Plan B: Design Methodology for Cyber-Physical Systems Robust to Timing Failures

• Published in: ACM transactions on cyber-physical systems 2022-09, Vol.6 (3), p.1-39, Article 21
• Main Authors: Khayatian, Mohammad, Mehrabian, Mohammadreza, Andert, Edward, Grimsley, Reese, Liang, Kyle, Hu, Yi, McCormack, Ian, Joe-Wong, Carlee, Aldrich, Jonathan, Iannucci, Bob, Shrivastava, Aviral
• Format: Article
• Language: English
• Subjects: Computer systems organization; Embedded and cyber-physical systems
• ISSN: 2378-962X; 2378-9638
• DOI: 10.1145/3516449

Many Cyber-Physical Systems (CPS) have timing constraints that must be met by the cyber components (software and the network) to ensure safety. It is a tedious job to check if a CPS meets its timing requirement especially when it is distributed and the software and/or the underlying computing platforms are complex. Furthermore, the system design is brittle since a timing failure can still happen (e.g., network failure, soft error bit flip). In this article, we propose a new design methodology called Plan B where timing constraints of the CPS are monitored at runtime, and a proper backup routine is executed when a timing failure happens to ensure safety. We provide a model on how to express the desired timing behavior using a set of timing constructs in a C/C++ code and how to efficiently monitor them at the runtime. We showcase the effectiveness of our approach by conducting experiments on three case studies: (1) the full software stack for autonomous driving (Apollo), (2) a multi-agent system with 1/10th-scale model robots, and (3) a quadrotor for search and rescue application. We show that the system remains safe and stable even when intentional faults are injected to cause a timing failure. We also demonstrate that the system can achieve graceful degradation when a less extreme timing failure happens.