Frame coding in dynamic segment - Real-time and Safety-critical Embedded Systems

DTS: Dynamic Trailing Sequence

To indicate the exact point in time of

transmitter's minislot action point

Prevents premature Channel idle detection

DTS is sent after FES (Frame End Sequence).

• extended byte from CRC, appending to the bit stream

• FES to the end

• DTS to the end, if dynamic segment

6.22. Symbol coding

Coding of two symbols are the same:

CAS (Collision Avoidance Symbol) and

MTS (Media Access Test Symbol)

Wakeup Symbol (WUS) This is not High, it is Idle!

6.23. Sampling and majority voting

• every node samples RxD many times within a bit duration

• majority voting within a sliding window (5 width voting window)

• suppresses glitches (spikes) coming from transient or disturbance(Assuming that the duration is short compared to bit duration)

• this is the timing of start of bit, not the clock for oversampling RxD!

• Receiver counts the received samples (oversampled) within bit duration

• If VotedVal High Low, sample counter is set to 2 at the next sample

• synchronization is accomplished only if enabled

6.25. Clock synchronization

Every node has a local clock

Assumptions:

• every node within the distributed system has approximately the same view of time

• difference between any two nodes cannot exceed a tolerance Distributed clock synchronization mechanism

6.26. Timing hierarchy

• microtick: derived from CC's internal timer (given prescaler, compare-match etc.) implementation might vary, controller specific

• macrotick: synchronized on a cluster-wide basis

Error model:

• offset (phase)

• rate (frequency) Both are corrected

Measurement: every node measures the time difference between the true and expected sync edge in microticks.

Last N is collected in a table.

6.28. Offset correction

• Measurement

• Selection of stored deviation values(only current communication cycle is used)

• I no sync frame error

• Calculation of fault-tolerant midpoint

• Within limit? If not crop

• An optional external correction (supplied by host)

6.29. Fault-tolerant midpoint algorithm

• determination of

• omitting the smallest and largest differences

• from the remaining: arithmetic mean of the smallest and larges, truncated towards zero (even if it is negative)

6.30. Rate correction

Principle:

• Measurement: time difference between two succeeding cycles are measured

• Last N time period measurements in a table

• If no sync frame error

• Calculation of fault-tolerant midpoint

• Damping value is applied

• smaller then a damping limit? no correction

• larger then a damping limit? correction = correction-limit

• Within upper/lower limits? If not crop

• An optional external correction (supplied by host)

6.31. External clock synchronization

If every node is in sync. within the cluster, different clusters can drift apart from each other

(clock sync. assures only consistency within the cluster)

host-determined external offset and rate correction for both clusters at the same time

Clock correction: adjustment of microticks within a macrotick

6.32. Wakeup

• Every bus driver needs to have stable power supply

Whole cluster needs to be awaken (wakeup)

• startup on both channels (synchronously)

• startup initiation: coldstart can be initiated only by coldstart node Coldstart:

• Collision Avoidance Symbol (CAS)

• in the first 4 cycle only this node can send messages

• first the other coldstart nodes integrate

• later the other (non coldstart) nodes integrate

6.34. Startup cont.

No. of coldstart nodes is

3, if No. of nodes 3

2, if No. of nodes 3

Startup frame is also a sync frame ď coldstart node is also a sync node At least two fault-free coldstart nodes are necessary for cluster startup

leading coldstart node: who actively starts the coldstart proc.

following coldstart node: coldstart node who integrates

Startup performed by coldstart nodes:

• coldstart startup initiation

• ends if there is stable communication between coldstart nodes Integration:

• at least 2 startup frame from different nodes

• integration can start during coldstart node startup, but might not finish until at least 2 coldstart nodes startup finishes

6.35. Node Local Bus Guardian

if both CC and BG enables it

If failure: fail-silent operation

The failure is not propagated

(sender is unmounted from bus)

BG: doesn't send,

only supervises timing

6.36. Central Bus Guardian

Verified failures:

• short-circuit and other bus errors

• sending at inappropriate time

CBG: needs to store static timing information

6.37. Central Bus Guardian cont.

• capable of decoding frames

• NOT capable of coding frames

• has own clock synchronization mechanism (same as in CC)

• distinguishes between various frame types(startup, sync etc.)

• can be cascaded

7. 7 Safety-critical systems

7.1. Safety-critical systems: Basic definitions

7.2. Introduction

• Safety-critical systems

• Informal definition: Malfunction may cause injury of people

• Safety-critical computer-based systems

• E/E/PE: Electrical, electronic, programmable electronic systems

• Control, protection, or monitoring

• EUC: Equipment under control

Railway signaling, x-by-wire, interlocking, emergency stopping, engine control, ...

7.3. Specialities of safety critical systems

• Special solutions to achieve safe operation

• Design: Requirements, architecture, tools, ...

• Verification, validation, and independent assessment

• Certification (by safety authorities)

• Basis of certification: Standards

• IEC 61508: Generic standard (for electrical, electronic or programmable electronic systems)

• DO178B: Software in airborne systems and equipment

• EN50129: Railway (control systems)

• EN50128: Railway (software)

• ISO26262: Automotive

• Other sector-specific standards: Medical, process control, etc.