Tool Chain for Avionics Design, Development, Integration and Test Martin Halle Frank Thielecke Institute of Aircraft Systems Engineering (FST) Institute of Aircraft Systems Engineering (FST) Hamburg University of Technology (TUHH) Hamburg University of Technology (TUHH) Hamburg, Germany Hamburg, Germany Martin.Halle@tuhh.de Frank.Thielecke@tuhh.de Index Terms—avionics, tool chain, IMA, design, development, integration, test Abstract—The design, development, integration and test of avionics systems is a complex task. Several national and European projects aimed at improving the methods and tools for new IMA platforms. Since about 12 years, the Institute of Aircraft Systems Engineering of the Hamburg University of Technology continuously contributed to such projects. This paper gives an overview about the tool chain that has been developed so far and addresses a new extension in the field of avionics tests and its automation that will be developed in on-going and future projects. I. I NTRODUCTION Avionics are based on a generic, modular platform (Inte- grated Modular Avionics, IMA [1]) and serve system appli- cations with the computing and I/O resource needs. Over the years and different aircraft programmes (i.e. B777, B787 or Fig. 1. Avionics double-V-process A380, A350), the avionics system has been further developed towards a distributed platform with different types of com- puting modules, different types of I/O and more and more a seamless tool-chain to demonstrate possible methods and applications running on IMA. automise process steps as much as possible. New in the tool- In the future, it is likely that IMA will expand into other chain is deriving re-usable and mostly generic tests procedures areas like cabin and flight control, but also new capabilities for different test-platforms. like multi-/many-core processors and I/O technologies like While the FST has a strong background in system testing wireless or optical communication or combined I/O concepts and virtual integration [2] [3] [4] [5] [6], partially including like data-over-power will be introduced. Such technologies IMA [7], so far, IMA has been either provided as-is or was not will be the enabler for a modern avionics platform and will considered at all. Therefore, the influence of the IMA platform increase the freedom for the platform- and system-designers. on the system function and vice versa in preliminary system However, the burden of handling the complex overall design design was hard to investigate. Because of that, the seamless space will increase, too. Manual design methods will likely tool-chain is extended to allow IMA platform simulations become too error-prone or even impossible but at least non- hosting system applications on virtual IMA modules to allow optimal. studying and test the functional behaviour of the system Ongoing research of the Institute of Aircraft Systems En- functions with respect to new IMA approaches. gineering (FST) of the Hamburg University of Technology The paper is organised as follows: First, the different tools (TUHH) adresses an approach to an avionics-centred double-V of the seamless-tool chain that already exist and how they process as shown in figure 1. fit into the double-V are explained. Then, the approach for The double-V stems from the idea to have a model-based simulation based avionics test will be explained. The paper seamless tool-chain that supports the development process not ends with a summary and outlook. only by the tools but also by enabling early validation and test. Using simulations and models that are derived from data II. AVIONICS A RCHITECT and information based on the current level of detail available, When starting to design a new avionics platform or updating a digital twin of the avionics platform allows its validation an existing one a lot of decisions have to me made. What at any time in the development process. The FST develops systems/system applications will utilise IMA; what resources AvioSE 2019: 1st Workshop on Avionics Systems and Software Engineering @ SE19, Stuttgart, Germany 79 require these applications; what I/O needs to be supported by supplier and do not allow for an optimisation at aircraft level. the platform as well as where and what installation locations III. AVIONICS C ONFIGURATOR can be used. To to derive a valid architecture, additionally system- and certification constraints have to be take into After the design of the avionics platform is done the account. function and configuration development starts. Besides the For such purposes, a model-based methodology has been actual system software applications the configuration for IMA developed [8] that allows to formulate and capture these re- modules plays an important role. It consists of thousands quirements is a formal way that allows to be further processed of parameters that define the application (partitions) as well and to derive an optimised IMA platform. The requirements as physical and logical I/O parameters. For specific IMA are captured in a rather generic way and can either be input modules several other parameters like for combinatorial logic manually or imported as tables which contain: are included, too. Configuration tools are provided by the • Software tasks and their attributes like resource require- respective module suppliers for their dedicated IMA modules ment (I/O, memory, redundancy/segregation constraints, whereas the actual configuration is managed by the OEM . . . ); by means of a database and configuration documents. These • Signals to be exchanged between tasks and attributes like configuration documents are often hand-crafted using tools periodicity or bandwidth like Excel in comma-separated-values (CSV) format. • Physical system peripherals like sensors or actuators and Due to the fact that this is often error-prone, a new model- their location as well as attributes like weight, dimen- based concept for creating and managing configuration data at sions, . . . ; aircraft level has been developed by FST [12] [13]. For such • Devices that can host tasks and provide resources or are purposes, a model-based configuration management concept required for I/O like switches. Additional attributes can and software-framework namely Avionics Configurator was be captured like weight, cost, power supply and others; developed and is shown in figure 3. • The anatomy of the aircraft or vehicle to describe in- stallation locations for devices or peripherals and cable routes including attributes like capacity, volume, available resources and alike. The information is structured and linked based on a meta- model in an Eclipse-based [9] application. The software- framework that implements the methodology and provides a graphical frontend to the user is called Avionics Architect and shown in figure 2. Fig. 3. Avionics Configurator It allows to capture all configuration parameters in a supplier independent format in one tool. It replaces the need for table-based editing with duplicated information by using a linked meta-model and guided input. Graphical visualisations and model-based verification of the users input improve the consistency of the configuration data early in the development process. It is not a replacement for the qualified tool-chain Fig. 2. Avionics Architect of the module supplier though, but can export the input files needed for these tools e.g. for a qualifiable validation. In the In the V-model its use is in the left-hand side when the V-model its use is currently in the implementation phase. requirements are captured. This includes the requirements for Because Avionics Architect and Avionics Configurator share the IMA platform to e.g. derive the specification for IMA the same philosophy of meta-modelling and also the same modules but also the requirements of the system applications modelling language (Ecore from the Eclipse Modelling Frame- to achieve a common understanding and integration database work, [9]) in [14] a methodology has been presented that al- between the integrator and the system departments. lows to create configuration stubs directly from the architecture Similar tools from platform suppliers have been developed data using a formal model-to-model transformation. Thus, all [10] [11] but they are usually limited to the modules of that configuration-relevant information that was already captured AvioSE 2019: 1st Workshop on Avionics Systems and Software Engineering @ SE19, Stuttgart, Germany 80 during the architecture phase will be derived automatically V. AVIONICS T EST following the philosophy of a seamless tool-chain [15]. A new project continues the work and aims at model-based or hybrid virtual testing in a more systematic and automated IV. AVIONICS S IMULATION manner. As already mentioned, using the architectural and configuration data, simulations can be derived that are used Knowing the architecture of an IMA platform, the functions, for nominal and failure case testing. As explained in [18], the I/O types and signals between function blocks and the functional tests can be executed on these models. So far, the configuration of system applications, virtual integration and tests were manually derived and executed. The overall goal of functional validation becomes possible. such tests is to ensure functionality of system applications When it comes to functional validation of system appli- on the designed platform in early design and development cations, often the algorithms behind these applications are stages. Thus, design limitations of the platform can be found. developed in Matlab/Simulink or similar. The timing behaviour Consequently, such functional tests should be re-usable as soon of the IMA platform and the I/O interfaces need to be consid- as hardware and/or equipment becomes available. ered as good as possible for functional validation. To address To do so, an at least semi-automatic derivation of test this issue, a simulation-framework namely Avionics Simulation cases and a test engine (Avionics Test) that can conduct and has been developed at FST that consists of Matlab/Simulink- document these tests is desired. Although system requirements based models to emulate the behaviour of IMA platforms and can be captured in Avionics Architect, this type of information communication interfaces with respect to their timing, nominal is not yet consequently used for test automation although it is and faulty behaviour [16]. It is shown in figure 4. already available in a structured, model-based and machine- readable fashion. Alternatively, requirements databases like 3DUWUHVWDUW 3DUWLWLRQ(QDEOH 'LVSOD\ :DLW Doors could be used. 3DUWVWRS ,Q 5HOHDVH To conduct a meaningful test and test automation, more /DQH 3DUWLWLRQ 3URFHVV 5HDG 2XW information is needed. At FST, a generic test environment for +0WULJ (UURU 7ULJJHU 3DUWUHVWDUW 3DUWLWLRQ(QDEOH %ODFNERDUG avionics systems is about to be established. The principle is (UURU VWRS 7ULJJHU SDUWVWRS 6HQG :DLW shown in figure 5. +0WULJ 3URFHVVWULJJHU UHVWDUW 7ULJJHU ,Q 5HOHDVH 3URFHVV:DLW 5HDG3LQJ 0RGXOH+0 3DUWLWLRQ0DQDJHU 5HFHLYH 2XW 3URFHVVWULJJHU %XႇHU 3URFHVV5HOHDVH :DLW 5HDG3LQJ 6DYH ,Q 3URFHVVWULJJHU 6LJQDO :DLW 2XW 5HOHDVH (UURU 5HDG3LQJ ,Q 5HDG 2XW &KHFN 5HOHDVH 6DPSOLQJ3RUW6RXUFH 6DPSOLQJ3RUW'HVWLQDWLRQ 3URFHVV0DQDJHU 6HPDSKRUH 6DYH :DLW ,Q 6HW :DLW 6HW :DLW 2XW 5HOHDVH 5HVHW ,Q 5HFHLYH 2XW &KHFN 5HOHDVH &KHFN 5HOHDVH 4XHXHLQJ3RUW6RXUFH 4XHXHLQJ3RUW'HVWLQDWLRQ :DLW (YHQW Fig. 5. Avionics Test Fig. 4. Avionics Simulation Assume an aircraft door system with 5 proxy sensors and The simulation-framework consists of models for IMA avionics system functions hosted on an IMA modules to read modules, schedulers, health management and I/O blocks. The their states and to visualise a consolidated state in the cockpit. latter for IMA module internal functions (like ARINC 653 For a test case of the function that validates a ”cabin door ports, buffers or blackboards [17]) but also external I/O like closed and locked” scenario, the following data is obtained AFDX, CAN or analogue/discrete busses. For a seamless tool- from the respective sources: chain, a model generator takes the architectural information • From a requirements database the functional requirements from the Avionics Architect and the configuration details from needed for the test case are derived. That is, what and how Avionics Configurator to generate an overall simulation model many proxy sensors must be in what state to confirm stub that consists of the allocated IMA modules, partitions for the door is closed. Additionally meta-information like the system applications and the communication between the test case ID and other information for traceability are IMA modules (AFDX network) including the logical signals. obtained. Technically this is done using the automation interface of Mat- • From the architecture model, the function and I/O allo- lab/Simulink. Embedding the developed system functions into cation including the signal path physical wiring are ob- this model is demonstrated in [18]. It allows for simulation- tained. This also includes the instances of IMA modules based, virtual early validation studies of system applications hosting the respective functions or sub-functions. under consideration of the IMA platform at aircraft level. In • From the configuration model, attributes like periods the V-model its use is in right-hand side and can already start, and detailed signal attributes like sampling times, type when hardware is not yet available. an size of data are obtained. This also includes the AvioSE 2019: 1st Workshop on Avionics Systems and Software Engineering @ SE19, Stuttgart, Germany 81 concrete signal names and protocol encapsulation (i.e. hereby. The scientific question in this stage is how far does functional data set structures with signal positions for this concept work and what type of tests can be accomplished AFDX messages). to an useful extend. Also, the institute is seeking for a • From the architecture and configuration model, the model standardisation of system tests including avionics. Some of of the IMA platform is derived and instrumented with the remaining issues are how to formalise data formats and system applications for simulations as explained earlier. data management. Other questions are how to derive test To use the simulation model for testing, interfaces for relevant parameters that are often not expressed in machine configuring the simulation itself, different block parameters readable format like timing behaviour constraints. For test like buffer sizes or signal names and methods to inject automation, besides Matlab/Simulink also existing HITL test- test-procedures and observers are required and need to be systems available at FST are investigated. implemented. Furthermore, a runtime-interface that controls R EFERENCES the simulation, injection and recording of data is needed. [1] H. Butz, “The Airbus approach to open integrated avionic modular To formulate the test cases and test sequences in a Mat- avionics (IMA),” in Workshop on Aircraft System Technologies (AST), lab/Simulink compatible fashion they shall be expressed in 2007. [2] J. Grymlas, T. Kreitz, and F. Thielecke, “Scenario-based testing of Simulink/Stateflow, similar to the SCXML notation [19]. A multifunctional fuel cell systems using the virtual integration platform library that consist of parameterisable standard test steps as VIPER,” in International Conference on Fundamentals and Develope- state machine templates is under development. Using the ment of Fuel Cells (FDFC), Toulouse 3 - 5 February 2015, Toulouse, 2 2015. Matlab/Simulink automation interface, such templates can be [3] T. Kreitz, R. Doering, S. Jäger, and F. Thielecke, “System-level virtual instantiated to simplify the generation of the test procedures. integration study of an aircraft electrical power network,” in Proceedings Similar to that, common input patterns for stimulations and of the 5th International Workshop on Aircraft System Technologies (AST 2015), Hamburg University of Technology. Shaker Verlag, 2015. output sinks for observation are provided through other li- [4] T. Kreitz and F. Thielecke, “Virtual integration of an all-electric flight braries. The generated test-procedure is expressed in Stateflow control system architecture and the aircraft electrical power distribution (an example is shown in figure 6) and connected to the system- network,” in SAE 2016 Aerospace Systems and Technology Conference. Hartford, CT, USA: SAE, 9 2016. and IMA platform simulation via input- and output-ports. [5] J. Grymlas, “Systemautomatisierung für den multifunktionalen Betrieb von Brennstoffzellen in Verkehrsflugzeugen,” phdthesis, Hamburg Uni- S versity of Technology, 12 2017. 2SHQB&ORVHB3$;B'RRUB/+ ,QLWB&ORVHGB/DWFKHGB/RFNHG 8QORFNB&ORVHG [6] L. Nordmann, F. Thielecke, P. Lücken, and M. Hamm, “Virtual testing of 6HWB,QSXWV 6HWB,QSXWV aircraft hydraulic systems,” in Recent Advances in Aerospace Actuation 6HWB'RRUB,QSXWV 6HWB36B,QSXWV 6HWB'RRUB,QSXWV Systems and Components, May 30 - June 1, 2018, Toulouse, France, 2018. [7] S. Benischke, “Modellbasierte Entwicklung eines verteilten Antrieb- :DLWB$QGB9HULI\B :DLWB$QGB9HULI\B ssystems für ein multifunktionales Landeklappensystem,” phdthesis, Hamburg University of Technology, 6 2018. [8] B. Annighöfer, “Model-based architecting and optimization of dis- 2SHQB$QGB/RFN 2SHQB+DQGOH tributed integrated modular avionics,” phdthesis, Hamburg University of Technology, 3 2015. &ORVHB'RRU &ORVHB+DQGOHB$QGB/RFN [9] D. Steinberg, F. Budinsky, M. Paternostro, and E. Merks, EMF: Eclipse Modeling Framework (2nd edition), 2nd ed. DIWHU  PVHF Addison-Wesley Longman, Amsterdam, 2008. [Online]. Available: http://my.safaribooksonline.com/9780321331885 [10] M. Fumey, “Avionics systems EVT: Early validation tools,” in SAE ¿QDO Technical Paper. SAE International, 10 2011. [11] E. Stav, “A sirius based function modelling tool for the avionics domain,” Fig. 6. Avionics Test Procedure in Eclipse Neon DemoCamp, Trondheim, 2016. [12] M. Halle and F. Thielecke, “7konfigurationsmanagement für integrierte Preliminary prototypes show the feasibility of the approach. modulare avionik.” However, a lot work still needs to be done. In the end, [13] ——, “Next generation ima configuration engineering – from archi- tecture to application,” in 34th Digital Avionics Systems Conference this approach shall enable to conduct functional tests across (DASC), 2015. different IMA platforms using different technologies without [14] ——, “Model-based transition of IMA architecture into configuration the need to rewrite or reconfigure the tests manually. For data,” in 35th Digital Avionics Systems Conference (DASC), 2016. [15] ——, “Evaluation of the ASHLEY seamless tool-chain on a real-world hybrid testing the integration of hardware test-benches should avionics demonstrator,” in 36th Digital Avionics Systems Conference also not affect the tests. (DASC), 2017. [16] B. Annighöfer, H. Höber, and F. Thielecke, “An easy-to-use real- VI. S UMMARY AND O UTLOOK time AFDX simulation framework,” in 35th Digital Avionics System Conference, Sacramento, CA , USA, 9 2016. This paper focusses on a new project at FST towards Avion- [17] ARINC, ARINC 653 Standard, ”Avionics Application Software Standard ics Testing. For many years the FST developed a sophisticated Interface”, Aeronautical Radio Incorporated (ARINC), 2006. [18] H. Höber and F. Thielecke, “Eine simulationsbasierte Methode zur tool-chain for the design, implementation and simulation of frühzeitigen Validierung von Avionik-Plattformen,” in Deutscher Luft- IMA platforms including and focussing on system function und Raumfahrtkongress (DLRK) 2018. Friedrichshafen: Deutsche applications hosted on avionics. Consequently, a new approach Gesellschaft für Luft- und Raumfahrt, 9 2018. [19] World Wide Web Consortium (W3C). (2015) State chart XML for automatic testing of system applications using a seamless (SCXML): State machine notation for control abstraction. [Online]. tool-chain is under development and has been introduced Available: https://www.w3.org/TR/scxml/ AvioSE 2019: 1st Workshop on Avionics Systems and Software Engineering @ SE19, Stuttgart, Germany 82