Design of Assured and Efficient Safety-critical Systems

(1)

N e sre d in Ma h mud D ES IG N O F A SS U R ED A N D E FF IC IE N T S A FE TY -C R IT IC A L S YS TE M S 20 19 ISBN 978-91-7485-428-2 ISSN 1651-4238 Address: P.O. Box 883, SE-721 23 Västerås. Sweden

Address: P.O. Box 325, SE-631 05 Eskilstuna. Sweden E-mail: info@mdh.se Web: www.mdh.se

Mälardalen University Doctoral Dissertation 291

Design of Assured and Efficient

Safety-critical Systems

Nesredin Mahmud

Nesredin has been a PhD student at Mälardalen University, Sweden, since 2014. He conducts research at the Mälardalen Real-Time Research Centre (MRTC) in the area of embedded systems, formal methods and design space exploration. In particular, he applied various formal techniques and tools to address industrial challeges at Volvo Group Trucks Technology (VGTT), specifically to improve quality of automotive requirements specifications, and software designs modeled in Simulink. Furthermore, he has conducted research on the efficient deployment of distributed real-time software func-tionality on heterogenous computing nodes by considering extra-functional properties such as timing, reliability and power consumption via integer linear programming and meta-heuristic algorithms.

Safety-critical systems need to be analyzed rigorously to remove software/specifications errors, that is, their requirements specifications should be unambiguous, comprehensible and consistent, and the software design should conform to the specifications, hence avoiding unde-sirable system failures. Currently, there is a lack of effective and scalable methods to specify and analyze requirements, and formally analyze the behavioral models of embedded systems. Most embedded systems requirements are expressed in natural language, which is flexible and intuitive but frequently ambiguous and incomprehensible. Besides natural language, template-based requirements specification methods are used frequently to specify requirements (esp. in safety-critical applications). Although the latter reduce ambiguity and improve the comprehensibility of the specifications, they are usually rigid due to the constrained syntax of the templates, and tem-plate selection is challenging. Industrial systems are frequently developed by using modeling and simulation environments such as Simulink, which is also used to generate code automatically for various hardware platforms. Therefore, it is essential to be able to formally analyze Simulink models, to get insight into the behavior of the embedded system, and also prevent potential errors from propagating into the implementation. Analyzing the timing behavior of safety-critical software that is refined by multi-rate periodic tasks with data age constraints across the end-to-end software functionality is not trivial. This is due to the undersampling and oversampling effects caused by the data propagation from higher to lower rates and vice versa, respectively. Furthermore, when such systems are deployed on a distributed architecture, e.g., electrical/electronic vehicular system, besides assuring the timeliness, the reliability of the distributed software should be maximized to counter the higher risk of failures in the distributed computing setting, hence improving the overall predictability of the safety-critical system. However, designing for reliability usually requires additional critical system resources such as energy. Hence, to accommodate the growing complexity of soft-ware functionality, the design of the safety-critical systems should consider the efficient use of critical system resources such as the power source, while meeting the timing and reliability requirements. To address the above needs, in this thesis, we propose formal-methods-based approaches and optimization techniques to assure improved quality of requirements specifications and software designs, and to efficiently map software functionality to hardware. The contributions of the thesis are: (i) ReSA - a domain-specific requirements specification language tailored to embedded systems, based on constrained natural language; (ii) a formal approach to check consistency of ReSA specifications via Boolean satisfiability problem (SAT) and ontology; (iii) a framework based on statistical model checking to analyze Simulink models via automated transformation into networks of stochastic timed automata; and (iv) a resource-efficient allocation of fault-tolerant software with end-to-end timing and reliability constraints via integer linear programming and hybrid particle-swarm optimization. Our proposed solutions are validated and evaluated on automotive use cases such as the Adjustable Speed Limiter (ASL) and the Brake-by-Wire (BBW) systems from Volvo Group Trucks Technology (VGTT), and on an Engine Management (EM) system benchmark from Bosch.

(2)

Mälardalen University Press Dissertations No. 291

DESIGN OF ASSURED AND EFFICIENT

SAFETY-CRITICAL SYSTEMS

Nesredin Mahmud 2019

School of Innovation, Design and Engineering

DESIGN OF ASSURED AND EFFICIENT

SAFETY-CRITICAL SYSTEMS

Nesredin Mahmud 2019

(3)

ISSN 1651-4238

Printed by E-Print AB, Stockholm, Sweden

ISSN 1651-4238

Printed by E-Print AB, Stockholm, Sweden

(4)

DESIGN OF ASSURED AND EFFICIENT SAFETY-CRITICAL SYSTEMS

Nesredin Mahmud

Akademisk avhandling

som för avläggande av teknologie doktorsexamen i datavetenskap vid Akademin för innovation, design och teknik kommer att offentligen försvaras

torsdagen den 13 juni 2019, 13.15 i Gamma, Mälardalens högskola, Västerås. Fakultetsopponent: Professor Joost-Pieter Katoen, RWTH Aachen University

Akademin för innovation, design och teknik

DESIGN OF ASSURED AND EFFICIENT SAFETY-CRITICAL SYSTEMS

Nesredin Mahmud

Akademisk avhandling

som för avläggande av teknologie doktorsexamen i datavetenskap vid Akademin för innovation, design och teknik kommer att offentligen försvaras

torsdagen den 13 juni 2019, 13.15 i Gamma, Mälardalens högskola, Västerås. Fakultetsopponent: Professor Joost-Pieter Katoen, RWTH Aachen University

(5)

Abstract

Safety-critical systems need to be analyzed rigorously to remove software/specifications errors, that is, their requirements specifications should be unambiguous, comprehensible and consistent, and the software design should conform to the specifications, hence avoiding undesirable system failures. Currently, there is a lack of effective and scalable methods to specify and analyze requirements, and formally analyze the behavioral models of embedded systems. Most embedded systems requirements are expressed in natural language, which is flexible and intuitive but frequently ambiguous and incomprehensible. Besides natural language, template-based requirements specification methods are used frequently to specify requirements (esp. in safety-critical applications). Although the latter reduce ambiguity and improve the comprehensibility of the specifications, they are usually rigid due to the constrained syntax of the templates, and template selection is challenging. Industrial systems are frequently developed by using modeling and simulation environments such as Simulink, which is also used to generate code automatically for various hardware platforms. Therefore, it is essential to be able to formally analyze Simulink models, to get insight into the behavior of the embedded system, and also prevent potential errors from propagating into the implementation. Analyzing the timing behavior of safety-critical software that is refined by multi-rate periodic tasks with data age constraints across the end-to-end software functionality is not trivial. This is due to the undersampling and oversampling effects caused by the data propagation from higher to lower rates and vice versa, respectively. Furthermore, when such systems are deployed on a distributed architecture, e.g., electrical/electronic vehicular system, besides assuring the timeliness, the reliability of the distributed software should be maximized to counter the higher risk of failures in the distributed computing setting, hence improving the overall predictability of the safety-critical system. However, designing for reliability usually requires additional critical system resources such as energy. Hence, to accommodate the growing complexity of software functionality, the design of the safety-critical systems should consider the efficient use of critical system resources such as the power source, while meeting the timing and reliability requirements. To address the above needs, in this thesis, we propose formal-methods-based approaches and optimization techniques to assure improved quality of requirements specifications and software designs, and to efficiently map software functionality to hardware. The contributions of the thesis are: (i) ReSA - a domain-specific requirements specification language tailored to embedded systems, based on constrained natural language; (ii) a formal approach to check consistency of ReSA specifications via Boolean satisfiability problem (SAT) and ontology; (iii) a framework based on statistical model checking to analyze Simulink models via automated transformation into networks of stochastic timed automata; and (iv) a resource-efficient allocation of fault-tolerant software with end-to-end timing and reliability constraints via integer linear programming and hybrid particle-swarm optimization. Our proposed solutions are validated and evaluated on automotive use cases such as the Adjustable Speed Limiter (ASL) and the Brake-by-Wire (BBW) systems from Volvo Group Trucks Technology (VGTT), and on an Engine Management (EM) system benchmark from Bosch.

ISBN 978-91-7485-428-2 ISSN 1651-4238

Abstract

Safety-critical systems need to be analyzed rigorously to remove software/specifications errors, that is, their requirements specifications should be unambiguous, comprehensible and consistent, and the software design should conform to the specifications, hence avoiding undesirable system failures. Currently, there is a lack of effective and scalable methods to specify and analyze requirements, and formally analyze the behavioral models of embedded systems. Most embedded systems requirements are expressed in natural language, which is flexible and intuitive but frequently ambiguous and incomprehensible. Besides natural language, template-based requirements specification methods are used frequently to specify requirements (esp. in safety-critical applications). Although the latter reduce ambiguity and improve the comprehensibility of the specifications, they are usually rigid due to the constrained syntax of the templates, and template selection is challenging. Industrial systems are frequently developed by using modeling and simulation environments such as Simulink, which is also used to generate code automatically for various hardware platforms. Therefore, it is essential to be able to formally analyze Simulink models, to get insight into the behavior of the embedded system, and also prevent potential errors from propagating into the implementation. Analyzing the timing behavior of safety-critical software that is refined by multi-rate periodic tasks with data age constraints across the end-to-end software functionality is not trivial. This is due to the undersampling and oversampling effects caused by the data propagation from higher to lower rates and vice versa, respectively. Furthermore, when such systems are deployed on a distributed architecture, e.g., electrical/electronic vehicular system, besides assuring the timeliness, the reliability of the distributed software should be maximized to counter the higher risk of failures in the distributed computing setting, hence improving the overall predictability of the safety-critical system. However, designing for reliability usually requires additional critical system resources such as energy. Hence, to accommodate the growing complexity of software functionality, the design of the safety-critical systems should consider the efficient use of critical system resources such as the power source, while meeting the timing and reliability requirements. To address the above needs, in this thesis, we propose formal-methods-based approaches and optimization techniques to assure improved quality of requirements specifications and software designs, and to efficiently map software functionality to hardware. The contributions of the thesis are: (i) ReSA - a domain-specific requirements specification language tailored to embedded systems, based on constrained natural language; (ii) a formal approach to check consistency of ReSA specifications via Boolean satisfiability problem (SAT) and ontology; (iii) a framework based on statistical model checking to analyze Simulink models via automated transformation into networks of stochastic timed automata; and (iv) a resource-efficient allocation of fault-tolerant software with end-to-end timing and reliability constraints via integer linear programming and hybrid particle-swarm optimization. Our proposed solutions are validated and evaluated on automotive use cases such as the Adjustable Speed Limiter (ASL) and the Brake-by-Wire (BBW) systems from Volvo Group Trucks Technology (VGTT), and on an Engine Management (EM) system benchmark from Bosch.

ISBN 978-91-7485-428-2 ISSN 1651-4238

(6)

Abstract

Safety-critical systems need to be analyzed rigorously to remove software (or specifications) errors, that is, their requirements specifications should be un-ambiguous, comprehensible and consistent, and the software design should conform to the specifications, hence avoiding undesirable system failures. Currently, there is a lack of effective and scalable methods to specify and analyze requirements, and formally analyze the behavioral models of embed-ded systems. Most embedembed-ded systems requirements are expressed in natural language, which is flexible and intuitive but frequently ambiguous and incom-prehensible. Besides natural language, template-based requirements specifi-cation methods are used frequently to specify requirements (esp. in safety-critical applications). Although, the latter reduce ambiguity and improve the comprehensibility of the specifications, they are usually rigid due to the con-strained syntax of the templates, and template selection is challenging. In-dustrial systems are frequently developed by using modeling and simulation environments such as Simulink, which is also used to generate code auto-matically for various hardware platforms. Therefore, it is essential to be able to formally analyze Simulink models, to get insight into the behavior of the embedded system, and also prevent potential errors from propagating into the implementation. Analyzing the timing behavior of safety-critical software that is refined by multi-rate periodic tasks with data age constraints across the end-to-end software functionality is not trivial. This is due to the undersam-pling and oversamundersam-pling effects caused by the data propagation from higher to lower rates and vice versa, respectively. Furthermore, when such systems are deployed on a distributed architecture, e.g., electrical/electronic vehicu-lar system, besides assuring the timeliness, the reliability of the distributed software should be maximized to counter the higher risk of failures in the distributed computing setting, hence improving the overall predictability of the safety-critical system. However, designing for reliability usually requires additional critical system resources such as power and energy. Hence, to ac-commodate the growing complexity of software functionality, the design of the safety-critical systems should consider the efficient use of critical system resources such as the power source, while meeting the timing and reliability requirements.

To address the above needs, in this thesis, we propose formal-methods-based approaches and optimization techniques to assure improved quality of requirements specifications and software designs, and to efficiently map soft-i

Abstract

Safety-critical systems need to be analyzed rigorously to remove software (or specifications) errors, that is, their requirements specifications should be un-ambiguous, comprehensible and consistent, and the software design should conform to the specifications, hence avoiding undesirable system failures. Currently, there is a lack of effective and scalable methods to specify and analyze requirements, and formally analyze the behavioral models of embed-ded systems. Most embedembed-ded systems requirements are expressed in natural language, which is flexible and intuitive but frequently ambiguous and incom-prehensible. Besides natural language, template-based requirements specifi-cation methods are used frequently to specify requirements (esp. in safety-critical applications). Although, the latter reduce ambiguity and improve the comprehensibility of the specifications, they are usually rigid due to the con-strained syntax of the templates, and template selection is challenging. In-dustrial systems are frequently developed by using modeling and simulation environments such as Simulink, which is also used to generate code auto-matically for various hardware platforms. Therefore, it is essential to be able to formally analyze Simulink models, to get insight into the behavior of the embedded system, and also prevent potential errors from propagating into the implementation. Analyzing the timing behavior of safety-critical software that is refined by multi-rate periodic tasks with data age constraints across the end-to-end software functionality is not trivial. This is due to the undersam-pling and oversamundersam-pling effects caused by the data propagation from higher to lower rates and vice versa, respectively. Furthermore, when such systems are deployed on a distributed architecture, e.g., electrical/electronic vehicu-lar system, besides assuring the timeliness, the reliability of the distributed software should be maximized to counter the higher risk of failures in the distributed computing setting, hence improving the overall predictability of the safety-critical system. However, designing for reliability usually requires additional critical system resources such as power and energy. Hence, to ac-commodate the growing complexity of software functionality, the design of the safety-critical systems should consider the efficient use of critical system resources such as the power source, while meeting the timing and reliability requirements.

To address the above needs, in this thesis, we propose formal-methods-based approaches and optimization techniques to assure improved quality of requirements specifications and software designs, and to efficiently map soft-i

(7)

ware functionality to hardware. The contributions of the thesis are: (i)ReSA

- a domain-specific requirements specification language tailored to embed-ded systems, based on constrained natural language; (ii) a formal approach to check consistency ofReSAspecifications via Boolean satisfiability problem (SAT) and ontology; (iii) a framework based on statistical model checking to analyze Simulink models via automated transformation into networks of stochastic timed automata; and (iv) a resource-efficient allocation of fault-tolerant software with end-to-end timing and reliability constraints via integer linear programming and hybrid particle-swarm optimization. Our proposed solutions are validated and evaluated on automotive use cases such as the Ad-justable Speed Limiter (ASL) and the Brake-by-Wire (BBW) systems from Volvo Group Trucks Technology (VGTT), and on an Engine Management (EM) system benchmark from Bosch.

ii

ware functionality to hardware. The contributions of the thesis are: (i)ReSA

- a domain-specific requirements specification language tailored to embed-ded systems, based on constrained natural language; (ii) a formal approach to check consistency ofReSAspecifications via Boolean satisfiability problem (SAT) and ontology; (iii) a framework based on statistical model checking to analyze Simulink models via automated transformation into networks of stochastic timed automata; and (iv) a resource-efficient allocation of fault-tolerant software with end-to-end timing and reliability constraints via integer linear programming and hybrid particle-swarm optimization. Our proposed solutions are validated and evaluated on automotive use cases such as the Ad-justable Speed Limiter (ASL) and the Brake-by-Wire (BBW) systems from Volvo Group Trucks Technology (VGTT), and on an Engine Management (EM) system benchmark from Bosch.

ii

(8)

Sammanfattning

Säkerhetskritiska system bör analyseras noggrant för att ta bort fel i program-varor och specifikationer, dvs systemens krav mäaste vara entydiga, begripliga och konsekventa, och programvarudesignen ska överensstämma med speci-fikationerna för att undvika oönskade systemfel. För närvarande saknas effek-tiva och skalbara metoder för att specificera och analysera systemkrav, och för att formellt analysera beteendemodellerna för inbyggda system. De flesta krav för inbyggda system uttrycks i naturligt spräak, vilket är flexibelt och intuitivt men ofta tvetydigt och oprecist. Förutom naturligt spräak används ofta mall-baserade kravspecifikationsmetoder för att specificera krav (speciellt i säker-hetskritiska tillämpningar). Även om de senare minskar otydligheten och för-bättrar begripligheten, är de vanligtvis oflexibla päa grund av den begränsade syntaxen i mallarna, och mallvalet är sväart. Industriella system utvecklas ofta genom att använda modellerings- och simuleringsmiljöer säasom Simulink, som ocksäa används för att generera kod automatiskt för olika häardvaruplat-tformar. Därför är det viktigt att kunna formellt analysera Simulink-modeller, för att fäa insikt i beteendet hos det inbyggda systemet, och för att förhindra potentiella fel fräan att sprida sig till implementationen. Att analysera tidsper-spektivet för säadan säkerhetskritisk mjukvara som har tasks med olika pe-riodicitet och som har begränsningar päa datas äalder, dvs datans färskhet, för end-to-end-programvarufunktionalitet, är inte trivialt. Detta orsakas av undersamplings- och översamplingseffekter, som uppstäar när data gäar fräan högre till lägre signaleringshastigheter och vice versa. Vidare, när säadana system används i en distribuerad arkitektur, t.ex. elektriska / elektroniska for-donssystem, säa bör, förutom att säkerställa tidskraven, även tillförlitligheten hos den distribuerade mjukvaran maximeras för att motverka den högre risken för fel i den distribuerade databehandlingen, för att därigenom förbättra den övergripande förutsägbarheten för det säkerhetskritiska systemet. Design för tillförlitlighet kräver emellertid vanligtvis mer av kritiska systemresurser, säa-som energi. För att tillgodose nuvarande och framtida mjukvarufunktionalitet bör utformningen av det säkerhetskritiska systemet ta hänsyn till effektiviteten hos kritiska systemresurser, säasom energiförbrukning, samtidigt som kraven päa tid och tillförlitlighet uppfylls.

För att möta ovanstäaende behov, föresläar vi i denna avhandling formella metoder och optimeringstekniker för att säkerställa förbättrad kvalitet päa kravspecifikationer och mjukvaruutveckling, och för att effektivt mappa mjukvarufunktionalitet till häardvara. Avhandlingens bidrag är: (i) ReSA - ett iii

Sammanfattning

Säkerhetskritiska system bör analyseras noggrant för att ta bort fel i program-varor och specifikationer, dvs systemens krav mäaste vara entydiga, begripliga och konsekventa, och programvarudesignen ska överensstämma med speci-fikationerna för att undvika oönskade systemfel. För närvarande saknas effek-tiva och skalbara metoder för att specificera och analysera systemkrav, och för att formellt analysera beteendemodellerna för inbyggda system. De flesta krav för inbyggda system uttrycks i naturligt spräak, vilket är flexibelt och intuitivt men ofta tvetydigt och oprecist. Förutom naturligt spräak används ofta mall-baserade kravspecifikationsmetoder för att specificera krav (speciellt i säker-hetskritiska tillämpningar). Även om de senare minskar otydligheten och för-bättrar begripligheten, är de vanligtvis oflexibla päa grund av den begränsade syntaxen i mallarna, och mallvalet är sväart. Industriella system utvecklas ofta genom att använda modellerings- och simuleringsmiljöer säasom Simulink, som ocksäa används för att generera kod automatiskt för olika häardvaruplat-tformar. Därför är det viktigt att kunna formellt analysera Simulink-modeller, för att fäa insikt i beteendet hos det inbyggda systemet, och för att förhindra potentiella fel fräan att sprida sig till implementationen. Att analysera tidsper-spektivet för säadan säkerhetskritisk mjukvara som har tasks med olika pe-riodicitet och som har begränsningar päa datas äalder, dvs datans färskhet, för end-to-end-programvarufunktionalitet, är inte trivialt. Detta orsakas av undersamplings- och översamplingseffekter, som uppstäar när data gäar fräan högre till lägre signaleringshastigheter och vice versa. Vidare, när säadana system används i en distribuerad arkitektur, t.ex. elektriska / elektroniska for-donssystem, säa bör, förutom att säkerställa tidskraven, även tillförlitligheten hos den distribuerade mjukvaran maximeras för att motverka den högre risken för fel i den distribuerade databehandlingen, för att därigenom förbättra den övergripande förutsägbarheten för det säkerhetskritiska systemet. Design för tillförlitlighet kräver emellertid vanligtvis mer av kritiska systemresurser, säa-som energi. För att tillgodose nuvarande och framtida mjukvarufunktionalitet bör utformningen av det säkerhetskritiska systemet ta hänsyn till effektiviteten hos kritiska systemresurser, säasom energiförbrukning, samtidigt som kraven päa tid och tillförlitlighet uppfylls.

För att möta ovanstäaende behov, föresläar vi i denna avhandling formella metoder och optimeringstekniker för att säkerställa förbättrad kvalitet päa kravspecifikationer och mjukvaruutveckling, och för att effektivt mappa mjukvarufunktionalitet till häardvara. Avhandlingens bidrag är: (i) ReSA - ett iii

(9)

domänspecifikt spräak för kravspecifikation, skräddarsytt för inbyggda sys-tem, baserat päa begränsat naturligt spräak; (ii) ett formellt tillvägagäangssätt för att kontrollera konsistensen av ReSA-specifikationer genom SAT och Ontologi; (iii) ett ramverk baserat päa statistisk modellkontroll för att analysera Simulink-modeller via automatiserad omvandling till nätverk av stokastiska tidsautomater; och (iv) en resurseffektiv fördelning av feltolerant programvara med end-to-end-tidskrav och driftsäkerhetsbegränsningar genom heltals-linjär programmering och hybrid partikel-svärmoptimering. Väara föreslagna lösningar utvärderas i fall som används i fordon, säasom justerbar hastighetsbegränsare (ASL) och BBW-system fräan Volvo Group Trucks Technology (VGTT), och päa ett motorstyrsystem fräan Bosch.

iv

domänspecifikt spräak för kravspecifikation, skräddarsytt för inbyggda sys-tem, baserat päa begränsat naturligt spräak; (ii) ett formellt tillvägagäangssätt för att kontrollera konsistensen av ReSA-specifikationer genom SAT och Ontologi; (iii) ett ramverk baserat päa statistisk modellkontroll för att analysera Simulink-modeller via automatiserad omvandling till nätverk av stokastiska tidsautomater; och (iv) en resurseffektiv fördelning av feltolerant programvara med end-to-end-tidskrav och driftsäkerhetsbegränsningar genom heltals-linjär programmering och hybrid partikel-svärmoptimering. Väara föreslagna lösningar utvärderas i fall som används i fordon, säasom justerbar hastighetsbegränsare (ASL) och BBW-system fräan Volvo Group Trucks Technology (VGTT), och päa ett motorstyrsystem fräan Bosch.

iv

(10)

To My Father, Haji M.Jemal Mahmud

For Prioritizing Education and Pursuit of Learning!

ንሓጂ

መ

/

ጀማል

ማሕሙድ

ንክመሃር፣ንክፈልጥዝገብርካዮተገዳሲነትየመስግን።

To My Father, Haji M.Jemal Mahmud

For Prioritizing Education and Pursuit of Learning!

ንሓጂ

መ

/

ጀማል

ማሕሙድ

(11)

(12)

Acknowledgements

I would like to express my deepest gratitude to my main supervisor Associate Professor Cristina Seceleanu. Your passion for research is inspiring, and your guidance, encouragements, determination, and patience have been the driving force of my PhD journey. It has been a pleasure to be around with you and get the best mentor one could ever get. I would like to thank my co-supervisor Oscar Ljungkrantz for the lively reception at Volvo Group Trucks Technology (VGTT), Gothenburg, and the wonderful researchers he introduced to me. It is my pleasure also to thank my co-supervisor Guillermo Rodriguez-Navas, for the great team work, valuable feedback, and encouragements. I am grateful to have you all as my supervisors. Your effort has made this work worthwhile.

Moreover, I would like to thank my examining committee Professor Peter Csaba Ölveczky, University of Oslo, Professor Wolfgang Ahrendt, Chalmers University of Technology, Associate Professor Raffaela Mirandola, Politec-nico di Milano, for accepting our call and reviewing my thesis; and Asso-ciate Professor Antonio Cicchetti for reviewing the thesis proposal. Special gratitude goes to the faculty examiner Professor Joost-Pieter Katoen, RWTH Aachen University, for accepting the opponentship. It is an honour to have you all at my defense. Also, I would like to extend my appreciation to Damir Isovic, Hans Hansson, Thomas Nolte, Moris Behnam, Kristian Sandström and the IDT administration staff, who facilitated my PhD defense and influenced my academic career.

I wish to acknowledge with much appreciation the role of Henrik Lönn, Oscar Ljungkrantz, as well as Saad Mubeen and Hamid Reza Faragardi, who supported my research technically at different levels, including co-authoring joint papers. Your willingness to share and support is highly admired. For the list is too long, I briefly express my respect and love to my colleagues at MDH, and outside such as Tewodros, Abu Hussaine, Björn. Your friendly support, jokes, and cultural exchanges will always be memorable.

I am thankful to Allah for granting me the well-being and strength to do my studies. I thank my parents for giving me unconditional love and supporting throughout my life, and my brothers, sisters and lifelong friends for the good words and encouragements. Thank you Big Brother Abdulwhab for being the example. In times of emotional stress, the support of my dear wife, Elham Salih, has been unconditional and unwavering. You are strong, confident and intelligent person and love of my life, and I thank the OOG for that! Our little boy, Mohammed, you should know that we love you so much. So learn the world with open mind and make us proud!

vii

Acknowledgements

I would like to express my deepest gratitude to my main supervisor Associate Professor Cristina Seceleanu. Your passion for research is inspiring, and your guidance, encouragements, determination, and patience have been the driving force of my PhD journey. It has been a pleasure to be around with you and get the best mentor one could ever get. I would like to thank my co-supervisor Oscar Ljungkrantz for the lively reception at Volvo Group Trucks Technology (VGTT), Gothenburg, and the wonderful researchers he introduced to me. It is my pleasure also to thank my co-supervisor Guillermo Rodriguez-Navas, for the great team work, valuable feedback, and encouragements. I am grateful to have you all as my supervisors. Your effort has made this work worthwhile.

Moreover, I would like to thank my examining committee Professor Peter Csaba Ölveczky, University of Oslo, Professor Wolfgang Ahrendt, Chalmers University of Technology, Associate Professor Raffaela Mirandola, Politec-nico di Milano, for accepting our call and reviewing my thesis; and Asso-ciate Professor Antonio Cicchetti for reviewing the thesis proposal. Special gratitude goes to the faculty examiner Professor Joost-Pieter Katoen, RWTH Aachen University, for accepting the opponentship. It is an honour to have you all at my defense. Also, I would like to extend my appreciation to Damir Isovic, Hans Hansson, Thomas Nolte, Moris Behnam, Kristian Sandström and the IDT administration staff, who facilitated my PhD defense and influenced my academic career.

I wish to acknowledge with much appreciation the role of Henrik Lönn, Oscar Ljungkrantz, as well as Saad Mubeen and Hamid Reza Faragardi, who supported my research technically at different levels, including co-authoring joint papers. Your willingness to share and support is highly admired. For the list is too long, I briefly express my respect and love to my colleagues at MDH, and outside such as Tewodros, Abu Hussaine, Björn. Your friendly support, jokes, and cultural exchanges will always be memorable.

I am thankful to Allah for granting me the well-being and strength to do my studies. I thank my parents for giving me unconditional love and supporting throughout my life, and my brothers, sisters and lifelong friends for the good words and encouragements. Thank you Big Brother Abdulwhab for being the example. In times of emotional stress, the support of my dear wife, Elham Salih, has been unconditional and unwavering. You are strong, confident and intelligent person and love of my life, and I thank the OOG for that! Our little boy, Mohammed, you should know that we love you so much. So learn the world with open mind and make us proud!

(13)

I would like to thank VINNOVA for sponsoring this research via the VeriSpec project, in which the financial support has made this work possible. Nesredin Mahmud Västerås, June 13, 2019

viii

I would like to thank VINNOVA for sponsoring this research via the VeriSpec project, in which the financial support has made this work possible. Nesredin Mahmud Västerås, June 13, 2019

viii

(14)

List of Papers Included in the Thesis

This thesis is based on the following papers:

Paper A ReSA: An ontology-based requirement specification language tai-lored to automotive systems. Nesredin Mahmud, Cristina Seceleanu and Oscar Ljungkrantz.In the 10th IEEE International Symposium on Indus-trial Embedded Systems (SIES)(pp. 1-10). IEEE, 2015.

Paper B ReSA tool: Structured requirements specification and SAT-based consistency-checking. Nesredin Mahmud, Cristina Seceleanu and Os-car Ljungkrantz. In the 2016 Federated Conference on Computer Sci-ence and Information Systems (FedCSIS)(pp. 1737-1746). IEEE, 2016. Paper C Specification and semantic analysis of embedded systems require-ments: From description logic to temporal logic. Nesredin Mahmud, Cristina Seceleanu and Oscar Ljungkrantz. In the International Confer-ence on Software Engineering and Formal Methods (SEFM)(pp. 332-348). Springer, Cham, 2017.

Paper D SIMPPAAL - A Framework For Statistical Model Checking of Industrial Simulink Models. Predrag Filipovikj, Nesredin Mahmud, Raluca Marinescu, Cristina Seceleanu, Oscar Ljungkrantz and Henrik Lönn. Submitted to ACM Transactions on Software Engineering and Methodology (TOSEM). Initially submitted in 2018, revisions required.

This article is an extended version of the following conference paper: Simulink to UPPAAL Statistical Model Checker: Analyzing Automotive Industrial Systems. Predrag Filipovikj, Nesredin Mahmud, Raluca Marinescu, Cristina Seceleanu, Oscar Ljungkrantz, Henrik Lönn. In Proceedings of the 21st International Symposium on Formal Methods (FM2016), pages 748-756. Limassol, Cyprus. Springer, LNCS, November 2016.

Paper E Power-aware Allocation of Fault-tolerant Multirate AUTOSAR Applications. Nesredin Mahmud, Guillermo Rodriguez-Navas, Hamid Faragardi, Saad Mubeen and Cristina Seceleanu. In the 25th Asia-Pacific Software Engineering Conference (APSEC’18). IEEE.

ix

List of Papers Included in the Thesis

This thesis is based on the following papers:

Paper A ReSA: An ontology-based requirement specification language tai-lored to automotive systems. Nesredin Mahmud, Cristina Seceleanu and Oscar Ljungkrantz.In the 10th IEEE International Symposium on Indus-trial Embedded Systems (SIES)(pp. 1-10). IEEE, 2015.

Paper B ReSA tool: Structured requirements specification and SAT-based consistency-checking. Nesredin Mahmud, Cristina Seceleanu and Os-car Ljungkrantz. In the 2016 Federated Conference on Computer Sci-ence and Information Systems (FedCSIS)(pp. 1737-1746). IEEE, 2016. Paper C Specification and semantic analysis of embedded systems require-ments: From description logic to temporal logic. Nesredin Mahmud, Cristina Seceleanu and Oscar Ljungkrantz. In the International Confer-ence on Software Engineering and Formal Methods (SEFM)(pp. 332-348). Springer, Cham, 2017.

Paper D SIMPPAAL - A Framework For Statistical Model Checking of Industrial Simulink Models. Predrag Filipovikj, Nesredin Mahmud, Raluca Marinescu, Cristina Seceleanu, Oscar Ljungkrantz and Henrik Lönn. Submitted to ACM Transactions on Software Engineering and Methodology (TOSEM). Initially submitted in 2018, revisions required.

This article is an extended version of the following conference paper: Simulink to UPPAAL Statistical Model Checker: Analyzing Automotive Industrial Systems. Predrag Filipovikj, Nesredin Mahmud, Raluca Marinescu, Cristina Seceleanu, Oscar Ljungkrantz, Henrik Lönn. In Proceedings of the 21st International Symposium on Formal Methods (FM2016), pages 748-756. Limassol, Cyprus. Springer, LNCS, November 2016.

Paper E Power-aware Allocation of Fault-tolerant Multirate AUTOSAR Applications. Nesredin Mahmud, Guillermo Rodriguez-Navas, Hamid Faragardi, Saad Mubeen and Cristina Seceleanu. In the 25th Asia-Pacific Software Engineering Conference (APSEC’18). IEEE.

(15)

Paper F Optimized Allocation of Fault-tolerant Embedded Software

with End-to-end Timing Constraints. Nesredin Mahmud,

Guillermo Rodriguez-Navas, Hamid Faragardi, Saad Mubeen and Cristina Seceleanu. Mälardalen Real-time Research Center Technical Report (MRTC), ISRN MDH-MRTC-325/2019-1-SE, 2019.

Note: The research is submitted as a journal paper to Elsevier Journal of Systems Architecture (JSA). Under Review.

List of Papers Not Included in the Thesis

• Evaluating industrial applicability of virtualization on a distributed mul-ticore platform. Nesredin Mahmud, Kristian Sandström, and Aneta Vul-garakis. In Proceedings of the 2014 IEEE Emerging Technology and Factory Automation (ETFA), pp. 1-8. IEEE, 2014.

• The multi-resource server for predictable execution on multi-core plat-forms. Rafia Inam, Nesredin Mahmud, Moris Behnam, Thomas Nolte, and Mikael Sjödin. In 2014 IEEE 19th Real-Time and Embedded Tech-nology and Applications Symposium (RTAS), pp. 1-12. IEEE, 2014. • Simulink to UPPAAL statistical model checker: Analyzing

automo-tive industrial systems. Predrag Filipovikj, Nesredin Mahmud, Raluca Marinescu, Cristina Seceleanu, Oscar Ljungkrantz, and Henrik Lönn. In International Symposium on Formal Methods, pp. 748-756. Springer, Cham, 2016.

Reprints were made with permission from the publishers.

x

Paper F Optimized Allocation of Fault-tolerant Embedded Software

with End-to-end Timing Constraints. Nesredin Mahmud,

Guillermo Rodriguez-Navas, Hamid Faragardi, Saad Mubeen and Cristina Seceleanu. Mälardalen Real-time Research Center Technical Report (MRTC), ISRN MDH-MRTC-325/2019-1-SE, 2019.

Note: The research is submitted as a journal paper to Elsevier Journal of Systems Architecture (JSA). Under Review.

List of Papers Not Included in the Thesis

• Evaluating industrial applicability of virtualization on a distributed mul-ticore platform. Nesredin Mahmud, Kristian Sandström, and Aneta Vul-garakis. In Proceedings of the 2014 IEEE Emerging Technology and Factory Automation (ETFA), pp. 1-8. IEEE, 2014.

• The multi-resource server for predictable execution on multi-core plat-forms. Rafia Inam, Nesredin Mahmud, Moris Behnam, Thomas Nolte, and Mikael Sjödin. In 2014 IEEE 19th Real-Time and Embedded Tech-nology and Applications Symposium (RTAS), pp. 1-12. IEEE, 2014. • Simulink to UPPAAL statistical model checker: Analyzing

automo-tive industrial systems. Predrag Filipovikj, Nesredin Mahmud, Raluca Marinescu, Cristina Seceleanu, Oscar Ljungkrantz, and Henrik Lönn. In International Symposium on Formal Methods, pp. 748-756. Springer, Cham, 2016.

Reprints were made with permission from the publishers.

x

(16)

List of Tables

5.1 Mapping between the included papers and the research con-tributions. . . 47 5.2 Mapping between the research contributions and the research

goals. . . 47

xv

List of Tables

5.1 Mapping between the included papers and the research con-tributions. . . 47 5.2 Mapping between the research contributions and the research

goals. . . 47

(21)

(22)

List of Figures

2.1 Brake pedal and global brake controller of the Brake-by-Wire model. . . 11 2.2 The Brake-by-Wire Subsystem block that computes vehicle

speed. The labels in red color denote of the execution order of the blocks. . . 13 2.3 STA example. . . 13 4.1 Research Process. . . 23 5.1 Thesis contributions workflow. . . 26 5.2 TheReSAgraphical user interface (GUI). . . 28 5.3 Specifying ASL requirements inReSA. . . 29 5.4 TheReSAspecifications R1 - R4 encoded as Z3 format, and

the unsat-core feedback from the Z3 solver, to localize the source of the inconsistency. . . 31 5.5 STA transformation patterns. . . 33 5.6 Analysis results snippet of the BBW Simulink model from

UPPAAL SMC. For the complete results, we refer the reader to [39]. . . 35 5.7 ILP optimization of different sizes of software applications

based on the number of software components, cause-effect chains, computing nodes. . . 39 5.8 Power consumption of nodes for different instances of

soft-ware allocation problems by different optimization algorithms. 40 5.9 Computation time of the software allocation for different

in-stances of the software allocation problems by different opti-mization algorithms. . . 41

1

List of Figures

2.1 Brake pedal and global brake controller of the Brake-by-Wire model. . . 11 2.2 The Brake-by-Wire Subsystem block that computes vehicle

speed. The labels in red color denote of the execution order of the blocks. . . 13 2.3 STA example. . . 13 4.1 Research Process. . . 23 5.1 Thesis contributions workflow. . . 26 5.2 TheReSAgraphical user interface (GUI). . . 28 5.3 Specifying ASL requirements inReSA. . . 29 5.4 TheReSAspecifications R1 - R4 encoded as Z3 format, and

the unsat-core feedback from the Z3 solver, to localize the source of the inconsistency. . . 31 5.5 STA transformation patterns. . . 33 5.6 Analysis results snippet of the BBW Simulink model from

UPPAAL SMC. For the complete results, we refer the reader to [39]. . . 35 5.7 ILP optimization of different sizes of software applications

based on the number of software components, cause-effect chains, computing nodes. . . 39 5.8 Power consumption of nodes for different instances of

soft-ware allocation problems by different optimization algorithms. 40 5.9 Computation time of the software allocation for different

in-stances of the software allocation problems by different opti-mization algorithms. . . 41

(23)

(24)

Part I:

Thesis

This part of the document discusses the summary of the thesis, including the research problem, goals, and scientific contributions, followed by the research methods used in the thesis, related work, and conclusions and future work.

Part I:

Thesis

This part of the document discusses the summary of the thesis, including the research problem, goals, and scientific contributions, followed by the research methods used in the thesis, related work, and conclusions and future work.

(25)

(26)

1. Introduction

R

EAL-TIME systems are characterized by timely computations, which are bounded by deadlines, besides correct results of the computations [23]. Many embedded systems are in fact real-time systems, especially due to their safety-critical nature. Safety-critical embedded systems are specialized com-puter systems designed for safety-critical applications [94], e.g. x-by-wire, flight control, industrial control systems. For instance, the brake-by-wire sys-tem [75] computes a torque proportional to the brake pedal force in order to slow down (or halt) the vehicle. Besides computing the correct torque, the system must act timely, that is not too soon and not too late so that traf-fic accidents are avoided. Therefore, safety-critical real-time systems should be analyzed for functional as well as timing correctness. In fact, they should be analyzed rigorously according to functional safety standards, such as ISO 26262 “Road vehicles-Functional safety” [48] that recommends the use of formal methods, which are mathematical techniques and tools that enable un-ambiguous specification, modeling and analysis of software and hardware sys-tems [79][6], for instance, via model checking [9], theorem proving [51][3], rewriting logic [78], satisfiability modulo theories (SMT) [13].

Over the last decades, a lot of functionality that has been earlier realized by mechanical (or hydraulic) systems has moved to software, e.g. via the x-by-wire technology [75]. Moreover, several application software programs (or user-level software functions), which are developed due to innovation and compliance to safety standards, are integrated into safety-critical systems to provide advanced, safe and reliable services, for instance, the advanced driver-assistance systems (ADAS) [99][41], machine vision system for autonomous and self-driving vehicles [91][82].

Given this status quo, it is beneficial to ensure the quality of most artifacts produced during the development of safety-critical embedded systems, especially when such development is based on the model-based paradigm [77], which is the case for increasingly many industries. Consequently, in this thesis, we propose a design approach that considers rigorous analysis and efficiency of safety-critical embedded systems by applying formal methods and optimization techniques on various artifacts produced during at the early stages of software development.

One artifact to start with is the requirements specification [2] that entails documenting the functional and extra-functional (e.g. timing, reliability) re-quirements of a system in a comprehensive way. In practice, natural language 5

1. Introduction

R

EAL-TIME systems are characterized by timely computations, which are bounded by deadlines, besides correct results of the computations [23]. Many embedded systems are in fact real-time systems, especially due to their safety-critical nature. Safety-critical embedded systems are specialized com-puter systems designed for safety-critical applications [94], e.g. x-by-wire, flight control, industrial control systems. For instance, the brake-by-wire sys-tem [75] computes a torque proportional to the brake pedal force in order to slow down (or halt) the vehicle. Besides computing the correct torque, the system must act timely, that is not too soon and not too late so that traf-fic accidents are avoided. Therefore, safety-critical real-time systems should be analyzed for functional as well as timing correctness. In fact, they should be analyzed rigorously according to functional safety standards, such as ISO 26262 “Road vehicles-Functional safety” [48] that recommends the use of formal methods, which are mathematical techniques and tools that enable un-ambiguous specification, modeling and analysis of software and hardware sys-tems [79][6], for instance, via model checking [9], theorem proving [51][3], rewriting logic [78], satisfiability modulo theories (SMT) [13].

Over the last decades, a lot of functionality that has been earlier realized by mechanical (or hydraulic) systems has moved to software, e.g. via the x-by-wire technology [75]. Moreover, several application software programs (or user-level software functions), which are developed due to innovation and compliance to safety standards, are integrated into safety-critical systems to provide advanced, safe and reliable services, for instance, the advanced driver-assistance systems (ADAS) [99][41], machine vision system for autonomous and self-driving vehicles [91][82].

Given this status quo, it is beneficial to ensure the quality of most artifacts produced during the development of safety-critical embedded systems, especially when such development is based on the model-based paradigm [77], which is the case for increasingly many industries. Consequently, in this thesis, we propose a design approach that considers rigorous analysis and efficiency of safety-critical embedded systems by applying formal methods and optimization techniques on various artifacts produced during at the early stages of software development.

One artifact to start with is the requirements specification [2] that entails documenting the functional and extra-functional (e.g. timing, reliability) re-quirements of a system in a comprehensive way. In practice, natural language 5

(27)

is the de facto standard for requirements specification, and quite seldom no-tations such as use cases, scenarios, UML diagrams, state machines. Even if natural language is intuitive and easy to use, requirements expressed in nat-ural language can sometimes be ambiguous, vague, inconsistent, while intu-itive to use [2]. In order to mitigate the aforementioned problems, several ap-proaches that involve semi-formal and formal specification methods have been investigated. Template-based approaches [36], such as requirements boiler-plates [47][36] and property specification patterns(SPS) [46][52], are formal methods that use frequently reoccurring patterns, whereas other semi-formal methods rely on requirements meta-model [97][8][40][87]. The bene-fits of the template-based approaches are syntactic and semantic similarities to natural language with reduced ambiguity and a high degree of reuse. How-ever, the methods are not scalable and template selection requires a lot of effort. In contrast, formal specification methods, e.g. temporal logics [44], Z language [80], etc., enable rigorous analysis but demand mathematical knowl-edge, which makes them not appealing to the average software engineers.

Due to the above, as a first contribution, we propose a constrained, yet flexible and unambiguous, natural language called ReSA, which is domain-specific and uses the notion of boilerplates to facilitate reuse [64]. The speci-fications created withReSAhave semantics in Boolean logic and description logic [69] to enable rigorous analysis via Boolean satisfiability [65] and on-tology [19] methods, respectively. Therefore, as asecond contribution, we propose a formal approach for analyzingReSAspecifications for logical con-sistency, via the two methods, which is implemented in ourReSA tool [60]. To complement the requirements modeling of an industrially-adopted archi-tecture description language called EAST-ADL1[18], the ReSA tool is inte-grated seamlessly into the Eclipse-based implementation of the EAST-ADL

standard, calledEATOP2. The language and its tool support are validated on the adjustable speed limiter use case, which is a vehicle speed control system provided by Volvo Group Trucks Technology (VGTT) in Sweden.

The requirements specifications are used in subsequent system develop-ment including software design to verify the latter for correct functionality. The software design is usually modeled, simulated and analyzed before im-plementation. In this regard, Simulink [49] is one of the most widely used development environments for multi-domain, multi-rate, discrete and continu-ous safety-critical industrial systems. For this main reason, there is increasing interest in the formal analysis of Simulink models [66]. Simulink Design Veri-fier3_{is the actual tool in the Simulink environment to formally verify Simulink} design models. However, it supports only discrete models, and does not offer 1_EAST-ADL_{- https://www.east-adl.info/index.html}

2_EATOP_{- http://synligare.eu/Tooling.html}

3_Simulink _Design _Verifier _- _{https://se.mathworks.com/products/}

sldesignverifier.html 6

is the de facto standard for requirements specification, and quite seldom no-tations such as use cases, scenarios, UML diagrams, state machines. Even if natural language is intuitive and easy to use, requirements expressed in nat-ural language can sometimes be ambiguous, vague, inconsistent, while intu-itive to use [2]. In order to mitigate the aforementioned problems, several ap-proaches that involve semi-formal and formal specification methods have been investigated. Template-based approaches [36], such as requirements boiler-plates [47][36] and property specification patterns(SPS) [46][52], are formal methods that use frequently reoccurring patterns, whereas other semi-formal methods rely on requirements meta-model [97][8][40][87]. The bene-fits of the template-based approaches are syntactic and semantic similarities to natural language with reduced ambiguity and a high degree of reuse. How-ever, the methods are not scalable and template selection requires a lot of effort. In contrast, formal specification methods, e.g. temporal logics [44], Z language [80], etc., enable rigorous analysis but demand mathematical knowl-edge, which makes them not appealing to the average software engineers.

Due to the above, as a first contribution, we propose a constrained, yet flexible and unambiguous, natural language calledReSA, which is domain-specific and uses the notion of boilerplates to facilitate reuse [64]. The speci-fications created withReSAhave semantics in Boolean logic and description logic [69] to enable rigorous analysis via Boolean satisfiability [65] and on-tology [19] methods, respectively. Therefore, as asecond contribution, we propose a formal approach for analyzingReSAspecifications for logical con-sistency, via the two methods, which is implemented in ourReSAtool [60]. To complement the requirements modeling of an industrially-adopted archi-tecture description language called EAST-ADL1[18], the ReSA tool is inte-grated seamlessly into the Eclipse-based implementation of the EAST-ADL

standard, calledEATOP2. The language and its tool support are validated on the adjustable speed limiter use case, which is a vehicle speed control system provided by Volvo Group Trucks Technology (VGTT) in Sweden.

The requirements specifications are used in subsequent system develop-ment including software design to verify the latter for correct functionality. The software design is usually modeled, simulated and analyzed before im-plementation. In this regard, Simulink [49] is one of the most widely used development environments for multi-domain, multi-rate, discrete and continu-ous safety-critical industrial systems. For this main reason, there is increasing interest in the formal analysis of Simulink models [66]. Simulink Design Veri-fier3_{is the actual tool in the Simulink environment to formally verify Simulink} design models. However, it supports only discrete models, and does not offer 1_EAST-ADL_{- https://www.east-adl.info/index.html}

2_EATOP_{- http://synligare.eu/Tooling.html}

3_Simulink _Design _Verifier _- _{https://se.mathworks.com/products/}

sldesignverifier.html 6

(28)

as reachability and invariance properties.

To address this lack, as athird contribution, we propose a scalable, for-mal approach for analyzing Simulink models, via statistical model checking, to verify functional and timing properties up to some probability. To auto-mate the approach, we propose the tool SIMPPAAL[37][38] that uses UPPAAL Statistical Model Checker (UPPAAL SMC) [22] as the underlying model-checking engine. Our approach is pattern-based, and subsumes an execution-order-preserving automatic transformation of a Simulink model into a net-work of stochastic timed automata that can be formally analyzed by UP -PAAL SMC [37]. The statistical model checker analyzes the generated state-transition system by conducting statistical analysis on the collected traces of the system executions [56], effectively avoiding the state-space explosion of (exact) model checking. To enable and ensure the correctness of the transfor-mation, we first define the syntax and semantics of Simulink blocks and their composition, and prove the soundness of the transformation for a certain class of Simulink models. Our proposed technique is validated on the Brake-by-Wire use case, which is an industrial prototype provided by VGTT.

Due to the complexity of software that nowadays implements many sys-tem functions, several computing architectures have moved from federated ar-chitectures, that is, dedicated hardware systems executing safety-critical soft-ware systems or applications, into consolidated and distributed architectures, with multiple safety-critical software applications co-hosted on the same hard-ware. In distributed computing [53], the safety-critical software is mapped on multiple hardware systems to capitalize on the computational power pro-vided by the distributed architecture, e.g. the Brake-by-Wire software execut-ing on multiple electronic control units (ECU) that are connected through a network bus, such as CAN [31]. The distributed software, unlike federated computing, it is exposed to a greater degree of permanent and transient faults, therefore, the software reliability should be maximized to improve the overall dependability of the system. However, such measures require additional criti-cal system resources besides computational resources, e.g. energy, which are constrained in battery-driven embedded systems. Thus, the distributed safety-critical software should be mapped onto hardware effectively, to satisfy the timing and reliability requirements of the software, but also efficiently to min-imize the power consumption of the distributed system. We assume that the software is scheduled using a fixed-priority preemptive policy, which is quite common in industry, and possesses end-to-end timing requirements, e.g. the time duration between the brake-pedal press and the slowdown (or halt) of the vehicle is strictly bounded. Furthermore, we consider fault tolerance as a means to maximize reliability of the distributed safety-critical software by mapping redundant software functionality on different computing units.

As the fourth thesis contribution, we propose exact and heuristic opti-mization methods, which deliver optimal and near-optimal solutions, respec-7

as reachability and invariance properties.

To address this lack, as athird contribution, we propose a scalable, for-mal approach for analyzing Simulink models, via statistical model checking, to verify functional and timing properties up to some probability. To auto-mate the approach, we propose the tool SIMPPAAL[37][38] that uses UPPAAL Statistical Model Checker (UPPAAL SMC) [22] as the underlying model-checking engine. Our approach is pattern-based, and subsumes an execution-order-preserving automatic transformation of a Simulink model into a net-work of stochastic timed automata that can be formally analyzed by UP -PAAL SMC [37]. The statistical model checker analyzes the generated state-transition system by conducting statistical analysis on the collected traces of the system executions [56], effectively avoiding the state-space explosion of (exact) model checking. To enable and ensure the correctness of the transfor-mation, we first define the syntax and semantics of Simulink blocks and their composition, and prove the soundness of the transformation for a certain class of Simulink models. Our proposed technique is validated on the Brake-by-Wire use case, which is an industrial prototype provided by VGTT.

Due to the complexity of software that nowadays implements many sys-tem functions, several computing architectures have moved from federated ar-chitectures, that is, dedicated hardware systems executing safety-critical soft-ware systems or applications, into consolidated and distributed architectures, with multiple safety-critical software applications co-hosted on the same hard-ware. In distributed computing [53], the safety-critical software is mapped on multiple hardware systems to capitalize on the computational power pro-vided by the distributed architecture, e.g. the Brake-by-Wire software execut-ing on multiple electronic control units (ECU) that are connected through a network bus, such as CAN [31]. The distributed software, unlike federated computing, it is exposed to a greater degree of permanent and transient faults, therefore, the software reliability should be maximized to improve the overall dependability of the system. However, such measures require additional criti-cal system resources besides computational resources, e.g. energy, which are constrained in battery-driven embedded systems. Thus, the distributed safety-critical software should be mapped onto hardware effectively, to satisfy the timing and reliability requirements of the software, but also efficiently to min-imize the power consumption of the distributed system. We assume that the software is scheduled using a fixed-priority preemptive policy, which is quite common in industry, and possesses end-to-end timing requirements, e.g. the time duration between the brake-pedal press and the slowdown (or halt) of the vehicle is strictly bounded. Furthermore, we consider fault tolerance as a means to maximize reliability of the distributed safety-critical software by mapping redundant software functionality on different computing units.

As the fourth thesis contribution, we propose exact and heuristic opti-mization methods, which deliver optimal and near-optimal solutions, respec-7