challenges. However, it entails an NP-hard combinatorial problem in that tasks need to be grouped into gangs of tasks, gang formation, which could significantly affect the energy saving result. As such, we present EASYR, an adaptive system optimization and reconfiguration approach that generates gangs of tasks from a given directed acyclic graph for multicore processors and dynamically adapts the scheduling parameters and processor speeds to satisfy dynamic deadlines while consuming as little energy as possible. The timing constraints are also satisfied between system reconfigurations through our proposed safe mode change protocol. Our extensive experiments with randomly generated task graphs show that our gang formation heuristic performs 32% better than the state-of-the-art one. Using an autonomous driving task set from Bosch and real-world driving data, our experiments show that EASYR achieves energy reductions of up to 30.3% on average in typical driving scenarios compared with a conventional energy optimization method with the current state-of-the-art gang formation heuristic in real-time systems, demonstrating great potential for dynamic energy optimization gains by exploiting dynamic deadlines.

Cyclops, introduced in this paper, is an open research platform for everyone who wants to validate novel ideas and approaches in self-driving heavy-duty vehicle platooning. The platform consists of multiple 1/14 scale semi-trailer trucks equipped with associated computing, communication and control modules that enable self-driving on our scale proving ground. The perception system for each vehicle is composed of a lidar-based object tracking system and a lane detection/control system. The former maintains the gap to the leading vehicle, and the latter maintains the vehicle within the lane by steering control. The lane detection system is optimized for truck platooning, where the field of view of the front-facing camera is severely limited due to a small gap to the leading vehicle. This platform is particularly amenable to validating mitigation strategies for safety-critical situations. Indeed, the simplex architecture is adopted in the computing modules, enabling various fail-safe operations. In particular, we illustrate a scenario where the camera sensor fails in the perception system, but the vehicle is able to operate at a reduced capacity to a graceful stop. Details of Cyclops, including 3D CAD designs and algorithm source codes, are released for those who want to build similar testbeds.

When executing a deep neural network (DNN), its model parameters are loaded into GPU memory before execution, incurring a significant GPU memory burden. There are studies that reduce GPU memory usage by exploiting CPU memory as a swap device. However, this approach is not applicable in most embedded systems with integrated GPUs where CPU and GPU share a common memory. In this regard, we present Demand Layering, which employs a fast solid-state drive (SSD) as a co-running partner of a GPU and exploits the layer-by-layer execution of DNNs. In our approach, a DNN is loaded and executed in a layer-by-layer manner, minimizing the memory usage to the order of a single layer. Also, we developed a pipeline architecture that hides most additional delays caused by the interleaved parameter loadings alongside layer executions. Our implementation shows a 96.5% memory reduction with just 14.8% delay overhead on average for representative DNNs. Furthermore, by exploiting the memory-delay tradeoff, near-zero delay overhead (under 1 ms) can be achieved with a slightly increased memory usage (still an 88.4% reduction), showing the great potential of Demand Layering.

The increasing computing demands of autonomous driving applications make energy optimizations critical for reducing battery capacity and vehicle weight. Current energy optimization methods typically target traditional real-time systems with static deadlines, resulting in conservative energy savings that are unable to exploit additional energy optimizations due to dynamic deadlines arising from the vehicle's change in velocity and driving context. We present an adaptive system optimization and reconfiguration approach that dynamically adapts the scheduling parameters and processor speeds to satisfy dynamic deadlines while consuming as little energy as possible. Our experimental results with an autonomous driving task set from Bosch and realworld driving data show energy reductions up to 46.4% on average in typical dynamic driving scenarios compared with traditional static energy optimization methods, demonstrating great potential for dynamic energy optimization gains by exploiting dynamic deadlines.

Self-driving systems execute an ensemble of different self-driving workloads on embedded systems in an end-to-end manner, subject to functional and performance requirements. To enable exploration, optimization, and end-to-end evaluation on different embedded platforms, system designers critically need a benchmark suite that enables flexible and seamless configuration of self-driving scenarios, which realistically reflects real-world self-driving workloads’ unique characteristics. Existing CPU and GPU embedded benchmark suites typically (1) consider isolated applications, (2) are not sensor-driven, and (3) are unable to support emerging self-driving applications that simultaneously utilize CPUs and GPUs with stringent timing requirements. On the other hand, full-system self-driving simulators (e.g., AUTOWARE, APOLLO) focus on functional simulation, but lack the ability to evaluate the self-driving software stack on various embedded platforms. To address design needs, we present Chauffeur, the first open-source end-to-end benchmark suite for self-driving vehicles with configurable representative workloads. Chauffeur is easy to configure and run, enabling researchers to evaluate different platform configurations and explore alternative instantiations of the self-driving software pipeline. Chauffeur runs on diverse emerging platforms and exploits heterogeneous onboard resources. Our initial characterization of Chauffeur on different embedded platforms – NVIDIA Jetson TX2 and Drive PX2 – enables comparative evaluation of these GPU platforms in executing an end-to-end self-driving computational pipeline to assess the end-to-end response times on these emerging embedded platforms while also creating opportunities to create application gangs for better response times. Chauffeur enables researchers to benchmark representative self-driving workloads and flexibly compose them for different self-driving scenarios to explore end-to-end tradeoffs between design constraints, power budget, real-time performance requirements, and accuracy of applications.

For realizing safe autonomous driving, the end-to-end delays of real-time object detection systems should be thoroughly analyzed and minimized. However, despite recent development of neural networks with minimized inference delays, surprisingly little attention has been paid to their end-to-end delays from an object's appearance until its detection is reported. With this motivation, this paper aims to provide more comprehensive understanding of the end-to-end delay, through which precise best- and worst-case delay predictions are formulated, and three optimization methods are implemented: (i) on-demand capture, (ii) zero-slack pipeline, and (iii) contention-free pipeline. Our experimental results show a 76% reduction in the end-to-end delay of Darknet YOLO (You Only Look Once) v3 (from 1070 ms to 261 ms), thereby demonstrating the great potential of exploiting the end-to-end delay analysis for autonomous driving. Furthermore, as we only modify the system architecture and do not change the neural network architecture itself, our approach incurs no penalty on the detection accuracy.

This paper proposes a novel technique called mRT-PLRU (Multitasking Real-Time constrained combination of Pinning and LRU), which forms a generic framework to use inexpensive nonvolatile NAND flash memory for storing and executing real-time programs in multitasking environments. In order to execute multiple real-time tasks stored in NAND flash memory with the minimal usage of expensive RAM, the mRT-PLRU is optimally configured in two steps. In the first step, the per-task analysis finds the function of RAM size versus execution time (and the corresponding optimal pinning/LRU combination) for each individual task. Using these functions for all the tasks as inputs, the second-step called a stochastic-analysis-in-loop optimization conducts an iterative convex optimization with the stochastic analysis for the probabilistic schedulability check. As a result, the optimization loop can optimally determine the RAM sizes for multiple tasks such that their deadlines are probabilistically guaranteed with the minimal size of total RAM. The usefulness of the developed technique is intensively verified through both simulation and actual implementation. Our experimental study shows that mRT-PLRU can save up to 80 percent of RAM required by the industry-common shadowing approach.

Emerging cyber-physical systems (CPSs) demand a new computing abstraction since the traditional ones have fundamental limitations in handling the para-functional also called physical requirements of CPSs such as timeliness, reliability, and evolvability. With the traditional computing abstractions such as processes, virtual memory, etc., multiple software (SW) components share hardware (HW) resources such as CPU and memory in a competitive manner causing unpredictable interferences in the para-functional properties. This problem becomes more serious along with the ever increasing scale and complexity of newly emerging cyber-physical systems. To fundamentally solve this problem, this paper proposes a HW resource componentizing approach that chops the capacity of a HW resource into smaller ones called HW components and dedicates a HW component to each SW component. With the dedicated HW component, each SW component can be guaranteed with the isolated para-functional properties regardless of surrounding SW components. This makes the system-wide issue of validating timeliness, reliability, and evolvability into the per-component validation issue. With this vision, this paper briefly presents a spatial/temporal-division scheduling algorithm that can be generally used for componentizing various HW resources including CPU, network, and RAM.

NAND flash memory has been widely used as a nonvolatile storage for storing data. However, it is challenging to execute program codes on NAND flash memory, since NAND flash memory only supports page-based reads, not byte-level random reads. This paper proposes an automated process to find the optimal paging strategy called RT-PLRU (Real-Time constrained combination of Pinning and LRU) that allows program codes stored in NAND flash memory to be executed satisfying real-time requirements with minimal usage of RAM. Moreover, the proposed process optimally configure the RT-PLRU in a developer-transparent way without giving any burden to the program developer. The developed technique is specifically applied to a media player program targeting a portable media player (PMP). To the best of our knowledge, this is the first effort to use NAND flash memory as a code storage for storing and executing real-time programs with minimal usage of RAM.

NAND flash memory has been widely used as a non-volatile storage for storing data. However, it requires a large amount of SRAM for executing program codes stored in it since it only supports page-based reads, not byte-level random reads. This paper proposes a new paging mechanism called RT-PLRU (real-time constrained combination of pinning and LRU) that allows program codes stored in NAND flash memory to be executed satisfying real-time requirements with minimal usage of SRAM. Moreover, the RT-PLRU is optimally configured in a developer-transparent way without giving any burden to the program developer. The developed technique is specifically applied to a media player program targeting a PMP (portable medial player). To the best of our knowledge, this is the first effort to use NAND flash memory as a code storage for storing and executing real-time programs with minimal usage of SRAM.