The European automotive industry is undergoing a revolution by the upcoming technologies of software-defined vehicles (SDV) and connected cooperative and automated mobility (CCAM). In a globally challenging context, in which Europe lost market share, the local automotive software and electronics market still expects a 11.9% compound annual growth rate from 2025 to 2030 – even more accentuated with the increasing adoption of advanced driver assistance (ADAS) and autonomous driving (AD). Both SDV and CCAM are key technological paradigms for enabling a shift of the European automotive sector towards a regained strategic competitiveness. Targeting the resulting need for faster development, deployment and test cycles the Horizon Europe RIA UP2DATE4SDV aims to develop a comprehensive ecosystem for seamless and efficient, safe and secure software updates, hardware upgrades, and situation-dependent reconfigurations of SDVs. For that goal, the UP2DATE4SDV consortium collaborates on the definition and development of two abstraction layers – the hardware abstraction layer and the operating system & middleware abstraction layer – as well as on researching and prototyping a safe and secure orchestration and reconfiguration plane between vehicle and cloud. Based on the resulting modular architecture concept and the corresponding DevOps process the project develops demonstrators to showcase safe and secure updates, upgrades and dynamic task reallocation for automotive hardware and software components. In this paper, we introduce the project, its objectives and planned results, draft first outcomes by refining our demonstrator definitions, and conclude with an outlook into the automotive future based on a safe and secure adaptive SDV stack.

Existing hardware platforms are typically optimized for either realtime or high-performance applications, which poses challenges when running a mix of both on the same platform. This work aims to address this issue by proposing a hybrid platform that can effectively execute both types of applications without compromising timing predictability or performance optimization. The proposed solution presents a hybrid HW/SW architecture template capable of dynamically switching between realtime and high-performance execution modes at runtime. The integration and implementation of this architecture template are described on an FPGA, utilizing an open-source RISC-V processor system and FreeRTOS as the software management layer. We have successfully applied the TACLe benchmark suite for the evaluation of our proposed approach. Through an integrated measurement infrastructure, the software functionality, execution timing, and switching times are analyzed on a single-core implementation of the proposed architecture template.

This paper introduces the project Scale4Edge. The project is focused on enabling an effective RISC-V ecosystem for optimization of edge applications. We describe the basic components of this ecosystem and introduce the envisioned demonstrators, which will be used in their evaluation.

The development of safety-critical software requires a significant additional effort compared to standard software. Safety mechanisms, e.g., for mitigating hardware errors, have to be designed and integrated into the functional code. This results not only in substantial implementation overhead, but also reduces the overall maintainability of the software. In this paper, we present the Universal Safety Format (USF), which enables a model-driven approach that complies with the separation of concerns principle. Software safety mechanisms are specified as patterns via a domain-agnostic transformation language, separated from the functional software. Various domain-specific tools apply these safety patterns to domain-specific artifacts, such as code or software architecture models. This enables the reuse of safety patterns in multiple designs as well as in a single design to artifacts from different domains.

Fast yet accurate performance and timing prediction of complex parallel data flow applications on multi-processor systems remains a difficult discipline. The reason for it comes from the complexity of the data flow applications and the hardware platform with shared resources, like buses and memories. This combination may lead to complex timing interferences that are difficult to express in pure analytical or classical simulation-based approaches. In this work, we propose a message-level communication model for timing and performance prediction of Synchronous Data Flow (SDF) applications on MPSoCs with shared memories. We compare our work against measurement and TLM simulation-based performance prediction models on two case-studies from the computer vision domain. We show that the accuracy and execution time of our simulation outperforms existing approaches and is suitable for a fast yet accurate design space exploration.

The UP2DATE H2020 project focuses on highperformance heterogeneous embedded platforms for critical systems. We will develop observability and controllability solutions to support online updates while ensuring safety and security for mixed-criticality tasks. In this paper, we describe the rationale behind the selection of the baseline research platforms which will be used to develop and demonstrate the project concepts, including a performance comparison to identify the most efficient one.

Precisely timed execution of resource constrained bare-metal applications is difficult, because the embedded software developer usually has to implement and check the timeliness of the executed application through manual interaction with timers or counters. In the scope of this work, we propose a combined timing specification and concept for time annotation and control blocks in C++. Our proposed blocks can be used to measure and profile software block execution time. Furthermore, it can be used to control and enforce the software time behavior at runtime. After the application of these time blocks, a trace-based verification against the block-based timing specification can be performed to obtain evidence on the correct implementation and usage of the time blocks on the target platform. We have implemented our time block concept in a C++ library and tested it on an ARM Cortex A9 bare-metal platform. The combined usage of timing specification and our time block library has been successfully evaluated on a critical flight-control software for a multi-rotor system.

Following the same trend of consumer electronics, safety-critical industries are starting to adopt Over-The-Air Software Updates (OTASU) on their embedded systems. The motivation behind this trend is twofold. On the one hand, OTASU offer several benefits to the product makers and users by improving or adding new functionality and services to the product without a complete redesign. On the other hand, the increasing connectivity trend makes OTASU a crucial cyber-security demand to download latest security patches. However, the application of OTASU in the safety-critical domain is not free of challenges, specially when considering the dramatic increase of software complexity and the resulting high computing performance demands. This is the mission of UP2DATE, a recently launched project funded within the European H2020 programme focused on new software update architectures for heterogeneous high-performance mixed-criticality systems. This paper gives an overview of UP2DATE and its foundations, which seeks to improve existing OTASU solutions by considering safety, security and availability from the ground up in an architecture that builds around composability and modularity.

The IEC 61499 standard supports the design and deployment of distributed industrial control systems. It provides modularity through a hierarchical and event driven function block model and its deployment on distributed compute nodes. Even though IEC 61499 tools provide model based testing of applications before and after deployment, a systematic specification of timing requirements and its monitoring at design time is not well support. For safety relevant control applications the monitoring of execution time requirements at run-time would also serve an important safety measure. For this reason, we propose the application of assume/guarantee contracts on the ports of a function block. A hierarchical application of these contracts can be used to specify timing properties along causal event chains in IEC 61499 function bock models. Besides contract based specification and design time consistency checks we propose a new function block type, called Timing Contract Function Block (TCFB). It allows monitoring of a timing contract at design and run-time, when this TCFB gets deployed on the target hardware. We evaluate our proposed methodology and the application of TCFBs for monitoring of timed causality chains on a simple pick and place control system that is modeled in the open-source framework 4diac1.

Real-time communication of distributed automation systems come with many challenges as there is no common time basis. Often a periodic execution of applications is considered which leads to time phenomena like drifts or jitter. Thus, this type of communication requires observance and enforcement of real-time properties to guarantee reliability of distributed systems. New industrial technologies like Time-Sensitive Networking (TSN) and the IEC 61499 standard provide support to conquer upcoming challenges. Therefore, we are using these jointly with contract-based design to propose a design methodology for verification of real-time communication in IEC 61499 systems. We implemented a simulation-based verification environment and performed postmortem trace-based verification against timing specifications. The evaluation confirms the possibility of integrating our proposed representation for non-local communication into IEC 61499 for analyzing time behavior of applications.

This paper extends a state-based timing analysis for Synchronous Dataflow Applications on an MPSoC with shared memory. The existing approach transforms a mapped and timing annotated SDF graph into a timed automata representation for the analysis of timing properties. One major drawback of the existing timing annotation approach is the usage of best- and worst-case execution time intervals, resulting in an overestimation of the actual timing behavior. This paper proposes to replace the timing bound annotation with a probability density function. For the overall timing analysis we use a stochastic timed automata model. We demonstrate and evaluate our approach on a Sobel filter, which is used in many image and video processing algorithms. As a reference, we compare our stochastic execution time model against a fixed best-/worst-case execution time model and against the measured execution time on an FPGA prototype. The results are promising and clearly indicate that our probabilistic approach provides tighter timing analysis results in comparison to the best-/worst-case execution analysis model.

Precisely timed execution of resource constrained bare-metal applications is difficult, because the embedded software developer usually has to implement and check the timeliness of the executed application through manual interaction with timers or counters. In the scope of this work, we propose a concept for time annotation and control blocks in C++. Our proposed blocks can be used to measure and profile software block execution time. Furthermore, it can be used to control and enforce the software time behavior at run-time. We have implemented our concept in a C++ library and tested it on an ARM Cortex A9 bare-metal platform. The usage of our library has been evaluated on a critical flight-control software for a multi-rotor system. The results show that our concept is working, while still having some room for systematic accuracy testing and optimization.

This paper presents a hypervisor architecture tailored to low-power real-time applications. This architecture extends the capability of a hypervisor by providing power management techniques and power monitoring services. An implementation based on an existing hypervisor XtratuM that runs over the ARM of a Zynq-7000 SoC device is proposed as a proof of concept. Measurement results show that the extended hypervisor can obtain information on the power consumption and reduce it.

Many safety-critical and especially mixed-criticality computer systems are realized as a time-triggered (TT) system. Such systems execute one or more tasks according to a pre-determined scheduling. The main advantage of TT systems is their deterministic timing behavior. With the ability of today's programmable MPSoC architectures, complex TT systems based on hypervisors (to support spatial isolation) and timing predictable Networks-on-Chip can be built on a single chip. For the integration of functionality on such a TT MPSoC not only the timing, but also the interplay of functional behavior and timing, needs to be validated. In the past, functional integration testing has been performed on a prototyping board, sometimes in a Hardware-in-the-Loop (HiL) configuration to support testing against a complex environment model. In this work, we propose a Globally Accurate Locally Inaccurate (GALI) simulation model that combines an instruction accurate simulation engine with a global time-triggered scheduler. GALI is demonstrated and evaluated on a full functional flight-control system of a mixed-criticality case-study. For this case-study, we will show that our GALI simulation achieves the same control behavior as a fast cycle accurate simulation, but runs 160 times faster. In comparison with the fastest state-of-the-art approximately timed simulation models, GALI runs between 2.3 and 47 times faster for the considered case-study.

The rise of mixed-critical embedded systems imposes novel challenges on the specification, development, and functional validation in a design flow. In the emerging dynamic scheduling context of mixed-criticality platforms, the system behaviour needs to be estimated in an early step in the design flow to assess the integration impact, especially for quality of service-driven, low-critical subsystems. We provide a modelling and integration flow for specifying, estimating, and evaluating software functions, ranging from an initial executable specification to an implementation candidate on an MPSoC. Based on a data-driven model to evaluate dynamic resource consumption effects of high-critical subsystems and the scheduling overhead, we propose a systematic method for constructing workload models of high-critical software components on the target. Our proxies provide an integration environment for low-critical functions by mimicking the high-critical temporal behaviour on the target. By integrating a low-critical video encoding subsystem with a benchmark suite as the high-critical subsystem we show that the performance model allows for evaluating end-to-end execution times in the low-critical function with an average error of 0.37% and the application proxy only introduces a maximum error of 1.14% in a performance evaluation.

Today's Cyber-Physical Systems (CPS) are witnessing a growing complexity in terms of the number of components and computational power in order to meet the requirements of nowadays applications. For this reason and due to their energy efficiency, Multiprocessor system-on-chips (MPSoC) are becoming ubiquitous. Yet, since these systems are often used in battery-driven and/or small housing use cases, the correct configuration of their power management techniques is an important factor in system design and can be related to possible safety aspects of the system. This calls for an adequate test framework, which is able to observe the power management functionalities of CPS, even before the actual hardware platform is available. The use of virtual platforms for functional validation, that allows executing the CPS's real target platform compatible application binary code on a generic host computer, is currently being adopted by the industry. This work focuses on enhancing industrial OVP virtual platforms by a functional test framework of the power management techniques. We will demonstrate and evaluate how this framework maintains to observe the power management techniques of the system under test. The evaluation uses a Xilinx ZC702 board based on a Xilinx Zynq-7000MPSoC and its correspondent virtual platform in OVP. Results show that the functional test framework is able to analyze the different modes of operation regarding the power management techniques of the Xilinx Zynq processing system.

The increasing processing power of today's HW/SW platforms leads to the integration of more and more functions in a single device. Additional design challenges arise when these functions share computing resources and belong to different criticality levels. The paper presents the CONTREX European project and its preliminary results. CONTREX complements current activities in the area of predictable computing platforms and segregation mechanisms with techniques to consider the extra-functional properties, i.e., timing constraints, power, and temperature. CONTREX enables energy efficient and cost aware design through analysis and optimization of these properties with regard to application demands at different criticality levels.

With the ever increasing industrial demand for bigger, faster and more efficient systems, a growing number of cores is integrated on a single chip. Additionally, their performance is further maximized by simultaneously executing as many processes as possible not regarding their criticality. Even safety critical domains like railway and avionics apply these paradigms under strict certification regulations. As the number of cores is continuously expanding, the importance of cost-effectiveness grows. One way to increase the cost-efficiency of such System on Chip (SoC) is to enhance the way the SoC handles its power resources. By increasing the power efficiency, the reliability of the SoC is raised, because the lifetime of the battery lengthens. Secondly, by having less energy consumed, the emitted heat is reduced in the SoC which translates into fewer cooling devices. Though energy efficiency has been thoroughly researched, there is no application of those power saving methods in safety critical domains yet. The EU project SAFEPOWER1 targets this research gap and aims to introduce certifiable methods to improve the power efficiency of mixed-criticality real-time systems (MCRTES). This paper will introduce the requirements that a power efficient SoC has to meet and the challenges such a SoC has to overcome.

In this paper, a monitoring framework for observing properties of tasks running on a multi-processor platform is proposed. We describe the implementation of the framework on a TLM-based virtual platform containing an ARM Cortex A9 multi-core instruction-set simulator and shared memory modules. An application model consisting of periodic tasks and communication channels is used to demonstrate the applicability of the monitoring framework. Based on the application model, we describe a method for deriving a monitor implementation at design time that is able to check the execution order and the platform mapping during run-time. The model is implemented on top of a POSIX-compatible real-time operating system and the monitor is instantiated as a TLM component in the virtual platform. The monitor implementation is then able to check the execution order and the platform mapping of the application against the specification at run-time. Finally, we discuss the monitoring capability and its contribution to a safety concept for fail-safe systems.

In this paper, an executable system model for performing a functional simulation while observing the dynamic effects of mixed-criticality requirements regarding applications with different levels of assurance is proposed. The model provides the expression of dynamic execution modes and execution time estimates on each criticality level of the system. In a refinement step, it is possible to observe the effects of scheduling policies, dynamic criticality-, and execution mode switches on the functional behaviour of the system in a trace-based, simulative manner. An early evaluation of a quadrocopter platform consisting of a safetycritical flight control application and a video-based, performancecritical object detection is used to demonstrate the applicability of the design flow. Simulation results indicate that by defining multiple execution modes of the object detection algorithm, the run-time utilisation feedback allows the algorithm to run in a high-quality mode for more than 50% of the time, thereby increasing the overall system utilisation by two thirds compared to a static resource utilisation analysis.

Intelligent automotive electronics significantly improved driving safety in the last decades. With the increasing complexity of automotive systems, dependability of the electronic components themselves and of their interaction must be assured to avoid any risk to driving safety due to unexpected failures caused by internal or external faults.

Due to the increasing algorithmic complexity of todays embedded systems, the consideration of extra-functional properties becomes even more important. Extra-functional properties such as timing, power consumption, and temperature need to be validated against given requirements on all abstraction levels. For timing and power consumption at RT- and gate-level, several techniques are available, but there is still a lack of methods and tools for power estimation and analyses at electronic system level (ESL) and above. Existing ESL methods in most cases use state-based methods for power simulation. This may lead to inaccurate results, especially for data-dependent designs. In this paper, we extend the Power State Machine (PSM) model for black-box RTL IP components with a mechanism that employs data-dependent switching activity using the Hamming distance (HD). In pipelined designs, we do not only consider the input HD but also the HDs of the internal pipeline stage registers. Since these registers of black-box IP are not observable from the outside, our model derives the internal HDs from previous input data. The results show that our extension achieves up to 38% better results than the previous PSM approach and up to 35% better results compared to a model considering only the input HD.

Since energy consumption is one of the most limiting factors for embedded and integrated systems, today’s microelectronic design demands urgently for power-aware methodologies for early specification, design-space exploration and verification of the designs’ power properties. To this end, we currently develop a contract- and component-based design concept for power properties, called Power Contracts, to provide a formal link between the bottom-up power characterization of low-level system components and the top-down specification of the systems’ high-level power intent. In this paper, we present a first proof of concept for the verification of the leaf-component power contracts of a hierarchical system design w. r. t. their implementation in UPPAAL. Building on these, we can provide assured power contracts for the hierarchical Virtual Integration (VI) of the leafcomponents to a compound power contract of the integrated final system and thus allow for a sound and traceable bottom-up integration and verification methodology for power properties.

Multi-rotor Unmanned Aerial Vehicles (UAVs) are interesting for commercial as well as for private use. Simple tasks like aerial photography are well known, but nowadays new scenarios, like on-board video processing or complex sensor data processing, are gaining in importance. These scenarios require high-performance on-board processing which is not available in most of today's avionics architectures for civilian multi-rotor systems. Due to the limited installation space and weight requirements, the usage of highly integrated Multi-Processor System on Chips (MPSoCs), capable to implement real-time critical flight control algorithms and compute intensive custom payload functions is appealing. This paper presents fundamental requirements on the architecture and flight control algorithms of existing autonomously flying commercial multi-rotor UAVs. On this basis a new approach for an avionics architecture using the Xilinx ZYNQ (MPSoC) is proposed. In combination with the presentation of the proposed architecture new challenges will be discussed that result from the integration of mixed-critical applications on a single chip.

The timing predictability of embedded systems with hard real-time requirements is fundamental for guaranteeing their safe usage. With the emergence of multicore platforms this task became very challenging. In this paper, a model-checking based approach will be described which allows us to guarantee timing bounds of multiple Synchronous Data Flow Graphs (SDFG) running on shared-bus multicore architectures. Our approach utilizes Timed Automata (TA) as a common semantic model to represent software components (SDF actors) and hardware components of the multicore platform. These TA are explored using the UPPAAL model-checker for providing the timing guarantees. Our approach shows a significant precision improvement compared with the worst-case bounds estimated based on maximal delay for every bus access. Furthermore, scalability is examined to demonstrate analysis feasibility for small parallel systems.

With the accelerating pervasiveness of multi-core platforms in the embedded domains and the on-going need for more computational power and increased integration, multi-core scheduling for real-time and mixed-critical applications is an active research topic. In this paper, we give an overview on the history and the current state-of-the-art on multi-core real-time scheduling. A special focus is put on shared resource access protocols and hierarchical scheduling approaches, both of which are increasingly important due to the higher spatial integration and stronger coupling between the different subsystems, both on the application and on the multi-core architectural level. Moreover, hierarchical scheduling is a promising approach in the area of mixed-criticality systems to enable composability and segregation, which is needed to cope with the complexity of such systems. This survey will be of interest to researchers and practitioners in the field of real-time scheduling for multi-core systems.

The consideration of an embedded device's power consumption and its management is increasingly important nowadays. Currently, it is not easily possible to integrate power information already during the platform exploration phase. In this paper, we discuss the design challenges of today's heterogeneous HW/SW systems regarding power and complexity, both for platform vendors as well as system integrators. As a result, we propose a design flow concept that combines system-level power optimization techniques with platform-based rapid prototyping. Virtual executable prototypes are generated from MARTE/UML and functional C/C++ descriptions, which then allows to study different platforms, mapping alternatives and power management strategies. Our proposed flow combines system-level timing and power estimation techniques available in commercial tools with platform-based rapid prototyping. We propose an efficient code annotation technique for timing and power properties that enables fast host execution as well as adaptive collection of power traces. Combined with a flexible design-space exploration (DSE) approach our flow allows a trade-off between different platforms, mapping alternatives, and optimization techniques, based on domain-specific workload scenarios. The proposed flow is currently under implementation in the COMPLEX FP7 European integrated project.

Cost efficient design of embedded HW/SW systems that need to meet certain requirements is a complex task due to the huge number of possible solutions, the ”design space”. Design space exploration methods depend on the designers' input in terms of application description, target architecture, and cost estimates for implementation alternatives. Obtaining feasible pre-implementation cost estimates causes lots of effort since the designer does not have confident information before implementation on the target architecture, or even different target architectures, has been performed. In this paper we present a methodology suitable for automatic cost estimation of synchronous data flow (SDF) graphs. We propose to start from an executable SystemC-AMS SDF specification, and demonstrate its automatic transformation and implementation for cost estimation on heterogeneous HW/SW architectures. The presented methodology allows the estimation of both HW and SW implementation alternatives of each SDF node based on a quick synthesis approach. These cost estimates are fed to a mapping framework to obtain a static binding and schedule for the architectures under exploration. With the proposed methodology the designer does not have to perform full synthesis and implementation for design space exploration. This is demonstrated by a case study of a Bluetooth baseband unit considered for implementation on a Xilinx Virtex-5 FPGA.

This paper will exemplarily describe and evaluate the OSSS methodology for embedded hardware/software systems and its use in a JPEG 2000 decoder case-study. The OSSS approach defines a design flow starting from an Application Model providing a rich subset of SystemCTM/C++ augmented with specific OSSS language concepts. It can be used to identify the most promising parallel structure by comparing different design alternatives. A clearly defined refinement process leads to the Virtual Target Architecture (VTA) Model. These refinements enable an analysis of the system behaviour at cycle-accurate granularity and support the exploration of different target architectures for the JPEG 2000 decoder. VTA models can be used as direct input for the FOSSY synthesis tool, which performs an automatic transformation into implementation models; that is to generate VHDL code for hardware, C/C++ for software, and platform configuration files for the target technology.

The Program-State Machine (PSM) unifies the concepts of hierarchical concurrent finite-state machines, dataflow graphs and imperative programming languages in a single model of computation. It is used as the foundation of the SpecC System Level Design Language. This paper demonstrates the obstacles and proposes an implementation of the PSM model of computation using SystemC. It is shown that this implementation overcomes some fundamental obstacles when using SystemC for System Level Design. Furthermore, we show the applicability of our PSM implementation by porting a JPEG encoder design originally implemented in SpecC. A comparison of model execution time is very promising and shows that our proposed approach is competitive with a native SpecC model execution.