can-full: the DC-DC as an AUTOSAR ECU, described by an ARXML

.github/workflows/can-full.yml

@@ -16,6 +16,7 @@ on:
       - "include/**"
       - "snippets/**"
       - "dbc/**"
+      - "arxml/**"
       - "tools/**"
       - "toolchain/**"
       - "zephyr/**"
@@ -88,3 +89,7 @@ jobs:
       - if: "!cancelled()"
         run: just test-bench can_raw can-full/build/full.elf
         working-directory: .
+      # The OBD suite's fault tests fall silent as the BMS; same bench of its own.
+      - if: "!cancelled()"
+        run: just test-bench obd can-full/build/full.elf
+        working-directory: .

.github/workflows/firmware.yml

@@ -12,6 +12,8 @@ on:
       - "snippets/**"
       - "tests/**"
       - "dbc/**"
+      - "arxml/**"
+      - "tools/arxml2c.py"
       - "toolchain/**"
       - "zephyr/**"
       - "west.yml"
@@ -59,3 +61,8 @@ jobs:
       - run: just canopen-od pdu
       - name: nodes/pdu/od/ is up to date with its EDS
         run: git diff --exit-code -- nodes/pdu/od
+
+      - uses: astral-sh/setup-uv@v6
+      - run: just arxml
+      - name: nodes/dcdc/src/autosar_pdus.* is up to date with arxml/can-full.arxml
+        run: git diff --exit-code -- nodes/dcdc/src/autosar_pdus.h nodes/dcdc/src/autosar_pdus.c

README.md

@@ -23,12 +23,13 @@ rather than copying them.
 | `zephyr/`, `CMakeLists.txt`, `Kconfig` | This repository as a Zephyr module, contributing `lib/` |
 | `nodes/` | Zephyr applications, one per node, each reusable by any bench: `vcu`, `bms`, `dcdc`, `pdu`, `console`, `motor`; `full` runs the DC-DC, the genset (its sources in `genset`, built only into `full`) and the PDU in one image |
 | `lib/`, `include/zelos/` | Code the nodes share, each piece off until a node's `prj.conf` enables it. `lib/can` owns the controller: every protocol sends through its one queue, lowest id first |
-| `snippets/` | Protocols any node can build with, e.g. `-S xcp`, `-S uds` |
+| `snippets/` | Protocols any node can build with, e.g. `-S xcp`, `-S uds`, `-S autosar` |
 | `dbc/` | Wire formats of the shared nodes: `bench.dbc` (classic), `genset.dbc` (J1939), and `full.dbc`, both merged, the one file tools load; `lib/codec_<name>/` and `full.dbc` are generated by `just dbc` |
+| `arxml/` | `can-full.arxml`, the can-full bench as an AUTOSAR R19-11 System Template; the DC-DC's AUTOSAR tables are generated from it (`just arxml`) |
 | `toolchain/` | The firmware build image |
 | `testing/` | Host-side pytest suites and fixtures, run against any SocketCAN channel |
 | `bench/` | A Renode bench for any set of nodes, and the agent image; each bench builds on it, and `just test-bench` runs a suite on it |
-| `tools/` | Host scripts the build runs, e.g. filling a node's A2L with one build's addresses |
+| `tools/` | Host scripts: filling a node's A2L with one build's addresses (the build runs it), generating the DC-DC's AUTOSAR tables from `arxml/` (`just arxml`) |
 | `justfile` | Shared recipes: building nodes, `twister`, `test-bench`, and `hil` for a flashed board |
 
 ## Licence

bench/compose.yaml

@@ -90,6 +90,8 @@ services:
     network_mode: "service:bus"
     volumes:
       - ../dbc:/dbc:ro
+      # The AUTOSAR system description the autosar suite decodes with.
+      - ../arxml:/arxml:ro
       # Node descriptions the suites read, such as a CANopen node's EDS.
       - ../nodes:/nodes:ro
       - ${BENCH_ELF_DIR:-.}:/elf:ro

bench/renode-run.sh

@@ -38,17 +38,22 @@ first=
 		# each write logs a warning: 134,221 of them in 56 minutes on one run,
 		# 99.9% of everything the container printed.
 		#
-		# The ELF loads from the reset macro, which Renode also runs when the
-		# firmware reboots. A machine reset puts the SysTick back to 96 MHz,
-		# so the macro sets its frequency again.
+		# The ELF loads once, at power-on. Renode runs the reset macro when
+		# the firmware reboots, and a machine reset keeps memory, as the
+		# board's does: reloading the ELF there would zero .noinit, which
+		# keeps DTC memory over an ECUReset. A machine reset puts the vector
+		# table back at 0, where Renode has empty ITCM, and the SysTick back
+		# to 96 MHz, so the macro sets the part's boot address (BOOT_ADD0,
+		# flash) and the frequency again.
 		cat <<-EOF
 			mach create "${name}"
 			machine LoadPlatformDescription @platforms/boards/nucleo_h753zi.repl
 			logLevel 3 nvic
 			showAnalyzer usart3
+			sysbus LoadELF @/elf/${elf}
 			macro reset
 			"""
-			sysbus LoadELF @/elf/${elf}
+			sysbus.cpu VectorTableOffset 0x08000000
 			sysbus.nvic Frequency 480000000
 			"""
 			runMacro \$reset

can-full/README.md

@@ -1,24 +1,26 @@
 # The CAN bench with protocols on it
 
 can-bench's VCU and BMS plus one image carrying every protocol real vehicle
-networks put on top of CAN: XCP for measurement and calibration and UDS for
-diagnostics on the DC-DC, J1939 for the engine, CANopen for a power
-distribution unit. One MCU hosts the three as logical ECUs, as one board does
+networks put on top of CAN: XCP for measurement and calibration, UDS for
+diagnostics and AUTOSAR PDUs on the DC-DC, J1939 for the engine, CANopen for a
+power distribution unit. One MCU hosts the three as logical ECUs, as one board does
 on the hardware bench; the same image is the bench's default and fallback.
 
 ```
  ┌───────┐ ┌───────┐ ┌──────────────────────────────────┐
  │  VCU  │ │  BMS  │ │ full: DC-DC   genset    PDU      │   Zephyr on STM32H753, in Renode
  │       │ │       │ │       XCP+UDS J1939     CANopen  │
+ │       │ │       │ │       AUTOSAR                    │
  └───┬───┘ └───┬───┘ └────────────────┬─────────────────┘
      └─────────┴──────── vcan0 ───────┘
                            │
                   agent :2300  ·  tester (pytest)
 ```
 
 Each protocol is checked by an independent implementation of it: pyxcp as the
-XCP master, can-isotp and udsoncan as the UDS tester, python-can-j1939
-reassembling J1939 transport, python `canopen` as the CANopen master. A bug shared by the node and the tool cannot hide that way.
+XCP master, can-isotp and udsoncan as the UDS tester, cantools reading the
+AUTOSAR system description, python-can-j1939 reassembling J1939 transport,
+python `canopen` as the CANopen master. A bug shared by the node and the tool cannot hide that way.
 
 ## What you need
 
@@ -45,18 +47,22 @@ same default, so run one bench at a time or move one.
 |---|---|---|---|
 | VCU | `../nodes/vcu` | | `0x101` |
 | BMS | `../nodes/bms` | | `0x200`-`0x202` |
-| DC-DC | `../nodes/full` (`../nodes/dcdc`, XCP and UDS) | XCP on CAN, UDS on ISO-TP | `0x300`; CRO `0x6F0`, DTO `0x6F1`; UDS `0x7E0`, functional `0x7DF`, responses `0x7E8` |
+| DC-DC | `../nodes/full` (`../nodes/dcdc`, XCP, UDS and AUTOSAR) | XCP on CAN, UDS on ISO-TP, AUTOSAR PDUs | `0x300`; AUTOSAR `0x310`-`0x315`; CRO `0x6F0`, DTO `0x6F1`; UDS `0x7E0`, functional `0x7DF`, responses `0x7E8` |
 | Signal generator | `../nodes/full/src/waveform.c` | Classic CAN | `0x7F0` `Waveform` every 2 ms: sine, square and sawtooth of one phase, chirped 1 to 100 Hz over 20 s; the lowest-priority id, for plots |
 | genset | `../nodes/full` (`../nodes/genset`) | J1939 | 29-bit, source address `0x80` |
 | PDU | `../nodes/full` (`../nodes/pdu`) | CANopen, node-id `0x20` | NMT `0x000`, SYNC `0x080`, TIME `0x100`, EMCY `0x0A0`, TPDO1 `0x1A0`, RPDO1 `0x220`, TPDO2 `0x2A0`, RPDO2 `0x320`, TPDO3 `0x3A0`, SDO `0x5A0`/`0x620`, heartbeat `0x720` |
 
-The first three are can-bench's, unchanged except that the DC-DC runs XCP and
-UDS. Over XCP its demand and slew rate become calibration parameters, its
+The first three are can-bench's, unchanged except that the DC-DC runs XCP, UDS
+and AUTOSAR PDUs. Over XCP its demand and slew rate become calibration parameters, its
 setpoint, current, temperature and allowance measurements, all described by
 `build/full.a2l`, which the build fills with that ELF's addresses.
 Over UDS (ISO 14229-1) it is a diagnostic server as an OEM baseline ECU carries
 one: sessions, two security levels, DTCs raised by its model, an output voltage
-setpoint the model follows, and download into RAM. The contract, which the UDS
+setpoint the model follows, and download into RAM. On the same identifiers it
+is an OBD-II responder (SAE J1979 and J1979-2): live PIDs, DTCs as a scan tool
+lists them, a freeze frame, the VIN. Its DTCs follow US OBD-II: pending in the
+first failing cycle, confirmed with the MIL in the second, the MIL off after
+three passing cycles, permanent DTCs kept in flash. An ECUReset ends a cycle. The contract, which the UDS
 extension's demo ECU mirrors, is `../nodes/dcdc/src/uds.c`. The UDS server is
 the DC-DC's: CommunicationControl and ControlDTCSetting act on it alone, and
 ECUReset reboots the MCU, so all three restart. CANopen's NMT reset-node resets
@@ -66,6 +72,14 @@ the PDU alone, without a reboot. Every protocol sends through one queue in
 XCP writes the calibration without seed and key while UDS asks level 0x01 for
 the same memory: this is a development ECU.
 
+As an AUTOSAR ECU it sends what `../arxml/can-full.arxml` (an AUTOSAR R19-11
+System Template of this bench, `bench.dbc` included) describes: E2E profiles 1,
+2 and 5, a container with short headers, a multiplexed PDU and a SecOC profile 1
+secured PDU, each carrying the model's values. Its tables are generated from the
+ARXML (`just arxml` at the root); the SecOC key is RFC 4493's example key. The
+ARXML is the node's description for host tools too: Zelos decodes the bench from
+it as from the DBC, each AUTOSAR PDU by name with its E2E status.
+
 The DC-DC and PDU single-node images still build, for focused work: `just build
 dcdc-xcp-uds pdu`. The genset runs only in `full`.
 
@@ -84,6 +98,8 @@ inputs and per-channel current, and trips channel 8, which is shorted.
 |---|---|---|
 | `../testing/suites/xcp` | DC-DC | Used as a bench uses its ECU: zelos-can opens the bus, pyxcp is the master, the A2L names everything, and `check` asserts on the Zelos trace. The EPK matches the A2L's; a measurement read over XCP matches the broadcast frame; DAQ on the A2L's event at its period, by the ECU's own timestamps; the node follows the BMS allowance; a calibration takes effect and is restored; measurements are read-only. Protocol conformance is covered by the ztests in `../tests/lib/xcp` |
 | `../testing/suites/uds` | DC-DC | A conformance suite for any UDS server on any python-can bus: this node, or the UDS extension's demo ECU in-process. Used as a tester uses an ECU: zelos-can opens the bus, can-isotp carries, udsoncan asks. Every Tier A service with its NRCs and their ISO 14229-1 order, physical and functional; sessions, S3, P2; both security levels, lockout and power-up delay; memory by address; erase, download, check, upload of 64 KiB. `test_dcdc_node.py`, against the node itself: 0x28 stops DCDC_Status, the setpoint drives the output, DTCs follow the model through operation cycles, a reset is a fresh boot, XCP and UDS share the ECU. Core conformance: ztests in `../tests/lib/uds` |
+| `../testing/suites/obd` | DC-DC | A scan tool's view of the same server, SAE J1979 on 0x7DF: supported PIDs walked from the bitmaps; PIDs against DCDC_Status; MIL and DTC count; a lost BMS pending in its first cycle and confirmed in its second, the MIL off after three passing cycles, the freeze frame stored with the pending code; a permanent DTC surviving 0x04 and gone after one passing cycle; J1979-2 protocol identification, multi-DID subsets, no 0x13 to OBD requests; the VIN (multi-frame) and ECU identity; J1979-2 (OBDonUDS) DIDs and 0x19 0x42/0x55/0x56 equal to the legacy services; silence to unsupported requests. Runs alone in CI (`just test-bench obd`) too, so its fault tests can play the BMS |
+| `../testing/suites/autosar` | DC-DC | Decoded as a bench decodes an AUTOSAR ECU, from the ARXML alone: ids, lengths and cycles as described; E2E profile 1 (by hand), 2 and 5 (cantools) CRCs and counters; the container's PDUs in turn; the multiplexed PDU's alternatives; the SecOC MAC verified with the key; every value equal to DCDC_Status's of the same sample; UDS on the CanTp addresses the ARXML gives, its flow control as described; 0x28 silences the PDUs. The ARXML carries `bench.dbc` unchanged. Core: ztests in `../tests/lib/autosar` with the PRS E2E examples |
 | `../testing/suites/j1939` | genset | Address claim on request; defending against a higher NAME and yielding to a lower one; requests answered; periods; DM1 by BAM, reassembled by python-can-j1939; SOFT by RTS/CTS in the windows the requester grants, and by BAM to a global request. Originator conformance (windows, retransmit, abort, T3/T4): ztests in `../tests/lib/j1939` |
 | `../testing/suites/canopen` | PDU | Boot-up and heartbeat; NMT start, stop and pre-operational; SDO identity and downloads; RPDO commands reflected in TPDOs; an overcurrent trip raises EMCY and recovers; SYNC answered by the synchronous TPDO |
 | `../testing/suites/full` | all three | Every protocol at once for `--soak-s` (120 s here, 10 s on hardware): XCP DAQ, a UDS 64 KiB download and upload loop, CANopen operational with SYNC every 10 ms and RPDO1, J1939 and DCDC_Status. No EMCY, no DAQ sample lost, periods kept, and the node's counters (UDS DID `0x0110`) show no TX queue overflow, TX error or RX FIFO overrun |

can-full/justfile

@@ -5,12 +5,12 @@
 set shell := ["bash", "--noprofile", "--norc", "-euo", "pipefail", "-c"]
 
 # The bench's VCU and BMS, and one image carrying every protocol: the DC-DC with
-# XCP and UDS, the genset (J1939) and the PDU (CANopen). See nodes/full.
+# XCP, UDS and AUTOSAR PDUs, the genset (J1939) and the PDU (CANopen). See nodes/full.
 NODES := "vcu bms full"
 # Each node with a suite, as node:suite, in the order they run. `just test`
 # runs every suite on the bench; `just hil` runs one node's. full's
 # coexistence suite runs every protocol at once.
-SUITES := "full:xcp full:uds full:j1939 full:canopen full:full"
+SUITES := "full:xcp full:uds full:obd full:j1939 full:canopen full:autosar full:full"
 
 # The firmware is built by the repository's shared recipes, one level up.
 FIRMWARE := quote(just_executable()) + " --justfile " + quote(justfile_directory() / ".." / "justfile")