Dirk Ziegenbein

AutoMoDe - Notations, Methods, and Tools for Model-Based Development of Automotive Software

This paper describes the first results from the AutoMoDe project (Automotive Model-based Development), where an integrated methodology for model-based development of automotive control software is being developed. The results presented include a number of problem-oriented graphical notations, based on a formally defined operational model, which are associated with system views for various degrees of abstraction. It is shown how the approach can be used for partitioning comprehensive system designs for subsequent implementation-related tasks. Recent experiences from a case study of an engine management system, specific issues related to reengineering, and the current status of CASE-tool support are also presented.

AutoMoDe - Model-Based Development of Automotive Software

The paper describes first results from the AutoMoDe (automotive model-based development) project. The projects overall goal is to develop an integrated methodology for model-based development of automotive control software, based on problem-specific design notations with an explicit formal foundation. Based on the existing AutoFOCUS framework (Huber, F. et al., 1997), a tool prototype is being developed in order to illustrate and validate the key elements of our approach.

Timing-aware control software design for automotive systems

The underlying theories of both control engineering and real-time systems engineering assume idealized system abstractions that mutually neglect central aspects of the other discipline. Control engineering theory, on the one hand, usually assumes jitter free sampling and constant input-output latencies disregarding complex real-world timing effects. Real-time engineering theory, on the other hand, uses abstract performance models that neglect the functional behavior, and derives worst-case situations that have little expressiveness for control functionalities in physically dominated automotive systems. As a consequence, there is a lot of potential for a systematic co-engineering between both disciplines, increasing design efficiency and confidence. In this paper, we discuss possible approaches for such a co-engineering and their current applicability to real world problems. In particular, we compare simulation-based and formal verification techniques for various construction principles of automotive real-time control software.

System-level timing feasibility test for cyber-physical automotive systems

For automotive systems there is a mismatch between worst-case timing analysis models and the perceived reality, diminishing their relevance, especially for the automotive powertrain domain. Strict worst-case guarantees are rarely needed in the powertrain domain. The reason is that a large amount of functionality is control software and this can tolerate sporadic deadline misses. For instance, certain control approaches can systematically account for sampling losses and still prove whether or not the controller is stable and adheres to required performance criteria. Typical worst-case analysis (TWCA) tackles this problem by providing formal guarantees on typical response-times including upper bounds on the number of violations of these. In this paper, we derive a system-level timing feasibility test exploiting the robustness of control applications based on TWCA. We extend the TWCA to cope with periodic tasks that have varying execution times. Taking the robustness of control applications into account, we derive upper bounds for the overload models of each task, along with possible typical worst-case execution times (TCET), as needed for the TWCA. We then use this information to find a feasible typical-case configuration such that all deadlines are reached and all robustness constraints are satisfied. To verify the approach and show the expressiveness, we apply it on a performance model of a full-blown modern engine management system provided by Bosch.

Demo Abstract: Demonstration of the FMTV 2016 Timing Verification Challenge

The complex dynamic behavior of automotive software systems, in particular engine management, in combination with emerging multi-core execution platforms, significantly increased the problem space for timing analysis methods. As a result, the risk of divergence between academic research and industrial practice is currently increasing. Therefore, we provided a concrete automotive benchmark for the Formal Methods for Timing Verification (FMTV) challenge 2016 (https://waters2016.inria.fr/challenge/), a full blown performance model of a modern engine management system (downloadable at http://ecrts.eit.uni-kl.de/forum/viewtopic.php?f=27&t=62), with the goal to challenge existing timing analysis approaches with respect to their expressiveness and precision. In the demo session we will present the performance model of the engine management system using the Amalthea tool (http://www.amalthea-project.org/). Furthermore, we will show the model in action using professional timing tools such as from Symtavision (https://www.symtavision.com/), Timing Architects (http://www.timing-architects.com/), and Inchron (https://www.inchron.de/). Thereby, the focus will lie on determining tight end-to-end latency bounds for a set of given cause-effect chains. This is challenging since the dynamic behavior of a engine management software is quite complex and contains mechanisms that explore the limits of existing academic approaches: preemptive and cooperative priority based scheduling; periodic, sporadic, and engine synchronous tasks; multi-core platform with distributed cause-effect chains including cross-core communication; label (i.e. data) placement dependent execution times of runnables Overall the demo gives an impression of the current state-of-practice in industrial product development, and serves as baseline for further academic research.

Splitting tasks for migrating real-time automotive applications to multi-core ECUs

Real-time automotive software becomes increasingly complex due to the integration of more functionalities. At the same time, the computation power of electronic control units grows by increasing the number of cores instead of the core performance. Thus, in the near future a single task will require more computation power than a single core can offer. We propose an approach that solves this problem by splitting a task into multiple parallel task partitions with minimal synchronization overhead while maintaining all data dependencies of the functionalities inside the original task. The approach is successfully validated on a real-world engine management system.

Response Time Analysis for Fixed Priority Servers

In the automotive domain, existing scheduling primitives do not suffice for complex integration scenarios involving heterogeneous applications with diverse timing requirements. Thus, there is a renewed interest to establish server based scheduling as a mainstream scheduling paradigm in automotive software development and to that end, we provide a response time analysis that provides tighter bounds than the existing state-of-the-art approaches for a system containing deferrable and periodic servers. Our proposed approach can also analyze periodic tasks with offsets and tasks with backlogged activations. We further perform experiments on LITMUSRT in order to demonstrate the tightness of the proposed response time analysis.

Model-based development of Autosar application software

Today, control algorithms of electronic in-vehicle functions are implemented on networked control units with differing software architectures. Special effort is needed when integrating software components from different sources, which limits the reusability of automotive embedded software. This Etas paper focuses on the advantages of model-based development and describes the reengineering of an engine management system as an example.