CPS: Medium: GOALI: Enabling Safe Innovation for Autonomy: Making Publish/Subscribe Really Real-Time

在当今的汽车行业中，公司正在激烈竞争，以便在其产品线中提供更复杂的自动驾驶功能。 这场竞争的高潮是大众市场规模的完全自主权。 这里的风险很高：率先实现这一目标的公司（和国家）将处于主导地位，影响未来几十年与安全相关的能力的发展。 这种高风险的竞争导致了在自动驾驶关键技术（如感知和决策能力）方面快速创新的巨大压力。 这种压力导致了系统设计的“黑箱”方法，将原本用于其他环境的现成软件和硬件组件重新用于实现复杂的驾驶功能。 最广泛使用的黑盒组件之一是ROS（机器人操作系统）。 ROS允许单独开发的软件程序实现不同的功能（例如，基于摄像头的感知、正确的车道跟随等）以组合形成提供更广泛能力的系统（例如，自动驾驶的汽车）。 不幸的是，正如其名称所示，ROS最初的设计和实现是为了支持机器人应用的开发，这些应用与自动驾驶汽车有着非常不同的要求。 因此，ROS缺乏确保安全汽车系统设计所需的功能。 这里的一个关键问题是缺乏对确保实时安全性的支持，即，某些功能（例如，制动）被“按时”执行（例如，在遇到障碍物之前）。 该项目旨在生产一种替代ROS的方案，将实时安全性作为首要关注点。尽管其名称，ROS实际上并不是一个操作系统（OS），而是一组用户级中间件库，用于构建机器人应用程序的典型处理图。 这些库通过图节点之间的消息通信的发布/订阅（pub/sub）概念支持模块化系统开发，该概念允许不同的软件包松散耦合。 这种松散耦合使软件重用成为可能，这是ROS成功实现快速创新的关键。 ROS的成功令人信服地证明了pub/sub在推动自主创新方面的重要性。 但是，pub/sub必须安全才能应用。 这个项目就是针对这个问题，特别是在自动驾驶汽车中使用的多核+加速器平台的背景下。 在这样的平台中，只有CPU的多核计算机被增强了像图形处理单元（GPU）这样的协处理器，这些协处理器可以加速某些数学计算，这些数学计算通常发生在基于AI的软件中，以实现自主性。 该项目的具体目标是产生一个pub/sub替代ROS，以实现实时安全认证。 主要的研究任务包括解决基本的资源分配问题，在操作系统和中间件的水平，生产分析验证响应时间的界限，在实时发布/订阅图，生产参考发布/订阅中间件的实现，并通过实验比较这种实现ROS。 虽然ROS的发展超出了本项目的范围，但本项目将揭示与这种发展相关的基本权衡。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

In the automotive industry today, companies are fiercely competing to field ever more sophisticated autonomous features in their product lines. The hoped-for culmination of this competition is full autonomy at mass-market scales. The stakes here are high: the companies (and countries) that get there first will be in a commanding position to influence how autonomy-related capabilities evolve for decades to come. This high-stakes competition has resulted in significant pressure to innovate quickly with respect to key technologies for autonomous driving, such as perception and decision-making capabilities. This pressure has led to a “black-box” approach to system design, with off-the-shelf software and hardware components, originally intended for other contexts, repurposed to implement autonomous-driving functions. One of the most widely used repurposed black-box components is ROS (the Robot Operating System). ROS enables separately developed software programs that implement different functions (e.g., camera-based perception, correct lane following, etc.) to be combined to form a system that provides broader capabilities (e.g., a car that drives itself). Unfortunately, as its name suggests, ROS was originally designed and implemented to support the development of robotics applications, which have very different requirements from autonomous vehicles. As a result, ROS lacks features needed to ensure safe automotive system designs. A key issue here is a lack of support for ensuring real-time safety, i.e., that certain functions (e.g., braking) are performed “on time” (e.g., before an obstacle is hit). This project is directed at producing an alternative to ROS that takes real-time safety as a first-class concern.Despite its name, ROS is really not an operating system (OS) but rather a set of user-level middleware libraries that facilitate constructing processing graphs typical of robotics applications. These libraries support modular system development via a publish/subscribe (pub/sub) notion of message communication between graph nodes that allows different software packages to be loosely coupled. This loose coupling enables software reuse, which has been a key to ROS’s success in enabling rapid innovation. ROS’s success convincingly demonstrates the importance of pub/sub in fueling innovation in autonomy. However, pub/sub must be safe to apply. This project is directed at this very issue, specifically in the context of multicore+acclerator platforms as used in autonomous vehicles. In such a platform, a CPU-only multicore computer is augmented with co-processors like graphics processing units (GPUs) that can speed up certain mathematical computations that commonly occur in AI-based software for autonomy. The specific aim of this project is to produce a pub/sub alternative to ROS that facilities real-time safety certification. Key research tasks include resolving fundamental resource-allocation concerns at the OS and middleware levels, producing analysis for validating response-time bounds in real-time pub/sub graphs, producing a reference pub/sub middleware implementation, and experimentally comparing this implementation to ROS. While evolving ROS itself is beyond the scope of this project, this project will expose fundamental tradeoffs of relevance to such an evolution.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.