Cameras are crucial sensors for autonomous vehicles. They capture images that are essential for many safety-critical tasks. To process these images, a complex pipeline with multiple layers is used. Security attacks on this pipeline can severely affect passenger safety and system performance. However, many attacks presented in scientific literature overlook the fact that there are different layers and, hence, the feasibility and impact of these attacks can vary. While there has been research to improve the quality and robustness of the image processing pipeline, these efforts are often orthogonal to security research without exploiting potential overlap and synergies. In this work, we aim to bridge this gap by combining security and robustness research for the image processing pipeline in autonomous vehicles. We thoroughly investigated the body of literature on the security and robustness of the image processing pipeline and selected 92 papers for deeper discussion in this SoK. For the security domain, we classify the risk of attacks using the automotive security standard ISO 21434, emphasizing the need to consider all layers for overall system security. With our online tool TARA-CAM, we propose an interactive method to perform threat analysis and risk assessment following the ISO standard. We also demonstrate how existing robustness research can help mitigate the impact of attacks, addressing the current research gap. Finally, we present PICT, an embedded open-source testbed that can influence various parameters across all layers, allowing researchers to analyze the effects of different defense strategies and attack impacts. With this SoK, we contribute a comprehensive discussion and systematic analysis of existing approaches to image processing pipeline security and robustness, together with an open-source tool and testbed that jointly facilitates hardening the image processing pipeline against existing and future security attacks.

Autonomous vehicles rely on deep neural networks (DNNs) for traffic sign recognition, lane centering, and vehicle detection, yet these models are vulnerable to attacks that induce misclassification and threaten safety. Existing defenses (e.g., adversarial training) often fail to generalize and degrade clean accuracy. We introduce Vehicle Vision-Language Models (V2LMs), fine-tuned vision-language models specialized for autonomous vehicle perception, and show that they are inherently more robust to unseen attacks without adversarial training, maintaining substantially higher adversarial accuracy than conventional DNNs. We study two deployments: Solo (task-specific V2LMs) and Tandem (a single V2LM for all three tasks). Under attacks, DNNs drop 33-74%, whereas V2LMs decline by under 8% on average. Tandem achieves comparable robustness to Solo while being more memory-efficient. We also explore integrating V2LMs in parallel with existing perception stacks to enhance resilience. Our results suggest V2LMs are a promising path toward secure, robust AV perception.

Cyclic Queuing and Forwarding (CQF) is a key Time-Sensitive Networking (TSN) shaping mechanism that ensures bounded latency using a simple gate control list (GCL). Recently, variants of CQF, including Cycle Specific Queuing and Forwarding (CSQF) and Multi Cyclic Queuing and Forwarding (MCQF), have emerged. While popular TSN mechanisms such as the Time-Aware Shaper (TAS), Asynchronous Traffic Shaper (ATS), Credit-Based Shaper (CBS), and Strict Priority (SP) have been extensively studied, cyclic shapers have not been thoroughly evaluated. This paper presents a comprehensive analysis of CQF, CSQF, and MCQF, providing insights into their performance. We quantify delays through simulations and quantitative analysis on both synthetic and realistic networks. For the first time, we introduce an open-source OMNeT++ and INET4.4 based framework capable of modeling all three cyclic shaper variants. Our tool facilitates the validation of new algorithms and serves as a benchmark for cyclic shapers. Our evaluations reveal that MCQF supports diverse timing requirements, whereas CSQF, with its additional queue, often results in larger delays and jitter for some TT flows compared to CQF. Additionally, CSQF does not demonstrate significant advantages in TSN networks where propagation delays are less critical than in wide-area networks (WANs).

Autonomous systems face significant challenges due to fluctuating resources and unstable environments, where traditional redundancy strategies for resilience can be inefficient. We present the Reflex pattern, inspired by biological reflexes, promoting system resilience by dynamically adapting to changing resource conditions. By switching between complex and resource-efficient algorithms based on availability, the pattern optimizes efficient resource utilization without extensive redundancy, ensuring essential functionalities remain operational under constraints. To facilitate adoption, we introduce ReflexLang, a domain-specific language (DSL) enabling automated code generation for reflex-pattern-based systems. We validate the pattern's effectiveness in a drone image processing scenario, demonstrating its potential to enhance operational integrity and resilience.

Digital infrastructure is vital for the economy, democracy, and everyday life, yet it is becoming increasingly vulnerable to strategic cyber-attacks. These attacks can lead to significant disruptions, resulting in widespread service outages, financial losses, and a decline in public trust. Ensuring resilience is difficult due to the infrastructure's complexity, the large volume of data involved, and the growing need for quick, coordinated responses. In the EU Horizon project CyberSecDome, we propose a multi-layered framework that provides AI-driven solutions for incident prediction and detection, automated testing, risk assessment, and rapid incident response, supporting continuity amid complex, large-scale cyber threats. Additionally, Cyber-SecDome introduces a virtual reality interface to enhance AI model explainability and provide real-time contextual awareness of ongoing attacks and defense mechanisms. It also enables privacy-aware model sharing across AI systems, fostering secure collaboration among different domes.

With the recent dramatic increase in performance of artificial intelligence and related computing systems, together with advanced sensing, connectivity, and technological platforms, autonomous systems are poised to enter many application domains such as transportation and manufacturing. As autonomy increases, the risks of cybersecurity threats are equally rising, requiring the development of sophisticated methods on all layers of autonomous systems architectures. Therefore, this paper systematically introduces cybersecurity challenges ranging from the physical layer to the system of systems layer defining the collaboration of autonomous systems. Without loss of generality, autonomous vehicles are used to highlight current developments, illustrating which efforts are necessary to achieve secure and safe autonomous systems. Our discussions are comprehensively highlighting which research domains require further investigation and offer promising opportunities to contribute to mitigating cybersecurity challenges of autonomous systems.

As space exploration advances and the commercialization and militarization of space technologies expand, ensuring the security of space assets has become a paramount concern. A key factor contributing to this challenge is the growing reliance on off-the-shelf hardware and software. While such components accelerate the adoption and commercial use of space technologies, they also introduce new vulnerabilities and broaden the attack surface. This paper highlights the critical importance of integrating cybersecurity concepts throughout the entire design lifecycle of space systems. It examines key dimensions of secure space system development, including secure engineering practices, comprehensive testing methodologies, strategies for cyber resiliency, and the role of standardization in fostering a consistent and robust security posture across the industry. By addressing these essential aspects, the paper underscores the need for a holistic, lifecycle-driven approach to safeguarding space systems against evolving cyber threats.

Cameras and the subsequently applied perception algorithms are essential for the safe operation of autonomous vehicles. While many attacks on this processing pipeline are known, their impact is often evaluated on generic, non-automotive Machine Learning models. Although such models are still widely used in research, a realistic attack evaluation is not possible with them. A central problem for security researchers is the lack of realistic open-source Machine Learning models that represent autonomous driving functionalities. In our work, we propose CATI, an open-source framework to evaluate attacks on cameras in autonomous vehicles. Besides two trained models for automotive object detection and traffic sign detection, it is designed to be modular to include further models for other tasks. The two integrated models are specifically trained versions of the established object detection model YOLO. We show different attacks that successfully trick commonly available implementations of YOLO but not our trained models. Additionally, we highlight how the model robustness benefits in challenging real-world scenarios.

Environmental perception and 3D object detection are key factors for advancing autonomous driving and require robust security measures to ensure optimal performance and safety. However, established methods often focus only on protecting the involved data and overlook synchronization and timing aspects, which are equally crucial for ensuring profound system security. For instance, multi-modal sensor fusion techniques for object detection can be affected by input desynchronization resulting from random communication delays or malicious cyber attacks, as these techniques combine various sensor inputs to extract shared features present in their data streams simultaneously. Current research acknowledges the importance of temporal alignment in this context. However, the presented studies typically assume genuine system behavior and neglect the potential threat of malicious attacks, as the suggested solutions lack strategies to prevent intentional data misalignment. Additionally, they do not adequately address how sensor input desynchronization affects fusion performance in depth. This paper investigates how desynchronization attacks impact sensor fusion algorithms for 3D object detection. We evaluate how varying sensor delays affect the detection performance and link our findings to the internal architecture of the sensor fusion algorithms and the influence of specific traffic scenarios and their dynamics. We compiled four datasets covering typical traffic scenarios for our empirical evaluation and tested them on four representative fusion algorithms. Our results show that all evaluated algorithms are vulnerable to input desynchronization, as the performance declines with increasing sensor delays, highlighting the existing lack of resilience to desynchronization attacks. Furthermore, we observe that the Light Detection and Ranging (LiDAR) sensor is significantly more susceptible to delays than the camera. Finally, our experiments indicate that the chosen fusion architecture correlates with the system’s resilience against desynchronization, as our results demonstrate that the early fusion approach provides greater robustness than others.

The 32-bit Unix time, which is commonly used in computer systems, will overflow on 2038-01-19. Extending the format to 64 bit would allow to count seconds for 584 billion years but misses the opportunity to add features, such as sub-second precision or relative time encoding, which are useful for a universal datetime encoding.We propose and implement Flexpoch, a versatile 64-bit time encoding that is compatible with Unix time, has a high range of 21 thousand years, supports leap seconds and timezone offsets, and offers multiple precisions from 119 ns to millennia while being highly resource-efficient.

Time-Sensitive Networking (TSN) supports multiple traffic types with diverse timing requirements, such as hard real-time (HRT), soft real-time (SRT), and Best Effort (BE) within a single network. To provide varying Quality of Service (QoS) for these traffic types, TSN incorporates different scheduling and shaping mechanisms. However, assigning traffic types to the proper scheduler or shaper, known as Traffic-Type Assignment (TTA), is a known NP-hard problem. Relying solely on domain expertise to make these design decisions can be inefficient, especially in complex network scenarios. In this paper, we present a proof-of-concept highlighting the advantages of a learning-based approach to the TTA problem. We formulate an optimization model for TTA in TSN and develop a Proximal Policy Optimization (PPO) based Deep Reinforcement Learning (DRL) model, called “TTASelector”, to assign traffic types to TSN flows efficiently. Using synthetic and realistic test cases, our evaluation shows that TTASelector assigns a higher number of traffic types to HRT and SRT flows compared to the state-of-the-art Tabu Search-based metaheuristic method.

We introduce Zero-Knowledge Location Privacy (ZKLP), enabling users to prove to third parties that they are within a specified geographical region while not disclosing their exact location. ZKLP supports varying levels of granularity, allowing for customization depending on the use case. To realize ZKLP, we introduce the first set of Zero-Knowledge Proof (ZKP) circuits that are fully compliant to the IEEE 754 standard for floating-point arithmetic. Our results demonstrate that our floating point circuits amortize efficiently, requiring only 64 constraints per operation for 215single-precision floating-point multiplications. We utilize our floating point implementation to realize the ZKLP paradigm. In comparison to a baseline, we find that our optimized implementation has 15.9× less constraints utilizing single precision floating-point values, and 12.2× less constraints when utilizing double precision floating-point values. We demonstrate the practicability of ZKLP by building a protocol for privacy preserving peer-to-peer proximity testing - Alice can test if she is close to Bob by receiving a single message, without either party revealing any other information about their location. In such a setting, Bob can create a proof of (non-)proximity in 0.26 s, whereas Alice can verify her distance to about 470 peers per second.

Domain-specific languages for safety validation testing have reduced the complexity of safety scenario generation and enhanced the adoption of Autonomous Driving (AD) safety testing. Yet, there is a lack of comparable solutions for cybersecurity testing. In this work, we present ADSecLang, a domain-specific language for cybersecurity testing of AD systems. ADSecLang provides a concise syntax that enables the tester to construct scenarios for AD cybersecurity straightforwardly that can be implemented in an AD test simulation platform. The proposed language is validated within the CARLA AD simulation platform in a use-case scenario of two diverse AV camera sensor manipulation attacks on a state-of-the-art trajectory-guided AD solution. The results show that the language is able to support the translation of threats from an abstract description to the technical implementation of the attack test cases and that these test cases could identify vulnerabilities in the target AD solution.

Autonomous driving (AD) software needs to be secure, and its decision control must be robust against cyber threats. The development of cybersecurity solutions for legacy and connected vehicles has been supported by an array of opensource datasets, mainly focused on the CAN Bus protocol. There exists a lack of open-source cybersecurity data and communitydriven platforms that enable fair and reproducible evaluations of AD algorithms from a cybersecurity perspective and defensive mechanisms. This study addresses this problem by conducting an in-depth analysis of the data ecosystem for AD cybersecurity and introducing an initial open-source data platform, ADSecData. ADSecData offers the community a comprehensive 4 -stage method for the creation of AD cybersecurity datasets, along with an initial common dataset. We evaluate the utility of ADSecData through a case study featuring diverse malicious injection attacks, including GPS spoofing, LiDAR point-cloud manipulation, and sensor interference. The results demonstrate the viability of ADSecData in generating AD cybersecurity datasets and supporting community research and development.

Cyclic queuing and forwarding (CQF) is a time-sensitive networking (TSN) shaping mechanism that provides bounded latency and deterministic Quality of Service (QoS). However, CQF’s use of a single cycle restricts its ability to support TSN traffic with diverse timing requirements. multi-cyclic queuing and forwarding (Multi-CQF) is a new and emerging TSN shaping mechanism that uses multiple cycles on the same egress port, allowing it to accommodate TSN flows with varied timing requirements more effectively than CQF. Despite its potential, current Multi-CQF configuration studies are limited, leading to a lack of comprehensive research, poor understanding of the mechanism, and limited adoption of Multi-CQF in practical applications. Previous work has shown the impact of time injection (TI), defined as the start time of time-triggered (TT) flows at the source node, on CQF queue resource utilization. However, the impact of TI has not yet been explored in the context of Multi-CQF. This article introduces a set of constraints and leverages domain-specific knowledge (DSK) to reduce the search space for Multi-CQF configuration. Building on this foundation, we develop an open-source genetic algorithm (GA) and a hybrid GA-simulated annealing (GASA) approach to efficiently configure Multi-CQF networks and introduce TI in Multi-CQF to enhance schedulability. Experimental results show that our proposed algorithms significantly increase the number of scheduled TT flows compared to the baseline simulated annealing (SA) model, improving scheduling by an average of 15%. Additionally, GA-SA (GASA) achieves a 20% faster convergence rate and lower time complexity, outperforming the SA model in speed, and efficiency.

The growing trend of software-controlled operation, control, and development of modern vehicles has led to the emergence of the software-defined vehicle (SDV) design paradigm. SDVs contain increasing software components and, like other cyber-physical systems, are more susceptible to cyber-attacks. However, patching vulnerabilities in these systems may take time, exposing them to cyber threats. To limit the effect of an attack, one solution is tomigratecritical tasks co-located on the same electronic control unit (ECU) with a compromised component to another ECU. However, existing migration solutions, often designed for fault tolerance, introduce overhead and ignore security parameters. This paper introduces ShiftGuard,a security-aware, distributed task migration mechanismfor SDVs. We explore various design decisions that may affect the performance of ShiftGuard. We implemented and demonstrated the efficacy of ShiftGuard on an automotive platform running the controller area network (CAN) protocol and found that the end-to-end latency of the task migration decision is less than 17 ms for a system with 15 tasks hosted in 3 ECUs. We also performed extensive design-space exploration using a custom-developed simulator. Our experiments with synthetic workloads show that any task migration request has a 76%-100% success rate. Additionally, we demonstrate ShiftGuard’s scalability for large networks of up to 70 ECUs, making it highly suitable for automotive systems with SDV capabilities.

Transport Layer Security (TLS) is foundational for safeguarding client-server communication. However, it does not extend integrity guarantees to third-party verification of data authenticity. If a client wants to present data obtained from a server, it cannot convince any other party that the data has not been tampered with. TLS oracles ensure data authenticity beyond the client-server TLS connection, such that clients can obtain data from a server and ensure provenance to any third party, without server-side modifications. Generally, a TLS oracle involves a third party, the verifier, in a TLS session to verify that the data obtained by the client is accurate. Existing protocols for TLS oracles are communication-heavy, as they rely on interactive protocols. We present ORIGO, a TLS oracle with constant communication. Similar to prior work, ORIGO introduces a third party in a TLS session, and provides a protocol to ensure the authenticity of data transmitted in a TLS session, without forfeiting its confidentiality. Compared to prior work, we rely on intricate details specific to TLS 1.3, which allow us to prove correct key derivation, authentication and encryption within a Zero Knowledge Proof (ZKP). This, combined with optimizations for TLS 1.3, leads to an efficient protocol with constant communication in the online phase. Our work reduces online communication by 375× and online runtime by up to 4.6×, compared to prior work.

Web users can gather data from secure endpoints and demonstrate the provenance of sensitive data to any third party by using privacy-preserving TLS oracles. In practice, privacy-preserving TLS oracles remain limited and cannot verify larger, sensitive data sets. In this work, we introduce new optimizations for TLS oracles, which enhance the efficiency of selectively verifying the provenance of confidential web data. The novelty of our work is a construction which secures an honest verifier zero-knowledge proof system in the asymmetric privacy setting while retaining security against malicious adversaries. Concerning TLS 1.3 in the one round-trip time (1-RTT) mode, we propose a new, optimized garble-then-prove paradigm in a security setting with malicious adversaries. Our improvements reach new performance benchmarks and facilitate a practical deployment of privacy-preserving TLS oracles in web browsers.

High-precision time synchronization is a vital prerequisite for many modern applications and technologies, including Smart Grids, Time-sensitive Networking (TSN), and 5G networks. Although the Precision Time Protocol (PTP) can accomplish this requirement in trusted environments, it becomes unreliable in the presence of specific cyber attacks. Mainly, time delay attacks pose the highest threat to the protocol, enabling attackers to diverge targeted clocks undetected. With the increasing danger of cyber attacks, especially against critical infrastructure, there is a great demand for effective countermeasures to secure both time synchronization and the applications that depend on it. However, current solutions are not sufficiently capable of mitigating sophisticated delay attacks. For example, they lack proper integration into the PTP protocol, scalability, or sound evaluation with the required microsecond-level accuracy. This work proposes an approach to detect and counteract delay attacks against PTP, which is based on cyclic path asymmetry measurements over redundant paths. We leverage Software-defined Networking (SDN) capabilities to dynamically find these redundant paths in arbitrary networks, recommend new links to increase the network’s security, and ensure deterministic routing. Furthermore, we show how path redundancy can be utilized to reveal and mitigate undesirable asymmetries on the synchronization path that cause the malicious clock divergence. Moreover, we propose PTPsec, a secure PTP protocol, and its implementation based on the latest IEEE 1588-2019 standard. With PTPsec, we advance the conventional PTP to support reliable delay attack detection and mitigation. We validate our approach in software simulations and on a hardware testbed, which includes an attacker capable of performing static and incremental delay attacks at a microsecond precision. Our experimental results show that the proposed approach is scalable, and all attack scenarios can be reliably detected and mitigated with minimal detection time.

Autonomous driving (AD) system designers need methods to efficiently debug vulnerabilities found in control algorithms. Existing methods lack alignment to the requirements of AD control designers to provide an analysis of the parameters of the AD system and how they are affected by cyber-attacks. We introduce ADAssure, a methodology for debugging AD control system algorithms that incorporates automated mechanisms which support generation of assertions to guide the AD system designer to identify vulnerabilities in the system. Our evaluation of ADAssure on a real-world AD vehicular system using diverse cyber-attacks developed a set of assertions that identified weaknesses in the OpenPlanner 2.5 AD planning algorithm and its constituent planning functions. Working with an AD control system designer and safety validation engineer, the results of ADAssure identified remediation of the AD control system, which can support the implementation of a redundant observer for data integrity checking and improvements to the planning algorithm. The adoption of ADAssure improves autonomous system design by providing a systematic approach to enhance safety and reliability through the identification and mitigation of vulnerabilities from corner cases.

Latest identity systems rely on public blockchains to enhance user autonomy and reduce tracking from conventional identity providers. At the same time, identity systems integrate novel technologies such as zero-knowledge proofs (ZKPs) to improve data privacy and data compliance. We show that a naive verification of ZKPs at smart contracts enables replay attacks: Attackers can replay ZKPs at arbitrary times without having access to the private inputs that are required for the computation of the ZKP. To solve this problem, we construct a transaction sequence which verifies time-bound and replay-resistant ZKPs at smart contracts. Our construction introduces an additional but constant fee of 0.14${\$}$ per verification of a ZKP on the public blockchain Ethereum. With our new construction, we propose Portal, a novel identity system for decentralized single sign-on.

Modern privacy-enhancing technologies reach new forms of computation and data privacy according to a statement (e.g. private value $\gt \mathbf{100}$). However, beyond the statement expression, the description of a private computation circuit requires knowledge of security algorithms protecting private values. To keep the description of private and compliant computation circuits as close to the statement expression as possible, we introduce a new composable policy language called zkPolicy. Further, we introduce a policy transpiler, called zkGen, to decouple the complexity expressed via zkPolicy from the complexity of the underlying security algorithms. Our results show that, with zkPolicy, the description of compliant data provenance circuits can be reduced from 957 to 22 lines of code. And, with zkGen, we automate the generation and composition of private computation circuits to a minimum effort of configuring a zkPolicy.

High-precision time synchronization is a vital prerequisite for many modern applications and technologies, including Smart Grids, Time-Sensitive Networking (TSN), and 5G networks. Although the Precision Time Protocol (PTP) can accomplish this requirement in trusted environments, it becomes unreliable in the presence of specific cyber attacks. Mainly, time delay attacks pose the highest threat to the protocol, enabling attackers to diverge targeted clocks undetected. With the increasing danger of cyber attacks, especially against critical infrastructure, there is a great demand for effective countermeasures to secure both time synchronization and the applications that depend on it. However, current solutions are not sufficiently capable of mitigating sophisticated delay attacks. For example, they lack proper integration into the PTP protocol, scalability, or sound evaluation with the required microsecond-level accuracy. This work proposes an approach to detect and counteract delay attacks against PTP based on cyclic path asymmetry measurements over redundant paths. For that, we provide a method to find redundant paths in arbitrary networks and show how this redundancy can be exploited to reveal and mitigate undesirable asymmetries on the synchronization path that cause the malicious clock divergence. Furthermore, we propose PTPsec, a secure PTP protocol and its implementation based on the latest IEEE 1588-2019 standard. With PTPsec, we advance the conventional PTP to support reliable delay attack detection and mitigation. We validate our approach on a hardware testbed, which includes an attacker capable of performing static and incremental delay attacks at a microsecond precision. Our experimental results show that all attack scenarios can be reliably detected and mitigated with minimal detection time.

Highly connected and automated driving technologies have ushered digital transformation and flexibility to modern cars. However, the vehicle's attack surface has significantly expanded due to increased connectivity. To address this problem, automotive manufacturers are adopting more secure practices driven by standards and regulations. In addition to the deployed cryptographically strong security measures in automotive, we need an Intrusion Detection and Prevention System (IDPS) that actively monitors the vehicle for intrusions, prevents them, and provides notification, as required by UN Regulation No. 155. In this work, we aim to identify the current limitations of the existing automotive approaches and contribute to an advanced IDPS solution. We propose architectural changes that improve reliability and form a framework to propose reactions in a safety-related automotive context. We evaluate our proposed architecture with regard to performance and security design. With the proposed changes to the IDPS architecture, our aim is to integrate a dynamic and adaptive strategy for IDPS, enhancing resilience against emerging threats and vulnerabilities.

Different scheduling mechanisms in Time Sensitive Networking (TSN) can be integrated together to design and support complex architectures with enhanced capabilities for mixed critical networks. Integrating Frame Preemption (FP) with Credit-Based Shaper (CBS) and Gate Control List (GCL) opens up different modes and configuration choices resulting in a complex evaluation of several possibilities and their impact on the Quality of Service (QoS). In this paper, we implement and quantify the integration of preemptive CBS with GCL by incorporating FP into the architecture. Our experiments show that the end-to-end delay of Audio Video Bridging (AVB) flows shaped by CBS reduces significantly (up to 40%) when AVB flows are set to preemptable class. We further show that the jitter of Time Triggered (TT) traffic remains unaffected in "with Hold/Release" mode. Furthermore, we propose to introduce Guardband (GB) in the "without Hold/Release" to reduce the jitter of the TT flow. We compare all the different integration modes, starting with CBS with GCL, extending it further to FP. We evaluate all feasible combinations in both synthetic and realistic scenarios and offer recommendations for practical configuration methods.

International audience

The dynamic reconfiguration of vehicular control and management systems to adapt to different scenarios, particularly those with conflicting design goals, remains a challenging task. In this context, we propose a reference architecture and a generic process to integrate advanced gain scheduling with a feedback loop that continually updates configuration lookup tables to generate scenario-related configurations at runtime. For demonstration purposes, our approach is applied to a Hyperloop vehicle's magnetic suspension system to guarantee simultaneously optimized accuracy of control, energy consumption and passenger comfort for a multitude of scenarios. Additionally, the feedback mechanism increases resilience against mechanical failures, marking an advancement in vehicular system adaptability and reliability.

Vehicular systems operate under diverse and often unpredictable operating conditions, necessitating robust adaptability to manage these uncertainties effectively. Traditionally, adaptability is linked to software capabilities, with hardware platforms frequently overlooked as variables for enhancement. This paper introduces a novel optimization framework aimed at improving the adaptability of vehicular systems during the hardware design phase. We develop an Adaptability Score and integrate it into a Multi-objective Optimization (MOO) framework, presenting its mathematical formulation and its application in hardware optimization. The efficacy of this framework is evaluated through its application to a real-world Hyperloop magnetic levitation system. Our results demonstrate that, compared to a baseline hardware configuration optimized without considering the Adaptability Score, our approach maintains multi-objective system performance across various anomalous scenarios by enhancing the system’s capability to adapt through improved hardware-software synergy.

Permissionless blockchains promise resilience against censorship by a single entity. This suggests that deterministic rules, not third-party actors, decide whether a transaction is appended to the blockchain. In 2022, the U.S. ØFAC sanctioned a Bitcoin mixer and an Ethereum application, challenging the neutrality of permissionless blockchains.

In the very recent past, there has been a trend for passenger transport towards electrification of the vehicles to reduce greenhouse gas emissions. However, due to the low energy density of battery technology, electrification of airplanes is not possible with current technologies. Here, Hyperloop systems can offer a climate-friendly alternative to short-haul flights but face some technical challenges to be resolved. In contrast to conventional rail systems, the Hyperloop concept uses magnetic propulsion and levitation to operate and has no physical contact with the environment. Consequently, mechanical backup solutions do not suffice to avoid catastrophic events in case of failure. Software solutions must, therefore, ensure fail-operational behavior, which requires autonomous adaptability to uncertain states. The MAPE-K approach offers a solution to achieve such adaptability. In this paper, we present a hierarchical architecture that combines the MAPE-K concept with the Simplex concept to achieve self-adaptive behavior. We impose our autonomous architecture on the controller design for the levitation system of a Hyperloop pod and show that this controller, designed using our methodology, outperforms a conventional PID controller by up to 76%.

Society appears to be on the verge of recognizing the need for control over sensitive data in modern web applications. Recently, many systems claim to give control to individuals, promising the preeminent goal of data sovereignty. However, despite recent attention, research and industry efforts are fragmented and lack a holistic system overview. In this paper, we provide the first transecting systematization of data sovereignty by drawing from a dispersed body of knowledge. We clarify the field by identifying its three main areas: (i) decentralized identity, (ii) decentralized access control and (iii) policy-compliant decentralized computation. We find that literature lacks a cohesive set of formal definitions. Each area is considered in isolation, and priorities in industry and academia are not aligned due to a lack of clarity regarding user control. To solve this issue, we propose formal definitions for each sub-area. By highlighting that data sovereignty transcends the domain of decentralized identity, we aim to guide future works to embrace a broader perspective on user control. In each section, we augment our definition with security and privacy properties, discuss the state of the art and proceed to identify open challenges. We conclude by highlighting synergies between areas, emphasizing the real-world benefit obtained by further developing data sovereign systems.

Emerging identity systems in the Web 3.0 achieve a new notion of digital ownership and control. Yet, existing identity ecosystems face bootstrapping issues as trustworthy authorities cannot be represented with adequate privacy. To equip authorities with trustworthy attributes, this work introduces a protocol of domain ownership oracles, where domain owners can prove domain ownership to any third party while remaining anonymous. To prove ownership of an anonymous domain example. com, users convince verifiers of t he f acts that (i) example.com is in control of users and that (ii) example.com belongs to a public anonymity set of domains. Verifiers learn nothing beyond these two facts and cannot determine which user owns which domain. For the first time, o ur work proposes a practical system to attribute anonymous domain owners with credentials of domain ownership where the degree of anonymity depends on the size of a public anonymity set of domains.

The growing computing power of embedded systems has led to an increase in the use of general-purpose Operating Systems (OSs) such as Linux. However, the substantial attack surface arising from their complexity makes them unsuitable for safety and security-critical use cases. Addressing this issue requires isolating the security-critical functionalities into separate execution environments and protecting them from the untrusted OS. Arm TrustZone applies this approach by providing hardware-based partitioning of the system into a secure and non-secure world, facilitating a Trusted Execution environment for the protection of security-critical functionality in the secure world. TrustZone, however, falls short when dealing with systems that virtualize multiple operating systems. Another approach to isolate functionality is employing a microkernel, such as the formally proven correct seL4 kernel, especially if it also offers virtualization functions. While current seL4-based virtualization systems offer good security and safety properties, they do not provide TrustZone-compatible security services to their virtualized guests. In this paper, we propose TEEVseL4, a TrustZone-compatible virtualization system leveraging the strengths of the seL4 microkernel, that can provide security services to the Linux guests based on the dynamic, scalable and flexible Trusted Computing Base of an seL4 system. A high-level performance benchmarking shows that TEEVseL4 can provide security services with acceptable overheads (less than 20%) when compared to a native TrustZone system, making it an attractive option for platforms with multiple, mutually-distrustful virtualized guests.

The selection of a Time-Sensitive Networking (TSN) shaping mechanism is a crucial design decision that impacts the Quality of Service (QoS) of applications and configuration complexity. However, current research has mainly evaluated TSN shapers individually, despite them being designed to work together in an egress port. Hence, the lack of investigation of the mixed TSN shaping mechanism is a major limitation of the current state of the art. Combined TSN traffic shaping provides greater flexibility to improve QoS than individual shapers, making it particularly beneficial for real-time applications. This paper aims to bridge this research gap by implementing the Asynchronous Traffic Shaper (ATS) in a plug-and-play manner, enabling its use individually or in combination with other TSN shapers. We propose various models of mixed TSN shaper architectures and implement the frozen and non-frozen credit behavior of the Time Aware Shaper (TAS) + Credit Based Shaper (CBS) during the guard band (GB) using OMNeT++. Furthermore, we compare the simulation results of ATS and CBS with the Network Calculus (NC) upper bounds. Our results indicate that the simulated delays (SMDs) were significantly lower than the theoretical worst-case delays (WCDs) obtained from the NC, indicating the need for tighter theoretical upper bounds, particularly for higher network loads. To the best of our knowledge, we are the first to provide simulation-based performance analysis of the combined$\text{TAS}+\text{ATS}+\text{CBS}$and$\text{TAS}+\text{ATS}+\text{Strict}$Priority (SP) architecture. Overall, this paper highlights the benefits of combining TSN shapers and encourages further research into the potential advantages of utilizing multiple shapers simultaneously to decrease reliance on TAS and CBS.

It is our pleasure to welcome you to the 29th IEEE International Conference on Embedded and Real-Time Computing Systems and Applications (RTCSA 2023), held in Niigata, Japan. This year, we are honored that RTCSA is sponsored by IEEE, IEEE Computer Society, and IEEE Technical Committee on Real-Time Systems (TCRTS). The objective of the conference is to bring together researchers and developers from academia and industry for advancing the technology of embedded and real-time systems and their emerging applications, including the Internet of Things (IoT) and Cyber-Physical Systems (CPS).

The integration of Time-Sensitive Networking (TSN) and 5G communication is crucial for achieving ultra-reliable and low-latency communication (URLLC) in various domains. This includes applications like industrial automation involving mobile and collaborative robots, as well as Industrial IoT (IIoT). However, an exhaustive performance analysis of mixed 5G-TSN networks that support the unique features of TSN and 5G is lacking. Furthermore, a deeper understanding of TSN traffic scheduling in the 5G system (5GS) is necessary. To address this gap, we propose a novel 5G-TSN Quality-of-Service (QoS) aware simulation framework that incorporates priority-based scheduling in the 5GS. Our framework integrates the latest 5G and TSN simulation libraries using OMNeT++ and provides the first-ever results of the performance analysis of a 5G-TSN converged network. We implement the 5G-TSN bridge translation mechanism and introduce a QoS mapping algorithm for our framework. Through a detailed performance evaluation, we assess the impact of 5G QoS-aware scheduling methods on the overall network performance. Our open-source framework utilizes the latest Simu5G and INET4.4 libraries and simulates two different 5G-TSN scenarios to provide comprehensive insights. The results of our study demonstrate that the performance of the 5G-TSN network is significantly influenced by the scheduling in the 5G network, as a substantial portion of the overall delay originates from the 5GS. Notably, our findings reveal that the 5G-TSN network can achieve latency values within 3ms for TSN traffic, emphasizing the need for a joint scheduling mechanism to meet URLLC requirements.

With the ongoing efforts toward autonomous driving, modern vehicles become increasingly digital and smart. Hence, the vehicle architecture including smart sensors, ECUs, and in-vehicle communication also faces new challenges to satisfy the ever-changing safety and security requirements. The complexity of the system naturally exposes many attack surfaces that demand for sound security solutions to protect the vehicle from potential intrusions. State-of-the-art approaches such as intrusion detection and intrusion response systems require lots of training and testing against various attack scenarios. However, implementing such attacks in real environments is difficult, expensive, and involves many legal and safety considerations. With Simutack, we present an open-source attack simulation framework that is capable of generating realistic attack scenarios for comprehensive security testing in the automotive development process. The framework integrates several classes of attacks, for instance, smart sensor attacks, V2X attacks, and attacks targeting the in-vehicle networks, which are all among the most commonly exploited attack vectors. We evaluate three common attack scenarios that showcase the applicability and capabilities of our work. In each scenario, the generated attack data is processed and returned to the simulation to visualize the attack’s effect on the vehicle and its environment. Furthermore, a custom autopilot application demonstrates the attack’s impact on autonomous driving systems.

The publish/subscribe (Pub/Sub) model offers a communication scheme that is appropriate for a variety of mobile Internet of Things (IoT) systems (e.g., autonomous vehicles). In most of these systems, ensuring the end-to-end (E2E) security of exchanged information is a critical requirement. However, the Pub/Sub scheme lacks appropriate mechanisms to ensure the E2E security, even when state-of-the-art solutions, such as transport layer security (TLS) or attribute-based encryption (ABE), were adopted. These solutions either do not offer E2E security or are infeasible to be adopted in mobile IoT systems with resource-constrained platforms. In this article, we propose a framework, so-called SEEMQTT, to ensure secure E2E Pub/Sub-based communication for mobile IoT systems. Our solution allows the publisher to encrypt the published messages and control which subscribers can decrypt these messages without violating the decoupling requirement of the Pub/Sub model. Our solution leverages multiple honest-but-curious KeyStores to store secret shares generated from a secret key using a secret sharing scheme. The links between the publisher and every KeyStores are secured using identity-based encryption (IBE). The publisher uses the secret key to encrypt published messages. Trust delegation is used to authorize certain subscribers to access these shares and consequently decrypt the published messages. We provide an Arduino-based library that implements our proposed protocol. Also, we perform an extensive performance evaluation using real IoT hardware. Experimental results show that adopting our proposed solution, SEEMQTT, makes E2E security for mobile IoT systems feasible.

Driving scenarios of autonomous vehicles combine many data sources with new networking requirements in highly dynamic system setups. To keep security mechanisms applicable to new application fields in the automotive domain, our work introduces a security framework to generate, attack, and validate realistic data sets at rest and in transit. Concerning realistic data sets, our framework leverages autonomous driving simulators as well as static data sets of vehicle sensors. A configurable networking setup enables flexible data encapsulation to perform and validate networking attacks on data in transit. We validate our results with intrusion detection algorithms and simulation environments. Generated data sets and configurations are reproducible, portable, storable, and support iterative security testing of scenarios.

Production systems continuously need to become more cost-efficient and flexible. Hardware-based programmable logic controllers, while widely used in the industry, do not offer the level of flexibility and scalability required for future applications. Each hardware-based PLC entails costs for maintenance and they cannot keep up with resource-intensive loads, such as artificial intelligence. The virtualization of PLCs promises to solve these issues. A Virtual PLC at the local edge level between cloud and industrial assets provides the flexibility and resource capacity needed for modern control applications. In this paper, the concept of virtual PLCs in a COTS server is outlined as a SoftPLC that is running within a virtual machine managed by a hypervisor. In addition, the virtual PLC is implemented and evaluated to determine whether virtual PLCs can satisfy the requirements for specific domains of industrial automation. We compare multiple virtual PLC configurations to a SoftPLC without a hypervisor. Our results indicate that the virtual PLC implementation is on par in terms of switching and response time for applications requiring response times below 10 ms and deterministic behavior is achievable. While further work is necessary, virtual PLCs may offer tremendous advantages for future industrial systems.

Resilience is a critical quality of future Industrial Control Systems (ICS). The ability to detect and react to unanticipated attacks, bugs, and failures is crucial. Self-adaptation can provide this ability, yet it is difficult to achieve in safety-critical real-time systems, since strict safety and timing requirements must be guaranteed. Recent results indicate that automated adaptation of ICS using the IEC 61499 is possible, however it has not been analyzed how much dynamic adaptation can contribute to overall system resilience. In this paper, we analyze how dynamic adaptation can be embedded into industrial control architectures, and quantify its advantage over a traditional restart. We propose a self-adaptive architecture using the MAPE-K model and merge it with the existing models for ICS. Using measurements on a real system, we estimate the expected adaptation time of selected adaptation scenarios and calculate the loss of productivity depending on the reaction time and adaptation complexity. The results show that using current dynamic adaptation mechanisms, minor to moderate adaptations can be completed within 10 ms, while larger adaptations can take up to a second from initialisation to cleanup. The resilience gain is larger the faster the reaction is initiated, which indicates that once dynamic adaptation is available, a faster detection and decision-making becomes more important. Dynamic adaptation can provide ICS the means to evolve and react rapidly, preparing them for an agile, flexible, and resilient future.

Established development processes for industrial control systems are static and struggle to adopt changing requirements. The interdisciplinary nature of such systems necessitates carefully designed interfaces between modules and components, as well as unambiguously defined requirements. The domain-specific modeling language IEC 61499 offers potentials to accelerate design processes and to introduce a model-driven approach, in which interface and behavior models are continuously refined and reused. We investigate these potentials and outline how to apply an extended development process in which implicit expert knowledge is preserved in behavior- and interface models that are currently not retained during the development. Based on a running example, we illustrate the refinement of scenarios along the development process and show how the retained information captures the expected behavior of the environment. We identify research questions and gaps in the elicitation, maintenance and utilization of these models, in particular in the domains of model-based testing, monitoring, and reconfiguration. An accelerated development process that integrates behavior models can help making future industrial control systems more dependable, flexible, and resilient during the whole life cycle.

Time synchronization in packet-switched networks has evolved into an indispensable prerequisite for many modern applications. In addition to high accuracy demands, also reliability and security are evermore of great concern. Despite the proposal of supplementary security concepts in the past years such as the four prongs in Annex P of the IEEE 1588 standard, available protocols are still vulnerable to time delay attacks. In this paper, we propose multiple methods to implement realistic delay attacks and verify the feasibility on a hardware testbed. Furthermore, we perform a risk analysis to evaluate the actual threat of delay attacks in practical applications. Our analysis shows that time delay attacks still pose a great threat to current systems and further research is required to find sound countermeasures.

AI/ML is envisioned to play an essential role in 6G mobile communication systems. The privacy-preserving capabil-ities of Federated Learning (FL) make it promising in vertical applications; however, the central server-based system and lack of trusted data management limit its widespread use. To effectively support FL as a service from a network architecture perspective, this work provides a comprehensive design including three key features: First, the network architecture enables transparent and traceable data management based on Distributed Ledger Technology (DLT) platform, and realizes distributed and off-chain data storage by adopting Distributed Data Storage Entity (DDSE). Second, the central aggregator of an FL service is decoupled from the data management scheme mentioned above, and is decentralized through smart contracts for aggregator selection among a set of aggregator candidates, with the selected aggregator subsequently responsible for client selection and model aggregation. Third, a completed set of procedures for FL services operations is defined. A simulation system is developed to verify the feasibility of the proposed architecture and to study the impact of introducing the data management mechanisms on the overall performance overhead. The results show that the impact is related to the FL settings, with a worst-case time overhead of 15% observed in selected test cases, i.e., 15% of the total time spent on the interactions with the DLT platform and DDSE.

Dynamic reconfiguration is a core contributor to the flexibility and agility of future industrial control systems. Verification and validation can provide some confidence in the success of a reconfiguration, yet unexpected external events or bugs can always lead to the abortion of the reconfiguration process. This can threaten the real-time behavior and must be anticipated. In this paper, we extend existing real-time models of dynamic reconfiguration to incorporate safe rollback scenarios that allow a disruption-free reversal of the reconfiguration process, thus providing fault-tolerance. We introduce the concept of a point of no return, after which a rollback is no longer feasible. We demonstrate in two example systems how the ordering of operations can affect the length of the rollback sequence and optimize the ordering of operations in two stages to find a sequence that offers a maximal fault-tolerance, while minimizing the real-time disruption. The results indicate that while considering potential failure modes requires additional overhead, it can provide fault-tolerance that promotes the further application of dynamic reconfiguration in practical applications. This may lead to higher agility and resilience in industrial control systems of the future.

Cyber attacks are increasingly targeting connected vehicles. Due to this, Intrusion Response System (IRS) is becoming necessary to respond to unpreventable attacks. This paper proposes a multi-layer IRS prototype that incorporates distributed process management to support continuous control and monitoring of incident responses. Based on our analysis of IRS taxonomies, our prototype respects the latest IRS system requirements.

Owning to the sub-standards being developed by IEEE Time-Sensitive Networking (TSN) Task Group, the traditional IEEE 802.1 Ethernet is enhanced to support real-time dependable communications for future time- and safety-critical applications. Several sub-standards have been recently proposed that introduce various traffic shapers (e.g., Time-Aware Shaper (TAS), Asynchronous Traffic Shaper (ATS), Credit-Based Shaper (CBS), Strict Priority (SP)) for flow control mechanisms of queuing and scheduling, targeting different application requirements. These shapers can be used in isolation or combination and there is limited work that analyzes, evaluates, and compares their performance, which makes it challenging for end-users to choose the right combination for their applications. This paper aims at (i) quantitatively comparing various traffic shapers and their combinations, (ii) summarizing, classifying, and extending the architectures of individual and combined traffic shapers and their Network calculus (NC)-based performance analysis methods, and (iii) filling the gap in the timing analysis research on handling ATS and CBS used for different priority queues, and two novel hybrid architectures of combined traffic shapers, i.e., TAS+ATS+SP and TAS+ATS+CBS when ATS and CBS used at the same queue. A large number of experiments, using both synthetic and realistic test cases, are carried out for quantitative performance comparisons of various individual and combined traffic shapers, from the perspective of upper bounds of delay, backlog, and jitter. To the best of our knowledge, we are the first to quantitatively compare the performance of the main traffic shapers in TSN. The paper aims at supporting the researchers and practitioners in the selection of suitable TSN sub-protocols for their use cases.

The Publish/Subscribe (Pub/Sub) pattern is an attractive paradigm for supporting Vehicle to Cloud (V2C) communication. However, the security threats on confidentiality, integrity, and access control of the published data challenge the adoption of the Pub/Sub model. To address that, our paper proposes a secure policy-based Pub/Sub model for V2C communication, which allows to encrypt and control the access to messages published by vehicles. A vehicle encrypts messages with a symmetric key while saving the key in distributed shares on semi-honest services, called KeyStores, using the concept of secret sharing. The security policy, generated by the same vehicle, authorizes certain cloud services to obtain the shares from the KeyStores. Here, granting access rights takes place without violating the decoupling requirement of the Pub/Sub model. Experimental results show that, besides the end-to-end security protection, our proposed system introduces significantly less overhead (almost 70% less) than the state-of-the-art approach SSL when reestablishing connections, which is a common scenario in the V2C context due to unreliable network connection.

Real-time decision-making is a key element in the transition from Reconfigurable Manufacturing Systems to Autonomous Manufacturing Systems. In Cyber-Physical Production Systems (CPPS) and Cloud Manufacturing, most decision-making algorithms are either centralized, creating vulnerabilities to failures, or decentralized, struggling to reach the performance of the centralized counterparts. In this paper, we combine the performance of centralized optimization algorithms with the resilience of a decentralized consensus. We propose a novel autonomous system architecture for CPPS featuring an automatic production plan generation, a functional validation, and a two-stage consensus algorithm, combining a majority vote on safety and optimality, and a unanimous vote on feasibility and authenticity. The architecture is implemented in a simulation framework. In a case study, we exhibit the timing behavior of the configuration procedure and subsequent reconfiguration following a device failure, showing the feasibility of a consensus-based decision-making process.

Enabling fail-operational behavior of safety-critical software is essential to achieve autonomous driving. At the same time, automotive vendors have to regularly deliver over-the-air software updates. Here, the challenge is to enable a flexible and dynamic system behavior while offering, at the same time, a predictable and deterministic behavior of time-critical software. Thus, it is necessary to verify that timing constraints can be met even during failover scenarios. For this purpose, we present a formal analysis to derive the worst-case application failover time. Without such an automated worst-case failover timing analysis, it would not be possible to enable a dynamic behavior of safety-critical software within safe bounds. We support our formal analysis by conducting experiments on a hardware platform using a distributed fail-operational neural network. Our randomly generated worst-case results are as close as 6.0% below our analytically derived exact bound. Overall, our presented worst-case failover timing analysis allows to conduct an automated analysis at run-time to verify that the system operates within the bounds of the over timing constraint such that a dynamic and safe behavior of autonomous systems can be ensured.

Distributed embedded applications (DEAs) are typically implemented on diverse embedded nodes interconnected through communication network(s) to exchange data and control information to achieve the desired functionality. Conventional approaches of utilising a single large-bandwidth link in a distributed system are not efficient in large DEAs owing to diverse requirements and factors like cost, reliability, scalability and criticality, among others. Heterogeneous communication is a promising approach in DEAs, where the diverse nature of underlying protocols (wired/wireless, synchronous/asynchronous, multiple access modes and others) can be leveraged to meet such requirements, in addition to the benefits like aggregated bandwidth and robustness. However, utilising them ‘directly’ places significant complexity on the application as it needs to dynamically evaluate the channels and utilise different protocol structures for each case. Virtualising the communication channels would present a unified interface to the application by abstracting away low-level details, similar to virtualisation applied in compute architectures. However, unlike architecture virtualisation, virtualising heterogeneous communication particularly for resource-constrained device networks involves unique challenges imposed by the physical (wired/wireless) and logical domains (limited-bandwidth, small payload, protocols, channel access schemes, etc.), which needs to be concurrently evaluated to optimise the communication system. This paper presents a model and an optimal transmission strategy as the proof of concept for deploying heterogeneous communication in DEAs. The model is described at an abstracted level while capturing transmission parameters of multiple channels, which are then optimised to meet the application’s communication requirements. The model and the optimisation method are validated through simulation and a practical case study.

Achieving a cost-efficient fail-operational behavior of safety-critical software is crucial for autonomous systems. However, most applications hold a state such that a checkpoint is required to enable a safe recovery. Here, the challenge is to find the maximum possible checkpointing period while minimizing network and computational overhead. For this purpose, we present an approach to analytically derive the maximum checkpointing period by giving an upper bound on the number of missed computational steps due to failure effects. Worst-case results of our case study using a SLAM application are consistent with our analytically derived exact bound. Overall, by using our approach, a maximum achievable checkpointing period can be determined to reduce network overhead in order to achieve a cost-efficient and safe behavior of autonomous systems.

Dynamic reconfiguration and adaptability are crucial features in the evolution from automation to autonomy of industrial control systems. Component-based systems, such as specified in the IEC 61499, already provide a compelling framework for the distribution and transformation of software components, yet most reconfiguration approaches rely on a manual implementation of the required reconfiguration setup. We propose an automatic mechanism to generate the needed reconfiguration operations and order them into reconfiguration sequences, while preserving the dependencies of each operation. We further identify four scenarios for dynamic reconfiguration with different requirements regarding the treatment of state and showcase the results of our methodology on each scenario.

Time synchronization of devices in Internet-of-Things (IoT) networks is one of the challenging problems and a pre-requisite for the design of low-latency applications. Although many existing solutions have tried to address this problem, almost all solutions assume all the devices (nodes) in the network are faultless. Furthermore, these solutions exchange a large number of messages to achieve synchronization, leading to significant communication and energy overhead. To address these short-comings, we propose C-sync, a clustering-based decentralized time synchronization protocol that provides resilience against several types of faults with energy-efficient communication. C-sync achieves scalability by introducing multiple reference nodes in the network that restrict the maximum number of hops any node can have to its time source. The protocol is designed with a modular structure on the Contiki platform to allow application transitions. We evaluate C-sync on a real testbed that comprises over 40 Tmote Sky hardware nodes distributed across different levels in a building and show through experiments the fault resilience, energy efficiency, and scalability of the protocol. C-sync detects and isolates faults to a cluster and recovers quickly. The evaluation makes a qualitative comparison with state-of-the-art protocols and a quantitative comparison with a class of decentralized protocols (derived from GTSP) that provide synchronization with no/limited fault-tolerance. Results also show a reduction of 56.12% and 75.75% in power consumption in the worst-case and best-case scenarios, respectively, compared to GTSP, while achieving similar accuracy.

Hash-based signatures (HBS) are promising candidates for quantum-secure signatures on embedded IoT devices because they only use fast integer math, are well understood, produce small public keys, and offer many design parameters. However, HBS can only sign a limited amount of messages and produce - similar to most post-quantum schemes - large signatures of several kilo bytes.In this paper, we explore possibilities to reduce the size of the signatures by 1. improving the Winternitz One-Time Signature with a more efficient encoding and 2. offloading auxiliary data to a gateway.We show that for similar security and performance, our approach produces 2.6 % smaller signatures in general and up to 17.3 % smaller signatures for the sender compared to the related approaches LMS and XMSS. Furthermore, our open-source implementation allows a wider set of parameters that allows to tailor the scheme to the available resources of an embedded device, which is an important factor to overcome the security challenges in IoT.

With rapid advancements in the Internet of Things (IoT) paradigm, electrical devices in the near future is expected to have IoT capabilities. This enables fine-grained tracking of individual energy consumption data of such devices, offering location-independent per-device billing. Thus, it is more fine-grained than the location-based metering of state-of-the-art infrastructure, which traditionally aggregates on a building or household level, defining the entity to be billed. However, such in-device energy metering is susceptible to manipulation and fraud. As a remedy, we propose a decentralized metering architecture that enables devices with IoT capabilities to measure their own energy consumption. In this architecture, the device-level consumption is additionally reported to a system-level aggregator that verifies distributed information and provides secure data storage using Blockchain, preventing data manipulation by untrusted entities. Using evaluations on an experimental testbed, we show that the proposed architecture supports device mobility and enables location-independent monitoring of energy consumption.

Ensuring fail-operational behavior is critical to enable autonomous driving. With the absence of a driver as a fallback in a failure scenario it will not be sufficient to use state-of-the-art fail-safe approaches. Here, instead of costly hardware redundancy, graceful-degradation can be used by repurposing the allocated resources of non-critical applications for safety-critical applications. However, solving the mapping problem with a state-of-the-art design-time analysis leads to semi-static solutions, where the mapping is fixed and the task activation is chosen at run-time. Therefore, such solutions are unsuited for future automotive architectures that will be highly customizable and which will include frequent software updates. In this paper we introduce and analyze the effectiveness of an agent-based approach that finds application mappings at run-time, ensures the fail-operational behaviour of safety-critical applications by using graceful degradation, and reconfigures itself after ECU failures. Our results indicate that the number of tolerated ECU failures until a safety-critical application fails can be significantly improved without adding any redundant hardware resources.

The increase of resource-intensive applications in modern vehicles used for streaming, gaming or autonomous driving results in rising energy-consumption of its advanced computing and connectivity hardware. Especially in electric vehicles, this leads to much higher hardware costs and a decreased vehicle range. Modern premium cars use distributed heterogeneous hardware and mostly communicate via APIs to large cloud backends. Current approaches to reduce on-board energy consumption offload applications partly and make use of limited network connectivity assumptions to their backends. In this paper, we propose a hybrid electric and electronic architecture that manages vehicle hardware by using cloud computing frameworks. Our hybrid cloud architecture is a connection of the local vehicle cloud and a large data centre community cloud. We propose an online optimization algorithm that shifts applications from on-board ECUs to data centre servers and vice-versa. The optimization algorithm minimizes the local energy-consumption while satisfying predicatively dynamic constraints like data rate limitations, application policies and resource limitations. Our approach outperforms the non-predictive approach in average by 16%, in the best case by 21% and in the worst case both behave equally well.

Maintaining peer-to-peer connectivity with low energy overhead is a key requirement for several emerging Internet of Things (IoT) applications. It is also desirable to develop such connectivity solutions for non-static network topologies, so that resilience to device failures can be fully realized. De-centralized clustering has emerged as a promising technique to address this critical challenge. Clustering of nodes around cluster heads (CHs) provides an energy-efficient two-tier framework for peer-to-peer communication. At the same time, decentralization ensures that the framework can quickly adapt to a dynamically changing network topology. Although some decentralized clustering solutions have been proposed in the literature, they either lack guarantees on connectivity or incur significant energy overhead to maintain the clusters. In this paper, we present Decentralized Connected Resilient IoT Clustering (DeCoRIC), an energy-efficient clustering scheme that is self-organizing and resilient to network changes while guaranteeing connectivity. Using experiments implemented on the Contiki simulator, we show that our clustering scheme adapts itself to node faults in a time-bound manner. Our experiments show that DeCoRIC achieves 100% connectivity among all nodes while improving the power efficiency of nodes in the system compared to the state-of-the-art techniques BEEM and LEACH by up to 110% and 70%, respectively. The improved power efficiency also translates to longer lifetime before first node death with a best-case of 109% longer than BEEM and 42% longer than LEACH.

Time synchronization is paramount for communication in Internet of Things (IoT) networks. Existing synchronization protocols in the IoT are designed to be accurate, energy-efficient and scalable with absolute trust on the time source(s). If a byzantine node becomes a time source, it can cause synchronization errors with false time, leading to system mal-functions or network crashes. In this paper, we introduce C-Sync: a clustering time synchronization protocol for decentralized IoT networks that incorporates resilience against byzantine nodes. We show that C-sync achieves a worst-case synchronization accuracy of a few tens of microseconds (µs).

Verification is essential to prevent malfunctioning of software systems. Model checking allows to verify conformity with nominal behavior. As manual definition of specifications from such systems gets infeasible, automated techniques to mine specifications from data become increasingly important. Existing approaches produce specifications of limited lengths, do not segregate functions and do not easily allow to include expert input. We present BaySpec, a dynamic mining approach to extract temporal specifications from Bayesian models, which represent behavioral patterns. This allows to learn specifications of arbitrary length from imperfect traces. Within this framework we introduce a novel extraction algorithm that for the first time mines LTL specifications from such models.

Recently, active charge balancing of the cells in battery packs has been gaining importance over state-of-the-art passive balancing solutions. The main advantage of active balancing lies in the ability to transfer charge between cells rather than dissipating it thermally. This enhances the overall efficiency and energy output of battery packs. In this paper, we develop a new class of strategies for decentralized operation of charge transfers between non-neighboring cells using appropriate balancing hardware architectures. While the benefits of the active balancing approach with a centralized controller have been discussed in literature extensively, the implementation of adequate strategies for scheduling charge transfers in decentralized battery management systems, which promise to be more robust and modular, have not been studied sufficiently so far. Furthermore, existing decentralized strategies only deal with charge transfers between neighboring cells. In order to compare our novel distributed non-neighbor balancing strategies to existing neighbor-only balancing strategies, we implement them in an open-source simulation framework for decentralized battery management systems. Our results show that we are able to improve the two most important metrics of balancing time and losses by up to 63 % and 51 %, respectively.

The smart energy grid features real-time monitoring of electricity usage such that it can control the generation and distribution of electricity as well as utilize dynamic pricing in response to the demands. For this purpose, smart metering systems continuously monitor the electricity usage of customers, and report it back to the Utility Provider (UP). This raises privacy concerns regarding the undesired exposure of human activity and time-of-use of home appliances. Photovoltaics (PV) and a residential Electrical Energy Storage (EES) have proven to be effective in mitigating the privacy concerns. However, this comes at several costs: Installation of PV and EES, their subsequent aging and the possibly increased electricity cost. We quantify the trade-off between privacy exposure and financial costs by formulating a stochastic dynamic programming problem. Our analysis shows that i) there is a quantifiable trade-off between the financial cost and privacy leakage, ii) proper control of the system is crucial for both metrics, iii) a strategy solely focusing on privacy results in high financial costs, and iv) that for a typical residential setting, the costs for a trade-off solution lie in the range of 600 US$-1700 US$. As the load flattening has a peak shaving effect desirable for UPs, increasing privacy is mutually beneficial for both, customers and UPs.

Autonomous driving, vehicle platoons and smart traffic management will dramatically improve our transportation systems. In contrast to centralized approaches, which do not scale efficiently with the actual traffic load, a decentralized traffic management based on distributed consensus could provide a robust, fair and well-scaling solution for infrastructures of variable density. In this paper, we propose a distributed platoon management scheme, where platoon operations such as join or merge are decided by consensus over a Vehicular ad hoc network (VANET). Since conventional consensus protocols are not suitable for Cyber-Physical Systems (CPS) such as platoons, we introduce CUBA, a new validated and verifiable consensus protocol especially tailored to platoons, which considers their special communication topology. We demonstrate that CUBA only introduces a small communication overhead compared to the centralized, Leader-based approach and significantly outperforms related distributed approaches.

Modern public transport solutions based on autonomous electric vehicles are on the rise. Public transportation as a service on demand is becoming a reality. Therefore, vehicles suitable for these kinds of applications need to be developed. One critical factor for such vehicles is a short turnaround time at the charging spot. Maximizing the utilization of a given battery pack capacity and minimizing the time spent charging are therefore of central importance. In this paper, we propose a novel preconditioning algorithm to minimize the time an EV is connected to the charging station. Our proposed approach uses existing Active Cell Balancing (ACB) hardware of the battery pack to precondition the State of Charge (SoC) of cells such that all cells reach the top SoC threshold at the same time without requiring an additional balancing phase during charging. This is done by considering the individual cells' charging rate to precondition them for achieving an equal time to full charge. Applying the same approach for discharging, we also extend the driving range of an EV, which otherwise is limited by the cell with the lowest SoC in the pack. Case studies show that our proposed preconditioning algorithm increases the usable energy of the battery pack by up to 3% compared to conventional balancing algorithms all while effectively halving the time connected to a charging station, all without requiring any additional hardware components.

Battery storage systems are becoming more popular in the automotive industry as well as in stationary applications. To fulfill the requirements in terms of power and energy, the literature is increasingly discussing electrically reconfigurable interconnection topologies. However, these topologies use switching elements on the cell and module level that exhibit an electric resistance due to their design and hence generate undesirable dissipative losses. In this article, we propose a new analysis and optimization framework to examine and minimize the losses in such topologies. For this purpose, we develop a SystemC model to investigate static and dynamic load scenarios, e.g., from the automotive domain. The model uses SystemC TLM for the digital subsystem, SystemC-AMS for the mixed-signal subsystem, and host-compiled simulation for the microcontroller executing the embedded software. Here, we analyze the impact of the dissipative losses on the system efficiency that depend on the modularization level, implying the number of serial and parallel switching elements. Our analysis clearly shows that in reconfigurable topologies, the modularization level has a significant influence on the losses, which in our automotive example covers several orders of magnitude. For the topologies we have investigated, the highest efficiency can be reached when a parallel-only modularization is aspired and the number of serial switching elements is minimized. It is also shown that the losses of the state-of-the-art topology with one battery pack protection switch are almost as high as in a smart cell approach in which each energy storage cell has its own switching element. However, due to the high number of switching elements, this results in a reduction of energy density and increases the system costs, showing that this is a multi-criteria optimization problem.

In modern vehicles, high communication complexity requires cost-effective integration tests such as data-driven system verification with in-vehicle network traces. With the growing amount of traces, distributable Big Data solutions for analyses become essential to inspect massive amounts of traces. Such traces need to be processed systematically using automated procedures, as manual steps become infeasible due to loading and processing times in existing tools. Further, trace analyses require multiple domains to verify the system in terms of different aspects (e.g., specific functions) and thus, require solutions that can be parameterized towards respective domains. Existing solutions are not able to process such trace amounts in a flexible and automated manner. To overcome this, we introduce a fully automated and parallelizable end-to-end preprocessing framework that allows to analyze massive in-vehicle network traces. Being parameterized per domain, trace data is systematically reduced and extended with domain knowledge, yielding a representation targeted towards domain-specific system analyses. We show that our approach outperforms existing solutions in terms of execution time and extensibility by evaluating our approach on three real-world data sets from the automotive industry.

Recently, reconfigurable battery packs that can dynamically modify the electrical connection topology of their individual cells are gaining importance. While several circuit architectures and management algorithms are proposed in the literature, the electrical characteristics of the reconfiguration circuit architectures are not sufficiently studied so far. In this paper, we derive a detailed analytical model for a state-of-the-art reconfiguration architecture capturing the losses introduced by the parasitic resistances of the circuit components. Based on this model we evaluate a novel fast charging strategy, which for the first time utilizes the reconfigurable battery pack architecture in order to reduce the losses during fast charging by switching between parallel and series connection of the cells. In order to do this, we consider the electrical characteristics of the reconfigurable circuit components. Since the component resistances are the main driver for the power losses during charging, we are able to give a realistic perspective on the overall pack performance and the efficiency increase due to the utilized fast charging strategy. Furthermore, using the analytical model, we highlight the challenges faced by existing reconfiguration architectures using state-of-the-art components and we derive specifications for the switches for further improving the energy efficiency. Experimental results show that our strategy improves the charging efficiency by up to 10 %.

Short drive range due to limited battery capacity and high battery depreciation costs persist to be the main deterrents to the wide adoption of Electric Vehicles (EVs). High power battery packs consisting of a large number of battery cells require extensive management, such as State of Charge (SOC) balancing and thermal management, in order to keep the operating conditions within a safe and efficient range. In this paper, we propose a novel State of Health (SOH)-aware active cell balancing technique, which is capable of extending the cycle life of the whole battery pack. In contrast to the state-of-the-art active cell balancing techniques, the proposed technique reduces the load current of cells with low SOH using the active cell balancing architecture. Based on the observation that assigning the smallest possible load current to cells with lower SOH extends cycle life, the technique identifies the most beneficial charge transfers. We find that with our proposed scheme, aging could be mitigated by up to 23.5% over passive cell balancing and 17.6% over active SOC cell balancing.

The Internet of Things (IoT) enables connectivity between devices, thereby allowing them to interact with each other. A recurring problem is the emergence of siloed IoT platforms due to proprietary standards. Recently, the World Wide Web Consortium (W3C) proposed a human-readable and machine- understandable format called Thing Description (TD). It allows to uniformly describe device and service interfaces of different IoT standards with syntactic and semantic information, and hence enables semantic interoperability. However, describing sequential behavior of devices, which is essential for many cyber-physical systems, is not covered. In this paper, we propose a systematic way to describe such sequential behavior as an extension within TDs, thereby increasing their semantic expressiveness through possible, valid state transitions. This enables safe and desired operation of devices as well as scalability by modeling systems as sequential compositions of Things. We show in a case study that previously unmodelable behavior can now be expressed and the overall manual intervention requirements of state-of-the-art implementations can be significantly reduced.

Smart contracts enable autonomous decentralized organizations (DADs) in large, trustless and open trading networks by specifying conditions for automated transactions of cryptographically secured data. This data could represent cryptocurrencies but also sensor data or commands to Cyber-Physical Systems (CPS) connected to the Internet. To provide reliability, the contract code is enforced by consensus and the transactions it triggers are nonrevertible, even if they were not intended by the programmer, which could lead to dangerous system behavior. In this paper, we conduct a survey over existing smart contract platforms and languages to determine requirements for the design of a safer contract language. Subsequently we propose concepts that enhance the understanding of code by limiting confusing language constructs, such as nesting, arbitrary naming of operations, and unreadable hash identifiers. This enables human reasoning about the contract semantics on a much higher abstraction layer, because a common understanding can be derived from the language specification itself. We implement these concepts in a new domain specific language called SmaCoNat to illustrate the feasibility and show that our concepts are barely covered by existing languages but significantly enhance readability and safety without violating deterministic parsability.

High power Lithium-Ion (Li-Ion) battery packs used in stationary Electrical Energy Storage (EES) systems and Electric Vehicle (EV) applications require a sophisticated Battery Management System (BMS) in order to maintain safe operation and improve their performance. With the increasing complexity of these battery packs and their demand for shorter time-to-market, decentralized approaches for battery management, providing a high degree of modularity, scalability and improved control performance are typically preferred. However, manual design approaches for these complex distributed systems are time consuming and are error-prone resulting in a reduced energy efficiency of the overall system. Here, special design automation techniques considering all abstraction-levels of the battery system are required to obtain highly optimized battery packs. This paper presents from a design automation perspective the recent advances in the domain of battery systems that are a combination of the electrochemical cells and their associated management modules. Specifically, we classify the battery systems into three abstraction levels, cell-level (battery cells and their interconnection schemes), module-level (sensing and charge balancing circuits) and pack-level (computation and control algorithms). We provide an overview of challenges that exist in each abstraction layer and give an outlook towards future design automation techniques that are required to overcome these limitations.

Blockchain provides decentralized consensus in large, open networks without a trusted authority, making it a promising solution for the Internet of Things (IoT) to distribute verifiable data, such as firmware updates. However, verifying data integrity and consensus on a linearly growing blockchain quickly exceeds memory and processing capabilities of embedded systems. As a remedy, we propose a generic blockchain extension that enables highly constrained devices to verify the inclusion and integrity of any block within a blockchain. Instead of traversing block by block, we construct a LeapChain that reduces verification steps without weakening the integrity guarantees of the blockchain. Applied to Proof-of-Work blockchains, our scheme can be used to verify consensus by proving a certain amount of work on top of a block. Our analytical and experimental results show that, compared to existing approaches, only LeapChain provides deterministic and tight upper bounds on the memory requirements in the kilobyte range, significantly extending the possibilities of blockchain application on embedded IoT devices.

Active cell balancing is the process of improving the usable capacity of a series-connected Lithium-Ion (Li-Ion) battery pack by redistributing the charge levels of individual cells. Depending upon the State-of-Charge (SoC) distribution of the individual cells in the pack, an appropriate charge transfer pattern (cell-to-cell, cell-to-module, module-to-cell or module-to-module) has to be selected for improving the usable energy of the battery pack. However, existing active cell balancing circuits are only capable of performing limited number of charge transfer patterns and, therefore, have a reduced energy efficiency for different types of SoC distribution. In this paper, we propose a modular, multi-pattern active cell balancing architecture that is capable of performing multiple types of charge transfer patterns (cell-to-cell, cell-to-module, module-to-cell and module-to-module) with a reduced number of hardware components and control signals compared to existing solutions. We derive a closed-form, analytical model of our proposed balancing architecture with which we profile the efficiency of the individual charge transfer patterns enabled by our architecture. Using the profiling analysis, we propose a hybrid charge equalization strategy that automatically selects the most energy-efficient charge transfer pattern depending upon the SoC distribution of the battery pack and the characteristics of our proposed balancing architecture. Case studies show that our proposed balancing architecture and hybrid charge equalization strategy provide up to a maximum of 46.83% improvement in energy efficiency compared to existing solutions.

Among series-connected cells in large battery packs, such as those found in electric vehicles, a charge imbalance develops over time due to manufacturing and temperature variations. Therefore, active balancing strategies can be employed in Battery Management Systems (BMSs) to attain a charge balance among cells by transferring charge between them, maximizing the usable capacity of the battery pack. Recently, decentralized BMS architectures with smart battery cells have been developed, in which balancing strategies can operate by local cooperation between the cells without requiring global coordination. In this paper, we propose a decentralized active balancing strategy for smart cells where we identify boundary cells having special properties. These boundary cells enable to divide the global balancing problem into independent subproblems, where local decisions on charge transfers eventually converge to a globally balanced battery pack. The proposed strategy is implemented in a simulator framework and compared with two decentralized state-of-the-art strategies. Our results show significantly improved performance and scalability of the proposed strategy in terms of charge transfer losses and communication overhead between cells, while maintaining a comparable time to balance.

Modern vehicles employ a large amount of distributed computation and require the underlying communication scheme to provide high bandwidth and low latency. Existing communication protocols like Controller Area Network (CAN) and FlexRay do not provide the required bandwidth, paving the way for adoption of Ethernet as the next generation network backbone for in-vehicle systems. Ethernet would co-exist with safety-critical communication on legacy networks, providing a scalable platform for evolving vehicular systems. This requires a high-performance network gateway that can simultaneously handle high bandwidth, low latency, and isolation; features that are not achievable with traditional processor based gateway implementations. We present VEGa, a configurable vehicular Ethernet gateway architecture utilising a hybrid FPGA to closely couple software control on a processor with dedicated switching circuit on the reconfigurable fabric. The fabric implements isolated interface ports and an accelerated routing mechanism, which can be controlled and monitored from software. Further, reconfigurability enables the switching behaviour to be altered at runtime under software control, while the configurable architecture allows easy adaptation to different vehicular architectures using highlevel parameter settings. We demonstrate the architecture on the Xilinx Zynq platform and evaluate the bandwidth, latency, and isolation using extensive tests in hardware.

Active cell balancing improves the performance of a battery pack by transferring charge from one cell to another. Associated design questions require multiple simulations with 100 cells over several hours. Since the most efficient transfer methods switch between phases in the kilohertz range, these simulations require high computational effort or reduced accuracy. To enable detailed analysis on a large scale, this paper includes state-of-the-art electrical battery models in active balancing simulation while keeping the computation effort for one transfer in the low millisecond range. This is achieved in three steps. First, we model the dynamics of each transfer phase using standard equivalent circuit abstraction. Next, we find closed form equations for the so-defined phase dynamics, yielding an iterative approach that saves computation time by replacing the numerical solver. Finally, we employ error control techniques to aggregate phases in that iteration, systematically reducing the millions of phase evaluations that would be necessary otherwise. Our experiments show that the speedup from equivalent circuit dynamics to error-controlled aggregation almost reaches five orders of magnitude while introducing virtually no additional error. This enables simulations of realistic balancing scenarios in less than a second and is hence suitable for design space exploration.

Due to the growing interconnectedness and complexity of in-vehicle networks, in addition to safety, security is becoming an increasingly important topic in the automotive domain. In this paper, we study techniques for detecting security infringements in automotive electrical and electronic (E/E) architectures. Toward this we propose in-vehicle network traffic monitoring to detect increased transmission rates of manipulated message streams. Attacks causing timing violations can disrupt safety-critical functions and have severe consequences. To reduce costs and prevent single points of failure, our approach enables an automatic distribution of detection tasks among selected E/E architecture components, such as a subset of electronic control units. First, we analyze a concrete E/E system architecture to determine the communication parameters and properties necessary for detecting security attacks. These are then used for a parametrization of the corresponding detection algorithms and the distribution of attack detection tasks. We use a lightweight message monitoring method and optimize the placement of detection tasks to ensure a full-coverage of the E/E system architecture and a timely detection of an attack.

With the increasing amount of interconnections between vehicles, the attack surface of internal vehicle networks is rising steeply. Although these networks are shielded against external attacks, they often do not have any internal security to protect against malicious components or adversaries who can breach the network perimeter. To secure the in-vehicle network, all communicating components must be authenticated, and only authorized components should be allowed to send and receive messages. This is achieved through the use of an authentication framework. Cryptography is widely used to authenticate communicating parties and provide secure communication channels (e.g., Internet communication). However, the real-time performance requirements of in-vehicle networks restrict the types of cryptographic algorithms and protocols that may be used. In particular, asymmetric cryptography is computationally infeasible during vehicle operation. In this work, we address the challenges of designing authentication protocols for automotive systems. We present Lightweight Authentication for Secure Automotive Networks (LASAN), a full lifecycle authentication approach. We describe the core LASAN protocols and show how they protect the internal vehicle network while complying with the real-time constraints and low computational resources of this domain. By leveraging the fixed structure of automotive networks, we minimize bandwidth and computation requirements. Unlike previous work, we also explain how this framework can be integrated into all aspects of the automotive product lifecycle, including manufacturing, vehicle maintenance, and software updates. We evaluate LASAN in two different ways: First, we analyze the security properties of the protocols using established protocol verification techniques based on formal methods. Second, we evaluate the timing requirements of LASAN and compare these to other frameworks using a new highly modular discrete event simulator for in-vehicle networks, which we have developed for this evaluation.

High-voltage battery packs consist of series-connected lithium-ion cells and require sophisticated battery management systems (BMSs) to maintain safe operating conditions. Active cell balancing is an important task of a BMS, performed in order to improve the usable capacity of the battery pack by equalizing the charge levels of individual cells. With the emerging trend of distributed BMS topologies, the associated balancing architectures are required to be modular, consisting of homogeneous units that minimize integration efforts. In this paper, we propose a modular active charge balancing architecture along with its control scheme for implementation toward such distributed BMSs. Compared with existing approaches, our proposed architecture provides increased charge transfer capabilities, with reduced hardware and control complexity. We propose a closed-form analytical model of the balancing architecture, which can be used to perform fast system-level simulation studies and design space exploration for analyzing efficient device combinations. A hardware implementation of the proposed balancing architecture is developed and measurements made with it are used to validate each part of our analytical model. Using the validated analytical model, we performed a case study, which shows that our proposed architecture provides a 14.5 % improvement in charge transfer efficiency compared with existing approaches.

This paper presents an overview of recent trends in Battery System Management Architectures (BSMAs). After introducing the main characteristics of large battery packs, the state of the art in BSMAs is discussed. Two emerging concepts are in the focus of this contribution. On the one hand, there is a development from centralized battery management architectures with a single control entity towards decentralized management where the computational resources are distributed across the battery pack and, hence, move closer to the individual battery cells. This enables a more scalable and modular battery system architecture, while, at the same time, posing challenges regarding hardware and management algorithm design. On the other hand, the static setup of the series- and parallel-connected cells forming the battery pack may be developed towards a reconfigurable architecture such that the electrical topology of the pack can be adaptively changed. Such reconfigurability could increase the reliability of battery packs and reduce management efforts such as cell balancing. At the same time, limited energy efficiency of the additional hardware poses a challenge. We give an outlook how these two trends could be combined into distributed reconfigurable BSMAs. This introduces a set of challenges which have to be solved in order to benefit from the increased scalability, reliability and safety such designs could offer.

This paper proposes a systematic and fast analog coverage-driven verification methodology which could increase the confidence in verification of today's analog blocks. We define an appropriate coverage metric to score simulations and then minimize the simulation effort for achieving full state space coverage with an algorithm generating appropriate input stimuli. Our proposed method uses characteristic properties of a discretized representation of the state space such as the spatial distribution of eigenvalues, guiding the generation of short and purposeful stimuli. The experimental results show a significant speed-up with similar accuracy compared to the state-of-the-art.

Large battery packs composed of Lithium-Ion cells are continuously gaining in importance due to their applications in Electric Vehicles (EVs) and smart energy grids. To ensure maximum lifetime, safety and performance of the battery pack, complex embedded system architectures consisting of sensors, power electronics and microcontrollers are integrated into the pack as Battery Management System (BMS). In this context, active cell balancing is a promising approach of the BMS to provide equal charge levels across the cells in the battery pack in an efficient manner. The design of such active cell balancing architectures, comprising circuits from the power electronics domain together with complex control schemes, is error-prone and tedious when done in the conventional manual fashion. This paper presents a design flow from a high-level requirements definition to an actual hardware implementation, using design automation approaches such as verification, synthesis and optimization. Here, graph-based models and algorithms from the domain of formal verification are applied to prove the system properties and are extended to enable synthesis of optimized and correct-by-construction active balancing circuit architectures.

Active balancing architectures effectively increase the efficiency of large battery packs by equalizing charge between cells. For this purpose, a balancing circuit and appropriate control scheme have to be designed to enable the charge transfer via energy storage elements such as inductors. Using a manual approach to design balancing architectures can be tedious and error-prone, resulting in potentially suboptimal solutions. As a remedy, this paper presents an automatic synthesis of balancing circuits and their corresponding control, optimizing the number of required metal-oxide-semiconductor field-effect transistors, and necessary control signals. The proposed synthesis combines a satisfiability solver to explore the search space with a graph-based verification that iteratively excludes infeasible solutions until the optimal architectures are obtained. The experimental results are carried out for three given template circuits and two signal templates. The synthesis results in architectures that are superior in terms of all design objectives in comparison to solutions from literature that result from a manual design approach.

Car manufacturers provide a growing variety of models and configuration options for customers. In the highly competitive and cost-driven automotive industry, managing these variants and increasing the reuse of functionality in different variants has therefore become one of the key challenges. This paper addresses the problem of generating variant schedules for time-triggered electrical/electronic-architectures. We propose a multischedule synthesis approach that determines the common parts of multiple variants and generates a schedule that exploits this commonality. Hence, a multischedule defines individual variant schedules with an identical schedule for applications common to different variants. This makes these applications variant-independent, thus, reduces the testing and integration efforts as it only has to be done once. Multischedule synthesis involves several challenges, viz., identification of commonality between different variants, schedule synthesis for common parts, and the integration of uncommon parts. Consequently, the schedule synthesis approach presented here is very different from conventional approaches. Finally, to address the increased complexity, we also propose a divide-and-conquer approach to partition the problem, improving the scalability.

Security in automotive in-vehicle networks is an increasing problem with the growing connectedness of road vehicles. This article proposes a security-aware priority assignment for automotive controller area network (CAN) platforms with the aim of mitigating scaling effects of attacks on vehicle fleets. CAN is the dominating field bus in the automotive domain due to its simplicity, low cost, and robustness. While messages might be encrypted to enhance the security of CAN systems, their priorities are usually identical for automotive platforms, comprising generally a large number of vehicle models. As a result, the identifier uniquely defines which message is sent, allowing attacks to scale across a fleet of vehicles with the same platform. As a remedy, we propose a methodology that is capable of determining obfuscated message identifiers for each individual vehicle. Since identifiers directly represent message priorities, the approach has to take the resulting response time variations into account while satisfying application deadlines for each vehicle schedule separately. Our approach relies on Quadratically Constrained Quadratic Program (QCQP) solving in two stages, specifying first a set of feasible fixed priorities and subsequently bounded priorities for each message. With the obtained bounds, obfuscated identifiers are determined, using a very fast randomized sampling. The experimental results, consisting of a large set of synthetic test cases and a realistic case study, give evidence of the efficiency of the proposed approach in terms of scalability. The results also show that the diversity of obtained identifiers is effectively optimized with our approach, resulting in a very good obfuscation of CAN messages in in-vehicle communication.

With the perennial demand for longer runtime of battery-powered Wireless Sensor Nodes (WSNs), several techniques have been proposed to increase the battery runtime. One such class of techniques exploiting the battery recovery effect phenomenon claims that performing an intermittent discharge instead of a continuous discharge will increase the usable battery capacity. Several works in the areas of embedded systems and wireless sensor networks have assumed the existence of this recovery effect and proposed different power management techniques in the form of power supply architectures (multiple battery setup) and communication protocols (burst mode transmission) in order to exploit it. However, until now, a systematic experimental evaluation of the recovery effect has not been performed with real battery cells, using high-accuracy battery testers to confirm the existence of this recovery phenomenon. In this article, a systematic evaluation procedure is developed to verify the existence of this battery recovery effect. Using our evaluation procedure, we investigated Alkaline, Nickel-Metal Hydride (NiMH), and Lithium-Ion (Li-Ion) battery chemistries, which are commonly used as power supplies for Wireless Sensor Node (WSN) applications. Our experimental results do not show any evidence of the aforementioned recovery effect in these battery chemistries. In particular, our results show a significant deviation from the stochastic battery models, which were used by many power management techniques. Therefore, the existing power management approaches that rely on this recovery effect do not hold in practice. Instead of a battery recovery effect, our experimental results show the existence of the rate capacity effect , which is the reduction of usable battery capacity with higher discharge power, to be the dominant electrochemical phenomenon that should be considered for maximizing the runtime of WSN applications. We outline power management techniques that minimize the rate capacity effect in order to obtain a higher energy output from the battery.

This article introduces a Cyber-physical Co-Simulation Framework (CPCSF) for design and analysis of smart cells that enable scalable battery pack and Battery Management System (BMS) architectures. In contrast to conventional cells in battery packs, where all cells are monitored and controlled centrally, each smart cell is equipped with its own electronics in the form of a Cell Management Unit (CMU). The CMU maintains the cell in a safe and healthy operating state, while system-level battery management functions are performed by cooperation of the smart cells via communication. Here, the smart cells collaborate in a self-organizing fashion without a central controller instance. This enables maximum scalability and modularity, significantly simplifying integration of battery packs. However, for this emerging architecture, system-level design methodologies and tools have not been investigated yet. By contrast, components are developed individually and then manually tested in a hardware development platform. Consequently, the systematic design of the hardware/software architecture of smart cells requires a cyber-physical multi-level co-simulation of the network of smart cells that has to include all the components from the software, electronic, electric, and electrochemical domains. This comprises distributed BMS algorithms running on the CMUs, the communication network, control circuitry, cell balancing hardware, and battery cell behavior. For this purpose, we introduce a CPCSF that enables rapid design and analysis of smart cell hardware/software architectures. Our framework is then applied to investigate request-driven active cell balancing strategies that make use of the decentralized system architecture. In an exhaustive analysis on a realistic 21.6kW h Electric Vehicle (EV) battery pack containing 96 smart cells in series, the CPCSF is able to simulate hundreds of balancing runs together with all system characteristics, using the proposed request-driven balancing strategies at highest accuracy within an overall time frame of several hours. Consequently, the presented CPCSF for the first time allows us to quantitatively and qualitatively analyze the behavior of smart cell architectures for real-world applications.

In the context of active cell balancing of electric vehicle battery cells, we deal with circuit architectures for inductor-based charge transfer and the corresponding high-level modeling and strategy development. In this work, we introduce a circuit architecture to transfer charge between arbitrarily many source and destination cells (many-to-many) for the first time and analyze the advantages over one-to-one transfer. Balancing simulation with numerical solvers remains challenging because of non-differentiable PWM signals, while the search space for high-level strategy design - crucial for time and energy efficiency - becomes even larger. Consequently, we develop a closed-form charge transfer model that extends state-of-the-art approaches and is three orders of magnitude faster than step-size controlled simulation. With an initial algorithm design based on experimentally derived rules, we demonstrate that many-to-many transfer dominates neighbor-only approaches in speed and efficiency even though it requires only one additional switch per circuit module.

Embedded systems are developed within a cost-driven process, such that many purpose-build systems share a common embedded platform. For instance, a shared hardware device might be applied in various use cases with different software. Here, the bare hardware is considered as platform while the final hardware/software system is the product that implements a certain set of features. In this paper, we propose an efficient design space exploration methodology that optimizes a set of embedded platforms. For this purpose, we separate the exploration into two stages: (1) A set of candidate platforms is determined within an optimization framework that can cope with different system models, considering the optimization objectives and feature coverage. (2) The final set of target platforms is determined as subset of the candidates by minimizing the expected objectives like cost, area, etc. The experimental results give evidence that our modular approach is more flexible and scalable than state-of-the-art methodologies.

This paper proposes a novel approach to security analysis of automotive architectures at the system-level. With an increasing amount of software and connectedness of cars, security challenges are emerging in the automotive domain. Our proposed approach enables assessment of the security of architecture variants and can be used by decision makers in the design process. First, the automotive Electronic Control Units (ECUs) and networks are modelled at the system-level using parameters per component, including an exploitability score and patching rates that are derived from an automated or manual assessment. For any specific architecture variant, a Continuous-Time Markov Chain (CTMC) model is determined and analyzed in terms of confidentiality, integrity and availability, using probabilistic model checking. The introduced case study demonstrates the applicability of our approach, enabling, for instance, the exploration of parameters like patch rate targets for ECU manufacturers.

The design process of safety-critical systems requires formal analysis methods to ensure their correct functionality without over-sized safety margins and extensive testing. For architectures with state-based events or scheduling, such as load-dependent frequency scaling, model checking has emerged as a promising tool. It formally verifies timing behavior of realtime systems with minimal over-approximation of the worst case delays. In this context, Event Count Automata (ECAs) have become a valuable modeling approach because they are specifically designed to handle typical arrival patterns and integrate well with analytic techniques. In this work, we propose an extension of the ECA framework's semantics and use it in a Fixed-Priority Non-preemptive Scheduling (FPNS) model that correctly abstracts the intra-slot behavior in the slotted-time model of the ECA. This is challenging because straightforward implementations cannot capture the full behavior of event-triggered scheduling with such a time model that the ECA shares with most model checking based methods. In a case study, we obtain bounds via model checking a basic model and then our proposed model. We compare these bounds with a SystemC simulation. This shows that the bounds from the basic model are too optimistic - and exceeded in practice - because it does not capture the full behavior, while the bounds from the proposed extended model are both safe and reasonably tight.

This paper presents an approach to optimal dimensioning of active cell balancing architectures, which are of increasing relevance in Electrical Energy Storages (EESs) for Electric Vehicles (EVs) or stationary applications such as smart grids. Active cell balancing equalizes the state of charge of cells within a battery pack via charge transfers, increasing the effective capacity and lifetime. While optimization approaches have been introduced into the design process of several aspects of EESs, active cell balancing architectures have, until now, not been systematically optimized in terms of their components. Therefore, this paper analyzes existing architectures to develop design metrics for energy dissipation, installation volume, and balancing current. Based on these design metrics, a methodology to efficiently obtain Pareto-optimal configurations for a wide range of inductors and transistors at different balancing currents is developed. Our methodology is then applied to a case study, optimizing two state-of-the-art architectures using realistic balancing algorithms. The results give evidence of the applicability of systematic optimization in the domain of cell balancing, leading to higher energy efficiencies with minimized installation space.

We study distributed controllers where sensor, controller, and actuator tasks are mapped onto different processors or Electronic Control Units (ECUs) in a distributed automotive architecture, communicating via a shared bus. Controllers in such setups are designed with a sampling period equal to the worst-case sensor-to-actuator message delay. However, this assumption of all messages having to meet their deadlines is too pessimistic. The inherent robustness of most controllers allows some of the messages to miss their deadlines, while still meeting specified control performance constraints. Given a controller, in this paper we first quantify the frequency of its acceptable deadline misses and represent this as a Linear Temporal Logic (LTL) formula. Further, we model the distributed architecture as a network of Time-Stamped Event Count Automata (TS-ECAs). Such a network of TS-ECAs is then model-checked to verify whether it satisfies the LTL formula. The verification ensures that the controller may be mapped onto the architecture and the control performance constraints will be satisfied. We have implemented this methodology in Symbolic Analysis Laboratory (SAL), which is a well-known framework combining different tools for system verification. Our implementation and case studies using standard controller design shows the applicability of our proposed controller/architecture co-verification. It represents a significant improvement in current design flows where, although controller models are formally verified, their implementation on a distributed architecture is done in an ad hoc fashion with extensive testing and integration effort.

Most innovations in the automotive domain are realized by electronics and software. Modern cars have up to 100 Electronic Control Units (ECUs) that implement a variety of control applications in a distributed fashion. The tasks are mapped onto different ECUs, communicating via a heterogeneous network, comprising communication buses like CAN, FlexRay, and Ethernet. For electric vehicles, software functions play an essential role, replacing hydraulic and mechanic control systems. While model-based software development and verification are already used extensively in the automotive domain, their importance significantly increases in electric vehicles as safety-critical functions might no longer rely on mechanical (fall-back) solutions. The need for reducing costs, size, and weight in electric vehicles has also resulted in a considerable interest in topics such as the consolidation of ECUs as well as efficient implementation of control software. In this paper we discuss two broad issues related to model-based software development and verification in electric vehicles. The first is concerned with how to ensure that model-level semantics are preserved in an implementation, which has important implications on the verification and certification of control software. The second issue is related to techniques for reducing the computational and communication demands of distributed automotive control algorithms. For both these topics we provide a broad introduction to the problem followed by a discussion on state-of-the-art techniques.

This paper proposes a novel modular architecture for Electrical Energy Storages (EESs), consisting of multiple series-connected cells. In contrast to state-of-the-art architectures, the presented approach significantly improves the energy utilization, safety, and availability of EESs. For this purpose, each cell is equipped with a circuit that enables an individual control within a homogeneous architecture. One major advantage of our approach is a direct and concurrent charge transfer between each cell of the EES using inductors. To enable a system-level modeling and performance analysis of the architecture, a detailed investigation of the components and their interaction with the Pulse Width Modulation (PWM) control was performed at transistor-level. At system-level, we propose a control algorithm for the charge transfer that aims at minimizing the energy loss and balancing time. The results give evidence of the significant advantages of our architecture over existing passive and active balancing methods in terms of energy efficiency and charge equalization time.

This paper gives an overview of the system architecture and software design challenges for Electric Vehicles (EVs). First, we introduce the EV-specific components and their control, considering the battery, electric motor, and electric powertrain. Moreover, technologies that will help to advance safety and energy efficiency of EVs such as drive-by-wire and information systems are discussed. Regarding the system architecture, we present challenges in the domain of communication and computation platforms. A paradigm shift towards time-triggered in-vehicle communication systems becomes inevitable for the sake of determinism, making the introduction of new bus systems and protocols necessary. At the same time, novel computational devices promise high processing power at low cost which will make a reduction in the number of Electronic Control Units (ECUs) possible. As a result, the software design has to be performed in a holistic manner, considering the controlled component while transparently abstracting the underlying hardware architecture. For this purpose, we show how middleware and verification techniques can help to reduce the design and test complexity. At the same time, with the growing connectivity of EVs, security has to become a major design objective, considering possible threats and a security-aware design as discussed in this paper.

This paper presents a methodology based on mathematical programming for the priority assignment of processes and messages in event-triggered systems with tight end-to-end real-time deadlines. For this purpose, the problem is converted into a Quadratically Constrained Quadratic Program (QCQP) and addressed with a state-of-the-art solver. The formulation includes preemptive as well as non-preemptive schedulers and avoids cyclic dependencies that may lead to intractable real-time analysis problems. For problems with stringent real-time requirements, the proposed mathematical programming method is capable of finding a feasible solution efficiently where other approaches suffer from a poor scalability. In case there exists no feasible solution, an algorithm is presented that uses the proposed method to find a minimal reason for the infeasibility which may be used as a feedback to the designer. To give evidence of the scalability of the proposed method and in order to show the clear benefit over existing approaches, a set of synthetic test cases is evaluated. Finally, a large realistic case study is introduced and solved, showing the applicability of the proposed method in the automotive domain.

This paper is an introduction to security challenges for the design of automotive hardware/software architectures. State-of-the-art automotive architectures are highly heterogeneous and complex systems that rely on distributed functions based on electronics and software. As cars are getting more connected with their environment, the vulnerability to attacks is rapidly growing. Examples for such wireless communication are keyless entry systems, WiFi, or Bluetooth. Despite this increasing vulnerability, the design of automotive architectures is still mainly driven by safety and cost issues rather than security. In this paper, we present potential threats and vulnerabilities, and outline upcoming security challenges in automotive architectures. In particular, we discuss the challenges arising in electric vehicles, like the vulnerability to attacks involving tampering with the battery safety. Finally, we discuss future automotive architectures based on Ethernet/IP and how formal verification methods might be used to increase their security.

Electric vehicles are emerging as a solution to environmental changes and transportation challenges in growing mega-cities. Compared to combustion engine vehicles, electric vehicles bring along new challenges in the CPS design. This paper gives an overview of several of these challenges and presents initial and potential solutions for the design of the electric powertrain and E/E architectures for electric vehicles. The powertrain consists of multiple complex CPS such as the battery, the electric motor, and a distributed energy management system. These components require a complex monitoring and control in order to guarantee safety and maintain a high efficiency. For this purpose, novel E/E architectures become necessary that facilitate a predictable distributed computation and communication, requiring a paradigm shift towards fully time-triggered systems. These E/E architectures will also enable novel CPS such as innovative driver assistance systems, x-by-wire control to further increase the safety and energy-efficiency of electric vehicles, and a pervasive interaction of the vehicle and the grid. Instead of focusing on the specific applications, this paper describes the prerequisite architectural changes that are necessary to implement these novel functions.

In this paper a novel approach to discrete state space modeling of nonlinear analog circuits is presented, based on the introduction of an underlying discrete analog transition structure (DATS) and the related optimization problem of accurately representing a nonlinear analog circuit with a DATS. Starting from a circuit netlist, a partitioning of the state space to the discrete model is generated parallel and orthogonal to the trajectories of the state space dynamics. Therefore, compared to previous approaches, a significantly higher accuracy of the model is achieved with a lower number of states. The mapping of the partitioning to a DATS enables the application of formal verification algorithms. Experimental validations show the soundness of the approach with an increase in accuracy between a factor of 4 to 10 compared to the state of the art. A model checking case study illustrates the application of the new discretization algorithm to identify a hidden circuit design error.

In this contribution a novel methodology for verification of analog circuit blocks with the aim of full coverage of the analog state space is proposed. On a discretized state space model of the analog system, an efficient state space-guided input stimuli generation algorithm produces piecewise linear input stimuli for every input of the system under verification. Processed by a conventional transient circuit simulator, the simulation results are covering the system's complete dynamic behavior. Simulation by complete state space-covering input stimuli guarantees the verification results to be sound for every possible state and input stimulus of the circuit under verification, which increases the significance of property verification and equivalence checking of transistor netlists versus behavioral models. The application to example circuits shows the feasibility of the approach.

In this contribution an advanced methodology for model checking of analog systems is introduced. A new analog specification language (ASL)for efficient property specifications is defined and model checking algorithms for implementing this language are presented. This allows verification of complex static and dynamic circuit properties like oscillation and startup time that have not yet been formally verifiable with previous approaches. The new verification methodology is applied to example circuits and experimental results are discussed and compared to conventional circuit simulation.