Computational resource configuration analysis and optimization methods for unmanned system considering intended functionality safety

Abstract

With the rapid expansion of unmanned system capabilities, integrating and sharing computing resources has become essential. In addition to enhancing resource utilization efficiency, this architecture may also introduce conflicts related to resource competition. Therefore, effective resource-sharing configurations are crucial to ensure the Safety of the Intended Functionality (SOTIF). This paper proposes a computing resource configuration analysis and optimization methods for SOTIF. First, four SOTIF requirements are explored using the computing resource-sharing architecture for unmanned systems, encompassing computing time, computing power, energy consumption restrictions, and mutual exclusion and correlation. Secondly, the computing resource configuration model and its SOTIF constraints are formalized based on the graph and set theories. Subsequently, this study divides the design process of computing resource configuration schemes into resource selection and allocation. It introduces a resource selection optimization method based on Forward Checking and a resource allocation optimization method based on NSGA-II. Finally, a typical unmanned driving scenario is considered as an example, and the optimal resource selection and allocation schemes are sequentially determined using the proposed method on the computing platform.

Graphical abstract

Keywords

safety analysis / unmanned system / safety of the intended functionality / computational resource allocation / optimization.

1 Introduction

Automation has rapidly increased across multiple industries worldwide (Guo et al., 2021; Khastgir et al., 2021). Unmanned systems, including aerial and underwater variants (Zhao et al., 2023; Chen et al., 2024), not only enhance performance in various fields but also provide significant economic and environmental benefits. However, with these advancements comes increased complexity, leading to a rise in accidents and safety concerns (Chen et al., 2025; de Koning et al., 2024). Ensuring the safety of the intended functionality (SOTIF) has become crucial as functional inadequacies and performance

limitations of unmanned systems become more apparent. Although the ISO/PAS 21448 standard for “Road Vehicles Safety of the Intended Functionality” was introduced in 2019, it lacks specific technical guidance, underscoring the need for further research (Schnellbach and Griessnig, 2019).

The SOTIF process is a hot topic for unmanned systems which mainly deals with the unreasonable risk due to those hazards caused by performance limitations. Some recent fatalaccidents involving autonomous vehicles have revealed that unmanned systems are highly sensitive to safety hazards due to performance limitations rather than traditional hardware or software faults or errors (Board, 2019; Pimentel, 2019). In these accidents, the performance boundary is exceeded at a certain point, namely the unmanned system is no longer competent for itscurrent job. However, users are often much overconfident in these smart unmanned systems and thus neglect the signs of danger.With the large-scale use of intelligent technology, similar risks are increasingly troubling designers. Therefore, it is vital to answer the question of whether the intended function of an unmanned system could be declared safe, which is exactly the ultimate goal of SOTIF design. More and more researchers are starting to delve into the SOTIF field. Kinalzyk (2021) detailed the differences between SOTIF and traditional functional safety work and proposed an integrated analysis approach. Skoglund et al. (2021) comprehensively analyzed the work process and focusedon three types of problems: SOTIF, functional safety, and information security, and provided a safety work arrangement for the entire development cycle of the system. Chelouati et al. (2023) explored the case of automatic train safety and security and proposed a GSN-based high-level framework. Grabbe et al. (2020) recommended using FRAM for risk assessment in developing highly automated vehicles, aiming to provide system design suggestions and insights for validation work. Overall, this study aims to extend the existing safety work process to cover the research scope of SOTIF. Similar work generally emphasizes the non-fault features of SOTIF-related hazards, which has reference significance for a deeper understanding of the SOTIF mechanism.

In addition, many researchers are currently committed to analyzing the SOTIF of an unmanned system through case testing. For example, Neurohr et al. (2020) proposed 16 factors to consider in scenario-based unmanned driving testing, including scenario generation, requirement generation, testing bias, testing execution, and testing confirmation. Zhou et al. (2022a) proposed a unified scenario description language and evaluation standard, which can support the expansion of test scenarios and improve data utilization efficiency. In analyzing SOTIF based on case testing, most studies use statistical indicators such as accident rates and takeover request frequencies (corresponding to situations where the system’s intended functionality is insufficient) as the basis for the final judgment. Birch et al. (2020) proposed a state machine to structure an argument concerning SOTIF. Cai et al. (2023) predicted the motion behavior of the preceding vehicle based on historical data and improved Markov model. Collin et al. (2020) linked the Rulebooks framework and the SOTIF process. Hu et al. (2022) proposed a novel and implementation-independent SOTIF validation strategy through real-world examples. Jiménez et al. (2023) demonstrated how the integration of the SOTIF process within an existing validation tool suite can be achieved. However, Kalra and Paddock (2016) have proven that at least 100 unmanned systems must be driven continuously for 12.5 years to demonstrate that unmanned systems have the same safety level as existing vehicles. Although many efforts have been made to improve case testingefficiency, the cost of analyzing SOTIF through pure experimental means is prohibitively high. There is a strong demand for considering SOTIF requirements in forward design of the unmanned systems.

Meanwhile, many research scholars have focused on SOTIF and its association with human-machine interactions. For example, Yan et al. (2021) proposed a SOTIF evaluation strategy for safety supervision to support the evaluation of driver errors and lane deviation risks caused by driver errors. Zhang et al. (2021) discussed the effectiveness of system theoretical process analysis and cognitive task analysis methods in addressing SOTIF issues in human factors engineering. Abdulazim et al. (2021) proposed a contextual-based predictive ML model to monitor the intervention between the driver and lane keep assist system. Rau et al. (2019) reviewed the SOTIF process, which described the development of a framework for deriving scenarios. It should be noted that SOTIF issues related to human-machine interaction usually only exist in low-level unmanned systems, which do not apply to high-level unmanned driving (SAE L4 and L5) because the necessary takeover actions by human drivers are no longer required when the unmanned driving function is activated.

SOTIF refers to the state description of whether the unmanned capability meets the actual operating needs under non-fault conditions.Thus, research on operating capabilities in specific operating tasks can also be classified into the scope of consideration for SOTIF. For example, Esterle et al. (2019) used linear logic to judge driving decisions during the operational phase to monitor whether they comply with preset traffic rules.Wang et al. (2022) proposed a robust non-fragile fault-tolerant control strategy as a quantitative risk method for the adaptive cruise control function for ensuring SOTIF. Chu et al. (2023) proposed a method to evaluate SOTIF-oriented perception effectiveness for forward obstacle detection of unmanned systems. Zhang et al. (2019) proposed intended safety systems for intelligent driving, incorporating SOTIF concepts to analyze and evaluate the driving scene and system safety. Luo et al. (2022) proposed a fuzzy reasoningevaluation method based on an analysis of scenarios and elements. Zhou et al. (2022b) investigated the safety of autonomous emergency braking (AEB) perception systems, providing crucial insights for optimizing AEB perception system parameters.

Briefly, the SOTIF concept is a challenging field that is directly related to the type of function being considered in unmanned systems. Although there are many conceptual discussions about SOTIF, there are relatively few forward design methods for specific functions.This paper presents an SOTIF analysis and optimization for unmanned systembased on computational resource allocation, the main contributions of this study are summarized as follows:

1) Computational resource allocation scheme modeling with multidimensional SOTIF constraints based on graph and set theory: This study constructs a comprehensive model for computational resource allocation in unmanned systems using graph and set theory. It considers task relationships, communication requirements, and SOTIF constraints, enabling a systematic analysis to ensure safety.

2) Optimization method for computational resource selection based on Forward Checking: This study introduces an optimization method for computational resource selection using Forward Checking. It boosts efficiency by narrowing the search space and swiftly identifying optimal allocation schemes that meet SOTIF constraints.

3) Optimization method for computational resource allocation based on NSGA-II: This study uses NSGA-II to optimize computational resource allocation, considering various objectives, such as load distribution and communication cost, while meeting SOTIF constraints. The NSGA-II generates Pareto-optimal solutions, enabling efficient resource use and safety.

This study introduces an innovative framework for analyzing and optimizing computational resource allocation in unmanned systems, enhancing both their efficiency and safety. The paper is organized as follows: Section 2 outlines the objectives and problem definition. Section 3 discusses the SOTIF analysis method based on computational power requirements. Section 4 details the comprehensive optimization methods for resource selection considering SOTIF and computational power costs. Section 5 details the comprehensive optimization method for resource allocation considering SOTIF and rational computational power allocation. Section 6 presents a case study, and Section 7 concludes the study with key findings.

2 Object description and problem description

Unmanned systems are intelligent systems that perceive their environment and make driving decisions autonomously. For specific unmanned driving tasks, the resource entities involved can be categorized into four types: sensors, communication units, processors, and actuators, as shown in Fig. 1. During task execution, sensors capture and preprocess environmental data. This data is transmitted through communication units to processors, where specific applications perform further computations. After multiple processing stages, driving commands are sent via communication units to actuators, which adjust the vehicle’s behavior in real-time.

The design process for the computational resource allocation scheme in unmanned systems is illustrated in Fig. 2. It begins with a functional logic model derived from breaking down the driving tasks, which defines the target functions and their interactions. Various applications and messages within this model act as virtual resources deployed on computational platforms, serving as key inputs for the allocation scheme. Additionally, information about available hardware resources is a critical input for this design process. Based on these foundations, the computational resource allocation design can be divided into two key challenges:

1) Hardware Resource Selection Problem: This involves selecting an appropriate combination of hardware entities from the available resource pool to form a computational platform system. This system must support at least one configuration that satisfies SOTIF requirements.

2) Functional Logic Architecture and Computational Platform Mapping Problem: This focuses on balancing multiple design objectives to find the optimal allocation among all configurations that meet SOTIF requirements.

To address these challenges, this study proposes a computational resource allocation method based on graph and set theory. The method leverages functional logic and resource entity models to evaluate resource sharing and constraints related to SOTIF. The optimization process is divided into two stages: resource selection and allocation scheme optimization. Forward Checking and NSGA-II algorithms are employed for optimization. Comprehensive case studies validated the method’s effectiveness, demonstrating significant improvements in resource allocation efficiency.

3 SOTIF analysis based on computational power requirements

This section performs formal modeling for the computational resource allocation scheme and its related SOTIF requirements to support the subsequent analysis and optimization work for SOTIF requirements.

3.1 The functional logic model

After decomposing and integrating into reusable functions, autonomous driving tasks are represented as a series of executable applications. Communication between these applications ensures task progress. As shown in Fig. 3, a typical functional logic model depicts these relationships. In this study, a quintuple ⟨F,M,E,FM,MF⟩ represents the functional logic relationship for autonomous driving tasks, as follows:

(1)\begin{array}{l}F=\left\{F_i|1\le i\le \left|F\right|\right\},\\ M=\left\{M_j|1\le j\le \left|M\right|\right\},\\ E=\left(\begin{array}{ccc}0& \cdots & e_{1,\left|F\right|}\\ ⋮& \ddots & ⋮\\ e_{\left|F\right|,1}& \cdots & 0\end{array}\right),\\ FM=\left(\begin{array}{ccc}{fm}_{1,1}& \cdots & {fm}_{1,\left|M\right|}\\ ⋮& \ddots & ⋮\\ {fm}_{\left|F\right|,1}& \cdots & {fm}_{\left|F\right|,\left|M\right|}\end{array}\right),\\ MF=\left(\begin{array}{ccc}{mf}_{1,1}& \cdots & {mf}_{1,\left|F\right|}\\ ⋮& \ddots & ⋮\\ {mf}_{\left|M\right|,1}& \cdots & {mf}_{\left|M\right|,\left|F\right|}\end{array}\right),\end{array}

where F represents the set of functions F_i to be executed; M represents the set of communications M_j to be transmitted; E is the communication cost matrix between functions, where e_{p,q} denotes the bandwidth required to send a message from function F_p to F_q, with main diagonal elements always 0; FM and MF are communication-sending and receiving matrices, respectively. In FM, {fm}_{p,q}=1 if function F_p sends communication requirement M_q, else {fm}_{p,q}=0; in MF, {mf}_{p,q}=1 if function F_q receives communication requirement M_p, else {mf}_{p,q}=0.

Furthermore, each functionF_ican be decomposed into a series of real-time application requirements, defined as follows:

(2)\begin{array}{c}{F}_i=⟨{RR}_i,{\mathrm{\Gamma }}_i⟩,\\ {\mathrm{\Gamma }}_i=\left\{{\tau }_{i,r}|1\le r\le \left|{\mathrm{\Gamma }}_i\right|\right\},\\ {\tau }_{i,r}=⟨C_{i,r},D_{i,r},T_{i,r}⟩,\end{array}

where {RR}_i represents the memory requirements for executing function F_i; {\mathrm{\Gamma }}_i represents the set of application programs within F_i, assumed to be numbered by priority. Each application program {\tau }_{i,r} is characterized by its worst-case execution time C_{i,r}, deadline D_{i,r}, and arrival period T_{i,r}. The worst-case execution time C_{i,r} depends on the processing resource capability used. Similarly, each communication requirement M_j is decomposed into a series of messages, defined as follows:

(3)\begin{array}{c}{M}_j=\left\{m_{j,s}|1\le s\le \left|M_j\right|\right\},\\ m_{j,s}=⟨{BW}_{m_{j,s}},C_{m_{j,s}},D_{m_{j,s}},T_{m_{j,s}},{Pre}_{m_{j,s}},{Sub}_{m_{j,s}}⟩,\end{array}

where m_{j,s} represents the information within the communication requirement M_j, numbered by priority. Each information m_{j,s} is described by six parameters: communication cost {BW}_{m_{j,s}}, worst-case transmission time C_{m_{j,s}}, transmission deadline D_{m_{j,s}}, message period T_{m_{j,s}}, source application program {Pre}_{m_{j,s}}, and target application program {Sub}_{m_{j,s}}. The worst-case transmission time C_{m_{j,s}} is dependent on the communication resource capability.

3.2 Resource entity model

As shown in Fig. 4, the types of resource entities included in the computing platform system can be divided into processor and communication resources. The resource entity model is represented by a triple ⟨N,Bus,A⟩, whichis defined as follows:

(4)\begin{array}{c}N=\left\{N_i|1\le i\le \left|N\right|\right\},\\ Bus=\left\{{Bus}_j|1\le j\le \left|Bus\right|\right\},\\ A=\left(\begin{array}{ccc}{a}_{1,1}& \cdots & a_{1,\left|Bus\right|}\\ ⋮& \ddots & ⋮\\ a_{\left|N\right|,1}& \cdots & a_{\left|N\right|,\left|Bus\right|}\end{array}\right),\end{array}

where N represents the set of processor resources, and its element N_i is used to refer to the processor entity included in the platform; Bus represents the set of communication resources, and its element {Bus}_j is used to refer to the communication bus included in the platform; A is the connection matrix, and its element a_{p,q} represents the connection relationship between processor N_p and communication bus {Bus}_q. When processor N_p is connected to communication bus {Bus}_q, a_{p,q}=1, indicating that data transmission can take place.

The basic performance of any processing resource node is characterized by the memory constraint {RAM}_i, input/output communication bandwidth constraint {BW}_i, and computing power {Cal}_i. Additionally, for a running processor, its energy consumption per unit time includes both static and dynamic energy components (Collin et al., 2019):

(5)Power={Power}^{\mathrm{i}\mathrm{d}\mathrm{l}\mathrm{e}}+{Power}^{\mathrm{r}\mathrm{u}\mathrm{n}\mathrm{t}\mathrm{i}\mathrm{m}\mathrm{e}},

where thestatic power consumption, denoted as {Power}^{\mathrm{i}\mathrm{d}\mathrm{l}\mathrm{e}}, encompasses power consumed by the clock circuit during processor core execution, multi-threaded dynamic scheduling control, on-chip bus communication, and other overheads provided by the processor manufacturer. Dynamic power consumption, denoted as {Power}^{\mathrm{r}\mathrm{u}\mathrm{n}\mathrm{t}\mathrm{i}\mathrm{m}\mathrm{e}}, primarily arises from computing and storage units, varying with the executed program. To approximate dynamic power consumption, two parameters, P_i^{\mathrm{m}\mathrm{e}\mathrm{m}\mathrm{o}\mathrm{r}\mathrm{y}} for storage space operations and P_i^{\mathrm{c}\mathrm{o}\mathrm{m}\mathrm{p}\mathrm{u}\mathrm{t}\mathrm{e}} for time computing operations, are agreed upon. The calculation method for the dynamic power consumption is as follows:

(6){Power}^{\mathrm{r}\mathrm{u}\mathrm{n}\mathrm{t}\mathrm{i}\mathrm{m}\mathrm{e}}=Memory\cdot P_i^{\mathrm{m}\mathrm{e}\mathrm{m}\mathrm{o}\mathrm{r}\mathrm{y}}+TimeRate\cdot P_i^{\mathrm{c}\mathrm{o}\mathrm{m}\mathrm{p}\mathrm{u}\mathrm{t}\mathrm{e}},

where memory represents the size of memory occupied by the program during execution; TimeRate represents the occupancy rate of the effective time of program execution, determined by the ratio of actual execution time to arrival time interval.

Based on this, any processor resource N_i can be represented by the following six-tuple:

(7)N_i=⟨{RAM}_i,{BW}_i,{Cal}_i,P_i^{\mathrm{i}\mathrm{d}\mathrm{l}\mathrm{e}},P_i^{\mathrm{m}\mathrm{e}\mathrm{m}\mathrm{o}\mathrm{r}\mathrm{y}},P_i^{\mathrm{c}\mathrm{o}\mathrm{m}\mathrm{p}\mathrm{u}\mathrm{t}\mathrm{e}}⟩.

Similarly, communication resources can be characterized using basic performance parameters such as communication bandwidth {BW}_{Bus}, and communication capability {Com}_{Bus}. Unlike processor resources, the energy consumption related to access operations can be ignored when considering communication resource consumption, and instead, static power consumption P_{Bus}^{\mathrm{i}\mathrm{d}\mathrm{l}\mathrm{e}} and power consumption per unit time for transmission operation P_{Bus}^{\mathrm{t}\mathrm{r}\mathrm{a}\mathrm{n}\mathrm{s}\mathrm{m}\mathrm{i}\mathrm{t}} are used to characterize communication resource performance. Therefore, any communication resource {Bus}_j can be represented using the following four-tuple:

(8){Bus}_j=⟨{BW}_{{Bus}_j},{Com}_{{Bus}_j}{,P}_{{Bus}_j}^{\mathrm{i}\mathrm{d}\mathrm{l}\mathrm{e}},P_{{Bus}_j}^{\mathrm{t}\mathrm{r}\mathrm{a}\mathrm{n}\mathrm{s}\mathrm{m}\mathrm{i}\mathrm{t}}⟩.

Considering the computing power of different processor resources directly impacts the estimation of worst-case execution time for application programs. This paper simplifies this consideration by using relative capacity values. A reference processor is chosen in the computing platform system, with its processing capacity set to 1. The processing capacity parameter of other processors is the ratio of their processing capacity to that of the reference processor. Similarly, relative communication capabilities were used to describe the performance of the communication buses in this study.

3.3 Configuration model and SOTIF constraints

Based on the definitions of the functional logical and resource entity models mentioned above, the following two allocation matrices can be used to characterize the mapping relationship between the application program and messages with their corresponding entity resources:

(9)\begin{array}{c}X=\left(\begin{array}{ccc}{x}_{1,1}& \cdots & x_{1,\left|N\right|}\\ ⋮& \ddots & ⋮\\ x_{\left|F\right|,1}& \cdots & x_{\left|F\right|,\left|N\right|}\end{array}\right),\\ Y=\left(\begin{array}{ccc}{y}_{1,1}& \cdots & y_{1,\left|Bus\right|}\\ ⋮& \ddots & ⋮\\ y_{\left|M\right|,1}& \cdots & y_{\left|M\right|,\left|Bus\right|}\end{array}\right),\end{array}

where X represents the function allocation matrixand Y represents the communication allocation matrix, where the corresponding elements satisfy:

(10)\begin{array}{c}\begin{array}{cc}{x}_{i,j}=\{\begin{array}{cc}1& \mathrm{w}\mathrm{h}\mathrm{e}\mathrm{n}{F}_i\mathrm{i}\mathrm{s}\mathrm{d}\mathrm{e}\mathrm{p}\mathrm{l}\mathrm{o}\mathrm{y}\mathrm{e}\mathrm{d}\mathrm{o}\mathrm{n}{N}_j\\ 0& \mathrm{e}\mathrm{l}\mathrm{s}\mathrm{e}\end{array}& \\ \begin{array}{cc}i=1,2,\dots ,\left|F\right|,& j=1,2,\dots ,\left|N\right|,\end{array}\\ y_{p,q}=\{\begin{array}{cc}1& \mathrm{w}\mathrm{h}\mathrm{e}\mathrm{n}{M}_p\mathrm{i}\mathrm{s}\mathrm{t}\mathrm{r}\mathrm{a}\mathrm{n}\mathrm{s}\mathrm{m}\mathrm{i}\mathrm{t}\mathrm{t}\mathrm{e}\mathrm{d}\mathrm{v}\mathrm{i}\mathrm{a}{Bus}_q\\ 0& \mathrm{e}\mathrm{l}\mathrm{s}\mathrm{e}\end{array}\\ \begin{array}{cc}p=1,2,\dots ,\left|M\right|,& q=1,2,\dots ,\left|Bus\right|.\end{array}\end{array}\end{array}

Note that the functionality allocation matrix X, communication allocation matrix Y and the resource connectivity matrix A described in section 3.2 are inherently correlated. Equations (11) and (12) provide the mathematical relationship between the three matrices from the sending and receiving communication perspective, respectively:

(11)\sum _{p=1}^{\left|M\right|}\sum _{i=1}^{\left|F\right|}{x}_{i,s}\cdot {fm}_{i,p}\cdot y_{p,q}\ge 1\Rightarrow a_{s,q}=1,

(12)\sum _{p=1}^{\left|M\right|}\sum _{j=1}^{\left|F\right|}{x}_{j,t}\cdot {mf}_{p,j}\cdot y_{p,q}\ge 1\Rightarrow a_{t,q}=1,

where s,t=1,2,\dots ,\left|N\right|, q=1,2,\dots ,\left|Bus\right|. Combining Eqs. (11)and (12), the following identity can be derived.

(13)A=\mathrm{m}\mathrm{a}\mathrm{x}(\mathrm{m}\mathrm{i}\mathrm{n}(X^T\cdot FM\cdot Y,1),\mathrm{m}\mathrm{i}\mathrm{n}(X^T\cdot {MF}^T\cdot Y,1)),

where \mathrm{m}\mathrm{a}\mathrm{x}(\cdot ) and \mathrm{m}\mathrm{i}\mathrm{n}(\cdot ) representing taking the maximum/minimum value bitwise.

On this basis, this study considers a configuration scheme ⟨X,Y⟩ to be compliant with SOTIF requirements if and only if it satisfies the following conditions simultaneously:

1) Uniqueness requirement for function and communication allocation

All functions F_i are assigned to one and only one corresponding processor resource entity:

(14)\sum _{j=1}^{\left|N\right|}{x}_{i,j}=1i=1,2,\dots ,\left|F\right|.

When the sending and receiving functions are located on different processor resources, the communication requirement M_i is sent and received by one and only one corresponding communication resource. When the sending and receiving functions are located on the same processor resource, the communication requirement M_i can be directly fulfilled by accessing the memory of the processor:

(15)\sum _{q=1}^{\left|Bus\right|}{y}_{p,q}\le 1,p=1,2,\dots ,\left|M\right|,

(16)\sum _{i=1}^{\left|F\right|}\sum _{j=1}^{\left|F\right|}\sum _{s=1}^{\left|N\right|}{fm}_{i,p}\cdot x_{i,s}\cdot {mf}_{p,j}\cdot x_{j,s}=1-\sum _q^{\left|Bus\right|}{y}_{p,q},p=1,2,\dots ,\left|M\right|.

2) The configuration scheme satisfies the real-time constraints of all application executions

In an effective configuration scheme, each application {\tau }_{i,r} needs to complete execution before its corresponding deadline D_{i,r}. Considering the computational characteristics of processor resource N_j when application {\tau }_{i,r} is deployed on processor resource N_j its corresponding equivalent worst-case execution time is C_{i,r}/{Cal}_j. We use the worst-case task response time R_{i,r} to represent the upper limit of the time required to complete application {\tau }_{i,r}. The scheduling mode of programs on processor resources will directly affect their corresponding worst-case task response time. In this article, we consider the most common fixed-priority scheduling mode. Based on this, it can be determined that:

(17)R_{i,r}=\frac{C_{i,r}}{{Cal}_j}+\sum _{{\tau }_k\in hp({\tau }_{i,r})}\lceil \frac{R_{i,r}}{T_{{\tau }_k}}\rceil \cdot \frac{C_{{\tau }_k}}{{Cal}_j},

where \lceil \cdot \rceil denotes rounding up; hp({\tau }_{i,r}) represents the set of applications with higher priorities than {\tau }_{i,r} running on the same processor. Equation (17) reflects the worst-case response time of a task, which consists of the worst-case execution time and the time preempted by higher-priority tasks running on the same processor.

In computing resource sharing, partition scheduling is a widely used mechanism where the rotation period for running partitions on a processing resource module is denoted as RL. The proportion of the total period that an application {\tau }_{i,r} corresponding to functionality F_i occupies in its partition is denoted as {\alpha }_i (referred to as the partition coefficient). Considering the inherent mechanism of mutually exclusive partition scheduling, other partitions can be regarded as a cyclic task with higher priority, having a period of RL and execution time of \left(1-{\alpha }_i\right)RL when computing the worst-case response time R_{i,r} of the application {\tau }_{i,r}. Based on this, Eq. (18) can be reformulated:

(18)R_{i,r}=\frac{C_{i,r}}{{Cal}_j}+\sum _{k=1}^{r-1}\lceil \frac{R_{i,r}}{T_{i,k}}\rceil \cdot \frac{C_{i,k}}{{Cal}_j}+\lceil \frac{R_{i,r}}{RL}\rceil \left(1-{\alpha }_i\right)RL.

It is known that the partition rotation period RL is a predetermined positive actual number. If RL\to 0, it follows that:

(19)\lceil \frac{R_{i,r}}{RL}\rceil =\frac{R_{i,r}}{RL}.

According to Eq. (18):

(20)R_{i,r}=\frac{C_{i,r}}{{Cal}_j}+\sum _{k=1}^{r-1}\lceil \frac{R_{i,r}}{T_{i,k}}\rceil \cdot \frac{C_{i,k}}{{Cal}_j}+\left(1-{\alpha }_i\right)R_{i,r}.

And thus satisfy:

(21)\begin{array}{rl}& {\alpha }_i\le \frac{1}{{Cal}_j}\cdot \left(\frac{C_{i,r}}{R_{i,r}}+\sum _{k=1}^{r-1}\left(\frac{R_{i,r}}{T_{i,k}}+1\right)\frac{C_{i,k}}{R_{i,r}}\right)\\ & =\frac{1}{{Cal}_j}\cdot \left(\sum _{k=1}^r\frac{C_{i,k}}{R_{i,r}}+\sum _{k=1}^{r-1}\frac{C_{i,k}}{T_{i,k}}\right).\end{array}

For application {\tau }_{i,r}, It satisfies the real-time requirement if and only if the response time R_{i,r} is not greater than the deadline D_{i,r} (i.e. R_{i,r}\le D_{i,r}) which is equivalent to Eq. (22):

(22)\frac{1}{{Cal}_j}\cdot \left(\sum _{k=1}^r\frac{C_{i,k}}{D_{i,r}}+\sum _{k=1}^{r-1}\frac{C_{i,k}}{T_{i,k}}\right)\le {\alpha }_i.

Therefore, it can be considered that the real-time requirements of all applications in the partition where function F_i is located can be met as long as they satisfy:

(23)\begin{array}{c}{\displaystyle \frac{1}{{Cal}_j}}\cdot {\alpha }_i^{lb}\le {\alpha }_i,\\ {\alpha }_i^{lb}=\underset{1\le r\le \left|{\mathrm{\Gamma }}_i\right|}{\mathit{m}\mathit{a}\mathit{x}}\left({\displaystyle \sum _{k=1}^r{\displaystyle \frac{C_{i,k}}{D_{i,r}}}+{\displaystyle \sum _{k=1}^{r-1}{\displaystyle \frac{C_{i,k}}{T_{i,k}}}}}\right),\end{array}

where {\alpha }_i^{lb} is defined to constrain the lower bound of the partition coefficient {\alpha }_i, which is only related to the function F_i.

Thus, the real-time requirements related to the application can be expressed in the scheduling scheme as follows: “For any processor resource, there exists a feasible combination of partition coefficients, such that each application within each partition is schedulable and the sum of all partition coefficients does not exceed 1.” In other words, it satisfies:

(24)\sum _{i=1}^{\left|F\right|}\frac{1}{{Cal}_j}\cdot x_{i,j}\cdot {\alpha }_i^{lb}\le 1,j=1,2,\dots ,\left|N\right|.

3) The configuration scheme meets the real-time constraints of all message transmissions

When the communication requirement M_j is assigned to the communication resource {Bus}_q, the worst-case transmission time of message M_j in m_{j,s} on the bus can be represented as follows:

(25)R_{m_{j,s}}=\frac{C_{m_{j,s}}}{{Com}_{{Bus}_q}}+B_{m_{j,s}}+\sum _{m_k\in hp\left(m_{j,s}\right)}\lceil \frac{R_{m_{j,s}}}{T_{m_k}}\rceil \cdot \frac{C_{m_k}}{{Com}_{{Bus}_q}},

where hp(m_{j,s}) represents the set of messages with higher priority than m_{j,s} on the same data bus; since there is actually no direct priority relationship between different communication requirements M_j, whenever considering the communication requirement M_j in this paper, it is assumed conservatively that other communication requirements M_k (k\ne j) have higher priority than M_j; B_{m_{j,s}} represents the maximum blocking time, which is equivalent to the blocking caused by the longest transmission time of the low-priority message:

(26)

Similarly, according to Eq. (25), it can be inferred that:

(27)

After simplification:

(28)

In summary, to strictly ensure that the worst-case transmission time R_{m_{j,s}} is not greater than the deadline D_{m_{j,s}}, a feasible approach is to make sure that:

(29)

For simplicity, concerning any communication requirement M_k(k=1,2,\dots ,\left|M\right|), two related variables are defined in this paper, the values of which are solely dependent on the communication requirement M_k:

(30)\begin{array}{c}{C}_{M_k}={\displaystyle \sum _{1\le l\le \left|M_k\right|}{C}_{m_{k,l}},}\\ {\displaystyle \frac{C_{M_k}}{T_{M_k}}}={\displaystyle \sum _{1\le l\le \left|M_k\right|}{\displaystyle \frac{C_{m_{k,l}}}{T_{m_{k,l}}}}.}\end{array}

Therefore, Eq. (29) is equivalent to:

(31)\frac{1}{{Com}_{{Bus}_q}}\cdot \left({\beta }_{m_{j,s}}+\sum _{k=1}^{\left|M\right|}{y}_{k,q}\cdot \left(\frac{C_{M_k}}{D_{m_{j,s}}}+\frac{C_{M_k}}{T_{M_k}}\right)\right)\le 1,

where {\beta }_{m_{j,s}} is defined by Eq. (32), and its value is only related to the message m_{j,s}.

(32)

It should be noted that although Eq. (31) can provide the most accurate real-time guarantee for transmission delay, it needs to be calculated separately for each message, which poses a huge challenge for practical analysis. To simplify the calculation, the communication requirement M_j, is defined as:

(33)

(34)

On this basis, the requirement that “the scheduling scheme can meet the real-time constraints of all message transmissions” can be expressed as:

(35)\begin{array}{c}{\displaystyle \sum _{q=1}^{\left|Bus\right|}{y}_{j,q}\cdot \frac{1}{{Com}_{{Bus}_q}}\cdot \left({\beta }_j^{ub}+{\displaystyle \sum _{k=1}^{\left|M\right|}{y}_{k,q}\cdot \left({\displaystyle \frac{C_{M_k}}{D_j^{lb}}}+{\displaystyle \frac{C_{M_k}}{T_{M_k}}}\right)}\right)\le 1,}\\ j=1,2,\dots ,\left|M\right|,\end{array}

where Eq. (35) is a sufficient condition for Eq. (31) to hold, i.e., Eq. (35) can provide a stronger feasibility guarantee.

4) The processing capacity requiredunder the maximum processing resources that a processor can provide

For any processor resource module, the application resource requirements deployed on it do not exceed its inherent memory, output bandwidth, and input bandwidth capabilities. It satisfies:

(36)\sum _{i=1}^{\left|F\right|}{x}_{i,j}{RR}_i\le {RAM}_j,j=1,2,\dots ,\left|N\right|,

(37)\sum _{i=1}^{\left|F\right|}{x}_{i,j}\sum _{k=1}^{\left|F\right|}\left(1-x_{i,k}\right)e_{k,i}\le {BW}_i,j=1,2,\dots ,\left|N\right|,

(38)\sum _{i=1}^{\left|F\right|}{x}_{i,j}\sum _{k=1}^{\left|F\right|}\left(1-x_{i,k}\right)e_{i,k}\le {BW}_i,j=1,2,\dots ,\left|N\right|.

5) The communication capacity requiredunder the maximum communication resources that can be provided

For any communication resource module, the sum of the required communication bandwidths corresponding to all messages transmitted through the communication resource by the processors connected does not exceed its inherent communication bandwidth capacity limit. This includes both input bandwidth requirements and output bandwidth requirements, where:

(39)\begin{array}{c}{\displaystyle \sum _{i=1}^{\left|F\right|}{x}_{i,s}{\displaystyle \sum _{p=1}^{\left|M\right|}{mf}_{i,p}\cdot y_{p,q}{\displaystyle \sum _{j=1}^{\left|F\right|}{\displaystyle \sum _{k=1}^{\left|F\right|}{fm}_{j,p}\cdot e_{j,i}\cdot {mf}_{p,i}\le {BW}_{{Bus}_q},}}}}\\ \begin{array}{c}s=1,2,\dots ,\left|N\right|,q=1,2,\dots ,\left|Bus\right|,\end{array}\end{array}

(40)\begin{array}{c}{\displaystyle \sum _{i=1}^{\left|F\right|}{x}_{i,s}{\displaystyle \sum _{p=1}^{\left|M\right|}{fm}_{i,p}\cdot y_{p,q}{\displaystyle \sum _{j=1}^{\left|F\right|}{\displaystyle \sum _{k=1}^{\left|F\right|}{fm}_{j,p}\cdot e_{j,i}\cdot {mf}_{p,i}\le {BW}_{{Bus}_q},}}}}\\ \begin{array}{c}s=1,2,\dots ,\left|N\right|,q=1,2,\dots ,\left|Bus\right|.\end{array}\end{array}

6) All processor resource power consumption under the threshold

High-performance processor resources enhance the performance of unmanned driving tasks but often result in increased energy consumption and heat dissipation. Processor power consumption comprises static and dynamic components, with the dynamic component further divided into computational and storage operations. A reasonable and safe configuration scheme should ensure that the total power consumption of all processor resources remains within a predefined threshold, as follows:

(41)\begin{array}{c}{P}_j^{\mathrm{i}\mathrm{d}\mathrm{l}\mathrm{e}}+{\displaystyle \frac{P_j^{\mathrm{m}\mathrm{e}\mathrm{m}\mathrm{o}\mathrm{r}\mathrm{y}}}{{RAM}_j}}{\displaystyle \sum _{i=1}^{\left|F\right|}{x}_{i,j}{RR}_i+P_j^{\mathrm{c}\mathrm{o}\mathrm{m}\mathrm{p}\mathrm{u}\mathrm{t}\mathrm{e}}{\displaystyle \sum _{i=1}^{\left|F\right|}{x}_{i,j}{\displaystyle \sum _{k=1}^{\left|{\mathrm{\Gamma }}_i\right|}\frac{C_{i,k}}{T_{i,k}}\le P_j^{ub},}}}\\ j=1,2,\dots ,\left|N\right|.\end{array}

7) Power consumption of all communication resources under the thresholds

Similarly, the working power consumption of all communication resources must not exceed a specified threshold. This paper primarily addresses the static power consumption and data transmission power consumption of communication resources, with the following requirements:

(42)P_{{Bus}_q}^{\mathrm{i}\mathrm{d}\mathrm{l}\mathrm{e}}+P_{{Bus}_q}^{\mathrm{t}\mathrm{r}\mathrm{a}\mathrm{n}\mathrm{s}\mathrm{m}\mathrm{i}\mathrm{t}}{\displaystyle \sum _{p=1}^{\left|M\right|}{y}_{p,q}{\displaystyle \sum _{l=1}^{\left|M_i\right|}\frac{C_{m_{p,l}}}{T_{m_{p,l}}}\le P_{{Bus}_q}^{ub},q=1,2,\dots ,\left|Bus\right|.}}

8) Preset feature allocation mutual exclusion requirements

In designing a shared configuration scheme, it is essential to consider preset allocation constraints and correlations between different functions and between functions and processor resources, as required by unmanned driving tasks.

Mutual exclusion in allocation means that “two target functions cannot be deployed on the same processor resource.” This requirement is satisfied by:

(43)\sum _{j=1}^{\left|N\right|}{x}_{i,j}\cdot x_{k,j}=0,

when F_i and F_k are preset as mutually exclusive functions.

Allocated correlation means that “two target functions must be deployed on the same processing resource.” This requirement is satisfied by:

(44)\sum _{j=1}^{\left|N\right|}{x}_{i,j}\cdot x_{k,j}=1,

when F_i and F_k are preset as correlated functions.

In summary, Eqs. (14)–(16), (24), (35)–(44) collectively constitute the constraint criteria for the feasibility of the configuration ⟨X,Y⟩. To facilitate batch operation analysis, this paper introduces auxiliary matrices listed in Table 1, which enable a vectorized representation of each constraint.

On this basis, SOTIF constraints of the configuration scheme can be reorganized into the following matrix expression:

(45)\begin{array}{l}Con01:X\cdot SN=SF,\\ Con02:Y\cdot SBus\le SM,\\ Con03:rdiag\left(MF\cdot X\cdot X^T\cdot FM\right)=1-Y\cdot SBus,\\ Con04:diag\left(SCal\right)\cdot X^T\cdot SAlpha\le SN,\\ Con05:diag\left(SBeta\right)\cdot Y\cdot SCOMB+diag({(SDLb)}^{-1})\\ \cdot Y\cdot diag(SCOMB)\cdot Y^T\cdot SCM+Y\\ \cdot diag\left(SCOMB\right)\cdot Y^T\cdot SCTM\le SM,\\ Con06:X^T\cdot SRR\le SRAM,\\ Con07:rdiag\left(\left(1-X^T\right)\cdot E\cdot X\right)\le SBW,\\ Con08:rdiag\left(\left(1-X^T\right)\cdot E^T\cdot X\right)\le SBW,\\ Con09:X^T\cdot {MF}^T\cdot diag\left(rdiag\left(MF\cdot E^T\cdot FM\right)\right)\cdot \\ Y\le BWNB,\\ Con10:X^T\cdot FM\cdot diag\left(rdiag\left(MF\cdot E^T\cdot FM\right)\right)\cdot \\ Y\le BWNB,\\ Con11:SPI+diag\left(SPM\right)\cdot X^T\cdot SRR+diag\left(SPC\right)\cdot \\ X^T\cdot SCT\le SPUb,\\ Con12:SPIB+diag\left(SPTB\right)\cdot Y^T\cdot SCTM\le SPUbB,\\ Con13:\mathrm{m}\mathrm{a}\mathrm{x}\left(X\cdot X^T,ME\right)=ME,\\ Con14:\mathrm{m}\mathrm{i}\mathrm{n}\left(X\cdot X^T,MC\right)=MC,\end{array}

where diag(\cdot ) denotes the operation of transforming a column vector into a diagonal matrix, while rdiag(\cdot ) denotes the operation of extracting the diagonal elements of a square matrix to form a column vector. Equation (46) provides examples of the operations of these two operators; Constraints Con01, Con02 and Con03 correspond to uniqueness requirements; constraints Con04 and Con05 correspond to temporal requirements; constraints Con06, Con07, Con08, Con09, Con10 correspond to capability requirements; constraints Con11 and Con12 correspond to energy consumption limit requirements; and constraints Con13 and Con14 correspond to mutual exclusion and correlation requirements.

(46)diag\left(\left(\begin{array}{c}1\\ 2\end{array}\right)\right)=\left(\begin{array}{cc}1& 0\\ 0& 2\end{array}\right),rdiag\left(\left(\begin{array}{cc}1& 3\\ 4& 2\end{array}\right)\right)=\left(\begin{array}{c}1\\ 2\end{array}\right).

4 Comprehensive optimization for resource selection considering SOTIF and computational power costs

This section presents a method for optimizing SOTIF and computational power costs for unmanned systems under varying computational power conditions. It introduces Constraint Satisfaction Problems (CSP) and a forward-checking algorithm, illustrating how hardware resource selection can be addressed through CSP construction.

4.1 Constraint satisfaction problems and Forward Checking algorithm

CSP has been applied to many practical problems since Mackworth (1977) first developed it. Classic examples include map coloring, job scheduling, and the n-queens problem. A formally defined CSP consists of a set of variables, each assigned values from a specific domain, and a set of constraints that must be simultaneously satisfied. This can be represented as the following triple:

(47)⟨X,D,C⟩,

where X=\left\{x_1,\dots ,x_n\right\} represents a set of variables; D=\left\{D_1,\dots ,D_n\right\} represents the corresponding domain of variables, and each element D_i (i=1,\dots ,n) reflects all possible values for each variable x_1\in X; C=\left\{c_1,\dots ,c_n\right\} represents a finite set of constraints that limit feasible values for each group of variables.

A feasible solution for a CSP is a set of specific assignments \left\{x_1=a_1,\dots ,x_n=a_n\right\}, from the variable domains, which guarantees that all constraints are not violated. Solving a CSP involves assigning values to variables to find feasible solutions. If at least one solution exists, the CSP is considered satisfiable; otherwise, it is unsatisfiable. There are two main approaches to solving a CSP: backtracking search and constraint propagation. Backtracking systematically explores all possible value combinations, often using depth-first search, to identify feasible solutions. In contrast, constraint propagation narrows the range of valid variable values by enforcing “local compatibility” through continuous reasoning. Haralick and Elliott combined these methods into the Forward Checking algorithm Kondrak and Van Beek (1997), which prunes the search tree early to reduce the number of nodes visited, minimizing the search effort.

Table 2 presents the pseudocode for the main program using Forward Checking. It integrates two heuristic techniques: ‘Select-Unassigned-Variable’ and ‘Order-Domain-Values.’ These heuristics allow for efficient variable and value ordering based on the problem’s requirements, improving search performance. Common heuristic methods include minimum remaining values, minimum degree, and minimum constraint values, among others.

4.2 Computational resource selection optimization method

Figure 5 illustrates the process of optimizing compute resource selection. This involves constructing a CSP in a limited search space and ensuring it meets SOTIF requirements using the forward-checking algorithm. The ‘compute resource selection’ challenge is divided into two stages: ‘processor resource selection’ and ‘communication resource selection’. The goal is to create a cost-effective plan that fulfills all SOTIF requirements.

4.2.1 Processor resource selection

In addressing the “processor resource selection” problem, communication resource constraints are temporarily ignored, assuming sufficient communication resources for message transmission. In Eq. (45), the constraints directly related to processor resources include eight items: Con01, Con04, Con06, Con07, Con08, Con11, Con13, Con14. These are used as criteria to assess the feasibility of processor resource combinations. For all processing resource sets AR=\left\{{AR}_i|1\le i\le \left|AR\right|\right\} in the resource library, a processing resource combination can be defined by the following variables:

(48)NumAR=({numAR}_1{numAR}_2\cdots {numAR}_{\left|AR\right|}),

where {numAR}_i represents the number of resources selected for the ith candidate processing resource type {AR}_i.

This study defines the relationship between the processor resource combination scheme, NumAR, and the processor resource set N=\left\{N_i|1\le i\le \left|N\right|\right\} in the resource entity model, as illustrated in Fig. 6. The elements in both sets satisfy the following criteria:

(49)N_i\leftarrow {AR}_j\mathrm{w}\mathrm{h}\mathrm{e}\mathrm{n}\sum _{k=1}^j{numAR}_k\ge i>\sum _{k=1}^{j-1}{numAR}_k.

Designers can set an acceptable upper limit on the number of processor resources, {numAR}^{ub}, in advance, due to the constraints of onboard space. Additionally, a conservative constraint is that the number of processor resources will not exceed the number of target functions, since the worst-case scenario would involve assigning each task to a different processing resource. Thus, {numAR}^{ub}\le \left|F\right|. Inspired by the memory resource capacity constraint in Eq. (36), it can be determined for the final resource entity scheme ⟨N,Bus,A⟩ that:

(50)Con15:\sum _{j=1}^{\left|N\right|}\sum _{i=1}^{\left|F\right|}{x}_{i,j}{RR}_i=\sum _{i=1}^{\left|F\right|}{RR}_i\le \sum _{j=1}^{\left|N\right|}{RAM}_j.

The constraint Con15 is a necessary condition for constraint Con06, which is independent of the allocation of functions and can support rapid prunin search space pruning. According to Eq. (50), it can be determined that:

(51)\sum _{i=1}^{\left|NumAR\right|}{numAR}_i\ge \frac{\sum _{i=1}^{\left|F\right|}{RR}_i}{\underset{1\le i\le \left|\mathit{N}\mathit{u}\mathit{m}\mathit{A}\mathit{R}\right|}{\mathrm{m}\mathrm{a}\mathrm{x}}{RAM}_{{AN}_i}}={numAR}^{lb}.

Based on this, the “processor resource selection” problem can be formulated as the following optimization problem:

(52)\begin{array}{c}\underset{\mathit{N}\mathit{u}\mathit{m}\mathit{A}\mathit{R}}{\mathrm{m}\mathrm{i}\mathrm{n}}{\displaystyle \sum _{i=1}^{\left|NumAR\right|}{numAR}_i\cdot {costAR}_i,}\\ \begin{array}{c}\begin{array}{cc}\mathrm{s}.\mathrm{t}.& \begin{array}{c}{numAR}^{ub}\ge {\displaystyle \sum _{i=1}^{\left|NumAR\right|}{numAR}_i\ge {numAR}^{lb},}\\ \mathrm{i}\mathrm{s}\mathrm{a}\mathrm{p}\mathrm{o}\mathrm{s}\mathrm{i}\mathrm{t}\mathrm{i}\mathrm{v}\mathrm{e}\mathrm{i}\mathrm{n}\mathrm{t}\mathrm{e}\mathrm{g}\mathrm{e}\mathrm{r}.\end{array}\end{array}\\ \begin{array}{cc}\mathrm{\exists }X,& \begin{array}{c}Con01\wedge Con04\wedge Con06\wedge Con07\wedge Con08\\ \wedge Con11\wedge Con13\wedge Con14,\end{array}\end{array}\end{array}\end{array}

where X represents the mapping relationship between functions and processing resources, defined by Eq. (9).

In fact, due to the constraint that {numAR}^{ub}\ge \sum _{i=1}^{\left|NumAR\right|}{numAR}_i\ge {numAR}^{lb}({numAR}_i is a positive integer), Eq. (52) can be understood as a finite-state search problem. By considering only the feasible domain and constraint Con15, we can easily obtain all potential solutions and calculate the corresponding design costs. We use RegionAR=\left\{{RegionAR}_i|1\le i\le \left|RegionAR\right|\right\} to represent the set of all potential solutions, where the solutions are numbered in ascending order of cost, i.e., Cost\left({RegionAR}_i\right)\le Cost({RegionAR}_j) (when i\le j). After determining RegionAR, Eq. (52) can be solved by sequentially checking whether a feasible allocation scheme X.

The symbol NumAR=({numAR}_1{numAR}_2\cdots {numAR}_{\left|AR\right|}) is used to represent any processor resource combination corresponding to a traversal process. To reduce the search space when judging the feasibility of the function allocation scheme X, this paper defines the following auxiliary column vector for the function allocation scheme by borrowing the requirement of allocation uniqueness:

(53)XZ=\left(\begin{array}{c}{XZ}_1\\ ⋮\\ {XZ}_{\left|F\right|}\end{array}\right),

where {XZ}_i represents the processor resource number on which function F_i is deployed, the element in the allocation scheme X satisfies:

(54)x_{i,j}=\{\begin{array}{cc}1& j={XZ}_i\\ 0& j\ne {XZ}_i\end{array}i=1,2,\dots ,\left|F\right|.

On this basis, the problem of determining whether SOTIF requirements can be satisfied for a given processor resource combination NumAR can be formulated as a CSP problem with the following structure.

(55)\begin{array}{l}\mathrm{v}\mathrm{a}\mathrm{r}\mathrm{i}\mathrm{a}\mathrm{b}\mathrm{l}\mathrm{e}Z\leftarrow XZ\\ \mathrm{d}\mathrm{o}\mathrm{m}\mathrm{a}\mathrm{i}\mathrm{n}D\leftarrow \left\{1,2,\dots ,\left|N\right|\right\}\\ \mathrm{c}\mathrm{o}\mathrm{n}\mathrm{s}\mathrm{t}\mathrm{r}\mathrm{a}\mathrm{i}\mathrm{n}\mathrm{t}C\leftarrow \{Con04,Con06,Con07,Con08,\\ Con11,Con13,Con14\},\end{array}

where \left|N\right|=\sum _{i=1}^{\left|NumAR\right|}{numAR}_i.

This paper introduces two heuristic methods for selecting unassigned variables:

1) Minimum Remaining Values (MRV): This method selects the variable with the fewest remaining values in its domain among the unassigned variables.

2) Maximum Memory Requirement (MMR): This method chooses the variable with the highest memory requirement among the unassigned variables.

Although the auxiliary column vector XZ offers a better representation for reducing the search space, the original matrix X is more practical for checking constraint violations. Therefore, during consistency checks in the Forward Checking algorithm, it is essential to convert between the auxiliary column vector XZ and the original matrix X. The conversion rules refer to Eqs. (53) and (54).

4.2.2 Communication resource selection

For all communication resource sets ABus=\left\{{ABus}_i|1\le i\le \left|ABus\right|\right\} in the resource library, a communication resource combination can be defined using the following variables:

(56)NumABus=({numABus}_1{numABus}_2\cdots {numABus}_{\left|ABus\right|}).

where {numABus}_i represents the number of resources selected for the ith candidate communication resource type {ABus}_i .

The communication resource combination NumABus is defined similarly as in Fig. 6, and its correspondence with the communication resource set Bus=\left\{{Bus}_j|1\le j\le \left|Bus\right|\right\} in the resource entity model satisfies the following condition:

(57){Bus}_i\leftarrow {ABus}_j\mathrm{w}\mathrm{h}\mathrm{e}\mathrm{n}\sum _{k=1}^j{numABus}_k\ge i>\sum _{k=1}^{j-1}{numABus}_k.

Similarly, designers can preset an acceptable upper limit of communication resource quantity {numABus}^{ub}, while the lower limit of communication resource quantity {numABus}^{lb} can be determined according to Eq. (58):

(58){numABus}^{lb}=\{\begin{array}{cc}1& {{\displaystyle \sum }}_{i=1}^{\left|NumAR\right|}{numAR}_i\ge 2\\ 0& {{\displaystyle \sum }}_{i=1}^{\left|NumAR\right|}{numAR}_i=1\end{array}.

Note that when evaluating the communication resource combination NumABus, the satisfiability of the resource connection matrix A must be checked simultaneously. According to Eq. (13), the resource connection matrix A can be directly determined from matrix X and matrix Y. Therefore, it is unnecessary to assign values separately to the resource connection matrix A.

In summary, this paper represents the “communication resource selection” problem as the following optimization problem:

(59)\begin{array}{c}\underset{\mathit{N}\mathit{u}\mathit{m}\mathit{A}\mathit{B}\mathit{u}\mathit{s}}{\mathrm{m}\mathrm{i}\mathrm{n}}{\displaystyle \sum _{i=1}^{\left|NumABus\right|}{numABus}_1\cdot {costABus}_1}\\ \mathrm{s}.\mathrm{t}.{numABus}^{ub}\ge {\displaystyle \sum _{i=1}^{\left|numABus\right|}{numABus}_i\ge {numABus}^{lb}}\\ {numABus}_i\mathrm{i}\mathrm{s}\mathrm{a}\mathrm{p}\mathrm{o}\mathrm{s}\mathrm{i}\mathrm{t}\mathrm{i}\mathrm{v}\mathrm{e}\mathrm{i}\mathrm{n}\mathrm{t}\mathrm{e}\mathrm{g}\mathrm{e}\mathrm{r}.\\ \mathrm{\exists }X,YCon01\sim Con14\end{array}

Similarly, the “communication resource selection” problem is also regarded as a search problem in a finite state space. It is assumed that RegionABus= \left\{{RegionABus}_i|1\le i\le \left|RegionABus\right|\right\} represents the set of all potential solutions for the “communication resource selection” optimization problem, and the solutions are numbered in ascending or concerning Cost\left({RegionABus}_i\right)\le Cost({RegionABus}_j) (i\le j). Therefore, Eq. (59) can be solved by sequentially checking the feasibility of the communication resource combination corresponding to each potential solution {RegionABus}_i concerning the functionality allocation matrix X and the communication allocation matrix Y.

The symbol NumABus=({numABus}_1{numABus}_2\cdots {numABus}_{\left|ABus\right|}) is used to represent the combination of communication resources during any traversal process. Similar to constructing the auxiliary column vector XZ for the functionality allocation matrix X in Eq. (53), this paper defines the auxiliary column vector YZ corresponding to the communication allocation matrix Y as follows:

(60)YZ=\left(\begin{array}{c}{YZ}_1\\ ⋮\\ {YZ}_{\left|M\right|}\end{array}\right),

where {YZ}_i represents the communication resource number connected to the communication requirement M_i. In addition, it is agreed that when the communication demand M_i does not need to be transmitted through any communication resource, its corresponding element {YZ}_i=-1, that is {YZ}_i=-1 when {\sum }_{j=1}^{\left|Bus\right|}{y}_{i,j}=0. Correspondingly, the elements in the communication allocation matrix Y satisfy:

(61)y_{i,j}=\{\begin{array}{cc}1& j={YZ}_i\\ 0& j\ne {YZ}_i\end{array}i=1,2,\dots ,\left|M\right|.

Subsequently, the problem of determining the feasibility of SOTIF requirements for a given communication resource combination scheme NumABus is constructed in the followingCSP form:

(62)\begin{array}{c}\mathrm{v}\mathrm{a}\mathrm{r}\mathrm{i}\mathrm{a}\mathrm{b}\mathrm{l}\mathrm{e}{Z}_1\leftarrow XZ\\ \mathrm{v}\mathrm{a}\mathrm{r}\mathrm{i}\mathrm{a}\mathrm{b}\mathrm{l}\mathrm{e}{Z}_2\leftarrow YZ\\ \mathrm{c}\mathrm{o}\mathrm{r}\mathrm{r}\mathrm{e}\mathrm{s}\mathrm{p}\mathrm{o}\mathrm{n}\mathrm{d}\mathrm{i}\mathrm{n}\mathrm{g}\mathrm{d}\mathrm{o}\mathrm{m}\mathrm{a}\mathrm{i}\mathrm{n}{D}_1\leftarrow \left\{1,2,\dots ,\left|N\right|\right\}\\ \mathrm{c}\mathrm{o}\mathrm{r}\mathrm{r}\mathrm{e}\mathrm{s}\mathrm{p}\mathrm{o}\mathrm{n}\mathrm{d}\mathrm{i}\mathrm{n}\mathrm{g}\mathrm{d}\mathrm{o}\mathrm{m}\mathrm{a}\mathrm{i}\mathrm{n}{D}_2\leftarrow \left\{-1,1,2,\dots ,\left|Bus\right|\right\}\\ \mathrm{c}\mathrm{o}\mathrm{n}\mathrm{s}\mathrm{t}\mathrm{r}\mathrm{a}\mathrm{i}\mathrm{n}\mathrm{t}C\leftarrow Con01\sim Con14\end{array},

where \left|N\right|=\sum _{i=1}^{\left|NumAR\right|}{numAR}_i, \left|Bus\right|=\sum _{i=1}^{\left|NumABus\right|}{numABus}_i.

When a feasible solution is found for the CSP in Eq. (62), the current communication resource combination scheme is optimal and meets all requirements. If no feasible solution exists, the scheme must be revised, and the next option in the set RegionABus should be evaluated. The final optimal computing resource combination scheme, denoted as ⟨NumAR,NumABus⟩, is determined by combining the best solutions from both the “processor resource selection” and “communication resource selection” problems. To maintain consistency with the symbols used in Section 3.2, we define N\leftarrow NumAR and Bus\leftarrow NumABus. Therefore, the optimal computing resource combination scheme is represented as ⟨N,Bus⟩.

5 Comprehensive optimization for resource allocation considering SOTIF and rational computational power allocation

This subsection discusses trade-offs among design objectives and optimal solution selection in computational resource allocation schemes for functional safety. It introduces constrained optimization problems and NSGA-II, detailing optimization based on safety constraints.

5.1 Constraint optimization problems and the NSGA-II algorithm

In this study, the Non-Dominated Sorting Genetic Algorithm (NSGA-II) (Deb et al. 2002) is used to design the computing resource allocation scheme. Table 3 provides the pseudocode for NSGA-II. This algorithm enhances traditional genetic algorithms by integrating Pareto sorting to obtain Pareto-optimal solutions for multiple objectives. NSGA-II generally comprises the following six steps: 1) population initialization; 2) non-dominated sorting; 3) crowding distance assignment; 4) optimization selection; 5) genetic population generation (crossover and mutation); 6) population recombination and generation.

5.2 Optimization methods for computing resource allocation schemes

For a given combination of computing resources ⟨N,Bus⟩, there may be multiple feasible allocation schemes for computing resources, with differences in load distribution and communication costs. According to Eq. (13), the resource connection matrix A can be derived from the functional allocation matrix X and the communication allocation matrix Y. Therefore, the independent variables that need to be determined in the process of designing the computing resource allocation scheme include the functional allocation matrix X and the communication allocation matrix Y We represent the computing resource allocation scheme as ⟨X,Y⟩ (or ⟨X,Y,A⟩), and consider the following three optimization objectives in this paper:

1) Achieving as uniform a load distribution as possible, balancing the task utilization of processor resources in the system

Task utilization is a key metric for evaluating processor resource performance. It represents the proportion of time that processor resources are actively executing tasks during system operation. The utilization of processor resources depends on the functions assigned and running on them. For a function F_i, its task utilization is defined as follows:

(63)U\left(F_i\right)=\sum _{r=1}^{\left|F_i\right|}U\left({\tau }_{i,r}\right)=\sum _{r=1}^{\left|F_i\right|}\frac{C_{i,r}}{T_{i,r}}.

Therefore, for a given configuration scheme ⟨X,Y⟩, considering the task utilization factor, this article uses the second-order central moment to represent the optimization objective as follows:

(64)\begin{array}{c}U\left(X,Y\right)=X^T\cdot U\left(F\right)\\ \mathrm{m}\mathrm{i}\mathrm{n}UXY={\displaystyle \frac{{\left(U\left(X,Y\right)-\overline{U\left(X,Y\right)}\right)}^T\cdot \left(U\left(X,Y\right)-\overline{U\left(X,Y\right)}\right)}{\left|N\right|}}\end{array}

where U\left(F\right) represents a \left|F\right|\times 1 column vector composed of U\left(F_i\right); U\left(X,Y\right) represents a \left|N\right|\times 1 column vector composed of the task utilization factor of each processor resource under the configuration scheme ⟨X,Y⟩; and \overline{U\left(X,Y\right)} represents the average task utilization factor of each processor resource.

2) Allocate the load as evenly as possible and balance the memory utilization of processor resources in the system

Similarly, considering the memory utilization of processor resources, this paper uses the second-order central moment to represent the optimization objective as follows:

(65)\begin{array}{c}R\left(X,Y\right)={\left(diag\left(SRAM\right)\right)}^{-1}\cdot X^{\mathrm{T}}\cdot SRR\\ \mathrm{m}\mathrm{i}\mathrm{n}RXY={\displaystyle \frac{{\left(R\left(X,Y\right)-\overline{R(X,Y)}\right)}^{\mathrm{T}}\cdot \left(R\left(X,Y\right)-\overline{R\left(X,Y\right)}\right)}{\left|N\right|}}\end{array},

where R\left(X,Y\right) represents an \left|N\right|\times 1 column vector composed of the memory utilization of each processor resource under the configuration ⟨X,Y⟩, and \overline{U\left(X,Y\right)} represents the average memory utilization of each processor resource.

3) Minimize the communication cost required by the system as much as possible

Considering the total communication cost required by the system, this paper represents the optimization objective using the first-order moment as follows:

(66)\mathrm{m}\mathrm{i}\mathrm{n}TXY={SN}^{\mathrm{T}}\cdot rdiag\left(\left(1-X^{\mathrm{T}}\right)\cdot E\cdot X\right).

Considering the three factors mentioned above, the optimization problem for allocating computing resources ⟨X,Y⟩ can be defined as the following multi-objective constrained optimization problem:

(67)\begin{array}{c}\underset{⟨X,Y⟩}{\mathrm{m}\mathrm{i}\mathrm{n}}\left[UXY,RXY,TXY\right]\\ \begin{array}{cc}\mathrm{s}.\mathrm{t}.& Con01\sim Con14.\end{array}\end{array}

This paper uses NSGA-II to solve the multi-objective constrained optimization problem described in Eq. (67). When using NSGA-II, a chromosome encoding format, as shown in Fig. 7 is adopted. The chromosome consists of a total of \left|F\right|+\left|M\right| bits, where the first \left|F\right| bits correspond to the allocation of one objective function each, and the last \left|M\right| bits correspond to a specific connection of processor resources. It is easy to convert the chromosome encoding into a computing resource allocation scheme ⟨X,Y⟩ using Eqs. (53) and (60).

Considering the nonlinear nature of SOTIF constraints, this paper uses the penalty function method to transform the multi-objective optimization problem into an unconstrained optimization problem. The encoding method illustrated in Fig. 1 automatically satisfies the constraints Con01 and Con02 for the resource allocation scheme ⟨X,Y⟩. Therefore, penalties are designed for constraints Con03\sim Con14, as follows:

(68)\begin{array}{rl}{PE}_1=& \mathrm{m}\mathrm{a}\mathrm{x}(\Vert rdiag(MF\cdot X\cdot X^{\mathrm{T}}\cdot FM)\\ & -(1-Y)\cdot SBus{\Vert }_1,0)\\ {PE}_2=& {SN}^{\mathrm{T}}\cdot \mathrm{m}\mathrm{a}\mathrm{x}(diag(SCal)\cdot X^{\mathrm{T}}\cdot SAlpha-SN,0)\\ {PE}_3=& {SM}^{\mathrm{T}}\cdot \mathrm{m}\mathrm{a}\mathrm{x}(diag(SBeta)\cdot Y\cdot SCOMB\\ & +{(diag(SDLb))}^{-1}\cdot Y\cdot diag(SCOMB)\\ & \cdot Y^{\mathrm{T}}\cdot SCM+Y\cdot diag(SCOMB)\cdot Y^{\mathrm{T}}\\ & \cdot SCTM-SM,0)\\ {PE}_4=& {SN}^{\mathrm{T}}\cdot \mathrm{m}\mathrm{a}\mathrm{x}(X^{\mathrm{T}}\cdot SRR-SRAM,0)\\ {PE}_5=& {SN}^{\mathrm{T}}\cdot \mathrm{m}\mathrm{a}\mathrm{x}(rdiag((1-X^{\mathrm{T}})\cdot E\cdot X)-SBW,0)\\ {PE}_6=& {SN}^{\mathrm{T}}\cdot \mathrm{m}\mathrm{a}\mathrm{x}(rdiag((1-X^{\mathrm{T}})\cdot E^{\mathrm{T}}\cdot X)-SBW,0)\\ {PE}_7=& {SN}^{\mathrm{T}}\cdot \mathrm{m}\mathrm{a}\mathrm{x}(X^{\mathrm{T}}\cdot {MF}^{\mathrm{T}}\cdot diag(rdiag(MF\cdot E^{\mathrm{T}}\cdot FM))\\ & \cdot Y-BWNB,0)\cdot SBus\\ {PE}_8=& {SN}^{\mathrm{T}}\cdot \mathrm{m}\mathrm{a}\mathrm{x}(X^{\mathrm{T}}\cdot FM\cdot diag(rdiag(MF\cdot E^{\mathrm{T}}\cdot FM))\\ & \cdot Y-BWNB,0)\cdot SBus\\ {PE}_9=& {SN}^{\mathrm{T}}\cdot \mathrm{m}\mathrm{a}\mathrm{x}(SPI+diag(SPM)\cdot X^{\mathrm{T}}\cdot SRR\\ & +diag(SPC)\cdot X^{\mathrm{T}}\cdot SCT-SPUb,0)\\ {PE}_{10}=& {SBus}^{\mathrm{T}}\cdot \mathrm{m}\mathrm{a}\mathrm{x}(SPIB+diag(SPTB)\cdot Y^{\mathrm{T}}\\ & \cdot SCTM-SPUbB,0)\\ {PE}_{11}=& \mathrm{m}\mathrm{a}\mathrm{x}({\Vert \mathrm{m}\mathrm{a}\mathrm{x}(X\cdot X^{\mathrm{T}},ME)-ME\Vert }_1,0)\\ {PE}_{12}=& \mathrm{m}\mathrm{a}\mathrm{x}({\Vert \mathrm{m}\mathrm{i}\mathrm{n}(X\cdot X^{\mathrm{T}},MC)-MC\Vert }_1,0),\end{array}

where {\Vert \cdot \Vert }_1 represents the column sum norm of a matrix, which is the maximum value of the absolute sum of all column vectors of the matrix; \mathrm{m}\mathrm{a}\mathrm{x}(\cdot ) represents the maximum value taken element-wise. In this article, we further integrate all penalty functions and express them in the form of Eq. (69):

(69)PEXY=\sum _{i=1}^{12}{\theta }_i\cdot {PE}_i={\mathrm{\Theta }}^{\mathrm{T}}\cdot PE,

where {\theta }_i represents the weight value of each normalized penalty function indicator; \mathrm{\Theta } and PE represent the weight values and row vector composed of each penalty function indicator, respectively.

By combining the objective function and penalty function, the fitness function used in NSGA-II for problem-solving can be expressed as:

(70)\begin{array}{c}{Fitness}_1={\omega }_1\cdot UXY+PEXY,\\ {Fitness}_2={\omega }_2\cdot RXY+PEXY,\\ {Fitness}_3={\omega }_3\cdot TXY+PEXY,\end{array}

where {\omega }_i is also a weight value used for normalization.

At this point, based on the chromosome encoding defined in Fig. 7. and the fitness function defined in Eq. (70), the NSGA-II algorithm provided in Table 3 can be smoothly executed.In practice, the following tricks are recommended in order to obtain the optimal computed resource allocation ⟨X,Y⟩:

1) All the weight values should be trailed before the NSGA-II algorithm is executed.On the one hand, throughestimating the magnitudes of UXY, RXY and TXY, we canpreset the value of {\omega }_i to ensure that {\omega }_1\cdot UXY, {\omega }_2\cdot RXY, and {\omega }_3\cdot TXY are of the same magnitude. On the other hand, because lower fitness values indicate better solutions, it is believedthat an unsatisfiedscheme ⟨X,Y⟩ will reach a rather high fitness value by setting the condition {\theta }_i\gg {\omega }_i. Therefore, throughestimating the magnitudes of thepenalty functions, we can preset the value of \mathrm{\Theta } to ensure the PEXY will be significantly higher than {\omega }_1\cdot UXY, {\omega }_2\cdot RXY, and {\omega }_3\cdot TXY.

2) The control parameters of the NSGA-II should be scientifically designed.Control parameters, such as population size {Num}_{pop}, crossover rate p_c and mutation rate p_m, have a direct impact on the performance and stability of the algorithm. According to practical experience,the preferredranges of initialvalues for {Num}_{pop}, p_c and p_m are [20, 200], [0.6, 1], and [0.01, 0.1], respectively. There are several options to better determine these control parameters. For example, we can carry out the control parameter tuning experiments and observe the specific impact on the performance of the algorithm.Besides, adaptive probabilities of crossover and mutation have also been a favored choice (Srinivas and Patnaik, 1994).

3) The correctness of the final solutions should be verified after the optimal process. Because ofdefining the penalty functions, it is impossible to completely rule out the possibility that the final solution does not satisfy the SOTIF constraints. Therefore, it is necessary to verify the correctness of the Pareto optimal solution through automated solution tools. In practice, the feasibility verification code of the solution is similar to the penalty function code, and thus partial code can be reused.

Finally, by combining the computed resource combination ⟨N,Bus⟩ obtained in Section 3 and the computed resource allocation ⟨X,Y⟩, determined in this section, a computed resource configuration scheme that satisfies all SOTIF requirements is generated.

6 Case study

In this section, we analyze and optimize computing resource allocation schemes for unmanned driving functions in relation to SOTIF requirements. Tables 4 and 5 provide detailed parameters for the expected functions/applications and communication/messages. Based on Table 5, the communication cost matrix E, communication sending matrix FM and communication receiving matrix MF defined in Eq. (71) can be determined as follows:

(71)E=\left(\begin{array}{cccccccccc}0& 0& 21& 0& 10& 0& 5& 12& 5& 12\\ 12& 0& 0& 11& 0& 34& 0& 0& 0& 0\\ 0& 0& 0& 24& 0& 0& 0& 0& 0& 0\\ 0& 0& 0& 0& 0& 0& 0& 0& 0& 0\\ 15& 0& 0& 0& 0& 17& 22& 0& 22& 0\\ 0& 0& 0& 0& 21& 0& 0& 22& 0& 22\\ 0& 0& 0& 16& 0& 0& 0& 15& 0& 0\\ 0& 0& 12& 0& 16& 0& 30& 0& 0& 0\\ 0& 0& 0& 16& 0& 0& 0& 0& 0& 15\\ 0& 0& 12& 0& 16& 0& 0& 0& 30& 0\end{array}\right),

(72)FM=\left(\begin{array}{ccccccccccccccccccccccccccc}1& 1& 1& 1& 1& 1& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0\\ 0& 0& 0& 0& 0& 0& 1& 1& 1& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0\\ 0& 0& 0& 0& 0& 0& 0& 0& 0& 1& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0\\ 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0\\ 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 1& 1& 1& 1& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0\\ 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 1& 1& 1& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0\\ 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 1& 1& 0& 0& 0& 0& 0& 0& 0& 0\\ 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 1& 1& 1& 0& 0& 0& 0& 0\\ 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 1& 1& 0& 0& 0\\ 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 1& 1& 1\end{array}\right),

(73)MF={\left(\begin{array}{ccccccccccccccccccccccccccc}0& 0& 0& 0& 0& 0& 1& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0\\ 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0\\ 1& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 1& 0& 0& 0& 0& 1& 0& 0\\ 0& 0& 0& 0& 0& 0& 0& 1& 0& 1& 0& 0& 0& 0& 0& 0& 0& 1& 0& 0& 0& 0& 1& 0& 0& 0& 0\\ 0& 1& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 1& 0& 0& 0& 0& 0& 1& 0& 0& 0& 0& 1& 0\\ 0& 0& 0& 0& 0& 0& 0& 0& 1& 0& 0& 1& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0\\ 0& 0& 1& 0& 0& 0& 0& 0& 0& 0& 0& 0& 1& 0& 0& 0& 0& 0& 0& 0& 0& 1& 0& 0& 0& 0& 0\\ 0& 0& 0& 1& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 1& 0& 0& 1& 0& 0& 0& 0& 0& 0& 0& 0\\ 0& 0& 0& 0& 1& 0& 0& 0& 0& 0& 0& 0& 0& 1& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 1\\ 0& 0& 0& 0& 0& 1& 0& 0& 0& 0& 0& 0& 0& 0& 0& 0& 1& 0& 0& 0& 0& 0& 0& 1& 0& 0& 0\end{array}\right)}^{\mathrm{T}}.

6.1 Computing resource selection

The selection and optimization of computing resources according to SOTIF requirements is divided into two phases: “Processor resource selection” and “Communication resource selection.” In general terms, the power consumption threshold is set to 150 W for processor resources and 70 W for communication resources.

By analyzing the Processor Resource Selection problem, the lower and upper limits for the number of processor resources selected in the repository AR shown in Table 6 are first defined as follows:

(74){numAR}^{lb}=\frac{730}{512}=1.43{numAR}^{ub}=4.

Furthermore, a total of 2793(7^2+7^3+7^4) potential solution sets were constructed, and a preliminary screening was performed based on constraint Con15 defined in Eq. (50), resulting in the set RegionAR, composed of 2587 potential solutions, sorted in ascending order of cost. Based on the Forward Checking algorithm, the corresponding constraint satisfaction problem was solved, and the 431st processor resource combination NumAR=(0011200) was ultimately determined as the optimal solution that satisfies SOTIF constraints (Con01, Con04, Con06Con08, Con11, Con13, Con14) which selects one {AR}_3, one {AR}_4, and two {AR}_2. For this processor resource solution, the assignment order and feasible solutions obtained using the “least remaining value” and “maximum memory requirement” heuristics with the Forward Checking algorithm are as follows:

(75)\begin{array}{c}F4:1F5:2F6:2F1:1F2:2F7:3\\ F9:4F8:3F10:4F3:1,\end{array}

(76)XZ=(1211223344{)}^{\mathrm{T}}.

This paper compares the actual number of assignment operations with the expected upper limit of operations when applying the Forward Checking algorithm to solve the CSP for each candidate solution {RegionAR}_i, as shown in Fig. 8. The results indicate a significant reduction in the number of assignment operations due to the use of the “minimum remaining value” and “maximum memory requirement” heuristics, which effectively minimize unnecessary operations.For example, for {RegionAR}_{200}=(0020020), the total number of hardware resources used is 4. If a full search traversal is performed, the overall expected upper limit of assignment operations is 4^7=16384, However, after only 40 assignment operations using the Forward Checking algorithm, it is determined that the current processor resource combination cannot satisfy all SOTIF requirements.

On the basis of the optimal processor resource combination NumAR=(0011200) obtained in this paper, further optimization design is carried out for the communication resource selection problem. Similarly, the lower and upper limits of the number of communication resources selected in the resource library ABus described in Table 7 are defined as:

(77){numABus}^{lb}=1{numABus}^{ub}=4.

Furthermore, a set of 120(·) potential solutionsare constructed in RegionABus, where the solution numbers are arranged in ascending order of cost. Based on the Forward Checking algorithm, the corresponding constraint satisfaction problem is solved, and the 9th communication resource combination solution NumABus=(020) is determined as the optimal solution that can satisfy SOTIF constraints (Con01-Con14), i.e., two {ABus}_2. are selected. The assignment sequence and feasible solutions for this communication resource solution are shown below:

(78)\begin{array}{c}F4:1F5:2F6:2M12:-1M15:-1F7:3\\ M13:1M18:2F9:4M14:1M23:1F2:1\\ F1:2F8:3F10:4F3:1M1:1M2:-1\\ M3:1M4:2M5:1M6:2M7:1M8:-1\\ M9:1M10:-1M11:-1M16:2M17:2\\ M19:-1M20:1M21:1M22:-1M24:-1\\ M25:1M26:1M27:-1\end{array}

(79)\begin{array}{c}XZ=(2111223344{)}^{\mathrm{T}}\\ YZ=(1-112121-11-1-1-11\\ 1-1222-111-11-111-1{)}^{\mathrm{T}}.\end{array}

In summary, the optimal result for the selection of computing resources that meets SOTIF requirements is:

(80)NumAR=(0011200)NumABus=(020).

6.2 Computingresource allocation

Based on the optimal compute resource selection scheme determined by Eq. (80), this section will further use the NSGA-II algorithm to determine the optimal compute resource allocation scheme that satisfies SOTIF requirements. To set the penalty coefficient more reasonably, this paper first makes a preliminary estimate of the order of magnitude of the objective functions defined in Eqs. (64)–(66) and the penalty function defined in Eq. (69), where the magnitudes of UXY, RXY and TXY are approximately 0.01, 0.01, and 100, respectively, while the penalty function is generally not less than 10. Therefore, based on experience, the weighting coefficients related to the objective functions in Eqs. (69) and (70) are specified as follows:

(81){\omega }_1=100{\omega }_2=100{\omega }_3=0.001{\theta }_i=1000(i=1,2,\dots ,12).

In this case, in order to ensure the search strength for the solution space,the population size and the maximum genetic generation are set as 200 and 500, respectively. Meanwhile, the adaptive crossover rate p_c and mutation rate p_m is used to enhancethe performance and stability of the algorithm. Drawing on Srinivas’ widely recognized research (Srinivas and Patnaik, 1994), detailed definitions of crossover rate p_c and mutation rate p_m for each generation are specified as follows:

(82)\begin{array}{c}{p}_c=\{\begin{array}{cc}{\displaystyle \prod _{i=1}^3\mathrm{m}\mathrm{i}\mathrm{n}\left({\displaystyle \frac{{Fitness}_i^{\prime }-{Fitness}_{min}}{\overline{{Fitness}_i}-{Fitness}_{min}}},1\right)}& \mathrm{\exists }{Fitness}_i^{\prime }\le \overline{{Fitness}_i}\\ 1& {\mathrm{\forall }Fitness}_i^{\prime }>\overline{{Fitness}_i}\end{array}\end{array},

(83)\begin{array}{c}{p}_m=\{\begin{array}{cc}0.5\cdot {\displaystyle \prod _{i=1}^3\mathrm{m}\mathrm{i}\mathrm{n}\left(\frac{{Fitness}_i-{Fitness}_{min}}{\overline{{Fitness}_i}-{Fitness}_{min}},1\right)}& \mathrm{\exists }{Fitness}_i\le \overline{{Fitness}_i}\\ 0.5& {Fitness}_i>\overline{{Fitness}_i}\end{array}\end{array},

where {Fitness}_i^{\prime } is the larger of thefitness values {Fitness}_i of the solutions to be crossed in each generation; {Fitness}_{min} is the minimum of fitness values {Fitness}_i; \overline{{Fitness}_i} is the average of fitness values {Fitness}_i. Both Eqs. (82) and (83) reflect that the closerto the {Fitness}_{min}, the smaller rate should be set.

Figure 9 illustrates the NSGA-II optimization process. Figure 9(a) Shows the average fitness values of 200 individuals over generations, with initial sharp drops indicating elimination of infeasible solutions. As shown in Fig. 9(b), after about 8 generations, the curve of the Pareto optimal total number of individuals has remained at 200. However, the curve for the Pareto optimal total types of individual types only began to converge after about 139 generations, and finally stabilized at 10. This convergence indicates solution stability despite maintaining solution diversity.

For the Pareto optimal solution generated after 500 iterations, 70 duplicate individuals were further removed in the last generation. And the remaining 10 different solutions are presented in Table 8. Obviously, the fitness values of all Pareto optimal solutions will already have their corresponding penalty functions at 0 after 500 iterations. Therefore, the original objective functions UXY, RXY and TXY can be directly obtained based on the fitness values, as shown in Fig. 10. Since these resource allocation schemes are Pareto optimal and thus often require further analysis in practical engineering applications. In this case, there is a cluster of points near the origin of the UXY–RXY view, there is a cluster of points near the origin. Solutions within this cluster are recommended if the focus is on average resource usage, with total communication cost as a secondary consideration. Consequently, the 3 rdsolution is identified as the most suitable allocation scheme in this case.

Based on the analysis in Sections 6.1 and 6.2 the optimal computing resource allocation scheme can be determined as follows:

(84)\begin{array}{c}NumAR=(0011200),NumABus=(020)\\ XZ=(4343212211{)}^{\mathrm{T}},\\ YZ=(-1211211-11211-1\\ 221-12-1-12-111-1{)}^{\mathrm{T}},\\ A=\left(\begin{array}{c}11\\ 11\\ 11\\ 11\end{array}\right),\end{array}

where the resource connection matrix A is determined according to Eq. (13).

7 Conclusions

This paper proposes an innovative computational resource allocation method for unmanned systems considering SOTIF, aiming at enhancing system performance and safety. First, a comprehensive computational resource allocation model is established by considering multidimensional SOTIF constraints, which can ensure SOTIF across various driving scenarios. Secondly, a forward-checking-based optimization method is proposed for computational resource selection, which can reduce search space and improve efficiency. This method can rapidly identify and exclude infeasible resource combinations, and expedite the discovery of optimal allocation schemes meeting all SOTIF constraints. Furthermore, NSGA-II is employed for multi-objective optimization of computational resource allocation schemes by considering SOTIF constraints and balancing various design objectives, such as task load distribution, memory utilization, and communication cost. NSGA-II can effectively deal with multi-objective optimization problems under complex constraints, offering an efficient and practical optimization strategy for computational resource allocation in unmanned systems. Based on the analytical optimization methods proposed in this paper, the optimal result of computing resource selection and the optimal allocation scheme is supplied, which can give some reference for unmanned system SOTIF design.

Compared with the state-of-the-art techniques associated with the SOTIF issues of unmanned systems, this paper proposes a computational resource allocation scheme modeling with multidimensional SOTIF constraints based on graph and set theory as well as a two-step optimization method for computational resource selection and computational resource allocation. Not only is it an important effort to guide the design of computational resource of unmanned system, but also it is asignificant attempt to combine SOTIF analysis with product forward design. Besides, it is noted that our work also has some disadvantages. This paper sets two general search heuristics, namely minimum residual value and maximum memory requirement, for optimizing SOTIF computing resource selection based on forward checking. Future heuristics can supplement these to enhance the optimization efficiency further.

References

[1] AbdulazimAElbahaeyMMohamedA (2021). Putting safety of intended functionality SOTIF into practice. SAE Technical Paper, 2021-01-0196

[2] Birch J, Blackburn D, Botham J, Habli I, Higham D, Monkhouse H, Price G, Ratiu N, Rivett R, (2020). A structured argument for assuring Safety of the Intended Functionality (SOTIF). In: Computer Safety, Reliability, and Security. SAFECOMP 2020 Workshops. Lecture Notes in Computer Science, 12235: 408–414

[3] BoardT (2019). Highway accident report: Collision between vehicle controlled by developmental automated driving system and pedestrian. Available at trb.org/view/1751168

[4] Cai B, Zhao L, Wang Q, Yan M, Fang T, (2023). A strategy of vehicle following on slope road at night considering the safety of the intended functionality. Physica A, 624: 128951

[5] Chelouati M, Boussif A, Beugin J, El Koursi E M, (2023). Graphical safety assurance case using Goal Structuring Notation (GSN) — challenges, opportunities and a framework for autonomous trains. Reliability Engineering & System Safety, 230: 108933

[6] ChenZ WYinS YLiL FCuiW WHongD P (2024). Resilience metric and dynamic assessment of unmanned system-of-systems considering cooperative reconfiguration strategies. IEEE Transactions on Reliability, early access: 1–13

[7] ChenWZRZhangYSDuiH (2025. Importance-based risk evaluation methodology in transportation cyber-physical systems. Frontiers of Engineering Management,early access: 1–14

[8] Chu J Y, Zhao T D, Jiao J, Yuan Y, Jing Y F, (2023). SOTIF-oriented perception evaluation method for forward obstacle detection of autonomous vehicles. IEEE Systems Journal, 17( 2): 2319–2330

[9] Collin A, Bilka A, Pendleton S, Tebbens R D, (2020). Safety of the intended driving behavior using rulebooks. In: IEEE Intelligent Vehicles Symposium (IV). IEEE, 2020: 136–143

[10] CollinA A C (2019). A systems architecture framework towards hardware selection for autonomous navigation. Dissertation for the Doctoral Degree. Massachusetts Institute of Technology

[11] de Koning M, Machado T, Ahonen A, Strokina N, Dianatfar M, De Rosa F, Minav T, Ghabcheloo R, (2024). A comprehensive approach to safety for highly automated off-road machinery under Regulation 2023/1230. Safety Science, 175: 106517

[12] Deb K, Pratap A, Agarwal S, Meyarivan T, (2002). A fast and elitist multiobjective genetic algorithm: NSGA-II. IEEE Transactions on Evolutionary Computation, 6( 2): 182–197

[13] Esterle K, Aravantinos V, Knoll A, (2019). From specifications to behavior: maneuver verification in a semantic state space. In: IEEE Intelligent Vehicles Symposium (IV). 2140–2147

[14] Grabbe N, Kellnberger A, Aydin B, Bengler K, (2020). Safety of automated driving: The need for a systems approach and application of the Functional Resonance Analysis Method. Safety Science, 126: 104665

[15] Guo K, Ye Z S, Liu D T, Peng X Y, (2021). UAV flight control sensing enhancement with a data-driven adaptive fusion model. Reliability Engineering & System Safety, 213: 107654

[16] Hu J, Xu T, Yan X R, Zhang R C, (2022). Validation on Safety of the Intended Functionality of automated vehicles: concept development. SAE International Journal of Connected and Automated Vehicles, 6( 12-06-01-0006): 83–97

[17] Expósito Jiménez V J, Winkler B, Castella Triginer J M, Scharke H, Schneider H, Brenner E, Macher G, (2024). Safety of the Intended Functionality concept integration into a validation tool suite. ACM SIGAda Ada Letters, 43( 2): 69–72

[18] Kalra N, Paddock S M, (2016). Driving to safety: How many miles of driving would it take to demonstrate autonomous vehicle reliability. Transportation Research Part A, Policy and Practice, 94: 182–193

[19] Khastgir S, Brewerton S, Thomas J, Jennings P, (2021). Systems approach to creating test scenarios for automated driving systems. Reliability Engineering & System Safety, 215: 107610

[20] Kinalzyk D, (2021). SOTIF process and methods in combination with functional safety. In: European Conference on Software Process Improvement. Cham: Springer International Publishing, 612–623

[21] Kondrak G, Van Beek P, (1997). A theoretical evaluation of selected backtracking algorithms. Artificial Intelligence, 89( 1–2): 365–387

[22] Luo Q, Zhang D, Zhou H, Pang S, Li X, Wang C, (2022). Evaluation on driving scenarios for safety of intended functionality of intelligent vehicles. China Safety Science Journal, 32: 140–145

[23] Mackworth A K, (1977). Consistency in networks of relations. Artificial Intelligence, 8( 1): 99–118

[24] Neurohr C, Westhofen L, Henning T, De Graaff T, Mohlmann E, Bode E, (2020). Fundamental considerations around scenario-based testing for automated driving. In: 2020 IEEE intelligent vehicles symposium (IV). 121–127

[25] PimentelJ (2019). Safety of the Intended Functionality. SAE International. Warrendale, PA, USA

[26] Rau P, Becker C, Brewer J, (2019). Approach for deriving scenarios for Safety of the Intended Functionality. 1–15

[27] Schnellbach A, Griessnig G, (2019). Development of the ISO 21448. In:European Conference on Software Process Improvement. Cham: Springer International Publishing, 585–593

[28] Skoglund M, Warg F, Hansson H, Punnekkat S, (2021). Synchronisation of an automotive multi-concern development process. International Conference on Computer Safety, Reliability, and Security. Cham: Springer International Publishing, 63–75

[29] Srinivas M, Patnaik L M, (1994). Adaptive probabilities of crossover and mutation in genetic algorithms. IEEE Transactions on Systems, Man, and Cybernetics, 24( 4): 656–667

[30] Wang B, Luo Y, Zhong Z, Li K, (2022). Robust non-fragile fault tolerant control for ensuring the Safety of the Intended Functionality of cooperative adaptive cruise control. IEEE Transactions on Intelligent Transportation Systems, 23( 10): 18746–18760

[31] Yan M Y, Chen W W, Wang Q D, Zhao L F, Liang X T, Cai B X, (2021). Human–machine cooperative control of intelligent vehicles for lane keeping—Considering Safety of the Intended Functionality. In: Actuators. MDPI, 10( 9): 210

[32] Zhang X Y, Zhou M, Shao W B, Luo T, Li J, (2019). The architecture of the intended safety system for intelligent driving. In: 2019 IEEE International Symposium on Circuits and Systems (ISCAS). 1–4

[33] ZhangYLinternGGaoLZhangZ (2021). A study on functional safety, SOTIF and RSS from the perspective of human-automation interaction. SAE Technical Paper, 2021–01–0858

[34] Zhao X, Lv Z H, Qiu Q A, Wu Y G, (2023). Designing two-level rescue depot location and dynamic rescue policies for unmanned vehicles. Reliability Engineering & System Safety, 233: 109119

[35] ZhouBChenCZhaiYZhaoS (2022a). A study on scenario generalization and optimization for ADS. SAE Technical Paper, 2022-01-7007

[36] Zhou H, Li X Y, He X, Li P F, Xiao L Y, Zhang D W, (2022b). Research on safety of the intended functionality of automobile AEB perception system in typical dangerous scenarios of two-wheelers. Accident Analysis and Prevention, 173: 106709

RIGHTS & PERMISSIONS

Higher Education Press