Der stetig steigende Funktionsumfang im Automobil und die zunehmende Vernetzung von Steuergeräten erfordern neue Methoden zur Beherrschung der Komplexität in der Validierung und Verifikation. Die virtuelle Absicherung ermöglicht die Integration der Software in einem PC-System, unabhängig von der Ziel-Hardware, zur frühzeitigen Gewährleistung der Softwarequalität im Entwicklungsprozess. Ebenso kann die Wiederverwendbarkeit vorhandener Komponenten in zukünftigen Mikrocontrollern sichergestellt werden. Die Grundlage dafür liefert der AUTOSAR-Standard durch einheitliche Schnittstellenbeschreibungen, welche die Abstraktion von Hardware und Software ermöglichen. Allerdings enthält der Standard hardwareabhängige Software-Komponenten, die als Complex-Device-Drivers (CDDs) bezeichnet werden. Aufgrund ihrer Hardwareabhängigkeit sind CDDs nicht direkt in eine virtuelle Absicherungsplattform integrierbar, da die spezifischen Hardware-Module nicht verfügbar sind. Die Treiber sind dennoch Teil der Steuergeräte-Software und somit bei einem ganzheitlichen Absicherungsansatz mit zu betrachten. Diese Dissertation beschreibt sieben unterschiedliche Konzepte zur Berücksichtigung von CDDs in der virtuellen Absicherung. Aus der Evaluierung der Praxistauglichkeit aller Ansätze wird eine Auswahlmethodik für die optimale Lösung bei sämtlichen Anwendungsfällen von CDDs in der Steuergeräte-Software entwickelt. Daraus abgeleitet, eignen sich zwei der Konzepte für die häufigsten Anwendungsfälle, die im Weiteren detailliert beschrieben und realisiert werden. Das erste Konzept erlaubt die vollständige Simulation eines CDD. Dies ist notwendig, um die Integration der Funktions-Software selbst ohne den Treiber zu ermöglichen und alle Schnittstellen abzusichern, auch wenn der CDD noch nicht verfügbar ist. Durch eine vollständige Automatisierung ist die Erstellung der Simulation nur mit geringem Arbeitsaufwand verbunden. Das zweite Konzept ermöglicht die vollständige Integration eines CDD, wobei die Hardware-Schnittstellen über einen zusätzlichen Hardware-Abstraction-Layer an die verfügbare Hardware des Systems zur virtuellen Absicherung angebunden werden. So ist der Treiber in der Lage, reale Hardware-Komponenten anzusteuern und kann funktional abgesichert werden. Eine flexible Konfiguration der Abstraktionsschicht erlaubt den Einsatz für eine große Bandbreite von CDDs. Im Rahmen der Arbeit werden beide Konzepte anhand von industrierelevanten Projekten aus der Serienentwicklung erprobt und detailliert evaluiert. / The constantly increasing amount of functions in modern automobiles and the growing degree of cross-linking between electronic control units (ECU) require new methods to master the complexity in the validation and verification process. The virtual validation and verification enables the integration of the software on a PC system, which is independent from the target hardware, to guarantee the required software quality in the early development stages. Furthermore, the software reuse in future microcontrollers can be verified. All this is enabled by the AUTOSAR standard which provides consistent interface descriptions to allow the abstraction of hardware and software. However, the standard contains hardware-dependent components, called complex device drivers (CDD). Those CDDs cannot be directly integrated into a platform for virtual verification, because they require a specific hardware which is not generally available on such a platform. Regardless, CDDs are an essential part of the ECU software and therefore need to be considered in an holistic approach for validation and verification. This thesis describes seven different concepts to include CDDs in the virtual verification process. A method to always choose the optimal solution for all use cases of CDDs in ECU software is developed using an evaluation of the suitably for daily use of all concepts. As a result from this method, the two concepts suited for the most frequent use cases are detailed and developed as prototypes in this thesis. The first concept enables the full simulation of a CDD. This is necessary to allow the integration of the functional software itself without the driver. This way all interfaces can be tested even if the CDD is not available. The complete automation of the generation of the simulation makes the process very efficient. With the second concept a CDD can be entirely integrated into a platform for virtual verification, using an hardware abstraction layer to connect the hardware interfaces to the available hardware of the platform. This way, the driver is able to control real hardware components and can be tested completely. A flexible configuration of the abstraction layer allows the application of the concept for a wide variety of CDDs. In this thesis both concepts are tested and evaluated using genuine projects from series development.

La complexité croissante des applications embarquées dans les voitures modernes augmente le besoin de puissance de calcul. Pour répondre à ce besoin, le standard automobile AUTOSAR introduit l'utilisation de plates-formes multi-cœurs. Cependant, l'utilisation du multi-cœurs pour des applications temps-réel critique automobile soulève plusieurs problématiques. Notamment, il faut respecter la spécification fonctionnelle et garantir de manière déterministe les échanges de données entre cœurs. Dans cette thèse, nous considérons des systèmes multi-périodiques spécifiés et validés fonctionnellement avec des modèles Matlab/Simulink. Ainsi, nous avons développé un framework pour déployer des applications Matlab/Simulink sur AUTOSAR multi-cœurs afin de garantir le déterminisme fonctionnel et temporel tout en exploitant au mieux le parallélisme. Notre contribution a porté sur trois axes. Premièrement nous avons identifié les mécanismes d'échanges de données imposés dans le modèle fonctionnel Matlab/Simulink. Nous avons montré que ces mécanismes pouvaient s'exprimer en utilisant le formalisme des Synchronous Dataflow Graph (SDFG). Ce modèle est un excellent outil d'analyse pour exploiter le parallélisme car il est très populaire dans la littérature et largement étudié pour le déploiement d'applications flow de données sur plateforme multi/many-cœurs. Par la suite, nous avons développé des méthodes pour réaliser le flux de données exprimés par le SDFG dans un ordonnancement temps-réel préemptif. Ces méthodes utilisent des résultats théoriques sur les SDFGs pour garantir les contraintes de précédence de manière déterministe sans utiliser des mécanismes de synchronisation bloquants. De cette sorte, nous garantissons à la fois le déterminisme fonctionnel et temporel des applications. Finalement, nous caractérisons l'impact des contraintes de flux de données sur l'ordonnancement des tâches. Nous proposons une technique de partitionnement qui minimise cet impact. Nous montrons alors que cette technique favorise la construction d'un partitionnement et d'un ordonnancement lorsqu'elle est utilisée pour initialiser des algorithmes de recherche et d'optimisation heuristiques. / The increasing complexity of embedded applications in modern cars has increased the need of computing power. To meet this need, the European automotive standard AUTOSAR has introduced the use of \multicore platforms. However, \multicore platform for critical automotive applications raises several issues. In particular, it is necessary to respect the functional specification and to guarantee deterministically the data exchanges between cores. In this thesis, we consider multi-periodic systems specified and validated with \mat. So, we developed a framework to deploy \mat applications on AUTOSAR \multicore. This framework guarantees the functional and temporal determinism and exploits the parallelism. Our contribution is threefold. First, we identify the communication mechanisms in \mat. Then, we prove that the dataflow in a multi-periodic \mat system is modeled by a SDFG. The SDFG formalism is an excellent analysis tool to exploit the parallelism. In fact, it is very popular in the literature and it is widely studied for the deployment of dataflow applications on multi/many-core. Then, we develop methods to realize the dataflow expressed by the SDFG in a preemptive \rt scheduling. These methods use theoretical results on SDFGs to guarantee deterministic precedence constraints without using blocking synchronization mechanisms. As such, both the functional and temporal determinism are guaranteed. Finally, we characterize the impact of dataflow requirements on tasks. We propose a partitioning technique that minimizes this impact. We show that this technique promotes the construction of a partitioning and a feasible scheduling when it is used to initiate multi-objective research and optimization algorithms. %As such, we reduce the number of design iterations and shorten the design time.

The rapid growth and development of the Information and Communications Technology attract many industries including the automotive industry. Since the last four decades, the automotive engineering has been impacted by the Information Technology. Nowadays, modern vehicles are being designed with up to hundreds of electronic control units (ECUs) and be able to communicate with other vehicles, infrastructure, and other things via wireless networks and sensors. For such in-vehicle networks, serial bus systems like CAN bus, LIN bus, FlexRay, and MOST are standardized. Parallel to this, the automotive industry vendors designed and standardized automotive open systems architecture (AUTOSAR) software platform. AUTOSAR has two main standards - the classical platform and adaptive platform. The classical platform (CP) is designed for the current embedded ECUs, whereas the adaptive platform (AP) is being designed for the future intelligent ECUs. The intelligent AP ECU constitute many multi-processing processors and Ethernet to realize the future autonomous vehicles.On the other hand, automotive industries shall ensure “safety first” in their design and regard it as part of their market feature. Directly or indirectly, the safety of the modern connected vehicles is related to their cybersecurity. Today, cybersecurity professionals are conducting researches to bring remarkable solutions to the sophisticated cyberattacks. One approach of cybersecurity solution is to make a cyber threat modeling and attack simulations. Example, meta-attack-language (MAL) is a threat modeling and attack simulation language, which is designed to make domain-specific threat analysis.In this study, potential assets of an automotive vehicle with AP ECUs are identified. Then, threats of each identified asset are collected from different literature. With both inputs, a cyber threat model is written using MAL. Finally, validation of the model is made with a simulation language. Consequently, modern vehicle with AP ECUs is modeled and simulated.This study contributes four important things - list of potential assets that AP running vehicle constitutes, collected list of threats of the identified assets, validated cyber threat model, and simulation test cases for each potential attack paths in the model. / Den snabba tillväxten och utvecklingen av informations- och kommunikationstekniken lockar många‌ branscher, däribland bilindustrin. Sedan de senaste fyra decennierna har automotive engineering påverkats av informationstekniken. Numera är moderna fordon utformade med upp till hundratals elektroniska styrenheter (ECU) och kan kommunicera med andra fordon, infrastruktur och andra saker via trådlösa nätverk och sensorer. För sådana inbyggda nätverk är seriella bussystem som CAN-buss, LIN-buss, FlexRay och MOST standardiserade. Parallellt med detta har automotive-leverantörerna utformat och standardiserat automatsystem för öppna systemarkitekturer (AUTOSAR). AUTOSAR har två huvudstandarder - den klassiska plattformen och den adaptiva plattformen. Den klassiska plattformen (CP) är utformad för nuvarande inbyggda ECU, medan den adaptiva plattformen (AP) är utformad för framtida intelligenta ECU. Den intelligenta AP-enheten utgör många processorer och Ethernet för att förverkliga de framtida autonoma fordonen. Bilindustrin ska å andra sidan säkerställa "säkerhet först" i sin design och betrakta den som en del av deras marknadsfunktion. Direkt eller indirekt är säkerheten hos moderna anslutna fordon relaterad till sin cybersäkerhet. Idag genomför cybersecurity-proffs för att få anmärkningsvärda lösningar på de sofistikerade cyberattackarna. Ett tillvägagångssätt för cybersecurity-lösningen är att göra en modellering av cyberhot och attack simuleringar. Exempel, meta-attack-language (MAL) är ett hot modellerings-och attack simuleringsspråk, som är utformat för att göra domänspecifik hotanalys. I denna studie identifieras potentiella tillgångar i ett fordonsbil med AP-ECU. Därefter samlas hot av varje identifierad tillgång från olika litteratur. Med båda ingångarna skrivs en cyber-hotmodell med MAL. Slutligen görs validering av modellen med ett simuleringsspråk. Följaktligen modelleras och simuleras moderna fordon med AP-ECU. Denna studie bidrar till fyra viktiga saker - en lista över potentiella tillgångar som AP-körfordon utgör, samlad lista över hot av identifierade tillgångar, validerad cyberhot-modell och simuleringsprovfall för varje potentiell attackvägar i modellen.

In the context of automotive industries today, the focus of ECU function development is always on finding the best possible combinations of control algorithms and parameter. The complex algorithms with broad implementation range requires optimal calibration of ECU parameters to achieve the desired behaviour during the drive cycle of the vehicle. With the growing function complexity of automotive E/E Systems, the traditional approaches of designing the automotive embedded systems are not suitable. In order to overcome the challenge of complexity, many of the leading automotive companies have formed a partnership in order to develop and establish an open industry standard for automotive E/E architecture called AUTOSAR. In this thesis, toolchain for ECU function development following AUTOSAR standard and an efficient measurement and calibration mechanism using XCP on CAN will be investigated and implemented. Two toolchains will be proposed in this thesis, describing their usage in different stages of ECU function development and in calibration. Both these toolchains will be tested to prove its working. / I området utveckling av funktionalitet på elektroniska styrsystem inom bilindustrin idag, ligger fokus på att finna den bästa kombinationen av reglermetoder och styrparametrar. Dessa avancerade system, med breda användningsområden, kräver bästa möjliga injustering av dess kalibrerbara parametrar, för att nå önskat beteende vid användning av fordonet. Det ökande omfånget av funktionskraven på styrsystemen, innebär att sedvanlig metodik för utveckling av dessa system inte är lämplig. För att kunna lösa dessa svårigheter, har de stora inom bilindustrin ingått ett samarbete, där de tillsammans skapat och utvecklar en industristandard för funktionsoch systemutveckling av styrsystem. Standarden kallas AUTOSAR. Denna rapport beskriver hur en kedja av utvecklingsverktyg som följer AUTOSAR-standarden kan användas, för att undersöka och använda en metod för systemövervakning och parameterkalibrering, genom användning av XCP över CAN.

With the increased use of Electronic Control Units (ECUs) in the automotive industry, the system creation and integration becomes progressively more complex. In order to manage this issue, the AUTomotive Open System Architecture (AUTOSAR) was initiated by several of the larger automotive companies and suppliers. Their goal was to create an architecture which will increase the reusability of software, integration of solutions from multiple suppliers and improve scalability. This thesis is made in collaboration with the company CrossControl and covers questions which are specific to their interests, features the AUTOSAR standard has to offer, evaluation of the use of development tools from different vendors, how migration is supported and how the standard affects the required hardware. Among our conclusions is that the AUTOSAR goals of decoupling software application components from the hardware is met to a high degree. Secondly even though file formats are standardized it is not a seamless integration between development tools. Finally, the choice of hardware is not only affected by properties of the standard, but the current versions of tools also limit the choices.

In den letzten Jahrzehnten ist die Komplexität und Vernetzung einzelner Komponenten im Automobil stetig gewachsen. Der Grund dafür sind immer zahlreicher werdende Systeme im und rund um das Auto, welche das tägliche Leben sicherer und komfortabler machen. Von ABS über elektronische Motorsteuerungen bis hin zu autonom fahrenden Fahrzeugen werden in den nächsten Jahren immer aufwendigere Systeme zum Einsatz kommen. Es wird davon ausgegangen, dass in Zukunft 90% der Innovationen im Fahrzeug von der programmierbaren Elektronik geprägt sein werden, was die Komplexität der Software in einem enormen Maße beeinussen wird. Schon heute wird versucht durch entsprechende Techniken den Entwicklungsaufwand gering zu halten, da der internationale Konkurrenz- und Kostendruck die Industrie dazu zwingt.

Les systèmes électroniques embarqués dans les véhicules ont une complexité sans cesse croissante. Cependant, il est crucial d'en maîtriser le comportement temporel afin de garantir la sécurité ainsi que le confort des passagers. La vérification des contraintes temporelles de bout-en-bout est donc un enjeu majeur lors de la conception d'un véhicule. Dans le contexte de l'architecture logicielle AUTOSAR standard dans les véhicules, nous décomposons la vérification d'une contrainte de bout-en-bout en sous-problèmes d'ordonnancement sur les calculateurs et sur les réseaux de communication que nous traitons ensuite séparément. Dans un premier temps, nous présentons une approche permettant d'améliorer l'utilisation des calculateurs exécutant un grand nombre de composants logiciels, compatible avec l'introduction progressive des plateformes multi-coeurs. Nous décrivons des algorithmes rapides et efficaces pour lisser la charge périodique sur les calculateurs multi-coeurs en adaptant puis en améliorant une approche existant pour les bus CAN. Nous donnons également des résultats théoriques sur l'efficacité des algorithmes dans certains cas particuliers. Enfin, nous décrivons les possibilités d'utilisation de ces algorithmes en fonction des autres tâches exécutées sur le calculateur. La suite des travaux est consacrée à l'étude des distributions de temps de réponse des messages transmis sur les bus CAN. Dans un premier temps nous présentons une approche de simulation basée sur la modélisation des dérives d'horloges des calculateurs communicant sur le réseau. Nous montrons que nous obtenons des distributions de temps de réponse similaires en réalisant une longue simulation avec des dérives d'horloge ou en faisant un grand nombre de courtes simulations sans dérives d'horloge. Nous présentons enfin une technique analytique pour évaluer les distributions de temps de réponse des trames CAN. Nous présentons différents paramètres d'approximation permettant de réduire le nombre très important de calculs à effectuer en limitant la perte de précision. Enfin, nous comparons expérimentalement les résultats obtenus par analyse et simulation et décrivons les avantages et inconvénients respectifs de ces approches / The complexity of electronic embedded systems in cars is continuously growing. Hence, mastering the temporal behavior of such systems is paramount in order to ensure the safety and comfort of the passengers. As a consequence, the verification of end-to-end real-time constraints is a major challenge during the design phase of a car. The AUTOSAR software architecture drives us to address the verification of end-to-end real-time constraints as two independent scheduling problems respectively for electronic control units and communication buses. First, we introduce an approach, which optimizes the utilization of controllers scheduling numerous software components that is compatible with the upcoming multicore architectures. We describe fast and efficient algorithms in order to balance the periodic load over time on multicore controllers by adapting and improving an existing approach used for the CAN networks. We provide theoretical result on the efficiency of the algorithms in some specific cases. Moreover, we describe how to use these algorithms in conjunction with other tasks scheduled on the controller. The remaining part of this research work addresses the problem of obtaining the response time distributions of the messages sent on a CAN network. First, we present a simulation approach based on the modelisation of clock drifts on the communicating nodes connected on the CAN network. We show that we obtain similar results with a single simulation using our approach in comparison with the legacy approach consisting in numerous short simulation runs without clock drifts. Then, we present an analytical approach in order to compute the response time distributions of the CAN frames. We introduce several approximation parameters to cope with the very high computational complexity of this approach while limiting the loss of accuracy. Finally, we compare experimentally the simulation and analytical approaches in order to discuss the relative advantages of each of the two approaches

MDE techniques are more and more used in praxis. However, there is currently a lack of detailed reports about how different MDE techniques are integrated into the development and combined with each other. To learn more about such MDE settings, we performed a descriptive and exploratory field study with SAP, which is a worldwide operating company with around 50.000 employees and builds enterprise software applications. This technical report describes insights we got during this study. For example, we identified that MDE settings are subject to evolution. Finally, this report outlines directions for future research to provide practical advises for the application of MDE settings. / Techniken der modellgetriebenen Entwicklung (MDE) werden mehr und mehr in der Praxis eingesetzt. Dabei gibt es wenige detaillierte Berichte darüber wie unterschiedliche MDE-Techniken kombiniert und in die Entwicklung integriert werden. Die vorliegende beschreibende Feldstudie dient dem Zweck, in SAP genutzte MDE-Ansätze detailliert zu beschreiben. SAP ist ein weltweit operierendes Unternehmen, hat ca. 50 000 Mitarbeiter und stellt Softwarelösungen für Firmen her. Der vorliegende technische Bericht beschreibt die Einblicke die wir in dieser Studie erhalten haben. Dazu gehört die Einsicht, dass MDE Ansätze einer Evolution unterliegen. Schließlich umreißt dieser Bericht mögliche Richtungen für zukünftige Forschung um praktische Ratschläge für die Gestaltung von MDE Ansätzen geben zu können.

The Electric/Electronic architecture of vehicle becomes more complex and costly, self-adaption can reduce the system, enhance the adaptive meanwhile reduce energy consumption and costs. The self-adaption needs the cooperation of both hardware and software reconfigurations, such that after the software is reconfigured the automotive network continues to fulfill the time constraints for time-critical applications. The thesis focuses on the real-time network reconfiguration. It uses EAST-ADL to model a real-time automotive system with timing events and constraints, which conforms to AUTOSAR timing extensions. The network media access is analyzed based on the model and a scheduling algorithm is developed. Then the concept is implemented by a use case, which is transformed from an EAST-ADL model to an executable simulation.

The Electric/Electronic architecture of vehicle becomes more complex and costly, self-adaption can reduce the system, enhance the adaptive meanwhile reduce energy consumption and costs. The self-adaption needs the cooperation of both hardware and software reconfigurations, such that after the software is reconfigured the automotive network continues to fulfill the time constraints for time-critical applications. The thesis focuses on the real-time network reconfiguration. It uses EAST-ADL to model a real-time automotive system with timing events and constraints, which conforms to AUTOSAR timing extensions. The network media access is analyzed based on the model and a scheduling algorithm is developed. Then the concept is implemented by a use case, which is transformed from an EAST-ADL model to an executable simulation.:1. Introduction 2. Research Fundamentals 2.1. AUTOSAR Specifications for Modeling Function Communication 2.2. Media Access Control in Real-time Network 3. Function Communication Model and Determination of Network Configuration 3.1. Function Communication Model 3.2. Scheduling Algorithm for Media Access 4. Implementation of Communication Model and Plugin for Model Transformation 4.1. EAST-ADL Modeling Language 4.2. Implementation of Function Communication Model in EAST-ADL 4.3. Model Transformation Plugin and Simulation Tool Integration 5. Evaluation of the Function Communication Model 5.1. Use-Case Model for Evaluation 5.2. Time Values of Use-Case Model 5.3. Analysis and Evaluation of Simulation Result 6. Conclusion and Outlook 6.1. Conclusion of the Work 6.2. Outlook of the Future Work A. OMNeT++ Simulation Log B. EAST-ADL Model to Artop Model Mapping Bibliography Nomenclature