Design methods and tools evolved to support the principle of "separation of concerns" in order to manage engineering complexity. Accordingly, most engineering tool suites are vertically integrated but have limited support for integration across disciplinary boundaries. Cyber–physical systems (CPSs) challenge these established boundaries between disciplines, and thus, the status quo on the tools market. The question is how to create the foundations and technologies for semantically precise model and tool integration that enable reuse of existing commercial and open source tools in domain-specific design flows. In this paper, we describe the lessons learned in the design and implementation of an experimental design automation tool suite, OpenMETA, for complex CPS in the vehicle domain. The conceptual foundation for the integration approach is platform-based design: OpenMETA is architected by introducing two key platforms: the model integration platform and the tool integration platform. The model integration platform includes methods and tools for the precise representation of semantic interfaces among modeling domains. The key new components of the model integration platform are model integration languages and the mathematical framework and tool for the compositional specification of their semantics. The tool integration platform is designed for executing highly automated design-space exploration. Key components of the platform are tools for constructing design spaces and model composers for analytics workflows. The paper concludes with describing experience and lessons learned by using OpenMETA in drivetrain design and by adapting OpenMETA to substantially different CPS application domains.

Design automation tools evolved to support the principle of "separation of concerns" to manage engineering complexity. Accordingly, we find tool suites that are vertically integrated with limited support (even intention) for horizontal integratability (i.e. integration across disciplinary boundaries). CPS challenges these established boundaries and with this - market conditions. The question is how to facilitate reorganization and create the foundation and technologies for composable CPS design tool chains that enables reuse of existing commercial and open source tools? In this paper we describe some of the lessons learned in the design and implementation of a design automation tool suite for complex cyber-physical systems (CPS) in the vehicle domain. The tool suite followed a model- and component-based design approach to match the significant increase in design productivity experienced in several narrowly focused homogeneous domains, such as signal processing, control and aspects of electronic design. The primary challenge in the undertaking was the tremendous heterogeneity of complex cyber-physical systems (CPS), where such as vehicles has not yet been achieved. This paper describes some of the challenges addressed and solution approaches to building a comprehensive design tool suite for complex CPS.

Safety verification of a plant together with its controller is an important part of controller design. If the controller is implemented in software, then a formal model such as hybrid automata is needed to model the composite system. However, classic hybrid automata scale poorly for complex software controllers due to their eager representation of discrete states. In this paper we present safety verification for software controllers without constructing hybrid automata. Our approach targets a common class of software controllers, where the plant is periodically sampled and actuated by the controller. The resulting systems exhibit a regular alternation of discrete steps and fixed length continuous-time evolution. We show that these systems can be verified by a combination of SMT solving and Taylor models. SMT formulas accurately capture control software in a compact form, and Taylor models accurately capture continuous trajectories up to guaranteed error bounds.

Abstract Domain-specific languages(DSLs) are routinely created to simplify difficult or specialized programming tasks. They expose useful abstractions and design patterns in the form of language constructs, provide static semantics to eagerly detect misuse of these constructs, and dynamic semantics to completely define how language constructs interact. However, implementing and composing DSLs is a non-trivial task, and there is a lack of tools and techniques. We address this problem by presenting a complete module system over LP for DSL construction, reuse, and composition. LP is already useful for DSL design, because it supports executable language specifications using notations familiar to language designers. We extend LP with a module system that is simple (with a few concepts), succinct (for key DSL specification scenarios), and composable (on the level of languages, compilers, and programs). These design choices reflect our use of LP for industrial DSL design. Our module system has been implemented in theformulalanguage, and was used to build key Windows 8 device drivers via DSLs. Though we present our module system as it actually appears in ourformulalanguage, our emphasis is on concepts adaptable to other LP languages.

Embedded systems are highly constrained, and modern constraint solvers can be used to synthesize architectures satisfying constraints. However, solvers may enumerate solutions with bias yielding a skewed view of the solution space. In this paper we formalize enumerators, enumeration bias, and build empirically diverse enumerators. An ideal diverse enumerator uniformly draws equivalence classes of solutions. We develop an algorithm, called symmetry-directed randomized partitioning, for constructing empirically diverse enumerators from modern unmodified constraint solvers. We show that our diverse enumerator is significantly closer to the ideal compared to baseline and randomized solvers.

We describe the design and implementation of P, a domain-specific language to write asynchronous event driven code. P allows the programmer to specify the system as a collection of interacting state machines, which communicate with each other using events. P unifies modeling and programming into one activity for the programmer. Not only can a P program be compiled into executable code, but it can also be tested using model checking techniques. P allows the programmer to specify the environment, used to "close" the system during testing, as nondeterministic ghost machines. Ghost machines are erased during compilation to executable code; a type system ensures that the erasure is semantics preserving.

Model-driven architecture (MDA) is a model-based approach for engineering complex software systems. MDA is particularly attractive for designing embedded systems because models can be easily evolved as hardware and software requirements evolve. However, efforts to apply MDA in industrial settings expose several open problems surrounding tooling: Engineers need automated techniques that are scalable, general, and extensible. In this paper we describe the formula framework as a novel approach towards general automation for MDA. We develop a running example and benchmarks to compare our tools with other state-of-theart approaches.

Assigning behavioral semantics to domain-specific languages (DSLs) opens the door for the application of formal methods, yet is largely an unresolved problem. Previously proposed solutions include semantic anchoring, in which a transformation from the DSL to an external framework that can supply both behavioral semantics and apply formal methods is constructed. The drawback of this approach is that it loses the structural constraints of the original DSL along with the details of the transformation, which can lead to erroneous results when formal methods are applied. We demonstrate this problem of ¿forgetful¿ semantic anchoring using existing approaches through a translation from dataflow systems to interface automata. We then describe our modeling tool FORMULA and apply it to the same example, showing how forgetful semantic anchoring can be avoided.

Embedded system design is inherently domain specific and typically model driven. As a result, design methodologies like OMG’s model driven architecture (MDA) and model integrated computing (MIC) evolved to support domain specific modeling languages (DSMLs). The success of the DSML approach has encouraged work on the heterogeneous composition of DSMLs, model transformations between DSMLs, approximations of formal properties within DSMLs, and reuse of DSML semantics. However, in the effort to produce a mature design approach that can handle both the structural and behavioral semantics of embedded system design, many foundational issues concerning DSMLs have been overlooked. In this paper we present a formal foundation for DSMLs and for their construction within metamodeling frameworks. This foundation allows us to algorithmically decide if two DSMLs or metamodels are equivalent, if model transformations preserve properties, and if metamodeling frameworks have meta-metamodels. These results are key to building correct embedded systems with DSMLs.

Embedded systems are commonly abstracted as collections of interacting components. This perspective has lead to the insight that component behaviors can be defined separately from admissible component interactions. We show that this separation of concerns does not imply that component behaviors can be defined in isolation from their envisioned interaction models. We argue that a type of behavior/interaction co-design must be employed to successfully leverage the separation of these concerns. We present formal techniques for accomplishing this co-design and describe tools that implement these formalisms.