Professional Documents
Culture Documents
MM/T/HMI ECU
V1.0.0
Document Title
Demonstration of Integration of
AUTOSAR into a MM/T/HMI
ECU
Document Owner
Document Responsibility
Document Identification No
Document Classification
AUTOSAR
AUTOSAR
422
Informal
Document Version
Document Status
1.0.0
Final
1 of 37
Version Changed by
1.0.0 AUTOSAR
Administration
Change Description
Initial Release
- AUTOSAR confidential -
2 of 37
- AUTOSAR confidential -
Table of Contents
1
Document Scope.......................................................................................... 5
Motivation..................................................................................................... 5
MM/T/HMI ECU Definition ............................................................................ 6
Related documentation........................................................................................ 8
3.1
Input documents........................................................................................... 8
3 of 37
- AUTOSAR confidential -
4 of 37
- AUTOSAR confidential -
1.2 Motivation
Todays architecture specified by AUTOSAR is not intended to support the needs of
large MM/T/HMI ECUs. It provides drivers for automotive specific technologies and
services needed by automotive applications. Services needed by MM/T/HMI
applications are not part of the AUTOSAR architecture.
MM/T/HMI applications are therefore often build on general-purpose operating
systems like WinCE, Linux or QNX. These operating systems already provide various
drivers and services needed for building multimedia applications. The drawback of
using general-purpose operating systems is that they lack automotive specific
services. For building a MM/T/HMI ECU both, MM/T/HMI services and automotive
services, are needed. Therefore, the missing automotive services have to be
implemented for the general-purpose operating system in question. At this point, it
would be desirable if existing AUTOSAR implementations of the automotive services
could be used. An obvious advantage would be that no time has to be spent on
implementing the services. Another advantage is that these implementations are
already used in various other ECUs and therefore have been tested extensively.
Using implementations of AUTOSAR communication services in MM/T/HMI ECUs
would also decrease the effort required for integrating the ECUs with the rest of the
5 of 37
- AUTOSAR confidential -
Support for Multi-Threading for executing more than one task at a time
A priority based scheduling algorithm (including priority-ceiling) for scheduling
threads
A high-resolution timer for fine-grained periodic scheduling
A memory protection mechanism which allows for threads to run in a protected
area (processes)
The general-purpose OSs used also support dynamic creation and configuration of
resources during runtime, virtual memory and other concepts not implemented by the
AUTOSAR architecture.
AUTOSAR modules are designed to run within the AUTOSAR architecture. They
assume the presence of certain services provided by AUTOSAR BSWMs. A
MM/T/HMI ECU might not provide these required services or they are provided via a
non-AUTOSAR interface by the installed drivers and service modules.
6 of 37
- AUTOSAR confidential -
Description:
BSD
BSWM
CRC
CE
DCM
DEM
ECU
IPC
I-PDU
IOC
MM/T/HMI
MCAL
NvRAM
OS
PDU
RTE
SWC
7 of 37
- AUTOSAR confidential -
3 Related documentation
3.1 Input documents
[1] Layered Software Architecture
AUTOSAR_EXP_LayeredSoftwareArchitecture.pdf
[2] Specification of PDU Router
AUTOSAR_SWS_PDURouter.pdf
[3] Specification of Operating System
AUTOSAR_SWS_OS.pdf
[4] Specification of Diagnostic Communication Manager
AUTOSAR_SWS_DiagnosticCommunicationManager.pdf
[5] Specification of Diagnostic Event Manager
AUTOSAR_SWS_DiagnosticEventManager.pdf
[6] Specification of RTE
AUTOSAR_SWS_RTE.pdf
[7] Specification of Communication Manager
AUTOSAR_SWS_COMManager.pdf
[8] Specification of ECU State Manager
AUTOSAR_SWS_ECUStateManager.pdf
[9] Specification of NvRAM Manager
AUTOSAR_SWS_NVRAMManager.pdf
[10] Specification of Socket Adaptor
AUTOSAR_SWS_SocketAdaptor.pdf
[11] Basic Software Module Description Template
AUTOSAR_TPS_BSWModuleDescriptionTemplate.pdf
8 of 37
- AUTOSAR confidential -
4 Integration Approaches
Integrating a BSWM or SWC into a MM/T/HMI ECU means that the implementation
(e.g. C code) of a complete BSWM or SWC is run on that MM/T/HMI ECU. SWCs
and BSWMs are designed to run within the AUTOSAR architecture. They expect that
other BSWMs, which they depend on, are present and their functions accessible. In
order to integrate a BSWM or SWC into a MM/T/HMI ECU, the ECUs basic software
has to make the BSWMs and SWCs believe that they are running in an AUTOSAR
architecture. Missing but required functions have to be emulated by BSWM
emulators. To emulate a BSWM means implementing a software module for the
MM/T/HMI ECU, providing a complete or just a subset of the BSWMs interfaces.
BSWM emulators provide the missing functions required by the integrated SWCs and
BSWMs. Functions not required by any of the integrated SWCs and BSWMs can be
omitted. The required functions are provided in exactly the way specified in the
according AUTOSAR specifications but are realized with the means provided by the
underlying general-purpose operating system (WinCE/Linux/QNX). Emulators are the
bridge between the AUTOSAR architecture and the services provided by the
MM/T/HMI ECUs basic software.
The following sections discuss different emulation strategies for integrating SWCs
and BSWMs.
- AUTOSAR confidential -
- AUTOSAR confidential -
The AUTOSAR OS emulator has to provide the RTE with functions like
ActivateTask() and SetRelAlarm() which the RTE requires for scheduling the
BSWMs and SWCs. When the RTE calls these functions, the AUTOSAR OS
emulator has to react accordingly. It has to create, trigger or suspend threads and
timers using the services provided by the MM/T/HMI ECUs general-purpose OS.
As mentioned above SWCs only depend directly on the RTE, but most SWCs
depend indirectly on BSWMs. Depending indirectly means that they require some
services of the BSWMs, which they access via the interface provided by the RTE
instead of calling the service directly via the BSWMs interface.
Thus, only SWCs, which do not depend on any BSWM, can be fully integrated by this
approach. Section 4.1.3 describes how to handle the integration of SWCs, which
depend on BSWMs.
11 of 37
- AUTOSAR confidential -
Since AUTOSAR release 4.0 the AUTOSAR architecture provides a BSWM for
sending and receiving I-PDUs over sockets the so called SocketAdaptor.
The SocketAdaptor is based on the BSD socket standard. Therefore, if the
MM/T/HMI ECUs IPC system is socket based and the MM/T/HMI ECUs basic
software provides a BSD Socket Programmierschnittstelle AUTOSARs
SocketAdaptor can be used for communicating with MM/T/HMI applications in other
processes. As Figure 4-3 illustrates this approach requires that also the AUTOSAR
COM and the PDU Router BSWMs are integrated into the MM/T/HMI ECU.
In order to configure the RTE correctly the following modelling steps are required:
12 of 37
An ECU with all the SWCs to integrate is created. The ECU represents the
AUTOSAR process.
Document ID 422: AUTOSAR_TR_IntegrationintoMMTHMIECU
- AUTOSAR confidential -
The configuration of the PDU Router and the SocketAdaptor are out of the scope of
this document. For further details on how to configure these BSWMs see the
Specification of PDU Router [2] and the Specification of Socket Adaptor [10].
Since release 4.0 AUTOSAR also supports the concept of partitioning software into
separated, protected execution areas. Within AUTOSAR these areas are called OS
Applications. The AUTOSAR OS provides a mechanism for transferring data from
one OS-Application to another one. This mechanism is called Inter OS-Application
Communication (IOC). RTE implementations from release 4.0 upwards can be
configured to use the Inter OS-Application Communication mechanism for routing
data between two SWCs residing in different OS-Applications.
This feature can be used for realizing the communication between SWCs and
MM/T/HMI applications. Instead of modeling the AUTOSAR process and the
MM/T/HMI processes as separate ECUs they are modeled as OS-Applications. The
RTE generated for the AUTOSAR process, will then call the AUTOSAR OS services
IOC_send_XXX and IOC_receive_XXX instead of calling the AUTOSAR COM. For
integrating the RTE an AUTOSAR OS emulator is required, which will provide the
two IOC services and map those to corresponding IPC calls (e.g. write/read to/from
shared memory).
13 of 37
- AUTOSAR confidential -
In order to configure the RTE correctly the following modelling steps are required:
An OS-Application with all the SWCs to integrate is created. The OSApplication represents the AUTOSAR process.
An OS-Application is created for each MM/T/HMI process containing
MM/T/HMI applications, which communicate with the SWCs in the AUTOSAR
process.
A SWC is created for each MM/T/HMI application communicating with the
SWCs in the AUTOSAR process. The SWCs provide and require port
interfaces, which correspond to their MM/T/HMI applications native interface.
A corresponding port interface could be a client/server interface with
Operations, which correspond to the C-functions the MM/T/HMI application
provides. Finding such a corresponding port interface might not be possible in
any case.
Until release 3.1 of AUTOSAR no concept for separated, protected execution areas
was supported. Mapping AUTOSARs inter partition communication mechanism to
the concrete IPC provided by the MM/T/HMI ECUs basic software is not possible.
Thus, when working with a RTE implementation based on AUTOSAR release 3.1 or
earlier a different approach is required.
By providing a module in the RTEs process, which proxies the MM/T/HMI
applications located outside of the process, the RTEs job can be reduced to intra
process communication. The RTE only has to forward data from the SWCs to the
proxy and vice versa. The proxy realizes the access to the MM/T/HMI ECUs IPC
system. It translates dispatches and routes data from and to the actual MM/T/HMI
14 of 37
- AUTOSAR confidential -
An ECU with all the SWCs to integrate is created. The ECU represents the
AUTOSAR process.
An extra SWC for the proxy has to be added to the ECU representing the
AUTOSAR process. The SWC provides and requires port interfaces, which
correspond to the MM/T/HMI applications native interface. A corresponding
port interface could be a client/server interface with Operations, which
correspond to the C-functions the MM/T/HMI application provides. Finding
such a corresponding port interface might not be possible in any case.
- AUTOSAR confidential -
If the RTE and the communication stack reside in the same process and the physical
communication medium is supported by AUTOSAR the MCAL emulation approach
can be used (see 4.2.2). The AUTOSAR communication stack can be integrated
enabling the RTE access to the communicate medium.
If the RTE and the communication stack reside in the same process but the
communication medium is not supported by AUTOSAR a similar approach as in
4.1.2.1.3 is required.
A module for accessing the communication stack is required, which acts as a proxy
for all remote communication partners of the SWCs serviced by the RTE. It provides
the ports of the communication partners to the SWCs. This way the communication
between the SWCs and their remote communication partners appears to the RTE
like intra ECU communication between the SWCs and the proxy. The proxy does the
actual work of translating, dispatching and routing the messages. The evaluation of
update-bits also has to be realized in the proxy unless it is already realized by the
gateway (see Figure 4-6).
16 of 37
- AUTOSAR confidential -
RTE_E_COM_STOPPED
RTE_E_MAX_AGE_EXCEEDED
RTE_E_TRANSMIT_ACK
RTE_E_LOST_DATA
Will not be returned if the data loss is based on communication errors.
RTE_E_TIMEOUT
Will not be returned if the client and server are in the same Task (only returned
for Inter Task communication).
If the implementation of a SWC depends on any of the above listed error values a
COM module emulation is required which will provide these errors.
- AUTOSAR confidential -
The behavior of the RTE is slightly changed by this approach (see 4.1.2.2.2).
- AUTOSAR confidential -
19 of 37
- AUTOSAR confidential -
Emulating a BSWM makes sense only if very few and simple functions are required
from it. Otherwise integrating that BSWM, too, is the better solution.
Unfortunately, integrating a BSWM is not always possible. Adjustments and
extensions to the BSWM might be needed due to the services provided by the
MM/T/HMI ECUs software srchitecture. In such a case the BSWM has to be
emulated. An example would be the usage of the ComManager on a MM/T/HMI
ECU, which uses the MOST bus-system for communication. The AUTOSAR
ComManager does not support MOST. Therefore, integrating an existing
implementation of the ComManager will not work on this specific MM/T/HMI ECU. A
ComManager emulator is required, which will take the status of the MOST bussystem into account.
20 of 37
- AUTOSAR confidential -
21 of 37
- AUTOSAR confidential -
22 of 37
- AUTOSAR confidential -
Communication Process
This process runs the communication stack of the ECU providing access to
the physical medium via which the ECU is connected to the rest of the vehicle.
The physical medium shall not be specified in more detail. It could be CAN,
Flexray, MOST, Firewire or any other physical medium.
CE Infrastructure Process
Consumer electronic specific services, which are required for implementing
MM/T/HMI applications are provided by this process.
The processes communicate with each other using inter process communication. It is
assumed that some inter process communication other than BSD sockets is provided
by the MM/T/HMI ECUs basic software. This could be shared memory or some other
mechanism provided by the OS.
- AUTOSAR confidential -
Figure 5-2: Architecture of the AUTOSAR Process for the DCM & DEM Integration
This is a very simple approach, which has some advantages making the integration
easier. One advantage of keeping all the AUTOSAR software in one process is that
unnecessary, time consuming process changes are avoided. Some of the BSWMs
highly depend on each other meaning that they call each others services very
frequently. Spreading the BSWMs across many processes would lead to numerous
process switches.
BSWMs are designed to call functions of other BSWMs directly not via the RTE. This
is of course only possible if the BSWMs reside in the same process. If they would be
scattered across various processes the function calls between the BSWMs would
have to be mapped to inter process communication calls. Therefore, an additional
emulator is required. By keeping the BSWMs together in one process the
implementation of additional emulation code can be avoided.
Keeping the AUTOSAR software separated from the CE services also makes the
integration easier. Integrating the BSWMs into an existing process with numerous
other CE services is far more complicated than simply adding an extra process
(AUTOSAR Process) to the system.
24 of 37
- AUTOSAR confidential -
Besides the dependencies to the emulated interfaces the DCM also has a
dependency to functions provided by the DEM as shown in Figure 5-3.
- AUTOSAR confidential -
The ECU State Manager emulator is the entry point for the AUTOSAR process. It
contains the process main() function which will be called by the MM/T/HMI OS
when starting the process. The main() function will call the initialization functions of
the BSWMs integrated in the AUTOSAR process. This behavior corresponds to the
behavior of the EcuM_Init() function specified in the Specification of ECU State
Manager document [8].
The ECU State Manager emulator does not have to support mode ports, as the DCM
does not use this feature.
Listing 5-2).
- AUTOSAR confidential -
The ComManager emulator has to provide these two functions and forward the
request for full communication to the communication management component of the
MM/T/HMI ECUs basic software. The ComManager emulator also has to forward the
notification to the RTE emulator for activating and deactivating the scheduling of the
DCMs main function. For more details on this issue, please see 5.3.1.8.
/**
* Ask DCM if ready for reception
*/
BufReq_ReturnType Dcm_StartOfReception(PduIdType,
27 of 37
- AUTOSAR confidential -
/**
* Notify DCM about completion of reception process
*/
void Dcm_RxIndication(PduIdType, NotifResultType)
/**
* DCM requests the cancelation of the current reception
*/
void PduR_CancelReceiveRequest (PduR_CancelReasonType, PduIdType)
After processing a diagnostic message, the DCM will ask the PDU Router to transmit
the corresponding response. The PDU Router emulator then has to retrieve the data
to transmit from the DCM, which provides a callback for that reason. Just as for the
reception, the DCM will expect to be informed by the PDU Router emulator as soon
as the response has been transmitted. As for the reception process the DCM
requires a cancelation function, which the PDU Router emulator has to implement.
The listing below lists all the functions the PDU Router emulator has to implement in
order to satisfy the transmission interface between the DCM and the PDU Router.
/**
* Ask the PDU Router to transmit a diagnostic response
*/
Std_ReturnType PduR_DcmTransmit(PduIdType, const PduInfoType*)
/**
* Copy data to transmit from the DCM to the PDU Router
28 of 37
- AUTOSAR confidential -
The PDU Router emulator is directly connected to the IPC system and listens for
incoming diagnostic messages. Depending on the IPC mechanism used, the PDU
Router emulator needs to explicitly register for the diagnostic messages or filter them
out. On reception of a diagnostic message, it needs to convert the diagnostic
message from the IPC format into the format expected by the DCM. When asked to
transmit a message for the DCM it would need to convert the diagnostic message to
the corresponding IPC format and pass it to the Communication Process via the IPC
mechanism.
Listing 5-6.
/**
* For reading a signal
*/
IoHwAb_Dcm_Read<EcuSignalName>()
/**
29 of 37
- AUTOSAR confidential -
The I/O Hardware Abstraction emulator has to map calls to these functions to system
calls, which the MM/T/HMI ECUs basic software provides for accessing the
corresponding signals of the sensors and actuators.
/**
* Request for resetting the ECU
*/
BswM_Dcm_RequestResetMode(Dcm_ResetModeType)
- AUTOSAR confidential -
/**
* Indicates that the mode <ModeName> has been entered.
*/
Dcm_<ModeName>ModeEntry()
/**
* For reading non-volatile data
* (ReadDataByIdentifier)
*/
Std_ReturnType NvM_ReadBlock(NvM_BlockIdType, uint8*)
/**
* Locking non-volatile data for exclusive access
* (WriteDataByIdentifier)
31 of 37
- AUTOSAR confidential -
The operating systems used in MM/T/HMI ECUs usually provide a file system.
Persistent data is accessed based on files. The NvRAM Manager emulator needs to
convert block identifiers to files. It could create a file for each block setting the file
name to the block identifier. Another possibility could be to create one file and store
the data together with the block identifier as a key in that one file.
The NVRam Manager is not simply an abstract interface to accessing non-volatile
memory. It provides a rich set of mechanisms for ensuring data storage and
maintenance of non-volatile data. Among these mechanisms, there are redundant
data storage, CRC checksums, error recovery and others. Depending on the
requirements towards the system, the NVRam Manager emulator will have to
implement these mechanisms, too. If a significant number of the NVRam Managers
mechanisms are required, an integration of the NVRam Manager might be a better,
less expensive solution.
32 of 37
- AUTOSAR confidential -
Sending
data
records
periodically
ReadDataByPeriodicIdentifier request
Sending diagnostic responses on event
as
response
to
In order to keep the jitter for the timeouts low the period for triggering the
Dcm_MainFunction() function is usually rather small (e.g. 10ms). In this example
the AUTOSAR components run in a separate process (see 5.2), which implies that a
small period for the Dcm_MainFunction() function would result in a high frequency
of process switches between the application process and the AUTOSAR process. It
is recommended to avoid unnecessary process switches, as they are rather
expensive.
Most of the time the Dcm_MainFunction() does not have to be triggered
periodically. The DCM only requires periodic triggering when processing a diagnostic
request, a non-default diagnostic session is active or responses have to be send
periodically or on event. This can be realized by using the notification calls
(ComM_DCM_ActiveDiagnostic()
& ComM_DCM_InactiveDiagnostic())
from the DCM to the ComManager emulator as triggers for starting and suspending
the DCM thread. Therefore, it is required that the ComManager emulator will forward
the notification calls to the RTE emulator (see 5.3.1.3) which is responsible for
scheduling the DCM.
This approach of using the notification functions as scheduling triggers will not work
for the ResponseOnEvent if it is resumed. This means ResponseOnEvent is
activated by settings loaded on ECU startup. In this case the DCM will not notify the
ComManager. If this functionality is being used the DCM will have to be triggered
periodically all the time.
The DCM does not handle all diagnostic requests. Some diagnostic requests, like the
UDS request StartRoutineByIdentifier, have to be handled by the Applications. In a
full-fledged AUTOSAR architecture, the DCM passes these requests to the RTE,
which routes them to the SWCs. In this integration example there are no SWCs. The
diagnostic routines are provided by the applications, which reside in another process
(see Figure 5-2). Thus, the job of the RTE emulator is to forward the applicationspecific diagnostic requests to the applications via the MM/T/HMI ECUs IPC.
5.3.2 DEM Integration
The DEM provides a service for handling errors. SWCs and BSWMs can pass errors
to the DEM. It will persistently store those errors in a standardized format.
Two emulators are needed to integrate the DEM into a MM/T/HMI ECU. The first
emulator needed is the ECU State Manager emulator, which has to call the DEMs
lifecycle functions. It initializes the DEM and shuts it down. The second emulator is
the NvRAM Manager emulator. It has to provide functions to the DEM for storing
errors in a persistent manner.
Figure 5-4 shows a more detailed view on the architecture of the AUTOSAR Process.
The interfaces between the DEM and the other components are depicted.
33 of 37
- AUTOSAR confidential -
- AUTOSAR confidential -
void Dem_PreInit()
void Dem_Init()
void Dem_Shutdown()
The ECU State Manager emulator contains the main() function of the process
which will call the DEM initialization functions (see 5.3.1.2).
The DEM expects to be initialized in a two-phased way. After the Dem_PreInit()
function is called the DEM will enter the first of two initialization phases. From this
time on the DEM will accept event notifications from SWCs and BSWMs. The events
received during phase I will not be stored in a persistent manner. The DEM will do so
after entering initialization phase II. The Dem_Init() function is to be called as soon
as the NvRAM Manager has finished initializing and access to the persistent memory
of the ECU is available.
This two-phased approach to initialize the DEM has been specified in order to track
errors, which occur before the persistent memory access of the ECU has been
initialized. Within a MM/T/HMI ECU, the DEM is not an integral part of the operating
system. It is started as part of the AUTOSAR process. This process is started after
the services of the operating system, which include the file system (persistent
memory access). Therefore, there is no need for starting the DEM in two steps. The
ECU State Manager emulator can simply call the Dem_PreInit() and the
Dem_Init() functions consecutively as soon as the AUTOSAR Process is started.
The ECU State Manager emulator does not have to support mode ports, as the DEM
does not use this feature.
Listing 5-11 are required by the DEM for storing and loading error entries.
35 of 37
- AUTOSAR confidential -
- AUTOSAR confidential -
37 of 37
- AUTOSAR confidential -