# A Perspective on Ethernet in Automotive Communications--Current Status and Future Trends
## 5 Car Architecture Evolution and Relevant Challenges
### Considerations on Verification and Functional Safety of Automotive TSN Networks  
TSN-based automotive networks require time-consuming traffic planning and verification, which in turn require suitable methodologies and tools. For this reason, several studies have addressed suitable scheduling methodologies [56; 57; 58] and tools for the modeling, verification [59], and simulation [60; 61; 62; 63] of TSN-based automotive networks. Moreover, when new devices that generate critical flows are added to an existing TSN-based in-vehicle network, the whole network configuration has to be reviewed, and part of it may need to be modified. After the reconfiguration, it is necessary to formally verify that all the requirements of the applications are satisfied.  
Several modeling approaches for configuring and verifying TSN networks have been proposed. For example, the formal analysis methods presented in [64; 65] verify the timing and latency performance of the TSN shapers. With reference to the IEEE 802.1 Qbv amendment, the approach in [56] derives the required constraints for computing offline schedules that guarantee low and bounded jitter and deterministic end-to-end latency for critical communication flows. The work in [61] considers the effects of the mutual influence of critical requirements and uses Logical Programming and inference algorithms to reduce the complexity of application requirements verification.  
Safety-relevant aspects in routing decisions designed to increase the reliability of the critical applications are addressed in [66; 67], while the work in [68] presents four different dynamic scheduling and routing heuristics to support FRER functionality in TSN.  
As far as functional safety is concerned, support for safety-critical applications on Ethernet TSN in-vehicle networks provides additional challenges. For example, after analyzing the safety requirements for communication and processing within a zonal controller, the work in [69] concludes that the design for functional safety goes far beyond a single product. Therefore, system solutions are recommended [69]. ISO 2626-6:2018 [70] is the most recent version of the standard for the development of software for safety-related systems installed in most road vehicles. The standard covers a broad spectrum of automotive applications and defines five different Automotive Safety Integrity Levels (ASILs) that correspond to different risk levels and safety requirements in the development, verification and validation process of the applications considered. For each ASIL, the ISO 26262 outlines requirements on the coverage of random hardware errors and systematic errors. In the context of random hardware errors, the work in [71] presents a lightweight formal analysis approach for the determination of the transmission reliability of messages in switched Ethernet networks under the influence of transient errors. The work in [72] proposes an ASIL-decomposition based technique that addresses systematic errors in safety-critical networked applications through the integration of automotive functional safety engineering with TSN routing and scheduling. In particular, the work proves that the ASIL decomposition can be integrated with routing and scheduling for TSN networks, with a significant improvement of the total cost.  
A comprehensive survey on real-time Ethernet modeling from AVB to TSN that includes end-to-end delay analysis, real-time scheduling, reliability-aware design, and security-aware design is provided in [73]. Here, these topics are not addressed in detail, as the focus of this work is on the evolution of in-car networking protocols and, in particular, on Automotive Ethernet and the TSN standards.