Mixed-Criticality Systems Based on Time- Triggered Ethernet with - PowerPoint PPT Presentation

Mixed-Criticality Systems Based on Time- Triggered Ethernet with Multiple Ring Topologies University of Siegen Mohammed Abuteir, Roman Obermaisser Naturwissenschaftlich-Technische Fakultät Department Elektrotechnik und Informatik / Embedded Systems

Mixed-Criticality Systems • Need for mixed-criticality systems due to pressing requirement to reduce the number of nodes and cables • Integration of functions with different importance and certification assurance levels on a shared computing platform • Validation of each subsystem to the respective criticality and modular certification Naturwissenschaftlich-Technische Fakultät 2 Department Elektrotechnik und Informatik / Embedded Systems

Requirements for the Communication Network of Mixed-Criticality Systems • Timing Requirements – Fault-tolerant global time with high precision – Bounded latency and low jitter • Encapsulation and Fault Containment – Absence of interference and unintended side-effects due to integration – Fault containment using time and space partitioning – Foundation for modular certification • Heterogeneity of Mixed-Criticality Systems – Multiple assurance levels (e.g.,SIL1-4 in IEC61508,Class A-E in DO178B) – Different reliability and fault-tolerance requirements – Different timing models (e.g., periodic, sporadic and aperiodic activities) Naturwissenschaftlich-Technische Fakultät 3 Department Elektrotechnik und Informatik / Embedded Systems

Real-Time Ethernet in Mixed-Criticality Systems • Avionics Full-Duplex Switched Ethernet (AFDX) – Rate-constrained virtual links and priorities – Bounded timing effects between virtual links • Time-Triggered Ethernet (TTE) – Time-triggered communication according to a static TDMA scheme – Contention with rate- constrained and best-effort communication resolved using timely blocking, shuffling or preemption Naturwissenschaftlich-Technische Fakultät 4 Department Elektrotechnik und Informatik / Embedded Systems

Fault Assumptions • End systems, switches and physical links regarded as Fault Containment Regions (FCR) • Failure modes based on IEC61508-2 – Component crash – Link failures – Omission – Corruption – Delay – Babbling idiot – Masquerading • Single failure of an end system or detectably faulty behavior of switch Naturwissenschaftlich-Technische Fakultät 5 Department Elektrotechnik und Informatik / Embedded Systems

System Model of Ring-Based Real-Time Ethernet Architecture • Non-redundant and redundant end-systems • Connection of end systems to switches in star topology • Interconnection of switches in ring topology • Interconnection of rings using peripheral switches End End End End System System System System 1.1 1.2 2.1 2.2 End End System System End Switch Switch 1.3 Switch Switch 1.1 1.2 1.7 System 2.1 2.2 2.3 Peripheral Switch 1 End Switch End Switch System Peripheral Switch Switch 1.4 1.3 System Switch 2 2.4 1.6 2.3 2.7 End System End End End End 2.6 System System System System 1.4 1.5 2.4 2.5 Naturwissenschaftlich-Technische Fakultät 6 Department Elektrotechnik und Informatik / Embedded Systems

End Systems • Safety-critical end system – RC and TT messages on double channels – BE can exploit two channels for higher bandwidth – Connection to two switches • Non safety-critical end system – Non redundant channel to one switch – Support for replication of messages at first switch Naturwissenschaftlich-Technische Fakultät 7 Department Elektrotechnik und Informatik / Embedded Systems

Conceptual Switch Model • Bridge forwards messages between ingress and egress queues • Schedule for time- triggered messages • Bandwidth Allocation Gap (BAG) and jitter for each virtual link • MAC layer and physical layer based on 802.1 and 802.3 Naturwissenschaftlich-Technische Fakultät 8 Department Elektrotechnik und Informatik / Embedded Systems

Redundancy Management • Hides the path and latency of the redundant messages • Establishment of redundancy – Outgoing time-triggered and rate-constrained messages from non safety-critical end systems – First switch that meets rate-constrained or time- triggered traffic creates copies of an incoming message – Transmission using redundant paths of the ring • Fusion of redundant messages – Last switch of a message’s path to a non safety-critical end-system – Safety-critical end-systems fuse internally Naturwissenschaftlich-Technische Fakultät 9 Department Elektrotechnik und Informatik / Embedded Systems

Redundancy Management (RM) Layer • Time-triggered Messages – RM layer interfaces with the time-triggered scheduling layer to hide the redundant paths and to perform the deduplication of time-triggered messages – RM layer checks the corresponding virtual-link buffer before the sending time and takes the decision to send on of the redundant time-triggered messages accordingly – Establishment of deterministic timing (e.g., no effect on timing due to an omission failure on a redundant channel) • Rate-constrained Redundancy Management Decision messages Redundant TT Message TT Message VL1 VL1 – Sequence number – first valid wins policy Naturwissenschaftlich-Technische Fakultät 10 Department Elektrotechnik und Informatik / Embedded Systems

Error Detection and Containment • Error detection by MAC layer (e.g., CRC) • Time-triggered traffic – Reception from correct ingress port – Specified receiving window – Protection of receiving end systems and channels (e.g., babbling idiot, masquerading) – Dedicated guaranteed buffer capacity for different virtual links (and different criticalities) • Rate constrained traffic – Violation of BAG – Dedicated guaranteed buffer capacity • Best effort – Error detection and containment based on standard Ethernet – Spanning Tree Protocol Naturwissenschaftlich-Technische Fakultät 11 Department Elektrotechnik und Informatik / Embedded Systems

End System End System • Fork layer maps Application layer messages to Application #1 Application #2 Application #n applications • Time-triggered clock Fork Layer layer transmits messages according to RC BE TT Shaper the schedule Priorty clock • Rate-constrained TTE controller shaper enforces BAG at end system MAC interface • TTE controller layer sends messages MAC Layer MAC Layer according to their Physical Layer Physical Layer priority Naturwissenschaftlich-Technische Fakultät 12 Department Elektrotechnik und Informatik / Embedded Systems

Evaluation based on Simulation • TTEthernet simulation environment based on OPNET • Simulation building blocks for switches and end systems • Simulation of MAC and physical layer from previous work ES_ 1 ES_ 2 SW_1 SW_2 ES_ 7 Link #2 Link #6 Link #3 Link #5 ES_ 3 SW_4 SW_3 ES_ 6 Link #4 ES_ 5 ES_ 4 Naturwissenschaftlich-Technische Fakultät 13 Department Elektrotechnik und Informatik / Embedded Systems

Example Scenario ES_ 1 ES_ 2 SW_1 SW_2 ES_ 7 Link #2 Link #6 Link #3 Link #5 ES_ 3 SW_4 SW_3 ES_ 6 Link #4 Naturwissenschaftlich-Technische Fakultät ES_ 5 ES_ 4 14 Department Elektrotechnik und Informatik / Embedded Systems

Example ES_ 1 ES_ 2 SW_1 SW_2 ES_ 7 Link #2 Link #6 Link #3 Link #5 ES_ 3 SW_4 SW_3 ES_ 6 Link #4 ES_ 5 ES_ 4 Naturwissenschaftlich-Technische Fakultät 15 Department Elektrotechnik und Informatik / Embedded Systems

Results (1) Babbling Idiot Omission Application Fault Free Case ID Sender Failure (ES3) Failure (SW3) Type Latency Jitter Latency Jitter Latency Jitter 1 App.1 ES 1 0,10 0,00 0,10 0,00 0,10 0,00 2 App.4 ES 1 1,02 0,00 1,02 0,00 1,02 0,00 3 App.7 ES 2 93,97 93,95 97,91 97,89 122,02 122,00 4 App.2 ES 3 134,05 126,00 Fault Injection 146,07 146,02 5 App.7 ES 3 155,19 155,14 Fault Injection 177,25 177,22 6 App.1 ES 4 0,09 0,00 0,09 0,00 0,09 0,00 7 App.2 ES 4 138,79 138,76 158,05 158,02 139,75 139,05 8 App.4 ES 4 2,03 0,00 2,03 0,00 2,03 0,00 9 App.5 ES 4 70,09 68,27 70,09 68,27 97,66 97,64 10 App.3 ES 5 5,07 0,00 5,07 0,00 5,07 0,00 11 App.5 ES 5 61,65 61,64 61,68 61,67 88,26 88,17 12 App.2 ES 6 132,10 132,05 138,81 138,76 100,16 100,13 13 App.6 ES 6 92,00 91,97 100,06 98,86 102,11 102,09 14 App.3 ES 7 0,01 0,00 0,01 0,00 0,01 0,00 15 App.6 ES 7 98,06 78,73 98,14 98,13 112,26 112,25 Naturwissenschaftlich-Technische Fakultät 16 Department Elektrotechnik und Informatik / Embedded Systems

Results (2) Omission Link Delay Application ID Sender Failure (L2) Failure (L3) Failure (ES5) Type Latency Jitter Latency Jitter Latency Jitter 1 App.1 ES 1 0,10 0,00 0,10 0,00 0,10 0,00 2 App.4 ES 1 1,02 0,00 1,02 0,00 1,02 0,00 3 App.7 ES 2 119,91 119,89 90,01 89,99 93,97 93,95 4 App.2 ES 3 110,30 110,23 76,05 75,99 132,05 124,00 5 App.7 ES 3 151,39 151,37 151,16 151,14 155,19 155,14 6 App.1 ES 4 0,09 0,00 0,09 0,00 0,09 0,00 7 App.2 ES 4 138,79 138,76 142,19 141,85 166,07 166,03 8 App.4 ES 4 2,03 0,00 2,03 0,00 2,03 0,00 9 App.5 ES 4 70,09 68,27 71,05 69,04 70,08 68,26 10 App.3 ES 5 5,07 0,00 5,07 0,00 5,07 0,00 11 App.5 ES 5 57,89 57,88 65,68 65,67 161,65 161,64 12 App.2 ES 6 134,05 126,04 137,20 157,18 132,10 132,05 13 App.6 ES 6 92,00 91,97 96,00 95,98 100,05 100,02 14 App.3 ES 7 0,01 0,00 0,01 0,00 0,01 0,00 15 App.6 ES 7 97,09 88,38 78,09 78,03 98,06 78,73 Naturwissenschaftlich-Technische Fakultät 17 Department Elektrotechnik und Informatik / Embedded Systems