A matter of context: How digital instrument clusters can enhance the driving experience

<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhAAw7k-AFoYWzayDLtJZzOI2BN-5wqy3uHeDlk-38VtyE94YLRDtw_l-f2-smhMbXg9z0PqTJPO47ZRMKU9ssjzO2ocny-oj2PaE_MVGtEFP_XVlOF1Ls_2-DolJWxTSiaMu04eAU6lO8/s1600/emil_dautovic_qnx_crop.jpg" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"><img border="0" height="120" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhAAw7k-AFoYWzayDLtJZzOI2BN-5wqy3uHeDlk-38VtyE94YLRDtw_l-f2-smhMbXg9z0PqTJPO47ZRMKU9ssjzO2ocny-oj2PaE_MVGtEFP_XVlOF1Ls_2-DolJWxTSiaMu04eAU6lO8/s400/emil_dautovic_qnx_crop.jpg" width="94" /></a>I always drive a manual, so checking the tachometer in my car’s instrument cluster has become second nature to me. But while I have a personal interest in what my cluster displays, why would a software company like QNX be interested in instrument clusters? After all, most clusters use physical gauges and relatively little software.<br /><br />The answer, of course, is that automakers are starting to migrate to digital instrument clusters, which replace mechanical gauges with virtual instruments rendered on an LCD display. In fact, <a href="http://onqpl.blogspot.ca/2010/11/qnx-drives-digital-instrument-cluster.html">Jaguar</a> and <a href="http://www.qnx.com/news/pr_3655_1.html">Land Rover</a>, who are pioneers in this market, have been shipping QNX-based digital clusters since about 2010. Here, for instance, is a photo of the digital cluster and dash in the latest Range Rover:<br /><br /><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUW458a0Ogxq1FR0jXKPISJNztVDDirRlKnRzWIKwrmyMe2DBgPtlfM4qVVvUP_pfuwOTC_FCJQ69piaG34NDO6nofj3kbJTcUygs9B-KJRxptCjr2ByLswXFveH1hkmS8kWjYt6IcaXE/s1600/range_rover_cluster_575px.jpg" imageanchor="1"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUW458a0Ogxq1FR0jXKPISJNztVDDirRlKnRzWIKwrmyMe2DBgPtlfM4qVVvUP_pfuwOTC_FCJQ69piaG34NDO6nofj3kbJTcUygs9B-KJRxptCjr2ByLswXFveH1hkmS8kWjYt6IcaXE/s1600/range_rover_cluster_575px.jpg" /></a><br /><br />So why use a large LCD display instead of mechanical gauges? For one thing, you can attract early adopters who always want the latest tech and who see large 3D displays as cool. But more importantly, a digital cluster can provide an experience that is both personal and adaptive — personal because consumers today want to control the UX (just as they customize their smartphones) and adaptive to help the driver in a variety of traffic situations. <br /><br /><b><span style="color: #073763;">Context matters</span></b><br />In the latest <a href="http://qnxauto.blogspot.ca/2013/01/its-bentley-guided-tour-of-new-qnx.html">QNX technology concept car</a>, for instance, the digital cluster can re-configure itself to display a 3D rear view camera to help with parking. Saab pursued similar ideas a few years ago with a <a href="http://en.wikipedia.org/wiki/Saab_900#Black_Panel">context-based cluster</a> that avoids loading the driver with too much information during night-time driving.<br /><br />It will be interesting to see who takes this to the next level with an adaptive HMI that takes speed, location, and driving conditions into account. For instance, driving at high speed on a German Autobahn differs immensely from driving at low speed on a busy downtown street with lots of pedestrians and intersections. These two scenarios place different demands on the driver, and a digital cluster could adapt accordingly. <br /><br />On the autobahn, the cluster could increase the size of the speedometer and tachometer to make them easier to see, while hiding other information that isn’t currently needed. (The cluster would, of course, still display any necessary warnings, such as high oil temperature.) In the city, meanwhile, the cluster could replace the tachometer with pedestrian warnings to improve the driver's situational awareness. <br /><br />Also, think of a car that supports both automatic and manual gear-shifting. A driver who prefers automatic might not be interested in a tachometer, whereas a driver who shifts manually will want to see a RPM readout to optimize gear shifting. A digital cluster could accommodate both preferences.<br /><br /><b><span style="color: #073763;">For safety’s sake</span></b><br />What does it mean from a safety perspective to include a large display and its attendant electronics in the car? A malfunctioning digital cluster can’t directly kill or injure, but it could give false indications that may lead to an accident. That is why automakers will likely have to address ISO 26262 requirements for their digital clusters. <br /><br />So what is ISO 26262? It’s a standard that focuses on functional safety in cars and other types of passenger vehicles, with the goal of avoiding or controlling system failures. It is similar in content and purpose to the IEC 61508 functional safety standard, to which two QNX OS products <a href="http://www.qnx.com/products/neutrino-rtos/index.html">have already been certified</a>. Read our previous posts (<a href="http://qnxauto.blogspot.ca/2012/10/the-iso-26262-functional-safety.html">here</a> and <a href="http://qnxauto.blogspot.se/2013/03/the-isolation-imperative-protecting.html">here</a>) for more information on ISO 26262.<br /><br /><span style="color: #073763;"><b>Massive arrays</b></span><br />When it comes to digital clusters, I’ve only scratched the surface. For instance, cars are becoming massive sensor arrays that generate tons of data. By leveraging this data, reconfigurable clusters could display contextually relevant information, such as highlighting a person in your path, an accident up ahead, or the current speed limit. <br /><br />And from the automaker’s perspective, a digital cluster could help reduce costs by allowing the same hardware to be used across multiple vehicle lines; in many cases, only the graphics would need to be “reskinned.”<br /><br /><hr /><i>Emil Dautovic is an automotive business development manager at QNX Software Systems, where he is responsible for the European automotive market. </i><br />

A matter of context: How digital instrument clusters can enhance the driving experience

I always drive a manual, so checking the tachometer in my car’s instrument cluster has become second nature to me. But while I have a person...

Read more »

The isolation imperative: protecting software components in an ISO 26262 system

<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjF70n8XEFXd-WCle6B_N5zb1HOWT6A2287uJL5IptS__jCjo-sMeLzRAv-qrES7Wnj9wEZiA4bLTxtEtJfmSDnchUPzbOIeuufEo685uCHndKAp_EbWo2F-A2ermk7zqXoap_GTGgnSh0/s1600/paul_leroux_photo_crop_v3.jpg" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"><img border="0" height="124" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjF70n8XEFXd-WCle6B_N5zb1HOWT6A2287uJL5IptS__jCjo-sMeLzRAv-qrES7Wnj9wEZiA4bLTxtEtJfmSDnchUPzbOIeuufEo685uCHndKAp_EbWo2F-A2ermk7zqXoap_GTGgnSh0/s400/paul_leroux_photo_crop_v3.jpg" width="87" /></a>Software components can be impolite, if not downright delinquent. For instance, a component might:<br /><br /><ul><li>rob other components of CPU time<br /></li><li>rob other components of file descriptors and other system resources<br /></li><li>access the private memory of other components<br /></li><li>corrupt data shared with other components<br /></li><li>create a deadlock or livelock situation with other components<br /></li></ul><br />Shameful, I know. But in all seriousness, this sort of behavior can wreak havoc in a safety-critical system. For instance, let's say that a component starts to perform a CPU-intensive calculation just as the system enters a failure condition. Will that component hog the CPU and prevent an alarm process from running? <br /><br />The answer, of course, is that it damn well better not.<br /><br />It becomes important, then, to prevent components from interfering with one another. In fact, this principle is baked into the <a href="http://qnxauto.blogspot.ca/2012/10/the-iso-26262-functional-safety.html">ISO 26262 functional safety standard</a> for road vehicles, which defines interference as: <br /><br /><ul>"...the presence of cascading failures from a sub-element with no ASIL [Automotive Safety Integrity Level] assigned, or a lower ASIL assigned, to a sub-element with a higher ASIL assigned leading to the violation of a safety requirement of the element” </ul><br />To put it crudely, less important stuff can't stop more important stuff from happening.<br /><br />So how do you prevent interference? One approach is through isolation. For instance, a system may implement spatial isolation between application processes. This would include mechanisms for interprocess communication and interprocess locking that prevent one process from inadvertently affecting another.<br /><br />Mind you, there are multiple types of interference, so you need to implement multiple forms, or <i>axes</i>, of isolation. Time for a picture:<br /><br /><br /><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhqXB2d5X4JJhti1Ph67QQmAb2Hd05LNAa3btIhcr6eHMPDLUjoDoWf3HrMEQxInso0iLhI1sM6G2zXrJpdIu80xyOij0PbeqfEo3Nsyd3K2NHL89TT25InUR9ltqO-w-ddW6vJHC1Yhlw/s1600/isolation_axes.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhqXB2d5X4JJhti1Ph67QQmAb2Hd05LNAa3btIhcr6eHMPDLUjoDoWf3HrMEQxInso0iLhI1sM6G2zXrJpdIu80xyOij0PbeqfEo3Nsyd3K2NHL89TT25InUR9ltqO-w-ddW6vJHC1Yhlw/s1600/isolation_axes.jpg" /></a><br /><br />In general, you need to determine what does, and what doesn't, need to be isolated. You also need to identify which components are apt to be delinquent and build a cage around them to protect more critical components. Which brings me to a recent paper by my inestimable colleagues Chris Hobbs and Yi Zheng. It's titled "<a href="http://www.qnx.com/download/feature.html?programid=24546"><b>Protecting Software Components from Interference in an ISO 26262 System</b></a>," and it explores techniques that can help you:<br /><br /><ul><li>implement the component isolation required by ISO 26262</li><li>demonstrate that such isolation has been implemented</li></ul><br />And while you're at it, check out the other titles in our <a href="http://www.qnx.com/download/group.html?programid=21552&tag=safety">"safe" whitepaper series</a>. These include "The Dangers of Over-Engineering a Safe System" and "Ten Truths about Building Safe Embedded Software Systems." <br /><br />And don't worry: there's nothing delinquent about downloading all of them.<br /><br />

The isolation imperative: protecting software components in an ISO 26262 system

Software components can be impolite, if not downright delinquent. For instance, a component might: rob other components of CPU time rob othe...

Read more »