<!DOCTYPE article PUBLIC "-//NLM//DTD JATS (Z39.96) Journal Archiving and Interchange DTD v1.0 20120330//EN" "JATS-archivearticle1.dtd">
<article xmlns:xlink="http://www.w3.org/1999/xlink">
  <front>
    <journal-meta />
    <article-meta>
      <title-group>
        <article-title>Towards an Architecture-Centric Approach dedicated to Model-Based Virtual Integration for Embedded Software Systems</article-title>
      </title-group>
      <contrib-group>
        <contrib contrib-type="author">
          <string-name>Huafeng Yu</string-name>
          <email>huafeng.yu@us.toyota-itc.com</email>
          <xref ref-type="aff" rid="aff1">1</xref>
        </contrib>
        <contrib contrib-type="author">
          <string-name>Jean-Pierre Talpin</string-name>
          <xref ref-type="aff" rid="aff0">0</xref>
        </contrib>
        <contrib contrib-type="author">
          <string-name>Sandeep Shukla</string-name>
          <xref ref-type="aff" rid="aff2">2</xref>
        </contrib>
        <contrib contrib-type="author">
          <string-name>Prachi Joshi</string-name>
          <xref ref-type="aff" rid="aff2">2</xref>
        </contrib>
        <contrib contrib-type="author">
          <string-name>Shinichi Shiraishi</string-name>
          <xref ref-type="aff" rid="aff1">1</xref>
        </contrib>
        <aff id="aff0">
          <label>0</label>
          <institution>INRIA Rennes - Bretagne Atlantique, Campus de Beaulieu</institution>
          ,
          <addr-line>263 Avenue General Leclerc, 35042 Rennes</addr-line>
          ,
          <country country="FR">France</country>
        </aff>
        <aff id="aff1">
          <label>1</label>
          <institution>TOYOTA InfoTechnology Center, U.S.A. 465 N Bernardo Avenue, Mountain View</institution>
          ,
          <addr-line>CA 94043</addr-line>
          ,
          <country country="US">U.S.A</country>
        </aff>
        <aff id="aff2">
          <label>2</label>
          <institution>Virginia Polytechnic Institute and State University Falls Church Campus</institution>
          ,
          <addr-line>7054 Haycock Rd., Falls Church, VA 22043</addr-line>
          ,
          <country country="US">USA</country>
        </aff>
      </contrib-group>
      <abstract>
        <p>Current embedded systems are increasingly more complex and heterogeneous, but they are expected to be more safe, reliable and adaptive. In consideration of all these aspects, their design is always a great challenge. Developing these systems with conventional design approaches and programming methods turns out to be di cult. In this paper, we mainly present the informative background and the general idea of an ongoing yet young research project, including the modelbased design and an architecture-centric approach, to address previous challenges. Our idea adopts a formal-methods-based model integration approach, dedicated to architecture-centric virtual integration for embedded software systems, in an early design phase. We thus expect to improve and enhance Correct By Construction in the design. The considered formal methods consist of timing speci cation, design by contracts, and semantics interoperability for models to be integrated in the system. The application domains of our approach include automotive and avionic systems.</p>
      </abstract>
      <kwd-group>
        <kwd>Virtual integration</kwd>
        <kwd>model-based design</kwd>
        <kwd>AADL</kwd>
        <kwd>timing speci cation</kwd>
        <kwd>design by contract</kwd>
        <kwd>semantics interoperability</kwd>
      </kwd-group>
    </article-meta>
  </front>
  <body>
    <sec id="sec-1">
      <title>-</title>
      <p>
        Current embedded systems are increasingly more complex and heterogeneous,
but they are expected to be more safe, reliable and adaptive [
        <xref ref-type="bibr" rid="ref8">8</xref>
        ] [
        <xref ref-type="bibr" rid="ref16">16</xref>
        ]. In
consideration of all these aspects, their design is always a great challenge. Complexity
in the design and implementation is a common issue for current avionic and
automotive systems. In the current system design, veri cation and validation
(V&amp;V) is also a key concern, particularly for safety-critical systems. These
systems generally require great V&amp;V e ort to avoid unexpected system behavior.
Moreover, the design is expected to be validated as early as possible due to the
huge cost of correction in the late-phase implementation. Design validation in
an early phase has become one of the key solutions to reduce the overall V&amp;V
cost.
      </p>
      <p>In this paper, we mainly present the informative background and the
general idea of an ongoing yet young research project, including the model-based
design and an architecture-centric approach, to address previous challenges. Our
idea adopts an formal-methods-based model integration approach, dedicated to
architecture-centric virtual integration for embedded software systems, in an
early design phase. By applying formal methods in an early design phase, we
expect to improve and enhance correct by construction. The formal methods to
be considered consist of timing speci cation, design by contracts, and
semantics interoperability for models to be integrated in the system. The application
domain of our approach include avionic and automotive systems.
2</p>
    </sec>
    <sec id="sec-2">
      <title>Research Challenges</title>
      <p>
        High-level modeling has been widely adopted as a promising solution to
address the system complexity issue [
        <xref ref-type="bibr" rid="ref33">33</xref>
        ]. High-level modeling languages, such
as UML[
        <xref ref-type="bibr" rid="ref27">27</xref>
        ], SysML[
        <xref ref-type="bibr" rid="ref1">1</xref>
        ] and MARTE[
        <xref ref-type="bibr" rid="ref26">26</xref>
        ], have been widely adopted, thanks to
its standardization for modeling. AUTOSAR[
        <xref ref-type="bibr" rid="ref2">2</xref>
        ] and EAST-ADL[
        <xref ref-type="bibr" rid="ref9">9</xref>
        ] are
domainspeci c languages for automotive systems. AADL[
        <xref ref-type="bibr" rid="ref32">32</xref>
        ] (Architecture Analysis and
Design Language) is an SAE standard dedicated to architecture description and
modeling for avionic and automotive systems. AADL provides an industry
standard, textual and graphic notation with precise semantics to model
applications and execution platforms and is supported by commercial and open source
tool solutions|including Open Source AADL Tool Environment (OSATE) [
        <xref ref-type="bibr" rid="ref28">28</xref>
        ].
Matlab/Simulink[
        <xref ref-type="bibr" rid="ref21">21</xref>
        ] is a data ow language for modeling, simulating and
analyzing dynamic systems. Modelica[
        <xref ref-type="bibr" rid="ref23">23</xref>
        ] is an object-oriented modeling language for
component-based complex systems. These high-level languages enables domain
speci c modeling and analysis of complex embedded systems. SCADE [
        <xref ref-type="bibr" rid="ref12">12</xref>
        ] is
an integrated design environment dedicated to rigorous design of safety-critical
systems[
        <xref ref-type="bibr" rid="ref4">4</xref>
        ].
      </p>
      <sec id="sec-2-1">
        <title>Multi-paradigm modeling</title>
        <p>
          All the languages mentioned previously are considered as candidate languages
in high-level modeling for embedded systems. Multi-languages can be used in
the same design because of system modeling from di erent views, for example,
software, architecture, etc.; and di erent purposes, such as analysis, veri cation,
and evaluation. Furthermore, di erent languages may adopt di erent formalism,
e.g., state machines, data ow, communicating sequential processes, di erential
equations, as backstage support. So the rst challenge at the modeling language
level is how to harmonize multiple paradigm modeling [
          <xref ref-type="bibr" rid="ref24">24</xref>
          ] [
          <xref ref-type="bibr" rid="ref25">25</xref>
          ] in the same
design, particularly, when we consider a reliable integration followed by using
formal techniques for analysis and V&amp;V at the system level.
        </p>
        <p>
          An avionic co-modeling example. Co-modeling for the system-level
design has been explored in [
          <xref ref-type="bibr" rid="ref37">37</xref>
          ] [
          <xref ref-type="bibr" rid="ref36">36</xref>
          ], where AADL was used to model the
architecture part and Simulink was used to model the behavior part of an avionic
case study, called simpli ed Airbus A350 doors management system. However,
semantic di erence of the two models makes the integration problematic. In
order to have a clear and unambiguous integration, a formal model of computation
(MoC), called Polychrony [
          <xref ref-type="bibr" rid="ref17">17</xref>
          ], was adopted as an intermediate model. This MoC
is based on the synchronous/polychronous timing semantics. The later formal
analysis, veri cation, and scheduling were mainly performed on the basis of the
same MoC.
        </p>
      </sec>
      <sec id="sec-2-2">
        <title>Integration frameworks</title>
        <p>
          In Polychrony, the integration is performed at the polychronous MoC level[
          <xref ref-type="bibr" rid="ref36">36</xref>
          ].
Polychrony provides model transformations from AADL and Simulink (via
GeneAuto[
          <xref ref-type="bibr" rid="ref35">35</xref>
          ]) to the polychronous MoC. In order to keep the semantics coherent,
both AADL and Simulink models adopt the polychronous semantics. Based on
the same polychronous semantics, the composed model can used for analysis,
veri cation, and simulation or be translated into other formal models for formal
veri cation and scheduling. So in this integration scheme, the core polychronous
model provides formal semantics support and its environment provides tool
connection. Model-based system integration has also been discussed in [
          <xref ref-type="bibr" rid="ref34">34</xref>
          ] with
regard to cyber-physical systems, [
          <xref ref-type="bibr" rid="ref6">6</xref>
          ] for tool integration platform, [
          <xref ref-type="bibr" rid="ref31">31</xref>
          ] based
on SOA (Service of Architecture), [
          <xref ref-type="bibr" rid="ref10">10</xref>
          ] for heterogeneous models integration,
and [
          <xref ref-type="bibr" rid="ref29">29</xref>
          ] for real-time software engineering. AUTOSAR[
          <xref ref-type="bibr" rid="ref2">2</xref>
          ] aims at
componentlevel integration for automotive systems. System Architecture Virtual
Integration (SAVI) program [
          <xref ref-type="bibr" rid="ref30">30</xref>
          ] [
          <xref ref-type="bibr" rid="ref13">13</xref>
          ] aims at creating an architecture-centric model
repository to support analysis of virtually integrated system models related to
performance, safety, and reliability, and so on. It also enables to discover
systemlevel faults at the early design phase, thus reduce risk, cost, and development
time.
3
        </p>
      </sec>
    </sec>
    <sec id="sec-3">
      <title>A Model-Based Architecture-Centric Virtual</title>
    </sec>
    <sec id="sec-4">
      <title>Integration Framework</title>
      <p>
        Based on the previous exploration of design issues and the state of the art of
solutions in research, we nd an architecture-centric model-based integration
framework is necessary for the next-generation design of automotive software
systems. The framework is expected to provide the following advantages: reliable
model integration, fast and early-phase design validation, architecture
optimization enabling, easy access to current matured software development tools and
environment, etc. With this objective in mind, we rst propose a model-based
architecture-centric virtual integration approach, in the framework of
modelbased systems engineering [
        <xref ref-type="bibr" rid="ref11">11</xref>
        ], for the design of next-generation automotive
systems. This approach is involved in mostly correct by construction
technologies, rather than a posterioriVeri cation &amp; Validation in the implementation
phase. We adopt di erent modeling languages with regards to di erent views
of the system, for example, AADL for architecture modeling and Simulink for
behavioral modeling, etc. The main research topics in the project include:
timing speci cation [
        <xref ref-type="bibr" rid="ref5">5</xref>
        ], design by contracts and semantics interoperability for the
purpose of a reliable model integration, which are explained in the following
subsections.
      </p>
      <sec id="sec-4-1">
        <title>Timing speci cation</title>
        <p>With all the concerns in the embedded system design, timing is one of the most
signi cant ones. In general, the timing issue becomes more explicit when
architecture is considered and the system is integrated, due to the gap between
software and architecture design. In our project, we consider high-level,
formalized timing constraints to be de ned, observed and analyzed based on software
architecture, speci ed in AADL. From this point of view, an architecture
centric approach is adopted for the model integration in our project. Considering
abstraction in the system design, we advocate the modeling of synchrony and
time as software and hardware events, which are related to synchronization in
an architecture speci cation. Compared to real time, synchronous logical time,
applied on both software and architecture, provides an algebraic framework in
which both event-driven and time-triggered execution policies can be speci ed.</p>
        <p>
          In the framework of our project, we de ne the semantics and algebra with
regard to logical timing constraints and speci cation, and support the
submission of a timing-related annex to the SAE standard AADL[
          <xref ref-type="bibr" rid="ref32">32</xref>
          ]. This annex will
de ne a synchronous and timed speci cation framework to formally model time
domains pertaining to the design of embedded architectures, including the
specications of automotive software architectures. The behavior annex of AADL are
considered as the vehicle to implement this model, together with a timing annex
(TA), as a mean to represent abstractions of these behavior annexes using clock
constraints and regular expressions.
        </p>
      </sec>
      <sec id="sec-4-2">
        <title>Design by contract</title>
        <p>
          Design by contract [
          <xref ref-type="bibr" rid="ref22">22</xref>
          ] [
          <xref ref-type="bibr" rid="ref15">15</xref>
          ] is also adopted in our approach in the project.
Contracts play a signi cant role in the safe and reliable model integration in our
approach. We rst analyze high-level requirements from automotive or avionic
systems, from which formalizable requirements are then extracted according to
the technical formalizability and veri ability. These requirements are expressed
in formal languages so that they can be used to build the contracts for the
integration of models that implement corresponding functionality. The contracts
are expected to consider di erent criteria for safety, performance, cost, timing
constraints, and so on. A mathematical framework will then be built to de ne the
composition of these models, together with the contracts on them, in a formal
way. The contracts and their associated models will be checked by modeling
checking technologies [
          <xref ref-type="bibr" rid="ref14">14</xref>
          ] [
          <xref ref-type="bibr" rid="ref19">19</xref>
          ] [
          <xref ref-type="bibr" rid="ref7">7</xref>
          ] .
        </p>
      </sec>
      <sec id="sec-4-3">
        <title>Semantics interoperability</title>
        <p>
          One of the main issues in the composition of models is semantics di erence
between heterogeneous models and di erent formalism. One of the feasible
solutions to this issue is to have a common model as the intermediate formal model,
and all other models are translated into the common model. An example can
be found in [
          <xref ref-type="bibr" rid="ref37">37</xref>
          ]. The intermediate model provides the formal semantics, based
on which, expected properties of the original models and their integration are
checked. However, this requires a semantics preservation in the model
translation, which is not practical in most cases. Another solution is related to formal
semantics interoperability. Some work can be found in [
          <xref ref-type="bibr" rid="ref3">3</xref>
          ] [
          <xref ref-type="bibr" rid="ref20">20</xref>
          ], [
          <xref ref-type="bibr" rid="ref18">18</xref>
          ]. Our current
research topic is focusing on the study of di erences between the models, which
can lead to issues in the model translations, from the point of view of model
semantics, particularly timing semantics and operational semantics. The expected
result of this research is intended to provide a foundation of the previous two
research topics.
4
        </p>
      </sec>
    </sec>
    <sec id="sec-5">
      <title>Conclusion</title>
      <p>In this position paper, we have presented several important issues in current
system design related to embedded systems, such as multi-paradigm modeling,
integration framework, and formal semantics issues. A brief survey of
corresponding research topics was also presented. We, hence, propose a model-based
architecture-centric integration approach, considering timing speci cation,
design by contract and semantics interoperability as main topics of research. Based
on these research, a model-based integration framework is expected to be built,
which is dedicated to model-based systems engineering for next-generation
automotive systems.</p>
    </sec>
    <sec id="sec-6">
      <title>Acknowledgment References</title>
      <p>The authors appreciate the valuable advices from Ryo Ito and Kazuhiro Kajio
(Toyota Motor Corporation).</p>
    </sec>
  </body>
  <back>
    <ref-list>
      <ref id="ref1">
        <mixed-citation>
          1.
          <string-name>
            <given-names>Systems</given-names>
            <surname>Modeling</surname>
          </string-name>
          <article-title>Language (SysML)</article-title>
          . http://www.sysml.org/specs.
        </mixed-citation>
      </ref>
      <ref id="ref2">
        <mixed-citation>
          2.
          <string-name>
            <surname>AUTOSAR (AUTomotive Open System</surname>
          </string-name>
          <article-title>ARchitecture)</article-title>
          . http://www.autosar.org/.
        </mixed-citation>
      </ref>
      <ref id="ref3">
        <mixed-citation>
          3.
          <string-name>
            <given-names>A.</given-names>
            <surname>Benveniste</surname>
          </string-name>
          ,
          <string-name>
            <given-names>B.</given-names>
            <surname>Caillaud</surname>
          </string-name>
          ,
          <string-name>
            <given-names>L.P.</given-names>
            <surname>Carloni</surname>
          </string-name>
          ,
          <string-name>
            <given-names>P.</given-names>
            <surname>Caspi</surname>
          </string-name>
          ,
          <article-title>and</article-title>
          <string-name>
            <given-names>A.L.</given-names>
            <surname>SangiovanniVincentelli</surname>
          </string-name>
          .
          <source>Composing Heterogeneous Reactive Systems. ACM Transactions on Embedded Computing Systems</source>
          ,
          <volume>7</volume>
          (
          <issue>4</issue>
          ),
          <year>2008</year>
          .
        </mixed-citation>
      </ref>
      <ref id="ref4">
        <mixed-citation>
          4.
          <string-name>
            <given-names>A.</given-names>
            <surname>Benveniste</surname>
          </string-name>
          ,
          <string-name>
            <given-names>P.</given-names>
            <surname>Caspi</surname>
          </string-name>
          ,
          <string-name>
            <given-names>S.</given-names>
            <surname>Edwards</surname>
          </string-name>
          ,
          <string-name>
            <given-names>N.</given-names>
            <surname>Halbwachs</surname>
          </string-name>
          ,
          <string-name>
            <given-names>P.</given-names>
            <surname>Le Guernic</surname>
          </string-name>
          , and R. de Simone.
          <source>The Synchronous Languages Twelve Years Later. Proceedings of the IEEE</source>
          ,
          <year>2003</year>
          .
        </mixed-citation>
      </ref>
      <ref id="ref5">
        <mixed-citation>
          5.
          <string-name>
            <given-names>L.</given-names>
            <surname>Besnard</surname>
          </string-name>
          , E. Borde,
          <string-name>
            <given-names>P.</given-names>
            <surname>Dissaux</surname>
          </string-name>
          ,
          <string-name>
            <given-names>T.</given-names>
            <surname>Gautier</surname>
          </string-name>
          ,
          <string-name>
            <given-names>P.</given-names>
            <surname>Le Guernic</surname>
          </string-name>
          , and
          <string-name>
            <given-names>J.-P.</given-names>
            <surname>Talpin</surname>
          </string-name>
          .
          <article-title>Logically timed speci cations in the aadl : a synchronous model of computation and communication (recommendations to the sae committee on aadl</article-title>
          .
          <source>Technical Report 446, INRIA</source>
          ,
          <year>2014</year>
          .
        </mixed-citation>
      </ref>
      <ref id="ref6">
        <mixed-citation>
          6.
          <string-name>
            <given-names>M.</given-names>
            <surname>Broy</surname>
          </string-name>
          ,
          <string-name>
            <given-names>M.</given-names>
            <surname>Feilkas</surname>
          </string-name>
          ,
          <string-name>
            <given-names>M.</given-names>
            <surname>Herrmannsdoerfer</surname>
          </string-name>
          ,
          <string-name>
            <given-names>S.</given-names>
            <surname>Merenda</surname>
          </string-name>
          , and
          <string-name>
            <given-names>D.</given-names>
            <surname>Ratiu</surname>
          </string-name>
          .
          <article-title>Seamless Model-Based Development: From Isolated Tools to Integrated Model Engineering Environments</article-title>
          .
          <source>Proceedings of the IEEE</source>
          ,
          <volume>98</volume>
          :
          <fpage>526</fpage>
          {
          <fpage>545</fpage>
          ,
          <year>2010</year>
          .
        </mixed-citation>
      </ref>
      <ref id="ref7">
        <mixed-citation>
          7.
          <string-name>
            <given-names>Darren</given-names>
            <surname>Cofer</surname>
          </string-name>
          , Andrew Gacek,
          <string-name>
            <given-names>Steven</given-names>
            <surname>Miller</surname>
          </string-name>
          , Michael W Whalen, Brian LaValley, and Lui Sha.
          <article-title>Compositional Veri cation of Architectural Models</article-title>
          .
          <source>In NASA Formal Methods</source>
          ,
          <year>2012</year>
          .
        </mixed-citation>
      </ref>
      <ref id="ref8">
        <mixed-citation>
          8. DARPA.
          <article-title>Adaptive Vehicle Make (AVM) Project</article-title>
          . http://www.darpa.mil/Our Work/TTO/Programs.
        </mixed-citation>
      </ref>
      <ref id="ref9">
        <mixed-citation>9. EAST-ADL. http://www.east-adl.info.</mixed-citation>
      </ref>
      <ref id="ref10">
        <mixed-citation>
          10.
          <string-name>
            <surname>J. Eker</surname>
            ,
            <given-names>J.W.</given-names>
          </string-name>
          <string-name>
            <surname>Janneck</surname>
            ,
            <given-names>E.A.</given-names>
          </string-name>
          <string-name>
            <surname>Lee</surname>
            ,
            <given-names>J.</given-names>
          </string-name>
          <string-name>
            <surname>Liu</surname>
            ,
            <given-names>X.</given-names>
          </string-name>
          <string-name>
            <surname>Liu</surname>
            ,
            <given-names>J.</given-names>
          </string-name>
          <string-name>
            <surname>Ludvig</surname>
            , S. Neuendor er, S. Sachs, and
            <given-names>Y.</given-names>
          </string-name>
          <string-name>
            <surname>Xiong. Taming</surname>
          </string-name>
          Heterogeneity - the
          <source>Ptolemy Approach. Proceedings of the IEEE</source>
          ,
          <volume>91</volume>
          (
          <issue>1</issue>
          ):
          <volume>127</volume>
          {
          <fpage>144</fpage>
          ,
          <year>2003</year>
          .
        </mixed-citation>
      </ref>
      <ref id="ref11">
        <mixed-citation>
          11.
          <string-name>
            <given-names>J.A.</given-names>
            <surname>Estefan</surname>
          </string-name>
          .
          <article-title>Survey of Model-Based Systems Engineering (MBSE) Methodologies</article-title>
          .
          <source>Technical report, INCOSE MBSE Initiative</source>
          ,
          <year>2008</year>
          .
        </mixed-citation>
      </ref>
      <ref id="ref12">
        <mixed-citation>
          12.
          <string-name>
            <given-names>Esterel</given-names>
            <surname>Technologies</surname>
          </string-name>
          . SCADE Suite. http://www.estereltechnologies.com/products/scade-suite/.
        </mixed-citation>
      </ref>
      <ref id="ref13">
        <mixed-citation>
          13.
          <string-name>
            <given-names>P.</given-names>
            <surname>Feiler</surname>
          </string-name>
          ,
          <string-name>
            <given-names>J.</given-names>
            <surname>Hansson</surname>
          </string-name>
          , D. de Niz, and
          <string-name>
            <given-names>L.</given-names>
            <surname>Wrage</surname>
          </string-name>
          .
          <source>System Architecture Virtual Integration: An Industrial Case Study. Technical report</source>
          , Software Engineering Institute, Nov.
          <year>2009</year>
          . CMU/SEI-2009
          <string-name>
            <surname>-</surname>
          </string-name>
          TR-
          <volume>017</volume>
          .
        </mixed-citation>
      </ref>
      <ref id="ref14">
        <mixed-citation>
          14.
          <string-name>
            <given-names>A.</given-names>
            <surname>Hinton</surname>
          </string-name>
          ,
          <string-name>
            <given-names>M.</given-names>
            <surname>Kwiatkowska</surname>
          </string-name>
          , G. Norman, and
          <string-name>
            <given-names>D.</given-names>
            <surname>Parker</surname>
          </string-name>
          .
          <article-title>PRISM: A Tool for Automatic Veri cation of Probabilistic Systems</article-title>
          .
          <source>In Proceedings of the 12th International Conference on Tools and Algorithms for the Construction and Analysis of Systems, TACAS'06</source>
          , pages
          <fpage>441</fpage>
          {
          <fpage>444</fpage>
          , Berlin, Heidelberg,
          <year>2006</year>
          . Springer-Verlag.
        </mixed-citation>
      </ref>
      <ref id="ref15">
        <mixed-citation>
          15.
          <string-name>
            <surname>J.-M. Jezequel</surname>
            and
            <given-names>B.</given-names>
          </string-name>
          <string-name>
            <surname>Meyer</surname>
          </string-name>
          .
          <article-title>Design by Contract: The Lessons of Ariane</article-title>
          . Computer,
          <volume>30</volume>
          :
          <fpage>129</fpage>
          {
          <fpage>130</fpage>
          ,
          <year>1997</year>
          .
        </mixed-citation>
      </ref>
      <ref id="ref16">
        <mixed-citation>
          16.
          <string-name>
            <surname>Xiaoqing</surname>
            <given-names>Jin</given-names>
          </string-name>
          , Jyotirmoy Deshmukh, James Kapinski, Koichi Ueda, and
          <string-name>
            <given-names>Ken</given-names>
            <surname>Butts</surname>
          </string-name>
          .
          <article-title>Challenges of Applying Formal Methods to Automotive Control Systems</article-title>
          .
          <source>In NSF National Workshop on Transportation Cyber-Physical Systems</source>
          ,
          <year>2014</year>
          .
        </mixed-citation>
      </ref>
      <ref id="ref17">
        <mixed-citation>
          17.
          <string-name>
            <surname>P. Le Guernic</surname>
            ,
            <given-names>J.-P.</given-names>
          </string-name>
          <string-name>
            <surname>Talpin</surname>
          </string-name>
          , and J.
          <string-name>
            <surname>-C. Le Lann</surname>
          </string-name>
          .
          <article-title>Polychrony for System Design</article-title>
          .
          <source>Journal for Circuits, Systems and Computers</source>
          ,
          <volume>12</volume>
          :
          <fpage>261</fpage>
          {
          <fpage>304</fpage>
          ,
          <year>2002</year>
          .
        </mixed-citation>
      </ref>
      <ref id="ref18">
        <mixed-citation>
          18.
          <string-name>
            <given-names>E. A.</given-names>
            <surname>Lee</surname>
          </string-name>
          and
          <string-name>
            <given-names>A.</given-names>
            <surname>Sangiovanni-Vincentelli</surname>
          </string-name>
          .
          <article-title>A Framework for Comparing Models of Computation</article-title>
          .
          <source>IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems</source>
          ,
          <volume>17</volume>
          (
          <issue>12</issue>
          ):
          <volume>1217</volume>
          {
          <fpage>1229</fpage>
          ,
          <year>2006</year>
          .
        </mixed-citation>
      </ref>
      <ref id="ref19">
        <mixed-citation>
          19.
          <string-name>
            <given-names>A.</given-names>
            <surname>Legay</surname>
          </string-name>
          ,
          <string-name>
            <given-names>B.</given-names>
            <surname>Delahaye</surname>
          </string-name>
          , and
          <string-name>
            <given-names>S.</given-names>
            <surname>Bensalem</surname>
          </string-name>
          .
          <article-title>Statistical model checking: An overview</article-title>
          . In Runtime Veri cation,
          <year>2010</year>
          .
        </mixed-citation>
      </ref>
      <ref id="ref20">
        <mixed-citation>
          20.
          <string-name>
            <given-names>D.</given-names>
            <surname>Mathaikutty</surname>
          </string-name>
          ,
          <string-name>
            <given-names>H.</given-names>
            <surname>Patel</surname>
          </string-name>
          ,
          <string-name>
            <given-names>S.</given-names>
            <surname>Shukla</surname>
          </string-name>
          ,
          <article-title>and</article-title>
          <string-name>
            <given-names>A.</given-names>
            <surname>Jantsch</surname>
          </string-name>
          .
          <article-title>Modelling Environment for Heterogeneous Systems based on MoCs</article-title>
          .
          <source>In Forum on speci cation and Design Languages (FDL)</source>
          , pages
          <fpage>291</fpage>
          {
          <fpage>303</fpage>
          ,
          <year>2005</year>
          .
        </mixed-citation>
      </ref>
      <ref id="ref21">
        <mixed-citation>
          21.
          <string-name>
            <surname>MathWorks</surname>
          </string-name>
          . The MathWorks: Matlab/Simulink. http://www.mathworks.com/products/simulink/.
        </mixed-citation>
      </ref>
      <ref id="ref22">
        <mixed-citation>
          22. B. Meyer. Applying '
          <article-title>design by contract'</article-title>
          .
          <source>Computer</source>
          ,
          <volume>25</volume>
          (
          <issue>10</issue>
          ):
          <volume>40</volume>
          {
          <fpage>51</fpage>
          ,
          <string-name>
            <surname>Oct</surname>
          </string-name>
          <year>1992</year>
          .
        </mixed-citation>
      </ref>
      <ref id="ref23">
        <mixed-citation>
          23.
          <article-title>Modelica and the Modelica Association</article-title>
          . https://www.modelica.org.
        </mixed-citation>
      </ref>
      <ref id="ref24">
        <mixed-citation>
          24.
          <string-name>
            <given-names>P. J.</given-names>
            <surname>Mosterman</surname>
          </string-name>
          and
          <string-name>
            <given-names>H.</given-names>
            <surname>Vangheluwe</surname>
          </string-name>
          .
          <article-title>Computer automated multi-paradigm modeling: An introduction</article-title>
          .
          <source>SIMULATION: Transactions of the Society for Modeling and Simulation International</source>
          ,
          <volume>80</volume>
          (
          <issue>9</issue>
          ):
          <volume>433</volume>
          {
          <fpage>450</fpage>
          ,
          <year>2004</year>
          .
        </mixed-citation>
      </ref>
      <ref id="ref25">
        <mixed-citation>
          25.
          <string-name>
            <surname>K.D. Mu</surname>
          </string-name>
          <article-title>ller-</article-title>
          <string-name>
            <surname>Glaser</surname>
            ,
            <given-names>G.</given-names>
          </string-name>
          <string-name>
            <surname>Frick</surname>
            , E. Sax, and
            <given-names>M.</given-names>
          </string-name>
          <article-title>Kuhl</article-title>
          .
          <source>Multiparadigm Modeling in Embedded Systems Design. IEEE Transactions on Control Systems Technology</source>
          ,
          <volume>12</volume>
          (
          <issue>2</issue>
          ):
          <volume>279</volume>
          {
          <fpage>292</fpage>
          ,
          <year>2004</year>
          .
        </mixed-citation>
      </ref>
      <ref id="ref26">
        <mixed-citation>
          26.
          <string-name>
            <surname>Object Management</surname>
          </string-name>
          <article-title>Group (OMG). The UML Pro le for MARTE: Modeling and Analysis of Real-Time and Embedded Systems</article-title>
          . http://www.omg.org/spec/MARTE/1.1/PDF,
          <year>June 2011</year>
          .
        </mixed-citation>
      </ref>
      <ref id="ref27">
        <mixed-citation>
          27. OMG.
          <article-title>Uni ed modeling language (uml). www</article-title>
          .uml.org/.
        </mixed-citation>
      </ref>
      <ref id="ref28">
        <mixed-citation>
          28.
          <string-name>
            <surname>OSATE. OSATE V2</surname>
          </string-name>
          <article-title>Project</article-title>
          . https://wiki.sei.cmu.edu/aadl/index.php/Osate 2.
        </mixed-citation>
      </ref>
      <ref id="ref29">
        <mixed-citation>
          29.
          <string-name>
            <surname>Maxime</surname>
            <given-names>Perrotin</given-names>
          </string-name>
          , Eric Conquet, Julien Delange, Andre Schiele, and
          <string-name>
            <given-names>Thanassis</given-names>
            <surname>Tsiodras</surname>
          </string-name>
          . TASTE:
          <string-name>
            <given-names>A</given-names>
            <surname>Real-Time Software Engineering Tool-Chain</surname>
          </string-name>
          <string-name>
            <surname>Overview</surname>
          </string-name>
          , Status, and Future.
          <source>In SDL 2011: Integrating System and Software Modeling</source>
          ,
          <source>2012. Lecture Notes in Computer Science</source>
          Volume
          <volume>7083</volume>
          , pp
          <fpage>26</fpage>
          -
          <lpage>37</lpage>
          .
        </mixed-citation>
      </ref>
      <ref id="ref30">
        <mixed-citation>
          30.
          <string-name>
            <given-names>D.</given-names>
            <surname>Redman</surname>
          </string-name>
          ,
          <string-name>
            <given-names>D.</given-names>
            <surname>Ward</surname>
          </string-name>
          ,
          <string-name>
            <given-names>J.</given-names>
            <surname>Chilenski</surname>
          </string-name>
          , and
          <string-name>
            <given-names>G.</given-names>
            <surname>Pollari</surname>
          </string-name>
          .
          <article-title>Virtual integration for improved system design,</article-title>
          .
          <source>In The First Analytic Virtual Integration of Cyber-Physical Systems Workshop in conjunction with RTSS</source>
          ,
          <year>2010</year>
          .
        </mixed-citation>
      </ref>
      <ref id="ref31">
        <mixed-citation>
          31.
          <string-name>
            <given-names>A.</given-names>
            <surname>Rossignol</surname>
          </string-name>
          .
          <article-title>The Reference Technology Platform. In CESAR - Cost-e cient Methods and Processes for Safety-relevant Embedded Systems</article-title>
          . Springer,
          <year>2013</year>
          .
        </mixed-citation>
      </ref>
      <ref id="ref32">
        <mixed-citation>
          32.
          <string-name>
            <surname>SAE</surname>
          </string-name>
          <article-title>Aerospace (Society of Automotive Engineers)</article-title>
          .
          <article-title>Aerospace Standard AS5506A: Architecture Analysis and Design Language (AADL)</article-title>
          .
          <source>SAE AS5506A</source>
          ,
          <year>2009</year>
          .
        </mixed-citation>
      </ref>
      <ref id="ref33">
        <mixed-citation>
          33.
          <string-name>
            <surname>D.C.</surname>
          </string-name>
          <article-title>Schmidt</article-title>
          .
          <article-title>Model-Driven Engineering</article-title>
          . IEEE Computer,
          <volume>39</volume>
          :
          <fpage>25</fpage>
          {
          <fpage>31</fpage>
          ,
          <year>2006</year>
          .
        </mixed-citation>
      </ref>
      <ref id="ref34">
        <mixed-citation>
          34.
          <string-name>
            <surname>J. Sztipanovits</surname>
            ,
            <given-names>X. D.</given-names>
          </string-name>
          <string-name>
            <surname>Koutsoukos</surname>
            , G. Karsai,
            <given-names>N.</given-names>
          </string-name>
          <string-name>
            <surname>Kottenstette</surname>
            ,
            <given-names>P.J.</given-names>
          </string-name>
          <string-name>
            <surname>Antsaklis</surname>
            ,
            <given-names>V.</given-names>
          </string-name>
          <string-name>
            <surname>Gupta</surname>
            ,
            <given-names>B.</given-names>
          </string-name>
          <string-name>
            <surname>Goodwine</surname>
            ,
            <given-names>J.S.</given-names>
          </string-name>
          <string-name>
            <surname>Baras</surname>
            , and
            <given-names>S.</given-names>
          </string-name>
          <string-name>
            <surname>Wang</surname>
          </string-name>
          .
          <article-title>Toward a Science of CyberPhysical System Integration</article-title>
          .
          <source>Proceedings of the IEEE</source>
          ,
          <volume>100</volume>
          (
          <issue>1</issue>
          ):
          <volume>29</volume>
          {
          <fpage>44</fpage>
          ,
          <year>2012</year>
          .
        </mixed-citation>
      </ref>
      <ref id="ref35">
        <mixed-citation>
          35.
          <string-name>
            <given-names>A.</given-names>
            <surname>Toom</surname>
          </string-name>
          ,
          <string-name>
            <given-names>T.</given-names>
            <surname>Naks</surname>
          </string-name>
          ,
          <string-name>
            <given-names>M.</given-names>
            <surname>Pantel</surname>
          </string-name>
          ,
          <string-name>
            <given-names>M.</given-names>
            <surname>Gandriau</surname>
          </string-name>
          ,
          <string-name>
            <given-names>and I.</given-names>
            <surname>Wati</surname>
          </string-name>
          .
          <article-title>Gene-Auto: An Automatic Code Generator for a Safe Subset of SimuLink/StateFlow and Scicos</article-title>
          .
          <source>In European Conference on Embedded Real-Time Software (ERTS'08)</source>
          ,
          <year>2008</year>
          .
        </mixed-citation>
      </ref>
      <ref id="ref36">
        <mixed-citation>
          36.
          <string-name>
            <given-names>H.</given-names>
            <surname>Yu</surname>
          </string-name>
          ,
          <string-name>
            <given-names>Y.</given-names>
            <surname>Ma</surname>
          </string-name>
          , T. Gautier,
          <string-name>
            <given-names>L.</given-names>
            <surname>Besnard</surname>
          </string-name>
          ,
          <string-name>
            <given-names>J.-P.</given-names>
            <surname>Talpin</surname>
          </string-name>
          , and
          <string-name>
            <given-names>P. Le</given-names>
            <surname>Guernic</surname>
          </string-name>
          .
          <article-title>Polychronous Modeling, Analysis, Veri cation and Simulation for Timed Software Architectures</article-title>
          .
          <source>Journal of Systems Architecture (JSA)</source>
          ,
          <volume>59</volume>
          (
          <issue>10</issue>
          ):
          <volume>1157</volume>
          {
          <fpage>1170</fpage>
          ,
          <year>2013</year>
          .
        </mixed-citation>
      </ref>
      <ref id="ref37">
        <mixed-citation>
          37.
          <string-name>
            <given-names>H.</given-names>
            <surname>Yu</surname>
          </string-name>
          ,
          <string-name>
            <given-names>Y.</given-names>
            <surname>Ma</surname>
          </string-name>
          ,
          <string-name>
            <given-names>Y.</given-names>
            <surname>Glouche</surname>
          </string-name>
          ,
          <string-name>
            <given-names>J.-P.</given-names>
            <surname>Talpin</surname>
          </string-name>
          ,
          <string-name>
            <given-names>L.</given-names>
            <surname>Besnard</surname>
          </string-name>
          ,
          <string-name>
            <given-names>T.</given-names>
            <surname>Gautier</surname>
          </string-name>
          ,
          <string-name>
            <given-names>P.</given-names>
            <surname>Le Guernic</surname>
          </string-name>
          ,
          <string-name>
            <given-names>A.</given-names>
            <surname>Toom</surname>
          </string-name>
          , and
          <string-name>
            <given-names>O.</given-names>
            <surname>Laurent</surname>
          </string-name>
          .
          <article-title>System-level Co-simulation of Integrated Avionics Using Polychrony</article-title>
          .
          <source>In ACM Symposium on Applied Computing (SAC'11)</source>
          ,
          <year>2011</year>
          .
        </mixed-citation>
      </ref>
    </ref-list>
  </back>
</article>