Engineering roadmap
Software reference first.
Silicon second.
C++ CORE→ROS 2→RISC-V SUBCORE→SoC IP
Mathematical contract
What the implementation must compute.
PLANT
\[
\mathbf x_{k+1}
=
A_d(\boldsymbol{\rho}_k)\mathbf x_k
+
B_d(\boldsymbol{\rho}_k)\mathbf u_k
+
E_d(\boldsymbol{\rho}_k)\boldsymbol{\xi}_k
\]
Plant dynamics change with the residual-resource vector.
RESOURCE STATE
\[
\boldsymbol{\rho}_k\in[0,1]^n
\]
Continuous operability, not binary alive/dead state.
SURVIVABILITY
\[
S(c,\boldsymbol{\rho})
=
\sum_{j=1}^{m}w_j f_j(\boldsymbol{\rho})\delta_j(c)
\]
Residual resources are mapped to active functions and mission value.
DECISION
\[
c^\star
\in
\operatorname*{arg\,max}_{c\in\mathcal C_{\mathrm{feas}}(\boldsymbol{\rho})}
S(c,\boldsymbol{\rho})
\]
Select the best feasible post-failure configuration.
STABILITY
\[
V(\mathbf x)=\mathbf x^\top P\mathbf x,\quad P\succ0,
\qquad
\Delta V_k\le-\gamma V(\mathbf x_k)<0
\]
A configuration is not accepted only because resources exist; the transition must remain stable.
VALIDATION
\[
\operatorname{Valid}(c)
=
R(c)\land C(c)\land \operatorname{Stab}(c)\land \operatorname{Safe}(c)
\]
Resource, constraint, stability and safety gates must all pass.
Threshold interpretation. Values such as \(F_N=0.8\) and \(F_K=0.3\) are model parameters used in the research framework; they are not presented here as ISO 26262 normative functionality thresholds.
SOURCE BASIS: Survivability paper §§2–5; Practical Implementation paper Eqs. (1)–(24); Sc.D. thesis §§3.5, 4.3–4.7.
Evidence from the practical simulation paper
Reported reference implementation results.
Control-loop WCET\(42\,\mu\mathrm{s}\)
Indicator computation\(8\,\mu\mathrm{s}\)
Emergency response\(4.2\,\mathrm{ms}\)
Code + data\(48\,\mathrm{KB}\)
These values are reported for the paper's reference implementation. They are evidence for feasibility, not platform-independent guarantees.
Stage 1 · active
Reference software implementation
IN PROGRESS
1.1
Domain-independent C++ classesNo ROS 2 dependency. This layer is the executable golden model.
| Class / module | Mathematical responsibility | Primary output | Research anchor |
|---|---|---|---|
PlantModel | \(A_d(\boldsymbol{\rho}_k),\,B_d(\boldsymbol{\rho}_k),\,E_d(\boldsymbol{\rho}_k)\); damaged-object dynamics | \(\mathbf x_{k+1}\) | Practical Impl. (1–2) |
ResourceHealthModel | degradation law, feature fusion, Bayesian/Kalman estimation of \(\rho_i\) | \(\boldsymbol{\rho}(t),\,\dot{\boldsymbol{\rho}}(t)\) | Thesis 4.29–4.46 |
SurvivabilityModel | \(S(c,\boldsymbol{\rho})=\sum_{j=1}^{m}w_j f_j(\boldsymbol{\rho})\delta_j(c)\); resource → function → mission mapping | \(S(c\mid\boldsymbol{\rho})\) | Survivability paper §2–3 |
DecisionEngine | candidate filtering + MCDM/TOPSIS/AHP; \(c^\star\) selection | \(c^\star\), confidence | Thesis 3.3–3.5 / 4.47–4.59 |
StabilityAnalyzer | \(V(\mathbf x)=\mathbf x^\top P\mathbf x\), \(\dot V\)/\(\Delta V_k\), eigenvalue / margin gate | stable, \(\gamma\) | Thesis 4.70–4.83 |
ReconfigManager | transition FSM, Hot Standby, validation, rollback | resource/config commands | Thesis 4.60–4.69 |
ConfigStore | pre-computed/post-build candidate configurations and constraints | configuration set | Survivability paper §5.1 |
SafetySupervisor | minimum-state / safe-stop gate, E2E and timeout constraints | safety action | Thesis 4.27–4.28 |
1.2
Convert classes into ROS 2 packages and componentsROS 2 is an integration/runtime layer. Mathematics remains in the C++ core.
| Package | ROS 2 component / node | Interface | Rate / role |
|---|---|---|---|
varingjar_core | — | C++ API | golden mathematical implementation |
varingjar_msgs | — | ResourceState, HealthStatus, DecisionRequest, StabilityStatus | typed contracts |
varingjar_health | health_monitor_node | /sensor_data → /health_status, /resource_state | 100 Hz / 1 kHz |
varingjar_decision | decision_engine_node | /health_status → /decision_request | 50 Hz |
varingjar_stability | stability_analyzer_node | x, ρ, cfg → /stability_status | 100 Hz |
varingjar_reconfig | reconfig_manager_node | /decision_request + /stability_status → /resource_commands | event + transition |
varingjar_safety | safety_supervisor_node | health / E2E / timeout / fallback | independent safety gate |
varingjar_bringup | composable container | launch + configuration | system integration |
REFERENCE RATES: resource 1 kHz; health 100 Hz; decision 50 Hz; stability 100 Hz; actuator path 1 kHz. Thesis §4.7.
1.3
Stage 1 verificationEvery gate has a mathematical acceptance criterion.
T01 · Unit / equation
\[
0\le\rho_{i,k}\le1,
\qquad
0\le S(c,\boldsymbol{\rho}_k)\le1
\]
Known vectors and edge cases for health, survivability, Kalman and ranking kernels.
T02 · Golden-model equivalence
\[
\left\|
\mathcal G_{\mathrm{ROS2}}(\mathbf z)
-
\mathcal G_{\mathrm{C++}}(\mathbf z)
\right\|
\le \varepsilon_{\mathrm{num}}
\]
Wrapping a class as a node must not alter the numeric result beyond the defined numerical tolerance.
T03 · Fault injectionThermal, sensor, communication and multi-fault classes.Replay degradation scenarios from the practical simulation work, plus irreversible resource loss.
T04 · Configuration gate
\[
c^\star
\in
\operatorname*{arg\,max}_{c\in\mathcal C_{\mathrm{feas}}(\boldsymbol{\rho})}
S(c,\boldsymbol{\rho})
\]
Selected configuration must satisfy resource/function constraints and outperform rejected candidates.
T05 · Stability gate
\[
V(\mathbf x)=\mathbf x^\top P\mathbf x,\quad P\succ0,
\qquad
\dot V(\mathbf x)\le-\gamma V(\mathbf x)<0
\]
Unstable transitions are rejected; if no candidate is stable, force the minimum safe configuration.
T06 · Timing\(t_{\mathrm{decision}}<2\,\mathrm{ms}\)Decision target from the research specification.
T07 · Transition timing\(t_{\mathrm{validate}}<6\,\mathrm{ms},\quad t_{\mathrm{switch}}<50\,\mathrm{ms},\quad t_{\mathrm{rollback}}<30\,\mathrm{ms}\)Hot-standby reference: approximately \(35\,\mathrm{ms}\).
T08 · Control cycle\(\sum_i t_i\le10\,\mathrm{ms}\)Reference \(100\,\mathrm{Hz}\) service-cycle budget; thesis model gives \(8.3\,\mathrm{ms}\) mean / \(10\,\mathrm{ms}\) WCET.
Stage 2 · planned
RISC-V control subcore → SoC IP
PLANNED
Stage 2 is a Væringjar II engineering extension. The current publications justify the mathematical kernels and real-time decomposition; they do not claim an existing RISC-V or SoC-IP implementation.
2.1
RISC-V control subcoreMove the verified Stage 1 core below Linux/ROS 2 while preserving the same interfaces and equations.
SUPERVISORRISC-V control coreFSM, scheduling, configuration selection, transition sequencing, host interface.
STATEHealth / \(\boldsymbol{\rho}\) engineWeighted feature fusion + small-state Kalman recursion.
METRICSurvivability engineEvaluate \(f_j(\boldsymbol{\rho})\) and \(S(c\mid\boldsymbol{\rho})\) for candidate configurations.
VERIFYStability engineRuntime quadratic form \(V(\mathbf x)=\mathbf x^\top P\mathbf x\) and \(\dot V\) or \(\Delta V_k\), using pre-computed matrices.
TRANSITIONReconfiguration FSMValidate → apply → verify → rollback; deterministic timeout handling.
SAFETYIndependent guardE2E, sequence counter, watchdog, minimum-state fallback.
2.2
Package as SoC IPThe IP boundary follows the mathematical state boundary.
| IP input | Internal state | IP output | Required property |
|---|---|---|---|
| sensor / diagnostic features | \(\boldsymbol{\rho}(t),\,\dot{\boldsymbol{\rho}}(t)\) | resource-health vector | bounded numeric error |
plant state x | \(P,\,V,\,\dot V,\,\gamma\) | stability status | deterministic latency |
| candidate configurations | \(S(c\mid\boldsymbol{\rho})\), constraints | \(c^\star\) | same rank as software golden model |
| fault / timeout events | transition FSM + checkpoint | resource/control commands | bounded transition time |
| host policy / mission weights | \(w_j,\,\delta_j,\,S_{\min}\) | status + telemetry | runtime configurability |
2.3
Stage 2 verificationSilicon implementation is accepted only if it reproduces Stage 1 behaviour within a defined numeric/timing envelope.
H01 · Numerical equivalence
\[
\left\|
\mathcal G_{\mathrm{IP}}(\mathbf x,\boldsymbol{\rho},c)
-
\mathcal G_{\mathrm{golden}}(\mathbf x,\boldsymbol{\rho},c)
\right\|
\le \varepsilon_{\mathrm{IP}}
\]
Define fixed-/floating-point error bounds before RTL freeze.
H02 · Quantization study\(\boldsymbol{\varepsilon}_{q}=\begin{bmatrix}\varepsilon_S&\varepsilon_{\rho}&\varepsilon_V\end{bmatrix}^{\top}\)Determine numeric format from sensitivity of survivability, ranking and stability decisions.
H03 · RTL / subcore fault injectionResource loss, corrupted input and timeout fault classes.Same scenario set as Stage 1; identical expected state transitions.
H04 · Cycle budget\(\mathrm{WCET}_{\mathrm{HW}}\le\mathrm{WCET}_{\mathrm{Stage\,1}}\)Measure health, decision, stability and transition paths independently.
H05 · FPGA prototypeHost ↔ V2 IP ↔ plant/HIL integration path.Validate interfaces and deterministic behaviour before SoC integration.
H06 · HIL / damaged-plant test\(\mathcal P_0\xrightarrow{\mathcal D}\mathcal P_d\)Inject irreversible plant/resource changes and verify residual-resource control of \(\mathcal P_d\).
Why the hardware path is technically plausible
| Kernel from research | Computational form | Hardware implication |
|---|---|---|
| resource health | weighted sums + small Kalman update | bounded arithmetic pipeline |
| survivability | products / weighted accumulation over finite resources/functions | parallel reducer |
| configuration selection | finite candidate scoring + constraints | bounded search, pre-computed candidate set |
| stability verification | quadratic form \(V(\mathbf x)=\mathbf x^\top P\mathbf x\) and derivative/difference | MAC-oriented accelerator; \(P\) can be pre-computed |
| reconfiguration | finite-state machine + timers + checkpoint | deterministic supervisory logic |
The practical implementation paper explicitly targets embedded deployment, uses a modular C++ architecture, and notes per-step complexity O(r) for the scalar simulation case; higher-dimensional Kalman processing can be reduced with pre-computed gains. Hardware mapping is the next engineering hypothesis to verify, not a published result.
Scalability
Per-step computational structure.
| Component | Time | Space |
|---|---|---|
| State estimation | \(\mathcal O(n^3)\) | \(\mathcal O(n^2)\) |
| Indicator computation | \(\mathcal O(r)\) | \(\mathcal O(r)\) |
| Regime classification | \(\mathcal O(1)\) | \(\mathcal O(1)\) |
| Control computation | \(\mathcal O(nm)\) | \(\mathcal O(nm)\) |
| Degradation update | \(\mathcal O(r)\) | \(\mathcal O(r)\) |
| Total | \(\mathcal O(n^3+r)\) | \(\mathcal O(n^2+r)\) |
Evidence boundary
What is not yet demonstrated.
Plant fidelityThe reported comparative study uses a simplified scalar plant for parameter studies.
Failure-model coverageThe degradation laws assume known failure mechanisms and parameterized progression.
Physical validationHardware-in-the-loop / representative-plant validation remains a required next step.
Implementation support · Contimech.org
Translate the research into testable technology.
Contimech.org supports the C++ / ROS 2 reference implementation, test infrastructure and exploratory RISC-V / SoC engineering. This work is part of technology formation, not a commercial offering.