Context: representing software architectures for embedded systems, together with an adequate development process, configures a fundamental step to enhance the quality of the derived software products. Objectives: This papers aims at presenting a multifaceted characterisation of different techniques used for representing software architectures for embedded systems. Method: A systematic map was built to help the comprehension of how the research community has been investigating and describing software architectures for embedded systems. The identified primary studies were analysed and classified according to three facets in order to characterise the current research and to identify research gaps that shall be explored in the future. Results: the produced map makes explicit the most investigated topics in architecture representation for embedded systems as well as the research needs. It also helps researchers to allocate their efforts to properly represent software architectures as part of an adequate software development process.

A Systematic Mapping of Architectures for Embedded Software

A reactive system reacts to an environment it tries to control. Lurette is a black-box testing tool for such closed-loop systems. It focuses on environment modeling using Lutin, a language designed to perform guided random exploration of the System Under Test (SUT) environment, taking into account the feedback. The test decision is automated using Lustre oracles resulting from the formalisation of functional requirements.

/pdf/environment-model-based-testing-of-control-systems-case-3qly9w8leg.pdf

Environment-Model Based Testing of Control Systems: Case Studies

This paper proposes a model-based software safety analysis method for flight control software Firstly, the AADL architecture model and error model of flight control software are constructed separately Then we convert the AADL model of flight control software into extended Markov chain model We can evaluate safety of software component by calculate the probability of component state in different hazardous levels with the extended Markov chain model Finally, safety of entire flight control software system can be calculated according to AADL error states composition relation, which can avoid states explosion problem of Markov chain model

An AADL Model-Based Safety Analysis Method for Flight Control Software

Flight control law software have errors. Some are found during the extensive testing and certification process and others pass through causing accidents. The testing of flight control software indicates that the code and the model match. But it is very difficult to ensure if the model was correct in the first place. Model checkers like Mathworks Simulink Design Verifier check the models against formally defined conditions and system behavior. The tool can come up with counterexamples that can fail an assertion or proof. A study is done on how easy or difficult it is to teach engineering students this formal process. The problem statement, the Simulink models and the outcome of the study in terms of advantages and disadvantages of using Simulink Design Verifier is highlighted in this preliminary study.

Arguing formally about flight control laws

Simulink is a powerful tool for Embedded Systems, playing a key role in dynamic systems modeling. However, far too little attention has been paid to quality of Simulink models. In addition, no research has been found linking the relationship between model complexity and its impact in the comprehension quality of Simulink models. The aim of this paper is to define a set of metrics to support the characterization of Simulink models and to investigate their relationship with the model comprehension property. For this study, we performed a controlled experiment using two versions of a robotic Simulink model — one of them was constructed through the ad hoc development approach and the other one through the re-engineered development approach. The results of the experiment show that the re-engineered model is more comprehensible than the ad hoc model. In summary, the set of metrics collected from each version of the Simulink model suggests an inverse relationship with the model comprehension, i.e., the lower the metrics, the greater the model comprehension.

/pdf/a-set-of-metrics-for-characterizing-simulink-model-4n98kuwz6j.pdf

A set of metrics for characterizing simulink model comprehension

Safety critical control systems, especially flight control systems, have failed in trials and actual flights sometimes killing people. Independence is a key word in the verification and validation activity of such systems. Model based testing is used today in all flight control programs. Test cases are generated using qualified automated tools or manually to ensure code and requirements coverage. A new paradigm of coverage metric is developed here for the independent verification. This has been developed for control systems represented as Simulink blocks. The coverage metrics are defined as pairs of cells. One cell has a True/False discrete metric, which indicates if a particular functionality has been covered. The other cell has the continuous metric, which indicates a distance to nominal, or coverage. The efficacy of these metrics is determined by tests using mutant code. Matlab code corresponding to the model is mutated to generate several mutant files. It is shown that the test cases developed using this coverage metric bring out the errors introduced in the mutant files. It was possible to use these metrics to optimize test cases successfully using the Taguchi Design of Experiments methodology. 1 2

A new input-output based model coverage paradigm for control blocks

Verification of Test Procedures and Test Cases (TP, TC) is an important process stage for fulfilling the RTCA/DO-178B/C compliance objective while developing software for safety critical flight control systems. Correctness of these results, their requirement coverage (High/Low level) analysis and justified discrepancies (if any) are the primary objectives that must be satisfied. Manual reviews are the most common methods for achieving these objectives. This paper consolidates some of the past experiences of conducting manual reviews in the flight control software V&V for a commercial aircraft program. Through them a clear need and scope for automating portions of manual review is identified. This led to the development of an Auto Review Tool (ART) which is qualified for claiming the certification credits. All the necessary documents such as Tool’s Operational Requirement (TOR), Tool Qualification Plan (TQP) and Tool Assessment Summary (TAS) are prepared. The paper presents the tool development process beginning with defining a library of Input/Output relation based functions for different control blocks, parser development and qualification activity that were performed by an independent testing team.

An auto-review tool for model-based testing of safety-critical systems

In this paper we present the usage ofa recently proposed array logic based technique for designing the autopilot mode transition logic for a commercial aircraft. The technique helps in reducing the design effort in the
development of an autopilot. It is easily understood and
provides a very concise way of specifying a large number of
transitions in simple tabular column. Vertical autopilot modes have been used for designing the mode transition logic, extending the technique to cover the navigation and approach modes. Appropriateflight conditions, performance criteria, external and internal events have been analyzed and incorporated in the mode transition logic design.

Mode Transition Logic of a Vertical Autopilot for Commercial Aircrafts

Autopilot mode confusion has resulted in many aircraft accidents. This brings out the importance of design validation for the complicated mode transition logic (MTL) for aircraft autopilot systems. A method of implementing mode transition tables in terms of transition and condition tables was developed for the Indian SARAS autopilot. This method is used for designing the mode transition for a generic aircraft. A practical method of reviews, assertions, safe states, and safe transitions is experimented for this design as a process. This practical process has yielded good results and helped the team to come up with the validated MTL. This approach is presented here as an industry experience paper.

Nagaraj Murthy

Papers

A new input-output based model coverage paradigm for control blocks

Arguing formally about flight control laws

An auto-review tool for model-based testing of safety-critical systems

Mode Transition Logic of a Vertical Autopilot for Commercial Aircrafts

A Methodology to Design a Validated Mode Transition Logic