The integration of connected and autonomous technologies in safety-critical and cyber-physical systems offers great potential in the vital application domains of transportation, manufacturing and aerospace. These technological advancements are necessary to meet the increasing demand for intelligent services, as they open doors to new business models by analysing and sharing the generated data. However, where this sharing of mix-critical data and broader connectivity brings opportunities, it simultaneously presents serious cybersecurity and safety risks due to the cyber-physical nature of these systems. Hence, delivering these intelligent services securely, safely, and reliably to its consumers is a complex engineering and design problem. One of the ways to approach this engineering problem is to consider both system functional and non-functional properties (safety, security, reliability) and systematically integrate them across system design and operational life cycle. The XANDAR project investigates this approach and aims to develop holistic software design methods and architectures for safety-critical and cyber-physical systems that guarantee functional and non-functional properties “byconstruction”. This paper focuses on the non-functional aspects of the project and discusses the preliminary work. by presenting the core cybersecurity principles and uses them as a baseline to propose a holistic cybersecurity engineering process. The tasks of the proposed cybersecurity engineering process are also map onto relevant clauses of ISO 21434. In future, proposed work will be integrated into the XANDAR software toolchain and validated for an avionics situation perception pilot assistance and automotive autonomous driving use cases.

Realizing desired properties "by construction" is a highly appealing goal in the design of safety-critical embedded systems. As verification and validation tasks in this domain are often both challenging and time-consuming, the by-construction paradigm is a promising solution to increase design productivity and reduce design errors. In the XANDAR project, partners from industry and academia develop a toolchain that will advance current development processes by employing a model-based X-by-Construction (XbC) approach. XANDAR defines a development process, metamodel extensions, a library of safety and security patterns, and investigates many further techniques for design automation, verification, and validation. The developed toolchain will use a hypervisor-based platform, targeting future centralized, AI-capable high-performance embedded processing systems. It is co-developed and validated in both an avionics use case for situation perception and pilot assistance as well as an automotive use case for autonomous driving.

Considering the design of safety-critical embedded systems for future mobility solutions, the XANDAR project employs the X-by-Construction paradigm to meet non-functional requirements in an automated manner. This paper introduces the pattern library concept developed as part of the project and analyzes three state-of-the-art safety mechanisms for their compatibility with the approach.

Safety-critical real-time systems must be carefully designed to guarantee both functional and temporal correctness. State-of-the-art approaches to achieve this are often based on formal notations capturing both the desired functionality and relevant timing properties. This work is concerned with the design of embedded software systems for emerging fields such as the Urban Air Mobility (UAM) sector. In this context, it deals with scenarios that benefit from a less formal programming model, but for which guarantees on functional and timing behavior must still be provided. We propose a concept to specify and simulate the behavior of embedded real-time software in a deterministic manner. It combines the Logical Execution Time (LET) paradigm with a flexible, code-based approach for behavior specification and performs discrete-event (DE) simulations to determine how exactly the designed system responds to given stimuli. We describe this concept, present a reference implementation using Ptolemy II as simulation backend, and discuss its application to a pilot assistance system from the UAM sector.

The next generation of networked embedded systems (ES) necessitates rapid prototyping and high performance while maintaining key qualities like trustworthiness and safety. However, development of safety-critical ES suffers from complex software (SW) toolchains and engineering processes. Moreover, the current trend in autonomous systems, which relies on Machine Learning (ML) and AI applications when combined with fail-operational requirements renders the Verification and Validation (V&V) of these new systems a challenging endeavor. Prime examples are Advanced Driver-Assistance Systems (ADAS) that are prone to various safety/security vulnerabilities. The XANDAR project aims at developing a mature SW toolchain (from requirements analysis to the actual code integration on target including V&V) fulfilling the needs of industry for rapid prototyping of interoperable and autonomous ES. Starting from a model-based system architecture, XANDAR will leverage automatic model synthesis and software parallelization techniques to achieve specific non-functional requirements setting the foundation for a novel (real-time, safety-, and security)-by-Construction paradigm.

Due to various trends in the automotive sector, such as autonomous driving and electrification, the number of Electric/Electronic (E/E) components has risen in both hardware and software. This has led to an increase in certification requirements, which cannot be fulfilled without simulation anymore [1]. Different approaches have emerged trying to master this issue. However, for supporting early design decisions in the E/E development, these are either domain-specific or too elaborate. In this paper, we demonstrate an approach to realize early design decisions through a cross-domain simulation of E/E architectures, regarding the environment, scenarios, vehicle physics, the scheduling of software components and the power supply net. We use static E/E architecture hardware models, consisting of Electronic Control Units (ECUs), sensors, actuators and the wiring harness, as the base for the structure of our simulation models. The individual E/E components are linked to parameterizable simulation model templates to facilitate scalable execution. Moreover, scenarios are used for model reduction and supply the simulation model with stimuli. The simulation model is synthesized in an automated manner. For the evaluation, we simulate the power consumption of an electric vehicle, dependent on different loads. It shows that considering hardware aspects in early design phases uncovers errors that would have been noticed much later, e.g. when using virtual Hardware In the Loop (vHIL) methods. We also investigate the scalability of our approach. As E/E architecture modeling tool, we use Vector PREEvision and for the simulation Mathworks Simulink.

Future computing architectures will host increasing numbers of cores while also moving toward specialized architectures and accelerators. This development strains hardware and software design, verification, and system validation efforts. This letter introduces a virtual platform (VP) centered design flow that not only enables early software development but also considers a solution for the challenges on hardware and system level. As a core element, a hybrid prototyping framework targeting networks-on-chip (NoC) links for interfacing a VP and a field-programmable gate array provides scalability and accuracy for hardware verification and system validation.

The trend towards more parallelism in information processing is unbroken. Manycore architectures provide both massive parallelism and flexibility, yet they raise the level of complexity in design and programming. Prototyping of such architectures helps in handling this complexity by evaluating the design space and discovering design errors. Several system simulators exist but they can only be used for early software development and interface specification. FPGA-based prototypes on the other hand are restricted by available FPGA resources or expensive multi-FPGA prototyping platforms. We present a hybrid prototyping approach for manycore systems that consists of an FPGA-part and a virtual part of the architecture on a host system. The hybrid prototyping requires less FPGA resources while retaining its speed advantage and enabling flexible modeling in the virtual platform. We describe the concept, provide an analysis of timing accuracy and synchronization of the FPGA with the Virtual Platform (VP) and show an example in which the hybrid prototype is used for feature development and evaluation of a scientific manycore architecture. The hybrid prototype allows us to evaluate a 7 × 7 architecture on a Virtex-7 XC7VX485T FPGA board which otherwise could only fit a reduced 2 × 2 design of our architecture.

Hardware multicast (one-to-many communication) support in Networks on Chips (NoCs) is beneficial for a wide range of applications. Multicast traffic is seen in applications using coherency protocols in distributed shared-memory systems, neural network implementations and fault-tolerant applications using redundant hardware components. In this paper, we present a dynamic and scalable runtime block-based multicast routing mechanism for mesh NoCs. In the proposed technique, a block of potential destinations is defined at runtime and a bit vector is used to give fine-grained control over destination addresses inside the target block. Since the block size is defined at runtime, dynamic mapping of bit vector index onto the nodes within the block is implemented. This provides a degree of flexibility for applications to dynamically change the block size at runtime when the number of destinations changes. Due to this concept, address overhead incurred is less especially when targeting large scale mesh based networks. For a 4×4 NoC with 6 destinations a 33% decrease in address overhead is seen and a 79% decrease is seen for 128×128 NoC when targeting 16 destinations. We implement this technique on a Virtex 7 FPGA and test it using traffic seen in fault tolerant applications implementing redundancy.

In this paper we present a novel Network Adapter (NA) for packaged-based Network-on-Chips. It is suitable for hard real-time and safety-critical applications. The NA we present has a low footprint low latency behavior. In contrast to state of the art we tightly couple a Message Passing Interface and a DMA Unit to achieve better real-time results. A WCTT analysis is provided for real-time applications.

Scalable communication and low latency memory accesses are the deciding factors for future manycore performance. An efficient hardware infrastructure is required, since raw performance must be balanced with area and power constraints. In distributed shared-memory (DSM) architectures, caches help in reducing costly remote accesses but must be kept coherent. To enable scalable coherence in manycore systems, the recently proposed region-based cache coherence defines configurable regions, i.e. cache coherent sub-sections of a manycore architecture. In this paper, a technique for supporting the region-based cache coherence mechanism by using so called in-NoC circuits (INCs) in a hybrid networks-on-chip is proposed. These circuits are automatically established based on traffic monitoring and traffic analysis to connect nodes (i.e. routers) in the network to enable a shortcut for packets, reducing their latency. The INCs can be used by packets stemming from different sources and targeting different destinations in contrast to traditional end-to-end circuits. Depending on the coherence region, our evaluations of several benchmarks show a latency reduction of up to 45% on average in a 4x4 mesh that further increases with the mesh size. The FPGA synthesis of a router from a scientific DSM architecture that was extended with the presented features shows additional costs of up to 31% more LUTs and 20% more Flip Flops.

Heterogeneous architectures featuring multiple hardware accelerators have been proposed as a promising solution for meeting the ever-increasing performance and power requirements of embedded systems. However, the existence of numerous design parameters may result in different architectural schemes and thus in extra design effort. To address this issue, OpenCL-based frameworks have been recently utilized for FPGA programming, to enable the portability of a source code to multiple architectures. However, such OpenCL frameworks focus on RTL design, thus not enabling rapid prototyping and abstracted modeling of complex systems. Virtual Prototyping aims to overcome this problem by enabling the system modeling in higher abstraction levels. This article combines the benefits of OpenCL and Virtual Prototyping, by proposing an OpenCL-based prototyping framework for data-parallel many-accelerator systems, which (a) creates a SystemC Virtual Platform from OpenCL, (b) provides a co-simulation environment for the host and the Virtual Platform, (c) offers memory and interconnection models for parallel data processing, and (d) enables the system evaluation with alternative real number representations (e.g., fixed-point or 16-bit floating-point).

Increasing performance requirements for cyber-physical systems in real-time applications raise the necessity to migrate to multi-core processor systems. However, commercial of the shelf multi-core systems are often inappropriate for the real-time domain and real-time capable multi-core programming models are rare. In this paper, we present a solution developed within the EU research project ARGO. By means of a predictability-enhanced NoC-based multi-/many-core architecture, we investigate hardware properties that can help to improve the predictability of the platform and the programming model. Both platform and programming model are complemented by a WCET-aware Architecture Description Language (ADL). This enables a certain degree of hardware abstraction while preserving the relevant details for accurate multi-core WCET analysis algorithms. Target platform and programming model are designed to be statically analyzable by multi-core WCET computation tools, that are part of the automated WCET-aware software parallelization tool flow developed in the ARGO project.

Networks on chips (NoCs) have become a promising candidate for communication in future many-core architectures. However, manufacturing defects and aging effects are expected to cause permanent errors in future technology nodes, which are targeted by NoC-based architectures. Consequently, fault tolerance concepts are necessary in order to deal with these permanent errors. In this work, we propose a novel approach for fault tolerance in NoC-based architectures. We introduce an additional network layer to take over the duties of defective routers. In contrast to existing approaches, the proposed concept is independent of the routing algorithm and can substitute the bandwidth of defective routers. In addition, we show the potential of the concept for power saving. An ASIC implementation of the proposed design is used for performance and power saving evaluation as well as for overhead analysis.

The increasing performance and power requirements in embedded systems has lead to a variety of heterogeneous hardware architectures, featuring many different types of processing elements. This heterogeneity however induces extra effort on system development and programming. To address this heterogeneity, OpenCL provides a portable programming model which enables the use of one source code in various architectures featuring different types of processors. Also, such systems impose higher design complexity due to the existence of an increased number of hardware components. Virtual Prototyping aims to alleviate this issue by enabling the hardware modeling in higher abstraction levels. This paper combines the benefits of OpenCL with Virtual Prototyping, by proposing an OpenCL-based framework for rapid prototyping, which (a) automatically derives a virtual prototype from an OpenCL code; (b) executes the OpenCL application by running the host program along with the hardware simulation; and (c) proposes a design flow for faster system evaluation, as compared to state-of-the-art FPGA-based flow. Using a set of OpenCL benchmarks, it is shown that the proposed framework enables faster prototyping by up to 18 x, as compared to state-of-the-art flow.

One challenge in developing complex software for embedded systems is the missing option of rapid prototyping in early stages of the development cycle. In this paper we present the use of the High Level Simulation Framework “Open Virtual Platforms” (OVP) for Software-in-the-Loop simulation of embedded control applications. Therefore, we investigate and evaluate different methods allowing the data exchange between the simulated platform and the host machine running the simulation environment. The insights we gain are used to design peripherals which appear to the simulated processor system like devices available on the targeted hardware platform and allow the access to files stored on the host machine on one hand, and the communication with hardware devices connected to the host on the other hand. In both cases the cross-compiled application code for the targeted embedded platform including the operating system (OS) and the hardware abstraction layer (HAL) can be executed by the virtual platform (VP) without any modifications. Additionally, we introduce a method for controlling the synchronization of OVP with the host, which can be used to either run simulations in fast motion mode, or to collaborate with hardware devices or other applications. The approach is verified with two use cases: (1) a motor control application processing data by accessing files and (2) an image processing application interacting with real hardware devices directly coupled with the virtual platform.