Time Triggered Protocol (TTP/C): A Safety-Critical System Protocol Literature Review EE382c Fall 1999 Howard Curtis Global Technology Services MCC Robert France Global Software Division Motorola, Inc.
The Evolution of Automotive Electronics Button Rectifiers Positive Crankcase Ventilation Power Steering Unleaded Gas 2 & 3-Way Catalytic Converters Engine Fuel Injection Fuel Mix Sensors MPU s Reformulating Gas High speed MCU for realtime control Cold Start Onboard Diagnostic level 2 Valve timing control Airbags Electric power steering Adaptive cruise control ABS with traction control and vehicle stability First available EVs and hybrids
Automotive Electronics Market Development 40 35 30 25 20 15 10 5 Automotive Semiconductor TAM World-Wide [$B] 5th Wave (EPAS, X-by-Wire, 42V ) ITS (Navigation, Telematics) Body (Comfort, Light ) Safety (ABS, Airbag ) Powertrain 0 1975 1980 1985 1990 1995 2000 2005 2010 Electronics and electromechanics ( Mechatronics ) are replacing hydraulic and mechanical components in vehicles. The role of the driver will (gradually) change from machine operator to supervisor of a transportation system.
Total Connectivity in the Vehicle Body (Comfort, Safety, Lighting, Instrumentation) Driver Information Systems Powertrain Vehicle Dynamics Video/ Radar Processing Climate Sub Bus Stepper Motor Climate Panel Seat Heating Stand-By Heating Left Door Module Right Door Module Sun-Roof Wiper Wish-Wash Remote Keyless Entry Sensor Panel Seat Positioner Sub Bus DC Motor Air Bag Squib CAN-B Lighting Light Level Regulation Telematics CD/DVD TV-Tuner ITS-Bus / MOST Dashboard Central ECU & Gateway HVAC/ Aux Gauges Multi-use Display Cellular Navigation HiFi Radio/ Audio Video Monitor CAN-C ISO 9141 Engine Gear Box TTP Solenoid Vehicle Dynamics Brake Petal TTP TTP Cameras High Speed Network Steering Radar Electric Brake
Event-Triggered vs Time-Triggered Systems Event-triggered systems react to events Reception of a message Termination of a task External interrupt Time-triggered systems derive actions from the progression of a globally synchronized time base Transmission of messages Task execution Monitoring of external states
Time-Triggered Protocols TTP: Family of TDMA based, fault tolerant protocols. TTP/C: A communication protocol specifically designed for safety-related automotive applications. The development of TTP and TTP/C has been led by Prof. Hermann Kopetz, Technical University of Vienna. The commercial development of TTP/C tools and products is led by TTTech. Existing protocols J1850 and CAN meet the the bandwidth specification for an SAE Class C protocol, but not the fault tolerant requirements.
TTP/C Node Architecture Host The Host runs the application software. ler Network Interface (CNI) De-couples the applications-level software from the network using dual ported RAM. Contains the Message Descriptor List (MEDL) controlling bus access. TTP/C Communications ler. Provides the actual connection between the TTP/C node and the shared network. the TTP/C controller provides guaranteed transmission times with minimal latency, jitter, fault-tolerant clock synchronization, and fast error detection. (Ross Bannatyne, Time Triggered Protocol..., Wescon 1998, p. 88.) Replica Determinant Allows multiple parallel nodes for fault tolerance Fail Silent Enforced by bus guardians.
Nodes are Smallest Replaceable Units (SRUs) TTP/C Cluster Host Subsystems Fault Tolerant Units (FTUs): Groups of actively replicated nodes FTU 0 Host CPU FTU 1 FTU 2 Host Host Host CPU CPU CPU Host Host CPU CPU TTP TTP TTPTTP TTP TTP Duplicated broadcast busses Communication Subsystem Communication Network Interface (CNI): System partitioning: autonomous TTP controllers, host CPUs Hides communication subsystem behind memory abstraction Predictable interface behavior achieves composability
TTP/C Communication Properties Static Scheduling Guaranteed delivery times with known variance (jitter). Clock Synchronization All nodes synchronized to within one microsecond each TDMA round. Composability TTP/C nodes are temporally composable as well as functionally composable. This is a key property of being replica determinant. Fail Silent The bus guardians ensure transmission only during the correct timeslot, in all cases. Membership Every node s membership is available during each TDMA round.
TTP/C Bus Access Scheme Time Division Multiple Access (TDMA): Fixed assignment of slots to nodes Every node periodically transmits in its slot SRU Slot FTU Slot Bus 0 Bus 1 A FTU 0 A B B B FTU B 1 B B TDMA Round C C FTU 2 C C D FTU 0 D B B B FTU B 1 B B E E FTU 2 E E t t Message Descriptor List (MEDL): Static data structure Message dispatching table
X-by-Wire Systems Mechanical & hydraulic subsystems controlling safety-related functions are replaced by computer control systems Examples: brake-by-wire, steer-by-wire, vehicle dynamics control, active suspension Advantages: Cost reduction, weight reduction, easier design, assembly and maintenance, passenger safety and comfort Safety-critical applications require: Fault tolerance: no single fault may lead to a system failure Predictable and timely system behavior Synchronized time base (global time)
Evolution of Steering Systems Hydraulic Power Assist (Conventional Steering) Electric Power Assist (Newest Technology) Cooling (high end) reservoir Hydraulic pump Servo actuator hoses Torque sensor unit To MUX network EPS Motor
Steer By Wire Systems Steering Unit with Redundant ECUs TTP/C Comms ECU TTP/C Comms ECU TTP/C Comms TTP/C Comms TTP/C Comms Triple Redundant Actuators and lers TTP/C Comms And Motor TTP/C Comms And Motor TTP/C Comms And Motor Sensor Sensor Sensor
Modeling & Simulation in Automotive Design Trigger, Crank Angle based Matlab/Simulink Algorithm pre-driver Signal Conditioning Power Module Thermal Behavior Electro Mechanical Valve Crank Angle Source PWM frequency Engine Data, Combustion Chamber Back Pressure
Simulation Results Open / Close Valve Speed Coil Current Crank Angle Cylinder Back Pressure Force Position
Summary & Conclusions Safety critical systems are the next big development area in the automotive industry. TTP/C provides the basic features needed for implementing safety critical systems. Modeling and Simulation are increasingly important to designing highly complex, safety critical systems affordably. Proposed project to implement a partial high level model of TTP/C in Ptolemy as proof of concept. Prof. Hermann Kopetz lecturing at UT, Nov. 18.