to Develop Using the Benefits of Model-Based Design AUTOSAR Basic Software Modules Mohamed Soliman & Amjad Elshenawy

Transcription

1 Using the Benefits of Model-Based Design to Develop AUTOSAR Basic Software Modules Mohamed Soliman & Amjad Elshenawy Mathworks Automotive Conference 2016 Stuttgart, Sep., 21 st 2016 September 2016 September 2016 I 1

2 Agenda 1 2 Why use MBD for Developing AUTOSAR BSW Modules? CAN State Manager (CanSM) 3 Challenges Encountered in Developing CanSM using MBD 4 Results of Our Experiment September 2016 I 2

3 Agenda 1 2 Why use MBD for Developing AUTOSAR BSW Modules? CAN State Manager (CanSM) 3 Challenges Encountered in Developing CanSM using MBD 4 Results of Our Experiment September 2016 I 3

4 AUTOSAR Embraces Complexity Number of Basic SW Modules Number of Basic SW Modules X 1X R R R R R R R R R September 2016 I 4

5 AUTOSAR Embraces Complexity Number of Requirements Number of Requirements X 1X R R R R R R R R R September 2016 I 5

6 Characteristics of AUTOSAR Basic Software Modules Link-time Configuration Configuration of modules that are only available as object code (e.g. IP protection) Pre-compile Configuration Post-build Configuration Enabling/disabling optional functionality Highly Configurable Change the configuration after building the code (in the run time) September 2016 I 6

7 Characteristics of AUTOSAR Basic Software Modules cmp Com Context View «module» Rte::Rte «module» Dem::Dem «use» Com Rte_Cbk «use» «module» ComM::ComM Standard Interfaces and Standard Types Dem_ReportErrorStatus «module» Com::Com «use» «optional» Com_IpduGroup Det_ReportError «optional» Com_Init «module» BswM::BswM «mandatory» PduR_Com Com_Cbk «optional» «use optionally» «module» Det::Det «module» PduR::PduR «module» EcuM::EcuM September 2016 I 7

8 Motivations for using MBD for Developing AUTOSAR BSW Modules In our case MBD is selected to provide the following benefits: Shorter development time Better re-usability and maintainability of design / model. Improvement of the product quality Time Quality Cost September 2016 I 8

9 Agenda 1 2 Why use MBD for Developing AUTOSAR BSW Modules? CAN State Manager (CanSM) 3 Challenges Encountered in Developing CanSM using MBD 4 Results of Our Experiment September 2016 I 9

10 CAN State Manager One of the basic software communication stack modules. Dbg Dcm RTE Communication Services Communication Manager Generic NM Interface Responsible for managing the states of the Can networks. XCP IpduM PduR Can Transport Protocol Can State Manager CanNm No Communication Communication HW Abstraction Can Interface CanTrcv CanTrcv Full Communication Silent Communication DIO Driver Microcontroller Abstraction Layer (MCAL) SPI Handler Driver Microcontroller Can Driver September 2016 I 10

11 CAN State Manager State Machine Complexity stm CANSM_BSM_S_FULLCOM CANSM_BSM_S_TX_TIMEOUT_EXCEPTION stm CANSM_BSM CANSM_BSM_S_FULLCOM ExitPoint CHANGE_BR CHANGE_BR EntryPoint CANSM_BSM_S_TX_TIMEOUT_EXCEPTION CANSM_BSM_S_FULLCOM S_TX_TIMEOUT_EXCEPTION_PROCEED S_BUS_OFF_CHECK T_CC_STOPPED_TIMEOUT S_CC_STOPPED S_CC_STOPPED_WAIT EntryPoint /E_FULL_COM CANSM_BSM_S_PRE_FULLCOM T_NO_COM_MODE_REQUEST, T_REPEAT_MAX /E_PRE_NOCOM [G_FULL_COM_MODE_REQUESTED] /E_BR_END_FULL_COM T_SILENT_COM_MODE_REQUEST /E_FULL_TO_SILENT_COM [G_TX_ON] /E_TX_ON S_TX_OFF do / DO_SET_CC_MODE_STOPPED() T_CC_STOPPED_INDICATED T_BUS_OFF /E_BUS_OFF do / DO_SET_CC_MODE_STARTED() [G_CC_STOPPED_E_OK] S_CC_STARTED [G_BUS_OFF_PASSIVE] /E_BUS_OFF_PASSIVE T_CC_STOPPED_INDICATED S_NO_BUS_OFF T_CHANGE_BR_REQUEST /E_CHANGE_BR_BSWM_MODE ExitPoint To FULLCOM ExitPoint REPEAT_MAX T_FULL_COM_MODE_REQUEST ExitPoint NO_COM CANSM_BSM_S_CHANGE_BAUDRATE ExitPoint FULL_OR_SILENT_COM [G_SILENT_COM_MODE_REQUESTED] /E_BR_END_SILENT_COM T_FULL_COM_MODE_REQUEST /E_SILENT_TO_FULL_COM CANSM_BSM_S_SILENTCOM T_TX_TIMEOUT_EXCEPTION [G_CC_STARTED_E_OK] T_RESTART_CC_INDICATED T_CC_STARTED_TIMEOUT /E_TX_OFF T_CC_STARTED_INDICATED CANSM_BSM_S_TX_TIMEOUT_EXCEPTION S_CC_STARTED_WAIT T_RESTART_CC_INDICATED /E_TX_OFF CANSM_BSM_S_RESTART_CC_WAIT T_RESTART_CC_TIMEOUT [G_RESTART_CC_E_OK] ExitPoint TxTimeout T_CC_STARTED_INDICATED T_BUS_OFF /E_BUS_OFF T_FULL_COM_MODE_REQUEST CANSM_BSM_WUVALIDATION /E_PRE_NOCOM CANSM_BSM_S_TX_TIMEOUT_EXCEPTION CANSM_BSM_S_SILENTCOM_BOR T_STOP_WAKEUP_SOURCE T_START_WAKEUP_SOURCE T_START_WAKEUP_SOURCE ExitPoint TxTimeout T_BUS_OFF T_NO_COM_MODE_REQUEST, T_REPEAT_MAX /E_PRE_NO_COM CANSM_BSM_S_PRE_NOCOM CanSM_Init T_NO_COM_MODE_REQUEST /E_PRE_NOCOM CANSM_BSM_S_NOCOM do / DO_SET_CC_MODE_STARTED ExitPoint TxTimeout S_RESTART_CC ExitPoint CHANGE_BR /E_NOCOM CANSM_BSM_S_NOT_INITIALIZED PowerOn PowerOff September 2016 I 11

12 CAN State Manager Module Complexity 280 requirements. 26 Configuration parameters. 18 Provided Interfaces. September 2016 I 12

13 Agenda 1 2 Why use MBD for Developing AUTOSAR BSW Modules? CAN State Manager (CanSM) 3 Challenges Encountered in Developing CanSM using MBD 4 Results of Our Experiment September 2016 I 13

14 Pre-compile Configuration SWS_BSW_00029: If the BSW Module contains optional functionality, then this functionality shall be enabled (STD_ON) or disabled (STD_OFF) by a Pre-compile time configuration parameter. September 2016 I 14

15 Pre-compile Configuration Using Variant Subsystem to generate pre-compile configuration September 2016 I 15

16 Pre-compile Configuration Generate preprocessor conditional for with variant model blocks. September 2016 I 16

17 Standard Interfaces SRS_Can_01142 : The CAN State Manager shall offer a network abstract API to upper layer Example scenario: "Network status change upon Communication Manager module (ComM) request" «module» ComM «module» Nm «module» CanSM Request COMM_FULL_COMMUNICATION Std_ReturnType:=CanSM_RequestComMode(NetworkHandle,ComM_Mode:=COMM_FULL_COMMUNICATION) CanSM_RequestComMode(...)=E_OK COMM_FULL_COMMUNICATION indication September 2016 I 17

18 Standard Interfaces September 2016 I 18

19 Code Duplication SWS_BSW_00127: The BSW Module implementation shall avoid duplication of code. stm CANSM_BSM_WUVALIDATION stm CANSM_BSM_S_TX_TIMEOUT_EXCEPTION CANSM_BSM_WUVALIDATION S_TRCV_NORMAL [G_TRCV_NORMAL_E_OK] do / DO_SET_TRCV_MODE_NORMAL EntryPoint stm CANSM_BSM_WUVALIDATION S_TRCV_NORMAL_WAIT T_TRCV_NORMAL_TIMEOUT T_TRCV_NORMAL_INDICATED S_CC_STARTED do / DO_SET_CC_MODE_STARTED T_TRCV_NORMAL_INDICATED [G_CC_STARTED_E_OK] S_CC_STOPPED [G_CC_STOPPED_E_OK] do / DO_SET_CC_MODE_STOPPED T_CC_STOPPED_INDICATED T_CC_STARTED_TIMEOUT stm CANSM_BSM_WUVALIDATION T_CC_STOPPED_TIMEOUT T_CC_STOPPED_INDICATED S_CC_STARTED S_CC_STOPPED_WAIT S_CC_STARTED_WAIT CANSM_BSM_S_TX_TIMEOUT_EXCEPTION S_TX_TIMEOUT_EXCEPTION_PROCEED EntryPoint T_CC_STOPPED_TIMEOUT S_CC_STOPPED S_CC_STOPPED_WAIT do / DO_SET_CC_MODE_STOPPED() stm CANSM_BSM_S_TX_TIMEOUT_EXCEPTION [G_CC_STOPPED_E_OK] S_CC_STARTED T_CC_STOPPED_INDICATED T_CC_STOPPED_INDICATED do / DO_SET_CC_MODE_STARTED() stm CANSM_BSM_S_TX_TIMEOUT_EXCEPTION S_CC_STARTED do / DO_SET_CC_MODE_STARTED() [G_CC_STARTED_E_OK] T_CC_STARTED_TIMEOUT [G_CC_STARTED_E_OK] S_CC_STARTED_WAIT T_CC_STARTED_TIMEOUT T_CC_STARTED_INDICATED S_CC_STARTED_WAIT do / DO_SET_CC_MODE_STARTED [G_CC_STARTED_E_OK] T_CC_STARTED_INDICATED T_CC_STARTED_INDICATED T_CC_STARTED_TIMEOUT S_CC_STARTED_WAIT WAIT_WUVALIDATION_LEAVE T_CC_STARTED_INDICATED ExitPoint TxTimeout September 2016 I 19

20 Code Duplication Using library of atomic sub-chart to avoid code duplication. September 2016 I 20

21 Compliance with MISRA C Rules SWS_BSW_00115: If the BSW Module implementation is written in C language, then it shall conform to the MISRA C 2004 Standard Source complexity (Cyclomatic Complexity): Number of linearly independent paths should not exceed a certain limit. Implicit and explicit type conversions (Casting). Example: casting from integer to pointer is prohibited. Parentheses ( and ) should be used to emphasis expressions. The final clause of a switch statement shall be the default clause. September 2016 I 21

22 Compliance with MISRA C Rules Cyclomatic Complexity control by separating atomic parts in separate functions September 2016 I 22

23 Compliance with MISRA C Rules Implicit and explicit type conversions (Casting) Parentheses level The final clause of a switch statement September 2016 I 23

24 Non-Functional Requirements Maintainability Reusability Non- Functional Requirements Reliability Efficiency (Execution Time, Memory consumption, ) September 2016 I 24

25 Non-Functional Requirements Execution time: Switch Case Vs If Else Expression True Exp #1 False Case #1 Statement #1 Statement #1 True Exp #2 False Case #2 Statement #2 Statement #2 True Exp #n False Case #n Statement #n Statement #n Default Statement September 2016 I 25

26 Non-Functional Requirements Execution time optimization: Code generation with Switch Case instead of If Else September 2016 I 26

27 Smoke Testing Smoke testing is non-exhaustive software testing, ascertaining that the most crucial functions of a program work, but not bothering with finer details. Smoke testing is not a substitute for traditional testing mechanism. September 2016 I 27

28 Smoke Testing Attaching Microsoft Visual Studio to Matlab process. September 2016 I 28

29 Smoke Testing Debugging in the Model and the manual code. September 2016 I 29

30 Agenda 1 2 Why use MBD for Developing AUTOSAR BSW Modules? CAN State Manager (CanSM) 3 Challenges Encountered in Developing CanSM using MBD 4 Results of Our Experiment September 2016 I 30

31 Results of The Provided Solution Development time is about 18% less than the other manually developed modules with similar size. Bug fixing is about 34% shorter than the other manually developed modules with similar size. Number of issues found during testing phase is about 30% less than the other manually developed modules with similar size. September 2016 I 31

32 September 2016 I 32