Abstract With the increasing demand for customized systems and rapidly evolving technology, software engineering faces many challenges. A particular challenge is the development and maintenance of systems that are highly variable both in space (concurrent variations of the system at one point in time) and time (sequential variations of the system, due to its evolution). Recent research aims to address this challenge by managing variability in space and time simultaneously. However, this research originates from two different areas, software product line engineering and software configuration management, resulting in non-uniform terminologies and a varying understanding of concepts. These problems hamper the communication and understanding of involved concepts, as well as the development of techniques that unify variability in space and time. To tackle these problems, we performed an iterative, expert-driven analysis of existing tools from both research areas to derive a conceptual model that integrates and unifies concepts of both dimensions of variability. In this article, we first explain the construction process and present the resulting conceptual model. We validate the model and discuss its coverage and granularity with respect to established concepts of variability in space and time. Furthermore, we perform a formal concept analysis to discuss the commonalities and differences among the tools we considered. Finally, we show illustrative applications to explain how the conceptual model can be used in practice to derive conforming tools. The conceptual model unifies concepts and relations used in software product line engineering and software configuration management, provides a unified terminology and common ground for researchers and developers for comparing their works, clarifies communication, and prevents redundant developments.

Modern automotive embedded systems are developed by Original Equipment Manufacturers (OEM) together with multiple suppliers. A key problem for a supplier is to allocate an OEM's requirements specification to their own subsystem design. This is a difficult manual task especially on complex systems and it requires expert knowledge about the system design. To address this problem, this paper presents a design science research to develop and evaluate a Requirements Allocation Assistant tool (RAA). The tool provides functionality to search through and filter requirements and system models to enable efficient requirements allocation even in the presence of complexity.RAA is built on top of the EATOP/Eclipse framework using EAST-ADL as system modelling language. The tool was evaluated and validated during a qualitative usability study with 17 engineers active in the Swedish automotive industry. Key findings are that searching is used to learn about a system, whereas filtering is used to narrow down a set of candidate elements of the system design. Engineers request further support in narrowing down a set of candidate elements and in checking that an allocation is correct.

ISO 26262 is the new standard for automotive functional safety. This standard identifies major process steps across a large number of system stages as well as safety-related artifacts required as input and output of these steps. The VeriSpec project intends to identify the main challenges for the adoption of ISO 26262 by the heavy-vehicle industry and to provide useful and industrially relevant "components" (methods, tools etc.) required by the standard. The project work targets two main research goals: (i) requirement formalization support, including a usable front-end for specifying requirements by using patterns, and (ii) formal analysis of realizations in form of architectural models at various levels of abstraction, by model-checking the formal representations of the latter. In this paper, we present the current challenges facing industry and justifying VeriSpec, together with a preliminary roadmap for the research.

In the modern automotive industry, feature models have been widely used as a domain-specific requirements model, which can capture commonality and variability of a software product line through a set of features. Product variants can thus be configured by selecting different sets of features from the feature model. For feature-oriented requirements validation, the variability of feature sets often makes the hidden flaws such as behavioral inconsistencies of features, hardly to avoid. In this paper, we present an approach to feature-oriented requirements validation for automotive systems w.r.t. both functional behaviors and non-functional properties. Our approach first starts with the behavioral specification of features and the associated requirements by following a restricted use case modeling approach, and then formalizes such specifications by using a formal yet literate language for analysis. We demonstrate the applicability of our approach through an industrial application of a Vehicle Locking-Unlocking system.

EPM is a prototypical research tool that combines traditional component modeling means with a comprehensive variability management support. In addition to ordinary containment hierarchies of components, the tool provides a few selected system modeling and product management capabilities, e.g. separate modeling of the system's software and hardware architecture and an end-customer / marketing-oriented view on the system's variability. In this article we present EPM and briefly describe its main functionality.

The complexity of embedded automotive systems calls for a more rigorous approach to system development compared to current state of practice. A critical issue is the management of the engineering information that defines the embedded system. Development time, cost efficiency, quality and dependability all benefit from appropriate information management. System modeling based on an architecture description language is a way to keep the engineering information within one information structure. The EAST-ADL was developed in the EAST-EEA project (www.easteea.net) and is an architecture description language for automotive embedded systems. It is currently refined in the ATESSTproject (www.atesst.org). This paper gives an overview of the EAST-ADL and accounts for some recent refinements as developed in the ATESST project. Areas covered include the relation to other standardization initiatives such as UML2.0, AADL, AUTOSAR, SysML, Marte profile, requirements management and variability.

A desired attribute in safety-critical embedded real-time systems is a system time and event synchronization capability on which predictable communication can be established. Focusing on bus-based communication protocols, we present a novel, efficient, and low-cost start-up and restart synchronization approach for TDMA environments. This approach utilizes information about a node's message length that forms a unique sequence to achieve synchronization such that communication overhead can be avoided. We present a fault-tolerant initial synchronization protocol with a bounded start-up time. The protocol avoids start-up collisions by deterministically postponing retries after a collision. We also present a resynchronization strategy that incorporates recovering nodes into synchronization.

A desired attribute in safety critical embedded real-time systems is a system time/event synchronization capability on which predictable communication can be established. Focusing on bus-based communication protocols in TDMA environments, we present a novel, efficient, and low-cost synchronization approach with bounded start-up time. This approach utilizes information about each node's unique message lengths to achieve synchronization. The protocol avoids start-up collisions by postponing retries after a collision. We also present a re-synchronization strategy that incorporates recovering nodes into synchronization.

This paper compares different scheduling policies applied to distributed systems intended for automotive real-time control applications. We describe the characteristics of systems using fixed priority (FP) and static cyclic (SC) scheduling of processors and bus communication, with combinations ranging from FP bus-FP processors to SC bus-SC processors. FP bus is represented by the Controller Area Network protocol (CAN) and SC bus by a Time Division Multiple Access (TDMA) protocol. We also study the effects of using a global time base. Our main concern is control performance, including input and output jitter and control delay and therefore the response time of a sequence of control tasks and the related communication. For each system configuration we analyze the expected response times of a series of control related tasks (delay) and the temporal variation of the input and output instants (jitter).

This paper discusses the startup phase of a TDMA protocol intended for safety-critical real-time systems using a broadcast bus. The protocol contains sender id in each message, and nodes send messages of equal size in a fixed order. A single channel media is used and data and synchronization information must therefore share the same channel. Synchronization is challenging, since clocks must be synchronized to guarantee successful transmissions, and successful transmissions rely on synchronized clocks. We describe three different start-up algorithms and evaluate them with respect to complexity, resynchronization time and performance in the presence of transient faults.

BASEMENT/sup TM/ is a distributed real-time architecture developed for vehicle internal use in the automotive industry. BASEMENT covers application development, as well as the hardware and software that provide execution and communication support. This paper gives an overview of the BASEMENT concept, as well as presenting two system realizations. The first realization is based on the commercial real-time kernel Rubus, while the second is an ultra-dependable architecture (DACAPO) with provisions for fault tolerance at various system levels. BASEMENT is designed for the automotive systems of the future. These systems will be required to simultaneously handle multiple safety critical functions and a large number of less critical functions. All of these features are to be provided at a production cost substantially lower than that of current systems, and, at the same time, with a reliability allowing vehicles to be built without mechanical backup systems, even for safety critical subsystems such as braking and steering.