The European-funded HAL4SDV project aims to advance European solutions in software-defined vehicles by introducing a hardware abstraction layer positioned between executed software and execution units. HAL4SDV includes over 60 partners across 12 countries and receives funding within the Chips Joint Undertaking under Horizon Europe since April 2024 and is coordinated by TTTech Computertechnik. The proposed hardware abstraction layer includes safety-critical scheduling and platform deployment of software tasks, and is motivated by the requirement for abstracted hardware with unified interfaces in centralized automotive architectures.This work presents a correct-by-construction workflow which is developed by academic partners to schedule and deploy periodic software tasks onto diverse execution units. The workflow facilitates the execution of the same task stack on multiple unit architectures and consists of a task model and scheduling algorithm, which is followed by platform deployment for diverse hardware units, ensuring safe execution. In this multi-partner project, a bandwidth regulation unit for hardware accelerators and a RISC-V-based multicore system with tightly coupled memories are used as target platforms.A RoboRacer driving stack is chosen for evaluation, showing the viability of our workflow to schedule autonomous driving functions. To show generalization capability, synthetic task sets are additionally used to validate our deployment workflow.

Convolutional Neural Networks (CNNs) have become an essential tool in the domain of vision processing. However, dedicated accelerators are needed for energy-efficient execution of these networks, especially for embedded devices with tight energy constraints. Integrating multiple of these accelerators via chiplets promises a way to scale up the performance of these emerging systems by partitioning a neural network across multiple accelerators. This approach enables the execution of different layers on an accelerator with the best-suited dataflow. However, partitioning a neural network is a non-trivial task, especially when different accelerator architectures must be considered. In this paper, we propose our framework DSEParted, which automates the co-design of network partitioning and hardware architecture optimization. It employs a hierarchical optimization approach to gradually reduce the number of design candidates until an optimal system configuration is found for a partitioned computation of a neural network. We demonstrate that our framework can design a system that, for GoogLeNet, reduces latency by 22.5% when optimizing for latency. In addition, when optimizing for energy, it reduces the system area by 7.9%, with no impact on latency or energy compared to a baseline system. Further, we show that our partitioning-aware pruning strategy can reduce the EDP of the system by up to 49.7% in the case of ResNeXt-50, compared to a strategy that only optimizes the accelerators individually. Through the provided information, designers receive feedback on the efficiency of the full system at an early development stage. Our work is available open source1.1https://github.com/itiv-kit/cnn-parted

Future automotive architectures are expected to transition from a network-centric to a domain-centered architecture featuring central compute units. Powerful domain controllers or smart sensors alleviate the load on these central units and communication systems. These controllers execute tasks with varying criticalities on heterogeneous multicore processors, and are ideally capable of dynamically balancing the computing load between the central unit and sensors. Here, Artificial Intelligence (AI) capabilities playa crucial role, as it is in high demand for such an automotive architecture. However, AI still requires specialized accelerators to improve their computation performance. Task-oriented distributed computing with criticalities up to ASIL-D necessitates the development and utilization of specialized methodologies, such as safety, through the isolation and abstraction of low-level hardware concepts. Meanwhile, online monitoring and diagnostics become vital features to detect errors during operation. The EMDRIVE architecture includes methods, components, and strategies to enhance the performance, safety, and security of such distributed computing platforms. The nationally funded EMDRIVE project connects its twelve partners from academia and industry and is currently in its intermediate stage.

The seamless and secure integration of subsystems is a pivotal requirement within contemporary automotive development, necessitating the application of design methodologies like the Vee model. While this approach includes dedicated verification steps for the included contexts and provides a high level of assurance that the system will operate correctly under specified conditions, formalizing specifications outside its operational design domain is per definition not included. Additionally, black-box systems like machine learning based functions prove difficulty to test by these traditional methodologies. In this project, we introduce and demonstrate a design workflow combining the Vee model design paradigm with continuous data-driven software engineering. Our workflow assists the continuous, safe and secure development and improvement of consumer vehicle functionality over the product lifecycle. This is achieved through the continuous monitoring of anomalies, as well as system states that deviate from the established design domain. The UNCOVER methodology consists of a continuous reduction in the amount of necessary monitored messages and presents a methodology throughout the entirety of the product lifecycle. We demonstrate our methodology through a simulation and show our automatic generation of monitoring components, and an automated preselection of identified safety or security incidents.

The ongoing trend of centralization of functionality and the resulting integration of previously distributed software components in automotive systems leads to mixed-criticality architectures on those resulting central execution platforms. Multiprocessor system-on-chip architectures provide a powerful platform for centralized execution. A major challenge arises in the safe and secure scheduling of software components on those platforms. Real time tasks can be delayed by interfer-ences occurring by simultaneous access onto shared resources. Meeting deadlines and eliminating contention is often guaranteed by using hypervisors or real time operating systems, which provide a runtime environment to enable tasks to meet their respective deadline in mixed-criticality systems. These runtime environments frequently employ TDMA-based scheduling for a predictable and certifiable execution. In this work, we introduce an algorithm creating scheduling tables for TDMA schedulers that support isolation mechanisms in multicore systems. Using a constructive approach, the resulting scheduling tables support mechanisms for parallel access to shared resources and windows for exclusive execution. Our approach is validated by reconstructing previously generated and valid synthetic scheduling tables. We achieve a high success rate in all cases for a processor utilization of up to 80 % with an algorithm runtime of 10 seconds.

The development of self-driving cars and driver-assistance systems necessitates highly interconnected system architectures with increasing communication volume between processing units. Increased communication as well as information exchange between the heterogeneous parts of distributed system architectures contributes to the rising complexity of future cars. Exploiting this complexity, numerous successful attacks on consumer vehicles were presented. These attacks capitalized on masking effects inside the communication structure, created by components acting as bridges between communication interfaces. This results in the obfuscation of information sources, allowing malicious messages to be sent over these communication interfaces. This paper introduces a method to represent and mitigate these masking effects by using a formal model to describe communication architectures. In addition to that, the generation of monitoring components to detect specified suspicious information flows, which signify an attack on the vehicle, is shown. This approach allows the user to model suspicious information flows originating in system parts that are inaccessible and not modifiable, and to generate monitoring components for communication interfaces which the user has access to. To demonstrate the model and generation, a sample in-vehicle network including a Xilinx UltraScale+ MPSoC is described. Generating monitoring components for the FPGA included inside takes up 4,140 look-up tables and 3,769 registers, corresponding to 1.5 % LUTs and 0.7 % registers inside the FPGA.