Schedulability Analysis for Controller Area Network (CAN) with FIFO Queues Priority Queues and Gateways

Transcription

1 Schedulability Aalysis for Cotroller Area Networ (CAN) with FIFO Queues Priority Queues ad Gateways Robert I. Davis Real-Tie Systes Research Group, Departet of Coputer Sciece, Uiversity of Yor, YO10 5DD, Yor, UK Steffe Kolla, Victor Pollex, Fra Sloa Istitute of Ebedded Systes / Real-Tie Systes Ul Uiversity, Albert-Eistei-Allee 11, Ul, Geray {steffe.olla, victor.pollex, Abstract Cotroller Area Networ (CAN) is widely used i autootive applicatios. Existig schedulability aalysis for CAN is based o the assuptio that the highest priority essage ready for trasissio at each ode o the etwor will be etered ito arbitratio o the bus. However, i practice, soe CAN device drivers ipleet FIFO rather tha priority-based queues ivalidatig this assuptio. I this paper, we itroduce respose tie aalysis ad optial priority assiget policies for CAN essages i etwors where soe odes use FIFO queues while other odes use priority queues. We show, via a case study ad experietal evaluatio, the detrietal ipact that FIFO queues have o the real-tie perforace of CAN. Further, we show that i gateway applicatios, if it is ot possible to ipleet a priority queue, the it is preferable to use ultiple FIFO queues each allocated a sall uber of essages with siilar trasissio deadlies. Exteded versio This paper fors a exteded versio of "Cotroller Area Networ (CAN) Schedulability Aalysis with FIFO queues by Davis et al. (2011) published i ECRTS. The aalysis give i that paper has bee exteded via the iclusio of the followig ew aterial: I Sectio 1.2 we have added exaples of CAN devices that provide hardware support for FIFO queues. Sectio 4.6 has bee added, providig foral proofs that the schedulability tests give i Sectios 4.1, 4.2 ad 4.3 are sufficiet (Theores 2 ad 3) ad selfsustaiable (Theores 4 ad 5). This sectio also shows how ore precise aalysis ca be achieved whe the priorities of essages i a FIFO queue spa those of essages i a priority queue or aother FIFO queue, which is ofte the case i practice. I Sectio 5.2, we have added a foral proof that trasissio deadlie ootoic priority orderig is optial whe all essages have the sae axiu trasissio tie (Theore 7). I Sectio 7, we have exteded the experietal evaluatio to show how the perforace degradatio due to FIFO queues depeds o the uber of essages i each queue. Sectios 6.1 ad 7.1 have bee added, explorig the effects of ipleetig oe or ore FIFO queues i gateway odes that are resposible for trasferrig essages fro oe etwor to aother. 1. Itroductio Cotroller Area Networ (CAN) (Bosch, 1991; ISO , 1993) was desiged as a siple, efficiet, ad robust, broadcast couicatios bus for i-vehicle etwors. Today, typical aistrea faily cars cotai Electroic Cotrol Uits (ECUs), ay of which couicate usig CAN. As a result of this wholesale adoptio of CAN by the autootive idustry, aual sales of CAN odes (8, 16 ad 32-bit icro-cotrollers with ochip CAN cotrollers) have grow fro uder 50 illio i 1999 to aroud 750 illio i I autootive applicatios, CAN is typically used to provide high speed etwors (500Kbits/s) coectig chassis ad power-trai copoets, for exaple egie aageet ad trasissio cotrol. It is also used for low speed etwors (100 or 125Kbits/s) coectig body ad cofort electroics. Data required by odes o differet etwors is typically trasferred betwee the differet CAN buses by a gateway ode coected to both. CAN is a asychroous ulti-aster serial data bus that uses Carrier Sese Multiple Access / Collisio Resolutio (CSMA/CR) to deterie access to the bus. The CAN protocol requires that odes wait for a bus idle period before atteptig to trasit. If two or ore odes attept to trasit essages at the sae tie, the the ode with the essage with the lowest ueric CAN Idetifier will wi arbitratio ad cotiue to sed its essage. The other odes will cease trasittig ad ust wait util the bus becoes idle agai before atteptig to re-trasit their essages. (Full details of the CAN physical layer protocol are give by Bosch (1991), with a suary give by Davis et al. (2007). I effect CAN essages are set accordig to fixed priority o-pre-eptive schedulig, with the idetifier (ID) of each essage actig as its priority Related wor Tidell ad Burs (1994) showed how research ito fixed priority schedulig for sigle processor systes could be adapted ad applied to the schedulig of essages o CAN. The aalysis of Tidell et al. provided a ethod of calculatig the axiu queuig delay ad hece the 1 Figures fro the CAN i Autoatio (CiA) website

2 worst-case respose tie of each essage o the etwor. (Tidell ad Burs, 1994; Tidell et al., 1994; Tidell et al., 1995) also recogised that with fixed priority schedulig, a appropriate priority assiget policy is ey to obtaiig effective real-tie perforace. Tidell et al. suggested that essages should be assiged priorities i Deadlie ius Jitter ootoic priority order (Zuhily ad Burs, 2007). The seial wor of Tidell et al. lead to a large body of research ito schedulig theory for CAN (Rufio et al., 1998; Broster et al., 2002; Broster ad Burs, 2003; Broster, 2003; Broster et al., 2005; Ferreira et al., 2004; Hasso et al., 2002; Nolte et al., 2002; Nolte et al., 2003; Nolte, 2006), ad was used as the basis for coercial CAN schedulability aalysis tools (Casparsso et al., 1998). Davis et al. (2007) foud ad corrected sigificat flaws i the schedulability aalysis give by Tidell ad Burs, (1994), Tidell et al., (1994), ad Tidell et al., (1995). These flaws could potetially result i the origial aalysis providig guaratees for essages that could i fact iss their deadlies durig etwor operatio. Further, Davis et al. (2007) showed that the Deadlie ius Jitter ootoic priority orderig, claied by Tidell et al. to be optial for CAN, is ot i fact optial; ad that Audsley s Optial Priority Assiget (OPA) algorith (Audsley, 1991, 2001) is required i this case. Prior to the advet of schedulability aalysis ad appropriate priority assiget policies for CAN, essage IDs were typically assiged siply as a way of idetifyig the data ad the sedig ode. This eat that oly low levels of bus utilisatio, typically aroud 30%, could be obtaied before deadlies were issed. Further, the oly eas of obtaiig cofidece that essage deadlies would ot be issed was via extesive testig. Usig the systeatic approach of schedulability aalysis, cobied with a suitable priority assiget policy, it becae possible to egieer CAN based systes for tiig correctess, providig guaratees that all essages would eet their deadlies, with bus utilisatios of up to about 80% (Davis ad Burs, 2009a; Casparsso et al., 1998) Motivatio Egieers usig schedulability aalysis to aalyse etwor / essage cofiguratios ust esure that all of the assuptios of the specified schedulig odel hold for their particular syste. Specifically, whe usig the aalysis give by Davis et al. (2007), it is iportat that each CAN cotroller ad device driver is capable of esurig that wheever essage arbitratio starts o the bus, the highest priority essage queued at that ode is etered ito arbitratio. This behaviour is essetial if essage trasissio is to tae place as if there were a sigle global priority queue ad for the aalysis to be correct. As oted by Di Natale (2008), there are a uber of potetial issues that ca lead to behaviour that does ot atch that required by the schedulig odel give by Davis et al. (2007). For exaple, if a CAN ode has fewer trasit essage buffers tha the uber of essages that it trasits, the the followig properties of the CAN cotroller hardware ca prove probleatic: (i) iteral essage arbitratio based o trasit buffer uber rather tha essage ID (Fujitsu MB90385/90387, Fujitsu 90390, Itel 87C196 (82527), Ifieo XC161CJ/167 (82C900)); (ii) o-abortable essage trasissio: Philips 82C200, (Di Natale, 2006); (iii) less tha 3 trasit buffers: Philips 8xC592 (SJA1000), Philips 82C200, (Meschi et al., 1996). CAN cotrollers which avoid these potetial probles iclude, the Atel AT89C51CC03 / AT90CAN32/64 the Microchip MPC2515, ad the Motorola MSCAN o-chip peripheral, all of which have at least 3 trasit buffers, iteral essage arbitratio based o essage ID rather tha trasit buffer uber, ad abortable essage trasissio. The CAN device driver / software protocol layer ipleetatio also has the potetial to result i behaviour which does ot atch that required by the stadard schedulig odel (Davis et al., 2007). Issues iclude, delays i refillig a trasit buffer (Kha et al., 2010), ad FIFO queuig of essages i the device driver or CAN cotroller. A uber of CAN cotroller hardware ipleetatios provide specific support for FIFO queues. These iclude: o The BXCAN ad BECAN for the ST7 ad ST9 Microcotrollers fro STMicroelectroics, which icludes hardware support for both priority-queued ad FIFO-queued essage trasissio (STMicroelectroics, 2001). o The XILINX CAN Cotroller Core (LogiCORE IP AXI Cotroller) which provides a trasit buffer FIFO of cofigurable depth (up to 64 essages) ad a sigle additioal high priority trasit buffer that taes precedece over the FIFO (XILINX, 2010). o The Microchip PIC32MX (Microchip Techology Ic., 2009) which has 32 FIFOs each of which ca hold up to 32 essages. Arbitratio betwee the idividual FIFOs taes place o the basis of a priority assiged to each FIFO or the FIFO uber i the case of ties, hece all of the essages i a high priority FIFO are set before ay of the essages i a lower priority FIFO. (We ote that as there are 32 FIFOs, the PIC32MX ca effectively provide priority-based queuig for up to 32 trasit essages, each utilisig a idividual FIFO). o The Avet MC-ACT-XCANF which is a sall FPGA footprit CAN Cotroller for use with Actel prograable logic devices (Avet, 2006). The MC- ACT-XCANF has a sigle trasit FIFO ad a sigle receive FIFO. o The Reesas R32C/160 (Reesas, 2010) is a icrocotroller fro the M16C faily, specific to vehicle etwor applicatios. The o-chip CAN peripheral has 32 essage buffers / ailboxes ad provides the optio of a FIFO ailbox ode. I this ode, 4 ailboxes are cofigured as a 4-stage trasit FIFO ad 4 ailboxes as a 4-stage receive FIFO. Otherwise the buffers ay be cofigured for

3 trasissio based o either essage priority or buffer uber. We ote that the ore sophisticated CAN cotrollers offer the optio of hardware support for FIFO queues while also fully supportig priority queues, thus leavig the choice of which queuig policy to use up to the device driver / software protocol layer ipleetatio. Di Natale (2008) oted that usig FIFO queues i CAN device drivers / software protocol layers ca see a attractive solutio, because of its siplicity ad the illusio that faster queue aageet iproves the perforace of the syste. This is ufortuate, because FIFO essage queues uderie the priority-based bus arbitratio used by CAN. They ca itroduce sigificat priority iversio ad result i degraded real-tie perforace. Nevertheless, FIFO queues are a reality i soe coercial CAN device drivers / software protocol layers. Oe area i which the use of FIFO queues ca have a particularly detrietal effect is i gateway applicatios. The uber of essages trasitted oto a etwor by a gateway ode ca easily exceed the uber of hardware trasit buffers available i the CAN cotroller it uses. A siple desig solutio to this proble is to use a sigle FIFO queue for all of these essages; however, such a choice ca sigificatly degrade the real-tie perforace of the etwor. As far as we are aware, there is o published research 2 itegratig FIFO queues ito respose tie aalysis for CAN. This paper focuses o the issue of FIFO queues. We provide respose tie aalysis ad appropriate priority assiget policies for Cotroller Area Networs coprisig soe odes that use FIFO queues ad other odes that use priority queues Orgaisatio The reaider of this paper is orgaised as follows: I Sectio 2, we itroduce the schedulig odel, otatio, ad teriology used i the rest of the paper. I Sectio 3 we recap o the sufficiet schedulability aalysis for CAN give by Davis et al. (2007). Sectio 4 the exteds this aalysis to etwors where soe odes ipleet prioritybased queues while others ipleet FIFO queues. Sectio 5 discusses priority assiget for ixed sets of FIFOqueued ad priority-queued essages. Sectio 6 presets the results of a case study explorig the ipact of FIFO queues o essage respose ties ad etwor schedulability. Sectio 7 evaluates the effect of priority assiget ad FIFO queues o the axiu achievable etwor utilisatio. Fially, Sectio 8 cocludes with a suary ad recoedatios. 2. Syste Model, Notatio ad Teriology I this sectio we describe a syste odel ad otatio that ca be used to aalyse the worst-case respose ties of CAN essages. This odel is based o that used by Davis 2 The coercial tool NETCAR-Aalyzer ( addresses the case of FIFO queues. et al. (2007) with extesios to describe FIFO queues. A suary of the otatio used is give i Table 1 for easy referece. Here we give oly a high level descriptio ecessary to uderstad the essage schedulig behaviour of CAN. Readers iterested i the uderlyig lower level CAN protocol ad its teriology are directed to Sectio 2.1 of (Davis et al., 2007). The syste is assued to coprise a uber of odes (icroprocessors) coected to a sigle CAN bus. Nodes are classified accordig to the type of essage queue used i their device driver. Thus FQ-odes ipleet a FIFO essage queue, whereas PQ-odes ipleet a priority queue. PQ-odes are assued to be capable of esurig that, at ay give tie whe bus arbitratio starts, the highest priority essage queued at the ode is etered ito arbitratio. FQ-odes are assued to be capable of esurig that, at ay give tie whe bus arbitratio starts, the oldest essage i the FIFO queue is etered ito arbitratio. The syste is assued to cotai a static set of hard real-tie essages, each statically assiged to a sigle ode o the etwor. Each essage has a distict fixed Idetifier (ID) ad hece a uique priority. As priority uiquely idetifies each essage, i the reaider of the paper we will overload to ea either essage or priority as appropriate. We use hp () to deote the set of essages with priorities higher tha, ad siilarly, lp () to deote the set of essages with priorities lower tha. Each essage has a axiu trasissio tie of C (see (Davis et al., 2007) for details of how to copute the axiu trasissio tie of essages o CAN, taig ito accout the uber of data bytes ad bitstuffig). The evet that triggers queuig of essage is assued to occur with a iiu iter-arrival tie of T, referred to as the essage period. Each essage has a hard deadlie D, correspodig to the axiu peritted tie fro occurrece of the iitiatig evet to the ed of successful trasissio of the essage, at which tie the essage data is assued to be available o the receivig odes that require it. Tass o the receivig odes ay place differet tiig requireets o the data, however i such cases we assue that D is the shortest such tie costrait. We assue that the deadlie of each essage is less tha or equal to its period ( D T ). Each essage is assued to be queued by a software tas, process or iterrupt hadler executig o the sedig ode. This tas is either ivoed by, or polls for, the evet that iitiates the essage, ad taes a bouded aout of tie, betwee 0 ad J, before the essage is i the device driver queue available for trasissio. J is referred to as the queuig jitter of the essage ad is iherited fro the overall respose tie of the tas, icludig ay pollig delay 3. The 3 I the best case, the tas could arrive the istat the evet occurs ad queue the essage iediately, whereas i the worst-case, there could be a delay of up to the tas s period before it arrives ad the a further delay of up to the tas s worst-case respose tie before it queues the essage.

4 trasissio deadlie E of essage is give by E = D J, ad represets the axiu peritted tie fro the essage beig queued at the sedig ode to it beig received at other odes o the bus. The axiu queuig delay w, correspods to the logest tie that essage ca reai i the device driver queue or CAN cotroller trasit buffers, before coecig successful trasissio o the bus. I this paper, we defie the worst-case respose tie R of a essage as the axiu possible trasissio delay fro the essage beig queued util it is received at the receivig odes 4. Hece: R = w + C (1) As oted by Broster (2003), receivig odes ca access essage followig the ed of (essage) frae arer ad before the 3-bit iter-frae space. The aalysis give i the reaider of this paper is therefore slightly pessiistic i that it icludes the 3-bit iter-frae space i the coputed worst-case respose ties. To reove this sall degree of pessiis, it is valid to siply subtract 3τ bit fro the coputed respose tie values, where τ bit is the trasissio tie for a sigle bit o the bus. A essage is said to be schedulable if its worst-case respose tie is less tha or equal to its trasissio deadlie ( R E ). A syste is said to be schedulable if all of the essages i the syste are schedulable. The followig additioal otatio is used to describe the properties of a set of essages that are trasitted by the sae FQ-ode ad so share a FIFO queue. The FIFO group M () is the set of essages that are trasitted by the FQode that trasits essage. The lowest priority of ay essage i the FIFO group M () is deoted by L. MAX MIN C ad C are the trasissio ties of the logest SUM ad shortest essages i the FIFO group, while C is the su of the trasissio ties of all of the essages i MIN the group. E is the shortest trasissio deadlie of ay essage i the group. We use f to deote the axiu bufferig tie fro essage beig queued util it is able to tae part i priority-based arbitratio. For a FIFO-queued essage f equates to the tie fro the essage beig etered ito the FIFO queue to it becoig the oldest essage i that queue. For a priority-queued essage f = 0. As well as deteriig essage schedulability give a particular priority orderig, we are also iterested i effective priority assiget policies. Defiitio 1: Optial priority assiget policy: A priority assiget policy P is referred to as optial with respect to a schedulability test S ad a give etwor odel, if ad oly if there is o set of essages that are copliat with the odel that are deeed schedulable by test S usig aother priority assiget policy, that are ot also deeed 4 Note this is a differet way of defiig respose tie to that used by Davis et al. (2007) which icludes queuig jitter. To copesate for ot icludig queuig jitter i the respose tie, i this paper we copare respose ties with trasissio deadlies to deterie schedulability. schedulable accordig to test S usig policy P. We ote that the above defiitio is applicable to both sufficiet schedulability tests such as those give i Sectios 3 ad 4, as well as exact schedulability tests. A schedulig algorith is said to be sustaiable (Baruah ad Burs, 2006) with respect to a syste odel, if ad oly if schedulability of ay set of essages copliat with the odel iplies schedulability of the sae set of essages odified by: (i) decreasig trasissio ties, (ii) icreasig periods or iter-arrival ties, ad (iii) icreasig deadlies. Siilarly, a schedulability test is referred to as sustaiable if these chages caot result i a set of essages that was previously deeed schedulable by the test becoig uschedulable. We ote that the odified set of essages ay ot ecessarily be deeed schedulable by the test. A schedulability test is referred to as selfsustaiable (Baer ad Baruah, 2009) if such a odified set of essages is always deeed schedulable by the test. Table 1: Notatio Sybol Meaig B Blocig factor at priority. C Logest trasissio tie of essage. MAX C Max. trasissio tie of a essage i M (). MIN C Mi. trasissio tie of a essage i M (). SUM C Su of trasissio ties of essages i M (). D Deadlie of essage. E Trasissio deadlie of essage. MIN E Mi. trasissio deadlie of ay essage i M () f Bufferig delay for essage. hp () Set of essages with higher priority tha essage. J Release jitter of essage. lp () Set of essages with lower priority tha essage. L Lowest priority of ay essage i M (). Message (also its priority). M () The set of essages sharig a FIFO queue with essage. R Worst case respose tie for essage. τ bit Trasissio tie for oe bit. T Miiu iter-arrival tie or period of essage. w Queuig delay for essage. 3. Schedulability Aalysis with Priority Queues I this sectio, we recapitulate the siple sufficiet schedulability aalysis give by Davis et al. (2007). For etwors of PQ-odes, coplyig with the schedulig odel give i Sectio 2, CAN effectively ipleets fixed priority o-pre-eptive schedulig. I this case, Davis et al. (2007) showed that a upper boud o the respose tie R of each essage ca be foud by coputig the axiu queuig delay w usig the

5 followig fixed-poit iteratio: w J τ bit w = ax( B, C ) + C (2) T hp( ) where τ bit is the trasissio tie for a sigle bit, ad B is the blocig factor described below. Iteratio starts with a 0 suitable iitial value such as w = C, ad cotiues util +1 either w + C > E i which case the essage is ot +1 schedulable, or w = w i which case the essage is schedulable ad its worst-case respose tie is give by: +1 R = w + C (3) As CAN essage trasissio is o-pre-eptable, the trasissio of a sigle lower priority essage ca cause a delay of up to B (referred to as direct blocig) betwee essage beig queued ad the first tie that essage could be etered ito arbitratio o the bus. B represets the axiu blocig tie due to lower priority essages: B = ax ( C ) (4) lp( ) Alteratively, i soe cases, the trasissio of the previous istace of essage could delay trasissio of a higher priority essage causig a siilar delay (referred to as push-through blocig 5 ) of up to C. Both direct ad push-through blocig are accouted for by the 1 st ter o the RHS of (2). The 2 d ter represets iterferece fro higher priority essages that ca wi arbitratio over essage ad so delay its trasissio. Note that oce essage starts successful trasissio it caot be preepted, so the essage s overall respose tie is siply the queuig delay plus its trasissio tie (give by (3)). Usig (2) ad (3), egieers ca deterie upper bouds 6 o worst-case respose ties ad hece the schedulability of all essages o a etwor coprisig solely PQ-odes. Although the aalysis ebodied i (2) ad (3) is pseudo-polyoial i coplexity i practice it is tractable o a destop PC for coplex systes with hudreds of essages. (A uber of techiques are also available for icreasig the efficiecy of such fixed poit iteratios (Davis et al., 2008)). 4. Schedulability Aalysis with FIFO Queues I this sectio, we derive sufficiet schedulability aalysis for essages o etwors with both PQ-odes ad FQ-odes. The aalysis we itroduce is FIFO-syetric, by this we ea that the sae worst-case respose tie is attributed to all of the essages i a FIFO group. We ote that FIFO-syetric aalysis icurs soe pessiis i ters of the worst-case respose tie attributed to the higher priority essages i a FIFO group; however, i practice this pessiis is liely to be sall. This is because the order i which essages are placed i a FIFO queue is udefied, ad so i the worst case, the highest priority essage i a FIFO group has to wait for a istace of each 5 See Davis et al. (2007) for a explaatio of why push-through blocig is iportat. 6 Equatio (2) is sufficiet rather tha exact due to the fact that push through blocig ay ot ecessarily be possible. lower priority essage i the group to be trasitted Priority-queued essages We ow derive a upper boud o the worst-case queuig delay for a priority-queued essage, i a syste with both PQ-odes ad FQ-odes. I the case of systes with oly PQ-odes, Davis et al. (2007) showed that the worst-case queuig delay for a priority-queued essage occurs for a istace of that essage queued at the begiig of a priority level- busy period 7 that starts iediately after the logest lower priority essage begis trasissio. Further, this axial busy period begis with a so-called critical istat where essage is queued siultaeously with all higher priority essages ad the each of these higher priority essages is subsequetly queued agai after the shortest possible tie iterval. Equatio (2) provides a sufficiet upper boud o this worst-case queuig delay. The aalysis ebodied i (2) assues that higher priority essages are able to copete for access to the bus (i.e. eter bus arbitratio) as soo as they are queued; however, this assuptio does ot hold for FIFO-queued essages. Istead a FIFO-queued essage ay have to wait for up to a axiu tie f before it becoes the oldest essage i its FIFO queue, ad ca eter prioritybased arbitratio. A FIFO-queued essage ca therefore be thought of as becoig priority queued after a additioal delay of f. Stated otherwise, i ters of its iterferece o lower priority essages, a FIFO-queued essage ca be viewed as if it were a priority-queued essage with its jitter icreased by f. (Note, we will retur to how f is calculated for FIFO-queued essages later). A upper boud o the queuig delay for a priorityqueued essage ca therefore be calculated via the fixed poit iteratio give by (5). w + J + f + τ + 1 w = ax( B, C ) + C (5) hp( ) T As with (2), iteratio starts with a suitable iitial value such 0 +1 as w = C, ad cotiues util either w + C > E i +1 which case the essage is ot schedulable, or w = w i which case its respose tie is give by: +1 R = w + C (6) Note that the queuig delay ad respose tie are oly valid with respect to the values of f used. We retur to this poit later FIFO-queued essages We ow derive a upper boud o the worst-case queuig delay for a FIFO-queued essage, i a syste with both PQ-odes ad FQ-odes. As our aalysis is FIFO-syetric, we will attribute the sae upper boud respose tie to all of the essages set by the sae FQ-ode. Our aalysis derives this sufficiet 7 A priority level- busy period is a cotiguous iterval of tie durig which there is always at least oe essage of priority that has ot yet copleted trasissio. bit

6 respose tie by cosiderig a arbitrary essage fro the FIFO group M (). For the sae of siplicity, we will still refer to this essage as essage ; however our aalysis will be idepedet of the exact choice of essage fro the FIFO group. At each stage i our aalysis we will ae worst-case assuptios, esurig that the derived respose tie is a correct upper boud. For exaple, we will frae our calculatio of the queuig delay w by assuig the lowest priority L of ay essage i the FIFO group. As every essage j i M () has D j T j the i a schedulable syste, whe ay arbitrary essage fro M () is queued, there ca be at ost oe istace of each of the other essages i M () ahead of it i the FIFO queue. The axiu trasissio tie of these essages, ad hece the axiu iterferece o a arbitrary essage, due to essages set by the sae FQ-ode, is therefore upper bouded by: SUM MIN C C (7) Idirect blocig could also occur due to the o-preeptive trasissio of a previous istace of ay oe of the essages i M (). This idirect blocig is upper MAX bouded by C. As a alterative, direct blocig could occur due to trasissio of ay of the essages of lower priority tha L set by other odes. Fially, i ters of iterferece fro higher priority essages set by other FQ-odes ad PQ-odes, the arguet about icreased jitter ade i the previous sectio applies, ad so the iterferece ter fro (5) ca agai be used. Cosiderig all of the above, a upper boud o the queuig delay for a arbitrary essage belogig to the FIFO group M () is give by the solutio to the followig fixed poit iteratio: + 1 MAX SUM w = ax( B, C ) + ( C C MIN ) + L w + J + f + τ bit C hp L M T (8) ( ) ( ) Iteratio starts with a value of w 0 = ax( B, MAX L C ) SUM MIN + ( C C ) ad cotiues util either +1 MIN MIN w + C > E i which case the set of essages +1 M () is declared uschedulable, or w = w i which case all of the essages i M () are deeed to have a respose tie of: +1 MIN R = w + C (9) Equatios (8) ad (9) ae the worst-case assuptio that iterferece fro higher priority essages ca occur up MIN to a tie C before trasissio of essage copletes. We ote that this is a pessiistic assuptio with respect to those essages belogig to the FIFO group that have trasissio ties 8 loger tha C. MIN 4.3. Schedulability test with arbitrary priorities We ow derive a schedulability test fro (5) & (6) ad (8) & (9). The basic idea is to avoid havig to cosider the potetially coplex iteractios betwee the FIFO queues of differet odes. This is achieved by abstractig the FIFO behaviour of essages set by other odes as siply additioal jitter f before each essage ca eter priority based arbitratio o the bus. Whe calculatig the respose tie of a give essage, we therefore eed oly cosider the behaviour of the ode that seds that essage (PQ-ode or FQ-ode) ad the bufferig delays of essages set by other odes 9. A upper boud o the bufferig tie f of a FIFOqueued essage is: MIN f = R C (10) 1 repeat = true 2 iitialise all f = 0 3 while(repeat){ 4 repeat = false 5 for each priority, highest first{ 6 if ( is FIFO-queued){ 7 calc R accordig to Eqs (8) & (9) 8 if( R > E MIN ) { 9 retur uschedulable 10 } 11 if( f < w ){ 12 f = w 13 repeat = true; 14 } 15 } 16 else { 17 calc R accordig to Eqs (5) & (6) 18 if( R > E ) { 19 retur uschedulable 20 } 21 } 22 } 23 } 24 retur schedulable Algorith 1: FIFO Syetric Schedulability Test Whe the priorities of essages i differet FIFO groups are iterleaved, this leads to a circular depedecy i the respose tie calculatios. For exaple, let ad be the priorities of essages i two differet FIFO groups with iterleaved priorities (i.e. hp( L ) ad hp( L ) ). The respose tie R of essage, ad hece its bufferig tie f, deped o the bufferig tie f of essage as hp( L ) ; however, the bufferig tie f of essage depeds o its respose tie R which i tur depeds o f as hp L ). This apparet proble ca be solved by ( 8 I practice all essages set o CAN ofte have the axiu legth (8 data bytes) so as to iiise the relative overheads of the other fields i the essage (ID, CRC etc). I this case, o additioal pessiis is itroduced by this assuptio. 9 If the essage belogs to a PQ-ode, the the other essages set by the sae ode have bufferig delays of zero, if it belogs to a FQ-ode, the the bufferig delays for other essages set by the sae ode are ot eeded i the calculatios (8) &(9).

7 otig that the respose ties calculated via (5) & (6) ad (8) & (9) are ootoically o-decreasig with respect to the bufferig ties, ad that the bufferig ties give by (10) are ootoically o-decreasig with respect to the respose ties calculated via (8) & (9). Hece by usig a outer loop iteratio, ad repeatig respose tie calculatios util the bufferig ties o loger icrease, we ca copute correct upper boud respose ties ad hece schedulability for all essages, as show i Algorith 1. (Note, to speed up the schedulability test, for each essage, the value of w coputed o oe iteratio of the while loop (lies 3 to 23) ca be used as a iitial value o the ext iteratio). Algorith 1 provides a sufficiet schedulability test for FIFO-queued ad priority-queued essages i ay arbitrary priority orderig Partial priority orderig withi a FIFO group I this sectio, we cosider a appropriate priority orderig for essages withi a FIFO group. Defiitio 2: A FIFO-adjacet priority orderig is ay priority orderig whereby all of the essages sharig a FIFO queue are assiged adjacet priorities. Theore 1: If a priority orderig Q exists that is schedulable accordig to the FIFO-syetric schedulability aalysis of Algorith 1 the a schedulable FIFO-adjacet priority orderig P also exists. Proof: Let be a FIFO-queued essage that is ot the lowest priority essage i its FIFO group. Now cosider a priority trasforatio whereby essage is shifted dow i priority so that it is at a priority level iediately above that of the lowest priority essage i its FIFO group. We will refer to the old priority orderig as Q ad the ew priority orderig as Q. We observe fro (5) ad (8), that give the sae fixed set of bufferig ties f, the (i) the respose tie coputed for essage is the sae for both priority orderigs, ad (ii) the respose ties coputed for all other essages are o larger i priority orderig Q tha they are i priority orderig Q. Due to the utual ootoically o-decreasig relatioship betwee essage bufferig ties ad respose ties, ad the fact that Algorith 1 starts with all the bufferig ties set to zero, this eas that o every iteratio of Algorith 1, the respose ties ad bufferig ties coputed for each essage uder priority orderig Q are o larger tha those coputed o the sae iteratio for priority orderig Q. Hece if priority orderig Q is schedulable, the so is priority orderig Q. Applyig the priority trasforatio described above to every FIFO-queued essage that is ot the lowest priority essage i its FIFO group trasfors ay schedulable priority orderig Q ito a FIFO-adjacet priority orderig P, without ay loss of schedulability Theore 1 tells us that regardless of the priority assiget applied to priority-queued essages, we should esure that all of the essages that share a sigle FIFO queue have adjacet priorities. I ters of CAN essage IDs we ote that this does ot require that cosecutive values are used for the IDs, oly that there is o iterleavig with respect to the priorities of other essages. I practice essage IDs ca be chose to eet these requireets, while also providig appropriate bit patters for essage filterig Schedulability test for FIFO-adjacet priorities I this sectio, we derive a iproved schedulability test that is valid for FIFO-adjacet priority orderigs. Recall that Davis et al. (2007) showed that the worstcase queuig delay for a priority-queued essage occurs withi the priority level- busy period that starts with a critical istat. Provided that a FIFO-adjacet priority orderig is used, the the sae situatio also represets the worst-case sceario whe higher priority essages are set by either PQ-odes or FQ-odes. This ca be see by cosiderig the iterferece o a priority-queued essage fro a higher priority FIFO-queued essage. As essage is of higher priority tha essage, the so are all of the other essages i the sae FIFO group (i.e. M () ). Thus ay essage i M () that is queued prior to the start of trasissio of essage will be set o the bus before essage, irrespective of the order i which the essages i M () are placed i the FIFO queue. I effect all of the additioal jitter o essage is already accouted for by iterferece o essage fro other essages i the sae FIFO group ( M () ). I this case, there is o additioal jitter o essage caused by essages of lower priority tha. Hece for each FIFO essage, we ca set f = 0, ad use (5) & (6) to calculate the queuig delay ad worstcase respose tie of each essage. The sae arguet applies whe we cosider the schedulability of a FIFOqueued essage. I this case we ca use (8) & (9) to calculate the queuig delay ad worst-case respose tie, with all bufferig ties f = 0. Further, as the bufferig ties are all fixed at zero, a sigle pass over the priority levels is all that is eeded to deterie schedulability. I other words, lies of Algorith 1 ca be oitted whe cosiderig FIFO-adjacet priority orderigs. This revised schedulability test therefore doiates the test give i Sectio 4.3 (i.e. Algorith 1 with lies preset). The siplified aalysis give i this sectio is siilar to that provided for FP/FIFO schedulig of flows by Marti et al., (2007) ad for OSEK/VDX tass by Bibard ad George (2006) ad Hladi et al. (2007) Sufficiecy ad sustaiability of the FIFOsyetric schedulability tests I this sectio, we prove that treatig all of the essages i a FIFO queue as havig the lowest priority L of ay essage i that queue, leads to a worst-case respose tie that is o saller tha the actual worst-case respose tie of each essage. Thus, we show that the FIFOsyetric schedulability test give i Sectio 4.2, by (8) ad (9) (i.e. Algorith 1), is sufficiet i the case of a geeral priority orderig (Theore 2), ad also i the case of a FIFO-adjacet priority orderig whe the bufferig delays are set to zero (Theore 3). We also show that the

8 FIFO-syetric schedulability test is self-sustaiable (Baer ad Baruah, 2009) i these two cases (Theores 4 ad 5). Recall fro Sectio 2 that the property of selfsustaiability iplies sustaiability of the schedulability test. Sustaiability is a iportat property as it eas that ay set of essages that are deeed schedulable by the test reai schedulable if their trasissio ties are reduced, for exaple by bit-stuffig which is less tha the worst-case assued by the aalysis, or their periods or deadlies are icreased. Lea 1: Cosider a syste G coprisig a set of odes coected via a CAN bus, with a static set of hard real-tie essages set o the bus. We assue that the ode trasittig essage is a FQ-ode, which trasits a FIFO-group of essages M (), ad that essages fro all other odes are priority queued. Further, the priorities of the essages i the FIFO-group M () are arbitrary, with a lowest priority of L. Let H be a syste that is idetical to syste G, with the exceptio that all of the essages i the FIFO-group M () have priority L. The worst-case respose tie of each essage i M () i syste G is o greater tha the worst-case respose tie of the equivalet essage uder syste H. Proof: We prove a stroger hypothesis: that for ay valid sequece of essage releases, the respose tie of every istace of every essage i M () is o greater i syste G tha it is i syste H. We observe that for ay valid sequece of essage releases, the duratio of each priority level L busy period (durig which there are ready essages of priority L or higher) is the sae i both systes. This is the case because fixed priority o-pre-eptive schedulig is worcoservig, essage release ties are the sae i both systes, ad the oly differece betwee the is the priority orderig of essages with priorities o lower tha L. As a cosequece, the ties at which essages with priorities lower tha L start to be trasitted are the sae i both systes. Note the order i which essages of priority L ad higher are set i a priority level L busy period ay be differet i the two systes. We prove the hypothesis by cotradictio: For soe arbitrary sequece of essage releases, let x be the first istace of a essage i M () with a loger respose tie i syste G tha it has i syste H. To copare the respose ties of essage istace x i the two systes, we eed oly cosider the priority level L busy period that cotais trasissio of x. Let t be the start of this busy period. The tie s at which x starts to be trasitted i syste H is give by: s = t + B + CP( t) + I ( t) (11) hp( L ) M ( ) where B is blocig due to a lower priority essage (if ay) that starts trasissio at the start of the busy period, CP (t) is the total trasissio tie for istaces of essages i M () released durig the busy period prior to the release of x, ad I (t) is the total trasissio tie of istaces of higher priority essage released durig the busy period, prior to tie s. As (11) holds for syste H, it ust be the case i syste G that x ca start trasissio o later tha s, as its priority is o lower tha L. This cotradicts the hypothesis that x is the first istace of a essage i M () with a loger respose tie i syste G tha it has i syste H. Hece there ca be o such istace x Theore 2: The FIFO-syetric schedulability test give i Sectio 4.2, (8) ad (9), is sufficiet. Proof: Lea 1 shows that the worst-case respose ties for a set of FIFO-queued essages M () with arbitrary priorities, the lowest of which is L, are upper bouded by the worst-case respose ties of those sae essages coputed for a syste that is equivalet except for the fact that all of the essages i M () have priority L. Sufficiet values for the worst-case respose ties of FIFOqueued essages ay therefore be calculated accordig to these assuptios as described i Sectio 4.2. Note that the assuptio that all essages set by other odes are priority queued is dealt with by (8) via odellig each essage set by aother FQ-ode as a priority queued essage with release jitter icreased by the bufferig delay f Next we show that i the case of a FIFO-adjacet priority orderig, the FIFO-syetric schedulability test give by Algorith 1 is sufficiet with the bufferig delays set to zero. Further, we show that i systes where ot all of the priorities of essages i FIFO-groups are adjacet, the soe specific bufferig delays ca still be assued to be zero, iprovig the precisio of the aalysis. We use the cocepts of spaig ad partitioig to describe how the priorities of essages i differet FIFO groups are iterleaved. We say that a FIFO-group M () spas a priority level j if there is at least oe essage i the group with a priority higher tha j ad at least oe essage i the group with a priority lower tha j. Siilarly, a FIFOgroup M () spas aother FIFO group M ( j) if there is a essage i M () with a priority higher tha L j (the lowest priority of a essage i M ( j) ) ad aother essage i M () with a priority lower tha L j. If o FIFO-groups spa priority level j, the we say that priority level j, partitios the FIFO-groups. I this case, all essages i the sae FIFO-group either have priorities that are higher tha j or lower tha j. Siilarly, a FIFO-group M ( j) is said to partitio the other FIFO groups if the lowest priority level L j of the FIFO-group partitios the other FIFO-groups. I a FIFO-adjacet priority orderig each FIFO-group partitios all of the other FIFO-groups, ad o FIFO group spas aother FIFO-group or a priority queued essage. Lea 2: Let j be a priority queued essage ad M () a FIFO group where all of the essages i M () have higher priorities tha j, i.e. j lp( L ). The worst-case respose tie of essage j ca be coputed accordig to (5) ad (6) with the iterferece fro essages i M () calculated with their bufferig delays assued to be zero. Proof: As j lp L ), the all of the essages i FIFO- (

9 group M () have a higher priority tha essage j. Thus all of the ready essages i FIFO-group M () ust be set prior to the start of trasissio of essage j. It follows that the worst-case iterferece fro essages i M () occurs whe all of those essages are queued siultaeously at the start of a priority level-j busy period ad are queued agai as soo as possible. Further, at ay give tie there ca be o essages i M () of priority higher tha j that are ready but waitig i the FIFO queue behid a essage of priority j or lower. Therefore the worst-case sceario for iterferece fro essages i higher priority FIFO-group M () is the sae as the priority-queued case. (Note that bufferig delays ca still occur, but their oly effect is to re-order the trasissio of essages i M (), without chagig the total iterferece o the essage at priority level j) Lea 3: Let M ( j) be a FIFO-group ad M () aother FIFO-group such that all of the essages i M () have higher priorities tha the lowest priority essage i M ( j), i.e. L j lp( L ). The worst-case respose tie for essages i M ( j) ca be coputed accordig to (8) ad (9) with the iterferece fro essages i M () calculated with their bufferig delays assued to be zero. Proof: (Follows the logic of the proof of Lea 2). Lea 1 tells us that we ca upper boud the worst-case respose ties of essages i M ( j) by assuig that they are all trasitted at priority L j. As L j lp( L ), the all of the essages i FIFO-group M () have a higher priority tha L j. Thus all of the ready essages i FIFO-group M () ust be set prior to the start of trasissio of ay essage at priority L j. It follows that the worst-case iterferece fro essages i M () occurs whe all of those essages are queued siultaeously at the start of a priority level- L j busy period ad are queued agai as soo as possible. Further, at ay give tie there ca be o essages i M () of priority higher tha L j that are ready but waitig i the FIFO queue behid a essage of priority L j or lower. Therefore the worst-case sceario for iterferece fro essages i FIFO-group M () is the sae as the priority-queued case. (Note that bufferig delays ca still occur, but their oly effect is to re-order the trasissio of essages i M (), without chagig the total iterferece o essages at priority level L j ) Theore 3: For ay priority queued essage (or FIFOgroup) that partitios the other FIFO groups, the worst-case respose tie ca be coputed accordig to (5) ad (6) (or (8) ad (9)) with the bufferig delays of essages i higher priority FIFO-groups assued to be zero. Further, for ay FIFO-group M ( j) that does ot partitio the other FIFOgroups, the the worst-case respose tie of essages i M ( j) ca be coputed with o-zero bufferig delays used oly for those essages i FIFO-groups that spa priority level L j. Siilarly, for a priority queued essage j that does ot partitio the FIFO-groups, the the worst-case respose tie of essage j ca be coputed usig (5) ad (6) with o-zero bufferig delays used oly for those essages i FIFO groups that spa priority level j. Proof: Follows fro the proofs of Lea 1 ad Lea 2, Lea 3, ad aalysis of the priority queued case Corollary 1: With a FIFO-adjacet priority orderig the FIFO-syetric schedulability test give by Algorith 1 is sufficiet with all bufferig delays assued to be zero. (This corollary follows fro Theore 3). For sets of essages that are ot all i FIFO-adjacet priority order, the the schedulability test give by Algorith 1 ust be used with lies preset. This is because at least oe priority queued essage or FIFO-group will eed to have its worst-case respose tie coputed usig o-zero bufferig delays, ad hece repeated calculatio is required to accout for the circular depedecy that this ay iply. Theore 3 allows for ore precise aalysis of worstcase respose ties whe there are costraits o essage priorities that prevet the use of a FIFO-adjacet priority orderig. This is illustrated by Figure 1 which shows, as bracets, the axiu ad iiu priority of essages i the various FIFO-groups, as well as the priorities of two priority queued essages. Theore 3 tells us that whe coputig the worst-case respose tie for essages i FIFO-4, the we ay assue a bufferig delay of zero for essages i FIFO-2 ad FIFO-1, because all of the essages i those FIFO-groups have higher priorities tha the lowest priority essage i FIFO-4. However, we ust copute ad use o-zero bufferig delays for essages i FIFO-6 as this group spas the lowest priority level of group FIFO-4. Further, whe coputig the worst-case respose tie for essages i FIFO-6, we ca assue the bufferig delays for essages i FIFO-1, FIFO-2 ad FIFO-4 are zero, but ust use the coputed o-zero values for the bufferig delays for essages i FIFO-7. Whe coputig the worst-case respose tie of priority queued essage PRI-5, we ca assue the bufferig delays for essages i FIFO-1 ad FIFO-2 are zero, but ust use the coputed o-zero bufferig delays for essages i FIFO-4 ad FIFO-6. Fially, whe coputig the worst-case respose tie for essages i FIFO-7, we ay assue a bufferig delay of zero for all essages i FIFO-1, FIFO-2, FIFO-4, ad FIFO-6.

10 Priority FIFO-2 FIFO-6 FIFO-1 FIFO-4 FIFO-7 PRI-3 PRI-5 Figure 1: Priorities spaig FIFO groups Note that whether we ca assue bufferig delays of zero or ot for essages i a particular FIFO-group (e.g. FIFO-6) depeds o which essages we are coputig the worst-case respose tie for (e.g. FIFO-4, PRI-5, ad FIFO-7). Theore 4: With a FIFO-adjacet priority orderig, the FIFO-syetric schedulability test of Sectio 4.5 (Algorith 1 with lies oitted) is self-sustaiable (Baer ad Baruah, 2009). Meaig that ay set of essages deeed schedulable by the test will also be deeed schedulable by the test if those essages are odified by: (i) decreasig trasissio ties, (ii) icreasig periods or iter-arrival ties, ad (iii) icreasig deadlies. Proof: The proof is i three parts: (i) Decreasig trasissio ties. Proof of this aspect of self-sustaiability follows fro the fact that the queuig delay w of essage, give by (5) ad (8), is oicreasig with respect to ay decrease i the trasissio tie of essage or ay other essages. Note that i (8), MIN the trasissio tie C of the shortest essage i the FIFO queue caot becoe saller by a aout x without at least a equivalet reductio i the su of the essage SUM trasissio ties C, hece the value of SUM MIN C C caot icrease. Fro (6) ad (9), it follows that the essage respose tie R is also o-icreasig with respect to a decrease i essage trasissio ties, ad so the test is self-sustaiable with respect to reductios i essage trasissio ties. (ii) Icreasig periods or iter-arrival ties. As essage periods appear oly i the deoiator of the ceilig fuctios i (5) ad (8), icreases i these values caot result i a icrease i essage queuig delays or respose ties. Hece the test is self-sustaiable with respect to icreases i essage periods. (iii) Icreasig deadlies. As icreases i essage deadlies MIN ca oly icrease the trasissio deadlies E ad E, such icreases caot result i a essage that was previously schedulable accordig to the test becoig uschedulable accordig to the test. Hece the test is selfsustaiable with respect to icreases i essage deadlies Theore 5: The FIFO-syetric schedulability test of Sectio 4.5 (Algorith 1 with lies preset) is selfsustaiable (Baer ad Baruah, 2009) i the geeral case with a arbitrary priority orderig. Proof: Follows fro the proof of Theore 4, otig that the bufferig delay f is equal to the queuig delay w (see (9) ad (10)), ad so f is also o-icreasig with respect to ay decrease i essage trasissio ties, or icrease i essage periods. Note that the proof of Theore 5 does ot require ay chages to the priority order of the essages. They will still reai schedulable accordig to the FIFO-syetric schedulability test with the origial priority orderig Buffer sizes Assuig that all essages have costraied deadlies, ad that the etwor is schedulable, the irrespective of the queuig policy, two istaces of the sae essage caot be preset i the queue at the sae tie; otherwise the first istace would have issed its deadlie. The worst-case buffer usage is therefore equal to the uber of essages that use that queue, ad this occurs whe all of the essages are queued at the sae tie. 5. Priority Assiget Policies The schedulability test preseted i Sectio 4.5 is applicable irrespective of the overall priority orderig, provided that essages sharig the sae FIFO queue are assiged adjacet priorities. Choosig a appropriate priority orderig aog the priority-queued essages ad the FIFO groups is however a iportat aspect of achievig overall schedulability ad hece effective realtie perforace. I this sectio, we cosider the assiget of essages to priority bads, where a priority bad coprises either a sigle priority level cotaiig oe priority-queued essage, or a uber of adjacet priority levels cotaiig a FIFO group of essages. We derive priority assiget policies that are optial with respect to the schedulability aalysis give i Sectio Optial priority assiget Davis et al. (2007), showed that, assuig solely priority queuig, Audsley s Optial Priority Assiget (OPA) algorith (Audsley, 1991, 2001) provides the optial priority assiget for CAN essages. We ow show that with a appropriate odificatio to hadle FIFO groups, Audsley s algorith is also optial with respect to the schedulability test give i Sectio 4.5. The pseudo code for this OPA-FP/FIFO algorith is give i Algorith 2. Note that oly oe essage fro each FIFO group is cosidered i the iitial list, as oce this essage is assiged to a priority bad, the so are the other essages i the sae FIFO group.

11 for each priority bad, lowest first { for each essage sg i the iitial list { if sg is schedulable i priority bad accordig to schedulability test S with all uassiged priorityqueued essages / other FIFO groups assued to be i higher priority bads { assig sg to priority bad if sg is part of a FIFO group { assig all other essages i the FIFO group to adjacet priorities withi priority bad } brea (cotiue outer loop) } } retur uschedulable } retur schedulable Algorith 2: Optial Priority Assiget (OPA-FP/FIFO) Davis ad Burs (2009b, 2011) showed that Audsley s OPA algorith is optial with respect to ay schedulability test that eets three specific coditios. Accordig to Theore 1, we eed oly cosider the priority bads assiged to each priority-queued essage, ad each FIFO group (as all essages i a FIFO group have adjacet priorities i a optial priority orderig). We therefore restate these three coditios i the cotext of priority-queued essages ad FIFO groups. The three coditios refer to properties or attributes of the essages. Message properties are referred to as idepedet if they have o depedecy o the priority assiged to the essage. For exaple the logest trasissio tie, deadlie, ad iiu iter-arrival tie of a essage are all idepedet properties, while the worstcase respose tie typically depeds o the essage s priority ad so is a depedet property. Coditio 1: The schedulability of a essage / FIFO group idetified by, ay, accordig to test S, deped o ay idepedet properties of other essages / FIFO groups i higher priority bads tha, but ot o ay properties of those essages / FIFO groups that deped o their relative priority orderig. Coditio 2: The schedulability of a essage / FIFO group idetified by ay, accordig to test S, deped o ay idepedet properties of the essages / FIFO groups i lower priority bads tha, but ot o ay properties of those essages / FIFO groups that deped o their relative priority orderig. Coditio 3: Whe the priorities of ay two adjacet priority bads are swapped, the the essage / FIFO group beig assiged the higher priority bad caot becoe uschedulable accordig to test S, if it was previously schedulable i the lower priority bad. (As a corollary, the essage / FIFO group beig assiged the lower priority bad caot becoe schedulable accordig to test S, if it was previously uschedulable i the higher priority bad). Theore 6: The OPA-FP/FIFO algorith is a optial priority assiget algorith with respect to the FIFOsyetric schedulability test of Sectio 4.5 (Algorith 1 with lies oitted). Proof: It suffices to show that coditios 1-3 hold with respect to the schedulability test give by Algorith 1 with lies oitted. Coditio 1: Ispectio of (5) & (6) ad (8) & (9), assuig all f are fixed at zero, shows that the respose tie of each essage is depedet o the set of essages i higher priority bads, but ot o their relative priority orderig. Coditio 2: Ispectio of (5) & (6) ad (8) & (9), shows that the respose tie of each essage is depedet o the set of essages i lower priority bads via the direct blocig ter, but ot o their relative priority orderig. Coditio 3: Ispectio of (5) & (6) ad (8) & (9), assuig all f are fixed at zero, shows that icreasig the priority bad of essage caot result i a loger respose tie. This is because although the direct blocig ter ca get larger with icreasig priority this is always couteracted by a decrease i iterferece that is at least as large; hece the legth of the queuig delay caot icrease with icreasig priority, ad so either ca the respose tie For N priority-queued essages / FIFO groups, the OPA-FP/FIFO algorith perfors at ost N(N-1)/2 schedulability tests ad is guarateed to fid a schedulable priority assiget if oe exists. It does ot however specify a order i which essages should be tried i each priority bad. This order heavily iflueces the priority assiget chose if there is ore tha oe orderig that is schedulable. I fact, a poor choice of iitial orderig ca result i a priority assiget that leaves the syste oly just schedulable. We suggest that, as a useful heuristic, priority-queued essages ad FIFO groups are tried at each priority level i order of trasissio deadlie (i.e. E or MIN E ), largest value first. This will result i a priority orderig reflectig trasissio deadlies if such a orderig is schedulable. Alteratively, approaches which result i a robust priority assiget ca be developed fro the techiques described by Davis ad Burs (2009a) TDMO-FP/FIFO priority assiget I idustrial practice, CAN cofiguratios are soeties desiged such that all of the essages are of the sae axiu legth (8 data bytes). This is doe to aeliorate the effects of the large overhead of the other fields (arbitratio, CRC etc) i each essage. Defiitio 3: Trasissio deadlie ootoic priority orderig for FP/FIFO (TDMPO-FP/FIFO) is a priority assiget policy that assigs priority bads to priority queued essages ad FIFO groups accordig to their trasissio deadlies; with a shorter trasissio deadlie iplyig a higher priority. (Recall that the trasissio deadlie of a FIFO group is give by the shortest trasissio deadlie of ay essage i that group). Figure 2 illustrates the TDMPO-FP/FIFO priority

12 assiget policy. I this sectio, we show that the TDMPO-FP/FIFO priority assiget policy is optial, with respect to the sufficiet schedulability test give i Sectio 4.5 (i.e. Algorith 1 with lies oitted) whe all essages have the sae worst-case trasissio tie (C). Corollary 2: For etwors where all of the essage trasissio ties are the sae, the the blocig factor, used i both the sufficiet schedulability test give by Davis et al. (2007) (recapitulated i Sectio 3) ad the sufficiet schedulability tests give i Sectio 4 of this paper, is the sae for every essage, ad is equal to the worst-case essage trasissio tie (C). Lea 4: Let i ad j be the idices of two adjacet priority bads i a priority orderig that is schedulable accordig to the sufficiet schedulability test give i Sectio 4.5 (i.e. Algorith 1 with lies oitted). Assue that i is of higher priority tha j, ad that the trasissio deadlie E X of the priority-queued essage / FIFO group (X) iitially i priority bad i is loger tha the trasissio deadlie E Y of priority-queued essage / FIFO group (Y) iitially i priority bad j. If the priorities of X ad Y are swapped, so that X is i the lower priority bad j, ad Y is i the higher priority bad i, the X reais schedulable, provided that the set of essages all have the sae worstcase trasissio tie (C). Proof: Let R Y, j be the respose tie of Y i priority bad j, (with X i the higher priority bad i). Siilarly, let R X, j be the respose tie of X i priority bad j, (with Y i the higher priority bad i). As Y is schedulable whe it is i the lower priority bad, the, RY, j EY, thus as E Y < E X, it follows that to prove the Lea, we eed oly show that R X, j RY, j. Further, as all essages have the sae worstcase trasissio tie (C), ad so the respose ties are equal to the queuig delays plus C, we eed oly copare the two queuig delays, referred to for coveiece as w X, j ad w Y, j. Below we give forulae for w X, j ad w Y, j based o (5) & (6) ad (8) & (9). We have separated out the iterferece ters for X ad Y. Further, we use B ( j) to represet the blocig factor, ad I ( i, w) to represet the iterferece fro essages i higher priority bads. B( j) = ax( B j, C) = C w + J + τ bit I( i, w) = C hp( i) T (i) Queuig delay w X, j (siplified by cacellig out the blocig factor C ad the C fro ( C X SUM C )) is give by: 1 wx, j J τ SUM bit w X, j = C X + C + I( i, wx, j ) (12) Y T Note, i (12), if X is a priority-queued essage, the C X SUM = C, also, if Y is a priority-queued essage, the there is oly oe essage Y preset i the suatio ter; siilarly for (13) below. (ii) Queuig delay w, : Y j 1 SUM w Y, j J bit w Y, j CY C + I( i, w Y, j ) X τ = + (13) T We ca siplify (13) by otig that as Y is schedulable accordig to the assuptio give i the Lea, the it ust be the case that: w + C = R E < E = i( D J ) i( T J ) Y, j Y, j Y X X X As C > τ bit, we have X : w Y, j + J + τ bit < T, ad so the ceilig fuctio i (13) evaluates to oe i each case; idicatig that oly oe istace of each essage i X ca cotribute to the iterferece ter. Hece (13) siplifies to: + 1 j SUM SUM w Y, = CY + C X + I( i, w Y, ) (14) Now let us cosider a siplificatio of (12) that is valid for values of wx, j EY C. As E = i( D J ) i( T J ) ad C > τ the Y Y Y we have Y : w X, j + J + τ bit < T ad so the ceilig fuctio i (12) evaluates to oe i each case; idicatig that oly oe istace of each essage i Y ca cotribute to the iterferece ter. Hece, provided that wx, j EY C, the (12) reduces to: + 1 SUM SUM w X, j = C X + CY + I( i, w X, j ) (15) Equatios (14) ad (15) are equivalet. As we ow that (14) coverges o a value wy, j = RY, j C EY C, the (15) ad hece (12) ust also coverge o the sae value, thus w X, j = wy, j, ad R X, j = RY, j Theore 7: TDMPO-FP/FIFO is a optial policy for assigig priority-queued essages ad FIFO groups to priority bads, with respect to the sufficiet schedulability test give i Sectio 4.5 (Algorith 1 with lies oitted), provided that all essages have the sae worstcase trasissio tie. Proof: We prove the theore by showig that ay orderig Q of priority bads that is schedulable accordig to the sufficiet schedulability test give i Sectio 4.5 ca be trasfored ito a TDMPO-FP/FIFO priority orderig without ay loss of schedulability. Let i ad j be the idices of two adjacet priority bads i a orderig that is schedulable accordig to the sufficiet schedulability test give i Sectio 4.5. Assue that i is of higher priority tha j, ad that the trasissio deadlie E X of the priority-queued essage / FIFO group (X) i priority bad i is loger tha the trasissio deadlie E Y of the priority-queued essage / FIFO group (Y) i priority bad j. We ow cosider what happes to the schedulability of all of the essages i the syste whe we swap the priorities of X ad Y (i.e. whe we place X i the lower priority bad j, ad Y i the higher priority bad i) to create priority orderig Q. There are four cases to cosider: 1. Priority bads with higher priority tha i ( h hp(i) ): Ispectio of (5) & (6) ad (8) & (9) shows that the respose ties of each of the essages i these bads is the sae i priority orderig Q as it is i priority j bit

13 orderig Q. This is because the priority orderig of the essages with higher priorities tha h is uchaged ad the direct blocig factor due to the set of essages with lower priority tha h depeds oly o the set of essages lp (h) ad ot o their relative priority orderig, ad is i ay case equal to C for all priority bads. All of the essages i bads with priorities higher tha j are therefore schedulable i priority orderig Q. 2. Priority bad i: Y was previously schedulable i the lower priority bad j. Shiftig Y up i priority above X results i o chage to the blocig factor, but reoves iterferece due to X, hece the worst-case respose tie for Y ca be o greater tha it was i priority orderig Q, Y is therefore schedulable i priority orderig Q. 3. Priority bad j: Lea 4 proves that X is schedulable i priority bad j. 4. Priority bads with lower priority tha j ( l hp( j) ): Ispectio of (5) & (6) ad (8) & (9) shows that the respose ties of each of these essages is the sae i priority orderig Q as it is i priority orderig Q. This is because the set of essages i higher priority bads is the sae i both orderigs, ad the iterferece due to higher priority essages does ot deped o their relative priority orderig. Further, the blocig factor due to the set of essages with lower priority tha l depeds oly o the set of essages lp (l) ad ot o their relative priority orderig, ad is i ay case equal to C for all priority bads. All of the essages i bads with priorities lower tha j are therefore schedulable i priority orderig Q. By repeatedly swappig the priorities of ay two adjacet priority bads that are ot i TDMPO-FP/FIFO priority order, ay arbitrary schedulable priority orderig Q ca be trasfored ito a TDMPO-FP/FIFO priority orderig without ay loss of schedulability. Corollary 3: For the case where all odes use priority queues ad all essages have the sae worst-case trasissio tie, TDMPO-FP-FIFO reduces to trasissio deadlie ootoic priority orderig, which is therefore a optial priority assiget policy with respect to the sufficiet schedulability test give by Davis et al. (2007) (recapitulated i Sectio 3). Note that trasissio deadlie (i.e. Deadlie ius Jitter) ootoic priority orderig has also bee show to be a effective heuristic policy i the geeral case with ixed legth essages (Davis ad Burs, 2009a) Priority iversio All of the essages i a FIFO group eed to have sufficietly high priorities that the essage with the shortest trasissio deadlie i the group ca still eet its deadlie. We have show that with the FIFO-syetric schedulability aalysis itroduced i this paper, the ost effective way to achieve this is to assig adjacet priorities to all of the essages i a FIFO group. Despite this, we ote that the use of FIFO queues still typically results i priority iversio with respect to the priority assiget that would be used if all odes ipleeted priority queues. The proble of priority iversio ca be see by cosiderig priority assiget accordig to the TDMPO- FP/FIFO policy, see Figure 2 below. With oly PQ-odes, the priority assiged to each essage would deped oly o its trasissio deadlie, with a loger deadlie iplyig lower priority. With FIFO queues, there are two fors of priority iversio: iteral ad exteral. Iteral priority iversio taes place withi a FIFO queue whe essages with loger trasissio deadlies eter the queue before, ad so are trasitted ahead of, essages with shorter trasissio deadlies. Exteral priority iversio occurs because all of the essages i a FIFO group effectively obtai priorities based o the shortest trasissio deadlie of ay essage i that group. This has the effect of creatig priority iversio with respect to essages set by other odes that have trasissio deadlies betwee the axiu ad iiu trasissio deadlies of essages i the FIFO group. This is illustrated i Figure 2, where essages causig exteral priority iversio are shaded i grey. FIFO group1 FQ-sg1: E = 10 FQ-sg2: E = 25 FQ-sg3: E = 100 FIFO group2 FQ-sg4: E = 50 FQ-sg5: E = 125 FQ-sg6: E = 1000 FQ-sg7: E = 1000 FQ-sg8: E = 1000 PQ-sg1: E = 5 PQ-sg2: E = 10 FQ-group1: E MIN = 10 PQ-sg3: E = 20 PQ-sg4: E = 50 FQ-group2: E MIN = 50 PQ-sg5: E = 100 PQ-sg6: E = 250 PQ-sg7: E = 250 PQ-sg8: E = 500 Higher priority Lower priority Figure 2: TDMPO-FP/FIFO priority orderig I Figure 2, observe that the essages withi each FIFO group have their priorities assiged accordig to trasissio deadlie ootoic priority assiget. We recoed this approach as although it does ot alter the sufficiet worst-case respose ties of the essages as calculated by our aalysis, it could result i lower actual worst-case respose ties for those essages i the group that have shorter trasissio deadlies. 6. Case Study: Autootive To show that our priority assiget policies ad schedulability aalysis wor with a real applicatio we aalysed a CAN bus architecture fro the autootive doai, first preseted by Kolla et al., (2010). Figure 3 shows this architecture. The syste cosists of a CAN bus coectig 10 ECUs. There are a total of 85 essages set o the bus. The uber of essages set by each ECU is give by the aotatios i Figure 3. All essages are set strictly periodically ad share a coo release tie. The

14 iteded bus speed for this etwor was 500 Bit/s. We assued that the queuig jitter for each essage was 1% of its period. Figure 3: CAN bus architecture We iitially copared five differet cofiguratios of the syste: Expt. 1: All ECUs used priority queues. Expt. 2: ECU3 ad ECU6 used FIFO queues ad the reaiig ECUs used priority queues. Expt. 3: All ECUs used FIFO queues. Expt. 4: All ECUs used priority queues, but the priority orderig was that established by Expt 3. Expt. 5: All ECUs used priority queues, but the priority orderig used was rado. I each experiet we deteried the lowest bus speed coesurate with a schedulable syste. The iiu bus speed was foud by a biary search with the essage priorities assiged accordig to the OPA-FP/FIFO algorith (Algorith 2) usig trasissio deadlie ootoic priority orderig as the reverse orderig for the iitial list. (For each FIFO group, oly the essage with the shortest trasissio deadlie was icluded i the iitial list). We siulated the syste assuig a bus ruig at the iiu bus speed, ad usig the priority orderig obtaied durig aalysis. The siulated etwor operatig tie was 1 hour. We used the coercial siulator fro Ichro (chrosim) to produce the siulatio results. There are three lies plotted o each of the graphs. The lies give the followig iforatio for each essage: (i) (ii) (iii) Trasissio deadlie; Worst-case respose tie coputed usig the aalysis give i Sectio 4.5, assuig the iiu schedulable bus speed for the cofiguratio. Maxiu observed respose tie foud by siulatio, assuig the iiu schedulable bus speed foud by aalysis. All of this data is plotted i s o the y-axis usig a logarithic scale. The x-axis o the graphs represets the priority order of the essages. Hece data for the essage assiged the highest priority i a particular cofiguratio appears o the LHS of the graph, while data for the lowest priority essage appears o the RHS. Note the priority order is differet i each experiet. Figure 4 depicts the results of Expt. 1, where all ECUs used priority queues. I this case, the iiu bus speed was 277 Bit/s, ad the correspodig bus utilisatio 84.5%. We observe that with this bus speed, the 26 th highest priority essage oly just eets its deadlie. Further, the results of aalysis ad siulatio are close together. This is because the essages share a coo release tie, ad all of the ECUs used priority-based queues, hece there is very little pessiis i the aalysis, ad the siulatio captures the worst-case sceario well. Figure 5 depicts the results of Expt. 2, where ECU3 ad ECU6 used FIFO queues ad the other ECUs used priority queues. I this case, the iiu bus speed was 389 Bit/s, ad the correspodig bus utilisatio 60.1%. Our aalysis attributes the sae worst-case respose tie to all of the essages i a FIFO queue; this results i the horizotal segets of the aalysis lies i Figure 5. The first FIFO queue is the 12 essages set by ECU3, ad the secod, the 6 essages set by ECU6. The iiu trasissio deadlie for both FIFO queues was 13.8 s. Observe that i Figure 5 the results of aalysis ad siulatio are close together for the essages set via priority queues, whereas for the essages set via FIFO queue there are larger gaps. These gaps are predoiatly due to the siulatio ot capturig the worst-case sceario for all of the FIFO-queued essages. This is evidet fro the variability of the axiu respose ties obtaied via siulatio for essages i the sae FIFO group. Figure 4: Respose Ties (PQ oly) Figure 5: Respose Ties (FQ ad PQ)

15 Figure 6: Respose Ties (FQ oly) Figure 7: Respose Ties (PQ oly, FQ priorities) Figure 8: Respose Ties (PQ oly, rado priorities) Figure 6 depicts the results of Expt. 3, where all ECUs used FIFO queues. I this case, the iiu bus speed was 654 Bit/s, ad the correspodig bus utilisatio oly 35.8%. I cotrast to the Expt. 1 & 2, this cofiguratio is ot schedulable at the iteded bus speed for the etwor of 500 Bit/s. I Expt. 3 (Figure 6), soe of the axiu respose ties observed i the siulatio are very low copared to the worst-case respose ties coputed by the aalysis. This is caused by differeces i the order i which essages eter the FIFO queues i the siulatio, copared to the assuptios ade by the aalysis. Figure 7 depicts the results of Expt. 4 which used the priority orderig obtaied i Expt. 3, but assued priority queues rather tha FIFO queues. I this case, the iiu bus speed required was 608 Bit/s, ad the correspodig bus utilisatio 38.5%. Copariso of these results with those fro Expt. 1 ad Expt. 3 shows that the ajority of the perforace degradatio caused by usig FIFO queues occurs as a result of uavoidable exteral priority iversio i the for of a disrupted priority orderig, rather tha as a cosequece of iteral priority iversio or pessiistic schedulability aalysis for FIFO queues. Fially, Expt. 5 exaied 1000 rado priority orderigs with o correlatio betwee essage priority ad trasissio deadlie. This experiet siulates assigig priorities to essages o the basis of the type of data or ECU, or ideed ay other etric that has little or o correlatio with essage trasissio deadlies. I this case, the ea value for the iiu bus speed required was 731 Bit/s (i. 618 Bit/s, ax. 750 Bit/s), ad the correspodig bus utilisatio 32.0% (ax. 37.8%, i. 31.2%). Figure 8 depicts the results of Expt. 5 for the worst of the rado priority orderigs, which required a iiu bus speed of 750 Bit/s i order to be schedulable. It is clear fro the graph, that it is the assiget of a low priority (80 th highest priority) to a essage with a short trasissio deadlie that results i the eed for such a high bus speed. Expt. 5 is directly coparable with Expt. 1 ad shows the iportace of appropriate priority assiget. I this case, arbitrary priority assiget icreased the iiu bus speed required by 163% while reducig the axiu schedulable bus utilisatio fro 84.5% to 32.0% (figures for the average case). The results of the experiets are suarised i Table 2 below. Table 2: Case Study: FIFO queues: Suary of results Expt. Node type Priority order Mi bus speed Max bus util. 1 All PQ OPA 277 Kbit/s 84.5% 2 2 FQ, OPA-FP/FIFO 389 Kbit/s 60.1% 8 PQ 3 All FQ OPA-FP/FIFO 654 Kbit/s 35.8% 4 All PQ Priority orderig 608 Kbit/s 38.5% fro Expt. 3 5 All PQ Rado Kbit/s 32.0% 6.1. Gateways ad ultiple FIFO queues Our case study is typical of autootive applicatios i 10 Values are the average for 1000 rado orderigs.

16 that it icludes a gateway ECU, which is coected to two CAN buses ad used to trasfer data betwee the. The gateway ECU has 38 essages to trasit, which is far ore tha the uber of trasit buffers available i ost CAN cotrollers. A seeigly attractive desig solutio for the gateway is to use a sigle FIFO queue; however, as we will see, such a choice ca sigificatly degrade the real-tie perforace of the etwor, copared to ipleetig a priority queue. If a priority queue ipleetatio is ot possible, the a viable alterative ay be to ipleet ultiple FIFO queues, each of which uses a separate hardware trasit buffer i the gateway s CAN cotroller to sed its essages. We ote that soe CAN devices such as the PIC32MX provide specific hardware support for ultiple FIFO queues i this way. I this sectio, we report the results of three further experiets exaiig the use of FIFO queues i the gateway ECU. I each of these experiets, ECUs 1-9 all used priority queues; however, we varied the behaviour of the gateway ECU as follows: Expt. 6: The gateway used a sigle FIFO queue. Expt. 7: The gateway used two FIFO queues. The 18 essages with the sae (shortest) trasissio deadlie of less tha 20 s shared the 1st FIFO queue ad the rest of the essages set by the gateway shared the 2d FIFO queue. Expt. 8: The gateway used three FIFO queues. The first 18 essages by trasissio deadlie shared the 1st FIFO queue, the ext 14 essages the 2d FIFO queue, ad the reaiig essages the 3 rd FIFO queue. Note the allocatio of essages to FIFO queues was doe o the basis of groupig essages with siilar trasissio deadlies together, as this iiises priority iversio. Table 3 suarises the results of the three experiets. Table 3: Case Study: Gateway ultiple FIFO queues: Suary of results Expt. Gateway Priority order Mi bus Max speed bus util. 6 1-FQ OPA-FP/FIFO 388 Kbit/s 60.3% 7 2-FQ OPA-FP/FIFO 285 Kbit/s 82.1% 8 3-FQ OPA-FP/FIFO 277 Kbit/s 84.5% The results for Expt. 1 where the gateway used a priority queue are show i Figure 4. Figure 9 shows that usig a sigle FIFO queue for the gateway icreased the iiu schedulable bus speed fro 277 Kbit/s (i the case of a priority queue) to 388 Kbit/s, ad reduced the axiu achievable bus utilisatio fro 84.5% to 60.3%. Usig two FIFO queues ade a sigificat iproveet, reducig the priority iversio caused by the sub-set of gatewayed essages with trasissio deadlies greater tha 20 s. This decreased the iiu schedulable bus speed to 285 Kbit/s, ad icreased the axiu achievable bus utilisatio to 82.1%, as show i Figure 10. Fially, usig three FIFO queues produced results that were equivalet i perforace ters to usig a priority queue, see Figure 11. Note, i Figure 9, Figure 10, ad Figure 11, the trasissio deadlies of essages set by the gateway are colour coded to show which FIFO they belog to. Figure 9: Respose Ties (Gateway 1-FQ) Figure 10: Respose Ties (Gateway 2-FQ) Figure 11: Respose Ties (Gateway 3-FQ) These experiets show that, for the case-study, a cofiguratio where the gateway uses three FIFO queues is far ore effective tha the default optio of usig just oe

17 FIFO queue. I this case, usig ultiple FIFO queues ad groupig essages by trasissio deadlie greatly reduces the aout of priority iversio, ad sigificatly iproves the real-tie perforace of the etwor with respect to just usig oe FIFO queue. 7. Experietal Evaluatio I this sectio we explore further the effects that FIFO queues ad priority assiget policies have o the axiu bus utilisatio. Our experietal evaluatio exaied a syste with 8 odes ad 80 essages coected via a sigle CAN bus. We cosidered five differet cofiguratios of this etwor. I Cofig. #1, all of the odes used priority queues. Cofigs. #2, #3, ad #4 icreased the uber of odes usig FIFO queues fro 2, to 4 to 8 (1/4, 1/2 ad all odes respectively). I Cofigs. #1 #4, essage priorities were assiged accordig to the TDMPO-FP/FIFO policy as depicted i Figure 2. (As all the essages were of the sae legth, this priority orderig was optial). I cotrast, i Cofig. #5, essage priorities were assiged at rado, ad all odes used priority queues. To exaie the perforace of these five cofiguratios, we radoly geerated 10,000 sets of essages as follows: o The period of each essage was chose accordig to a log-uifor distributio fro the rage s; thus geeratig a equal uber of essages i each tie bad (e.g s, s etc.). o The deadlie of each essage was equal to its period. o The jitter of each essage was chose accordig to a uifor rado distributio i the rage 2.5s to 5s. o Each essage cotaied 8 data bytes. o Each essage was radoly allocated to oe of the 8 odes o the etwor, thus o average, each ode trasitted 10 essages. o All essages were assued to have 11-bit idetifiers. For each cofiguratio, we coputed the axiu bus utilisatio for each essage set. This was doe via a biary search cobied with the schedulability aalysis give i Sectios 3 ad 4. A bi size of 1% was used i the frequecy distributio plots, with essage sets with axiu bus utilisatios i the rage 50.00% to 50.99% recorded i the 50% bi. The solid lies i Figure 12 illustrate the frequecy distributio of the axiu bus utilisatio across the 10,000 essage sets for each of the five cofiguratios. Fro Figure 12, it is clear that the use of FIFO queues sigificatly degrades the real-tie perforace of the etwor. With all eight odes usig priority queues (#1), the ea value of the axiu bus utilisatio was 89.5%. With a quarter of the odes usig FIFO queues (#2), this reduced to 62.7%, ad with half of the odes usig FIFO queues (#3) it further reduced to 44.9%. Fially, with all eight odes usig FIFO queues (#4) the ea value of the axiu bus utilisatio degraded to just 28.4%. Worse still was rado priority assiget (# 5) with a ea value of just 18.4%; despite usig priority queues. Figure 12 also shows results for the priority orderigs obtaied fro Cofigs. #2, #3, ad #4, assuig that all odes use priority queues. These results are labelled #2a, #3a, ad #4a respectively (dashed lies). The differeces betwee Cofigs. #1, #2a, #3a, ad #4a are idicative of the perforace degradatio caused by the FIFO queues due to exteral priority iversio (i.e. priority iversio with respect to essages set by other odes). By cotrast, the differece betwee the pairs of Cofigs. #2 #2a, #3 #3a, ad #4 #4a are idicative of the perforace degradatio caused by the FIFO queues due to iteral priority iversio (i.e. priority iversio with respect to essages set by the sae ode), ad also potetial pessiis i the schedulability aalysis for FIFO queues. As expected, the degradatio i perforace due to exteral priority iversio is uch larger tha that due to iteral priority iversio, which affects oly a liited uber of essages. We repeated our experietal evaluatio of a 8 ode syste for essage sets of size 20 ad 40. The for of the results ad the broad coclusios that ca be draw fro the reaied the sae as with essage sets of size 80. However, with fewer essages to radoly allocate to each ode, the perforace degradatio due to each FIFO queue becae soewhat saller. (This is expected as i the liit, with just oe essage per ode, FIFO ad priority queues are equivalet). Results for 8 odes ad essage sets of sizes 20, 40 ad 80 are suarised i Table 4 ad depicted for essage sets of sizes 80 ad 20 i Figure 12 ad Figure 13. Frequecy #5 PQ - Rado Priorities #1 PQ (No FIFO odes) #2 FQ ad PQ (Quarter FIFO odes) #2a PQ (Priorities fro 2.) #3 FQ ad PQ (Half FIFO odes) #3a PQ (Priorities fro 3.) #4 FQ (All FIFO odes) #4a PQ (Priorities fro 4.) #5 PQ - Rado Priorities #4 FQ (All FIFO odes) #3 FQ ad PQ (Half FIFO odes) #2 FQ ad PQ (Quarter FIFO odes) #1 PQ (No FIFO odes) Breadow Utilisatio Figure 12: Frequecy distributio of ax. bus utilisatio (8 odes, 80 essages, 10,000 essage sets)

18 Frequecy #5 PQ - Rado Priorities #1 PQ (No FIFO odes) #2 FQ ad PQ (Quarter FIFO odes) #2a PQ (Priorities fro 2.) #3 FQ ad PQ (Half FIFO odes) #3a PQ (Priorities fro 3.) #4 FQ (All FIFO odes) #4a PQ (Priorities fro 4.) #5 PQ - Rado Priorities #4 FQ (All FIFO odes) #3 FQ ad PQ (Half FIFO odes) #1 PQ (No FIFO odes) #2 FQ ad PQ (Quarter FIFO odes) Breadow Utilisatio Figure 13: Frequecy distributio of ax. bus utilisatio (8 odes, 20 essages, 10,000 essage sets) Table 4: Evaluatio: 8 odes, varyig the uber of essages per ode Cofig. Node Priority Mea of Max. bus util. types order =20 =40 =80 1 All PQ TDMPO 86.8% 88.4% 89.5% 2 1/4 FQ, TDMPO- 72.7% 68.1% 62.7% 3/4 PQ FP/FIFO 3 1/2 FQ, TDMPO- 61.6% 53.6% 44.9% 1/2 PQ FP/FIFO 4 All FQ TDMPO- 46.5% 36.9% 28.4% FP/FIFO 5 All PQ Rado 26.1% 21.5% 18.4% We also repeated our experietal evaluatio for 16 ad 24 ode systes with essage sets of size 160 ad 240 respectively. As the average uber of essages per ode was the sae as the case with 8 odes ad 80 essages, the results were also siilar. Results for essage sets of sizes 80, 160 ad 240 are suarised i Table 5 ad depicted for essage sets of sizes 80 ad 240 i Figure 12 ad Figure 14. As the average uber of essage per ode was costat i these experiets, the average of the axiu achievable bus utilisatio varied oly a sall aout. However, with ore essages the frequecy distributios becae sharper, ad the axiu achievable bus utilisatio icreased slightly. The latter effect is due to the fact that with ore essages, essage trasissio ties are saller with respect to overall respose ties, ad so the effect of o-pre-eptive trasissio becoes less proouced, ad so schedulability iproves. I the case of Cofig. #5, usig a rado priority order, the average achievable bus utilisatio decreased as the uber of odes ad essages icreased, eve though the average uber of essages per ode reaied costat. This was due to the fact that with a larger uber of essages, there is a saller probability that oe of the essages with short deadlies will be assiged low priorities (for exaple i the lowest 5% of essages by priority), hece the frequecy distributio is less spread out towards higher utilisatio values, ad has a lower ea. Table 5: Evaluatio: varyig uber of odes ad essages with the sae average uber of essages per ode Cofig. Node types Priority order Mea of Max. bus util. 8 odes =80 16 odes = odes =240 1 All PQ TDMPO 89.5% 90.3% 90.7% 2 1/4 FQ, TDMPO- 62.7% 65.6% 67.0% 3/4 PQ FP/FIFO 3 1/2 FQ, TDMPO- 44.9% 47.2% 48.3% 1/2 PQ FP/FIFO 4 All FQ TDMPO- 28.4% 29.8% 30.6% FP/FIFO 5 All PQ Rado 18.4% 16.3% 15.4% Frequecy #5 PQ - Rado Priorities #1 PQ (No FIFO odes) #2 FQ ad PQ (Quarter FIFO odes) #2a PQ (Priorities fro 2.) #3 FQ ad PQ (Half FIFO odes) #3a PQ (Priorities fro 3.) #4 FQ (All FIFO odes) #4a PQ (Priorities fro 4.) #5 PQ - Rado Priorities #4 FQ (All FIFO odes) #3 FQ ad PQ (Half FIFO odes) #2 FQ ad PQ (Quarter FIFO odes) #1 PQ (No FIFO odes) Breadow Utilisatio Figure 14: Frequecy distributio of ax. bus utilisatio (24 odes, 240 essages, 10,000 essage sets) Overall, our experietal evaluatio shows that realtie etwor perforace, easured i ters of the axiu achievable bus utilisatio is sesitive to the followig: the proportio of odes o the etwor ipleetig FIFO queues; the uber of essages set by FQ-odes, ad the rage of trasissio deadlies of essages i each FIFO group copared to other essages set o the etwor. Icreasig ay / all of these factors icreases priority iversio, to the detriet of etwor perforace Gateways ad ultiple FIFO Queues We ow explore further the effect that usig FIFO queues i gateway applicatios has o the axiu achievable bus utilisatio. To ivestigate this, we evaluated a etwor with 120

19 essages i total, 48 of which were set by a gateway ode. All other essages were assued to be set by odes ipleetig priority queues, hece the results hold idepedet of the uber of o-gateway odes o the etwor. The essage paraeters were geerated as described previously, with 48 essages allocated to the gateway ad the reaider to the other odes. We cosidered seve differet cofiguratios of the gateway ode. I Cofig. #1, the gateway used a priority queue. I Cofigs. #2 to #6, the gateway ipleeted 16, 8, 4, 2, ad 1 FIFO queues respectively, which were used to trasit its 48 essages. I Cofigs. #1 to #6, essage priorities were assiged accordig to the TDMPO-FP/FIFO policy as depicted i Figure 2. (As all the essages were of the sae legth, this priority orderig was optial). I cotrast, i Cofig. #7, essage priorities were assiged at rado, ad the gateway agai used a priority queue. Whe the gateway used ore tha oe FIFO queue, the the essages set by the gateway were sorted accordig to their trasissio deadlies, ad the G / N FIFO essages with the shortest trasissio deadlies were assiged to the first FIFO queue, where G is the uber of essages set by the gateway, ad N is the uber of FIFO FIFO G N FIFO queues it uses. The ext / essages, ordered by trasissio deadlie, were assiged to the 2 d FIFO queue, ad so o. This siple allocatio heuristic esured that all of the FIFO queues had a sall uber of essages, ad that the essages i each FIFO queue had broadly siilar trasissio deadlies. Frequecy #7 PQ - Rado Priorities #6 Gateway 1-FQ #1 PQ - Optial Priorities #2 Gateway 16-FQ #3 Gateway 8-FQ #4 Gateway 4-FQ #5 Gateway 2-FQ #6 Gateway 1-FQ #7 PQ - Rado Priorities #5 Gateway 2-FQ #1 PQ - Optial Priorities #2 Gateway 16-FQ #3 Gateway 8-FQ #4 Gateway 4-FQ Breadow Utilisatio Figure 15: Frequecy distributio of ax. bus utilisatio for differet gateway cofiguratios (120 essages, 48 set by the gateway, 10,000 essage sets) Figure 15 shows the frequecy distributio of the axiu achievable bus utilisatio for the seve differet cofiguratios, ad the 10,000 radoly geerated sets of essages used. It is evidet fro Figure 15 that, with the gateway sedig a large uber of essages with diverse trasissio deadlies, usig a sigle FIFO queue results i poor etwor perforace. The average value for the axiu achievable bus utilisatio i this case was just 34.2%. However, perforace was sigificatly iproved by ipleetig ultiple FIFO queues i the gateway. Usig two FIFO queues iproved the average value for the axiu achievable bus utilisatio to 62.3%. While utilisig 4, 8 or 16 FIFO queues, resulted i perforace approachig that of a priority queue. A suary of these results is give i Table 6. Table 6: Evaluatio: gateway cofiguratios Cofig. Gateway Priority order Mea of Max. bus util. #1 PQ TDMPO 90.0% #2 16-FQ TDMPO-FP/FIFO 89.1% #3 8-FQ TDMPO-FP/FIFO 87.4% #4 4-FQ TDMPO-FP/FIFO 83.1% #5 2-FQ TDMPO-FP/FIFO 62.3% #6 1-FQ TDMPO-FP/FIFO 34.2% #7 PQ Rado 17.1% We ote that the results of our evaluatio are based o the use of a siple heuristic for allocatig essages to FIFO queues. We expect that i ay cases, iproved perforace could be obtaied with fewer FIFO queues by usig a ore sophisticated essage allocatio policy. This is bore out by the results of the case study. Ivestigatio of such policies is however beyod the scope of this paper. 8. Suary ad Coclusios The ajor cotributio of this paper is the derivatio of sufficiet respose tie aalysis for CAN where soe of the odes o the etwor ipleet FIFO queues, while others ipleet priority queues. This aalysis is FIFOsyetric i that it attributes the sae worst-case respose tie (easured fro the tie a essage is queued i the sedig ode util it is received by other odes o the bus) to all of the essages that share the sae FIFO. For this schedulability aalysis, we proved that it is optial to assig adjacet priorities to essages that share the sae FIFO. We odified Audsley s Optial Priority Assiget algorith to provide a overall priority assiget policy (OPA-FP/FIFO) that is optial with respect to our aalysis for both priority-queued essages ad groups of essages that share a FIFO. Further, we showed that a siple policy based o trasissio deadlies (TDMPO-FP/FIFO), depicted i Figure 2, is optial with respect to our aalysis for the specific case whe all essages are of the sae legth. Although this paper provides schedulability aalysis for CAN assuig FIFO queues, we caot recoed the use of such queues. By copariso with priority queues, FIFO queues ievitably cause priority iversio which is detrietal to real-tie perforace. Usig appropriate optial priority assiget policies i both cases, we were able to ae a lie-for-lie copariso betwee the use of priority queues ad FIFO queues, thus deteriig the specific pealty icurred by the latter i ters of etwor perforace. We foud that the use of FIFO queues sigificatly icreases the iiu bus speed

20 ecessary to esure that all deadlies are et. This was illustrated i our case study where allowig just two ECUs (sedig 18 out of the 85 essages) to use FIFO queues icreased the iiu bus speed required fro 277 Bit/s with priority queues to 389 Bit/s, a 40% icrease. With all ECUs usig FIFO queues, the iiu bus speed required icreased to 654 Bit/s; a icrease of over 130%. Usig FIFO queues reduces the axiu bus utilisatio achievable before ay deadlies are issed, thus liitig the scope for extedig a syste by addig further essages without havig to icrease bus speed. I our case study, the axiu bus utilisatio with priority queues was 84.5%, this reduced to 60.1% whe two ECUs used FIFO queues, ad to just 35.8% whe all of the ECUs used FIFO queues. These figures were baced-up by our experietal evaluatio of a eight ode syste with 80 essages. This evaluatio of 10,000 radoly geerated essage sets showed a degradatio i the ea value of the axiu bus utilisatio fro 89.5% with all odes usig priority queues, to 62.7% with two odes usig FIFO queues, to 44.9% with four odes usig FIFO queues, to just 28.4% with all eight odes usig FIFO queues. Such reductios i achievable utilisatio ot oly icrease the iiu bus speed required to obtai a schedulable etwor, but also decrease the robustess of the etwor to errors that result i essage re-trasissio. We recoed that CAN device drivers / software protocol layers ipleet priority-based queues, rather tha FIFO queues wheever possible. FIFO queues are appealig because they are sipler to ipleet ad ae the device driver appear ore efficiet; however, this perceived local gai typically coes at the expese of uderiig the priority-based essage arbitratio schee used by CAN, ad sigificatly degradig the overall real-tie perforace capability of the etwor. We ote that the degree of priority iversio caused ad hece the degradatio i perforace due to usig FIFO queues is lower whe oly a few essages use each FIFO queue or alteratively whe the essages that use each FIFO queue have siilar trasissio deadlies. Uder these circustaces, the use of FIFO queues alog with appropriate priority assiget ay result i a satisfactory solutio. If o the other had, FIFO queues are used for large ubers of essages with a wide rage of trasissio deadlies, the this ca be expected to have a sigificat detrietal ipact o etwor perforace. For ECUs that act as a gateway fro oe CAN bus to aother ad thus have a large uber of essages to trasit, if a priority queue ipleetatio is ot possible, the syste desigers ay wish to cosider usig ultiple FIFO queues each utilisig a separate hardware trasit buffer. A allocatio of essages to these ultiple FIFO queues ca the ai to avoid assigig essages with widely differig trasissio deadlies to the sae FIFO queue, while also eepig the uber of essages i each FIFO queue relatively sall. This approach ca result i sigificatly higher etwor perforace tha the alterative of usig a sigle FIFO queue. The schedulability aalysis ad priority assiget policies give i this paper provide the tools ecessary to ivestigate such trade-offs. This was deostrated i a further cofiguratio of our case study (described i Sectio 7.1), where the iiu bus speed required reduced fro 388 Bit/s whe the gateway ipleetatio used a sigle FIFO queue, to 285 Bit/s whe it used two FIFO queues, to 277 Bit/s whe it used three FIFO queues (assuig all other odes used priority queues). This copares favourably with the iiu bus speed of 277 Bit/s required whe the gateway used a priority queue. These figures equate to axiu achievable bus utilisatios of 60.3% with oe FIFO queue, 82.1% with two FIFO queues, 84.5% with three FIFO queues, ad the sae 84.5% with a priority queue. These figures were baced up via further epirical evaluatio showig that reducig priority iversio via the use of ultiple FIFO queues, rather tha a sigle FIFO queue, withi a gateway ode is effective i reducig the iiu required bus speed ad so icreasig the axiu achievable bus utilisatio. Fially, both our case study ad experietal evaluatio cofired that appropriate priority assiget is vital to obtaiig effective real-tie perforace fro Cotroller Area Networs. Usig a rado priority assiget policy, represetative of priority assiget based o the type of data ad ECU, or ideed ay other etric that has little or o correlatio with trasissio deadlies, icreased the iiu bus speed required fro 277 Bit/s to 731 Bit/s, ad reduced the axiu bus utilisatio fro 84.5% to just 32.0% i the case study, as copared to a optial priority assiget policy. This data was baced up by our evaluatio of a eight ode syste with 80 essages. Here, for essage sets of size 80, a rado priority assiget policy resulted i values for the axiu bus utilisatio, for 10,000 radoly geerated essage sets, i the rage 8% to 45% with a ea of just 18.4%, copared to a rage of 69% to 96% ad a ea of 89.5% whe a optial priority assiget policy was used. We therefore strogly recoed that i Cotroller Area Networs, essage IDs are assiged usig a optial or ear optial priority orderig reflectig essage trasissio deadlies Recoedatios ad further research The research preseted i this paper serves two ai purposes. Firstly, it highlights the detrietal effect that usig FIFO queues ca have o etwor perforace. Here, our ai was to ifor the desig choices ade by syste itegrators ad desigers, thus esurig that ewly developed systes ipleet priority queues wheever possible. Secodly, we recogise that due to other factors ifluecig or costraiig desig choices, soe autootive etwors will cotiue to be built usig soe ECUs that ipleet FIFO queues. I this case, the aalysis preseted i this paper ca be used to deteriig etwor schedulability. Give that it ay ot always be possible to avoid usig FIFO queues, our results o priority assiget

21 ad the use of ultiple FIFOs show how to ae the ost effective use of the. Further, we highlighted the detrietal effect that usig a sub-optial essage ID allocatio (priority assiget) ca have. We acowledge that there are soeties desig costraits o priority assiget, for exaple due to the iclusio of legacy copoets; however, we hope that our wor i this area will otivate syste itegrators to fully cosider priority assiget for essages o CAN, debuig the ee 11 of CAN bus utilisatio, that oe caot ru CAN reliably at ore tha 35% utilisatio (Buttle, 2012). We ote that the aalysis described i this paper has bee geeralised by Davis ad Navet (2012) to essages with arbitrary deadlies, ad wor-coservig queuig policies 12, of which FIFO is a exaple. Davis ad Navet (2012) showed that for essages with costraied deadlies, the aalysis give i this paper holds ot oly for FIFO queues but also for wor-coservig queuig policies i geeral. Fially, we ote that ay autootive systes ae use of offsets betwee essage trasissio ties as a eas of reducig the pea load o the etwor ad hece iprovig essage schedulability. The aalysis of FIFO queues i this paper was derived for systes where all of the essages ca potetially be queued siultaeously. As such, it provides upper bouds o the respose ties of essages with offsets; however, this is a area where further research would be useful i obtaiig tighter upper bouds o essage respose ties. Acowledgeets The authors would lie to tha Ala Burs for his coets o a previous draft of this paper. This wor was partially fuded by the UK EPSRC fuded Tepo project (EP/G055548/1), the EU fuded ArtistDesig Networ of Excellece, the Gera Research Foudatio, ad the Carl Zeiss Foudatio. Refereces Avet (2006), Avet core datasheet versio 1.0 July Audsley N.C., (1991) "Optial priority assiget ad feasibility of static priority tass with arbitrary start ties", Techical Report YCS 164, Dept. Coputer Sciece, Uiversity of Yor, UK, Dec Audsley N.C., (2001) O priority assiget i fixed priority schedulig, Iforatio Processig Letters, 79(1): 39-44, May Baer T.P., Baruah S.K., (2009) Sustaiable ultiprocessor schedulig of sporadic tas systes. I Proceedigs of the EuroMicro Coferece o Real-Tie Systes, pp Baruah S.K., Burs A., (2006) Sustaiable Schedulig Aalysis. I Proceedigs of the 27th Real-tie Systes Syposiu,, pp A ee is soethig believed but ot true. 12 A wor-coservig queuig policy is oe which esures that wheever the ode has ay essages i its trasit queue ad the bus becoes idle the there is a essage ready to be trasitted. Bosch, (1991) CAN Specificatio versio 2.0. Robert Bosch GbH, Postfach , D Stuttgart. Bibard F., George L., (2006) FP/FIFO feasibility coditios with erel overheads for periodic tass o a evet drive OSEK syste. I Proceedig of ISORC. Broster I., Burs A., Rodríguez-Navas G., (2002) Probabilistic Aalysis of CAN with Faults, I Proceedigs of the 23rd IEEE Real-Tie Systes Syposiu (RTSS'02), pp Broster I., Burs A., (2003) A Aalysable Bus-Guardia for Evet-Triggered Couicatio. I Proceedigs of the 24th Real-tie Systes Syposiu, pp Broster I., (2003) Flexibility i depedable couicatio. PhD Thesis, Departet of Coputer Sciece, Uiversity of Yor, UK, August Broster I., Burs A., Rodriguez-Navas G., (2005) Tiig aalysis of real-tie couicatio uder electroagetic iterferece, Real-Tie Systes, 30(1-2) pp Buttle D., (2012) Real-Tie i the Prie Tie Keyote tal at the EuroMicro Coferece o Real-Tie Systes. Presetatio available fro Casparsso L., Raja A., Tidell K., Malberg P., (1998) Volcao - a revolutio i o-board couicatios. Volvo Techology Report, 1998/1. chrosim. Davis R.I., Burs A., Bril R.J., Luie J.J., (2007) Cotroller Area Networ (CAN) Schedulability Aalysis: Refuted, Revisited ad Revised. Real-Tie Systes, Volue 35, Nuber 3, pp Davis R.I., Zabos A., Burs A., (2008) "Efficiet Exact Schedulability Tests for Fixed Priority Real-Tie Systes. IEEE Trasactios o Coputers IEEE Coputer Society Digital Library. IEEE Coputer Society, Vol. 57, No. 9, pp Davis R.I., Burs A., (2009a) "Robust priority assiget for essages o Cotroller Area Networ (CAN). Real-Tie Systes, Volue 41, Issue 2, pages Davis R.I., Burs A., (2009b) "Priority Assiget for Global Fixed Priority Pre-eptive Schedulig i Multiprocessor Real- Tie Systes. I proceedigs Real-Tie Systes Syposiu (RTSS), pages Davis R.I., Burs A., (2011) "Iproved Priority Assiget for Global Fixed Priority Pre-eptive Schedulig i Multiprocessor Real-Tie Systes. Real-Tie Systes, Volue 47, Issue 1, pages Davis R.I., Kolla S., Pollex V., Sloa F., (2011) "Cotroller Area Networ (CAN) Schedulability Aalysis with FIFO queues. I proceedigs 23rd Euroicro Coferece o Real-Tie Systes, pages Davis R.I., Navet N., (2012) Cotroller Area Networ (CAN) Schedulability Aalysis for Messages with Arbitrary Deadlies i FIFO ad Wor-Coservig Queues. I proceedigs 9th Worshop o Factory Couicatio Systes, pp Di Natale M., (2006) Evaluatig essage trasissio ties i Cotroller Area Networs without buffer preeptio, I proceedigs 8th Brazilia Worshop o Real-Tie Systes. Di Natale M., (2008) Uderstadig ad usig the Cotroller Area etwor ist.eecs.bereley.edu/~ee249/fa08/lectures/ hadout_cabus2.pdf. Ferreira J., Oliveira A., Foseca P., Foseca J. A.. (2004) A Experiet to Assess Bit Error Rate i CAN. I Proceedigs of 3rd Iteratioal Worshop of Real-Tie Networs, pp

22 Hasso H., Nolte T., Norstro C., Pueat S., (2002) Itegratig Reliability ad Tiig Aalysis of CAN-based Systes. IEEE Trasactio o Idustrial Electroics, 49(6): Hladi P., Deplache A., Faucou S., Triquet Y., (2007) Schedulability aalysis of OSEKNVDX applicatios. I Proceedigs Iteratioal Coferece o Real-Tie ad Networ Systes. ISO , (1993) Road Vehicles iterchage of digital iforatio cotroller area etwor (CAN) for high-speed couicatio, ISO Stadard-11898, Iteratioal Stadards Orgaisatio (ISO). Kha D.A., Bril R.J., Navet N., (2010) "Itegratig hardware liitatios i CAN schedulability aalysis," I proceedigs Worshop o Factory Couicatio Systes pp Kolla S., Pollex V., Kepf K., Sloa F., Traub M., Boe T., Becer J. (2010). "Coparative Applicatio of Real-Tie Verificatio Methods to a Autootive Architecture". I proceedigs Iteratioal Coferece o Real-Tie ad Networ Systes. Marti S., Miet P., George L., (2007) No pre-eptive Fixed Priority schedulig with FIFO arbitratio: uiprocessor ad distributed cases, Techical Report No. 5051, INRIA Rocquecourt. Meschi A., Di Natale M., Spuri M., (1996) Priority iversio at the etwor adapter whe schedulig essages with earliest deadlie techiques, I proceedigs Euroicro Coferece o Real-Tie Systes. Microchip Techology Ic. (2009) PIC32MX Faily Referece Maual DS-61155A. Nolte T., Hasso H., Norstro C., (2002) Miiizig CAN respose-tie aalysis jitter by essage aipulatio. I Proceedigs 8 th IEEE Real-Tie ad Ebedded Techology ad Applicatios Syposiu, pp Nolte T., Hasso H., Norstro C., (2003) "Probabilistic worstcase respose-tie aalysis for the Cotroller Area Networ." I Proceedigs of the 9th IEEE Real-Tie ad Ebedded Techology ad Applicatios Syposiu, pp Nolte T., (2006) Share-drive schedulig of ebedded etwors, PhD Thesis, Malardale Uiversity Press. Reesas, (2010) R32C/160 Group Hardware Maual Reesas MCU M16C Faily/ R32C/100 series. Rev. 1.02, Feb Rufio J., Verissio P., Arroz G., Aleida C., Rodrigues L., (1998) Fault-tolerat broadcasts i CAN. I Digest of Papers, The 28th IEEE Iteratioal Syposiu o Fault-Tolerat Coputig. pp STMicroelectroics, (2001) AN1077 Applicatio ote. Overview of ehaced CAN cotrollers for the ST7 ad ST9 MCUS (available fro Tidell K.W., Burs A.. (1994) Guarateeig essage latecies o Cotroller Area Networ (CAN), I proceedigs of 1st Iteratioal CAN Coferece, pp Tidell K.W., Burs A., Welligs A. J., (1995) Calculatig Cotroller Area Networ (CAN) essage respose ties. Cotrol Egieerig Practice, 3(8): Tidell K.W., Hasso H., Welligs A.J., (1994) Aalysig realtie couicatios: Cotroller Area Networ (CAN). I Proceedigs 15th Real-Tie Systes Syposiu, pp XILINX, (2010) LogiCORE IP AXI Cotroller Area Networ (axi_ca) (v1.01.a) product specificatio DS791. Zuhily A., Burs A., (2007) Optiality of (D-J)-Mootoic Priority Assiget. Iforatio Processig Letters, No. 103, pp

23 Biographies Robert I. Davis is a Seior Research Fellow i the Real-Tie Systes Research Group at the Uiversity of Yor, ad a Director of Rapita Systes Ltd. He received his DPhil i Coputer Sciece fro the Uiversity of Yor i Sice the he has fouded three startup copaies, all of which have succeeded i trasferrig real-tie systes research ito coercial products. Robert s research iterests iclude schedulig algoriths ad schedulability aalysis for real-tie systes ad etwors. Steffe Kolla studied coputer sciece with the focus o ebedded systes ad icro-robotics at the Uiversity of Oldeburg. I 2012 he received his doctoral degree at Ul Uiversity. Curretly he is worig at BTC Ebedded Systes AG. His scietific iterests iclude odel drive developet of ebedded systes ad correspodig verificatio ethods lie schedulability aalysis. He aily applies his scietific results to the autootive doai. Victor Pollex is a PhD cadidate at the Istitute of Ebedded Systes/Real-Tie Systes at Ul Uiversity. He received his Diploa i Coputer Sciece fro Ul Uiversity i His research iterests are schedulability aalysis for real-tie systes ad etwors icludig real-tie calculus. Fra Sloa holds a diploa degree (Dipl.- Ig.) i electrical egieerig fro the Techical Uiversity of Brauschweig. After three years developig real-tie software for DECT telephoes he was with the Uiversity of Erlage-Nureberg. I 2002 he receives the Phd (Dr.-Ig.) with a thesis o desig space exploratio i telecouicatio systes. Fro 2002 util 2007 he was a assistat professor for ebedded systes at the Uiversity of Oldeburg. Sice 2007 he is full professor of ebedded systes/real-tie systes at Ul Uiversity. His research iterests are real-tie aalysis ad real-tie calculus, desig-space exploratio, hardware-software co-desig ad desig ethodologies ad etrics for distributed ebedded real-tie systes.