Pi Technology has been working on hybrid propulsion systems for its various customers for several years, including the Ford Fuel Cell Focus and Hybrid Escape. The systems we have worked on cover a wide range of technologies, from fuel cell/battery and engine/battery systems to hydraulic based systems. As a result we are only too aware of the multitude of issues that need to be addressed. Each of the systems when viewed in isolation appears to be completely different to each of the others; however, we have found this not to be the case, in that common architectural challenges have emerged from each system. In this paper we review the issues we encountered on two early hybrid projects and discuss our experimental efforts at creating a unified control strategy framework for combining different components, in a way that provides a consistency of view between the individual subsystems and the system as a whole. We then go on to examine how we applied this experience to a hydraulic hybrid vehicle, and to some of the novel issues that such systems possess.

Pi Technology and the Ford Motor Company are using MATLAB Simulink/Stateflow model based design and automatic code generation in C, for the main software development for three electronic control units targeted at the FordFocus fuel cell vehicle. The automatic generation of code for embedded automotive applications offers a number of potential advantages over traditional methods. These include faster development, the avoidance of coding errors and avoiding inconsistencies with the design specification. However, the use of automatically generated code in production-intent safety-related systems requires at least the same standard of validation and verification. If code generation were perfect, one could validate only the design. However, it is impractical to require that the code generator must be validated for all possible input designs. Furthermore it must be assumed that the compiler and the hardware can also introduce faults. Therefore we adopt the approach of testing output code for the particular designs we wish to implement, in the same manner as we would test hand-written code for production systems [1]. This retains the additional benefits of exposing the design to further detailed scrutiny in test preparation, and encouraging designs that are straightforward to test. This paper discusses the development lifecycle employed on this project, highlighting the particular benefits, issues, and challenges surrounding the use of automatically generated code for these production-quality safety-related automotive controllers.