[image] [image] Ressource protégée - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu

[image] [image]

* Documentation

* FR
  Français (FR)

* Anglais (EN)
  Se connecter

* Portail HAL Inria

* Recherche
  Loading...

## Recherche avancée

Information de documents

Titres

○ Titres

○ Sous-titre

○ Titre de l'ouvrage

○ Titre du volume (Série)

○ Champ de recherche par défaut (multicritères) + texte intégral des PDF

○ Résumé

○ Texte intégral indexé des documents PDF

○ Mots-clés

○ Type de document

○ Sous-type de document

○ Tous les identifiants du document

○ Identifiant HAL du dépôt

○ Langue du document (texte)

○ Pays (Texte)

○ Ville

○ À paraître (true ou false)

Ajouter
# Monitoring of an Artificial DNA in Dynamic Environments

Mathias Pacher, Uwe Brinkschulte

► To cite this version:

Mathias Pacher, Uwe Brinkschulte. Monitoring of an Artificial DNA in Dynamic Environments. 6th International Embedded Systems Symposium (IESS), Sep 2019, Friedrichshafen, Germany. pp.167-178, 10.1007/978-3-031-26500-6_14. hal-04489005

HAL Id: hal-04489005

https://inria.hal.science/hal-04489005v1

Submitted on 4 Mar 2024

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
## Auteur

### Auteur (multicritères)

○ Auteur (multicritères)

○ Auteur : Nom complet

○ Auteur : Nom de famille

○ Auteur : Prénom

○ Auteur : Complément de nom, deuxième prénom

○ Auteur : Organisme payeur

○ Auteur : IdHal (chaîne de caractères)

○ Auteur : Fonction

○ Auteur : personID (entier)

○ Auteur : Identifiant de l'organisme payeur

○ Auteur : Identifiant de la structure

○ Directeur de thèse

○ Éditeur

○ Éditeur scientifique

○ Éditeur de la série

## Ajouter

### Structure

#### Structure (multicritères)

○ Structure (multicritères)

○ Structure : Acronyme

○ Structure : Nom

○ Structure : Code

○ Structure : Pays

○ Structure : Type

○ Structure : État dans le référentiel

○ Structure : Identifiant HAL de la structure

○ Structure/équipe de recherche : Pays

○ Structure/regroupement d'équipes : Pays

○ Structure/laboratoire : Pays

○ Structure/regroupement de laboratoires : Pays

○ Structure/institution : Pays

○ Structure/regroupement d'institutions : Pays

## Ajouter
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
Autres

Champ de recherche par défaut (multicritères)

○ <u>Champ de recherche par défaut (multicritères)</u>

○

○ <u>Revues (multicritères)</u>

○ <u>Revue : Éditeur</u>

○ <u>Revue : Titre abrégé</u>

○ <u>Revue : Titre</u>

○ <u>Revue : Identifiant interne</u>

○ <u>Revue : Date de début de publication</u>

○ <u>Revue : ISSN électronique</u>

○ <u>Revue : ISSN</u>

○ <u>Revue : Éditeur</u>

○ <u>Revue : Couleur dans SHERPA/RoMEO</u>

○ <u>Revue : État dans le référentiel</u>

○

○ <u>Colloque (multicritères)</u>

○ <u>Colloque : Titre</u>

○ <u>Colloque : Organisateur</u>

○ <u>Colloque : date de début (Année)</u>

○ <u>Colloque : date de fin (Année)</u>

○ <u>Conférence invitée (oui/non)</u>

○

○ <u>Projets ANR (multicritères)</u>

○ <u>Projet ANR : Acronyme</u>

○ <u>Projet ANR : Acronyme du programme</u>

○ <u>Projet ANR : Code décision (référence)</u>

○ <u>Projet ANR : Nom</u>

○ <u>Projet ANR : Identifiant interne</u>

○ <u>Projet ANR : État dans le référentiel</u>

○

○ <u>Projets européens (multicritères)</u>

○ <u>Projet européen : Acronyme</u>

○ <u>Projet européen : Identifiant de l'appel à projet</u>

○ <u>Projet européen : Référence</u>

○ <u>Projet européen : Nom</u>

○ <u>Projet européen : Date de fin</u>

○ <u>Projet européen : Financement</u>

○ <u>Projet européen : Date de début</u>
# Monitoring of an Artificial DNA in Dynamic Environments

Mathias Pacher and Uwe Brinkschulte

Johann Wolfgang Goethe-Universität, 60629 Frankfurt am Main, Germany
{pacher, brinks}@es.cs.uni-frankfurt.de

**Abstract.** In the last decade, bio-inspired techniques like self-organization and emergence have been in the focus of several research projects to deal with the challenge to develop, to configure and to maintain highly distributed and embedded systems. In biology the structure and organization of a system is coded in its DNA, and several dynamic control flows are regulated by the hormone system. We adapted these concepts to embedded systems using an artificial DNA (ADNA) and an artificial hormone system (AHS). Based on these concepts, highly reliable, robust and flexible systems can be created. These properties predestine the ADNA and AHS for the use in future automotive applications.

We showed in recent publications several examples for the use of the ADNA/AHS approach dealing with automotive applications running on the processors of a single distributed system of processors. We also showed how to adapt the ADNA/AHS approach so that different systems using the ADNA can merge at run-time if these systems come in communication range and form a new system including the ADNAs of both systems. In this contribution, we present and evaluate a way to monitor the ADNA and its tasks. This can be used to realize paywalls or security mechanisms for the ADNA.

**Keywords:** Artificial DNA, artificial hormone system, self-organization, dynamic merger and separation, monitoring

## 1 Introduction

In the last decade, bio-inspired techniques like self-organization and emergence have been in the focus of several research projects to deal with the challenge to develop, to configure and to maintain highly distributed and embedded systems. They are a promising approach to handle real-world applications such as control tasks in cars which may suffer from processor or task failures and must adapt to a changing environment. In biology, the structure and organization of a system is coded in its DNA. The dynamic control flows are regulated by the hormone system. We adapted these concepts and developed the Artificial DNA (ADNA) by which the blueprint of the structure and organization of an embedded systems can be described. The ADNA can be stored in every processor of the system. The tasks described by the ADNA are distributed to the processors in a self-organizing way by an artificial hormone system (AHS). The combination of ADNA and AHS
○ Projet européen : État dans le référentiel

○ Projet européen : Identifiant interne

○

○ Date de production : année

○ Date de mise en ligne : année

○ Date de publication : année

○ Date d'écriture : année

○ Date de modification du dépôt : année

○ Date de dépôt : année

○ Date de publication électronique : année

○

○ Collection HAL (multicritères)

○ Collection HAL : catégorie

○ Collection HAL : Code

○ Collection HAL : Nom

○ Collection HAL : Identifiant interne

○

○ Identifiant interne du contributeur/déposant

○ Nom complet du contributeur/déposant

○

○ Domaines

○ Domaine primaire

○ Domaine racine

○ Sous-domaine niveau 1

○ Sous-domaine niveau 2

○ Sous-domaine niveau 3

○

○ Statut du document

○ Version du document

○ Type de dépôt

○ Type de document

○ ISBN

○ Numéro - référence

○ Identifiant DOI

○

○ Classification

○ Audience

○ Vulgarisation

○ Comité de lecture - texte (oui ou non)

○ Actes de colloque
allows to create very robust and flexible systems providing self-X features like self-
configuration, self-optimization and self-healing. We have already demonstrated
these features in previous publications [4] using an autonomous self-balancing
robot vehicle.

We showed in [13] that the concept of ADNA and AHS can successfully
be applied to a dynamic environment of distributed systems which merge and
separate at run-time. Merging different systems of distributed processors makes
sense

- if the processors of one system offer functionalities which are not offered by the other system or

- if the processors of one system offer these functionalities but promise a better performance in terms of execution time, reaction time, needed memory space or power consumption or

- if processors of a system fail and some of its tasks can run on the other system's processors in order to guarantee graceful degradation.

If tasks of other systems run on processors of the own system, it is mandatory to
monitor them as they use the computing power of the own processors. Thus, it
is reasonable to let the other system's owner pay for using the computing power.
Another reason is to guarantee security of the own system, i.e. to prevent the
other systems ADNA to harm the functionality of the own system. In this paper,
we show

1. ways to adapt the ADNA and AHS to run such a monitoring task on the own system and

2. an evaluation of this task.

The conception of both the ADNA and the AHS is presented in Section 3. The
architecture of the ADNA/AHS system for dynamic environments is presented in
Section 4. In section 5 we discuss the evaluation results while section 6 concludes
this paper.

## 2 Related Work

Our approach relies on self-organization in automotive applications and embedded
systems and have been explained in detail in [2, 4]. Other approaches on this topic
have been addressed especially at the ESOS workshop [5]. None of the presented
approaches at ESOS deals with self-organization using DNA-like structures.

Several authors in [11] emphasize the necessity of redundant processors and
sensors in future autonomous cars, however, they do not propose such a fine-
grained approach as possible by the ADNA. In [8] a redundancy scheme for
processors in automotive applications is proposed where a voting algorithm is
used to determine the validity of results of redundant processors. This is different
from our approach which improves the exploit of redundancy using the ADNA.

To realize DNA-like structures, we have to describe the building plan of
an embedded system in a compact way so it can be stored in each processor
○ Référence interne

○ Financement

○ Collaborations

Ajouter

Lancer la recherche
Recherche experte (SolR)

Recherche experte (SolR)

Lancer la recherche
Vers la recherche avancée

• Déposer

Portail INRIA.HAL.SCIENCE
Les publications, logiciels... des scientifiques Inria

• Accueil

• Publications Inria

○ Consulter les derniers dépôts

○ Par équipe de recherche

○ Par auteur

○ Rapports de recherche et techniques

○ Livres blancs

○ Rapports d'activité des équipes

○ Statistiques

• Boite à Outils

○ X2Hal : importer par lot

○ Logiciels : créer le Codemeta.json

○ Créer mon IDHal

○ Créer mon CVHal

○ Haltools : créer ma page de publications

○ Haltools : extraire des données (réservé Inria)

○ Les bonnes pratiques

■ Comment bien s'affilier ?
core. Therefore, we have adapted well known techniques like netlists and data flow models (e.g. the actor model [10]) to achieve this description. However, in contrast to such classical techniques our approach uses this description to build the embedded system dynamically at run-time in a self-organizing way. The description acts like a DNA in biological systems. It shapes the system autonomously to the available distributed multi/many-core hardware platform and re-shapes it in case of platform and environment changes (e.g. core failures, temperature hotspots, reconfigurations like adding new cores, removing cores, changing core connections, etc.). This is also a major difference to model-based [12] or platform-based design [15], where the mapping of the desired system to the hardware platform is done by tools at design time (e.g. a Matlab model). Our approach allows very high flexibility and robustness due to self-organization and self-configuration at run-time while still providing real-time capabilities.

In [14] the concept of trust is used in self-organizing systems as a mechanism to enable agents to decide if they execute tasks for other agents. Self-aware computing systems (SACS) [9] are a new research topic and deal with modeling systems and their environments. The models help to interact with and to manipulate the environment according to user-specified goals. None of these approaches deals with DNA-like structures at run-time.

# 3 Conception of the Artificial Hormone System and DNA

This section briefly describes the concept of the artificial DNA and the underlying artificial hormone system (AHS). For detailed information see [6], [1], [3].

## 3.1 Artificial DNA

The approach presented here is based on the observation that in many cases embedded systems are composed of a limited number of basic elements, e.g. controllers, filters, arithmetic/logic units, etc. This is a well known concept in embedded systems design. If a sufficient set of these basic elements is provided, many embedded real-time systems could be completely built by simply combining and parametrizing these elements. Figure 1 shows the general structure of such an element. It has two possible types of links to other elements. The *Sourcelink* is a reactive link, where the element reacts to incoming requests. The *Destinationlink* is an active link, where it sends requests to other elements.

Each basic element is identified by a unique Id and a set of parameters. The *sourcelink* and the *destinationlink* of a basic element are compatible to all other basic elements and may have multiple channels.

The Id numbers can be arbitrarily chosen, it is important only that they are unique. Figure 2 gives an example for a PID controller which is often used in closed control loops. This element has the unique Id = 10 and the parameter values for P, I, D and the control period. Furthermore, it has a single *sourcelink* and *destinationlink* channel.
* Quelle version puis-je déposer ?

* Choisir le bon « type de document »

* Mettre en valeur ses publications

○ Les tutos IES Inria

* Lier les notices dans HAL

* Umbrhal Inria pour l'accessibilité

* Personnaliser son CVHAL

* Créer et Personnaliser sa collection

• Documentation

○ Aide en ligne HAL

○ Aide en ligne Haltools

○ Aide en ligne X2hal

○ Tutoriels video HAL

○ Documentation API HAL

○ Ajouter des vignettes

○ Identifiant auteur IdHAL et CV

○ Compléter son dossier ORCID avec ses dépôts HAL

○ Inria et la Science Ouverte

X

X

X

Loading...

X

Le document que vous demandez est en access restreint
jusqu'au 2026-01-01 !

Revenir a la notice

Retourner à l'accueil

Contact

•

Ressources
<figure><img src="image_3.png" /><figcaption>Fig. 1. Structure of a basic element (task)</figcaption></figure>

<figure><img src="image_4.png" /><figcaption>Fig. 2. Sample basic element</figcaption></figure>

Embedded systems can be composed by using these basic elements as building blocks. Figure 3 shows a very simple example of a closed control loop based on basic elements. An actor (defined by its resource id, e.g. a motor) is controlled by a sensor (also defined by its resource id, e.g. a speed sensor) applying a constant set-point value. If we consider the closed control loop to be the *function* of the embedded system, it is divided by the ADNA into *tasks*: the basic elements.

<figure><img src="image_5.png" /><figcaption>Fig. 3. A closed control loop consisting of basic elements</figcaption></figure>

If a sufficient set of standardized basic elements with unique Ids is available, an embedded system will no longer be programmed, but composed by connecting and parametrizing these elements. The building plan of the system can be described by a compact netlist containing the basic elements, its parameters and interconnections. This netlist can be stored in each processor of the system. It therefore represents a digital artificial DNA (ADNA) which allows to partition and build the system at run-time. Detailed examples and a very memory efficient format to store an ADNA are presented in [1] and [3].

## 3.2 Building the System from its ADNA by the AHS

Using the ADNA the system is divided into functions (e.g. control functions, closed control loops, data processing, filtering, etc.) and tasks (the basic elements
* Documentation

* FAQ

* API

* OAI-PMH

* AuréHAL

## Informations

* À propos

* Données personnelles

* Mentions légales

* Accessibilité

* Conformité RGAA

## Questions juridiques

* Je publie, quels sont mes droits ?

* Loi pour une République numérique

* Stratégie de non-cession des droits

* SHERPA/RoMEO

## Portails

* Portails institutionnels

* HAL

* HAL SHS

* HAL Thèses

* MédiHAL

## CCSD

* CCSD

* Episciences

* Sciencesconf
of a function). Each processor has a local copy of the ADNA and therefore knows all these functions, tasks and their interconnections. It passes this information to the local instance of its artificial hormone system (AHS). The AHS is a completely decentralized mechanism to assign tasks to distributed computing nodes, see [6]. It uses artificial hormones (emulated by short messages) to find the most suitable computing node for each task based on node capability, load and tasks interconnection. It can also detect failing nodes and tasks by missing hormone values. So all basic elements of the ADNA are assigned as tasks at run-time by the AHS to the available processors. These elements are then interconnected according to the ADNA. This means the functions build themselves at runtime in the best possible way on the available processor resources. In case of a processor failure the basic elements are autonomously reassigned and reconnected to other processors as long as there is enough computing power left. Assignment and reassignment of tasks is done in real-time (with a time complexity of $O(n)$, where $n$ is the number tasks) as proven in [6] and demonstrated by a self-balancing robot vehicle in [3]. The ADNA therefore enables an extremely robust and fine-grained distribution of functions to processors. A function is not bound to a single processor but can be split among several processors on the task (basic element) level. In case of processor failures only the affected basic elements are automatically moved to other processors. Additionally, the importance of basic elements can be derived from the ADNA and used to operate the most important parts if not enough computation power is left to assign all tasks. A detailed description of building a system from the ADNA and complex examples can be found in [3].

### 3.3 Application of the ADNA and AHS concept to Automotive Systems

In automotive applications the system functions (anti-locking brake, traction control, stability control, engine control, driving assistants, infotainment, etc.) are executed by the car's processors, the ECUs (electronic control units). To enable advanced concepts like autonomous driving, many of these systems require fail-operational behavior. So a highly robust design is necessary. In classical approaches, a function is usually mapped to an ECU (e.g. anti-locking brake to the anti-locking brake ECU). To provide fail-operational behavior, critical ECUs have a backup ECU (1:1 redundancy). In more advanced approaches like e.g. the AutoKonf project [7], several ECUs share a single backup ECU (p:1 redundancy) to reduce the overhead. These approaches apply redundancy on the *function level*. In contrast, the self-healing process of the ADNA and AHS concept provides redundancy on the *task (basic element) level*. This enables a very fine-grained and efficient use of the available ECU resources.

It is simple to see that the failure probability of a $p:1$ redundancy approach like in the AutoKonf project with $q$ failing ECUs is

$$P(q) = \begin{cases} 1 - \frac{(k-q)!}{k!} \cdot \frac{(a-1)!(p+1)^{q-1}((a-q)(p+1)+qr)}{(a-q)!} & \text{if } q \le a \\ 1 & \text{else} \end{cases}$$
where $k = n + a$ is the number of ECUs with $n$ being the basic number of ECUs and $a = \lfloor \frac{n}{p} \rfloor$ being the redundant ECUs. $r = (n \bmod p) + 1$ is the number of remaining ECUs is $n$ is not a multiple of $p$.

The failure probability of the ADNA/AHS approach can be computed much easier as there are only two choices: Either there are enough ECUs to run all tasks; the failure probability is 0 then, or there are not enough ECUs to run all tasks; the failure probability is 1 then. Figure 4 compares the failure probability of a 1:1 redundancy approach with ADNA-based redundancy using $k = 2n$ (12 ECUs each) and a conventional 2:1 redundancy approach with ADNA-based redundancy using $k = 1.5n$ (9 ECUs each). The 1:1 and 2:1 redundancy approaches produce a failure probability greater than 0 if more than a single ECU fails and converge to 1. They reach the failure probability 1 when four (2:1 redundancy) and seven (1:1 redundancy) ECUs fail. The redundancy due to the ADNA-based redundancy behaves much smoother: Their failure probabilities are 0 up to four ($k = 1.5n$) and seven ($k = 2n$) failing ECUs and then jump to 1. Therefore, it makes sense to apply the ADNA/AHS concept to the automotive area. This is especially interesting in the context of the approach of this paper as the number of fully functional ECUs may dynamically be increased.

<figure><img src="image_6.png" /><figcaption>Fig. 4. Fail-operational limits of different redundancy configurations</figcaption></figure>

# 4 Architecture of the ADNA/AHS Approach for Dynamic Environments

Figure 5 shows the architecture of the ADNA/AHS approach in dynamic environments. Each ECU of system A has a local copy of the system's ADNA.
<figure><img src="image_7.png" /><figcaption>Fig. 5. Architecture</figcaption></figure>

Therefore, their ADNA builders can parse the ADNA and segment it into tasks. It also derives the communication relations between these tasks as well as timing, logging and all other relevant parameters to run the application. Each instance of a basic element becomes a task in the embedded system. Then, the AHS tries to assign tasks to the most suitable ECU. The suitability is indicated by specific hormone levels. With the ADNA, the suitability of an ECU for a task can be derived automatically by the ADNA builder from the Id of the basic element in the ADNA representing the task and the features of the ECU. As an example, a basic element with Id = 10 (PID controller) performs better on a ECU with better arithmetic features while memory is less important. So the appropriate hormone levels can be calculated automatically by the ADNA builder and assigned to the AHS. More details on the ADNA building in a single system are presented in [2]. The same building process also performs in system B.

If the systems get in communication range (e.g. by C2C or C2X communica-
tion), they exchange their ADNAs, thus enabling the other system to process and
run the other ADNA and building up a new system running the tasks of both
ADNAs.<fnref n="1" /> This enables to run tasks on the best suited currently available ECUs
thus increasing the quality of task execution (by e.g. increasing the computation
frequency in a closed control loop) on the one hand and to enable the execution
of the ADNA despite massive failures of a system’s ECUs on the other hand.

The exchange of ADNA can be implemented in two different ways: The first option is that all systems are pre-programmed with the ADNAs of each system, however, the ADNA from each other system is deactivated by the ADNA builder. It activates the ADNA from another system if and only if the other system is in communication range. The second option is that each system possesses only its own ADNA and transmits it to another system if this is in communication range. We chose to implement and analyze the first option in this contribution in

<footnote n="1">¹ Therefore, the ADNAs of the different systems needs to be tagged to distinguish between tasks of different ADNAs. This is indicated in Fig. 5 by the indices of the ADNAs.</footnote>
order to evaluate if the concept of ADNAs in dynamic environments is feasible
and to neglect side-effects like the ADNA transfer time. If the systems leave the
communications range they deactivate or delete the other systems' ADNAs.

As stated in the introduction, a system needs to monitor the tasks taken from
another system to implement e.g. payment mechanisms. We focus on how these
tasks affect the ADNA/AHS system. As the local AHS of each ECU periodically
sends suppressor hormones for each taken task, the monitor task can access
the these information by the AHS interface. Thus, the monitor task collects
information

- on which of the own system's ECUs tasks of other systems are running,

- how many task re-allocations are caused by taking tasks of another system
  and

- the ECU load affected by the other system's tasks.

It is important that the monitor task remains static on a single ECU of the
own system. If the monitor task did not run on the own system's ECUs, we
could not guarantee for its proper execution. The limitation of the monitor task
running on the own system's ECUS is guaranteed by not exporting its ADNA
to any other system. Otherwise it were not able to monitor the tasks while it is
re-allocated. There are two ways to locate a task on an ECU so that it is not
affected by task re-allocation: The first way is to set the hormone values of all
ECUs so that only a single ECU can take the monitor task. This is a simple
solution which, however, has two severe disadvantages: First, it contradicts the
ADNA/AHS concept which enables self-optimization and self-healing. Second, if
the ECU running the monitor task fails, monitoring itself will fail.

Therefore, the more appropriate solution is to introduce inhibitor hormones
which are a special kind of suppressor hormones. If the monitor task is allocated
by an ECU the local AHS sends inhibitor hormones to all ECUs. This inhibitor
suppresses the other ECUs eagerness to run the monitor task. But in case the
ECU running the monitor task fails, the inhibitor hormone is not sent any more.
This leads to a re-allocation of the monitor task but it prevents the monitor task
from re-allocation due to small variations in the hormone levels. Fig. 6 illustrates
the way inhibitor hormones work.

5 Evaluation

An automotive scenario may be as shown in Fig. 7: The ECUs of the cars may run
the ADNA shown in Fig. 8. Here, each line describes a task used to control the
cars. The numbers in the brackets describe the communication relations between
the tasks and the remaining numbers describe the task's timing parameters. In
the lines 1 to 3 the position of the steering wheel is used to control the angle of
the front wheels. Lines 4 up to 12 describe how to use the brake pedal position
to determine the brake force while lines 13 up to 22 describe how the throttle
pedal position is used to compute the engine force. In line 23 a special task is
<figure><img src="image_8.png" /><figcaption>**Fig. 6.** Realizing a static monitoring task by inhibitor hormones</figcaption></figure>

activated to check if all ADNA basic blocks are executed; the binary result is shown by an actor described in line 24. Line 25 includes the monitor task.

The grey circles in the figure indicate the field strength of their wireless communication network. As it does not overlap yet, the cars are not able to communicate, however, if they overlap, the cars are in communications range.

<figure><img src="image_9.png" /><figcaption>**Fig. 7.** Dynamic scenario</figcaption></figure>

The evaluation shows a scenario where the red car is driving and after some time two third of its ECUs fail. As a result, several tasks from the red car's ADNA fail because the computing power of its ECUs does not meet the needed computing power. However, the red car meets other cars each 6 seconds and is in communication range with them for 4.5 seconds and can use their ECUs in this time. Fig. 9 shows the cumulated results of the monitoring tasks of the oncoming cars. We present the time a gate task and a sensor task (measuring the throttle position) spent on ECUs of another system as well as the number of ECU hops of these tasks on another system. The monitor task run about 10000 AHS cycles (1 AHS cycle takes 50 msec), so the evaluation took about 8 minutes. The figure shows that the sensor task has initially been executed by the own system's ECUs. However, from about 1900 AHS cycles (which is about a minute after the start of the evaluation) the sensor task is moved to another system each time another car
<figure><img src="image_10.png" /><figcaption>Fig. 8. ADNA to enable simple driving functions of a car</figcaption></figure>

<figure><img src="image_11.png" /><figcaption>Fig. 9. Result of monitor task</figcaption></figure>
comes in communication range. This task is not executed any more if no other
car is in communication range. The effects of the sensor task being executed only
if another car is in communication range is shown in Fig. 10: The speed of the red
car with the failing ECUs periodically decreases because the motor control input
is missing. However, this shows that the ADNA/AHS system provides graceful
degradation because if the ECUs of other system could not be used, the red car's
motor control would fail completely and the car would stop.

The other monitored task is a gate task and we see that executed on the
own system's ECUs most of the time. If there are not enough ECUs to take all
tasks of the ADNA, the AHS decides which task to skip on internal parameters.
Therefore, the monitor tasks show such a different behaviour for the sensor and
the gate tasks. In future versions of the ADNA/AHS we plan to implement a
priority scheme for the tasks, so that the AHS skips firstly low prior tasks. This
enables the user to control the task failure behaviour in case of reduced ECU
computing power.

<figure><img src="image_12.png" /><figcaption>Fig. 10. Speed of damaged car</figcaption></figure>

6 Conclusion

We showed in this paper that other systems' tasks can run on an ADNA/AHS
system, thus increasing its dependability. However, monitoring these tasks is
mandatory for payment and security reasons. We showed that the own monitor
task can be located on a single ECU by using special inhibitor hormones. The
evaluation showed that the monitor task can observe parameters like execution duration and number of task hops using the AHS system.

The evaluation also shows that it is mandatory to provide a priority scheme for the tasks supported by the AHS in future work. We can then guarantee that important tasks like engine control or brake control are either not moved away from their current processors or they are reallocated at first which decreases their down time.

## References

1. Brinkschulte, U.: An artificial DNA for self-descripting and self-building embedded real-time systems. Concurrency and Computation: Practice and Experience (2015)

2. Brinkschulte, U.: An artificial DNA for self-descripting and self-building embedded real-time systems. Concurrency and Computation: Practice and Experience **28**(14), 3711–3729 (2016)

3. Brinkschulte, U.: Prototypic Implementation and Evaluation of an Artificial DNA for Self-Describing and Self-Building Embedded Systems. In: 19th IEEE International Symposium on Real-time Computing (ISORC 2016). York, UK (May, 17-20 2016)

4. Brinkschulte, U.: Prototypic implementation and evaluation of an artificial dna for self-descripting and self-building embedded systems. Springer EURASIP Journal on Embedded Systems (February 2017), https://jes-eurasipjournals.springeropen.com/articles/10.1186/s13639-016-0066-2

5. Brinkschulte, U., Pacher, M., (editors), C.M.S.: Proceedings of the Workshop on Embedded Self-Organizing Systems, San Jose, USA (2013)

6. Brinkschulte, U., Pacher, M., v. Renteln, A.: An Artificial Hormone System for Self-Organizing Real-Time Task Allocation in Organic Middleware. In: Organic Computing. Springer (2008)

7. German Federal Ministry of Education and Research: Projekt AutoKonf, http://autokonf.de/, Last access: 2019-05-23

8. Hong Yi, C., Kwon, K., Wook Jeon, J.: Method of improved hardware redundancy for automotive system pp. 204–207 (2015)

9. Kounev, S., Kephart, J.O., Milenkoski, A., Zhu, X.: Self-Aware Computing Systems. Springer Publishing Company, Incorporated, 1st edn. (2017)

10. Lee, E., Neuendorffer, S., Wirthlin, M.: Actor-Oriented Design Of Embedded Hardware And Software Systems. In: Journal of Circuits, Systems and Computers (2003)

11. Maurer, M., Gerdes, J.C., Winner, B.L.H.: Autonomous Driving – Technical, Legal and Social Aspects. Springer, Berlin, Heidelberg (2016)

12. Nicolescu, G., Mosterman, P.J.: Model-Based Design for Embedded Systems. CRC Press, Boca Raton, London, New York (2010)

13. Pacher, M., Brinkschulte, U.: Towards an Artificial DNA for the Use in Dynamic Environments. In: 22nd IEEE International Symposium on Real-Time Computing (ISORC 2019). Valencia, Spain (May 2019)

14. Reif, W., Anders, G., Seebach, H., Steghöfer, J.P., André, E., Hähner, J., Ungerer, C.M.S.T. (eds.): Trustworthy Open Self-Organising Systems. Springer International Publishing Switzerland, 1st edn. (2016)

15. Sangiovanni-Vincentelli, A., Martin, G.: Platform-Based Design and Software Design Methodology for Embedded Systems. In: IEEE Design and Test, Vol 18, No. 6. pp. 23–33 (2001)