SEKE 2012 Proceedings - Knowledge Systems Institute

dataflow and data de pendency relationship betwee n
components are represented with an arrow and a dotted
arrow respectively. Fig. 1 depicts the dataflow between
components for part of the Environment Modeling and
Perception (EMP) in the Unmanned Ground Vehicle (UGV)
application [Roh11]. The L aser Range Finder (LRF ) and
Camera components generate LRF data array and 24 bits raw
RGB respectively. The Car Detection component produc es
other cars trajectory by analysing the data that com es from
the LRF and Camera components. Using the data from the
Car Detection com ponent, the Dangerous Situation
component determines wheather it should generate an alarm
to prevent critical accidents.
Laser Range
Finder (LRF)
LRF data array
have a minor impact from a com ponent failure. The Car
Detection component (Fig. 2) is supported by two Camera
components, each impact level of whic h is de fined as
tolerable. Even though one of two Camera components fails
to capture other cars pictures, the Car Detection component
can make other cars trajectory using the remaining Camera
component.
Laser Range
Finder (LRF)
Camera 1
insignificant
tolerable
Car Detection
serious
Dangerous
Situation
Camera1
Camera2
24 bits raw
RGB
24 bits raw
RGB
Car Detection
List of car trajectory
Dangerous
Situation
Fig. 1 Dataflow between Components for Environment
Modeling and Perception in UGV application
The impact of a component failure to another component
is analyzed using the data dependency relationship between
components. The impact is defined depending on how much
a component is affected from other co mponent failure, and
the impact level is determined by considering the importance
of received data. The impact level of a component failure to
its dependent components is categorized as insignificant,
tolerable, serious, and catastr ophic. An insignificant im pact
level describes a data depe ndency in which a com ponent
uses an extra data from another component to verify or
increase the reliability of co mponent output additionally. A
component can provide its full functionality required without
any problem even though there is no extra data from a fai led
component. The impact is represented with an impact level
on the data dependency relationship between components.
Fig. 2 depicts the data dependency relationships between
components for the Environment Modeling and Perception
(EMP), which are defined based on the dataflow in Fig. 1.
The LRF co mponent is in significant for the Car Detection
component (Fig. 2), which receives data from the LRF and
two Camera components to trace other cars trajectory. Even
though the LRF component fails, the Car Detection
component can still produce other cars trajectory using only
the data generated from the Camera components. The LRF
component is added to the EMP as an extra component so
that the Car Detection com ponent can produce high quality
of other cars trajectory.
Failures of a component, which is t olerable to its
dependency component, do not disrupt the normal function
of its dependent component. The dependent component may
Camera 2
tolerable
Fig. 2 Data Dependency Relationship between Components
for Environment Modeling and Perception in UGV
application
A component failure that makes serious impact to its
dependents component causes the dependent to st op
processing data. This is because the dependent component
cannot generate a reliable output any more without the data
from the failed com ponent. Stopping the de pendent
components could give a ripple effect to the next dependent
components so that it can pa ralyze part of an application.
But, stopping the dependent components does not lead the
application to a total failure. The application can provi de
still partial services using the remaining components, which
may not have critical impact from the stopped com ponents.
The data generated by the Car Detection c omponent is
critical to the Dangerous Sit uation component in Fig. 2, so
the impact of Car Detection component to the Dangerous
Situation component is defi ned as seriou s. When the Car
Detection component fails, the Da ngerous Situation
component should stop processing the data. This is because
the Dangerous Situation c omponent cannot generate the
reliable output without t he data from the Car Detection
component.
Catastrophic impact is used to describe a sit uation where
a component failure needs to stop all components
constituting an application. An application may encounter a
critical accident if all the com ponents do not stop
immediately. Catastrophic i mpact may be associated wi th
safety of robots. The Virtual Robot component in the UGV
application controls real devices such as engine and steering
wheel. A failure of Virtual Robot component may cause the
UGV to encounter an accident, which could lead to l ose
human life.
Some kind of data dependency relationships bet ween
components, which have the same impact level, can have a
cardinality constraint that describes a m inimum number of
685