Model-checking and Model-based Testing of Automotive Embedded Systems Starting from the System Architecture

Nowadays, modern vehicles are equipped with electrical and electronic systems that implement highly complex functions such as anti-lock braking or cruise control. The use of such embedded systems in the automotive domain requires a development process that takes into account their complex features. In this context, architectural models have been introduced in system development as convenient abstractions of the system’s structure represented by interacting components. To enjoy the full benefits of such abstractions, the architectural models should be complemented by analysis frameworks that provide means for formal verification, and ideally also model-based testing, tailored to complex automotive systems. One major difficulty in developing such frameworks lies in the fact that architectural models represent the system’s structure as well as inter-component communication, often without the actual description of the behavior. This entails the need to integrate the two views (structural and behavioral) in order to integrate them in a formal framework for verification. In this thesis, we propose an integrated formal modeling and analysis methodology for automotive embedded systems that are originally described in the domain-specific architectural language EAST-ADL. Our analysis methodology relies on formal verification of the original EAST-ADL model by model-checking with UPPAAL PORT for component-based analysis, and UPPAAL SMC for statistical model-checking. To enable analysis, we first propose a formal description of the EAST-ADL components as networks of timed automata, which are UPPAAL’s modeling language. Since code implementation is in fact what is deployed on the vehicle, it is highly desirable to narrow the gap between the code and the architectural model, but also to test the implementation for various requirements. To accomplish the former, we define an executable semantics of the UPPAAL PORT components. To be able to support testing of EAST-ADL based implementations, we take advantage of the model-checker’s ability to generate witness traces during verification of reachability properties. Consequently, we employ UPPAAL PORT to generate such traces that become our abstract test-cases. By pairing the automated model-based test-case generator with an automatic transformation from the abstract test-cases to Python scripts, we enable the execution of the generated Python