Automotive Open System Architecture Research Articles

AUTOSAR-Compatible Level-4 Virtual ECU for the Verification of the Target Binary for Cloud-Native Development

The rapid evolution of automotive software necessitates efficient and accurate development and verification processes. This study proposes a virtual electronic control unit (vECU) that allows for precise software testing without the need for hardware, thereby reducing developmental costs and enabling cloud-native development. The software was configured and built on a Hyundai Autoever AUTomotive Open System Architecture (AUTOSAR) classic platform, Mobilgene, and Renode was used for high-fidelity emulations. Custom peripherals in C# were implemented for the FlexTimer, system clock generator, and analog-to-digital converter to ensure the proper functionality of the vECU. Renode’s GNU debugger server function facilitates detailed software debugging in a cloud environment, further accelerating the developmental cycle. Additionally, automated testing was implemented using a vECU tester to enable the verification of the vECU. Performance evaluations demonstrated that the vECU’s execution order and timing of tasks and runnable entities closely matched those of the actual ECU. The vECU tester also enabled fast and accurate verification. These findings confirm the potential of the AUTOSAR-compatible Level-4 vECU to replace hardware in development processes. Future efforts will focus on extending capabilities to emulate a broader range of hardware components and complex system integration scenarios, supporting more diverse research and development efforts.

Autonomous Driving System Architecture with Integrated ROS2 and Adaptive AUTOSAR

In the automotive industry, research is now underway to apply Adaptive Automotive Open System Architecture (AUTOSAR) to the development of next-generation mobility, such as autonomous driving and connected cars. However, research on autonomous driving is being predominantly conducted on the robotics platform ROS2 (Robot Operating System 2). This demonstrates a considerable distance between autonomous driving research and its application in actual vehicles. To bridge this gap, interoperability that leverages the strengths of the Adaptive AUTOSAR and ROS2 platforms and compensates for their weaknesses is required. Therefore, this study proposes an architecture for interoperability between the two platforms, named Autonomous Driving System with Integrated ROS2 and Adaptive AUTOSAR (ASIRA). The proposed architecture enables communication between each of the two platforms through the ROS2 SOME/IP Bridge and allows for the necessary data exchange. It validates them in autonomous driving scenarios and goes beyond vehicle development, testing, and prototyping to exploit the advantages of each platform. Additionally, the simulation of autonomous vehicles within the ASIRA architecture is demonstrated by interoperating the ROS2 representative open-source autonomous driving project, Autoware, with the Adaptive AUTOSAR simulator. This study contributes to the assimilation of ROS2 into the automotive industry and its application in real vehicles by linking ROS2 and Adaptive AUTOSAR.

Protecting SOME/IP Communication via Authentication Ticket.

Designed using vehicle requirements, Scalable service-Oriented MiddlewarE over IP (SOME/IP) has been adopted and used as one of the Ethernet communication standard protocols in the AUTomotive Open System Architecture (AUTOSAR). However, SOME/IP was designed without considering security, and its vulnerabilities have been demonstrated through research. In this paper, we propose a SOME/IP communication protection method using an authentication server (AS) and tickets to mitigate the infamous SOME/IP man-in-the-middle (MITM) attack. Reliable communication between the service-providing node and the node using SOME/IP communication is possible through the ticket issued from the authentication server. This method is relatively light in operation at each node, has good scalability for changes such as node addition, guarantees freshness, and provides interoperability with the existing SOME/IP protocol.

Focus on software, data acquisition, and instrumentation

Focus on software, data acquisition, and instrumentation

Automatic modelling and verification of Autosar architectures

Autosar (AUTomotive Open System ARchitecture) is a development partnership whose primary goal is the standardization of basic system functions and functional interfaces for electronic control units in automobiles. As an open specification, its layered software architecture promotes the interoperability of real-time embedded vehicle systems and components. It also opens up the possibility of formal modelling and verification approaches, centred around the specification, that can be used to support analysis in the early stages of design. In this paper, we describe a methodology and associated tool, called A2A, that automatically models systems defined by the Autosar specifications as timed automata, and then verifies their timing properties using Uppaal. It contains 22 groups of timed automata templates, together with two auxiliary test templates, that model the Autosar architecture and timing properties, allowing time-related behaviours to be extracted from the three-layer architecture, i.e., the Autosar Software, Autosar Runtime Environment, and Basic Software layers, and templates to be automatically instantiated. The timing properties are specified using timed computation tree logic (TCTL) in Uppaal to verify the system model. We demonstrate the capabilities of the methodology by applying it to an Autosar architecture that describes an internal vehicle light control system, thereby showing its effectiveness.

Improvement of Automotive Sensors by Migrating AUTOSAR End-to-End Communication Protection Library into Hardware

This paper explores new methods to increase the level of safety of data transfer between sensors and electronic control units (ECUs) in automotive communication. A new model of basic sensors to be used in automotive electronics is proposed. This model contains hardware modules that implement the end-to-end communication protection (E2E) mechanism, as defined by the Automotive Open System Architecture (AUTOSAR) standard. By adding this feature inside the sensors, it is possible that, in addition to increasing the safety level, these sensors can be directly connected to the network ECUs via standard communication buses (e.g., Local Interconnect Network (LIN), Controller Area Network (CAN), Flexray, etc.). This paper describes the model, design, and mapping (in a Field Programmable Gate Array device (FPGA)) of the hardware E2E module capable of generating the Cyclic Redundancy Code (CRC) and counter signal for a customized message. This message represents the output of the new sensor E2E module used in a safety communication as requested by the automotive E2E standard. The model is validated also by comparing the data output of the E2E hardware with the data output of the AUTOSAR software E2E library. Finally, future needs and directions are suggested in this area.

Software-Based AUTOSAR-Compliant Precision Clock Synchronization Over CAN

Modern cars are characterized by a growing number of sensors, actuators, and advanced driver assistance systems that require a synchronized view of the time. These devices are typically interconnected by CAN, which is still the most important in-vehicle network. Precise clock synchronization over CAN is difficult due to the properties of the bus, and current approaches often use dedicated hardware or proprietary software solutions. A few years ago, however, the AUTomotive Open System ARchitecture (AUTOSAR) development alliance published a standardized synchronization method. In this article, we investigate what synchronization precision can be realistically achieved in a real-world automotive hardware and software environment. This involves pure software timestamping, standard CAN controllers without hardware modifications, and a typical automotive real-time operating system. We evaluate several approaches to reduce the synchronization jitter using filtering and optimizing the timestamping procedure. Experiments show that, ultimately, a precision better than 50 <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\mu$</tex-math></inline-formula> s can be achieved with a fully AUTOSAR-compliant software implementation.

Isolation of Shared Resources for Mixed-Criticality AUTOSAR Applications

Temporal isolation without consideration of spatial isolation has been attained for mixed-criticality systems, while the need for spatial isolation is urgently required in the automotive industry. Moreover, tasks with different criticality levels sharing the same resources are a common requirement for safety-critical automotive applications. Such tasks are more challenging to spatially isolate due to context sharing to access the same resources. Nevertheless, safety certification cannot be issued without addressing spatial isolation. This paper argues that traditional real-time locking solutions are unsuitable for mixed-criticality applications within the automotive open system architecture (AUTOSAR). We adopted the server task named resource server for spatial isolation within AUTOSAR limitations. We formalized a software component model for reducing design space and proposed the mapping algorithms. Properties of resource servers within AUTOSAR were formally analyzed for blocking delays, task priority assignment, and utilization analysis. Case studies in a powertrain domain of an electric vehicle were carried out to assess the proposed solutions.

Two-Layer Bus-Independent Instruction Set Architecture for Securing Long Protocol Data Units in Automotive Open System Architecture-Based Automotive Electronic Control Units

In this paper, we propose a bus-independent hardware (HW)-based approach to secure long protocol data units (PDUs) in Automotive Open System Architecture (AUTOSAR)-based automotive electronic control units (ECUs). Our approach is based on extending previous works that implemented two AUTOSAR communication (COM) application-specific instruction set processors (ASIPs). COM ASIP V1 introduced two instructions to handle the transmission and reception of PDUs no larger than 8 bytes and signals no larger than 32 bits individually through send signal and receive signal instructions. COM ASIP V2 introduced two extra instructions to handle long signals and PDUs of arbitrary lengths. We extended the instruction set architecture (ISA) of our previous ASIPs by introducing six new instructions, in COM ASIP V3, to hash PDUs that contain these signals to authenticate transmission and reception of such PDUs. The experimental results show that COM ASIP V3 can handle (i.e., transmit, receive, calculate hash, or verify hash) a 64-byte controller area network flexible data-rate (CAN FD) frame in 1.575 μs and a 254-byte FlexRay frame in 6.301 μs. These measurements indicate that the throughput of our new COM ASIP is much higher, 42× to 75×, than the throughput required by these communication buses.

A Multicycle Pipelined GCM-Based AUTOSAR Communication ASIP

In this paper, we explore two pipeline techniques to enhance performance of communication operations in AUTomotive Open System Architecture (AUTOSAR)-based automotive electronic control units (ECUs), and securing these communication operations using an enhanced two-layer process based on the highly secure Galois/Counter Mode of Operation (GCM) algorithm. Our work is based on extending a previous work that implemented three versions of AUTOSAR communication (COM) application-specific instruction set processor (ASIP). We made two pipelined architectures on top of COM ASIP V3 (i.e. COM ASIP V4 and COM ASIP V5). These new versions of COM ASIP are able to handle all operations (i.e. transmitting signals/long signals, receiving signals/long signals, calculating hash, or verifying hash for protocol data units (PDUs) containing these signals using GCM) of our previously implemented COM ASIPs in a pipelined fashion. The experimental results show that COM ASIP V4 has a speedup of 2.25x to 2.39x over COM ASIP V3, and COM ASIP V5 has a speedup of 3.27x to 5.5x over COM ASIP V3. They also show that throughput of these new versions of COM ASIP is much more, 100x to 338x, than throughput required by Controller Area Network Flexible Data Rate (CAN FD) and FlexRay communication buses.

A Non-Exclusive Multi-Class Convolutional Neural Network for the Classification of Functional Requirements in AUTOSAR Software Requirement Specification Text

Software Requirement Specification (SRS) describes a software system to be developed that captures the functional, non-functional, and technical aspects of the stakeholder’s requirements. Retrieval and extraction of software information from SRS are essential to the development of software product line (SPL). Albeit Natural Language Processing (NLP) techniques, such as information retrieval and standard machine learning, have been advocated in the recent past as a semi-automatic means of optimising requirements specifications, they have not been widely embraced. The complexity in the organization’s information makes requirement analysis intricately a challenging task. The interdependence of subsystems and within an organisation drives this complexity. A plain multi-class classification framework may not address this issue. Hence, this paper propounds an automated non-exclusive approach for classification of functional requirements from SRS, using a deep learning framework. Specifically, Word2Vec and FastText word embeddings are utilised for document representation for training a convolutional neural network (CNN). The study was carried out by the compilation of manually categorised relevant enterprise data (AUTomotive Open System ARchitecture (AUTOSAR)), which were also employed for model training. Over a convolutional neural network, the impact of data trained with Word2Vec and FastText word embeddings from SRS documentation were compared to pre-trained word embeddings models, available online.

Recent development in operating system based on AUTOSAR standard used in ECUs for automotive vehicles

Development in automotive embedded systems has grown rapidly in recent years due to increased functionality in automotive vehicles. Nowadays, a lot of modern technologies have been implemented in automotive vehicles in order to improve the performance and reliability. Automotive Open System Architecture (AUTOSAR) is a software standard used for development of the new modules inside of the automotive Systems. The evolution in automotive vehicles impacted the usage and design of real time operating systems as automotive embedded systems are mainly dependent on real time operating systems used in ECUs inside automotive vehicle. AUTOSAR based operating system is also a real time operating system which is developed on the basis of OSEK (Open Systems and the Corresponding Interfaces for Automotive Electronics) standards. AUTOSAR is nothing but a standardized extension of OSEK and both play very important role in software development of automotive systems. In this paper, the recent trends in the development in automotive embedded system have been discussed. The standards required for designing a real time operating system have been briefly explained for better understanding of the developments in the automotive embedded systems.

ECU EXTRACT ANALYZER AND MERGER TOOL

AUTOSAR XML (.arxml) is a format introduced by the Automotive Open System Architecture consortium to contain the data used in and required by Electric Control Units which is based on Automotive Open System Architecture. Electric Control Unit development is done by 3 groups i.e. OEM like BMW, Tier1like Bosch, and Tier2 like a vector. Each one has its own data that is required for Software development. OEM shares the information with Tier1.Tier1 shares the same with Tier2 for implementing into Electric Control Unit. The DataBase Container (DBC) describes the properties of the Controller Area Network (CAN) / Controllable Area Network Flexible Data Rate (CAN FD). Data analysis in ECU Extract ARXML is very difficult due to the complex structure of data. Performing two-way and three-way comparisons/merges of XML files is difficult. To handle the mentioned challenges manually is a big task that requires huge manual efforts and time which may even result in a manual error. In this paper, we are presenting a newly developed Python-based tool that overcomes the above-mentioned drawbacks.

The Migration of Engine ECU Software From Single-Core to Multi-Core

As multiple functions have been added to single-core-based engine electronic control units (ECUs) in vehicles, automotive researchers and manufacturers have actively studied multi-core architecture for engine ECUs. Multi-core architecture can provide load balancing and parallelism that can meet the requirements of international organization standard (ISO) 26262. However, since real-world engine ECUs have the most complex automotive open system architecture (AUTOSAR)-based control logic and datasets among automotive ECUs, developing multi-core-based engine ECUs is a substantial amount of work. Thus, automotive researchers and manufacturers will need new methodologies for multi-core-based engine ECUs. In this paper, we focus on designing a multi-core migration methodology and applying it to a real-world AUTOSAR-based engine ECU from HYUNDAI. We verify its practicability and enhanced performance. In conclusion, through connection with other automotive domain ECUs, it is demonstrated that a multi-core engine ECU using our migration technology can be applied in real-world automotive vehicles, leading to a significant improvement in performance.

AUTILE Framework: An AUTOSAR Driven Agile Development Methodology to Reduce Automotive Software Defects

This article introduces AUTOSAR Driven Agile Development (AUTILE) Framework as a new methodology to develop automotive software with an aim to reduce the number of defects and their severity. Automotive software, developed in a traditional/legacy way, currently must be rewritten from scratch to support new features or modifications in associated hardware. Disruptive automotive megatrends: connectivity, electrification, and autonomous driving continue to demand new features in a complex software-base. As a result, greater quality issues are faced when more functionality is added to traditional, nonstandardized automotive software. Several researchers have proposed standardization of automotive software to improve the software quality. However, as yet, the industry lacks a de facto standard. At the heart of the AUTILE Framework, we recommend following automotive open system architecture standard as the basis to design modular and open software architecture. To further realize the benefits of modular software architecture designed in the first phase, AUTILE chooses and integrates Agile methodologies as its software development approach. Widespread adoption of Agile methodologies for automotive software development has not occurred and this research highlights the enablers and barriers in this domain. The proposed framework was applied practically to develop automotive software projects, demonstrating that defect reduction can be accomplished using the steps outlined in this new methodology.

ASFIT: AUTOSAR-Based Software Fault Injection Test for Vehicles

With recent increases in the amount of software installed in vehicles, the probability of automotive software faults that lead to accidents has also increased. Because automotive software faults can lead to serious accidents or even mortalities, vehicle software design and testing must consider safety a top priority. ISO 26262 recommends fault injection testing as a measure to verify the functional safety of vehicles. However, the standard does not clearly specify when and where faults should be injected, and the tools to support fault injection testing for automotive software are also insufficient. In the present study, we define faults that may occur in Automotive Open System Architecture (AUTOSAR)-based automotive software and propose a fault injection method to be applied during the software development process. The proposed method can inject different types of faults that may occur in AUTOSAR-based automotive software, such as access, asymmetric, and timing errors, while minimizing performance degradation due to fault injection, and without using any separate hardware devices. The superior performance of the proposed method is demonstrated through empirical studies applied to fault injection testing of a range of vehicle electronic control unit software.

Real-Time Scheduling for Mixed-Criticality Systems in the Automotive Industry

Currently, mixed-criticality systems (MCSs) are rapidly adopted by the automotive industry, with the shift in electricalelectronic architecture from federated to integrated design to reduce developmental costs, pull in the development schedule, and easy reconfiguration of the system with service-oriented architecture. Several studies have been based on Vestal’s original MCS model, in which the criticality modes are the same as criticality levels. However, the MCS model does not fit the automotive industry or the safety perspective. In this study, we identify the divergence of theory and automotive practice for real-time MCS. We also propose a generalized MCS model close to industry practice and a priority assignment algorithm along with schedulability analysis for both online and offline phases. Further, we present a practical example of memory partition and decomposition tasks based on AUTomotive Open System Architecture (AUTOSAR). The proposed design is currently being developed for battery management systems of electric and plug-in hybrid electric vehicles.

Modeling and Verification of A Timing Protection Mechanism in the OSEK/VDX OS using CSP

Abstract The functions of automobiles are becoming increasingly intelligent, which leads to the increasing number of electrical control units for one automobile. Hence, it makes software migration and extension more complicated. In order to avoid these problems, the standard OSEK/VDX has been proposed jointly by a German automotive company consortium and the University of Karlsruhe. This standard provides specifications for the development of automotive software, this standard has become one of the major standards for real-time automotive operating systems (OSs). Since errors in the automotive OS may pose threat to the safety of people in a vehicle, it is necessary to verify the correctness of the OSEK OS which is used by many manufacturers around the world. Formal methods can be adopted to verify the correctness of both software and hardware. Therefore, we propose a formal model of the OSEK OS at the code level and verify three significant properties of the OSEK-based system. In this study, the code-level OSEK OS is verified to ensure compliance with the specifications. An automotive OS always requires that the systemreacts in a timelymanner to external events and performs the computations within the timing constraints. However, there is a possibility that the running time of the tasks exceeds the timing requirements due to the complexity of the tasks. Therefore, by referring to one of the extensions of the OSEK OS, Automotive Open System Architecture (AUTOSAR), we proposed tpOSEK, which is capable of extending the OSEK OS with a timing protection mechanism in AUTOSAR in this study. In our previous study, it was verified that the higher-priority task cannot be preempted by lower-priority tasks. In this paper, after improvement made to the OSEK OS model by adding interrupt service routine models and alarms, and extension of the OSEK OS model with a timing protection model, we have verified that tpOSEK satisfies three significant properties, which include deadlock f ree, complete and no timeout. These properties represent the basic conditions for the systemto run smoothly. If such properties as deadlock f ree and complete are satisfied, it means no deadlock is encountered by this system and all of the tasks can be scheduled completely. Moreover, if the property timeout cannot be satisfied, it means that none of the tasks would miss the deadline. Based on the tpOSEK model, the correct timing protection APIs can be designed at the code level. Thus, by extending the OSEKOSwith theseAPIs,we can update theOSEKOS faster and the need tomodify the dependent applications can be removed. Furthermore, we have constructed formal models for two industrial cases based on tpOSEK OS to demonstrate the soundness of our methods.

ECU Inter‐processor data communication End to End verification in Autosar for achieving Functional Safety Goals

AbstractSafety is absence of unreasonable risk. Functional safety emphasis to handle unintended behavior of the system. ISO26262 recommends the process and development of electrical components in automotive vehicle weighing less than 3000kg. Features are assigned with Automotive safety integrate levels (ASIL) A,B,C and D by performing Hazard Analysis and Risk Assignment(HARA). ISO 26262 recommends integrity of data communicated between sender and receiver components which handles data associated with ASIL features. This is achieved by developing each software or hardware components in compliance with ISO26262 ASIL recommended process and implementation. The process requires lot of effort to develop and validate each software component as per ISO26262 recommendations. This is more challenging when data integrity needs to be maintained between sender and receiver components which resides on two different microprocessors in the ECU. Also, it is more challenging to achieve freedom from interference between QM (quality managed) and ASIL feature software with in the software or hardware components. This paper detailed the decomposition of ASIL as per ISO‐ 26262 and exploring the end to end verification methods in AUTOSAR (Automotive Open System Architecture) to achieve safety goals. This paper considers achieving data integrity between two microprocessors in infotainment. This paper highlights the software components on sender and receiver that must comply to ISO26262 and recommendations, instead of developing all software and hardware components as per ISO 26262.

Design and Implementation Procedure for an Advanced Driver Assistance System Based on an Open Source AUTOSAR

In this paper, we present the detailed design and implementation procedures for an advanced driver assistance system (ADAS) based on an open source automotive open system architecture (AUTOSAR). Due to the increasing software complexity of ADAS, portability, component interoperability, and maintenance are becoming essential development factors. AUTOSAR satisfies these demands by defining system architecture standards. Although commercial distributions of AUTOSAR are well established, accessibility is a huge concern as they come with very expensive licensing fees. Open source AUTOSAR addresses this issue and can also minimize the overall cost of development. However, the development procedure has not been well established and could be difficult for engineers. The contribution of this paper is divided into two main parts: First, we provide the complete details on developing a collision warning system using an open source AUTOSAR. This includes the simplified basic concepts of AUTOSAR, which we have organized for easier understanding. Also, we present an improvement of the existing AUTOSAR development methodology focusing on defining the underlying tools at each development stage with clarity. Second, as the performance of open source software has not been proven and requires benchmarking to ensure the stability of the system, we propose various evaluation methods measuring the real-time performance of tasks and the overall latency of the communication stack. These performance metrics are relevant to confirm whether the entire system has deterministic behavior and responsiveness. The evaluation results can help developers to improve the overall safety of the vehicular system. Experiments are conducted on an AUTOSAR evaluation kit integrated with our self-developed collision warning system. The procedures and evaluation methods are applicable not only on detecting obstacles but other variants of ADAS and are very useful in integrating open source AUTOSAR to various vehicular applications.