Redundant Data Storage

In the AUTOSAR world, multiple SWC from multiple sources are integrated into one ECU. Due to a missing memory protection (the ECU memory management cannot isolate these SWC from each other), there is a potential risk that one faulty SWC may corrupt the data of other SWC in memory.

ASCET offers a possibility for critical data to detect invalid data during program execution: Redundant data storage. Redundant data storage means that selected data can be stored in two different places in the memory (the original representation and its complement), and the two values can be compared at a later time. If the original value and its complement are not consistent, error actions can be taken.

The following conditions must be met for redundant data storage of an element:

the element is of scalar, enumeration, array, or matrix type
an array or matrix element is of scalar or enumeration type
the element belongs to one of the following components:
- an SWC
- a class or module specified as block diagram or ESDL
- an ActionCondition diagram in a state machine
the element is of the kind Variable or Message
the element is of scope Local or Exported
the element is volatile

For all other elements (e.g., elements with bit implementation, parameters, complex elements, elements in records or AUTOSAR interfaces, etc.), redundant data storage must not be activated. If it is, an error message is issued during code generation:

MMdl37 – redundant data flag is set for <element>, but <reason for error>

In the context of a project, redundant data storage can be activated or deactivated via the Use Redundant Data Storage option.

For an individual element, redundant data storage is activated via the Redundant option in the "Attribute" area of the properties editor. An element's Redundant option has no effect when redundant data storage is deactivated for the project.

When redundant data storage is activated, each write access to an element marked as redundant stores the value in both the original and the complement representation. The memory section of the complement representation is specified in the memorySections.xml file; see Memory Classes for Redundant Data Storage.

The Verify operator (block diagrams) or the verify() operation (ESDL) can be used to check consistency of an element's original value and its complement. You have to specify each check manually; see Using the Verify Operator and Verify Operation for details. If an element marked as redundant is never checked with a verify operation, a warning is issued during code generation:

WMdl17 – Element <element> specified as redundant, but there is no verify call for this element

When you calibrate an element marked as redundant in an experiment, or stimulate the element during an offline simulation, only the original value is changed. The complement representation is not changed, and the result of a verify operation will be false.