The paper addresses the issue of reliability of complex embedded control systems in the safety-critical environment. In this paper, we propose a novel approach to design controller that (i) guarantees the safety of nonlinear physical systems, (ii) enables safe system restart during runtime, and (iii) allows the use of complex, unverified controllers (e.g., neural networks) that drive the physical systems towards complex specifications. We use abstraction-based controller synthesis approach to design a formally verified controller that provides application and system-level fault tolerance along with safety guarantee. Moreover, our approach is implementable using commercial-off-the-shelf (COTS) processing unit. To demonstrate the efficacy of our solution and to verify the safety of the system under various types of faults injected in applications and in the underlying real-time operating system (RTOS), we implemented the proposed controller for the inverted pendulum and three degree-of-freedom (3-DOF) helicopter.
@cite_38: Abstract : In this report, we study tolerance of semantic faults, one of the crucial Issues In the Simplex(TM) architecture. In particular, we examine semantic faults that cause the controlled device to be unsafe (i.e., unable to carry out its normal operation) and eventually cause the device to become damaged. We also consider fault detection as a safety check. For the class of control systems operating around an equilibrium, the objective of maintaining the safety of the controlled device is formulated as a stabilization problem, and the safety of the controlled device is tested against the stability region of the device under the safety control. To establish the stability region, we apply the Lyapunov stability theory and linear matrix inequality (LMI) methodologies. It is shown that the stability region for a given safety controller as well as a safety control law can be systematically derived by LMI based approaches. We conclude the report with a summary of the procedure for deriving the safety check and safety controller for a given application.
@cite_22: To keep systems affordable, there is a trend towards using open standard and commercial off the shelf (COTS) components in the development of dependable real-time systems. However, the use of COTS also introduces the vendor-driven upgrade problem that is relatively new to the dependable real-time computing community. If we refuse to accept the "new and improved" hardware and software components provided by vendors, then the hope that using COTS components will help keep the system modern via market forces will be dashed. If we decide to keep our systems modern, then we have to develop approaches that can introduce new hardware and software components into deployed systems safely, reliably and easily, in spite of the inevitable bugs in some of the new COTS components. In this paper, we give an informal review of the Simplex Architecture, which has been developed to support safe and reliable online upgrade of dependable computing systems. This paper is a revision of the SEI technical report: A Software Architecture for Dependable and Evolvable Industrial Computing Systems. CMU SEI-95-TR-005.
@cite_7: The rate of innovations in technologies has far exceeded the rate of adopting them in at least the past 20 years. To fully realize the potential of innovations, a paradigm shift is needed, from a focus on enabling technologies for completely new installations to one which is designed to mitigate the risk and cost of bringing new technologies into functioning systems. In this paper, we show that real time control software can be dependably upgrade online via the use of analytically redundant controllers.
@cite_6: 
@cite_27: 
@cite_5: Cyber-physical systems are networked, component-based, real-time systems that control and monitor the physical world. We need software architectures that limit fault-propagation across unreliable components. This paper introduces our simplex reference model which is distinguished by: a plant being controlled in an external context, a machine performing the control, a domain model that estimates the plant state, and the safety requirements that must be met. The simplex reference model assists with constructing CPS architectures which limit fault-propagation. We present a representative case study to highlight the ideas behind the model and our particular decomposition.
@cite_34: Improving the reliability and availability of increasingly complex software is a serious challenge, especially in efforts to protect society's critical functions. Is it true that building diverse, redundant systems provides robustness? This article investigates the relationship between software complexity, reliability, and development resources. It also presents a forward-recovery approach based on the idea of using simplicity to control complexity as a way to improve the robustness of complex software systems.
The concept of utilizing an unverified, complex controller along with a simple, verified safety controller for fault tolerance was initially proposed as Simplex Architecture in @cite_7 @cite_27 @cite_6 . In earlier simplex designs, fault tolerance was achieved in one of two ways. In some of these designs such as @cite_7 @cite_38 @cite_34 @cite_22 @cite_5 , all three components (safety controller, complex controller, and decision unit) share the same computing hardware (processor) and software platform (OS, middleware). As a result, these designs only protect the safety against the faults in the application logic of the complex controller. And, there is no guarantee of the correct behavior in the presence of system-level faults. Our proposed design protects the system from both application-level and system-level faults.