State of the art timing analysis
with industry-hardened methods and tools.
...with industry-hardened methods and tools. T1 empowers and enables. T1 is the most frequently deployed timing tool in the automotive industry , being used for many years in hundreds of mass-production projects.
As a worldwide premiere, the ISO 26262 ASIL‑D certified T1-TARGET-SW allows safe instrumentation based timing analysis and timing supervision. In the car. In mass-production.
T1.timing comes with two extension options. Add-on product T1.streaming provides the possibility to stream trace data continuously — over seconds, minutes, hours or even days. Add-on product T1.posix supports POSIX operating systems such as Linux or QNX.
T1.timing comes with a modular concept and several plug-ins which are described in the following. Plug-ins can be easily enabled or disabled at compile-time using dedicated compiler switches such as T1_DISABLE_T1_CONT. To disable T1 altogether, it is sufficient to disable compiler switch T1_ENABLE which leaves the system in a state as of before the T1 integration.
The primary purpose of this tool is to allow engineers to view or edit "locked" logic blocks in older Siemens programming environments like .
: It does not defeat CPU-level hardware passwords or online access passwords.
While powerful for legacy systems, the tool has several hard boundaries:
The (often stylized as S7CanOpener) is a specialized third-party software utility designed to bypass the KNOW_HOW_PROTECT security feature in Siemens SIMATIC S7-300 and S7-400 PLC (Programmable Logic Controller) projects.
: Studying how specific standard library blocks or third-party functions were structured. Safety and Ethical Considerations
: It cannot unlock the newer "Block Privacy" protection introduced in Step 7 v5.5 or any TIA Portal (S7-1200/1500) security features.
: It removes the KNOW_HOW_PROTECT attribute from OB, FC, FB, and DB blocks.
: A system integrator is no longer in business, and the end-user needs to troubleshoot protected code.
For POSIX-based projects, see T1.posix.
The primary purpose of this tool is to allow engineers to view or edit "locked" logic blocks in older Siemens programming environments like .
: It does not defeat CPU-level hardware passwords or online access passwords.
While powerful for legacy systems, the tool has several hard boundaries:
The (often stylized as S7CanOpener) is a specialized third-party software utility designed to bypass the KNOW_HOW_PROTECT security feature in Siemens SIMATIC S7-300 and S7-400 PLC (Programmable Logic Controller) projects.
: Studying how specific standard library blocks or third-party functions were structured. Safety and Ethical Considerations
: It cannot unlock the newer "Block Privacy" protection introduced in Step 7 v5.5 or any TIA Portal (S7-1200/1500) security features.
: It removes the KNOW_HOW_PROTECT attribute from OB, FC, FB, and DB blocks.
: A system integrator is no longer in business, and the end-user needs to troubleshoot protected code.
| Vendor | Operating System |
|---|---|
| Customer | Any in-house OS** |
| Customer | No OS - scheduling loop plus interrupts** |
| Elektrobit | EB tresos AutoCore OS |
| Elektrobit | EB tresos Safety OS |
| ETAS | RTA-OS |
| GLIWA | gliwOS |
| HighTec | PXROS-HR |
| Hyundai AutoEver | Mobilgene |
| KPIT Cummins | KPIT** |
| Siemens | Capital VSTAR OS |
| Micriμm | μC/OS-II** |
| Vector | MICROSAR-OS |
| Amazon Web Services | FreeRTOS** |
| WITTENSTEIN high integrity systems | SafeRTOS** |
| Qorix | Qorix Classic |
| Embedded Office | Flexible Safety RTOS |
(**) T1 OS adaptation package T1-ADAPT-OS required.
| Target Interface | Comment |
|---|---|
| CAN | Low bandwidth requirement: typically one CAN message every 1 to 10ms. The bandwidth consumed by T1 is scalable and strictly deterministic. |
| CAN FD | Low bandwidth requirement: typically one CAN message every 1 to 10ms. The bandwidth consumed by T1 is scalable and strictly deterministic. |
| Diagnostic Interface | The diagnostic interface supports ISO14229 (UDS) as well as ISO14230, both via CAN with transportation protocol ISO15765-2 (addressing modes 'normal' and 'extended'). The T1-HOST-SW connects to the Diagnostic Interface using CAN. |
| Ethernet (IP:TCP, UDP) | TCP and UDP can be used, IP-address and port can be configured. |
| FlexRay | FlexRay is supported via the diagnostic interface and a CAN bridge. |
| Serial Line | Serial communication (e.g. RS232) is often used if no other communication interfaces are present. On the PC side, an USB-to-serial adapter is necessary. |
| JTAG/DAP | Interfaces exist to well-known debug environments such as Lauterbach TRACE32, iSYSTEM winIDEA and PLS UDE. The T1 JTAG interface requires an external debugger to be connected and, for data transfer, the target is halted. TriCore processors use DAP instead of JTAG. |