Search Results

Connecting microcontrollers, sensors and actuators by several communication systems is state of the art within the electronic architectures of modern vehicles. The communication among these components is widely based on the event triggered communication on the Controller-Area-Network (CAN) protocol. The arbitrating mechanism of this protocol ensures that all messages are transferred according to the priority of their identifiers and that the message with the highest priority will not be disturbed. In the future some mission critical subnetworks within the upcoming generations of vehicle systems, e.g. x-by-wire systems (xbws), will additionally require deterministic behavior in communication during service. Even at maximum bus load, the transmission of all safety related messages must be guaranteed. Moreover it must be possible to determine the point of time when the message will be transmitted with high precision.

This paper presents the conceptual model and the fundamental mechanisms for software development in the context of the Brite-EuRam project Safety Related Fault Tolerant Systems in Vehicles (nick-named X-By-Wire). The objective of the X-By-Wire project is to achieve a framework for the introduction of safety related fault tolerant electronic systems without mechanical backup in vehicles. To achieve the required level of fault-tolerance, an X-By-Wire system must be designed as a distributed system comprising a number of fault-tolerant units connected by a reliable real-time communication system. For the communication system, the time-triggered TTP/C real-time communication protocol was selected. TTP/C provides fault-tolerance message transfer, state synchronization, reliable detection of node failures, a global time base, and a distributed membership service. Redundancy is used for masking failures of individual processor nodes and hardware peripherals.

Signals in Automotive Communication Networks often represent safety relevant information. Therefore, automotive network protocols provide multiple powerful mechanisms for error detection and for error reporting. The objective is to ensure that on average less than one undetected error occurs during the lifetime of a vehicle. This places an upper bound on the residual error probability of the communication network. The determination of this residual error probability requires new methods in order to account for the interaction of the various error detection mechanisms. This paper presents an analysis method that has been developed for the investigation of the CAN protocol. This comprehensive investigation distinguishes two types of errors that contribute most significantly to the residual error probability of the CAN protocol. Errors of one type transform stuffbits into information bits or vice versa, and are related to the use of variable bit stuffing.

A significant portion of communication in Automotive Networks consists of signals, which are vital to the safety of the vehicle. In addition to requirements resulting from the actual transfer of information an Automotive Communication Protocol has to incorporate properties which ensure operational safety even in presence of errors. Based upon a discrimination into reversible errors and irreversible failures, defect nodes have to be determined and subsequently disconnected from the network. In this paper proper schemes for error detection, report, recovery and confinement are presented.

The new aerial communication protocol “Controller Area Network” (CAN) efficiently supports distributed realtime control in automotive applications. In order to unload CPUs from high-speed message transfer, dedicated CAN hardware handles messages up to the communication object level. In multiplex wiring message rates are one to two orders of magnitude lower, allowing to implement the upper communication level more cost-effectively in software. This reduces CAN interface hardware to bitwise protocol handling only. It may be incorporated even into low-end microcontrollers without significantly increasing chip size. Thus the same CAN protocol supports the entire range of serial automotive communication, matching implementation costs to requirements at each performance level.

The SAE J2716 SENT (Single Edge Nibble Transmission) Protocol has entered production with a number of announced products. The SENT protocol is a point-to-point scheme for transmitting signal values from a sensor to a controller. It is intended to allow for high resolution data transmission with a lower system cost than available serial data solution. The SAE SENT Task Force has developed a number of enhancements and clarifications to the original specification which are summarized in this paper.

Actual research results in the automotive field show that there is a big potential in increasing active and passive safety by implementing intelligent driver assisting systems. Realizing such safety related system functions requires an electronic system without mechanical or hydraulic backup to de-couple the human interface from the vehicle functions, e.g., steering and braking. Safety critical functions without mechanical backup enforce new requirements in system design. Any faulty behavior of a component within the system must not lead to a malfunction of the overall system. Consequently in the system design fault-tolerance mechanisms in real time must be introduced. Active replication of a functional node is a proper solution to guarantee this real time fault-tolerance. Redundancy management of the functional nodes can be implemented by fail-silent replicas, i.e. a node behaves correctly or does not produce any output at all.