ElectricalEngineeringResearchVol.1Iss.

4,October2013

RealTimeSystemsinAutomotive
Applications:VehicleStabilityControl
AdnanShaout*1andKevinMcGirr2

1TheUniversityofMichiganDearborn,2TheElectricalandComputerEngineeringDepartment

Dearborn,MI48128
*[email protected]

Abstract
This paper will investigate the application of embedded
systems in current state of the art vehicle stability systems.
Forclarificationpurposes,thefocuswillbeonthosesystems
similar to ESP (electronic stability program) originally
developed by Bosch in 1995. The overall emphasis of this
paperwillbetoexaminetheseautomotivesystemsfroman
embeddedsystemspointofview.
Thereareseveralkeyissuespertainingtoembeddedsystems
invehiclestabilitycontroladdressedthroughoutthispaper.
The first issue addressed will be state of the art electronics
used in these systems including controllers, actuators, and
sensors; then followed by the issue of operation of the
stability control electronics and the way they interact with
other vehicle electronics such as engine control. The third
issueisthecontrolalgorithmandarchitecturethatoperates
thesystem.
This paper will also analyze the limitations of these vehicle
stability systems, possible sources of system failure, as well
as what is being done to prevent such failure. In addition,
this paper will investigate the future trends in vehicle
stabilitycontrolandtrytodeterminefuturedevelopmentsin
vehicle stability control. Finally, the advantages and
disadvantages in terms of safety and performance are
discussed.
Keywords
VehicleStabilitySystems;EmbeddedSystems;VehicleSafety;Real
TimeSystems;AutomotiveApplications

Introduction
Embedded systems play a critical role in vehicle
stabilitycontrolsystems.Byexaminingcurrentstateof
the art systems like Boschs ESP in great detail, the
impact of embedded systems for this automotive
applicationcanbeunderstood.
One of the biggest technological advances that have
made systems like Boschs ESP possible is the wide
availabilityofautomotiveelectronics.Electronicssuch

as electronic control units, steering angle sensors,

wheel sensors, lateral acceleration sensors, yaw rate
sensors, and engine controllers have made the
development of vehicle stability systems possible. In
addition, the ability to connect these electronic
components over a high speed network has aided in
thedevelopmentofthesevehiclesystems.
The electronic components of ESP work to stabilize a
vehicle in a critical situation and prevent it from
steering are out of control. The system operates
through a series of high speed digital messages sent
fromthesensorstothecontrolunit,andfinallytothe
actuators.Inamatterofmilliseconds,thesecomponents
assess the status of the vehicle, determine any
necessarycorrectiveaction,andinitiatethatcorrective
action by applying the brakes and controlling engine
torque[VanZantenetal.(1999)].
The fundamental control algorithm utilizes the data
flowamongalloftheelectroniccomponentstoassess
thevehiclesbehavior,determineifanychangesneed
tobemadetothevehicle,andcontrolthecomponents
responsible for altering the vehicles behavior. The
primary goal of the control algorithm is to compare
the actual behavior of the vehicle with the desired
behavior, as well as to determine what needs to be
done to make those behaviors equivalent [Van Zanten
etal.(1999)].
Electronic systems have greatly improved the safety
andperformanceofvehicles.Withsuchsystems,there
aresomeinherentlimitationsandproblemsincluding
increased risk that must be addressed by system
designers.Becausethesesystemsarecriticalforsafety,
special steps must be taken to ensure the systems
reliabilityandfaulttolerance.
Inthepasttwentyyears,theautomotiveindustryhas
seen vehicle safety going from antilock brakes, to

83

ElectricalEngineeringResearchVol.1Iss.4,October2013

traction control, and finally to stability control.

Stability control is a technology people could have
never dreamed of 40 years ago. However, recent
developments in other vehicle applications such as
brakebywire and steerbywire are continuing to
push the capability and performance of vehicle
stabilitycontrolforward.
Finally there are many advantages of a system like
ESP,includingvehiclesafetyandimprovedcontrolin
inclement conditions. While the introduction of
electroniccontrolintomoreandmorevehiclesystems
offerssignificantimprovementsandadvantages,there
are inherent risks and problems associated with this
progression.Issuesrelatedtodecreaseddrivercontrol
and consumer awareness need to be addressed when
vehicleelectronicsystemslikeESPareindevelopment.
ESP: Past, Present, and Future
Thehistoryofvehiclestabilitycontrolcanbefollowed
simply by investigating Boschs contributions to
vehicle electronic systems over the past 25 years.
Bosch has led to the development of vehicle stability
controlledbyintroducing3fundamentalsystemsinto
the market: antilock braking (ABS), traction control
(TCS), and electronic stability program (ESP) [Bosch
BrakingSystems,http://www.boschautoparts.co.uk].
The development of ESP began in 1978 when Bosch
introduced the worlds first antilock braking (ABS)
system
[Bosch
Braking
Systems,
http://www.boschautoparts.co.uk]. ABS was the first
step in vehicle stability control. By means of an
electronic controller integrated with the brake
hydraulic modulator, this system increased vehicle
stability during heavy braking by preventing the
wheels from locking up [Bosch Braking Systems,
http://www.boschautoparts.co.uk]. This system is
especiallyeffectivewhenbrakingonslipperysurfaces.
ABS functions by using the wheel speed sensors to
monitor each wheel and send that information to the
centralECU.IftheECUdetectsanindicationofwheel
lockup based upon the speed of each wheel, it will
use the hydraulic modulator to adjust the braking
force applied to the desired wheel [Cage (1999)]. The
greatest level of benefit will occur when ABS is
utilizedonslipperysurfaces.Therearethreeprimary
objectives of ABS: reduction of stopping distances,
improvement on stability, and steerability during

84

braking[Cage(1999)].
The next step in the development of vehicle stability
control was the introduction of the traction control
system (TCS) by Bosch in 1987 [Bosch Braking
Systems,http://www.boschautoparts.co.uk].Thegoal
of traction control is to stabilize the vehicle during
acceleration by preventing the wheels from spinning
out of control. TCS also seeks to improve traction of
the wheels while accelerating. TCS used all of the
same components as previous ABS systems with the
additionofenginemanagement[Sauter(1999)].
By selectively applying the brakes to wheels that are
slipping,TCSisabletoincreasetheamountoftraction
for that wheel. This is especially important when the
wheels are on surfaces with varying levels of friction
[Sauter (1999)]. In addition to using the brakes to
control traction while accelerating, TCS also utilizes
engine management to control the vehicle. By
communicating with the engine controller, the TCS
system is able to control the amount of torque that is
sent to the wheels. If the system detects that a wheel
has almost no traction with the road and is simply
spinning,theTCSsystemisabletogreatlyreducethe
torque delivered to that wheel. The engine
management system adjusts the amount of torque by
controllingtheairflowtotheengine(throttlecontrol),
thefuelinjection,andthesparktiming[Sauter(1999)].
By adjusting all of these elements, TCS is capable to
greatly increase or decrease the amount of torque
deliveredtoawheel.
Enginemanagementisatremendousadvancementin
vehicle stability because it greatly has reduced the
dependence on braking systems, thus the amount of
wear and tear on the brakes as well as the size of
brakes necessary on the vehicle [Sauter (1999)] are
reduced.
The following table shows the evolution of vehicle
stabilitycontrolsystemsoverthepast25years,theway
how each system was built based upon the previous
one by indicating shared components and how each
systemdiffersbylistingtheadditionalcomponentsthat
enablethenextevolutioninvehiclestability.
Bosch took vehicle stability from preventing skidding
while braking to stabilizing the vehicle on slippery
roads. Vehicle stability technology will continue to
moveforwardwithmoredevelopmentsinautomotive
electronics.

ElectricalEngineeringResearchVol.1Iss.4,October2013

Technology

Year PastComponents

ABSAntiLock
1978
BrakingSystem
TCSTraction
1987
ControlSystem
ESPElectronic
1995
StabilityControl

DiscBrakes
DiscBrakes,
ECU,wheel
speedsensors
DiscBrakes,
ECU,Engine
ECU,Wheel
SpeedSensors

NewComponents
HydraulicModulator,
ECU,wheelspeed
sensors
EngineECU
YawRatesensor,Lat.
Accel.Sensor,Steering
AngleSensor

FIG.1VEHICLESTABILITYTIMELINE[BOSCHBRAKING
SYSTEMS,HTTP://WWW.BOSCHAUTOPARTS.CO.UK]

Vehicle Stability Manufacturers

Therearefourmajormanufacturersofvehiclestability
control systems: Bosch, ContinentalTeves, TRW, and
Delphi.BoschandContinentalTevespredominatethe
majority of the market share, with Delphi and TRW
the relative latecomers developing systems only
within the past two years [Braking Systems,
www.trw.com,ElectricSteeringSystems,www.delphi.com].
All four manufacturers follow a similar architecture.
The basis for all current vehicle stability control
systems is of course Boschs ESP system that was
originally introduced in 1995 [Braking and Chassis
Systems, www.boschusa.com]. Current state of the art
systemsfromallofthesemanufacturersallincludethe
samebasiccomponents:hydraulicmodulatorw/ECU,
wheel speed sensors, steering angle sensor, yaw rate
sensor, lateral acceleration sensor, engine controller,
transmissioncontroller,accelerationpedalsensor,and
brake pressure sensor. The greatest amount of
variation in systems manufactured by different
companies will reside in selection of the individual
components rather than in the overall architecture.
The following table displays the current
manufacturersofvehiclestabilitysystems,whenthey
firstenteredthemarket,theirsystem,andthevarious
vehiclemarketswheretheirsystemcanbefound.
Manufacturer Year

SystemName

Markets
Mercedes,Lexus,
Audi,BMW,VW
BMW,Chrysler,
Ford,Jaguar,
Nissan,Toyota

Bosch

1995

ESPElectronic
StabilityProgram

Continental
Teves

1998

ESPElectronic
StabilityProgram

Delphi

2002

TRAXXAR

TRW

Cadillac,GMVans

VSESVehicleStability
2002
CadillacEscalade
EnhancementSystem

FIG.2VEHICLESTABILITYMANUFACTURERS[BRAKEBY
WIRETECHNOLOGIES,WWW.CONTIONLINE.COM,BRAKING
ANDCHASSISSYSTEMS,WWW.BOSCHUSA.COM,BRAKING
SYSTEMS,WWW.TRW.COM,ELECTRICSTEERINGSYSTEMS,
WWW.DELPHI.COM]

Components of ESP
Avehiclestabilityprogramrequirestheinteractionof
severalelectronicmodules,sensors,andactuators.The
mostfundamentalpieceoftheESPsystemistheECU
orElectronicControlUnit.Thefigurebelowshowsan
ESP ECU from Bosch with a builtin hydraulic
modulator for brake activation. Early versions of ESP
used an ECU that is separated from the hydraulic
modulator,butinanefforttoreduceweight,size,and
cost, an ECU was developed using hybrid ceramic
substrates much smaller in size than earlier ECUs.
Using ceramic substrates has also greatly improved
the ECUs thermal robustness and overall lifetime
[VanZantenetal.(1998)].

FIG.3ESPHYDRAULICMODULATORWITHADDONECU
[BrakingandChassisSystems,www.boschusa.com]

TheECUisthebrainsofthevehiclestabilitysystem.
The ECU is responsible for gathering data from the
sensorsandusingthatdatatocalculateanyadjustments
that need to be made to the brake pressure or engine
torque. A more detailed explanation of system
operationwillbegivenlater.
A common design for current state of the art ESP
ECUs is a dual microprocessor layout. A typical
microprocessorusedinECUsofthistypeistheIntel
8XC196JT [Van Zanten et al. (1998)] specifically
designed for automotive applications that is an 8bit
microprocessor with 256 kilobytes of ROM and 8
kilobytesofRAMandhasPWMoutputs(pulsewidth
modulation),A/Dinputsonoperatingrangefrom40
to 125C [www.intel.com/design/auto/chassis.htm].
The chip also has a builtin watch dog timer to reset
thedeviceinthecaseofsoftwareorhardwarefailure
[TheTTPProtocols,http://www.vmars.tuwien.ac.at/
projects/ttp/ttpmain.html]. Such fault tolerance
protectionisextremelycriticalinasystemsuchasESP.
ESP that is a hard realtime system and system faults
or failures are not acceptable. The results could be
catastrophicintheeventofasystemfailure.

85

ElectricalEngineeringResearchVol.1Iss.4,October2013

FIG.4ECULAYOUTWITHDUAL8XC196JTMICROPROCESSORS
[VanZantenetal.(1998)]

The vehicle stability system also requires the use of

many different sensors in order to determine the
actualstateofthevehicleaswellasthedesiredstateof
thevehiclebaseduponthedriversinput.
Todeterminethespeedofthevehicleandtheamount
of pressure applied to each wheel, the system uses
wheelspeedsensors.Theinformationfromthewheel
speed sensors is used to calculate the actual vehicle
speedaswellastheamountofslipthateachwheelis
experiencing. The amount of tire slip is calculated by
comparing the speed of the wheel with the actual
vehicle speed. Tire Slip = wheel speedactual vehicle
speed [Van Zanten et al. (1999)]. The actual vehicle
speed is determined by assessment on the speed of a
nondrivenwheel.

Afundamentaldevelopmentinautomotiveelectronics
that facilitate the creation of ESP is the ability to
measure the vehicles rotation around a vertical axis.
Imagineapolegoingthroughthetopofthecardown
totheroad.Nowimaginethecarspinningaroundthis
pole:theamountofrotationistheyawofthevehicle.
The ECU uses the data from the yaw rate sensor to
determine if the vehicle rotates too much: oversteer
condition, or if the vehicle does not rotates enough:
understeer condition. The yaw rate sensor is based
upon a vibrating cylindergyrometer. The metal
cylinderisvibratedataconstantfrequency.Nodesare
displaced depending on amount of vehicle rotation
duetotheCoriolisEffect.Atypicalyawratesensoris
picturedbelow.

FIG.7YAWRATESENSOR[BRAKINGANDCHASSIS

SYSTEMS,WWW.BOSCHUSA.COM]

Inadditiontothesensorsdescribedpreviously,vehicle
stabilitysystemsalsoemploylateralaccelerationsensors
andbrakepressuresensors.

FIG.5WHEELSPEEDSENSOR[BrakingandChassisSystems,

Thefollowingpictureshowsthelayoutofthevarious
ESPcomponentsandsensorsinavehicle.

www.boschusa.com]

Thesystemalsoneedstobecapableofmonitoringthe
desired motion of the vehicle from thedriversinput.
Tomeasurethedriversinput,asteeringanglesensor
and acceleration pedal sensor are used. The steering
anglesensorismountedbehindthesteeringwheelon
top of the steering column and measures the position
of the steering wheel. There is also a sensor for the
acceleration pedal to measure the desired speed/
accelerationofthevehicle.SeeFig.3below.

FIG.8ESPSYSTEMONCANNETWORK

CAN Network

FIG.6STEERINGANGLESENSOR[BRAKINGANDCHASSIS

SYSTEMS,WWW.BOSCHUSA.COM]

86

The electronic components in ESP are communicated

using a CAN network. CAN, a secure, high speed
serialcommunicationstandard,developedbyBOSCH
inthemid1980sandbecameaworldwidestandardin
the early 1990s, is a very cost effective and robust
network [CAN networking, www.can.bosch.com].
Currently,CANisthemostwidelyusedstandardfor
networkinginautomotiveapplications.BecauseCAN

ElectricalEngineeringResearchVol.1Iss.4,October2013

is used in so many automotive applications, systems

such as ESP are able to interact with other onboard
vehicle systems using CAN such as engine and
transmissioncontrollers.
CANisfasterthanearlierserialcommunicationprotocols
intheautomotiveindustrysuchasJ1850.Highspeed
CANisabletoreachtransferspeedsinthe500kbytes
1Mbyte/srange.SuchhighdataspeedsmakeCANan
excellentchoiceforsafetycriticalsystemssuchasESP.
CANusesaneventtriggeredprotocol.Thesystemwill
experience peak loads when transmission of multiple
messages is requestedat the same time. CAN utilizes
nondestructivearbitrationallmessageswilleventually
be transmitted. Because CAN uses a nondestructive
arbitration,thesystemmusthavesufficientprocessing
powertomeetalltransmissiondeadlinesduringpeak
loads[CANnetworking,www.can.bosch.com].Thisis
especially critical for hard realtime systems such as
ESP, because any missed deadline during peak bus
loadswouldresultincompletesystemfailure.
Theorderoftransmissionwhenmultiplemessagesare
sentisbaseduponapredefinedpriority.Thismethod
of transmission leads to one significant drawback
duringpeakbusloads:unpredictablelatency.Because
thereisnospecificpieceoftransmissiontimesetaside
for each message, lower priority messages must keep
until all higher priority messages have been sent
beforetheyaregivencontrolofthebus.Dependingon
the amount of load on the bus, some lower priority
messagesmayhavetokeepacoupleofsecondsbefore
transmitting.Becauseofthisunpredictablelatency,it
isimperativeforhardrealtimesystemslikeESPthata
scheduling analysis of the whole system has to be
donetoensurethatalltransmissiondeadlinesaremet
even at peak bus loads [CAN networking,
www.can.bosch.com]. This means that special care
should be taken when a microprocessor for ESP is
selected. The processor should have plenty of spare
capacity even during peak load times to make sure
therearenodelaysforsystemcriticalmessages.
System Operation
ESP works to prevent a vehicle from skidding out of
control. Every 40 ms the ESP system evaluates where
thedriverissteeringthevehicleandwherethevehicle
isactuallygoing.Whenvehicleinstabilityisimminent
duetooversteeringorundersteering,theESPsystem
reacts by selectively breaking the wheels individually

and managing the engine output. By controlling the

amountofslipateachwheelandtheamountoftorque
produced by the engine, ESP is able to stabilize the
vehicle giving the driver control of the vehicle in
critical situations [Braking and Chassis Systems,
www.boschusa.com].

FIG.9OVERSTEERANDUNDERSTEEROFAVEHICLE

During a right hand turn, if the system detects an

oversteercondition,itwillapplybrakepressuretothe
left front wheel. If the system detects an understeer
condition,thenitwillapplypressuretotherightrear
wheel[VanZantenetal.(1999)].ESPhelpsthedriver
to avoid serious accidents caused by skidding or
swerving.
Inadditiontocontrollingthevehiclebyapplyingbrake
pressure, the ESP system also interacts with the engine
managementsystembycommunicatingwiththeengine
controlunit.Theenginecontrollerisalsoanembedded
systemthatisresponsibleforsuchtasksasfuelinjection,
spark timing, throttle control and air/fuel ratio. By
sending control signals to the engine controller, ESP is
able to adjust the amount of torque applied to the
wheels. Even though the driver is fully depressing the
accelerator, ESP may decide that a reduction in wheel
torqueisnecessarytostabilizethevehicle.

FIG.10ONBOARDENGINECONTROLLER[ELECTRIC
STEERINGSYSTEMS,WWW.DELPHI.COM]

RealTimeSystemIssues
Atitsmostbasiclevel,asystemisoneormoreinputs
entering a device and one or more outputs leaving a
device.InthecaseofESP,theapproximatenumberof
inputsis11:

87

ElectricalEngineeringResearchVol.1Iss.4,October2013

1.

BrakeMasterCylinderPressure

2.

BrakeLightSignal

3.

LateralAcceleration

4.

WheelSpeed(4)

5.

YawRate

6.

ParkBrakeSwitch

7.

SteeringWheelAngle

8.

ESPOn/OffSwitch

9.

BrakeFluidLevel

the tire forces or inform the driver. In the event of a

failure, the ESP system may use these actuators
improperly; therefore the system should be designed
toavoidsuchmalfunctions[VanZantenetal.(1999)].

10. Accel.PedalPosition
11. TransmissionStatus
The ESP system uses the input information to
determines the current state and desired state (driver
input) of the vehicle. From these inputs, the system
willgenerateasetofprimaryoutputsignalstoadjust
thestateofthevehicle:
1.

2.

HydraulicControl(brakes)

a.selfprimingrecircpump

b.prechargepump

c.inletvalve

d.outletvalve

e.pressurelimitingEMvalve

f.highpressuresuctionvalve

g.accumulator
a.sparktiming

b.throttlecontrol

c.fuelinjection

3.

TransmissionManagement

4.

DriverInformationSignals

FIG.11ESPI/ODIAGRAM[VANZANTENETAL.(1998)]

The ESP controller calculates the signals for up to 21

actuators (12 valves, pump motor, engine and
transmission controls, 3 driver information lamps,
buzzer, and ON/OFF switch for ESP) which modify

88

ESPistrulyanembeddedsystemwithalmostnoinput
from the user. There is no keyboard or mouse or
monitor.Theonlycontrollableinterfacethatthedriver
hasistheESPon/offswitch.Additionaluserinterfaces
wouldincludetheESPsignalintheclustertoalertthe
driverthatthesystemisactiveorthatthereisanerror
withthesystem.
ESPisacomplexsystemworkingunderverystringent
timing requirements. Every 40 ms the system must
sample the input signals and determine the current
stateofthevehicle.Inthoseinstanceswhenthesystem
detects a critical condition, it will begin to respond
before the driver is even aware of that the vehicle is
steering out of control. Time is of the utmost
importance, because any delay in the systems
response could have disastrous consequences for the
driver.Whendrivingathighwayspeedsundericyor
wet conditions, a tenth of a second could mean the
difference between slamming into a guardrail and
safelystayinginyourlane.

EngineManagementSignals

ESP uses both a polling and interrupt driven I/O

method.Thepollingoccursevery40msasthesystem
collects data from all of the sensors and modules.
These tasks are quietly running in the background
completelyimperceptibletothedriver.ThemainECU
is also constantly monitoring individual system
components for faults and failures. Aside from
collecting data from the sensors, the system is
primarily interrupt driven. When a critical situation
occurs,thesystemimmediatelytakesactionregardless
of what timebased task takes place. The timebased
tasks are suspended until all critical service routines
arecompleted.

ESP should be classified as a hard realtime system.

The system must meet strict timing requirements
during operation. The principle value of ESP is its
ability to react and stabilize the vehicle faster than
humanbeing.SomestateoftheartESPsystemsisable
toactivateatarateof150times/secorevery7ms.This
isfarbetterthanthefastesthumanresponseof300ms
[Braking and Chassis Systems, www.boschusa.com]. In
most cases, ESP identifies the critical situation and
reacts before the driver is even aware of that the
vehicle is out of control [Braking and Chassis Systems,

ElectricalEngineeringResearchVol.1Iss.4,October2013

www.boschusa.com]. If the system were to consistently

missitstimingdeadlines,thentherewouldbenouse
forsuchasystem.
IftheESPsystemfailstomeetatimingdeadline,then
the system has failed entirely. The systems inability
to meet response time requirements could have
disastrous consequences for both the driver of the
vehicle and other drivers on the road. In some
instances,failingtomeettimingdeadlinescouldresult
in death or serious injury to vehicle occupants.
Because of this, ESP is a hard realtime system, and
special precautions must be taken during system
designed to ensure the systems ability to meet
responsetimerequirements.

in the tire slip values that need to be made, the slip

controller will then determine the control signals that
need to be sent to the systems actuators (valves,
pumps, etc) in order to achieve the desired tire slip
values [Van Zanten et al. (1999)]. The slip controller
sendsthesecontrolsignalstothevariousactuatorsto
change the motion of the tires. Below is the flow of
controldatafortheslipcontroller.

Control Structure
The flow of control for ESP begins with the drivers
inputandcurrentvehiclestatus.Thefollowingdatais
gathered from the sensors and sent to the ECU:
steering angle, yaw rate, wheel speed, lateral
acceleration, acceleration pedal pressure, brake pedal
pressure, brake fluid pressure, and engine
management information. From this information, the
ECU calculates the actual motion of the vehicle. In
additiontocalculatingtheactualmotionofthevehicle,
the ECU must also determine the nominal or desired
motion of the vehicle. The nominal motion of the
vehicle is calculated primarily based on driver input
information: steering angle sensor, throttle position
sensor, brake pedal sensor. The nominal motion is
wherethedriverwouldwantthevehicletogowere
it not for the environmental conditions such as a
slipperyroadcausingthevehicletosteeroutofcontrol.
The ESP controller compares the nominal values for
vehicle motion with the actual values for vehicle
motion. Once the difference in these two values is
determined, the ESP controller determines the
correctionsinthetireslipvaluesthatarenecessaryto
achieve the nominal value for vehicle motion [Van
Zantenetal.(1999)].Theoverallcontrolofthevehicle
is based upon theslip values forall four wheels. Tire
slipisthedifferencebetweenthespeedofthetireand
the actual speed of the vehicle. If the tire is spinning
faster than the vehicle that is moving, then the tire
experiencesslip.
The corrections in the tire slip valuesare then sent to
aninternalmoduleoftheESPcontroller.Thismodule
iscalledtheslipcontroller.Baseduponthecorrections

FIG.12SLIPCONTROLLERDATAFLOW[VANZANTENETAL.
(1999)]

Control of ESP operates under a dual feedback loop

system. There is an outer control loop and an inner
control loop. The outer feedback loop calculates
corrections in the nominal slip values of the tires from
the difference between the nominal and actual motion
of the vehicle. These corrections are sent to the inner
feedbackloopwhichderivesthecontrolsignalsforthe
actuators to adjust the tire slip to the nominal values
[VanZantenetal.(1999)].

FIG.13DUALLOOPCONTROLCONCEPT[VANZANTENETAL.
(1999)]

Picturedbelowisthefundamentalcontroltaskforthe
ESP system. The vehicle is the plant. The sensors
transmit information to determine both the nominal
and actual behavior of the vehicle. By comparing the
actual behavior with nominal behavior of the vehicle
corrections to the tire, slip values can be determined.
Actuator control signals derived from the tire slip

89

ElectricalEngineeringResearchVol.1Iss.4,October2013

values are sent to the various actuators in the vehicle

toinitiatebrakeandengineinterventions[VanZanten
etal.(1999)].

FIG.14FUNDAMENTALCONTROLTASK[VANZANTENETAL.
(1999)]

Safety and Robustness

There are several key safety issues that play an
importantroleinthedesignandevaluationinahard
realtime system like ESP. One of the most important
issues is integration and validation of the system
components: sensors, ECU, hydraulic components.
Oftentimes, the components are manufactured by
varioussuppliersandmayhaveproprietaryinterfaces
or internal software that must be adapted to work
with other components. Some of the electronic
modules are not designed for ESP applications. Their
operationsmustbevalidatedandtheirinterfaceshave
to be adapted to the ESP system [Van Zanten et al.
(1999)].
As true with any system made of various modules,
ESPisonlyasgoodasitsweakestcomponent.Forthis
reason,eachcomponentmustbetestedandverifiedto
make sure that it meets the strict safety and timing
requirementsforanESPsystem.
Another challenge faced by suppliers of ESP systems
is vehicle variation. Since driving characteristics and
other components can vary greatly from vehicle to
vehicle, ESP will have to be reconfigured and
validatedforeachvehicle.
Therearetwotypesofsystemshutdownsthatcanbe
used for ESP: soft or hard [Van Zanten et al. (1999)].
The system must be able to evaluate the
appropriatenessofthetypeofshutdowntobeused.In
theeventthatthevehicleisdrivenathighwayspeeds,
a hard shutdown should be avoided if possible. On
the other hand, if the system detects a severe failure
while the vehicle is stopped then a hard shutdown
maybeusedintheformoflimphomeorwalkhome.

90

Limphome mode utilizes the engine management

system to restrict the vehicles speed below 20mph.
This is one advantage of ESP and the engine
managementsystemsharingthesamevehiclenetwork.
When the system determines that a system failure is
severeenoughandthatthedriverssafetyisindanger
then it would create a walkhome condition, another
hardshutdown.Usingtheenginemanagementsystem,
ESP would prevent the engine from starting entirely,
forcing the driver to walk home. Such a system
shutdown would only be used in the worst case
scenario.
In addition, because failure of the ESP system could
have such disastrous consequences steps have been
takentoensurepartialfunctionalityoftheESPsystem
evenwhenfailureoccurs.Thiswouldbeasoftsystem
shutdown. Instead of completely switching off the
system in the event of a failure, certain key elements
like ABS will remain functioning. For example, if the
system discovers a failure in the engine management
interface, then that portion of the system would be
suspendedandthesystemwouldonlyoperateduring
braking [Van Zanten et al. (1999)]. Such steps have
been taken to increase the systems robustness and
faulttolerance.
As with any system like ESP, a thorough Design
Failure Mode and Effects Analysis (DFMEA) should
be completed during system design and testing. This
wouldallowforbuiltincorrectivemeasuresbasedon
the analysis of potential problems resulting from
failures[VanZantenetal.(1999)].
One important feature found in the ESP software is
modelbased sensor monitoring. This type of sensor
monitoring is able to detect failures that are only
slightly out of specification. Modelbased sensor
monitoring operates by comparing the actual output
of the sensor with a predicted output calculated by a
software model [Van Zanten et al. (1999)]. The
software tracks the history of thesensors outputand
determines the possibility of current readings based
upon a model. Once the controller has detected a
sensorthatoperatesoutofspec,thenthecontrolleris
able to decrease its own level of sensitivity to that
sensor. In other words, when a sensor is under
suspicion of failure, the systems magnitude of
response to that sensor may decrease dramatically
[VanZantenetal.(1999)].

ElectricalEngineeringResearchVol.1Iss.4,October2013

FIG.15MODELBASEDSENSORMONITORINGDIAGRAM[VAN
ZANTENETAL.(1999)]

These are just some of the techniques used by

engineers and designers to increase the safety and
reliabilityofvehiclestabilitycontrolsystems.
Future Trends in ESP
As long as the number of embedded systems in
automotiveapplicationscontinuestogrowsowillthe
possibilities of ESP or vehicle stability. With every
vehicle system or function that replaces mechanical
control with electronic control, ESP has another
opportunitytoincreaseitscapabilityandperformance.
The future of ESP will be dictated by advances in
embeddedsystemsforotherautomotiveapplications.
Two of the most significant advancements that will
affect the future of ESP are the development of steer
bywire and brakebywire systems. Removal of the
mechanical element from steering and braking would
allow ESP to have full control over braking and
steeringduringacriticalsituation.
Brake-By-Wire
True brakebywire is also referred to as EMB, or
electromechanical brake. Another form of brakeby
wire is electrohydraulic brake, but this system uses
traditionalmethodstoapplypressuretothebrakesvia
fluid.ForthisdiscussionEMBwillbethefocuswhen
referringtobrakebywire.
EMB eliminates brake fluid and hydraulic lines
entirely.Thebrakingforceisgenerateddirectlyateach
wheel by high performance electric motors. These
motors are controlled by a central ECU and activated
byelectricalsignalssentfromtheECUinresponseto
the electronic pedal module [BrakeByWire
Technologies, www.contionline.com]. Below is the
brakebywire system architecture with the 4 brake
actuatorsonadualTTPbus.

FIG.16EMBSYSTEMARCHITECTURE[HEDENETZ&
BELSCHNER(1998)]

EMB is a hard realtime system. Any kind of system

delay or failure could have disastrous, in some cases
fatalresultsforthedriverofthevehicle.Withoutroom
forerrorduringsystemoperation,specialcaremustbe
taken during system design to ensure robustness and
reliabilityunderallconditions.
There is no physical connection between the brake
pedalandthebrakes.Thismechanicalconnectionhas
been replaced by anelectronic signalsent over a bus.
Without physical connection to the brakes, an
electronicactuatormustbeplacedonthebrakepedal
to simulate the mechanical feedback to the driver.
Consumerswouldneveracceptabrakingsystemthat
lacks the normal feel associated with braking.
Because braking is such a safety critical system, this
kind of brakebywire system would have to use a
fault tolerant bus such as TTP protocol [Hedenetz &
Belschner(1998)].
TTP is a time triggered protocol specifically designed
forClassCautomotiveapplicationsinwhichanykind
ofsystemfailurecouldresultindeathorinjurytothe
driver. The network consists of sets of redundant
ECUswithineachmoduleonthebus.TTPisanideal
choice for hard realtime systems like brakebywire
thatcannottolerateasinglepointoffailurewithinthe
network. The diagram below shows the fault tolerant
units (FTU) that are made of two or more separate
ECUs to ensure continued system operation even if
one of the ECUs within the FTU were to fail. In
addition, TTP operates using a TDMA (time division
multiple access) principle. Each module has its own
TDMAslotwhereitcontrolstheentirecapacityofthe

91

ElectricalEngineeringResearchVol.1Iss.4,October2013

network [Microcontroller Family User s Manual

(1995)].

designedanddeveloped.
Steer-By-Wire
Steerbywire eliminates the mechanical connection
between the driver and the vehicles front tires. The
traditional steering elements are replaced by two
actuators positioned in the vehicles front corners.
Theseactuatorsreceiveinputfromthecontrolmodule
and turn the front wheels per the control modules
instructions.Thesystemalsousesanelectricmotorto
provide road feedback to the steering wheel [Electric
SteeringSystems,www.delphi.com].

FIG.172FTUSONTTPBUS[HEDENETZ&BELSCHNER(1998)]

Truebrakebywireonavehiclewouldallowasystem
suchasESPevengreatercontrolofthevehicleduring
operation.ESPwouldnolongerbeconstrainedbythe
physical limitations of hydraulic braking. There
would be almost no time delay waiting for fluid
pressure to build up when ESP activates. This
shortened response time is extremely valuable for a
hard realtime system like ESP. The fraction of a
second that traditional brakes require to begin
activationmeansthedifferencebetweenstayingonan
icyroadandendingupinaditch.
Because EMB is on the vehicle bus and supports
communication protocols such as CAN, this would
allow for much easier integration with other vehicle
systems such as ESP [Electromechanical Braking
(EMB), www.freescale.com]. The ESP and EMB
controller could be integrated into a single module
thuseliminatingdataEMBwouldgreatlyimprovethe
performance of ESP. Integrating EMB into a vehicle
stability system would decrease response times,
decrease braking distances, eliminate mechanical
braking anomalies, improve system communication
and overall system performance. As the number of
embedded systems in the vehicle increases, so do the
possibilitiesfortotalvehiclecontrol.
EMB takes one more element of vehicle control away
from the driver and gives that control to a computer.
There are risks associated with moving automobile
safety in this direction. Drivers will place more and
more their trust in embedded systems and rely less
andlessontheirowndrivingability.Suchissuesmust
beconsideredwhenfutureautomotiveelectronicsare

92

FIG.18STEERBYWIRE[BRAKEBYWIRETECHNOLOGIES,
WWW.CONTIONLINE.COM]

A true steerbywire system offers many advantages

over traditional mechanical steering systems. A steer
bywirehasfewermechanicalelementsthusreducing
vehiclemassandimprovingfueleconomy.Reducing
the number of hardware components also simplifies
vehicle assembly, improves packaging flexibility and
system reliability [Electric Steering Systems,
www.delphi.com]. Fewer components improve
reliabilitybecausethereislesschanceofsystemfailure
duetocomponentfailure.Steerbywirealsoimproves
steering capability in the front wheels resulting in a
tighter turning radius [Electric Steering Systems,
www.delphi.com]. Steerbywire is an embedded
system with access to the vehicle network thus
allowingeasierintegrationwithothervehiclesystems
suchasESP.
A steerbywire system can be subdivided into three
major subsystems: a controller subsystem, a driver
interface subsystem, and a road wheel subsystem
[Kaufmannetal.(2001)].Thefigurebelowdepictsthe
threesubsystemsofsteerbywire.

ElectricalEngineeringResearchVol.1Iss.4,October2013

wheel torque and roadwheel position inputs for the

othersubsystems[Kaufmannetal.(2001)].

FIG.21ROADWHEELSUBSYSTEM[KAUFMANNETAL.(2001)]

FIG.19STEERBYWIRECONCEPTUALDESIGN[KAUFMANN
ETAL.(2001)]

The handwheel subsystem provides torque feedback

tothedriverandpositioninformationtothecontroller
baseduponthedriversdesirepositionofthesteering
wheel [Kaufmann et al. (2001)]. The subsystem
contains torque sensors and position sensors to
measure the force with which the driver turns the
wheelandtheanglethatthedriverturnsthewheel.In
addition, there is a motor mechanism that provides
feedbacktothedrivertosimulatethetraditionalfeel
ofmechanicalsteering.Thetorquefeedbacksystemis
necessary for drivers to accept the steerbywire
system. If there is mechanical feedback coming
throughthesteeringwheel,driverswouldbelievethat
thecarfailstofunctionproperly.Thetorquefeedback
device is necessary to make steerbywire a
commerciallyviableautomotivesystem.

FIG.20HANDWHEELSUBSYSTEM[KAUFMANNETAL.(2001)]

The roadwheel subsystem positions the wheels

according to input provided by the driver via the
handwheelsubsystem.Theinputisprocessedbythe
controller subsystem. The roadwheel subsystem is
also responsible for providing road force information
back to the controller subsystem to be used in
synthesizing torque feedback to the driver. The
controller subsystem calculates the desired hand

As with brakebywire systems discussed previously,

steerbywire is a safety critical system. Special
measures must be taken to ensure the systems
robustnessandreliabilityunderallconditions.Efforts
are made to avoid design errors, limit complexity,
avoid common mode failures, continuous
maintenanceofanacceptable stateandsupport fault
tolerant operation [Kaufmann et al. (2001)]. While
steerbywire is able to offer much benefit and
improve performance, because of its design, it also
increasesthelevelofriskforsystemfailure.
Steerbywire could be classified as a hard realtime
system.Abilitytomeetresponsetimerequirementsis
criticalforasystemsuchassteerbywire.Thereisno
backupsystemtosteerthevehicleintheeventthatthe
roadwheel actuators are to fail [Kaufmann et al.
(2001)]. The system must be designed to be fault
tolerant, because any kind of system delay or failure
wouldhasdisastrousresultsforthedriver.
Steerbywire offers much benefit for vehicle stability
systems such as ESP. Steering control could be
integrated into the ESP system and would remove
driver interference during critical situations.
Currentlydriversareabletooutsteerthestabilizing
abilityoftheESPsystem.Incriticalsituations,adriver
might panic and steer the vehicle into an
uncontrollable state. ESP is a very effective system,
buttherearelimitstoitsabilitytostabilizethevehicle.
Ultimately, ESP cannot defy the laws of physics or a
driver determined to steer the vehicle out of control.
Having steerbywire adds an additional level of
control over the vehicle stability system. No longer
dependent upon a drivers decision during a critical
situation with steerbywire, ESP could have total
controlofthevehicle.ESPwouldnowhavetheadded
benefitofcontrollingthedirectionandpositionofthe
road wheels. Steerbywire also opens the possibility
of steering each wheel independently if necessary for

93

ElectricalEngineeringResearchVol.1Iss.4,October2013

theESPsystem.
Steerbywirewouldgreatlyimprovetheperformance
of ESP. It is another element of vehicle control that
could be integrated into ESP. Just like brakebywire,
steerbywire is another example of bywire systems
increasingtheperformanceandpossibilitiesofvehicle
stabilitysystemslikeESP.
With steerbywire, there are certain risks associated
with replacing hard mechanical systems with
computercontrollednetworks.Aswithbrakebywire,
there are critical issues that must be addressed when
an element of vehicle control is taken away from the
driver and given over to a computer system. While
this transition of control offers almost unlimited
potential in terms of safety and control, it also raises
concernsondriverresponsibility.Ifacarweretoget
intoanaccident,whichwouldbeatfault:thedriverof
the vehicle or the steerbywire system manufacturer.
Such issues must be weighed carefully when systems
likesteerbywirearedesignedandimplemented.
Recent advances in dependable embedded system
technology,aswellascontinuingdemandforimproved
handlingandpassiveandactivesafetyimprovements,
have led vehicle manufacturers and suppliers to
actively pursue development in computercontrolled
bywire subsystems [Kaufmann et al. (2001)]. Every
step of advancement in bywire subsystems such as
brakebywire and steerbywire is another step
towardsthedevelopmentofimprovedvehiclestability
systems. As more and more traditionally mechanical
vehicle systems are converted to electronic systems,
the ability to integrate these systems with ESP
increases.ESPwillsoonhavetheabilitytocompletely
control many traditionally mechanical systems like
steering and braking. This control will increase the
performanceandcapabilityofESP.
Advantages and Disadvantages
ESPofferingmuchbenefittovehicleperformanceand
safety, greatly improves a cars ability to steer on icy
or slippery roads and also prevents a vehicle from
spinning out of control during critical situations,
furthermore,itisabletominimizetheadverseeffects
of driving on slippery roads, as well as to recognize
whenthedriverisnolongerabletosafelycontrolthe
vehicle and assists in stabilizing the vehicle. When
used properly, ESP is capable to assist the driver in
avoidingaccidents.Adriverisimmunetohelplessness

94

whenveeringofftheroadonarainyoricyday.When
a driver feels that they have lost control over the
vehicle, ESP is able to react with brake and engine
interventionatarateovertentimesfasterthanhuman
being. When ESP is viewed as mechanism to assist
drivers in critical situation, then it is very beneficial
andgreatlyimprovesvehiclesafety.
WhileESPoffersdriversmuchsafetyandperformance
benefit, it is important that drivers are aware of the
limitations of systems like ESP. The most important
rule to remember is that ESP cannot defy the laws of
physics.ThedriverofanyvehiclewithESPmustkeep
in mind that there are physical limitations to ESPs
ability to stabilize the vehicle. If a driver is going 100
mph and suddenly performs a 90 turn into the
guardrail, then ESP may not be able to stabilize the
vehicle.ItisimportantfordriverstobeawarethatESP
willnotbeabletostabilizethevehicleinallsituations.
Having a vehicle with ESP may give some drivers a
false sense of security about their cars ability to
handleinclementcondition.InnowayisESPalicense
todriverecklesslyininclementconditions.Thisisone
potentialdrawbacktoESP.
An additional issue that must be considered with a
systemlikeESPisdriverresponsibility.Asmoreand
more electronic systems replace traditionally
mechanical systems, an increasing amount of vehicle
control is being given over to embedded systems.
While this offers many safety and performance
benefits,italsocreatesapotentialhazard.Consumers
might become less responsible for their driving and
willsimplyassumethattheircarwillsave.Thisisa
very dangerous trend and all efforts should be made
by manufacturers and dealers to reinforce the notion
thatsuchsystemsaresimplymeanttoassistthedriver.
They were never intended to replace the function of
the driver. Control of the vehicle is ultimately the
responsibilityofthedriver.Itisimportantthatconsumers
be informed of the capabilities and limitations of
systemslikeESPtoavoidpotentiallyfatalincidents.
These are some of the positive and negative issues
surrounding the development of vehicle safety
systemslikeESP.
Conclusion
The use of embedded systems in automotive
applicationshasmadepossiblecurrentstateoftheart
safety systems like ESP. ESP uses high tech sensors,

ElectricalEngineeringResearchVol.1Iss.4,October2013

actuators, and microprocessors to provide vehicle

stability in adverse driving conditions. Originally
introduced by Bosch in 1995, ESP continues to grow
bothinuseandperformance.Asautomotivesuppliers
continue to find new ways to replace existing
mechanical systems with purely electronic ones, the
capability of ESP will continue to improve. At the
same time, automotive suppliers and manufacturers
must carefully way the benefits of such technologies
against the inherent risks of computer controlled
systems. Perhaps the greatest service that suppliers
and manufacturers can perform is to inform
consumers of the capabilities and limitations of these
systems.Thesesystemswillonlybeeffectiveifdrivers
areproperlyinformedonhowtousethem.

Mesa,California,Aug.2022,2001.
Memmer, Scott, Stability Control: Get Your YawYaws
Out!www.edmunds.com,2004.
Microcontroller Family Users Manual, Intel, 8XC196Kx,
8XC196Jx,87C196CA,1995.
Sauter,Thomas,TractionControl,AutomotiveElectronics
Handbook,pp.16.116.19,1999.
Van Zanten, Anton, Bosch ESP Systems: 5 Years of
Experience, SAE Automotive Dynamics & Stability
Conference,Troy,Michigan,May1517,2000.
Van Zanten, Anton, Erhardt, Rainer, Landesfeind, Klaus,
Pfaff, Georg, Stability Control, Automotive Electronics
Handbook,pp.17.117.33,1999.
Van Zanten, Anton, Erhardt, Rainer, Landesfeind, Klaus,

REFERENCES

Pfaff,

BoschBrakingSystems,http://www.boschautoparts.co.uk

Perspective,SAEInternationalCongressandExposition,

BrakingSystems,www.trw.com

Detroit,Michigan,Feb.2326,1998.

Georg,

VDC

Systems

Development

and

ElectromechanicalBraking(EMB),www.freescale.com

www.intel.com/design/auto/chassis.htm

The

Dr. AdnanShaoutisafullprofessorin
the
Electrical
and
Computer
Engineering Department at the
University of Michigan Dearborn. At
present, he teaches courses in fuzzy
logic and engineering applications and
computer engineering (hardware and
software). His current research is in
applications of software engineering
methods, computer architecture, embedded systems, fuzzy
systems, real time systems and artificial intelligence. Dr.
Shaouthasmorethan29yearsofexperienceinteachingand
conducting research in the electrical and computer
engineeringfieldsatSyracuseUniversityandtheUniversity
of Michigan Dearborn; in addition, he has published over
140 papers in topics related to electrical and computer
engineering fields. Dr.Shaout has obtainedB.S.c, M.S. and
Ph.D. in Computer Engineering from Syracuse University,
Syracuse,NY,in1982,1983,1987,respectively.

TTP

Protocols,

http://www.vmars.tuwien.ac.at/

projects/ttp/ttpmain.html
BrakeByWireTechnologies,www.contionline.com.
BrakingandChassisSystems,www.boschusa.com.
Cage, Jerry, Braking Control, Automotive Electronics
Handbook,pp.15.115.16,1999.
CANnetworking,www.can.bosch.com.
ElectricSteeringSystems,www.delphi.com.
Gill, Jim, Electronic Stability Program (ESP) from
Continental Teves: Critical Driving Conditions Are
AvoidedRightfromtheStart,APRNewswire.
Hedenetz, B., Belschner, R., BrakebyWire Without
Mechanical Backup by Using a TTPCommunication
Network, SAE International Congress and Exposition,
Detroit,Michigan,Feb.2326,1998.
Kaufmann,Tim,Millsap,Scott,Murray,BrianandPetrowski,
Jim, Development Experience with SteerbyWire, SAE

Kevin McGirr is a graduate student at the University of

Michigan Dearborn in the Electrical and Computer
EngineeringDepartment.

Future Transportation Technology Conference, Costa

95