Bernard Bavoux

Multisource Software on Multicore Automotive ECUs—Combining Runnable Sequencing With Task Scheduling

As the demand for computing power is quickly increasing in the automotive domain, car manufacturers and tier-one suppliers are gradually introducing multicore electronic control units (ECUs) in their electronic architectures. In addition, these multicore ECUs offer new features such as higher levels of parallelism, which ease the compliance with safety requirements such as the International Organization for Standardization (ISO) 26262 and the implementation of other automotive use cases. These new features involve greater complexity in the design, development, and verification of the software applications. Hence, car manufacturers and suppliers will require new tools and methodologies for deployment and validation. In this paper, we address the problem of sequencing numerous elementary software modules, called runnables, on a limited set of identical cores. We show how this problem can be addressed as the following two subproblems, which cannot optimally be solved due to their algorithmic complexity: 1) partitioning the set of runnables and 2) building the sequencing of the runnables on each core. We then present low-complexity heuristics to partition and build sequencer tasks that execute the runnable set on each core. Finally, we globally address the scheduling problem, at the ECU level, by discussing how we can extend this approach in cases where other OS tasks are scheduled on the same cores as the sequencer tasks.

Multi-source and multicore automotive ECUs - OS protection mechanisms and scheduling

As the demand for computing power is quickly increasing in the automotive domain, car manufacturers and tier-one suppliers are gradually introducing multicore ECUs in their electronic architectures. Additionally, these multicore ECUs offer new features such as higher levels of parallelism which ease the respect of the safety requirements such as the ISO 26262 and the implementation of other automotive use-cases. These new features involve also more complexity in the design, development and verification of the software applications. Hence, OEMs and suppliers will require new tools and methodologies for deployment and validation. In this paper, we review the operating system protection mechanisms (e.g., memory, timing), needed for multi-source software in a safety critical context, with a clear focus on AUTOSAR OS which is the upcoming defacto standard for automotive ECUs. Then, we identify the main use-cases for automotive multicore ECUs and present solutions for the scheduling in a context where there are hundreds of software components and only a few OS tasks are allowed. Finally, experiments aim to assess the load level that can be reached on realistic case-studies.

Aperiodic traffic in response time analyses with adjustable safety level

In distributed real-time systems it is crucial to ensure the temporal validity of the data exchanged among the nodes. Classically, the frame worst case response time (WCRT) analyses, and the software tools which implement them, do not take into account the aperiodic traffic. One of the main reasons for this is that the aperiodic traffic is generally very difficult to characterize (i.e., the arrival patterns of the aperiodic frames). The consequence of this is that one tends to underestimate the WCRT, which may have an impact on the overall safety of the system. In this paper, we propose a probabilistic approach to model the aperiodic traffic and integrate it into response time analysis. The approach allows the system designer to choose the safety level of the analysis based on the systems dependability requirements. Compared to existing deterministic approaches the approach leads to more realistic WCRT evaluation and thus to a better dimensioning of the hardware platform.

Fractional Models for Thermal Modeling and Temperature Estimation of a Transistor Junction

The thermal behavior of a power transistor mounted on a dissipator is considered in order to estimate the transistor temperature junction using a measure of the dissipator temperature only. The thermal transfers between the electric power applied to the transistor, the junction temperature, and the dissipator temperature are characterized by two fractional transfer functions. These models are then used in a Control Output Observer (COO) to estimate the transistor junction temperature.

Impact of clock drifts on CAN frame response time distributions

The response time distributions of the frames sent on a Controller Area Network (CAN) bus are of prime interest to dimension and validate automotive electronic architectures. However, the existing work on the timing behaviour of the CAN network does not take into account that all the data exchanges between the Electronic Control Units (ECUs) are driven by different and independent clocks which are subject to clock drifts. This paper proposes a model for clock drifts and describes their impact on the CAN frame response time distributions. By implementing the clock drifts in a CAN simulation tool, we show experimentally that the response time distributions converge, for drift values chosen randomly within the same range on all ECUs, whatever the initial phasings between the sending nodes. Furthermore, we show that, as a result of the clock drifts, the situations leading to the worst case response times are transient.

ENSURING HIGH QUALITY IN SPECIFICATIONS FOR AUTOMOTIVE EMBEDDED CONTROL SYSTEMS

Achieving confidence in safety, and robustness of complex systems is a key issue for an automotive manufacturer. Specifications are the first and crucial stage of the engineering process. The aim is to provide a high level of quality assurance for the specifications of systems incorporing several reused parts. This paper presents a method using an external modeling of the function supervision. We propose a framework based on modes analysis and a formal operation which allows to combine automaton descriptions of modes by adding logic commutations between modes.