Digital transformation fundamentally changes established practices in public and private sector. Hence, it represents an opportunity to improve the value creation processes (e.g., “industry 4.0”) and to rethink how to address customers' needs such as “data-driven business models” and “Mobility-as-a-Service”. Dependable, collaborative and autonomous systems are playing a central role in this transformation process. Furthermore, the emergence of data-driven approaches combined with autonomous systems will lead to new business models and market dynamics. Innovative approaches to reorganise the value creation ecosystem, to enable distributed engineering of dependable systems and to answer urgent questions such as liability will be required. Consequently, digital transformation requires a comprehensive multi-stakeholder approach which properly balances technology, ecosystem and business innovation. Targets of this paper are (a) to introduce digital transformation and the role of / opportunities provided by autonomous systems, (b) to introduce Digital Depednability Identities (DDI) - a technology for dependability engineering of collaborative, autonomous CPS, and (c) to propose an appropriate agile approach for innovation management based on business model innovation and co-entrepreneurship.

Abstract The future will encompass heavily interconnected, distributed, heterogeneous and intelligent systems which are bound to have a significant economic and social impact. Cyber physical systems (CPS) such as autonomous cars, smart electric grid, implanted medical devices and smart manufacturing are some practical examples of these intelligent systems. However, due to the open and cooperative nature of CPS, assuring their dependability is a challenge. The DEIS project addresses this important and unsolved challenge by developing the concept of a digital dependability identity (DDI). A DDI contains all the information that uniquely describes the dependability characteristics of a CPS or CPS component. DDIs are synthesised at development time and are the basis for the (semi)automated integration of components into systems during development, as well as for the fully automated dynamic integration of systems into systems of systems in the field.

Among the actual trends that will affect society in the coming years, autonomous driving stands out as having the potential to disruptively change the automotive industry as we know it today. As a consequence, this will also highly impact the semiconductor industry and open new market opportunities, since semiconductors play an indispensable role as enablers for automated vehicles. Fully automated driving has been identified as one major enabler to master the Grand Societal Challenges of safe, clean, and efficient mobility. For this, fail-operational behavior is essential in the sense, plan, and act stages of the automation chain in order to handle safety-critical situations by its own, which currently is not reached with state-of-the-art approaches also due to missing reliable environment perception and sensor fusion. PRYSTINE, which was the highest ranked ECSEL project proposal in 2017, will realize Fail-operational Urban Surround perceptION (FUSION) which is based on robust Radar and LiDAR sensor fusion and control functions in order to enable safe automated driving in urban and rural environments. Furthermore, PRYSTINE will strengthen and extend traditional core competencies of the European industry, research organizations, and universities in smart mobility and in particular in the electronic component and systems and cyber-physical systems domain.

Since April 2014 the Artemis/ECSEL project EMC2 is running and provides significant results. EMC2 stands for "Embedded Multi-Core Systems for Mixed Criticality Applications in Dynamic and Changeable Real-Time Environments". In this paper we report recent progress on technical work in the different workpackages and use cases. We highlight progress in the research on system architecture, design methodology, platform and operating systems, and in qualification and certification. Application cases in the fields of automotive, avionics, health care, and industry are presented exploiting the technical results achieved.

The introduction of multi-core computing platforms aims at providing more computing resources and additional interfaces to answer the needs of new automotive control strategies with respect to computing performances and connectivity (e.g. connected vehicle, hybrid powertrains). At the same time, the parallel execution and resulting resources and timing conflicts require a paradigm change for the embedded software. Consequently, efficient migration of legacy software on multi-core platform, while guaranteeing at least the same level of integrity and performance as for single cores, is a significant challenge. The contributions of this paper are (1) to provide a state-of-practice survey on multi-core CPUs and operating systems for the automotive domain, and (2) based on this survey to provide guidelines for the migration of legacy SW. Finally the related challenges and opportunities for the development of high-integrity control systems on multi-cores, as platform for dependable systems are discussed.

Cyber-Physical Systems (CPS) provide enormous potential for innovation but a precondition for this is that the issue of dependability has been addressed. This paper presents the concept of a Digital Dependability Identity (DDI) of a component or system as foundation for assuring the dependability of CPS. A DDI is an analyzable and potentially executable model of information about the dependability of a component or system. We argue that DDIs must fulfill a number of properties including being universally useful across supply chains, enabling off-line certification of systems where possible, and providing capabilities for in-field certification of safety of CPS. In this paper, we focus on system safety as one integral part of dependability and as a practical demonstration of the concept, we present an initial implementation of DDIs in the form of Conditional Safety Certificates (also known as ConSerts). We explain ConSerts and their practical operationalization based on an illustrative example.

Automotive network technologies such as FlexRay present a cost-optimized structure in order to tailor the system to the required functionalities and to the environment. The space exploration for optimization of single components (cable, transceiver, communication controller, middleware, application) as well as the integration of these components (e.g. selection of the topology) are complex activities that can be efficiently supported by means of simulation. The main challenge while simulating communication architectures is to efficiently integrate the heterogeneous models in order to obtain accurate results for a relevant operation time of the system. In this work, a run-time model switching method is introduced for the holistic simulation of FlexRay networks. Based on a complete modeling of the main network components, the simulation performance increase is analyzed and the new test and diagnosis possibilities resulting from this holistic approach are discussed.

Ensuring a correct signal integrity within the entire FlexRay network and for all the possible environmental situations is mandatory for reliable operation of the distributed application. However, this is a goal difficult to reach due to the large number of parameters that influence the signal integrity. The use of simulation is a natural answer to efficiently support space exploration. We discuss in this work how the TEODACS test approach supports the validation process of the simulation models for FlexRay topologies and provides trustfulness for the simulation results even if hardware reference is not available. Further, we introduce a new method for the advanced analysis and evaluation of signal integrity in FlexRay networks.

Electronic Control Units (ECUs) are implemented nowadays in safety-critical applications such as battery management or power control systems for hybrid vehicles. In this context, a critical product failure can harm people, environment or property and has therefore to be avoided. The challenge during the design of such components is to improve and guarantee the product quality while keeping flexibility for different variants and minimizing the development costs. We present in this paper first results of the newly started MEPAS project. The focus is set on improvements regarding requirements engineering as well as regarding the development of safety-relevant automotive embedded systems in the context of ISO 26262.

Distributed systems, especially time-triggered ones, are implementing clock synchronization algorithms to provide and maintain a common view of time among the different nodes. Such architectures heavily rely on the nodes' local oscillators to remain within given accuracy bounds. However, measuring the oscillator frequencies (e.g., for maintenance or diagnosis) is usually difficult to perform since it requires physical access to each single node and may interfere with the running application. Moreover, clock synchronization features tend to mask clock deviations. In this work, we propose a non-intrusive method for remote measurement of the individual oscillator drifts within a distributed system. Our approach is based on a tester that sends carefully aligned messages to stimulate the clock synchronization service and records the resulting bus traffic for an analysis of the nodes' synchronization behavior. This tester needs access to the communication bus only. We focus our work to FlexRay and validate our approach by experiments.

Integration work at system level has been made easier with the introduction of the time-triggered concept and technologies such as FlexRay. Paradoxically, the ongoing integration efforts at component level have led to complex local interactions between the subsystems that are difficult to analyze globally. We present in this work a test environment for automotive networks that goes beyond the component boundaries and enables the concurrent analysis of the entire communication architecture. This supports the investigation of data- and fault propagation within the system as well as the analysis of the interactions between the components. Supported by an industrial use case, we discuss how this environment improves fault detection and diagnosis of the system.

Deterministic replay is used during testing to reproduce a scenario and drive the system under test to a given state. In this work, we replay ana prioridefined bus traffic to influence the clock synchronization mechanism. Beyond testing this distributed mechanism itself, our aim is to draw conclusions on the nodes' bus receiver operation. Since these replay activities are part of a transparent online test procedure, it is important to ensure that they do not represent a threat for proper system operation. We show this for TTP/C by means of a generic formal proof, while for the case of FlexRay we formally prove that the system precision can be bounded according to the replay operation applied. Experimental results confirm and illustrate our approach.

The introduction of FlexRay in the automotive industry as well as the standardization efforts for the hardware and software architecture rise different challenges: How to efficiently integrate the new services in the system, how to validate the communication architecture with respect to the effects influencing the network? The research project TEODACS aims at answering these questions. We present in this document a new validation approach for the communication architecture based on the simulation of the entire FlexRay network within a co-simulation framework. This environment largely reduces the processing resources required for simulation and thus makes the analysis of such complex system possible.

The introduction of computer-controlled intelligent safety and comfort features has turned cars into complex distributed computing systems. In such a system the proper operation of the communication backbone as well as the proper interaction of components from different vendors must be ensured for all configurations and operating conditions. This system-level test goes far beyond the (isolated) test of single components and represents a substantial problem, that seems to be still largely unsolved, although its solution is crucial for maintaining the consumers' trust in modern automotive electronics. In this paper we concentrate on the test of distributed systems based on FlexRay, the protocol that is envisioned as the communication backbone for future automotive systems. The cornerstones of our approach are a decomposition of the system into layers and mechanisms, and a versatile strategy for monitoring and stimulation under various conditions. Our concept can be adapted to diverse needs ranging from an early debugging with full access to the system, over non-intrusive online testing during interoperability tests, to maintenance testing that is restricted to a remote access only. We give detailed discussions of the requirements and present our solutions for the various issues involved. Selected use cases demonstrate the usefulness of the taken approach.

The aim of this work is to study how the temporal behavior of time-triggered distributed systems is influenced by a drift of their underlying quartz. More especially, we focus on convergence-average clock synchronization used e.g. for TTP/C and FlexRay. We show that, for a fault free system in a stable environment, the global time converges to an interval spanned by the accuracies of the physical clocks independently of the system history. Although this result seems quite intuitive, it is not self-evident, given the complex behavior of distributed clock synchronization. Moreover, this proof allows to derive diagnosis information about the underlying quartz and is the enabler of remote system test.

Time-triggered architectures are being introduced in safety-critical automotive systems ("X-by-wire") to cope with the growing complexity and the high safety demands. One of their merits is to provide a static operation schedule, thus largely reducing the complexity of (otherwise input-dependent) execution flow. This, however, comes for the price of increased configuration complexity: the FlexRay protocol that implements the time-triggered paradigm on the communication level requires several tens of configuration parameters. The product of their possible settings spans a space of more than 10M48(theoretical) configurations. This does not represent a problem as long as the configuration is known and fault-free. However, in many cases - ranging from debugging over conformance testing to maintenance - an identification of the configuration is desirable, but turns out extremely burdensome. This paper presents a systematic approach that facilitates parameter identification in such complex systems. Experimental results illustrate the usefulness of our approach and explore its limitations.

Embedded electronic communication systems play a vital role in the future development of automotive systems. For successful application developments new test and diagnosis solutions for these distributed systems are required. This paper presents solutions for the stimulus generation of test systems based on a remote test under the stringent constraints of the automotive industry. We elaborate a flexible and accurate method that enables a systematic and comprehensive test of data link layer related communication services. Furthermore, we discuss how this solution can be applied for various different test purposes (e.g. for verification, robustness, interoperability or maintenance tests) and demonstrate its application by use of an example that varies one fundamental protocol parameter of FlexRay

We present a systematic test strategy for the communication subsystem of a distributed automotive system. Key points are (1) system decomposition into layers and services and (2) integration of fault injection and monitoring within this framework