We describe the challenges addressed by the three year German national collaborative research project Step-Up!CPS that is currently in its third year. The goal of the project is to develop software methods and technologies for modular updates of safety-critical cyber-physical systems. To make this possible, contracts are utilized, which formally describe the behaviour of an update and make it verifiable at different times of the update life cycle. We have defined a development process that allows for a continuous improvement of such systems by monitoring their operation, identifying the need for updates, and development and deploying these updates in a safe and secure manner. We highlight the points along the update process that are necessary for a secure update and show how we counteract them in a contractually secured update process.

The lifecycles of software updates for Cyber Physical Systems are significantly decreasing. Especially for safety-critical functions, these must be carefully tested for compatibility to target configurations. In order to formalize the requirements of the system and to validate software changes in a modular way, contract-based design can be used for formal verification. A contract is defined as a pair of an assumption describing the required conditions for the working environment of a component, and a guarantee, which specifies its expected behavior including timing properties and value ranges of interfaces. In this work, we present a concept for efficient verification of a software update in a contract-based development environment with consideration of several system variants. The concept is based on an incremental refinement verification methodology which uses deltas, i.e. differences between variants, to automatically propagate changes and retest only the incrementally relevant contracts. By applying the methodology in a case study for a network representing a variable Adaptive Cruise Control system, we could demonstrate its applicability and its advantages in reducing the total verification effort for product line evolution.

Current automotive trends, such as autonomous and connected driving, are mainly enabled by embedded software that is deployed on a network of several, often more than one hundred, electronic control units. These software parts are responsible for many complex tasks concerning safety, comfort, energy management, and vehicle dynamics. Currently, they are deployed to the units at the end of the assembly line. Although a new software baseline of electronic control units is released in regular terms, normally six months, updates during after-sales are mostly conducted only in urgent cases, such as recall campaigns. Upcoming over-the-air services will enable more frequent updates to fix bugs and add new functionality. The possible alternatives of engines, chassis, and customer wishes lead to a high number of existing vehicle variants, so that the management of releases and configurations becomes more complex and costly. In a survey, we asked participants from different automotive institutions about the current state of practice, and the challenges they face during release development and management. This paper presents and discusses the main results of this survey: We have identified that field updates will be deployed more frequently in the future, and that over-the-air communication is an efficient way to realize them. The reported main update reasons are bug fixes and function improvement. However, the shortening release and update cycles, the increasing number of variants, and the multidisciplinarity in the automotive field are major challenges requiring suitable processes, methods, and tools to achieve software that operates correctly.