RV-ECU: Maximum Assurance In-Vehicle Safety Monitoring

The Runtime Verification ECU (RV-ECU) is a new development platform for checking and enforcing the safety of automotive bus communications and software systems. RV-ECU uses runtime verification, a formal analysis subfield geared at validating and verifying systems as they run, to ensure that all manufacturer and third-party safety specifications are complied with during the operation of the vehicle. By compiling formal safety properties into code using a certifying compiler, the RV-ECU executes only provably correct code that checks for safety violations as the system runs. RV-ECU can also recover from violations of these properties, either by itself in simple cases or together with safe message-sending libraries implementable on third-party control units on the bus. RV-ECU can be updated with new specifications after a vehicle is released, enhancing the safety of vehicles that have already been sold and deployed. Currently a prototype, RV-ECU is meant to eventually be deployed as global and local ECU safety monitors, ultimately responsible for the safety of the entire vehicle system. We describe its overall architecture and implementation, and demonstrate monitoring of safety specifications on the CAN bus. We use past automotive recalls as case studies to demonstrate the potential of updating the RV-ECU as a cost effective and practical alternative to software recalls, while requiring the development of rigorous, formal safety specifications easily sharable across manufacturers, OEMs, regulatory agencies and even car owners. INTRODUCTION Modern automobiles are highly computerized, with 70 to 100 complex and interconnected electronic control units responsible for the operation of automotive systems, and roughly 35 to 40 percent of the development cost of modern automobiles going towards software. In the next 10 years this number is expected to jump to between 50 and 80 percent, and even higher for hybrid vehicles. This will only be more true with the advent of autonomous vehicles [1, 2]. It is not surprising, then, that the automotive industry suffers from nearly every possible software fault and resulting error. Many related stories have recently been featured on the news, including cases where cars are hacked and remotely controlled, including brakes and the engine, completely ignoring driver input. In some cases prior physical access to the car was needed, in others the car was not even touched. Massive automobile recalls in the past few years have been due to software bugs, costing billions [3, 4, 5, 6, 7, 8, 9]. Moreover, almost 80 percent of car innovations currently come from computer software, which has therefore become the major contributor of value in cars [1]. As software becomes more and more integral to the function and economics of vehicles, the safety and security of car software has taken center stage. LIMITATIONS OF CURRENT APPROACHES Traditional software development quality processes rely on static analysis tools and techniques to improve the quality, security and reliability of their code. Static