1. A Membership Service for a Distributed, Embedded System Based on a Time-Triggered FlexRay Network Martin Mitzlaff Rüdiger Kapitza, Michael Lang, Wolfgang Schröder-Preikschat Ingolstadt Institute of the Friedrich-Alexander University Erlangen-Nuremberg

2. Drive by Wire A non functional state is not tolerable.
Most parts are time-triggered
Hard real-time
Dependable
Single units not dependable enough
Redundancy, Fault masking
Important to know which units are online
Need for a Membership Service Provides a consistent view of the fault-free units
Martin Mitzlaff -- EDCC 2010 Industrial Track

3. Brake-by-wire Brake! ECU5 ECU1 ECU4 ECU2 ECU3
Martin Mitzlaff -- EDCC 2010 Industrial Track

4. Agenda FlexRay Membership Service Verification Evaluation
Martin Mitzlaff -- EDCC 2010 Industrial Track

5. Communication Controller
FlexRay
High-speed time-triggered bussystem
De-facto standard time-triggered bussystem in the automotive industry
Node structure:
Node
Host
Communication Controller
Transceiver
wire
Martin Mitzlaff -- EDCC 2010 Industrial Track

6. FlexRay - Features Cycle-based communication: Synchronized clocks
Central bus guardian in the active star
No membership service
Cycle 0
Cycle 1
Cycle 2 …
Cycle 63
Slot 0
Slot 1
Slot 2 …
Slot 29
Slot 30
Slot 31 32 33 34
Static Part
Dynamic Part
Idle
Martin Mitzlaff -- EDCC 2010 Industrial Track

7. Using FlexRay Interrupts to synchronize access to message buffers
Interrupts disturb the application
Application
Send_Confimation()
Receive()
Fill_Sendbuffer()
Send()
Macrotick
2000
700
2700
FlexRay
cycle
Martin Mitzlaff -- EDCC 2010 Industrial Track

8. Current approaches
Membership protocols for synchronous systems already exist:
F. Cristian 1988
S. Katz, P. Lincoln and J.M. Rushby 1997
R. Barbosa and J. Karlsson 2006
But all are slot based
Not possible in a FlexRay system
TTP/C includes a membership service (in hardware)
Master thesis
Martin Mitzlaff -- EDCC 2010 Industrial Track

9. Round-based Approach Slot based: Round based:
Sending and receiving in one interval
No timing requirements inside the interval
Calculation only at one point in the round
Send
Receive
Calculate
Martin Mitzlaff -- EDCC 2010 Industrial Track

10. What’s a view? View: Just a bit vector; One bit for one node
Local view:
Node’s current opinion of fault-free nodes
Interchanged with other nodes
Global view
Former local view
Verified by the local views of other nodes
ECU 1
ECU 2
ECU 8
Martin Mitzlaff -- EDCC 2010 Industrial Track

11. Integration G G G L L L Round: 3 2 1 L L G G ECU5 ECU1 ECU4 ECU2 ECU31 L L G G
Martin Mitzlaff -- EDCC 2010 Industrial Track

12. Faulty node G G G L L L Round: 1 3 2 L L G G ECU5 ECU1 ECU4 ECU2 ECU31 3 2 L L G G
Martin Mitzlaff -- EDCC 2010 Industrial Track

13. Verification Need for a fault hypothesis Formal proof of the latency
For FlexRay nothing published
Each node and each logical communication-channel are a Fault-Containment Region
Active star guarantees that the message is transmitted to all or no node by the communication system. [see TTP/C]
Important to detect invalid messages
Further CRC, including cycle counter
A faulty host does not send membership messages.
Different fault modes can be mapped to just three faults: sending, receiving or sending&receiving fault
At most one fault in two cycles
Formal proof of the latency
Result: two rounds can be guarantied
Martin Mitzlaff -- EDCC 2010 Industrial Track

14. Model checking Modeling using PROMELA Verifying the model using SPIN
Used results for decreasing number of states
Only possible with small networks
Results:
Absence of Livelocks
Absence of Deadlocks
New nodes do not disturb
Latency of two rounds
Martin Mitzlaff -- EDCC 2010 Industrial Track

15. Evaluation Using TTTech Multi-Purpose ECU TriCore TC1796
Freescale MFR4300
TTTech AUTOSAR FlexRay-Stack
Vector VN3600
Special active star
Martin Mitzlaff -- EDCC 2010 Industrial Track

16. Evaluation Results CPU Load:
Maximal 2,4% CPU-Load caused by membership service
2.6 kbyte ROM
Martin Mitzlaff -- EDCC 2010 Industrial Track

17. Conclusion FlexRay is the bus for drive-by-wire applications
But lacks a membership service
Our Contribution: Membership service for FlexRay
Key features:
Round-based approach
minimal CPU load
Transparent to the application
Verification by different techniques
Even outside the fault hypothesis, coming back to a consistent global view
Martin Mitzlaff -- EDCC 2010 Industrial Track

18. Thank you for your attention!
Any questions?
Martin Mitzlaff -- EDCC 2010 Industrial Track