Search Results

Automotive vehicles today consist of very complex network of electronic control units (ECU) connected with each other using different network implementations such as Controller Area Network (CAN), FlexRay, etc. There are several ECUs inside a vehicle targeting specific applications such as engine, transmission, body, steering, brakes, infotainment/navigation, etc. comprising on an average more than 50 ECUs executing more than 50 million lines of software code. It is expected to increase exponentially in the next few years. Such complex electric/electronic (E/E) architecture and software calls for a comprehensive, flexible and systematic development and validation environment especially for a system level or vehicle level development. To achieve this goal, we have built a virtual multi-ECU high fidelity cyber-physical multi-rate cosimulation that closely resembles a realistic hardware based automotive embedded system.

Along with the efforts to cope with the increase of functions which require higher communication bandwidth in vehicle networks using CAN-FD and vehicle Ethernet protocols, we have to deal with the problems of both the increased busload and more stringent response time requirement issues based on the current CAN systems. The widely used CAN busload limit guideline in the early design stage of vehicle network development is primarily intended for further frame extensions. However, when we cannot avoid exceeding the current busload design limit, we need to analyze in more detail the maximum frame response times and message delays, and we need good estimation and measurement techniques. There exist two methods for estimating the response time at the design phase, a mathematical worst-case analysis that provides upper bounds, and a probability based distributed response time simulation.

The increasing functionality and complexity of future electric/electronic architectures requires efficient methods and tools to support design decisions, which are taken in early development phases 6. For the past four years, a holistic approach for architecture development has been established at Mercedes-Benz Cars R&D department. At its core is a seamless design flow, including the conception, the analysis and the documentation for electric/electronic architectures. One of the actual challenges in the design of electric/electronic architectures concerns communication behavior and network topologies. The increasing data exchange between the ECUs creates high requirements for the networks. With the introduction of FlexRay 21 and Ethernet the automotive network architecture become a lot more heterogeneous. Especially gateways must fulfill many new requirements to handle the strict periodic schedule of FlexRay and the partly event-triggered communication on CAN-busses 23.

The increasing complexity of automotive functions which are necessary for improved driving assistance systems and automated driving require a change of common vehicle architectures. This includes new concepts for E/E architectures such as a domain-oriented vehicle network based on powerful Domain Control Units (DCUs). These highly integrated controllers consolidate several applications on different safety levels on the same ECU. Hence, the functions depend on a strictly separated and isolated implementation to guarantee a correct behavior. This requires middleware layers which guarantee task isolation and Quality of Service (QoS) communication have to provide several new features, depending on the domain the corresponding control unit is used for. In a first step we identify requirements for a middleware in automotive DCUs. Our goal is to reuse legacy AUTOSAR based code in a multicore domain controller.

More electronic vehicle functions lead to an exponentially growing degree of software integration in automotive ECUs. We are seeing an increasing number of ECUs with mixed criticality software. ISO26262 describes different safety requirements, including freedom from interference and absence from error propagation for the software. These requirements mandate particular attention for mixed-criticality ECUs. In this paper we investigate the ability to guarantee that these safety requirements will be fulfilled by using established (deadline monitoring) and new error detection mechanisms (execution time monitoring). We also show how these methods can be used to build up safe and efficient schedules for today's and future automotive embedded real time systems with mixed criticality software.

The integration of mixed-criticality software according to safety standards like ISO 26262 generates new, parasitic mutual effects within the involved software architectures. In this situation, established schedule design patterns like RMS fail to deliver both efficiency and safety, in particular the freedom of interference. In today's practice of building a schedule, certain such measures to fulfill these safety requirements can conflict with efficiency requirements. The target of this paper is to present a sound approach of how to solve such requirement conflicts and to build up schedules that are safe and also efficient. We present a general early-stage procedure to build safe, certifiable, and efficient schedules. The procedure is based on the established design patterns and adds guidelines on how to exploit additional options in both schedule design and software partitioning. This procedure was validated against typical real-world systems and one example is presented.

Ethernet is the hottest candidate for future in-car communication architecture, promising much higher bandwidth, flexibility and reduced costs. In the coming years, Ethernet will likely evolve from a separate communication medium for special applications like surround-view cameras and infotainment to a central communication infrastructure as a backbone technology. To make this transition, many difficult design decisions have to be made in order to make the technology suitable for the stricter time and safety requirements of todays and future cars. There are a lot of potential real-time effects that must be taken into account. To guide these design decisions, it is necessary to analyze the various architecture concepts with respect to load, performance and real-time capabilities. In this paper, we present different design space axes of Ethernet and propose a methodology of assessing and comparing them.

With the increasing complexity of electronic vehicle systems, one particular “gap” between function development and ECU integration becomes more and more apparent, and critical; albeit not new. The core of the problem is: as more functions are integrated and share the same E/E resources, they increasingly mutually influence and disturb each other in terms of memory, peripherals, and also timing and performance. This has two consequences: The amount of timing-related errors increases (because of the disturbance) and it becomes more difficult to find root causes of timing errors (because of the mutual influences). This calls for more systematic methods to deal with timing requirements in general and their transformation from function timing requirements to software architecture timing requirements in particular.

For a long time, tools and methods for automotive E/E design were mostly in the domain of academic researches only. Recently, OEMs have started adopting selected contributions, because (very soon) it will become quite costly NOT to apply them. The first step is establishing centralized data storage for all design data. At present, selecting appropriate abstraction levels and design methods that get fed by and feed the data is the task at hand. In this paper, we summarize recent progress in this selection process with a focus on performance; which is a key aspect for architecture generation. Our contribution provides incremental progress from both ends of the mentioned gap (requirements vs. architecture vs. implementation) towards one another. The presentation is created around the IMES project [21] considering centralized data storage. However, the overall approach is based on established standards and common design patterns as much as possible.

Today, gated networks with several buses are becoming standard in automotive E/E-systems but are evolving differently among the various vehicle manufactures, with different topologies, combinations of bus protocols, and speeds. Making the right architecture decisions requires systematic evaluation of the many alternatives during early design stages. However, there are many trade-offs in terms of performance, cost, extensibility, etc.. In this context, scheduling analysis is a powerful tool. It clarifies performance, end-to-end timing, and dynamic behavior. This enables evaluation of networking alternatives, foresight of bottlenecks, and provides guidance in the design process. In the paper, the application of scheduling analysis in automotive network exploration and optimization will be demonstrated. Specific emphasize will be put on end-to-end timing, migration from CAN to FlexRay, black-box integration and early-stage assumptions, extensibility, and trade-offs.

Developers of safety-critical real-time systems have to ensure that their systems react within given time bounds. Ideally, the system is designed to provide sufficient computing power and network bandwidth, is cost efficient and provides the necessary safety level. To achieve this goal, three challenges have to be addressed. First, it must be possible to account for timing during early development stages in the architecture exploration phase. Second, during software development, timing behavior and the effects of software changes on timing must be observable. Third, there must be a technology for formally verifying the final timing behavior for industry-size applications. In this article we present a comprehensive methodology for dealing with timing which addresses all three issues based on state-of-the-art commercial tools.

Systems and network integration is a major challenge, and systematic analysis of the complex dynamic timing effects becomes key to building reliable systems. Very often, however, systematic analysis techniques are (considered) too restrictive with respect to established design practice. In this paper we present lessons learned from real-world case studies, in which OEMs have used the new SymTA/S scheduling analysis technology to evaluate different network choices with minimum effort. Thanks to its flexibility and supplier independence, SymTA/S can be applied in non-ideal situations, where other, more restricted technologies are inherently limited. Finally, we put the technology into relation with ongoing standardization activities.