This content is not included in your SAE MOBILUS subscription, or you are not logged in.
Techniques and Measures for Improving Domain Controller Availability while Maintaining Functional Safety in Mixed Criticality Automotive Safety Systems
ISSN: 0148-7191, e-ISSN: 2688-3627
Published April 08, 2013 by SAE International in United States
Annotation ability available
With the advent of AUTOSAR version 4 and the availability of automotive specific multicore microcontrollers in volume production it is now possible to make very large scale integrations of different vehicle functions in a single ECU, running on a single high performance microcontroller. These microcontrollers typically provide all the hardware diagnostic mechanisms to achieve functional safety up to ISO 26262 ASILD, however careful consideration must be made in regard to the overall availability when undertaking large scale integrations in a single MCU. The motivation is clear. Up integration reduces costs, energy usage, wire harness complexity, and system bus traffic. However, when a multicore microcontroller is running different software for different applications on each of the available cores, if a fault is detected in one core the side effects and fault reactions must be contained, to prevent the fault propagating to other cores and applications. AUTOSAR version 4 does not implement any specific measures for fault containment, and, to the contrary, relies on a cooperative OS application model to work successfully. The challenge is to retain a high level of system availability but still meet the rigorous fault metrics defined in ISO 26262 by providing additional strategies for fault containment, fault classification, and function degradation. This paper describes the motivation for up-integration of functions on a domain controller ECU, shows the technologies required, and provides some solutions and workarounds for multicore microcontrollers running AUTOSAR version 4 in a mixed criticality safety system.
CitationGandhi, S. and Brewerton, S., "Techniques and Measures for Improving Domain Controller Availability while Maintaining Functional Safety in Mixed Criticality Automotive Safety Systems," SAE Technical Paper 2013-01-0198, 2013, https://doi.org/10.4271/2013-01-0198.
- Automated Emergency Braking Systems: Technical Requirements Costs and Benefits. Version 1.1. TRL Ltd. http://ec.europa.eu/enterprise/sectors/automotive/files/projects/report_aebs_en.pdf
- EURO NCAP to Drive the Availability of Autonomous Emergency Braking Systems for safer Cars in Europe. http://www.euroncap.com/Content-Web-Article/c79b2bdcf914-4ad0-8d49-54254cda0ddc/euro-ncap-to-driveavailability-of-autonomous-emer.aspx
- Factsheet from EVITA Project website http://evita-project.org/EVITA_factsheet.pdf
- TC27x AURIX microcontroller Target Specification version3.3, 2012-07. www.infineon.com/AURIX
- ISO 26262 is the adaptation of IEC 61508 to comply with needs specific to E/E systems within road vehicles. The International Standard is publicly available since November 2011.
- Brewerton, S., Willey, N., Gandhi, S., Rosenthal, T. et al., “Demonstration of Automotive Steering Column Lock using Multicore AutoSAR® Operating System,” SAE Technical Paper 2012-01-0031, 2012, doi: 10.4271/2012-01-0031.
- AUTOSAR Technical Safety Concept Status Report (http://www.autosar.de/download/R4.0/AUTOSAR_TR_SafetyConceptStatusReport.pdf)
- Elektrobit AUTOSAR (http://www.elektrobit.com/what_we_deliver/automotive_software/products)
- RECOMP project (Reduced Certification of Multicore Processors) http://atc.ugr.es/recomp/
- Website of the German “Normenausschuss Kraftfahrzeuge (FAKRA)” (engl. Road Vehicle Engineering Standards Committee) (2006): http://www.fakra.din.de/index.php?lang=en&na_id=fakra
- HIS (2002): Requirements for Protected Applications under OSEK. http://www.automotivehis.de/download/HIS%20Protected%20OS.pdf
- HIS (2003): OSEK OS Extensions for Protected Applications. http://www.automotivehis.de/download/HIS_ProtectedOSEK10.pdf
- Schneider, R., Kalhammer, M., Eberhard, D., and Brewerton, S., “Basic Single-Microcontroller Monitoring Concept for Safety Critical Systems,” SAE Technical Paper 2007-01-1488, 2007, doi: 10.4271/2007-01-1488.
- Brewerton, S., Schneider, R., and Eberhard, D., “Implementation of a Basic Single-Microcontroller Monitoring Concept for Safety Critical Systems on a Dual-Core Microcontroller,” SAE Technical Paper 2007-01-1486, 2007, doi: 10.4271/2007-01-1486.
- Sundaram, P. and D'Ambrosio, J., “Controller Integrity in Automotive Failsafe System Architectures,” SAE Technical Paper 2006-01-0840, 2006, doi: 10.4271/2006-01-0840.
- Brewerton, S., Schneider, R., and Grosshauser, F., “Practical Use of AUTOSAR in Safety Critical Automotive Systems,” SAE Int. J. Passeng. Cars - Electron. Electr. Syst. 2(1):249-257, 2009, doi: 10.4271/2009-01-0748.
- Eberhard, D., Schneider, R., Grosshauser, F., and Brewerton, S., “Timing Protection in Multifunctional and Safety-Related Automotive Control Systems,” SAE Technical Paper 2009-01-0757, 2009, doi: 10.4271/2009-01-0757.
- Leteinturier, P., Brewerton, S., and Scheibert, K., “MultiCore Benefits & Challenges for Automotive Applications,” SAE Technical Paper 2008-01-0989, 2008, doi: 10.4271/2008-01-0989.