Realizing desired properties “by construction” is a highly appealing goal in the design of safety-critical embedded systems. As verification and validation tasks in this domain are often both challenging and time-consuming, the by-construction paradigm is a promising solution to increase design productivity and reduce design errors. In the XANDAR project, partners from industry and academia develop a toolchain that will advance current development processes by employing a modelbased X-by-Construction (XbC) approach. XANDAR defines a development process, metamodel extensions, a library of safety and security patterns, and investigates many further techniques for design automation, verification, and validation. The developed toolchain will use a hypervisor-based platform, targeting future centralized, AI-capable high-performance embedded processing systems. It is co-developed and validated in both an avionics use case for situation perception and pilot assistance as well as an automotive use case for autonomous driving.

Safety-critical real-time systems must be carefully designed to guarantee both functional and temporal correctness. State-of-the-art approaches to achieve this are often based on formal notations capturing both the desired functionality and relevant timing properties. This work is concerned with the design of embedded software systems for emerging fields such as the Urban Air Mobility (UAM) sector. In this context, it deals with scenarios that benefit from a less formal programming model, but for which guarantees on functional and timing behavior must still be provided. We propose a concept to specify and simulate the behavior of embedded real-time software in a deterministic manner. It combines the Logical Execution Time (LET) paradigm with a flexible, code-based approach for behavior specification and performs discrete-event (DE) simulations to determine how exactly the designed system responds to given stimuli. We describe this concept, present a reference implementation using Ptolemy II as simulation backend, and discuss its application to a pilot assistance system from the UAM sector.

The integration of connected and autonomous technologies in safety-critical and cyber-physical systems offers great potential in the vital application domains of transportation, manufacturing and aerospace. These technological advancements are necessary to meet the increasing demand for intelligent services, as they open doors to new business models by analysing and sharing the generated data. However, where this sharing of mix-critical data and broader connectivity brings opportunities, it simultaneously presents serious cybersecurity and safety risks due to the cyber-physical nature of these systems. Hence, delivering these intelligent services securely, safely, and reliably to its consumers is a complex engineering and design problem. One of the ways to approach this engineering problem is to consider both system functional and non-functional properties (safety, security, reliability) and systematically integrate them across system design and operational life cycle. The XANDAR project investigates this approach and aims to develop holistic software design methods and architectures for safety-critical and cyber-physical systems that guarantee functional and non-functional properties “byconstruction”. This paper focuses on the non-functional aspects of the project and discusses the preliminary work. by presenting the core cybersecurity principles and uses them as a baseline to propose a holistic cybersecurity engineering process. The tasks of the proposed cybersecurity engineering process are also map onto relevant clauses of ISO 21434. In future, proposed work will be integrated into the XANDAR software toolchain and validated for an avionics situation perception pilot assistance and automotive autonomous driving use cases.

The next generation of networked embedded systems (ES) necessitates rapid prototyping and high performance while maintaining key qualities like trustworthiness and safety. However, development of safety-critical ES suffers from complex software (SW) toolchains and engineering processes. Moreover, the current trend in autonomous systems, which relies on Machine Learning (ML) and AI applications when combined with fail-operational requirements renders the Verification and Validation (V&V) of these new systems a challenging endeavor. Prime examples are Advanced Driver-Assistance Systems (ADAS) that are prone to various safety/security vulnerabilities. The XANDAR project aims at developing a mature SW toolchain (from requirements analysis to the actual code integration on target including V&V) fulfilling the needs of industry for rapid prototyping of interoperable and autonomous ES. Starting from a model-based system architecture, XANDAR will leverage automatic model synthesis and software parallelization techniques to achieve specific non-functional requirements setting the foundation for a novel (real-time, safety-, and security)-by-Construction paradigm.

Due to various trends in the automotive sector, such as autonomous driving and electrification, the number of Electric/Electronic (E/E) components has risen in both hardware and software. This has led to an increase in certification requirements, which cannot be fulfilled without simulation anymore [1]. Different approaches have emerged trying to master this issue. However, for supporting early design decisions in the E/E development, these are either domain-specific or too elaborate. In this paper, we demonstrate an approach to realize early design decisions through a cross-domain simulation of E/E architectures, regarding the environment, scenarios, vehicle physics, the scheduling of software components and the power supply net. We use static E/E architecture hardware models, consisting of Electronic Control Units (ECUs), sensors, actuators and the wiring harness, as the base for the structure of our simulation models. The individual E/E components are linked to parameterizable simulation model templates to facilitate scalable execution. Moreover, scenarios are used for model reduction and supply the simulation model with stimuli. The simulation model is synthesized in an automated manner. For the evaluation, we simulate the power consumption of an electric vehicle, dependent on different loads. It shows that considering hardware aspects in early design phases uncovers errors that would have been noticed much later, e.g. when using virtual Hardware In the Loop (vHIL) methods. We also investigate the scalability of our approach. As E/E architecture modeling tool, we use Vector PREEvision and for the simulation Mathworks Simulink.

Increasing performance requirements for cyber-physical systems in real-time applications raise the necessity to migrate to multi-core processor systems. However, commercial of the shelf multi-core systems are often inappropriate for the real-time domain and real-time capable multi-core programming models are rare. In this paper, we present a solution developed within the EU research project ARGO. By means of a predictability-enhanced NoC-based multi-/many-core architecture, we investigate hardware properties that can help to improve the predictability of the platform and the programming model. Both platform and programming model are complemented by a WCET-aware Architecture Description Language (ADL). This enables a certain degree of hardware abstraction while preserving the relevant details for accurate multi-core WCET analysis algorithms. Target platform and programming model are designed to be statically analyzable by multi-core WCET computation tools, that are part of the automated WCET-aware software parallelization tool flow developed in the ARGO project.

Heterogeneous architectures featuring multiple hardware accelerators have been proposed as a promising solution for meeting the ever-increasing performance and power requirements of embedded systems. However, the existence of numerous design parameters may result in different architectural schemes and thus in extra design effort. To address this issue, OpenCL-based frameworks have been recently utilized for FPGA programming, to enable the portability of a source code to multiple architectures. However, such OpenCL frameworks focus on RTL design, thus not enabling rapid prototyping and abstracted modeling of complex systems. Virtual Prototyping aims to overcome this problem by enabling the system modeling in higher abstraction levels. This article combines the benefits of OpenCL and Virtual Prototyping, by proposing an OpenCL-based prototyping framework for data-parallel many-accelerator systems, which (a) creates a SystemC Virtual Platform from OpenCL, (b) provides a co-simulation environment for the host and the Virtual Platform, (c) offers memory and interconnection models for parallel data processing, and (d) enables the system evaluation with alternative real number representations (e.g., fixed-point or 16-bit floating-point).

One challenge in developing complex software for embedded systems is the missing option of rapid prototyping in early stages of the development cycle. In this paper we present the use of the High Level Simulation Framework “Open Virtual Platforms” (OVP) for Software-in-the-Loop simulation of embedded control applications. Therefore, we investigate and evaluate different methods allowing the data exchange between the simulated platform and the host machine running the simulation environment. The insights we gain are used to design peripherals which appear to the simulated processor system like devices available on the targeted hardware platform and allow the access to files stored on the host machine on one hand, and the communication with hardware devices connected to the host on the other hand. In both cases the cross-compiled application code for the targeted embedded platform including the operating system (OS) and the hardware abstraction layer (HAL) can be executed by the virtual platform (VP) without any modifications. Additionally, we introduce a method for controlling the synchronization of OVP with the host, which can be used to either run simulations in fast motion mode, or to collaborate with hardware devices or other applications. The approach is verified with two use cases: (1) a motor control application processing data by accessing files and (2) an image processing application interacting with real hardware devices directly coupled with the virtual platform.