Design and Analysis ofFault-Tolerant Digital Systems: B. W. JOHNSON (Addison Wesley, 1989,577 pp., £41.35) The book provides an introduction to the important aspects of designing fault-tolerant systems, and an evaluation of how well the reliability goals have been achieved. The book is mainly oriented towards a final year undergraduate course on fault-tolerant computing, primarily with an implementation bias. In chapters 1 and 2, definitions and basic terminology are covered, which sets the stage for the remaining chapters, and provides the background and motivation for the remainder of the book. Chapter 3 provides a thorough analysis of fault-tolerance techniques and concepts. This chapter in particular is remarkably well written, covering the issues of hardware and information redundancy, which form the mainstay offault-tolerant computing. Subsequent chapters on the use and evaluation of the various approaches illustrate the principles as they have been put into practice. At the end of chapter 5, small projects that allow the reader to apply the material presented in the preceding chapters are included. The resurgence of interest in fault-tolerance with the emergence of VLSI is the theme of chapter 6, focussing on designing fault-tolerant systems in a VLSI environment. The problems and opportunities presented by VLSI are discussed and the use of redundancy techniques in order to enhance manufacturing yield and to provide in-service reliability are reviewed. The final chapter covers testing, design for testability and testability analysis, which must be considered during each phase of the design process to guarantee that resulting designs can be thoroughly tested. Each chapter is followed by a summary of the key issues and concepts presented therein, and a separate list of references, which makes it easily readable. In addition, there is a reading list with more comprehensive and specialised references devoted to each chapter. Overall, the book is well written, and contains a great deal of information in 577 pages. The book has a definite implementation bias, and draws considerably on the author's experience in industry, particularly reflected in the projects accompanying chapter 5. The book should be a useful addition to a library, and a suitable text to accompany a lecture course on fault-tolerant computing. R. RAMASWAMI, Department ofComputation, UMIST

Book Review: Design and Analysis of Fault-Tolerant Digital SystemsDesign and Analysis of Fault-Tolerant Digital Systems: JohnsonB. W. (Addison Wesley, 1989, 577 pp., £41.35)

This paper presents a comprehensive survey of five most widely used in-vehicle networks from three perspectives: system cost, data transmission capacity, and fault-tolerance capability. The paper reviews the pros and cons of each network, and identifies possible approaches to improve the quality of service (QoS). In addition, two classifications of automotive gateways have been presented along with a brief discussion about constructing a comprehensive in-vehicle communication system with different networks and automotive gateways. Furthermore, security threats to in-vehicle networks are briefly discussed, along with the corresponding protective methods. The survey concludes with highlighting the trends in future development of in-vehicle network technology and a proposal of a topology of the next generation in-vehicle network.

In-Vehicle Networks Outlook: Achievements and Challenges

The controller area network (CAN) protocol was originally introduced for automotive applications but is now also widely used in process control and many other industrial areas. In this paper, we present a low-cost redundancy-management scheme for replicated CAN channels that helps to ensure that clocks (and, hence, tasks) on the distributed nodes remain synchronized in the event of failures in the underlying communication channels, without the need for expensive or proprietary interface electronics. We argue that, when using this framework with duplicated channels, the probability of inconsistent message delivery drops to acceptable levels for a wide range of systems. Through an analysis of the protocol and a case study, we conclude that the creation of reliable, low-cost, distributed embedded systems using CAN is a practical possibility.

Fault-Tolerant Time-Triggered Communication Using CAN

This paper presents the design, implementation, and validation of a FlexRay transceiver and a SpaceWire (SpW) router and interface, which constitute the main hardware building blocks of the two in-vehicle communication standards. The FlexRay protocol features data rates up to 10 Mb/s and time- and event-triggered transmissions, along with scalable fault-tolerance support, and it is expected to become the standard network for X-by-wire and active safety automotive systems. However, collision avoidance and driver-assistance applications based on camera/radar sensors require data rates up to hundreds of megabits per second as well as fault tolerance, features that can hardly be covered by current or expected automotive standards. In this scenario, a promising technology seems to be the new SpW protocol, currently used in avionics and aerospace.

Design and Verification of Hardware Building Blocks for High-Speed and Fault-Tolerant In-Vehicle Networks

As time-triggered communication protocols [e.g., time-triggered controller area network (TTCAN), time-triggered protocol (TTP), and FlexRay] are widely used on vehicles, the scheduling of tasks and messages on in-vehicle networks becomes a critical issue for offering quality-of-service (QoS) guarantees to time-critical applications on vehicles. This paper studies a holistic scheduling problem for handling real-time applications in time-triggered in-vehicle networks where practical aspects in system design and integration are captured. The contributions of this paper are multifold. First, it designs a novel scheduling algorithm, referred to as Unfixed Start Time (UST) algorithm, which schedules tasks and messages in a flexible way to enhance schedulability. In addition, to tolerate assignment conflicts and further improve schedulability, it proposes two rescheduling and backtracking methods, namely, Rescheduling with Offset Modification (ROM) and Backtracking and Priority Promotion (BPP) procedures. Extensive performance evaluation studies are conducted to quantify the performance of the proposed algorithm under a variety of scenarios.

/pdf/holistic-scheduling-of-real-time-applications-in-time-4m1w35nkau.pdf

Holistic Scheduling of Real-Time Applications in Time-Triggered In-Vehicle Networks

A significant innovation effort in ground vehicles' technology is represented by the replacement of the traditional mechanical-hydraulic systems with all-electric systems, termed by-wire systems, for the transmission and execution of the driving commands. According to the experience in the aerospace environment, such replacement is expected to give appreciable benefits, even though it poses several problems. This paper provides an overview of the key components of by-wire systems, i.e. the electric actuators and the communication networks, especially for steering and braking operations.

Drive-by-wire systems for ground vehicles

This paper is concerned with the issue of protecting CAN networks against the consequences of babbling-idiot faults such as unscheduled traffic generated by a faulty node that denies any other communication. A full solution of the problem would greatly enhance the dependability of the CAN networks, making them applicable to safety-critical systems. After explaining the weakness of the native CAN protocol in tolerating the babbling-idiot faults, this paper shows how the FlexCAN architecture is suitable to tolerate them effectively. To this aim, a simple bus guardian is proposed and tested. The results of the test are given in this paper.

Overcoming Babbling-Idiot Failures in CAN Networks: A Simple and Effective Bus Guardian Solution for the FlexCAN Architecture

The paper is concerned with the key issue of protecting FlexCAN networks against the babbling-idiot faults, e.g., node faults that busy the bus unduly. A full solution of the problem would enhance the dependability of these networks greatly, making them attractive for safety-critical applications. After analyzing the various modes by which a babbling-idiot fault affects the network operation, a classification of the babbling-idiot faults into hardware and software is proposed. Then it is shown that the FlexCAN architecture provides a suitable means for tolerating hardware babbling-idiot faults. Afterwards, a simple bus-guardian is proposed to cope with the software babbling-idiot faults in the FlexCAN environment. The proposed bus-guardian has been implemented and tested, and some significant results are given to demonstrate its effectiveness

/pdf/overcoming-babbling-idiot-failures-in-the-flexcan-l53f81mamm.pdf

Overcoming babbling-idiot failures in the FlexCAN architecture: a simple bus-guardian

Dependability, i.e. the capability of a system of delivering the expected service, is a fundamental requirement for safety-critical applications. It is becoming a very important matter in the automotive field. Indeed, car industries are planning to replace the traditional mechanical-hydraulic apparatus used for the execution of the driving commands with all-electric systems, the so-called drive-by-wire (DbW) systems, which are made of components that are not as reliable as the ones of the traditional apparatus. This paper, starting from the existing literature, provides at first a conceptual framework for the dependability topic. Then dependable architectures for DbW systems are presented. As a case of study, the steering maneuver is considered.

Dependability of safety-critical systems

Drive-by-wire (DbW) is an emerging technology in the automotive environment that provides for the transmission and actuation of the driving commands by means of electric devices. The commands are entered by appropriate transducers, forwarded to electrical drives via a communication network and applied to local mechanical actuators. This paper deals with a DbW system for an industrial vehicle, at first presenting the safety requirements for the vehicle and the system architecture arranged to meet the requirements. Then, the design of the communication network is presented. The variables to be conveyed are defined and the specifications for the data exchange are established. Two communication protocols are evaluated for possible implementation. An experimental rig implementing the selected protocol is described and the tasks devised to validate the design of the communication network are illustrated

A. Zuccollo

Papers

Drive-by-wire systems for ground vehicles

Overcoming Babbling-Idiot Failures in CAN Networks: A Simple and Effective Bus Guardian Solution for the FlexCAN Architecture

Overcoming babbling-idiot failures in the FlexCAN architecture: a simple bus-guardian

Dependability of safety-critical systems

Design of drive-by-wire communication network for an industrial vehicle