Code generators play a critical role in the Model Based Development of complex software systems. This is particularly true in the automotive domain, where the code auto-generated from Simulink/Stateflow models is directly flashed onto embedded controllers. Testing based approaches are popular for validating the translation of models to code. However, these approaches cannot guarantee the absence of bugs introduced during translation.

Abstract The primary aim of a software product-line is to maximise reuse of software components by managing the variability in component functionalities and product configurations. Feature oriented domain analysis (FODA) diagrams are a formalism for modelling the variability in a software product-line, and are used as a tool for managing a product-line and planning its evolution. This paper presents an elementary theory of variations in a product-line, leading up to a technique for extracting FODA diagrams from legacy product-lines. The theory is elementary in the sense that it is built using very simple mathematical structures, making minimal assumptions on the structure of product-lines. Examples drawn from the automotive domain are used to illustrate the theoretical developments.

The modern automobile is a complex electronic system with a number of features providing functionalities for driver and passenger convenience, control of the vehicle, and safety of the occupants. As new features are developed and introduced into the automobile, they interact with already existing features, sometimes resulting in undesirable behaviours. These undesirable interactions are often detected very late in the development cycle, or sometimes even in the field. This introduces uncertainty in the system development process as changes to address these interactions often result in a cascading series of changes whose scope is difficult to predict. This paper presents a method and algorithms for identifying and resolving feature interactions early in the development life-cycle by addressing the problem at the level of requirements specifications. We have applied this method successfully in the automotive domain and present a case study of detecting and resolving feature interactions.

This paper presents a formal specification and analysis method motivated by issues faced during early stages of requirements development for automotive features. At this early stage of development, only overall goals of features are understood, and there is a need to discover all possible scenarios of operation. We have developed a formalism - Structured Transition Systems (STS) - that facilitates the rapid evolution of specifications. STS supports multiple idioms of specification : transitions, state-diagrams, scenarios etc. It also supports constructs for hierarchical organization of a specification. We have further defined analyses that are useful for review and inspection of STS specifications. A distinctive feature of our method is the ability to use analysis results to refine and reinforce parts of the specification by importing analysis results into STS specifications. In practice, this leads to a feedback loop where requirements can be rapidly refined using analysis engines to drive the development of requirements. We have experimented using our technique on a number of automotive case-studies, and we present some of our experiences with these case-studies.

We present the CoGenTe tool for automated black-box testing of code generators. A code generator is a program that takes a model in a high-level modeling language as input, and outputs a program that captures the behaviour of the model. Thus, a code generator's input and output are complex objects having not just syntactic structure but execution semantics, too. Hence, traditional test generation methods that take only syntax into account are not effective in testing code generators. CoGenTe amends this by incorporating various coverage criteria over semantics. This enables it to generate test-cases with a higher potential of revealing subtle semantic errors in code generators. CoGenTe has uncovered such issues in widely used real-life code generators: (i) lexical analyzer generators Flex and JFlex, and (ii) The MathWorks' simulator/code generator for Stateflow.

This paper addresses the problem of testing auto-code generators. Auto-code generators take as input a model in certain modeling language, and produce as output a program that captures the execution semantics of the input-model. We focus on the problem of test specification for the purpose of automatically generating a test-suite. We propose a novel technique for test specification based on the execution behavior of models. We also propose an algorithm that uses such a behavioral test specification for directing test-case generation towards very specific behavioral patterns that we would like to exercise. We have implemented this technique, and have applied it for generating test-cases for a Stateflow auto-code generator.

It is now widely believed that FlexRay will emerge as the predominant protocol for in-vehicle automotive communication systems. As a result, there has been a lot of recent interest in timing and predictability analysis techniques that are specifically targeted towards FlexRay. In this paper we propose a compositional performance analysis framework for a network of electronic control units (ECUs) that communicate via a FlexRay bus. Given a specification of the tasks running on the different ECUs, the scheduling policy used at each ECU, and a specification of the FlexRay bus (e.g. slot sizes and message priorities), our framework can answer questions related to the maximum end-to-end delay experienced by any message, the amount of buffer required at each communication controller and the utilization of the different ECUs and the bus. In contrast to previous timing analysis techniques which analyze the FlexRay bus in isolation, our framework is fully compositional and allows the modeling of the schedulers at the ECUs and the FlexRay protocol in a seamless manner. As a result, it can be used to analyze large systems and does not involve any computationally expensive step like solving an ILP (which previous approaches require). We illustrate our framework using detailed examples and also present results from a Matlab-based implementation.

Model-based development is increasingly becoming the method of choice for developing embedded systems for applications in automotive and aerospace industries. It relies on tool-suites consisting of a variety of model-processing tools like simulators, model-translators and code-generators. The correctness of these tools used in the development process is a key requirement for safety critical applications. This paper proposes a novel testing methodology for the rigorous verification of model processing tools. The proposed methodology takes as input the syntactic and semantic meta-model of a modeling language, expressed in the form of inference rules. Using a coverage criteria over this meta-model, it generates test-models, and test-inputs for these test-models. Apart from testing the syntactic aspects of the translation, our method aims at testing subtle semantic interactions of the modeling language that are potentially mistranslated by the model-processing tools. We illustrate the methodology with a simple prototypical process calculus. We also report on the experiments carried out with Stateflow, a variant of hierarchical state-machines implemented in the Matlab/Simulink tool-suite

We address the problem of rigorous testing of program generators. Program generators are software that take as input a model in a certain modeling language, and produce as output a program that captures the execution semantics of the input-model. In this sense, program generators are also programs and, at first sight, the traditional techniques for testing programs ought to be applicable to program generators as well. However, the rich semantic structure of the inputs and outputs of program generators poses unique challenges that have so far not been addressed sufficiently in the testing literature. We present a novel automatic test-case generation method for testing program generators. It is based on both syntax and semantics of the modeling language, and can uncover subtle semantic errors in the program generator. We demonstrate our method on flex, a prototypical lexical analyzer generator.

In this paper we present a mechanism for developing context-sensitive analyses by composing together two analyses: a subject analysis and a context analysis. The construction provides a means for building analyses of complex properties out of analyses of simpler component properties. In particular, it becomes possible to introduce different forms of context-sensitivity into an analysis. This paper also considers the practical problems of implementing such analyses. In particular, the na¨ýve method of implementing the construction leads to analyses that are impractical and infeasible. We attack this problem by proposing a generic abstraction scheme based on the duality-theory of boolean algebras that makes this approach for building context-sensitive analyses practical.