Modern vehicles employ a large amount of distributed computation and require the underlying communication scheme to provide high bandwidth and low latency. Existing communication protocols like Controller Area Network (CAN) and FlexRay do not provide the required bandwidth, paving the way for adoption of Ethernet as the next generation network backbone for in-vehicle systems. Ethernet would co-exist with safety-critical communication on legacy networks, providing a scalable platform for evolving vehicular systems. This requires a high-performance network gateway that can simultaneously handle high bandwidth, low latency, and isolation; features that are not achievable with traditional processor based gateway implementations. We present VEGa, a configurable vehicular Ethernet gateway architecture utilising a hybrid FPGA to closely couple software control on a processor with dedicated switching circuit on the reconfigurable fabric. The fabric implements isolated interface ports and an accelerated routing mechanism, which can be controlled and monitored from software. Further, reconfigurability enables the switching behaviour to be altered at runtime under software control, while the configurable architecture allows easy adaptation to different vehicular architectures using highlevel parameter settings. We demonstrate the architecture on the Xilinx Zynq platform and evaluate the bandwidth, latency, and isolation using extensive tests in hardware.

FlexRay is a hybrid communication protocol tailored to the requirements in the automotive domain, supporting both time-triggered and event-triggered communication with high data-rates. The time-triggered static segment is commonly used for in-vehicle communication while the event-triggered dynamic segment is used for diagnostics and configuration. This paper addresses the problem of synthesizing schedules for the static FlexRay segment for asynchronous scheduling, following the design approach of current automotive architectures. Previous approaches largely focused on FlexRay 2.1 while the few existing approaches for FlexRay 3.0 are nonoptimal in several aspects. As a remedy, our framework makes use of all new features of version 3.0 while supporting the still predominantly used FlexRay 2.1, making it backward compatible. The following approaches are proposed: 1) a single-stage integer linear programming (ILP) approach that determines an optimal solution but does not scale; 2) a multistage ILP for combining previously generated subsystem schedules to a global schedule. It clearly improves the scalability but is not optimal. The multistage approach allows to integrate and convert existing FlexRay 2.1 schedules into a FlexRay 3.0 schedule which is important for legacy reasons, i.e., to reduce testing and certification efforts; 3) a greedy heuristic which scales well and obtains high quality solutions in comparison with the optimal solution, but is unsuitable to integrate existing schedules; and 4) metaheuristic approaches based on genetic algorithms or simulated annealing to evaluate the benefits of the proposed approaches.

Due to the growing interconnectedness and complexity of in-vehicle networks, in addition to safety, security is becoming an increasingly important topic in the automotive domain. In this paper, we study techniques for detecting security infringements in automotive electrical and electronic (E/E) architectures. Toward this we propose in-vehicle network traffic monitoring to detect increased transmission rates of manipulated message streams. Attacks causing timing violations can disrupt safety-critical functions and have severe consequences. To reduce costs and prevent single points of failure, our approach enables an automatic distribution of detection tasks among selected E/E architecture components, such as a subset of electronic control units. First, we analyze a concrete E/E system architecture to determine the communication parameters and properties necessary for detecting security attacks. These are then used for a parametrization of the corresponding detection algorithms and the distribution of attack detection tasks. We use a lightweight message monitoring method and optimize the placement of detection tasks to ensure a full-coverage of the E/E system architecture and a timely detection of an attack.

With the increasing amount of interconnections between vehicles, the attack surface of internal vehicle networks is rising steeply. Although these networks are shielded against external attacks, they often do not have any internal security to protect against malicious components or adversaries who can breach the network perimeter. To secure the in-vehicle network, all communicating components must be authenticated, and only authorized components should be allowed to send and receive messages. This is achieved through the use of an authentication framework. Cryptography is widely used to authenticate communicating parties and provide secure communication channels (e.g., Internet communication). However, the real-time performance requirements of in-vehicle networks restrict the types of cryptographic algorithms and protocols that may be used. In particular, asymmetric cryptography is computationally infeasible during vehicle operation. In this work, we address the challenges of designing authentication protocols for automotive systems. We present Lightweight Authentication for Secure Automotive Networks (LASAN), a full lifecycle authentication approach. We describe the core LASAN protocols and show how they protect the internal vehicle network while complying with the real-time constraints and low computational resources of this domain. By leveraging the fixed structure of automotive networks, we minimize bandwidth and computation requirements. Unlike previous work, we also explain how this framework can be integrated into all aspects of the automotive product lifecycle, including manufacturing, vehicle maintenance, and software updates. We evaluate LASAN in two different ways: First, we analyze the security properties of the protocols using established protocol verification techniques based on formal methods. Second, we evaluate the timing requirements of LASAN and compare these to other frameworks using a new highly modular discrete event simulator for in-vehicle networks, which we have developed for this evaluation.

High-voltage battery packs consist of series-connected lithium-ion cells and require sophisticated battery management systems (BMSs) to maintain safe operating conditions. Active cell balancing is an important task of a BMS, performed in order to improve the usable capacity of the battery pack by equalizing the charge levels of individual cells. With the emerging trend of distributed BMS topologies, the associated balancing architectures are required to be modular, consisting of homogeneous units that minimize integration efforts. In this paper, we propose a modular active charge balancing architecture along with its control scheme for implementation toward such distributed BMSs. Compared with existing approaches, our proposed architecture provides increased charge transfer capabilities, with reduced hardware and control complexity. We propose a closed-form analytical model of the balancing architecture, which can be used to perform fast system-level simulation studies and design space exploration for analyzing efficient device combinations. A hardware implementation of the proposed balancing architecture is developed and measurements made with it are used to validate each part of our analytical model. Using the validated analytical model, we performed a case study, which shows that our proposed architecture provides a 14.5 % improvement in charge transfer efficiency compared with existing approaches.

This paper presents an overview of recent trends in Battery System Management Architectures (BSMAs). After introducing the main characteristics of large battery packs, the state of the art in BSMAs is discussed. Two emerging concepts are in the focus of this contribution. On the one hand, there is a development from centralized battery management architectures with a single control entity towards decentralized management where the computational resources are distributed across the battery pack and, hence, move closer to the individual battery cells. This enables a more scalable and modular battery system architecture, while, at the same time, posing challenges regarding hardware and management algorithm design. On the other hand, the static setup of the series- and parallel-connected cells forming the battery pack may be developed towards a reconfigurable architecture such that the electrical topology of the pack can be adaptively changed. Such reconfigurability could increase the reliability of battery packs and reduce management efforts such as cell balancing. At the same time, limited energy efficiency of the additional hardware poses a challenge. We give an outlook how these two trends could be combined into distributed reconfigurable BSMAs. This introduces a set of challenges which have to be solved in order to benefit from the increased scalability, reliability and safety such designs could offer.

Large battery packs composed of Lithium-Ion cells are continuously gaining in importance due to their applications in Electric Vehicles (EVs) and smart energy grids. To ensure maximum lifetime, safety and performance of the battery pack, complex embedded system architectures consisting of sensors, power electronics and microcontrollers are integrated into the pack as Battery Management System (BMS). In this context, active cell balancing is a promising approach of the BMS to provide equal charge levels across the cells in the battery pack in an efficient manner. The design of such active cell balancing architectures, comprising circuits from the power electronics domain together with complex control schemes, is error-prone and tedious when done in the conventional manual fashion. This paper presents a design flow from a high-level requirements definition to an actual hardware implementation, using design automation approaches such as verification, synthesis and optimization. Here, graph-based models and algorithms from the domain of formal verification are applied to prove the system properties and are extended to enable synthesis of optimized and correct-by-construction active balancing circuit architectures.

The complex dynamic behavior of automotive software systems, in particular engine management, in combination with emerging multi-core execution platforms, significantly increased the problem space for timing analysis methods. As a result, the risk of divergence between academic research and industrial practice is currently increasing. Therefore, we provided a concrete automotive benchmark for the Formal Methods for Timing Verification (FMTV) challenge 2016 (https://waters2016.inria.fr/challenge/), a full blown performance model of a modern engine management system (downloadable at http://ecrts.eit.uni-kl.de/forum/viewtopic.php?f=27&t=62), with the goal to challenge existing timing analysis approaches with respect to their expressiveness and precision. In the demo session we will present the performance model of the engine management system using the Amalthea tool (http://www.amalthea-project.org/). Furthermore, we will show the model in action using professional timing tools such as from Symtavision (https://www.symtavision.com/), Timing Architects (http://www.timing-architects.com/), and Inchron (https://www.inchron.de/). Thereby, the focus will lie on determining tight end-to-end latency bounds for a set of given cause-effect chains. This is challenging since the dynamic behavior of a engine management software is quite complex and contains mechanisms that explore the limits of existing academic approaches: preemptive and cooperative priority based scheduling; periodic, sporadic, and engine synchronous tasks; multi-core platform with distributed cause-effect chains including cross-core communication; label (i.e. data) placement dependent execution times of runnables Overall the demo gives an impression of the current state-of-practice in industrial product development, and serves as baseline for further academic research.

Active balancing architectures effectively increase the efficiency of large battery packs by equalizing charge between cells. For this purpose, a balancing circuit and appropriate control scheme have to be designed to enable the charge transfer via energy storage elements such as inductors. Using a manual approach to design balancing architectures can be tedious and error-prone, resulting in potentially suboptimal solutions. As a remedy, this paper presents an automatic synthesis of balancing circuits and their corresponding control, optimizing the number of required metal-oxide-semiconductor field-effect transistors, and necessary control signals. The proposed synthesis combines a satisfiability solver to explore the search space with a graph-based verification that iteratively excludes infeasible solutions until the optimal architectures are obtained. The experimental results are carried out for three given template circuits and two signal templates. The synthesis results in architectures that are superior in terms of all design objectives in comparison to solutions from literature that result from a manual design approach.

Car manufacturers provide a growing variety of models and configuration options for customers. In the highly competitive and cost-driven automotive industry, managing these variants and increasing the reuse of functionality in different variants has therefore become one of the key challenges. This paper addresses the problem of generating variant schedules for time-triggered electrical/electronic-architectures. We propose a multischedule synthesis approach that determines the common parts of multiple variants and generates a schedule that exploits this commonality. Hence, a multischedule defines individual variant schedules with an identical schedule for applications common to different variants. This makes these applications variant-independent, thus, reduces the testing and integration efforts as it only has to be done once. Multischedule synthesis involves several challenges, viz., identification of commonality between different variants, schedule synthesis for common parts, and the integration of uncommon parts. Consequently, the schedule synthesis approach presented here is very different from conventional approaches. Finally, to address the increased complexity, we also propose a divide-and-conquer approach to partition the problem, improving the scalability.

Security in automotive in-vehicle networks is an increasing problem with the growing connectedness of road vehicles. This article proposes a security-aware priority assignment for automotive controller area network (CAN) platforms with the aim of mitigating scaling effects of attacks on vehicle fleets. CAN is the dominating field bus in the automotive domain due to its simplicity, low cost, and robustness. While messages might be encrypted to enhance the security of CAN systems, their priorities are usually identical for automotive platforms, comprising generally a large number of vehicle models. As a result, the identifier uniquely defines which message is sent, allowing attacks to scale across a fleet of vehicles with the same platform. As a remedy, we propose a methodology that is capable of determining obfuscated message identifiers for each individual vehicle. Since identifiers directly represent message priorities, the approach has to take the resulting response time variations into account while satisfying application deadlines for each vehicle schedule separately. Our approach relies on Quadratically Constrained Quadratic Program (QCQP) solving in two stages, specifying first a set of feasible fixed priorities and subsequently bounded priorities for each message. With the obtained bounds, obfuscated identifiers are determined, using a very fast randomized sampling. The experimental results, consisting of a large set of synthetic test cases and a realistic case study, give evidence of the efficiency of the proposed approach in terms of scalability. The results also show that the diversity of obtained identifiers is effectively optimized with our approach, resulting in a very good obfuscation of CAN messages in in-vehicle communication.

With the perennial demand for longer runtime of battery-powered Wireless Sensor Nodes (WSNs), several techniques have been proposed to increase the battery runtime. One such class of techniques exploiting the battery recovery effect phenomenon claims that performing an intermittent discharge instead of a continuous discharge will increase the usable battery capacity. Several works in the areas of embedded systems and wireless sensor networks have assumed the existence of this recovery effect and proposed different power management techniques in the form of power supply architectures (multiple battery setup) and communication protocols (burst mode transmission) in order to exploit it. However, until now, a systematic experimental evaluation of the recovery effect has not been performed with real battery cells, using high-accuracy battery testers to confirm the existence of this recovery phenomenon. In this article, a systematic evaluation procedure is developed to verify the existence of this battery recovery effect. Using our evaluation procedure, we investigated Alkaline, Nickel-Metal Hydride (NiMH), and Lithium-Ion (Li-Ion) battery chemistries, which are commonly used as power supplies for Wireless Sensor Node (WSN) applications. Our experimental results do not show any evidence of the aforementioned recovery effect in these battery chemistries. In particular, our results show a significant deviation from the stochastic battery models, which were used by many power management techniques. Therefore, the existing power management approaches that rely on this recovery effect do not hold in practice. Instead of a battery recovery effect, our experimental results show the existence of the rate capacity effect , which is the reduction of usable battery capacity with higher discharge power, to be the dominant electrochemical phenomenon that should be considered for maximizing the runtime of WSN applications. We outline power management techniques that minimize the rate capacity effect in order to obtain a higher energy output from the battery.

This article introduces a Cyber-physical Co-Simulation Framework (CPCSF) for design and analysis of smart cells that enable scalable battery pack and Battery Management System (BMS) architectures. In contrast to conventional cells in battery packs, where all cells are monitored and controlled centrally, each smart cell is equipped with its own electronics in the form of a Cell Management Unit (CMU). The CMU maintains the cell in a safe and healthy operating state, while system-level battery management functions are performed by cooperation of the smart cells via communication. Here, the smart cells collaborate in a self-organizing fashion without a central controller instance. This enables maximum scalability and modularity, significantly simplifying integration of battery packs. However, for this emerging architecture, system-level design methodologies and tools have not been investigated yet. By contrast, components are developed individually and then manually tested in a hardware development platform. Consequently, the systematic design of the hardware/software architecture of smart cells requires a cyber-physical multi-level co-simulation of the network of smart cells that has to include all the components from the software, electronic, electric, and electrochemical domains. This comprises distributed BMS algorithms running on the CMUs, the communication network, control circuitry, cell balancing hardware, and battery cell behavior. For this purpose, we introduce a CPCSF that enables rapid design and analysis of smart cell hardware/software architectures. Our framework is then applied to investigate request-driven active cell balancing strategies that make use of the decentralized system architecture. In an exhaustive analysis on a realistic 21.6kW h Electric Vehicle (EV) battery pack containing 96 smart cells in series, the CPCSF is able to simulate hundreds of balancing runs together with all system characteristics, using the proposed request-driven balancing strategies at highest accuracy within an overall time frame of several hours. Consequently, the presented CPCSF for the first time allows us to quantitatively and qualitatively analyze the behavior of smart cell architectures for real-world applications.

In the context of active cell balancing of electric vehicle battery cells, we deal with circuit architectures for inductor-based charge transfer and the corresponding high-level modeling and strategy development. In this work, we introduce a circuit architecture to transfer charge between arbitrarily many source and destination cells (many-to-many) for the first time and analyze the advantages over one-to-one transfer. Balancing simulation with numerical solvers remains challenging because of non-differentiable PWM signals, while the search space for high-level strategy design - crucial for time and energy efficiency - becomes even larger. Consequently, we develop a closed-form charge transfer model that extends state-of-the-art approaches and is three orders of magnitude faster than step-size controlled simulation. With an initial algorithm design based on experimentally derived rules, we demonstrate that many-to-many transfer dominates neighbor-only approaches in speed and efficiency even though it requires only one additional switch per circuit module.

Embedded systems are developed within a cost-driven process, such that many purpose-build systems share a common embedded platform. For instance, a shared hardware device might be applied in various use cases with different software. Here, the bare hardware is considered as platform while the final hardware/software system is the product that implements a certain set of features. In this paper, we propose an efficient design space exploration methodology that optimizes a set of embedded platforms. For this purpose, we separate the exploration into two stages: (1) A set of candidate platforms is determined within an optimization framework that can cope with different system models, considering the optimization objectives and feature coverage. (2) The final set of target platforms is determined as subset of the candidates by minimizing the expected objectives like cost, area, etc. The experimental results give evidence that our modular approach is more flexible and scalable than state-of-the-art methodologies.

This paper proposes a novel approach to security analysis of automotive architectures at the system-level. With an increasing amount of software and connectedness of cars, security challenges are emerging in the automotive domain. Our proposed approach enables assessment of the security of architecture variants and can be used by decision makers in the design process. First, the automotive Electronic Control Units (ECUs) and networks are modelled at the system-level using parameters per component, including an exploitability score and patching rates that are derived from an automated or manual assessment. For any specific architecture variant, a Continuous-Time Markov Chain (CTMC) model is determined and analyzed in terms of confidentiality, integrity and availability, using probabilistic model checking. The introduced case study demonstrates the applicability of our approach, enabling, for instance, the exploration of parameters like patch rate targets for ECU manufacturers.

The design process of safety-critical systems requires formal analysis methods to ensure their correct functionality without over-sized safety margins and extensive testing. For architectures with state-based events or scheduling, such as load-dependent frequency scaling, model checking has emerged as a promising tool. It formally verifies timing behavior of realtime systems with minimal over-approximation of the worst case delays. In this context, Event Count Automata (ECAs) have become a valuable modeling approach because they are specifically designed to handle typical arrival patterns and integrate well with analytic techniques. In this work, we propose an extension of the ECA framework's semantics and use it in a Fixed-Priority Non-preemptive Scheduling (FPNS) model that correctly abstracts the intra-slot behavior in the slotted-time model of the ECA. This is challenging because straightforward implementations cannot capture the full behavior of event-triggered scheduling with such a time model that the ECA shares with most model checking based methods. In a case study, we obtain bounds via model checking a basic model and then our proposed model. We compare these bounds with a SystemC simulation. This shows that the bounds from the basic model are too optimistic - and exceeded in practice - because it does not capture the full behavior, while the bounds from the proposed extended model are both safe and reasonably tight.

This paper presents a novel approach to detect resources in distributed systems with an increased occurrence of intermittent faults that exceed the amount of unavoidable transient faults caused by environmental phenomena. Intermittent faults occur due to stressed resources and often are a precursor of permanent faults. The proposed early fault detection and diagnosis allows the use of precautionary measures before the permanent failure of a component in a distributed system occurs. In this paper, we present four methods that can implicitly detect intermittent faults by taking the distributed applications and their dependencies into account. Thus, explicit tests are not required which would lead to additional costs and resource load. On the other hand, the implicit approach may considerably reduce the number of plausibility tests compared to the conservative solution with one test per resource. We analyzed and evaluated implementations of the proposed fault detection principle. The experimental results give evidence of the feasibility of our approach and show a comparison of the implemented methods in terms of runtime and detection rate.

Automotive Electrical/Electronic (E/E)-architectures consist of various components which are generally developed independently. Due to the increasing size and complexity, component integration is highly challenging and already slight modifications to components or subsystems often require expensive re-testing and re-validation. As a remedy, we propose a framework for modular architectures based on a data-centric description and a fully time-triggered scheduling. This modular design approach is enabled by a novel methodology for schedule integration where local schedules are defined independently for subsystems before being integrated into a global schedule. This divide-and-conquer approach significantly reduces the integration complexity while the system becomes highly composable. Our experimental results give evidence of the efficiency and versatility of the proposed approach, using networks based on a time-triggered automotive Ethernet.

This paper presents an approach to optimal dimensioning of active cell balancing architectures, which are of increasing relevance in Electrical Energy Storages (EESs) for Electric Vehicles (EVs) or stationary applications such as smart grids. Active cell balancing equalizes the state of charge of cells within a battery pack via charge transfers, increasing the effective capacity and lifetime. While optimization approaches have been introduced into the design process of several aspects of EESs, active cell balancing architectures have, until now, not been systematically optimized in terms of their components. Therefore, this paper analyzes existing architectures to develop design metrics for energy dissipation, installation volume, and balancing current. Based on these design metrics, a methodology to efficiently obtain Pareto-optimal configurations for a wide range of inductors and transistors at different balancing currents is developed. Our methodology is then applied to a case study, optimizing two state-of-the-art architectures using realistic balancing algorithms. The results give evidence of the applicability of systematic optimization in the domain of cell balancing, leading to higher energy efficiencies with minimized installation space.

As time-triggered communication protocols [e.g., time-triggered controller area network (TTCAN), time-triggered protocol (TTP), and FlexRay] are widely used on vehicles, the scheduling of tasks and messages on in-vehicle networks becomes a critical issue for offering quality-of-service (QoS) guarantees to time-critical applications on vehicles. This paper studies a holistic scheduling problem for handling real-time applications in time-triggered in-vehicle networks where practical aspects in system design and integration are captured. The contributions of this paper are multifold. First, it designs a novel scheduling algorithm, referred to asUnfixed Start Time(UST) algorithm, which schedules tasks and messages in a flexible way to enhance schedulability. In addition, to tolerate assignment conflicts and further improve schedulability, it proposes two rescheduling and backtracking methods, namely,Rescheduling with Offset Modification(ROM) andBacktracking and Priority Promotion(BPP) procedures. Extensive performance evaluation studies are conducted to quantify the performance of the proposed algorithm under a variety of scenarios.

We study distributed controllers where sensor, controller, and actuator tasks are mapped onto different processors or Electronic Control Units (ECUs) in a distributed automotive architecture, communicating via a shared bus. Controllers in such setups are designed with a sampling period equal to the worst-case sensor-to-actuator message delay. However, this assumption of all messages having to meet their deadlines is too pessimistic. The inherent robustness of most controllers allows some of the messages to miss their deadlines, while still meeting specified control performance constraints. Given a controller, in this paper we first quantify the frequency of its acceptable deadline misses and represent this as a Linear Temporal Logic (LTL) formula. Further, we model the distributed architecture as a network of Time-Stamped Event Count Automata (TS-ECAs). Such a network of TS-ECAs is then model-checked to verify whether it satisfies the LTL formula. The verification ensures that the controller may be mapped onto the architecture and the control performance constraints will be satisfied. We have implemented this methodology in Symbolic Analysis Laboratory (SAL), which is a well-known framework combining different tools for system verification. Our implementation and case studies using standard controller design shows the applicability of our proposed controller/architecture co-verification. It represents a significant improvement in current design flows where, although controller models are formally verified, their implementation on a distributed architecture is done in an ad hoc fashion with extensive testing and integration effort.

This paper presents a framework for schedule integration of time-triggered systems tailored to the automotive domain. In-vehicle networks might be very large and complex and hence obtaining a schedule for a fully synchronous system becomes a challenging task since all bus and processor constraints as well as end-to-end-timing constraints have to be taken concurrently into account. Existing optimization approaches apply the schedule optimization to the entire network, limiting their application due to scalability issues. In contrast, the presented framework obtains the schedule for the entire network, using a two-step approach where for each cluster a local schedule is obtained first and the local schedules are then merged to the global schedule. This approach is also in accordance with the design process in the automotive industry where different subsystems are developed independently to reduce the design complexity and are finally combined in the integration stage. In this paper, a generic framework for schedule integration of time-triggered systems is presented. Further, we show how this framework is implemented for a FlexRay network using an Integer Linear Programming (ILP) approach which might also be easily adapted to other protocols. A realistic case study and a scalability analysis give evidence of the applicability and efficiency of our approach.

Most innovations in the automotive domain are realized by electronics and software. Modern cars have up to 100 Electronic Control Units (ECUs) that implement a variety of control applications in a distributed fashion. The tasks are mapped onto different ECUs, communicating via a heterogeneous network, comprising communication buses like CAN, FlexRay, and Ethernet. For electric vehicles, software functions play an essential role, replacing hydraulic and mechanic control systems. While model-based software development and verification are already used extensively in the automotive domain, their importance significantly increases in electric vehicles as safety-critical functions might no longer rely on mechanical (fall-back) solutions. The need for reducing costs, size, and weight in electric vehicles has also resulted in a considerable interest in topics such as the consolidation of ECUs as well as efficient implementation of control software. In this paper we discuss two broad issues related to model-based software development and verification in electric vehicles. The first is concerned with how to ensure that model-level semantics are preserved in an implementation, which has important implications on the verification and certification of control software. The second issue is related to techniques for reducing the computational and communication demands of distributed automotive control algorithms. For both these topics we provide a broad introduction to the problem followed by a discussion on state-of-the-art techniques.

This paper proposes a novel modular architecture for Electrical Energy Storages (EESs), consisting of multiple series-connected cells. In contrast to state-of-the-art architectures, the presented approach significantly improves the energy utilization, safety, and availability of EESs. For this purpose, each cell is equipped with a circuit that enables an individual control within a homogeneous architecture. One major advantage of our approach is a direct and concurrent charge transfer between each cell of the EES using inductors. To enable a system-level modeling and performance analysis of the architecture, a detailed investigation of the components and their interaction with the Pulse Width Modulation (PWM) control was performed at transistor-level. At system-level, we propose a control algorithm for the charge transfer that aims at minimizing the energy loss and balancing time. The results give evidence of the significant advantages of our architecture over existing passive and active balancing methods in terms of energy efficiency and charge equalization time.

This paper gives an overview of the system architecture and software design challenges for Electric Vehicles (EVs). First, we introduce the EV-specific components and their control, considering the battery, electric motor, and electric powertrain. Moreover, technologies that will help to advance safety and energy efficiency of EVs such as drive-by-wire and information systems are discussed. Regarding the system architecture, we present challenges in the domain of communication and computation platforms. A paradigm shift towards time-triggered in-vehicle communication systems becomes inevitable for the sake of determinism, making the introduction of new bus systems and protocols necessary. At the same time, novel computational devices promise high processing power at low cost which will make a reduction in the number of Electronic Control Units (ECUs) possible. As a result, the software design has to be performed in a holistic manner, considering the controlled component while transparently abstracting the underlying hardware architecture. For this purpose, we show how middleware and verification techniques can help to reduce the design and test complexity. At the same time, with the growing connectivity of EVs, security has to become a major design objective, considering possible threats and a security-aware design as discussed in this paper.

This paper presents a methodology based on mathematical programming for the priority assignment of processes and messages in event-triggered systems with tight end-to-end real-time deadlines. For this purpose, the problem is converted into a Quadratically Constrained Quadratic Program (QCQP) and addressed with a state-of-the-art solver. The formulation includes preemptive as well as non-preemptive schedulers and avoids cyclic dependencies that may lead to intractable real-time analysis problems. For problems with stringent real-time requirements, the proposed mathematical programming method is capable of finding a feasible solution efficiently where other approaches suffer from a poor scalability. In case there exists no feasible solution, an algorithm is presented that uses the proposed method to find a minimal reason for the infeasibility which may be used as a feedback to the designer. To give evidence of the scalability of the proposed method and in order to show the clear benefit over existing approaches, a set of synthetic test cases is evaluated. Finally, a large realistic case study is introduced and solved, showing the applicability of the proposed method in the automotive domain.

This paper is an introduction to security challenges for the design of automotive hardware/software architectures. State-of-the-art automotive architectures are highly heterogeneous and complex systems that rely on distributed functions based on electronics and software. As cars are getting more connected with their environment, the vulnerability to attacks is rapidly growing. Examples for such wireless communication are keyless entry systems, WiFi, or Bluetooth. Despite this increasing vulnerability, the design of automotive architectures is still mainly driven by safety and cost issues rather than security. In this paper, we present potential threats and vulnerabilities, and outline upcoming security challenges in automotive architectures. In particular, we discuss the challenges arising in electric vehicles, like the vulnerability to attacks involving tampering with the battery safety. Finally, we discuss future automotive architectures based on Ethernet/IP and how formal verification methods might be used to increase their security.

Safety-critical in-vehicle electronic control units (ECUs) demand high levels of determinism and isolation, since they directly influence vehicle behaviour and passenger safety. As modern vehicles incorporate more complex computational systems, ensuring the safety of critical systems becomes paramount. One-to-one redundant units have been previously proposed as measures for evolving critical functions like x-by-wire. However, these may not be viable solutions for power-constrained systems like next generation electric vehicles. Reconfigurable architectures offer alternative approaches to implementing reliable safety critical systems using more efficient hardware. In this paper, we present an approach for implementing redundancy in safety-critical in-car systems, that uses FPGA partial reconfiguration and a customised bus controller to offer fast recovery from faults. Results show that such an integrated design is better than alternatives that use discrete bus interface modules.

Automotive systems comprise a high number of networked safety-critical functions. Any design changes or addition of new functionality must be rigorously tested to ensure that no performance or safety issues are introduced, and this consumes a significant amount of time. Validation should be conducted using a faithful representation of the system, and so typically, a full subsystem is built for validation. We present a scalable scheme for emulating a complete cluster of automotive embedded compute units on an FPGA, with accelerated network communication using custom physical level interfaces. With these interfaces, we can achieve acceleration of system emulation by 8× or more, with a systematic way of exploring real-world issues like jitter, network delays, and data corruption, among others. By using the same communication infrastructure as in a real deployed system, this validation is closer to the requirements of standards compliance. This approach also enables hardware-in-the-loop (HIL) validation, allowing rapid prototyping of distributed functions, including changes in network topology and parameters, and modification of time-triggered schedules without physical hardware modification. We present an implementation of this framework on the Xilinx ML605 evaluation board that integrates six FlexRay automotive functions to demonstrate the potential of the framework.

This paper proposes a modular framework that enables a scheduling for time-triggered distributed embedded systems. The framework provides a symbolic representation that is used by an Integer Linear Programming (ILP) solver to determine a schedule that respects all bus and processor constraints as well as end-to-end timing constraints. Unlike other approaches, the proposed technique complies with automotive specific requirements at system-level and is fully extensible. Formulations for common time-triggered automotive operating systems and bus systems are presented. The proposed model supports the automotive bus systems FlexRay 2.1 and 3.0. For the operating systems, formulations for an eCos-based non-preemptive component and a preemptive OSEKtime operating system are introduced. A case study from the automotive domain gives evidence of the applicability of the proposed approach by scheduling multiple distributed control functions concurrently. Finally, a scalability analysis is carried out with synthetic test cases.

The design of electric vehicles require a complete paradigm shift in terms of embedded systems architectures and software design techniques that are followed within the conventional automotive systems domain. It is increasingly being realized that the evolutionary approach of replacing the engine of a car by an electric engine will not be able to address issues like acceptable vehicle range, battery lifetime performance, battery management techniques, costs and weight, which are the core issues for the success of electric vehicles. While battery technology has crucial importance in the domain of electric vehicles, how these batteries are used and managed pose new problems in the area of embedded systems architecture and software for electric vehicles. At the same time, the communication and computation design challenges in electric vehicles also have to be addressed appropriately. This paper discusses some of these research challenges.

We present an automatic schedule synthesis framework for applications that are mapped onto distributed time-triggered automotive platforms where multiple Electronic Control Units (ECUs) are synchronized over a FlexRay bus. We classify applications into two categories (i) safety-critical control applications with stability and performance constraints, and (ii) time-critical applications with only deadline constraints. Our proposed framework can handle such mixed constraints arising from timing, control stability, and performance requirements. In particular, we synthesize schedules that optimize control performance and respects the timing requirements of the real-time applications. An Integer Linear Programming (ILP) problem is formulated by modeling the ECU and bus schedules as a set of constraints for optimizing both linear or quadratic control performance functions.

FlexRay is likely to become the de-facto standard for upcoming in-vehicle communication. Efficient scheduling of the static and dynamic segment of the communication cycle in combination with the determination of more than 60 parameters that are part of the FlexRay protocol is a challenging task. This paper provides a formal analysis for interdependencies between the parameters as well as a scheduling approach for the static and dynamic segment. Experimental results give evidence of a significant interdependency between the subtasks such that a holistic scheduling approach becomes mandatory to provide high-quality FlexRay schedules. As a solution, this work introduces a complete functional FlexRay scheduling approach that takes parameter selection, allocation of messages to the static and dynamic segment, and concurrent scheduling into account. A real-world case study from the automotive domain gives evidence of efficiency and applicability of the proposed approach.

Electric vehicles are emerging as a solution to environmental changes and transportation challenges in growing mega-cities. Compared to combustion engine vehicles, electric vehicles bring along new challenges in the CPS design. This paper gives an overview of several of these challenges and presents initial and potential solutions for the design of the electric powertrain and E/E architectures for electric vehicles. The powertrain consists of multiple complex CPS such as the battery, the electric motor, and a distributed energy management system. These components require a complex monitoring and control in order to guarantee safety and maintain a high efficiency. For this purpose, novel E/E architectures become necessary that facilitate a predictable distributed computation and communication, requiring a paradigm shift towards fully time-triggered systems. These E/E architectures will also enable novel CPS such as innovative driver assistance systems, x-by-wire control to further increase the safety and energy-efficiency of electric vehicles, and a pervasive interaction of the vehicle and the grid. Instead of focusing on the specific applications, this paper describes the prerequisite architectural changes that are necessary to implement these novel functions.

Stringent real-time constraints lead to complex search spaces containing only very few or even no valid implementations. Hence, while searching for a valid implementation a substantial amount of time is spent on timing analysis during system synthesis. This paper presents a novel system synthesis approach that efficiently prunes the search space in case real-time constraints are violated. For this purpose, the reason for a constraint violation is analyzed and a deduced encoding removes it permanently from the search space. Thus, the approach is capable of proving both the presence and absence of a correct implementation. The key benefit of the proposed approach stems from its integral support for real-time constraint checking. Its efficiency, however, results from the power of deduction techniques of state-of-the-art Boolean Satisfiability (SAT) solvers. Using a case study from the automotive domain, experiments show that the proposed system synthesis approach is able to find valid implementations where former approaches fail. Moreover, it is up to two orders of magnitude faster compared to a state-of-the-art approach.

It is projected that the communication data volume in electric vehicles will significantly increase compared to state-of-the-art vehicles due to additional functionalities like x-by-wire and safety functions. This paper presents a networking concept for electric vehicles to cope with the high data volume in cases where a single FlexRay bus is not sufficient. We present a FlexRay switch concept that is capable of increasing the effective bandwidth and improving the safety of existing FlexRay buses. A prototype FPGA implementation shows the feasibility of our approach. Further, a scheduling approach for the FlexRay switch that obtains the optimal results based on Integer Linear Programming (ILP) is presented. Since the ILP approach becomes intractable for real-world problems, we present a heuristic three-step approach that determines the branches of the network, performs a local scheduling for each node, and finally assembles the local schedules into a global schedule. Test cases and an entire realistic in-vehicle network are used to emphasize the benefits of the proposed approach.

High-end cars today consist of more than 100 electronic control units (ECUs) that are connected to a set of sensors and actuators and run multiple distributed control applications. The design flow of such architectures consists of specifying control applications as Simulink/Stateflow models, followed by generating code from them and finally mapping such code onto multiple ECUs. In addition, the scheduling policies and parameters on both the ECUs and the communication buses over which they communicate also need to be specified. These policies and parameters are computed from high-level timing and control performance constraints. The proposed tutorial will cover different aspects of this design flow, with a focus on timing and schedulability problems. After reviewing the basic concepts of worst-case execution time analysis and schedulability analysis, we will discuss the differences between meeting timing constraints (as in classical real-time systems) and meeting control performance constraints (e.g., stability, steady and transient state performance). We will then describe various control performance related schedulability analysis techniques and how they may be tied to model-based software development. Finally, we will discuss various schedule synthesis techniques, both for ECUs as well as for communication protocols like FlexRay, so that control performance constraints specified at the model-level may be satisfied. Throughout the tutorial different commercial as well as academic tools will be discussed and demonstrated.

This paper presents a modular framework for meta-heuristic optimization of complex optimization tasks by decomposing them into subtasks that may be designed and developed separately. Since these subtasks are generally correlated, a separate optimization is prohibited and the framework has to be capable of optimizing the subtasks concurrently. For this purpose, a distinction of genetic representation (genotype) and representation of a solution of the optimization problem (phenotype) is imposed. A compositional genotype and appropriate operators enable the separate development and testing of the optimization of subtasks by a strict decoupling. The proposed concept is implemented as open source reference OPT4J [6]. The architecture of this implementation is outlined and design decisions are discussed that enable a maximal decoupling and flexibility. A case study of a complex real-world optimization problem from the automotive domain is introduced. This case study requires the concurrent optimization of several heterogeneous aspects. Exemplary, it is shown how the proposed framework allows to efficiently optimize this complex problem by decomposing it into subtasks that are optimized concurrently.

State-of-the-art automatic reliability analyses as used in system-level design approaches mainly rely on Binary Decision Diagrams (BDDs) and, thus, face two serious problems: (1) The BDDs exhaust available memory during their construction and/or (2) the final size of the BDDs is, sometimes up to several orders of magnitude, larger than the available memory. The contribution of this paper is twofold: (1) A partitioning-based early quantification technique is presented that aims to keep the size of the BDDs during construction at minimum. (2) A SAT-assisted simulation approach aims to deliver approximated results when exact analysis techniques fail because the final BDDs exhaust available memory. The ability of both methods to accurately analyze larger and more complex systems than known approaches is demonstrated for various test cases.

This paper presents a methodology to evaluate and optimize the robustness of an embedded system in terms of invariability in case of design revisions. Early decisions in embedded system design may be revised in later stages resulting in additional costs. A method that quantifies the expected additional costs as the robustness value is proposed. Since the determination of the robustness based on arbitrary revisions is computationally expensive, an efficient set-based approach that uses a symbolic encoding as Binary Decision Diagrams is presented. Moreover, a methodology for the integration of the optimization of the robustness into a design space exploration is proposed. Based on an external archive that accepts also near-optimal solutions, this robustness-aware optimization is efficient since it does not require additional function evaluations as previous approaches. Two realistic case studies give evidence of the benefits of the proposed approach.

With the continued demand for more and innovative functions in series automobiles, significantly higher data-rates and more reliable communication are necessary than traditional automotive bus systems, e.g., the controller area network (CAN), provide. In this paper, we present a novel hardware device for FlexRay networks, which splits the bus into separate branches and operates as a selective central switch. The proposed device is capable of increasing both the available bandwidth and safety of existing FlexRay networks. The bandwidth is increased by enabling the scheduling of multiple messages in parallel on disjoint sets of branches. The device can furthermore serve as a central bus guardian (CBG), protecting the majority of the participants on the network from so-called babbling idiots and short circuits, by isolating a faulty component on its respective branch. The proposed device is fully compatible with the existing FlexRay specifications and transparently extends a system, requiring no modifications to the existing FlexRay bus participants. The architectural challenges of a FlexRay switch/CBG, its subsequent proof-of-concept implementation on an FPGA-platform, and our experimental results are described in detail.

More and more embedded systems provide a multitude of services, implemented by a large number of networked hardware components. In early design phases, dimensioning such complex systems in terms of monetary costs, power consumption, reliability etc. demands for new analysis approaches at the electronic system level. In this paper, two symbolic system level reliability analysis approaches are introduced. First, a formal approach based on Binary Decision Diagrams is presented that allows to calculate exact reliability measures for small to moderate-sized systems. Second, a simulative approach is presented that hybridizes a Monte Carlo simulation with a SAT solver and delivers adequate approximations of the reliability measures for large and complex systems.

In this paper, a design method for automotive architectures is proposed. The two main technical contributions are (i) a novel hardware/software architecture encoding that unifies a number of design steps, i.e., resource allocation, process binding, message routing, scheduling, and parameter estimation for the processor and bus schedulers, and (ii) a hybrid scheme that allows different timing analysis techniques to be applied to different bus protocols (viz., CAN and FlexRay) within the same architecture in order to derive global performance estimates such as end-to-end delays of messages. The use of the compact encoding technique substantially reduces the underlying search space, and the hybrid timing analysis scheme allows the combination of known timing analysis techniques from the real-time systems domain. The proposed techniques were combined into a tool-chain and a real-life case study to illustrate their advantages.

In this work, the focus is put on the behavior of a system in case a fault occurs that disables the system from executing its applications. Instead of executing a random subset of the applications depending on the fault, an approach is presented that optimizes the systems structure and behavior with respect to a possible graceful degradation. It includes a degradation-aware reliability analysis that guides the optimization of the resource allocation and function distribution, and provides data-structures for an efficient online degradation algorithm. Thus, the proposed methodology covers both, the design phase with a structural optimization and the online phase with a behavioral optimization of the system. A case study shows the effectiveness of the proposed approach.

A novel design space exploration approach is proposed that enables a concurrent optimization of the topology, the process binding, and the communication routing of a system. Given an application model written in SystemC TLM 2.0, the proposed approach performs a fully automatic optimization by a simultaneous resource allocation, task binding, data mapping, and transaction routing for MPSoC platforms. To cope with the huge complexity of the design space, a transformation of the transaction level model to a graph-based model and symbolic representation that allows multi-objective optimization is presented. Results from optimizing a Motion-JPEG decoder illustrate the effectiveness of the proposed approach.

Nowadays many design space exploration tools are based on Multi-Objective Evolutionary Algorithms (MOEAs). Beside the advantages of MOEAs, there is one important drawback as MOEAs might fail in design spaces containing only a few feasible solutions or as they are often afflicted with premature convergence, i.e., the same design points are revisited again and again. Exact methods, especially Pseudo Boolean solvers (PB solvers) seem to be a solution. However, as typical design spaces are multi-objective, there is a need for multi-objective PB solvers. In this paper, we will formalize the problem of design space exploration as multi-objective 0-1 ILP. We will propose (1) a heuristic approach based on PB solvers and (2) a complete multi-objective PB solver based on a backtracking algorithm that incorporates the non-dominance relation from multi-objective optimization and is restricted to linear objective functions. First results from applying our novel multi-objective PB solver to synthetic problems will show its effectiveness in small sized design spaces as well as in large design spaces only containing a few feasible solutions. For non-linear and large problems, the proposed heuristic approach is outperforming common MOEA approaches. Finally, a real world example from the automotive area will emphasize the efficiency of the proposed algorithms.

Meta-heuristic optimization approaches are commonly applied to many discrete optimization problems. Many of these optimization approaches are based on a local search operator like, e.g., the mutate or neighbor operator that are used in evolution strategies or simulated annealing, respectively. However, the straightforward implementations of these operators tend to deliver infeasible solutions in constrained optimization problems leading to a poor convergence. In this paper, a novel scheme for a local search operator for discrete constrained optimization problems is presented. By using a sophisticated methodology incorporating a backtracking-based ILP solver, the local search operator preserves the feasibility also on hard constrained problems. In detail, an implementation of the local serach operator as a feasibility-preserving mutate and neighbor operator is presented. To validate the usability of this approach, scalable discrete constrained testcases are introduced that allow to calculate the expected number of feasible solutions. Thus, the hardness of the testcases can be quantified. Hence, a sound comparison of different optimization methodologies is presented.

In this paper, a novel automatic approach for the concurrent topology and routing optimization that achieves a high quality network layout is proposed. This optimization is based on a specialized binary Integer Linear Program (ILP) in combination with a Multi-Objective Evolutionary Algorithm (MOEA). The ILP is formulated such that each solution represents a topology and routing that fulfills all requirements and demands of the network. Thus, in an iterative process, this ILP is solved to obtain feasible networks whereas the MOEA is used for the optimization of multiple even non-linear objectives and ensures a fast convergence towards the optimal solutions. Additionally, a domain specific preprocessing algorithm for the ILP is presented that decreases the problem complexity and, thus, allows to optimize large and complex networks efficiently. The experimental results validate the performance of this methodology on two state-of-the-art prototype automotive networks.

Increasing reliability at a minimum amount of extra cost is a major challenge in todays ECU network design. Considering reliability as an objective already in early design phases has the potential to avoid expensive modifications in later design phases. Hence, there is a need for an appropriate optimization process and efficient analysis techniques to evaluate the found implementations. In this paper, we will show how symbolic techniques can be used to efficiently analyze and optimize such reliable systems. The contribution of this paper is (1) a symbolic reliability analysis that makes use of a partitioned structure function and (2) a symbolic optimization process based on binary ILP solvers. Our case study from the automotive area will show a significant speed-up using our analysis technique. Moreover, our optimization approach is able to offer implementations with considerably improved reliability at no additional costs as well as implementations with reduced costs without decreasing their reliability.

For complex optimization problems, several population-based heuristics like Multi-Objective Evolutionary Algorithms have been developed. These algorithms are aiming to deliver sufficiently good solutions in an acceptable time. However, for discrete problems that are restricted by several constraints it is mostly a hard problem to even find a single feasible solution. In these cases, the optimization heuristics typically perform poorly as they mainly focus on searching feasible solutions rather than optimizing the objectives. In this paper, we propose a novel methodology to obtain feasible solutions from constrained discrete problems in population- based optimization heuristics. At this juncture, the constraints have to be converted into the Prepositional Satisfiability Problem (SAT). Obtaining a feasible solution is done by the DPLL algorithm which is the core of most modern SAT solvers. It is shown in detail how this methodology is implemented in Multi-objective Evolutionary Algorithms. The SAT solver is used to obtain feasible solutions from the genetic encoded information on arbitrarily hard solvable problems where common methods like penalty functions or repair strategies are failing. Handmade test cases are used to compare various configurations of the SAT solver. On an industrial example, the proposed methodology is compared to common strategies which are used to obtain feasible solutions.