DATA CONSISTENCY TEST TOWARDS SYSTEMATIC REQUIREMENTS ELICITATION IN AUTOMOTIVE MULTI-CORE APPLICATIONS ERTS 2020 Toulouse, 30.01.2020 Ralph Mader Vitesco Technologies GmbH Wolfgang Pree University of Salzburg and Chrona.com Public
DATA CONSISTENCY TEST – TOWARDS SYSTEMATIC REQUIREMENTS ELICITATION 1 MULTI CORE SOFTWARE FOR POWERTRAIN 2 WHAT IS DATA CONSISTENCY 3 IDENTIFICATION OF CONSISTENCY REQUIREMENTS 4 SUMMARY AND OUTLOOK 2
MULTI-CORE SOFTWARE FOR POWERTRAIN WHERE IS MULTI-CORE IN USE? Domain Controller Combustion Engine Transmission Control HV Inverter DC/DC Converter 3
MULTI-CORE SOFTWARE FOR POWERTRAIN PROJECT VERSUS PLATFORM DEVELOPMENT Platform of re-usable elements Core independent Function A Function E Function I Function M Function B Function F Function J Function N Function C Function G Function K Function O Function D Function H Function L Function P Project A – 2 Core Project N – 3 Core Project B – 4 Core Micro Controller Micro Controller Micro Controller … Function A Function E Function B Function A Function E Function G Function E Function I Function B Function F Function H Function K Function C Function I Function K Function J Function D Function J Function K Function N Function O Function C Function F Function H > Platform solution must be independent from core partitioning in project 4
MULTI-CORE SOFTWARE FOR POWERTRAIN TYPES OF SOFTWARE USED Legacy Engine Vitesco Technologies OEM OEM Vitesco Technologies IF’s ASW - Non AUTOSAR ASW - Non AUTOSAR Drivers ASW - AUTOSAR 4.3.1 ASW - AUTOSAR 4.3.1 (CDD) Multi Core PDA Layer RTE Legacy IF PowerSAR CDD‘s Communication IO HW abstraction System Services Memory Stack Stack OS Microcontroller Abstraction - Drivers Multicore Microcontroller > Multi Core Layer is generated based on data protection needs in project 5
DATA CONSISTENC TEST – TOWARDS SYSTEMATIC REQUIREMENTS ELICITATION 1 MULTI CORE SOFTWARE FOR POWERTRAIN 2 WHAT IS DATA CONSISTENCY 3 IDENTIFICATION OF CONSISTENCY REQUIREMENTS 4 SUMMARY AND OUTLOOK 6
WHAT IS DATA CONSISTENCY? DATA CONSISTENCY = DATA STABILITY & DATA COHERENCY Coherency Stability > For proper functional behavior, both stability and coherency have to be ensured 7
MEANS TO ENSURE DATA CONSISTENCY BUFFERING OR LOGICAL EXECUTION TIME (LET) > Below you find two means how to ensure data consistency in Multi-Core Systems Buffering of Data Logical Execution Time (LET) LET 01 LET 01 LET 02 LET 02 Task individual buffer time Rc Task 2 Core 0 R 1 R 2 R 2 R 2 R 3 R 3 R 3 Task R 4 R 4 R 5 R 5 R N R N Global Data RAM Task Fill buffer LET 01 LET 02 Flush buffer Global Data RAM Rp time Task 1 Core 1 > Ensuring data consistency generates overhead 8
DATA CONSISTENCY WITH MINIMAL OVERHEAD SHORTCOMINGS OF REQUIREMENTS ELICITATION Status Quo Consequences > Functions are designed mostly by mechanical > Missing Requirements engineers could generate sporadic functional issues (sleeping issues) > Design object reviews are used today for identifying consistency requirements > Non-maintained Requirements could lead to miss data protection > Quality of requirements is based on the multi-core background of the reviewers > Useless Requirements consume resources and add validation & maintenance effort > Ensuring data consistency should minimize the overhead 9
DATA CONSISTENCY TESTING – TOWARDS SYSTEMATIC REQUIREMENTS ELICITATION 1 MULTI CORE SOFTWARE FOR POWERTRAIN 2 WHAT IS DATA CONSISTENCY 3 IDENTIFICATION OF CONSISTENCY REQUIREMENTS 4 SUMMARY AND OUTLOOK 10
SAMPLE STABILITY VIOLATION TIMING IS EVERYTHING ... 0 milliseconds global variables a, b a b 11
SAMPLE STABILITY VIOLATION TIMING IS EVERYTHING ... 2 milliseconds 98 3 global variables a, b a b Provider component (PRV) writes values to a, b 12
SAMPLE STABILITY VIOLATION TIMING IS EVERYTHING ... Module under Test (MUT) reads variables a, b as inputs void f(void) { ... if (98 > 3) if (a > b) { core 1 3 ... ... milliseconds // use a, b for calc. ... } } 98 3 global variables a, b a b core 2 Provider component (PRV) writes values to a, b 13
SAMPLE STABILITY VIOLATION TIMING IS EVERYTHING ... Module under Test (MUT) reads variables a, b as inputs void f(void) { ... if (98 > 3) if (a > b) { core 1 5 ... ... milliseconds // use a, b for calc. ... } } 98 3 global variables a, b a b core 2 Provider component (PRV) writes values to a, b 14
SAMPLE STABILITY VIOLATION TIMING IS EVERYTHING ... Module under Test (MUT) reads variables a, b as inputs void f(void) { ... if (98 > 3) if (a > b) { core 1 8 ... ... milliseconds // use a, b for calc. ... } } 1 3 global variables a, b a b core 2 Provider component (PRV) writes values to a, b 15
SAMPLE STABILITY VIOLATION TIMING IS EVERYTHING ... Module under Test (MUT) reads variables a, b as inputs void f(void) { ... if (98 > 3) if (a > b) { core 1 9 ... a= 1, b= 3 ... milliseconds // use a, b for calc. ... } } 1 3 global variables a, b a b core 2 Provider component (PRV) writes values to a, b 16
SAMPLE STABILITY VIOLATION TIMING IS EVERYTHING ... All would have been fine if: > MUT would have executed a bit faster (eg, shorter waiting time for bus communication resource), or > PRV would have executed a bit slower (eg, longer interrupt by another task function on core 2) void f(void) { void f(void) { ... ... (98 > 3) if (98 > 3) if (a > b) { if (a > b) { ... ... ... ... a= 98, b= 3 a= 1, b= 3 // use a, b for calc. // use a, b for calc. ... ... } } } } we call this a Problematic Access Pattern (PAP) 17
CORE CONCEPT: ADVERSARIAL TESTING BY VARYING THE EXECUTION TIMES OF TASK FUNCTIONS WITHIN WCET LIMITS > maximize occurrences of violations by manipulating execution times of code fragments to achieve ”bad” interleaving of MUT and PRV executions > PAP coverage (as many different PAPs as possible ) > filter by assessing the effect of certain PAPs on the outputs > basis for consistency testing: Validator simulator: a platform-aware Software-in- the-Loop (SiL) simulation > execution of application software is interleaved with simulation of a virtual platform model 18
RESULTS OF CONSISTENCY TESTING ADEQUATE SET OF VARIABLES THAT NEED TO BE BUFFERED >a (typically a reduced) set of data protection requirements >documented exceptions with reproducible tests 19
SOLID FORMAL BASIS FINITE STATE MACHINES . : . . . . | . . W Entry vVS vVS C v CS vVS C fat v pat Wait4PRV . : W During t pEt / . vVS vVS . . . | . . C v CS vVS C fat v pat * * . / ( ); P net t exec P M * max , . ; pEt t P net * / (arg min . ); P P net Init CheckPRV Final P v PS . * . P net t M min . v VS C fat C v CS . . Entry resume : ; . . vVS v CS . : . , . min( . , ); W Exit C v CS C fat C fat t > THUS, CONSISTENCY/COHERENCY TESTING CAN BE FORMALLY VERIFIED
TOOL USAGE IMPROVES SOFTWARE QUALITY AND REDUCES RESOURCE CONSUMPTION > batch mode as part of a daily build (continuous integration) > interactively with UI seamlessly integrated in Matlab/Simulink and Eclipse 21
DATA CONSISTENC TEST - TOWARDS SYSTEMATIC REQUIREMENT ELICITATION 1 MULTI CORE SOFTWARE FOR POWERTRAIN 2 WHAT IS DATA CONSISTENCY 3 IDENTIFICATION OF CONSISTENCY REQUIREMENTS 4 SUMMARY AND OUTLOOK 22
SUMMARY AND OUTLOOK WHEN TO PERFORM THE CONSISTENCY TEST? Functional Test Expected Validator Requirements cases Values Configure ≈ Configuration Modeling Validator MIL Functional Model Result Model Model Coverage in the Loop ≈ Scaling Chrona Producer Implementation Result Runtime model Validator Event DB = DB ACG SIL Consistency Software Code C-Code Stress Test In the Loop Result Test Validator Coverage (s-function in model) Project = YPDAs YPDAs Result Test Archite Projects PIL Projects Summary Trace C-Code ctures Processor Result (compiled for µC - Target) In the Loop Consistency stress test will complement the SIL test as a formal way to prove data consistency 23
SUMMARY AND OUTLOOK > Test is based on a formal method to identify consistency requirements > It works in context of a project > Extension to platform approach is possible by batch processing of different scenarios > Piloting Phase within Vitesco Technologies is started 24
QUESTIONS?
ANNEX EXAMPLE AND CASE STUDY ENGINE CONTROL FUNCTION – FOR SELF STUDY
EXAMPLE >Consistency sets: C 0 ={a,c,e}, C 1 ={b,d} 27
EXAMPLE >Consistency sets: C 0 ={a,c,e}, C 1 ={b,d} 28
EXAMPLE >Consistency sets: C 0 ={a,c,e}, C 1 ={b,d} Stability violations: (c,a),(d,b),(e,c) Buffer: a,c 29
EXAMPLE >Consistency sets: C 0 ={a,c,e}, C 1 ={b,d} Stability violations: (c,a),(d,b),(e,c) Buffer: a,c 30
EXAMPLE >Consistency sets: C 0 ={a,c,e}, C 1 ={b,d} Stability violations: (c,a),(d,b),(e,c) Buffer: a,c Coherency violations: (d,b) Buffer: a,c,d 31
Recommend
More recommend
