Electronic systems, like they are embedded in road vehicles, have to be compliant to functional safety standards like ISO 26262 [1], which limit the impacts of malfunctions for safety critical systems. ISO 26262, for instance, defines different safety levels for road vehicles, which require different means and measures for a safety compliant system and its development process like risk analysis and fault effect simulation. For fault effect simulation it is important to investigate the impact of physical and hardware related effects to the correct function of a system. This article first studies code and model mutations for fault injection in the context of fault effect simulation through different system abstraction levels. It demonstrates how high level mutations correlate to bit flips of software binaries by examples from the TriCore™ instruction set and finally presents a virtual platform based implementation for automated injection of bit flip based mutations into software binaries. Experimental results demonstrate the efficiency of the implemented approach.

This paper presents an advanced eight levels spanning SystemC based virtual platform methodology and framework - referred to as HeroeS3 - providing smooth application to platform mapping and continuous co-refinement of a virtual prototype with its physical environment model. For heterogeneity support, various SystemC extensions are combined covering continuous/discrete models of computation and different communication abstractions, such as analog mixed-signal models, abstract RTOS/HAL/middleware models, TLM bus models, and QEMU wrappers. We enable dependability assessment by Fault Effect Modeling (FEM) at the virtual prototype in order to avoid risking physical injury or damage. Also, simulation results are deterministic and can be evaluated interactively or offline. We apply FEM to both the physical environment model and the different abstractions of the virtual prototype. Currently, we focus on sensor failures and application control flow errors.

In this paper, we present an efficient approach to virtual platform modeling for TriCoreTMbased SoCs by combining fast and open software emulation with IEEE-1666 Standard SystemC simulation [9]. For evaluation we consider Infineon’s recently introduced AURIXTM processor family as a target platform, which utilizes multiple CPU cores operating in lockstep mode, memories, hierarchical buses, and a rich set of peripherals. For SoC prototyping, we integrate the fast and open instruction accurate QEMU software emulator with the TLMu library for SystemC co-verification [2]. This article reports our most recent efforts of the implementation of the TriCoreTM instruction set for QEMU. The experimental results demonstrate the functional correctness and performance of our TriCoreTM implementation. Keywords—HW/SW co-verification; software emulation; dynamic binary translation;

In this article, we present a virtual platform driven methodology for model-based design of dependable SW targeting cyber-physical systems. Our methodology covers an eight levels spanning flow for smooth refinement of discrete/continuous application models towards the implementation of distributed SW stacks providing flexibility w.r.t. early integration of object/binary code. For this, we propose multiple virtual platform abstraction levels supporting SW synthesis from high level MoCs. By continuous interfacing with a model of the physical environment in-the-loop we enable to holistically consider mutual impacts of the SW and its environment. In order to assess and improve SW dependability we investigate the injection of faults and their effects into both the environment model and the SW under test. We present a mapping of the proposed methodology to a completely SystemC-based framework by employing several SystemC extensions, such as AMS/TDF, QEMU, and abstract models of RTOS, HAL and middleware. Finally, we present experimental results from an automotive case study: a fault- tolerant fuel injection control system for which we consider two fault injection use cases: (i) robustness/stress testing and (ii) mutation testing. Our results were derived by prototypic integration of our SystemC framework with a commercial Simulink- based tool chain for AUTOSAR-compliant SW development and deployment.

In diesem Artikel stellen wir die Portierung der TriCore-Architektur des Prozessorherstellers Infineon auf den quelloffenen Prozessorund Systememulator QEMU vor. Dazu beschreiben wir die Modellierung der Befehlssatzarchitektur durch den dynamischen Binarubersetzer in QEMU und gehen auf TriCore-spezifische Details der QEMU-Portierung ein. Unsere aktuelle Implementierung umfasst eine Untermenge des TriCore-Befehlsatzes fur die Emulation im User-Mode. Erste Ergebnisse der Portierung zeigen wir anhand von Testprogrammen in Assembler und C. Durch einen direkten Verlgeich mit dem von Infineon bereitgestellten TSIM-Simulator konnten wir die Korrektheit unserer Portierung verifizieren und dabei bereits eine um bis zu 886-fache Ausfuhrungsbeschleunigung messen.

This article presents the HeroeS virtual platform driven methodology for embedded multi-core and real-time SW design. The methodology's focus is on early integration, testing and performance estimation of heterogeneous SW stacks, i.e., SW components and layers at mixed abstraction levels and/or targeting different instruction sets. We take into account current system-level methodologies such as Transaction Level Modeling (TLM) and Real-Time Operating System (RTOS) modeling. For this, a SystemC virtual platform framework is presented combining state of the art simulation techniques according to the proposed methodology. This includes host-compiled target SW abstraction, abstract RTOS and Hardware Abstraction Layer (HAL) models in SystemC, extended QEMU user and system mode emulation and TLM 2.0 bus models. Efficient but yet accurate performance estimates can be provided through static and dynamic annotation. We apply binary mutation testing, i.e, a test assessment and improvement approach for instruction level SW testing. Our approach was investigated by prototypical integration into a commercial AUTOSAR environment. Experimental results were obtained by an automotive case study: a fault-tolerant fuel injection control system, which is part of an in-car network.

This work proposes an advanced methodology based on an open source virtual prototyping framework for verification of complex Heterogeneous Embedded Systems (HES). It supports early rapid modelling of complex HES through smooth refinements, an open interface based on IP-XACT extensions for secure composition of HES components, and automatic testbench generation over different abstraction levels.

This paper presents a novel mutation based testing method through binary mutation. For this, a table of mutants is derived by control flow analysis of a disassembled binary under test. Mutations are injected at runtime by dynamic translation. Thus, our approach neither relies on source code nor a certain compiler. As instrumentation is avoided, testing results correspond to the original binary. In addition to high-level language faults, the proposed approach captures target specific faults related to compiling and linking. We investigated the software of an automotive case study. For this, a taxonomy of mutation operators for the ARM instruction set is proposed. Our experimental results prove 100% accuracy w.r.t. confidence metrics provided by conventional testing methods while avoiding significant mutant compilation overhead. Further speed up is achieved by an efficient binary mutation testing framework that relies on extending the open source software emulator QEMU.

This paper presents the XEMU framework for mutation based testing of embedded software binaries. We apply an extension of the QEMU software emulator, which injects mutations at run-time by dynamic code translation without affecting the binary software under test. The injection is based on a mutation table, which is generated by control flow graph (CFG) analysis of the disassembled code prior to its execution without presuming access to source code. We introduce our approach by the example of the ARM instruction set architecture for which a mutation taxonomy is presented. In addition to extending the testing scope to target specific low level faults, XEMU addresses the reduction of the mutants creation, execution, and detection overheads. Moreover, we reduce testing efforts by applying binary CFG analysis and constraint-based test generation for improved test quality. The experimental results of a car motor management software show significant improvements over conventional source code based approaches while providing 100% accuracy in terms of the computed test quality metrics.

The modeling and analysis of Cyber-Physical Systems (CPS) is one of the key challenges in complex system design as heterogeneous components are combined and their close interaction with the physical environment has to be considered. This article presents a methodology and an open toolset for the virtual prototyping of CPS. The focus of the methodology is the virtual prototyping of the embedded software combined with the prototyping of the physical environment in order to capture the complete closed control loop of the software over the hardware via sensors/actors with the physical objects. The methodology is based on the application of integrated open source tools and standard languages, i.e., C/C++, SystemC, and the Open Dynamics Engine, which are combined to a powerful simulation framework. Key activities of the methodology are outlined by the example of an electric two-wheel vehicle.

Virtual platforms are widely applied for embedded software protoyping and analysis. We introduce here an automatic annotation and estimation technique for the dynamic time analysis of embedded software. The annotation technique automatically inserts marks into the software, which can later be identified at assembler code level in order to back-annotate them with timing or power information. Our graph based technique applies automated labeling of basic blocks to aid in efficient construction of basic blocks for the disassembler. The graph is compacted for efficiency and a novel graph traversal technique is applied to estimate the flow cost. The timing estimates are later back annotated to the source code with the help of identifiers which are then used in SystemC simulations. Our technique can be easily deployed across variety of architectures as it is compiler-independent and does not implement any architecture specific features to estimate the time. The option to back-annotate the timing estimates avoids the requirement to recompile the entire model to get the same information before simulation.

Refinement of untimed TLM models into a timed HW/SW platform is a step by step design process which is a trade-off between timing accuracy of the used models and correct estimation of the final timing performance. The use of an RTOS on the target platform is mandatory in the case real-time properties must be guaranteed. Thus, the question is when the RTOS must be introduced in this step by step refinement process. This paper proposes a four-level RTOS-aware refinement methodology that, starting from an untimed TLMSystemC description of the whole system, progressively introduce HW/SW partitioning, timing, device driver and RTOS functionalities, till to obtain an accurate model of the final platform, where SW tasks run upon an RTOS hosted by QEMU and HW components are modeled by cycle accurate TLM descriptions. Each refinement level allows the designer to estimate more and more accurate timing properties, thus anticipating design decisions without being constrained to leave timing analysis to the final step of the refinement. The effectiveness of the methodology has been evaluated in the design of two complex platforms.

Dellacherie, S, Hofferek, G, Pravadelli, G, Bresolin, D, Bombieri, N, Di Guglielmo, L, Geretti, L, Villa, T, Perbellini, G, Roveri, M, Narasamdya, I, Quigley, R, Marques-Silva, J, Letombe, F, M¸ller, W, Becker, M & Hui-Bon-Hoa, C 2010, Final validation of the COCONUT flow and Tools Integration … Dellacherie S, Hofferek G, Pravadelli G, Bresolin D, Bombieri N, Di Guglielmo L et al. Final validation of the COCONUT flow and Tools Integration. ., 2010 … Dellacherie, Samuel ; Hofferek, Georg ; Pravadelli, Graziano ; Bresolin, Davide ; Bombieri, Nicola ; Di Guglielmo, Luigi ; Geretti, Luca ; Villa, Tiziano ; Perbellini, Giovanni ; Roveri, Marco ; Narasamdya, Iman ; Quigley, Rob ; Marques-Silva, Joao ; Letombe, Florian ; M¸ller, Wolfgang ; Becker, Markus ; Hui-Bon-Hoa, Christophe. / Final validation of the COCONUT flow and Tools Integration. ., 2010.

Refinement of untimed TLM models into a timed HW/SW platform is a step by step design process which is a tradeoff between timing accuracy of the used models and correct estimation of the final timing performance. The use of an RTOS on the target platform is mandatory in the case real-time properties must be guaranteed. Thus, the question is when the RTOS must be introduced in this step by step refinement process. This paper proposes a four-level RTOS-aware refinement methodology that, starting from an untimed TLMSystemC description of the whole system, progressively introduce HW/SW partitioning, timing, device driver and RTOS functionalities, till to obtain an accurate model of the final platform, where SW tasks run upon an RTOS hosted by QEMU and HW components are modeled by cycle accurate TLM descriptions. Each refinement level allows the designer to estimate more and more accurate timing properties, thus anticipating design decisions without being constrained to leave timing analysis to the final step of the refinement. The effectiveness of the methodology has been evaluated in the design of two complex platforms.

ion Level i A b s ra c io n R e in e m e n t Hybrid/discrete domain mapping P ro o f o f c o re c tn e s s A b s ra c io n R e in e m e n t P ro o f o f c o re c tn e s s Figure 1: The key idea of the COCONUT workbench Such activities will be implemented in a set of tools working on more than one abstraction level whose correctness will be formally proved. Each model/property can be refined to a lower abstraction level or abstracted to a higher abstraction level, and verification should not be only a post-refinement step, but it should guide the design with a correct-by-construction methodology. 1.2 Modeling and Verification Requirements The COCONUT flow must address several high-level requirements on both the modelling and the verification aspects of embedded platform design and configuration. These requirements are the ultimate goals that have driven all the methodology and tools developments achieved during the COCONUT project by all partners. These requirements can be expressed as follows: Requirement #1: Define a methodology, supported by tools, to identify system requirements for platform modelling and verification by identifying a connection between hybrid and discrete domains. Requirement #2: Provide a methodology to express useful properties at the hybrid and TLM domains, validate their consistency and completeness and use them for semi-automatically synthesizing critical components. Requirement #3: Improve and integrate different techniques in a novel modelling environment operating at both hybrid and discrete domains, based on correct-byconstruction abstraction/refinement of models and properties. Requirement #4: Integrate dynamic and static post-refinement verification around a coherent assertion-based approach.

Seamless HW/SW codesign flows support early verification of hardware and Hardware-dependent Software (HdS) like drivers, operating systems, and firmware. For early estimation and verification, the application of SystemC in combination with Instruction Set Simulators and Software Emulators like QEMU is widely accepted. In this article, we present an advanced design flow for HW, (RT)OS and HdS refinement and verification with focus on the transition from abstract RTOS verification to full system RTOS/HdS emulation. In the context of assertion-based verification, we introduce a set of generic real-time properties which can be reused and verified at different abstraction levels and discuss their application. The properties are presented by the means of IEEE standard PSL assertions which are applied for mixed SystemC/HdS models.

In this article, we present a flexible simulation environment for embedded real-time software refinement by a mixed level cosimulation. For this, we combine the native speed of an abstract real-time operating system (RTOS) model in SystemC with dynamic binary translation for fast Instruction Set Simulation (ISS) by QEMU. In order to support stepwise RTOS software refinement from system level to the target software, each task can be separately migrated between the native execution and the ISS. By adapting the dynamic binary translation approach to an efficient but yet very accurate synchronization scheme the overhead of QEMU user mode execution is only factor two compared to native SystemC. Furthermore, the simulation speed increases almost linearly according to the utilization of the task set abstracted by the native execution. Hereby, the simulation time can be considerably reduced by cosimulating just a subset of tasks on QEMU.

RTOS simulation RTE execution time estimation System modeling Hardware topology Software architecture Network comm. System integration System e.g. component supplier, component development depart. e.g. car manufacturer, system development depart. Abbildung 7: Entwurfsraumexploration im erweiterten AUTOSAR-Entwurf mit abstrakter RTOS-Simulation 4 Implementierung und Evaluierung Fur die Evaluierung der Methodik haben wir unsere abstrakte RTOS-Bibliothek prototypisch in die Werkzeugkette der AUTOSAR-Entwicklungsumgebung (Integrated Development Environment, IDE) dSPACE SystemDesk integriert. Dazu haben wir unsere abstrakte RTOS-Bibliothek zu einer konkreten AUTOSAR-ECU-Bibliothek erweitert. Auf dieser Basis haben wir eine SystemCSimulation fur Windows mit einer XML-Konfigurationsschnittstelle implementiert. Die Checkpoints zur Instrumentierung der ECU-Software haben wir mit der CodeUberdeckungsanalyse von dSPACE TargetLink platziert. Die segmentierte ECU-Software laden wir als DLL (Dynamic Link Library) in unsere RTOS-Simulation. Die Ausfuhrungszeiten haben wir durch Messungen auf einem Infineon C167-Evaluierungsboard ermittelt. Abbildung 8 zeigt unsere prototypische Werkzeugkette fur die zeitgenaue RTOS-Simulation.

This paper presents an adaptive near-optimal scheduler for multimedia traffic for the 802.11e Enhanced Distributed Channel Access (EDCA) medium access control scheme: The scheduler exploits the ant colony optimization (ACO) meta heuristic to tackle the challenge of packet scheduling. ACO is a biologically inspired algorithm that is known to find near-optimal solutions for combinatorial optimization problems. Thus, we expect that ACO scheduling produces more efficient schedules than comparable deterministic scheduling approaches at the expenses of a computational overhead it introduces. We compare ACO scheduling relevant deterministic scheduling approaches, and in particular the MLLF scheduler that is specifically designed for the needs of compressed multimedia applications. The purpose of the evaluation is twofold. It allows to draw conclusions on the feasibility of ACO scheduling for multimedia traffic while it serves as a benchmark to determine to what extent deterministic schedulers fall short of a near-optimal solution.