Embedded system engineering magazine 2006.07,08

90% CUT IN EMISSIONS

AND 50% CUT IN DEVELOPMENT TIME.

THAT’S MODEL-BASED DESIGN.

To meet a tough performance target, the engineering

team at Nissan used dynamic system models instead of paper specifications.

The result: 50% time savings, the first car certified to meet California’s Partial Zero Emissions Vehicle standard, and a U.S. EPA award.

To learn more, visit mathworks.com/mbd

©2005 The MathWorks, Inc.

Accelerating the pace of engineering and science

</Feature>

ESE Magazine July/August 06

22

Developing platform independent embedded applications

<Written by> Irv Badr, Telelogic. </W>

Platform independent models will meet the needs of changing targets through early verification

Software for embedded systems has not only to work properly, it must also meet tight memory, processor, and storage constraints of a target platform. The

application has to be properly architected from the start to meet the platform’s physical and timing constraints, even when the RTOS, processor, memory, and I/O can change several times during the life of a product.

Model-based design makes it possible to develop source code for multiple compilers, languages, and underlying platforms, even different Real-Time Operating Systems, all from a common design. By capturing the intended application’s architecture in a high level Platform Independent Model (PIM), the resulting application source code becomes a truly sharable entity, not just across the same application, but many different ones on other platforms.

PIM generates sharable components and raises the level of abstraction for an application: developers can directly execute a model without needing RTOS integration or writing lengthy programs. They can validate applications very early in the development cycle, fixing errors at the design level, instead of through source code

inspection and debugging. The proven model is deployed as an embedded application on any given platform, with the modelling tool used to define platform specificity.

Practical process framework

Common contributions to schedule slips are inaccurate project scoping, underestimating product complexity, and inadequate unit and regression testing. Addressing these problems requires building a system gradually with continual testing during the course of the development process. Most embedded projects require significant amounts of system modelling and analysis to produce an accurate interpretation of project requirements and their unambiguous production into a system model, for the software engineers to use for application development. A minor mistake in the systems engineering model will be greatly exaggerated when implemented in the software design, and detecting the errors while testing source code requires that all the preceding software layers are fixed before the error is identified in the systems model

Figure 1 shows a V process that emphasizes

Figure 1 testing and verification at every stage of analysis and design.

testing and verification at every stage of both analysis and design, and pushes software generation further downstream in favour of developing more models. Testing is concurrently and continually performed on the corresponding models, rather than only on the resulting source code.

Figure 2 (a) is a Sequence Diagram, part of a systems engineering model, of a vehicle ignition management system. Animated interactions summarise the black-box behaviour of the components, and furnish the instance values of the associated parameters such as, fuel flow rate, the RPM of the freshly started engine, and the ensuing demand for fuel. This provides a sound basis for system analysis with both normal and boundary-level operating conditions. In the detailed design of the ignition sub-system, software designers add behavioural details (Figure 2 (b)), and generate source code.

Software Modelling

While specifying the system components and black-box behaviour system engineers also lay the groundwork for software development. When the detailed behaviour of one of the vehicle fuel tank, was elabodetailed behaviour, the added a path to pump fuel on the demand for fuel engine management

engineers, recognising the the design added a the diagram, providing a setting timers) of the tank and an error flag if

empty.

the system and software generic syntax to allow extend the other’s design. behaviour is normally code, but systems engifamiliar with the programmay be intimidated by its Platform Independent syndelve into the deepest lev-

els of design detail.

</Feature>

Figure 2a: Sequence diagram of an ignition system.

Figure 2b: System details for the fuel tank.

Code Generation

The system detail in Figure 2(b) is sufficient to generate working source code for the fuel tank. Platform specificity can be added to the modelling tool either as an adaptation layer or directly into the modelled system’s diagram, for the software engineer to form a Platform Specific Model(PSM) and develop code for the specific target platform. The software engineering team can generate and tailor source code which optimally executes on the platform,

knowing that the application itself remains correct and robust.

Changes in platform specifics and architecture are dealt with by generating a new PSM, instead of modifying code and risking inefficiencies and bugs.

Conclusion

Platform Independent Modelling allows the application’s architecture to be developed and validated independently of the development of

application code. The software development team can then focus on developing optimised source code for the selected target architectures, with the knowledge that the application is working and tested. In this way, organisations get the best of both worlds—a device that fully addresses and meets the requirements of a working application coupled with an

efficient implementation.	<End/>
www.telelogic.com

</Feature>

ESE Magazine July/August 06

24

Systems & software modelling for safety critical environments

<Written by> Paul Raistrick, Esterel Technologies </W>

Modelling is moving into the safety-critical realm

Model based development is an attractive approach in systems and software where time to market is critical and development cycles are

short. This approach is increasingly relevant to safety critical systems.

In model based development explicit graphical models are used to define and describe a system. This approach is attractive because:

•Developers can test and analyse their system before any code is written.

•Models are expressed in notations that are easily understood, supporting communi-

cation between systems and software engineers

Within safety critical software development there are additional requirements that a model based development has to take into account; freedom from ambiguity and determinism. These are areas where the model based process can fail.

This article uses SCADE (Safety Critical Application Development Environment), a tool that supports model based development and safe code generation, to discuss how the problems of determinism and ambiguity can be addressed resulting in an implementation view of the control model.

SCADE is a graphical modelling tool in which engineers can specify a control model using familiar block diagrams and state diagrams, simulate and generate safe production code for embedding. Figure 1 shows an example of a SCADE design.

describe architectural, structural and behavioural aspects of the software. They typically reference control law algorithms from the systems engineering environment. However it may not be clear to a software engineer the implicit assumptions that the control model was built on. Therefore it is easy for software engineers to make incorrect assumptions about model behaviour. If the software is based upon different assumptions from those of the control model then the behaviour of the software will diverge from the required

behaviour of the model. The control model is precise from the system engineers point of view, but ambiguous from the software engineers point of view.

SCADE is based on a formal graphical language. The language was defined in close connection with its early industrial users and certification authorities in the aeronautics domain. Formal specifications sit behind all the diagrams developed in SCADE. These specifications are sequences of equations that provide an unambiguous meaning for the

Figure 1: SCADE design model.

Freedom from ambiguity

Systems engineers develop quantitative models to describe control algorithms. These are typically block diagrams or state machines.

Verification of the control model is achieved through simulation in a design environment. Implementation choices are made for the software simulation through simulation settings, implicit sampling rates or the graphical position of model elements. This assists efficiency as the systems engineers do not concern themselves with detail outside the scope of precisely defin-

ing control laws. Figure 2: SCADE modelling sub-set.

Software engineers develop models that

model. Therefore, interpretation of SCADE models does not depend on hidden settings, tool version or graphical positioning.

SCADE provides a number of options for model validation before software development has completed:

•Models can be simulated with system level scenarios. SCADE’s code generator enables system software simulation. At

a source level your simulation is the same as the software that you embed.

•Models can be exported and simulated in tools outside of SCADE. For example if Simulink? is used then the code generat-

ed by SCADE may be exported as an S-Function to allow re-run- ning of system scenarios.

•Formal proofs can be constructed across the model. Testing typically shows correctness only for the values used in the tests.

Formal proof shows correctness over the whole input space. An exhaustive way to demonstrate that safety properties hold over the whole system.

Determinism

Safety-critical software must be deterministic. Control models developed for system rapid prototyping are typically non-deter- ministic. For example within a state machine the control model may run until all possible transitions have been taken.

One of the challenges of safety critical software is to translate non-deterministic specification behaviour into bounded, deterministic behaviour. However, this translation may cause the software implementation to diverge from the control model behaviour.To meet the goals of model based software development, where a design model can be exercised early in the development, there is a need to incorporate architectural constraints into the control model to reflect the translation decisions.

SCADE automatically incorporates constraints that ensure deterministic behaviour of the control model. A SCADE model has the following features that ensure predictable steady execution time and memory use on the target:

•Safe control structures and linear control sequences are employed (no recursion, no jumps, etc).

•A SCADE model is strongly typed; no dynamic variables, and fully static memory allocation ensure data integrity.

Implementation view

With SCADE control models can be developed which automatically take into account the constraints of a safety critical software development. The model can then be used directly to generate production code. SCADE takes a central place in the whole system-software workflow.

The formal basis of SCADE, along with rigorous validation carried out on the tool, allows a high level of confidence to be placed in the generated code. The validation evidence available for SCADE has allowed safety authorities to audit and ‘certify’ the tool so that the code it generates may be used with reduced unit testing requirements.

SCADE operates as a “Certified Software Factory”, providing the necessary tools to perform Verification and Validation (V&V) activities early in the development life cycle, at model-level.

With SCADE we now have a deterministic unambiguous control model that takes into account a safe architecture. We can execute it early in the design cycle, and we have a high degree of confidence that model and final software will operate in the

same way.	<End/>
www.esterel-technologies.com

optimal

proportions...

compact

high brightTFTs

with small metalframe

wide operating temperature range, long term availability, modern COG technology

ideal for industrial applications

TX09D70VM1Cxx

3,5“ TFT (3x6bit CMOS)

QVGA (320x240pixel)

400cd/m2; sunlight readable

TX14D12VM1Cxx

5,7“ TFT (3x6bit CMOS)

QVGA (320x240pixel)

350 (600)cd/m2; sunlight readable

TX16D11VM2Cxx

6,2“ TFT (3x6Bit CMOS)

HVGA (640x240pixel)

250 (350)cd/m2

TX18D16VM1Cxx

7“ TFT (3x6bit CMOS)

WVGA (800x470pixel)

350 (600)cd/m2; sunlight readable

... all TFTs also available with touchscreen

[phone] [e-mail]

xxxx-GJAE-200603-V	MSC (UK) LTD.
	Shaftesbury Court · 95 Ditchling Road
	GB - Brighton, Sussex · BN1 4ST
	Phone [phone] · Fax [phone]
	www.msc-ge.com

<In-Depth>

ESE Magazine July/August 06

26

In-Depth: System modelling and verification

<Written by> Martin Whitbread </W>

Complex systems can be realised faster through system modelling

The market for tools supporting highlevel behavioural modelling is very active. As systems get more complex and mechanical components are eliminated,

the proving of systems designs becomes much harder. The designs often have to be developed using a virtual prototype and all parties in the process need access to the model, in some form or other, from user through to test engineer. With multiple processor cores and many peripherals on a single chip, device level modelling is a vital process in the development cycle. The thoroughness of the test process is also very important, untested features may kill the system at critical times, and with it may go considerable financial loss and even loss of life.

Virtual Prototyping

Virtual prototyping technology enables the creation of a software model of an embedded platform that fully mirrors the functionality of the target embedded system. This virtual platform may combine a high-speed processor instruc- tion-set simulator with fully functional C/C++ models of the hardware building blocks, to provide a high-level model of the hardware.

A virtual platform includes a number of essential components:

• Fastprocessormodels: instruction-setsim- ulator,connectedtocommercialsoftwaredebuggers.

•

processor ators are

•Co-

less software

•Test icking

plays.

The cuting hardware ond. This in advance

tual platform

Corporation for support for TI’s OMAP3430 processor. The VPOM-3430 Virtual Platform pro-

vides a complete simulated environment for the OMAP3430 hardware and software platform. This platform enables system designers focusing on converging mobile phones with advanced

SystemVision provides a virtual lab for design and analysis of distributed mechatronic systems.

developed on the virtual prototype.

The VaST technology – including tools and models, allows a single-core simulation at up to 200MIPS, while multi-core systems with tiered memory structures, multi-level buses, bus bridges, and peripherals, can be simulated at up to 100 MIPS depending on the configuration.

This level of performance is clearly important for this market. A simulation of the SPARC-com- pliant Leon 2 processor – developed for the European Space Agency, achieves 318 MIPS using Virtutech’s SIMICS model running on a 2.4 GHz AMD Athlon64 processor. SIMICS includes a device modelling language and compiler, as well as Hindsight, a tool that allows developers to run code backward once an error has been detected. The presence of a device modelling language provides scope for configuring nonstandard devices such as ASICS and FPGAS.

Mechatronic Systems

There is scope in this market for modelling mechatronic systems, so often the sensor or actuator is assumed to function perfectly, rather than being noise prone and subject to manufacturing tolerances. SystemVision, from Mentor Graphics provides a virtual lab for the design and analysis of distributed mechatronic systems. It provides a virtual lab for creating and analyzing digital and mixed signal systems, supporting industry standard languages: VHDL-AMS, SPICE and C. SystemVision supports the design verification of hierarchical schematic and circuit elements, providing concept verification through block diagrams and transfer functional blocks.

Sharing Models

There is always a risk with any design that it will turn out to be “the perfect solution to nobody’s problem”! The key to avoiding this is communication between all parties involved. The MathWorks recently released Simulink Report Generator 3 which includes Web View Exporting feature which creates interactive renditions of Simulink and Stateflow models than be viewed using a web browser. This allows access to models from remote locations and the previous multi-format capabilities of Simulink Report Generator. Users can navigate and view model

Simulink Report Generator 3 from The MathWorks enables users to automatically export Simulink and Stateflow Models to Web Views to share designs throughout an organization.

hierarchy in Web View in the same way that they can do so in Simulink. The cost is nil to the remote user as they are accessing a web page and running any additional software.

For some time it has been possible to generate code from Simulink models. Now Maplesoft, a Canadian software house, has released a mathematical modelling environment that provides automated export to the Simulink platform for multi-domain simulation and model-based design. It automatically generates Simulink S- Function blocks and using this facility engineers can export dynamic system models and analytical algorithms from the BlockBuilder model development environment. It also enables the creation of multi-input/multi-output blocks and supports procedures for exporting non-linear models and other algorithms

Model Test Coverage

We often hear of systems failing due to untested paths or failure to recognise an error when it occurs. Tests need to be carried out on all paths in the system and the results recorded. The new version of SCADE (5.1) that was released in February included a Model Test Coverage module which allows measurement of the coverage by a high-level requirements based test suite.

This shows how thoroughly the behaviour of the model has been explored by simulation. The primary objective is to detect unintended functions and methodology has been designed in cooperation with major industrial users such as Airbus and Eurocopter.

The SCADE 5.1 Model Test Coverage tool will be DO-178B qualified as a verification tool. It also includes a Compiler Verification kit which verifies that SCADE generated code can be predictably compiled using the chosen tool chain, and that it executes correctly. There is also now a gateway to Rhapsody and UML from SCADE, as well connection to Green Hills’ INTEGRITY RTOS and compilers. Now designers will be able to use UML to specify the system’s high level requirements architecture, and then use SCADE to formally specify the software behaviour.

A partnership between I-Logix and Esterel Technologies has recently been formed in order to provide a unique integrated Model-Driven Development environment for developing DO178B and IEC65108 certified safety-critical embedded software applications. I-Logix’ Rhapsody is based on the UML 2.0 standard and the latest version of the Systems Modelling Language (SysML) draft standard for specifying, documenting and validating systems designs.

References

ARTISAN www.artisansw.com

Esterel

www.esterel-technologies.com

i-Logix(Telelogic) www.ilogix.com Mentor Graphics www.mentor.com

VaST www.vastsystems.com

Virtio www.virtio.com

Virtutech www.virtutech.com

Esterel SCADE product provides a full set of tools for formal graphical design capture and simulation down to embedded C code generation for safety critical production use. SCADE provides DO-178B qualified C code generation up to level A and certified IEC 61508 C code generation for all SIL levels.

SysML

With the launch of ARTISAN Studio 6.1 earlier this year, ARTISAN Software Tools has included support for SysML requirements modelling in a UML/SysML model. This supports a range of safety related process models for DO178B for avionics software, IEC/DIN/EN 61508 for automotive and other safety critical applications. The new SysML Requirements Profile brings textual requirements to the UML community by making use of ARTISAN Studios’ Ergonomic Profiling capabilities to provide new menus, diagrams and a browser for exploring systems requirements and traceability relationships. It also supports external tool chains, allowing textual requirements to be displayed and traced inside the UML/SysML model. Synchronisation can be achieved with requirements held in external tools such as DOORS, Requisite Pro, Word, Excel and Access.

ARTISAN Studio 6.1 also supports the OMG’s concept of Model Driven Architecture with a practical solution for transforming state machines into code. <End/>

	Optimising	Hardware	The Leader in Embedded
		Debug	Software Development
	Compilers
		Probes
			FREE 30-Day Product Evaluation
	Integrated	Real-Time	register now at www.ghs.com/eval
	Development	Operating
	Environments	Systems

Debugging &	All
Performance	Royalty
Analysis	Free!

Tel: [phone] Fax: [phone] Email: [e-mail]

</Feature>

ESE Magazine July/August 06

28

Selecting the right service is key as M2M moves to GPRS

<By Mike Collen, ACTE Components. </W>

GPRS offers an effective route to M2M

One of the most appealing ways of adding wireless connectivity to a machine, device or sensor is to use the public cellular networks. The approach

has many advantages, not least that cellular coverage is now more or less ubiquitous, allowing the mobile device to work anywhere. Moreover, the networks are inherently interconnected with the wider communications infrastructure: this gives equal freedom of location for the central site (or peer machines) as for the mobile device. Cellular networks are built for carrier class reliability, and provide low cost-per-bit.

Modules

On a practical level, such implementations are also easily devised and realised. Vendors provide ready type-approved GSM/GPRS modules that can be integrated into any appliance, often via a high level interface. Not only does this ease the designer’s task, it averts the possibility of system changes that could require costly and time consuming re-approval. Most modules now also include multi-band facilities, to allow roaming and the selection of least-cost network options, and to provide a hardware platform that can be used with products deployed anywhere in the world.

GPRS M2M services are now taking over from SMS-based systems, as designers realise the advantages of moving to IP-based infrastructures. Not only do such always-on systems produce further reductions in cost-per-bit, they also allow the use of established networking techniques – for instance in security, verification and encryption – that have been proven in use on the Internet and world-wide web.

Device manufacturers, however, have often struggled to make practical use of the long list of benefits of cellular, and GPRS in particular, largely because the overall communications function is not just about the device. Many facilities need to be overlaid on the base network in a technically complicated process that requires a great deal of software development. In particular, the network needs to be secure and resistant to malware and spam: not least because unwanted incoming communications cost money in a pay-per-bit environment..

Just like any other form of communication,

M2M also requires an appropriate billing system, and a billing structure that makes economic sense for the network operator, service provider, device manufacturer and end customer. Sometimes the system also needs to interface with the PSTN, and perhaps most importantly of all, must work smoothly with the end customer’s existing IT infrastructure.

Partners

This means that the device manufacturer needs to partner with both a subsystem manufacturer that can provide the right hardware modules and embedded software support and with a service provider which understands M2M requirements. Alternatively it may be possible to find a “ready made” partnership that can offer a virtually turnkey communications solution.

At ACTE Components we have partnered with service provider Wireless Logic to provide the customer with a solution at the device level, and a complete layer of functionality sitting on top of the cellular network. Wireless Logic effectively offers airtime services via its ManageNet product.

The device developer receives ready-activat- ed SIMs that are added to the device at the point of assembly, reducing overall costs. The SIM includes a static IP address for better security and reliability, and ease of development and configuration. To protect against network outages, ManageNet has its own private kilostreams operating across the mobile networks’ GPRS gateway support nodes (GGSNs). If one network goes down, the other will automatically step in. Wireless Logic also maintains VPN tunnels and private leased lines allowing a secure private service

in 48 hours of its Authentication,

tion via VPN and leased triple DES III encryption together to keep

data secure. ManageNet also has its own

centre which enables core communication without the use of public networks, and allows the establish-

ment of a route per SIM or per customer as soon as the GPRS connection is established to the application server.

Billing

Billing is one of the most important benefits of using a one-stop M2M service. Without facilities such as direct billing to the end customer, revenue sharing, and advanced, flexible tariff definition, it can be difficult to devise a profitable business model for all concerned. The billing system must also be scaleable, since M2M often involves networks with tens of thousands of nodes. Branded airtime contracts, credit checking, provisioning and bill collection (via invoice or direct debit) are all elements that must be considered.

From a hardware point of view, developers need to check that the modules they choose are type approved. Siemens modules supplied by ACTE, for instance, meet all of the requirements laid down by the R&TTE, FCC, IC, UL, GCF, and PTCRB. Attaining type, board and operator approval is a time-consuming, costly and unpredictable business, so any changes to the communications module are to be avoided.

GPRS offers the best option yet for M2M communications via an IP-based backbone: a fact that developers have clearly discovered if we are to judge from the rapidly expanding number of high-volume implementations using the technology. With 40 billion potential candidates for networking, it’s a market that looks set to be around for some time to come. <End/>

www.actecomponents.co.uk

Beagle I2C/SPI

Protocol Analyser

	Non-intrusive I2C monitoring up to 4
	Mhz
	#
	Non-intrusive SPI monitoring up to
	24 Mhz
	#
	Real-Time Data Capture and
	Display
	#
	Watch I2C and SPI packets as they
	occur on the bus
	#
	Bit-Level Timing
	See the individual bit timings down
	to 20 ns resolution
Only £225	#
	Fully Linux and Windows compatible

Experts in Embedded Systems

www.gwmicros.com

ADVANCED MICRO PERIPHERALS LTD.

“The Embedded Video Experts”

MPEG4000 - 4-Channel MPEG4 Encoder

h4 Live PAL/NTSC inputs.

h4 concurrent recordings to disk

hSynchronized Video/Audio recording

hSDK’s for Windows NT/2000/

XP, Linux

http://www.ampltd.com/prod/mpeg4k.html

MICRO886ULP - Ultra Low Power CPU

hFanless operation @ 1GHz h128-512MBytes SDRAM hPC/104 and PC/104+ h10/100MBit Ethernet hSerial, Parallel, USB hEIDE and Floppy h+3.3V and +5V tolerant PCI h-40 to +80°C option

http://www.ampltd.com/prod/u886.html

VAC104+ - Video Annotation Controller

hPAL or NTSC input

hVideo Blending with VGA

Graphics

h256 levels of Alpha Blending hPAL/NTSC and VGA outputs

hSDKs for Windows, Linux,

QNX

http://www.ampltd.com/prod/vac104p.html

All products designed, manufactured and supported in the UK

ADVANCED MICRO PERIPHERALS LTD

TEL: [phone] FAX: [phone] EMAIL: [e-mail]

http://www.ampltd.com

</Feature>

ESE Magazine July/August 06

30

Internet Protocols for M2M

<Written by> Alan Singer, Connect One </W>

Evolving Internet protocols need choosing connectivity devices carefully

to
Mof Post-PC,
gy, providing
non-PC
trollers,
fleet
terminals,
telemedicine
ty meters,
SCADA
Device
but the
New
that a device’s communication application be	Comments) on servers located in disparate net-
	works, ISPs, wireless and telecoms operators,
	and this may require a total hardware redesign.
	Connectivity processors
	Several manufacturers offer microcontrollers
	(MCUs) with Internet protocols designed to run
	simultaneously with the application. The proto-
	cols are often scaled down for the limitations on
	internal chip memory and available processing
	power, Mingling the Internet protocols and appli-
	cation may degrade CPU performance, depend-
	ing on processing power and speed, the amount
	of data transmitted, the protocols’ implementa-
	tion, but may be adequate sometimes.
	TCP/IP-enabled modems
	Most wireless modems today offer some imple-
	mentation of the Internet protocol stack. Writing a
	new application on the modem processor may
	works but it may not make sense to rewrite an
	existing application already exists. Due to limited
	memory, most modems only include a minimal
	implementation of the IP stack and may not be
	able to adequately buffer the data if there is a lot
	of data to send. With little flexibility or control over
	the connection, modems require a great deal of

Figure 1: iChipBlock Diagram

requirements. The Internet adapter must offer

Figure 2: Communication options for IPenabling an M2M application

higher functionality to justify the extra cost over an IP-enabled wireless modem,.

Offloading connectivity

An IP networking controller mediates the connection between the host and the Internet via the physical medium, requiring minimal changes to the hardware and minimal or no change to the application of an existing design, just a few commands to set the Internet configuration parameters and to activate Internet communications.

An IP controller offloads Internet connectivity tasks from a host processor, enabling it to exclusively and efficiently run the device application. When offloading Internet connectivity, customer can use their current application, operating system, and remain focused on their area of expertise, which is the device itself. Offloading eliminates the possibility of having to update the operating system, CPU, and memory (or even a major rewrite of the application) if the customer wishes to add new Internet functionality or protocol support.

Conclusion

dynamic, and that is consolution must must be adaptyet sophisticatInternet’s inherent to embedded cost-effective-

<End/>

www.connectone.com