Safely Using the AUTOSAR End-to-End Protection Library

  • Thomas Arts
  • Stefano TonettaEmail author
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 9337)


The AUTOSAR End-to-End library is used to protect data. On the producer side a counter and checksum are added, such that on the consumer side it can be detected whether there was a communication failure. For optimal bus utilisation, it is a common solution that a producer publishes data that is read by many consumers. If the data also needs to be protected, this results in an End-to-Many-Ends solution.

In this paper, we analyse the impact of an End-to-Many-Ends solution on the safety guarantees of the AUTOSAR End-to-End Protection. In particular with focus on the problem that arises when the consumers read the messages with a periodicity that differs from the producer. It turns out that this common situation severely reduces the safety guarantees these standard components offer. In this report we analyze these reductions on different architectures.


Verification Formal methods AUTOSAR E2E Protection Communication failures 



We thank Martin Skoglund for useful input on realistic values for the safety case parameters. The research leading to these results has received funding from the ARTEMIS JU for the nSafeCer project under grant agreement n\(^o\) 295373 and from National funding.


  1. 1.
    ISO 26262: Road vehicles Functional safety (2011)Google Scholar
  2. 2.
    AUTOSAR: Software architecture specification
  3. 3.
    AUTOSAR. In: Specification of SW-C End-to-End Communication ProtectionLibrary. AUTOSAR consortium (2008–2013)Google Scholar
  4. 4.
    Arts, T., Dorigatti, M., Tonetta, S.: Making implicit safety requirements explicit. In: Bondavalli, A., Di Giandomenico, F. (eds.) SAFECOMP 2014. LNCS, vol. 8666, pp. 81–92. Springer, Heidelberg (2014) Google Scholar
  5. 5.
    Armstrong, J.: A history of Erlang. In: HOPL, pp. 1–26 (2007)Google Scholar
  6. 6.
    Arts, T., Hughes, J., Johansson, J., Wiger, U.: Testing telecoms software with Quviq QuickCheck. In: ACM SIGPLAN Workshop on Erlang (2006)Google Scholar
  7. 7.
    Arts, T., Hughes, J., Norell, U., Svensson, H.: Testing AUTOSAR software with QuickCheck. In: Proceedings of TAIC Part 2015 (2015)Google Scholar
  8. 8.
    Cimatti, A., Clarke, E., Giunchiglia, E., Giunchiglia, F., Pistore, M., Roveri, M., Sebastiani, R., Tacchella, A.: NuSMV 2: an opensource tool for symbolic model checking. In: Brinksma, E., Larsen, K.G. (eds.) CAV 2002. LNCS, vol. 2404, pp. 359–364. Springer, Heidelberg (2002) CrossRefGoogle Scholar
  9. 9.
    Cavada, R., Cimatti, A., Dorigatti, M., Griggio, A., Mariotti, A., Micheli, A., Mover, S., Roveri, M., Tonetta, S.: The nuXmv symbolic model checker. In: Biere, A., Bloem, R. (eds.) CAV 2014. LNCS, vol. 8559, pp. 334–342. Springer, Heidelberg (2014) Google Scholar
  10. 10.
    Cimatti, A., Dorigatti, M., Tonetta, S.: OCRA: a tool for checking the refinement of temporal contracts. In: ASE, pp. 702–705 (2013)Google Scholar
  11. 11.
    McMillan, K.L.: Symbolic Model Checking. Kluwer Academic, Dordrecht (1993)CrossRefzbMATHGoogle Scholar
  12. 12.
    Pnueli, A.: The temporal logic of programs. In: FOCS, pp. 46–57 (1977)Google Scholar
  13. 13.
    Broy, M., Huber, F., Schätz, B.: AutoFocus - Ein Werkzeugprototyp zur Entwicklung eingebetteter Systeme. Inform. Forsch. Entwickl. 14(3), 121–134 (1999)CrossRefGoogle Scholar
  14. 14.
    Forest, T., Jochim, M.: On the fault detection capabilities of AUTOSAR’s end-to-end communication protection CRC’s. In: SAE (2011)Google Scholar
  15. 15.
    Cimatti, A., Griggio, A., Mover, S., Tonetta, S.: Parameter synthesis with IC3. In: FMCAD, pp. 165–168 (2013)Google Scholar

Copyright information

© Springer International Publishing Switzerland 2015

Authors and Affiliations

  1. 1.QuviQGothenburgSweden
  2. 2.FBKTrentoItaly

Personalised recommendations