Simulink has emerged as the fundamental infrastructure that supports modeling, simulation, verification, and code generation for embedded software development. To improve the performance of the code generated from Simulink models, state-of-the-art code generators employ various optimization techniques, such as expression folding, variable reuse, and parallelism. However, they overlook the presence of redundant calculations within data-intensive models widely used to perform substantial data processing in embedded scenarios, which can significantly degrade the performance and introduce additional memory usage. This paper proposes MFRODO, an efficient and memory-sensitive code generator for data-intensive Simulink models through redundancy elimination. MFRODO begins by conducting model analysis to construct the dataflow graph and derive the I/O mapping of each block. Then, for each block within the dataflow graph, MFRODO recursively determines its calculation range by leveraging the I/O mapping of its subsequent blocks and marks optimization blocks whose calculation range is eliminated. For optimizable blocks, MFRODO eliminates the redundant calculations and reduces the memory space associated with these calculations. Finally, MFRODO rebuilds the I/O mappings of these optimizable blocks to ensure code correctness and synthesizes the embedded code for deployment. We implemented and evaluated MFRODO on benchmark Simulink models, in terms of execution duration, memory usage, and code generation overhead across different compilers and architectures. The results show that, compared with the Simulink Embedded Coder, DFSynth, and HCG, MFRODO achieves performance improvements ranging from 1.17× - 8.55×, while reducing BSS segment usage by 12.00% - 52.71%. Besides, MFRODO reduces compile time by 91.8% - 98.7% and code synthesis time by 94.3% - 99.6% compared with Simulink Embedded Coder, while incurring comparable overhead to DFSynth and HCG.

Simulink has emerged as the fundamental infrastructure that supports modeling, simulation, verification, and code generation for embedded software development. To improve the performance of the code generated from Simulink models, state-of-the-art code generators employ various optimization techniques, such as expression folding, variable reuse, and parallelism. However, they overlook the presence of redundant calculations within data-intensive models widely used to perform substantial data processing in embedded scenarios, which can significantly undermine the efficiency and performance of the generated code.

Simulink has gained widespread recognition as a valuable tool for system design. As systems grow increasingly complex, particularly in terms of their internal states, this complexity poses new challenges for existing model testing methodologies. Traditional techniques such as constraint solving and random search encounter difficulties when attempting to explore the intricate logic embedded within these models. In this paper, we introduceHSTCG, a state-aware test case generation method for Simulink models with heuristic strategy.HSTCGsolves only one iteration of the model each time to get the test input that can cover a target branch, then executes the model once to obtain and update the new model state based on the solved input dynamically. Then, it solves the remaining branches based on the new model state iteratively until all the coverage requirements are satisfied. To improve the efficiency of test case generation, we also designed a heuristic strategy containing heuristic branch searching, repeated state filter and unreached branch filter to minimize the times of constraint solving. We implementedHSTCGand evaluated it on several benchmark Simulink models. Compared to the built-in Simulink Design Verifier and state-of-the-art academic work SimCoTest,HSTCGachieves an average improvement of 55% and 103% on Decision Coverage, 53% and 62% on Condition Coverage and 192% and 201% on Modified Condition Decision Coverage, respectively. We also validated the significant improvement of the heuristic strategy, which can improve the efficiency of test case generation by 62.2% on average.

Simulink has been widely used in system design, which supports the efficient modeling and synthesis of embedded controllers, with automatic test case generation to simulate and validate the correctness of the constructed Simulink model. However, the increasing complexity of the model, especially the internal states, brings extra challenges to existing model testing techniques such as constraint solving and random search, which results in difficulties when trying to reach the deeper logic of the model effectively.In this paper, we propose STCG, a state-aware test case generation method for Simulink models. STCG solves only one iteration of the model each time to get the test input that can cover a target branch, then executes the model once to obtain and update the novel model state based on the solved input dynamically. Then, it solves the remaining branches based on the new model state iteratively until all the coverage requirements are satisfied. We implemented STCG and evaluated it on several benchmark Simulink models. Compared to the built-in Simulink Design Verifier and state-of-the-art academic work SimCoTest, STCG achieves an average improvement of 58% and 132% on Decision Coverage, 52% and 70% on Condition Coverage and 239% and 237% on Modified Condition Decision Coverage, respectively.

Simulink is widely used for the model-driven design of embedded systems. It is able to generate optimized embedded control software code through expression folding, variable reuse, etc. However, for some commonly used computing-sensitive models, such as the models for signal processing applications, the efficiency of the generated code is still limited. In this article, we propose PHCG, an optimized code generator for the Simulink model with single-instruction–multiple-data (SIMD) instruction synthesis. It will select the optimal implementations for intensive computing actors based on adaptively precalculation of the input scales, and synthesize the appropriate SIMD instructions for batch computing actors based on the iterative dataflow graph mapping. In addition, actors of the same type that can be executed in parallel can be combined into batch computing actors as much as possible by merging isomorphic subgraphs. We implemented and evaluated its performance on benchmark Simulink models. Compared to the built-in Simulink Coder and the most recent DFSynth, the code generated by PHCG achieves an improvement of 38.9%–92.9% and 41.2%–76.8% in terms of execution time across different architectures and compilers, respectively.

Embedded operating systems (Embedded OSs) are extensively deployed in many mission-critical industrial scenarios. Any defects within these systems may result in unacceptable losses. Therefore, it is imperative to develop tools to detect bugs within Embedded OSs, thus minimizing potential impacts on industrial infrastructures. Coverage-guided fuzzing is a vulnerability detection technique that has found numerous real-world vulnerabilities within both application programs as well as kernels. However, state-of-the-art kernel fuzzers, e.g., Syzkaller, mainly target general purpose-operating systems, such as Linux, macOS, and Windows, whereas Embedded OSs support is mostly lacking. In this article, we propose Tardis, the first Embedded OSs fuzzer capable of testing a wide selection of Embedded OSs while leveraging coverage feedback. Tardis conducts OS-agnostic code coverage collection and analysis, allowing developers and testers to test a wide range of Embedded OSs without significant manual efforts. We implemented and evaluated Tardis on several well-known Embedded OSs, such as UC/OS and FreeRTOS. Tardis can successfully perform fuzz testing on these kernels without significant manual effort for adaptation. By leveraging coverage feedback, Tardis can cover 51.32% more branches than black-box fuzzing on average on the respective Embedded OSs over 24 h. Tardis also found 17 previously unknown bugs among the target Embedded OSs.

Model-driven methods are widely used in embedded control software development. Current design tools, such as Ptolemy-II and Simulink, have strong modeling capability but their simulation and code generation functionalities are challenged by the increasing complexity of control requirements. For simulation, emulating the triggering of the actor leads to additional time overhead and speed degradation. For code generation, generating redundant content degrades the code quality. Besides, current tools do not have a unified interface, which makes it difficult to cooperation. In this article, we propose a unified model-driven design framework MDD to facilitate embedded control software development. MDD can support the unification of models built by different modeling tools for high-efficiency simulation and high-quality code generation. The MDD framework supports the expansion of more modeling tools, and also supports the expansion of more uses, such as unified testing and verification. First, it offers a model intermediate representation (MIR) and several corresponding parsers, which facilitate a unified representation and cooperation for different design tools. Then, based on data flow schedule analysis of the original MIR, intermediate code representation will be generated for optimized code synthesis. Finally, a variety of code translators will synthesize the intermediate code representation into the code of actual use, such as code for simulation and code for deployment. For evaluation, we enhance two widely used design tools in industry, Ptolemy-II and Simulink, and apply them on the implementation of several benchmark models and a real-world self-driving control software of our industrial collaborator. Using MDD can help reduce their simulation time by 98.9% and 92.6%, the generated code by 99.7% and 69.9% in the number of lines, and 94.3% and 34.3% in code execution time, respectively.

Simulink is a widely used model-driven design environment for supporting the simulation and code generation of embedded applications. To improve the quality of the code generated from Simulink models, state-of-the-art code generators employ various high-level optimizations, like eliminating local variables. However, they overlook the compatibility between code and the low-level processor architecture, especially the instruction pipeline. Consequently, instruction pipeline stalls occur frequently, leading to additional delays in instruction execution, as well as limited efficiency for deployed the embedded software. In this article, we propose Mercury, an instruction pipeline aware code generator for Simulink models which utilizes data dependencies between actors to decrease the instruction pipeline stalls of the generated code. First, Mercury collects data dependencies through model dataflow traversal and records the property of each actor. Then, Mercury approximately estimates the execution latency of required instructions fetched from corresponding actors and uses a topology-based method to obtain candidate actors for code synthesis. Finally, Mercury adopts the least penalty priority to iteratively select the most suitable actor for code synthesis and releases data dependencies with its subsequent actors. We implemented and evaluated Mercury on benchmark Simulink models (Su et al., 2021) as well as a real industrial model. Compared to the official tool Simulink Embedded Coder and the state-of-the-art academic tool DFSynth, Mercury outperformed them by 9.7%–33.4% and 9.2%–59.4% in terms of the execution time of the generated code across different architectures, respectively. The statistics also demonstrate that the generated code of Mercury increases utilization of pipeline slots by 11.0%–37.1% and 10.6%–50.0%, respectively.

Industrial control system (ICS) employs complex multistate protocols to realize high-reliability communication and intelligent control over automation equipment. ICS has been widely used in various embedded fields, such as autonomous vehicle systems, power automation systems, etc. However, in recent years, many attacks have been performed on ICS, especially its protocols, such as the hijacks over Jeep Uconnect and Tesla Autopilot autonomous systems, also the Stuxnet and DragonFly viruses over national infrastructures. It is important to guarantee the security of ICS protocols. In this article, we presentCharon, an efficient fuzzing platform for the vulnerability detection of ICS protocol implementations. InCharon, we propose an innovative fuzzing strategy that leverages state guidance to maximize cross-state code coverage instead of focusing on isolated states during the fuzzing of ICS protocols. Moreover, we devise a novel feedback collection method that employs program status inferring to avoid the restart of the ICS protocol at each iteration, allowing for continuous fuzzing. We evaluateCharonon several popular ICS protocol implementations, including real-time publish subscribe, IEC61850-MMS, MQTT, etc. Compared with typical fuzzers, such as American fuzzy lop, Polar, AFLNET, Boofuzz, and Peach, it averagely improves branch coverage by 234.2%, 194.4%, 215.9%, 52.58%, and 35.18%, respectively. Moreover, it has already confirmed 21 previously unknown vulnerabilities (e.g., stack buffer overflow) among these ICS protocols, most of which are security critical and corresponding patches from vendors have been released accordingly.

Modern operating system kernels are too complex to be free of bugs. Fuzzing is a promising approach for vulnerability detection and has been applied to kernel testing. However, existing work does not consider the influence relations between system calls when generating and mutating inputs, resulting in difficulties when trying to reach into the kernel's deeper logic effectively.