Technical papers

At RTaW, we focus on advancing the tools, techniques, and platforms that enable the development of provably safe critical systems efficiently and cost-effectively. Explore a selection of our presentations and papers below. Have any questions or feedback? We’d love to hear from you. You can also check out a selection of presentation slides on this page and recent research papers here.

Jump to:

Automotive & Aerospace

2022–2026
2018–2021
2013–2017
2008–2012
2000–2007

Real-Time Systems / Formal Methods

Low-Power Scheduling

Automotive & Aerospace Embedded Systems

Technical papers on real-time performance, communication networks, and architecture design for automotive and aerospace embedded systems.

  • 2022-2026

The presentation examines FRER configuration challenges during normal operation and failure recovery. RTaW-Pegase simulations show how traffic bursts can cause downstream PSFP to discard valid frames. It also reviews ongoing IEEE 802.1CBec standardization efforts and discusses engineering approaches to managing the effects of FRER on network timing, buffering, and traffic policing.

This work examines how PSFP configuration affects fault containment and the forwarding of valid traffic in TSN networks. Using RTaW-Pegase simulation and hardware experiments, it shows how overly loose configurations may fail to contain faulty traffic, while overly strict settings can discard valid traffic due to jitter accumulation. It also provides practical configuration guidelines and discusses PSFP limitations and possible improvements to the standard.

Ring-based zonal Ethernet can provide redundancy and bandwidth, but unequal path lengths and daisy-chain burst accumulation create latency skew, buffering, and reshaping challenges. The presentation analyzes how TSN mechanisms—especially source-proximate shaping and per-stream ATS—can control circular burst dependencies, and highlights design rules for line rates, ring egress memory, receiver buffering, and resilient attachment units.

Per-Stream Filtering and Policing (IEEE 802.1Qci) is intended to contain faulty TSN traffic, yet its byte accounting can understate on-wire frame size by 20 bytes. Simulations and hardware-in-the-loop tests show that minimum-size frames may exceed contracted bandwidth by up to 30%, delaying independent streams or overflowing buffers. The paper evaluates mitigations and proposes overhead-aware metering and minimum-frame-size checks.

This case study examines end-to-end QoS in a zonal automotive architecture where CAN, SOME/IP, switched Ethernet and 10BASE-T1S coexist. It combines timing budgets and worst-case analysis for a brake-to-stop-lamp path with scalability and buffer studies. Results show that T1S cycle timing and PLCA alone cannot distinguish criticalities; priority assignment and shaping significantly increase schedulability while controlling switch memory.

Bursty high-priority traffic increases switch buffering, latency variation and interference with lower-priority flows in automotive Ethernet. Through scenario-based analysis, the presentation compares natural, end-to-end and per-hop shaping, explains limitations of standard TSN shapers, and introduces hierarchical token bucket preconditioning. It argues that topology-aware source shaping can store bursts once, reduce network memory, and improve latency trade-offs for demanding uses such as flashing and streaming.

The presentation maps application-level DDS Quality-of-Service policies to TSN mechanisms in software-defined vehicle networks. It explains how priorities, shaping and scheduling can be configured to satisfy DDS deadline, reliability, latency-budget and flow-control needs while using network resources efficiently. Combining this configuration with worst-case timing analysis allows designers to verify, rather than merely expect, that DDS communications meet their end-to-end QoS requirements.

CBS and ATS both regulate TSN traffic, but differ in granularity, configuration and resilience to burst accumulation. The presentation compares their effects on latency, bandwidth and topology-dependent behavior, showing that ATS is more flexible and can reproduce CBS-style shaping when needed. It also explains valid combinations of the two and warns that, without strict policing, only the highest numerical traffic class can retain dependable latency guarantees.

This keynote reviews a decade of practical experience with TSN timing mechanisms in automotive, aerospace and industrial networks. It compares priorities, frame preemption, CBS, ATS and time-aware shaping in terms of use cases, benefits, limitations and configuration effort. The central lesson is that TSN is a flexible toolbox rather than an automatic guarantee: mixed-criticality systems still require careful network engineering, verification and fault-containment design.

This cross-company case study evaluates timing and resource trade-offs in a centralized software-defined vehicle architecture that gateways CAN traffic over a TSN Ethernet backbone. Simulation compares PDU-packing, gateway tasking and shaping strategies across latency, link load, CPU load and memory. Results favor sub-millisecond CAN-to-Ethernet gatewaying, CBS for buffer and low-priority latency control, and multicore frame processing; TAS improves scalability but roughly doubles buffer consumption.

The presentation identifies timing-predictability challenges introduced by service-oriented, zone-based vehicle architectures. It distinguishes determinism from bounded real-time behavior, examines the need for timing-accurate communication and execution models, and proposes temporal firewalls using TSN priorities, CBS, TAS and preemption. Because increasingly complex computing platforms threaten predictability, timing guarantees must guide architectural choices and be supported by a verification strategy throughout development.

This case study models how signal-oriented CAN/CAN-FD devices scale within a centralized, service-oriented vehicle architecture. It compares periodic publish-subscribe communication with event-triggered activation and on-demand services across end-to-end delay, processor load and network load. A mixed strategy—periodic communication for non-critical chains and event-triggered services for critical ones—best meets constraints, while local jitter-reduction shaping limits burst propagation and preserves independence between subnetworks and software layers.

  • 2018-2021

Using a representative next-generation helicopter network, this paper quantifies what TSN can deliver in timing, memory use and extensibility compared with conventional Ethernet. It evaluates scheduling choices for mixed-criticality avionics and mission traffic, showing that priorities often need support from shaping, preemption or time-aware scheduling. Selective deployment can control cost, but choosing and jointly configuring mechanisms remains a substantial engineering task.

This Renault case study examines how a service-oriented architecture running over a TSN backbone can provide predictable QoS for lighting control and sensor-fusion services. It evaluates service granularity and alternative TSN configurations against latency and memory. The results emphasize model-based configuration and verification, because middleware behavior, shaping availability, execution-platform nondeterminism and interactions among QoS mechanisms make manual optimization unreliable.

The presentation outlines a computer-aided, iterative process for designing Ethernet- and TSN-based vehicle architectures as BMW moves toward layered service orientation and dynamically allocated computing resources. Virtual platforms, quantitative KPIs and design-space exploration provide early evidence for topological and technological choices. The approach aims to manage complexity, cost and extensibility while fitting architecture optimization into an existing industrial development process.

This study compares practical IEEE 802.1CB redundancy arrangements for zonal automotive Ethernet, modeling both persistent hardware failures and intermittent transmission errors. It quantifies protection, bandwidth and cost trade-offs for switch-based replication, end-to-end redundancy, dual-homing and temporal redundancy. End-to-end protection offers the highest integrity, while selective deployment is essential because duplicated backbone traffic is costly; progressive configurations also permit reuse of existing ECUs.

A Volvo centralized TSN architecture is used to demonstrate early design-space exploration for robustness, capacity, bottleneck removal, cost and communication reliability. Synthetic but realistic traffic scenarios expose constraints that simple average link-load metrics miss. The workflow progressively refines the baseline architecture, identifies limiting resources and evaluates targeted changes, showing how automated stress testing and topology optimization can support future-proof, cost-effective network design.

This Renault FACE case study uses design-space exploration and realistic generated traffic to compare topology and TSN scheduling choices before detailed implementation. It introduces KPIs for network extensibility and congestion, identifies the resource and performance constraint behind each bottleneck, and shows that duplicating one 100-Mbit/s link can increase supported services by 54%. Combined TSN mechanisms and tool support are required because no single scheduling policy fits every traffic class.

This report investigates whether machine learning can predict the schedulability of realistic Ethernet TSN configurations faster than conventional network-calculus analysis. Standard supervised and unsupervised methods achieve over 93% accuracy for the best tested models and evaluate 1,000 configurations in milliseconds rather than minutes. The resulting accuracy–runtime trade-offs are attractive for design-space exploration, although false-positive feasibility predictions still require careful handling.

The paper combines machine-learning predictions with conventional schedulability analysis: clear cases are classified quickly, while uncertain cases receive sound analysis. On TSN networks using eight priority classes, the method reaches 99% accuracy, a 5.7-fold speedup and 46% fewer false positives than machine learning alone. Final candidate designs should still undergo schedulability analysis, but the hybrid approach greatly accelerates exploration on ordinary desktop computers.

Timing-accurate simulation explores the performance of AUTOSAR TCP over in-vehicle Ethernet under video and other interfering traffic. The study shows that TCP can consume available bandwidth with low latency when receive windows, polling periods and memory are configured together; oversized windows can instead trigger switch losses and costly retransmission timeouts. TSN shaping improves throughput and memory use, but TCP remains appropriate only for soft real-time traffic.

This paper validates a fine-grained TTEthernet simulation model against a hardware platform, then injects link failures and transient frame errors to study clock synchronization for launcher avionics. Synchronization remains precise after one permanent link failure, while transient errors reduce accuracy but stay within the tested tolerance margin. The work highlights transparent-clock implementation quality and shows how CPAL simulation supports protocol understanding, fault analysis and model traceability.

The paper evaluates sender-side pre-shaping as a lightweight alternative to CBS and time-aware scheduling for bursty automotive audio and video streams. Carefully inserted pauses between frames sharply reduce interference and best-effort latency while preserving deadlines for critical traffic, without specialized network hardware or clock synchronization. The method is simple and effective, but its parameters must balance schedulability against robustness to later changes in traffic and topology.

A demanding Renault Ethernet case study compares IEEE 802.1Q priorities, AVB credit-based shaping and TSN time-aware scheduling, individually and in combination. Simulation and worst-case analysis show that pre-shaping, custom AVB classes, or synchronized TAS/CBS configurations can satisfy all requirements, whereas default settings often fail. Fine-grained parameter selection and coordinated task-message scheduling are decisive, making automated configuration and verification essential.

This paper develops routing, bandwidth allocation and deterministic delay analysis for the wormhole-switched network-on-chip of the Kalray MPPA2 manycore processor. It constructs deadlock-free, feed-forward routes, assigns single paths using max-min fairness, and computes queue backlogs and end-to-end bounds through linear network calculus. An LP-based heuristic limits combinatorial growth while preserving useful rate and latency performance across concurrent flows.

  • 2013-2017

Experiments on a mixed-criticality Renault prototype compare priority Ethernet, AVB and TSN configurations for control, audio, video and data-transfer traffic. Three feasible solutions emerge—pre-shaped priority traffic, custom AVB classes, and carefully combined TAS/CBS—but standard configurations miss key deadlines or throughput targets. The study demonstrates that protocol selection alone is insufficient: priorities, shaping rates, gate schedules and task-message coordination require joint, tool-supported optimization.

The paper uses bounded clock phase differences as a practical compromise between expensive global synchronization and independent local clocks on CAN. A network-calculus method covers periodic and sporadic traffic, CAN FD and transmission errors. In the tested realistic configurations, weak synchronization reduces average delay bounds by about 50% for periodic traffic and remains beneficial with substantial sporadic load, while requiring only coarse clock accuracy.

This model-driven co-design framework connects control stability with real-time software scheduling through explicit timing-tolerance contracts. Controller design is checked by jitter analysis and co-simulation, software integration by WCET estimation and schedulability analysis, and implementation by run-time monitoring. Built on CPAL model interpretation, the same verified controller model runs directly on target hardware, reducing semantic gaps and revealing timing problems earlier in the development cycle.

The paper prototypes an IoT mobility system for motorcycles and auto-rickshaws that reports location, speed, driver alcohol level and air-quality data to a cloud platform. CPAL models the timing-aware application, which executes on ARM mbed hardware connected through cellular networking and IBM Watson IoT. Vehicle tests demonstrate feasibility and suggest applications in speeding detection, pollution monitoring, traffic management and context-sensitive driver warnings.

Using worst-case traversal-time analysis and sensitivity experiments, this study quantifies how time-triggered and rate-constrained traffic interact in TTEthernet. It examines latency, jitter and usable bandwidth under different TT loads and integration policies, showing that performance depends strongly on the global schedule and configuration tool. The results motivate design-space exploration to guide mixed-criticality network configuration and automate verification across the many available parameters.

This paper develops a smart-parachute add-on that can terminate an unsafe unmanned-aircraft flight independently of an untrusted autopilot. Requirements, design, simulation and partial verification are expressed in CPAL, including the motor-shutdown and parachute-deployment sequence. Model-based fault injection provides initial evidence that the prototype can meet its objectives cost-effectively, while the authors note that broader verification coverage and refined requirements remain necessary.

The paper presents CPAL, a model-driven flow in which the same model describes functional behavior, architecture, timing and activation, runs in workstation simulation, and is interpreted on embedded hardware. This model-as-code approach targets shorter development cycles, hardware independence and timing predictability without the rigidity of fully synchronous languages. High-level abstractions support design-space exploration and verification while keeping the programming model accessible to conventional developers.

CPAL is applied to the 2015 Formal Methods for Timing Verification challenge, whose interacting tasks exceed the expressiveness of conventional real-time scheduling models. Building an executable CPAL model exposes ambiguities and provides a complete timing-aware specification. Timing-accurate simulation and schedulability analysis then solve and cross-check the sub-challenges, illustrating how simulation can guide design when exact verification is impractical, while still requiring caution about worst-case guarantees.

This study models the startup and subscription timing of AUTOSAR SOME/IP Service Discovery to identify configurations that balance fast service availability against broadcast overhead. Analytical sensitivity results show that service readiness, initial-wait duration and cyclic offer delay dominate subscription latency. A broad parameter range performs acceptably unless timing constraints are very tight, but network delays above one millisecond must be included when selecting practical values.

The paper examines what timing-accurate simulation can reliably contribute to critical automotive Ethernet verification when analytic models are incomplete or overly pessimistic. Across realistic case studies, simulation provides detailed latency distributions and efficient resource estimates, while worst-case analysis retains hard guarantees. The proposed methodology emphasizes large samples, quantified tail risks, comparison with analytic bounds and validation of assumptions such as ergodicity before accepting occasional deadline misses.

A formal model computes the worst-case time for every AUTOSAR SOME/IP Service Discovery client to receive its first service offer and derives total network startup delay from protocol parameters. Implemented in GNU Octave, the calculation is validated against timing-accurate simulation and an experimental setup, with less than a 1.3% gap in the evaluated cases. The method supports systematic configuration of millisecond-scale automotive startup requirements.

This paper proposes response-time quantiles from simulation as an adjustable alternative when CAN worst-case analyses are unavailable or excessively conservative. Target quantiles are selected according to frame criticality, with simulation length and confidence checked accordingly. Two automotive case studies show how the method quantifies rare deadline misses, including their possible clustering, and gives designers finer evidence for balancing safety margins against bandwidth and resource use.

AFDX certification requires safe upper bounds on every flow’s network traversal time, yet conventional network calculus ignores useful traffic-shaping information created inside end systems. By incorporating the actual frame schedule and offsets, this work reduces computed worst-case bounds by about 40% on average in a realistic Thales Avionics configuration. Because end-system scheduling is already controlled by the network supplier, the improvement requires little change to the established design process.

Instead of fully qualifying a complex network-analysis program, proof-by-instance makes the program emit a certificate for each computed AFDX delay or buffer bound. A small trusted checker verifies that certificate against formalized network-calculus rules. The paper demonstrates feasibility on a realistically sized network and defines a roadmap toward industrial tooling, promising stronger confidence, clearer specifications and lower certification cost as algorithms evolve.

This work formalizes network-calculus concepts in Isabelle/HOL and instruments an existing AFDX analysis engine to generate machine-checkable proofs of its delay bounds. A prototype produces a complete certificate for one switch, demonstrating that result certification can replace much of the trust placed in complex implementation code. The authors estimate that the approach could reduce trustworthy-tool development overhead from roughly four-to-tenfold to two-to-threefold.

Deficit Round Robin can partition AFDX bandwidth among traffic classes, simplifying mixed-criticality integration and incremental certification, but consumes more network capacity than FIFO or static priority. A realistic study evaluates DRR and combined static-priority/DRR scheduling using network calculus. Both appear feasible on gigabit networks and offer configurable trade-offs between resource efficiency and independence, although class grouping and quantum allocation remain open optimization problems.

This preliminary study proposes certifying the outputs of network-calculus tools rather than proving or qualifying every implementation detail. The analysis program records its calculation trace, which a trusted Isabelle/HOL theory checks offline for applicable rules and numerical correctness. Early experiments show the approach is feasible for AFDX and may substantially reduce qualification effort while allowing tool vendors to retain conventional languages, processes and high-performance algorithms.

  • 2008-2012

Gatewayed CAN messages inherit queuing jitter that can accumulate across buses and degrade the schedulability of lower-priority traffic. The paper introduces Non-blocking Jitter Reduction, a lightweight traffic shaper driven by a local free-running timer and implemented as one periodic gateway task. It needs neither global synchronization nor precise arrival timestamps or blocking reads, making it suitable for constrained OSEK systems while accommodating bounded clock drift.

After reviewing more than two decades of CAN use, this forward-looking paper assesses pressures from growing architectures, hybrid powertrains, driver assistance, energy modes, distributed functions, software downloads and safety requirements. It argues that disciplined specification, schedulability verification and optimized CAN configurations can delay costly migrations, while FlexRay, Ethernet and CAN FD offer distinct paths when network size, bandwidth or predictability exceeds classical CAN capabilities.

Because some CAN device drivers use FIFO or other non-priority queues, this paper derives response-time analyses for arbitrary deadlines under two work-conserving policies: queues that preserve order and queues that permit reordering. It establishes optimal adjacent priority assignments per node and adapts Audsley’s algorithm to the setting. Although priority queues remain preferable, the results provide safe integration guarantees when only work conservation is known.

The paper extends CAN response-time analysis to periodic messages with offsets and release jitter through a transaction-based framework. Exploiting deliberate desynchronization produces substantially tighter worst-case bounds than the classical synchronous assumption, especially at high load, and can reduce unnecessary overprovisioning. The approach is exponential in principle but practical for medium automotive networks, with further work needed for finite buffers, FIFO behavior and non-abortable transmissions.

This work addresses the deployment of numerous automotive software runnables onto a small number of identical ECU cores. It decomposes the intractable problem into runnable partitioning and per-core sequencing, then proposes low-complexity heuristics that respect locality and dependency constraints while smoothing processor demand through offsets. The resulting sequencer tasks can also be integrated with conventional operating-system tasks, enabling global schedulability analysis of mixed multicore workloads.

Fine-grained CAN simulation that explicitly models ECU clock drift is combined with worst-case response-time analysis to support network design. Analysis locates rare adverse phasings, while simulation reveals their duration, evolution and response-time distributions. Long simulations show that realistic drift makes distributions converge largely independently of initial phases and drift values, so a single trajectory can provide useful statistics without replacing the hard guarantees of analysis.

Hundreds of realistic AFDX configurations generated with NETAIRBENCH are used to compare three safe network-calculus techniques implemented in RTaW-Pegase. Simple token-bucket analysis is fastest, shaped-staircase functions improve accuracy at modest cost, and ultimately pseudo-periodic functions give the tightest bounds but take longer. The experiments quantify these trade-offs, helping engineers select an appropriate method for early design-space exploration or detailed verification.

This paper introduces a tractable class of arrival curves for packetized flows and an associated FIFO delay-bound algorithm. On a realistic AFDX example, the proposed model improves bounds by about 2.9% over fluid modeling for only 22% more computation, whereas fully detailed packet modeling gains about 5.9% at roughly seven times the cost. It therefore offers a useful accuracy-speed compromise for repeated design-space exploration.

RTaW-Pegase is presented as an industrial tool for computing safe worst-case traversal times in large AFDX networks. The paper covers its requirements, architecture, graphical network editor and network-calculus engine, then evaluates several function representations on realistic configurations. Recent algorithms improve bound accuracy while retaining scalable computation, reducing resource overprovisioning and supporting design-space exploration; more automated optimization of complex architectures remains ongoing.

The study examines how unavoidable differences between ECU clocks affect CAN frame response-time distributions. A fine-grained simulator shows that, over sufficiently long runs, distributions converge to essentially the same shape despite different initial node phasings and randomly selected drift rates. Clock drift also makes worst-case phasings transient rather than persistent, supporting more representative statistical evaluation while motivating formal conditions for convergence and complementary stochastic analysis.

Classical CAN analysis assumes that each node can always present its highest-priority ready message, an assumption violated by controllers whose transmit requests cannot be cancelled. This paper derives a schedulability analysis for nodes with three or more finite non-abortable buffers and quantifies the resulting priority inversion. Automotive case studies show large response-time increases and even missed schedulability, highlighting the need to model controller and driver limitations explicitly.

These seminar slides connect automotive communication dependability with the emerging problem of security. They review growing architectural complexity, timing-verification pitfalls and threats introduced by physical or wireless access, including unauthorized software changes and network attacks. The presentation argues that safety, availability, integrity and confidentiality must be treated together across the development lifecycle, with realistic models, verification tools and appropriate architectural protections.

The PEGASE project brings aerospace partners and researchers together to improve the precision, scalability and implementation of network-calculus timing analysis. It targets safe worst-case traversal bounds for large AFDX and SpaceWire systems without excessive resource overprovisioning. Early work includes new theoretical results and a min-plus interpreter, while indicating that exact methods will require sound, user-controlled approximations beyond a still-unknown complexity threshold.

Using CAN experiments, this presentation explains why neither simulation nor analytic worst-case analysis is sufficient by itself for early timing validation. Simulation explores realistic latency distributions but can miss rare failures; simplified analytic models provide guarantees yet may be pessimistic or wrong. Replaying analytically identified worst-case trajectories and nearby scenarios helps validate models, measure how long adverse behavior persists and improve resource-dimensioning decisions.

Finite CAN transmit buffers can trap low-priority messages and delay newly released high-priority traffic, invalidating classical response-time assumptions. This paper explains the resulting priority inversion and extends schedulability analysis for controllers with at least three buffers and cancellable requests. It also proposes implementation guidance that limits both the additional delay and run-time CPU overhead, while identifying non-abortable requests as a harder follow-up case.

This outlook surveys virtualization for consolidating automotive functions on more powerful multicore ECUs. Promising uses include legacy software reuse, heterogeneous operating systems, security isolation and diverse redundant execution. However, hierarchical scheduling, limited hardware support, memory footprint and shared peripheral virtualization complicate predictable real-time behavior. The authors conclude that virtualization is mature enough for meaningful deployment, provided its timing properties are formally verified.

The paper combines two requirements of future consolidated automotive ECUs: strong AUTOSAR operating-system protection for multi-source software and predictable multicore scheduling. It reviews memory, timing, service and hardware-resource isolation, then proposes practical heuristics to partition and cyclically sequence hundreds of runnables. Realistic experiments achieve high processor utilization while respecting locality and dependency constraints, with performance guarantees available for important harmonic cases.

For automotive multicore ECUs, this work adopts static partitioning to preserve the simplicity and predictability expected by designers. It proves that both assigning runnables to identical cores and constructing each cyclic schedule are computationally hard, then supplies efficient heuristics for load balancing and offset selection. Realistic studies show strong CPU utilization and versatility, while future extensions include precedence constraints, redundant lockstep execution and distributed timing chains.

This survey presentation describes contemporary in-vehicle electronic architectures, the AUTOSAR communication stack and the principal trade-offs among CAN, FlexRay and other automotive networks. It explains event-triggered versus time-triggered behavior, high-load CAN optimization and FlexRay configuration. The outlook anticipates architectural change driven by greater complexity, safety-critical functions and ISO 26262, while noting that established medium-access technologies still meet many current needs.

Aperiodic CAN traffic is difficult to characterize and is therefore often omitted from worst-case response-time calculations, potentially understating risk. This paper builds probabilistic workload-arrival functions from observed interarrival data and lets designers select a safety threshold matched to dependability requirements. The method yields more realistic hardware dimensioning than fully deterministic assumptions, although its accuracy depends on traffic priority modeling and statistical properties such as independence.

This French-language presentation explains how AUTOSAR OS supports reusable, multi-source ECU software through memory, timing, service and hardware-resource protection. These mechanisms isolate applications, confine faults and clarify supplier responsibility, but also constrain task organization and scheduling. The slides examine implementation classes and limitations in the 2009 specification, then outline expected extensions for multicore processors, standardized on-chip support and broader automotive deployment.

This edited handbook provides a broad engineering reference on automotive embedded systems, linking vehicle functions to electronic architectures, software platforms and communication networks. Its chapters cover development processes, real-time design, dependability, diagnostics and major in-vehicle protocols, combining research foundations with industrial practice. The volume is intended to help engineers understand the constraints and multidisciplinary trade-offs behind increasingly software-intensive, safety-critical vehicles.

This handbook chapter reviews the communication protocols used among automotive electronic control units and relates them to the needs of different vehicle domains. It explains the characteristics and trade-offs of technologies including LIN, CAN, FlexRay, MOST and time-triggered networks, covering access methods, timing behavior, bandwidth, fault tolerance and cost. The survey also shows why heterogeneous networks and gateways are necessary in production vehicles.

Configuring FlexRay requires coordinating time-triggered and event-triggered traffic, task timing, protocol parameters, extensibility and fault tolerance across an enormous search space. This presentation decomposes the problem into tractable scheduling and verification steps supported by NETCAR-FlexConf. Experiments show robust behavior as load increases and suggest that 2.5-Mbit/s FlexRay can carry far more useful data than one or two optimized 500-kbit/s CAN networks.

Deliberately offsetting periodic CAN message releases spreads traffic over time and sharply improves worst-case response times. The chapter proposes a low-complexity offset-selection algorithm and evaluates it on representative body and chassis networks, showing substantial, robust performance gains. This traffic-shaping strategy can extend CAN’s useful lifetime and defer additional buses or FlexRay, while limited inter-node synchronization may offer further benefits at the cost of greater implementation complexity.

The paper addresses FlexRay static-segment configuration when signal-producing tasks are asynchronous to the communication cycle, as with reused legacy software. It supplies simple rejection tests and an exact analysis for signal-freshness constraints, then introduces a Best Slot First scheduling heuristic. Experiments show high feasibility and efficient slot use, especially when deadlines equal periods, providing a practical basis for reducing bandwidth while preserving extensibility and dependability.

  • 2000-2007

NETCARBENCH is an open benchmark for evaluating and comparing algorithms and tools used to design automotive communication networks. XML files let users finely control message-set properties and their variability, while generated outputs interoperate with other software. Experiments show close agreement with requested characteristics, and supplied body and chassis profiles support reproducible studies of schedulability, bandwidth optimization and future higher-load or larger-message network technologies.

Packing many small automotive signals into frames must minimize bandwidth without violating timing constraints, an NP-hard joint optimization problem. This paper develops heuristics that outperform earlier methods in both bandwidth use and the ability to find schedulable frame sets. Its BDFF algorithm also provides a strong starting point for genetic or local search, while more dynamic packing could save additional bandwidth when schedule-storage requirements remain manageable.

This paper determines how redundant message replicas should be placed in a TDMA schedule to withstand bursty random faults. Convexity arguments show that spreading replicas over time minimizes the probability of losing every copy, whereas majorization proves that grouping replicas minimizes the probability of losing any copy. The authors adapt both optimal policies to TTP/C, making the schedule reflect the application’s precise fault-tolerance objective.

A Markov analysis reveals that CAN’s standard fault-confinement counters can push healthy nodes into error-passive or bus-off states too readily under bursty electromagnetic interference. The proposed mechanisms weight state progression by the information conveyed through recent successful and failed transmissions. Experiments greatly extend healthy-node bus-off times without delaying isolation of truly faulty nodes, and the paper discusses practical implementation and offline or adaptive parameter tuning.

  • N. Navet, Y.-Q. Song, F. Simonot-Lion, C. Wilwert, “Trends in Automotive Communication Systems”, Proceedings of the IEEE, special issue on Industrial Communications Systems, invited paper, vol 96, n°6, pp1204-1223, June 2005.

This invited survey relates in-vehicle network design to the distinct timing, cost, bandwidth and dependability needs of vehicle domains. It reviews established and emerging protocols including LIN, J1850, CAN, TTP/C, FlexRay, MOST and IDB-1394, then discusses middleware for managing heterogeneous systems. The outlook highlights continuing growth in distributed functions, safety requirements and software integration as drivers of new communication architectures and engineering methods.

  • C. Wilwert (PSA), N. Navet, Y.-Q. Song, F. Simonot-Lion, “Design of Automotive X-by-Wire Systems”, in The Industrial Communication Technology Handbook, CRC Press, ISBN 0-8493-3077-7, January 2005.

Replacing mechanical steering or braking links with electronics imposes stringent real-time and dependability requirements. This chapter reviews the necessary fault-tolerant services and compares TTP/C, FlexRay and TTCAN for X-by-Wire communication. A steer-by-wire case study demonstrates redundant architecture design, transmission scheduling and probabilistic verification of deadline failures, illustrating how engineers can assess whether a candidate system satisfies demanding safety-integrity objectives.

The paper proposes an integrated configuration method for automotive nodes, middleware and network frames under task deadlines and signal-freshness constraints. It first packs signals into a feasible, bandwidth-efficient frame set, then configures middleware tasks and searches for schedulable application-task priorities. By combining established fixed-priority analyses and Audsley assignment in one workflow, the approach supports automated generation of validated OSEK configurations rather than isolated local optimizations.

To account for potentially dangerous CAN transmission errors, this paper introduces worst-case deadline failure probability. For each message it first computes the maximum number of errors compatible with its timing constraint, then combines that threshold with a generalized Poisson model representing both error frequency and severity. A numerically efficient algorithm evaluates the resulting probabilities and is demonstrated on an industrial automotive case study.

Real-Time Systems / Formal Methods

Publications on real-time schedulling, formal verification, and performance evaluation.

  • L. Shan, S. Graf, S. Quinton, L. Fejoz, “A Framework for Evaluating Schedulability Analysis Tools”, in “Models, Algorithms, Logics and Tools”, pp539-559, Springer, 2018. Pre-print version available as Research Report.

Low-Power Scheduling

Research on schedulling techniques for energy-efficient real-time systems.