Ulrich Freund

Correct-by-Construction Transformations across Design Environments for Model-Based Embedded Software Development

Embedded software design for real time reactive systems has become the bottleneck in their market introduction into complex products such as automobiles, airplanes, and industrial control plant. In particular, functional correctness and reactive performance are increasingly difficult to verify. The advent of model-based design methodologies has alleviated some of the verification-related problems by making the code-generation process flow automatically from the model description. Given the relative infancy of this approach, several companies rely upon design flows based on different tools connected together by file transfer. This way of integrating tools defeats the very purpose of the methodology, introducing a high potential of errors in the transformation from one format to another and preventing formal analysis of the properties of the design. We propose to adopt a formal transformation across different tools and we give an example of this approach by linking two tools that are widely used in the automotive domain, Simulink and ASCET. We believe that this approach can be applied to any embedded software design flow to leverage the power of all the tools in the flow.

AutoMoDe - Notations, Methods, and Tools for Model-Based Development of Automotive Software

This paper describes the first results from the AutoMoDe project (Automotive Model-based Development), where an integrated methodology for model-based development of automotive control software is being developed. The results presented include a number of problem-oriented graphical notations, based on a formally defined operational model, which are associated with system views for various degrees of abstraction. It is shown how the approach can be used for partitioning comprehensive system designs for subsequent implementation-related tasks. Recent experiences from a case study of an engine management system, specific issues related to reengineering, and the current status of CASE-tool support are also presented.

AutoMoDe - Model-Based Development of Automotive Software

The paper describes first results from the AutoMoDe (automotive model-based development) project. The projects overall goal is to develop an integrated methodology for model-based development of automotive control software, based on problem-specific design notations with an explicit formal foundation. Based on the existing AutoFOCUS framework (Huber, F. et al., 1997), a tool prototype is being developed in order to illustrate and validate the key elements of our approach.

Architecture Centric Modeling of Automotive Control Software

Within the automotive industry model-based specification techniques are the basis for the definition of seamless design processes allowing the complete, the consistent, and the unambiguous specification of software and hardware parts of car specific networks of control units. For a successful application, those modeling approaches have to give methodical support for adequately capturing the architecture in the targeted system class. In our opinion most standard modeling languages leave room for improvement exactly at this point. Therefore we develop a modeling language characterized by the following features: (1) architecture centric modeling, (2) domain-specificity, and (3) close relation to standard modeling languages. Within this article we introduce the Automotive Modeling Language (AML) by illustrating a case study which comprises parts of the body car electronics within a car. Architecture related modeling concepts are discussed in detail by showing the correlation between their UML representation and their ASCET-SD representation.

Mulit-level system integration based on AUTOSAR

The design of distributed embedded real-time system is a challenging task. Besides solving the control-engineering issues, one has to consider real-time scheduling, reliability and production requirements w.r.t. production cost of the electronic control unit (ECU). This has a considerable impact on the employed software design techniques. These design techniques are well known in the automotive software industry, but are applied with different flavors at each vehicle manufacturer and their suppliers. This situation has changed considerably with the results of the AUTOSAR development partnership, which unifies the flavors of automotive software design. Automotive software design is embedded in the so-called V-Cycle of embedded automotive system development[1]. It starts with the requirements analysis which results later on in a model of the control algorithm. The control algorithm is tested against a vehicle model and establishes the topmost level in system integration. The second system integration level is the adaptation of the control algorithm to be run on a rapid-prototyping system. The rapid-prototyping system is integrated into an existing E/Earchitecture. The E/E-architecture consists of the ECUs connected by networks like CAN or FlexRay and gateways. Sensors- and actuators being used by several control algorithms are coupled to an ECU, which might propagate signals to other ECUs via a vehicle network. From the software point of view, the controlalgorithm has now to respect real-time scheduling and the quantization of the sensor- and actuator signals, no matter whether these signals are generated on the rapid-prototyping system or exchanged via the bus with other ECUs. Further development steps in the V-cycle are the software implementation, the ECU- and the network integration. The integrated ECUs and networks are tested against vehicle models running on Hardware-in-the-loop (HiL) systems. If this works fine, the ECUs are integrated in the real vehicle for calibration. The software implementation and the ECU integration are deeply influenced by AUTOSAR. AUTOSAR is a development partnership of all stakeholders in the automotive software development (e.g. vehicle manufacturers and their suppliers) which unifies several software implementation techniques[2]. It describes a common ECU software architecture[3] consisting of configurable basic software modules (BSW), a runtime environment (RTE) and a software component description[4]. The software component description describes the interfaces for dataexchange as well as the access points for the RTE. The basic idea of consisting of interconnected software components which are later mapped to an E/E-architecture. Currently, the VFB structure of AUTOSAR software architectures is mainly driven by the next generation E/E-architectures. The VFB structure forms the third system integration level. The next integration step into an AUTOSAR environment is the integration of the rapid-prototyping tested control algorithm to AUTOSAR software components. Since most VFB descriptions use fixed-point interfaces, the control algorithm has to be transformed to fixed-point arithmetic. If the control algorithm is modelled in tools like ASCET, this conversion can be achieved by code-generation. The same holds true for control algorithms already being used in E/E-architectures without an AUTOSAR software architecture. The VFB-description with the control-algorithms forms the fourth system integration level, which can be simulated with plant-models on a PC by tools like INTECRIO-VP. The fifth system integration level is given by the mapping process as defined in the AUTOSAR methodology[5] and requires the configuration of the RTE and the BSW modules for a single ECU. At this integration level, one can perform HiL testing and calibration in the same way as for non-AUTOSAR systems. Several evaluation projects, e.g. [6] and [7], have shown that the multi-level integration approach is feasible to guide the configuration capabilities of AUTOSAR software architectures.

Modellbasierte Entwicklung von Autosar-Anwendungssoftware

Die Steuerungs- und Regelungsalgorithmen elektronischer Funktionen sind heute auf vernetzten Steuergeraten mit unterschiedlichen Software-Architekturen implementiert. Gleichzeitig erfordert die Integration von Softwarekomponenten aus unterschiedlichen Quellen hohen Aufwand, was die Wiederverwendung von Embedded Software einschrankt. Der Beitrag von Etas erlautert Vorteile der modellbasierten Entwicklung und beschreibt beispielhaft das Reengineering eines Motormanagementsystems.

Representation of automotive software description means in ASCET

Embedded automotive real-time software is developed according to the V-Cycle. The control engineers start with the so-called function development where they specify the control-algorithm. This control-algorithm transforms input signals to output signal reflecting also the state variables and parameters. A software engineer partitions the control-algorithm to executable software components, which are then transformed to C-code with a code-generator

Model-based development of Autosar application software

Today, control algorithms of electronic in-vehicle functions are implemented on networked control units with differing software architectures. Special effort is needed when integrating software components from different sources, which limits the reusability of automotive embedded software. This Etas paper focuses on the advantages of model-based development and describes the reengineering of an engine management system as an example.

Model-Based Design & Rapid Prototyping

Abstract Mastering complexity of embedded automotive systems while not compromising quality is one of the main research topics in embedded systems. The SEA-Design Chain based on rich component models provides early validation results for nonfunctional properties of embedded automotive systems. While rapid prototyping systems are well established for early functional validation, they will assume an additional role in the SEA-Design Chain in validating architectural models used for the ECUs microcontroller specification.