Configuring the communication on FlexRay - the case of the static segment

Transcription

1 Confgurng the communcaton on FlexRay - the case of the statc segment Matheu Grener, Lonel Havet, Ncolas Navet To cte ths verson: Matheu Grener, Lonel Havet, Ncolas Navet. Confgurng the communcaton on FlexRay - the case of the statc segment. 4th European Congress on Embedded Real Tme Software (ERTS 2008), 2008, Toulouse, France <nra > HAL Id: nra Submtted on 16 Apr 2008 HAL s a mult-dscplnary open access archve for the depost and dssemnaton of scentfc research documents, whether they are publshed or not. The documents may come from teachng and research nsttutons n France or abroad, or from publc or prvate research centers. L archve ouverte plurdscplnare HAL, est destnée au dépôt et à la dffuson de documents scentfques de nveau recherche, publés ou non, émanant des établssements d ensegnement et de recherche franças ou étrangers, des laboratores publcs ou prvés.

2 Confgurng the communcaton on FlexRay - the case of the statc segment Matheu Grener 1, Lonel Havet 2, Ncolas Navet 2 1: LORIA - Nancy Unversté, BP 239, Vandoeuvre, France 2: INRIA - RealTme-at-Wor, 615 Rue du Jardn Botanque, Vandoeuvre-lès-Nancy, France Contact author: Ncolas Navet (Ncolas.Navet@realtmeatwor.com) Abstract: Ths paper deals wth the confguraton of the statc segment of a FlexRay networ, n the case where the tass producng the sgnals are not synchronzed wth the FlexRay communcaton cycle, as t can be the case, for nstance, f legacy software s to be re-used. Frst, we provde solutons to verfy the freshness constrants of the sgnals exchanged n the statc segment, under the form of both smple non-schedulablty tests and an exact analyss. Then we propose a heurstc to construct the communcaton schedule, whch proved to be effcent n our experments. Fnally, we hghlght some future wor that should help us further optmze the confguraton of FlexRay networs, be t n regard to hardware resource usage or dependablty objectves. Keywords: FlexRay, message schedulng, statc segment, freshness constrant. 1 Introducton Context of the study. FlexRay [3, 14] s an ndustry ntatve developed to fulfll the needs of upcomng automotve real-tme control applcatons, that requre hgh-speed transmsson and dependablty-orented servces. FlexRay supports both tme-trggered and event-trggered communcatons through, respectvely, the statc segment and the dynamc segment, whch once concatenated form the communcaton cycle. The dynamc segment obeys a prorty based protocol, smlar n the sprt to CAN, whch s well-suted to event-trggered traffc and whch facltates the re-use of legacy software. Ths paper focuses on the confguraton of the statc segment where the transmssons are organzed accordng to a TDMA-based protocol (Tme Dvson Multplexed Access): each ECU (Electronc Control Unt) possesses a certan number of slots wth a system-wde length n each communcaton cycle, each slot allowng the transmsson of a sngle FlexRay frame at most. Confgurng the communcaton nvolves defnng 64 dstnct communcaton cycles, where each slot always belongs to the same staton but the frames that are transmtted can dffer. Contrbuton of the paper. We are nterested here n the confguraton of the statc segment and do not address the case of the dynamc segment - the reader nterested n the dynamc segment can refer to [10, 9]. We consder the stuaton where the tass are executed asynchronously wth regard to the FlexRay Communcaton cycle, they transmt and receve sgnals through a mddleware layer Ths document s a worng paper on the bass of a publcaton at the 4th European Congress on Embedded Real Tme Software (ERTS 2008), Toulouse, France, January 29 - February 1, Ths verson dated February 13,

3 whch, when assumptons are needed, s assumed to be AUTOSAR gven ts wdespread adopton. In partcular, the specfc requrements of the AUTOSAR FlexRay Interface [7] wll be taen nto account. The confguraton problem addressed s to set the characterstcs of the communcaton n the statc segment n such a way as to 1) meet the freshness constrants of the sgnals and 2) mnmze the bandwdth utlzaton (.e., use the lowest data rate and the least number of slots). The latter pont s mportant for enablng the use of low cost electronc components and for facltatng an ncremental desgn process. Organzaton of the paper. The assumptons made on the use of FlexRay, as well as the notatons used throughout ths study, are ntroduced n Secton 2. In Secton 3, t s shown how to chec that the sgnals tmng constrants are met. Secton 4 presents an algorthm to buld an optmzed communcaton schedule and some experments to assess ts performance. Fnally, Secton 5 hghlghts some nsghts ganed from ths study. 2.1 Data producton 2 System model We consder a set of applcatve-level tass that are runnng asynchronously wth regard to the FlexRay communcaton cycle. Asynchronous means here that the nstances of the tass are not drven by the FlexRay networ (.e., they are not trggered by communcaton related events such as the arrval of messages - ther perods are not related the length of the communcaton cycle). Ths s usually the case f the applcaton has not been conceved and confgured specfcally for a gven FlexRay communcaton cycle, as wth legacy software that s re-used. However, we assume that the schedulng of tass s brought up by the networ, for nstance, the schedulng on each node starts rght after the networ has been synchronzed, at the begnnng of the frst communcaton cycle 1. Tas nstances are assumed to produce sgnals at the end of ther executon, we assume that all sgnal nstances must be transmtted at least once (.e., no sgnal s permtted to be overwrtten n a transmsson buffer f t has not been transmtted). The model s llustrated n Fgure 1. Each sgnal s s characterzed by a tuple (N, T, O, C, D ) where: N s the dentfer of the ECU whch produces the sgnal, T s the perod of producton - generally correspondng to the perod of the producng tas, O s the offset of the sgnal, that s the latest tme after whch the frst nstance of the sgnal s produced (and subsequent values of the same sgnal wll be released at tmes O + T at the latest). The offset s expressed wth regard to the start of the frst FlexRay communcaton cycle, C ts sze n bts, 1 The tass are thus not fully asynchronous wth regard to the bus, but, by synchronous, we mean somethng stronger where the tas perods are multple of the communcaton cycle s length and each tas nstance s trggered by some communcaton-related events. If the startup of the schedulng s not trggered by the networ, wthout further assumptons, t mples that each sgnal can be produced at each and every pont n tme durng the communcaton cycle, and lttle can be done n terms of optmzaton. In partcular, t s always possble that the sgnal value s produced after the slot where ts transmsson was planed, whch mples a delay, before recepton by the consumer of the data, equal to at most the transmsson perod (see the begnnng of secton 3 for an example). In that case, oversamplng - at the cost of an ncreased bandwdth usage - s probably the only way to ensure better temporal performances. 2

4 The age of a sgnal s the duraton between the producton of the sgnal on the sender sde and the end of transmsson of the frst frame carryng the sgnal. The same sgnal value can be transmtted n several FlexRay cycles untl t s updated by the producng tas but only the frst frame s sgnfcant snce the subsequent ones do not provde any new nformaton. D s the freshness constrant assocated to sgnal s, that s the maxmum age acceptable at the consumer end. The maxmum age that s actually experenced by sgnal s n a gven confguraton s denoted by A, and one needs A D for the system to be schedulable 2. O T model of sgnal s D A A A tme Slots Cycles cycle cycle cycle cycle cycle 4 r : producton of sgnal s r FR : frame transmsson begnnng Statc segment Dynamc segment, Symbol Wndow and Networ Idle Tme 3 Slot used to transmt the frame carryng the sgnal s Fgure 1: Illustraton of the system model. Successve sgnal nstances are produced and transmtted n the thrd slot of every communcaton cycle where r s the release tme of an nstance of the sgnal s and r s the begnnng of transmsson of an AUTOSAR frame sendng s. 2.2 Assumptons Throughout ths study, we place a set of assumptons on the use of FlexRay. These assumptons are n lne wth the desgn choces made by BMW (see [13] and [8]) and, more generally, wth what s foreseen at the tme of wrtng regardng the use of FlexRay n the automotve context: 1. The sze of the communcaton cycle and the statc segment are fxed respectvely to 5 and 3ms (.e., the dynamc segment plus the Symbol Wndow and Networ Idle Tme last 2ms). These are parameters that cannot be optmzed. Wth ths setup, t s possble to accommodate 2.5ms freshness constrants that are thought to be possble n the next few years, by allocatng 2 slots n the statc segment. In ths study, we lmt ourselves to the case where each sgnal s sent at most once n a communcaton cycle because sub-5ms sgnals wll most often be produced by safety-crtcal tass runnng synchronously wth the communcaton cycles, and thus are outsde the scope the paper 3. However, the part of the statc segment left for the transmssons of the asynchronous tass should be used at the fullest of ts potental, and ths s what s dealt wth n ths study, 2 In the followng, schedulable and feasble are synonyms. 3 It would be possble as well to meet sub-5ms usng the dynamc segment but strong tmng and dependablty constrants are more easly and effcently ensured wth tme-trggered communcatons, thus the lely choce of the statc segment for such nd of sgnals probably related to the control of the vehcle. The reader s for nstance referred to the extensve wor on the Tme-Trggered Archtecture (TTA) by the team of Prof. Kopetz at Venna Unversty for further nformaton. 3

5 2. In the statc segment, the sze of the frames, and thus the duraton of the slots, s fxed to a reasonable value chosen by the car manufacturer. For nstance, BMW n ts X5 uses 16 bytes frames (see [13]), but 24 bytes may be a vable opton as well. Snce, n addton, the length of the statc segment s fxed, the maxmum number of statc slots avalable, gnumberofstatcslots, s nown (see paragraph for more detals), 3. Only one communcaton channel s used snce for the tme beng redundant transmsson supports seem not to be consdered necessary by carmaers, be t for dependablty reasons or n order to ncrease the bandwdth, 4. FlexRay s used wthn an AUTOSAR communcaton stac (see, n partcular, AUTOSAR FlexRay Interface [7]). In ths context, confgurng a frame, called an AUTOSAR frame n the remander of the paper, nvolves decdng : (a) the slot used to transmt the frame (parameter FRIF_SLOT_ID), (b) the base cycle (FRIF_BASE_CYCLE), whch s the frst cycle out of the 64 (see [3]) n whch the frame s scheduled for transmsson, (c) the repetton of the frame (parameter FRIF_CYCLE_REPETITION), whch s the perod of transmsson expressed as a multple of the communcaton cycle wth the AUTOSAR constrants that the repetton taes ts value n {2 n n N, n 6}. 5. Each sgnal fts wthn one frame (.e., no segmentaton as provded by the FlexRay Transport Layer [6]), and s sent n a separate frame. If some frame pacng strategy s mplemented (see [12] and the dscusson n the concluson of ths document), t s done at the applcatve level, 6. We consder the typcal case where D T, whch mples that, f tmng constrants are met, no buffer overwrte taes place, 7. We assume that the cloc used for the applcatve tass does not drft apart from the FlexRay cloc. In practce, the possble drft can be controlled by resynchronzng the OS cloc on the FlexRay cloc, as t s possble n the AUTOSAR context. In the followng, the term confguraton denotes the allocaton of the slots of the statc segment to the ECUs and, for each slot, the allocaton of the sgnals to the frames sent n the 64 communcaton cycles. Once the confguraton s set, the communcaton schedule n the statc segment s fully defned. 3 Verfyng tmng constrants on FlexRay It s wdely sad that confgurng communcatons wth guaranteed response tmes on tme-trggered buses s much easer than on event trggered buses. Ths s certanly partly true n the sense that no really complex schedulablty analyss s needed to assess the feasblty of a gven confguraton. However f one ams to optmze the utlzaton of the hardware resources - n order to mae use of a lower data rate or smply to connect more ECUs on the networ - then the problem becomes much more nvolved, and communcaton cycles should be explctly conceved wth the objectve n mnd to mnmze the bandwdth usage whle meetng tmng constrants. 4

6 There are two man reasons why optmzng the desgn of the communcaton s mportant. Frst, as dscussed n paragraph 4.4 (consderng the statc segment alone), the bandwdth that s actually avalable s much smaller than the nomnal worload of the networ, n partcular because oversamplng can not be avoded n the general case. In addton, on the contrary to CAN, the communcatons n the statc segment are drven by FlexRay s own nternal cloc. If - as n ths paper - we consder applcatve tass that are runnng asynchronously wth regard to the communcaton then t happens that a sgnal has to wat several communcaton cycles before beng transmtted. As an example, let us consder a sgnal sent every 100ms, wth a 5ms communcaton cycle, f the possblty of transmsson errors s overlooed, t wll be transmtted every 16 cycles (by assumpton 4 n paragraph 2.2 and because no sgnal overwrtes are permtted - see equaton 2). Shall a new value of the sgnal be released mmedately after the begnnng of transmsson of the frame that carres the sgnal, then the transmsson wll tae place 90ms later. In that case, the response tme, and thus the sgnal age at the consumer end, s greater than that what would have been obtaned on most CAN networs. Indeed, n our experence, a worst-case response tme equal to 90ms can only be observed n farly loaded 125Kbt/s CAN buses (see [5]). 3.1 Basc non-schedulablty condton We propose a smple test to detect that a gven set of sgnals s for sure not schedulable on a networ wth certan characterstcs (.e., data rate, number of slots n the statc segment, length of the communcaton cycles, number of statons). For a confguraton, not beng ruled out by the test s a necessary but non-suffcent condton for feasblty, whch means that some set of sgnals mght not be dscarded by the test whle there s no confguraton leadng to a feasble schedule. However, the test s useful to rule out the use of some data rate, and to provde an global overvew of the system s load and possblty of evoluton. The frst step s to determne the number of slots avalable n the statc segment Number of slots avalable n the statc segment FlexRay Specfcaton, see Annexe B.4 n [3], provdes the necessary nformaton about confguraton constrants and confguraton parameters determnaton. Varous error terms nfluence the precson that can be acheved by the FlexRay cloc synchronzaton algorthm. In order to choose the proper confguraton parameters, t s frst necessary to now the attanable precson of the cloc synchronzaton, whch s manly nfluenced by the networ topology : a large and complex networ wth several stars wll result n a low synchronzaton accuracy. The acton pont offset, denoted gdactonp ontoffset, s the tme nstant n a slot after whch the frame starts beng transmtted. In Annexe B.4.6, t s precsed that gdactonp ontof f set must be greater than the attanable precson. Hence, the larger the gdactonp ontof f set, the larger the slot sze, and thus fewer slots n the communcaton cycles. In ths study, we assume a smple networ topology (.e., no star, bus length 20 meters) whch leads to a good attanable precson and allows for a small acton pont offset. We use the followng FlexRay confguraton settngs, whch are n lne wth the settngs dsclosed by BMW ([13]): The data payload of a statc frame, gp ayloadlengthstatc, s set to 8 2-bytes words, whch s 16 bytes, The communcaton cycle s fxed to 5ms, denoted here by gdcyclelength, and the length of the statc segment s 3ms (see paragraph 2.2), 5

7 The length of the macrotc, gdmacrotc, s set to 2µs. Based on these settngs, and followng the equatons n Annexe B, one can derve the maxmum number of slots n the statc segment (gn umberof StatcSlots) at dfferent bt rates. The results are shown n Table 1. Bt Rate (Mbt/s) gn umberof StatcSlots Table 1: Number of slots n the statc segment for dfferent data transmsson rates. Logcally, the confguraton at 10Mbt/s s close to what BMW s usng n the latest X5 model, where gn umberof StatcSlots s equal to Mnmum number of slots requred The non-schedulablty condton s based on the mnmum number of slots requred by the set of sgnals of a gven applcaton. The requred number of slots must be lower than gn umberof StatcSlots, otherwse we now for sure that the set of sgnals s not schedulable. We stress that ths s a necessary but non-suffcent condton: there are confguratons that wll pass the test wthout beng actually schedulable. Also, the condton holds under the assumpton that there s no frame-pacng: one sgnal uses a full slot. For a node, sendng a set of sgnals S, the mnmum number of slots needed s : n = { N =} 1 T (1) where T s the repetton of the frame (FRIF_CYCLE_REPETITION n AUTOSAR termnology), whch s the perod of transmsson expressed as a multple of the communcaton cycle, wth the constrants 4 that T = max{2 n n N, n 6 and 2 n gdcyclelength T }. (2) The mnmum number of slots requred by all statons s thus n. For nstance, let us consder a networ wth 4 statons sendng each 10 sgnals wth a perod of 10ms and 10 sgnals wth a perod of 20ms. Ths confguraton requres at least = 32. Ths s larger than the number of statc slots avalable at 2.5Mbt/s (see Table 1), and thus we now that the confguraton s not schedulable at 2.5Mbt/s. Ths non-schedulablty condton offers a smple coarse-graned test, that s ndependent of the slot allocaton and the deadlnes of the sgnals. In our experence, the test s relatvely accurate as long as the freshness constrants of the sgnals are close to ther perods. Ths test wll be refer to as non-schedulablty test 1, or test 1 for short, n the experments of paragraph 4.5. The next paragraph presents a necessary and suffcent test for the case where a confguraton s defned. In paragraph 3.3, ths latter test s used n turn to come up wth a more precse nonschedulablty test that taes deadlnes nto account wthout requrng that the confguraton of the communcaton s defned. 4 Indeed, f T gdcyclelength > T (.e., the transmsson perod s greater than the sgnal producton perod), some sgnals wll be lost. 6

8 3.2 Schedulablty of a confguraton Here we explan how to decde on the schedulablty of a gven confguraton. It conssts n checng that the freshness constrant assocated to each sgnal s verfed. If at least one sgnal s sent n an AUTOSAR frame that does not ensure the freshness constrant, then the confguraton s nonschedulable. In the remander of the paragraph, we show how to estmate the maxmal age A experenced by a sgnal n a gven confguraton General case Let us consder a sgnal s wth producton perod T, offsets O and freshness constrant D (see paragraph 2.1). Ths sgnal s assgned to an AUTOSAR frame wth gven FRIF_SLOT_ID and FRIF_BASE_CYCLE characterstcs. From the two latter nformaton, we deduce the begnnng of the frst slot after the startup of the communcaton n whch the frame s scheduled for transmsson, ths tme pont s called the offset of the frame and s denoted by O. The next characterstc of nterest here s FRIF_CYCLE_REPETITION: T denotes the tme between two subsequent transmssons of the frame (T =FRIF_CYCLE_REPETITION gdcyclelength). Let r be the release tme of any nstance of the sgnal s, let r be the begnnng of transmsson of any AUTOSAR frame sendng s. We now from Lemma 2 n [11] that r r = p g + (O O ) mod g (3) where g = gcd(t, T ), p Z, wth gcd beng the greatest common dvsor. The quantty r r s equal to A n Fgure 1. Snce the constructon of an AUTOSAR frame requres some tme, we place the assumpton that sgnal s must be released at least PacngTme before r : r r P acngt me. (4) As explaned n paragraph 2.1, we only consder the frst frame carryng the sgnal to evaluate the age. The release r of the AUTOSAR frame whch contans the value of the sgnal for the frst tme s such that: r r < P acngt me + T. (5) Indeed, otherwse r s not the release of the frst frame carryng the sgnal. We now am to dentfy the maxmum value of the quantty r r, whch comes to fnd the largest value that can be taen by p n equaton 3. From equatons 3 and 5, one has: p < P acngt me + T (( ) ) O O mod g. g Thus, the maxmal duraton between the producton of the sgnal and the begnnng of transmsson of the frst frame carryng that sgnal s p max g + (O O ) mod g, where: P acngt me + T (( ) ) O O mod g p max = 1. (6) g The maxmum age of a sgnal s thus equal to A = p max g + (O O ) mod g + slotsze (7) where slotsze s the length of each slot n the statc segment. 7

9 It s worth pontng out that n equatons 6 and 7, the only two terms nfluencng the age that can be confgured are O and T. In partcular, reducng the transmsson perod below what we call the natural perod (.e., the largest possble perod T gdcyclelength, see equaton 2), and thus oversamplng, wll reduce the age. Ths strategy wll be used when loong for feasble confguratons Specfc propertes n the case where deadlnes equal perods In the case where the freshness constrant of each sgnal s equal to ts perod (D = T ) - f we neglect the pacng tme and the frame transmsson tme - any possble choce for the parameters of the AUTOSAR frame wll guarantee the freshness constrant snce T T gdcyclelength T = D. Let us descrbe the followng nave strategy executed on each staton consdered n an arbtrary order: Construct the set of AUTOSAR frames wth ther transmsson perod T equal to T gdcyclelength (where s the ndex of the sgnal the frame carres), ran the frames by ncreasng value of ther perod, Whle there are unassgned AUTOSAR frames on the staton, consder the frst avalable slot and fll t up by placng teratvely the frames n the frst avalable cycle (.e., set the frame base cycle to the frst avalable cycle). As shown n Appendx A, ths nave strategy comes up wth a confguraton that uses exactly the mnmum number of slots requred, as computed n paragraph Wth the aforementoned assumptons, schedulablty test 1 becomes a necessary and suffcent condton. However, f one really needs to be accurate, one can not neglect the pacng tme and the frame transmsson tme, and all choces are not equvalent n ths context. Let us for nstance consder the example shown n Fgure 2 where a sgnal A s produced wth a perod and deadlne equal to gdcyclelength (length of the communcaton cycle) and the frame transmttng that sgnal s assgned to the frst slot of the statc segment (and transmtted n every cycle gven ts perod). Now, magne that sgnal A s produced after the begnnng of the frst slot of the FlexRay cycle, t wll therefore have to wat for the frst slot of the next communcaton cycle to be transmtted. The age of the sgnal at recepton s thus gdcyclelength + slotsze, and thus the freshness constrant s not met. Fgure 2: Example showng that the slot locaton matters even n the case where the sgnal deadlne s equal to ts perod. 8

10 In practce, for an AUTOSAR frame, only one, or at most a few choces for the transmsson slot and base cycle (typcally out of several hundreds) are not compatble wth the freshness constrant n the case where the deadlne s equal to the perod. Ths explans why, n the experments of paragraph 4.5.1, all the sgnals sets that are not ruled out as unschedulable by test 1 are ndeed schedulable wth our algorthm. In many practcal cases the freshness constrants wll be much smaller that the sgnals perods, especally for the sgnals wth the largest perods, and, n that case, fewer confguratons lead to a feasble schedule. 3.3 Improved non-schedulablty condton The frame repetton that s consdered n equaton 1 s the largest one that meets the AUTOSAR constrant expressed n assumpton 4c (see equaton 2 also). However t can happen that - wth that repetton value - none of the slots leads to a feasble schedule. Ths occurs when, whatever the value of O n equaton 6, the age of the sgnal s greater than the freshness constrant. In the latter case, the only soluton s to ncrease the transmsson frequency. Precsely, the AUTOSAR constrant forces us to double the frequency each tme. Ths can be accounted for n the non-schedulablty condton, and equaton 2 becomes: T = max{2 n n N, n 6 and O such that A D }. (8) where A s computed usng equaton 7. Of course, f for at least one sgnal no sutable value has been found for T then the set of sgnals as a whole s non-schedulable. Ths test wll be refer to as non-schedulablty test 2 n the experments of paragraph 4.5. The complexty of ths second test does not rase any practcal problems gven the lmted number of slots n the statc segment (.e., a few hundreds at most). It s worth pontng out that the dfference between the number of slots requred that s returned by test 2 and the number of slots returned by test 1, enables to estmate the cost of oversamplng. Ths dfference can be also computed on a sgnal per sgnal bass, whch can serve to dentfy the sgnals that nduce the most overheads n the statc segment, and thus ones possbly best suted to the dynamc segment. 4.1 Performance metrcs 4 Optmzng cycle confguraton The prmary objectve s to come up wth confguratons that are feasble n regard to the respect of the freshness constrants. The secondary objectve s to mnmze the bandwdth usage, whch translates nto mnmzng the number of slots used. Ths latter objectve s ntended to preserve the possblty of evoluton of the embedded system, whch s crucal gven the ncremental desgn process n use n the automotve ndustry. Another meanngful secondary objectve would be to mnmze the age of the sgnals at the consumer end (or, sad dfferently, maxmze the freshness of the data). The correspondng cost functon could be for nstance s (D A ) /D, but other choces would be meanngful as well. However, ths latter crteron s not compatble wth mnmzng the bandwdth usage snce mprovng the freshness generally comes at the prce of some oversamplng. In ths study, we focus on feasblty and bandwdth usage. 9

11 4.2 Sze of the search space Allocatng slots belongs to the famly of NP-hard problems (see, for nstance, [10] for further nformaton on the complexty ssue of ths problem), whch means that ths problem has no soluton n polynomal tme. The worst case scenaro n terms of sze of the search space occurs when each sgnal s sent n one slot and one cycle out of the 64 (IF _CY CLE_REP ET IT ION = 64). In ths setup, there are n = 64 gnumberofstatcslots possble choces for where to send a sgnal. Assgnng #sgnals conssts n a permutaton A #sgnals n = n!/(n #sgnals)!, whch, gven the number of sgnals n practcal cases, s much too bg for an exhaustve search. To cope wth the complexty, we propose a heurstc algorthm and assess t performances wth a random search strategy as benchmar. 4.3 Confguraton algorthm The proposal conssts n a greedy algorthm (.e., locally optmal decsons are made at each step) that maxmzes, at each step, the number of sgnals scheduled for transmsson n a sngle slot. The heurstc s called Best Slot Frst (BSF) because the slot, whose schedule s decded a gven step, s the one that can accommodate the greatest number of sgnals. Gven the greedy nature of the algorthm, the global optmum wll not be obtaned n general, however, as shown n paragraph 4.5, the algorthm performed well n our experments. Best Slot Frst Heurstc (BSF): 1. Construct the set of sgnals that each staton s able to transmt durng each unassgned slot. Ths s done by fllng up the slots wth as many AUTOSAR frames as possble accordng to the followng procedure that s executed for each staton and each slot: (a) Construct the lst L of AUTOSAR frames that respect the tmng constrants of the sgnals they carry. Ths lst s obtaned by enumeratng and testng all base cycles and repettons that are possble for each sgnal, (b) The AUTOSAR frames n L are raned by decreasng values of the couples (T gdcyclelength/t, T ): the smaller the numercal value of T gdcyclelength /T, the hgher the ran n the lst - the second component s used to dstngush frames havng the same frst component. The underlyng dea s to favor the AUTOSAR frames havng a repetton value close to the natural perod of the sgnal the frame s carryng because t allows lmtng the oversamplng, (c) Assgn the frst frame n L to the slot, remove from L all AUTOSAR frames that are n conflct wth ths schedulng choce (.e., frames scheduled for transmsson durng the same cycle). If L s not empty, go to step 1b, otherwse return the set of sgnals transmtted wth ths schedule. 2. Set the schedule of the slot that can transmt the greatest number of sgnals - the schedule s the one computed at step 1c. If there s at least one unassgned slot, go to step 1. Otherwse, f there s no more slot avalable, and at least one sgnal stll to place, no schedulable soluton has been found. For a gven networ, the algorthm runs n O(#sgnals 2 log(#sgnals)), whch does not rase practcal problems. 10

12 Below s the descrpton of the benchmar algorthm, called Randomzed Slot Selecton (RSS), to whch BSF s compared. It should be ponted out that, manly, what s random at each step of RSS s the choce of the schedulng soluton that s ept among all feasble solutons, but not the constructon of the solutons themselves. Randomzed Slot Selecton (RSS): 1. For each sgnal, construct the lst of all AUTOSAR frames that respect the freshness constrant, 2. One sgnal S s chosen randomly, 3. In the lst of the frames sendng S, f not empty, one frame F s chosen at random - the frame s scheduled for transmsson accordng to ts characterstcs (see 4 n paragraph 2.2). If the lst s empty, there s no more possble frame for sgnal S: the random allocaton has faled and non feasble s returned, 4. Frame F that has just been placed s removed from the lst, as well as all other frames that have become ncompatble wth the schedule of F. Precsely, 1) all frames scheduled for transmsson n the same slot as F but not sent by the same ECU, 2) frames from the same ECU, sent n the same slot, that have a conflct wth the choce made for F (.e., one nstance of the frames colldes wth one nstance of F ), 5. Go to step 2 as long as the lst of sgnals s not empty. 4.4 Expermental setup In the experments, we choose to consder the traffc exchanged on powertran or chasss networs because that s where FlexRay s the most lely to be used n a frst step. Sets of sgnals were generated usng NETCARBENCH [1], a GPL-lcensed software that creates random sets of sgnals, or random set of frames, wrtten n a smple XML format, accordng to user-defned parameters (e.g., networ load, number of ECUs, dstrbuton of the perods of the frames, etc.). We would le to stress that, f 10Mbt/s s the data rate, the bandwdth that can actually be used n our experments s much less mportant. Indeed, the statc segment s 3/5 of the whole communcaton cycle, the sze of the slot s slotsze = /93 = second whle each slot s only used to transmt a sgnal of at most 8 bytes (or second). Thus the useful bandwdth s: / Mbt/s, and the correspondng overall effcency of the protocol - wthout the dynamc segment here - s only 12%. In addton, ths fgure s obtaned wthout tang nto account the AUTOSAR constrant whch says that the repetton factor must be a power of two n a certan range (see equaton 2). For nstance, a frame havng a perod equal to one second wll be transmtted at least once every 64 cycles, whch s every 320ms n our setup. The constrant on the repetton factor reduces the avalable bandwdth, whch explans why 1Mbt/s, nstead of 1.2Mbt/s, s the rate of applcatve-level data used n the NETCARBENCH confguraton fle shown n Fgure 3. 11

13 <?xml verson="1.0" encodng="utf-8"?> <confg> <ecu Mn="5" Max ="15" /> <load Mn="30" Max="40" /> <bandwdth Value="1000" /> [...] <p1 Value="10" Weght="5" [...]/> <p2 Value="20" Weght="5" [...]/> <p3 Value="50" Weght="5" [...]/> <p4 Value="100" Weght="5" [...]/> <p5 Value="200" Weght="5" [...]/> <p6 Value="1000" Weght="5" [...]/> <p7 Value="2000" Weght="2" [...]/> <messages_szes> <m8 Length="8" [...] /> </messages_szes> </confg> Fgure 3: Excerpt of a NETCARBENCH confguraton fle used to generate the sets of message, [...] means that non relevant nformaton has been omtted. The perods are expressed n mllseconds, and randomly chosen accordng the dstrbuton ndcated by the parameters. For nstance, a perod equals to 2 seconds wll be allocated wth a probablty 2/ Weght as specfed by <p7 Value="2000" Weght="2" [...]/>. The number of ECUs s randomly chosen between 5 and 15 (<ecu Mn="5" Max ="15"/>). The load range (.e., only applcatve level data, protocol overheads are not taen nto account snce here sets of sgnals are generated) for sgnals set drawn at random from ths confguraton fle s specfed by the lne <load Mn="5" Max="10"/> n Fgure 3. Experments were done at varous levels of load: precsely, one hundred sets of messages were generated for each load level n the set {(M n = 0.3M bt/s, M ax = 0.4M bt/s), (0.4, 0.5), (0.5, 0.6), (0.6, 0.7),(0.7, 0.8), (0.8, 0.9),(0.9, 1)}. Experments were performed wth and wthout offsets for the sgnals (parameter O, see paragraph 2.1), only the results wthout offsets are shown snce the conclusons that can be drawn from both sets of experments do not vary substantally. 4.5 Performance evaluaton Performances are evaluated wth regard to the percentage of feasble confguratons and the bandwdth usage. Two dstnct cases are consdered: deadlnes equal to perods, and deadlnes smaller than perods Deadlnes equal to perods Table 2 summarzes the results regardng feasblty. As can be seen n that Table, BSF leads to the best possble result n terms of feasblty when D = T. In that specfc context, BSF maes, except n some partcular cases, exactly the same confguraton choces as the nave strategy that s shown to be near-optmal (see the explanatons n paragraph and the proof n Appendx A), whch explans the results. On the contrary, the performance of RSS becomes qucly unacceptably low, one reason beng that RSS does not strve to put addtonal sgnals n a slot already allocated to a staton. In regard to the bandwdth usage (see Table 3), BSF s also clearly more effcent than RSS. 12

14 Load (0.3, 0.4) (0.4, 0.5) 0.5, 0.6) (0.6, 0.7) (0.7, 0.8) (0.8, 0.9) (0.9, 1) Test 1& BSF RSS Table 2: Percentage of sgnal sets that are schedulable wth Best Slot Frst (BSF) and Randomzed Slot Selecton (RSS) Heurstc. Schedulablty test 1 and test 2 (row Test 1&2 ) ndcate the number of sgnal sets that mght be feasble (.e., not unfeasble for sure), they both have the same outcome snce T = D here. The load s the sgnal bt rate n Mbt/s (.e., useful data only - no protocol overhead). The statstcs are made on samples of 100 sets of sgnals. When the networ load exceeds 1Mbt/s, the mnmum number of slots requred (see paragraph 1) s most often larger than the number of avalable slots. Load (0.3, 0.4) (0.4, 0.5) 0.5, 0.6) (0.6, 0.7) (0.7, 0.8) (0.8, 0.9) (0.9, 1) Test 1& BSF RSS NA NA NA NA Table 3: The row Test 1&2 shows the mnmum number of slots that s requred at each load level as computed by test 1 and test 2 (both tests are equvalent here snce T = D). Average number of slots used wth Best Slot Frst (BSF) and Randomzed Slot Selecton (RSS) Heurstc. The maxmum number of slots avalable s 93. The load s the sgnal bt rate n Mbt/s (.e., useful data only - no protocol overhead). Statstcs made on the sgnal sets that are feasble n Table 2. NA means that no statstcs can be made snce RSS s unable to come up wth feasble solutons n the most loaded confguratons Deadlnes smaller than perods The deadlnes are now more strngent snce they are set to 30ms for all sgnals havng a perod greater than 30ms (deadlnes are unchanged for the other sgnals). The frst observaton that can be drawn from Table 4 s that test 2 s much more accurate than test 1 when deadlnes are smaller than perods. In ths setup, test 1 s too mprecse to be really useful. What s more nformatve s the dfference between the number of slots requred by test 2 and test 1 (see Table 5), whch ndcates the cost of oversamplng requred to meet the freshness constrants. Indeed, for a gven deadlne - here 30ms - there s a threshold for the transmsson perod above whch oversamplng s necessary. At least part of the oversamplng overheads could be saved by placng some or all of the sgnals wth a perod above that threshold n the dynamc segment of FlexRay, especally by tang advantage of the nce slot multplexng feature that allows several statons to share the same dynamc slot. From Table 4 and Table 5 t s also clear that BSF greatly outperforms the random strategy RSS both n feasblty and number of slots used, as t was the case as well when deadlnes were equal to perods. At low and moderate bus load, BSF s effcent and produces feasble confguratons for most sgnal sets, whch, n addton, do not requre many more slots than the lower bound gven by test 2. At hgher bus loads, above 600Kbt/s, the dfference between BSF and test 2 becomes more pronounced. There are two possble reasons: test 2 s probably farly optmstc n the sense that unfeasble sgnal sets are not detected as such (.e., there are conflctng requrements between sgnals that are not captured by the test), and BSF mght not be able to come up wth solutons n some cases. The extent to whch the root cause s the frst or second reason should be determned n the lght of addtonal experments, especally experments nvolvng more CPU-ntensve search heurstcs, such as genetc algorthms or local search technques as hll-clmbng. 13

15 Load (0.3, 0.4) (0.4, 0.5) 0.5, 0.6) (0.6, 0.7) (0.7, 0.8) (0.8, 0.9) Test Test BSF RSS Table 4: Percentage of sgnal sets that are schedulable wth Best Slot Frst (BSF) and Randomzed Slot Selecton (RSS) Heurstc. The fgures shown for non-schedulablty test 1 (see paragraph 1) and non-schedulablty test 2 (see paragraph 3.3) denote the number of sgnal sets that mght be feasble usng respectvely test 1 and test 2. The load s the sgnal bt rate n Mbt/s (.e., useful data only - no protocol overhead). Statstcs made on samples of 100 sets of sgnals. Load (0.3, 0.4) (0.4, 0.5) 0.5, 0.6) (0.6, 0.7) (0.7, 0.8) (0.8, 0.9) Test Test NA BSF NA NA RSS NA NA NA NA Table 5: Average number of slots used wth Best Slot Frst (BSF) and Randomzed Slot Selecton (RSS) Heurstc, as well as the average number of slots requred as computed by non-schedulablty test 1 and non-schedulablty test 2. The maxmum number of slots avalable s 93. The load s the sgnal bt rate n Mbt/s (.e., useful data only - no protocol overhead). Statstcs made on the sgnal sets that are feasble n Table 4. 5 Concludng remars The confguraton of the dynamc segment of FlexRay has already receved qute a lot of attenton n the lterature. Ths paper provdes a frst study focused on the statc segment n the case where tass are executed asynchronously wth regard to the communcaton cycle. The contrbuton of the paper s threefold. Frst, we tred to hghlght a set of assumptons that correspond to what can be foreseen at the tme of wrtng of the use of FlexRay n the automotve context. Confgurng a FlexRay cluster s complex problem, more than 70 ndependent parameters have to be set [2], and thus decdng beforehand what s outsde the scope of optmzaton s crucal to reduce the search space and come up wth effcent solutons. Second, we propose ways to verfy the freshness constrants of the sgnals exchanged on the bus, under the form of both smple non-schedulablty tests and an exact analyss. Besde the answer on the feasblty of the schedulng, these tests mght help to dentfy sgnals that would be best transmtted n the dynamc segment. Fnally, we propose a heurstc to construct the communcaton schedule n the statc segment, whch proved to be effcent n the frst sets of experments run for ths study. The heurstc can be used as a startng pont to drect the search towards promsng parts of the soluton space n more CPU-ntensve optmzaton algorthms. In partcular, the confguraton produced by the heurstc can be ncluded n the ntal populaton of a genetc algorthm, nowng that the ntal populaton has often a strong mpact on the fnal performance of the algorthm. FlexRay s stll lacng hgher-level protocol layers provdng dependablty-orented servces such as group membershp, clque avodance, or even frame acnowledgment. When safety-crtcal functons wll be mplemented on top of FlexRay soon, dependablty cannot be overlooed anymore. Fortunately, the experence ganed over the years wth other TDMA networs, TTP/C n partcular, 14

16 can be re-used to some extent. Ths s true n partcular for the confguraton of the communcaton cycle, and the wor presented here can be extended to tae nto account dependablty objectves, for nstance, by ntegratng the results presented n [4] where the possblty of transmsson errors s consdered. The results and the analyss presented here are prelmnary and further nvestgaton s certanly requred. What s needed also s some more feedbac about the use of FlexRay, be t on producton or prototype cars. From our perspectve, the followng nsght nto how to use FlexRay can be stated: If the applcatve tass are executed asynchronously wth regard to the FlexRay communcaton cycle, then the response tmes of the frames sent n the statc segment can be equal to the transmsson perod (wthout oversamplng). Ths can be larger than what would have been observed on a CAN bus, especally when offset strateges are mplemented (see [5]). The amount of applcatve-level data that can be transmtted n practce durng the statc segment of FlexRay - even on a 10Mbt/s networ - s rather lmted. The frst consequence s that best confgurng the statc segment s crucal. The second consequence s that the statc segment should probably be used preferentally for communcaton nvolvng tass runnng synchronously wth the communcaton cycles. Gven the dscrepancy between the typcal sze of a sgnal (a few bytes at most) and the typcal sze of a FlexRay frame (at least 16 bytes n practce), frame pacng strateges, as there are for CAN (see [12]), are needed. The problem s more complex n the context of an AUTOSAR stac because the pacng can be done at two levels: 1. pacng sgnals nto AUTOSAR bus ndependent PDUs, whose sze are 8 bytes, ths s done at the AUTOSAR COM Layer, 2. pacng PDUs nto FlexRay frames, accordng to the Frame Constructon Plan, at the FlexRay Interface level. Confgurng a FlexRay networ s very complex gven the number of parameters nvolved and ther nteractons, and also gven the number of, sometmes contradctory, desgn objectves. Software tools are needed to help, and when possble to gude the FlexRay system desgner. Ths s our ongong wor to extend our software tool NETCAR-Analyzer n that drecton, see reference [5] and for further nformaton. References [1] C. Braun, L. Havet, and N. Navet. NETCARBENCH: a benchmar for technques and tools used n the desgn of automotve communcaton systems. In Proc. of the 7th IFAC Internatonal Conference on Feldbuses and Networs n Industral and Embedded Systems (FeT 2007), November Software and manual avalable at nnavet/netcarbench/. [2] J. Broy and K. Muller-Glaser. The mpact of tme-trggered communcaton n automotve embedded systems. In IEEE Second Internatonal Symposum on Industral Embedded Systems (SIES 07), pages , 4-6 July [3] FlexRay Consortum. FlexRay communcatons system - protocol specfcaton - verson 2.1. Avalable at http: // www. flexray. com, December

17 [4] B. Gaujal and N. Navet. Maxmzng the robustness of TDMA networs wth applcatons to TTP/C. Real-Tme Systems, 31(1-3):5 31, December [5] M. Grener, L. Havet, and N. Navet. Pushng the lmts of CAN - schedulng frames wth offsets provdes a major performance boost. In ERTS Embedded Real Tme Software 2008, [6] AUTOSAR Development Partnershp. Specfcaton of FlexRay transport layer. Avalable at http: // www. autosar. org, June Verson [7] AUTOSAR Development Partnershp. Specfcaton of module FlexRay nterface. Avalable at http: // www. autosar. org, June Verson [8] M. Peteratznger, F. Stener, and R. Schuermans. Use of XCP on FlexRay at BMW. Translated reprnt from HANSER Automotve 9/2006, avalable at url https: // www. vector-worldwde. com/ v_ downloadcenter_ en,,223. html? product= xcp, [9] T. Pop, P. Pop, P. Eles, and Z. Peng. Bus access optmsaton for flexray-based dstrbuted embedded systems. In DATE 07: Proceedngs of the conference on Desgn, automaton and test n Europe, pages 51 56, San Jose, CA, USA, EDA Consortum. [10] T. Pop, P. Pop, P. Eles, Z. Peng, and A. Andre. Tmng analyss of the FlexRay communcaton protocol. In ECRTS 06: Proceedngs of the 18th Euromcro Conference on Real-Tme Systems, pages , Washngton, DC, USA, IEEE Computer Socety. [11] G. Quan and X. Hu. Enhanced fxed-prorty schedulng wth (m,)-frm guarantee. In Proceedngs IEEE Real-Tme System Symposum (RTSS 2000), [12] R. Saet and N. Navet. Frame pacng algorthms for automotve applcatons. Journal of Embedded Computng, 2:93 102, [13] A. Schedl. Goals and archtecture of FlexRay at BMW. Sldes presented at the Vector FlexRay Symposum, March [14] B. Schätz, C. Kühnel, and Gonschore. The FlexRay protocol. In N. Navet and F. Smonot-Lon, edtors, Automotve Embedded Systems Handboo. CRC Press/Taylor and Francs, to appear n A Cycle confguraton when deadlnes are equal to perods Here we show that, under some hypotheses, the nave algorthm descrbed n paragraph leads to an optmal schedule n the sense that t uses the mnmum number of slot requred, as computed by the schedulablty condton of paragraph 3.1. Precsely the results s shown under the hypotheses that the transmsson tme of the frame and the frame pacng tme are neglected n the evaluaton of the age of the sgnal. The reader s referred to paragraph 3.2 for the motvaton and the notatons. Some addtonal notatons are needed here. In paragraph 3.2, T was expressed n tme unt, we now need to quantfy the repetton factor as a multple of the communcaton cycle denoted by T Precsely, one has T = T. /gdcyclelength. The slot h durng the gth communcaton cycle s dentfed by S h,g and called a slot-cycle. Wth ths defnton, there are 64 avalable slot-cycles for each slot of the statc segment. One says that the slot-cycles S h,g and S h,g+1 are consecutve. At ths pont, some observatons can be done: 16

18 1. As shown n paragraph 3.2.2, n ths context, any possble choce for the parameters of the AUTOSAR frame guarantees the freshness constrant, 2. In a gven slot, the base cycle for a frame havng a repetton equal to T must be chosen n the T frst slot-cycles (AUTOSAR constrant, see tem 4 n paragraph 2.2), 3. Let T and T be the repettons of two AUTOSAR frames f and f wth T Wth the power of two constrant, one has T uses T T = 2 n T T. wth n N. AUTOSAR frame f slot-cycles over T consecutve slot-cycles. For nstance, an AUTOSAR frame f 1 wth T 1 = 4 uses 2 slot-cycles out of T 2 = 8 consecutve slot-cycles. 4. Let S h be the set of AUTOSAR frames assgned to a slot h. If 1 f S h T slot-cycles of slot h are used. = 1 then the 64 For each slot, the nave strategy places teratvely the frames n the frst avalable slot-cycle:.e., t sets the frame base cycle to the frst avalable slot-cycle. At each step, the algorthm taes the frst AUTOSAR frame (n the order of the transmsson perod), denoted by f n the followng, among the frames that have not been assgned a slot-cycle yet. Let S h be the set of AUTOSAR frames already allocated to the current slot h. We show that f there s at least one free slot-cycle n slot h, then the base cycle of f can be assgned to ths slot-cycle. Proof: The proof s done n two steps: 1. show that f there s at least one free slot-cycle n slot h, there s at least one free slot-cycle n the T frst slot-cycles, 2. f the base cycle of f s set to the frst free slot-cycle, then all nstances of f (all slot-cycles used by f n the 64 communcaton cycles) wll be transmtted durng slot-cycles that are stll free (.e., no conflcts wth other AUTOSAR frames). Step 1: From observaton 4, f there s at least one avalable slot-cycle n slot h then 1 f S h T (otherwse all slot-cycles are used). Ths nduces that: T 1 T f S h < T < 1 T f S h T T }{{} number of slot-cycles used by the frames n S over T consecutve slot-cycles > 0 (9) Snce the algorthm consders the frames by ncreasng perods, one has f S h, T T, thus T T 1 and we now by the power of two constrant that T N. Equaton 9 becomes T T T f S h 1. There s thus at least one free slot-cycle n the T T frst slot-cycles n the slot h. 17

19 Step 2: Let O be the base cycle of frame f, we now that: 1. O s set to the frst avalable slot-cycle. O other frames already assgned: 2. Snce T T f S h and j N, O s thus greater than the base cycles of all the O and the power of two constrant then gcd( T + j T. (10), T ) = T. From equaton 3, the dstance between the release r of the begnnng of transmsson of any AUTOSAR frame f and the release r of the begnnng of transmsson of any AUTOSAR frame f n S h s: where g = gcd( T r r = p g + (O, T ) and p Z. From tem 2, equaton 11 becomes: r and from equaton 10, O r O = p T + (O j T, thus: r r 0 O ) mod g (11) O ) mod T. There s thus no other AUTOSAR frame released n the same slot-cycle, and the schedule s collson-free. Now, t remans to be shown that the nave strategy comes up wth a schedule that uses exactly the mnmum number of slots requred as computed by test 1 n paragraph 3.1. The frst observaton s that no oversamplng s requred (.e., all frames are transmtted at ther natural perod) snce whatever the slot, and whatever the base cycle, the sgnal wll respect ts freshness constrant. The second observaton s that each slot s fully used (f there are sgnals left) and thus no place s wasted. From observaton 1 and 2, one concludes that the nave strategy s optmal under the aforementoned assumptons n the case where D = T. 18