Formal Methods and Validation Techniques for Ensuring Automotive Systems Security

Formal methods for software development receive much attention in research centres, but are rarely used in industry for the development of (large) software systems. One of the reasons is that little is known about the integration of formal methods in the software process, and the exact role of formal methods in the software life-cycle is still unclear. In this paper, a detailed examination is made of the application of, and the benefits resulting from, a generally applicable formal method (VDM) in a standard model for software development (DoD-STD-2167A). Currently, there is no general agreement on how formal methods should be used, but in order to analyse the use of formal methods in the software process, a clear view of such use is essential. Therefore, we show what is meant by ‘using a formal method’. The different activities of DoD-STD-2167A are analysed with regard to their suitability for applying VDM and the benefits that may result from applying VDM for that activity. Based on this analysis, an overall view on the usage of formal methods in the software process is formulated.

This paper shows how a simulation model can be specified so that its static and temporal properties can be formally analyzed. The approach adopted is based on the integration of Formal Methods (FMs) and the DEVS paradigm. FMs are known to allow symbolic manipulation and reasoning, while DEVS is known as being a well-establish Modeling and Simulation (M&S) framework. Combining them makes it possible to develop rigorous proofs of the properties of simulation models as regard to design and use requirements. This paper focuses on the so-called atomic specification. Static aspects of the model are captured with the Z formalism, while dynamic aspects are expressed in first order logic. The specification is supported by the Z/EVES tool. A case study is exhibited.

A modern automotive design contains over a hundred microprocessors, several cyber-physical modules, connectivity to a variety of networks, and several hundred megabytes of software. The future is anticipated to see an even sharper rise in complexity of this electronics, with the imminence of driverless vehicles, the potential of connected automobiles within a few years, and work towards seamless integration of automobiles with smart cities and infrastructure systems. Security is a fundamental challenge in the design of automotive systems. Unfortunately, security considerations in automotive systems are complicated by two factors: (1) need for real-time mitigation against in-field threats; and (2) in-field configurability and extensibility of security features. This paper examines the trade-offs between security countermeasures, real-time requirements, and in-field configurability needs for modern automotive systems. We discuss the current state of the practice in automotive security architecture, as well as gaps and challenges that need to be addressed for a viable security solution in future.

Cellular neural network (CNN) implementations used in real time image processing are rapidly generated by a formal High-level synthesis (HLS) toolset in this work. Industrial and academic hardware design projects can benefit from the use of the Custom Coprocessors Compilation (CCC) HLS behavioral synthesise, via the massive reduction in design and verification time. The CCC tool is built with formal compiler-compiler, Logic Programming and XML validation techniques, thus the generated RTL VHDL or Verilog models are provably-correct. In this work, we rapidly modeled CNNs in the ADA programming language, compiled and verified along with all the necessary testbenches in GNU ADA. Edge-detection, halftoning and morphological processing applications were prototyped, so as to evaluate the CCC HLS method, which was the main contribution of this work. The combination of Logic Programming and RDF validation techniques, as well as prototyping of CNN applications made this work unique.

A well-known testing method for the safety evaluation and real-time validation of automotive software systems (ASSs) is Fault Injection (FI). In accordance with the ISO 26262 standard, the faults are introduced artificially for the purpose of analyzing the safety properties and verifying the safety mechanisms during the development phase. However, the current FI method and tools have a significant limitation in that they require manual identification of FI attributes, including fault type, location and time. The more complex the system, the more expensive, time-consuming and labour-intensive the process. To address the aforementioned challenge, a novel Large Language Models (LLMs)-assisted fault test cases (TCs) generation approach for utilization during real-time FI tests is proposed in this paper. To this end, considering the representativeness and coverage criteria, the applicability of various LLMs to create fault TCs from the functional safety requirements (FSRs) has been investigated. Through the validation results of LLMs, the superiority of the proposed approach utilizing gpt-4o in comparison to other state-of-the-art models has been demonstrated. Specifically, the proposed approach exhibits high performance in terms of FSRs classification and fault TCs generation with F1-score of 88% and 97.5 %, respectively. To illustrate the proposed approach, the generated fault TCs were executed in real time on a hardware-in-the-loop system, where a high-fidelity automotive system model served as a case study. This novel approach offers a means of optimizing the real-time testing process, thereby reducing costs while simultaneously enhancing the safety properties of complex safety-critical ASSs.

This paper propose an optical design of adaptive automotive headlight system with advanced light-emitting diodes (LEDs) and digital micro-mirror device (DMD). In recent days, safety of on-road drive plays the role at automotive industries so that fast response of adaptive automotive headlight system becomes a critical issue especially in mountain road drive. In order to integrate the function of low and high beam into a single headlight without sacrifice of volumetric size of whole system, a DMD is employed in this optical design. Simulation shows that new optical design not only promotes light efficiency but also reduce volumetric size. Besides, light from adaptive automotive headlight system could make the projected light much suitable for drivers according to individual driver's vision experience. Results show that volumetric size of all system might be reduced up to 30 percent but light efficiency could be promoted up to 20 percent.

Automotive system is the safety-critical and cost-critical heterogeneous distributed embedded system. Task assignment based on replication fault-tolerance strategy is commonly used to satisfy the reliability requirement of directed acyclic graph (DAG)-based parallel automotive application. However, automotive system development is redundancy constrained due to the limited hardwares and resources. Finding optimal redundancy under the reliability requirement saves the hardware and resource costs, and ensures the driving safety for the automotive industry, but the process is time-consuming by using traditional exhaustive method. In this paper, we propose the fast task assignment for optimal redundancy (FTAOR) algorithm to find minimum redundancy of DAG-based parallel automotive application under the established reliability requirement. Unlike exhaustive method, the verification time is reduced by using the FTAOR algorithm, which predicts and eliminates most meaningless computations effectively. Experimental results on parallel automotive applications at different heterogeneity show that the proposed FTAOR algorithm generates lower redundancy compared with the state-of-the-art heuristic algorithms and increases the task size to 150 with a shorter computation time compared with exhaustive method.

This article conducts a highly systematic, logical and layered analysis of the issues related to user experience improvement and security risk control in the automotive over- the-air (OTA) update technology: It first clarifies industry trends, technical features, and existing problems, and then uses methods such as literature analysis, case studies, and expert interviews to rigorously argue feasible strategies for enhancing user experience and ensuring system security. It naturally and appropriately takes the OTA practices of important domestic and foreign automakers such as Tesla and NIO as comparative objects. Thus, it naturally and powerfully concludes that improving the software update process, enhancing the friendliness of the human-machine interaction interface, and building a complete security protection system all have direct and significant implications for improving the overall performance of the automotive OTA system. Therefore, this article further proposes a system optimization model that combines users, technology, and security, providing a clear framework for the design and development of automotive OTA systems that is both theoretically supported and practically instructive. Even more commendably, the results obtained have extremely strong academic and practical significance for the advanced development of intelligent connected vehicle technology and the transformation and upgrading of related industries.

The Controller Area Network (CAN) is the most common network system in automotive systems. However, the standardized design of a CAN protocol does not consider security issues, so it is vulnerable to various security attacks from internal and external electronic devices. Recently, in-vehicle network is often connected to external network systems, including the Internet, and can result in an unwarranted third-party application becoming an attack point. Message Authentication CAN (MAuth-CAN) is a new centralized authentication for CAN system, where two dual-CAN controllers are utilized to process message authentication. MAuth-CAN is designed to provide an authentication mechanism as well as provide resilience to a message flooding attack and sustainably protect against a bus-off attack. This paper presents formal techniques to guarantee critical timing properties of MAuth-CAN, based on model checking, which can be also used for safety certificates of vehicle components, such as ISO 26262. Using model checking, we prove sufficient conditions that MAuth-CAN is resilient and sustainable against message flooding and bus-off attacks and provide two formal models of MAuth-CAN in timed automata that are applicable for formal analysis of other applications running on CAN bus. In addition, we discuss that the results of model checking of those properties are consistent with the experiment results of MAuth-CAN implementation.

SNCF is responsible for putting into service all interlocking systems on the French railway network. It is therefore essential, especially for computerized SIL4 systems that, SNCF has its own approval process to ensure that new interlocking systems are safe in the context of the French network. Checks and tests before putting safety facilities into service as well as the results of these tests are essential, time consuming and may show great variations between each other. Economic constraints and the increasing complexity associated with the development of computerized tools tend to limit the capacity of the classic approval process (manual or automatic). A reduction of the validation cover rate could result in practice. The method and the tool presented in this paper makes it possible to formally validate new computerized systems or evolutions of existing French interlocking systems with real-time functional interpreted Petri nets. The aim of our project is to provide SNCF with an effective method for the formal validation of French interlocking systems. A formal proof method by assertion, which is applicable to industrial automation equipment such as interlocking systems, and which covers equally the specification and its real software implementation, is presented in this paper. With the proposed method and its associated tools we completely verify that the system follows all safety properties at all times and does not show superfluous conditions: it replaces all the indoor checks (not the outdoor checks). It can easily be included in the existing SNCF testing procedures. The immediate advantages expected are a significant reduction of testing time and of the related costs, an increase of the test coverage rate, an answer to the new demand of railway infrastructure maintenance engineering to modify and validate computerized interlocking systems. Formal methods mastery by infrastructure engineers is surely a key to prove that more safety is not necessarily more expensive.

Autonomous vehicles use Electronic Control Units running complex software to improve passenger comfort and safety. To test safety of in-vehicle electronics, the ISO 26262 standard on functional safety recommends using fault injection during component and system-level design. A Fault Injection Framework (FIF) induces hard-to-trigger hardware and software faults at runtime, enabling analysis of fault propagation effects. The growing number and complexity of diverse interacting components in vehicles demands a versatile FIF at the vehicle level. In this paper, we present a novel retargetable FIF based on debugger interfaces available on many target systems. We validated our FIF in three Hardware-In-the-Loop setups for autonomous driving based on the NXP BlueBox prototyping platform. To trigger a fault injection process, we developed an interactive user interface based on Robot Operating System, which also visualized vehicle system health. Our retargetable debugger-based fault injection mechanism confirmed safety properties and identified safety shortcomings of various automotive systems.

This paper introduces and elaborates on Super-Critical Operational Modes (SCOMs) within automotive systems. In the landscape of increasingly software-centric automotive functionalities, SCOMs are pivotal for maneuvering through severe operational disruptions while ensuring vehicle safety and longevity. Distinctly diverging from the traditional focus on normal operational modes and isolated component failures, this research accentuates the imperative need for a systematic understanding and mitigation of SCOMs. A nuanced classification system is proposed for SCOMs: Type I (Mild), Type II (Moderate), and Type III (Severe) intensities, each distinguished by their respective intensity levels, impacts, and recovery complexities. Particularly for Type III SCOMs, an innovative approach rooted in automatic diagnostics, analysis, and internal system restructuring is advocated, thereby obviating the need for external intervention. This framework provides invaluable insights for practitioners, enabling the identification, analysis, and autonomous response to SCOMs, thereby fostering the development of resilient, self-sustaining, and safe automotive systems.

The More Electric Vehicles (MEV) concept emphasizes the utilization of electrical systems instead of mechanical, hydraulic, and pneumatic systems to optimize vehicle fuel economy, emissions, performance, and reliability. In addition, the need for improvement in comfort, convenience, entertainment, safety, security, and communications necessitates more electric automotive systems. As a result, an electric power distribution system with larger capacity and more complex configuration is required to facilitate increasing electrical loads. Due to the environmental concerns, there is also a definite development towards new propulsion systems for the future cars in the form of electric and hybrid electric vehicles (EV and HEV). Most of these new electrical systems in advanced cars utilize power electronic converters and motor drives. In this paper, a modeling tool, which has been developed to study automotive systems using PSIM software, is presented. Different heat engines, transmissions, differentials, mechanical systems, control strategies, batteries, solar cells, and fuel cells have been modeled to enable simulation of vehicular systems. Suitability of the software package in design of different automotive systems is explored as well.

A novel design methodology, associated algorithms, and tools for the design of complex automotive cyber-physical systems are presented. Rather than supporting the critical path where most resources are spent, we preemptively target the concept design phase that determines 75% of a vehicle's cost. In our methodology, the marriage of systems engineering principles with high-level synthesis techniques results in a Functional Modeling Compiler capable of generating high-fidelity simulation models for the design space exploration and validation of multiple cyber-physical (ECUs+Physics) vehicle architectures. Using real-world automotive use-cases, we demonstrate how functional models capturing cyber-physical aspects are synthesized into high-fidelity simulation models.

An expert system approach for designing air-conditioning systems for cars and trucks is presented. A brief introduction to the automotive application of the vapor-compression refrigeration cycle is provided as general background. The method presented uses an integrated approach combining the power of conventional analysis programs, databases and model-based expert system technology. Some sample rules from the knowledge base have been included in the paper to illustrate the application of the domain knowledge and its interaction with algorithmic programs. The system architecture is very open and modular, and it lends itself to easy modifications and future expansions. Possibilities for system enhancements are also outlined in the paper. The approach presented in this paper provides substantial benefits to the automotive air-conditioning design engineer particularly in the early stages of new vehicle platform planning and development. A pilot system has been successfully tested at General Motors for preliminary design of automotive air-conditioning systems.