Trusted measurement and evaluation for intelligent transportation system products: A case study for traffic signal controller

Abstract

This study proposes trusted measurement and evaluation models for intelligent transportation system products to provide technological means for the transport sector and government departments to detect the compliance and availability of intelligent transportation system products and consider the market access of intelligent transportation system products. Then, this study builds a trusted testing platform based on a hardware-in-loop system to test and validate trusted measurement and evaluation models of intelligent transportation system products. Finally, a traffic signal controller is tested and validated in the platform in different operation environments. The result shows that the trusted measurement model can accurately measure the trusted status in normal and non-normal operation conditions, and the trusted evaluation model can dynamically calculate the intelligent transportation system product’s trusted attributes, namely, the trusted evaluation values and comprehensive trusted evaluation values of the intelligent transportation system product, as the intelligent transportation system product’s operation environment changes.

Introduction

Intelligent transportation systems (ITSs) show positive effects on improving traffic operation efficiency, alleviating traffic congestion, ensuring traffic safety, and reducing traffic emissions, among others. Therefore, the state and governments at all levels take a serious attitude toward the ITS industry’s development and planning strategy. Governments have proposed a series of policies to simulate the development of the ITS industry and raised its financial budget to develop the ITS. With the application and popularization of ITS in the area of transportation, especially in urban traffic system, people are becoming increasingly dependent on ITS products. The governors use ITS products to alleviate traffic disorders, reduce traffic accidents, and decrease traffic emissions, such as using traffic signal controller. The travelers use ITS products to obtain traffic information, improving traffic safety and comfort, such as using personal digital assistant (PDA) navigation. ITS products are being extensively used in all areas of urban traffic system, such as traffic signal control, traffic flow guidance, traffic information service, and traffic safety monitoring. These products not only directly affect people’s quality of living but also the safety of their life and property. Therefore, when ITS products develop faults, failures, or errors, it will have increasingly serious consequences for the governors and travelers. ¹

In China, there are more than 2000 corporations engaged in the ITS industry. ² The products of these corporations include hardware products, software products, and integrated systems. These products are used in the fields of traffic signal control, traffic flow guidance, traffic information service, electronic toll collection (ETC) system, traffic monitoring, and so on. However, these products’ reliability, usability, testability, maintainability, and security are of varying quality. The governors and travelers enjoy the various services, conveniences, and effectiveness of ITS products, but at the same time, they suffer from life and property loss, trouble, and challenge due to untrusted ITS products.

To ensure the trustability of ITS products, excluding potential faults in the hardware, software, and integrated systems of ITS products before launching in the application market, it is necessary to measure and evaluate the capacity of trusted services provided by ITS products. ³ This article aims to analyze the influencing factors for the trusted measurement and trusted evaluation of ITS products and then to develop a measurement and evaluation model to measure and evaluate the trustability of ITS products.

The rest of this article is organized as follows. Section “Literature review” is a review of the literature on fault detection and trusted computing. In section “ITS product trusted measurement and evaluation model,” the trusted measurement model and trusted evaluation model for ITS products is proposed and deduced. In section “Experimental validation,” an ITS product trusted testing platform based on a hardware-in-loop system was set up to test and validate the trusted measurement model and trusted evaluation model using traffic signal controller. In section “Discussion and conclusion,” a brief review of this article and the future research are presented.

Literature review

Urban traffic management and control rely heavily on ITS products for its reliable and effective operation. ITS products provide traffic network operating condition, detect traffic incident, and so on for the governors to make more effective management. With increasing safety, performance, and automation requirements, ITS construction is increasingly sophisticated and is heavily reliant on ITS products. However, ITS products are often considered the weak link in urban traffic management and control. Any ITS product failure could degrade ITS performance and possibly lead to the failure of all the urban traffic systems. Therefore, it is necessary to detect and accommodate such failures, particularly if the ITS product in question has a safety-critical application. In safety-critical applications, any failure could result in damage to property or the environment and, in the worst-case scenario, the loss of life. Traffic signal control system is a good example of safety-critical application. All in a word, ITS product failure detection, identification, and accommodation constitute an important part of research in the safety-critical systems domain. ⁴

Throughout the research and application of the trusted measurement and evaluation of ITS products, the state-of-the-art practice is to implement fault detection, identification, and accommodation of hardware devices. There have been three stages of development for hardware devices’ fault detection, diagnosis, identification, and fault-tolerant control. The researches are mostly based on experimental experiences, sensors and dynamic testing, and artificial intelligence. In the literature, early works on analytical ITS hardware devices’ faults were mostly based on observers and Kalman filtering.^5–8 These researches relied on the linear time-invariant mathematical model of the system. In addition, these techniques can suffer from modeling discrepancies between reality and the mathematical models of the system. The recent literatures have seen efforts been made to address these issues, particularly regarding the linearity assumption of the Kalman filtering. Several versions of the Kalman filtering have been developed and applied to various fault tolerance and state estimation problems in hardware devices.^9,10

With a constant improvement in hardware performances, the stability and reliability of hardware device fundamentally improve. The industry found that the most fault of hardware occurred in its embedded software. In recent years, researchers have begun to focus on software’s stability, security, and credibility. The enactments or formulations of standards, norms, contracts between ITS products, or ITS product units have been organized. ITS products’ reliability, stability, availability, and compliance have attracted increasing focus and will be the most prominent factor in trusted measurement and evaluation in the research and application stage of trusted computing. In the literature, research on analytical software trusted measurements is mostly based on software trusted modeling and measurement. Johnson ¹¹ analyzes the use of formal verification methods in developing trusted software and gives methods for the design, implementation, and maintenance of safe and dependable software, to enhance the dependability of software. Alawneh and Hamou-Lhadj ¹² propose high-performance computing analytic tools to describe the necessary trusted software behavior and model trusted computing of the inter-process communication. Betous-Almeida and Kanoun ¹³ present a stepwise approach for dependability modeling, based on generalized stochastic Petri nets. This approach allows the various dependencies to be considered at the correct level of abstraction: functional dependency, structural dependency, and dependency induced by non-exponential distributions. Lenzini et al. ¹⁴ propose a trustworthiness management framework for quality metrics on the software component behaviors and for periodically evaluating their trustworthiness. Ardagna et al. ¹⁵ provide an approach that permits service developers and software adopters to evaluate service performance at design time through building on expert knowledge, service complexity evaluation, and the performance (retrieved by testing) of some reference services; to estimate the execution time of service operations; and to improve the credibility and stability of software. The recent literatures have seen efforts to address security analysis, mutual authentication, identity management, and trusted interaction of software. Several versions of trusted authentication, trusted security analysis, and identity management have been developed and applied to various ITS software products.

In the current researches and applications in fault detection and diagnosis, they mostly used redundancy modules embedded in hardware or software to collect information and analyzed and confirmed the fault sections and reasons based on the principle of subordination of the minority to the majority. Although using embedded redundancy modules can improve the reliability of hardware or software, it can increase system complexity and running delay of the hardware or software. For safety-critical and real-time demanded system, especially in ITS, the method of embedding redundancy modules is unacceptable. This article focuses on external fault detection and diagnosis. A trusted testing platform based on hardware in-loop system was built to extract input vector, state vector, and output vector of different modules of ITS hardware or software. The trusted measurement and evaluation model was inject to observe the data stream of ITS hardware or software using the input vector, state vector, and output vector, testing and validating the trusted capacity of ITS product. According the trusted evaluation value, the user of ITS product can decide whether it can be deployed in urban traffic management and control area.

ITS product’s trusted measurement and evaluation model

ITS product’s trusted measurement

In traffic management and control systems, ITS products are used for detecting traffic information, monitoring traffic flow condition, and controlling traffic flow work in a time-driven, event-driven, and data-driven style. Time-driven means that the ITS product works periodically, such as a fixed-time traffic signal controller. Event-driven means that the ITS product works when an event occurs, such as a traffic flow video detector. Data-driven means that the ITS product works when data are input to the product, such as traffic information display devices.^16–18 The high-level abstract structure of an ITS product is illustrated in Figure 1.

Figure 1.

Structure of ITS product.

The sensor module of an ITS product obtains traffic flow data. It may be time-driven, event-driven, or data-driven, depending on the type and the application of ITS product. The controller module of an ITS product processes traffic flow data and generates or optimizes a traffic control plan. The traffic data transmitted from the sensor module to the controller module have time-lag, set as ${\overline{d}}^{\mathrm{sc}}$ . The controller module’s traffic data processing cycle is set as T.

The ITS product’s actuator module preformation status model can be described as follows

$$\{\begin{array}{c}\stackrel{·}{x}\left(t\right)=A_f·x\left(t\right)+B_f·v\left(t\right)+f\left(t\right)\hfill \\ \multicolumn{1}{c}{y\left(t\right)=C_f·x\left(t\right)}\end{array}$$

(1)

The ITS product’s sensor module preformation status model can be described as follows

$$\{\begin{array}{c}\stackrel{·}{x}\left(t\right)=A_f·x\left(t\right)+B_f·v\left(t\right)\hfill \\ \multicolumn{1}{c}{y\left(t\right)=C_f·x\left(t\right)+f\left(t\right)}\end{array}$$

(2)

where $x(t)\in R^n$ is the state vector, $v(t)\in R^m$ is the input vector, $y(t)\in R^l$ is the output vector, and $f(t)\in R^n$ is the fault vector. Under normal circumstances, $f(t)$ is the zero vector, which represents whether the ITS product is creditable. If $f(t)$ is a nonzero vector, then a fault had occurred in the ITS product, and the ITS product is untrusted. $A_f$ , $B_f$ , and $C_f$ are the constant coefficient matrices.

The ITS product’s controller module preformation status model can be described as follows

$$\{\begin{array}{c}x(t+1)=A·x\left(t\right)+B·u\left(t\right)+f\left(t\right)\hfill \\ \multicolumn{1}{c}{y\left(t\right)=C·x\left(t\right)}\\ \multicolumn{1}{c}{z\left(t\right)=y(t-1)}\end{array}$$

(3)

where $A=e^{A_f·T_d}$ , $B={\int }_0^{T_d}{e}^{A_f·s}\mathrm{ds}·B_f$ , $C=C_f$ , $u(t)$ is the control vector of controller module, and $z(t)$ is the input vector of controller module.

Thus, the ITS product’s trusted measurement model can be described as follows

$$\stackrel{⌢}{x}(t+1)=A·\stackrel{⌢}{x}\left(t\right)+B·u\left(t\right)+L·(y(t-1)-\stackrel{⌢}{y}(t-1))$$

(4)

where L is the gain measurement matrix.

The state estimation error is assumed to be as follows

$$e\left(t\right)=x\left(t\right)-\stackrel{⌢}{x}\left(t\right)$$

(5)

The ITS product’s trusted status estimation can be described as follows

$$e(t+1)=A·e\left(t\right)-L·C·e(t-1)$$

(6)

Introducing the augmenting vector ${\theta }_k$ to equation (6) gives the following

$$\theta \left(t\right)={\left[e^T\left(t\right)e^T(t-1)\right]}^T$$

(7)

$$\theta (t+1)=\left[\begin{array}{cc}A\hfill & L·C\hfill \\ \multicolumn{1}{c}{I}& 0\hfill \end{array}\right]·\theta \left(t\right)$$

(8)

Then, let $\tilde{A}=\left[\begin{array}{cc}A\hfill & 0\hfill \\ \multicolumn{1}{c}{I}& 0\hfill \end{array}\right]$ , $\tilde{L}=\left[\begin{array}{c}L\hfill \\ \multicolumn{1}{c}{0}\end{array}\right]$ , and $\tilde{C}=[\begin{array}{cc}0\hfill & C\hfill \end{array}]$ , and the ITS product’s trusted measurement estimation error is as follows

$$Q(t+1)=(\tilde{A}-\tilde{L}·\tilde{C})·Q\left(t\right)$$

(9)

Lemma 1 (matrix Schur complement property)

Given constant matrices A, P, Q, $Q=Q^T$ , $P=P^T>0$ , and $A^T\mathrm{PA}+Q<0$ , then if and only if ¹⁹

$$\left[\begin{array}{cc}Q\hfill & A^T\hfill \\ \multicolumn{1}{c}{A}& -P^{-1}\hfill \end{array}\right]<0\mathrm{or}\left[\begin{array}{cc}-P^{-1}\hfill & A\hfill \\ \multicolumn{1}{c}{A^T}& Q\hfill \end{array}\right]<0$$

(10)

Theorem 1

As the ITS product’s trusted measurement estimation error equation, if there exist symmetrical positive matrices P and Q, and they meet the below condition

$$\left[\begin{array}{cc}-P\hfill & {\tilde{A}}^{T}P-{\tilde{C}}^{T}Q\hfill \\ \multicolumn{1}{c}{P\tilde{A}-Q^T\tilde{C}}& -P\hfill \end{array}\right]<0$$

(11)

Proof

Using Lyapunov’s function $V(t)=e^T(t)\mathrm{Pe}(t)$ , where P is the symmetric positive definite matrix, then

$$\begin{array}{c}\multicolumn{1}{c}{\Delta V\left(t\right)=V(t+1)-V\left(t\right)=e^T(t+1)\mathrm{Pe}(t+1)-e^T\left(t\right)\mathrm{Pe}\left(t\right)}\\ \multicolumn{1}{c}{=e^T\left(t\right)[{(A-\mathrm{LC})}^{T}P(A-\mathrm{LC})-P]e\left(t\right)}\end{array}$$

(12)

Obviously, $\Delta V<0$ is equal to formula (13)

$${(A-\mathrm{LC})}^{T}P(A-\mathrm{LC})-P<0$$

(13)

According to matrix Schur complement property (as in lemma 1), formula (13) is equal to formula (14)

$$\left[\begin{array}{cc}-P\hfill & A^T-C^T{L}^T\hfill \\ \multicolumn{1}{c}{A-\mathrm{LC}}& -P^{-1}\hfill \end{array}\right]<0$$

(14)

As formula (14) includes P and $P^{-1}$ , the matrix inequality is nonlinear. Let formula (14) pre-multiply and post-multiply $\mathrm{diag}(I,P)$ respectively, then we will obtain

$$\left[\begin{array}{cc}-P\hfill & A^{T}P-C^T{L}^{T}P\hfill \\ \multicolumn{1}{c}{\mathrm{PA}-\mathrm{PLC}}& -P\hfill \end{array}\right]<0$$

(15)

Definition $Q=L^{T}P$ replaces $L^{T}P$ in formula (15), which turns out to be formula (11).

End proof.

Then, using Lyapunov’s function

$$\begin{array}{c}\multicolumn{1}{c}{{\theta }^T(t+1)P\theta (t+1)-{\theta }^T\left(t\right)P\theta \left(t\right)={\theta }^T\left(t\right)}\\ \multicolumn{1}{c}{[{(\tilde{A}-\tilde{L}\tilde{C})}^{T}P(\tilde{A}-\tilde{L}\tilde{C})-P]\theta \left(t\right)<0}\end{array}$$

(16)

With lemma 1, it can be stated that the ITS product’s trusted measurement estimation error is asymptotically stable.

When the ITS product’s trusted measurement estimation error shows asymptotic stability, then $\epsilon (t)=\mathrm{He}(t)$ is defined as the ITS product’s trusted measurement residual error, where H is the weight matrix.

Then, it is possible to choose a suitable critical threshold, $\overline{\epsilon }$ , to decide whether the ITS product is trustable or untrustable

$$\{\begin{array}{c}\Vert \epsilon \left(t\right)\Vert ⩽\overline{\epsilon }\mathrm{ITS}\mathrm{product}\mathrm{is}\mathrm{trustable}\hfill \\ \multicolumn{1}{c}{\Vert \epsilon \left(t\right)\Vert >\overline{\epsilon }\mathrm{ITS}\mathrm{product}\mathrm{is}\mathrm{untrustable}}\end{array}$$

(17)

here, $\Vert \epsilon (t)\Vert =\sqrt{{\epsilon }^T(t)\epsilon }$ is the Euclidean norm of the vector.

ITS product’s trusted evaluation

To validate whether the ITS product’s operation behavior corresponds to expectations, and the ITS product is continuously trustable at the scheduled time, it is necessary to confirm the trusted requirement. Generally, the trusted requirement consists of a set of multi-dimensional trusted attributes and establishes a trusted evaluation indices system.^13,20

Definition 1

For trusted evaluation, the ITS product’s trusted status at time $t_i$ is defined as follows

$$S〈t_i,t{r}_i,\mathrm{TEIS}(X_{e,i},X_{w,i})〉$$

(18)

where $t_i$ is the ITS product’s operation time; $t{r}_i$ is the ITS product’s trusted requirement at time $t_i$ ; $\mathrm{TEIS}(X_{e,i},X_{w,i})$ is the ITS product’s trusted evaluation indices system; and $X_{e,i}$ and $X_{w,i}$ are the trusted indices set and trusted indices weight set, respectively.

Definition 2

During the ITS product’s operation period $(t_i,t_j]$ , the ITS product’s status transfer function is defined as follows

$$\begin{array}{c}\multicolumn{1}{c}{C{S}_{i\to j}\left(\tau \right)=S〈t_i,t{r}_i,\mathrm{TEIS}(X_{e,i},X_{w,i})〉}\\ \multicolumn{1}{c}{\to S〈t_j,t{r}_j,\mathrm{TEIS}(X_{e,j},X_{w,j})〉}\end{array}$$

(19)

where $\tau$ is the incentive parameter.

ITS products have different trusted requirements in different statuses, different operation times, and different operation environments. Therefore, the ITS product’s trusted evaluation model needs to be dynamic and adaptive. The ITS product’s trusted requirement is demonstrated by trusted indices and a trusted evaluation indices system. Thus, it is necessary to adjust the trusted indices set $X_{e,i}$ and trusted indices weight set $X_{w,i}$ dynamically to adapt to environmental heterogeneity.

Trusted indices self-adjustment

When an ITS product’s trusted requirements change, it needs to add or delete a trusted index in its trusted indices set at time $t_i$ .

Definition 3

Assuming $a_i$ and $a_j$ are the ITS product’s trusted attributes, the degree of correlation of $a_i$ to $a_j$ is $C_{\mathrm{ij}}$ , $C_{\mathrm{ij}}\in (-1,1)$ with $C_{\mathrm{ij}}$ not necessarily equal to $C_{\mathrm{ji}}$ . If $C_{\mathrm{ij}}>0$ , $a_i$ and $a_j$ are positively correlated. If $C_{\mathrm{ij}}=0$ , $a_i$ and $a_j$ are mutually independent. If $C_{\mathrm{ij}}<0$ , $a_i$ and $a_j$ are negatively correlated.

An ITS product’s trusted evaluation computing system can construct a conjunction matrix $\mathrm{TAIM}=[C_{\mathrm{ij}}{]}_{n\times n}$ to adapt the change in the trusted indices of the ITS product. ²¹

Trusted indices weight self-adjustment

When an ITS product operates in different working environments, the trusted indices of the ITS product in trusted evaluation indices system are changed, and the trusted index weights need to change synchronously. The trusted attributes’ trusted indices weights are set as $W=\{w_1,w_2,\dots ,w_n\}$ . $\mathrm{TAIM}=[C_{\mathrm{ij}}{]}_{n\times n}$ is the trusted attributes’ conjunction matrix. The trusted index weights are adjusted as shown below when the trusted indices change:^12,22

• Step 1. When the trusted evaluation indices system deletes a trusted attribute $a_i$ , then

• Step 1.2. If $C_{i*}$ are not all zeroes, in the trusted evaluation index system, trusted attribute $a_i$ is related to other trusted attributes. The trusted index weights are adjusted as follows

  $$\{\begin{array}{cc}{w\prime }_t=w_t-C_{\mathrm{it}}{w}_i\hfill & C_{\mathrm{it}}\ne 0\hfill \\ \multicolumn{1}{c}{{w\prime }_t=w_x-\frac{\sum _t^n({w\prime }_t-w_t)-w_i}{n-\omega -1}}& C_{\mathrm{ix}}=0\hfill \end{array}$$

  (21)

  where $t,x=1,\dots ,n$ and $t,x\ne i$ ; and $\omega$ is the number of trusted attributes that trusted attribute $a_i$ relates to.

Step 2. When the trusted evaluation index system adds a new trusted attribute, it is necessary to compute the degree of correlation of the new trusted attribute with the existing trusted attributes, constructing the new conjunction matrix $\mathrm{TAIM}\prime =[C_{\mathrm{ij}}{]}_{(n+1)\times (n+1)}$ .

Step 3. When the ITS product’s operation status changes, the trusted index weights also need to change.

Definition 4

In the trusted evaluation index system, $a_i$ is the key trusted attribute; $S_k$ is the operation status of the ITS product; $S_{k+1}$ is the next operation status of the ITS product; and $w_i$ and $w{\prime }_i$ are the trusted index weights of trusted attribute $a_i$ under the operation statuses $S_k$ and $S_{k+1}$ , respectively. In the trusted evaluation index system, $a_t$ is related to $a_i$ , and the degree of correlation of $a_i$ to $a_t$ is $C_{\mathrm{it}}$ . In the trusted evaluation index system, $a_x$ is not related to $a_i$ . The trusted index weights of $a_t$ and $a_x$ under the operation status $S_{k+1}$ are as follows

$$\{\begin{array}{cc}{w\prime }_t=w_t+C_{\mathrm{it}}({w\prime }_i-w_i)\hfill & C_{\mathrm{it}}\ne 0\hfill \\ \multicolumn{1}{c}{{w\prime }_x=w_x-\frac{\sum _t^n({w\prime }_i-w_t)+({w\prime }_i-w_i)}{n-\omega -1}}& C_{\mathrm{ix}}=0\hfill \end{array}$$

(22)

Trusted evaluation

When the ITS product operates in different working statuses or working environments, the trusted evaluation index system dynamically and self-adaptively adjusts the trusted indices and trusted index weights according to the ITS product’s working status or working environment. Then, it is necessary to obtain the ITS product’s state vector $x(t)$ , input vector $v(t)$ , and output vector $y(t)$ and use different measurement scales and evaluation criteria to normalize the ITS product’s operation status data.

Definition 5

$\mathrm{\Omega }=\{H_1,\dots ,H_n\}$ is the ITS product’s operation status evaluation set; $H_n(n=1,\dots ,N)$ is a group of evaluation degrees; $m(S)$ is the trusted confidence level of the ITS product’s operation status S within $\mathrm{\Omega }$ ; and $u(m)$ is the value of the utility function for the ITS product’s operation status data

$$m\left(S\right)=\{(H_n,{\beta }_n),(\mathrm{\Omega },{\beta }_{\mathrm{\Omega }}),n=1,\dots ,N\}$$

(23)

$$u\left(m\right)=\sum _{n=1}^N{\beta }_{n}u\left(H_n\right)+{\beta }_{\mathrm{\Omega }}u\left(\mathrm{\Omega }\right)$$

(24)

$${\beta }_n=\frac{u\left(H_{n+1}\right)-u\left(m_0\right)}{u\left(H_{n+1}\right)-u\left(H_n\right)}$$

(25)

where ${\beta }_n$ and ${\beta }_{\mathrm{\Omega }}$ are the trusted confidence level probability in $H_n$ and $\mathrm{\Omega }$ , respectively, and $m_0$ is given an initial value.

The trusted evaluation values of different ITS products’ trusted attributes are calculated as follows

$$V_{\mathrm{TA}}\left(m\right)=\sum _n{\beta }_{n}u\left(H_n\right)+\sum _{{\beta }_n\ne 0}\frac{{\beta }_{\mathrm{\Omega }}u\left(H_n\right)}{\left|m\right|}$$

(26)

Experimental validation

This study developed an ITS product trusted testing platform based on a hardware-in-loop system to test ITS products’ trusted attributes, as shown in Figure 2. The ITS product’s trusted testing platform consists of a traffic simulator which is used to generate different traffic statuses. The trusted testing management software is used in fault injection, load simulation, and information coordination. The ITS software product and ITS hardware product are used to inter-feedback the ITS product’s operation status and trusted status. ²³ To validate the ITS product’s trusted measurement model and trusted evaluation model, this article uses a traffic signal controller to test and verify the model. The control module of the traffic signal controller is ARM 9. The sensor module of the traffic signal controller is PLC 51, and its maximum control capacity is 64 signal lights. In the ITS product’s trusted testing platform, the traffic simulator’s simulation step is set as 0.1 s and the running time is set as 3600 s. Daily traffic flow data and traffic signal plan of a typical four-phase signalized intersection in Changchun city, China, were used as normal operation condition input and status vectors of the simulator and controller. In the experiment, we defined traffic flow below 800 PCU/lane as status $\lambda 1$ and above 1200 PCU/lane as status $\lambda 2$ .

Figure 2.

ITS product’s trusted testing platform.

ITS product’s trusted measurement testing

In the trusted testing platform, when the daily traffic flow data and traffic signal plan run in the simulator module and controller module, respectively, the input vector, state vector, and output vector are extracted by I/O port of hardware-in-loop system. The trusted testing management uses a sampling period to discrete the continuous data stream of the hardware-in-loop system. When the sampling dataset was enough (in this article, the sample size is 30), the constant coefficient matrices in different modules can be derived from the sampling data. In the ITS product’s trusted measurement, the constant coefficient matrices are calibrated as $A_f=\left[\begin{array}{cc}-1\hfill & 0.2\hfill \\ \multicolumn{1}{c}{0}& -1.5\hfill \end{array}\right]$ , $B_f=\left[\begin{array}{cc}1.5\hfill & 0\hfill \\ \multicolumn{1}{c}{0}& 1\hfill \end{array}\right]$ , and $C_f=[\begin{array}{cc}1\hfill & 1\hfill \end{array}]$ . In the ITS product’s trusted testing platform, the traffic simulator’s simulation step is set as 0.1 s ( $T=0.1\mathrm{s}$ ) and ${\overline{d}}^{\mathrm{sc}}$ is randomly distributed in the range between 0 and 0.1.

According to formula (3), the ITS product’s controller module preformation status model can be discretized as follows

$$\{\begin{array}{c}{x}_{k+1}=\left[\begin{array}{cc}0.905\hfill & 0.018\hfill \\ \multicolumn{1}{c}{0}& 0.861\hfill \end{array}\right]·x_k+\left[\begin{array}{cc}1.5\hfill & 0.133\hfill \\ \multicolumn{1}{c}{0}& 0.667\hfill \end{array}\right]·u_k+f_k\hfill \\ \multicolumn{1}{c}{y_k=\left[\begin{array}{cc}1\hfill & 1\hfill \end{array}\right]·x_k}\\ \multicolumn{1}{c}{z_k=y_{k-1}}\end{array}$$

(27)

The gain measurement matrix L can be calculated as $L=[\begin{array}{cc}0.461\hfill & 0.430\hfill \end{array}{]}^T$ .

In the first step of experimental process, the trusted testing management did not inject any fault information to the hardware-in-loop system and let the ITS product’s trusted testing platform to run in the normal status. The preformation status of the controller module and the actuator module is observed under input statuses $\lambda 1$ and $\lambda 2$ , respectively. The ITS product’s trusted operation status is measured as shown in Figures 3 and 4.

Figure 3.

ITS product’s trusted measurement curve in operation status $\lambda 1$ .

Figure 4.

ITS product’s trusted measurement curve in operation status $\lambda 2$ .

In hardware-in-loop system, the controller module can be simulated and evaluated by the trusted testing management software. So, we simulate the input vector of status $\lambda 1$ and status $\lambda 2$ for controller module, respectively. The trusted testing management extracts the state vector. Then, the state of the actuator module was observed. The observed state of the controller module and the actuator module is shown in Figures 3 and 4. In status $\lambda 1$ , with the F-test ( $F=1.026$ ), the single tail critical $F_{\alpha }=2.687$ , $F<F_{\alpha }$ ; with two-sample heteroscedasticity hypothesis in T-test, $P(T⩽t)=0.971$ . In status $\lambda 2$ , with the F-test ( $F=0.871$ ), the single tail critical $F_{\alpha }=0.372$ , $F>F_{\alpha }$ ; with two-sample heteroscedasticity hypothesis in T-test, $P(T⩽t)=0.947$ . From the F-test and T-test, the observed state of the controller module and the running state of the actuator module were not significantly different. So, the designed model can accurately track the running state of the ITS product in the level of significance $a=0.05$ .

To test the ITS product’s trusted operation status in non-normal status, a random fault data is injected through the trusted testing management software to the hardware-in-loop system when the ITS product’s trusted testing platform running simulator time is 1800 s. The ITS product’s trusted measurement dependable critical threshold is set as $\overline{\epsilon }=0.05$ . The Euclidean norm value of the ITS product’s trusted measurement residual error results is computed from formulas (4)–(16) and shown in Figures 5 and 6.

Figure 5.

ITS product’s trusted measurement residual error in operation status $\lambda 1$ .

Figure 6.

ITS product’s trusted measurement residual error in operation status $\lambda 2$ .

As shown in Figures 5 and 6, before the random fault was injected, the residual error was asymptotically stable under the designed model. But after the simulator time t = 1800 s, when the random fault was injected, there was a sequence of sudden transformation in the modules. The detected non-normal condition almost continues until the end of the simulation. It can be seen that there were different degrees of time delay in the detected fault: the time delay of status $\lambda 1$ was about 160 s and status $\lambda 1$ was about 120 s. The delay result is the data stream of the input vector, state vector, and output vector in different modules of the hardware-in-loop system which have time gap in the experimental processing. If the time gap of data stream between different modules is subtracted, then the residual error can reflect that a fault had occurred in the system immediately. This means that the designed model can detect the non-normal status of the system.

ITS product’s trusted evaluation testing

In an urban traffic signal control system, to keep the road safe and in order, a traffic signal controller should have high trustability. The traffic signal controller operates in all weather conditions to protect the traffic flow from conflicts, keep the traffic flow in order, and prevent disturbance and invasion. A trusted traffic signal controller should have the following trusted attributes: reliability ( $T{A}_1$ ), availability ( $T{A}_2$ ), fault tolerance ( $T{A}_3$ ), safety ( $T{A}_4$ ), and security ( $T{A}_5$ ). According to the study of Dickinson et al., ²¹ the conjunction matrix is calculated as follows

$$\mathrm{TAIM}=\begin{array}{cccccc}\hfill & T{A}_1\hfill & T{A}_2\hfill & T{A}_3\hfill & T{A}_4\hfill & T{A}_5\hfill \\ \multicolumn{1}{c}{T{A}_1}& \times \hfill & 0\hfill & -0.10\hfill & 0.35\hfill & 0\hfill \\ \multicolumn{1}{c}{T{A}_2}& 0\hfill & \times \hfill & 0\hfill & 0\hfill & 0\hfill \\ \multicolumn{1}{c}{T{A}_3}& -0.05\hfill & 0\hfill & \times \hfill & -0.10\hfill & 0.10\hfill \\ \multicolumn{1}{c}{T{A}_4}& 0.25\hfill & 0\hfill & -0.20\hfill & \times \hfill & 0\hfill \\ \multicolumn{1}{c}{T{A}_5}& 0\hfill & 0\hfill & 0.05\hfill & 0\hfill & \times \hfill \end{array}$$

(28)

Let the traffic signal controller operate under different statuses: idle ( $S_1$ ), traffic flow detector inspection ( $S_2$ ), traffic data collection ( $S_3$ ), traffic control strategy optimization ( $S_4$ ), traffic signal plan implementation ( $S_5$ ), and traffic signal control exception ( $S_6$ ).

According to the studies of Alawneh and Hamou-Lhadj ¹² and Li et al., ²² in different operation statuses, the trusted index weights of the traffic signal controller’s trusted attributes change as shown in Figure 7.

Figure 7.

Weight of trusted attributes in different operation status.

Let $\mathrm{\Omega }=\{H_n,n=1,\dots ,5\}$ be the traffic signal controller’s operation status set. $u(H_n)=\{0,0.25,0.5,$ $0.75,1\}$ is the value of the utility function for the traffic signal controller’s operation status. The trusted evaluation results of the traffic signal controller’s trusted attributes are shown in Figure 8, as calculated by formula (26).

Figure 8.

Traffic signal controller’s trusted attributes’ trusted evaluation value in different operation status.

Then, the comprehensive trusted evaluation value can be calculated using trusted attributes’ utility function and the trusted index weights. The traffic signal controller’s comprehensive trusted evaluation value is shown in Figure 9.

Figure 9.

Traffic signal controller’s comprehensive trusted evaluation value in different operation status.

As shown in Figure 9, the traffic signal controller operating under traffic data collection ( $S_3$ ) situation has the lowest trusted evaluation value because the traffic signal controller is injected by outside data stream and the robustness of the inside traffic signal controller system had changed by outside data stream. The lower trusted evaluation value is obtained when the traffic signal controller is in idle ( $S_1$ ) situation, that is because the traffic signal controller is in ready state, but the dataset in I/O port and state of processing is empty. The highest trusted evaluation value is obtained in traffic signal plan implementation ( $S_5$ ) and traffic signal control exception ( $S_6$ ), that is because the data stream in the traffic signal controller and the processing of the traffic signal controller are all well done.

Conclusion

In this article, a trusted measurement model and trusted evaluation model for ITS products are proposed using fault detection, diagnosis methods, and trusted computing theory. A hardware-in-loop system of ITS products’ trusted testing platform is set up to verify the proposed models of this article. The experimental results show that the trusted measurement model can track the running state of the traffic signal controller and reflect the sudden change in the traffic signal controller when the fault information was injected. Of course, there is still time delay in reflecting a fault had occurred in the current experimental stage. But the time delay in some degree depends on the time gap of processing data in different modules of the traffic signal controller. To a certain extent, the trusted evaluation model can reflect the reality running situation of the ITS products using dynamic adjustment of trusted indices and trusted indices weight in different operation status.

In order to obtain more general and robust conclusions, experimental data from different fault-injected information, traffic signal controller’s running status, and processing conditions require further exploration. And future studies are required to apply the model to other ITS products (such as traffic flow guidance device, traffic information service device, and ETC system). Moreover, with the development and pervasive application of ITS products in the area of transportation, the trusted measurement and evaluation will be focus on gradually before ITS product deployed in the roadside for some considerable time to come. It will be interesting to further design a suitable observer to test and evaluate the fault detection and diagnosis of ITS products, and enhance the robustness of the models to deal with system’s uncertainty and disturbance input. More accurate mathematical model should be further studied to reduce the complexity of parity-check function in trusted measurement and evaluation and make it practicable in engineering application.