A Membership Service for a Distributed, Embedded System Based on a Time-Triggered FlexRay Network

The FlexRay bus system is the new de-facto standard for connecting electronic control units (ECUs) in cars. Because of its time-triggered message scheduling, it is regarded as the basis for applications like drive-by-wire. In order to fulfill the associated safety requirements, a reliable membership service is mandatory for providing consensus on all fault-free nodes. However, the FlexRay specification misses to define such a service. Consequently, it is not a part of the communication controllers but has to be realized in the software that is executed by the ECUs. This paper proposes a membership protocol especially tailored for FlexRay-based distributed systems such as envisioned by the AUTomotive Open System ARchitecture (AUTOSAR) standard. It features low runtime overhead and imposes small scheduling restrictions on the ECU. We have verified the correctness of the main characteristics of the protocol by means of model checking and have practically evaluated it in a cluster of common automotive microcontrollers.