Als Voraussetzung für die Musterzulassung eines Luftfahrzeugs unterliegt die Avioniksystementwicklung strengen behördlichen Regularien. Mit geeigneten Prozessvorgaben wird erreicht, dass ein Flugzeug die dafür erforderliche Betriebssicherheit besitzt. Allerdings entsteht dadurch ein hoher Entwicklungsaufwand, der durch die permanent steigende Systemkomplexität verschärft wird. Deshalb sind geeignete Methoden erforderlich, um in diesem Kontext die gewünschte Produktqualität bei beherrschbaren Kosten gewährleisten zu können. Im vorliegenden Beitrag werden als Beispiele für aktuelle Herausforderungen in der Entwicklung neben der Produktkomplexität die bisher manuell durchgeführten Tätigkeiten zur Allokation von Softwarekomponenten auf Hardwareelemente aufgegriffen. Letztere sind besonders für die Migration bisher monolithischer Software auf Mehrkernprozessoren relevant, womit allerdings hoher Arbeitsaufwand, Fehleranfälligkeit und Qualitätsunsicherheit verbunden sind. Als Lösung wird ein modellbasierter Ansatz vorgeschlagen, welcher durch Einführung von semantisch reichhaltigen, domänenspezifischen Modellen („viewpoints“) eine übersichtliche Darstellung und effiziente Bearbeitung selbst komplexer Systeme ermöglicht und durch die formale Untermauerung für hohes Automatisierungspotenzial (etwa zur Prüfung oder Synthese von Artefakten) sorgt. So wird am Beispiel des Allokationsproblems demonstriert, wie, basierend auf den eingeführten „viewpoints“, existierende Explorationskonzepte genutzt werden können, um automatisch fehlerfreie und optimale Lösungen für komplexe Probleme zu identifizieren. Der Transfer in die industrielle Praxis wird durch eine prototypische Implementierung eines Werkzeugs beschrieben. Abgeschlossen wird der Beitrag mit Vorschlägen für weitere Arbeiten.

Military capability is increasingly determined by software. Yet defence platforms are procured on decade-long timescales, while the software and AI models they carry must evolve in days or hours. This paper calls this mismatch the lifecycle paradox, and argues it is the central problem Software-Defined Defence (SDD) must solve. SDD rests on three dimensions: software and systems engineering (design, procurement, certification), AI engineering (sovereignty and trust of learned components), and connectivity and infrastructure engineering (timely exchange of information among sensors, AI, and operators). The proposed path to resilient SDD starts from civilian technologies, addressed through a continuous, DevOps-style loop: model-based systems engineering and simulation-based testing front-load design and verification; tactical connectivity and low-power edge execution carry that design into contested operation; continuous compliance, assurance, and variability management run as cross-cutting concerns. This loop is sustainable given capabilities already proven in automotive, manufacturing, space, and energy. The next step is validating them under adversarial or defence-certified conditions, with short-, medium-, and long-term paths to closing gaps. Closing the SDD gap while preserving civic benefits is a distributed responsibility: researchers must redirect methods toward adversarial conditions; industry must expose tooling to operational needs; policymakers must shape regulatory instruments; and defence agencies must validate results with operators. Recommendations span three horizons: a short-term baseline of adversarial testing and connectivity pilots; a medium-term pipeline of incremental certification; and a long-term validation closing the loop under operational conditions.

The same failure mode, injected into the same component of the same Cyber-Physical System (CPS) may or may not reveal a residual fault depending only on the parametrization of the tested failure scenario: This is shown in Part 10, Clause 8 of the ISO 26262 standard. Hence, when performing Fault Injection (FI) testing to assess the functional correctness, accuracy, and timing of safety mechanisms, it is essential to determine the "worst-case" scenarios in a typically high-dimensional, unbounded, and continuous parameter space. These scenarios are commonly influenced by intricate interactions among system components and between the system and its environment, and are thus known to change with each modification to the system under test. As a result, manually created FI test suites tend to be error-prone, sub-optimal, and expensive to maintain. In contrast, automated FI Test Case Generation (TCG) approaches have already proven to be effective in identifying potentially unsafe behavior of CPS while significantly reducing manual effort. However, given the lack of systematic methodologies for the application of such techniques in real-world development environments, we set to understand how FI TCG can be applied in continuous development, integration, and testing processes. Based on our findings, we propose a methodology for encoding the generation of "worst-case" FI test cases as an optimization problem to which generic optimization approaches can be applied. We apply this methodology to assess two of the safety mechanisms safeguarding the TTTech Auto MotionWise automotive middleware. Using search-based TCG in a Hardware-in-the-Loop (HiL) setup, we demonstrate how it supports the identification of highly challenging FI test cases and increases confidence in the absence of residual faults with minimal manual effort.

Companies increasingly rely on Model-Based Systems Engineering to develop Cyber-Physical Systems such as cars, aircraft, or medical devices. The quality of engineering model artifacts is key to efficient collaboration in systems engineering with multi-tier supply chains. Ensuring model artifact quality and comprehensibility for practitioners is challenging. Manual reviews are time- and cost-intensive and subject to bias, whereas existing automated methods based on syntactical rules and model metrics are limited in scope. The paper presents work towards swift quality feedback to system engineers during modeling. The concept allows domain and project-specific context and is applicable to industry-size model artifacts. We implement a data-driven estimation that combines automated model metric extraction with expert quality assessments. We leverage the system model version history from an open-source miniature automotive demonstrator. We assess the model versions' comprehensibility and showcase a semi-automated pipeline to initiate a model quality estimator. We achieve an average accuracy of 0.94 with a random forest approach on our test data.

Autonomous vehicles handle complicated tasks that may lead to harm when performed incorrectly. These harms, in particular when caused by system faults, may be avoided by the deployment of safety architectural patterns, such as the Heterogeneous Duplex pattern. Our goal is to provide safety engineers with computer-aided support for synthesizing architectures with safety architecture patterns. To this end, we build on our previous work in which we proposed a model-based system engineering plugin to enable the model-driven approach using safety architecture patterns. This article proposes a toolchain for synthesizing the structure and switching logic of safety architectures, as well as for validating them through simulation-based fault-injection. We validate our toolchain using an industrial use-case for autonomous driving systems, namely, a Highway Pilot system.

The adoption of autonomous cars requires operational critical functions even in the event of HW faults and/or SW defects, and protection of safety-critical functions against security threats. Defining appropriate safe and secure architectures is challenging and costly. In previous work, we have proposed tools to automate the recommendation of safety and security patterns for safety-critical systems. However, safety and security measures may (negatively) influence system performance, besides introducing additional development effort. We present a design space exploration approach, a model-based engineering workflow and tool prototype for automated guidance on trade-off decisions when applying safety and security patterns on a given (unsafe) baseline architecture. Based on models that abstract the vehicle’s functionality and its software and hardware components, as well as an engine for the automated pattern recommendation, we investigate the optimization of HW/SW deployments, and provide a trade-off analysis for different architecture candidates. We implemented our approach in an open-source tool and evaluate it with a model of the Apollo autonomous driving platform.

This paper reports on a study of transferring a desktop-based model-based engineering tool to a web application. The study has been conducted in the WEBMODEL project where the well-established technology stack around the Eclipse platform and the Eclipse Modeling Framework was lifted into a cloud-based environment. As results, a modeling language independent tooling kernel for web-based modeling tools and a minimal prototypical web-based implementation of the AutoFOCUS 3 model-based engineering tool are presented. Furthermore, the report documents experiences and implementation advises gained during the implementation.

While the adoption of Service-Oriented Architectures (SOA) eases the implementation of features such as autonomous driving and over-the-air updates, it also increases the vehicle's exposure to attacks that may place road-users in harm. To address this problem, standards (ISO 21434/UNECE) expect manufacturers to produce security arguments and evidence by carrying out appropriate threat analysis. As key threat analysis steps, e.g., damage/threat scenario and attack path enumeration, are often carried out manually and not rigorously, security arguments lack precise guarantees, e.g., traceability w.r.t. safety goals, especially under system updates. This article proposes automated methods for threat analysis using a model-based engineering methodology that provides precise guarantees with respect to safety goals. This is accomplished by proposing an intruder model for automotive SOA which together with the system architecture and the loss scenarios identified by safety analysis are used as input for computing assets, impact rating, damage/threat scenarios, and attack paths. To validate the proposed methodology, we developed a faithful model of the autonomous driving functions of the Apollo framework, a widely used open-source autonomous driving stack. The proposed machinery automatically enumerates several attack paths on Apollo, including attack paths not reported in the literature.

: Safety architecture patterns are abstract representations to address faults in the system architecture. In the current state of practice, the decision of which safety architecture pattern to deploy and where in the system architecture is carried out manually by a safety expert. This decision may be time consuming or even lead to human errors. This paper presents Safety Pattern Synthesis, a tool for automating the recommendation of safety architecture patterns during the design of safety-critical systems: 1) Safety Pattern Synthesis recommends patterns to address faults in the system architecture (possibly resulting in more than one architectural solution), 2) the user selects the system architecture with patterns based on, e.g., the criteria provided by Safety Pattern Synthesis, and 3) Safety Pattern Synthesis provides certain requirements that shall be considered in the overall safety engineering process. The proposed tool has been implemented as a plugin in the model-based system engineering tool called AutoFOCUS3. Safety Pattern Synthesis is implemented in Java while using a logic-programming engine as a backend to reason about the safety of the system architecture. This paper provides implementation details about Safety Pattern Synthesis and its applicability in an industrial case study taken from the automotive domain.

Tools for creating safety cases currently on the market target safety experts, whose main concern is the management of safety cases. However, for safety assurance, safety experts should collaborate with technical experts, who have better understanding of technical and operational hazards. Thus, there should be a closer collaboration between the management of safety cases and technical expertise. Technical expertise may be retrieved, among others, from model-based system artifacts and processes. In order to close the gap between safety and technical expertise, we present ExplicitCase, an open-source tool for semi-automatic modeling, maintenance, and verification of safety cases integrated with system models. The advantage of this tool is two-fold. First, it enables its users to capture safety relevant information from model-based artifacts into safety cases. Second, it makes the safety cases rationale available to engineers in order to help them reason about design choices, while minding safety concerns. We evaluate the approach and the implemented tool based on the experiences obtained in a project use case.

Safety-critical applications could benefit from the standardisation, cost reduction and cross-domain suitability of current heterogeneous computing platforms. They are of particular interest for Mixed-Criticality Product Lines (MCPL) where safety- and non-safety functions can be deployed on a single embedded device using suitable isolation artefacts and development processes. The development of MCPLs can be facilitated by providing a reference architecture, a model-based design, analysis tools and Modular Safety Cases (MSC) to support the safety claims.

Mixed-criticality systems (MCS) aim at boosting the integration density in safety-critical systems, resulting into efficient systems, while simultaneously providing increased performance. The DREAMS project provides a cross-domain architectural style for MCS based on networked, virtualized multi-cores controlled by hierarchical resource managers. However, the availability of a platform is only one side of the coin: deploying mixed-critical applications to shared resources typically requires design-time configurations (e.g., to ensure real-time constraints or separation constraints mandated by safety regulations). These configurations are the outcome of complex optimization problems which are intractable in a manual process that also hardly can guarantee the consistency of all deployable artefacts nor their traceability to the requirements. However, existing toolchains lack support for MCS integration, and particularly DREAMS' advanced platform capabilities. We present an integrated model-driven toolchain and the underlying metamodels covering all relevant aspects of MCS including applications, timing, platforms, deployments, configurations and annotations for extra-functional properties such as safety. The approach focuses on the left branch of the V-cycle, and ranges from product-line and design space exploration to resource allocation and configuration generation. We report on the integration of exploration tools and a reconfiguration graph synthesizer, and evaluate the resulting toolchains in two use cases consisting of a product-line of wind power control applications and an avionic subsystem respectively.

Mixed-Criticality Systems (MCS) reconcile safety-critical requirements with multi-core architectures, by offering spatial and temporal isolation while preserving other extrafunctional properties such as optimised energy consumption or minimised latencies. MCS designers struggle to manually balance the offered functionalities with pertinent implementation choices in order to ensure that the system eventually meets all constraints. Existing attempts to further automate this process focus on specific concerns, and fail to account for variation in system functionalities. Our contribution is to integrate product-lines that capture functional variations with evolutionary optimisation to explore possible implementations and their impact on extra functional properties. Our solution is a model-driven process (and a tool prototype) to automatically select functionally different products that balance well the various concerns of interest. We illustrate how this process applies to the construction of wind turbines. Moving toward product-lines eventually contributes to reduce high development costs and the long time to market associated with MCS.

The solution of many engineering and scientific problems requires the exploration of a huge n-dimensional design space. Typical approaches rely on an abstract problem model consisting of a system model (description of the problem's variable couplings) and an optimization specification defining the objectives as well as the constraints bounding the design space. Advances in solver technologies enabled to efficiently search the solution space, however the diversity of the approaches led to problem descriptions that are difficult to reuse, as well as to solutions that are hard to compare. Our Exploration Meta-Model (EMM) addresses this issue by providing a unified language for optimization specifications that is a well-defined basis for model-based implementations of solver-independent design-space exploration (DSE) tool-chains. The EMM is a light-weight framework that allows to a) describe optimization specifications independent of particular optimization methods and solvers, b) relate solutions and optimization specifications, and c) define domain profiles that provide high-level optimization specifications that ease the adoption of automated DSE by domain experts. The applicability of our framework to different optimization methods is demonstrated by applying it to the generic vector optimization problem and to single-objective linear programs. The EMM's support to relate optimization results to input specifications is exercised for the Opt4J framework. Finally, a profile for real-time embedded systems demonstrates how the EMM can be tailored to specific domains.

This paper presents a model-driven framework that provides a tool-supported design flow for fault-tolerant embedded systems. Its system models comprise abstract descriptions of the application and the underlying execution platform. They provide the input to our analysis and optimization techniques that enable the automated exploration of design alternatives for applications with reliability requirements. The automated generation of source code and platform configuration files speeds up the development process. Our contribution is to advance reliability-aware design further into practice by providing an integrated tool framework and removing unrealistic assumptions in the analyzes. The case studies demonstrate the effectiveness of our approach.

Multicore-Prozessoren bieten sich in der Automatisierung vor allem zur Integration von Steuerungsprogrammen und somit zur Reduktion der Anzahl von Steuergeraten an. Insbesondere wenn es um sicherheitskritische Anwendungen geht, ist dabei allerdings zu gewahrleisten, dass die verschiedenen Anwendungen hinreichend voneinander separiert sind. Die modellbasierte Entwicklung leistet hier wertvolle Unterstutzung.

Modellbasierte Entwicklung ist ein zunehmend popularer Ansatz, um der wachsenden Komplexitat eingebetteter Anwendungen zu begegnen. Eine besondere Herausforderung besteht in der Berucksichtigung nicht-funktionaler und zeitlicher Anforderungen (z.B. Kommunikation, Safety, Energieverbrauch), deren Erfullung ein nahtloses Zusammenspiel der Hardware, der verschiedenen Ebenen der Systemsoftware und der Anwendungssoftware bedingt. Die vorliegende Arbeit schlagt vor, die Abhangigkeiten der Hardware/-Software-Schichten mit einem Dienstmodell zu beschreiben. Dieses Modell umfasst einerseits die Kapselung funktionaler Abhangigkeiten zwischen verschiedenen Systemebenen (Peripherietreiber, Taskausfuhrung, Kommunikation, etc.); andererseits beinhaltet es die Spezifikation nicht-funktionaler Eigenschaften in Form von Garantien durch den Dienstanbieter sowie in Form von Anforderungen durch die Bindung an einen Dienst. Beide Aspekte kommen bei der Verfeinerung einer Applikation bis hin zu einer plattformspezifischen Implementierung zum Tragen. Die spezifizierten nicht-funktionalen Abhangigkeiten konnen dabei als Ausgangspunkt fur Analysen dienen (z.B. Mapping, Scheduling), deren Ergebnisse fur die automatische Erzeugung von Programmcode genutzt werden konnen. Diese Arbeit prasentiert neben einem geeigneten Metamodel auch eine Taxonomie von Diensten fur die Entwicklung eingebetteter Systeme und validiert den vorgeschlagenen Ansatz in einer Fallstudie.

While robot systems become more and more elaborate, the need to simplify programming them grows as well. Regarding the high degree of internal heterogeneity in the sense that different microcontroller platforms, protocols and performance layers are used in a single robot application, it is not feasible to have specialists dedicated to each individual task. This motivates the need for tool support that allows an abstract view on a robot’s sensors and actuators,means to program individual components as well as to define their interaction. In this work, we present how the model-based development and code generation tool EasyLab can be extended to support programming of all parts of a robot, including the main controller as well as peripheral devices like smart sensors. We show three typical use cases in the context ofmobile platforms and highlight EasyLab’s advantages in each domain.