Automatic Sound Static Analysis for Integration Verification of AUTOSAR Software

<div class="section abstract"> <div class="htmlview paragraph">This Recommended Practice provides a taxonomy for motor vehicle <i>driving automation systems</i> that perform part or all of the <i>dynamic driving task</i> (<i>DDT</i>) on a <i>sustained</i> basis and that range in level from <i>no driving automation</i> (level 0) to <i>full driving automation</i> (level 5). It provides detailed definitions for these six levels of <i>driving automation</i> in the context of <i>motor vehicles</i> (hereafter also referred to as “<i>vehicle</i>” or “<i>vehicles</i>”) and their <i>operation</i> on roadways. These level definitions, along with additional supporting terms and definitions provided herein, can be used to describe the full range of <i>driving automation features</i> equipped on <i>motor vehicles</i> in a functionally consistent and coherent manner. “On-road” refers to publicly accessible roadways (including parking areas and private campuses that permit public access) that collectively serve users of <i>vehicles</i> of all classes and <i>driving automation</i> levels (including no <i>driving automation</i>), as well as motorcyclists, pedal cyclists, and pedestrians.</div> <div class="htmlview paragraph">The levels apply to the <i>driving automation feature(s)</i> that are engaged in any given instance of on-road <i>operation</i> of an equipped <i>vehicle</i>. As such, although a given <i>vehicle</i> may be equipped with a <i>driving automation system</i> that is capable of delivering multiple <i>driving automation features</i> that perform at different levels, the level of <i>driving automation</i> exhibited in any given instance is determined by the <i>feature(s)</i> that are engaged.</div> <div class="htmlview paragraph">This document also refers to three primary actors in <i>driving</i>: the (human) <i>driver</i>, the <i>driving automation system</i>, and other <i>vehicle</i> systems and components. These other <i>vehicle</i> systems (or the <i>vehicle</i> in general terms) do not include the <i>driving automation system</i> in this model, even though as a practical matter a <i>driving automation system</i> may actually share hardware and software components with other <i>vehicle</i> systems, such as a processing module(s) or operating code.</div> <div class="htmlview paragraph">The levels of <i>driving automation</i> are defined by reference to the specific role played by each of the three primary actors in performance of the <i>DDT</i>. “Role” in this context refers to the expected role of a given primary actor, based on the design of the <i>driving automation system</i> in question and not necessarily to the actual performance of a given primary actor. For example, a <i>driver</i> who fails to <i>monitor</i> the roadway during engagement of a level 1 adaptive cruise control (ACC) system still has the role of <i>driver</i>, even while s/he is neglecting it.</div> <div class="htmlview paragraph"><i>Active safety systems</i>, such as electronic stability control and automated emergency braking, and certain types of driver assistance systems, such as lane keeping assistance, are excluded from the scope of this <i>driving automation</i> taxonomy because they do not perform part or all of the <i>DDT</i> on a <i>sustained</i> basis and, rather, merely provide momentary intervention during potentially hazardous situations. Due to the momentary nature of the actions of <i>active safety systems</i>, their intervention does not change or eliminate the role of the <i>driver</i> in performing part or all of the <i>DDT,</i> and thus are not considered to be <i>driving automation</i>.</div> <div class="htmlview paragraph">It should, however, be noted that crash avoidance features, including intervention-type <i>active safety systems</i>, may be included in <i>vehicles</i> equipped with <i>driving automation systems</i> at any level. For <i>ADS</i>-equipped <i>vehicles</i> (i.e., levels 3-5) that perform the complete <i>DDT</i>, crash avoidance capability is part of <i>ADS</i> functionality.</div></div>

<div class="htmlview paragraph">In order to allow continued production of the AM General Optimizer 6500 during MY 2007 through 2010 this IDI engine (Indirect Injection - swirl chamber) requires sophisticated aftertreatment controls while maintaining its fuel economy and durability.</div> <div class="htmlview paragraph">The main purpose of the development program was to retain the relatively inexpensive and simple base engine with distributor pump and waste-gated turbocharger, while adding hardware and software components that allow achievement of the phase-in emission standards for 2007 through 2010. The aftertreatment system consists of Diesel Oxidation Catalyst (DOC), NOx Adsorber Catalyst (or DeNOx Trap - DNT) and Diesel Particle Filter (DPF). In addition to the base hardware, an intake air throttle valve and an in-exhaust fuel injector were installed.</div> <div class="htmlview paragraph">The presented work will document the development process for a 2004 certified 6.5 l IDI heavy-duty diesel engine to comply with the 2007 heavy-duty emission standards. The system architecture evaluation proved to be one of the key development items that determined the packaging in the projected vehicle platform. Based on the temperature profile, it was found that the DOC-DPF-DNT configuration is mandatory to achieve NOx and NMHC standards. The development of the DPF regeneration, deNOx and deSOx strategy were strongly based on a multi-variable controls approach using temperature or lambda interventions depending on the system request.</div> <div class="htmlview paragraph">Development results for the HD-FTP and SET (13-mode Supplemental Emissions Test) show that the tailpipe emissions and the NTE (not-to-exceed) limits can be met with a considerable safety margin allowing reasonable degradation factors.</div> <div class="htmlview paragraph">The integrated system was installed in a project vehicle and underwent multiple climate testing trips focusing on DPF regeneration under cold ambient, high altitude and hot ambient conditions.</div> <div class="htmlview paragraph">It could be proven that a concept with a comparably cost-effective base engine which does not utilize direct fuel injection, along with an advanced aftertreatment control system, is capable to meet the U.S. 2007-2010 phase-in emission standards.</div>

In this paper, an experimental analysis and study of the Modified Signed-Digit (MSD) method was conducted, which aims to hide a quantity of secret data represented in a grayscale image of size 512 × 512 in a set of cover images. Some quality metrics such as signal-to-noise ratio (PSNR), mean squared error (MSE), and embedding capacity (BPP) were measured. As well as calculating, the optimal number of cover images, the time taken in the hiding process, and the consumed memory. The experiments were conducted two different sizes of cover images, where the number of cover images required for the secret image is determined according to some inputs such as the number of pixels n in each group of the cover image and the number of bits in each block of the secret image L=n+1. Also, four different values of n, (2, 3, 4, 5). We tried to find the best value for the number of bits in each block L of the secret image and in each case of n to achieve the best case for image quality PSNR, MSE for both cover image sizes, and on the other hand, less time memory consumption. By using the Matlab program, we compared the results at different cover image sizes, we found that as the larger size used, the fewer cover images are needed and less time consumption. On the other hand, more memory consumption. For the other metrics, PSNR, MSE and BPP, close results were obtained. Finally, the best choice remains related to the user and the type of application or the required performance, whether in image quality or in less memory and time consumption with a larger embedding capacity. Keywords: MSD algorithm, Signal-to-noise ratio (PSNR), Mean square error (MSE), Bit-per-pixel (BPP), Memory consumption, Time consumption.

<div class="htmlview paragraph">The ever increasing demands on combustion engines with regard to exhaust emissions and fuel consumption require the use of modern analytical methods. Especially optical measurement techniques have contributed a lot to the realization of complicated engine concepts. The disadvantages of complex measurement techniques are the expenditure of time and the necessary changes of the engine.</div> <div class="htmlview paragraph">This paper introduces a new practice oriented optical measurement technique with the aid of an example. With this technique it is possible to record the combustion process with a sampling rate of up to 200 kHz through a small drilling.</div> <div class="htmlview paragraph">Even quick events like knocking can be recorded. The combustion luminosity is watched through a special UV-capable borescope, transmitted to an array of photoelectric transformers and finally recorded as a flame figure. We will show an SI-engine which is limited by knocking. Analyzing the optical images will show that the combustion process tends to burn to one side of the combustion chamber. It was possible to influence the combustion with flow corrections which resulted in a displacement of the knocking threshold and ultimately in a higher efficiency of the engine.</div>

<div class="section abstract"><div class="htmlview paragraph">Today’s agriculture demands increased productivity due to the higher cropping intensities. Agricultural field readiness for cultivation requires various operation in field resulting in delay in cultivation which lower down productivity. Therefore, field operation needs to be more efficient in terms of both input cost and time consumption. One way to achieve this is by performing multiple operations in a single tractor pass, utilizing the increased power available in modern Tractors. In some agricultural operations, implements need to be mounted on the front of the tractor. Therefore, designing a front three-point hitching system for the tractor is essential to meet various farming needs, allowing customers to perform multiple operations simultaneously. The use of a front three-point linkage better utilizes the potential of four-wheel drive, higher horsepower tractors.</div><div class="htmlview paragraph">This paper focuses on the comprehensive design process for developing and validating a front hitch system for both future and existing tractor designs. It describes the study of the Real-World Usage Pattern (RWUP) for the front hitch and the creation of a load block program for component validation. Multiple design iterations were conducted to meet CAE acceptance criteria and ensure design robustness. A new lab test was established and performed to assess the hitch’s lifting performance, durability, endurance, and track performance. The recommended design successfully passed physical validation and was implemented in the tractor. The front three-point linkage design achieved 20.25%-time savings and 15.15% fuel savings compared to traditional designs, with a cultivator at the front and a harrow at the rear during field operations, as per ISO-8759(4) and ISO 730 standards.</div></div>

In recent years, GPUs have emerged as an extremely cost-effective means for achieving high performance. Many application developers, including those with no prior parallel programming experience, are now trying to scale their applications using GPUs. While languages like CUDA and OpenCL have eased GPU programming for non-graphical applications, they are still explicitly parallel languages. All parallel programmers, particularly the novices, need tools that can help ensuring the correctness of their programs. Like any multithreaded environment, data races on GPUs can severely affect the program reliability. Thus, tool support for detecting race conditions can significantly benefit GPU application developers. Existing approaches for detecting data races on CPUs or GPUs have one or more of the following limitations: 1) being illsuited for handling non-lock synchronization primitives on GPUs; 2) lacking of scalability due to the state explosion problem; 3) reporting many false positives because of simplified modeling; and/or 4) incurring prohibitive runtime and space overhead. In this paper, we propose GRace, a new mechanism for detecting races in GPU programs that combines static analysis with a carefully designed dynamic checker for logging and analyzing information at runtime. Our design utilizes GPUs memory hierarchy to log runtime data accesses efficiently. To improve the performance, GRace leverages static analysis to reduce the number of statements that need to be instrumented. Additionally, by exploiting the knowledge of thread scheduling and the execution model in the underlying GPUs, GRace can accurately detect data races with no false positives reported. Based on the above idea, we have built a prototype of GRace with two schemes, i.e., GRace-stmt and GRace-addr, for NVIDIA GPUs. Both schemes are integrated with the same static analysis. We have evaluated GRace-stmt and GRace-addr with three data race bugs in three GPU kernel functions and also have compared them with the existing approach, referred to as B-tool. Our experimental results show that both schemes of GRace are effective in detecting all evaluated cases with no false positives, whereas Btool reports many false positives for one evaluated case. On the one hand, GRace-addr incurs low runtime overhead, i.e., 22-116%, and low space overhead, i.e., 9-18MB, for the evaluated kernels. On the other hand, GRace-stmt offers more help in diagnosing data races with larger overhead.

<div class="htmlview paragraph">A 1977 Buick V-6 engine and a 1981 Ford Granada automobile were equipped with heat exchangers to transfer energy from the exhaust gases to the cooling water after cold starts in order to shorten engine warm-up periods and improve fuel economy. A parallel concern was the time required to reach satisfactory heat delivery to the passenger compartment.</div> <div class="htmlview paragraph">The Buick engine was investigated in the laboratory. The Ford automobile was tested during driving over a 12.4 km length of freeway and over an 8.6 km test route including both in-town and highway segments. Prior to each test run the engines were exposed to ambient air for at least 8 hours at temperatures ranging from −26° C to + 2° C.</div> <div class="htmlview paragraph">The use of the heat exchangers resulted in average reductions of fuel consumption of 2.8% during a 7 minute warm-up period for the engine, and of 2.2% for the autombile when tested on the above test routes. The corresponding times for the coolant in the automobile compartment heater to reach maximum temperature were reduced by 16% and 7%. While fuel savings were achieved, their economic value is questionable, particularly in light of a possible retrofit of an existing automobile with an exhaust-to-coolant heat exchanger and the necessary control equipment.</div>

<div class="htmlview paragraph">Performance analysis and early architecture exploration minimizes new technology adoption risks and optimizes the resulting system specification. This paper will demonstrate that early design exploration can validate the specification for performance, power and functionality at an accuracy of 85-90% of the real system. This methodology reduces development time by over 30%, reduces implementation re-spins, and ensures that the required performance, power, functionality, and cost metrics are achieved.</div> <div class="htmlview paragraph">Current system architecture exploration approaches take too long, require a lot of custom development, and are not very reusable. Architecture explorations using an analytical approach, such as spreadsheets, have a very limited exploration scope and are prone to errors due to their deterministic and non-graphical nature. Physical prototypes can take a long time to evaluate, and can only be validated for hardware-specific test cases. Graphical models based on Simulink check the correctness of the signal flow and data transfers.</div> <div class="htmlview paragraph">Distributed embedded systems must be analyzed for timing, resource usage and power consumption, and spreadsheets typically break down with more than two or three shared resources. Graphical modeling tools can overcome the shared resource concurrency issues, present systems as they are diagrammed, and include built-in statistics and power analysis.</div>

<div class="section abstract"><div class="htmlview paragraph">Modern automotive systems are becoming increasingly complex, comprising tightly integrated hardware and software components with varying safety implications. As the demand for ISO 26262 compliance grows, performing efficient and consistent Hazard Analysis and Risk Assessment (HARA) across these layers presents both methodological and practical challenges. Traditional approaches often involve performing HARA for an item (where item maybe a system or a combination of systems), which can lead to update of HARA for every new feature addition in an item, which in turn may lead to analysis of same functions in multiple HARAs leading to inconsistent risk categorization, redundancy, or even conflicting safety goals. Therefore, this paper proposes a unique HARA methodology which consolidates the list of functions from various systems and performs the HARA for the grouped functions (hereby referred to as Cluster HARAs)<b>.</b> For example, Electrical power steering, Electric pump powered hydraulic steering, Electric motor assisted – hydraulic steering, have identical functions but are being analysed separately for many years which causes redundancy and results in increased effort. Once a cluster HARA is created, in case of development of a new feature/function or update of an existing feature/function, we check only for similar functions in the existing cluster HARAs and take up the corresponding safety goals. In this way, all the systems / components which has the same function, refer to the cluster HARA and no redundant HARAs are created, resulting in decreased effort from implementation point of view. In short, the proposed methodology will greatly reduce the number of HARAs that are handled across all systems. The benefits of using this methodology also involve identifying unique safety goals for each function, irrespective of how the function is implemented. When the new E/E features are developed which uses the existing vehicle functions, it simplifies the workflow by reusing the existing cluster HARAs.</div></div>

<div class="htmlview paragraph">In this paper, we present a comprehensive approach to design of embedded real-time software for electrically controlled mechanical systems in automotive applications. As a case study, we implement a Gear change and Clutch controller for a Formula SAE car. This includes a generic communication interface and protocol for CAN bus communication, I/O interfaces for A/D conversion and PWM output, together with a PID controller for clutch actuation.</div> <div class="htmlview paragraph">Under our framework, the embedded software is developed using Timber, a programming language and formalism that provides executable models for embedded real-time systems.</div> <div class="htmlview paragraph">The case study shows how a complete control system can be straightforwardly modeled, simulated and transformed into executable code. The system has been realized and tested onto a lightweight, 8-bit AVR-5, embedded platform.</div> <div class="htmlview paragraph">Compared to the raw C code design flow, the proposed framework has in our case study showed increased efficiency with respect to development time. We boldly conclude that our Timber based framework offers true <b>“work with the work”.</b></div>

Since function pointers are closely related to software control flow and they are writable, attackers often take function pointers as the targets. To protect the function pointers, we propose a novel solution called PointerLock. To avoid being tampered with by the attacker, PointerLock restricts the writing operation on the function pointers with the support of access control on the page. PointerLock centralizes the application's function pointers to a few pages, and these pages are only readable by default. Only when the application want to modify the pointer, PointerLock makes the page writable where the function pointer is located in. This reduces the time window of attacking the function pointer. To prevent an attacker from tampering with other function pointers on the same page as function pointers, PointerLock performs the necessary checks on the page before they are used again. The prototype system of PointerLock was built in Fedora 21 with a 3.17.6 kernel. Two system calls are implemented in kernel space, and six interfaces are developed for users in the form of dynamic link libraries in user space. The tests show that PointerLock is capable of preventing the attacker from tampering with the function pointers, and it does not introduced an overheavy performance.

The buffer overflow attack is the single most dominant and lethal form of security exploits as evidenced by recent worm outbreaks such as Code Red and SQL Slammer. In this paper, we propose a new architectural solution to detect and deter the buffer overflow exploit. The idea is that the buffer overflow attacks usually exhibit abnormal symptoms in the system. This kind of unusual behavior can be simply detected by checking the integrity of instruction and data references at runtime, avoiding the potential data or control corruptions made by such attacks. Both the hardware cost and the performance penalty of enforcing the integrity rules are negligible. By performing detailed execution-driven simulations on the programs selected from SPEC CPU2000 benchmark, we evaluate the effectiveness of the proposed safety guards. By randomly corrupting stack and other data sections of a process’s address space during simulation, we create various buffer overflow scenarios, including both stack and heap smashing. Experimental data shows that enforcing two safety guards not only reduces the number of system failures substantially but it also circumvents virtually all forms of malicious code execution made by stack smashing or function pointer corruptions.KeywordsReturn AddressMalicious CodeBuffer OverflowData CorruptionBranch TargetThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

The system buffer overflow (SBO) is a universal problem in information security. In the traditional defence mechanisms, the SBO prevents shell code execution and neglect unsuccessful attack that makes system procedures terminate abnormally. In this loophole, attackers can modify the data structure of the control programme procedure such as the return address or the function pointer and then the system programme procedure will be turned to the code-injection attacks (CIA) or the return-into-libc attacks. In this paper, we propose the memory protector (MP) which is a novel solution to prevent the SBO attack. The MP uses Linux operating system to implement the defence mechanism that will prevent the stack-based buffer overflow attack from the malicious CIA, defect and prevent the zero-day-attack, and keeping memory integrity. In this experiment, we choose Linux operating system (Linux 2.4.21) to implement the defence mechanism that will prevent the stack-based buffer overflow attack from the malicious CIA, defect and prevent the zero-day-attack, and keeping memory integrity.

<div class="htmlview paragraph">Electric's and electronics' content in the high performance luxury segment's vehicles is continuously increasing. Dynamically controlled safety features, passenger comfort, information and entertainment and operational convenience are <i>the</i> field of permanent innovation. To guarantee an appropriate level of quality for this permanently innovated features requires robust design techniques (analysis, modeling, simulation, rapid prototyping and verification) and reliably controlled integration processes for components with significantly different lifecycles including information management and change control.</div> <div class="htmlview paragraph">For these purposes BMW chose to utilize object-oriented analysis (OOA) methods and to define its automotive-specific subset of the Unified Modeling Language UML [<span class="xref">OMG99</span>]. The resulting object networks of OOA are then specified within an object-based specification (generation of executable models) process. Dedicated tools support a seamless development process.</div> <div class="htmlview paragraph">Effective information management and change control are based on sound management of the projects' requirements. Thus, the information model of the developed products has to be embedded in the requirements model.</div>

Although the data-flow framework is a powerful tool to statically analyze a program, current data-flow analysis techniques have not addressed the effect of procedures on concurrency analysis. This work develops a data race detection technique using a data-flow framework that analyzes concurrent events in a program in which tasks and procedures interact. There are no restrictions placed on the interactions between procedures and tasks, and thus recursion is permitted. Solving a system of data-flow equations, the technique computes a partial execution order for regions in the program by considering the control flow within a program unit, communication between tasks, and the cdlinglcreation context of procedures and tasks. From the computed execution order, concurrent events are determined as unordered events. We show how the information about concurrent events can be used in debugging to automatically detect data races.