SWAN_ASSIST: Semi-Automated Detection of Code-Specific, Security-Relevant Methods - Piskachev, Goran; Nguyen Quang Do, Lisa; Johnson, Oshando; Bodden, Eric (2019 34th IEEE/ACM International Conference on Automated Software Engineering (ASE))

AuthCheck: Program-State Analysis for Access-Control Vulnerabilities - Piskachev, Goran; Petrasch, Tobias; Späth, Johannes; Bodden, Eric (Lecture Notes in Computer Science)

Softwareentwicklung wie am Fliessband - Koch, Thorsten; Meyer, Matthias; Fazal-Baqaie, Masud; Runschke, Hubert (Software Engineering 2020 (SE 2020))

Coaching on the Job bei Unternehmen des Maschinen- und Anlagenbaus - Wissenslücken schließen zur Weiterpflege modernisierter IT-Anwendungen - Fazal-Baqaie, Masud; Strüwer, Jan-Niclas; Schmelter, David; Dziwok, Stefan (Projektmanagement und Vorgehensmodelle 2019 (PVM 2019))

Designing and Integrating IEC 62443 Compliant Threat Analysis - Fockel, Markus; Merschjohann, Sven; Fazal-Baqaie, Masud; Förder, Torsten; Hausmann, Stefan; Waldeck, Boris (European System, Software & Service Process Improvement & Innovation Conference (EuroSPI 2019))

Codebase-adaptive detection of security-relevant methods - Piskachev, Goran; Do, Lisa Nguyen Quang; Bodden, Eric (Proceedings of the 28th ACM SIGSOFT International Symposium on Software Testing and Analysis)

Was fehlt (bisher) um Apps sicher zu entwickeln? - Prozesse, Werkzeuge und Schulungen für sichere Apps by Design - Altemeier, Katharina; Becker, Matthias; Dziwok, Stefan; Koch, Thorsten; Merschjohann, Sven (Projektmanagement und Vorgehensmodelle 2019 (PVM 2019))

Safety Requirements Engineering for Early SIL Tailoring - Fockel, Markus
Der hohe Grad an Innovation in mechatronischen Systemen führt zu sogenannten Cyber-Physical Systems (CPS). Diese haben eine komplexe Funktionalität und Kommunikation. Wie sicherheitskritisch solche Systeme sind, wird durch sogenannte Sicherheits-Integritätslevel (SIL) kategorisiert, die durch Normen wie der ISO 26262 definiert werden. Ein bestimmter SIL beschreibt nicht nur die Höhe des Gefährdungsrisikos, sondern diktiert auch den erforderlichen Grad an Sorgfalt bei der Entwicklung des Systems. Ein hoher SIL erfordert die Anwendung von Safety-Maßnahmen mit einem hohen Sorgfaltsgrad in allen Phasen der Entwicklung und impliziert daher einen hohen Safety-Aufwand. SIL-Tailoring ist ein Mittel um den Safety-Aufwand zu reduzieren, indem man Subsystemen geringere SILs zuordnet, falls sie von kritischeren Subsystemen getrennt sind oder redundante Safety-Anforderungen erfüllen. Um den nötigen Safety-Aufwand zu planen, sollten Möglichkeiten für SIL-Tailoring so früh wie möglich identifiziert werden - d.h. bereits in der Anforderungsanalyse. Durch die Komplexität von CPS, ist es schwierig valide SIL-Tailorings zu finden. Die Validität von SIL-Tailorings muss durch Analyse von Fehlerpropagierungspfaden geprüft und durch Argumente im Safety Case begründet werden. Der Beitrag dieser Dissertation ist ein systematischer, tool-unterstützter SIL-Tailoring-Prozess, der im Safety Requirements Engineering angewendet wird. Der Prozess nutzt eine modell-basierte, formale Anforderungsspezifikation und stellt einen Katalog von Anforderungsmustern bereit. Basierend auf diesen Anforderungen werden Fehlerpropagierungsmodelle generiert und Subsystemen automatisch SILs zugeordnet. Das minimiert den Sicherheitsanalyseaufwand. Aus den generierten Ergebnissen wird automatisch ein Safety Case mit Argumenten für die SIL-Tailoring-Validität abgeleitet.

Threat Analysis in Practice - Systematically Deriving Security Requirements - Fockel, Markus; Merschjohann, Sven; Fazal-Baqaie, Masud (19th International Conference on Product-Focused Software Process Improvement (PROFES 2018))
With the growing number of incidents, the topic security gains more and more attention across all domains. Organizations realize their lack of state-of-the-art security practices, however, they struggle to improve their software lifecycle in terms of security. In this talk, we introduce the concept of security by design that implements security practices within the whole software lifecycle. Based on our practical experience from industry projects in the regulated industrial automation and unregulated classical IT domain, we explain how to perform a threat analysis and how to integrate it into the software lifecycle.

Model-Driven STEP Application Protocol Extensions Combined with Feature Modeling Considering Geometrical Information - Koch, Thorsten; Holtmann, Jörg; Lindemann, Timo (Revised Selected Papers of the 5th International Conference on Model-Driven Engineering and Software Development)
Original equipment manufacturers (OEMs) build mechatronic, variant-rich systems using components from several suppliers in industry sectors like automation. The OEMs have to integrate the different components to the overall system based on a virtual layout. For this purpose, the suppliers provide geometrical information via the standardized exchange format STEP. Beyond the geometrical information, the OEMs need additional logical and technical information for the integration task as well as the variant handling. For that reason, STEP provides an extension mechanism for extending and tailoring STEP to project-specific needs. However, extending STEP requires extending several capabilities of all involved tools, which prevents the project-specific utilization of the STEP extensions mechanism. In order to cope with this problem, we presented in previous work a model-driven approach enabling the flexible specification of STEP extensions and particularly the automatic derivation of the required capability extensions for two involved tools. Nevertheless, the OEMs still need to apply several engineering tools from different domains to consider logical as well as geometrical constraints between product variants. In this paper, we hence combine our previous approach with extended feature models that consider conventional logical and particularly geometrical information, thereby enabling a holistic product line engineering for mechatronic systems. By means of an automation production system example, we illustrate how OEMs can orchestrate their overall supply and development processes through the combination of both approaches.

Towards Scenario-based Security Requirements Engineering for Cyber-Physical Systems - Koch, Thorsten (International Workshop on Security for and by Model-Driven Engineering (SecureMDE 2018))

Automated Synthesis of a Real-Time Scheduling for Cyber-Physical Multi-core Systems - Geismann, Johannes; Höttger, Robert; Krawczyk, Lukas; Pohlmann, Uwe; Schmelter, David (Model-Driven Engineering and Software Development)
Cyber-physical Systems are distributed, embedded systems that interact with their physical environment. Typically, these systems consist of several Electronic Control Units using multiple processing cores for the execution. Many systems are applied in safety-critical contexts and have to fulfill hard real-time requirements. The model-driven engineering paradigm enables system developers to consider all requirements in a systematical manner. In the software design phase, they prove the fulfillment of the requirements using model checking. When deploying the software to the executing platform, one important task is to ensure that the runtime scheduling does not violate the verified requirements by neglecting the model checking assumptions. Current model-driven approaches do not consider the problem of deriving feasible execution schedules for embedded multi-core platforms respecting hard real-time requirements. This paper extends the previous work on providing an approach for a semi-automatic synthesis of behavioral models into a deterministic real-time scheduling. We add an approach for the partitioning and mapping development tasks. This extended approach enables the utilization of parallel resources within a single ECU considering the verification assumptions by extending the open tool platform App4mc. We evaluate our approach using an example of a distributed automotive system with hard real-time requirements specified with the MechatronicUML method.

Formal, Model- and Scenario-based Requirement Patterns - Fockel, Markus; Holtmann, Jörg; Koch, Thorsten; Schmelter, David (6th International Conference on Model-Driven Engineering and Software Development (MODELSWARD 2018))
Distributed, software-intensive systems such as automotive electronic control units have to handle various situations employing message-based coordination. The growing complexity of such systems results in an increasing difficulty to achieve a high quality of the systems' requirements specifications. Scenario-based requirements engineering addresses the message-based coordination of such systems and enables, if underpinned with formal modeling languages, automatic analyses for ensuring the quality of requirements specifications. However, formal requirements modeling languages require high expertise of the requirements engineers and many manual iterations until specifications reach high quality. Patterns provide a constructive means for assembling high-quality solutions by applying reusable and established building blocks. Thus, they also gained momentum in requirements documentation. In order to support the requirements engineers in the systematic conception of formal, scenario-based requirements specification models, we hence introduce in this paper a requirement pattern catalog for a requirements modeling language. We illustrate and discuss the application of the requirement patterns with an example of requirements for an automotive electronic control unit.

Improving Quality Control of Mechatronic Systems Using KPI-Based Statistical Process Control - Wohlers, Benedict; Dziwok, Stefan; Schmelter, David; Lorenz, Wadim (Advances in Manufacturing, Production Management and Process Control - AHFE 2018)

Systemmodelle als Schlüssel zu durchgängigen XIL-Testszenarien - Schmitz, Joachim; Fockel, Markus (Tag des Systems Engineering 2017)
Intelligente technische Systeme, wie autonom fahrende Fahrzeuge, werden in einem hohen Maß durch Software realisiert. Der Weg zum autonomen Fahren führt unweigerlich über eine steigende Vernetzung von Steuergeräten im Fahrzeug und über Fahrzeuggrenzen hinweg. Damit einher geht eine stetig steigende Komplexität der Software. Deshalb liegt es auf der Hand, dass die systematische Qualitätssicherung für derartige technische Systeme sehr früh, also bereits entwicklungsbegleitend, erfolgen muss. Dazu lässt sich das Software-in-the-Loop-Verfahren einsetzen, das auf etablierte Techniken des Hardware-in-the-Loop-Verfahrens zurückgreift. Eine besondere Herausforderung besteht darin, Simulationsmodelle und Testbibliotheken sowie die zugehörigen Visualisierungs- und Testwerkzeuge in beiden Welten synergetisch zu nutzen. Das Ziel ist eine einheitliche X-in-the-Loop (XIL) Basis für beide Verfahren. Der Schlüssel zu einer einheitlichen Basis für durchgängige XIL-Testszenarien ist der Einsatz eines übergeordneten Systemmodells. Es definiert die Systemgrenze und umliegenden Systeme in der Umwelt. Zudem dient das Systemmodell als Ordnungsschema für die Ablage der Artefakte wie Verhaltensmodelle, Testskripte, Parametersätze oder Workflows. Ein zentrales Datenmanagementwerkzeug, welches sämtliche Strukturinformationen, Verhaltensmodelle und Variantenbezüge verknüpft, ermöglicht ein teilautomatisches Umschalten zwischen den Testszenarien. In diesem Beitrag stellen wir eine solche Lösung vor.

Model-based Requirement Pattern Catalog - Fockel, Markus; Holtmann, Jörg; Koch, Thorsten; Schmelter, David
Scenario-based requirements engineering addresses the message-based coordination of software-intensive systems and enables, if underpinned with formal languages, automatic requirements validation techniques for improving the quality of a requirements specification. One of such requirements engineering approaches bases on a recent visual Live Sequence Chart variant compliant to the Unified Modeling Language, so-called Modal Sequence Diagrams (MSDs). The usage of patterns is known to be constructive thanks to assembling solutions by means of reusable building blocks that are proven in practice, so that recurring problems do not need to be solved over and over again. Thus, patterns also gained momentum in the area of requirements documentation. In this technical report, we introduce a model- and scenario-based pattern catalog for MSD requirements. Our MSD requirement pattern catalog consolidates and unifies 86 requirement patterns from three well-known, practice-oriented requirement pattern catalogs, each covering different aspects.

Toward Learning Realizable Scenario-based, Formal Requirements Specifications - Schmelter, David; Greenyer, Joel; Holtmann, Jörg (4th International Workshop on Artificial Intelligence for Requirements Engineering (AIRE))
Distributed, software-intensive systems such as fully automated cars have to handle various situations employing message-based coordination. The growing complexity of such systems results in an increasing difficulty to achieve a high quality of the systems’ requirements specifications, particularly w.r.t. the realizability of the specifications. Scenario-based requirements engineering addresses the message-based coordination of such systems and enables, if underpinned with formal languages, automatic requirements validation techniques for proving the realizability of a requirements specification. However, formal requirements modeling languages require a deep knowledge of requirements engineers and typically require many manual iterations until they find a realizable specification. In order to support requirements engineers in the stepwise development of scenario-based requirements specifications, we propose to evolve a high-quality specification from a (presumably unrealizable) manually created specification employing an evolutionary algorithm. In this paper, we show our results on automatically evolving new assumptions on the systems’ environment behavior that guarantee a realizable requirements specification. Based on this contribution, we outline our research roadmap toward our long-term goal of automatically supporting requirements engineers in finding high-quality requirements specifications.

Improving the Product Control of Mechatronic Systems Using Key Performance Indicators - Wohlers, Benedict; Dziwok, Stefan; Bremer, Christian; Schmelter, David; Lorenz, Wadim (Proceedings of the 24th International Conference on Production Research (ICPR))

Flexible Specification of STEP Application Protocol Extensions and Automatic Derivation of Tool Capabilities - Koch, Thorsten; Holtmann, Jörg; Lindemann, Timo (Proceedings of the 5th International Conference on Model-Driven Engineering and Software Development)
Original equipment manufacturers (OEMs) build mechatronic systems using components from several suppliers in industry sectors like automation. The suppliers provide geometrical information via the standardized exchange format STEP, such that the OEM is able to virtually layout the overall system. Beyond the geometrical information, the OEM needs additional technical information for his development tasks. For that reason, STEP provides an extension mechanism for extending and tailoring STEP to project-specific needs. However, extending STEP moreover requires extending several capabilities of all involved tools, causing high development effort. This effort prevents the project-specific utilization of the STEP extension mechanism and forces the organizations to use awkward workarounds. In order to cope with this problem, we present a model-driven approach enabling the flexible specification of STEP extensions and particularly the automatic derivation of the required further capabilities for two involved tools. We illustrate and evaluate the approach with an automation production system example.

Integrated and Iterative Systems Engineering and Software Requirements Engineering for Technical Systems (Précis) - Holtmann, Jörg; Bernijazov, Ruslan; Meyer, Matthias; Schmelter, David; Tschirner, Christian (Proceedings of the Software Engineering 2017)
The development of software-intensive technical systems (e.g., within the automotive industry) involves several engineering disciplines like mechanical, electrical, control, and particularly software engineering. Model-based Systems Engineering (MBSE) coordinates these disciplines throughout the development by means of a discipline-spanning system model. An integral part of MBSE is the requirements engineering on the system level. However, these requirements need to be refined for the discipline-specific development to start, for example, into specific requirements for the embedded software. Since existing MBSE approaches lack support for this refinement step, we conceived a systematic and iterative transition from MBSE to model-based software requirements engineering, which we present in this talk. We automated the steps of the transition where possible, in order to avoid error-prone and time-consuming manual tasks. We illustrate the approach and perform a case study with an example of an automotive embedded system.

Towards an Automated Synthesis of a Real-time Scheduling for Cyber-physical Multi-core Systems - Geismann, Johannes; Pohlmann, Uwe; Schmelter, David (Proceedings of the 5th International Conference on Model-Driven Engineering and Software Development)
Modern Cyber-physical Systems are executed in physical environments and distributed over several Electronic Control Units using multiple cores for execution. These systems perform safety-critical tasks and, therefore, have to fulfill hard real-time requirements. To face these requirements systematically, system engineers de- velop these systems model-driven and prove the fulfillment of these requirements via model checking. It is important to ensure that the runtime scheduling does not violate the verified requirements by neglecting the model checking assumptions. Currently, there is a gap in the process for model-driven approaches to derive a feasible runtime scheduling that respects these assumptions. In this paper, we present an approach for a semi- automatic synthesis of behavioral models into a deterministic scheduling that respects real-time requirements at runtime. We evaluate our approach using an example of a distributed automotive system with hard real-time requirements specified with the MechatronicUML method.

The MechatronicUML Requirements Engineering Method: Process and Language - Holtmann, Jörg; Fockel, Markus; Koch, Thorsten; Schmelter, David; Brenner, Christian; Bernijazov, Ruslan; Sander, Marcel
In this technical report, we present the MechatronicUML requirements engineering method. The method encompasses a process and a scenario-based modeling language for the documentation and analysis of requirements on the message-based interaction behavior of software-intensive systems. The modeling language uses a scenario notation based on Modal Sequence Diagrams (MSDs), which borrows concepts of UML Interactions as well as of Live Sequence Charts. Furthermore, we introduce the so-called Emergency Braking & Evasion System (EBEAS) as a running example, which is based on current and upcoming real-world driver assistance systems.

Towards Feature-based Product Line Engineering of Technical Systems - Koch, Thorsten; Holtmann, Jörg; Schubert, David; Lindemann, Timo (3rd International Conference on System-integrated Intelligence: New Challenges for Product and Production Engineering (SysInt 2016))
The development of today’s technical products (e.g., in automation) is characterized by high customer expectations regarding the product individualization, which causes a wide range of product variants. Original equipment manufacturers (OEMs) can apply classical approaches from product line engineering, like feature modeling, to cope with the variability and the induced development complexity. Our tool support for feature models integrates a variety of feature model extensions like feature attributes and properties, logical constraints between features and feature properties, and the distinction between features and feature realizations. Furthermore, technical products have geometrical dimensions. The OEM specifies Computer Aided Design (CAD) models to consider these geometric dimensions and to virtually layout particular product variants. Geometric assembly constraints specify how parts of the product can be arranged in a CAD model. However, a potential product customer cannot configure an individual product variant and virtually layout this variant in the same software tool since the respective information stems from different sources. In order to cope with this problem, we present in this paper an extension of our tool support for feature models to specify geometric assembly constraints. Based on the proposed extension, we outline our research roadmap to consider these constraints in an online shop of an e-commerce system, in which a potential customer shall be able to configure a product variant and to virtually layout it according to the assembly constraints.

ASIL Tailoring on Functional Safety Requirements - Fockel, Markus (5th International Workshop on Next Generation of System Assurance Approaches for Safety-Critical Systems (SASSUR))
Cyber-physical systems like self-driving cars are highly complex and safety-critical. This results in a great number of safety requirements that have different levels of criticality. In automotive, the criticality is categorized in Automotive Safety Integrity Levels (ASIL). As a high ASIL causes high development effort, the goal is to develop most subsystems with lower ASIL requirements. To achieve this ASIL tailoring, subsystems need to be separated or redundantly implemented. These safety measures are usually integrated late in the development process and thus cause costly development iterations. In this paper, we present a systematic, tool-supported ASIL tailoring process for the requirements analysis phase. It is applied on formal safety requirements and automatically generated fault trees for a functional view of the system. The process supports early planning of safety efforts for mixed-criticality systems and avoids costly late development iterations.

Requirements Engineering - Zusatzaufgabe oder Kernkompetenz? - Holtmann, Jörg; Fockel, Markus; Koch, Thorsten; Schmelter, David (OBJEKTspektrum)
In verschiedenen Unternehmen wird mit Anforderungen unterschiedlich umgegangen. Je nach Größe, Branche und Unternehmenskultur ist das Thema Requirements Engineering (RE) mal weniger, mal mehr etabliert. In einigen Unternehmen wird es als lästige Zusatzaufgabe betrachtet, während andere Unternehmen ganze Abteilungen mit RE als Kernkompetenz betreiben. RE wird allerdings in jedem Projekt - bewusst oder unbewusst - durchgeführt! RE ist die Basis für den weiteren Entwicklungsprozess, die Validierung/Verifikation und die Plan- und Messbarkeit des Projekts. Darüber hinaus können Fehler, die auf Anforderungsebene gefunden werden, weniger aufwendig und somit günstiger behoben werden als in späteren Entwicklungsphasen. Am Fraunhofer IEM beraten wir Unternehmen und erforschen neue Methoden bezüglich der Entwicklung von intelligenten technischen Systemen. In diesem Artikel berichten wir über unsere Erfahrungen aus Projekten, in denen wir Unternehmen aus verschiedenen Branchen und mit unterschiedlichem RE-Reifegrad zwecks Leistungssteigerung des RE begleitet haben. Auf Basis dieser Projekterfahrungen zeigen wir Wege auf, wie der Stand des RE mittels eines Reifegradmodells im eigenen Unternehmen verbessert werden kann.

Integrated and iterative systems engineering and software requirements engineering for technical systems - Holtmann, Jörg; Bernijazov, Ruslan; Meyer, Matthias; Schmelter, David; Tschirner, Christian (Journal of Software Evolution and Process)
The development of software-intensive technical systems involves several engineering disciplines like mechanical, electrical, control, and particularly software engineering. Model-based Systems Engineering (MBSE) coordinates these disciplines throughout the development by means of discipline-spanning processes and a system model. Such a system model provides a common understanding of the system under development and serves as a starting point for the discipline-specific development. An integral part of MBSE is the requirements engineering on the system level. However, these requirements need to be refined for the discipline-specific development to start, e.g., into specific requirements for the embedded software. Since existing MBSE approaches lack support for this refinement step, we conceived in previous work a systematic transition from MBSE to model-based software requirements engineering. We automated the steps of the transition where possible, in order to avoid error-prone and time-consuming manual tasks. In this paper, we extend this approach with support for subsequent process iterations and provide an algorithm for the automated steps. We illustrate the approach and perform a case study with an example of an automotive embedded system.

Vom Systemmodell zu disziplinspezifischen Modellen und zurück - Schmitz, Joachim; Fockel, Markus (Tag des Systems Engineering 2015)
Zukünftige mechatronische Systeme entwickeln sich mehr und mehr zu intelligenten technischen Systemen, die durch eine zunehmende Verzahnung der mechanischen, elektrischen und informationsverarbeitenden Anteile gekennzeichnet sind. Um das Zusammenspiel der Disziplinen besser zu beherrschen, werden zunehmend Methoden und disziplinübergreifende Systemmodelle des Systems Engineering genutzt. Offene Probleme sind dabei noch die Nachverfolgbarkeit der Entwicklung (Traceability) und die Verwaltung zueinander konsistenter Versionen von disziplinübergreifenden und disziplinspezifischen Modellen. Dieser Beitrag adressiert diese Probleme durch die Verknüpfung der Spezifikationstechnik CONSENS für den Systementwurf mit dem Datenmanagementwerkzeug SYNECT. Der Beitrag stellt die Konzipierung und prototypische Werkzeugunterstützung für die Verknüpfung von Systemmodellen und disziplinspezifischen MATLAB/Simulink-Modellen vor.

Systementwurf unter Einbeziehung funktionaler Sicherheit bei automobilen Steuergeräten - Meyer, Jan; Fockel, Markus; Holtmann, Jörg (Tag des Systems Engineering 2015)
Automobile Steuergeräte realisieren mehr und mehr sicherheitskritische Funktionen. Nicht erst durch die Einführung der ISO 26262 werden an die Entwicklung sicherheitskritischer Funktionen besondere Anforderungen zum Beispiel in Form von Sicherheitsanalysen gestellt. In der Praxis hat sich herausgestellt, dass durch den bisherigen Systementwurf nicht alle notwendigen Daten für die Sicherheitsanalysen vorlagen. Von daher war eine Erweiterung des bisherigen Vorgehens erforderlich, sodass die benötigten Daten zu den erforderlichen Zeitpunkten vorliegen und die Sicherheitsanalysen ohne aufwendige Nacharbeiten erstellt werden können. Dieser Artikel beschreibt die durchgeführten Erweiterungen und die Erfahrungen, die in Serienprojekten eines automobilen Zulieferers gesammelt wurden.

ReqPat: Efficient Documentation of High-quality Requirements using Controlled Natural Language - Fockel, Markus; Holtmann, Jörg (Proc. of the 23rd International Requirements Engineering Conference 2015 (RE15))
The growing complexity of today's software intensive systems results in an increased size of requirements specifications, which are typically documented by means of natural language (NL). Large NL requirements specifications are prone to contain defects (e.g., contradictions), and the inherent ambiguity of NL impedes automatic techniques to support the requirements engineer. In order to cope with this problem, we conceived a requirements documentation approach implemented in the tool ReqPat. Using a controlled NL, it supports an efficient requirements documentation, an automatic requirements validation, and an automatic transition to models--while still keeping the requirements understandable for all stakeholders.

Integrated systems engineering and software requirements engineering for technical systems - Holtmann, Jörg; Bernijazov, Ruslan; Meyer, Matthias; Schmelter, David; Tschirner, Christian (Proceedings of the 2015 International Conference on Software and System Process)
The development of software-intensive technical systems (e.g., within the automotive industry) involves several engineering disciplines like mechanical, electrical, control, and software engineering. Model-based Systems Engineering (MBSE) coordinates these disciplines throughout the development by means of discipline-spanning processes and system models. Such a system model provides a common understanding of the system under development and serves as a starting point for the discipline-specific development. An integral part of MBSE is the requirements engineering on the system level. However, for the discipline-specific development to start, these requirements need to be refined, e.g., into specific requirements for the embedded software. Since existing MBSE approaches lack support for this refinement step, we conceived a systematic transition from MBSE to model-based software requirements engineering, which we present in this paper. We automated the steps of the transition where possible, in order to avoid error-prone and time-consuming manual tasks. We illustrate the approach with an example of an automotive embedded system.

Generierung von AUTOSAR-Modellen aus UML-Spezifikationen - Meyer, Jan; Holtmann, Jörg; Koch, Thorsten; Meyer, Matthias (10. Paderborner Workshop Entwurf mechatronischer Systeme)
Die Komplexität moderner Fahrzeuge steigt aufgrund der zunehmenden Anzahl von Funktionen, die durch elektronische Systeme umgesetzt werden. Insbesondere nehmen die Abhängigkeiten zwischen den an der Entwicklung beteiligten Fachdisziplinen und der Softwareanteil massiv zu. Wir haben einen für die Automobilindustrie angepassten, zum Reifegradmodell Automotive SPICE konformen Prozess für die Entwicklung von Steuergeräten konzipiert, der ein fachdisziplinübergreifendes Systems Engineering und einen systematischen Übergang in die Softwareentwicklung unterstützt. Im Kontext dieses Entwicklungsprozess beschreiben wir in diesem Beitrag den Übergang vom UML-basierten Softwareentwurf zum in der Automobilindustrie etablierten AUTOSAR-Standard mit Hilfe einer automatischen Modelltransformation. So werden fehleranfällige und zeitaufwändige manuelle Tätigkeiten reduziert. Wir haben die Generierung von AUTOSAR-Modellen gemeinsam mit dem international tätigen Automobilzulieferer Hella KGaA Hueck & Co. in seriennahen Entwicklungsprojekten praktisch erprobt und Zeit- und Kostenersparnisse festgestellt.

A requirements engineering methodology combining models and controlled natural language - Fockel, Markus; Holtmann, Jörg (2014 IEEE 4th International Model-Driven Requirements Engineering Workshop (MoDRE))
The use of models in requirements engineering (RE) for software-intensive embedded systems is considered beneficial. The main advantages of requirements models as documentation format are that they facilitate requirements understanding and foster automatic analysis techniques. However, natural language (NL) is still the dominant documentation format for requirements specifications, particularly in the domain of embedded systems. This is due to the facts that NL-based requirements can be used within legally binding documents and are more appropriate for reviews than models. In order to bridge the gap between both of these documentation formats, this paper proposes a model-driven RE methodology that makes use of requirements models along with a controlled natural language. The methodology combines the advantages of model-based and NL-based documentation by means of a bidirectional multi-step model transformation between both documentation formats. We illustrate the approach by means of an automotive example, explain the particular steps of the model transformation, and present performance results.

Generating EAST-ADL Event Chains from Scenario-Based Requirements Specifications - Koch, Thorsten; Holtmann, Jörg; DeAntoni, Julien (Software Architecture)
Real-time software-intensive embedded systems complexity, as in the automotive domain, requires rigorous Requirements Engineering (RE) approaches. Scenario-based RE formalisms like Modal Sequence Diagrams (MSDs) enable an intuitive specication and the simulative validation of functional requirements. However, the dependencies between events occurring in different MSD scenarios are implicit so that it is difficult to find causes of requirements defects, if any. The automotive architecture description language EAST-ADL addresses this problem by relying on event chains, which make dependencies between events explicit. However, EAST-ADL event chains have a low abstraction level, and their relationship to functional requirements has seldom been investigated. Based on the EAST-ADL functional architecture, we propose to use its central notion of event to conciliate both approaches. We conceived an automatic transformation from the high abstraction level requirements specified in MSDs to the low abstraction level event chains.

Mit Satzmustern hochwertige Anforderungsdokumente effizient erstellen - Fockel, Markus; Holtmann, Jörg; Meyer, Matthias (OBJEKTspektrum)
Von heutigen technischen Systemen wird immer mehr Funktionalität gefordert. Dies manifestiert sich in einer steigenden Anzahl von Anforderungen, die üblicherweise in freier natürlicher Sprache festgehalten werden. Das führt oft zu mehrdeutigen, widersprüchlichen oder unvollständigen Anforderungen. In diesem Beitrag wird eine Methode zur Spezifikation von Anforderungen auf Basis von Satzmustern inklusive ihrer Werkzeugunterstützung „ReqPat“ vorgestellt: Anforderungen werden weiterhin textuell aber in einer eingeschränkten natürlichen Sprache verfasst. Dadurch wird ein einheitliches Anforderungsverständnis erreicht und es werden Qualitätsanalysen sowie der Übergang zu Modellen automatisiert.

Goal-Scenario-Oriented Requirements Engineering for Functional Decomposition with Bidirectional Transformation to Controlled Natural Language. Case Study "Body Control Module" - Daun, Marian; Fockel, Markus; Holtmann, Jörg; Tenbergen, Bastian

Semi-automatic establishment and maintenance of valid traceability in automotive development processes - Fockel, Markus; Holtmann, Jörg; Meyer, Jan (2012 Second International Workshop on Software Engineering for Embedded Systems (SEES))
The functionality realized by software in modern cars is increasing and as a result the development artifacts of automotive systems are getting more complex. The existence of traceability along these artifacts is essential, since it allows to monitor the product development from the initial requirements to the final code. However, traceability is established and maintained mostly manually, which is time-consuming and error-prone. A further crucial problem is the assurance of the validity of the trace links, that is, the linked elements are indeed related to each other. In this paper we present a semiautomatic approach to create, check, and update trace links between artifacts along an automotive development process.

Application and Evaluation in the Automotive Domain - Fockel, Markus; Heidl, Peter; Höfflinger, Jens; Hönninger, Harald; Holtmann, Jörg; Horn, Wilfried; Meyer, Jan; Meyer, Matthias; Schäuffele, Jörg (Model-Based Engineering of Embedded Systems)
This chapter summarizes the application and evaluation of the SPES engineering methodology in the automotive domain. After introducing the particular domain characteristics, we state some research questions that we have investigated. Some of the activities that address these research questions are presented in detail. We conclude that the SPES engineering methodology is a good basis for the development of automotive systems, but could be further refined to fit the particular needs of the domain.