Architecting systems for complex contexts by Gerrit Muller University College of South East Norway e-mail: gaudisite@gmail.com www.gaudisite.nl Abstract The move from today s automotive archictectures to autonomous architectures triggers many questions. Todays architectures are federative, focused on safety through predictability, and legacy and bottom-up driven. Autonomy requires context understanding, and a fundamental discussion on the balance between humans and autonomous systems. This presentation takes the perspective from other domains with software intensive systems, to explore the potential hurdles in the transition to autonomous systems. Distribution This article or presentation is written as part of the Gaudí project. The Gaudí project philosophy is to improve by obtaining frequent feedback. Frequent feedback is pursued by an open creation process. This document is published as intermediate or nearly mature version to get feedback. Further distribution is allowed as long as the document remains complete and unchanged. status: planned
An outsiders perspective on Automotive The speaker s background Health care, MRI scanners 1981-1991 (and 2007-2010) Highly integrated architecture: Host computer + controllers Health care, Imaging workstations 1991-1997 Object Oriented, workstations + servers Semiconductor equipment 1997-1999 From federated to integrated architecture The speaker s perspective on automotive Loooong development cycles (heavy qualification, certification, verification) Where is the system from control perspective? Why do designers constrain themselves so much? (no dynamic memory management!) How can automotive move from such primitive state to autonomous driving? 2 Gerrit Muller AACSoutsidersPerspective
Figure of Contents TM architecture example and trends from semiconductor equipment domain automotive architecture and trends health care automation example autonomous driving? 3 Gerrit Muller AACSlogo
Example ASML Waferstepper 4 Gerrit Muller ASMLtwinscanPhoto
Control Hierarchy of a Waferstepper system control coordination ethernet laser lens illuminator measurement C&T reticle stage reticle handler wafer stage wafer handler VME VME vertical motion horizontal motion vertical motion horizontal motion 5 Gerrit Muller FAIcontrolHierarchy
Trend: Increased Frequency of Control Actions trend with increasing performance requirements SW sampling per die per wafer per batch per day preventive maintenance 10-3 1 10 3 10 6 seconds 6 Gerrit Muller FAIcontrolFrequency
Evolution of System Control user interface automation interface monitoring and optimization user interface static simple calibration sequencer 1990 150 kloc data store production and installation support feedforward metro exposure control dynamic calibration infrastructure 2000 2000 kloc job control data management monitoring 7 Gerrit Muller FAIcontrolEvolution
Consequences of Evolution Performance and functionality demands causes Complexity threatens Reliability loss of overview (150kloc fits in 1 mind, 2Mloc not) (more than?) exponential increase of coupling 1:1 relation HW:SW becomes n:m relation autonomous subsystems paradigm shift! integrated system 8 Gerrit Muller FAIevolutionConsequences
architecture example and trends from semiconductor equipment domain automotive architecture and trends health care automation example autonomous driving? 9 Gerrit Muller AACSlogoAutomotive
Conventional Vehicle Network Master Gateway ECU ECU ECU Free after: A reference architecture for cooperative driving. By Sagar Behere, Martin Törngren, De-Jiu Chen 10 Gerrit Muller AACSvehicleNetwork
Cooperative Driving Vehicle Network Master Gateway ECU ECU ECU Coop driving system From: A reference architecture for cooperative driving by Sagar Behere, Martin Törngren, De-Jiu Chen 11 Gerrit Muller AACSvehicleNetworkPlus
Conceptual view of the reference architecture Wireless reception To Supervisor Semantic Data analyser From: A reference architecture for cooperative driving. By Sagar Behere, Martin Törngren, De-Jiu Chen Model data supplier Super sensors Local sensors Vehicle gateway Other information sources Model data processors Data Fusion #1 World Model Generic data processor Map matching Model data consumers Wireless broadcast HMI Control Data flow Architecural element Generic data processor Plugin Local Actuators Vehicle Gateway 12 Gerrit Muller AACSreferenceArchitecture
architecture example and trends from semiconductor equipment domain automotive architecture and trends health care automation example autonomous driving? 13 Gerrit Muller AACSlogoAutomation
MRI: From Human Intent to Technical Realization clinical workflow protocol, request clinical imaging contrast, resolution, position,... 1990 exam card MRI physics method, TR, TE,... 1982 preset procedure machine desired waveforms corrected waveforms f.i. Eddy currents 1980 pulse programming digital samples analog currents human access and support 14 Gerrit Muller AACStransformationsMRI
Evolution in Operation of MRI operator knowledge and focus: from technical to application to workflow scope: from system to examination (including humans) to department or hospital positive: result orientation How robust is this set-up for more exceptional cases? focus on workflow efficiency focus on clinical imaging MRI physics knowledge machine knowledge 1980 1990 2000 2010 15 Gerrit Muller AACSevolutionMRIoperation
What are the Consequences of Automation Benefits Focus on patient and clinical aspects Less errors for routine cases, due to protocolized way of working Concerns How much do clinical users know and understand the imaging system? Will they understand and be able to cope with technical opportunities and constraints? Will they be able to operate the system for non-routine cases? Challenge of automating How can clinical users build up and maintain technical competence? 16 Gerrit Muller AACSautomationBCs
Symptom of Problematic Automation Alarm Fatigue Ignoring or switching off alarms that occur too often. Typical pattern When designers do not know how to handle an exception, then they make a configurable alarm, delegating the problem to the next person in the chain. Have you been in Critical Care Units or any control room? How many alarms are ignored? Deepwater Horizon, Gulf of Mexico The alarms in the crew cabins were switched off, since the alarm sounded too often 17 Gerrit Muller AACSalarmFatigue
architecture example and trends from semiconductor equipment domain automotive architecture and trends health care automation example autonomous driving? 18 Gerrit Muller AACSlogoAutonomous
Should Cars Ignore the Law? Date: Fri, 18 Dec 2015 07:18:52-0800 Subject: Driverless cars: too safe at any speed? Keith Naughton, 18 Dec 2015 Accident rates are twice as high for driverless cars as for regular cars, but the driverless cars have never been at fault. https://www.autonews.com/article/20151218/oem11/151219874/humans-are-slamming-intodriverless-cars-and-exposing-a-key-flaw DETROIT (Bloomberg) -- The self-driving car, that cutting-edge creation that's supposed to lead to a world without accidents, is achieving the exact opposite right now: The vehicles have racked up a crash rate double that of those with human drivers. The glitch? They obey the law all the time, as in, without exception. This may sound like the right way to program a robot to drive a car, but good luck trying to merge onto a chaotic, jam-packed highway with traffic flying along well above the speed limit. It tends not to work out well. As the accidents have piled up -- all minor scrape-ups for now -- the arguments among programmers at places like Google Inc. and Carnegie Mellon University are heating up: Should they teach the cars how to commit infractions from time to time to stay out of trouble? [...] 19 Gerrit Muller AACScompRisksQuote
A functional architecture for autonomous driving off-board guidance systems tele-operation/remote monitoring/fleet management on-board vehicle systems sensing external localization semantic understanding world model external S 1 sensor fusion decision and control cognitive driving intelligence S k trajectory energy platform fault man vehicle platform abstraction vehicle platform internal S 1 S n diagnostics & fault man. reactive control energy management trajectory execution platform stabilization propulsion/steering/braking passive safety internal from: A Functional Architecture for Autonomous Driving, by Sagar Behere, Martin Törngren 20 Gerrit Muller AACSautonomousArchitecture
Human and Automotive Minds System 2 slow, lazy, critical thinking situation awareness sometimes lured by System 1 System 1 fast, intuitive situation assessment and handling often right Thinking Fast and Slow by: Daniel Kahneman artificial intelligence? cognitive driving intelligence fast situation assessment and handling how often right or wrong? intelligent transport system (or wider context) sometimes wrong cerebellum autonomic nervous system peripheral nervous system vehicle platform very fast local 21 Gerrit Muller AACSmodelMinds
What is your Conclusion? When and why do we benefit from full autonomous driving? Will we have time and energy for new developments? Will we lose our own capabilities? 22 Gerrit Muller AACSconclusion