Abstract Agile development processes are more flexible than conventional ones. They emphasize iterative development and learning over feedback loops. Nevertheless, we experienced some pitfalls in the application of agile processes in dependable software systems. We present here the experiences we gathered in the construction of high‐quality industrial software. Moreover, we will digest our experiences into a conceptual model of waste creation. This model will be refined to a case study where we take appropriate measurements in order to provide empirical evidence for it. Finally, we discuss the implications of the developed model, which helps to estimate the trade‐off between agile and traditional software processes. Copyright © 2015 John Wiley & Sons, Ltd.

RFID-based and NFC-based applications can be found, apart from others, in security critical application fields, such as payment or access control. For this purpose, Elliptic-Curve Cryptography (ECC) is commonly used hardware integrated in resource constrained applications in order to provide authenticity and data integrity. On the one hand, specialized crypto hardware approaches provide good performance and consume low power. On the other hand, they often lack flexibility, caused, for example, by hardware integrated protocols and cryptographic parameters. Here we present a flexible and lightweight ECC-based authentication solution that takes into account resource constrained systems. This technique permits to shift parts of the computational intense ECC calculations from the resource constrained device to the authentication terminal. By employing a security controller with a small multi-purpose hardware acceleration core, high computation speed is achieved and a maximum level of flexibility is maintained at the same time. We demonstrate the feasible implementation of the proposed technique by means of an Android-based reader / smart card system, which represent a prime example of contemporary power-constrained and performance-constrained embedded systems. An ECC-based authentication can be carried out on average within 25 ms and checked against a back-end server within 66 ms in a secured manner. Thus, a secured and flexible one-way authentication system is given that shows high performance. This solution can be utilized in a wide variety of application fields, such as anti-counterfeiting, where flexibility and low chip prices are essential.

Java-enabled smart cards are used in different fields of application, such as access control, electronic banking, and passports. On these cards, a standardized virtual machine runs, which protects the security-critical code and data using a sandbox model. Unfortunately, this sandbox can be circumvented by fault attacks, which corrupt the data on which the virtual machine operates. The fault emulation environment of this work enables the user to configure faults at definable Java applet code locations. The user specifies which Java code she wants to attack but does not need to provide any information on where these data are placed in the memory and when the memory is accessed. To enable this approach, our environment monitors the virtual machine during the applet execution to receive the information which Java code is currently executed and which security-critical memory regions are in use. Then, the faults are injected using a bus saboteur at the correct clock cycle and memory location. This generic high-level approach provides the environment user an abstraction of the internal states of the virtual machine and the emulated hardware. Therefore, our environment enables the recreation of currently known attacks and allows us to study the effects of fault attacks on the virtual-machine behavior. The concept was successfully evaluated by a Java wallet case study. This case study shows a speedup of 6,600 compared to a simulation.

Developing an embedded system today means integrating a bundle of features into a constrained and complex system. Examples are Near Field Communication (NFC) handsets like smart phones, which will hit the 1.2billion mark in 2017. Model Driven Architecture (MDA) is an approach to handle this complexity. Challenges in MDA are the verification of power-requirements across the development phases and to find the suitable abstraction for the power models for higher abstraction levels. Therefore, we propose a framework for MDA to support cross-verification of these requirements. We implemented this framework and made a case study of developing a power-aware NFC-System. The case study shows that the framework allows a power-verification with an accuracy of 10%.

Java Card is a secure Java running environment targeted for smart cards. In such low-end embedded systems, ROM size and execution time play very important, usually opposing roles. Dictionary compression can be applied to the Java Card software architecture, but pays for the reduced ROM size of the applications with a higher execution time. On the other hand, acceleration mechanisms to speed up the execution need additional information or additional software complexity, with the effect of increasing ROM size. In this paper, we propose a dictionary compression system based on an instruction folding mechanism that permits a reduction in the ROM size of Java Card applications, and at the same time, a speed-up of their execution.

Java Card is a Java running environment specific for smart cards. In such low-end embedded systems, the execution time of the applications is an issue of first order. One of the components of the Java Card Virtual Machine (JCVM) playing an important role in the execution speed is the bytecode interpreter. In Java systems the main technique for speeding-up the interpreter execution is the Just-In-Time compilation (JIT), but this resource consuming technique is inapplicable in systems with as restricted resources available as in smart cards. This paper presents a hardware/software co-design solution for the performance improvement of the interpreter. In the software domain, we adopted a pseudo-threaded code interpreter that allows a better run-time performance with a small amount of additional code. In the hardware domain, we proceeded moving parts of the interpreter into hardware, giving origin to a Java Card interpreter based on an application specific instruction set processor.

Java Cards, which are primarily used to store security-sensitive data, are employed in a wide range of applications, such as authentication and banking. Because these data must be protected against logical and fault attacks, static and runtime verification must be performed to assure the security of Java applets. Currently, this verification is performed in the software. Runtime verification for counteracting fault attacks is costly due to additional execution time and memory consumption. To circumvent the drawbacks of software verification, we propose incorporating a microarchitectural support of runtime verification directly into smart card hardware. These new hardware features enable a defensive virtual machine to counteract buffer overflow attacks, type confusion attacks, control flow attacks, and data integrity attacks. To measure the additional overhead of hardware and performance, the new microarchitectural security features are integrated into a smart card prototype on a field programmable gate array board.

Testing hardware and software components regarding their fault detection and fault handling capabilities is of vital importance. However, considering the fact that security systems are built using several distributed hardware components (e.g., reader/smart card authentication system), testing each component individually is insufficient. Because novel system-wide multi-fault attack campaigns can be conducted, fault propagation as well as fault handling of the entire system must be regarded. State-of-the-art emulation-based fault analysis approaches neglect this system aspect as well as the fault impact on power dissipation and power supply. Here, we present a novel analysis methodology that characterizes the behavior of complete systems during the design phase, in terms of fault handling, power dissipation, and power supply. Emulation-based techniques are applied to provide cycle accurate analysis information of the system-under-test in real time. The presented approach is of importance when it comes to test resource constrained, dependable, and high secure system designs. We demonstrate the application of this approach by means of a reader/smart card authentication system. Furthermore, we show how system level-based multi-fault attacks can be emulated and how the resulting system behavior (e.g., power consumption, power supply, information leakage) can be exploited to extract security relevant information.

Power consumption and thermal behavior are important characteristics that need to be explored and evaluated during a product's development cycle. If not handled properly, the consequences are, for example, increased mean-time-to-failure and fatal timing variations of the critical path. In the field of contactlessly powered reader/smart card systems, a magnetic field strength exceeding the allowed maximum threshold may harm the smart card's hardware. Thus, secure smart cards must be designed to cope with faults provoked by power oversupply and thermal stress. Proper fault detection and fault handling are imperative tasks to protect internal secrets. However, state-of-the-art design exploration tools cover these smart card specific power and thermal stress issues only to some extent. Here we present an innovative high level simulation approach used for exploring and simulating secure reader/smart card systems, focusing on magnetic field oversupply and thermal stress evaluations. Gate-level-based power models are used besides RF-channel models, thermal models, and thermal effect models. Furthermore, fault injection techniques are featured to evaluate the fault resistance of a smart card system's software implementation. This framework grants software and hardware designers a novel opportunity to detect functional, power, thermal, and security issues during the design time. We demonstrate the usage of our exploration framework and show an innovative hardware design approach to prolong the lifetime of smart card electronics, which are exposed to high magnetic field strengths.

More than 500 million Near Field Communication (NFC) devices will be delivered in 2014. This technology enables a lot of application fields like using it for bridges to embedded systems (e.g., smart meters). With this wireless bridge the user can interact with the embedded system using an off-the-shelf NFC-enabled smart phone. The user of such a bridge also trusts in the system's security. Furthermore, this security should not lead to an excessive battery drain of the smart phone nor the embedded system. This publication deals with these concerns and shows a method called PtNBridge. The method secures the whole communication path from the smart phone application to the accessed module in the embedded system (e.g., power sensor of the smart meter). To take account of the energy consumption, the PtNBridge has been analyzed and optimized to avoid an excessive battery drain. Two variants of the PtNBridge have been implemented, which aim for two different goals of power-aware security.

Test and verification are essential parts during a product's development cycle. Simulation and emulation are well known techniques to test and verify the functionality of a design-under-test (DUT) before its tape-out. However, there are additional issues like peak power consumption and supply voltage drops, which can compromise a hardware's functionality. These issues are only partly covered by nowadays functional hardware emulation test and verification approaches. This paper presents a comprehensive emulation methodology. It combines functional hardware emulation with model-based performance, power, and supply voltage analysis techniques. The DUT, which has to be available in a hardware description language, is integrated into a FPGA along with designated analysis units. These analysis units implement models of the DUT's performance, power consumption, and supply voltage behavior. The presented emulation methodology allows a designer to test designs in such a way that the cycle accurate results are taken online, in real-time, and verify both functional and performance behavior, as well as power consumption and supply voltage levels. The proposed comprehensive emulation methodology is used, as an example of application, to verify the design of a LEON3 multi-core processor system as well as a RF-powered contacatless smart card. The depicted results demonstrate that this emulation approach is suitable to detect functional misbehavior caused by power and supply voltage hazards and how they influence the performance of the system.

Design exploration and evaluation are essential tasks during a product's development cycle. Simulation and hardware emulation are common techniques to explore and evaluate the functionality of hardware/software designs. However, when it comes to distributed secure applications, like contactless reader/smart card systems, non-functional design properties and system aspects (e.g., conctactless power transfer, power consumption) have to be regarded too. State-of-the-art simulation-based and emulation-based design exploration tools cover these design issues and system aspects only to some extent. Here we present a design exploration framework for complete reader/smart card systems using state-of-the-art model-based emulation and estimation techniques. This novel system-based approach is of high importance because of the high availability of battery powered mobile readers (i.e. smart phones) and novel mobile application fields. Contactless power transfer and power consumption analyses of reader and smart cards can be performed for each clock cycle and in real time. Thus, novel system-level power and security optimization techniques can be evaluated considering the reader/smart card system as a whole. We demonstrate the application of our exploration framework by means of a typical Diffie-Hellman key exchange between reader and smart card and highlight power optimization possibilities.

In recent years the complexity of digital control systems in safety critical environments increased steadily from simple discrete control units to complex embedded systems. A wide industrial consensus about the necessity of a set of safety definitions lead to the introduction of several functional safety standards like IEC61508. To achieve that novel embedded systems comply with these requirements, thorough testing is needed during early design stages of the integrated device. Currently only fault injection testing using manufactured products and netlists of system-on-chips are used to determine the fault resistance of the embedded system. This late testing could result in expensive redesigns and hide implementation errors because of the black-box approach. This approach is also not practicable if software and hardware providers are separate entities. This paper presents a flexible fault injection and power estimation platform to enable thorough examinations of novel complex system-on-chips for automotive or similar critical environments. The microprocessor evaluation approach is extended with smart bus fault emulation units for common buses like Ethernet. The combined power and fault emulation techniques allow for the instant exploration of eventual power supply peaks and implementation weaknesses.

During recent years the increasing introduction of system functionality into integrated devices resulted into several new problems for chip designers. First, high system-on-chip complexity combined with increased clock frequencies leads to power budget and thermal issues. Second, small semiconductor process structures are more sensitive to faults resulting from logic degradation and external radiation sources. Early testing and evaluation of hardware and software implementations have been enabled in the last years using hardware-accelerated emulation techniques. Such implementations rely on functional models of the target system, generated using specialized benchmark suites. These have been designed to accurately resemble typical application scenarios of the target implementation. Unfortunately, power and fault injection emulation accuracy is depending on a good coverage of the system's logic, which is not guaranteed by typical benchmarks. Therefore, this paper proposes an exhaustive hardware accelerated methodology for the evaluation of such applications and generation of accurate emulation models. The behavior of standard benchmarks are investigated using an open available system-on-chip platform based case study.

RF-powered smart cards are constrained in their operation by their power consumption. Smart card application designers must pay attention to power consumption peaks, high average power consumption and supply voltage drops. If these hazards are not handled properly, the smart card's operational stability is compromised. Here we present a novel multi-core smart card design, which improves the operational stability of nowadays used smart cards. Estimation based techniques are applied to provide cycle accurate power and supply voltage information of the smart card in real time. A supply voltage management unit monitors the provided power and supply voltage information, flattens the smart card's power consumption and prevents supply voltage drops by means of a dynamic voltage and frequency scaling (DVFS) policy. The presented multi-core smart card design is evaluated on a hardware emulation platform to prove its proper functionality. Experimental tests show that harmful power variations can be reduced by up to 75% and predefined supply voltage levels are maintained properly. The presented analysis and management functionalities are integrated at a minimal area overhead of 10.1%.

During recent years a tremendous number of embedded systems has been introduced into every person's house-hold. Such systems cannot only be found inside non-critical applications like entertainment devices but also in safety or security critical implementations like smart-cards. The increasing complexity leads to the introduction of several different co-design techniques to enable the parallel design of the system's hardware and software. Especially concerning security evaluation procedures this may raise a problem of trust between the manufacturer of the hardware and the software if both are different entities. To enable a bridge between these two worlds, simulation and emulation-based approaches have been shown in literature and industry to provide abstracted information about fault-attack effects to the software developer. However, no fast and cost-effective approach is available to provide a metric about how much of a given secret is leaking from the device to its environment. Therefore, this paper proposes such a metric and an emulation-based methodology to enable an early estimation of side-channel leakage to a possible adversary. The effectiveness of our approach is shown using a common available system-on-chip implementation using an open-source standard-cell library for characterization and a FPGA-based emulation platform for demonstration.

Many near field communication (NFC)-based reader / smart card applications are operated at a maximum magnetic field strength to increase the smart card's operational stability. However, a maximum magnetic field strength is worthwhile only in situations of high smart card power requirements (e.g., performing cryptographic operations) or long distance communications. As a result, electrical power is wasted, which limits the run-time of mobile battery-operated reader devices. Here we present an adaptive field strength scaling (AFSS) methodology. The strength of the reader's emitted magnetic field is modified depending on the instantaneous power consumption requirements of the smart card. When the smart card consumes less power, the magnetic field strength is reduced. Whereas when it consumes more power, the magnetic field strength is increased. Thus, the power consumption of the reader / smart card system as a whole is optimized while preserving the smart card's operational stability. In this work, we present the design and implementation of two different AFSS approaches. A reader / smart card hardware emulation platform is used to prove the AFSS technique's feasibility and proper functionality. Experimental tests demonstrate that the energy consumption of the AFSS enhanced reader / smart card system can be reduced by up to 54% compared to current commonly used approaches. Furthermore, we show that the smart card's stability is preserved if the AFSS technique is applied.

Today security and safety applications are often a large conglomerate of complex different components. Because of a strong trend to high system integration to fulfill financial and production cost constraints, as much of these components as possible are combined to form large-scale system-on-chips. Risks of dependability and security problems caused by device degradation and adversaries lead to a wide range of research concerning fault detection and recovery techniques in recent years. Especially in safety systems the concurrent use of different checking techniques, to protect the integrity of the operation, is preferred. Standard duplication or triplication methods for such critical devices are not completely fulfilling this property and raising a need for new on-line testing and recovery methodologies. Furthermore, the smart-card sector produces a strong need for new checking techniques with a low resource footprint. Therefore, this paper presents a novel automatized hardware generation flow to create a predictive control signal monitor unit in an automatized way. Depending on the instruction loaded by the processor pipeline this unit will predict the signature of following control signal changes. Hence, a new way of fault detection, weak checking, is implemented without introducing any large additional hardware blocks. A case study using an open-source processor is also presented to show the applicability of our approach.

In recent years the wide spread introduction of small embedded systems into every corner of everyday life lead to the strong need for highly reliable and secure computing machines. These machines now affect the safety of humans as well as the security of personal data and consequently money transactions. To ensure the integrity of these systems' operating state, several fault detection mechanisms have been developed to safely correct or stop unforeseen execution behavior. Because of the rise of battery or even field-supplied systems these mechanisms often heavily decrease available power budgets or lead to significantly increased production costs. Therefore, this paper introduces novel micro-architectural execution signature characterization and handling techniques for system-on-chip designs providing power estimation hardware. Existing power sensor infrastructure is reused to enable efficient system-state monitoring using micro-architectural hashes to cover a wide range of implemented system functionality. Reduced hashing implementations are characterized for their fault detection efficiency. This hardware-based approach provides a completely transparent solution to counteract faults resulting from emerging wearout defects or intentional attacks on the execution integrity.

Domain modeling is a key task in Software Product Line (SPL) development. We identified two popular modeling paradigms: Feature-Oriented Domain Modeling (FODM) and Domain-Specific Modeling (DSM). The representation of the domain model is crucial in SPL engineering, since domain models have a long lifecycle and represent the externalized organizational domain knowledge. For complex and heterogeneous domains, such as embedded systems, different representation techniques can be useful to describe different aspects of the system.

Wireless sensor networks (WSNs) are power critical systems, because they are used in application areas without wired infrastructure. Each sensor node needs a dedicated power supply. Today's protocols and applications for WSNs are often power-aware. However, the state-of-charge (SoC) estimation of the energy storage component (e.g. rechargeable battery) influences the decisions of the power-aware software. A measurement error may cause wrong decisions which would reduce the lifetime of the network. This work presents the simulation results of the impact of an SoC measurement error on the network lifetime running a simple and an enhanced power-aware WSN application. A simulation environment written in SystemC-AMS is used, which enables the combined simulation of the sensor node's application software and its hardware. The simulation shows a reduction of the network lifetime of 3.13% caused by an erroneous measurement. However, the enhanced software is able to increase the network lifetime by 1.66%.

Standby power consumption of electric devices is a growing waste of energy. Between 5% and 14% of the residential electrical power consumption is caused by devices being in standby mode. Depending on the device type, more than 50% of standby power consumption could be saved by applying state-of-the-art power management techniques. By implementing a zero energy standby design and outsourcing power consuming user interfaces, even more electrical power can be saved. Here we present a novel Near Field Communication (NFC) interfacing method for everyday electronic devices. By implementing this interface, the target device can be shut down during idle times. Thus, standby power consumption is eliminated completely. If user interaction is requested, NFC provides the electrical energy to switch on the target device's power supply and to start the device. Furthermore, any control, status, and maintenance information can be transmitted over NFC. By outsourcing high power dissipating and unoptimized user interfaces (touch screens, WiFi, etc.) to the power optimized NFC reader, further energy savings are possible also during running state. This paper demonstrates the implementation and integration of this novel interfacing technique into common consumer electronics. Two implementation approaches are presented. A simple, energy harvesting-based approach illustrates the basic working principle. The second, more sophisticated approach, enables also authentication, encrypted data transfer, user interface outsourcing, configuration and control tasks, etc. A proof of concept is demonstrated by means of an access control terminal.

Innovation cycles have been shortening significantly during the last years. This process puts tremendous pressure on designers of embedded systems for security-or reliability-critical applications. Eventual design problems not detected during design time can lead to lost money, confidentiality, or even loss of life in extreme cases. Therefore it is of vital importance to evaluate a new system for its robustness against intentionally and random induced operational faults. Currently this is generally done using extensive simulation runs using gate-level models or direct measurements on the finished silicon product. These approaches either need a significant amount of time and computational power for these simulations or rely on existing product samples. This article presents a novel system evaluation platform using power emulation and fault injection techniques to provide an additional tool for developers of embedded systems in security-and reliability-critical fields. Faults are emulated using state-of-the-art fault injection methods and a flexible pattern representation approach. The resulting effects of these faults on the power consumption profile are estimated using state-of-the-art power emulation hardware. A modular system augmentation approach provides emulation flexibility similar to fault simulation implementations. The platform enables the efficient evaluation of new hardware or software implementations of critical security or reliability solutions at an early development phase.

The increasing level of integration and decreasing size of circuit elements leads to greater probabilities of operational faults. More sensible electronic devices are also more prone to external influences by energizing radiation. Additionally not only natural causes of faults are a concern of today's chip designers. Especially smart cards are exposed to complex attacks through which an adversary tries to extract knowledge from a secured system by putting it into an undefined state. These problems make it increasingly necessary to test a new design for its fault robustness. Several previous publications propose the usage of single bit injection platforms, but the limited impact of these campaigns might not be the right choice to provide a wide fault attack coverage. This paper first introduces a new in-system fault injection strategy for automatic test pattern injection. Secondly, an approach is presented that provides an abstraction of the internal fault injection structures to a more generic high level view. Through this abstraction it is possible to support the task separation of design and test-engineers and to enable the emulation of physical attacks on circuit level. The controller's generalized interface provides the ability to use the developed controller on different systems using the same bus system. The high level of abstraction is combinable with the advantage of high performance autonomous emulations on high end FPGA-platforms.

Since the discovery that hardware used for cryptographic applications could leak secret information through its power or radiation profile a wide range of possible attack methods has been published. The rapid evolution of these side-channel attacks made it increasingly important to minimize this possible information leakage. Additionally timing information also derived from this power profile is used to control fault-attack campaigns to drive the system into an unintended state. Therefore a wide range of leakage countermeasures has been developed for dedicated cryptographic hardware. Contrariwise only little work is available concerning power profile scrambling techniques for cryptographic software implementations running on general purpose architectures. Such implementations often include power management hardware to cope with several power budget constraints which could be used to influence the system's power consumption during run-time. This paper proposes a novel side channel attack countermeasure technique using such power management methods in combination with techniques for power profile manipulation. State-of-the-art power estimation hardware using a reduced power model allows for the efficient on-line monitoring and manipulation of the power consumption and radiation profile.

The supply voltage level has emerged as an important metric alongside power consumption information to investigate system stability and reliability issues. In this paper, we propose a supply voltage emulation platform based on a power emulation approach to derive real-time power and supply voltage information from a system. Moreover, we present a dynamic voltage and frequency scaling (DVFS) based voltage drop compensation scheme to maintain stable system operation. The early design phase applicability of our emulation-based approach enables the investigation of the effectiveness of voltage drop compensation schemes before the final chip is available.

Wireless sensor networks (WSNs) are typically used in application areas without wired infrastructure or mobility. Therefore, each sensor node needs its own energy supply unit. Sustainable WSNs are powered by energy harvesting systems (EHSs). These systems harvest and buffer the energy from the environment into rechargeable batteries or double layer capacitors. Due to the fact that the connectivity of the WSN depends on every single sensor node, it is important to know the state-of-charge (SoC) of the buffer to determine the remaining operating time. Therefore, each node has to measure its SoC, calculate the remaining operating time and populate this information through the network. The measurement is usually done by an integrated analog-to-digital converter (ADC) of the microcontroller. Each ADC has a specified error that has to be taken into account at the calculations of the remaining operating time. This work presents the error analysis of the SoC measurement using different energy storage components.

Wireless sensor networks (WSNs) are resource-constrained devices. Especially energy is scarce. Recent advances with energy harvesting system (EHS) technology now offer new opportunities for long-lived WSNs. Several prototypes of EHS-enhanced WSN platforms have recently been designed in a low-power and power-efficient way. While the field starts to mature there are still a few lessons to be learned for building low-cost and robust systems. Especially, perpetual systems pose new constraints that have not yet been formalized in well-established metrics. Several studies exist, that try to tune systems and algorithms offline for being able to cope with different situations that might occur. The prediction of solar traces is a well-known example for EHS-enhanced WSNs. However, it is a cumbersome task trying to be prepared for all possible extreme conditions especially when prediction is needed. Therefore, we introduce RiverMote which is a low-cost highly efficient design with extended black-out sustainability (BOS) capabilities. We suggest to put special focus on BOS as a mechanism that can even react to hard-to-model events in a general way without the need to rely on error-prone prediction mechanisms. RiverMote is a low-cost WSN platform with integrated EHS. It outperforms state-of-the-art EHS technology efficiency for WSNs and supports BOS of more than three weeks.

Energy efficiency is very important for mobile devices and wireless sensor networks (WSNs), because the consumable energy is limited. Therefore, the operating time of such devices depends mainly on the capacity of the energy storage component and on the average power consumption of the device. The power consumption depends on the supply voltage and on the activated components of the hardware. This work presents the evaluation of component-aware dynamic voltage scaling (CADVS). This low power technique combines the power-down of unused components and the minimization of the supply voltage. Typically, each component of the hardware (microcontroller, transceiver, sensors) has its own supply voltage range. Therefore, the minimum allowed supply voltage depends on the activated components. However, the activated components and consequently the minimum allowed supply voltage varies over time. CADVS uses voltage converter to adjusts the supply voltage of the hardware to save as much energy as possible. This work presents the evaluation of six different voltage converters. It has been shown that CADVS can be used to save up to 38.7% of the energy compared to a constant voltage supply using the introduced scenario while achieving the same end-user performance.

Automotive network technologies such as FlexRay present a cost-optimized structure in order to tailor the system to the required functionalities and to the environment. The space exploration for optimization of single components (cable, transceiver, communication controller, middleware, application) as well as the integration of these components (e.g. selection of the topology) are complex activities that can be efficiently supported by means of simulation. The main challenge while simulating communication architectures is to efficiently integrate the heterogeneous models in order to obtain accurate results for a relevant operation time of the system. In this work, a run-time model switching method is introduced for the holistic simulation of FlexRay networks. Based on a complete modeling of the main network components, the simulation performance increase is analyzed and the new test and diagnosis possibilities resulting from this holistic approach are discussed.

Ensuring a correct signal integrity within the entire FlexRay network and for all the possible environmental situations is mandatory for reliable operation of the distributed application. However, this is a goal difficult to reach due to the large number of parameters that influence the signal integrity. The use of simulation is a natural answer to efficiently support space exploration. We discuss in this work how the TEODACS test approach supports the validation process of the simulation models for FlexRay topologies and provides trustfulness for the simulation results even if hardware reference is not available. Further, we introduce a new method for the advanced analysis and evaluation of signal integrity in FlexRay networks.

Today power dissipation is the most important constraint for Systems-on-Chips (SoCs). Consequently, it is necessary to consider power in the requirements of mobile, battery-powered devices in which SoCs are often used. These power requirements describe battery lifetime, power constraints and low-power states. Verification ensures that the system fulfills the power requirements. However, verifying all requirements of the complex SoC design needs considerable effort. We introduce a methodology to reduce the verification effort through a high degree of automation. Our novel approach to verify battery lifetime, power constraints and the power aware design comprises three parts. First, a semi-formal use case format unifies specification of power and system requirements. Second, these specifications are used to automatically derive test cases and to generate a verification environment. Third, fast simulation and power estimation are employed to verify battery lifetime, power constraints and the power aware design against the requirements.

With the advent of increasingly complex systems, the use of traditional power estimation approaches is rendered infeasible due to extensive simulation times. Hardware accelerated power emulation techniques, performing power estimation as a by-product of functional emulation, are a promising solution to this problem. However, only little attention has been awarded so far to the problem of devising a generic methodology capable of automatically enabling the power emulation of a given system-under-test. In this paper, we propose an automated power characterization and modeling methodology for high level power emulation. Our methodology automatically extracts relevant model parameters from training set data and generates an according power model. Furthermore, we investigate the automation of the power model hardware implementation and the automated integration into the overall system's HDL description. For a smart card controller test-system the automatically created power model reduces the average estimation error from 11.78% to 4.71% as compared to a manually optimized one.

Small embedded systems are often powered by unreliable power supplies like energy harvesting systems or external power supplies. For secure embedded systems a sudden loss of power can violate data integrity. The power has just to drop when data is written to non-volatile memory. In order to guarantee data integrity, a secure embedded system has to provide an anti-tearing mechanism. In this work we summarize a fast simulation based test method for such mechanisms.

TinyOS2 (TOS2) is the state of the art operating system for wireless sensor network (WSN) programming. There are a number of testbeds and simulation tools for checking functional correctness and a few integrated development environments (IDEs) that support graphical user interface (GUI) and power profiling of WSN simulation as well. All these systems and environments are tailored towards design optimization of WSNs subject to functional correctness and energy conservation. Unfortunately, all these approaches lack self-contained support for energy harvesting systems (EHSs) which is the state of the art technique for tackling the energy conservation problem. Here, we present the design and implementation of a self-contained X-in-the-loop approach. TOSPIE2 is an Eclipse plug-in that integrates TOS2 installation and compilation support, power profiles and EHS efficiency in simulation and measurement.

Power profiling methods are indispensible in the power-aware design of HW/SW systems. By extending functional emulators with power estimation hardware, high-level power information can be derived during run-time, yielding a considerable speed-up as compared to simulation based approaches. A key enabler for the widespread use of the power emulation methodology is the automation of both power model creation and HDL adaptation. In this paper, we outline our system-level power emulation technique as well as its automatic power modeling and hardware adaptation. Furthermore, applications in the field of HW/SW power management are illustrated.

According to the standard IEC 61508 fault insertion testing is required for the verification of fail-safe systems. Usually these systems are realized with microcontrollers. Fail-safe systems based on a novel CPLD-based architecture require a different method to perform fault insertion testing than microcontroller-based systems. This paper describes a method to accomplish fault insertion testing of a system based on the novel CPLD-based architecture using the original system hardware. The goal is to verify the realized safety integrity measures of the system by inserting faults and observing the behavior of the system. The described method exploits the fact, that the system contains two channels, where both channels contain a CPLD. During a test one CPLD is configured using a modified programming file. This file is available after the compilation of a VHDL-description, which was modified using saboteurs or mutants. This allows injecting a fault into this CPLD. The other CPLD is configured as fault-free device. The entire system has to detect the injected fault using its safety integrity measures. Consequently it has to enter and/or maintain a safe state.

Integration work at system level has been made easier with the introduction of the time-triggered concept and technologies such as FlexRay. Paradoxically, the ongoing integration efforts at component level have led to complex local interactions between the subsystems that are difficult to analyze globally. We present in this work a test environment for automotive networks that goes beyond the component boundaries and enables the concurrent analysis of the entire communication architecture. This supports the investigation of data- and fault propagation within the system as well as the analysis of the interactions between the components. Supported by an industrial use case, we discuss how this environment improves fault detection and diagnosis of the system.

The introduction of FlexRay in the automotive industry as well as the standardization efforts for the hardware and software architecture rise different challenges: How to efficiently integrate the new services in the system, how to validate the communication architecture with respect to the effects influencing the network? The research project TEODACS aims at answering these questions. We present in this document a new validation approach for the communication architecture based on the simulation of the entire FlexRay network within a co-simulation framework. This environment largely reduces the processing resources required for simulation and thus makes the analysis of such complex system possible.

The complexity of embedded systems is continuously growing due to the increasing requirements on performance. In portable systems such as smart cards, not only performance is an important attribute, but also the power and energy consumed by a given application. Sources of energy used in smart card systems like batteries and electromagnetic fields are not such ideal elements, as their effectiveness depends heavily on the energy consumed over time. Optimization strategies proposed so far are implemented statically. Often a manual measurement of the current profile followed by manual optimizations is carried out. This procedure is very time consuming. We present a method for reducing automatically the power of an application based on a compiler optimization.

Developing modern integrated and embedded systems require well-designed processes to ensure flexibility and independency. These features are related to exchangeability of hardware targets and to the ability of choosing the target at a very late stage in the implementation process. Especially in the field of ultra high frequency radio frequency identification (UHF RFID) the model-based design approach leads to expected results. Beside a clear design process, which is applied in this work to build the required system architecture, the scope for UHF RFID simulations is defined and an extendable platform based on the MathWorks Matlab Simulinkreg is developed. This simulation platform, based on a multi-processor hardware target, using a Texas Instruments TMS320C6416 digital signal processor is able to run UHF RFID tag simulations of very high complexity. The highest effort is made to ensure flexibility to handle future simulation models on the same hardware target, realized by the continuous design and implementation flow of this platform based on model-based design

Enhanced RFID tag technology especially in the UHF frequency range provides extended functionality like high operating range and sensing and monitoring capabilities. Such functionality requiring extended system structures including data acquisition units, real time clocks and active transmitters causes a high energy consumption of the tag and requires an on board energy store (battery). As a key parameter of the reliability of an RFID system is the lifetime, the energy budget of the higher class tag has to be as balanced as possible. This can be achieved by using energy harvesting devices as additional power supply. The PowerTag1project and thus this paper proposes special energy storage structures interfacing energy harvesting devices and dealing with their special requirements for the use with battery-driven higher class UHF RFID tags. Different implementation variants of such structures are compared by using accurate simulation models of the various parts of the system. The results of the simulations are compared to manufacturer given and guaranteed system performance parameters of a state-of-the-art higher class UHF RFID system.

Component based software engineering (CBSE) suggests the idea of applications as assemblies of prefabricated components. Practical experiences with the CORBA component model (CCM), which is a multi-language and multi-platform component architecture, have shown that pure syntax declarations are inadequate for describing trustworthy software components, in particular for reuse. In this paper we present a contract extension to the CCM metamodel, a contract aware CCM container that improves the trustworthiness of CORBA components and experimental results that explore the runtime impacts of contract verification.

Smart cards are embedded systems which are used in an increasing number of secure applications. As they store and deal with confidential and secret data many attacks are performed on these cards to reveal this private information. Consequently, the security demands on smart cards are very high. It is mandatory to evaluate the security of the design but this is performed often very late in the design process or when the chip has already been manufactured. This paper presents a hierarchical security attack simulation flow for smart card designs where security attacks can be simulated in the processor specific model at transaction layer 1 in SystemC. Therefore, the power consumption profile is analyzed at this level. Preliminary results show that this analysis at high abstraction level can be used to determine vulnerabilities of the system to security attacks. Moreover, points to insert software countermeasures can easily be identified.

In this paper an environment for design verification of smart cards using security attack simulation in SystemC is presented. The method for automatic instrumentation of the SystemC code is described, also depicted is the process by which design robustness against attacks is verified. This process involves the system behavior analysis using an extended control flow graph. The results discuss the system behavior analysis of a Java Card/spl trade/ Virtual Machine.

Smart cards are one of the smallest computing platforms in use today. They are used in an increasing number of security applications. To gain sensitive data, a lot of security attacks are performed on smart cards. Therefore it is mandatory to test smart cards for robustness in matters of security. Tests are very time consuming and are performed often very late in the design process. This paper presents a methodology for high-level fault injection for security attack simulation in smart cards. The fault injection technique into SystemC designs is described and the fault injection tool is presented. Moreover, the system behaviour analysis is depicted. Preliminary results show that this methodology can assist in finding system components vulnerable to security attacks.

Smart cards are one of the smallest computing platforms in use today. Due to their limited resources applications are often simple and less complex. High performance 32-bit smart cards, which were introduced by several vendors in the last years, allow the implementation of complex applications on smart cards. Additional to the high performance processor cores these smart cards contain coprocessors to reach the performance and power consumption goals. The interface between the processor and the coprocessor influences the performance and power consumption and should be evaluated early in the design process. We propose a hierarchical bus model for system-level smart card design which supports accurate energy dissipation estimation. The bus models have been implemented in systemC 2.0 at transaction level layer one (cycle accurate) and layer two (timing estimation). We evaluate accuracy and simulation performance of the models and show their usage as bus functional models for a smart card application.

Due to slow improvements in battery technology there will be an insignificant increase of battery capacities in near future. Therefore, the ubiquitous environment should help mobile battery-operated devices to increase their runtime. One possibility is power aware remote processing. The needed flexibility should be provided by power aware middleware. This paper describes a concept for adaptive power aware remote processing, shows some implementation details, and presents evaluation results of real-world image processing tasks.

In this paper, a co-processor for run-time energy estimation in system-on-a-chip designs is proposed. The estimation process is done by using power macro-models, thus making analogue measurement equipment obsolete to the software engineer once the system-on-a-chip (SOC) design is characterized. Compared to sampling-based profiling systems [17], the performance overhead of energy profiling is less, because the energy estimation is done completely parallel to the functional units residing on the SOC. The proposed methodology can be used for run-time power optimization and in-system energy profiling. The co-processor was evaluated on a SOC for MPEG layer III audio decoding and the experimental results show a maximum relative error of <5%.

Short product cycles and rapidly changing requirements are increasingly forcing developers to use agile development strategies like extreme programming and test-driven development. At the same time, hierarchical software design strategies such as component based software engineering are becoming necessary to overcome increasing software complexity. In this paper, we present a test-driven component development framework that encapsulates test code in a mirror component for automated testing during development, and as an executable semantic to simplify assessment and to increase trustworthiness of software systems.

In recent years the interest on the problem of designing mixed hardware/software systems has increased due to growing system complexities. This paper describes a hardware/software codesign framework for the design of embedded systems based on digital signal processors and FPGAs. Our approach is based on distributed DSP virtual machines for simulation and verification of the application on a Linux cluster and for running the application on different target architectures (DSPs, FPGAs) as well. The DSP virtual machines were designed to make DSP applications portable across different platforms while maintaining optimal code.

We present a novel approach to model inter-processor communication in multi-DSP systems. In most multi-DSP systems, inter-processor communication is realized by transferring data over point-to-point links with hardware FIFO buffers. Direct memory access (DMA) is additionally used to concurrently transfer data to the FIFO buffers and perform computation. Our model accounts for the limited size of the communication buffers as well as concurrent DMA transfer. This novel communication model is applied in our rapid prototyping environment for optimizing multi-DSP systems. Given an extended data flow graph of the DSP application and a description of the target multi-processor system our rapid prototyping environment automatically maps the DSP application onto the multi-processor system and generates a schedule for each processor.

The goal of decentralization in failure detection, identification, and recovery of high-assurance systems is to focus diagnosis on safety-critical components. The goal of probabilistic causal reasoning in diagnosis is to improve performance of fault isolation, However, this reasoning method is dependent on prior reliability knowledge. Our approach aims at focusing the overall diagnostic cycle in two independent ways: first, autonomous agents diagnose high-consequence appliances of a modular manufacturing system and second prior reliability data needed is derived from a quality assurance program. Therefore we present a hybrid technique in combining quality assurance data, failure mode and effects analysis and probabilistic causal reasoning. We develop a dynamic Bayesian network which, given evidence from sensor observations, is able to learn and reason over time. We successfully apply autonomous diagnosis agents in concert with reliability assessment to improve online diagnosis of a pneumatic-mechanical device.

This paper presents the development of repeaters and line equipment for an experimental digital long-haul transmission system using coaxial cable. A comparison, of different types of digital transmission systems indicates that the digital repeater hybrid system with binary transmission code is the most desirable. This development has resulted in digital pulse reshaping repeaters with very small dimensions, low cost, and good reliability. Both digital repeaters that are without timing and regenerators that include timing have been developed. Their circuitry and the corresponding signal shapes are described. The dc power-feeding system and the fault-location system are also discussed. An experimental field trial with the Deutsche Bundespost was performed over 10-repeater sections of the International Telephone and Telegraph Consultative Committee (CCITT) normal coaxial tube with a section length of 1/2 mi, The experiments confirmed that a long-haul digital transmission system of 560 Mbits/s, and later of 1100 Mbits/s using the described system concept and technology, can be established with relatively low cost and good reliability.