Search Results

This paper presents the conceptual model and the fundamental mechanisms for software development in the context of the Brite-EuRam project Safety Related Fault Tolerant Systems in Vehicles (nick-named X-By-Wire). The objective of the X-By-Wire project is to achieve a framework for the introduction of safety related fault tolerant electronic systems without mechanical backup in vehicles. To achieve the required level of fault-tolerance, an X-By-Wire system must be designed as a distributed system comprising a number of fault-tolerant units connected by a reliable real-time communication system. For the communication system, the time-triggered TTP/C real-time communication protocol was selected. TTP/C provides fault-tolerance message transfer, state synchronization, reliable detection of node failures, a global time base, and a distributed membership service. Redundancy is used for masking failures of individual processor nodes and hardware peripherals.

This paper describes the architecture and the implementation of a software for the communication between networked in-vehicle ECUs. The communication software is based upon a real-time multitasking operating system. The operating system and the communication software form an application-independent platform for the implementation of distributed ECU software. The software architecture consists of several communication layers and a station management module. The communication layers provide network driver, data transfer services and an application interface that is independent of the used network protocol. The station management module is responsible for configuration and initialization of the communication controller, error detection during operation and error handling. The modula r structure of the architecture supports the simple adaptation of the software to different bus systems and communication controllers.

The new generation of drive-by-wire systems currently under development has demanding requirements on the electronic architecture. Functions such as brake-by-wire or steer-by-wire require continued operation even in the presence of component failures. The electronic architecture must therefore provide fault-tolerance and real-time response. This in turn requires the operating system and the communication layer to be predictable, dependable and composable. It is well known that this properties are best supported by a time-triggered approach. A consortium consisting of German and French car manufacturers and suppliers, which aims at becoming a working group within the OSEK/VDX initiative, the OSEKtime consortium, is currently defining a specification for a time-triggered operating system and a fault-tolerant communication layer.1 The operating system and the communication layer are based on applicable interfaces of the OSEK/VDX standard.