End-to-end autonomous driving systems have achieved significant progress, yet their adversarial robustness remains largely underexplored. In this work, we conduct a closed-loop evaluation of state-of-the-art autonomous driving agents under black-box adversarial threat models in CARLA. Specifically, we consider three representative attack vectors on the visual perception pipeline: (i) a physics-based blur attack induced by acoustic waves, (ii) an electromagnetic interference attack that distorts captured images, and (iii) a digital attack that adds ghost objects as carefully crafted bounded perturbations on images. Our experiments on two advanced agents, Transfuser and Interfuser, reveal severe vulnerabilities to such attacks, with driving scores dropping by up to 99% in the worst case, raising valid safety concerns. To help mitigate such threats, we further propose a lightweight Attack Detection model for Autonomous Driving systems (AD2) based on attention mechanisms that capture spatial-temporal consistency. Comprehensive experiments across multi-camera inputs on CARLA show that our detector achieves superior detection capability and computational efficiency compared to existing approaches.

Vehicle platooning has emerged as a prominent Intelligent Transportation Systems (ITS) application due to its promise toward enabling high-speed movement of Connected Autonomous Vehicle (CAV) fleets in a close formation. This close formation is usually associated with stringent constraints such as a short and strictly bounded safety gaps between consecutive platoon vehicles. In order to meet these stringent specifications, CAV fleets critically depend on the underlying platoon communication protocols, which are vulnerable to various types of attacks that may be launched by an attacker. For instance, a common attack, namely False Data Injection (FDI) attack, can potentially disrupt and destabilize a platoon’s close formation by causing collisions among platoon vehicles, or causing potential traffic disruption due to platoon slowdown, thus making the platoon unsafe . One mechanism for mitigating an FDI attack can be the placement of uniformly separated Road-Side Units (RSUs) along the path of a vehicle platoon. The RSUs can act as the root of trust to detect and mitigate attack attempts. However, frequent RSU placements over a path can lead to prohibitive deployment costs. In this work, we first formulate a constraint optimization problem which aims to minimize RSU deployments along a path (by maximizing the inter-RSU distance), while ensuring that the safety of a platoon under a given FDI attack scenario is guaranteed. Our methodology outputs an RSU placement solution such that the worst-case attack (which spans the entire inter-RSU blind spot) is unable to violate the safety guarantee of the platoon. A platoon’s robustness, in the presence of state-of-the-art attack detectors and trusted RSUs, is defined by its resilience against possible stealthy FDI attacks in the inter-RSU blind spots. We leverage this concept and propose a novel SMT-based hierarchical solution strategy. Our method iteratively hypothesizes an inter-RSU distance and formally checks the safety of the resulting platooning solution against possible attack scenarios. The process terminates when the RSU deployment spacings can no longer be relaxed without violating safety constraints. We motivate this work through simulations in PLEXE. Our experimental results demonstrate that the method is able to minimize RSU deployments while preserving safety, under diverse real-world highway platooning scenarios.

Increasing interconnectivity in modern safety-critical cyber-physical systems (CPSs) renders them susceptible to attacks like false data injection (FDI). Due to computation and communication resource constraints, it is infeasible to encrypt all data exchanges in such systems. As the other alternative, the lightweight statistical detectors are system-agnostic in nature; attackers can launch stealthy FDI attacks with a high degree of sophistication. This research introduces an adaptive parameterisation method for stateful anomaly detectors to fill this security gap. The study includes a theoretical analysis for statistical evidence of stealthy data falsifications. The proposed adaptive detection framework has the capability to continuously observe the system’s behaviour in real time, with the goal of rapidly detecting FDI incidents using this statistical evidence. We propose a novel parameter tuning strategy to guarantee early detection of FDI attacks, keeping the false alarms to a minimum. Its efficacy is evaluated in CPS case studies from different domains and in an automotive Hardware-in-the-Loop (HIL) setup.

Constrained Reinforcement Learning (RL) aims to maximize the return while adhering to predefined constraint limits, which represent domain-specific safety requirements. In continuous control settings, where learning agents govern system actions, balancing the trade-off between reward maximization and constraint satisfaction remains a significant challenge. Policy optimization methods often exhibit instability near constraint boundaries, resulting in suboptimal training performance. To address this issue, we introduce a novel approach that integrates an adaptive incentive mechanism in addition to the reward structure to stay within the constraint bound before approaching the constraint boundary. Building on this insight, we propose Incrementally Penalized Proximal Policy Optimization (IP3O), a practical algorithm that enforces a progressively increasing penalty to stabilize training dynamics. Through empirical evaluation on benchmark environments, we demonstrate the efficacy of IP3O compared to the performance of state-of-the-art Safe RL algorithms. Furthermore, we provide theoretical guarantees by deriving a bound on the worst-case error of the optimality achieved by our algorithm.

The future of automotive communication hinges on integrating legacy real-time protocols with advanced Ethernet technologies to empower Software-Defined Vehicles (SDVs). SDVs propose the adoption of the zonal computing architectures, which centralize vehicle functions into distinct zones connected by a high-speed communication backbone. While on the one hand, different zones can employ distinct network protocols like CAN, FlexRay, etc., Time Sensitive Ethernet (IEEE802.1Q) is being projected as the most promising protocol for the central backbone network. With such a heterogeneous distributed platform, SDVs demand reliable and deterministic end-to-end communication strategies, especially for zone-to-backbone or interzonal traffic via the central backbone. Although, there exist a few strategies for message transmission across heterogeneous network domains, they are ad-hoc in nature and oblivious to the precise demands of the control applications they cater to. These drawbacks may lead to poor bandwidth utilization and/or network congestion. Opposed to these ad-hoc techniques, this work proposes an optimal SMT (Satisfiability Modulo Theories) formulation for i) multiplexing periodic zonal message frames onto a minimum number of Ethernet frames, taking into account (m, k)-firmness-based relaxations on specific message flows, and ii) routing Ethernet frames between specified source and destination switches. Through extensive experimental evaluations of the proposed formulation using Z3 solver demonstrate substantial performance improvements, showing at least 30% gain in frame utilization under diverse traffic conditions and timing constraints. Our results validate the proposed approach as a robust solution for ensuring efficient and predictable real-time communication in futuristic SDVs.

Smart meters provide fine-grained power usage profiles of consumers to various utility providers, thus facilitating multiple grid functionalities such as load monitoring, Real-Time Pricing (RTP), demand response, and so on. However, information leakage from such usage profiles reveals consumers’ private day-to-day life patterns and their home presence/absence, as the state-of-the-art metering strategies lack adequate security and privacy measures. Since Smart grid communication infrastructure supports low bandwidth, it prohibits the usage of computation-intensive cryptographic solutions. Among different privacy-preserving smart meter streaming methods, data manipulation techniques can easily be implemented in smart meters and do not require installing any storage devices or alternative energy sources. For this purpose, Differential Privacy (DP) is widely adopted in the literature due to its solid mathematical foundation. However, the effect of such manipulations on the RTP control is worth exploring since pricing signals operate in a closed-loop between consumers and utilities. This brings up the privacy-utility tradeoff problem between the user’s achieved privacy and the performance of the pricing loop of Smart grids, an area where the characterization between privacy and pricing control performance is not yet established. We analytically highlight such privacy-utility tradeoff in the closed-loop RTP systems in terms of achieved privacy and the overall generation scheduling errors. We utilize the notion of \(w\) -event privacy and present a RTP aware DP scheme that promises strong user privacy and guarantees pricing signal stabilization irrespective of the privacy level of the DP mechanism. Finally, we show the efficiency and robustness of our scheme by performing extensive experimental validation on MATLAB and, subsequently, on an in-house smart meter test bed.

With increasing transistor density, modern heterogeneous embedded processors often exhibit high temperature gradients due to complex application scheduling scenarios which may have missed design considerations. In many use cases, off-chip ”active” cooling solutions are considered prohibitive in such reduced form factors. Core frequency throttling by existing dynamic thermal management techniques often compromises the Quality-of-Service (QoS) and violates real-time deadlines. This necessitates the adoption of intelligent resource management that simultaneously manages both thermal and latency performance. Coupled with the complexity of modern heterogeneous multi-cores, the periodic application updates that cater to ever-changing user requirements often render model-driven thermal-aware resource allocation approaches unsuitable for heterogeneous multi-core systems. For such application-architecture scenarios, we propose a novel self-learning based resource manager using Reinforcement Learning that intelligently manipulates core frequencies and task set mappings to fulfill thermal and latency objectives. Our framework employs a data-driven system modeling technique using Gaussian Process Regression to enable efficient offline training of this learning-based resource manager to avoid challenges associated with initial online training. We evaluate the approach on a heterogeneous embedded CPU-GPU platform with real workloads and observe a significant reduction in peak operating temperature when compared to the default onboard frequency governor as well as other learning-based state-of-the-art approaches.

Safe Reinforcement Learning (SRL) algorithms aim to learn a policy that maximizes the reward while satisfying the safety constraints. One of the challenges in SRL is that it is often difficult to balance the two objectives of reward maximization and safety constraint satisfaction. Existing algorithms utilize constraint optimization techniques like penalty-based, barrier penalty-based, and Lagrangian-based dual or primal policy optimizations methods. However, they suffer from training oscillations and approximation errors, which impact the overall learning objectives. This paper proposes the Permeable Penalty Barrier-based Policy Optimization (P2BPO) algorithm that addresses this issue by allowing a small fraction of penalty beyond the penalty barrier, and a parameter is used to control this permeability. In addition, an adaptive penalty parameter is used instead of a constant one, which is initialized with a low value and increased gradually as the agent violates the safety constraints. We have also provided a theoretical proof of the proposed method's performance guarantee bound, which ensures that P2BPO can learn a policy satisfying the safety constraints with high probability while achieving a higher expected reward. Furthermore, we compare P2BPO with other SRL algorithms on various SRL tasks and demonstrate that it achieves better rewards while adhering to the constraints.

Modern cyber-physical systems (CPSs) employ an increasingly large number of software control loops to enhance their autonomous capabilities. Such large task sets and their dependencies may lead to deadline misses caused by platform-level timing uncertainties, resource contention, etc. To ensure the schedulability of the task set in the embedded platform in the presence of these uncertainties, there exist co-design techniques that assign task periodicities such that control costs are minimized. Another line of work exists that addresses the same platform schedulability issue by skipping a bounded number of control executions within a fixed number of control instances. Considering that control tasks are designed to perform robustly against delayed actuation (due to deadline misses, network packet drops etc.) a bounded number of control skips can be applied while ensuring certain performance margin. Our work combines these two control scheduling co-design disciplines and develops a strategy to adaptively employ control skips or update periodicities of the control tasks depending on their current performance requirements. For this we leverage a novel theory of automata-based control skip sequence generation while ensuring periodicity, safety and stability constraints. We demonstrate the effectiveness of this dynamic resource sharing approach in an automotive Hardware-in-loop setup with realistic control task set implementations.

Low-power edge devices equipped with Graphics Processing Units (GPUs) are a popular target platform for real-time scheduling of inference pipelines. Such application-architecture combinations are popular in Advanced Driver-assistance Systems for aiding in the real-time decision-making of automotive controllers. However, the real-time throughput sustainable by such inference pipelines is limited by resource constraints of the target edge devices. Modern GPUs, both in edge devices and workstation variants, support the facility of concurrent execution of computation kernels and data transfers using the primitive of streams , also allowing for the assignment of priority to these streams. This opens up the possibility of executing computation layers of inference pipelines within a multi-priority, multi-stream environment on the GPU. However, manually co-scheduling such applications while satisfying their throughput requirement and platform memory budget may require an unmanageable number of profiling runs. In this work, we propose a Deep Reinforcement Learning (DRL)-based method for deciding the start time of various operations in each pipeline layer while optimizing the latency of execution of inference pipelines as well as memory consumption. Experimental results demonstrate the promising efficacy of the proposed DRL approach in comparison with the baseline methods, particularly in terms of real-time performance enhancements, schedulability ratio, and memory savings. We have additionally assessed the effectiveness of the proposed DRL approach using a real-time traffic simulation tool IPG CarMaker.

Neural network pruning is a technique of network compression by removing weights of lower importance from an optimized neural network. Often, pruned networks are compared in terms of accuracy, which is realized in terms of rewards for Deep Reinforcement Learning (DRL) networks. However, networks that estimate control actions for safety-critical tasks, must also adhere to safety requirements along with obtaining rewards. We propose a methodology to iteratively refine the weights of a pruned neural network such that we get a sparse high-performance network without significant side effects on safety.

Modern smart grids utilize advanced sensors and digital communication to manage the flow of electricity from generation source to consumption points. They also employ anomaly detection units and phasor measurement units (PMUs) for security and monitoring of grid behavior. However, as smart grids are distributed, vulnerability analysis is necessary to identify and mitigate potential security threats targeting the sensors and communication links. We propose a novel algorithm that uses measurement parameters, such as power flow or load flow, to identify the smart grid's most vulnerable operating intervals. Our methodology incorporates a Monte Carlo simulation approach to identify these intervals and deploys a deep reinforcement learning agent to generate attack vectors during the identified intervals that can compromise the grid's safety and stability in the minimum possible time, while remaining undetected by local anomaly detection units and PMUs. Our approach provides a structured methodology for effective smart grid vulnerability analysis, enabling system operators to analyze the impact of attack parameters on grid safety and stability and facilitating suitable design changes in grid topology and operational parameters.

Modern cyber-physical systems (CPSs) consist of numerous control units interconnected by communication networks. Each control unit is responsible for executing possibly multiple safety-critical and non-critical tasks in real time. Adversaries can exploit the deterministic behaviour maintained in such realtime systems to launch schedule-based attacks on safety-critical tasks. This paper aims to prevent the possibility of such timing inference-based side-channel attacks by executing safety-critical control tasks using a multi-rate schedule without hampering performance. With this strategy, we propose a novel attack-aware dynamic priority schedule randomization policy with the goal of success rate minimization of schedule-based attacks on safetycritical tasks.

Modern vehicles contain a multitude of electronic control units that implement software features controlling most of the operational, entertainment, connectivity, and safety aspects of the vehicle. However, with security requirements often being an afterthought in automotive software development, incorporation of such software features with intra- and inter-vehicular connectivity requirements often opens up new attack surfaces. Demonstrations of such security vulnerabilities in past reports and literature bring in the necessity to formally analyze how secure automotive control systems really are against adversarial attacks. Modern vehicles often incorporate onboard monitoring systems that test the sanctity of data samples communicated among controllers and detect possible attack/noise insertion scenarios. The performance of such monitors against security threats also needs to be verified. In this work, we outline a rigorous methodology for estimating the vulnerability of automotive CPSs. We provide a computer-aided design framework that considers the model-based representation of safety-critical automotive controllers and monitoring systems working in a closed loop with vehicle dynamics and verifies their safety and robustness w.r.t. false data injection attacks. Symbolically exploring all possible combinations of attack points of the input automotive CPS, the proposed framework tries to find out which sensor and/or actuation signal is vulnerable by generating stealthy and successful attacks using a formal method-based counter-example guided abstract refinement process. We also validate the efficacy of the proposed framework using a case study performed in an industry-scale simulator.

Neural Network (NN)-based real-time inferencing tasks are often co-scheduled on GPGPU-style edge platforms. Existing works advocate using different NN parameters for the same detection task in different environments. However, realizing such approaches remains challenging, given accelerator devices’ limited on-chip memory capacity. As a solution, we propose a multi-pass, time- and space-aware scheduling infrastructure for embedded platforms with GPU accelerators. The framework manages the residency of NN parameters in the limited on-chip memory while simultaneously dispatching relevant compute operations. The mapping decisions for memory operations and compute operations to the underlying resources of the platform are first determined in an offline manner. For this, we proposed a constraint solver-assisted scheduler that optimizes for schedule makespan. This is followed by memory optimization passes, which take the memory budget into account and accordingly adjust the start times of memory and compute operations. Our approach reports a 74%–90% savings in peak memory utilization with 0%–33% deadline misses for schedules that suffer miss percentage in ranges of 25%–100% when run using existing methods.

Smart metering is a mechanism through which fine-grained electricity usage data of consumers is collected periodically in a smart grid. However, a growing concern in this regard is that the leakage of consumers' consumption data may reveal their daily life patterns as the state-of-the-art metering strategies lack adequate security and privacy measures. Many proposed solutions have demonstrated how the aggregated metering information can be transformed to obscure individual consumption patterns without affecting the intended semantics of smart grid operations. In this paper, we expose a complete break of such an existing privacy preserving metering scheme [10] by determining individual consumption patterns efficiently, thus compromising its privacy guarantees. The underlying methodol-ogy of this scheme allows us to - i) retrieve the lower bounds of the privacy parameters and ii) establish a relationship between the privacy preserved output readings and the initial input readings. Subsequently, we present a rigorous experimental validation of our proposed attacking methodology using real-life dataset to highlight its efficacy. In summary, the present paper queries: Is the Whole lesser than its Parts? for such privacy aware metering algorithms which attempt to reduce the information leakage of aggregated consumption patterns of the individuals.

Recent developments in the smart mobility domain have transformed automobiles into networked transportation agents helping realize new age, large-scale intelligent transportation systems (ITS). The motivation behind such networked transportation is to improve road safety as well as traffic efficiency. In this setup, vehicles can share information about their speed and/or acceleration values among themselves and infrastructures can share traffic signal data with them. This enables the connected vehicles (CVs) to stay informed about their surroundings while moving. However, the inter-vehicle communication channels significantly broaden the attack surface. The inter-vehicle network enables an attacker to remotely launch attacks. An attacker can create collision as well as hamper performance by reducing the traffic efficiency. Thus, security vulnerabilities must be taken into consideration in the early phase of CVs' development cycle. To the best of our knowledge, there exists no such automated simulation tool using which engineers can verify the performance of CV prototypes in the presence of an attacker. In this work, we present an automated tool flow that facilitates false data injection attack synthesis and simulation on customizable platoon structure and vehicle dynamics. This tool can be used to simulate as well as design and verify control- theoretic light-weight attack detection and mitigation algorithms for CVs.

We present an ongoing work on countermeasure design against timing attacks specific to real-time safety-critical Cyber Physical Systems (CPS). Such attacks use timing side channels exposed due to worst-case response time based deterministic scheduling decisions. We propose a methodology to partially nullify this determinism by skipping certain control task executions and related data transmissions. As a proof of concept, we demonstrate how such strategic randomization makes it difficult to launch stealthy timing attacks on controller area network (CAN) based systems.

Modern data intensive Cyber-physical Systems ubiquitously employ heterogeneous multiprocessor systems-on chips (MPSoCs) for real-time sensing, computation, and actuation. The low foot-print of such SoCs often leads to high operating temperatures beyond acceptable limits. In this context, conventional thermal management techniques such as Operating System (OS) governed frequency scaling result in drastic degradation of the quality of experience and violation of real-time requirements. In this work, we propose an analytical thermal model for heterogeneous CPU-GPU embedded platforms and demonstrate a Model Predictive Control (MPC) based scheduling strategy with a novel heuristics-based optimization technique that leverages information about future kernels to judiciously choose suitable task mapping options for minimization of the platform's peak (or maximum) temperature to prolong chip's life span while adhering to real-time performance requirements. To the best of our knowledge, this is the first work that considers future awareness along with a variety of online task mapping control actions such as partitioning, migration, and frequency tuning in the context of thermal management in heterogeneous CPU-GPU embedded platforms. We evaluate the proposed heterogeneous framework on an Odroid-XU4 board using OpenCL based workloads and demonstrate its effectiveness in reducing the platform peak temperature.

In the past decade, high performance compute capabilities exhibited by heterogeneous GPGPU platforms have led to the popularity of data parallel programming languages such as CUDA and OpenCL. Developing high performance parallel programming solutions using such languages involve a steep learning curve due to the complexity of the underlying heterogeneous compute devices and their impact on performance. This has led to the emergence of several High Performance Computing frameworks which provide high-level abstractions for easing the development of data-parallel applications on heterogeneous platforms. However, the scheduling decisions undertaken by such frameworks only exploit coarse-grained concurrency in data parallel applications. In this paper, we propose PySchedCL, a framework which explores fine-grained concurrency aware scheduling decisions that harness the power of heterogeneous CPU/GPU architectures efficiently. We showcase the efficacy of such scheduling mechanisms over existing coarse-grained dynamic scheduling schemes by conducting extensive experimental evaluations for a diverse set of popular Deep Learning benchmarks.

In the energy sector, IoT manifests in the form of next-generation power grids that provide enhanced electrical stability, efficient power distribution, and utilization. The primary feature of a Smart Grid is the presence of an advanced bi-directional communication network between the Smart meters at the consumer end and the servers at the Utility Operators. Smart meters are broadly vulnerable to attacks on communication and physical systems. We propose a secure and operationally asymmetric mutual authentication and key-exchange protocol for secure communication. Our protocol balances security and efficiency, delegates complex cryptographic operations to the resource-equipped servers, and carefully manages the workload on the resource-constrained Smart meter nodes using unconventional lightweight primitives such as Physically Unclonable Functions. We prove the security of the protocol using well-established cryptographic assumptions. We implement the proposed scheme end-to-end in a Smart meter prototype using commercial-off-the-shelf products, a Utility server, and a credential generator as the trusted third party. Additionally, we demonstrate a physics-based attack named load modification attack on the Smart meter to demonstrate that merely securing the communication channel using authentication does not secure the meter, but requires further protections to ensure the correctness of the reported consumption. Hence, we propose a countermeasure to such an attack that goes side-by-side with our protocol implementation.

Adjusting the remote electrical tilt (RET) of antennas is one of the important actions targeting run-time optimization of key performance indicators (KPIs) related to service quality in wireless self-organizing networks (SONs). Reinforcement learning (RL) is one of the preferred Machine Learning methods for automating the choice of RET for all the antennas managed by a company in a region. The automated system should ensure that the system will operate within a safe region to maintain a minimum defined service quality. The safe region of operation is typically customizable based on the targeted service quality at any point in time. This customizable nature of the safe region necessitates automated learning of adaptive safety shields for steering the RL agent away from unsafe regions. This paper presents an adaptive safety shield framework that is capable of learning such shields during the training phase of the RL agent. Our adaptive safety shield framework has been evaluated in different RET scenarios, and we have shown the benefits of our proposed framework over the Baseline method currently in use and a vanilla RL-based method in terms of both safety and performance metrics.

Delivering driving comfort in this age of connected mobility is one of the primary goals of semi-autonomous perception systems increasingly being used in modern automotives. The performance of such perception systems is a function of execution rate which demands on-board platform-level support. With the advent of GPGPU compute support in automobiles, there exists an opportunity to adaptively enable higher execution rates for such Advanced Driver Assistant System tasks (ADAS tasks) subject to different vehicular driving contexts. This can be achieved through a combination of program level locality optimizations such as kernel fusion, thread coarsening and core-level DVFS techniques while keeping in mind their effects on task-level deadline requirements and platform-level thermal reliability. In this communication, we present a future-proof, learning-based adaptive scheduling framework that strives to deliver reliable and predictable performance of ADAS tasks while accommodating for increased task-level throughput requirements.

Given that building loads consume roughly 40% of the energy produced in developed countries, smart buildings with local renewable resources offer a viable alternative towards achieving a greener future. Building temperature control strategies typically employ detailed physical models which require a significant amount of time, information and finesse. Even then, due to unknown building parameters and related inaccuracies, future power demands by the building loads are difficult to estimate. This creates unique challenges in the domain of microgrid economic power dispatch for satisfying building power demands through efficient control and scheduling of renewable and non-renewable local resources in conjunction with supply from the main grid. In this work, we estimate the real-time uncertainties in building loads using Gaussian Process (GP) learning and establish the effectiveness of run time model correction in the context of microgrid economic dispatch.

Building loads consume roughly 40% of the energy produced in developed countries, a significant part of which is invested towards building temperature-control infrastructure. Therein, renewable resource-based microgrids offer a greener and cheaper alternative. This communication explores the possible co-design of microgrid power dispatch and building HVAC (heating, ventilation and air conditioning system) actuations with the objective of effective temperature control under minimised operating cost. For this, we attempt control designs with various levels of abstractions based on information available about microgrid and HVAC system models using the Deep Reinforcement Learning (DRL) technique. We provide control architectures that consider model information ranging from completely determined system models to systems with fully unknown parameter settings and illustrate the advantages of DRL for the design prescriptions.

Increased dependence on networked, software-based control has escalated the vulnerabilities of Cyber-Physical Systems (CPSs). Detection and monitoring components developed leveraging dynamical systems theory are often employed as lightweight security measures for protecting such safety-critical CPSs against false data injection attacks. However, existing approaches do not correlate attack scenarios with parameters of detection systems. In this work, we propose real-time attack detection and mitigation strategies for safety-critical CPSs. A Reinforcement Learning (RL) based framework is presented which adaptively sets the parameters of such detectors based on experience learned from attack scenarios. The detection system is provided with a suitable training environment to learn how to maximize the detection rate while minimizing false alarms. Along with the objective of attack detection, our framework also attempts to preserve system performance by judiciously choosing control actions based on the operating region. Our proposed method i) mathematically establishes a detection strategy for fast and accurate FDI attack detection, ii) correlates the key parameters of the detection system by learning from attack scenarios, and iii) incorporates a real-time attack mitigation strategy that uses formally synthesized fast controllers, thus creating an end-to-end defense against FDI attacks for safety-critical CPSs. We evaluate our proposed method using wellknown safety-critical CPS examples.

Thermal efficient resource mapping and scheduling techniques are particularly important for mobile processors because of limited opportunities for external cooling. In mobile processors such as the ones using ARM’s big.LITTLE architectures, the cores of either the big or the LITTLE processor cannot be individually voltage/frequency scaled. However, we show that by forcing all the application threads to a single core, and not having any workload on the other cores of a processor, there is still considerable thermal benefit. This is counter intuitive since all the cores run at the same frequency. We show real measurements and discuss what impact this has on thermal-aware scheduling for such multicore processors.

Recent trends in real-time applications have raised the demand for high-throughput embedded platforms with integrated CPU-GPU based Systems-On-Chip (SoCs). The enhanced performance of such SoCs, however, comes at the cost of increased power consumption, resulting in significant heat dissipation and high on-chip temperatures. The prolonged occurrences of high on-chip temperature can cause accelerated in-circuit ageing, which severely degrades the long-term performance and reliability of the chip. Violation of thermal constraints leads to on-board dynamic thermal management kicking-in, which may result in timing unpredictability for real-time tasks due to transient performance degradation. Recent work in adaptive software design have explored this issue from a control theoretic stand-point, striving for smooth thermal envelopes by tuning the core frequency. Existing techniques do not handle thermal violations for periodic real-time task sets in the presence of dynamic events like change of task periodicity, more so in the context of heterogeneous SoCs with integrated CPU-GPUs. This work presents an OpenCL runtime extension for thermal-aware scheduling of periodic, real-time tasks on heterogeneous multi-core platforms. Our framework mitigates dynamic thermal violations by adaptively tuning task mapping parameters, with the eventual control objective of satisfying both platform-level thermal constraints and task-level deadline constraints. We consider multiple platform-level control actions like task migration, frequency tuning and idle slot insertion as the task mapping parameters. To the best of our knowledge, this is the first work that considers such a variety of task mapping control actions in the context of heterogeneous embedded platforms. We evaluate the proposed framework on an Odroid-XU4 board using OpenCL benchmarks and demonstrate its effectiveness in reducing thermal violations.

The increasing demand for mapping diverse embedded features onto shared electronic control units has brought about novel ways to co-design control tasks and their schedules. These techniques replace traditional implementations of control with new methods, such as pattern-based scheduling of control tasks and adaptive sharing of bandwidth among control loops through orchestration of their execution patterns. In the current practice of control design, once the static execution schedule is prepared for control tasks, no further control-related optimization is attempted for improving the control performance. We introduce, for the first time, an algorithmic mechanism that re-engineers a recurrent control task by enforcing switching between multiple control laws, which are designed for compensating the non-uniform gaps between successive executions of the control task. We establish that such post-processing of control task schedules may potentially help in improving the combined control performance of the co-scheduled control loops that are executing on a shared platform.

Modern electronic systems become evermore complex, yet remain modular, with integrated circuits (ICs) acting as versatile hardware components at their heart. Electronic design automation (EDA) for ICs has focused traditionally on power, performance, and area. However, given the rise of hardware-centric security threats, we believe that EDA must also adopt related notions like secure by design and secure composition of hardware. Despite various promising studies, we argue that some aspects still require more efforts, for example: effective means for compilation of assumptions and constraints for security schemes, all the way from the system level down to the "bare metal"; modeling, evaluation, and consideration of security-relevant metrics; or automated and holistic synthesis of various countermeasures, without inducing negative cross-effects.In this paper, we first introduce hardware security for the EDA community. Next we review prior (academic) art for EDA-driven security evaluation and implementation of countermeasures. We then discuss strategies and challenges for advancing research and development toward secure composition of circuits and systems.

We consider the problem of securing a given control loop implementation of a cyber-physical system (CPS) in the presence of Man-in-the-Middle attacks on data exchange between plant and controller over a compromised network. To this end, there exists various detection schemes which provide mathemat¬ical guarantees against such attacks for the theoretical control model. However, such guarantees may not hold for the actual control software implementation. In this article, we propose a formal approach towards synthesizing attack detectors with varying thresholds which can prevent performance degrading stealthy attacks while minimizing false alarms.

Given the widespread deployment of cyber-physical systems and their safety-critical nature, reliability and security guarantees offered by such systems are of paramount importance. While the security of such systems against sensor attacks have garnered significant attention from researchers in recent times, improving the reliability of a control software implementation against transient environmental disturbances need to be investigated further. Scalable formal methods for verification of actual control performance guarantee offered by software implementations of control laws in the face of sensory faults have been explored in recent work [20]. However, the formal verification of the improvement of system reliability by incorporating sensor fault mitigation techniques like Kalman filtering [29] and sensor fusion [18, 52] remains to be explored. Moreover, system designers face complex tradeoff choices for deciding upon the usage of fault and attack mitigation techniques and scheduling them on available system resources as they incur extra computation load. In the present work, our contributions are threefold. We formally analyze the actual performance guarantee of control software implementations enabled with additional fault mitigation techniques. We consider task-level models of such implementations enabled with security and fault tolerance primitives and construct a timed automata-based model which checks for schedulability on heterogeneous multi-core platforms. We leverage these methodologies in the context of a novel Design-Space-Exploration (DSE) framework that considers target reliability and security guarantees for a control system and computes schedulable design options while considering well-known platform-level security improvement and fault mitigation techniques. We validate our contributions over several case studies from the automotive domain.

Executing a set of control loops over a shared multi-hop (wireless) control network (MCN) requires careful co-scheduling of the control tasks and the routing of sensory/actuation messages over the MCN. In this work, we establish pattern guided aperiodic execution of control loops as a resource-aware alternative to traditional fully periodic executions of a set of embedded control loops sharing a computation and the communication infrastructure. We provide a satisfiability modulo theory–based co-design framework that synthesizes loop execution patterns having optimized control cost as the underlying scheduling scheme together with the associated routing solution over the MCN. The routing solution implements the timed movement of the sensory/actuation messages of the control loops, generated according to those loop execution patterns. From the given settling time requirement of the control loops, we compute a control theoretically sound model using matrix inequalities, which gives an upper bound to the number of loop drops within the finite length loop execution pattern. Next, we show how the proposed framework can be useful for evaluating the fault tolerance of a resource-constrained shared MCN subject to communication link failure.

Heating ventilation and air conditioning (HVAC) systems usually account for the highest percentage of overall energy usage in large-sized smart building infrastructures. The performance of HVAC control systems for large buildings strongly depend on the outside environment, building architecture, and (thermal) zone usage pattern of the building. In large buildings, HVAC system with multiple air handling units (AHUs) is required to fulfill the cooling/heating requirements. In the present work, we propose an energy-aware building resource allocation and economic model predictive control (eMPC) framework for multi-AHU-based HVAC system. The energy consumption of a multi-AHU-based HVAC system significantly depends on how long the AHUs are running, which again is governed by the zone usage demands. Our approach comprises a two-step hierarchical technique where we first minimize the running time of AHUs by suitably allocating building resources (thermal zones) to usage demands for zones. Next, we formulate a finite receding horizon control problem for trading off energy consumption against thermal comfort during HVAC operations. Given a high-level building specification and usage demand, our computer-aided design framework generates building thermal models, allocates usage demands, formulates the control scheme, and simulates it to generate power consumption statistics for the given building with usage demands. We believe that the proposed framework will help in early analysis during the design phase of energy-aware building architecture and HVAC control. The framework can also be useful from a building operator point of view for energy-aware HVAC control as well as for satisfying smart grid demand-response events by HVAC system peak power reduction through automated control actions.

For many embedded systems, such as automotive electronic systems, security has become a pressing challenge. Limited resources and tight timing constraints often make it difficult to apply even lightweight authentication and intrusion detection schemes, especially when retrofitting existing designs. Moreover, traditional hard deadline assumption is insufficient to describe control tasks that have certain degrees of robustness and can tolerate some deadline misses while satisfying functional properties such as stability. In this work, we explore feasible weakly-hard constraints on control tasks, and then leverage the scheduling flexibility from those allowed misses to enhance system's capability for accommodating security monitoring tasks. We develop a co-design approach that 1) sets feasible weakly-hard constraints on control tasks based on quantitative analysis, ensuring the satisfaction of control stability and performance requirements; and 2) optimizes the allocation, priority, and period assignment of security monitoring tasks, improving system security while meeting timing constraints (including the weakly-hard constraints on control tasks). Experimental results on an industrial case study and a set of synthetic examples demonstrated the significant potential of leveraging weakly-hard constraints to improve security and the effectiveness of our approach in exploring the design space to fully realize such potential.

Embedded control systems are an important and often safety-critical class of applications that need to operate reliably even in the presence of faults. We show that intermittent fault scenarios caused by wear-out effects due to a higher density and a smaller geometry of the embedded electronic components may become a reliability concern for real-time embedded control applications. To mitigate the effects of such intermittent faults, we propose a novel fault-tolerant controller design method such that the resulting controllers ensure closed loop stability (i.e., guarantee safety) with only possibly degraded performance under such fault scenarios. In order to measure the amortized performance offered by the software implementations of such fault-tolerant controllers, we provide a program analysis methodology that statically estimates the quality of control guaranteed by the C code implementation of the fault-tolerant control law. This combination of fault-tolerant controller design followed by performance feedback computed using a formal analysis is illustrated with a case study from the automotive domain.

Development of highly reliable embedded control systems is typically performed following the model driven engineering paradigm. Such systems involve software controlled interaction of mechanical subsystems. The aging of the overall system depends on the physical aging or reliability decay of the underlying mechanical components. The reliability of such components degrade according to their rate of usage which again is governed by the software control logic and input environment. Such dependencies of component reliabilities make the problem of deriving system level reliability degradation using exact methods combinatorially intractable. Given the fact that model driven system design advocates the usage of initial high level system models, methods for early stage lifetime reliability and reliability degradation estimation based on such initial models should definitely aid in robust high assurance engineering of such software controlled physical systems. The present work proposes SERD, a lightweight, scalable simulation framework for embedded control systems. It can accommodate active as well as quiescent reliability decay rates of underlying mechanical components. It uses path based reliability modeling to estimate the reliability degradation of component based systems that are controlled by software logic. Its efficacy is further demonstrated using a thorough case study.

Software implementation of multiple embedded control loops often share compute resources. The control performance of such implementations have been shown to improve if the sharing of bandwidth between control loops can be dynamically regulated in response to input disturbances. In the absence of a structured methodology for planning such measures, the scheduler may spend too much time in deciding the optimal scheduling pattern. Our work leverages well known results in the domain of network control systems and applies them in the context of bandwidth sharing among controllers. We provide techniques that may be used a priori for computing co-schedulable execution patterns for a given set of control loops such that stability is guaranteed under all possible disturbance scenarios. Additionally, the design of the control loops optimize the average case control performance by adaptive sharing of bandwidth under time varying input disturbances.

Automotive software applications implement a variety of control algorithms, with many of them being safety-critical in nature. A typical design flow starts with modeling these control algorithms using tools like MATLAB/Simulink. However, at this stage, a number of assumptions, like negligible sensor-to-actuator delay and instantaneous computation of the controller software, are often made. In particular, the details of the software implementation and the computing platform, both eventually defining the timing properties of the applications, are not accounted for. Such idealistic assumptions can cause a significant deviation of the control performance compared to what was proven at the modeling stage. This is usually addressed with multiple design iterations, which are costly and may lead to over-provisioned and thus poorly designed systems. In this paper we attempt to address this problem by proposing a design-and tool flow that integrates software-and platform-level timing information into the high-level modeling stage. We outline our proposed flow using concrete, industry-strength design tools.

The tagged signal model (TSM) is a formal framework for modeling heterogeneous embedded systems. In the present work, we provide a representation of tagged systems using the semantics of Kleene algebra. We further illustrate mechanisms for both behavioral transformational verification through equivalence checking and property verification of heterogeneous embedded systems based on this algebraic representation.

This paper proposes a methodology for performance evaluation of schedules for job-shops modeled using tag machines. The most general tag structure for capturing dependences is shown to be inadequate for the task. A new tag structure is proposed. Comparison of the method with existing ones reveals that the proposed method has no dependence on schedule length in terms of modeling efficiency and it shares the same order of complexity with existing approaches. The proposed method, however, is shown to bear promise of applicability to other models of computation and hence to heterogeneous system models having such constituent models.

The increasing processing power of embedded devices have created the scope for certain applications that could previously be executed in desktop environments only, to migrate into handheld platforms. An important feature of the computing systems of modern times is their support for applications that interact with the user by synthesizing natural speech output. Such applications deliver state of the art performance in desktop environments. However, the real-time performance of such applications in handheld platforms with on-line incoming text streams have not been explored till date. In this work, the performance of a text to speech synthesis application is evaluated on embedded processor architectures and modifications in the underlying hardware platform are proposed for real time performance improvement of the concerned application.