AUTOSAR and Functional Safety - Automotive SPIN

1 AUTOSAR and Functional Safety Robert Leibinger, Dr. Alexander Mattausch, Jochen Olig November 2013 AUTOSAR and Functional Safety Mixed ASIL Systems as typical use case software mix in typical ECUs: QM Functions Safety Functions (ASIL) Safety Integrity Functions (ASIL) Basic software , reused standard software Black Box software or software from 3rd party The majority of functions on an ECU is not Safety related and thus QM classified Only a minority of function is Safety software (ASIL classified) Elektrobit (EB), 2013 2 ASIL QM AUTOSAR and Functional Safety How to mix QM and ASIL software ? Use independent mechanisms to realize Freedom from Interference independent standard Safety mechanisms reduced complexity and effort avoids or detects propagation of failures Develop complete SW in conformance to highest ASIL of any function within the ECU ( ASIL Lift-up Effect ) high development effort additional Safety measures in application necessary increased complexity failure detection only Elektrobit (EB), 2013 3 ASIL ASIL ASIL QM AUTOSAR and Functional Safety Interference with Operating System Elektrobit (EB)

2 , 2013 4 QM software ASIL software 1 ASIL software 2 Micro Safety OS Memory Protection Memory Interference blocked by MPU Execution of Tasks, Interrupts and Hooks Safety OS is basis of program execution has to ensure freedom from interference has to be independant from all other SW parts uses HW MPU controls the execution of Tasks, Interrupts and Hooks => according OS functionality has to be provided with the necessary ASIL AUTOSAR and Functional Safety A safe operating system Elektrobit (EB), 2013 5 Operating System features Concurrent Execution of tasks, ISRs and hooks Inter-Process communication (Events) Mutual Exclusion (OSEK resources) Error Handling Monitored startup Freedom from Interference Memory protection Context protection Safety Mechanisms can rely on these features AUTOSAR and Functional Safety AUTOSAR Safety Architecture Elektrobit (EB), 2013 6 Safety E2E Protection MCAL (ASIL) ASIL CDD QM SW-C BSW MCAL ASIL SW-C Safety TimE Protection Wdg Partitions Safety OS Safety OS.

3 Data Protection Stack Protection Context Protection OS Protection Hardware Error management Safety E2E Protection for safe communication to other ECUs Safety TimE Protection for alive supervision, deadline and controlflow monitoring Safety RTE Safety RTE for protected communication between Memory Partitions Memory COM Safety RTE AUTOSAR and Functional Safety Strengths of this solution Mix of Safety and QM software possible reuse of available software in QM quality simplify integration of black box software Availability of Safety Functions and Mechanisms independent from QM software fulfill Safety Requirement Availability ( electrical power steering) key functions stay intact even if QM-parts fail Modular concept and reuse of Safety Argumentation reduced complexity, better maintainability & management of variants saves ~ 30% engineering costs compared to previous solution (Tier1 statement) Concept can be extended to Multi-Core devices Efficient integration of Functional Safety and AUTOSAR Elektrobit (EB), 2013 7 Get in touch!

4 Contact us.