We present an approach for deployment of real-time software in ECU networks enabling AUTOSAR-based design of fault-tolerant automotive systems. Deployment of software in a safety-critical distributed system implies appropriate mapping and scheduling of tasks and messages to fulfill hard real-time constraints. Additional safety requirements like deterministic communication and redundancy must be fulfilled to guarantee fault tolerance and dependability. Our approach is built on AUTOSAR methodology and enables redundancy for compensation of ECU failures to increase fault tolerance. Based on AUTOSAR-compliant modeling of real-time software, our approach determines an initial deployment combined with reconfigurations for remaining nodes at design time. To enable redundancy options, we propose a reconfigurable ECU network topology. Furthermore, we present a concept to detect failed nodes and activate reconfigurations by means of AUTOSAR.

In this paper we present an approach for the self reconfiguration of distributed micro-controllers for increased fault tolerance. Based on a modified distributed system topology utilizing a time division multiple access (TDMA) protocol, i.e., Flex Ray, we present a self-organized distributed coordinator concept which performs the self-reconfiguration in the case of node failures. We introduce a distributed coordinator, which utilizes redundant slots in the Flex Ray communication schedule and combines messages in configured protocol frames and slots to avoid a complete bus restart. As such, the self-reconfiguration is realized by means of predetermined information about resulting changes in the communication dependencies and (re-)assignments determined in the design phase. To retrieve the necessary information, we present an analytical approach, which determines a combined solution for the initial configuration and all possible reconfigurations for the remaining nodes of the Flex Ray network in case of node failures. Hence, through this method we can design self-reconfiguring network-based systems enabling the handling of node failures for an increased fault tolerance.

In this paper we present an approach for the configuration and reconfiguration of FlexRay networks to increase their fault tolerance. To guarantee a correct and deterministic system behavior, the FlexRay specification does not allow a reconfiguration of the schedule during run time. To avoid the necessity of a complete bus restart in case of a node failure, we propose a reconfiguration using redundant slots in the schedule and/or combine messages in existing frames and slots, to compensate node failures and increase robustness. Our approach supports the developer to increase the fault tolerance of the system during the design phase. It is a heuristic, which, additionally to a determined initial configuration, calculates possible reconfigurations for the remaining nodes of the FlexRay network in case of a node failure, to keep the system working properly. An evaluation by means of realistic safety-critical automotive real-time systems revealed that it determines valid reconfigurations for up to 80% of possible individual node failures. In summary, our approach offers major support for the developer of FlexRay networks since the results provide helpful feedback about reconfiguration capabilities. In an iterative design process these information can be used to determine and optimize valid reconfigurations.

In this paper we present an approach for the self-reconfiguration of FlexRay networks to increase their fault tolerance. We propose a self-organized distributed coordinator concept which performs the self-reconfiguration in case of a node failure using redundant slots in the FlexRay schedule and combination of messages in existing frames and slots to avoid a complete bus restart. Therefore, the self-reconfiguration is realized by means of predetermined information about resulting changes in the communication dependencies and (re-)assignments from a introduced heuristic, which determines initial configurations and, based on that, calculates valid reconfigurations for the remaining nodes of the FlexRay network. The distributed coordinator concept, which is implemented by lightweight tasks not consuming any significant resources, uses these information and performs the reconfiguration of the FlexRay network at run time to increase the fault tolerance of the system. An evaluation by means of realistic safety-critical automotive real-time systems revealed that this reconfiguration approach determines valid reconfigurations for up to 80% of possible individual node failures and thereby offers applicable information for the self-reconfiguration approach. Furthermore, in an iterative design process these results can be improved to optimize the reconfigurations. The evaluation of our self-organized distributed coordinator concept and the comparison to a centrally organzied solution with a dedicated coordinator proves its benefits regarding the additional hardware and communication overhead and the resulting reconfiguration time, which has an great impact on the fault tolerance of the FlexRay network.

In this paper we present new concepts to resolve ECU (Electronic Control Unit) failures in Flex Ray networks. Our approach extends the Flex Ray bus schedule by redundant slots with modifications in the communication and slot assignment. We introduce additional backup nodes to replace faulty nodes. To reduce the required memory resources of the backup nodes, we distribute redundant tasks over different nodes and propose the migration of tasks to the backup node at runtime. We investigate different solutions to migrate the redundant tasks to the backup node by time-triggered and event-triggered transmissions.

Safety-critical automotive systems must fulfill hard real-time constraints for reliability and safety. This paper presents a case study for the application of an AUTOSAR-based language for timing modeling and analysis. We present and apply the Timing Augmented Description Language (TADL) and demonstrate a methodology for the development of a speed-adaptive steer-by-wire system. We examine the impact of TADL and the methodology on the development process and the suitability and interoperability of the applied tools with respect to the AUTOSAR-based tool chain in the context of our case study.

In this paper we present an approach to increase the fault tolerance in FlexRay networks by introducing backup nodes to replace defect ECUs (Electronic Control Units). In order to reduce the memory requirements of such backup nodes, we distribute redundant tasks over different nodes and propose the distributed coordinated migration of tasks of the defect ECU to the backup node at runtime. This approach enhances our former work in, where we extended the FlexRay bus schedule by redundant slots to consider changes in the communication/slot assignment and investigated and evaluated different solutions to migrate the redundant tasks to the backup node using the static and/or dynamic segment of the communication cycle for transmissions. We present the approach of distributed coordination for migration and communication instead of additional dedicated coordinator nodes to further increase the fault tolerance. With this approach we improve the safety of FlexRay networks by avoiding a possible single point of failure due to a dedicated coordinator node also minimizing the necessary time needed for a reconfiguration after an ECU failure. Furthermore, we reduce the overhead within the communication and the demand for additional hardware components.

Safety-critical automotive systems must fulfill hard real-time constraints to guarantee their reliability and safety requirements. In the context of network-based electronics systems, high-level timing requirements have to be carefully mastered and traced throughout the whole development process. In this paper, we outline the management of scheduling-specific timing information by the application of a steer-by-wire design example. We apply the principles of the AUTOSAR-compliant Timing Augmented Description Language (TADL) following the methodology introduced by the TIMMO project [2]. Focus of the example will be the identification of end-to-end timing constraints and their refinement by means of stimuli-response event chains.

The upcoming IEEE 802.11e standard improves the Medium Access Control (MAC) of the legacy 802.11 with regard to Quality of Service (QoS) by introducing the Enhanced Distributed Channel Access (EDCA) and the HCF Controlled Channel Access (HCCA). EDCA achieves QoS by providing independent transmit queues and MAC parameters for each traffic class, and hence higher prioritized traffic has a higher probability for transmission. Crucial to the success of such a strategy is a scheduler that assigns the data traffic to the respective transmit queues. This paper develops and accommodates a new dynamic scheduler for EDCA into the MPEG-4 Delivery Framework. Experiments prove that the new scheduling policy timely delivers up to 50% more frames than statical scheduling solutions. To the best of our knowledge this is one of very few scheduling approaches that considers MPEG-4 related traffic priorization in EDCA.