Peter Van Der Perk
Total Page:16
File Type:pdf, Size:1020Kb
Eindhoven University of Technology MASTER A distributed safety mechanism for autonomous vehicle software using hypervisors van der Perk, P.J. Award date: 2019 Link to publication Disclaimer This document contains a student thesis (bachelor's or master's), as authored by a student at Eindhoven University of Technology. Student theses are made available in the TU/e repository upon obtaining the required degree. The grade received is not published on the document as presented in the repository. The required complexity or quality of research of student theses may vary by program, and the required minimum study period may vary in duration. General rights Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. • Users may download and print one copy of any publication from the public portal for the purpose of private study or research. • You may not further distribute the material or use it for any profit-making activity or commercial gain Department of Electrical Engineering Electronic Systems Research Group A Distributed Safety Mechanism for Autonomous Vehicle Software Using Hypervisors graduation project Peter van der Perk Supervisors: prof.dr. Kees Goossens dr. Andrei Terechko version 1.0 Eindhoven, June 2019 Abstract Autonomous vehicles rely on cyber-physical systems to provide comfort and safety to the passen- gers. The objective of safety designs is to avoid unacceptable risk of physical injury to people. Reaching this objective, however, is very challenging because of the growing complexity of both the Electronic Control Units (ECUs) and software architectures required for autonomous operation. The thesis begins with an extensive survey of state-of-the-art safety concepts and software architectures for autonomous driving systems. Based on this survey we identified three system design challenges: fault handling in distributed processes, hazardous road situations in the absence of faults and freedom from interference in ECUs consolidating multiple functions. Inspired by the E-Gas concept of distributed health monitoring, we split our safety mechanism into function, platform, and vehicle levels, which we run on different processors. For the software middleware to enable communication between distributed processors, we chose the Data Distri- bution Service (DDS) protocol, which is deployed in safety-critical applications across industries. At present safety cores are not capable to run the full DDS stack, however, there exists a DDS subset - DDS-XRCE specially designed for resource-constrained devices. We ported DDS-XRCE onto NXP S32R274 SoC, which is ready for the highest automotive safety integrity level, to enable this processor's participation in the safety mechanism. Remarkably, the DDS middleware exposes the application software state, which safety mechanisms can use to identify hazardous situations in the absence of faults. Freedom from interference between multiple software stacks is supported by modern processors through hardware virtualization and hypervisors. In our study, we chose the Xen hypervisor, which can host and isolate multiple operating systems on top of it. Using Xen on NXP S32V234 ASIL B capable SoC (System-on-a-Chip) we instantiated two domains - one for vehicle control and one for health monitoring. To validate the concepts of our safety mechanism, we built an experimental setup using the LG SVL simulator and Baidu Apollo software framework on the NXP BlueBox platform for autonomous driving. A take-over driving scenario was developed using the Python API of the LG SVL simulator to ensure reproducible and deterministic analysis of the safety mechanism. To validate our safety mechanism as part of this scenario, we programmatically injected a fault - a high CPU load in the software stack responsible for vehicle control in the target BlueBox system. Based on our fault injection experiment, we concluded that safety mechanisms for distributed processing can rely on the DDS middleware. In our implementation, the middleware also enables resource-constrained safety cores to read application state, which in the future can be used to identify hazardous road situations in the absence of faults. Furthermore, we discovered that the hypervisors are not only useful in ensuring freedom from interference, but they can also implement a fail-silent behavior of faulty software stacks. In the final chapter, we listed promising future research directions, including the challenge-response mechanism in distributed health monitoring and a study of the non-atomic nature of the hypervisor-based software pause in a complex SoC. A Distributed Safety Mechanism for Autonomous Vehicle Software Using Hypervisors iii Acknowledgements This master project is conducted in the Systems and Applications group of NXP Semiconductors, Eindhoven. Throughout this research, I have received a great deal of support and assistance. I would like to express the deepest appreciation to my supervisor Andrei Terechko, for giving me the opportunity to conduct my research and further my thesis at NXP Semiconductors. During my research, you have guided me through the wonderful world of functional safety, the automotive industry, and embedded systems. Your expert guidance and tremendous experience in these domains, has helped me to develop and improve my skills, both technical and non-technical. You have provided me invaluable encouragement and support in various ways. I am really indebted to you more than you know. I would like to thank my university supervisor, Kees Goossens. During our meetings you have provided me with valuable feedback during the course my of research. Focusing on the academic aspect of my research and pinpointing valuable topics. I would like to show my greatest appreciation to the colleagues of the Systems and Applications group at NXP Semiconductors in particular: Yuting Fu, thank you for your critical comments during our brainstorm sessions providing value feedback. Bart Vermeulen, thank your for joining some meetings and providing your expertise and suggestions. I appreciate the feedback offered by Tjerk Bijlsma from TNO-ESI, Your expertise from the EcoTwin project and great understanding of functional safety, provided valuable input for my research. Finally, I wish to express my thanks and gratitude to my parents, brothers, and grandparents for believing in me and being with moral support. In particular, I would like to thank my mo- mther, Yke van der Perk, without her proper guidance and encouragement it would have been impossible for me to complete my Master's degree. Peter van der Perk Eindhoven, the Netherlands June 2019 iv A Distributed Safety Mechanism for Autonomous Vehicle Software Using Hypervisors Glossary ADAS Advanced Driver Assistance Systems.3, 12 ASIL Automotive Safety Integrity Level. 11, 14, 15, 21 CAN Controller Area Network. 20 DDS Data Distribution Service. 11, 21, 22, 26, 30, 34{36 DDS-TSN DDS for Time-Sensitive Networking. 11 DDS-XRCE DDS for eXtremely Resource Constrained Environments. 11, 21, 26, 34{36 DSM Distributed Safety Mechanism. 22, 23, 30 ECU Electronic Control Unit.1, 18, 22 fault tolerance property of a system to continue operating properly in the event of one or more faults [39].4 FCCU Fault Collection and Control Unit. 26 freedom from interference absence of cascading failures between two or more elements that could lead to the violation of a safety requirement [39]. 24, 36 GNSS Global Navigation Satellite System.3,4 HAD Highly Automated Driving.2{5,8, 16, 17, 20, 22, 24{28, 30, 31, 33, 34, 36 hypervisor A hypervisor or virtual machine monitor is computer software, firmware or hardware that creates and runs virtual machines [82]. 12{15 LiDAR Light Detection And Ranging.4, 16 ROS Robot Operating System.4,5, 11, 20, 21, 30 RTOS Real-Time Operating System. 11, 12, 14, 15 SAE Society of Automotive Engineers.3 SoC System-on-Chip. 16, 24{26, 30, 31, 33, 37 SOTIF ISO/PAS 21448, Road vehicles { Safety of the intended functionality. Standard draft.7, 8, 18, 26, 35, 37 A Distributed Safety Mechanism for Autonomous Vehicle Software Using Hypervisors v Contents Contents vi List of Figures viii List of Tables ix 1 Introduction 1 1.1 Research context.....................................1 1.2 Thesis outline.......................................1 2 State of the art overview2 2.1 Highly Automated Driving (HAD) application.....................3 2.1.1 HAD software frameworks............................3 2.1.2 Feature analysis of HAD software frameworks.................4 2.1.3 Fault tolerance in HAD software frameworks.................4 2.2 Safety standards and concepts..............................5 2.2.1 Fault models and monitoring techniques....................5 2.2.2 Device reliability.................................7 2.2.3 ISO 26262 Road Vehicles - Functional safety.................7 2.2.4 ISO/PAS 21448 Road Vehicles - Safety of the intended functionality....7 2.2.5 Security and safety................................8 2.2.6 Safety mechanisms and processes........................8 2.2.7 Scoping diagram of safety frameworks.....................8 2.3 Software middleware................................... 11 2.3.1 Robot Operating System (ROS)........................ 11 2.3.2 Data Distribution Service (DDS)........................ 11 2.4 Operating Systems.................................... 12 2.4.1