In-Situ Requirements Monitoring of Embedded Systems

We present a requirements-driven methodology enabling efficient runtime monitoring of embedded systems. The proposed approach extracts a runtime monitoring graph from system requirements specified using unified modeling language sequence diagrams with timing annotations. Nonintrusive, in-situ, on-chip hardware dynamically monitors the system execution, matches the specified requirements, and provides detailed information that can be analyzed in the event of a system failure. We present a case study using an autonomous vehicle subsystem demonstrating that the approach can achieve 100% detection rate of common failure types, including timing, dependency, synchronization, and sensor failures. We further analyze the relationship between coverage of system events, detection rates, and hardware requirements.

I. Introduction

Defining and verifying system requirements are a critical challenge in embedded systems. During development, system verification often includes test-based and formal verification methods. Overall, test and verification comprise as much as 75% of the design effort. Even with the significant effort, exhaustively verifying software and hardware to be bug free before deployment is prohibitive. This implies that software and hardware bugs may have unintended consequences, particularly in safety-critical applications. Additionally, accounting for all operating conditions of embedded systems at the design stage is infeasible, as all possible conditions that may affect the system performance cannot be evaluated a priori. As evidenced from numerous examples, testing and verification solely during development is insufficient. Embedded systems also present unique challenges in monitoring correctness. Tight integration of hardware and software means monitoring must consider both hardware and software, which increases the monitoring complexity. This tight integration prevents the use of traditional methods to observe, monitor, or control the state of these components at runtime. Ensuring systems operate correctly in-situ is a significant challenge. Thus, there is a need for methods that continually verify correct system execution at runtime within the deployed system.