IEEE Consumer Electronics Magazine - April 2017 - 76

developed various paradigms for novel ECU architectures:
dual-core architecture, lock-step dual processor architecture,
loosely synchronized dual processor architecture, and triple
modular redundant (TMR) architecture. Figure 4 displays typical dual-core and TMR architectures that consist of two and
three processor cores, respectively, a level-one instruction cache
(L1-I), a level-one data cache (L1-D), and a level-two cache
(L2) per core on a single chip. The processor cores are connected via memory buses to a flash memory and a RAM, also
known as main memory. The dual-core architecture permits FT
(error detection only) by FT-RMT, and the TMR architecture
permits FT (error detection plus single error correction) by FTRMT-TMR. In the FT-RMT, two independent threads run on
the two processor cores, and an error is detected on a mismatch
between the two threads' outputs. In the FT-RMT-TMR, a
majority voter compares the outputs of the three threads and
chooses the majority voted output. The design of novel dependable ECU architectures is a promising research area.

impair the automotive system's real-time performance. A prerequisite for providing FT is fault/error detection. Error
detection latency denotes the time passed between the happening of an error (due to a bug or external interference) and
its detection at an observable point in the program. Long
error detection latencies can result in missed real-time deadlines for safety-critical automotive systems. Hence, timely
detection or masking of soft errors is vital for real-time constrained applications. There is a need to develop dependability methodologies that would enable quick error detection and
correction. For instance, an optimized combination of comparison points (i.e., insertion of comparison instructions in a
program to detect faults) and lightweight checkpointing can
help to meet the application's real-time constraints even in
the presence of faults.

SECURITY

The safety of automobiles can be enhanced by leveraging
advanced driver assistance systems (ADAS). Some of the
ADAS features include automated lighting, adaptive cruise
control, automated braking, traffic warnings, and a lane departure warning system. Safety can be further reinforced by
leveraging radar, lidar, and vehicle-2-X communication technologies in ADAS. The integration of these new technologies
in ADAS can help in detecting road hazards, such as broken
roads, bumps and potholes, and obstacles, even in hazardous
environmental conditions (e.g., fog, snow, and sandstorms).
The realization of these additional features in ADAS will
require advancements in computer vision and pattern recognition techniques.

Modern automobiles include several interfaces, such as the
on-board diagnostics port, entertainment systems (e.g., compact disc, universal serial bus, iPod), and short-range or
long-range wireless access, that provide direct or indirect
access to an automobile's internal networks. Because messages are transmitted in plain-text format over in-vehicle
networks [e.g., controller area networking (CAN), CAN with
flexible data rate, and FlexRay], intruders may be able to
gain access and even alter these messages, creating security
threats. Cyberphysical aspects of modern automobiles
directly couple security vulnerabilities to cybercars' physical
safety and dependability. The research challenge is to integrate security primitives (i.e., confidentiality, integrity, and
authentication) over in-vehicle networks without violating
real-time constraints imposed by the response time of automotive applications.

REAL-TIME CONSTRAINTS

ENERGY CONSUMPTION

ADVANCED DRIVER ASSISTANCE SYSTEMS

Many of the automotive embedded systems have stringent
real-time constraints. The challenge is to meet the strict
safety and dependability requirements of these automotive
systems without violating hard real-time constraints. Specifically, the added redundancy in an FT design should not

The challenge in the design of safe and dependable cybercars is integration of security and dependability primitives
while minimizing energy consumption. The dependability
methodologies that integrate dynamic voltage and frequency
scaling (DVFS) and lightweight checkpointing can help
in reducing energy consumption. The
DVFS controller can help in determining the operating voltage and freFT-RMT
FT-RMT-TMR
quency of ECUs to minimize energy
consumption while ensuring that realtime constraints are satisfied even in
Thread 0
Thread 1
Thread 2
the presence of faults. The checkpointCore 0
Core 1
Core 2
ing can reduce the energy overhead beL1-I L1-D
L1-I L1-D
L1-I L1-D
cause of reduced recomputation time
Flash
Flash
L2
L2
L2
in the presence of faults, as the correct
Memory Bus
operating state can be restored from a
RAM
RAM
saved checkpoint. Further research endeavors in energy-efficient integration
Dual-Core Architecture
TMR Architecture
of safety and dependability primitives
are required to reduce emissions, pollution, and carbon footprint and
FIGURE 4. The dual-core and triple-core FT architectures.
76 IEEE Consumer Electronics Magazine

APRIL 2017

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - April 2017