Search

Spacecraft on-board computers are responsible for controlling the spacecraft platform, payloads, or other on-board devices. Their mission-specific software allows communication with ground or other on-board computers. Traditionally, on-board software has been written close to the hardware in assembly language, Ada, C, or C++, with or without a real-time operating system (RTOS) [1]. As the spacecraft computer hardware capabilities are increasing, spacecraft software is becoming larger and more complex, handling more tasks from payload data processing to landing a first stage of a launch vehicle on an ocean-going barge. Spacecraft will still continue to include very small embedded systems that can be developed without operating systems (OS), but some systems will also have large software bases, requiring efficient software development processes and reuse of existing software modules. The last decade has seen increasing use of Linux in spacecraft on-board software. This article presents common features of spacecraft on-board computers and software and discusses potential benefits and drawbacks of on-board Linux use. The focus of this article is on spacecraft on-board avionics software, that is, spacecraft- controlling code that flies into orbit with the spacecraft. Other types of computers are not included in this analysis; for example, many laptops on the International Space Station run Linux [2].

Errors in safety-critical software can have disastrous consequences. However, tools exist that developers can use to thoroughly analyze software subsystems for critical safety properties.

Safety stories specify safety requirements, using the EARS (Easy Requirements Specification) format. Software practitioners can use them in agile projects at lower levels of safety criticality to deal effectively with safety concerns.

Commercial microprocessors could be useful computational platforms in space systems, as long as the risk is bound. Many spacecraft are computationally constrained because all of the computation is done on a single radiation-hardened microprocessor. It is possible that a commercial microprocessor could be used for configuration, monitoring and background tasks that are not mission critical. Most commercial microprocessors are affected by radiation, including single-event effects (SEEs) that could be destructive to the component or corrupt the data. Part screening can help designers avoid components with destructive failure modes, and mitigation can suppress data corruption. We have been experimenting with a method for masking radiation-induced faults through the software executing on the microprocessor. While triple-modular redundancy (TMR) techniques are very effective at masking faults in software, the increased amount of execution time to complete the computation is not desirable. In this paper we present a technique for combining duplication with compare (DWC) with TMR that decreases observable errors by as much as 145 times with only a 2.35 time decrease in performance.

Fujitsu researchers have developed a methodology to automate testing of industrial-strength embedded software implemented in C or C++. The methodology’s core is a program analysis technique called symbolic execution, which the researchers have customized to automate testing. The methodology generates unit-level tests, greatly reducing test generation time and cost while providing excellent test coverage.

The requirement for high reliability is no longer restricted to a few specialized and proven domains. Instead, ever more functions whose failure can hurt humans and damage property are cropping up in new areas. Avoiding problems and catastrophes in the new software reliability landscape is possible but won't be easy.

The aim of this paper is to provide a review on verification and validation of embedded software. An embedded software is a product that contains a microprocessor and software to perform certain function. The growing demand for new features and functionalities of embedded systems makes the design and implementation reach a higher level of complexity. We focused on identifying research trends in order to provide a review of the challenges that emerge during the verification and validation processes of embedded software. The research works are grouped by related themes in order to find research problems that persist nowadays.

The features of current TV sets is increasing rapidly resulting in more complicated embedded TV software that is also harder to test and verify. Using model checking in verification of embedded software is a widely accepted practice even though it is seriously affected by the exponential increase in the number of states being produced during the verification process. Using fully non-deterministic user agent models is one of the reasons that can result in a drastic increase in the number of states being produced. In order to shrink the state space being observed during the model checking process of TV software, a method is proposed that rely on using previous test logs to generate partly nondeterministic user agent model. Results show that by using partly non-deterministic user agents, the verification time of certain safety and liveness properties can be significantly decreased.

IMA (Integrated Modular Avionics) approaches have been around for 30 years but vary widely in implementation and the extent of both hardware and software levels of unification. The IMA concept, which replaces numerous separate processors and line replaceable units (LRUs) with fewer, more centralized processing units, has led to significant weight reduction and maintenance savings in both military and commercial airborne platforms. The IMA concept for this definition originated in the United States with the F-22 Joint Integrated Avionics Working Group (JIAWG) 30 years ago and then migrated to business jets and commercial transports in the late 1990s. In the last 10 years, the mainstream IMA definition has incorporated time and space partitioned software environments based on the ARINC 653 standard. During this period, software complexity has exploded. The ARINC 653 extended IMA definition has enabled the development of common software infrastructure to enhance complex systems management and enable greater software reuse. In open literature, civil aviation has cornerstone IMA extended examples in the Airbus 380 and Boeing 787 Dream-liner platforms. This article provides a summary of IMA history, presents these new IMA challenges going forward, and summarizes research focus exploring advanced IMA solutions.

The rapid growth in the use of software in airborne systems and equipment in the early 1980s resulted in a need for industry-accepted guidance for satisfying airworthiness requirements [1]. To assure the reliability of the software and to ultimately ensure the safety of passengers, the U.S. Federal Aviation Administration (FAA) has imposed software certifcation suited to the development of safety-critical systems. The FAA has accepted guidelines developed by the Radio Technical Commission for Aeronautics (RTCA) that respond to the necessity of reliability and safety, which are vital in this feld: DO-178B/EUROCAE ED-12B (DO-178B), titled Software Considerations in Airborne Systems and Equipment Certifcation [1]. DO-178B prescribes design assurance guidance for airborne software. The aim of DO-178B is to assure that software developed for avionics systems is reliable and safe to use in fight [2].

As discussed in Partitioning in Avionics Architectures: Requirements, Mechanisms, and Assurance by Rush by, J. [1], integrated modular avionics (IMA) is an embedded version of a centralized time-shared “mainframe,” which provides the hosted applications with the common computing resources and the airborne data network. The features of various IMA systems can be summarized in the following points: 1. high performance shared common computing resources 2. high speed communication network 3. open architecture for both software and hardware.

To meet future demands for wireless sensor network (WSN) software, both experts and average software developers should be involved in WSN software development. However, WSN software development is difficult for the average software developer because data processing-related design and network-related design are tangled in the software. Here, we propose a software development process for WSN software by stepwise refinement. Our process enables stepwise refinement to separately address data processing-related and network-related concerns, reuse of well-defined designs, and implementations for network-related concerns prepared by the experts, and perform model-driven development to obtain source codes from models by model transformations. Additionally, we used case studies using actual WSN software development and user studies to evaluate how our proposed process can support actual WSN software development.

Moore's law describes exponential productivity in the semiconductor industry. It depends on rapid hardware and software development. Many hardware modules will be replaced in new products, while the total system software must remain consistent and high performing. This brings unique challenges, and this article discusses software development strategies.

Traditional software testing methods are not effective for testing embedded software thoroughly due to the fact that generating effective test inputs to cover all code is extremely difficult. In this work, we propose an automatic method to generate test inputs for embedded executables which is based on concolic execution. The core idea of our method is to divide concolic execution into symbolic execution on hosts, and concrete execution on targets, so considerable development work can be saved. Our method overcomes the limitations of the software and hardware abilities of embedded systems by restricting heavy-weight work on resourceful hosts. One feature of our method is that it targets executables, so the source of tested software is not needed. Another feature is that tested programs run in a real environment rather than in a simulator, so accurate run-time information can be acquired. Symbolic execution and concrete execution are coordinated by cross-debugging functions. Then we implement our method on Wind River VxWorks. Experiments show that our method achieves high code coverage with acceptable speed.

In the wake of several high-profile embedded-software failures and scandals, we have a responsibility to ensure that the software artifacts we design meet high standards and to reassure users that embedded systems are reliable, safe, and secure.

We propose multiple reliability-driven software transformations targeting unreliable hardware. These transformations reduce the executions of critical instructions and spatial/temporal vulnerabilities of different instructions with respect to different processor components. The goal is to lower the application's susceptibility toward failures. Compared to performance-optimized compilation, our method incurs 60% lower application failures, averaged over various fault injection scenarios and fault rates.

Embedded systems are severely resource constrained and thus can benefit from adaptations to enhance their functionality in highly dynamic operating conditions. Adaptations, however, often require additional programming effort or complex architectural solutions, resulting in long design cycles, troublesome maintenance, and impractical use for legacy applications. In this paper, we introduce an adaptation logic for the dynamic reconfiguration of embedded applications and its implementation via a domain-specific language. We illustrate the approach in a real-world case study of a navigation application for avionics.

Embedded and mobile software systems are marked with a high degree of unpredictability and dynamism in the execution context. At the same time, such systems are often mission-critical, meaning that they need to satisfy strict reliability requirements. Most current software reliability analysis approaches are not suitable for these types of software systems, as they do not take the changes in the execution context of the system into account. We propose an approach geared to such systems which continuously furnishes refined reliability predictions at runtime by incorporating various sources of information, including the execution context of the system. The reliability predictions are leveraged to proactively place the software in the (near-)optimal configuration with respect to changing conditions. Our approach considers two representative architectural reconfiguration decisions that impact the system's reliability: reallocation of components to processes and changing the number of component replicas. We have realized the approach as part of a framework intended for mission-critical settings, called REsilient SItuated SofTware system (RESIST), and evaluated it using a mobile emergency response system.

The software performing navigation, guidance, control, and mission-sequencing functionalities embedded in the flight computer system (FCS) of a satellite launch vehicle must be highly dependable. The presence of faults in the embedded flight software affects its dependability and may even jeopardize the entire mission, resulting in a huge loss to the space agency concerned. There are many techniques available to achieve high dependability and can be classified under fault avoidance, fault removal and fault tolerance.

Time to market is a crucial factor in increasing market share in consumer electronics. Furthermore, fierce market competition tends to sharply lower the prices of new consumer electronics products as soon as they're released. Researchers have studied software-intensive embedded system design methods, such as hardware/software co-design, with the goal of reducing development lead time by designing hardware and software simultaneously. However, most studies concentrate on static design methods, in which a design remains unchanged once it's determined. To survive the market competition in consumer electronics requires a dynamic design strategy that takes various market conditions into account for software-intensive embedded systems. This article proposes a sustainable embedded software life-cycle planning (SeSLP) process based on the evolution of embedded software. The SeSLP process provides a dynamic method for both selecting product life-cycle design alternatives and generating a profit-maximizing transition plan that covers the entire product life cycle.

Software for commercial aircraft is subject to the stringent certification processes described in the DO-178B standard, "Software Considerations in Airborne Systems and Equipment Certification." Issued in 1992, this document focuses strongly on the verification process, with a major emphasis on testing. In 2005, the avionics industry initiated an effort to update DO-178B, in large part to accommodate development practices (including formal verification techniques) that had matured since its publication. A revised standard, DO-178C, was issued in late 2011, incorporating new guidance that allows formal verification to replace certain forms of testing. In this article, the authors describe some of the new objectives and activities in the area of formal methods, explain how these methods may be used instead of testing in a DO-178C context, and summarize the practical experience of Dassault-Aviation and Airbus in successfully applying the new DO-178C approach. The first Web extra at http://youtu.be/tRtK4xOK-8o is part 1 of a video talk by Hervé Delseny, describing Airbus's use of formal methods to verify avionics software and summarizing the integration of formal methods in the upcoming ED-12/DO-178 issue C. The second Web extra at http://youtu.be/BVI5J1GAQ30 is part 2 of a video talk by Hervé Delseny, describing Airbus's use of formal methods to verify avionics software and summarizing the integration of formal methods in the upcoming ED-12/DO-178 issue C. The third Web extra at http://youtu.be/U3G1ZOoqg78 is part 3 of a video talk by Hervé Delseny, describing Airbus's use of formal methods to verify avionics software and summarizing the integration of formal methods in the upcoming ED-12/DO-178 issue C. The fourth Web extra at http://youtu.be/WtlqS-JOHrA is part 4 of a video talk by Hervé Delseny, describing Airbus's use of formal methods to verify avionics software and summarizing the integration of formal methods in the upcoming ED-12/DO-178 issue C.

The NASA SCaN Test Bed flight experiment payload aboard ISS will enable experimenters the unique opportunity to investigate SDRs, navigation, and networking in the space environment. Comprised of three SDRs from industry partners, CoNNeCT allows experimenters to develop and verify new waveforms compliant with the STRS SDR architecture standard, using verified ground systems and then have those waveforms uploaded to the flight SDRs to assess in situ performance and to better understand operational concepts for SDRs in space. In addition to the SDRs, the reprogrammable avionics software allows application software for on-board networking and routing experiments. The flight system communicates with TDRSS at both S-band and Ka-band and can receive within the GPS L-band for navigation waveform development and experiments.

Embedded devices are resourceconstrained devices. They have limited computation power, a small memory footprint, and a low-capacity battery. The computational power is defined by the processor type, its architecture, bus width, and register set. The primary (system) memory available is generally a few megabytes to a gigabyte or two . Secondary storage is either absent or present as flash memory. The batteries provided are of low capacity and need periodic charging depending upon the usage. All these hardware constraints challenged the software developers to design highly optimized software architecture that could fully leverage the capabilities provided by these devices without hampering the performance or user experience. Several algorithms for process scheduling, cache management, memory management, and power management are available that help in achieving the above objectives.

The prevalence of software as an integral part of almost anything is commonplace today among the products, systems, applications, services and/or solutions with which we all interact. Software reliability directly impacts both the user experience and field operating costs. A key challenge is for the product developer to accurately predict and improve software field reliability in terms of attributes such as outage frequency and duration, prior to software delivery. Unfortunately, the actual field performance data does not often correlate with the predictions. Markov analysis and software reliability growth models are necessary key steps, but are insufficient to fully address customer-perceived reliability issues. Can we make better use of field performance data to improve our predictive models and tune our test strategies from one release to the next? In this paper, we describe an integrative software reliability framework that attempts to close the gap between expectations, predictions, and the actual behavior of systems by leveraging key best-in-class practices, tools, and techniques for software reliability analysis, modeling and predicting software field performance in terms of outage frequency/duration; tracking and monitoring test defect data and defects “not fixed” in subsequent releases over the software lifecycle, and validating prediction results with the actual field data. The proposed approach is designed to achieve customer expectations for software reliability and help assure the delivery of highly reliable software products. © 2012 Alcatel-Lucent.

As embedded software systems have grown in number, complexity, and importance in the modern world, a corresponding need to teach computer science students how to effectively engineer such systems has arisen. Embedded software systems, such as those that control cell phones, aircraft, and medical equipment, are subject to requirements and constraints that are significantly different from those encountered in the standard desktop computing environment. For example, embedded systems must frequently address challenges that arise from severe resource restrictions (e.g., low memory and network bandwidth), heterogeneous hardware platforms, and safety-critical operations. Software architecture has been shown to be an effective means for coping with such issues, yet traditional courses on embedded software development rarely focus on software architectural abstractions. Instead, they have concentrated on lower-level issues such as programming languages and hardware interfaces. Since 2005 at the University of Southern California, Los Angeles, a unique course has been developed that affords students the opportunity to gain experience and insights on developing software architectures for embedded systems. At the heart of the course is a middleware platform, Prism-MW, that helps students use software architectural principles to construct embedded systems and understand the important challenges of the embedded systems domain. This paper describes this course through the explanation and evaluation of four years of class projects, weaving together the course, the middleware platform, and the relationship of each to three key pedagogical goals that drove the formulation of the course curriculum.

Conformance to software standards plays an essential role in establishing confidence in high-integrity software systems. However, standards conformance suffers from uncertainty about its meaning for three reasons: because requirements of the standard must be interpreted to fit the specifics of the application; because standards can deliberately leave options for developers; and because goal-based software standards exist that simply specify the high-level principles of software assurance without prescribing a specific means of compliance. The overall effect of these issues is that when conformance to a software assurance standard is claimed, there can be a lack of clarity as to exactly what the claim entails. This article draws on principles and practice from the domain of safety argument construction to describe the use of explicit and structured conformance arguments to help address this problem.

Measurement of software security is a long-standing challenge to the research community. At the same time, practical security metrics and measurements are essential for secure software development. Hence, the need for metrics is more pressing now due to a growing demand for secure software. In this paper, we propose using a software system's attack surface measurement as an indicator of the system's security. We formalize the notion of a system's attack surface and introduce an attack surface metric to measure the attack surface in a systematic manner. Our measurement method is agnostic to a software system's implementation language and is applicable to systems of all sizes; we demonstrate our method by measuring the attack surfaces of small desktop applications and large enterprise systems implemented in C and Java. We conducted three exploratory empirical studies to validate our method. Software developers can mitigate their software's security risk by measuring and reducing their software's attack surfaces. Our attack surface reduction approach complements the software industry's traditional code quality improvement approach for security risk mitigation and is useful in multiple phases of the software development lifecycle. Our collaboration with SAP demonstrates the use of our metric in the software development process.

In this paper, we propose two general frameworks for deriving several software reliability growth models based on a non-homogeneous Poisson process (NHPP) in the presence of imperfect debugging and error generation. The proposed models are initially formulated for the case when there is no differentiation between failure observation and fault removal testing processes, and then extended for the case when there is a clear differentiation between failure observation and fault removal testing processes. During the last three decades, many software reliability growth models (SRGM) have been developed to describe software failures as a random process, and can be used to evaluate development status during testing. With SRGM, software engineers can easily measure (or forecast) the software reliability (or quality), and plot software reliability growth charts. It is not easy to select the best model from a plethora of models available. There are few SRGM in the literature of software engineering that differentiates between failure observation and fault removal processes. In real software development environments, the number of failures observed need not be the same as the number of faults removed. Due to the complexity of software systems, and an incomplete understanding of software, the testing team may not be able to remove the fault perfectly on observation of a failure, and the original fault may remain, resulting in a phenomenon known as imperfect debugging, or get replaced by another fault causing error generation. In the case of imperfect debugging, the fault content of the software remains the same; while in the case of error generation, the fault content increases as the testing progresses. Removal of observed faults may result in the introduction of new faults.

Over the last decade, a new reality has set in for the semiconductor industry. In a variety of application domains like wireless, multimedia, networking, and automotive, it has become more and more difficult to provide silicon solutions without the associated software executing on the hardware. Not only has software become the key functional differentiator in many areas; its development cycle now determines the overall project success. Market research firm International Business Strategies, Inc. claims that today at 90 nm the typical overall SoC-related development effort for software has already surpassed the effort for hardware. For 45 nm designs in the year 2011, IBS projects that less than 40 percent of the overall development efforts will be spent on hardware. Given the ever growing levels of complexity, traditional approaches to developing embedded software are failing to meet the challenge; a new era of software development has begun in which the majority of embedded software is developed with virtual prototypes, in contrast to traditional software development on hardware boards.

Model-based methodologies have been widely used to handle the increasing demand for rapid development of high-quality, real-time embedded control software. A key challenge in such model-based design is integration of various ?collaborative? analysis methods to support the automation of the design process. Traditional analysis methods developed for analyzing specific system properties, however, are not designed for such integration, and thus cannot ensure that the information for the analysis will be provided at the design stage where the information is needed. Moreover, many traditional analysis methods depend heavily on complete and accurate design models which can only be applied to post-design verification and are unavailable for automation of the design process involving an early design stage, where implementation details are unknown. This challenge can be met by integrating analysis methods with the design process. We have developed such a framework combined with software modeling, execution platform configuration, and run-time monitoring mechanisms to enable accurate assessment of embedded software quality at early design stages. We have implemented and demonstrated the framework with a toolkit, called AIRES, that integrates software models, a virtual execution platform, and timing and schedulability analysis methods.

Software deployment deals with the transition of software assets from production to consumers' sites. Distributed systems are created by combination of multiple software components at runtime, possibly running on different devices over a network, making the problem of deployment harder than in the case of centralized systems. This article presents a model for the description of software components, distributed systems, and their dependencies, and a mechanism that uses them to automate the deployment of software units onto devices. These have been implemented and validated in a case study, the digital home, which demonstrated its feasibility.

Consumer electronics are becoming more feature rich. Embedded system developers use design and testing tools to make their products faster. However, tool improvements have not kept pace with the rapid development of customized hardware parts. The simulation of target system or virtual platform helps developers of embedded software for consumer electronics work without having to wait for the physical hardware to be available. In this work, we designed and implemented a virtual development environment for embedded software (VDEES). This environment provides the tools to build a virtual platform according to a given target hardware specification and to develop software to run on the target hardware with the virtual platform. VDEES is implemented at low cost by exploiting open source software packages and extended or customized them to meet our requirements. VDEES provides a configuration tool for composing a virtual target, a code editor for writing simulated components, software to be run on the target, building tools for binary images, a debugger for investigation of the software running on the virtual target, and a system monitor for the investigation of the virtual target.

peer-reviewed Current advances in model-based develop-ment technology indicate that embedded software developers can expect more tool support for the whole embedded-software spectrum, from applications to system software.

Software is no longer creeping into every aspect of our lives - it's already there. In fact, failing to recognize just how much everything we do depends on software functioning correctly makes modern society vulnerable to software errors.

In recent decades, safety has emerged as a major issue in many embedded applications in the aerospace, aircraft, automobile, railways, nuclear, medical, and other industries. Safety in this context means avoiding harm to individuals or society due to malfunctioning computer equipment or software. The essential requirements for these systems are so strict that they are regulated by government agencies such as the US Federal Aviation Administration (FAA) in the case of both airborne and ground aviation systems.The general concept of safety assurance is to minimize risk that can lead to accidents. This implies that the software tools used to develop the hardware and software components in safety-critical systems must be evaluated as thoroughly as the products themselves.

For a software development project, management often faces the dilemma of when to stop testing the software and release it for operation, which requires careful decision making as it has great impact on both software reliability and project cost. In most existing research on the optimal software release problem, the cost considered was the Expected Cost (EC) of the project. However, what concerns management is the Actual Cost (AC) of the project rather than the EC. Treatment (such as minimization) of the EC may not ensure the desired low level of the AC due to the uncertainty (variability) involved in the AC. In this paper, we study the uncertainty in software cost and its impact on optimal software release time in detail. The uncertainty is quantified by the variance of the AC and several risk functions. A risk-control approach to the optimal software release problem is proposed. New formulations of the problem which are extensions of current formulations are developed and solution procedures are established. Several examples are presented. Results reveal that it seems crucial to take into account the uncertainty in software cost in the optimal software release problem; otherwise, unsafe decisions may be reached which could be a false dawn to management.

The amount of software in consumer electronics has grown from thousands to millions of lines of source code over the past decade. Up to a million of these products are manufactured each month for a successful mobile phone or television. Development organizations must meet two challenging requirements at the same time: be predictable to meet market windows and provide nearly fault-free software. Software reliability is the probability of failure-free operation for a specified period of time in a specified environment. The process of finding and removing faults to improve the software reliability can be described by a mathematical relationship called a software reliability growth model (SRGM). Our goal is to assess the practical application of SRGMs during integration and test and compare them with other estimation methods. We empirically validated SRGMs' usability in a software development environment. During final test phases for three embedded software projects, software reliability growth models predicted remaining faults in the software, supporting management's decisions.

Although software's complexity and scope have increased tremendously over the past few decades, advances in software engineering techniques have been only moderate at best. Software measurement has remained primarily a labor-intensive effort and thus subject to human limitations. The Space Shuttle's avionics software is an excellent example of how applying standards such as IEEE 982.1 can help alleviate human limitations by providing a quantitative roadmap to answer key questions

This paper proposes a more general acceptance of software certification that comprises two steps: first, it should certify the environment in which the software will execute, second, it should certify the software in the context of that environment. With the proposed certification, more complex single systems can be replaced with multiple simpler systems with increased reliability. A simpler system with a single party responsible for repair is far more likely to be fixed or replaced in a manageable time frame

Embedding defective software in medical devices increases safety risks. Given that all software is inherently defective, how can medical device manufacturers identify and manage risk? An effective, tailored risk management process can make the task less daunting. Developing complex, software-based medical devices is a challenging business. Device manufacturers must understand the inherent differences between hardware and software components and establish robust software development processes that are based on recognized engineering principles appropriate for safety-critical systems. At the heart of such processes, they must incorporate risk management - from early development through product retirement. Manufacturers have a responsibility to train development and risk management teams in the use of recognized software engineering practice that promote software safety. Only then can they minimize the risk of including inherently defective software in their products.

Advances in electronics over the past decade have produced major improvements in the power and flexibility of computer systems. Unfortunately current avionics systems for space applications typically have not leveraged these COTS advantages. A decade ago, the state-of-the-art for avionics systems made a step change to the Integrated Modular Avionics (IMA) used in the Boeing 777. This next generation avionics architecture is not based upon traditional Byzantine redundancy structures, but on a truth-based scheme where each element knows when an internal failure occurs and removes itself from the system. IMA utilizes a lock-step microprocessor design that communicates to a COTS Backplane for input/output, and to a Virtual Backplane/spl trade/ (a reliable high-speed serial bus) for intra-system communication. The system functions are implemented using a time and space partitioned operating system. The entire system provides the simplicity of a simplex system, implements the highest level of reliability providing complete flexibility to reconfigure both software applications and hardware interfaces, allows for rapid prototyping using low-cost COTS hardware, and is easily expandable beyond the initial point implementation. As the only 5/sup th/ generation avionics architecture, the concepts incorporated into Honeywell's IMA are ideally suited to be the backbone of the next generation Space Exploration Program avionics architectures.

One area from which we might gain leverage in the ubiquitous- and embedded-systems domain is software architecture, which has emerged over the past decade as an area of intense interest among researchers and practitioners. Such interest has resulted in many approaches to dealing with architectural description and analysis, architectural styles, domain-specific and application family architectures, and architecture-based dynamic system adaptation. By and large, however, these approaches share assumptions that make them suited specifically to the domain of traditional, desktop-based development platforms. Those comparatively few architecture-based solutions that have focused on software systems for embedded devices have faced some traditional development challenges (such as applying solutions across an application family) but have also had different priorities (for example, ensuring efficient, architecture-compliant system implementations). In this article, the author draw general distinctions between "traditional" software architectures and those targeted at embedded systems. The author focuses on several areas that traditional software architecture research has studied and discusses their applicability and potential shortcomings in the embedded-systems context.

Control systems are one of the main application domains for embedded computing. With the complexity of applications growing rapidly, it is important that engineers who design control systems be knowledgeable about the design procedures and challenges in embedded computing technology. To meet this need, a low cost laboratory setup for integrating diverse concepts is presented, including microprocessors, control systems, programming and software development, and electronics. A project based laboratory setup allows students to develop fundamental skills in the design and implementation of embedded computer controlled systems.

Society is becoming increasingly dependent on the safe and secure operations of digital devices and software embedded in consumer, industrial, and military systems. This special issue features three outstanding articles that illustrate some of the advanced design and certification concepts using cyber-physical systems from the domains of medical devices, driverless cars, and avionics as well as the importance and difficulty of learning from experience.

With the integration of computer technology, consumer products, and communication facilities, the software in an embedded system now accounts for as much as 70% of total system functionalities. In this work, we propose a complete methodology called ESSP (embedded software synthesis and prototyping) for the automatic design of embedded software. Several issues are solved, including software synthesis, software verification, code generation, and system emulation. To avoid design errors, a formal approach is adopted because glitches in embedded software are intolerable and very expensive or even impossible to fix. Complex-choice Petri nets are used to model embedded software, which are then synthesized using an extended quasi static scheduling algorithm. The final generated C code is prototyped on an emulation platform, which consists of an 89C5I microcontroller for executing the software, an FPGA chip for programming the hardware for different applications, and some input/output devices. Two application examples are used to illustrate the feasibility of the ESSP methodology.

Technologies for the development of embedded systems should address specific constraints such as hard timing constraints, limited memory and power use, predefined hardware platform technology, and hardware costs. Existing development technologies don't address their specific impact on, or necessary customization for, the embedded domain. Nor do these technologies give developers any indication of how to apply them to specific areas in this domain, for example, automotive systems, telecommunications, or consumer electronics. Consequently, tailoring a technology for a specific use is difficult. Furthermore, the embedded domain is driven by reliability factors, cost factors, and time to market. So, this embedded domain needs specifically targeted development technologies. An inventory of eight European companies reveals what tools developers of embedded-systems software are and aren't using, and why. The need exists for more specific, yet flexible, tools.

With growing demand for embedded multimedia applications, time to market of embedded software has become a crucial issue. As a result, embedded software designers often use libraries that have been preoptimized for a given processor to achieve higher code quality. Unfortunately, current software design methodology often leaves high-level arithmetic optimizations and the use of complex library elements up to the designer's ingenuity. In this paper, we present a tool flow and a methodology, SymSoft, that automates the use of complex processor instructions and preoptimized software library routines using symbolic algebraic techniques. We use SymSoft to optimize a set of examples for the SmartBadgeIV (Maguire et al., 1998) portable embedded system running the Linux embedded operating system. The results of these optimizations show that by using SymSoft we can map the critical basic blocks of the benchmark examples to the StrongARM SA-1110 instruction set much more efficiently than the commercial StrongARM compiler. SymSoft is also used to map critical code sections to commercially available software libraries with complex mathematical elements such as exp or the inverse discrete cosine transform routine. Our measurements on SmartBadgeIV show that even higher performance improvements and energy savings are achieved by using these library elements. For example, the final optimized MP3 audio decoder runs four times faster than real-time playback while consuming four times less energy. Since the decoder executes faster than real-time playback, additional energy savings are now possible by using processor frequency and voltage scaling.

Software reliability growth models (SRGMs) have been developed to estimate software reliability measures such as the number of remaining faults, software failure rate, and software reliability. Issues such as imperfect debugging and the learning phenomenon of developers have been considered in these models. However, most SRGMs assume that faults detected during tests will eventually be removed. Consideration of fault removal efficiency in the existing models is limited. In practice, fault removal efficiency is usually imperfect. This paper aims to incorporate fault removal efficiency into software reliability assessment. Fault removal efficiency is a useful metric in software development practice and it helps developers to evaluate the debugging effectiveness and estimate the additional workload. In this paper, imperfect debugging is considered in the sense that new faults can be introduced into the software during debugging and the detected faults may not be removed completely. A model is proposed to integrate fault removal efficiency, failure rate, and fault introduction rate into software reliability assessment. In addition to traditional reliability measures, the proposed model can provide some useful metrics to help the development team make better decisions. Software testing data collected from real applications are utilized to illustrate the proposed model for both the descriptive and predictive power. The expected number of residual faults and software failure rate are also presented.

The memory system often determines a great deal about the behavior of an embedded system: performance, power, and manufacturing cost. A great many software techniques have been developed over the past decade to optimize software to improve these characteristics. Embedded software design and compilation can take advantage of two important facts: the hardware target is known; and we can spend more time and computational effort to optimize the software. This paper surveys techniques for optimizing memory behavior of embedded software and points to some future trends in the field.