Controller Area Network (CAN) Schedulability Analysis with FIFO queues

Transcription

1 Cotroller Area Network (CAN) Schedulability Aalysis with FIFO queues Robert I. Davis Real-Tie Systes Research Group, Departet of Coputer Sciece, Uiversity of York, YO10 5DD, York, UK Steffe Kolla, Victor Pollex, Frak Sloka Istitute of Ebedded Systes / Real-Tie Systes Ul Uiversity, Albert-Eistei-Allee 11, Ul, Geray {steffe.kolla, victor.pollex, Abstract Cotroller Area Network (CAN) is widely used i autootive applicatios. Existig schedulability aalysis for CAN is based o the assuptio that the highest priority essage ready for trasissio at each ode o the etwork will be etered ito arbitratio o the bus. However, i practice, soe CAN device drivers ipleet FIFO rather tha priority-based queues ivalidatig this assuptio. I this paper, we itroduce respose tie aalysis ad optial priority assiget policies for CAN essages i etworks where soe odes use FIFO queues while other odes use priority queues. We show, via a case study ad experietal evaluatio, the detrietal ipact that FIFO queues have o the real-tie perforace of CAN. Revisio: This techical report was revised i April 2011 to iclude a sectio o experietal evaluatio. 1. Itroductio Cotroller Area Network (CAN) [3], [21] was desiged as a siple, efficiet, ad robust, broadcast couicatios bus for i-vehicle etworks. Today, typical aistrea faily cars cotai Electroic Cotrol Uits (ECUs), ay of which couicate usig CAN. As a result of this wholesale adoptio of CAN by the autootive idustry, aual sales of CAN odes (8, 16 ad 32-bit icrocotrollers with o-chip CAN cotrollers) have grow fro uder 50 illio i 1999 to aroud 750 illio i CAN is a asychroous ulti-aster serial data bus that uses Carrier Sese Multiple Access / Collisio Resolutio (CSMA/CR) to deterie access to the bus. The CAN protocol requires that odes wait for a bus idle period before atteptig to trasit. If two or ore odes attept to trasit essages at the sae tie, the the ode with the essage with the lowest ueric CAN Idetifier will wi arbitratio ad cotiue to sed its essage. The other odes will cease trasittig ad ust wait util the bus becoes idle agai before atteptig to re-trasit their essages. (Full details of the CAN physical layer protocol are give i [3], with a suary i [11]). I effect CAN essages are set accordig to fixed priority o-preeptive schedulig, with the idetifier (ID) of each essage actig as its priority. 1 Figures fro the CAN i Autoatio (CiA) website Related work I 1994, Tidell et al. showed how research ito fixed priority schedulig for sigle processor systes could be adapted ad applied to the schedulig of essages o CAN. The aalysis of Tidell et al. provided a ethod of calculatig the axiu queuig delay ad hece the worst-case respose tie of each essage o the etwork. Tidell et al. [30], [31], [32] also recogised that with fixed priority schedulig, a appropriate priority assiget policy is key to obtaiig effective real-tie perforace. Tidell et al. suggested that essages should be assiged priorities i Deadlie ius Jitter ootoic priority order [33]. The seial work of Tidell et al. lead to a large body of research ito schedulig theory for CAN [5], [6], [7], [8], [17], [18], [25], [26], [27], [28], ad was used as the basis for coercial CAN schedulability aalysis tools [9]. I 2007, Davis et al. [11] foud ad corrected sigificat flaws i the schedulability aalysis give by Tidell et al. [30], [31], [32]. These flaws could potetially result i the origial aalysis providig guaratees for essages that could i fact iss their deadlies durig etwork operatio. Further, Davis et al. [11] showed that the Deadlie ius Jitter ootoic priority orderig, claied by Tidell et al. to be optial for CAN, is ot i fact optial; ad that Audsley s Optial Priority Assiget (OPA) algorith [1], [2] is required i this case. Prior to the advet of schedulability aalysis ad appropriate priority assiget policies for CAN, essage IDs were typically assiged siply as a way of idetifyig the data ad the sedig ode. This eat that oly low levels of bus utilisatio, typically aroud 30%, could be obtaied before deadlies were issed. Further, the oly eas of obtaiig cofidece that essage deadlies would ot be issed was via extesive testig. Usig the systeatic approach of schedulability aalysis, cobied with a suitable priority assiget policy, it becae possible to egieer CAN based systes for tiig correctess, providig guaratees that all essages would eet their deadlies, with bus utilisatios of up to about 80% [13], [9] Motivatio Egieers usig schedulability aalysis to aalyse etwork / essage cofiguratios ust esure that all of the assuptios of the specified schedulig odel hold for their particular syste. Specifically, whe usig the aalysis

2 give by Davis et al. i [11], it is iportat that each CAN cotroller ad device driver is capable of esurig that wheever essage arbitratio starts o the bus, the highest priority essage queued at that ode is etered ito arbitratio. This behaviour is essetial if essage trasissio is to take place as if there were a sigle global priority queue ad for the aalysis to be correct. As oted by Di Natale [15], there are a uber of potetial issues that ca lead to behaviour that does ot atch that required by the schedulig odel give i [11]. For exaple, if a CAN ode has fewer trasit essage buffers tha the uber of essages that it trasits, the the followig properties of the CAN cotroller hardware ca prove probleatic: (i) iteral essage arbitratio based o trasit buffer uber rather tha essage ID (Fujitsu MB90385/90387, Fujitsu 90390, Itel 87C196 (82527), Ifieo XC161CJ/167 (82C900)); (ii) o-abortable essage trasissio (Philips (iii) 82C200) [16]; less tha 3 trasit buffers [24] (Philips 8xC592 (SJA1000), Philips 82C200). CAN cotrollers which avoid these potetial probles iclude, the Atel AT89C51CC03 / AT90CAN32/64 the Microchip MPC2515, ad the Motorola MSCAN o-chip peripheral, all of which have at least 3 trasit buffers, iteral essage arbitratio based o essage ID rather tha trasit buffer uber, ad abortable essage trasissio. The CAN device driver / software protocol layer ipleetatio also has the potetial to result i behaviour which does ot atch that required by the stadard schedulig odel [11]. Issues iclude, delays i refillig a trasit buffer [20], ad FIFO queuig of essages i the device driver or CAN cotroller (The BXCAN ad BECAN for the ST7 ad ST9 Microcotrollers fro STMicroelectroics iclude hardware support for both priority-queued ad FIFO-queued essage trasissio [29]). Di Natale [15] otes that usig FIFO queues i CAN device drivers / software protocol layers ca see a attractive solutio because of its siplicity ad the illusio that faster queue aageet iproves the perforace of the syste. This is ufortuate, because FIFO essage queues uderie the priority-based bus arbitratio used by CAN. They ca itroduce sigificat priority iversio ad result i degraded real-tie perforace. Nevertheless, FIFO queues are a reality i soe coercial CAN device drivers / software protocol layers. As far as we are aware, there is o published research 2 itegratig FIFO queues ito respose tie aalysis for CAN. This paper focuses o the issue of FIFO queues. We provide respose tie aalysis ad appropriate priority assiget policies for Cotroller Area Networks coprisig soe odes that use FIFO queues ad other 2 The coercial tool NETCAR-Aalyzer ( clais to address the case of FIFO queues. odes that use priority queues Orgaisatio The reaider of this paper is orgaised as follows: I sectio 2, we itroduce the schedulig odel, otatio, ad teriology used i the rest of the paper. I sectio 3 we recap o the sufficiet schedulability aalysis for CAN give i [11]. Sectio 4 the exteds this aalysis to etworks where soe odes ipleet priority-based queues while others ipleet FIFO queues. Sectio 5 discusses priority assiget for ixed sets of FIFOqueued ad priority-queued essages. Sectio 6 presets the results of a case study explorig the ipact of FIFO queues o essage respose ties ad etwork schedulability. Sectio 7 further evaluates the effect of priority assiget ad FIFO queues o the axiu achievable etwork utilisatio. Fially, sectio 8 cocludes with a suary ad recoedatios. 2. Syste odel, otatio ad teriology I this sectio we describe a syste odel ad otatio that ca be used to aalyse the worst-case respose ties of essages o CAN. This odel is based o that used i [11] with extesios to describe FIFO queues. The syste is assued to coprise a uber of odes (icroprocessors) coected to a sigle CAN bus. Nodes are classified accordig to the type of essage queue used i their device driver. Thus FQ-odes ipleet a FIFO essage queue, whereas PQ-odes ipleet a priority queue. PQ-odes are assued to be capable of esurig that, at ay give tie whe bus arbitratio starts, the highest priority essage queued at the ode is etered ito arbitratio. FQ-odes are assued to be capable of esurig that, at ay give tie whe bus arbitratio starts, the oldest essage i the FIFO queue is etered ito arbitratio. The syste is assued to cotai a static set of hard real-tie essages, each statically assiged to a sigle ode o the etwork. Each essage has a fixed Idetifier (ID) ad hece a uique priority. As priority uiquely idetifies each essage, i the reaider of the paper we will overload to ea either essage or priority as appropriate. We use hp () to deote the set of essages with priorities higher tha, ad siilarly, lp () to deote the set of essages with priorities lower tha. Each essage has a axiu trasissio tie of C (see [11] for details of how to copute the axiu trasissio tie of essages o CAN, takig ito accout the uber of data bytes ad bit-stuffig). The evet that triggers queuig of essage is assued to occur with a iiu iter-arrival tie of T, referred to as the essage period. Each essage has a hard deadlie D, correspodig to the axiu peritted tie fro occurrece of the iitiatig evet to the ed of successful trasissio of the essage, at which tie the essage data is assued to be available o the receivig odes that require it. Tasks o the receivig odes ay place differet tiig requireets o the data, however i such cases we assue that D is the shortest such tie

3 costrait. We assue that the deadlie of each essage is less tha or equal to its period ( D T ). Each essage is assued to be queued by a software task, process or iterrupt hadler executig o the sedig ode. This task is either ivoked by, or polls for, the evet that iitiates the essage, ad takes a bouded aout of tie, betwee 0 ad J, before the essage is i the device driver queue available for trasissio. J is referred to as the queuig jitter of the essage ad is iherited fro the overall respose tie of the task, icludig ay pollig delay 3. The trasissio deadlie E of essage is give by E = D J, ad represets the axiu peritted tie fro the essage beig queued at the sedig ode to it beig received at other odes o the bus. The axiu queuig delay w, correspods to the logest tie that essage ca reai i the device driver queue or CAN cotroller trasit buffers, before coecig successful trasissio o the bus. I this paper 4, we defie the worst-case respose tie R of a essage as the axiu possible trasissio delay fro the essage beig queued util it is received at the receivig odes. Hece: R = + C (1) As oted by Broster [7], receivig odes ca access essage followig the ed of (essage) frae arker ad before the 3-bit iter-frae space. The aalysis give i the reaider of this paper is therefore slightly pessiistic i that it icludes the 3-bit iter-frae space i the coputed worst-case respose ties. To reove this sall degree of pessiis, it is valid to siply subtract 3τ bit fro the coputed respose tie values, where τ bit is the trasissio tie for a sigle bit o the bus. A essage is said to be schedulable if its worst-case respose tie is less tha or equal to its trasissio deadlie ( R E ). A syste is said to be schedulable if all of the essages i the syste are schedulable. The followig additioal otatio is used to describe the properties of a set of essages that are trasitted by the sae FQ-ode ad so share a FIFO queue. The FIFO group M () is the set of essages that are trasitted by the FQode that trasits essage. The lowest priority of ay essage i the FIFO group M () is deoted by L. MAX MIN C ad C are the trasissio ties of the logest SUM ad shortest essages i the FIFO group, while C is the su of the trasissio ties of all of the essages i MIN the group. E is the shortest trasissio deadlie of ay essage i the group. We use f to deote the axiu bufferig tie fro essage beig queued util it is able to take part i 3 I the best case, the task could arrive the istat the evet occurs ad queue the essage iediately, whereas i the worst-case, there could be a delay of up to the task s period before it arrives ad the a further delay of up to the task s worst-case respose tie before it queues the essage. 4 Note this is a differet way of defiig respose tie to that used i [11] which icludes queuig jitter. To copesate for ot icludig queuig jitter i the respose tie, i this paper we copare respose ties with trasissio deadlies to deterie schedulability. priority-based arbitratio. For a FIFO-queued essage f equates to the tie fro the essage beig etered ito the FIFO queue to it becoig the oldest essage i that queue. For a priority-queued essage f = 0. As well as deteriig essage schedulability give a particular priority orderig, we are also iterested i effective priority assiget policies. Defiitio 1: Optial priority assiget policy: A priority assiget policy P is referred to as optial with respect to a schedulability test S ad a give etwork odel, if ad oly if there is o set of essages that are copliat with the odel that are deeed schedulable by test S usig aother priority assiget policy, that are ot also deeed schedulable accordig to test S usig policy P. We ote that the above defiitio is applicable to both sufficiet schedulability tests such as those give i sectios 3 ad 4, as well as exact schedulability tests. 3. Schedulability Aalysis with Priority Queues I this sectio, we recapitulate the siple sufficiet schedulability aalysis give i [11]. For etworks of PQodes, coplyig with the schedulig odel give i sectio 2, CAN effectively ipleets fixed priority opre-eptive schedulig. I this case, Davis et al. [11] showed that a upper boud o the respose tie R of each essage ca be foud by coputig the axiu queuig delay w usig the followig fixed poit iteratio: J k + τ bit = ax( B, C ) + C k (2) T k hp( ) k where τ bit is the trasissio tie for a sigle bit, ad B is the blockig factor described below. Iteratio starts with a suitable iitial value such as w 0 = C, ad cotiues util +1 either w + C > E i which case the essage is ot +1 schedulable, or w = i which case the essage is schedulable ad its worst-case respose tie is give by: +1 R = + C (3) As CAN essage trasissio is o-pre-eptable, the trasissio of a sigle lower priority essage ca cause a delay of up to B (referred to as direct blockig) betwee essage beig queued ad the first tie that essage could be etered ito arbitratio o the bus. B represets the axiu blockig tie due to lower priority essages: B = ax ( C ) (4) k lp( ) Alteratively, i soe cases, the trasissio of the previous istace of essage could delay trasissio of a higher priority essage causig a siilar delay (referred to as push-through blockig 5 ) of up to C. Both direct ad push-through blockig are accouted for by the 1 st ter o the RHS of (2). The 2 d ter represets iterferece fro higher priority essages that ca wi arbitratio over essage ad so delay its trasissio. Note that oce essage starts successful trasissio it caot be pre- 5 See [11] for a explaatio of why push-through blockig is iportat. k

4 epted, so the essage s overall respose tie is siply the queuig delay plus its trasissio tie (give by (3)). Usig (2) ad (3), egieers ca deterie upper bouds 6 o worst-case respose ties ad hece the schedulability of all essages o a etwork coprisig solely PQ-odes. Although the aalysis ebodied i (2) ad (3) is pseudo-polyoial i coplexity i practice it is tractable o a desktop PC for coplex systes with hudreds of essages. (A uber of techiques are also available for icreasig the efficiecy of such fixed poit iteratios [12]). 4. Schedulability Aalysis with FIFO Queues I this sectio, we derive sufficiet schedulability aalysis for essages o etworks with both PQ-odes ad FQ-odes. The aalysis we itroduce is FIFO-syetric, by this we ea that the sae worst-case respose tie is attributed to all of the essages i a FIFO group. We ote that FIFO-syetric aalysis icurs soe pessiis i ters of the worst-case respose tie attributed to the higher priority essages i a FIFO group; however, i practice this pessiis is likely to be sall. This is because the order i which essages are placed i a FIFO queue is udefied, ad so i the worst case, the highest priority essage i a FIFO group has to wait for a istace of each lower priority essage i the group to be trasitted Priority-queued essages We ow derive a upper boud o the worst-case queuig delay for a priority-queued essage, i a syste with both PQ-odes ad FQ-odes. I the case of systes with oly PQ-odes, Davis et al. [11] showed that the worst-case queuig delay for a priorityqueued essage occurs for a istace of that essage queued at the begiig of a priority level- busy period 7 that starts iediately after the logest lower priority essage begis trasissio. Further, this axial busy period begis with a so-called critical istat where essage is queued siultaeously with all higher priority essages ad the each of these higher priority essages is subsequetly queued agai after the shortest possible tie iterval. Equatio (2) provides a sufficiet upper boud o this worst-case queuig delay. The aalysis ebodied i (2) assues that higher priority essages are able to copete for access to the bus (i.e. eter bus arbitratio) as soo as they are queued; however, this assuptio does ot hold for FIFO-queued essages. Istead a FIFO-queued essage k ay have to wait for up to a axiu tie f k before it becoes the oldest essage i its FIFO queue, ad ca eter prioritybased arbitratio. A FIFO-queued essage k ca therefore be thought of as becoig priority queued after a additioal delay of f k. Stated otherwise, i ters of its 6 Equatio (2) is sufficiet rather tha exact due to the fact that push through blockig ay ot ecessarily be possible. 7 A priority level- busy period is a cotiguous iterval of tie durig which there is always at least oe essage of priority that has ot yet copleted trasissio. iterferece o lower priority essages, a FIFO-queued essage k ca be viewed as if it were a priority-queued essage with its jitter icreased by f k. (Note, we will retur to how f k is calculated for FIFO-queued essages later). A upper boud o the queuig delay for a priorityqueued essage ca therefore be calculated via the fixed poit iteratio give by (5). J k f k + τ bit = ax( B, C ) + C k (5) k hp( ) Tk As with (3), iteratio starts with a suitable iitial value such 0 +1 as w = C, ad cotiues util either w + C > E i +1 which case the essage is ot schedulable, or w = i which case its respose tie is give by: +1 R = + C (6) Note that the queuig delay ad respose tie are oly valid with respect to the values of f k used. We retur to this poit later FIFO-queued essages We ow derive a upper boud o the worst-case queuig delay for a FIFO-queued essage, i a syste with both PQ-odes ad FQ-odes. As our aalysis is FIFO-syetric, we will attribute the sae upper boud respose tie to all of the essages set by the sae FQ-ode. Our aalysis derives this sufficiet respose tie by cosiderig a arbitrary essage fro the FIFO group M (). For the sake of siplicity, we will still refer to this essage as essage ; however our aalysis will be idepedet of the exact choice of essage fro the FIFO group. At each stage i our aalysis we will ake worst-case assuptios, esurig that the derived respose tie is a correct upper boud. For exaple, we will frae our calculatio of the queuig delay w by assuig the lowest priority L of ay essage i the FIFO group. As every essage j i M () has D j T j the i a schedulable syste, whe ay arbitrary essage fro M () is queued, there ca be at ost oe istace of each of the other essages i M () ahead of it i the FIFO queue. The axiu trasissio tie of these essages, ad hece the axiu iterferece o a arbitrary essage, due to essages set by the sae FQ-ode, is therefore upper bouded by: SUM MIN C C (7) Idirect blockig could also occur due to the o-preeptive trasissio of a previous istace of ay oe of the essages i M (). This idirect blockig is upper MAX bouded by C. As a alterative, direct blockig could occur due to trasissio of ay of the essages of lower priority tha L set by other odes. Fially, i ters of iterferece fro higher priority essages set by other FQ-odes ad PQ-odes, the arguet about icreased jitter ade i the previous sectio applies, ad so the iterferece ter fro (5) ca agai be used. Cosiderig all of the above, a upper boud o the queuig delay for a arbitrary essage belogig to the FIFO group M () is give by the solutio to the followig

5 fixed poit iteratio: w + 1 MAX SUM = ax( B, ) + ( MIN L C C C ) + + J k + f k + τ bit Ck k hp L k M T k (8) ( ) ( ) Iteratio starts with a value of 0 = ax( B, MAX L C ) SUM MIN + ( C C ) ad cotiues util either +1 MIN MIN w + C > E i which case the set of essages +1 M () is declared uschedulable, or w = i which case all of the essages i M () are deeed to have a respose tie of: +1 MIN R = + C (9) Equatios (8) ad (9) ake the worst-case assuptio that iterferece fro higher priority essages ca occur up MIN to a tie C before trasissio of essage copletes. We ote that this is a pessiistic assuptio with respect to those essages belogig to the FIFO group that have trasissio ties 8 loger tha C. MIN 4.3. Schedulability test with arbitrary priorities We ow derive a schedulability test fro (5) & (6) ad (8) & (9). The basic idea is to avoid havig to cosider the potetially coplex iteractios betwee the FIFO queues of differet odes. This is achieved by abstractig the FIFO behaviour of essages set by other odes as siply additioal jitter f k before each essage k ca eter priority based arbitratio o the bus. Whe calculatig the respose tie of a give essage, we therefore eed oly cosider the behaviour of the ode that seds that essage (PQ-ode or FQ-ode) ad the bufferig delays of essages set by other odes 9. A upper boud o the bufferig tie f of a FIFOqueued essage is: MIN f = R C (10) Whe the priorities of essages i differet FIFO groups are iterleaved, this leads to a apparetly circular depedecy i the respose tie calculatios. For exaple, let ad k be the priorities of essages i two differet FIFO groups with iterleaved priorities (i.e. k hp( L ) ad hp( L k ) ). The respose tie R k of essage k, ad hece its bufferig tie f k, deped o the bufferig tie f of essage as hp( L k ) ; however, the bufferig tie f of essage depeds o its respose tie R which i tur depeds o f k as k hp( L ). This apparet proble ca be solved by otig that the respose ties calculated via (5) & (6) ad (8) & (9) are ootoically o-decreasig with respect to the bufferig ties, ad that the bufferig ties give by (10) are ootoically o- 8 I practice all essages set o CAN ofte have the axiu legth (8 data bytes) so as to iiise the relative overheads of the other fields i the essage (ID, CRC etc). I this case, o additioal pessiis is itroduced by this assuptio. 9 If the essage belogs to a PQ-ode, the the other essages set by the sae ode have bufferig delays of zero, if it belogs to a FQ-ode, the the bufferig delays for other essages set by the sae ode are ot eeded i the calculatios (8) &(9). decreasig with respect to the respose ties calculated via (8) & (9). Hece by usig a outer loop iteratio, ad repeatig respose tie calculatios util the bufferig ties o loger chage, we ca copute correct upper boud respose ties ad hece schedulability for all essages, as show i Algorith 1. (Note, to speed up the schedulability test, for each essage, the value of w coputed o oe iteratio of the while loop (lies 3 to 23) ca be used as a iitial value o the ext iteratio). 1 repeat = true 2 iitialise all f k = 0 3 while(repeat){ 4 repeat = false 5 for each priority, highest first{ 6 if ( is FIFO-queued){ 7 calc R accordig to Eqs (8) & (9) 8 if( R > E MIN ) { 9 retur uschedulable 10 } 11 if( f! = ){ 12 f = 13 repeat = true; 14 } 15 } 16 else { 17 calc R accordig to Eqs (5) & (6) 18 if( R > E MIN ) { 19 retur uschedulable 20 } 21 } 22 } 23 } 24 retur schedulable Algorith 1: FIFO Syetric Schedulability Test Algorith 1 provides a sufficiet schedulability test for FIFO-queued ad priority-queued essages i ay arbitrary priority orderig Partial priority orderig withi a FIFO group I this sectio, we cosider a appropriate priority orderig for essages withi a FIFO group. Defiitio 2: A FIFO-adjacet priority orderig is ay priority orderig whereby all of the essages sharig a FIFO queue are assiged adjacet priorities. Theore 1: If a priority orderig Q exists that is schedulable accordig to the FIFO-syetric schedulability aalysis of Algorith 1 the a schedulable FIFO-adjacet priority orderig P also exists. Proof: Let be a FIFO-queued essage that is ot the lowest priority essage i its FIFO group. Now cosider a priority trasforatio whereby essage is shifted dow i priority so that it is at a priority level iediately above that of the lowest priority essage i its FIFO group. We will refer to the old priority orderig as Q ad the ew priority orderig as Q. We observe fro (5) ad (8), that give the sae fixed

6 set of bufferig ties f k, the (i) the respose tie coputed for essage is the sae for both priority orderigs, ad (ii) the respose ties coputed for all other essages are o larger i priority orderig Q tha they are i priority orderig Q. Due to the utual ootoically o-decreasig relatioship betwee essage bufferig ties ad respose ties, ad the fact that Algorith 1 starts with all the bufferig ties set to zero, this eas that o every iteratio of Algorith 1, the respose ties ad bufferig ties coputed for each essage uder priority orderig Q are o larger tha those coputed o the sae iteratio for priority orderig Q. Hece if priority orderig Q is schedulable, the so is priority orderig Q. Applyig the priority trasforatio described above to every FIFO-queued essage that is ot the lowest priority essage i its FIFO group trasfors ay schedulable priority orderig Q ito a FIFO-adjacet priority orderig P, without ay loss of schedulability Theore 1 tells us that regardless of the priority assiget applied to priority-queued essages, we should esure that all of the essages that share a sigle FIFO queue have adjacet priorities. I ters of CAN essage IDs we ote that this does ot require that cosecutive values are used for the IDs, oly that there is o iterleavig with respect to the priorities of other essages. I practice essage IDs ca be chose to eet these requireets, while also providig appropriate bit patters for essage filterig Schedulability test for FIFO-adjacet priorities I this sectio, we derive a iproved schedulability test that is oly valid for FIFO-adjacet priority orderigs. Recall that Davis et al. [11] showed that the worst-case queuig delay for a priority-queued essage occurs withi the priority level- busy period that starts with a critical istat. Provided that a FIFO-adjacet priority orderig is used, the the sae situatio also represets the worst-case sceario whe higher priority essages are set by either PQ-odes or FQ-odes. This ca be see by cosiderig the iterferece o a priority-queued essage fro a higher priority FIFO-queued essage k. As essage k is of higher priority tha essage, the so are all of the other essages i the sae FIFO group (i.e. M (k) ). Thus ay essage i M (k) that is queued prior to the start of trasissio of essage will be set o the bus before essage, irrespective of the order i which the essages i M (k) are placed i the FIFO queue. I effect all of the additioal jitter o essage k is already accouted for by iterferece o essage fro other essages i the sae FIFO group ( M (k) ). I this case, there is o additioal jitter o essage k caused by essages of lower priority tha. Hece for each FIFO essage k, we ca set f k = 0, ad use (5) & (6) to calculate the queuig delay ad worstcase respose tie of each essage. The sae arguet applies whe we cosider the schedulability of a FIFOqueued essage. I this case we ca use (8) & (9) to calculate the queuig delay ad worst-case respose tie, with all bufferig ties f k = 0. Further, as the bufferig ties are all fixed at zero, a sigle pass over the priority levels is all that is eeded to deterie schedulability. I other words, lies of Algorith 1 ca be oitted whe cosiderig FIFO-adjacet priority orderigs. This revised schedulability test therefore doiates the test give i sectio 4.3 (i.e. Algorith 1 with lies preset). The siplified aalysis give i this sectio is siilar to that provided for FP/FIFO schedulig of flows i [23] ad for OSEK/VDX tasks i [4], [19]. 5. Priority Assiget Policies The schedulability test preseted i sectio 4.5 is applicable irrespective of the overall priority orderig, provided that essages sharig the sae FIFO queue are assiged adjacet priorities. Choosig a appropriate priority orderig aog the priority-queued essages ad the FIFO groups is however a iportat aspect of achievig overall schedulability ad hece effective realtie perforace. I this sectio, we cosider the assiget of essages to priority bads, where a priority bad coprises either a sigle priority level cotaiig oe priority-queued essage, or a uber of adjacet priority levels cotaiig a FIFO group of essages. We derive priority assiget policies that are optial with respect to the schedulability aalysis give i sectio Optial priority assiget Davis et al. [11], showed that, assuig solely priority queuig, Audsley s Optial Priority Assiget (OPA) algorith [1], [2] provides the optial priority assiget for CAN essages. We ow show that with a appropriate odificatio to hadle FIFO groups, Audsley s algorith is also optial with respect to the schedulability test give i sectio 4.5. The pseudo code for this OPA-FP/FIFO algorith is give i Algorith 2. Note that oly oe essage fro each FIFO group is cosidered i the iitial list, as oce this essage is assiged to a priority bad, the so are the other essages i the sae FIFO group. for each priority bad k, lowest first { for each essage sg i the iitial list { if sg is schedulable i priority bad k accordig to schedulability test S with all uassiged priorityqueued essages / other FIFO groups assued to be i higher priority bads { assig sg to priority bad k if sg is part of a FIFO group { assig all other essages i the FIFO group to adjacet priorities withi priority bad k } break (cotiue outer loop) } } retur uschedulable } retur schedulable Algorith 2: Optial Priority Assiget (OPA-FP/FIFO) I [14] Davis ad Burs showed that Audsley s OPA

7 algorith is optial with respect to ay schedulability test that eets three specific coditios. Accordig to Theore 1, we eed oly cosider the priority bads assiged to each priority-queued essage, ad each FIFO group (as all essages i a FIFO group have adjacet priorities i a optial priority orderig). We therefore restate these three coditios i the cotext of priority-queued essages ad FIFO groups. The three coditios refer to properties or attributes of the essages. Message properties are referred to as idepedet if they have o depedecy o the priority assiged to the essage. For exaple the logest trasissio tie, deadlie, ad iiu iter-arrival tie of a essage are all idepedet properties, while the worstcase respose tie typically depeds o the essage s priority ad so is a depedet property. Coditio 1: The schedulability of a essage / FIFO group idetified by, ay, accordig to test S, deped o ay idepedet properties of other essages / FIFO groups i higher priority bads tha, but ot o ay properties of those essages / FIFO groups that deped o their relative priority orderig. Coditio 2: The schedulability of a essage / FIFO group idetified by ay, accordig to test S, deped o ay idepedet properties of the essages / FIFO groups i lower priority bads tha, but ot o ay properties of those essages / FIFO groups that deped o their relative priority orderig. Coditio 3: Whe the priorities of ay two adjacet priority bads are swapped, the the essage / FIFO group beig assiged the higher priority bad caot becoe uschedulable accordig to test S, if it was previously schedulable i the lower priority bad. (As a corollary, the essage / FIFO group beig assiged the lower priority bad caot becoe schedulable accordig to test S, if it was previously uschedulable i the higher priority bad). Theore 2: The OPA-FP/FIFO algorith is a optial priority assiget algorith with respect to the FIFOsyetric schedulability test of sectio 4.5 (Algorith 1 with lies oitted). Proof: It suffices to show that coditios 1-3 hold with respect to the schedulability test give by Algorith 1 with lies oitted. Coditio 1: Ispectio of (5) & (6) ad (8) & (9), assuig all f k are fixed at zero, shows that the respose tie of each essage is depedet o the set of essages i higher priority bads, but ot o their relative priority orderig. Coditio 2: Ispectio of (5) & (6) ad (8) & (9), shows that the respose tie of each essage is depedet o the set of essages i lower priority bads via the direct blockig ter, but ot o their relative priority orderig. Coditio 3: Ispectio of (5) & (6) ad (8) & (9), assuig all f k are fixed at zero, shows that icreasig the priority bad of essage caot result i a loger respose tie. This is because although the direct blockig ter ca get larger with icreasig priority this is always couteracted by a decrease i iterferece that is at least as large; hece the legth of the queuig delay caot icrease with icreasig priority, ad so either ca the respose tie For N priority-queued essages / FIFO groups, the OPA-FP/FIFO algorith perfors at ost N(N-1)/2 schedulability tests ad is guarateed to fid a schedulable priority assiget if oe exists. It does ot however specify a order i which essages should be tried i each priority bad. This order heavily iflueces the priority assiget chose if there is ore tha oe orderig that is schedulable. I fact, a poor choice of iitial orderig ca result i a priority assiget that leaves the syste oly just schedulable. We suggest that, as a useful heuristic, priority-queued essages ad FIFO groups are tried at each priority level i order of trasissio deadlie (i.e. E or MIN E ), largest value first. This will result i a priority orderig reflectig trasissio deadlies if such a orderig is schedulable. Alteratively, approaches which result i a robust priority assiget ca be developed fro the techiques described i [13] TDMO-FP/FIFO priority assiget I idustrial practice, CAN cofiguratios are ofte desiged such that all of the essages are of the sae axiu legth (8 data bytes). This is doe to aeliorate the effects of the large overhead of the other fields (arbitratio, CRC etc) i each essage. Defiitio 3: Trasissio deadlie ootoic priority orderig for FP/FIFO (TDMPO-FP/FIFO) is a priority assiget policy that assigs priority bads to priority queued essages ad FIFO groups accordig to their trasissio deadlies; with a shorter trasissio deadlie iplyig a higher priority. (Recall that the trasissio deadlie of a FIFO group is give by the shortest trasissio deadlie of ay essage i that group). Figure 1 illustrates the TDMPO-FP/FIFO priority assiget policy. Theore 3: TDMPO-FP/FIFO is a optial policy for assigig priority-queued essages ad FIFO groups to priority bads, with respect to the sufficiet schedulability test give i sectio 4.5 (Algorith 1 with lies oitted), provided that all essages have the sae worstcase trasissio tie. Proof: See Appedix A. Corollary 1: For the case where all odes use priority queues ad all essages have the sae worst-case trasissio tie, TDMPO-FP-FIFO reduces to trasissio deadlie ootoic priority orderig, which is therefore a optial priority assiget policy with respect to the sufficiet schedulability test give by Davis et al. i [11] (recapitulated i sectio 3). Note that trasissio deadlie (i.e. Deadlie ius Jitter) ootoic priority orderig has also bee show to be a effective heuristic policy i the geeral case with ixed legth essages [13].

8 5.3. Priority iversio All of the essages i a FIFO group eed to have sufficietly high priorities that the essage with the shortest trasissio deadlie i the group ca still eet its deadlie. We have show that with the FIFO-syetric schedulability aalysis itroduced i this paper, the ost effective way to achieve this is to assig adjacet priorities to all of the essages i a FIFO group. Despite this, we ote that the use of FIFO queues still typically results i priority iversio with respect to the priority assiget that would be used if all odes ipleeted priority queues. The proble of priority iversio ca be see by cosiderig priority assiget accordig to the TDMPO- FP/FIFO policy, see Figure 1 below. With oly PQ-odes, the priority assiged to each essage would deped oly o its trasissio deadlie, with a loger deadlie iplyig lower priority. With FIFO queues, there are two fors of priority iversio: iteral ad exteral. Iteral priority iversio takes place withi a FIFO queue whe essages with loger trasissio deadlies eter the queue before, ad so are trasitted ahead of, essages with shorter trasissio deadlies. Exteral priority iversio occurs because all of the essages i a FIFO group effectively obtai priorities based o the shortest trasissio deadlie of ay essage i that group. This has the effect of creatig priority iversio with respect to essages set by other odes that have trasissio deadlies betwee the axiu ad iiu trasissio deadlies of essages i the FIFO group. This is illustrated i Figure 1, where essages causig exteral priority iversio are shaded i grey. FIFO group1 FQ-sg1: E = 10 FQ-sg2: E = 25 FQ-sg3: E = 100 FIFO group2 FQ-sg4: E = 50 FQ-sg5: E = 100 FQ-sg6: E = 1000 FQ-sg7: E = 1000 FQ-sg8: E = 1000 PQ-sg1: E = 5 PQ-sg2: E = 10 FQ-group1: E MIN = 10 PQ-sg3: E = 20 PQ-sg4: E = 50 FQ-group2: E MIN = 50 PQ-sg5: E = 100 PQ-sg6: E = 250 PQ-sg7: E = 250 PQ-sg8: E = 500 Higher priority Lower priority Figure 1: TDMPO-FP/FIFO priority orderig I Figure 1, observe that the essages withi each FIFO group have their priorities assiged accordig to trasissio deadlie ootoic priority assiget. We recoed this approach as although it does ot alter the sufficiet worst-case respose ties of the essages as calculated by our aalysis, i practice it could result i lower actual worst-case respose ties for those essages i the group that have shorter trasissio deadlies. 6. Case Study: Autootive To show that our priority assiget policies ad schedulability aalysis work with a real applicatio we aalysed a CAN bus architecture fro the autootive doai, first preseted i [22]. Figure 2 shows this architecture. The syste cosists of a 500 kbit/s CAN bus coectig 10 ECUs. There are a total of 85 essages set o the bus. The uber of essages set by each ECU is give by the aotatios i Figure 2. All essages are set strictly periodically ad have o offsets with respect to each other. We assued that the queuig jitter for each essage was 1% of its period. Figure 2: CAN bus architecture We copared five differet cofiguratios of the syste: Expt. 1: All ECUs used priority queues. Expt. 2: ECU3 ad ECU6 used FIFO queues ad the reaiig ECUs used priority queues. Expt. 3: All ECUs used FIFO queues. Expt. 4: All ECUs used priority queues, but the priority orderig was that established by Expt 3. Expt. 5: All ECUs used priority queues, but the priority orderig used was rado. I each experiet we deteried the lowest bus speed coesurate with a schedulable syste. The iiu bus speed was foud by a biary search with the essage priorities assiged accordig to the OPA-FP/FIFO algorith (Algorith 2) usig trasissio deadlie ootoic priority orderig as the reverse orderig for the iitial list. (For each FIFO group, oly the essage with the shortest trasissio deadlie was icluded i the iitial list). Based o the priority orderig obtaied, we aalysed ad siulated the syste assuig a 500 kbit/s bus. The siulated etwork operatig tie was 1 hour. We used the coercial siulator chrosim fro Ichro [10] to produce the siulatio results. There are four lies plotted o each of the graphs. The lies give the followig iforatio for each essage: (i) trasissio deadlie; (ii) worst-case respose tie coputed usig the aalysis give i sectio 4.5, assuig a 500 Kbit/s bus; (iii) axiu observed respose tie foud by siulatio, assuig a 500 Kbit/s bus, ad (iv) worst-case respose tie coputed usig the aalysis give i sectio 4.5, assuig the iiu schedulable bus speed for the cofiguratio. All of this data is plotted i s o the y-axis usig a logarithic scale. The x-axis o the graphs represets the priority order of the essages. Hece data for the essage assiged the highest priority i a particular cofiguratio appears o the LHS of the graph, while data for the lowest

9 priority essage appears o the RHS. Note the priority order is differet i each experiet. Figure 3 depicts the results of Expt. 1, where all ECUs used priority queues. I this case, the iiu bus speed was 277 kbit/s, ad the correspodig bus utilisatio 84.5%. We observe that with this bus speed, the 26 th highest priority essage oly just eets its deadlie. Further, the results of aalysis ad siulatio for a 500 kbit/s bus are close together. This is because the essages have o offsets, ad all of the ECUs used priority-based queues, hece there is very little pessiis i the aalysis, ad the siulatio captures the worst-case sceario well. Figure 4 depicts the results of Expt. 2, where ECU3 ad ECU6 used FIFO queues ad the other ECUs used priority queues. I this case, the iiu bus speed was 389 kbit/s, ad the correspodig bus utilisatio 60.1%. Our aalysis attributes the sae worst-case respose tie to all of the essages i a FIFO queue; this results i the horizotal segets of the aalysis lies i Figure 4. The first FIFO queue is the 12 essages set by ECU3, ad the secod, the 6 essages set by ECU6. The iiu trasissio deadlie for both FIFO queues was 13.8 s. Observe that i Figure 4 the results of aalysis ad siulatio are close together for the essages set via priority queues, whereas for the essages set via FIFO queue there are larger gaps. These gaps are predoiatly due to the siulatio ot capturig the worst-case sceario for all of the FIFO-queued essages. This is evidet fro the variability of the axiu respose ties obtaied via siulatio for essages i the sae FIFO group. Figure 4: Respose Ties (FQ ad PQ) Figure 5: Respose Ties (FQ oly) Figure 3: Respose Ties (PQ oly) Figure 6: Respose Ties (PQ oly, FQ priorities)

10 Figure 7: Respose Ties (PQ oly, rado priorities) Figure 5 depicts the results of Expt. 3, where all ECUs used FIFO queues. I this case, the iiu bus speed was 654 kbit/s, ad the correspodig bus utilisatio oly 35.8%. I cotrast to the Expt. 1 & 2, this cofiguratio was ot schedulable at a bus speed of 500 kbit/s. At 500 kbit/s, the 54 highest priority essages were foud to be schedulable by the aalysis. For the reaiig lower priority essages, soe appear to have worst-case respose ties that are less tha their deadlies; however, this does ot iply that such essages are schedulable. Oce a sigle higher priority essage is uschedulable, the the assuptios ade by the aalysis ay be broke ad the coputed worst-case respose ties o loger valid. For exaple, the aalysis assues that due to costraied deadlies at ost oe istace of each of the other essages i the sae FIFO group ay be ahead of a particular essage i the queue. If oe of the essages i a FIFO group caot eet its deadlie the this assuptio ay o loger hold. I Expt. 3, soe of the axiu respose ties observed i the siulatio are very low copared to the worst-case respose ties coputed by the aalysis. This is caused by differeces i the order i which essages eter the FIFO queues i the siulatio, copared to the assuptios ade by the aalysis. Figure 6 depicts the results of Expt. 4 which used the priority orderig obtaied i Expt. 3, but assued priority queues rather tha FIFO queues. I this case, the iiu bus speed required was 608 kbit/s, ad the correspodig bus utilisatio 38.5%. Copariso of these results with those fro Expt. 1 ad Expt. 3 shows that the ajority of the perforace degradatio caused by usig FIFO queues occurs as a result of uavoidable exteral priority iversio i the for of a disrupted priority orderig, rather tha as a cosequece of iteral priority iversio or pessiistic schedulability aalysis for FIFO queues. Fially, Expt. 5 exaied 1000 rado priority orderigs with o correlatio betwee essage priority ad trasissio deadlie. This experiet siulates assigig priorities to essages o the basis of the type of data or ECU, or ideed ay other etric that has little or o correlatio with essage trasissio deadlies. I this case, the ea value for the iiu bus speed required was 731 kbit/s (i. 618 kbit/s, ax. 750 kbit/s), ad the correspodig bus utilisatio 32.0% (ax. 37.8%, i. 31.2%). Figure 7 depicts the results of Expt. 5 for the worst of the rado priority orderigs, which required a iiu bus speed of 750 kbit/s to be schedulable. It is clear fro the graph, that it is the assiget of a low priority (80 th highest priority) to a essage with a short trasissio deadlie that results i the eed for such a high bus speed. Expt. 5 is directly coparable with Expt. 1 ad shows the iportace of appropriate priority assiget. I this case, arbitrary priority assiget icreased the iiu bus speed required by 163% while reducig the axiu schedulable bus utilisatio fro 84.5% to 32.0% (figures for the average case). The results of the experiets are suarised i Table 1 below. Table 1: Case Study: Suary of results Expt. Node type Priority order Mi bus speed Max bus util. 1 All PQ OPA 277 Kbit/s 84.5% 2 2 FQ, OPA-FP/FIFO 389 Kbit/s 60.1% 8 PQ 3 All FQ OPA-FP/FIFO 654 Kbit/s 35.8% 4 All PQ Priority orderig 608 Kbit/s 38.5% fro Expt. 3 5 All PQ Rado Kbit/s 32.0% 7. Experietal evaluatio I this sectio we explore further the effects that FIFO queues ad priority assiget policies have o the axiu bus utilisatio. Our experietal evaluatio exaied a syste with 8 odes ad 80 essages coected via a sigle CAN bus. We cosidered five differet cofiguratios of this etwork. I cofiguratio #1, all of the odes used priority queues. Cofiguratios #2, #3, ad #4 icreased the uber of odes usig FIFO queues fro 2, to 4 to 8 respectively. I cofiguratios #1 #4, essage priorities were assiged accordig to the TDMPO-FP/FIFO policy as depicted i Figure 1. (As all the essages were of the sae legth, this priority orderig was optial). I cotrast, i cofiguratio #5, essage priorities were assiged at rado, ad all odes used priority queues. To exaie the perforace of these five cofiguratios, we radoly geerated 10,000 sets of essages as follows: o The period of each essage was chose accordig to a log-uifor distributio fro the rage s; thus geeratig a equal uber of essages i each tie bad (e.g s, s etc.). o o The deadlie of each essage was equal to its period. The jitter of each essage was chose accordig to a uifor rado distributio i the rage 2.5s to 5s. 10 Values are the average for 1000 rado orderigs.

11 o Each essage cotaied 8 data bytes. o Each essage was radoly allocated to oe of the 8 odes o the etwork, thus o average, each ode trasitted 10 essages. o All essages were assued to have 11-bit idetifiers. For each cofiguratio, we coputed the axiu bus utilisatio for each essage set. This was doe via a biary search cobied with the schedulability aalysis give i sectios 3 ad 4. The solid lies i Figure 8 illustrate the frequecy distributio of the axiu bus utilisatio across the 10,000 essage sets for each of the five cofiguratios. Fro Figure 8, it is clear that the use of FIFO queues sigificatly degrades the real-tie perforace of the etwork. With all eight odes usig priority queues (#1), the ea value of the axiu bus utilisatio was 89.5%. With two odes usig FIFO queues (#2), this reduced to 62.7%, ad with four odes usig FIFO queues (#3) it further reduced to 44.9%. Fially, with all eight odes usig FIFO queues (#4) the ea value of the axiu bus utilisatio degraded to just 28.4%. Worse still was rado priority assiget (# 5) with a ea value of just 18.4%; despite usig priority queues. Figure 8 also shows results for the priority orderigs obtaied fro cofiguratios #2, #3, ad #4, but assuig that all odes use priority queues. These results are labelled #2a, #3a, ad #4a respectively (dashed lies). The differece betwee cofiguratios #1, #2a, #3a, ad #4a is idicative of the perforace degradatio caused by the FIFO queues due to exteral priority iversio (i.e. priority iversio with respect to essages set by other odes). By cotrast, the differece betwee the pairs of cofiguratios #2 #2a, #3 #3a, ad #4 #4a is idicative of the perforace degradatio caused by the FIFO queues due to iteral priority iversio (i.e. priority iversio with respect to essages set by the sae ode), ad also potetial pessiis i the schedulability aalysis for FIFO queues. As expected, the degradatio i perforace due to exteral priority iversio is uch larger tha that due to iteral priority iversio, which affects oly a liited uber of essages. We repeated our experietal evaluatio of a 8 ode syste for essage sets of size 20 ad 40. The for of the results ad the broad coclusios that ca be draw fro the reaied the sae as with essage sets of size 80. However, with fewer essages to radoly allocate to each ode, the perforace degradatio due to each FIFO queue becae soewhat saller. (This is expected as i the liit, with just oe essage per ode, FIFO ad priority queues are equivalet). Results for essage sets of sizes 20, 40 ad 80 are suarised i Table 2 ad depicted i Figure 8, Figure 9, ad Figure 10 respectively. Table 2: Evaluatio: Message sets of size 20 Cofig Node Priority Mea of Max. bus util. type order =20 =40 =80 1 All PQ TDMPO 86.8% 88.4% 89.5% 2 2 FQ, TDMPO- 72.7% 68.1% 62.7% 8 PQ FP/FIFO 3 4 FQ, 4 TDMPO- 61.6% 53.6% 44.9% PQ FP/FIFO 4 All FQ TDMPO- 46.5% 36.9% 28.4% FP/FIFO 5 All PQ Rado 26.1% 21.5% 18.4% Frequecy PQ - Rado Priorities 4. FQ (All FIFO odes) 3. FQ ad PQ (Four FIFO odes) 5. PQ - Rado Priorities 4. FQ (All FIFO odes) 4a. PQ (Priorities fro 4.) 3. FQ ad PQ (Four FIFO odes) 3a. PQ (Priorities fro 3.) 2. FQ ad PQ (Two FIFO odes) 2a. PQ (Priorities fro 2.) 1. PQ (No FIFO odes) 2. FQ ad PQ (Two FIFO odes) 1. PQ (No FIFO odes) Breakdow Utilisatio Figure 8: Frequecy distributio of ax. bus utilisatio (8 odes, 80 essages, 10,000 essage sets)

12 Frequecy PQ - Rado Priorities 4. FQ (All FIFO odes) 5. PQ - Rado Priorities 4. FQ (All FIFO odes) 4a. PQ (Priorities fro 4.) 3. FQ ad PQ (Four FIFO odes) 3a. PQ (Priorities fro 3.) 2. FQ ad PQ (Two FIFO odes) 2a. PQ (Priorities fro 2.) 1. PQ (No FIFO odes) 1. PQ (No FIFO odes) FQ ad PQ (Four FIFO odes) 2. FQ ad PQ (Two FIFO odes) Breakdow Utilisatio Figure 9: Frequecy distributio of ax. bus utilisatio (8 odes, 40 essages, 10,000 essage sets) Frequecy PQ - Rado Priorities 5. PQ - Rado Priorities 4. FQ (All FIFO odes) 4a. PQ (Priorities fro 4.) 3. FQ ad PQ (Four FIFO odes) 3a. PQ (Priorities fro 3.) 2. FQ ad PQ (Two FIFO odes) 2a. PQ (Priorities fro 2.) 1. PQ (No FIFO odes) 1. PQ (No FIFO odes) 4. FQ (All FIFO odes) 2. FQ ad PQ (Two FIFO odes) 3. FQ ad PQ (Four FIFO odes) Breakdow Utilisatio Figure 10: Frequecy distributio of ax. bus utilisatio (8 odes, 20 essages, 10,000 essage sets) 8. Suary ad Coclusios The ajor cotributio of this paper is the derivatio of sufficiet respose tie aalysis for CAN where soe of the odes o the etwork ipleet FIFO queues, while others ipleet priority queues. This aalysis is FIFOsyetric i that it attributes the sae worst-case respose tie (easured fro the tie a essage is queued i the sedig ode util it is received by other odes o the bus) to all of the essages that share the sae FIFO. For this schedulability aalysis, we proved that it is optial to assig adjacet priorities to essages that share the sae FIFO. We odified Audsley s Optial Priority Assiget algorith to provide a overall priority assiget policy (OPA-FP/FIFO) that is optial with respect to our aalysis for both priority-queued essages ad groups of essages

13 that share a FIFO. Further, we showed that a siple policy based o trasissio deadlies (TDMPO-FP/FIFO), depicted i Figure 1, is optial with respect to our aalysis for the specific case whe all essages are of the sae legth. Although this paper provides schedulability aalysis for CAN assuig FIFO queues, we caot recoed the use of such queues. By copariso with priority queues, FIFO queues ievitably cause priority iversio which is detrietal to real-tie perforace. The use of FIFO queues icreases the iiu bus speed ecessary to esure that all deadlies are et. This was illustrated i our case study where allowig just two ECUs (sedig 18 out of the 85 essages) to use FIFO queues icreased the iiu bus speed required fro 277 kbit/s with priority queues to 389 kbit/s, a 40% icrease. With all ECUs usig FIFO queues, the iiu bus speed required icreased to 654 kbit/s; a icrease of over 130%. Usig FIFO queues reduces the axiu bus utilisatio achievable before ay deadlies are issed, thus liitig the scope for extedig a syste by addig further essages without havig to icrease bus speed. I our case study, the axiu bus utilisatio with priority queues was 84.5%, this reduced to 60.1% whe two ECUs used FIFO queues, ad to just 35.8% whe all of the ECUs used FIFO queues. These figures were backed-up by our experietal evaluatio of a eight ode syste with 80 essages. This evaluatio of 10,000 radoly geerated essage sets showed a degradatio i the ea value of the axiu bus utilisatio fro 89.5% with all odes usig priority queues, to 62.7% with two odes usig FIFO queues, to 44.9% with four odes usig FIFO queues, to just 28.4% with all eight odes usig FIFO queues. Such reductios i achievable utilisatio ot oly icrease the iiu bus speed required to obtai a schedulable etwork, but also decrease the robustess of the etwork to errors that result i essage re-trasissio. We recoed that CAN device drivers / software protocol layers ipleet priority-based queues, rather tha FIFO queues wheever possible. FIFO queues are appealig because they are sipler to ipleet ad ake the device driver appear ore efficiet; however, this perceived local gai typically coes at the expese of uderiig the priority-based essage arbitratio schee used by CAN, ad sigificatly degradig the overall real-tie perforace capability of the etwork. We ote that the degree of priority iversio caused ad hece the degradatio i perforace due to usig FIFO queues is lower whe oly a few essages use each FIFO queue or alteratively whe the essages that use each FIFO queue have siilar trasissio deadlies. Uder these circustaces, the use of FIFO queues alog with appropriate priority assiget ay result i a satisfactory solutio. If o the other had, FIFO queues are used for large ubers of essages with a wide rage of trasissio deadlies, the this ca be expected to have a sigificat detrietal ipact o etwork perforace. For ECUs that act as a gateway fro oe CAN bus to aother ad thus have a large uber of essages to trasit, if a priority queue ipleetatio is ot possible, the syste desigers ay wish to cosider usig ultiple FIFO queues each utilisig a separate hardware trasit buffer. A allocatio of essages to these ultiple FIFO queues ca the ai to avoid assigig essages with widely differig trasissio deadlies to the sae FIFO queue, while also keepig the uber of essages i each FIFO queue relatively sall. This approach ca result i sigificatly higher etwork perforace tha the alterative of usig a sigle FIFO queue. The schedulability aalysis ad priority assiget policies give i this paper provide the tools ecessary to ivestigate such tradeoffs. Fially, both our case study ad experietal evaluatio cofired that appropriate priority assiget is vital to obtaiig effective real-tie perforace fro Cotroller Area Networks. Usig a rado priority assiget policy, represetative of priority assiget based o the type of data ad ECU, or ideed ay other etric that has little or o correlatio with trasissio deadlies, icreased the iiu bus speed required fro 277 kbit/s to 731 kbit/s, ad reduced the axiu bus utilisatio fro 84.5% to just 32.0% i the case study, as copared to a optial priority assiget policy. This data was backed up by our experietal evaluatio of a eight ode syste with 80 essages. Here, for essage sets of size 80, such a priority assiget policy resulted i values for the axiu bus utilisatio, for 10,000 radoly geerated essage sets, i the rage 8% to 45% with a ea of just 18.4%, copared to a rage of 69% to 96% ad a ea of 89.5% whe a optial priority assiget policy was used. We therefore strogly recoed that i Cotroller Area Networks, essage IDs are assiged usig a optial or ear optial priority orderig reflectig essage trasissio deadlies. Ackowledgeets The authors would like to thak Ala Burs for his coets o a previous draft of this paper. This work was partially fuded by the UK EPSRC fuded Tepo project (EP/G055548/1), the EU fuded ArtistDesig Network of Excellece, the Gera Research Foudatio, ad the Carl Zeiss Foudatio. 9. Refereces [1] N.C. Audsley, "Optial priority assiget ad feasibility of static priority tasks with arbitrary start ties", Techical Report YCS 164, Dept. Coputer Sciece, Uiversity of York, UK, Dec [2] N.C. Audsley, O priority assiget i fixed priority schedulig, Iforatio Processig Letters, 79(1): 39-44, May [3] Bosch. CAN Specificatio versio 2.0. Robert Bosch GbH, Postfach , D Stuttgart, [4] F. Bibard ad L. George. FP/FIFO feasibility coditios with kerel overheads for periodic tasks o a evet drive OSEK syste. I Proceedig of ISORC, [5] I. Broster, A. Burs, G. Rodríguez-Navas, Probabilistic Aalysis of CAN with Faults, I Proceedigs of the 23rd IEEE Real-Tie Systes Syposiu (RTSS'02), pp , Deceber, 2002.

14 [6] I. Broster ad A. Burs. A Aalysable Bus-Guardia for Evet- Triggered Couicatio. I Proceedigs of the 24th Real-tie Systes Syposiu, pp , IEEE Coputer Society Press, Deceber [7] I. Broster. Flexibility i depedable couicatio. PhD Thesis, Departet of Coputer Sciece, Uiversity of York, UK, August [8] I. Broster, A. Burs ad G. Rodriguez-Navas, Tiig aalysis of real-tie couicatio uder electroagetic iterferece, Real-Tie Systes, 30(1-2) pp , May [9] L. Casparsso, A. Rajak, K. Tidell, ad P. Malberg. Volcao - a revolutio i o-board couicatios. Volvo Techology Report, 1998/1. [10] chrosim. [11] R.I. Davis, A. Burs, R.J. Bril, ad J.J. Lukkie. Cotroller Area Network (CAN) Schedulability Aalysis: Refuted, Revisited ad Revised. Real-Tie Systes, Volue 35, Nuber 3, pp , April [12] R.I. Davis, A. Zabos, A. Burs, "Efficiet Exact Schedulability Tests for Fixed Priority Real-Tie Systes. IEEE Trasactios o Coputers IEEE Coputer Society Digital Library. IEEE Coputer Society, Septeber 2008 (Vol. 57, No. 9) pp [13] R.I. Davis, A. Burs "Robust priority assiget for essages o Cotroller Area Network (CAN). Real-Tie Systes, Volue 41, Issue 2, pages , February [14] R.I. Davis ad A. Burs, "Iproved Priority Assiget for Global Fixed Priority Pre-eptive Schedulig i Multiprocessor Real-Tie Systes. Real-Tie Systes, Volue 47, Issue 1, pages 1-40, [15] M. Di Natale, Uderstadig ad usig the Cotroller Area etwork ist.eecs.berkeley.edu/~ee249/fa08/lectures/ hadout_cabus2.pdf. [16] M. Di Natale, Evaluatig essage trasissio ties i Cotroller Area Networks without buffer preeptio, I 8th Brazilia Workshop o Real-Tie Systes, [17] J. Ferreira, A. Oliveira, P. Foseca, J. A. Foseca. A Experiet to Assess Bit Error Rate i CAN. I Proceedigs of 3rd Iteratioal Workshop of Real-Tie Networks (RTN2004), pp , Cataia, Italy. Jue [18] H. Hasso, T. Nolte, C. Norstro, ad S. Puekkat. Itegratig Reliability ad Tiig Aalysis of CAN-based Systes. IEEE Trasactio o Idustrial Electroics, 49(6): , Deceber [19] P. Hladik, A. Deplache, S. Faucou, ad Y. Triquet, Schedulability aalysis of OSEKNVDX applicatios. I Proceedigs RTNS, [20] D.A. Kha, R.J. Bril, N. Navet, "Itegratig hardware liitatios i CAN schedulability aalysis," IEEE Iteratioal Workshop o Factory Couicatio Systes (WFCS) pp , May doi: /WFCS [21] ISO Road Vehicles iterchage of digital iforatio cotroller area etwork (CAN) for high-speed couicatio, ISO Stadard-11898, Iteratioal Stadards Orgaisatio (ISO), Nov [22] S. Kolla, V. Pollex, K. Kepf, F. Sloka, M. Traub, T. Boe, J. Becker (2010). "Coparative Applicatio of Real-Tie Verificatio Methods to a Autootive Architecture, " I Proceedigs of the 18th Iteratioal Coferece o Real-Tie ad Network Systes, Nov [23] S. Marti, P. Miet, L. George, No pre-eptive Fixed Priority schedulig with FIFO arbitratio: uiprocessor ad distributed cases, Techical Report No. 5051, INRIA Rocquecourt, Dec [24] A. Meschi, M. DiNatale, ad M. Spuri, Priority iversio at the etwork adapter whe schedulig essages with earliest deadlie techiques, i Proceedigs of Euroicro Coferece o Real-Tie Systes, Jue [25] T. Nolte. Share-drive schedulig of ebedded etworks, PhD Thesis, Malardale Uiversity Press, May [26] T. Nolte, H. Hasso, ad C. Norstro. Miiizig CAN resposetie aalysis jitter by essage aipulatio. I Proceedigs 8 th IEEE Real-Tie ad Ebedded Techology ad Applicatios Syposiu (RTAS'02), pp , Septeber [27] T. Nolte, H. Hasso, ad C. Norstro, "Probabilistic worst-case respose-tie aalysis for the Cotroller Area Network." I Proceedigs of the 9th IEEE Real-Tie ad Ebedded Techology ad Applicatios Syposiu (RTAS'03), pp , May [28] J. Rufio, P. Verissio, G. Arroz, C. Aleida, ad L. Rodrigues. Fault-tolerat broadcasts i CAN. I Digest of Papers, The 28th IEEE Iteratioal Syposiu o Fault-Tolerat Coputig (FTCS 98). pp , Jue [29] STMicroelectroics, AN1077 Applicatio ote. Overview of ehaced CAN cotrollers for the ST7 ad ST9 MCUS 2001 (available fro [30] K.W. Tidell ad A. Burs. Guarateeig essage latecies o Cotroller Area Network (CAN), I Proceedigs of 1st Iteratioal CAN Coferece, pp. 1-11, Septeber [31] K.W. Tidell, A. Burs, ad A. J. Welligs. Calculatig Cotroller Area Network (CAN) essage respose ties. Cotrol Egieerig Practice, 3(8): , August [32] K.W. Tidell, H. Hasso, ad A.J. Welligs. Aalysig real-tie couicatios: Cotroller Area Network (CAN). I Proceedigs 15th Real-Tie Systes Syposiu (RTSS 94), pp IEEE Coputer Society Press, Deceber [33] A. Zuhily ad A. Burs, Optiality of (D-J)-Mootoic Priority Assiget. Iforatio Processig Letters, o. 103, pp , Apr Appedix A: Trasissio deadlie ootoic priority assiget I this appedix, we show that the TDMPO-FP/FIFO priority assiget policy is optial, with respect to the sufficiet schedulability test give i sectio 4.5 (i.e. Algorith 1 with lies oitted) whe all essages have the sae worst-case trasissio tie (C). Corollary A.1: For etworks where all of the essage trasissio ties are the sae, the the blockig factor, used i both the sufficiet schedulability test give by Davis et al. i [11] (recapitulated i sectio 3) ad the sufficiet schedulability tests give i sectio 4 of this paper, is the sae for every essage, ad is equal to the worst-case essage trasissio tie (C). Lea A.1: For a set of essages that all have the sae worst-case trasissio tie (C). Let i ad j be the idices of two adjacet priority bads i a priority orderig that is schedulable accordig to the sufficiet schedulability test give i sectio 4.5 (i.e. Algorith 1 with lies oitted). Assue that i is of higher priority tha j, ad that the trasissio deadlie E X of the priority-queued essage / FIFO group (X) iitially i priority bad i is loger tha the trasissio deadlie E Y of priority-queued essage / FIFO group (Y) iitially i priority bad j. If the priorities of X ad Y are swapped, so that X is i the lower priority bad j, ad Y is i the higher priority bad i, the X reais schedulable. Proof: Let R Y, j be the respose tie of Y i priority bad j, (with X i the higher priority bad i). Siilarly, let R X, j be the respose tie of X i priority bad j, (with Y i the higher priority bad i). As Y is schedulable whe it is i the lower priority bad, the, RY, j EY, thus as E Y < E X, it follows that to prove the Lea, we eed oly show that R X, j RY, j. Further, as all essages have the sae worstcase trasissio tie (C), ad so the respose ties are equal to the queuig delays plus C, we eed oly copare the two queuig delays, referred to for coveiece as w X, j ad w Y, j. Below we give forulae for w X, j ad w Y, j based o (5) & (6) ad (8) & (9). We have separated out the iterferece ters for X ad Y. Further, we use B ( j) to represet the blockig factor, ad I ( i, w) to represet the

15 iterferece fro essages i higher priority bads. B( j) = ax( B j, C) = C w + J k + τ bit I i w C k hp i Tk (, ) = ( ) (i) Queuig delay w X, j (siplified by cacellig out the blockig factor C ad the C fro ( C X SUM C )) is give by: w 1 X, j + J k + τ + SUM bit wx, j = C X + C + I( i, w) (A.1) k Y T k Note, i (A.1), if X is a priority-queued essage, the C X SUM = C, also, if Y is a priority-queued essage, the there is oly oe essage k Y preset i the suatio ter; siilarly for (A.2) below. (ii) Queuig delay w Y, j : w 1 Y, j + J k + τ + SUM bit wy, j = CY + C + I( i, w) (A.2) k X T k We ca siplify (A.2) by otig that as Y is schedulable accordig to the assuptio give i the Lea, the w + C E < E = i( D J ) i( T J ) Y, j Y X k k X k k k X Hece, at ost oe istace of each essage i X ca cotribute to the iterferece ter ad so we have: + 1 SUM SUM w Y, j = CY + C X + I( i, w) (A.3) Now let us cosider the iterative solutio to (A.1), for all values of w E C < i( T J ) τ X, j Y k k bit, k X oly oe istace of each essage i Y ca cotribute to the iterferece ter. Hece for wx, j EY C, (A.1) reduces to: + 1 SUM SUM w X, j = C X + CY + I( i, w) (A.4) Equatios (A.3) ad (A.4) are the sae, hece as we kow that (A.3) coverges o a value wy, j EY C, the (A.4) ust also coverge o the sae value, hece w X, j = wy, j, ad so R X, j = RY, j Theore 3: TDMPO-FP/FIFO is a optial policy for assigig priority-queued essages ad FIFO groups to priority bads, with respect to the sufficiet schedulability test give i sectio 4.5 (Algorith 1 with lies oitted), provided that all essages have the sae worstcase trasissio tie. Proof: We prove the theore by showig that ay orderig Q of priority bads that is schedulable accordig to the sufficiet schedulability test give i sectio 4.5 ca be trasfored ito a TDMPO-FP/FIFO priority orderig without ay loss of schedulability. Let i ad j be the idices of two adjacet priority bads i a orderig that is schedulable accordig to the sufficiet schedulability test give i sectio 4.5. Assue that i is of higher priority tha j, ad that the trasissio deadlie E of the priority-queued essage / FIFO group (X) i X k priority bad i is loger tha the trasissio deadlie E Y of the priority-queued essage / FIFO group (Y) i priority bad j. We ow cosider what happes to the schedulability of all of the essages i the syste whe we swap the priorities of X ad Y (i.e. whe we place X i the lower priority bad j, ad Y i the higher priority bad i) to create priority orderig Q. There are four cases to cosider: 1. Priority bads with higher priority tha i ( h hp(i) ): Ispectio of (5) & (6) ad (8) & (9) shows that the respose ties of each of the essages i these bads is the sae i priority orderig Q as it is i priority orderig Q. This is because the priority orderig of the essages with higher priorities tha h is uchaged ad the direct blockig factor due to the set of essages with lower priority tha h depeds oly o the set of essages lp (h) ad ot o their relative priority orderig, ad is i ay case equal to C for all priority bads. All of the essages i bads with priorities higher tha j are therefore schedulable i priority orderig Q. 2. Priority bad i: Y was previously schedulable i the lower priority bad j. Shiftig Y up i priority above X results i o chage to the blockig factor, but reoves iterferece due to X, hece the worst-case respose tie for Y ca be o greater tha it was i priority orderig Q, Y is therefore schedulable i priority orderig Q. 3. Priority bad j: Lea A.1 proves that X is schedulable i priority bad j. 4. Priority bads with lower priority tha j ( l hp( j) ): Ispectio of (5) & (6) ad (8) & (9) shows that the respose ties of each of these essages is the sae i priority orderig Q as it is i priority orderig Q. This is because the set of essages i higher priority bads is the sae i both orderigs, ad the iterferece due to higher priority essages does ot deped o their relative priority orderig. Further, the blockig factor due to the set of essages with lower priority tha l depeds oly o the set of essages lp (l) ad ot o their relative priority orderig, ad is i ay case equal to C for all priority bads. All of the essages i bads with priorities lower tha j are therefore schedulable i priority orderig Q. By repeatedly swappig the priorities of ay two adjacet priority bads that are ot i TDMPO-FP/FIFO priority order, ay arbitrary schedulable priority orderig Q ca be trasfored ito a TDMPO-FP/FIFO priority orderig without ay loss of schedulability.