Testing and calibration plays a significant role in the automotive development process. In order to shorten development cycles and to enable the detection of problems at early design phases, OEMs and suppliers are often operating a highly complex testing infrastructure covering all development stages including pure simulation in the office, engine test, drive train test, chassis test, vehicle test on the test bed and road test. A multitude of IT systems from different vendors often complemented by custom in-house solutions is usually required to make testing in such scenarios manageable. Examples are systems for requirement management, test management, calibration management, measurement data management, model management and larger systems for application and product lifecycle management. All these systems increase the productivity within their domain, but an increase of productivity on the macro level can only be achieved when these tool are well integrated to enable seamless collaboration among the different engineering domains and stakeholders. In larger organizations, the cost and time required to integrate the individual IT systems into a seamless system engineering environment is extraordinarily high. The Openness of an IT system with respect to system integration is the cornerstone to reduce this effort. The ARTEMIS CRYSTAL project has recognized this need. With 68 partners and a budget of over 82 million Euro, it has the objective to develop an open Interoperability Specification that enables tools to share and interlink their data in a typical multi-vendor environment. In this presentation we will show how the CRYSTAL Interoperability Specification can be applied in a typical automotive testing and calibration scenario. In particular we will present how systems for Calibration Data Management and Test Information Management can be integrated in the overall automotive development process. We will present details about the technical realization, assess the implementation overhead and show the benefits gained by a better tool integration.

The European ARTEMIS ACROSS project aims to overcome the limitations of existing Multi-Processor System-on-a-Chip (MPSoC) architectures with respect to safety-critical applications. MPSoCs have a tremendous potential in the domain of embedded systems considering their enormous computational capacity and energy efficiency. However, the currently existing MPSoC architectures have significant limitations with respect to safety-critical applications. These limitations include difficulties in the certification process due to the high complexity of MPSoCs, the lacking temporal determinism and problems related to error propagation between subsystems. These limitations become even more severe, when subsystems of different criticality levels have to be integrated on the same computational platform. Examples of such mixed-criticality integration are found in the avionics and automotive industry with their desire to integrate safety-critical, mission critical and non-critical subsystems on the same platform in order to minimize size, weight, power and cost. The main objective of ACROSS is to develop a new generation of multicore processors designed specially for safety-critical embedded systems; the ACROSS MPSoC. In this paper we will show how the ACROSS MPSoC overcomes the limitations of existing MPSoC architectures in order to make the multi-core technology available to the safety-critical domain.

This paper investigates on the security of time -- triggered transmission channels, which are used to establish a predictable and timely message transfer in a distributed embedded system with potential safety constraints. Within such a system, safety and security are closely related, because malicious attacks can have an impact on a system's safety and thereby cause severe damage. An attacker could masquerade as an original sender and try to alter some system parameters by injecting malicious messages in the system. In the embedded real-time systems domain particularly the authenticity of data items is of interest, because a lack of integrity can lead to incorrect or erroneous system behavior. In addition, we address the open research question how a common notion of time can contribute to a system's security. Our solution encompasses an authentication protocol to secure time-triggered transmission channels. We illustrate two attack scenarios (insertion and substitution) that aim at injecting fake messages in such a channel thereby corrupting the internal system state of a receiver. We discuss the feasibility of several key management strategies for embedded systems and describe an authentication protocol using time-delayed release of symmetric keys for time-triggered systems. In a case study we implement the protocol for a prototype Time-Triggered Ethernet (TTE) system. The insight gained from the evaluation is that the computation of the cryptographic algorithms consumes most resources. Our solution shows that authentication can be transparently applied to a time-triggered system exploiting the available global time base and without violating its timeliness properties.

High-integrity systems are deployed in order to realize safety-critical applications. To meet the rigorous requirements in this domain, these systems require a sophisticated approach to design, verification, and certification. Not only safety consideration shave an impact on a product's overall dependability, but also security has to be taken into account. In this paper we analyze the Time-Triggered System-on-Chip (TTSoC) architecture, which is a novel architecture for Multi-Processor System-on-Chip (MPSoC) devices, regarding its security properties. We discuss essential compliance criteria to the Multiple Independent Layers of Security (MILS) architecture, which is a industry-ready architecture for embedded high-integrity systems. We found that both architectures share intrinsic properties and we are able to show that the TTSoC architecture implements the core requirements of a MILS Separation Kernel and thus realizes its elementary security policies by design.

The GENESYS (Generic Embedded System) project is a European research project that aims to develop a cross-domain architecture for embedded systems. The requirements and constraints for such an architecture are documented in the ARTEMIS strategic research agenda in the form of seven key challenges. This paper presents the architectural style of GENESYS by listing the key architectural principles, such as: strict component orientation, separation of computation from communication, availability of a common time, hierarchical system structure, adherence to message passing, state awareness, fault isolation and integrated resource manage-ment. This paper explains how these architectural principles contribute to solve the seven key challenges in the ARTEMIS strategic research agenda.

This paper describes an integrated system architecture for automotive electronic systems based on multicore systems-on-chips (SoCs). We integrate functions from different suppliers into a few powerful electronic control units using a dedicated core for each function. This work is fueled by technological opportunities resulting from recent advances in the semiconductor industry and the challenges of providing dependable automotive electronic systems at competitive costs. The presented architecture introduces infrastructure IP cores to overcome key challenges in moving to automotive multicore SoCs: a time-triggered network-on-a-chip with fault isolation for the interconnection of functional IP cores, a diagnostic IP core for error detection and state recovery, a gateway IP core for interfacing legacy systems, and an IP core for reconfiguration. This paper also outlines the migration from today's federated architectures to the proposed integrated architecture using an exemplary automotive E/E system.

Finite state machine (FSM) models are widely used to model the operations of computer systems. Since the basic FSM model is timeless, it is not possible to model within the basic FSM framework system properties that are dependent on the progression of real time, such as the duration of computations or the limited temporal validity of real-time data. To overcome these limitations, efforts have been made to modify the FSM model to include some notion of time. It is the objective of this paper to expand existing work on basic FSMs and timed automata to include the concept of a sparse global time base as a central element of the model. We call such an extended FSM model a periodic finite state machine (PFSM) model. The PFSM model also incorporates the notions of state variables, global time, periodic clock constraints, and time-triggered activities. Thereby, PFSMs enable a concise and intuitive representation of distributed control systems and reduce the gap between a modeled system and its implementation