1、Design and the Reliability Factor P151383_PT-174.indb 1 11/13/15 2:35 PMOther SAE books of interest: Counterfeit Electronic Parts and Their Impact on Supply Chains By Kirsten M. Koepsel (Product Code: T-130) Automotive E/E Reliability By John Day (Product Code: T-126) Automotive Electronics Reliabil
2、ity By Ronald K. Jurgen (Product Code: PT-144) For more information or to order a book, contact: SAE INTERNATIONAL 400 Commonwealth Drive Warrendale, PA 15096 Phone: +1.877.606.7323 (U.S. and Canada only) or +1.724.776.4970 (outside U.S. and Canada) Fax: +1.724.776.0790 Email: CustomerServicesae.org
3、 Website: books.sae.org P151383_PT-174.indb 2 11/13/15 2:35 PMDesign and the Reliability Factor By John Day Warrendale, Pennsylvania, USA P151383_PT-174.indb 3 11/13/15 2:35 PM Copyright 2016 SAE International eISBN: 978-0-7680-8268-5Copyright 2016 SAE International. All rights reserved. No part of
4、this publication may be reproduced, stored in a retrieval system, distributed, or transmitted, in any form or by any means without the prior written permission of SAE International. For permission and licensing requests, contact SAE Permissions, 400 Commonwealth Drive, Warrendale, PA 15096-0001 USA;
5、 e-mail: copyrightsae.org; phone: 724-772-4028; fax: 724-772- 9765. Printed in the United States of America Library of Congress Catalog Number 2015953119 SAE Order Number PT-174 http:/dx.doi.org/10.4271/pt-174 Information contained in this work has been obtained by SAE International from sources bel
6、ieved to be reliable. However, neither SAE International nor its authors guarantee the accuracy or completeness of any information published herein and neither SAE International nor its authors shall be responsible for any errors, omissions, or damages arising out of use of this information. This wo
7、rk is published with the understanding that SAE International and its authors are supplying information, but are not attempting to render engineering or other professional services. If such services are required, the assistance of an appropriate professional should be sought. ISBN-Print 978-0-7680-8
8、157-2 ISBN-PDF 978-0-7680-8268-5 ISBN-epub 978-0-7680-8270-8 ISBN-prc 978-0-7680-8269-2 To purchase bulk quantities, please contact SAE Customer Service e-mail: CustomerServicesae.org phone: +1.877.606.7323 (inside USA and Canada) +1.724.776.4970 (outside USA) fax: +1.724.776.0790 Visit the SAE Book
9、store at books.sae.org 400 Commonwealth Drive Warrendale, PA 15096 E-mail: CustomerServicesae.org Phone: +1.877.606.7323 (inside USA and Canada)+1.724.776.4970 (outside USA) Fax: +1.724.776.0790 P151383_PT-174.indb 4 11/13/15 2:35 PMv Table of Contents Introduction . 1 Efficient Reliability and Safe
10、ty Analysis for Mixed-Criticality Embedded Systems (2011-01-0445) 3 Maurice Sebastian, Philip Axer, and Rolf Ernst, Technische Universitt Braunschweig; Nico Feiertag and Marek Jersak, Symtavision GmbH CAN Security: Cost-Effective Intrusion Detection for Real-Time Control Systems (2014-01-0340) 21 Sa
11、toshi Otsuka and Tasuku Ishigooka, Hitachi, Ltd.; Yukihiko Oishi and Kazuyoshi Sasazawa, Hitachi Automotive Systems, Ltd. An AUTOSAR-Compliant Automotive Platform for Meeting Reliability and Timing Constraints (2011-01-0448) . 33 Junsung Kim, Gaurav Bhatia, and Ragunathan Rajkumar, Carnegie Mellon U
12、niv.; Markus Jochim, General Motors Research Design for Reliability: Overview of the Systemic Approach for Failure Analysis in Electronics (2011-36-0056) . 49 Mauro C. Andreassa and Joo Ricardo Tiusso, Ford Motor Company Brazil About Trends in the Strategy of Development Accelerated Reliability and
13、Durability Testing Technology (2012-01-0206) . 57 Lev Klyatis, Sohar Inc. Reliability of Multi-Sensor Fusion for Next Generation Cars and Trucks (2014-01-0718) 65 Venkatesh Agaram, PTC Inc. Techniques and Measures for Improving Domain Controller Availability while Maintaining Functional Safety in Mi
14、xed Criticality Automotive Safety Systems (2013-01-0198) 73 Swapnil Gandhi, Delphi Deutschland GmbH; Simon P. Brewerton, Infineon Technologies UK Ltd. About the Editor 87 P151383_PT-174.indb 5 11/13/15 2:35 PMP151383_PT-174.indb 6 11/13/15 2:35 PM1 Introduction Sophisticated infotainment systems are
15、 increasingly common in cars today. So are systems such as lane departure warning, adaptive cruise control, and blind-spot monitoring, which all have the purpose of making cars more reliable and safe. The proliferation of infotainment, safety, connectivity, powertrain control, body electronics, and
16、other “smart” features has increased the market for automotive semiconductor devices. According to the Gartner research firm, automotive semiconductor revenue grew 10.3% in 2014 to $30 billion, driven by strength in LEDs (light emitting diodes), image sensors, ASSPs (application-specific standard pr
17、oducts), and analog ICs. (https:/ market-share-analysis-automotive-semiconductors) Mark Fitzgerald, Associate Director of Strategy Analytics Automotive Practice, notes that vehicle makers increasing use of sophisticated electronic systems to develop vehicles that are safer, more fuel efficient, and
18、environmentally friendly is creating a demand for a higher number of sensors per vehicle. (https:/ analytics/news/strategy-analytics-press-releases/strategy- analytics-press-release/2014/12/09/global-automotive- sensor-demand-to-exceed-$25-8-billion-by-2021#. VfhDv_SULFU ) Hiroaki Kaneho, General Ma
19、nager of Renesas Electronics Corporations automotive systems division marketing unit, explains that automotive MCUs (microcontroller units) implement safety features; enhance environmental friendliness; and provide convenience, comfort, connectivity, and entertainment for drivers and passengers. For
20、 that reason, it is not unusual for a typical mid-priced new car to contain hundreds of MCUs spanning a range of processing and communication capabilities. “Going forward, even larger numbers of embeddable MCUs will be needed to meet the growing number of standard and optional electronically control
21、led capabilities required by regulators and desired by car buyers,” says Kaneho. “These design requirements will necessitate chips with greater functionality.” (http:/ index.jsp) More chips and greater functionality translate to further networking/communications activity within the car, and that rai
22、ses the prospect of potentially serious errors. Minimizing those errors by design is the focus of this book, which contains seven SAE Internationals handpicked technical papers, each important for engineers with responsibility for ultimate vehicle safety. They cover: A way to calculate the reliabili
23、ty of priority-driven, real-time components with respect to timing failures. Assessing components load situations during a certain interval of time, and covering each potential timing effect results in a realistic estimate of each components reliability. A delayed-decision cycle detection method tha
24、t can detect and prevent spoofing attacks with high accuracy. The method detects intrusion by evaluating a reception cycle of data frames, and it can destroy an intrusive data frame when it is determined to be attacking data. An AUTOSAR-compliant automotive platform for meeting reliability and timin
25、g constraints. The platform is based on a new software-component (SWC) allocation algorithm for fail-stop processors to support fault- tolerance with bounded recovery times. An eight-point process for determining the cause of failures with real-world cases in which the process was used. The authors
26、also list the main reasons why engineering items fail. How accelerated reliability and durability testing technology (ART/ADT)based on an accurate simulation of real-world conditionscan better predict reliability and durability. How to achieve reliable sensor-fusion despite sensor system complexity
27、and inconsistent reliability. How to improve domain controller availability while maintaining functional safety in mixed criticality automotive safety systems. Each paper provides insightful detail on a topic of increasing importancethe challenge to design for vehicle safety and reliability as these
28、 factors are influenced by automotive electronics technology. P151383_PT-174.indb 1 11/13/15 2:35 PMP151383_PT-174.indb 2 11/13/15 2:35 PM3 ABSTRACT Due to the increasing integration of safety-critical functionalities into electronic devices, safety-related system design and certification have becom
29、e a major challenge. Amongst others a suitable reaction of components in case of internal errors must be ensured in order to prevent a function from failing and to guarantee a certain degree of reliability. In this context a wide variety of different fault tolerance mechanisms have been developed in
30、 the past, including analytical considerations of error coverage and resulting reliability. However, most of these mechanisms induce a certain timing overhead, which in turn might affect the real- time capabilities of the system in a negative way. More concretely, even if each error is treated adequ
31、ately such that no logical failure occurs, a timing failure due to missing a deadline cannot be ruled out definitely. Thus, there is a growing need for appropriate methods to calculate the probability of timing failures and to prove that potential reliability and safety constraints are not violated.
32、 In this paper we present an analysis approach for networked systems as well as highly integrated multi-core architectures to calculate reliability with respect to timing failures. For that purpose simulation techniques are less appropriate and expensive due to the rare fault events, leading to exha
33、ustive simulation times until results are statistically relevant. Therefore, formal methods have been developed to prove that the considered embedded real-time system is working correctly and that failure rates are bounded according to the required safety level. Further on we present an extension of
34、 the basic analysis ideas to include the influence of different error models into reliability analysis. Special emphasis is put on mixed-criticality systems, i.e. systems with applications of different safety requirements. We propose an approach to decouple the reliability analyses for these applica
35、tions and to determine an individual safety integrity level for each application. Based on this approach it is possible to refine the conservative concept of IEC 61508 to take the most critical application as a basis for the whole system, enabling cost reduction and automated qualification. Based on
36、 a prototype implementation for Symtavisions SymTA/S tool suite we will show how the presented methodologies can be integrated into a safety related design flow. Based on that kind of tooling support the presented approaches can be applied for different stages of the design process, such as design s
37、pace exploration and optimization as well as for verification and certification purposes. 1. INTRODUCTION The increasing demand for comfort and driver assistance functionalities in upcoming vehicle generations poses new challenges on the E/E/PE (electrical/electronic/programmable electronic) equipme
38、nt of a car. A large variety of ubiquitous services should be realized by embedded systems in a cost- and power-efficient way, providing a maximum degree of usability and dependability. The consequence is a continuously growing amount of resources within the embedded systems to provide additional co
39、mputational power, transmission bandwidth or memory capacities. The interconnection structures between processing nodes, sensors and actors are becoming more and more complex. A mixture of wire-based transmission protocols and wireless systems might form a highly inhomogeneous network structure with
40、 high bandwidths to satisfy the customers demands. Another trend is the ongoing evolution of computational resources. Efficient Reliability and Safety Analysis for Mixed- Criticality Embedded Systems 2011-01-0445 Published 04/12/2011 Maurice Sebastian, Philip Axer and Rolf Ernst Technische Universit
41、t Braunschweig Nico Feiertag and Marek Jersak Symtavision Gmbh Copyright 2011 SAE International doi:10.4271/2011-01-0445 P151383_PT-174.indb 3 11/13/15 2:35 PM4 Future processor cores must be able to provide sufficient processing capacities while energy consumption should be minimized. For that purp
42、ose the appliance of highly integrated multi-cores seems to be a promising approach. Even though these design approaches might be considered as a quite suitable solution to handle the upcoming challenges, the issue of reliability is gaining more and more importance in that context. Inhomogeneous hig
43、h-bandwidth networks, unpredictable EMC effects, shrinking of semiconductor devices or decreasing supply voltages cause the probability of transient errors to increase drastically. Consequently the individual system components must be hardened such that they are able to tolerate faults and to ensure
44、 correct service behaviour. For that purpose numerous fault tolerance mechanisms such as modular redundancy, forward error correction, cyclic redundancy checks or checkpointing/ rollback schemes have been suggested in the past. Even though these mechanisms are able to detect errors and to react in a
45、n appropriate, they induce a certain amount of temporal overhead. This overhead is normally acceptable for general purpose systems because these systems are not subjected to hard real-time constraints. However in embedded systems and especially in the automotive sector the latency of system function
46、s matters. Deadlines are given such that each deadline miss actually violates the system specification and thus produces a failure which potentially causes severe causalities. In particular this topic is relevant when safety-critical systems are considered. These systems must be certified based on s
47、tate-of-the art safety standards such as IEC 61508 or ISO 26262. Most safety standards use a risk based approach to identify safety functions and potential risk that emanate from it. If the risk is unacceptably high, it is necessary to reduce the risk. A common approach to quantify this risk reducti
48、on is to use target failure rates. Depending on the degree of risk reduction that is required to fulfill the requirement of a specific safety function, different constraints for the target failure rate and thus for the required degree of reliability are given. For example, IEC 61508 specifies four s
49、afety integrity levels (SIL), each associated with a maximum acceptable failure rate. ISO 26262 is an adaptation of IEC 61508 for the automotive domain that introduces a similar notation, referred to as automotive SIL (ASIL). To verify that the system fulfills these reliability requirements, suitable analytical methods such as formal analysis, simulation or testing are necessary to proof the actually achieved SIL or ASIL. For that purpose simulation approac
