Design and Evaluation of Ethernet-based E/E-Architectures for Latency- and Safety-critical Applications Entwurf und Evaluierung Ethernet-basierter E/E-Architekturen für latenz- und sicherheitskritische Anwendungen Der Technischen Fakultät der Friedrich-Alexander-Universität Erlangen-Nürnberg zur Erlangung des Doktorgrades Dr.-Ing. vorgelegt von Fedor Smirnov aus Udomlja Als Dissertation genehmigt von der Technischen Fakultät der Friedrich-Alexander-Universität Erlangen-Nürnberg Tag der mündlichen Prüfung: 27.09.19 Vorsitzender des Promotionsorgans: Prof. Dr.-Ing. Reinhard Lerch Gutachter: Prof. Dr.-Ing. Jürgen Teich Prof. Dr.-Ing. Michael Glaß Prof. Dr. phil. nat. Sebastian Steinhorst Abstract In recent years, there has been a tremendous number of innovations in car electronics. New infotainment and driver assistance features introduce an ever increasing amount of data that has to be transmitted via the in-car communication network. With its huge bandwidth advantage over other communication protocols, Ethernet offers an interesting opportunity to meet the increasing bandwidth and latency requirements of modern car communication networks and is generally seen as the most promising solution for future automotive systems. The strict real-time and reliability require- ments of modern Advanced Driver Assistance Systems (ADAS) may be addressed by protocol extensions like Ethernet Time-Sensitive Networking (TSN) which offer new mechanisms like time-triggered traffic or seamlessly redundant message transmission. The complexity of automotive communication networks, regarding both the size of the networks and the number of configuration parameters like the sending period or the priority of messages, will certainly further increase in the future and necessitates design automation already today. Yet, existing approaches for automated network design cannot be applied to the design of automotive Ethernet (TSN) networks, as they do not account for their special features such as the introduction of transmission schedules, virtually isolated subnetworks, redundant transmissions, and, in particular, Ethernet’s lack of real-time and reliability guarantees. In this context, this thesis, for the first time, presents a system-level design ap- proach for automotive Ethernet networks where the multi-dimensional solution search space created by the many—oftentimes non-linear and possibly conflicting—design objectives from the automotive domain is explored within a Design Space Exploration (DSE) to find not one, but multiple high-quality designs. This approach enables an automated design and evaluation of Ethernet-based electric/electronic (E/E) archi- tectures, in particular for latency- and safety-critical applications, and is based on contributions from the areas of formal analysis, constraint-based restriction of the search space, and the injection of problem-specific knowledge into the optimization. During network design, the evaluation of design decisions plays an important role, especially for the timing and the reliability of message transmissions within the network. Existing approaches for timing analysis provide safe timing guarantees for strict-priority Ethernet networks, but are not applicable for networks with TSN-specific iii features like time-triggered traffic or transmission preemption. To cope with these novel network features, this thesis extends existing timing analysis approaches, so that the timing of the scheduled traffic and, in particular, the interference imposed on unscheduled traffic are considered. The timing analysis is, moreover, complemented by preprocessing techniques that significantly reduce the time required for the analysis of each network design. While a lot of work can be found on the formal analysis of permanent hardware errors and their impact on the system reliability, the influence of transient errors has, so far, attracted less attention from the scientific community. This thesis provides a contribution in this area by proposing a formal analysis approach for the analysis of transient errors which is specifically tailored to the error-detection mechanism used in automotive networks. The proposed approach combines timing and reliability analysis and demonstrates that temporal redundancy can be used as an effective means to improve transmission reliability. Especially for problems like the optimization of automotive networks, where the search space is huge and the evaluation of a single solution can take considerable amounts of time, excluding infeasible solutions from the evaluation space has been shown to significantly accelerate the optimization process. Based on SAT-Decoding, an existing approach for hybrid optimization of constrained problems, this work contributes constraint systems that formally describe Ethernet networks with overlap- free transmission schedules, message routes that are created with respect to a given Virtual Local Area Network (VLAN) partitioning, and a redundant routing without communication loops, respectively. These constraint sets enable an automatic creation of network designs which are valid with respect to application-specific requirements, which makes a design optimization of these networks at all possible. Over the years, a great pool of experience has been built by design and analysis experts. With the third area of contributions, this work proposes novel means of making parts of this problem-specific knowledge accessible to the optimizer. The thesis contributes Artificial Gene Design (AGD), a novel approach that extends SAT- Decoding and enables the optimizer to directly adjust problem characteristics with a high relevance for the design objectives. The application of AGD is demonstrated using the optimization of redundant routings with respect to the transmission reliability as an example. Furthermore, this thesis shows how topology-specific knowledge can be considered during the formulation of routing constraints to significantly reduce the number of encoding variables, resulting in a smaller search space and a faster convergence towards the (Pareto-)optimal solutions. iv Acknowledgments I would like to express my sincere gratitude to Prof. Dr.-Ing. Jürgen Teich for his constant support, his trust, his encouragement to pursue my research interests, and for providing an excellent research environment. I also want to thank Prof. Dr. phil. nat. Sebastian Steinhorst for agreeing to be the co-examiner of this work and to Prof. Dr.-Ing. Felix Freiling and Prof. Dr.-Ing. Sebastian Sattler for being part of the exam committee. I am grateful to all my colleagues at the Chair for Hardware/Software Co-Design for the great ambiance, help, and intriguing discussions. A large part of this thesis has resulted from a doctoral research project in cooperation with the AUDI corporation within its INI.FAU initiative. I am very grateful to the AUDI corporation for the opportunity to work on an industry-relevant research topic and to participate in the research activities of a large corporation. In particular, I would like to thank Felix Reimann for his support, the challenging discussions, and the opportunity to contribute research ideas of my own. Last but not least, I would like to thank Michael Glaß, whose support, advice, and criticism, both during his time as the group leader of the SDA group and after his move to the University of Ulm, were of great importance for this dissertation and for me personally. v Contents 1 Introduction1 1.1 Ethernet in Automotive . .2 1.2 The Challenge of Design Complexity . .2 1.3 Contributions and Scope . .3 1.3.1 Timing and Reliability Analysis of Ethernet TSN Networks3 1.3.2 Constraining the Design Space . .5 1.3.3 Efficient Design Space Exploration . .6 2 Fundamentals9 2.1 Ethernet Technology . .9 2.1.1 Origins and Characteristics . .9 2.1.2 Switched Strict-Priority Ethernet in Automotive . 11 2.1.3 Ethernet TSN . 14 2.2 Multi-Objective Optimization of Embedded Systems . 19 2.2.1 System Model . 20 2.2.2 SAT-Decoding . 26 2.2.3 Synthesis Constraints . 28 2.2.4 Multi-Objective Optimization . 31 3 Formal Timing and Reliability Analysis of Ethernet TSN Networks 35 3.1 Timing Analysis of Mixed-Criticality TSN Networks . 36 3.1.1 Timing Analysis using the Busy-Period Approach . 38 3.1.2 Timing Analysis of Scheduled TSN Networks . 45 3.1.3 Experimental Results . 49 3.1.4 Related Work . 52 3.2 Reliability Analysis of Ethernet Networks under Transient Transmis- sion Errors . 53 3.2.1 Reliability Model . 55 3.2.2 Reliability Calculation . 56 3.2.3 Reliability/Timing Correlation . 60 3.2.4 Experimental Results . 66 vii Contents 3.2.5 Related Work . 67 3.3 Conclusion . 68 4 Constraints Characterizing Valid Message Routings and Schedules for Ethernet TSN Networks 71 4.1 Joint Constraint Generation for Routing and Scheduling . 73 4.1.1 System Model . 74 4.1.2 Constraint Formulation . 74 4.1.3 Experimental Results . 79 4.1.4 Related Work . 85 4.2 Constraints for a Message Routing Respecting the VLAN Partitioning 85 4.2.1 System Model . 87 4.2.2 Routing Constraints . 88 4.2.3 Experimental Results . 100 4.2.4 Related Work . 107 4.3 Constraints for Redundant Message Routing . 109 4.3.1 Introduction . 109 4.3.2 The Link Encoding Approach . 110 4.3.3 The Preprocessing Approach . 111 4.3.4 Related work . 113 4.4 Conclusions . 114 5 Injection of Objective- and Topology-Specific Knowledge for a Faster Optimization Convergence and a Higher Result Quality 115 5.1 Artificial Gene Design . 116 5.1.1 Introduction . 116 5.1.2 Formal Reliability Analysis of Ethernet Networks