This article announces the first public release ofan experimental research tool for variability management,called “CVM framework” and provides an overview of thetool’s capabilities and architecture.

DySCAS is a dynamically self-configuring middleware for automotivecontrol systems. The addition of autonomic, context-aware dynamic configurationto automotive control systems brings a potential for a wide range of benefits in termsof robustness, flexibility, upgrading etc. However, the automotive systems representa particularly challenging domain for the deployment of autonomics concepts, havinga combination of real-time performance constraints, severe resource limitations,safety-critical aspects and cost pressures. For these reasons current systems are staticallyconfigured. This paper describes the dynamic run-time configuration aspectsof DySCAS and focuses on the extent to which context-aware adaptation has beenachieved in DySCAS, and the ways in which the various design and implementationchallenges are met.

This chapter describes DySCAS: an advanced autonomic platform-independent middleware framework for automotive embedded systems. The concepts and architecture are motivated and described in detail, focusing on the need for, and achievement of, high flexibility and automatic run-time reconfiguration. The design of the middleware is positioned with respect to the way it overcomes the specific technical, environmental, and performance challenges of the automotive domain. Self-management is achieved in terms of automatic configuration for context-aware behavior, resource-use efficiency, and self-healing to handle run-time detected faults. The self-management is governed by the use of policies distributed throughout the middleware components. The simulation techniques that have been used for extensive validation are described and some key results presented. A reference implementation is presented, illustrating the way in which the various concepts and mechanisms can be realized and orchestrated.

Embedded software systems in vehicles are of rapidly increasing commercial importance for the automotive industry. Current systems employ a static run-time environment; due to the difficulty and cost involved in the development of dynamic systems in a high-integrity embedded control context. A dynamic system, referring to the system configuration, would greatly increase the flexibility of the offered functionality and enable customised software configuration for individual vehicles, adding customer value through plug-and-play capability, and increased quality due to its inherent ability to adjust to changes in hardware and software. We envisage an automotive system containing a variety of components, from a multitude of organizations, not necessarily known at development time. The system dynamically adapts its configuration to suit the run-time system constraints.This paper presents our vision for future automotive control systems that will be regarded in an EU research project, referred to as DySCAS (Dynamically Self-Configuring Automotive Systems). We propose a self-configuring vehicular control system architecture, with capabilities that include automatic discovery and inclusion of new devices, self-optimisation to best-use the processing, storage and communication resources available, self-diagnostics and ultimately self-healing. Such an architecture has benefits extending to reduced development and maintenance costs, improved passenger safety and comfort, and flexible owner customisation.Specifically, this paper addresses the following issues: The state of the art of embedded software systems in vehicles, emphasising the current limitations arising from fixed run-time configurations; and the benefits and challenges of dynamic configuration, giving rise to opportunities for self-healing, self-optimisation, and the automatic inclusion of users’ Consumer Electronic (CE) devices. Our proposal for a dynamically reconfigurable automotive software system platform is outlined and a typical use-case is presented as an example to exemplify the benefits of the envisioned dynamic capabilities.

This paper proposes a vehicular control system architecture that supports self-configuration. The architecture is based on dynamic mapping of processes and services to resources to meet the challenges of future demanding use-scenarios in which systems must be flexible to exhibit context-aware behaviour and to permit customization. The architecture comprises a number of low-level services that will provide the required system functionalities, which include automatic discovery and incorporation of new devices, self-optimisation to best-use the processing, storage and communication resources available, and self-diagnostics. The benefits and challenges of dynamic configuration and the automatic inclusion of users' Consumer Electronic (CE) devices are briefly discussed and the self-management and control-theoretic technologies that will be used are described in outline. A number of generic use-cases have been identified, each with several specific use-case scenarios. To demonstrate the extent of the flexible reconfiguration facilitated by the architecture, some of these use-cases are described, each exemplifying a different aspect of dynamic reconfiguration.

This paper presents an advanced dynamically configurable middleware for automotive embedded systems. The layered architecture of the middleware, and the way in which core and optional services provide transparency and flexible platform independent support for portability, is described. The design of the middleware is positioned with respect to the way it overcomes the specific technical, environmental, performance and safety challenges of the automotive domain. The use of policies to achieve flexible run-time configuration is explained with reference to the core policy technology which has been extended and adapted specifically for this project. The component model is described, focussing on how the configuration logic is distributed throughout the middleware and application components, by inserting ‘decision points’ wherever deferred logic or run-time context-sensitive configuration is required. Included in this discussion are the way in which context information is automatically provided to policies to inform context-aware behaviour; the dynamic wrapper mechanism which isolates policies, provides transparency to software developers and silently handles run-time errors arising during dynamic configuration operations.

Advanced functionalities unthinkable a few decades ago are now being introduced into automotive vehicles through embedded systems for reasons like emission control, vehicle connectivity, safety and cooperative behaviors. As the development often involves stakeholders from different engineering disciplines and organizations, the complexity due to shared requirements, interdependencies of data, functions, and resources, as well as tight constraints in regards to timing, safety, and resource efficiency makes the system integration, quality control and assurance, reuse and change management increasingly more difficult. This calls for a more rigorous approach to the development of automotive embedded systems and components. This paper describes the CESAR reference technology platform (RTP) that supports the formalization of various engineering concerns in the development of safety-relevant embedded systems and thereby a model-based integration of various tools and methods to form seamless environments or toolchains for the development of such systems.

Context: Exploratory Testing (ET) is a manual approach to software testing in which learning, test design and test execution occurs simultaneously. Still a developing topic of interest to academia, although as yet insufficiently investigated, most studies focus on the skills and experience of the individual tester. However, contextual factors such as project processes, test scope and organisational boundaries are also likely to affect the approach.

Objective: This study explores contextual differences between teams of testers at a MedTec firm developing safety-critical products to ascertain whether contextual factors can influence the outcomes of ET, and what associated implications can be drawn for test management.

Method: A development project was studied in two iterations, each consisting of a quantitative phase testing hypotheses concerning when ET would identify faults in comparison to other testing approaches and a qualitative phase involving interviews.

Results: Influence on ET is traced to how the scope of tests focus learning on different types of knowledge and imply an asymmetry in the strength and number of information flows to test teams.

Conclusions: While test specialisation can be attractive to software development organisations, results suggest changes to processes and organisational structures might be required to maintain test efficiency throughout projects: the responsibility for test cases might need to be rotated late in projects, and asymmetries in information flows might require management to actively strengthen the presence and connections of test teams throughout the firm. However, further research is needed to investigate whether these results also hold for non safety-critical faults.

The transition from engineering student to early career engineer is often difficult as not all skills that constitute effective engineering practice are formally taught. Work placements are suggested as a solution by providing opportunities to learn skills that academia is unable to teach. However, academic requirements for skills such as research proficiency can be overlooked in a work placement environment, since they are often seen as of little value to engineers. Nevertheless, through interviews with master’s students that have conducted their thesis projects at a firm, their experience of boundary spanning to align academic and industrial requirements has been shown to prepare them for an (early) career in engineering by providing opportunities to learn informal professional skills. As the effect is moderated by the motivation of the individual firm for offering work placements, teachers need to consider this motivation when planning and preparing a student for such a work placement.

Master students at our institute were graduating without acceptable research proficiency. We intervened by shifting our research training from teaching-centred to student-centred, and from research-related subject content to research-related processes. We performed a mixed methods study aimed to confirm there was improved research proficiency without a negative trade-off for our students’ engineering skills. Results indicated improvements to research proficiency, which our students were able to transfer to engineering-related learning activities to increase their ability to achieve engineering synthesis. This outcome was potentially supported by our courses including several perspectives on scientific knowledge production. This implies that research training, rather than having a negative effect on engineering skills, can be helpful in learning diametrically opposing aspects of thinking required by current engineering. As engineering education evolves towards more cross-disciplinary cooperation, this implies the need to pursue the increased opportunities for students to learn about different perspectives on knowledge production.

Heavy commercial vehicles constitute the dominant form of inland freight transport. There is a strong interest in making such vehicles autonomous (self-­‐driving), in order to improve safety and the economics of fleet operation. Autonomy concerns affect a number of key systems within the vehicle. One such key system is brakes, which need to remain continuously available throughout vehicle operation. This paper presents a fail-­‐operational functional brake architecture for autonomous heavy commercial vehicles. The architecture is based on a reconfiguration of the existing brake systems in a typical vehicle, in order to attain dynamic, diversified redundancy along with desired brake performance. Specifically, the parking brake is modified to act as a secondary brake with capabilities for monitoring and intervention of the primary brake system. A basic fault tree analysis of the architecture indicates absence of single points of failure, and a reliability analysis shows that it is reasonable to expect about an order of magnitude improvement in overall system reliability.

The increasing usage of electronics and software in a modern automobile enables realization of many advanced features. One such feature is autonomous driving. Autonomous driving means that a human driver’s intervention is not required to drive the automobile; rather, theautomobile is capable of driving itself. Achieving automobile autonomyrequires research in several areas, one of which is the area of automotive electrical/electronics (E/E) architectures. These architectures deal with the design of the computer hardware and software present inside various subsystems of the vehicle, with particular attention to their interaction and modularization. The aim of this thesis is to investigate how automotive E/E architectures should be designed so that 1) it ispossible to realize autonomous features and 2) a smooth transition canbe made from existing E/E architectures, which have no explicit support for autonomy, to future E/E architectures that are explicitly designed for autonomy.The thesis begins its investigation by considering the specific problem of creating autonomous behavior under cooperative driving condi-tions. Cooperative driving conditions are those where continuous wireless communication exists between a vehicle and its surroundings, which consist of the local road infrastructure as well as the other vehicles in the vicinity. In this work, we define an original reference architecture for cooperative driving. The reference architecture demonstrates how a subsystem with specific autonomy features can be plugged into an existing E/E architecture, in order to realize autonomous driving capabilities. Two salient features of the reference architecture are that it isminimally invasive and that it does not dictate specific implementation technologies. The reference architecture has been instantiated on two separate occasions and is the main contribution of this thesis. Another contribution of this thesis is a novel approach to the design of general, autonomous, embedded systems architectures. The approach introduces an artificial consciousness within the architecture, that understands the overall purpose of the system and also how the different existing subsystems should work together in order to meet that purpose.This approach can enable progressive autonomy in existing embedded systems architectures, over successive design iterations.

Highly automated driving systems promise increased road traffic safety, as well as positive impacts on sustainable transportation by means of increased traffic efficiency and environmental friendliness. The design and development of such systems require scientific advances in a number of areas. One area is the vehicle's electrical/electronic (E/E) architecture. The E/E architecture can be presented using a number of views, of which an important one is the functional view. The functional view describes the decomposition of the system into its main logical components, along with the hierarchical structure, the component inter-connections, and requirements. When this view captures the principal ideas and patterns that constitute the foundation of a variety of specific architectures, it may be termed as a reference architecture. Two reference architectures for highly automated driving form the principal contribution of this thesis. The first reference architecture is for cooperative driving. In a cooperative driving situation, vehicles and road infrastructure in the vicinity of a vehicle continuously exchange wireless information and this information is then used to control the motion of the vehicle. The second reference architecture is for autonomous driving, wherein the vehicle is capable of driver-less operation even without direct communication with external entities. The description of both reference architectures includes their main components and the rationale for how these components should be distributed across the architecture and its layers. These architectures have been validated via multiple real-world instantiations, and the guidelines for instantiation also form part of the architecture description. A comparison with similar architectures is also provided, in order to highlight the similarities and differences. The comparisons show that in the context of automated driving, the explicit recognition of components for semantic understanding, world modeling, and vehicle platform abstraction are unique to the proposed architecture. These components are not unusual in architectures within the Artificial Intelligence/robotics domains; the proposed architecture shows how they can be applied within the automotive domain. A secondary contribution of this thesis is a description of a lightweight, four step approach for model based systems engineering of highly automated driving systems, along with supporting model classes. The model classes cover the concept of operations, logical architecture, application software components, and the implementation platforms. The thesis also provides an overview of current implementation technologies for cognitive driving intelligence and vehicle platform control, and recommends a specific setup for development and accelerated testing of highly automated driving systems, that includes model- and hardware-in-the-loop techniques in conjunction with a publish/subscribe bus. Beyond the more "traditional" engineering concepts, the thesis also investigates the domain of machine consciousness and computational self-awareness. The exploration indicates that current engineering methods are likely to hit a complexity ceiling, breaking through which may require advances in how safety-critical systems can self-organize, construct, and evaluate internal models to reflect their perception of the world. Finally, the thesis also presents a functional architecture for the brake system of an autonomous truck. This architecture proposes a reconfiguration of the existing brake systems of the truck in a way that provides dynamic, diversified redundancy, and an increase in the system reliability and availability, while meeting safety requirements.

This report deals with the technical solution that was implemented for the Grand Cooperative Driving Challenge (GCDC) 2011. The GCDC involved developing a system to drive a vehicle autonomously in specific situations. Some reflections on the design process are also included. The goal of the report is to make the user understand the technical solution and the motivations behind the design choices made.

This chapter provides insights into architecture and systems engineering for autonomous driving systems, through a set of complementary perspectives. For practitioners, a short term perspective uses the state of the art to define a three layered functional architecture for autonomous driving, consisting of a vehicle platform, a cognitive driving intelligence, and off-board supervisory and monitoring services. The architecture is placed within a broader context of model based systems engineering (MBSE), for which we define four classes of models: Concept of Operations, Logical Architecture, Application Software Components, and Platform Components. These classes aid an immediate or subsequent MBSE methodology for concrete projects. Also for concrete projects, we propose an implementation setup and technologies that combine simulation and implementation for rapid testing of autonomous driving functionality in physical and virtual environments. Future evolution of autonomous driving systems is explored with a long term perspective looking at stronger concepts of autonomy like machine consciousness and self-awareness. Contrasting these concepts with current engineering practices shows that scaling to more complex systems may require incorporating elements of so-called \emph{constructivist} architectures. The impact of autonomy on systems engineering is expected to be mainly around testing and verification, while implementations shall continue experiencing an influx of technologies from non-automotive domains.

Machines are displaying a trend of increasing autonomy. This has a far reaching impact on the architectures of the embedded systems within the machine. The impact needs to be clearly understood and the main obstacles to autonomy need to be identified. The obstacles, especially from an industrial perspective, are not just technological butalso relate to system aspects like certification, development processes and product safety. In this paper, we identify and discuss some of the main obstacles to autonomy from the viewpoint of technical specialists working on advanced industrial product development. The identified obstacles cover topics like world modeling, user interaction, complexity and system safety.

The use of embedded computers in modern automobiles is enabling increasingly autonomous features. Electronic power train management and applications in active safety, cooperative driving and navigation show an underlying trend of the transfer of responsibilities from the human driver to a vehicle's (semi-)autonomous subsystems. The logical culmination ofthis trend would be a completely autonomous vehicle. How should existing vehicle architectures be evolved to sustain the development and growth of autonomous functions? We explore the principal problems with existing architectures, caused due to ad hoc addition of (semi-) autonomous features and argue that it is time to rethink automotive architectures from an autonomous systems perspective. We introduce a pattern that can help architects and designers to think in terms of autonomy and suggest where the application of autonomous systems thinking should begin, in the context of architecture development.

Context

As autonomous driving technology matures towards series production, it is necessary to take a deeper look at various aspects of electrical/electronic (E/E) architectures for autonomous driving.

Objective

This paper describes a functional architecture for autonomous driving, along with various considerations that influence such an architecture. The functionality is described at the logical level, without dependence on specific implementation technologies.

Method

Engineering design has been used as the research method, which focuses on creating solutions intended for practical application. The architecture has been refined and applied over a five year period to the construction of protoype autonomous vehicles in three different categories, with both academic and industrial stakeholders.

Results

The architectural components are divided into categories pertaining to (i) perception, (ii) decision and control, and (iii) vehicle platform manipulation. The architecture itself is divided into two layers comprising the vehicle platform and a cognitive driving intelligence. The distribution of components among the architectural layers considers two extremes: one where the vehicle platform is as "dumb" as possible, and the other, where the vehicle platform can be treated as an autonomous system with limited intelligence. We recommend a clean split between the driving intelligence and the vehicle platform. The architecture description includes identification of stakeholder concerns, which are grouped under the business and engineering categories. A comparison with similar architectures is also made, wherein we claim that the presence of explicit components for world modeling, semantic understanding, and vehicle platform abstraction seem unique to our architecture.

Conclusion

The concluding discussion examines the influences of implementation technologies on functional architectures and how an architecture is affected when a human driver is replaced by a computer. The discussion also proposes that reduction and acceleration of testing, verification, and validation processes is the key to incorporating continuous deployment processes.

Cooperative driving systems enable vehicles to adapt their motion to the surrounding traffic situation by utilizing information communicated by other vehicles and infrastructure in the vicinity. How should these systems be designed and integrated into the modern automobile? What are the needed functions, key architectural elements and their relationships? We created a reference architecture that systematically answers these questions and validated it in real world usage scenarios. Key findings concern required services and enabling them via the architecture. We present the reference architecture and discuss how it can influence the design and implementation of such features in automotive systems.

This specification of the EAST ADL 2.0 is based on the EAST-ADL developed in the EAST EEA projectand has been further refined and harmonized with on-going modelling appraches in the automotiveindustry. It presents the modeling infrastructure, i.e. how the modeling elements should be represented inthe language and the UML representation. For each package a usage example is provided.The EAST-ADL 2.0 is harmonized with AUTOSAR.The metamodel and UML profile of EAST ADL 2.0 is defined in two steps: A domain (automotive)metamodel is defined, capturing only the domain specific needs of the language, without adding the UML2details. The basic concepts of UML are used for this purpose, such as classes, compositions andassociations. Based on the domain metamodel, a UML2 profile for the domain metamodel is defined,specifying stereotypes with properties and constraints.Comments on the content of this document are welcomed, and should be directed to <coordinator@atesst.org>.Please download the latest available specification and the XMI file ready for use in UML2 tools from the <atesst.org> website.

The development of embedded systems is typically supported by a number of diverse development tools. To achieve seamless tool support throughout the embedded systems development process, tool chains are constructed as software solutions that integrate the development tools. Tool chains have grown from ad-hoc solutions to complex software systems, since they need to support distributed engineering, integration conventions, a specific set of tools and the complete product development process used in a company. In practice, the development of tool chains that fulfill these needs is difficult and time-consuming, since it is a largely unsupported, manual engineering task. In addition, tool chains are typically described using general purpose modeling languages or languages borrowed from other domains, which contributes to the accidental complexity of tool chain development. Due to the increasing sophistication and size of tool chains, there is a need for a systematic, targeted description and development approach for tool chains.

This thesis contributes with a language for the systematic description of tool chains and semi-automated techniques to support their development.

The Tool Integration Language (TIL) is a domain-specific modeling language (DSML) for tool chains that allows describing tool chains explicitly, systematically and at an appropriate level of abstraction. TIL concepts are from the domain of tool integration and express the essential design decisions of tool chains at an architectural level of abstraction. A TIL model serves as a basis for the development of a tailored tool chain.

Semi-automated techniques for the specification, analysis and synthesis support the development of tool chains that are described as TIL models. Specification techniques support the creation and refinement of a tool chain model that is aligned to a given development process and set of tools. Domain-specific analysis techniques are used to check the alignment of the tool chain model with the supported process. Synthesis techniques support the efficient realization of the specified tool chain model as a software solution that conforms to integration conventions.

Experiences from case studies are presented which apply TIL to support the creation of tool chains. The approach is evaluated, both qualitatively and quantitatively, by comparing it to traditional development methods for tool chains. The approach enables the efficient development of tailored tool chains, which have the potential to improve the productivity of embedded systems development.

Tool chains have grown from ad-hoc solutions to complex software systems, which often have a service-oriented architecture. With service-oriented tool integration, development tools are made available as services, which can be orchestrated to form tool chains. Due to the increasing sophistication and size of tool chains, there is a need for a systematic development approach for service-oriented tool chains. We propose a domain-specific modeling language (DSML) that allows us to describe the tool chain on an appropriate level of abstraction. We present how this language supports three activities when developing service-oriented tool chains: communication, design and realization. A generative approach supports the realization of the tool chain using the service component architecture. We present experiences from an industrial case study, which applies the DSML to support the creation of a service-oriented tool chain. We evaluate the approach both qualitatively and quantitatively by comparing it with a traditional development approach.

Globally distributed development of complex systems relies on the use of sophisticated development tools but today the tools provide only limited possibilities for integration into seamless tool chains. If development tools could be integrated, development data could be exchanged and tracing across remotely located tools would be possible and would increase the efficiency of globally distributed development. We use a domain specific modeling language to describe tool chains as models on a high level of abstraction. We use model-driven technology to synthesize the implementation of a service-oriented wrapper for each development tool based on OSLC (Open Services for Lifecyle Collaboration) and the orchestration of the services exposed by development tools. The wrapper exposes both tool data and functionality as web services, enabling platform independent tool integration. The orchestration allows us to discover remote tools via their service wrapper, integrate them and check the correctness of the orchestration.

Modern software development relies increasingly on the orchestrated use of development tools in the form of seamless, automated tool chains. Tool chains are becoming complex software systems themselves, however, the efficient development of tool chains is a largely unsupported, manual engineering task. We propose both a domain specific modeling language for systematically specifying tool chains and generators for efficiently realizing the tool chain as software. Tool chain software consists of diverse components, such as service-oriented applications, models and model transformations, which we produce by different generative techniques. We study both the separate generative techniques and the dependencies between the generated artifacts to ensure that they can be integrated. We evaluate the approach both quantitatively and qualitatively, and show in a case study that the approach is practically applicable when building a tool chain for industrially relevant tools.

The seamless integration of development tools can help to improve the productivity of software development and reduce development costs. When tool chains are used in the context of global software engineering, they are deployed as globally distributed systems. Tool chains have the potential to bring productivity gains but they are also expensive to realize. The decision to introduce a tool chain is often made based only on a qualitative analysis of the situation. More precise analysis of the trade-offs would be possible if a quantitative model describing the cost-efficiency of tool chains would be available. We apply the COCOMO model for cost analysis in combination with the TIL model for tool chain design to create a generic quantitative estimation model for predicting the cost-efficiency of tool chains. We validate the cost-efficiency model with a case study of an industrial tool chain.

EAST-ADL is an Architecture Description Language (ADL) initially defined in several European-funded research projects and subsequently refined and aligned with the more recent AUTOSAR automotive standard. It provides a comprehensive approach for defining automotive electronic systems through an information model that captures engineering information in a standardized form. Aspects covered include vehicle features, requirements, analysis functions, software and hardware components, and communication. The representation of the system’s implementation is not defined in EAST-ADL itself but by AUTOSAR. However, traceability is supported from EAST-ADL’s lower abstraction levels to the implementation level elements in AUTOSAR. In this chapter, the authors describe EAST-ADL in detail, show how it relates to AUTOSAR as well as other significant automotive standards, and present current research work on using EAST-ADL in the context of fully-electric vehicles, the functional safety standard ISO 26262, and for multi-objective optimization.

The design of embedded real-time systems requires skills from multiple specific disciplines, including, but not limited to, control, computer science, and electronics. This often involves experts from differing backgrounds, who do not recognize that they address similar, if not identical, issues from complementary angles. Design methodologies are lacking in rigor and discipline so that demonstrating correctness of an embedded design, if at all possible, is a very expensive proposition that may delay significantly the introduction of a critical product. While the economic importance of embedded systems is widely acknowledged, academia has not paid enough attention to the education of a community of high-quality embedded system designers, an obvious difficulty being the need of interdisciplinarity in a period where specialization has been the target of most education systems. This paper presents the reflections that took place in the European Network of Excellence Artist leading us to propose principles and structured contents for building curricula on embedded software and systems.

Modern machineries are often cyber-physical system-of-systems controlled by intelligent controllersfor collaborative operations on the productions of complex products. To assure theefficiency and effectiveness, a consolidation of concerns across managerial levels, product lifecyclestages, and product lines or families becomes necessary. This calls for a common informationinfrastructure in terms of ontology, models, methods and tools. For industrial manufacturerssubjected to increased cost pressure and market volatility, the availability of such an informationinfrastructure would promote their abilities of making optimized and proactive decisions andthereby their competitiveness and survivability. This paper presents a virtual environment thatconstitutes an information infrastructure for the management and development of evolvableproduction systems (EPS) in manufacturing. It adopts mature modeling frameworks throughEAST-ADL for an effective model-based approach. The contribution is centered on a meta-modelthat offers a common data specification and semantic basis for information management acrossproduct lifecycle, models and tools, both for resource planning and for anomaly treatment. Aprototype tool implementation of this virtual environment for validation is also presented.

EAST-ADL is a domain specific Architecture Description Language (ADL) for safety-criticaland software-intensive embedded systems. The language enables a formalized and traceabledescription of a wide range of engineering concerns throughout the entire lifecycle of systems.This makes it possible to fully utilize the leverage of state-of-the-art methods and tools forthe development of correct-by-construction system functions and components in a seamlessand cost efficient way.This talk focuses on the recent advances of EAST-ADL in supporting the description,analysis, verification&validation of complex embedded systems for the purposes of require-ments engineering, application design, and safety engineering. The approach is architecturecentric as all behavior descriptions are formalized and connected to a set of standardizeddesign artifacts existing at multiple levels of abstraction. This talk presents the languagedesign, its theoretical underpinning and tool implementation. From a bigger perspective, thecontribution makes it possible for embedded system and software developers to maintainvarious engineering concerns coherently, while exploiting mature state-of-the-art technologiesfrom computer science and other related domains for a model-based design.

Modern automotive vehicles represent one category of cyber-physical systems that are inherently safety&time-critical. Future automotive technology will to an increasingly large extent be based on an integration of general purpose components for shortening the innovation loops and enabling efficient product evolution. Nevertheless, the adoption of general purpose solutions in automotive vehicles will not be a trivial task. Currently, while domain-specific frameworks like AUTOSAR and ISO26262 facilitate component-based system development based on well-formulated assumptions and interfaces, challenges remain in the areas of contract synthesis, conformity assessment, and diagnostics when issues like mode behaviors, timing, and failures are of concern.  This talk presents the EAST-ADL modeling framework and discusses an EAST-ADL based approach to system modularity and risk analysis in order to integrate separately developed electronic components into safety-critical automotive systems. Special attention is paid to the synthesis of both component contracts and the associated runtime services for lifecycle and quality management, anomaly treatment according to ISO26262.

Embedded electronic systems in vehiclesare of rapidly increasing commercial importance forthe automotive industry. While current vehicularembedded systems are extremely limited and static,a more dynamic configurable system would greatlysimplify the integration work and increase quality ofvehicular systems. This brings in features likeseparation of concerns, customised softwareconfiguration for individual vehicles, seamlessconnectivity, and plug-and-play capability.Furthermore, such a system can also contribute toincreased dependability and resource optimizationdue to its inherent ability to adjust itself dynamicallyto changes in software, hardware resources, andenvironment condition. This paper describes thearchitectural approach to achieving the goals ofdynamically self-configuring automotive embeddedelectronic systems by the EU research projectDySCAS. The architecture solution outlined in thispaper captures the application and operationalcontexts, expected features, middleware services,functions and behaviours, as well as the basicmechanisms and technologies. The paper alsocovers the architecture conceptualization bypresenting the rationale, concerning the architecturestructuring, control principles, and deploymentconcept. In this paper, we also present the adoptedarchitecture V&V strategy and discuss some openissues in regards to the industrial acceptance.

Software systems in vehicles are of rapidly increasing commercial importance for the automotive industry. Current vehicular embedded systems exhibit a fixed software structure and the possibilities for software upgrades are limited. Due to increasing expectations of context-awareness, dependability, flexibility, cost efficiency and time-to-market; we argue that it is now necessary to enable advanced features that are based on dynamic configuration.To reach the goals of dynamically self-configuring automotive systems, we propose an architecture which is currently being developed in the EC funded DySCAS project. We describe the proposed architecture, with a focus on its support for adaptive behavior. To illustrate the type and extent of adaptability achievable, a set of generic use case classes are briefly described and the requirements they place on the architecture and in particular the adaptive aspects, are discussed.The architecture is based on a distributed hierarchical control and decision strategy, which through the policy-based middleware functions and underlying technologies allows separation-of-concerns, on-line reconfiguration, seamless connectivity, plug-and-play capability, and also increased dependability and resource optimization. Decision points are concerned with both application and resource aspects and are dispersed throughout a distributed platform, allowing the embedding of numerous policies to make context-aware decisions whilst avoiding excessive complexity. The approach is scalable and provides additional freedom for engineers to define the dynamic configuration characteristics.The developed architecture is so far on a functional level and has been validated against system requirements. Current work concentrates on defining the corresponding software architecture, considering automotive platforms and constraints.

Intelligent Transportation System (ITS) with autonomic functions that are cyber-physical in nature is of rapidly increasing importance for traffic efficiency and safety. Current engineering approaches to such functions often rely on worst-case assumptions, originally used for safety engineering, due to the difficulty and cost involved in precisely modeling and analyzing the system boundaries and emergent behaviors in a highly dynamic configuration of system-of-systems. This can lead to the loss of many of the benefits in regard to traffic efficiency, but also to conditions where the transport system as a whole is prone to unacceptable high risks. We envisage a systematic approach to the development of autonomous functions in ITS resting on the basis of a formal modeling framework. This paper presents our vision for achieving such a goal on the basis of EAST-ADL, which is an ISO26262 compatible architecture modeling language and methodology for the development and management of automotive Electrics & Electronics systems. Especially, this paper elaborates on some key challenges and outlines related research issues to be regarded in a Swedish research initiative, referred to as SARMITS (Systematic Approach to Risk Management in ITS Context).

The expected increase in transports of people and goods across Europe will aggravate the problems related to traffic congestion, accidents and pollution. As new road infrastructure alone would not solve such problems, Intelligent Transportation Systems (ITS) has been considered as new initiatives. Due to the complexity of behaviors, novel methods and tools for the requirements engineering, correct-by-construction design, dependability, product variability and lifecycle management become also necessary. This chapter presents an ontology-based approach to safety management in Cooperative ITS (C-ITS), primarily in an automotive context. This approach is supposed to lay the way for all aspects of ITS safety management, from simulation and design, over run-time risk assessment and diagnostics. It provides the support for ontology driven ITS development and its formal information model. Results of approach validation in CarMaker are also given in this Chapter. The approach is a result of research activities made in the framework of Swedish research initiative, referred to as SARMITS (Systematic Approach to Risk Management in ITS Context).

EAST-ADL is a domain specific Architecture Description Language (ADL) for safety-critical and software-intensive embedded systems. The language allows a formalized and traceable description of a wide range of engineering concerns throughout the entire lifecycle of system development. This makes it possible to fully utilize the leverage of state-of-the-art methods and tools for the development of correct-by-construction system functions and components in a seamless and cost efficient way. This paper focuses on the recent advancement of EAST-ADL in supporting an architecture-centric analysis, verification&validation of complex behaviors for the purposes of requirements engineering, application design, and safety engineering. The approach is architecture centric because all behavior descriptions are formalized and connected to a set of standardized design artifacts sitting at multiple levels of abstractions. We present the language design to support this, the theoretical underpinning and tool implementation. To show the capability of EAST-ADL, we also introduce an algorithm and its implementation for transforming the EAST-ADL behavior models to SPIN models for logic model checking. Exploiting mature state-of-the-art technologies from computer science, electronic engineering, and other related domains for a model-based incremental system development, the contribution enables the developers of embedded systems and software to maintain various engineering concerns coherently using EAST-ADL.

EAST-ADL is an architecture description language (ADL) for model-based development of automotive embedded systems.The formalization of domain-specific engineering information and methodology brings a potential for a wide range of benefitsfor information management, system design and integration, tool interaction, documentation and communication. This paper describesthe EAST-ADL language support for safety requirements, faults/failures, hazards and safety constraints in the context of ISO/DIS 26262reference safety lifecycle. Based on the language support, the safety related information can be derived and managed seamlessly alongwith its target nominal system architecture model with multiple abstraction levels and view extensions. Through model transformationand tool integration, automated safety analysis is allowed.

This paper describes and demonstrates an approach that promises to bridge the gap between model-based systems engineering and the safety process of automotive embedded systems. The basis for this is the integration of safety analysis techniques, a method for developing and managing Safety Cases, and a systematic approach to model-based engineering - the EAST-ADL2 architecture description language. Three areas are highlighted: (I) System model development on different levels of abstraction. This enables fulfilling many requirements on software development as specified by ISO-CD-26262 (2) Safety Case development in close connection to the system model (3) Analysis of mal-functional behaviour that may cause hazards, by modelling of errors and error propagation in a (complex and hierarchical) system model.

The complexity of embedded automotive systemscalls for a more rigorous approach to systemdevelopment compared to current state of practice. Acritical issue is the management of the engineeringinformation that defines the embedded system. TheEAST-ADL1 is an architecture description languagefor automotive embedded systems. The languageemphasizes information management as a basis forsystematic design and verification. It is currently beingrefined in the ATESST2 project.

Modern automotive vehicles represent one category of CPS (Cyber-Physical Systems) that are inherently time- and safety-critical. To justify the actions for quality-of-service adaptation and safety assurance, it is fundamental to perceive the uncertainties of system components in operation, which are caused by emergent properties, design or operation anomalies. From an industrial point of view, a further challenge is related to the usages of generic purpose COTS (Commercial-Off-The-Shelf) components, which are separately developed and evolved, often not sufficiently verified and validated for specific automotive contexts. While introducing additional uncertainties in regard to the overall system performance and safety, the adoption of COTS components constitutes a necessary means for effective product evolution and innovation. Accordingly, we propose in this paper a novel approach that aims to enable advanced operation monitoring and self-assessment in regard to operational uncertainties and thereby automated performance and safety awareness. The emphasis is on the integration of several modeling technologies, including the domain-specific modeling framework EAST-ADL, the A-G contract theory and Hidden Markov Model (HMM). In particular, we also present some initial concepts in regard to the usage performance and safety awareness for quality-of-service adaptation and dynamic risk mitigation.

EAST-ADL is a domain-specific modeling framework with methodology and language supportfor the engineering of automotive embedded systems. In regard to functional safety, it aims toprovide the maximum possible support for ISO 26262 so that all safety related information can beconsolidated seamlessly in a common system model together with the requirements specification.This paper describes the EAST-ADL support for the modeling of plausible error behaviors as anorthogonal system view. We introduce in particular an integration of such EAST-ADL modelswith the HiP-HOPS method for automated temporal fault tree analysis.

A system-of-systems (SoS) is inherently open inconfiguration and evolutionary in lifecycle. For the nextgeneration of cooperative cyber-physical system-of-systems,safety and security constitute two key issues of public concernthat affect the deployment and acceptance. In engineering, theopenness and evolutionary nature also entail radical paradigmshifts. This paper presents one novel approach to thedevelopment of qualified cyber-physical system-of-systems, withCooperative Intelligent Transport Systems (C-ITS) as one target.The approach, referred to as knowledge-in-the-loop, aims toallow a synergy of well-managed lifecycles, formal qualityassurance, and smart system features. One research goal is toenable an evolutionary development with continuous andtraceable flows of system rationale from design-time to postdeploymenttime and back, supporting automated knowledgeinference and enrichment. Another research goal is to develop aformal approach to risk-aware dynamic treatment of safety andsecurity as a whole in the context of system-of-systems. Key basetechnologies include: (1) EAST-ADL for the consolidation ofsystem-wide concerns and for the creation of an ontology foradvanced run-time decisions, (2) Learning Based-Testing for runtimeand post-deployment model inference, safety monitoringand testing, (3) Provable Isolation for run-time attack detectionand enforcement of security in real-time operating systems.

A Stewart platform is a six-degree-of-freedom parallel manipulator widely used as the motion base for flight simulators, antenna positioning systems, machine tool technology, etc. This work presents a novel mechatronics-twin framework that integrates such a manipulator with advanced biomechanical models and simulations for effective exploration of operational behaviors of prosthetic sockets with amputees. By means of the biomechanical models and simulations, the framework allows the users to first analyze the fundamental operational characteristics of individual amputees according to their specific body geometries, pelvis-femur structures, sizes of transfemoral sockets, etc. Such operational characteristics are then fed to one Stewart platform as the reference control signals for the generation of dynamic loads and behaviors of prosthetic sockets that are otherwise difficult to observe or realize with the real amputees. Experiments in form of integration testing show that the proposed control strategy is capable of generating expected dynamic operational conditions. Currently, the mechatronics-twin framework supports a wide range of biomechanical configurations and the quantification of the respective intra-socket load conditions for socket design optimization and anomaly detection.

Modern machineries are becoming complex cyberphysicalsystems with increasingly intelligent support for processautomation. For the dependability and performance, acombination of measures for fault avoidance, robust architecture,and runtime anomaly handling is necessary. These in turn callfor a formalization of knowledge across different system lifecyclestages and a provision of novel methods and tools for qualifiedsystem synthesis and effective risk management. This paperpresents a model-based approach to qualified process automationfor the operation and maintenance of production systems. Thecontribution is centered on the formalizations of a wide range ofsystem concerns, and thereby a consolidation of the rationalebehind the design of run-time process logic in BPMN2.0. Inparticular, the approach allows an integration of formal systemdescriptions, FTA and FEMA based anomaly analysis, andexecutable process models for effective anomaly detection andtreatment. The approach adopts mature modeling methods andtools through EAST-ADL. In this paper, a prototype tool-chainwith MetaEdit+ Domain-Specific Modeling (DSM) Workbench,HiP-HOPS Analysis Tool and Camunda BPM Platform is alsopresented.

The purpose of this document is to provide a comprehensive definition of theDySCAS Middleware Reference Architecture, including the DySCASArchitecture Model together with the underlying DySCAS Component Model andDySCAS Information Model. The component model provides a standardizedapproach to the interfaces, internal structure and behaviours of middlewareservices. The information model constitutes an ontology and effective means forcapturing and formulating the meta-information of system configuration. Suchinformation is typically concerned with the system architecture specification andoperation status that is necessary for run-time configuration management.This document serves as a guide for understanding the functionalities andsemantics of this reference architecture in detail.

This deliverable provides an architectural strategy and overall system design forthe DySCAS middleware system as a first step towards a complete systemspecification. The DySCAS Basic Architecture captures both the systemconceptualization and an initial function-level outline without consideringimplementation and technology details. It defines the middleware system in termsof its application and operational contexts, expected features, middleware servicesthat group functions, behaviours, as well as the structuring and implementationdecisions that are most crucial to satisfy the given set of requirements. In thisdocument, we also outline some fundamental strategies for binding themiddleware components to the target platforms and infrastructures and forhandling potential errors at both initialization-time and rum-time, while taking thetechnology support and domain needs into consideration.This deliverable also covers the rationale behind the architecture solutions andprovides a generic framework that relates architecture principles and styles, wellknownmechanisms, and reference models to the expected functionalities andqualities of DySCAS. The aim is to consolidate the proposed solutions and also tofacilitate the communications between DySCAS partners and to third-parties.