1. DATE 20091 Optimizations of an Application- Level Protocol for Enhanced Dependability in FlexRay Wenchao Li 1, Marco Di Natale 2, Wei Zheng 1, Paolo Giusto 3, Alberto Sangiovanni-Vincentelli 1, Sanjit A. Seshia 1 1 UC Berkeley 2 Scuola Superiore S. Anna 3 General Motors

2. DATE 20092 Introduction [IMG: www.autofieldguide.com]

3. DATE 20093 CAN vs. FlexRay FlexRay - Capable of 10 Mbps communication - Time-triggered and event-triggered communication - Reliable - Clock Synchronization - Clique Detection - Bus Guardian CAN - Max 1 Mbps; - Protocol overhead of > 40%; - Contention resolved by priority. - Acknowledgment and retransmission when message is corrupted

4. DATE 20094 Motivation The current error-management scheme instructs the receiver to discard a corrupted frame. Need for application-level protocol for enhanced dependability, such as an acknowledgement-retransmission scheme which exists in CAN.

5. DATE 20095 Challenge The main challenge of implementing the fault recovery scheme is finding available transmission time in slots that can be used for acknowledgment and retransmission.

6. DATE 20096 Agenda Introduction Motivation Preliminaries and Related Work Tool Flow and MILP Formulation Case Study Conclusion

7. DATE 20097 FlexRay [FlexRay Specification v2.1]

8. DATE 20098 FlexRay [FlexRay Specification v2.1]

9. DATE 20099 Related Work Schedulability analysis of the FlexRay communication protocol [Pop’08] Embedded System Design for Automotive Applications [Sangiovanni- Vincentelli’07] NO previous work on optimizing FlexRay schedule for fault-tolerance.

10. DATE 200910 Objective We define Fault Recovery Rate (FRR) as the percentage of faulty messages guaranteed to be retransmitted before their deadlines. Objective: maximize FRR How: optimize remaining static slot assignments to ECUs to allow placement of acknowledgements and retransmissions in static slots on top of an existing schedule.

11. DATE 200911 Agenda Introduction Motivation Preliminaries and Related Work Tool Flow and MILP Formulation Case Study Conclusion

12. DATE 200912 Tool Flow Schedule Schedule with recovery allocation Optimized Acknowledgment and Retransmission Scheme Task Graph FlexRay Scheduler 1 st : Optimize FRR 2 nd : Optimize allocation

13. DATE 200913 Tool Flow Task Graph FlexRay Scheduler Automatic Deadline Extraction Fault Tolerance Optimization FlexRay Configuration Optimize Scheme Optimize Recovery rate

14. DATE 200914 Extract Deadline Information

15. DATE 200915 Assumptions Hard Real Time Constraints Fixed Schedule minimum changes to the existing subsystems. Fault Hypothesis: Fault Mode: fault can behave inconsistently to different ECUs; Fault Arrival Rate*: one per application cycle; Acknowledgments are represented as a single bit. Delay in CRC/adapter is not modeled Error on messages is uniformly random

16. DATE 200916 Assumptions Fault rate data in CAN is used to understand the challenges in FlexRay Bit Error Rate (BER) for CAN [Ferreira’04] Benign: 3 £ 10 -11 Normal: 3.1 £ 10 -9 Aggressive: 2.6 £ 10 -7 Without a fault-tolerant mechanism, the number of errors per hour can be between 0.22 and 1. If one error per cycle is masked, the number of errors per hour is between 3 £ 10 -8 and 4.86 £ 10 -1.

17. DATE 200917 MILP Formulation Parameters: ECUs E: {ECU i } Messages M i : {w i, ms i, mc i, d i, se i, de i } Number of cycles n c, number of slots n s Schedule matrix n s £ n c Variables*: Message M i : {f i, rs i, rc i, as ij, ac ij } Static slot S i : own ij

18. DATE 200918 MILP Formulation II Some Constraints: Acknowledgments are placed iff the original message is protected against faults 8 i, j : {1 · i · n m, j 2 de i } and M is large enough constant f i · as ij · M £ f i f i · ac ij · M £ f i

19. DATE 200919 MILP Formulation III Retransmissions must follow acknowledgments 8 i s.t. 1 · i · n m, 8 j 2 de i, (f i ! (as i + (ac i – 1)n s · rs ij + (rc ij – 1)n s )) Corresponding linear inequality is: as ij + (ac ij -1)n s – r i – (r i – 1)n s · M(1 – f i )

20. DATE 200920 MILP Formulation IV Two-stage optimization 1 st : optimize the fault recovery rate. maximize:  f i 2 nd : optimize the placement of acknowledgement and retransmission such that latency is minimized. 8 i minimize: rs i + (rc i – 1) £ n s

21. DATE 200921 Agenda Introduction Motivation Preliminaries and Related Work Tool Flow and MILP Formulation Case Study Conclusion

22. DATE 200922 Case Study I A real schedule for an x-by- wire application configuration from General Motors: 10 ECUs, 22 static slots, 8 cycles, 78 messages, 56 tasks.

23. DATE 200923 Case Study II Optimal fault recovery rate is 55.1% (43/78 messages) vs. 40.8% (random slot assignment) vs. 33.3% (no using unassigned slots) Placements of acknowledgments and retransmissions can be optimized in a greedy fashion after slot assignments are optimized.

24. DATE 200924 Discussion Recovery rate changes as the load increases.

25. DATE 200925 Conclusion A MILP formualation for implementing an application-level acknowledgment and retransmission scheme in FlexRay. Drawbacks: Works on top of an existing schedule Works only on the static segment Limited configuration change.

26. DATE 200926 Ongoing Work Extend it to handle different criticalities on messages Reschedule for more vacancies Combine this with a scheduling formulation Dynamic window Lift fault tolerance analysis to control algorithm

27. DATE 200927 Acknowledgment Hellman Family Faculty Fund Gigascale Systems Research Focus Center ArtistDesign network of Excellence STREP project COMBEST

28. DATE 200928 Q & A Thank you!