In the ITEA2 predecessor project TIMMO (TIMing MOdel), a system development methodology was defined explicitly taking into account the real-time behavior of the developed system, an aspect that is ignored in many comparable methodologies.
The TIMMO methodology describes the application of the Timing Augmented Description Language (TADL), that was also developed in the TIMMO project and that is extended in WP2 of TIMMO-2-USE, in the context of the automotive software system development process. Based on the information captured by TADL, the TIMMO methodology highlights the possibilities of applying timing analyses to help the designer taking design decisions and verifying the system’s adherence to timing constraints. This guideline on how timing analyses can be applied during the development process of automotive software systems represents the main novelty of the TIMMO methodology.
The TIMMO methodology is based on EAST-ADL at the higher levels of abstraction and on AUTOSAR at implementation level (compare Figure 1).
· Vehicle Phase (EAST-ADL)
· Analysis Phase (EAST-ADL)
· Design Phase (EAST-ADL)
· Implementation Phase (AUTOSAR)

Figure 1. The different Phases of the TIMMO Methodology
The development steps (tasks) that are performed in the different phases of the TIMMO methodology are shown in Figure 2. Please note that the TIMMO methodology allows design iterations at each phase. Each task or sequence of tasks involved in creating the solution in the current phase can be repeated based on the knowledge gained in the timing analysis tasks (“Analyze timing …”). For this reason, each phase ends with a milestone acting as gateway for checking the real-time behavior of the created solution before continuing system development in the subsequent phase.

Figure 2 - Different phases and tasks of the TIMMO methodology
Timing Analyses
In the following, the timing analyses that can be performed during the different phases to support the developers in taking design decisions and helping her to ensure the correct real-time behavior are briefly sketched.
Vehicle phase
Timing analysis during the vehicle phase focuses on two aspects. First, the logical validation of the timing requirements is performed. This consists in a first (in most cases subjective) evaluation of the general satisfiability of the timing requirements through timing experts.
The second aspect consists in performing consistency checks of the timing requirements.
Analysis phase
During the analysis phase the timing behavior of initial versions of the functional models are checked against the timing requirements formulated at vehicle phase. Additionally, robustness checks are performed to early detect critical paths in the functional architecture that need special focus in the subsequent phases.
Design phase
During the design phase the first implementation decisions are taken, including the mapping of functionalities to computational resources and utilized communication media. Due to these decisions also many timing properties of the systems are fixed or can be estimated. Therefore, the timing models that can be derived at design phase are much more detailed compared to the previous phases. This enables more detailed timing analyses assessing the approximate dynamic behavior of the software system under development.
At design phase so-called Response Time Analyses Techniques can be applied for the first time. They are performed to verify the system’s adherence to end-to-end timing requirements. Response time analysis can be performed for a wide range of scopes, spanning from single tasks to complex cause-effect chains involving several ECUs.
Implementation phase
In the implementation phase all details for accurate timing analyses are available. However, while in the previous phases the results of timing analysis can be used to take design decisions, the focus during the implementation shifts to pure validation, i.e. it is checked in detail if all imposed timing requirements from the previous phases are satisfied.
AUTOSAR defines four different views on the developed software system:
· Virtual Function Bus (VFB) View
· System View
· Component View
· Electronic Control Unit (ECU) View
Each of these views focuses on different aspects, and thus different timing analysis techniques are applied. For instance, on system view the validation of global end-to-end delays, e.g. maximum reaction constraints, spanning several ECUs are of interest. In the case of the ECU view, the focus lies on response time analysis on task level and deadlock analysis for shared resources.
Relation to the TIMMO-2-USE methodology
The TIMMO methodology is one of the corner stones for the TIMMO-2-USE methodology. The main differences compared to the TIMMO-2-USE methodology are twofold:
· The TIMMO methodology has a pure top-down view on the development process of automotive software systems. In contrast, the TIMMO-2-USE methodology explicitly considers also bottom-up aspects that play an important role for many use cases.
· The TIMMO methodology’s main use case lies on the application of timing analyses during the development process. The TIMMO-2-USE methodology covers many more practical use cases that require the consideration of timing aspects. Examples include the specification of time budgets, the integration of new functionalities into an existing system, the development of control applications, etc. |