Abstract The complexity of safety-critical systems is continuously increasing. To create safe systems despite the complexity, the system development requires a strong integration of system design and safety activities. A promising choice for integrating system design and safety activities are model-based approaches. They can help to handle complexity through abstraction, automation, and reuse and are applied to design, analyze, and assure systems. In practice, however, there is often a disconnect between the model-based design and safety activities. At the same time, there is often a delay until recent approaches are available in model-based frameworks. As a result, the advantages of the models are often not fully utilized. Therefore, this article proposes a framework that integrates recent approaches for system design (model-based systems engineering), safety analysis (system-theoretic process analysis), and safety assurance (goal structuring notation). The framework is implemented in the systems modeling language (SysML), and the focus is placed on the connection between the safety analysis and safety assurance activities. It is shown how the model-based integration enables tool assistance for the systematic creation, analysis, and maintenance of safety artifacts. The framework is demonstrated with the system design, safety analysis, and safety assurance of a collision avoidance system for aircraft. The model-based nature of the design and safety activities is utilized to support the systematic generation, analysis, and maintenance of safety artifacts.

The safe and secure implementation of increasingly complex features is a major challenge in the development of autonomous and distributed embedded systems. Automated design-time procedures that guarantee the fulfillment of critical system properties are a promising approach to tackle this challenge. In the European project XANDAR, which took place from 2021 to 2023, eight partners developed an X-by-Construction (XbC) design framework to support developers in the creation of embedded software systems with certain safety, security, and real-time properties. The design framework combines a model-based toolchain with a hypervisor-based runtime architecture. It targets modern high-performance hardware, facilitates the integration of machine learning applications, and employs a library of trusted safety and security patterns to reduce the implementation and verification effort. This paper describes the concepts developed during the project, the prototypical implementation of the design framework, and its application in both an automotive and an avionics use case.

In recent years, artificial intelligence (AI) has been applied to a wide range of safety-critical domains, such as automotive, robotics, and aviation. Especially the automotive and robotics domains have seen a rapid increase in the number of AI-based systems that are being deployed in real-world applications. However, real-world applications in the aviation domain are still sparse, given the challenges of AI engineering in combination with strict safety requirements. A first possible application of AI in the aviation domain might be the future collision avoidance system Airborne Collision Avoidance Systems X (ACAS X). The goal of collision avoidance systems is to issue advisories to the pilot to avoid near mid-air collisions (NMACs). The two important variants of ACAS X for this work are ACAS XA, providing vertical advisories and meant as a drop-in replacement for current systems in commercial air flight, and ACAS Xu, providing horizontal advisories for the ever-growing unmanned aircraft systems market. This work brings both variants closer to real-world deployment by implementing a vertical collision avoidance system, based upon ACAS XA, and a horizontal collision avoidance system, based upon ACAS Xu, for the research flight simulator FlightGear. Using advisories given by this implementation, this work furthermore provides an auto-avoid function that can command an airplane in FlightGear to safely avoid NMACs. Finally, this work will show that the ACAS X implementation can avoid collisions in a simulated environment. For this task, an Operational Design Domain will be defined serving as a basis for safety considerations and evaluating the implementation of the ACAS X. In the end, simulation-based testing will be used separately for VCAS and HCAS showing the successful utilization of advisory predictions as autopilot inputs. Summarizing, this work not only presents an open-source implementation of ACAS XAand ACAS Xu for FlightGear but also shows how the generated advisories can be used to successfully avoid NMACs.

The deterministic integration of concurrent functions on shared multicore platforms is a challenging yet important task. Especially in safety-critical environments, hypervisors can be used to achieve time and space partitioning, but their sole application is often insufficient to guarantee deterministic timing and data flow behavior. Considering the growing complexity of modern embedded systems, for example in terms of functionality and mixed-criticality requirements, model-based approaches are a promising starting point to tackle this issue. In this work, we bridge the gap between a model-based behavior specification methodology based on the Logical Execution Time (LET) concept and target platforms running a commercially available bare-metal hypervisor. Therefore, this paper describes a runtime environment that implements LET semantics at the level of hypervisor partitions and a tool-supported design methodology that deploys software to this runtime environment. From a behavior specification provided as a system model with annotated C code, the presented deployment tool generates binary images with guaranteed timing and data-flow behavior for the XtratuM hypervisor. The approach is finally validated by applying it to a Flight Assistance System (FAS) from the avionics domain.

Realizing desired properties “by construction” is a highly appealing goal in the design of safety-critical embedded systems. As verification and validation tasks in this domain are often both challenging and time-consuming, the by-construction paradigm is a promising solution to increase design productivity and reduce design errors. In the XANDAR project, partners from industry and academia develop a toolchain that will advance current development processes by employing a modelbased X-by-Construction (XbC) approach. XANDAR defines a development process, metamodel extensions, a library of safety and security patterns, and investigates many further techniques for design automation, verification, and validation. The developed toolchain will use a hypervisor-based platform, targeting future centralized, AI-capable high-performance embedded processing systems. It is co-developed and validated in both an avionics use case for situation perception and pilot assistance as well as an automotive use case for autonomous driving.

Safety-critical real-time systems must be carefully designed to guarantee both functional and temporal correctness. State-of-the-art approaches to achieve this are often based on formal notations capturing both the desired functionality and relevant timing properties. This work is concerned with the design of embedded software systems for emerging fields such as the Urban Air Mobility (UAM) sector. In this context, it deals with scenarios that benefit from a less formal programming model, but for which guarantees on functional and timing behavior must still be provided. We propose a concept to specify and simulate the behavior of embedded real-time software in a deterministic manner. It combines the Logical Execution Time (LET) paradigm with a flexible, code-based approach for behavior specification and performs discrete-event (DE) simulations to determine how exactly the designed system responds to given stimuli. We describe this concept, present a reference implementation using Ptolemy II as simulation backend, and discuss its application to a pilot assistance system from the UAM sector.

The integration of connected and autonomous technologies in safety-critical and cyber-physical systems offers great potential in the vital application domains of transportation, manufacturing and aerospace. These technological advancements are necessary to meet the increasing demand for intelligent services, as they open doors to new business models by analysing and sharing the generated data. However, where this sharing of mix-critical data and broader connectivity brings opportunities, it simultaneously presents serious cybersecurity and safety risks due to the cyber-physical nature of these systems. Hence, delivering these intelligent services securely, safely, and reliably to its consumers is a complex engineering and design problem. One of the ways to approach this engineering problem is to consider both system functional and non-functional properties (safety, security, reliability) and systematically integrate them across system design and operational life cycle. The XANDAR project investigates this approach and aims to develop holistic software design methods and architectures for safety-critical and cyber-physical systems that guarantee functional and non-functional properties “byconstruction”. This paper focuses on the non-functional aspects of the project and discusses the preliminary work. by presenting the core cybersecurity principles and uses them as a baseline to propose a holistic cybersecurity engineering process. The tasks of the proposed cybersecurity engineering process are also map onto relevant clauses of ISO 21434. In future, proposed work will be integrated into the XANDAR software toolchain and validated for an avionics situation perception pilot assistance and automotive autonomous driving use cases.

The next generation of networked embedded systems (ES) necessitates rapid prototyping and high performance while maintaining key qualities like trustworthiness and safety. However, development of safety-critical ES suffers from complex software (SW) toolchains and engineering processes. Moreover, the current trend in autonomous systems, which relies on Machine Learning (ML) and AI applications when combined with fail-operational requirements renders the Verification and Validation (V&V) of these new systems a challenging endeavor. Prime examples are Advanced Driver-Assistance Systems (ADAS) that are prone to various safety/security vulnerabilities. The XANDAR project aims at developing a mature SW toolchain (from requirements analysis to the actual code integration on target including V&V) fulfilling the needs of industry for rapid prototyping of interoperable and autonomous ES. Starting from a model-based system architecture, XANDAR will leverage automatic model synthesis and software parallelization techniques to achieve specific non-functional requirements setting the foundation for a novel (real-time, safety-, and security)-by-Construction paradigm.

The adoption of modeling and simulation based approaches brings several benefits in various domains. However, as the simuland and the simulation technologies got more and more complicated, the modeling and simulation became a complex task which eventually required a systems engineering approach. IEEE 1730-2010 Distributed Simulation Engineering and Execution Process (DSEEP) has been published in 2010 as a process framework to help systems engineers in the execution of the several technical and organizational activities which encompass the simulation development life-cycle. It includes a set of high-level best practices and guidelines, particularly for component based distributed simulations. Recent advances in cloud technologies and service-oriented architecture led to Modeling and Simulation as a Service (MSaaS) - a ground breaking paradigm shift from component based technologies that is now changing how we model and simulate. This paper not only presents a critical review, but also proposes revision to DSEEP for supporting the systems engineering effort for modeling and simulation in a cloud-based and service-oriented context.

Parallel architectures are nowadays not only confined to the domain of high performance computing, they are also increasingly used in embedded time-critical systems. The ARGO H2020 project1provides a programming paradigm and associated tool flow to exploit the full potential of architectures in terms of development productivity, time-to-market, exploitation of the platform computing power and guaranteed real-time performance. In this paper we give an overview of the objectives of ARGO and explore the challenges introduced by our approach.

We apply an ontology based knowledge and software reuse methodology adhering to domain engineering principles. Our domain is trajectory simulation. A trajectory simulation is a piece of software to calculate the flight path and other parameters of a munition, such as its orientation and angular rates, from launch to impact. Trajectory Simulation ONTology (TSONT) has been constructed as part of the domain analysis. Object oriented and function oriented reuse infrastructures have been built based upon TSONT following a model-driven development approach. Use of these infrastructures in simulation development has been demonstrated.