For automotive systems it is not possible to efficiently determine the impact of changes on the functional safety of the system. A new impact analysis is presented in this work that provides a linear relation between the re-verification effort and the size of the change by still guaranteeing the safety of the device. The impact analysis uses a formal safety model using contracts to express fault containment properties and safety mechanisms. The specification means in this model have been developed to cover the needs from the functional safety concept of the ISO 26262. In contrast to other safety specifications we provide an abstraction technique, which allows the development of a system in a top-down manner. The semantics of the language are formally defined to allow automatic analyses. To compare the effectiveness of the analysis compared with the re-verify all technique, a stochastic simulation framework has been developed.

The distributed design process for safety-critical embedded systems has become an increasingly difficult challenge: Electronic Control Units (ECUs) in vehicles, for instance, participate in many vehicle functions, while each vehicle function, in turn, is spread across several ECUs. Many suppliers participate in systems design and many partial functions are reused from past projects, not always knowing the assumptions at the time of their development. In particular, efficient allocation of safety mechanisms and a sound safety case are difficult tasks for original equipment manufacturers (OEMs). Contract-based development has gained popularity as an approach for supporting distributed development by explicitly annotating assumptions and guarantees to components, but an integrated process covering specification of nominal behavior and safety has not been described so far. We present such an integrated development approach that encompasses the systematic breakdown of nominal system behavior using contracts, the consistent derivation of safety analysis by interpreting several types of contract violations as a specification for failure modes, and the subsequent integration of safety mechanisms that cover these failure modes through safety contracts. The approach equally fits hardware and software and is therefore applicable on the system level. We demonstrate it by an electric drive example. The extensibility of our approach towards Cyber Physical Systems, which compose themselves at runtime, is briefly outlined at the end of the article.

—Model-based design methodologies have become the standard approach to develop safety critical systems. Therefore, many approaches exist to model faults, failures and their propagation. Nevertheless, due to the frequent use of off-the-shelf components as well as the need to react efficiently on changes, the importance of modular and compositional techniques is gaining constantly. Here, we present an approach for compositional reasoning on safety specifications that supports multiple abstraction levels in the design process. Especially in the safety domain, it is obvious that a safety concept is just valid under certain conditions, e.g. that only a limited amount of components may fail at the same time. Therefore, we extend existing safety specification methods based on contracts, which explicitly distinguish between assumptions and guarantees, building a well-founded framework for compositional reasoning. Our formalization method can be used to develop a safety specification starting from the top level system component and refine it until the lower hardware and software layers while preserving the validity of early performed analyzes. On a practical level, we further describe how safety specifications can be formalized into a model checking problem and analyzed using existing tools.

Product line engineering is applied in many engineering domains. It is used to save development time by reusing system components in an organized way. While developing safety critical systems this approach is complicated by the fact, that safety concepts on higher abstraction levels need to be fulfilled by the different variants of the system. This typical leads to the creation of individual safety concepts for each variant or the analysis of the fulfillment of the safety concepts by all variants, both very costly efforts. In this paper we present an approach to enable multiple variants to use one common functional safety concept, while having different technical implementations at the low level. We specify safety properties such as potential faults and failure propagation as well as independence assumptions on them for the functional components as well as for technical ones. This information is used to create constraints for the variability models allowing only to configure safe variants. We focus on detecting the violation of independence assumption due to allocation decisions that are typically mainly driven by functional needs, disregarding safety properties. An implementation based on the tool pure::variants and the SAFE framework is presented that creates variants based on EAST-ADL and AUTOSAR.

Modular verification approaches have recently gained attention to enable cost efficient handling of changes in safety critical embedded systems. First results in this field are based on formal languages and iterative change processes to analyze the neighboring design elements of the change and thereby determine the effects of the change and possible inconsistencies. The alternative, being mostly applied in practice, is the complete re-verification of modules or even the whole product. In this paper we present simulation results comparing the effectiveness of both approaches by analyzing their effort of re-validation to regain a consistent set of requirements and implementations. As modular re-verification strategies execute only the needed analyzes, the effort progresses linearly with the number of necessary changes within the system. Consequently, we find that for a small number of changes this approach presents a huge saving in contrast to the commonly used approach of complete re-verification. Surprisingly, the critical portion of changes over the system size at which both approaches perform equally well is relatively small.

Fault-injection is a commonly used method for testing safety-relevant embedded systems. Especially after the introduction of the ISO 26262 the importance of this technique has gained attention in the automotive domain to test the proper implementation of safety concepts. To enable meaningful tests, the possible random hardware faults need to be aligned in early stages of the development process between the hardware and software developers. Since it is difficult to reason that a system nominal behavior is not affected by the injected fault-code, we aim at an automatic injection of faults into the software units using an AUTOSAR tool-chain. An extension in the AUTOSAR design tool is proposed in order to capture fault definitions that shall be used to automatically create trigger-able defects in the behavioral models designed with SIMULINK/Targetlink. As first results, it is demonstrated how to integrate faults in Targetlink to be able to use AUTOSAR simulation environments without any further changes to perform fault-injection tests. Furthermore, automatically generated test-vectors from requirements are used to trigger the fault injection at runnable level.

Verification techniques for analyzing the design or requirements at early development stages are used since the beginning of the model-based design paradigm. Most of these analyses are focused on a single purpose, like safety, real-time, or geometry. This separation of concerns leads to the introduction of so called aspects that describe these properties of a system. Nevertheless, these aspects are not necessarily independent. In this paper we use the fault tolerance time interval, the maximum time to recover from faults, as an example to state the need for a multi-aspect analysis. We present how a virtual integration test can be performed covering safety and real-time properties to prove the correct refinement of requirements. Our requirements formalization approach using contracts, a pattern language and the internal representation as timed automata are described. The presented technique is applied to an automotive lane-keepingsupport system.

The interoperability of tools and methods is a topic being currently discussed across all engineering domains of embedded systems. The increasing amount of requirements on interoperability demands a common understanding of design artifacts which needs to be accessible beyond tool boundaries. Furthermore, to support safety related development, a framework to integrate verification and validation activities has to be established. This eases early design decisions and provides support for certification processes.

Current safety standards like the ISO 26262 require a continuous safety argumentation starting from the initial hazard and risk assessment, down to the implementation of hardware and software. To enable re-use of components and ease handling of changes in the system, modular safety cases are addressed by many research projects. Current approaches are focusing on hierarchical safety specifications describing the relevant fault propagation behavior. Nevertheless, it needs to be ensured that the final implementation meets the safety specification. Currently, this is at most a manual and error prone process of matching fault trees or test results to the specification. In this paper, we present an automated approach based on fault-injection and model checking for proving the compliance of an implementation to a safety specification. In our multi-aspect analysis, (safety and functional aspect) we rely on the popular specification mechanism of safety contracts and implementations modeled in Matlab/Stateflow.

Changes in parts of a safety critical system typically require the re-verification of the whole system design. In this paper we present a change management approach that contains the effects of a change within a region of the system. The approach guarantees to maintain the integrity of the system while performing changes. Our approach directly integrates verification and validation activities in the process. Furthermore, the propagation of changes is not based on the interfaces of the components and their interconnections, but exploits the knowledge of the behavior described by the requirements. This approach creates a much more precise set of affected system artifacts. In addition, we propose techniques to analyze the propagation of changes automatically based on formalized requirements and guide the selection of suitable compensation candidates.

It is mandatory to design safety relevant embedded systems in multiple structural system views. A typical example is the usage of a functional and technical system representation. A transition between these system views not only comprises the allocation of components but also copes with multiple design aspects and constraints that need to be transferred to the target perspective. Optimization goals regarding arbitrary design artifacts complicate this problem. In this paper we present a novel comprehensive approach integrating common allocation techniques together with a partial design generation in a system wide process to optimize complex system view transitions. We demonstrate our approach using the CESAR design methodology. The original system models and requirements are used as input for our procedure and the results are directly applied to the same models.

The CESAR project1 aims at elaborating a Reference Technology Platform usable across several application domains (Aeronautics, Automotive, Industrial Automation, Railway and Space) for the cost effective development and validation of safety related embedded systems. Safety and, more generally, dependability are therefore major topics addressed by the project. This paper focuses on the work performed on safety requirements and approaches to be supported by a common Reference Technology Platform. We analyse and compare the industrial practice, applicable standards and state of the art so as to identify which and how safety views should be supported. This is achieved in particular through the incorporation of the necessary safety concepts in the CESAR Meta Model. We then focus on the major axes investigated by the project, formal model-based techniques for requirements engineering and component-based engineering. Incremental realisations and case studies confirm the interest and provide refined requirements for the final version of the platform.

Virtualization has become a key technology in the design of embedded systems. Within the scope of virtualization, emulation is a central aspect to overcome the limits induced by the heterogeneity of complex distributed embedded systems. Most of the techniques developed for the desktops and servers are not directly applicable to embedded systems due to their strict timing requirements. We will show the problems of existing emulation methods when applying them to embedded real-time systems and will propose a metric to determine the worst-case overhead caused by emulation. Based on this metrics we then propose an emulation method minimizing the worst-case overhead.