Controller Area Network (CAN) Schedulability Analysis: Refuted, Revisited and Revised

Transcription

1 Cotroller Area Networ (CAN) Schedulability Aalysis: Refuted, Revisited ad Revised Robert. Davis ad Ala Burs Real-ie Systes Research Group, Departet of Coputer Sciece, Uiversity of Yor, YO1 5DD, Yor (UK) Abstract Cotroller Area Networ (CAN) is used extesively i autootive applicatios, with i excess of 4 illio CAN eabled icrocotrollers aufactured each year schedulability aalysis was developed for CAN, showig how worst-case respose ties of CAN essages could be calculated ad hece guaratees provided that essage respose ties would ot exceed their deadlies. his seial research has bee cited i over 2 subsequet papers ad trasferred to idustry i the for of coercial CAN schedulability aalysis tools. hese tools have bee used by a large uber of ajor autootive aufacturers i the desig of i-vehicle etwors for a wide rage of cars, illios of which have bee aufactured over the last 8 years. his paper shows that the origial schedulability aalysis give for CAN essages is flawed. t ay provide guaratees for essages that will i fact iss their deadlies i the worst-case. his paper provides revised aalysis resolvig the probles with the origial approach. Further, it highlights that the priority assiget policy, previously claied to be optial for CAN, is ot i fact optial ad cites a ethod of obtaiig a optial priority orderig that is applicable to CAN. he paper discusses the possible ipact o coercial CAN systes desiged ad developed usig flawed schedulability aalysis ad aes recoedatios for the revisio of CAN schedulability aalysis tools. 1. troductio 1.1. Bacgroud Cotroller Area Networ (CAN) is a serial couicatios bus desiged to provide siple, efficiet ad robust couicatios for i-vehicle etwors. CAN was developed by Robert Bosch Gb begiig i 1983 ad preseted to a wider Reider J. Bril ad Joha J. Luie echische Uiversiteit Eidhove (U/e), De Dolech 2, 56 AZ Eidhove, he Netherlads r.j.bril@tue.l j.j.luie@tue.l audiece at the Society of Autootive Egieers (SAE) Cogress i 1986 effectively the birth of CAN the first CAN cotroller chips were released by tel (82526) ad Philips (82C2). the early 199s Bosch subitted the CAN specificatio [2] for stadardisatio, leadig to publicatio of the first SO stadard for CAN (11898) i 1993 [32]. Mercedes was the first autootive aufacturer to deploy CAN i a productio car, the 1991 S-class. By the id 199s, the coplexity of autootive electroics was icreasig rapidly. he uber of etwored Electroic Cotrol Uits (ECUs) i Mercedes, BMW, Audi ad VW cars wet fro 5 or less at the begiig of the 199s to aroud 4 at the tur of the illeiu. With this explosio i coplexity traditioal poit-to-poit wirig becae icreasigly expesive to aufacture, istall, ad aitai due to the hudreds of separate coectios ad tes of ilogras of copper wire required. As a result CAN was rapidly adopted by the cost-coscious autootive idustry, providig a effective solutio to the probles posed by icreasig vehicle electroics cotet. Followig o fro Mercedes other aufacturers icludig Volvo, Saab, BMW, Volswage, Ford, Reault, PSA, Fiat ad others all adopted CAN techology. As a result of the wholesale adoptio of CAN by the autootive idustry, sales of CAN odes (8, 16 ad 32-bit icrocotrollers with o-chip CAN peripherals) grew fro just uder 5 illio i 1999 to over 34 illio i 23 1 see Figure 1. By 24 there were at least 15 silico vedors aufacturig, i total, over 5 differet icroprocessor failies with o-chip CAN capability. oday alost every ew car aufactured i 1 Figures fro the CAN i Autoatio (CiA) website 1

2 Europe is equipped with at least oe CAN bus. the Uited States, the Eviroetal Protectio Agecy has adated the use of CAN, for O Board Diagostics, i all cars ad light trucs sold i the US fro odel year 28 owards. Millio uits bit 16-bit 8-bit stad aloe CAN ode sales Year Figure 1: Sales of Microcotrollers with ochip CAN Peripherals 1.2. Autootive Applicatios autootive applicatios, CAN is typically used to provide high speed etwors (5Kbits/s) coectig chassis ad power-trai ECUs, for exaple egie aageet ad trasissio cotrol. t is also used for low speed etwors (1 or 125Kbits/s) coectig body ad cofort electroics, for exaple door odules, seat odules ad cliate cotrol. Data required by ECUs o differet etwors is typically gatewayed betwee the differet CAN buses by a powerful ECU coected to both. Figure 2: VW Passat Networ Architecture he etwor architecture of the VW Passat [33] show i Figure 2, reproduced fro [15], illustrates how a uber of CAN buses are used to coect aroud 45 ECUs i that vehicle. Also show i Figure 2 2 are three Local tercoect Networs (LN). LN is a copleetary techology to CAN, ad is used to provide iexpesive, low speed (2Kbits/s) coectivity. able 1 suarises the requireets placed o ivehicle etwors for the BMW 7 Series. his is typical of autootive applicatios, where idividual CAN buses are used to coect betwee 2 ad 32 ECUs at badwidths ragig fro 1 to 5Kbits/s. Body Chassis Powertrai No. of ECUs Badwidth 1 Kbits/s 5 Kbits/s 5Kbits/s No. of Messages Cycle ies 5s-2s 1s-1s 1s-1s able 1: BMW 7 Series Networ Requireets autootive applicatios the essages set o CAN are used to couicate state iforatio, referred to as sigals, betwee differet ECUs. Exaples of sigals iclude: wheel speeds, oil ad water teperature, egie rp, gear selectio, accelerator positio, dashboard switch positios, cliate cotrol settigs, widow switch positios, fault codes, diagostic iforatio ad so o. a high-ed vehicle there ca be ore tha 25 distict sigals, each effectively replacig what would, i a traditioal poit-to-poit wirig loo, have bee a separate wire. May of these sigals have real-tie costraits associated with the. For exaple, a ECU reads the positio of a switch attached to the brae pedal. his ECU ust sed a sigal, carryig iforatio that the braes have bee applied, over the CAN etwor so that the ECU resposible for the rear light clusters ca recogise the chage i the value of the sigal ad switch the brae lights o. All withi a few tes of illisecods of the brae pedal beig pressed. Egie, trasissio, ad stability cotrol systes typically place eve tighter tie costraits o sigals, which ay eed to be set as frequetly as oce every 5 illisecods to eet their tie costraits Research ad Real-ie Aalysis CAN is a serial data bus that supports priority based essage arbitratio ad o-pre-eptive essage trasissio. the early 199s, a coo iscoceptio about CAN was that although the protocol was very good at trasittig the highest priority essage with low latecy, it was ot possible to guaratee that less urget sigals, carried i lower priority essages, would eet their deadlies idell et al. [6, 8, 9] showed how research ito fixed priority pre-eptive schedulig for sigle processor systes could be adapted ad applied to the

3 schedulig of essages o CAN. his aalysis provided a ethod of calculatig the worst-case respose ties of all CAN essages. Usig this aalysis it becae possible to egieer CAN based systes for tiig correctess, providig guaratees that all essages, ad the sigals that they carry would eet their deadlies. idell s seial research heavily iflueced the desig of o-chip CAN peripherals such as Motorola scan [34] ad has lead to a large body of wor ito schedulability theory ad error odels for CAN [22-27, 29], icludig at least two PhD theses [13, 15]. Overall, this research ito CAN schedulig has bee cited i over 2 2 subsequet papers idell s research was recogised by Volvo Car Corporatio ad successfully used i the cofiguratio ad aalysis of the CAN buses for the forthcoig Volvo S8 (P23) [11]. Followig the success of this project, Volcao Couicatios echologies AB 3 used idell s aalysis as the basis of a coercial CAN schedulability aalysis tool. Sice 1998 these tools have bee used, by a uber of autootive aufacturers, i the desig ad developet of the CAN etwors ad electroics systes for their vehicles. Prior to idell s wor, low levels of bus utilizatio, up to 3 or 4%, were typical i autootive applicatios, with extesive testig required to obtai cofidece that CAN essages would eet their deadlies. With the advet of a systeatic approach based o schedulability aalysis, CAN bus utilizatio could be icreased to aroud 8% [14] whilst still guarateeig that deadlies would be et Motivatio he desig ad developet of ay i vehicle Cotroller Area Networs relies o the schedulability aalysis of CAN give i [6, 8, 9]. this sectio, we show that this aalysis is flawed. t ay result i coputed worst-case respose ties for essages that are optiistic, i.e. less tha the respose ties that ay actually occur. he set of CAN essages listed i able 2 serve to highlight the proble with the existig schedulability aalysis of CAN. As a siple exaple, we have assued a 125Kbit/s etwor with 3 essages, each of which carries 7 bytes of sigal data. Assuig 11-bit idetifiers ad worst-case bit-stuffig, the axiu legth of each essage is 125 bits ad hece the axiu trasissio tie of each essage is 1s. 2 As of August 26, referece [6] has 78 citatios, referece [8] 199 citatios ad referece [9] 11 citatios (Google Scholar). 3 Volcao Couicatios echologies AB was acquired by Metor Graphics i May he aalysis ethod give i [6, 8, 9] calculates the worst-case respose ties of essages A, B ad C as 2s, 3s ad 3s respectively. ece the syste is deeed to be schedulable the aalysis supposedly guaratees that all of the essages will eet their deadlies i the worst case, despite the high bus utilisatio of 97%. Message Priority Period Deadlie tie A 1 2.5s 2.5s 1s B 2 3.5s 3.25s 1s C 3 3.5s 3.25s 1s able 2: CAN Messages ighlightig Flawed Aalysis Figure 3 illustrates the worst-case sceario for trasissio of essage C. We ote that the first ivocatio of this essage is delayed by higher priority essages A ad B, leadig to a respose tie of 3s this is the worst-case respose tie calculated usig existig CAN schedulability aalysis ethods. owever, as essage trasissio is o-preeptable, the first trasissio of essage C has a oc o effect, delayig subsequet trasissios of higher priority essages A ad B. Soe of this higher priority iterferece is pushed through ito the ext period of essage C leadig to a loger respose tie for the secod istace of essage C. Figure 3: Worst-case Sceario for Message C At tie t = 7s, the secod istace of essage C copletes trasissio with a respose tie of 3.5s. (Note at tie t = 7s, there are o higher priority essages awaitig trasissio ad so there is o further push through iterferece that could delay subsequet istaces of essage C). he actual worst-case respose tie for essage C is 3.5s, which is greater tha its deadlie of 3.25s, ad so the syste is i fact uschedulable; cotrary to the guaratees give by [6, 8, 9]. fact, if the periods of essages B ad C are shorteed fro 3.5s to 3.25s the the existig aalysis results i uchaged worst-case respose ties, iplyig that the syste is still schedulable. owever, with these shorter periods the overall bus utilisatio exceeds 1% ad so the syste caot possibly be schedulable!

4 1.5. Related wor he schedulability aalysis for CAN builds o previous research ito fixed priority schedulig of tass o sigle processor systes. 199, Lehoczy [5] itroduced the cocept of a busy period ad showed that if tass have deadlies greater tha their periods, referred to as arbitrary deadlies, the it is ecessary to exaie the respose ties of all ivocatios of a tas fallig withi a busy period i order to deterie the worst-case respose tie. 1991, arbour [4] showed that if deadlies are less tha or equal to periods, but priorities vary durig executio, the agai ultiple ivocatios ust be ispected to deterie the worst-case respose tie. We ote that o-pre-eptive schedulig is effectively a special case of pre-eptive schedulig with varyig executio priority as soo as a tas starts to execute its priority is raised to the highest level. 1994, idell et al. [7] iproved upo the wor of Lehoczy [5] providig a forulatio for arbitrary deadlie aalysis based o a recurrece relatio. Buildig upo these earlier results, coprehesive schedulability aalysis of o-pre-eptive fixed priority schedulig for sigle processor systes was give by George et al i 1996 [3]. 26, Bril [2] refuted the aalysis of fixed priority systes with deferred pre-eptio give by Burs i [12], showig that this aalysis ay result i coputed worst-case respose ties that are optiistic. he schedulability aalysis for CAN give by idell i [6, 8, 9] builds upo [12] ad suffers fro essetially the sae flaw. A siilar issue with wor o pre-eptio thresholds [19] was first idetified ad corrected by Regehr [18] i 22. he revised schedulability aalysis preseted i this paper ais to provide a evolutioary iproveet upo the aalysis of CAN give by idell i [6, 8, 9]. o do so, it draws upo the aalysis of idell [7] for fixed priority pre-eptive schedulig of systes with arbitrary deadlies ad the aalysis of George et al. [3] for fixed priority o-pre-eptive systes. A techical report [16] ad a worshop paper [17] highlight the proble for CAN but do ot provide a specific i-depth solutio. hat is the purpose of this paper Orgaisatio he reaider of this paper is orgaised as follows: sectio 2 describes the CAN protocol ad teriology before outliig a suitable schedulig odel ad otatio o which to base revised schedulability aalysis. Sectio 3 provides ew schedulability aalysis for CAN, correctig the flaws i the existig approach. Sectio 4 discusses the syste ad essage paraeters eeded for the flaws i the existig aalysis to result i icorrect worst-case respose ties ad hece isleadig guaratees. Sectio 5 discusses the issue of optial priority assiget for CAN. Sectio 6 suarises the iplicatios of flaws i the existig aalysis for coercial CAN applicatios. Fially, sectio 7 cocludes with a suary of the ai cotributios of this paper ad recoedatios for further research. 2. Cotroller Area Networ (CAN) his sectio describes eleets of the CAN protocol ad characteristics of a syste odel that are eeded to forulate a schedulability test. For a coplete descriptio of the CAN protocol see the CAN specificatio versio 2. [2] CAN Protocol ad eriology Cotroller Area Networ (CAN) is a ulti-aster serial data bus which uses Carrier Sese Multiple Access/ Collisio Resolutio (CSMA/CR) to deterie access. CAN was desiged as a siple ad robust broadcast bus capable of operatig at speeds of up to 1 Mbit/s. Message trasfer over CAN is cotrolled by 4 differet types of frae: Data fraes, Reote rasit Request (RR) fraes, Overload fraes ad Error fraes. he layout of a stadard forat data frae is show i Figure 4. Each CAN data frae is required to have a uique idetifier. detifiers ay be 11-bit (stadard forat) or 29-bit (exteded forat). he idetifier serves two purposes beyod siply idetifyig the essage. First, the idetifier is used as a priority to deterie which essage aog those cotedig for the bus will be trasitted ext. Secod, the idetifier ay be used by receivers to filter out essages that they are ot iterested i, ad so reduce the load o the receiver s host icroprocessor. this paper we are iterested i the schedulability of data fraes, with error fraes also cosidered i sectio 3.5. he schedulability aalysis ca however easily be exteded to iclude RR fraes usig the approach give i [8]. 4

5 2.1.1 Priority Based Arbitratio he CAN physical layer supports two states tered doiat ( ) ad recessive ( 1 ). f two or ore CAN cotrollers are trasittig at the sae tie ad at least oe of the trasits a the the value o the bus will be a. his echais is used to cotrol access to the bus ad also to sigal errors. he CAN protocol calls for odes to wait util a bus idle period 4 is detected before atteptig to trasit. f two or ore odes start to trasit at the sae tie, the by oitorig each bit o the bus, each ode ca deterie if it is trasittig the highest priority essage (with a uerically lower idetifier) ad should cotiue or if it should stop trasittig ad wait for the ext bus idle period before tryig agai. As the essage idetifiers are uique, a ode trasittig the last bit of the idetifier field, without detectig a bit that it did ot trasit, ust be trasittig the essage with the lowest uerical value ad hece the highest priority that was ready at the start of arbitratio. his ode the cotiues to trasit the reaider of its essage, all other odes havig baced off. he requireet for a ode to be able to overwrite a recessive bit, ad the trasittig ode detect this chage, liits the cobiatio of physical legth ad speed of CAN bus. he duratio of each bit ust be sufficiet for the sigal to propagate the legth of the etwor. his liits the axiu data rate to 1Mbit/s for a etwor up to 4 i legth or to 125Kbit/s for a 5 log etwor. he arbitratio echais eployed by CAN eas that essages are set as if all the odes o the etwor shared a sigle global priority based queue. effect essages are set o the bus accordig to fixed priority o-pre-eptive schedulig. he above high level descriptio is a soewhat siplified view of the tiig behaviour of CAN. CAN does ot have a global cocept of tie, rather each CAN cotroller typically has its ow cloc which, 4 A bus idle period is a iterval of arbitrary legth coprisig oly recessive bits ad begiig with the last bit of the iter-frae space the fial 3-bit field show i Figure 4. Figure 4: Stadard Forat Data Frae 5 withi a tolerace specified by the protocol, ay drift with respect to the clocs of other odes. he CAN protocol therefore requires that odes re-sychroise o each essage trasissio. Specifically, every ode ust sychroise to the leadig edge of the start of frae bit caused by whichever ode starts to trasit first. Norally, CAN odes are oly allowed to start trasittig whe the bus is idle. hus, whe the bus is idle beyod the 3-bit iter-frae space ad a ode starts to trasit a essage begiig with the doiat start of frae bit ( ), the all the other odes sychroise o the leadig edge of this bit ad becoe receivers i.e. they are ot peritted to trasit util the bus ext becoes idle. this case ay essage that becoes ready for trasissio after the leadig edge of the start of frae bit has to wait for the ext bus idle period before it ca eter ito arbitratio. owever, to avoid probles due to cloc drift, the CAN protocol also specifies that, if a CAN ode has a essage ready for trasissio ad detects a doiat bit at the 3 rd bit of the iter-frae space, it will iterpret this as a start of frae bit, ad, with the ext bit, start trasittig its ow essage with the first bit of the idetifier without first trasittig a start of frae bit ad without becoig a receiver 5. Agai the leadig edge of the start of frae bit causes a sychroisatio. his behaviour esures that ay essages that becoe ready for trasissio, whilst aother essage is beig set o the bus, are etered ito the ext roud of arbitratio, irrespective of ay, withi tolerace, cloc drift Error Detectio CAN was desiged as a robust ad reliable for of couicatio for short essages. Each data frae carries betwee ad 8 bytes of payload data ad has a 15-bit Cyclic Redudacy Chec (CRC). he CRC is used by receivig odes to chec for errors i the trasitted essage. f a ode detects a error i the trasitted essage, which ay be a bit-stuffig error (see sectio 2.1.3), a CRC error, a for error i the 5 See page 54 of the CAN Specificatio versio 2. [2].

6 fixed part of the essage or a acowledgeet error, the it trasits a error flag. he error flag cosists of 6 bits of the sae polarity: if the ode is i the error active state ad if it is error passive. rasissio of a error flag typically causes other odes to also detect a error, leadig to trasissio of further error flags. Figure 5: CAN Error Fraes Figure 5 illustrates CAN error fraes, for further details see [2] ad [22]. he legth of a error frae is betwee 17 ad 31 bits. ece each essage trasissio that is sigalled as a error ca lead to a axiu of 31 additioal bits 6 of error recovery overhead plus re-trasissio of the essage itself Bit Stuffig As the bit patters ad are used to sigal errors, it is essetial that these bit patters are avoided i the variable part of a trasitted essage see Figure 4. he CAN protocol therefore requires that a bit of the opposite polarity is iserted by the trasitter wheever 5 bits of the sae polarity are trasitted. his process is referred to as bit-stuffig, ad is reversed by the receiver. he worst-case sceario for bit-stuffig is show i Figure 6. Note that each stuff bit begis a sequece of 5 bits that is itself subject to bit stuffig. Figure 6: Worst-case Bit Stuffig Stuff bits icrease the axiu trasissio tie of CAN essages. cludig stuff bits ad the iter- 6 he aalysis give i [6, 8, 9] uses 29 bits as the error recovery overhead as specified o page 8 of part A of the CAN specificatio 2. [2] for stadard idetifiers oly. We use 31 bits as specified o page 4 of the CAN specificatio 2. Part B [2] for both stadard ad exteded idetifiers. 6 frae space, the axiu trasissio tie C, of a CAN essage cotaiig s data bytes is give by 7 : g + 8s 1 C = g + 8 s τ bit (1) 4 where g is 34 for stadard forat (11-bit idetifiers) or 54 for exteded forat (29-bit idetifiers), a / b is otatio for the floor fuctio, which returs the largest iteger less tha or equal to a/b, adτ bit is the trasissio tie for a sigle bit. he forula give i Equatio (1) siplifies to: C = ( ) τ (2) s for 11-bit idetifiers ad C = ( ) τ (3) s for 29-bit idetifiers Schedulig Model this sectio we describe a appropriate syste odel ad otatio that ca be used to aalyse worstcase respose ties of essages o CAN ad hece deterie syste schedulability. he syste is assued to coprise a uber of odes (icroprocessors) coected via CAN. Each ode is assued to be capable of esurig that at ay give tie whe arbitratio starts, the highest priority essage queued at that ode is etered ito arbitratio. he syste is assued to cotai a static set of hard real-tie essages each statically assiged to a ode o the etwor. Each essage has a fixed idetifier ad hece a uique priority. As priority uiquely idetifies each essage, i the reaider of this paper we will overload to ea either essage or priority as appropriate. Each essage has a axiu uber of data bytes s ad a axiu trasissio tie C, give by Equatio (1). Each essage is assued to be queued by a software tas, process or iterrupt hadler executig o the host icroprocessor. his tas is either ivoed by, or polls for, the evet ad taes a bouded aout of tie betwee ad J to queue the essage ready for trasissio. J is referred to as the queuig jitter of the essage ad is iherited fro the overall respose tie of the tas, icludig ay pollig delay. he evet that triggers queuig of the essage is assued to occur with a iiu iter-arrival tie of, referred to as the essage period. his odel supports evets that occur strictly periodically with a period of, evets that occur sporadically with a iiu separatio of ad evets that occur oly oce before the syste is reset, i which case is bit bit 7 his forula corrects a siilar oe i [6, 8, 9] which does ot accout for the fact that stuff bits are theselves also subject to bit stuffig.

7 ifiite. Each essage has a hard deadlie D, correspodig to the axiu peritted tie fro occurrece of the iitiatig evet to the ed of successful trasissio of the essage, at which tie the essage data is assued to be available o the receivig odes that require it. ass o the receivig odes ay place differet tiig requireets o the data, however i such cases we assue that D is the tightest such tie costrait. he worst-case respose tie R, of a essage is defied as the logest tie fro the iitiatig evet occurrig to the essage beig received by the odes that require it. A essage is said to be schedulable if ad oly if its worst-case respose tie is less tha or equal to its deadlie ( R D ). he syste is schedulable if ad oly if all of the essages i the syste are schedulable Practical plicatios of the Model Egieers watig to use the aalysis give i sectio 3 to aalyse CAN based systes ust be careful to esure that all of the assuptios of the above odel hold for their syste. particular, it is iportat that each CAN cotroller ad device driver is capable of esurig that, at ay give tie whe arbitratio starts, the highest priority essage queued at that ode is etered ito arbitratio. his behaviour is essetial if essage trasissio is to tae place as if there were a sigle global priority queue ad for the aalysis give i sectio 3 to be applicable. As oted i [6], the Philips 82C5 CAN cotroller caot i geeral support this behaviour. Also the tel CAN cotroller has a feature where essages are etered ito arbitratio i slot order rather tha idetifier order. this case it is iportat that essages are allocated to slots i idetifier order to preserve the correct priority based behaviour. May o-chip CAN cotrollers have ultiple slots that ca be allocated to either trasit or receive a specific essage. For exaple soe Motorola, Natioal Seicoductor, Fujitsu ad itachi o-chip CAN peripherals have 14, 15 or 16 such slots. hese slots typically have oly a sigle buffer ad therefore it is ecessary to esure that the previous istace of a essage has bee trasitted before ay ew data is writte ito the buffer, otherwise the previous essage will be overwritte ad lost. his behaviour provides a additioal costrait o essage trasissio: the deadlie of each essage ust be less tha or equal to its period ( D ). Recall that the worst-case respose tie of a 7 essage is fro the occurrece of the iitiatig evet to the ed of successful essage receptio at the receivig odes. As oted by Broster i [13], receivig odes ca access the essage followig the ed of frae arer ad before the 3-bit iter-frae space see Figure 4. he aalysis give i the reaider of this paper is slightly pessiistic i that it icludes the 3-bit iter-frae space i the coputed worst-case respose ties. o reove this sall degree of pessiis it is valid to siply subtract 3τ bit fro the coputed respose tie values. ypically the respose tie of a essage represets oly part of a overall ed-to-ed respose tie that is of iterest to egieers. Oce the essage is received it ay cause a iterrupt or be polled for at the receivig ode. ypically the data i the essage will be processed by a tas or iterrupt hadler ad soe output ade. he worst-case respose tie of the receivig tas or iterrupt hadler, icludig ay pollig delay, eeds to be added to the worst-case respose tie of the essage to deterie the overall ed-to-ed respose tie. he schedulig odel assued i this paper uses oly oe tie doai, whilst CAN typically has a separate cloc source for each ode o the etwor. o esure that the schedulability aalysis for a real etwor does ot produce optiistic results, it is ecessary to tae cloc toleraces ito accout. his ca be achieved by covertig to real-tie as follows: for essage jitters ad bit ties o the bus the coversio to real-tie should assue that the ode clocs ru as slowly as their tolerace allows. Siilarly, essage periods ad deadlies derived fro ode clocs should be coverted to real-tie assuig that the ode clocs ru as quicly as their tolerace allows. 3. Respose ie Aalysis Respose tie aalysis for CAN ais to provide a ethod of calculatig the worst-case respose tie of each essage. hese values ca the be copared to the essage deadlies to deterie if the syste is schedulable. itially we provide aalysis assuig o errors o the CAN bus. his aalysis is the exteded, i sectio 3.5, to accout for errors o the bus. For systes coplyig with the schedulig odel give i sectio 2.2, CAN effectively ipleets fixed priority o-pre-eptive schedulig of essages. Followig the aalysis i [6, 8, 9] the worst-case respose tie of a essage ca be viewed as beig ade up of three eleets: (i) he queuig jitter J, correspodig to the logest tie betwee the iitiatig evet ad the essage beig queued, ready to be

8 trasitted o the bus. (ii) he queuig delay w, correspodig to the logest tie that the essage ca reai i the CAN cotroller slot or device driver queue before coecig successful trasissio o the bus. (iii) he trasissio tie C, correspodig to the logest tie that the essage ca tae to be trasitted. he worst-case respose tie of essage is give by: R = J + w + C (4) he queuig delay coprises blocig B, due to lower priority essages which ay be i the process of beig trasitted whe essage is queued ad iterferece due to higher priority essages which ay wi arbitratio ad be trasitted i preferece to essage. Give the behaviour of CAN described i the fial two paragraphs of sectio 2.1.1, the axiu aout of blocig occurs whe a lower priority essage starts trasissio iediately before essage is queued, ready to be trasitted o the bus. Message ust wait util the bus is idle before it ca be etered ito arbitratio. he axiu blocig tie B, is give by: B = ax ( C ) (5) lp( ) where lp() is the set of essages with lower priority tha. he cocept of a busy period, itroduced by Lehoczy [5], is fudaetal i aalysig worst-case respose ties. Modifyig the defiitio of a busy period give i [4] to apply to CAN essages, a priority level- busy period is defied as follows: s (i) t starts at soe tie t whe a essage of priority or higher is queued ready for trasissio ad there are o essages of priority or higher waitig to be trasitted s that were queued strictly before tie t. (ii) t is a cotiguous iterval of tie durig which ay essage of priority lower tha is uable to start trasissio ad wi arbitratio. e (iii) t eds at the earliest tie t whe the bus becoes idle, ready for the ext roud of trasissio ad arbitratio, yet there are o essages of priority or higher waitig to be trasitted that were queued strictly before e tie t. he ey characteristic of a busy period is that all essages of priority or higher queued strictly before the ed of the busy period are trasitted durig the busy period. hese essages caot therefore cause 8 ay iterferece o a subsequet istace of essage queued at or after the ed of the busy period. atheatical teriology, busy periods ca be s e s viewed as right half-ope itervals: [ t, t ) where t e is the start of the busy period ad t the ed. hus the ed of oe busy period ay correspod to the start of aother separate busy period. his is i cotrast to the sipler defiitio give i [5], which uifies two adjacet busy periods as we have defied the, ad therefore soeties results i aalysis of ore essage istaces tha is strictly ecessary. For exaple, i the extree case of 1% utilisatio, the busy period defied i [5] ever eds ad a ifiite uber of essage istaces would eed to be cosidered. he worst-case queuig delay for essage occurs for soe istace of essage queued withi a priority level- busy period that starts iediately after the logest lower priority essage begis trasissio. his axial busy period begis with a so-called critical istat [21] where essage is queued siultaeously with all higher priority essages ad the each of these essages is subsequetly queued agai after the shortest possible tie itervals. the reaider of this paper wheever we refer to a busy period we ea this axiu legth busy period. f ore tha oe istace of essage is trasitted durig a priority level- busy period the it is ecessary to deterie the respose tie of each istace i order to fid the overall worst-case respose tie of the essage Basic Aalysis ad Stoppig Coditio [6, 8, 9], idell gives the followig equatio for the worst-case queuig delay: w + J + τ bit w B C hp = + (6) ( ) where hp() is the set of essages with priorities higher tha ad a / b is otatio for the ceilig fuctio which returs the sallest iteger greater tha or equal to a/b. Although w appears o both sides of Equatio (6), as the right had side is a ootoic odecreasig fuctio of w, the equatio ay be solved usig the recurrece relatio below. + 1 w + J + τ bit w = B + C (7) ) A suitable startig value is w = B. he relatio +1 iterates util either J + w + C > D i which +1 case the essage is ot schedulable or w = w, i which case the worst-case respose tie of the first

9 istace of the essage i the busy period is give by: +1 J + w + C. he flaw i the above aalysis is that, give the costrait D, it iplicitly assues that if essage is schedulable the the priority level- busy period will ed at or before. We observe that with fixed priority pre-eptive schedulig this would always be the case, as o copletio of trasissio of essage ; o higher priority essage could be awaitig trasissio. owever, with fixed priority o-pre-eptive schedulig, a higher priority essage ca be awaitig trasissio whe essage copletes trasissio, ad thus the busy period ca exted beyod as show by the exaple i sectio 1.4. he legth t, of the priority level- busy period is give by the followig recurrece relatio, startig with a iitial value of t = C ad fiishig whe +1 t = t : t J t = B + C (8) ) where hp( ) is the set of essages with priority or higher. As the right had side is a ootoic odecreasig fuctio of t the the recurrece relatio is guarateed to coverge provided that the bus utilisatio U, for essages of priority ad higher, is less tha 1: C U = (9) ) f t J the the busy period eds at or before the secod istace of essage is queued. his eas that oly the first istace of the essage is trasitted durig the busy period. he existig aalysis calculates the worst-case queuig tie for this istace via Equatio (7) ad hece provides the correct worst-case respose tie i this case. f t > J the the existig aalysis ay give a optiistic worst-case respose tie depedet upo whether the first or subsequet istaces of essage i the busy period have the logest respose tie. We observe that the aalysis preseted i appedix A.2 of [3] suggests that t is the sallest value that is a solutio to Equatio (8), however this is ot strictly correct. For the lowest priority essage B = ad so t = is trivially the sallest solutio. We avoid this proble by usig a iitial value of t =. C 3.2. Checig Multiple staces he uber of istaces Q, of essage that becoe ready for trasissio before the ed of the busy period is give by: t + J Q = (1) o deterie the worst-case respose tie of essage, it is ecessary to calculate the respose tie of each of the Q istaces. he axiu of these values the gives the worst-case respose tie. the followig aalysis, we use the idex variable q to represet a istace of essage. he first istace i the busy period correspods to q = ad the fial istace to q = Q 1. he logest tie fro the start of the busy period to istace q begiig successful trasissio is give by: w J τ bit w ( q) = B + qc + C ) (11) he recurrece relatio starts with a value of + 1 w ( q) = B + qc ad eds whe w ( q) = w ( q) + 1 or whe J + w ( q) q + C > D i which case the essage is uschedulable. For values of q > a efficiet startig value is give by w ( q) = w ( q 1) + C. he evet iitiatig istace q of the essage occurs at tie q J relative to the start of the busy period so the respose tie of istace q is give by: R ( q) = J + w ( q) q + C (12) he worst-case respose tie of essage is therefore: R = ax ( R ( q)) (13) q=.. Q 1 We ote that the aalysis preseted above is also applicable whe essages have deadlies that are greater tha their periods, so called arbitrary deadlies. owever, if such tiig characteristics are specified the the software device drivers or CAN cotroller hardware ay eed to be capable of bufferig ore tha oe istace of a essage. he uber of istaces of each essage that eed to be buffered is bouded by: R N = (14) We observe that the aalysis preseted i [3] Q t / + rather tha effectively uses = 1 Q t / =. his yields a value which is oe too large whe the legth of the busy period plus jitter is a iteger ultiple of the essage period. Although this does ot give rise to probles, we prefer the ore efficiet forulatio give by Equatio (1). 9

10 3.3. Exaple sectio 1.4 we showed, with the aid of a siple exaple, how the existig aalysis ca provide optiistic worst-case respose ties ad hece flawed guaratees that essages will eet their deadlies. We retur to this exaple to illustrate how the aalysis preseted i this paper coputes the correct worst-case respose ties. For ease of referece, the table of essage paraeters is repeated below. Message Priority Period Deadlie tie A 1 2.5s 2.5s 1s B 2 3.5s 3.25s 1s C 3 3.5s 3.25s 1s able 3: CAN Messages Usig the ew aalysis, the worst-case respose tie of essage C ( = 3) is calculated as follows. As there are o lower priority essages, B 3 =. Startig with a value of t3 = C3 = 1, the recurrece relatio 1 give by Equatio (8) iterates as follows: t 3 = 3, t3 = 4, t3 = 6, t3 = 7, covergig as t3 = t3 = 7. he legth of the busy period is therefore 7.s ad the uber of istaces of essage C that eed to be exaied is give by Equatio (1): 7. Q 3 = = his tells us that there is the possibility that the existig aalysis will calculate a optiistic worst-case respose tie. he value could still be correct if the first istace of the essage has the logest respose tie. Calculatio of the respose tie of the first istace proceeds usig Equatio (11): w 3 () =, w3 () = 2, covergig whe w3 () = w3 () = 2. Usig Equatio (12) we have R 3 () = 3, the sae respose tie calculated by the existig aalysis. Movig o to the secod istace, 1 2 w ( 1) = w3 () + C = 3, w3 (1) = 4, w 3 (1) = 5, 3 w 3 (1) = 6. At this poit coputatio would orally stop as the respose tie, give by J 3 + w3 ( q) q3 + C3 has reached 3.5 s which is greater tha the essage deadlie. owever, if we cotiue iteratig, assuig a loger deadlie, the the 4 3 recurrece relatio coverges o w3 (1) = w3 (1) = 6 ad hece R 3 (1) = 3.5 s. he worst-case respose tie of essage C is i fact 3.5s as previously illustrated by Figure 3 i sectio Sufficiet Schedulability ests he aalysis give i sectios 3.1 ad 3.2 corrects a sigificat flaw i the existig schedulability aalysis for CAN. owever, the schedulability test preseted is ore coplex, potetially requirig the coputatio of ultiple respose ties. this sectio, we preset two sipler but ore pessiistic schedulability tests, which are applicable give the costrait that essage deadlies do ot exceed their periods. hese tests are referred to as sufficiet but ot ecessary. By sufficiet, we ea that all systes deeed to be schedulable by the tests are i fact schedulable, ad by ot ecessary we ea that ot all systes deeed to be uschedulable by the tests are i fact uschedulable. he respose tie of the first istace of a essage i the busy period is give by Equatio (7). Assuig that this first istace copletes trasissio before its deadlie ad hece before the ed of its period, the we have two possibilities to cosider. (i) f the busy period eds before the ext istace of essage is queued, the Equatio (7) gives the correct worst-case respose tie. (ii) Alteratively if the busy period cotiues beyod the tie at which the ext istace of essage is queued, the we ust also cosider the respose tie of the secod ad ay subsequet istaces of essage, queued before the ed of the busy period. the latter case, the axiu aout of higher priority iterferece that ca be pushed through ito the ext period of essage due to the o-preeptive trasissio of the previous istace is C. Further, as the first istace of essage copleted trasissio at or before the ed of its period, ad the priority level- busy period exteds at least as far as the ed of that period, the there ca be o outstadig essages of lower priority blocig the ext istace. We ow tae a alterative ad pessiistic view of the respose tie of the ext istace of essage. he queuig tie of this istace ca be cosidered i isolatio. We assue that, (i) it is queued siultaeously with all other essages of higher priority a critical istat, (ii) it is subject to push through iterferece of C fro the previous istace of essage. A upper boud o the queuig delay of the secod ad subsequet istaces of essage withi the busy period is therefore give by: w J τ bit w = C + C (15) ) his result suggests a siple but pessiistic schedulability test. A istace of essage ca either be subject to blocig due to lower priority essages or to push through iterferece of at ost C due to the previous istace of the sae essage, but ot both. ece we ca odify Equatio (7) to provide a correct sufficiet but ot ecessary 1

11 schedulability test: w J τ bit w = ax( B, C ) + C ) (16) A further siplificatio is to assue that the blocig factor always taes its axiu possible value: MA w J τ bit w = B + C (17) ) MA Where B correspods to the trasissio tie of the logest possible CAN essage (8 data bytes) irrespective of the characteristics ad priorities of the essages i the syste Error odel So far we have assued that o errors occur o the CAN bus, however as origially show i [6, 8, 9] schedulability aalysis of CAN ay be exteded to iclude a appropriate error odel. this paper we cosider oly a very siple ad geeral error odel. We assue that the axiu uber of errors preset o the bus i soe tie iterval t is give by the fuctio F(t). We assue o specific details about this fuctio; save that it is a ootoic o-decreasig fuctio of t. For a ore detailed discussio of appropriate error odels for CAN see [22, 24, 25]. We ow odify the schedulability equatios to accout for the error recovery overhead. he worstcase ipact of a sigle bit error is to cause trasissio of a additioal 31 bits of error recovery overhead plus re-trasissio of the affected essage. Oly errors affectig essage or higher priority essages ca delay essage fro beig successfully trasitted. he axiu additioal delay caused by the error recovery echais is therefore give by: E ( t) = 31τ bit + ax ( C ) F( t) (18) hp( ) Revisig Equatio (8) to copute the legth of the busy period we have: + 1 t + J t = E ( t ) + B + C (19) ) Agai a appropriate iitial value is t = C. Equatio (19) is guarateed to coverge o a solutio provided that the utilisatio icludig error U 8 [8], idell et al. state that the blocig tie o CAN is defied as the logest tie that a essage ca tae to be physically trasitted o the bus. his siplified view provides a sufficiet but ot ecessary schedulability test that correspods to Equatio (17). owever, later i [8], the blocig ter is described as the logest tie that ay lower priority essage ca occupy the bus. his descriptio, also i [6, 9], results i a flawed schedulability test. 11 recovery overhead is less tha 1. As before, Equatio (1) ca be used to copute the uber of essage istaces that eed to be exaied to fid the worst-case respose tie. + 1 w ( q) = E ( w + C ) + B + qc + w + J + τ (2) bit C ) Equatio (2) exteds Equatio (11) to accout for the error recovery overhead. Note that as errors ca ipact the trasissio of essage itself, the tie iterval cosidered i calculatig the error recovery overhead icludes the trasissio tie of essage as well as the queuig delay. Equatios (2), (12) ad (13) ca be used together to copute the respose tie of each essage istace q, ad hece fid the worst-case respose tie of each essage i the presece of errors at the axiu rate specified by the error odel. he sufficiet schedulability tests give i sectio 3.4 ca be siilarly odified via the additio of the ter E ( w + C ) to accout for the error recovery overhead. 4. Discussio this sectio we cosider various characteristics of CAN systes ad discuss whether flaws i the existig aalysis ca result i erroeous guaratees uder specific circustaces that are relevat to realworld systes. We see to aswer the followig questios. 1. Ca the existig aalysis give faulty guaratees to essages of ay priority? 2. f the bus utilizatio is low, ca the existig aalysis still result i optiistic respose ties? 3. Do error odels give sufficiet egieerig argi for error to accout for the flaw i the aalysis? 4. Does the oissio of diagostic essages durig oral operatio reduce iterferece / blocig eough to esure that the deadlies of the reaiig essages will be et? 5. Which essage guaratees ca we be sure are ot at ris? 4.1. Priorities of Messages at Ris We have foud that, i geeral, the existig aalysis gives the correct worst-case respose ties for the highest priority ad the 2 d highest priority essage. owever; it ca copute icorrect worstcase respose ties for essages fro the 3 rd highest priority to the lowest priority.

12 Figure 7: Busy Period for Message. his is show by the exaple essage set costructed below ad illustrated i Figure 7. he exaple essage set cosists of; (i) a high priority essage ; (ii) a group of (where 1 ) iterediate priority essages, represeted by, which all have the sae periods ad trasissio ties; (iii) a essage of priority below those essages i group, which highlights the flaw i the aalysis ad (iv) a group of (where ) low priority essages represeted by L, which all have the sae trasissio ties. he trasissio ties of the essages are C, C, C ad CL respectively. he exaple assues that C > CL. he low priority essages L, are assued to have very large periods ad o jitter. hese essages cotribute oly blocig to the respose tie of essage. (Note if there are o lower priority essages, i.e. =, the the exaple still holds with = ). C L he period of essage is: = C + 2C + 2C + C ( L ) / 2 he period of essage is: = ( CL + 3C + 2C + 2C ) / 2 he period of the iterediate essages, is assued to be large ( >> 2 ). owever, the period less jitter for each iterediate essage is: J = C + 2 C + C + C L By cotrast essages ad are assued to have o jitter. he busy period for essage is show i Figure 7. For siplicity, there is oly oe iterediate priority essage show i the diagra, however the trasissio tie of this essage is give as C, represetig the arbitrary uber of iterediate essages that are cosidered. We ow show that uder certai coditios, essage exhibits the proble with the existig aalysis. he legth of the busy period for essage, give by Equatio (8), is: t = C + 3 C + 2C + 2C = 2 L ece, accordig to Equatio (1), there are two istaces of essage i the busy period that eed to have their respose ties coputed. Accordig to Equatio (11), ad as C > CL, the queuig delay of the first istace of essage is: w ( ) = C + C + C L Siilarly for the secod istace: w ( 1) = C + 3C + 2C + C L Accordig to Equatio (12), the respose ties of the two istaces are: R ( ) = C + C + C + C L ad R ( 1) = ( CL + 3C + 2C + 2C ) / 2 Coparig R () ad R (1), the, provided that C > CL, the respose tie of the secod istace is greater tha that of the first. Meaig that essage exposes the flaw i the existig aalysis. ( fact, assuig D =, the secod istace of essage is oly just schedulable with R = ). As we ca choose a arbitrary uber ( 1 ) of iterediate priority essages ad siilarly a arbitrary uber ( ) of lower priority essages, essage ay lie aywhere fro the 3 rd highest to the lowest priority i a set of essages with cardiality greater tha or equal to 3. We coclude that ay essage fro the lowest priority to the 3 rd highest priority i a set of 3 or ore essages ca be give a optiistic respose tie ad therefore a faulty guaratee by the existig aalysis Breadow Utilisatio he exaple i sectio 1.4 has a bus utilisatio of 97%. t is iterestig to as if the existig aalysis ca yield optiistic worst-case respose ties for systes with uch lower utilisatio. 12

13 Returig to the exaple essage set, costructed i sectio 4.1, we ow cosider how low the utilisatio of that essage set ca be. o achieve the lowest possible utilisatio, we eed oly cosider the cotributio fro essages ad as the utilisatio of both the iterediate essages, ad the low priority essages L, teds to zero whe their periods are icreased to a arbitrarily large value. We therefore have: 2C 2C U = + C + 3C + 2C + 2C C + 2C + 2C + C L with the costraits that C > C L ad C > CL. he overall utilisatio is iiised by choosig values of C ad C as sall as possible ad C as large as possible. Give the costraits o CAN essage sizes, the iiu occurs whe we choose essages ad to have zero data bytes, so C = C = 55τ bit, the iterediate essages to have 8 data bytes ad so C = 135τ bit ad o lower priority essages, so C L =. We ote that this essage set is soewhat pathological i that all the iterediate priority essages have arbitrarily large periods / deadlies ad correspodigly large queuig jitter. t does however illustrate that i geeral the existig aalysis breas dow at very low levels of utilisatio. able 4 provides a upper boud o this breadow utilisatio: the existig aalysis is ow to breadow at these levels of utilisatio, it ay breadow at still lower levels. Nuber of Utilisatio Messages % % 1 9.2% % 1.82% able 4: Utilisatio of Message Sets Breaig the Existig Aalysis Whilst it is uliely that real-world applicatios will have essage cofiguratios that replicate the pathological case discussed above, such systes ay i soe cases iclude essages with large aouts of queuig jitter. ypically these are gatewayed essages that have iherited a large jitter fro variability i the respose tie of a source essage set o aother etwor. We coclude that, for applicatios characterised by o-zero queuig jitter, it is prudet to assue that there could be probles with the existig aalysis irrespective of overall bus utilisatio. fact, for real-world CAN systes characterised by essages with o-zero queuig jitter ad cosequetly deadlies less tha periods, overall bus L 13 utilisatio is a poor idicator of syste schedulability Margi for Error sectio 3.5 we saw how a geeralised error odel could be icluded i the revised schedulability aalysis. Bit error rates o CAN are typically very low: 11 1 up to 1 6 depedig o eviroetal coditios [31]. owever, errors do occur ad it is therefore appropriate that ay coercial applicatio of CAN schedulability aalysis should iclude at least a siple error odel to accout for sporadic errors o the bus. hese errors are typically caused by exteral sources of Electroagetic terferece (EM) such as obile phoes, radar, radio trasitters ad lightig as well as other possible causes such as switch cotacts, ad shieldig or wirig faults. As such errors are typically copletely ucorrelated with essage trasissio; it is therefore reasoable to assue that ay useful error odel allows for the possibility of a error occurrig at ay give tie ad hece the error fuctio F( t) 1 for ay tie iterval t. Let us ow cosider the situatio where the schedulability aalysis give i [6, 8, 9] has bee used alog with a error odel with F( t) = 1 to deterie the schedulability of a syste. he recurrece relatio used by the existig aalysis is give below: w J τ bit w = B + E ( w + C ) + C ) (21) Give that F( t) 1, the fro Equatio (18), the axiu additioal delay to essage due to the error recovery echais is always loger tha the trasissio tie of essage, i.e. E ( t) > C. Substitutig C for E (t) i Equatio (21) gives: w J τ bit w = B + C + C (22) ) We ote that as E ( t) > C, the solutio to Equatio (22) caot be larger tha the solutio to Equatio (21). Recall that Equatio (16) provides a correct sufficiet but ot ecessary schedulability test for the case where there are o errors o the CAN bus. Coparig Equatio (22) ad Equatio (16), we observe that, as ax( B + C ) B + C, the solutio to Equatio (16) caot be larger tha the solutio to Equatio (22) ad hece caot be larger tha the solutio to Equatio (21). his eas that if essage is deeed to be schedulable give the queuig delay coputed by Equatio (21) for the case where there are errors o the bus, the it ust also be schedulable give the queuig delay coputed via Equatio (16) for the case where there are o errors o the bus.

14 his is a iportat result. t eas that if the existig aalysis showed that every essage was schedulable i the presece of ay reasoable error odel ( F( t) 1), the, despite the flaw i the existig aalysis, every essage is actually guarateed to be schedulable whe o errors are preset. Put aother way, the egieerig argi for error provided by the error odel is sufficiet to accout for the error i the aalysis. We observe however, that the robustess of systes aalysed usig the schedulability aalysis i [6, 8, 9] ay ot be all that was expected. Flaws i the existig aalysis could lead to essage cofiguratios that will iss their deadlies i the presece of errors at a rate withi the paraeters of the specified error odel, eve though we ca be sure that they will ot iss their deadlies whe o errors are preset o the bus Message Oissio May CAN applicatios allow for 8 data byte diagostic essages, which are ot trasitted durig the oral ode of operatio. hese essages are trasitted oly whe the syste is i diagostic ode 9 ad lied to service equipet. this sectio, we cosider whether the oissio of diagostic essages provides sufficiet reductio i iterferece / blocig to esure that essages do ot iss their deadlies durig oral operatio, despite beig give potetially optiistic worst-case respose ties by the existig aalysis. o aswer this questio, we cosider a syste that is deeed to be schedulable by the existig aalysis. We assue that this syste icludes a 8 data byte diagostics essage x, which is oly trasitted whe the syste is i diagostic ode. We ote that as essage x has the axiu uber of data bytes, its trasissio tie is equivalet to the largest possible MA blocig factor, so C x = B. he blocig factor for each essage of higher priority tha x, is MA therefore give by B = B, which eas that the existig aalysis based o Equatio (7) coputes exactly the sae worst-case respose tie for each higher priority essage, as the correct sufficiet but ot ecessary schedulability aalysis test based o Equatio (17). he existig aalysis caot therefore result i optiistic worst-case respose ties for essages of higher priority tha x. For each essage of lower priority tha x, the MA iterferece due to essage x is at least B. Coparig Equatio (7) ad Equatio (17), we 9 ypically all oral ode essages cotiue to be trasitted durig diagostic ode. 14 observe that the solutio to Equatio (7), with diagostic essage x icluded i the set of higher priority essages, is at least as large as the solutio to Equatio (17) whe essage x is excluded. his eas that if a lower priority essage is deeed to be schedulable by the existig aalysis whe essage x is preset, the it ust also be schedulable accordig to the correct sufficiet but ot ecessary schedulability aalysis whe essage x is oitted. We coclude that the oissio of a sigle axiu legth essage of arbitrary priority provides sufficiet reductio i iterferece / blocig to esure that the flaw i the existig aalysis caot lead to ay of the reaiig essages issig their deadlies Message Guaratees ot at Ris this sectio, we cosider the circustaces uder which the first istace of a essage i the busy period is guarateed to have the logest respose tie. Uder these circustaces, despite its flaws, the existig aalysis gives correct results. Assuig that essage deadlies do ot exceed their periods, the Equatio (15) i sectio 3.4 provides a upper boud o the queuig delay for the secod ad subsequet istaces of essage i the busy period. Coparig Equatios (7) ad (15), we observe that provided B C, the the first istace of essage is guarateed to have a loger respose tie tha ay subsequet oes. Fro the defiitio of B give i Equatio (5), we coclude the followig iportat result: the existig aalysis gives the correct respose tie for ay essage where there exists at least oe lower priority essage with equal or loger trasissio tie / essage legth. 5. Priority Assiget Policies he aalysis preseted i sectio 3 is applicable idepedet of the priority orderig of CAN essages. owever, choosig a appropriate priority orderig is iportat i obtaiig a schedulable syste ad i axiisig robustess to errors. Priority orderig is deteried by a priority assiget policy. A priority assiget policy P is referred to as optial if there are o systes that are schedulable usig ay other priority assiget policy that are ot also schedulable usig policy P. [6, 8] it was claied that deadlie ootoic [35] ad deadlie ius jitter or (D-J)-ootoic [1] priority assiget policies are optial for CAN. owever, whilst these policies are optial for fixed priority pre-eptive schedulig assuig deadlies o greater tha periods, they are ot optial for fixed priority o-pre-eptive schedulig [3] ad are

15 therefore ot optial for CAN. his is illustrated by the followig exaple usig the set of essages give i able 5. Message Period Deadlie Nuber tie of bits A 3.s 3.s s B 4.s 4.s s C 4.5s 4.5s 65.52s able 5: CAN Messages ighlightig Nooptial Priority Assiget his exaple assues a 125Kbit/s etwor ad 11- bit idetifiers. Messages A ad B cotai 8 data bytes ad essage C cotais 1 data byte, givig trasissio ties of 1.8, 1.8 ad.52s respectively, assuig worst-case bit stuffig. additio there are a uber of lower priority essages, each cotaiig 8 data bytes, which are also set o the etwor. heir trasissio ties are also 1.8s. Settig essage priorities i the order A highest, the B, the C results i a uschedulable syste. he worst-case respose ties of essages A ad B are 2.16s ad 3.24s respectively. owever, i the worst case, essage C does ot eve begi trasissio before its deadlie. Figure 8 illustrates the log delays that essage C is subject to before trasissio. Messages A, B ad C are assued to be queued just too late to eter arbitratio at tie t = ad hece the low priority essage L is trasitted first. Figure 8: Message Respose ies with Optial Priority Assiget he priority orderig A, B, C correspods to both deadlie ootoic ad also (D-J)-ootoic priority orderig as all the essages have zero queuig jitter. f these priority assiget policies are optial the we should ot be able to fid aother priority orderig which results i all the deadlies beig et. owever, if we use the priority orderig A, C, B the the worstcase respose ties of the essages are: RA = 2.16s, RC = 2.68s ad RB = 3.76s as illustrated i Figure 9. With this priority orderig, all of the essages eet their deadlies. Figure 9: Message Respose ies with a Alterative Priority Assiget he reaso that the revised priority orderig results i a schedulable syste is that givig the shortest essage a higher priority eables all three essages to start trasissio withi 3s of beig queued ad hece oe of the are subject to iterferece fro a secod istace of essage A ad subsequetly a secod istace of essage B. his exaple shows that the priority assiget policies assued i [6, 8] to be optial are ot. [3] George et al. claied that deadlie ootoic priority assiget is optial for o-preeptive systes with o jitter, provided that deadlies ad executio ties are i the sae order i.e. D i < D j iplies C i C j. he proof assues that as i, Di i the worst-case respose tie of ay tas is foud i its first istace, however this assuptio is false as we have see with the siple exaple i sectio 1.4 ad so the proof is uderied. he theore ay or ay ot still be true. George et al. [3] also showed that the optial priority assiget algorith devised by Audsley [1] is applicable to o-pre-eptive systes. geeral, Audsley s algorith is applicable provided that the worst-case respose tie of a essage: (i) does ot deped upo the specific priority (ii) orderig of higher priority essages ad, does ot get loger if the essage is give a higher priority. spectio of the various equatios preseted i this paper shows that both of the above coditios hold: either the legth of queuig delay, or the legth of the busy period deped upo the specific priority order of higher priority essages, or ca they icrease i legth with icreasig priority. Although the blocig ter ca get larger with icreased priority this is always couteracted by a decrease i iterferece that is at least as large. Audsley s optial priority assiget algorith, give below, is therefore applicable for deteriig the priority orderig of CAN essages. 15

16 Optial Priority Assiget Algorith for each priority level, lowest first { for each uassiged essage { if is schedulable at this priority { assig this priority brea (cotiue outer loop) } } retur uschedulable } retur schedulable For essages, Audsley s algorith perfors at ost (-1)/2 schedulability tests ad is guarateed to fid a schedulable priority assiget if oe exists. t does ot however specify a order i which essages should be tried at each priority level. his order heavily iflueces the priority assiget chose if there is ore tha oe orderig that is schedulable. fact, a poor choice of iitial orderig ca result i a priority assiget that leaves the syste oly just schedulable. We suggest that, as a useful heuristic, essages are tried at each priority level i (D-J) order, largest value of (D-J) first, with ties broe accordig to essage legth, logest first. 6. plicatios ad Recoedatios this sectio, we discuss the iplicatios of flaws i existig CAN schedulability aalysis o coercial CAN schedulability aalysis tools ad deployed CAN applicatios CAN Schedulability Aalysis ools CAN schedulability aalysis tools eed to tae accout of the fidigs preseted i this paper. his will ivolve checig ad if ecessary updatig the aalysis they eploy, to esure that it caot provide optiistic worst-case respose ties ad false guaratees. he sufficiet but ot ecessary schedulability tests give i sectio 3.4 provide a quic-fix solutio as the chages required to the existig aalysis are iial. hese tests are however pessiistic ad ipleetig the revised aalysis, give i sectio 3, would potetially lead to a techically better solutio. Whilst deadlie ius jitter or (D-J)-ootoic priority orderig is still a good heuristic to use, it is ot ecessarily the optial priority assiget policy for CAN. pleetig priority orderig based upo Audsley s optial priority assiget algorith would esure that a schedulable priority orderig is foud wheever oe exists Coercial CAN Applicatios Syste Desigers cofigurig coercial CAN applicatios ofte tae the egieerig approach that all essages i the syste should reai schedulable give the additio of ay uber of low priority essages that ca be used for developet ad test purposes. Such aalysis based o [6, 8, 9] would assue that every essage is subject to the axiu blocig factor, as per the sufficiet schedulability test give by Equatio (17). his schedulability test coputes a correct upper boud o the actual respose tie of each essage ad so provides a correct guaratee that the cofigured essages will eet their deadlies. Give the flaws i the existig schedulability aalysis, it would however be prudet for Syste Desigers to chec the precise details of the aalysis used to copute worst-case respose ties for their systes. f the aalysis used has the potetial to copute erroeous worst-case respose ties, the the feasibility of all the CAN cofiguratios desiged, developed ad deployed usig that aalysis should be checed to esure that they are i fact schedulable ad robust to errors at the rate specified by the prescribed error odel Faults i Deployed Systes May deployed CAN systes, for exaple those i autootive applicatios, will have bee aalysed usig the pragatic egieerig approach described i the previous sectio. he flaws i the existig aalysis caot lead to a proble with a deployed syste i this case. May CAN applicatios allow for axiu legth (8 data byte) diagostic essages that are ot trasitted durig oral operatio. Assuig that the existig aalysis deeed the syste schedulable with these diagostic essages preset, the sectio 4.4 showed that the oissio of a sigle diagostic essage provides sufficiet reductio i iterferece / blocig to esure that the flaws i the existig aalysis caot lead to ay essages issig their deadlies durig oral operatio. sectio 4.5 we saw that the existig aalysis gives the correct respose tie for ay essage where there is at least oe lower priority essage with equal or loger trasissio tie / essage legth. May CAN applicatios use exclusively 8 data byte essages as a eas of addressig the high ratio of overhead to useful data o CAN. this case, the existig aalysis is guarateed to copute correct respose ties for all but the lowest priority essage. Eve if a essage has the potetial to be give a erroeous worst-case respose tie by the existig

17 aalysis, the uless that essage is close to beig uschedulable, the coputed worst-case respose tie is still liely to be the true value. Eve if a optiistic value is coputed, the the true value ay still be less tha the essage deadlie. Fially, for a deadlie iss to actually happe i a deployed syste requires that the worst-case essage phasig occurs ad, at the sae tie, a uber of the essages tae close to their axiu trasissio ties. his requires worst-case or ear worst-case bit stuffig to occur which is, i itself, highly uliely [23]. Noral practice with coercial CAN cofiguratios is to esure that schedulability aalysis icludes provisio for a error odel of soe sort. this case, sectio 4.3 showed that such systes are guarateed to be schedulable whe o errors are preset o the CAN bus provided that they were deeed to be schedulable i the presece of errors by the existig aalysis. We coclude that deadlie isses i deployed CAN systes due to flaws i the existig aalysis are extreely uliely. Ay such deadlie failures are ore liely to occur due to errors occurrig o the bus at a higher rate tha that accouted for by the error odel. We ote that ebedded CAN-based systes are built to be resiliet to soe essages issig their deadlies ad to uch sipler fors of error such as wirig faults. CAN is ot used i its basic for for safety critical systes due to ow issues such as the double receive ad babblig idiot probles [28, 29, 3]. 7. Suary ad Coclusios this paper we highlighted a sigificat flaw i log-stadig highly cited ad widely used schedulability aalysis of CAN. We showed how this flaw could lead to the coputatio of optiistic worstcase respose ties for CAN essages, broe guaratees ad deadlie isses. his paper provides revised aalysis that ca be used to calculate correct worst-case respose ties for CAN. additio, we showed that: 1. he existig aalysis ca provide optiistic worstcase respose ties for essages fro the 3 rd highest priority to the lowest priority. 2. he existig aalysis ca lead to broe guaratees ad hece deadlie isses i systes with low bus utilisatio. 3. Where a error odel has bee cosidered, the flaw i the existig aalysis is ot sufficiet to lead to CAN cofiguratios that will result i issed deadlies whe o errors are preset o the bus. he desired robustess to errors ay ot 17 however be achieved. 4. he oissio of a sigle axiu legth diagostic essage, accouted for by the existig aalysis, reduces iterferece / blocig eough to esure that the deadlies of all the reaiig essages are et durig oral operatio. 5. Despite its flaws, the existig aalysis gives the correct respose tie for ay essage where there is at least oe lower priority essage with the sae or greater trasissio tie / essage legth. We discussed the iplicatios of these results for coercial CAN systes developed usig flawed aalysis ad provided two siple, sufficiet schedulability tests eablig a quic-fix to be ade to coercial CAN schedulability aalysis tools. Fially, we showed that the either deadlie ootoic or (D-J)-ootoic priority assiget is optial for CAN. Audsley s optial priority assiget algorith is however optial for fixed priority o-pre-eptive systes ad ay be used to obtai a schedulable priority orderig for CAN wheever oe exists Future Wor A cosiderable body of acadeic wor has grow up fro idell s seial aalysis of CAN. he flaws i that origial wor ay have partly uderied soe of the subsequet research built upo it. Authors that have cited the origial CAN aalysis i their wor are ecouraged to chec the iplicatios. particular the acadeic wor ost liely to be affected is that which exteds the origial aalysis ad pushes syste schedulability to its liits, for exaple wor o error odels. 8. Acowledgeets his wor was partially fuded by the UK EPSRC fuded DRC project, the EU fuded FRESCOR project ad the S-4527 fuded ARS 2 etwor of excellece o Ebedded Systes Desig. 9. Refereces [1] N.C. Audsley, "Optial priority assiget ad feasibility of static priority tass with arbitrary start ties", echical Report YCS 164, Dept. Coputer Sciece, Uiversity of Yor, UK, Deceber [2] R.J. Bril. Existig worst-case respose tie aalysis of realtie tass uder fixed-priority schedulig with deferred preeptio is too optiistic. CS-Report 6-5, echische Uiversiteit Eidhove (U/e) he Netherlads, February 26. [3] L. George, N. Rivierre, ad M. Spuri. Pre-eptive ad opre-eptive real-tie ui-processor schedulig. echical Report 2966, stitut Natioal de Recherche et foratique et e Autoatique (NRA), Frace, Septeber 1996 [4] M.G. arbour, M.. Klei, J.P. Lehoczy. Fixed priority schedulig of periodic tass with varyig executio priority.

18 Proceedigs 12 th EEE Real-ie Systes Syposiu, pp , EEE Coputer Society Press, Deceber [5] J. Lehoczy. Fixed priority schedulig of periodic tas sets with arbitrary deadlies. Proceedigs 11th EEE Real-ie Systes Syposiu, pp , EEE Coputer Society Press, Deceber 199. [6] K.W. idell ad A. Burs. Guarateeig essage latecies o Cotroller Area Networ (CAN), Proceedigs of 1st teratioal CAN Coferece, pp. 1-11, Septeber [7] K. W. idell, A. Burs, ad A.J. Welligs. A extedible approach for aalysig fixed priority hard real-tie systes. Joural of Real-ie Systes, 6(2): , March [8] K.W. idell, A. Burs, ad A. J. Welligs. Calculatig Cotroller Area Networ (CAN) essage respose ties. Cotrol Egieerig Practice, 3(8): , August [9] K.W. idell,. asso, ad A.J. Welligs. Aalysig real-tie couicatios: Cotroller Area Networ (CAN). Proceedigs 15th Real-ie Systes Syposiu (RSS 94), pp EEE Coputer Society Press, [1] A. Zuhily Optiality of (D-J)-ootoic priority assiget. echical Report YCS44. Dept. of Coputer Sciece, Uiversity of Yor, UK, May 26. [11] L. Casparsso, A. Raja, K. idell, ad P. Malberg. Volcao - a revolutio i o-board couicatios. Volvo echology Report, 1998/1. [12] A. Burs. Pre-eptive priority based schedulig: A appropriate egieerig approach. S. So, editor, Advaces i Real-ie Systes, pp Pretice-all, [13]. Broster. Flexibility i depedable couicatio. PhD hesis, Departet of Coputer Sciece, Uiversity of Yor, UK, August 23. [14] R. DeMeis Cars sag uder weighty wirig Electroic ies 1/24/25. [15]. Nolte Share-drive schedulig of ebedded etwors, PhD hesis, Malardale Uiversity Press, May 26. [16] R.J. Bril, J J. Luie, R.. Davis, ad A. Burs. Message respose tie aalysis for ideal cotroller area etwor (CAN) refuted. CS-Report 6-19, echische Uiversiteit Eidhove (U/e) he Netherlads, May 26. [17] R J. Bril, J.J. Luie, R.. Davis, ad A. Burs. Message respose tie aalysis for ideal cotroller area etwor (CAN) refuted. Proceedigs 5 th teratioal Worshop o Real- ie Networs (RN 6). o appear 26. [18] J. Regehr. Schedulig tass with ixed pre-eptio relatios for robustess to tiig faults Proceedigs 23rd Real-ie Systes Syposiu, pp , EEE Coputer Society Press, Deceber 22. [19] Y. Wag ad M. Sasea. Schedulig fixed priority tass with pre-eptio threshold. Proceedigs of the 6th teratioal Worshop o Real-ie Coputig Systes ad Applicatios (RCSA 99), pp , Deceber [2] Bosch. CAN Specificatio versio 2.. Robert Bosch Gb, Postfach 3 2 4, D-7442 Stuttgart, [21] C. L. Liu ad J. W. Laylad. "Schedulig algoriths for ultiprograig i a hard-real-tie eviroet", Joural of the ACM, 2(1): 46-61, [22] S. Pueat,. asso, C. Norstro. Respose tie aalysis uder errors for CAN. Proceedigs 6 th Real-ie echology ad Applicatios Syposiu, pp , EEE Coputer Society Press May/Jue 2. [23]. Nolte,. asso, ad C. Norstro. Miiizig CAN respose-tie aalysis jitter by essage aipulatio. Proceedigs 8 th EEE Real-ie ad Ebedded echology ad Applicatios Syposiu (RAS'2), pp , Septeber 22. [24]. Broster, A. Burs ad G. Rodriguez-Navas, iig aalysis of real-tie couicatio uder electroagetic iterferece, Real-ie Systes, 3(1-2) pp , May 25. [25]. Broster, A. Burs, G. Rodríguez-Navas, Probabilistic Aalysis of CAN with Faults, Proceedigs of the 23rd EEE Real-ie Systes Syposiu (RSS'2), pp , Deceber, 22 [26]. asso,. Nolte, C. Norstro, ad S. Pueat. tegratig Reliability ad iig Aalysis of CAN-based Systes. EEE rasactio o dustrial Electroics 49(6): , Deceber 22. [27]. Nolte,. asso, ad C. Norstro, "Probabilistic worst-case respose-tie aalysis for the Cotroller Area Networ." Proceedigs of the 9th EEE Real-ie ad Ebedded echology ad Applicatios Syposiu (RAS'3), pp. 2-27, May 23. [28] J. Rufio, P. Verissio, G. Arroz, C. Aleida, ad L. Rodrigues. Fault-tolerat broadcasts i CAN. Digest of Papers, he 28th EEE teratioal Syposiu o Fault- olerat Coputig (FCS 98) pp , Jue [29]. Broster ad A. Burs. A Aalysable Bus-Guardia for Evet-riggered Couicatio. Proceedigs of the 24th Real-tie Systes Syposiu, pp , EEE Coputer Society Press, Deceber 23. [3] J. Rufio Coputatioal Syste for Real-ie Distributed Cotrol. PhD-hesis, echical Uiversity of Lisbo, stituto Superior, July 22. [31] J. Ferreira, A. Oliveira, P. Foseca, J. A. Foseca. A Experiet to Assess Bit Error Rate i CAN Proceedigs of 3rd teratioal Worshop of Real-ie Networs (RN24) pp [32] SO Road Vehicles iterchage of digital iforatio cotroller area etwor (CAN) for high-speed couicatio, SO Stadard-11898, teratioal Stadards Orgaisatio (SO), Noveber [33] J. Leohold. Autootive syste architecture. Proceedigs of the Suer School Architectural Paradigs for Depedable Ebedded Systes. pp , Viea, Austria, Septeber 25. Viea Uiversity of echology. [34] Motorola c. MSCAN Bloc Guide V3.1 Docuet No. SV12MSCANV3/D. FreeScale Seicoductor c.may 1998 (Revised July 24). [35] J. Y.-. Leug ad J. Whitehead, "O the coplexity of fixed-priority schedulig of periodic real-tie tass," Perforace Evaluatio, 2(4): , Deceber