Simon Kramer

Extracting, specifying and predicting software system properties in component based real-time embedded software development

Bosch has established Component Based Software Development (CBSD) for automotive systems, which are resource constrained real-time embedded systems such as engine control systems. Classical CBSD approaches enable effective software reuse mainly in functional aspects by managing complexity with abstraction and encapsulation. However, to fully exploit the advantages of CBSD for real-time embedded systems, non-functional system properties such as timing and memory usage need to be addressed by the underlying component model. It is important that non-functional properties have a certain degree of precision to ensure hardware dimensioning and cost optimization for such systems. Static analysis methods used to extract or analyze nonfunctional properties (e.g., worst case execution time) in most cases introduce overestimation which is a hindrance for accurate prediction of non-functional properties. Therefore, accurate prediction of system properties requires specifying semantic context information such as modes in the component model to reduce overestimation. This paper describes how we extend the Bosch software component model to specify non-functional component properties with modes information. We demonstrate how mode dependent timing behavior is automatically extracted from the software, specified in the component specification and used for analysis and prediction in real-time embedded systems. This paper shows that semantic context information such as modes enhances performance analysis and prediction by ruling out infeasible worstcase situations that lead to overly conservative performance predictions.

Communication Centric Design in Complex Automotive Embedded Systems

Automotive embedded applications like the engine management system are composed of multiple functional components that are tightly coupled via numerous communication dependencies and intensive data sharing, while also having real-time requirements. In order to cope with complexity, especially in multi-core settings, various communication mechanisms are used to ensure data consistency and temporal determinism along functional cause-effect chains. However, existing timing analysis methods generally only support very basic communication models that need to be extended to handle the analysis of industry grade problems which involve more complex communication semantics. In this work, we give an overview of communication semantics used in the automotive industry and the different constraints to be considered in the design process. We also propose a method for model transformation to increase the expressiveness of current timing analysis methods enabling them to work with more complex communication semantics. We demonstrate this transformation approach for concrete implementations of two communication semantics, namely, implicit and LET communication. We discuss the impact on end-to-end latencies and communication overheads based on a full blown engine management system.

Demo Abstract: Demonstration of the FMTV 2016 Timing Verification Challenge

The complex dynamic behavior of automotive software systems, in particular engine management, in combination with emerging multi-core execution platforms, significantly increased the problem space for timing analysis methods. As a result, the risk of divergence between academic research and industrial practice is currently increasing. Therefore, we provided a concrete automotive benchmark for the Formal Methods for Timing Verification (FMTV) challenge 2016 (https://waters2016.inria.fr/challenge/), a full blown performance model of a modern engine management system (downloadable at http://ecrts.eit.uni-kl.de/forum/viewtopic.php?f=27&t=62), with the goal to challenge existing timing analysis approaches with respect to their expressiveness and precision. In the demo session we will present the performance model of the engine management system using the Amalthea tool (http://www.amalthea-project.org/). Furthermore, we will show the model in action using professional timing tools such as from Symtavision (https://www.symtavision.com/), Timing Architects (http://www.timing-architects.com/), and Inchron (https://www.inchron.de/). Thereby, the focus will lie on determining tight end-to-end latency bounds for a set of given cause-effect chains. This is challenging since the dynamic behavior of a engine management software is quite complex and contains mechanisms that explore the limits of existing academic approaches: preemptive and cooperative priority based scheduling; periodic, sporadic, and engine synchronous tasks; multi-core platform with distributed cause-effect chains including cross-core communication; label (i.e. data) placement dependent execution times of runnables Overall the demo gives an impression of the current state-of-practice in industrial product development, and serves as baseline for further academic research.