The safe and secure implementation of increasingly complex features is a major challenge in the development of autonomous and distributed embedded systems. Automated design-time procedures that guarantee the fulfillment of critical system properties are a promising approach to tackle this challenge. In the European project XANDAR, which took place from 2021 to 2023, eight partners developed an X-by-Construction (XbC) design framework to support developers in the creation of embedded software systems with certain safety, security, and real-time properties. The design framework combines a model-based toolchain with a hypervisor-based runtime architecture. It targets modern high-performance hardware, facilitates the integration of machine learning applications, and employs a library of trusted safety and security patterns to reduce the implementation and verification effort. This paper describes the concepts developed during the project, the prototypical implementation of the design framework, and its application in both an automotive and an avionics use case.

Realizing desired properties “by construction” is a highly appealing goal in the design of safety-critical embedded systems. As verification and validation tasks in this domain are often both challenging and time-consuming, the by-construction paradigm is a promising solution to increase design productivity and reduce design errors. In the XANDAR project, partners from industry and academia develop a toolchain that will advance current development processes by employing a modelbased X-by-Construction (XbC) approach. XANDAR defines a development process, metamodel extensions, a library of safety and security patterns, and investigates many further techniques for design automation, verification, and validation. The developed toolchain will use a hypervisor-based platform, targeting future centralized, AI-capable high-performance embedded processing systems. It is co-developed and validated in both an avionics use case for situation perception and pilot assistance as well as an automotive use case for autonomous driving.

The integration of connected and autonomous technologies in safety-critical and cyber-physical systems offers great potential in the vital application domains of transportation, manufacturing and aerospace. These technological advancements are necessary to meet the increasing demand for intelligent services, as they open doors to new business models by analysing and sharing the generated data. However, where this sharing of mix-critical data and broader connectivity brings opportunities, it simultaneously presents serious cybersecurity and safety risks due to the cyber-physical nature of these systems. Hence, delivering these intelligent services securely, safely, and reliably to its consumers is a complex engineering and design problem. One of the ways to approach this engineering problem is to consider both system functional and non-functional properties (safety, security, reliability) and systematically integrate them across system design and operational life cycle. The XANDAR project investigates this approach and aims to develop holistic software design methods and architectures for safety-critical and cyber-physical systems that guarantee functional and non-functional properties “byconstruction”. This paper focuses on the non-functional aspects of the project and discusses the preliminary work. by presenting the core cybersecurity principles and uses them as a baseline to propose a holistic cybersecurity engineering process. The tasks of the proposed cybersecurity engineering process are also map onto relevant clauses of ISO 21434. In future, proposed work will be integrated into the XANDAR software toolchain and validated for an avionics situation perception pilot assistance and automotive autonomous driving use cases.

The next generation of networked embedded systems (ES) necessitates rapid prototyping and high performance while maintaining key qualities like trustworthiness and safety. However, development of safety-critical ES suffers from complex software (SW) toolchains and engineering processes. Moreover, the current trend in autonomous systems, which relies on Machine Learning (ML) and AI applications when combined with fail-operational requirements renders the Verification and Validation (V&V) of these new systems a challenging endeavor. Prime examples are Advanced Driver-Assistance Systems (ADAS) that are prone to various safety/security vulnerabilities. The XANDAR project aims at developing a mature SW toolchain (from requirements analysis to the actual code integration on target including V&V) fulfilling the needs of industry for rapid prototyping of interoperable and autonomous ES. Starting from a model-based system architecture, XANDAR will leverage automatic model synthesis and software parallelization techniques to achieve specific non-functional requirements setting the foundation for a novel (real-time, safety-, and security)-by-Construction paradigm.

The international standard ISO 26262 “Road vehicles - Functional safety” claims qualitative and quantitative analysis of hardware designs at the appropriate level of abstraction. For large-scaled hardware designs, these evaluations have to be initiated early in development adequate to hardware architectural design and not delayed to hardware detailed design at the level of electronic schematics. Therefore, we describe a structural modeling and annotation of failure data for hardware architectural designs. Based on a top-down qualitative fault tree analysis, the classification of hardware failure modes in context of system behavior can be determined according to ISO 26262. Using these classifications and assumed failure rates, we facilitate a rapid quantitative safety analysis regarding evaluation of the hardware architectural metrics and evaluation of safety goal violations.

FPGA-accelerated real-time simulations of physical phenomena gain importance in the area of Hardware-in-the-Loop tests for electrified powertrain components. Especially the challenging timing requirements demand dedicated hardware solutions. We propose System#, which is a highly modular, flexible and extensible open source environment for synthesizing physical computations to FPGAs. We demonstrate its capabilities by using an existing model of a squirrel-cage induction machine. We oppose several design variants, using fixed point and floating point arithmetic, and various settings for schedule length and pipelining depth of arithmetic operators. We conclude that the synthesized designs are on the par with a manually optimized implementation. Moreover, our approach scales well by allowing a time/area tradeoff over a wide range.

Although fault tree analysis is well established in the industry and its application is proposed by the international standard for functional safety for road vehicles - ISO 26262 - it is often time intensive to perform. Tool chains are long, the line of action is not straightforward, annotations in data models are complex and traceability is not self-evident. To overcome these inconveniences, this paper presents an approach for graphically notated failure modeling, based on an integrated data model for electric and electronic architectures and rapidly performing of fault tree analysis during concept phase of system design. We demonstrate the utilization of existing concepts in the domain of electric and electronic architecture modeling to enrich existing architectures with concepts of fault tree analysis. Also, we demonstrate the model-based specification of failure models, their relation to modeling artifacts of electric and electronic architectures and the automated processing of failure expressions without the necessity to leave the development environment for electric and electronic architecture modeling. The presented methodology supports closer links between the development of architectures for safety-critical systems and failure analysis by facilitating traceability between failure and system modeling based on a common data structure and well-established modeling approaches.