https://www.mdu.se/

Safety-critical   systems   need   to   be   analyzed rigorously to remove software/specifications errors, that is, their requirements specifications should be unambiguous, comprehensible and consistent, and the software design should conform to the specifications, hence avoiding undesirable system failures. Currently, there is a lack of effective and scalable methods to specify and analyze requirements, and formally analyze the behavioral models of embedded systems. Most embedded systems requirements are expressed in natural language, which is flexible and intuitive but frequently ambiguous and incomprehensible.  Besides natural language, template-based requirements specification methods are used frequently to specify requirements (esp.  in safety-critical applications).  Although the latter reduce ambiguity and improve the comprehensibility of the specifications, they are usually rigid due to the constrained syntax of the templates, and template selection is challenging.  Industrial systems are frequently developed by using modeling and simulation environments such as Simulink, which is also used to generate code automatically for various hardware platforms. Therefore, it is essential to be able to formally analyze Simulink models, to get insight into the behavior of the embedded system, and also prevent potential errors from propagating into the implementation.  Analyzing the timing behavior of safety-critical software that is refined by multi-rate periodic tasks with data age constraints across the end-to-end software functionality is not trivial. This is due to the undersampling and oversampling effects caused by the data propagation from higher to lower rates and vice versa, respectively. Furthermore, when such systems are deployed on a distributed architecture, e.g., electrical/electronic vehicular system, besides assuring the timeliness, the reliability of the distributed software should be maximized to counter the higher risk of failures in the distributed computing setting, hence improving the overall predictability of the safety-critical system. However, designing for reliability usually requires additional critical system resources such as energy.  Hence, to accommodate the growing complexity of software functionality, the design of the safety-critical systems should consider the efficient use of critical system resources such as the power source, while meeting the timing and reliability requirements.

To address the above needs, in this thesis, we propose formal-methods-based approaches and optimization techniques to assure improved quality of requirements specifications and software designs, and to efficiently map software functionality to hardware. The contributions of the thesis are: (i) ReSA - a domain-specific requirements specification  language tailored to embedded systems, based on constrained natural language; (ii) a formal approach to check consistency of ReSA specifications via Boolean satisfiability problem (SAT) and ontology; (iii) a framework based on statistical model checking to analyze Simulink models via automated transformation into networks of stochastic timed automata; and (iv) a resource-efficient allocation of fault-tolerant software with end-to-end timing and reliability constraints via integer linear programming and hybrid particle-swarm optimization. Our proposed solutions are validated and evaluated on automotive use cases such as the Adjustable Speed Limiter (ASL) and the Brake-by-Wire (BBW) systems from Volvo Group Trucks Technology (VGTT), and on an Engine Management (EM) system benchmark from Bosch.

Säkerhetskritiska system bör analyseras noggrant för att ta bort fel i programvaror och specifikationer, dvs systemens krav måste vara entydiga, begripliga och konsekventa, och programvarudesignen ska överensstämma med specifikationerna för att undvika oönskade systemfel. För närvarande saknas effektiva och skalbara metoder för att specificera och analysera systemkrav, och för att formellt analysera beteendemodellerna för inbyggda system. De flesta krav för inbyggda system uttrycks i naturligt språk, vilket är flexibelt och intuitivt men ofta tvetydigt och oprecist. Förutom naturligt språk används ofta mallbaserade kravspecifikationsmetoder för att specificera krav (speciellt i säkerhetskritiska tillämpningar). Även om de senare minskar otydligheten och förbättrar begripligheten, är de vanligtvis oflexibla på grund av den begränsade syntaxen i mallarna, och mallvalet är svårt. Industriella system utvecklas ofta genom att använda modellerings- och simuleringsmiljöer såsom Simulink, som också används för att generera kod automatiskt för olika hårdvaruplattformar. Därför är det viktigt att kunna formellt analysera Simulink-modeller, för att få insikt i beteendet hos det inbyggda systemet, och för att förhindra potentiella fel från att sprida sig till implementationen. Att analysera tidsperspektivet för sådan säkerhetskritisk mjukvara som har tasks med olika periodicitet och som har begränsningar på datas ålder, dvs datans färskhet, för end-to-end-programvarufunktionalitet, är inte trivialt. Detta orsakas av undersamplings- och översamplingseffekter, som uppstår när data går från högre till lägre signaleringshastigheter och vice versa. Vidare, när sådana system används i en distribuerad arkitektur, t.ex. elektriska / elektroniska fordonssystem, , så bör, förutom att säkerställa tidskraven, även tillförlitligheten hos den distribuerade mjukvaran maximeras för att motverka den högre risken för fel i den distribuerade databehandlingen, för att därigenom förbättra den övergripande förutsägbarheten för det säkerhetskritiska systemet. Design för tillförlitlighet kräver emellertid vanligtvis mer av kritiska systemresurser, såsom energi. För att tillgodose nuvarande och framtida mjukvarufunktionalitet bör utformningen av det säkerhetskritiska systemet ta hänsyn till effektiviteten hos kritiska systemresurser, såsom energiförbrukning, samtidigt som kraven på tid och tillförlitlighet uppfylls.

För att möta ovanstående behov, föreslår vi i denna avhandling formella metoder och optimeringstekniker för att säkerställa förbättrad kvalitet på kravspecifikationer och mjukvaruutveckling, och för att effektivt mappa mjukvarufunktionalitet till hårdvara. Avhandlingens bidrag är: (i) \textit{ReSA} - ett domänspecifikt språk för kravspecifikation, skräddarsytt för inbyggda system, baserat på begränsat naturligt språk; (ii) ett formellt tillvägagångssätt för att kontrollera konsistensen av \textit{ReSA}-specifikationer genom SAT och Ontologi; (iii) ett ramverk baserat på statistisk modellkontroll för att analysera Simulink-modeller via automatiserad omvandling till nätverk av stokastiska tidsautomater; och (iv) en resurseffektiv fördelning av feltolerant programvara med end-to-end-tidskrav och driftsäkerhetsbegränsningar genom heltals-linjär programmering och hybrid partikel-svärmoptimering. Våra föreslagna lösningar utvärderas i fall som används i fordon, såsom justerbar hastighetsbegränsare (ASL) och BBW-system från Volvo Group Trucks Technology (VGTT), och på ett motorstyrsystem från Bosch.

This paper proposes an Integer Linear Programming optimization approach for the allocation of fault-tolerant embedded software applications that are developed using the AUTOSAR standard. The allocation takes into account the timing and reliability requirements of the multi-rate cause-effect chains in these applications and the heterogeneity of their execution platforms. The optimization objective is to minimize the total power consumption of the these applications that are distributed over more than one computing unit. The proposed approach is evaluated using a range of different software applications from the automotive domain, which are generated using the real-world automotive benchmark. The evaluation results indicate that the proposed allocation approach is effective and scalable while meeting the timing, reliability and power requirements in small- and medium-sized automotive software applications.

The evolution of automotive systems has been rapid. Nowadays, electronic brains control dozens of functions in vehicles, like braking, cruising, etc. Model-based design approaches, in environments such as MATLAB Simulink, seem to help in addressing the ever-increasing need to enhance quality, and manage complexity, by supporting functional design from predefined block libraries, which can be simulated and analyzed for hidden errors, but also used for code generation. For this reason, providing assurance that Simulink models fulfill given functional and timing requirements is desirable. In this paper, we propose a pattern-based, execution-order preserving automatic transformation of Simulink atomic and composite blocks into stochastic timed automata that can then be analyzed formally with UPPAAL Statistical Model Checker (UPPPAAL SMC). Our method is supported by the tool SIMPPAAL, which we also introduce and apply on an industrial prototype called the Brake-by-Wire system. This work enables the formal analysis of industrial Simulink models, by automatically generating their semantic counterpart.

Currently, there is lack of effective and scalable methods to specify and ana-lyze requirements specifications, and verify the behavioral models of embed-ded systems. Most embedded systems requirements are expressed in naturallanguage which is flexible and intuitive but frequently ambiguous, vague andincomprehensive. Besides to natural language, template-based requirementsspecification methods are used to specify requirements specifications (esp. insafety-critical applications), which reduce ambiguity and improves the com-prehensibility of the specifications. However, the template-based method areusually rigid due to the fixed structures of the templates. They also lack meta-models for extensibility, and template selection is challenging.In this thesis, we proposed a domain specific language for embedded sys-tems, called ReSA, which is constrained natural language but flexible enoughto allow engineers to use different constructs to specify requirements. Thelanguage has formal semantics in proportional logic and description logic thatenables non-trivial and rigorous analysis of requirements specification, e.g.,consistency checking, completeness of specifications, etc.Moreover, we propose a scalable formal verification of Simulink models,whichisusedtodescribethebehaviorofsystemsthroughcommunicatingfunc-tional blocks. In industry, Simulink is the de facto modeling and analysis en-vironment of embedded systems. It is also used to generate code automati-cally from special Simulink models for various hardware platforms. However,Simulink lacks formal approach to verify large and hybrid Simulink models.Therefore, we also propose a formal verification of Simulink models, repre-sented as stochastic timed automata, using statistical model checking, whichhas proven to scale for industrial applications.We validate our approaches on industrial use cases from the automotiveindustry. These includes Adjustable Speed Limiter (ASL) and Brake-By-Wire(BBW) systems from Volvo Group Trucks Technology, both safety-critical.

Due to the increasing complexity of embedded systems, early detection of soft- ware/hardware errors has become desirable. In this context, e ective yet exible speci cation methods that support rigorous analysis of embedded system requirements are needed. Current speci cation methods such as pattern-based, boilerplates normally lack meta-models for exten- sibility and exibility. In contrast, formal speci cation languages, e.g., temporal logic, Z, etc. are too mathematical to be used by the average software engineer in industry. In this paper, we propose a speci cation representation that considers thematic roles and domain knowledge that enable a deep semantic analysis of requirements. The speci cation is complemented by our constrained natural language speci cation framework, ReSA, which acts as interface to the representation. The representation that we propose is encoded in the logic-based, usually de- cidable ontology language called Description Logic. With support from the ontology reasoner, Hermit, we check for consistency and completeness of requirements. Moreover, we transform the ontology-based speci cation into Timed Computation Tree Logic formulas, to be used further in model checking system behavioral models.

Due to the increasing complexity of embedded systems, early detection of software/hardware errors has become desirable. In this context, effective yet flexible specification methods that support rigorous analysis of embedded systems requirements are needed. Current specification methods such as pattern-based, boilerplates normally lack meta-models for extensibility and flexibility. In contrast, formal specification languages, like temporal logic, Z, etc., enable rigorous analysis, however, they usually are too mathematical and difficult to comprehend by average software engineers. In this paper, we propose a specification representation of requirements, which considers thematic roles and domain knowledge, enabling deep semantic analysis. The specification is complemented by our constrained natural language specification framework, ReSA, which acts as the interface to the representation. The representation that we propose is encoded in description logic, which is a decidable and computationally-tractable ontology language. By employing the ontology reasoner, Hermit, we check for consistency and completeness of requirements. Moreover, we propose an automatic transformation of the ontology-based specifications into Timed Computation Tree Logic formulas, to be used further in model checking embedded systems.

Most industrial embedded systems requirements are specified in natural language, hence they can sometimes be ambiguous and error-prone. Moreover, employing an early-stage model-based incremental system development using multiple levels of abstraction, for instance via architectural languages such as EAST-ADL, calls for different granularity requirements specifications described with abstraction-specific concepts that reflect the respective abstraction level effectively. In this paper, we propose a toolchain for structured requirements specification in the ReSA language, which scales to multiple EAST-ADL levels of abstraction. Furthermore, we introduce a consistency function that is seamlessly integrated into the specification toolchain, for the automatic analysis of requirements logical consistency prior to their temporal logic formalization for full formal verification. The consistency check subsumes two parts: (i) transforming ReSA requirements specification into boolean expressions, and (ii) checking the consistency of the resulting boolean expressions by solving the satisfiability of their conjunction with the Z3 SMT solver. For validation, we apply the ReSA toolchain on an industrial vehicle speed control system, namely the Adjustable Speed Limiter.

Automotive systems are developed using multi-leveled architectural abstractions in an attempt to manage the increasing complexity and criticality of automotive functions. Consequently, well-structured and unambiguously specified requirements are needed on all levels of abstraction, in order to enable early detection of possible design errors. However, automotive industry often relies on requirements specified in ambiguous natural language, sometimes in large and incomprehensible documents. Semi-formal requirements specification approaches (e.g., requirement boilerplates, pattern-based specifications, etc.) aim to reduce requirements ambiguity, without altering their readability and expressiveness. Nevertheless, such approaches do not offer support for specifying requirements in terms of multileveled architectural concepts, nor do they provide means for early-stage rigorous analysis of the specified requirements. In this paper, we propose a language, called ReSA, which allows requirements specification at various levels of abstraction, modeled in the architectural language of EAST-ADL. ReSA uses an automotive systems’ ontology that offers typing and syntactic axioms for the specification. Besides enforcing structure and more rigor in specifying requirements, our approach enables checking refinement as well as consistency of requirements, by proving ordinary boolean implications. To illustrate ReSA’s applicability, we show how to specify some requirements of the Adjustable Speed Limiter, which is a complex, safety-critical Volvo Trucks user function.

Adoption of virtualization technology has been limited in industrial automation due to unavailability of mature solutions, and strict timing requirements of control systems. However, current advancement in Virtual Monitoring Machine, multicore technology, virtualization extension and network virtualization has led to increased interest of virtualization in industrial automation. So far, many related research are focused on maximizing CPU and I/O utilization, and optimization applicable to soft realtime systems (i.e., outside industrial automation domain), e.g., multimedia applications. In this research, we make use of QoS for CPU, memory and network bandwidth in pursuit of high speed and predictability on a distributed multicore platform which is constructed entirely from open source products. We evaluate the platform for latency and jitter, network throughput and CPU computation load. Finally, we analyze the result for applicability in industrial control domain. 

In this paper we present an implementation and demonstration of the Multi-Resource Server (MRS) which enables predictable execution of real-time applications on multi-core platforms. The MRS provides temporal isolation both between tasks running on the same core, as well as, between tasks running on different cores. The latter could, without MRS, interfere with each other due to contention on a shared memory bus. We demonstrate that MRS can be used to ”encapsulate” legacy systems and to give them enough resources to fulfill their purpose. In our case study a legacy media-player is integrated with several resource-hungry tasks running at a different core. We show that without MRS the media-player starts to drop frames due to the interference from other tasks; while introduction of MRS alleviates this problem. Another part of our demonstration shows how traditional periodic real-time tasks can be kept schedulable even when tasks with high memory-demand are added to the system.