Formal Methods, and in particular Model Checking, are seeing an increasing use in the Aerospace domain. In recent years, Formal Methods are now commonly used to verify systems and software and its correctness as a way to augment traditional methods relying on simulation and testing. Recent updates to the relevant Aerospace regulations (e.g. DO178C, DO331 and DO333) now have explicit provisions for utilization of models and formal methods. At the system level, Model Checking has seen more limited uses due to the complexity and abstractions needed. In this paper we propose several methods to increase the capability of applying Model Checking to complex Aerospace Systems. An aircraft electrical power system is used to highlight the methodology. Automated model-based methods such as Cone of Influence and Timer Abstractions are described. Results of those simplifications, in combination with traditional Assume-Guarantee approaches will be shown for the Electric Power System application.

In this paper, we present a simulation framework based on SystemC and QEMU applied to the robustness testing of the communication layers in the AutroSafe fire alarm system from Autronica Fire and Security. This is a distributed large scale fire detection and alarm system. The system is based on state-of-the-art redundant protocols and embedded Linux operating systems. To achieve good confidence about the correctness and the robustness of the system, a simulation environment is used to run the target software using virtual execution platforms with timing variability. These platform variations allow simulating a range of system conditions, hence several possible interactions among the nodes and the network protocols, to which the application must be resilient. QEMU is used to execute the target software, while accurate models of the network protocols and topologies are provided in a SystemC-based simulation framework called DESYRE. The novel contribution described in this work is the integration of these environments for the simulation of a networked system with control of time execution accuracy and variability, as well as the application to the robustness testing of the industrial application.

Boolean satisfiability (SAT) based methods have traditionally been popular for formally verifying properties for digital circuits. We present a novel methodology for formulating a SPICE-type circuit simulation problem as a satisfiability problem. We start with a circuit level netlist, capture the non-linear behavior of the circuits at the transistor level via conservative approximations and transform the simulation problem into a search problem that can be exhaustively explored via a SAT solver. Thus, for DC as well as fixed time-step based transient and periodic steady state (PSS) simulation formulations, the solutions produced by the solver are formal in nature. We also present algorithms for abstraction refinement and smart interval generation to improve the computational efficiency of our proposed solution scheme. We have implemented our ideas into a tool called fSpice which is the first attempt at building a formal SPICE engine. We demonstrate the applicability of our ideas by showing experimental results using pruned versions of real designs that faced challenges during chip tape-out.

Safety-critical feedback-control applications may suffer faults in the controlled plant as well as in the execution platform, i.e., the controller. Control theorists design the control laws to be robust with respect to the former kind of faults while assuming an idealized scenario for the latter. The execution platforms supporting modern real-time embedded systems, however, are distributed architectures made of heterogeneous components that may incur transient or permanent faults. Making the platform fault tolerant involves the introduction of design redundancy with obvious impact on the final cost. We present a design flow that enables the efficient exploration of redundancy/cost tradeoffs. After providing a system-level specification of the target platform and the fault model, designers can rely on the synthesis of the low-level fault-tolerance mechanisms. This is performed automatically as part of the embedded software deployment through the combination of the following three steps: replication, mapping, and scheduling. Our approach has a sound foundation in fault-tolerant data flow, a novel model of computation that simplifies the integration of formal validation techniques. Finally, we report on the application of our design flow to two case studies from the automotive industry: a steer-by-wire system from General Motors and a drive-by-wire system from BMW.

Most automotive applications today consist of a set of interacting tasks. These applications are implemented on a distributed architecture consisting of several ECUs connected by buses. Although algorithms are designer to be robust, several communication flows between tasks should be designed in such a way that there is no loss of data. Furthermore, safety critical applications depend on corre ct data being delivered on time. We address this problem when the buses of the implementation architecture are Controlle r Area Networks (CANs). Flow-of-data requirements are addressed using an intermediate mapping solution where the LTTA protocol is used on some of the communication links. Then the problem becomes one of mapping LTTA links to CAN buses. We give conditions under which this mapping is feasible and show how to optimize the design solution with respect to performance.

We propose the notion of logical reliability for real-time program tasks that interact through periodically updated program variables. We describe a reliability analysis that checks if the given short-term (e.g., single-period) reliability of a program variable update in an implementation is sufficient to meet the logical reliability requirement (of the program variable) in the long run. We then present a notion of design by refinement where a task can be refined by another task that writes to program variables with less logical reliability. The resulting analysis can be combined with an incremental schedulability analysis for interacting real-time tasks proposed earlier for the Hierarchical Timing Language (HTL), a coordination language for distributed real-time systems. We implemented a logical-reliability-enhanced prototype of the compiler and runtime infrastructure for HTL.

Synchronous systems offer a clean semantics and an easy verification path at the expense of often inefficient implementations. Capturing design specifications as synchronous models and then implementing the specifications in a less restrictive platform allow to address a much larger design space. The key issue in this approach is maintaining semantic equivalence between the synchronous model and its implementation. We address this problem by showing how to map a synchronous model onto a loosely time-triggered architecture that is fairly straightforward to implement as it does not require global synchronization or blocking communication. We show how to maintain semantic equivalence between specification and implementation using an intermediate model (similar to a Kahn process network but with finite queues) that helps in defining the transformation. Performance of the semantic preserving implementation is studied for the general case as well as for a few special cases.

Schedulability theory provides support for the analysis of the worst case latencies in distributed computations when the architecture of the system is known and the communication and synchronization mechanisms have been defined. In the design of complex automotive systems, however, a great benefit of schedulability analysis may come from its use as an aid in the exploration of the software architecture configurations that can best support the target application. We present an optimization algorithm that leverages the trade-offs between the purely periodic and the data-driven activation models to meet the latency requirements of distributed vehicle functions. We demonstrate its effectiveness on a complex automotive architecture

Modern automotive architectures support the execution of distributed safety- and time-critical functions on a complex networked system with several buses and tens of ECUs. Schedulability theory allows the analysis of the worst case end-to-end latencies and the evaluation of the possible architecture configurations options with respect to timing constraints. The paper presents an optimization framework, based on an ILP formulation of the problem, to select the communication and synchronization model that leverages the trade-offs between the purely periodic and the precedence constrained data-driven activation models to meet the latency and jitter requirements of the application. The authors demonstrate its effectiveness by optimizing a complex automotive architecture

As design complexities increase exponentially, automotive designers need integrated tool environments enabling system-level analyses of alternative architectural solutions. Hence, a huge amount of heterogeneous design data must be made available easily and quickly for the analysis. In this paper, we introduce the AETM (architecture exploration tools and methods) data model, a key enabler for an integrated model-based tool environment. The data model encompasses several important aspects of the design of any embedded architecture (not only an automotive one), as it supports design capture at different levels of abstraction (e.g., functional, logical, and physical) and across application domains.

Architecture design is a critical stage of the Electronics/Controls/Software (ECS) -based vehicle design flow. Traditional approaches relying on component-level design and analysis are no longer effective as they do not always allow for the quantitative evaluation of properties arising from the composition of subsystems. This paper presents a system level architecture design methodology that is supported by tools and methods for the quantitative evaluation of key metrics of interest related to timing, dependability and cost. An example of its application to a by-wire system case study is presented, and the challenges faced in its application in the context of the actual development process are discussed.

The complexity and physical distribution of modern active-safety automotive applications requires the use of distributed architectures. These architectures consist of multiple electronic control units (ECUs) connected with standardized buses. The most common configuration features periodic activation of tasks and messages coupled with run-time priority-based scheduling. The correct deployment of applications on such architectures requires end-to-end latency deadlines to be met. This is challenging since deadlines must be enforced across a set of ECUs and buses, each of which supports multiple functionality. The need for accommodating legacy tasks and messages further complicates the scenario. In this work, we automatically assign task and message periods for distributed automotive systems. This is accomplished by leveraging schedulability analysis within a convex optimization framework to simultaneously assign periods and satisfy end-to-end latency constraints. Our approach is applied to an industrial case study as well as an example taken from the literature and is shown to be both effective and efficient.

We address the problem of mapping a set of processes which communicate synchronously on a distributed platform. The Time Triggered Architecture (TTA) proposed by Kopetz for the communication mechanism of a distributed platform offers a direct mapping that would preserve the semantics of the specification. However, its exact implementation may, at times, be problematic as it requires the distributed platform to have the clocks of its components perfectly synchronized. We propose as implementation architecture a relaxation of TTA called Loosely Time-Triggered Architecture (LTTA), in which computing units perform writes into and reads from the communication medium independently, triggered by local, quasi-periodic but non synchronized, clocks. LTTA offers some of the advantages of TTA with lower hardware cost and greater flexibility. So far LTTA was studied for single directional two-users communications over an LTT bus. General topology was not studied. In this paper we propose a design flow that ensures semantics preservation for an LTT communication network with arbitrary topology. Key elements are two new protocols for clock regeneration and predictive traffic shaping. Our approach relies on a mathematical Model of Communication (MoC) that we describe in detail.

This DOI is not currently attached to any metadata records. DOIs can’t actually ever be deleted (they’re persistent), but sometimes our members create DOIs in error. We do have a process to approximate deletion which we follow only in rare cases where the DOI has been genuinely created in error, and most crucially, if the DOI has never been published anywhere online or in print and never otherwise distributed to or communicated with anyone (authors, readers, reviewers, etc.

We introduce a model-based approach to heterogeneou s system design that enables the automatic generati on of fault trees for analyzing system reliability properties. This approach extends our previous work that addre ssed the generation of fault trees from a dataflow model. I n this new context, heterogeneous systems are compo sed f interacting discrete-time components, such as an el ectronic feedback controller, and continuous-time c omponents, such as a plant. More recent work in computer-aide d fault-tree generation methods is based on functio al models of the system to produce a system fault tree automatic ally. Yet, most of these approaches were not appli ed to heterogeneous systems. Furthermore, these approache s continued to rely on intuition to create fault tr ees. Since in this approach fault tree generation is disjoint fro m the system modeling, consistency problems may ari se when the structure and behavior of the system model is not a ccurately reflected. Our approach is different sin ce we use a model of the system specified as a set of mathemati cal equations to derive the system fault modes and ultimately produce fault trees for heterogeneous systems.

The large variety of architectural dimensions in automotive electronics design, for example, bus protocols, number of nodes, sensors and actuators interconnections and power distribution topologies, makes architecture design task a very complex but crucial design step especially for OEMs. This situation motivates the need for a design environment that accommodates the integration of a variety of models in a manner that enables the exploration of design alternatives in an efficient and seamless fashion. Exploring these design alternatives in a virtual environment and evaluating them with respect to metrics such as cost, latency, flexibility and reliability provide an important competitive advantage to OEMs and help minimize integration risks later in the design cycle. In particular, the choice of the degree of decentralization of the architecture has become a crucial issue in automotive electronics. In this paper, we demonstrate how a rigorous methodology (platform-based design) and the Metropolis framework can be used to find the balance between centralized and decentralized architectures

A platform is an abstraction layer that hides the details of several possible implementation refinements of the underlying layers. It is a library of elements characterized by models that represent their functionalities and offer an estimation of (physical) quantities that are of importance for the designer. The library contains interconnects and rules that define what are the legal composition of the elements. A legal composition of elements and interconnects is called a platform instance. Platform-based design is a meet-in-the-middle process, where successive refinements of specifications meet with abstractions of potential implementations that are captured in the models of the elements of the platform. It is this characteristic that makes platform-based design a novel design method. We argue for the importance of structuring precisely the platform layers and we discuss how to define formally the transitions from one platform to the next. In particular, we emphasize the interplay of top-down constraint propagation and bottomup performance estimation while illustrating the notion of articulation point in the design process. In this context, we study the key role played by the API platform together with the micro-architecture platform in embedded system design. Also, we report on three applications of platform-based design: at the system-level, we discuss network platforms for communication protocol design and fault-tolerant platforms for the design of safety-critical applications; at the implementation level, we present analog platforms for mixed-signal integrated circuit design.