IEC 60848 GRAFCET is a standardized, graphical specification language for control functions. Because of the semiformal nature of IEC 60848, the details of specifications created with GRAFCET can be interpreted in different ways, possibly leading to faulty implementations. These ambiguities have been partially addressed in existing literature, but solved in different manners. Based on a literature review, this work aims at providing an overview of existing interpretations and, based on that, proposes a comprehensive interpretation algorithm for IEC 60848, which takes all relevant ambiguities from the literature review into account.

The graphical modeling language GRAFCET is used as a formal specification language in industrial control design. This paper proposes a structural analysis that approximates the variable values of GRAFCET to allow verification on specification level. GRAFCET has different elements resulting in concurrent behavior, which in general results in a large state space for analyses like model checking. The proposed analysis approach approximates that state space and takes into consideration the entire set of GRAFCET elements leading to concurrent behavior. The analysis consists of two parts: We present an algorithm analyzing concurrent steps to approximate the step variables and we adapt analysis means from the field of Petri nets to approximate internal and output variables. The proposed approach is evaluated using an industrial-sized example to demonstrate that the analysis is capable of verifying behavioral errors and is not limited by the specification size of practical plants.

Model checking of GRAFCET, an IEC standardized specification language, is typically performed by a translation of GRAFCET into a different (target) formalism. However, analyzing instances of considerable sizes quickly becomes unfeasible due to the state space explosion problem. We propose three techniques to reduce a GRAFCET instance depending on the property to be evaluated, resulting in a smaller state space. These techniques can be employed, even in combination, before transformation into a formalism suitable for model checking.

The graphical modeling language GRAFCET is used as a formal specification language in industrial control design. This paper proposes a static analysis approach based on the control flow of GRAFCET using abstract interpretation to allow verification on specification level. GRAFCET has different elements leading to concurrent behavior, which in general results in a large state space. To get precise results and reduce the state space, we propose an analysis suitable for GRAFCET instances without concurrent behavior. We point out how to check for the absence of concurrency and present a flow-sensitive analysis for these GRAFCET instances. The proposed approach is evaluated on an industrial-sized example.

Roads are one of the most important transportation routes in the world, yet the way we build roads has remained the same for decades. The road system’s structure is virtually unchanged, and there is little use beyond the primary function of load transfer. However, the road could be an essential data source for different applications. This paper presents an algorithm for detecting and tracking vehicles passing over the road surface using real-time load data. We detect individual tires based on local pressure maxima on the surface and track them using a multiple-target tracker. Our algorithm subsequently identifies individual vehicles performing pattern matching with the tracked wheels. We tested the algorithm in the Cyber-Physical Mobility Lab because there is yet to be a system for real-world testing, and cyber-physical labs are more flexible and less expensive than real-world testing. In our test run, we achieved a vehicle detection accuracy and recall of 100% and a localization accuracy of a few centimeters.

Automatic test suite generation is an established technique used to generate test suites adhering to structural coverage metrics of PLC software. In order to reduce redundancy in the test suite generation after a structural reconfiguration to the PLC software has occurred, reusable summaries of program parts should be employed. This paper presents a combination of state-of-the-art symbolic execution and static analysis algorithms for test suite generation and summary reuse. The general rationale is to improve efficiency by not doing redundant work. For this purpose, summaries of function blocks are cached and reused to benefit from the previous analysis. As code untouched from reconfigurations will result in equivalent path conditions summaries can aid in speeding up regression testing. The proto-typical implementations of several techniques are evaluated and compared using selected domain-specific benchmarks showing the ineffectiveness of using summarization during test suite generation for reconfigurable logic control software.

This paper presents an approach for allocation of resources in an automotive service-oriented software architecture. Using mathematical optimization, we assign computational resources of an automotive compute cluster to a set of software services. Additionally, scheduling parameters of services are optimized under the consideration of dependencies between data flows and computations within services. The optimization minimizes power consumption and the maximum execution times of critical effect chains in a multi-objective optimization problem. The evaluation investigates the achievable reduction in power consumption using an exemplary system. Furthermore, we demonstrate a sharp reduction in maximum execution times of effect chains that span multiple services and ECUs.

This paper demonstrates a system comprised of infrared beacons and a camera equipped with an optical band-pass filter. Our system can reliably detect and identify individual beacons at 100m distance regardless of lighting conditions. We describe the camera and beacon design as well as the image processing pipeline in detail. In our experiments, we investigate and demonstrate the ability of the system to recognize our beacons in both daytime and nighttime conditions. High precision localization is a key enabler for automated vehicles but remains unsolved, despite strong recent improvements. Our low-cost, infrastructure-based approach is a potential step towards solving the localization problem. All datasets are made available here https://embedded.rwth-aachen.de/doku.php?id=forschung:mobility:infralocalization:concept.

This paper presents a method for generating coupling topologies for multi-agent systems. Our method is based on a non-cooperative game in which each agent chooses couplings to activate or deactivate using a utility function. The utility function measures the importance of agents to one another and enables conflict avoidance in distributed decision-making. Depending on the application’s needs, our method is able to generate unidirectional or bidirectional couplings. In our evaluation, we used car-like robots in a simulation environment. It shows that the generated coupling topologies are applicable to the domain of networked and autonomous vehicles.

In the context of the Industrial Internet of Things safety and robustness play a crucial role as autonomous and emergent behavior increase the complexity of Cyber-Physical Production Systems. Given the intractability of exhaustively verifying distributed production systems, testing and runtime monitoring seem to be two promising methods used to verify correctness in the digitally networked factory. External runtime monitoring is an efficient and lightweight technique that bridges the gap between testing and verification.This paper describes a framework for on-the-fly monitor generation using a state-of-the-art monitoring algorithm for proving properties of a distributed production system relying on the Amazon Web Services Internet of Things architecture and the use of the digital shadow. The feasibility of the proposed architecture is evaluated using an industrial case study.

This paper investigates a method for pose control of multiple nonholonomic vehicles using time-optimal control in a Model Predictive Control (MPC) framework. The vehicles are driving on a limited space considering field boundaries to build-up a formation. Distributed Model Predictive Control (DMPC) in a priority-based manner reduces computation time and avoids vehicle collisions. Priorities are automatically set by evaluating the target poses of the vehicles. We demonstrate our method in simulations. It produces near-optimal trajectories and reduces the compuation time in comparison to centralized MPC.

Decompression algorithms in hyperbaric applications currently usually base on information about the ambient pressure in a temporal course. However, the impact of other factors like temperature or physical activity is well documented in literature. Therefore, we elaborated a prototypic setup, which is not only able to enrich the decompression algorithms run on a diving computer by this data, but also store this information for successive data mining.

The safety of software-based control systems plays an essential role in a vast number of applications. SynTACS is a tool that generates a framework for controller supervision, which enforces safety during runtime by utilizing the supervisory control theory of Ramadge and Wonham. In this paper, the results of a user study are presented in which it was investigated how far discrete-event systems, the underlying modeling formalism, are suitable to express safety requirements. Further, the usability of the tool was evaluated. In the second part, several concepts are introduced to support use cases that require real-time controllers due to unstable processes. Finally, two case studies are presented to show the applicability of both the tool and the new concepts.

Static code analysis is a convenient technique to support the development of software. Without prior test setup, information about a later runtime behavior can be inferred and errors in the code can be found before using a regular compiler. Solutions to apply static code analysis to PLC software following the IEC 61131-3 already exist, but using these separate tools usually creates a gap in the development process. In this paper we introduce an architecture to use static analysis directly in a development environment and give instant feedback to the developer while he is still editing the PLC software.

Hardware-in-the-loop (HiL) Simulation is a powerful method to reduce the risk of system failures leading to expensive damages. Many existing HiL tools require the tester to use proprietary test specification languages, usually unknown to the domain of a PLC programmer. This work presents a novel approach of HiL test specification using programming languages specified by IEC 61131-3. By doing this, PLC programmers are able to specify test cases in the domain they are already familiar with.

Automated production systems need to be thoroughly tested. For this, the fully integrated system, consisting of software and hardware, is investigated for remaining bugs using system tests. Unlike unit tests, these tests involve human interaction with the system and are mostly performed manually, without any tool support for their simulation or adequacy examination. Thus, important functionality can be overlooked during testing, decreasing the overall system quality. Coverage measurement during testing can be a valuable support for assessing test adequacy, but requires instrumentation that might influence the real time behavior of the system. Further, test adequacy cannot be calculated until all tests have been executed. To tackle these problems, we propose an approach that aims at estimating coverage criteria prior to system test execution at the aPS and without instrumenting the code or defining hardware simulations. To this end, the nominal hardware behavior and human interaction models are derived from existing integration tests, enabling a priori estimation of the system test coverage via simulation of the software along with the deduced behavior.

Summary Different approaches for extending the original Android platform with real‐time capabilities were presented in the last few years. Most of the work covers fundamental issues like real‐time scheduling and non‐blocking memory management. This article shows the weak predictability of Android's internal intra‐process and inter‐process communication based on Intent messaging and presents a concept to improve its soft real‐time capability. The proposed approach introduces a priority‐based broadcast handling using explicit priority values, instead of the original first in – first out processing. Furthermore, the size of responsible critical sections is reduced in order to improve the preemptibility and to assure predictable processing times for applications with real‐time requirements. Our evaluation highlights the improvements in comparison with the original Android implementation without any loss of the system performance. Additionally, the compatibility with already existing components and applications is preserved. Copyright © 2017 John Wiley & Sons, Ltd.

Supervisory control theory, introduced by Ramadge and Wonham, provides a method to synthesize a supervisor that keeps a discrete-event system model inside a previously specified safe state space. In order to apply this technique on physical plants, the user has to provide a model representation of the latter, on the one hand, and of the safety specification on the other hand. This contribution introduces three methods to improve that modeling process and decrease the necessary manual effort by syntactic means. These are hierarchical namespaces for events and automata, automaton templates with abstract roles, and conditional transitions and prohibitions.

In this work we present an abstract interpretation based static value set analysis method tailored for Sequential Function Charts (SFCs). Translation based approaches that transform SFCs into different presentations - and thus loosing the structure - have shown to be imprecise for this language. Our approach thus keeps the SFC structure and additionally provides value sets as entry-and exit information for each set of possibly active steps in the SFC. Further, analysis information for actions connected to the steps is provided, to allow for in-depth debugging. Beside value set information, our analysis does structural checks and, hence, is able to generate warnings for erroneous SFC behaviour, as specified in the IEC-61131-3 standard. As some semantic aspects for SFCs are left open in the standard specification, our analysis adopts the CODESYS semantics.

MATLAB/Simulink is a widespread tool for modelbased software development within the automotive domain. Industrial sized models developed with Simulink often contain more than 20000 blocks connected by complex dependency relations. Those relations are mostly concealed by architectural pattern within the model. Common tools to discover dependencies during model development/maintenance are static analyses and slicing algorithms. In this paper we present a flow sensitive definition of data dependence for Simulink models for the inclusion within such analyses. It is tailored to describe dependencies hidden by the architecture of the model. This includes the distinction of data dependencies of virtual from nonvirtual blocks, the impact of buscapable blocks and bus signals. When integrated into a slicing algorithm, the relation enables accurate tracing of the atomic and composite signal flow of a model via its program dependence graph. We evaluate the created slicing algorithm with models from industrial case studies against another approach from the literature. During the evaluation of the slicing algorithms we could observe a reduction of the average slice sizes by up to 66%, due to the inclusion of the proposed data dependency relation.

This paper introduces the artshop model repository framework which, among others, includes methods to analyse the structure and quality of the architecture of model-based software developed with The Mathwork's Matlab-Simulink/Stateflow. The framework supports the import of MATLAB-Simulink/Stateflow models and is able to synchronize imported models with their initial sources. Imported model data can be queried, inspected, analyzed and enriched with meta-information like associations or additional documentation. Analyses provided by artshop include duplicate detection, model slicing, various coupling and cohesion metrics and user-defined conformity checks for MATLAB/Simulink models.

This paper presents a method for automatic test case generation for PLC software following the IEC61131-3 standard. The core component is a model checker that iteratively creates program traces, each of them covering a part of the program in terms of a coverage metric. These test cases are translated into Structured Text, a programming languages defined in the IEC61131-3, to allow the execution on a soft-PLC or the actual hardware. Our approach is evaluated on a set of function blocks that are used in industry. We demonstrate that test cases can be automatically generated within few seconds in most cases.

This paper introduces the application of off-the-shelf Android tablet computers as real-time capable control devices. We present an IDE to create and execute PLC programs written in Structured Text on a tablet running RTAndroid. This derivative of Android with support for real-time applications ensures the predictable execution of PLC programs. A USB-driven field device adapter enables interaction with peripheral hardware. The evaluation demonstrates the competitiveness of our solution in comparison to conventional PLC devices.

Static code analysis techniques are a well-established tool to improve the efficiency of software developers and for checking the correctness of safety-critical software components. However, their use is often limited to general purpose or “mainstream” programming languages. For these languages, static code analysis has found its way into many integrated development environments and is available to a large number of software developers. In other domains, e. g., for the programming languages used to develop many industrial control applications, tools supporting sophisticated static code analysis techniques are rarely used. This paper reports on the experience of the authors while adapting static code analysis to a software development environment for engineering the control software of industrial process automation systems. The applicability of static code analysis for industrial controller code is demonstrated by a case study using a real-world control system.

Operating systems of modern mobile devices, like e.g. iOS and Android, require the applications to conform to a life cycle model, to ensure the functional correctness of the application and its data integrity over exceptional behavior as e.g. out-swapping of the application. The applications life cycle events are triggered asynchronously by the system and depend on the environment. In order to test life cycle dependent properties of the applications, we define a unit testing based approach that uses life cycle callback-methods. The method identifies life cycle dependent properties in the application specification, and derives assertion-based test cases for validating the conformance of the properties. Life cycle triggers are used in the test case execution. The paper describes to which application features the approach can be applied, and the limitations of the approach. A case study demonstrates how to apply our approach to state-of-the-art mobile platforms, using Android 2.2 as an example.

This paper introduces Arcade.PLC, a verification platform for programmable logic controllers (PLCs). The tool supports static analysis as well as ACTL and past-time LTL model checking using counterexample-guided abstraction refinement for different programming languages used in industry. In the underlying principles of the framework, knowledge about the hardware platform is exploited so as to provide efficient techniques. The effectiveness of the approach is evaluated on programs implemented using a combination of programming languages.

We introduce a new concept of modeling timed behavior in pi-calculus by representing timed actions (or timers) as interactions between application processes and clock processes. This approach extends the original calculus in a manner such that bisimulation arrangements in pi-calculus remain untouched. We also present a tool to simulate specifications written in our timed version of pi-calculus in order to verify their behavior.

Recent advances in symbolic execution have proposed a number of promising solutions to automatically achieve high-coverage and explore non-determinism during testing. This attractive testing technique of unmodified software assists developers with concrete inputs and deterministic schedules to analyze erroneous program paths. Being able to handle complex systems' software, these tools only consider single software instances and not their distributed execution which forms the core of distributed systems. The step to symbolic distributed execution is however steep, posing two core challenges: (1) additional state growth and (2) the state intra-dependencies resulting from communication. In this paper, we present SDE - a novel approach enabling scalable symbolic execution of distributed systems. The key contribution of our work is two-fold. First, we generalize the problem space of SDE and develop an algorithm significantly eliminating redundant states during testing. The key idea is to benefit from the nodes' local communication minimizing the number of states representing the distributed execution. Second, we demonstrate the practical applicability of SDE in testing with three sensor net scenarios running Contiki OS.

Embedded software development has become one of the greatest challenges in the automotive domain, due to the rising complexity of vehicle systems. A method to handle the complexity of automotive software is Model Based Design (MBD). As MBD offers great advantages in early simulation and testing, it has become today's mainstream method for automotive software engineering. However, some aspects can be initially tested after the integration of software on real hardware components (usually by the supplier) and when all parts of a system (e.g. bus systems, sensors, actuators) are present. The consequence is that the requirement specification of the according system possibly contains gaps that can lead to software defects. New technologies like the AUTOSAR standard enable additional potentials for the validation of model based developed software. Due to the AUTOSAR software architecture it is possible for an OEM to realize an early ¿virtual¿ software integration with an acceptable effort and perform at next step a front loading of system tests. In this paper we present an approach that improves the quality of the requirement specification artifacts by using test front loading. In detail, we analyze the requirement engineering part of the software development process to identify aspects that can not be tested without having all system components. Afterwards, we classify these aspects and define an abstract test pattern that can be globally used for testing. Additionally, we illustrate our approach in a case study on an interior light system for the next Mercedes-Benz M-Class generation.

Model checking of binary code is recognized as a promising tool for the verification of embedded software. Our approach, which is implemented in the [MC]SQUARE model checker, uses tailored simulators to build state spaces for model checking. Previously, these simulators have been generated by hand in a time-consuming and error-prone process. This paper proposes a method for synthesizing these simulators from a description of the hardware in an architecture description language in order to tackle these drawbacks. The application of this approach to the Atmel ATmega16 microcontroller is detailed in a case study.

Complex interactions and the distributed nature of wireless sensor networks make automated testing and debugging before deployment a necessity. A main challenge is to detect bugs that occur due to non-deterministic events, such as node reboots or packet duplicates. Often, these events have the potential to drive a sensor network and its applications into corner-case situations, exhibiting bugs that are hard to detect using existing testing and debugging techniques.

Software reliability represents a major requirement for safety critical applications. Several fault tolerance methods have been proposed to improve software reliability. These methods are based on either fault masking such as N-version programming or on fault detection such as in the recovery block method. The success of the recovery block method depends on a high quality of the effective acceptance test, which is sometimes very difficult to achieve. In this paper, we propose a hybrid fault tolerance method called recovery block with backup voting to improve the reliability of the normal recovery block in the case of a weak acceptance test. In the proposed method, a copy of the outcome of each version is stored in a cache memory as backup, and when the recovery block method fails to produce a correct output due to a weak acceptance test, the stored values are used as inputs to a voting method to produce the correct output. A Monte Carlo based simulation method is used to show the reliability improvement in the new proposed hybrid method as well as to show the decreased dependency of the new method on the quality of the acceptance test, which makes the new method more suitable for critical applications where the construction of an effective acceptance test is difficult.

An increasing number of safety-critical functions is taken over by embedded systems in today's automobiles. While standard microcontrollers are the dominant hardware platform in these systems, the decreasing costs of new devices as field programmable gate arrays (FPGAs) make it interesting to consider them for automotive applications. In this paper, a comparison of microcontrollers and FPGAs with respect to safety and reliability properties is presented. For this comparison, hardware fault handling was considered as well as software fault handling. Own empirical evaluations in the area of software fault handling identified advantages of FPGAs with respect to the encapsulation of real-time functions. On the other hand, several dependent failures were detected in versions developed independently on microcontrollers and FPGAs.

The paper presents details of a model checker for microcontroller-based embedded systems, called [mc] square. The purpose of the tool is to make model checking technology applicable in an embedded systems industry context. Consequently, it does not implement new theory but combines existing techniques to achieve the necessary efficiency and usability in a novel application area. One of the pragmatic requirements has been that model checking must be possible without any kind of manual preprocessing of the code. In its core, [mc]square is an explicit state, CTL model checker which builds the state space from the hardware-specific assembly code. The paper describes the tool features in detail and illustrates its abilities using two realistic examples.

This paper discusses important hybrid aspects of chemical processing plants. It is outlined that discrete phenomena occur both on the physical level and in the control of these plants. As the dynamics of the transformations of energy and material are predominantly continuous, large and complex hybrid systems arise. We focus on three different aspects of dealing with such systems: (1) Modeling and simulation of hybrid systems for the design and optimization of plants, controllers and operating strategies. We present powerful simulation environments that have been developed in recent years. (2) Validation of plant instrumentation and discrete controllers. These systems are largely responsible for the safe and economic operation of chemical plants and the protection of the workforce, and the environment. Techniques for the verification of discrete controllers for continuous processes are discussed, which are based on a discrete approximation of the continuous dynamics. (3) Scheduling of batch plants. For plants that are operated in a discontinuous fashion, the timing and sequencing of the operations are very important for the efficient use of the equipment. This leads to large mixed-integer optimization problems. For a typical example, we show how the process and the constraints can be modeled and describe an efficient solution algorithm.