Ensuring fail-operational behavior is critical to enable autonomous driving. With the absence of a driver as a fallback in a failure scenario it will not be sufficient to use state-of-the-art fail-safe approaches. Here, instead of costly hardware redundancy, graceful-degradation can be used by repurposing the allocated resources of non-critical applications for safety-critical applications. However, solving the mapping problem with a state-of-the-art design-time analysis leads to semi-static solutions, where the mapping is fixed and the task activation is chosen at run-time. Therefore, such solutions are unsuited for future automotive architectures that will be highly customizable and which will include frequent software updates. In this paper we introduce and analyze the effectiveness of an agent-based approach that finds application mappings at run-time, ensures the fail-operational behaviour of safety-critical applications by using graceful degradation, and reconfigures itself after ECU failures. Our results indicate that the number of tolerated ECU failures until a safety-critical application fails can be significantly improved without adding any redundant hardware resources.

Dividing the communication network into so-called Virtual Local Area Networks (VLANs), i.e., subnetworks that are isolated at the data link layer (OSI layer 2), is a promising approach to address the increasing security challenges in automotive networks. The automation of the VLAN partitioning is a well-researched problem in the domain of local or metropolitan area networks. However, the approaches used there are hardly applicable for the design of automotive networks as they mainly focus on reducing the amount of broadcast traffic and cannot capture the many design objectives of automotive networks like the message timing or the link load, which are affected by the VLAN partitioning. As a remedy, this article proposes an approach based on a set of Pseudo-Boolean constraints to generate a message routing which is feasible with respect to the VLAN-related routing restrictions in automotive networks. This approach can be used for a design space exploration to optimize not only the VLAN partitioning but also other routing-related objectives. We demonstrate both the efficiency of our message routing approach and the now accessible optimization potential for the complete Electric/Electronic architecture with a mixed-criticality system from the automotive domain. There we thoroughly investigate the impact of the VLAN partitioning on the message timing and the link loads by optimizing these design objectives concurrently. During the exploration of the huge design space, where each resource can be assigned to one of four VLANs, our approach requires less than 40ms for the creation of a valid solution and ensures that all messages satisfy their deadlines and link load bounds.

To cope with the strict reliability requirements of safety-critical ADAS applications, the upcoming TSN standard introduces mechanisms that enable transmission redundancy at any switch or end node. However, it is up to the designer to decide at which points and for which messages to activate transmission redundancy. This significantly increases the design space and requires to trade-off reliability with other routing-related design objectives like network load, transmission timing, or the monetary cost of the hardware. As a remedy, this paper a) presents two different exact approaches to generate feasible redundant message routings and b) proposes an extension of the state-of-the-art approach for the multi-objective routing optimization, enabling the optimizer to directly adjust system features that are relevant for the design objectives. A case study with an application from the automotive domain compares the optimization capabilities of the presented approaches for the routing generation and demonstrates the significant gain in optimization power that is achieved with the proposed optimization extension.

Current automotive E/E architectures are comprised of hardware and software and are mostly designed in a monolithic approach, static over the lifetime of the vehicle. Design, implementation and updates are mostly performed on a per-component-basis, exchanging complete Electronic Control Units (ECUs) or their software image as a whole. With an increasing amount of functionality being realized in software, the benefits of software can be used increasingly. This includes modularization of components, which forms the basis for updates and addition of functions. Additionally, this modularization allows the consolidation of ECUs and supports a higher level of integration. Such modularization and dynamic behavior over the lifetime of a vehicle feet, as well as a single vehicle does, however, hold a lot of challenges for safety-critical systems. Safety-critical systems, such as cars, require their behavior to be deterministic. The design of such modular systems needs to consider and cope with uncertainties in modular architectures. This paper highlights some of the dimensions of uncertainty, which will exist in future E/E architectures and presents initial approaches on how to manage these.

Upcoming high-bandwidth protocols like Ethernet TSN feature mechanisms for redundant and deterministic (scheduled) message delivery to integrate safety- and real-time--critical applications and, thus, realize mixed-criticality systems. In existing design approaches, the message routing and system scheduling are generated in two entirely separated design steps, ignoring and/or not exploiting the distinct interrelations between routing and scheduling decisions. In this paper, we first introduce an exact approach to generate an implementation with a valid routing and a valid schedule in a single step by solving a 0-1 ILP. Second, we show that the 0-1 ILP formulation can be utilized in a design space exploration to optimize the routing and schedule with respect to, e.g., interference imposed on non-scheduled traffic or the number of configured port slots. We demonstrate the optimization potential of the proposed approach using a mixed-criticality system from the automotive domain.

To cope with requirements for low latency, the upcoming Ethernet standard Time-Sensitive Networking (TSN) provides enhancements for scheduled traffic, enabling mixed-criticality networks where critical messages are sent according to a system-wide schedule. While these networks provide a completely predictable behavior of the scheduled traffic by construction, timing analysis of the critical non-scheduled traffic with hard deadlines remains an unsolved issue. State-of-the-art analysis approaches consider the interference that unscheduled messages impose on each other, but there is currently no approach to determine the worst-case interference that can be imposed by scheduled traffic, the so-called schedule interference (SI), without relying on restrictions of the shape of the schedule. Considering all possible interference scenarios during each calculation of the SI is impractical, as it results in an explosion of the computation time. As a remedy, this paper proposes a) an approach to integrate the analysis of the worst-case SI into state-of-the-art timing analysis approaches and b) preprocessing techniques that reduce the computation time of the SI-calculation by several orders of magnitude without introducing any pessimism.

Modern cars integrate a huge number of functionalities with high bandwidth, real-time, and reliability requirements. Ethernet offers the possibility to satisfy these bandwidth requirements and enables the usage of temporal redundancy mechanisms to increase the reliability of the communication network. In this paper, we present a lightweight formal analysis approach for the determination of the transmission reliability of messages in switched Ethernet networks under the influence of transient errors. In particular, this approach takes the interrelation between the individual message reliability and the timing behavior of the communication network into account. We present both a fast approach delivering a pessimistic safe reliability bound and a more sophisticated approach that results in a tighter yet still safe bound. The proposed approaches are compared by performing a design space exploration of an automotive communication network.

In recent years, reliability has become a major issue and objective during the design of embedded systems. Here, different techniques to increase reliability like hardware-/software-based redundancy or component hardening are applied systematically during Design Space Exploration (DSE), aiming at achieving highest reliability at lowest possible cost. Existing approaches typically solely provide reliability measures, e.g. failure rate or Mean-Time-To-Failure (MTTF), to the optimization engine, poorly guiding the search which parts of the implementation to change. As a remedy, this work proposes an efficient approach that (a) determines the importance of resources with respect to the system's reliability and (b) employs this knowledge as part of a local search to guide the optimization engine which components/design decisions to investigate. First, we propose a novel approach to derive Importance Measures (IMs) using a structural evaluation of Success Trees (STs). Since ST-based reliability analysis is already used for MTTF calculation, our approach comes at almost no overhead. Second, we enrich the global DSE with a local search. Here, we propose strategies guided by the IMs that directly change and enhance the implementation. In our experimental setup, the available measures to enhance reliability are the selection of hardening levels during resource allocation and software-based redundancy during task binding; exemplarily, the proposed local search considers the selected hardening levels. The results show that the proposed method outperforms a state-of-the-art approach regarding optimization quality, particularly in the search for highly-reliable yet affordable implementations -- at negligible runtime overhead.

The constantly growing amount of semiconductors in automotive systems increases the number of possible defect mechanisms, and therefore raises also the effort to maintain a sufficient level of quality and reliability. A promising solution to this problem is the on-line application of structural tests in key components, typically ECUs. In this work, an approach for the optimized integration of both Software-Based Self-Tests (SBST) and Built-In Self-Tests (BIST) into E/E architectures is presented. The approach integrates the execution of the tests non-intrusively, i. e., it (a) does not affect functional applications and (b) does not require costly changes in the communication schedules or additional communication overhead. Via design space exploration, optimized implementations with respect to multiple conflicting objectives, i. e., monetary costs, safety, test quality, and required execution time are derived.

With ever more complex automotive systems, the current approach of using functional tests to locate faulty components results in very long analysis procedures and poor diagnostic accuracy. Built-In Self-Test (BIST) offers a promising alternative to collect structural diagnostic information during E/E-architecture test. However, as the automotive industry is quite cost-driven, structural diagnosis shall not deteriorate traditional design objectives. With this goal in mind, the work at hand proposes a design space exploration to integrate structural diagnostic capabilities into an E/E-architecture design. The proposed integration is performed non-intrusively, i. e., the addition and execution of tests (a) does not affect any functional applications and (b) does not require any costly changes in the communication schedules.

Success tree analysis is a well-known method to quantify the dependability features of many systems. This paper presents a system-level methodology to automatically generate a success tree from a given embedded system implementation and subsequently analyzes its reliability based on a state-of-the-art Monte Carlo simulation. This enables the efficient analysis of transient as well as permanent faults while considering methods such as task and resource redundancy to compensate these. As a case study, the proposed technique is compared with two analysis techniques, successfully applied at system level: (1) a BDD-based reliability analysis technique and (2) a SAT-assisted approach, both suffering from exponential complexity in either space or time. Experimental results performed on an extensive test suite show that: (a) Opposed to the Success Tree (ST) and SAT-assisted approaches, the BDD-based approach is highly vulnerable to exhaust available memory during its construction for moderate and large test cases. (b) The proposed ST technique is competitive to the SAT-assisted analysis in analysis speed and accuracy, while being the only technique that is suitable to also handle large and complex system implementations in which permanent and transient faults may occur concurrently.

Due to ever-increasing bandwidth requirements of modern automotive applications, Ethernet AVB is becoming a standard high-speed bus in automotive E/E architectures. Since Ethernet AVB is tailored to audio and video entertainment, existing analysis approaches neglect the specific requirements and features of heterogeneous E/E architectures and their applications. This paper presents a timing analysis technique based on Real Time Calculus to consider Ethernet AVB in complex E/E architectures, reflecting key features such as static routing and stream reservation, fixed topology, and real-time applications. A comparison with a simulation on case studies from the automotive domain gives evidence that the proposed technique delivers valuable bounds for complete sensor-to-actuator chains, enabling automatic system synthesis and design space exploration approaches.

Stringent real-time constraints lead to complex search spaces containing only very few or even no valid implementations. Hence, while searching for a valid implementation a substantial amount of time is spent on timing analysis during system synthesis. This paper presents a novel system synthesis approach that efficiently prunes the search space in case real-time constraints are violated. For this purpose, the reason for a constraint violation is analyzed and a deduced encoding removes it permanently from the search space. Thus, the approach is capable of proving both the presence and absence of a correct implementation. The key benefit of the proposed approach stems from its integral support for real-time constraint checking. Its efficiency, however, results from the power of deduction techniques of state-of-the-art Boolean Satisfiability (SAT) solvers. Using a case study from the automotive domain, experiments show that the proposed system synthesis approach is able to find valid implementations where former approaches fail. Moreover, it is up to two orders of magnitude faster compared to a state-of-the-art approach.

Modern embedded systems incorporate multiple applications that run on the same execution platform. However, due to limited resources and other constraints, not all the combinations of applications may run concurrently. This paper tackles the problem of determining which combinations of applications can run on a given hardware architecture without violating given constraints, thus creating feasible operational modes of the system. The architecture itself may include standard processors for software implementation of applications and dynamically (partially) reconfigurable hardware resources, which enable dynamic sharing of the resource in different operational modes. The paper describes the models, theoretical results, and the mode exploration algorithm to perform this task. Here, the specification is symbolically encoded so that the feasibility of modes can be tested by applying a SAT solver. In the experiment, we demonstrate how to apply our approach to build a self-organizing smart camera framework.

This paper presents a modular framework for meta-heuristic optimization of complex optimization tasks by decomposing them into subtasks that may be designed and developed separately. Since these subtasks are generally correlated, a separate optimization is prohibited and the framework has to be capable of optimizing the subtasks concurrently. For this purpose, a distinction of genetic representation (genotype) and representation of a solution of the optimization problem (phenotype) is imposed. A compositional genotype and appropriate operators enable the separate development and testing of the optimization of subtasks by a strict decoupling. The proposed concept is implemented as open source reference OPT4J [6]. The architecture of this implementation is outlined and design decisions are discussed that enable a maximal decoupling and flexibility. A case study of a complex real-world optimization problem from the automotive domain is introduced. This case study requires the concurrent optimization of several heterogeneous aspects. Exemplary, it is shown how the proposed framework allows to efficiently optimize this complex problem by decomposing it into subtasks that are optimized concurrently.

More and more embedded systems provide a multitude of services, implemented by a large number of networked hardware components. In early design phases, dimensioning such complex systems in terms of monetary costs, power consumption, reliability etc. demands for new analysis approaches at the electronic system level. In this paper, two symbolic system level reliability analysis approaches are introduced. First, a formal approach based on Binary Decision Diagrams is presented that allows to calculate exact reliability measures for small to moderate-sized systems. Second, a simulative approach is presented that hybridizes a Monte Carlo simulation with a SAT solver and delivers adequate approximations of the reliability measures for large and complex systems.

Increasing reliability at a minimum amount of extra cost is a major challenge in todays ECU network design. Considering reliability as an objective already in early design phases has the potential to avoid expensive modifications in later design phases. Hence, there is a need for an appropriate optimization process and efficient analysis techniques to evaluate the found implementations. In this paper, we will show how symbolic techniques can be used to efficiently analyze and optimize such reliable systems. The contribution of this paper is (1) a symbolic reliability analysis that makes use of a partitioned structure function and (2) a symbolic optimization process based on binary ILP solvers. Our case study from the automotive area will show a significant speed-up using our analysis technique. Moreover, our optimization approach is able to offer implementations with considerably improved reliability at no additional costs as well as implementations with reduced costs without decreasing their reliability.