Network Calculus-based Timing Analysis of AFDX networks incorporating   multiple TSN/BLS traffic classes

Anais Finzi; Ahlem Mifdaoui; Fabrice Frances; Emmanuel Lochin

arXiv:1905.00399·cs.NI·August 8, 2019

Network Calculus-based Timing Analysis of AFDX networks incorporating multiple TSN/BLS traffic classes

Anais Finzi, Ahlem Mifdaoui, Fabrice Frances, Emmanuel Lochin

PDF

Open Access

TL;DR

This paper extends Network Calculus models to analyze timing in AFDX networks with multiple TSN/BLS traffic classes, enabling better real-time bounds for heterogeneous avionics systems.

Contribution

It generalizes existing Network Calculus models to handle multiple BLS classes in multi-hop networks, improving timing analysis for mixed-criticality avionics traffic.

Findings

01

The generalized model is more accurate and tight compared to CPA.

02

Extended AFDX improves delay bounds for medium priority traffic.

03

Model validation on realistic configurations confirms its effectiveness.

Abstract

We propose a formal timing analysis of an extension of the AFDX standard, incorporating the TSN/BLS shaper, to homogenize the avionics communication architecture, and enable the interconnection of different avionics domains with mixed-criticality levels, e.g., current AFDX traffic, Flight Control and In-Flight Entertainment. Existing Network Calculus models are limited to three classes, but applications with heterogeneous traffic require additional classes. Hence, we propose to generalize an existing Network Calculus model to do a worst-case timing analysis of an architecture with multiple BLS on multi-hop networks, to infer real-time bounds. Then, we conduct the performance analysis of such a proposal. First we evaluate the model on a simple 3-classes single-hop network to assess the sensitivity and tightness of the model, and compare it to existing models (CPA and Network Calculus).…

Tables8

Table 1. Table 1: Notations

$C$	Link speed
$M F S_{i}$	Maximum Frame Size of flow or class $i$
$J_{f}, D l_{f}$ , $B A G_{f}$	Jitter, deadline and BAG of flow $f$
$L_{M}^{k}, L_{R}^{k}$	BLS maximum and resume credit levels of class $k$
$L_{M}, L_{R}$	BLS maximum and resume credit levels when considering a single shaped class
$B W^{k}$	BLS reserved bandwidth of class $k$
$B W$	BLS reserved bandwidth when considering a single shaped class
$I_{i d l e}^{k}, I_{s e n d}^{k}$	BLS idle and sending slopes of class $k$ , defined in Eq. (1) and Eq. (2)
$I_{i d l e}, I_{s e n d}$	BLS idle and sending slopes when considering a single shaped class
$p (k)$	Priority level of a class $k$
$p_{H} (k)$	BLS high priority of class $k$
$p_{L} (k)$	BLS low priority of class $k$
$H C (k)$	Set of flows or classes with a priority strictly higher than $p_{H} (k)$ , i.e., $\forall j$ such as: $p_{H} (k) > p (j)$
$L C (k)$	Set of flows or classes with a priority strictly lower than $p_{L} (k)$ , i.e., $\forall j$ such as: $p_{L} (k) < p (j)$
$M C (k)$	Set of flows or classes with a priority strictly between $p_{L} (k)$ and $p_{H} (k)$
$U R_{k}$	Utilisation rate of a class $k$ at the input of a output port
$U R_{k}^{b n}$	The bottleneck network utilisation rate of a class $k$
$n_{k}^{e s}$	Number of flows of class $k$ generated per node $e s$
$γ_{k}^{n}$	Maximum service curve guaranteed for the traffic class $k$ within node $n$
$γ_{k}^{b l s, f l u i d}$	Maximum service curve of class $k$ in the BLS node when considering fluid traffics
$β_{k, f}^{n}$	Strict minimum service curve guaranteed to a flow $f$ of class $k$ in a node $n \in {e s, m u x}$
$β_{k}^{n}$	Strict minimum service curve guaranteed for the traffic class $k$ in a node $n \in {e s, m u x}$ (end-system or output multiplexer) or component $n \in {b l s, s p}$
$β_{k \in B L S, p}^{s p}$	Strict minimum service curve guaranteed to BLS class $k$ when having the priority level $p$ in a $s p$ component
$β_{k}^{b l s, f l u i d}$	Strict minimum service curve of class $k$ in the BLS node when considering fluid traffics
$α_{k, f}^{n}$	Input arrival curve of the flow $f$ of class $k$ in the node $n \in {e s, m u x}$ or component $n \in {b l s, s p}$ in its path
$α_{k}^{n}$	Input arrival curve of the aggregated flows of class $k$ in a node $n \in {e s, m u x}$ or component $n \in {b l s, s p}$
$α_{k, f}^{*, n}$	Output arrival curve of the flow f of class $k$ from the node $n \in {e s, m u x}$ or component $n \in {b l s, s p}$ in its path
$α_{k}^{*, n}$	Output arrival curve of the aggregated flows of class $k$ from a node $n \in {e s, m u x}$ or a component $n \in {b l s, s p}$
$D e a d l i n e_{k, f}^{e n d 2 e n d}$	End-to-end deadline of flow $f$ of class $k$
$d e l a y_{k, f}^{e n d 2 e n d}$	End-to-end delay of flow $f$ of class $k$
$d e l a y_{k, f}^{n}$	Delay of flow $f$ of class $k$ in a node $n \in {e s, s w, m u x}$
$d e l a y_{k, f}^{p r o p}$	Propagation delay of flow $f$ of class $k$

Table 2. Table 2: Avionics flow Characteristics

Priority	Traffic type	MFS	BAG	deadline	jitter
		(Bytes)	(ms)	(ms)	(ms)
0/2	SCT	64	2	2	0
1	RC	320	2	2	0
3	BE	1024	8	none	0.5

Table 3. Table 3: CPA and NC models computation times for the different scenarios

scenario	CPA	NC	CPA/NC
	(s)	(s)
varying SCT	97.2	0.0051	19 058
varying RC	71.4	0.0032	22 187
varying $L_{M}$	384.4	0.0072	53 388
varying $L_{R}$	1059	0.0100	105 900
varying $B W$	390	0.0095	41 052

Table 4. Table 4: 6 priorities: Avionics flow Characteristics

Name	Priorities	Traffic	MFS	BAG	deadline	jitter
		type	(Bytes)	(ms)	(ms)	(ms)
$S C T_{1}$	1	SCT	64	2	1	0
$S C T_{2}$	2/5	SCT	128	4	4	0
$R C_{1}$	3	RC	256	4	4	0
$R C_{2}$	4/6	RC	512	8	8	0
$B E_{1}$	7	BE	1024	2	none	0.5
$B E_{2}$	8	BE	1500	8	none	0.5

Table 5. Table 5: Considered Test Scenarios with 6 classes

Scenarios	$S c e n a r i o_{S C T_{2}}$	$S c e n a r i o_{R C_{1}}$	$S c e n a r i o_{R C_{2}}$
$U R_{S C T_{1}}^{b n} (%)$	$5$	$5$	$5$
$U R_{S C T_{2}}^{b n} (%)$	$[0.4..50]$	$25$	$25$
$U R_{R C_{1}}^{b n} (%)$	$5$	$[0.8..30]$	$5$
$U R_{R C_{2}}^{b n} (%)$	$5$	$5$	$[0.8..30]$
$U R_{B E_{1}}^{b n} (%)$	$15$	$15$	$15$
$U R_{B E_{2}}^{b n} (%)$	$20$	$20$	$20$
$n_{S C T_{1}}^{e s}$	$12$	$12$	$12$
$n_{S C T_{2}}^{e s}$	$[1 : 5 : 122]$	$36$	$36$
$n_{R C_{1}}^{e s}$	$6$	$[1 : 2 : 36]$	$6$
$n_{R C_{2}}^{e s}$	$6$	$6$	$[1 : 2 : 36]$
$n_{B E_{1}}^{e s}$	$18$	$18$	$18$
$n_{B E_{2}}^{e s}$	$33$	$33$	$33$

Table 6. Table 6: S C T 2 𝑆 𝐶 subscript 𝑇 2 SCT_{2} schedulability limits

$S c e n a r i o_{S C T_{2}}$	maximum $U R_{S C T_{2}}$ (% C)
SP	23
BLS, $B W^{S C T_{2}} = 0.90$ , $B W^{R C_{2}} = 0.50$	23
BLS, $B W^{S C T_{2}} = 0.10$ , $B W^{R C_{2}} = 0.50$	25
BLS, $B W^{S C T_{2}} = 0.50$ , $B W^{R C_{2}} = 0.50$	25
BLS, $B W^{S C T_{2}} = 0.74$ , $B W^{R C_{2}} = 0.50$	32

Table 7. Table 7: Flight Control application: scenarios

scenario	$M F S_{S C T}$	$B A G_{S C T}$	$D e a d l i n e_{S C T}$	$M F S_{R C}$	$B A G_{R C}$	$D e a d l i n e_{R C}$
	(bytes)	( $μ$ s)	( $μ$ s)	(bytes)	( $μ$ s)	(ms)
1	64	2000	1000	320	2000	2000
2	64	1000	1000	320	2000	2000
3	64	1000	500	320	2000	2000
4	64	1000	1000	320	4000	4000
5	64	1000	1000	640	2000	2000
6	64	1000	1000	1280	2000	2000
7	128	1000	1000	320	2000	2000
8	256	1000	1000	320	2000	2000

Table 8. Table 8: Flight Control application: results

scenario	$d e l a y_{S C T}^{e n d 2 e n d, B L S}$	$d e l a y_{S C T}^{e n d 2 e n d, S P}$	$d e l a y_{R C}^{S W 1, B L S}$	$d e l a y_{R C}^{S W 1, S P}$
	( $μ$ s)	( $μ$ s)	( $μ$ s)	( $μ$ s)
1	120.00	130.27	44.89	55.16
2	121.96	132.7	44.89	55.63
3	121.96	132.7	44.89	55.63
4	184.54	195.73	84.73	95.92
5	129.91	140.70	47.46	58.25
6	145.80	156.68	52.60	63.48
7	176.53	198.74	45.55	67.76
8	298.62	345.21	46.79	93.38

Equations269

I_{i d l e}^{k} = B W^{k} \cdot C

I_{i d l e}^{k} = B W^{k} \cdot C

I_{se n d}^{k} = C - I_{i d l e}^{k}

I_{se n d}^{k} = C - I_{i d l e}^{k}

I_{i}^{S B} (δ t) = ⌈ \frac{δ t}{t _{I}^{S -}} ⌉ \cdot t_{I}^{R +}

I_{i}^{S B} (δ t) = ⌈ \frac{δ t}{t _{I}^{S -}} ⌉ \cdot t_{I}^{R +}

\forall t, R (t) \leq R \otimes α (t)

\forall t, R (t) \leq R \otimes α (t)

\forall t, R^{*} (t) \leq R \otimes γ (t)

\forall t, R^{*} (t) \leq R \otimes γ (t)

β_{1}^{n} (t) = (β (t) - α_{2} (t))_{↑}

β_{1}^{n} (t) = (β (t) - α_{2} (t))_{↑}

β_{i} (t) = β (t) - \forall j, p (j) < p (i) \sum α_{j} (t) - \forall l, p (l) ⩾ p (i) max M F S_{l}_{↑}

β_{i} (t) = β (t) - \forall j, p (j) < p (i) \sum α_{j} (t) - \forall l, p (l) ⩾ p (i) max M F S_{l}_{↑}

\displaystyle delay^{max}_{f}=\underset{j}{\min}\Big{(}\frac{y_{k}}{R_{j}}+T_{j}-x_{k}\Big{)}\textnormal{, with: }k=\min\{i|r_{i}\leqslant R_{j}\}

\displaystyle delay^{max}_{f}=\underset{j}{\min}\Big{(}\frac{y_{k}}{R_{j}}+T_{j}-x_{k}\Big{)}\textnormal{, with: }k=\min\{i|r_{i}\leqslant R_{j}\}

\left\{\begin{array}[]{ll}x_{1}=0,y_{1}=b_{1}\\ x_{k}=\frac{b_{k}-b_{k-1}}{r_{k-1}-r_{k}},y_{k}=b_{k}+r_{k}\cdot x_{k}\textnormal{, for }2\leqslant k\leqslant n\\ x_{n+1}=+\infty,y_{n+1}=\infty\\ \end{array}\right.

\left\{\begin{array}[]{ll}x_{1}=0,y_{1}=b_{1}\\ x_{k}=\frac{b_{k}-b_{k-1}}{r_{k-1}-r_{k}},y_{k}=b_{k}+r_{k}\cdot x_{k}\textnormal{, for }2\leqslant k\leqslant n\\ x_{n+1}=+\infty,y_{n+1}=\infty\\ \end{array}\right.

d e l a y^{ma x} = \frac{y _{k}}{R _{j}} + T_{j} - x_{k}, with: k = min {i ∣ r_{i} \leq R_{j}}

d e l a y^{ma x} = \frac{y _{k}}{R _{j}} + T_{j} - x_{k}, with: k = min {i ∣ r_{i} \leq R_{j}}

\textnormal{and with: }\left\{\begin{array}[]{ll}x_{1}=0,y_{1}=b_{1}\\ \alpha_{k}(x_{1})=\alpha_{k+1}(x_{1})=y_{k}\textnormal{, for }1\leqslant k\leqslant n\\ x_{n+1}=+\infty,y_{n+1}=\infty\\ \end{array}\right.

\textnormal{and with: }\left\{\begin{array}[]{ll}x_{1}=0,y_{1}=b_{1}\\ \alpha_{k}(x_{1})=\alpha_{k+1}(x_{1})=y_{k}\textnormal{, for }1\leqslant k\leqslant n\\ x_{n+1}=+\infty,y_{n+1}=\infty\\ \end{array}\right.

(α ⊘ β) (t)

(α ⊘ β) (t)

β_{k}^{es} (t) = C \cdot t - \forall (i, f), f \in i, p (i) < p (k) \sum α_{i, f}^{es} (t) - \forall (i, f), f \in i, p (i) ⩾ p (k) max M F S_{f}_{↑}

β_{k}^{es} (t) = C \cdot t - \forall (i, f), f \in i, p (i) < p (k) \sum α_{i, f}^{es} (t) - \forall (i, f), f \in i, p (i) ⩾ p (k) max M F S_{f}_{↑}

α_{k, f}^{n} (t) = b_{k, f}^{n} + r_{k, f}^{n} \cdot t

α_{k, f}^{n} (t) = b_{k, f}^{n} + r_{k, f}^{n} \cdot t

α_{k}^{es} (t)

α_{k}^{es} (t)

\forall node n \in network, \forall i ∋ n \sum r_{i} ⩽ R_{n}

\forall node n \in network, \forall i ∋ n \sum r_{i} ⩽ R_{n}

\forall class k, \forall flow f \in k, d e l a y_{k, f}^{e n d 2 e n d} ⩽ D e a d l in e_{k, f}^{e n d 2 e n d}

\forall class k, \forall flow f \in k, d e l a y_{k, f}^{e n d 2 e n d} ⩽ D e a d l in e_{k, f}^{e n d 2 e n d}

d e l a y_{k, f}^{e n d 2 e n d} = d e l a y_{k, f}^{es} + d e l a y_{k, f}^{p r o p} + s w \in p a t h_{f} \sum d e l a y_{k, f}^{s w}

d e l a y_{k, f}^{e n d 2 e n d} = d e l a y_{k, f}^{es} + d e l a y_{k, f}^{p r o p} + s w \in p a t h_{f} \sum d e l a y_{k, f}^{s w}

β_{k}^{b l s} (t) = C - h \in H C (k) \sum r_{h} - \frac{M F S _{k}^{s a t}}{Δ _{in t er}^{k, β}} \cdot \frac{I _{i d l e}^{k}}{C} \cdot (t - Δ_{i d l e}^{k, β})^{+}

β_{k}^{b l s} (t) = C - h \in H C (k) \sum r_{h} - \frac{M F S _{k}^{s a t}}{Δ _{in t er}^{k, β}} \cdot \frac{I _{i d l e}^{k}}{C} \cdot (t - Δ_{i d l e}^{k, β})^{+}

M F S_{k}^{s a t}

M F S_{k}^{s a t}

Δ_{in t er}^{k, β}

L_{R}^{k, min}

Δ_{i d l e}^{k, β}

β_{S C T}^{b l s} (t) = (C - \frac{M F S _{S C T}^{s a t}}{Δ _{in t er}^{β}}) \cdot \frac{I _{i d l e}}{C} \cdot (t - Δ_{i d l e}^{β})^{+}

β_{S C T}^{b l s} (t) = (C - \frac{M F S _{S C T}^{s a t}}{Δ _{in t er}^{β}}) \cdot \frac{I _{i d l e}}{C} \cdot (t - Δ_{i d l e}^{β})^{+}

M F S_{S C T}^{s a t}

M F S_{S C T}^{s a t}

Δ_{in t er}^{β}

L_{R}^{min}

Δ_{i d l e}^{β}

γ_{k}^{b l s} (t) = \frac{Δ _{se n d}^{k, γ}}{Δ _{in t er}^{k, γ}} \cdot C \cdot t + b_{k}^{ma x} \cdot \frac{Δ _{i d l e}^{k, γ}}{Δ _{in t er}^{k, γ}}

γ_{k}^{b l s} (t) = \frac{Δ _{se n d}^{k, γ}}{Δ _{in t er}^{k, γ}} \cdot C \cdot t + b_{k}^{ma x} \cdot \frac{Δ _{i d l e}^{k, γ}}{Δ _{in t er}^{k, γ}}

b_{k}^{ma x} = \frac{C}{I _{se n d}^{k}} \cdot L_{M}^{k} + M F S_{k}

b_{k}^{ma x} = \frac{C}{I _{se n d}^{k}} \cdot L_{M}^{k} + M F S_{k}

Δ_{se n d}^{k, γ} = \frac{M F S _{k}}{C} + \frac{L _{M}^{k} - L _{R}^{k}}{I _{se n d}^{k}}

Δ_{se n d}^{k, γ} = \frac{M F S _{k}}{C} + \frac{L _{M}^{k} - L _{R}^{k}}{I _{se n d}^{k}}

Δ_{i d l e}^{k, γ} = \frac{L _{M}^{k} - L _{R}^{k}}{I _{i d l e}^{k}}

Δ_{i d l e}^{k, γ} = \frac{L _{M}^{k} - L _{R}^{k}}{I _{i d l e}^{k}}

Δ_{in t er}^{k, γ} = Δ_{se n d}^{k, γ} + Δ_{i d l e}^{k, γ}

Δ_{in t er}^{k, γ} = Δ_{se n d}^{k, γ} + Δ_{i d l e}^{k, γ}

Peer Reviews

No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.

Videos

No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.

Taxonomy

TopicsReal-Time Systems Scheduling · Network Time Synchronization Technologies · Interconnection Networks and Systems

Full text

11institutetext: University of Toulouse,ISAE-SUPAERO, France

Network Calculus-based Timing Analysis of AFDX networks incorporating multiple TSN/BLS traffic classes

Anaïs FINZI

Ahlem MIFDAOUI

Fabrice FRANCES

Emmanuel LOCHIN

[email protected]

Abstract

We propose a formal timing analysis of an extension of the AFDX standard, incorporating the TSN/BLS shaper, to homogenize the avionics communication architecture, and enable the interconnection of different avionics domains with mixed-criticality levels, e.g., current AFDX traffic, Flight Control and In-Flight Entertainment. Existing Network Calculus models are limited to three classes, but applications with heterogeneous traffic require additional classes. Hence, we propose to generalize an existing Network Calculus model to do a worst-case timing analysis of an architecture with multiple BLS on multi-hop networks, to infer real-time bounds. Then, we conduct the performance analysis of such a proposal. First we evaluate the model on a simple 3-classes single-hop network to assess the sensitivity and tightness of the model, and compare it to existing models (CPA and Network Calculus). Secondly, we study a realistic AFDX configuration with six classes and two BLS. Finally, we compute a real use-case to add A350 flight control traffic to the AFDX. Results show the good properties of the generalized Network Calculus model compared to the CPA model and the efficiency of the extended AFDX to noticeably enhance the medium priority level delay bounds, while respecting the higher priority level constraints, in comparison with the current AFDX standard.

1 Introduction
2 Background and Related Work
2.1 Burst Limiting Shaper
2.2 Existing Worst-case Timing Analyses of TSN/BLS Shaper
3 Network Calculus framework
4 System Model
4.1 Network model
4.2 Traffic Model
5 Worst-case Timing Analysis
5.1 Schedulability Conditions
5.2 BLS node model: generalized Continuous Credit-based Approach (gCCbA)
5.3 Output port multiplexer service curves
5.4 Computing End-to-End Delay Bounds
5.5 Discussion: is the BLS really a shaper?
6 Performance Analysis
6.1 Use-case 1: sensitivity, tightness and comparison with CPA
6.2 Use-case 2: multiple BLS for 6 classes
6.3 Use-case 3: adding A350 Flight Control to the AFDX
7 Conclusion
A Computing Achievable Worst-Cases
A.1 SCT achievable worst-cases
A.1.1 Methodology
A.1.2 SCT Achievable Worst-Case 1
A.1.3 SCT Achievable Worst-Case 2
A.2 RC achievable worst-cases
A.2.1 Methodology
A.2.2 RC Achievable Worst-Case 1
A.2.3 RC Achievable Worst-Case 2
B Generalized Continuous-Credit-based Approach (gCCbA) model proofs
B.1 Continuous-credit Lemmas
B.2 Th.5.1: gCCbA strict minimum service curve
B.3 Th.5.2: gCCbA maximum service curve

1 Introduction

The growing number of interconnected end-systems and the expansion of exchanged data in avionics have led to an increase in complexity of the communication architecture. To cope with this trend, a first communication solution based on a high rate backbone network, i.e., the AFDX (Avionics Full Duplex Switched Ethernet) ARINC664 , has been implemented by Airbus in the A380, to interconnect critical subsystems. Moreover, some low rate data buses, e.g., CAN CAN , are still used to handle some specific avionics domains, such as the I/O process and the Flight Control Management. Although this architecture reduces the time to market, it conjointly leads to inherent heterogeneity and new challenges to guarantee the real-time requirements.

To cope with these emerging issues, with the maturity and reliability progress of the AFDX after a decade of successful use, a homogeneous avionic communication architecture based on such a technology to interconnect different avionics domains may bring significant advantages, such as quick installation and maintenance and reduced weight and costs.

Furthermore, this new communication architecture needs to support, in addition to the current AFDX traffic profile, called Rate Constrained (RC) traffic, at least two extra profiles. The first, denoted by Safety-Critical Traffic (SCT), is specified to support flows with hard real-time constraints and the highest criticality level, e.g., flight control data; whereas the second is for Best-Effort (BE) flows with no delivery constraint and the lowest criticality level, e.g., In-Flight Entertainment traffic.

Various fair solutions exist to solve this issues, for instance implementing well-known scheduling schemes, e.g., Deficit-Round-Robin (DRR) hua2012scheduling , Weighted-Round-Robin (WRR) tianran2012design . However, these solutions are notably hard to tune.

More recently, the Audio Video Bridging (AVB) Task Group proposed a new shaper: the Credit-Based Shaper (CBS) diemer2012formal . However, it has a severe limitation: it is a blocking shaper, which may cause undue delays. To fix this issue, the Time Sensitive Networking (TSN) task group has proposed the Burst Limiting Shaper (BLS).

As these are promising solutions, they have gathered interest from the automotive thiele2016formal , avionics schneele2012comparison and internet communities globefinzi17 . In this last work, simulations showed the interest of the BLS as it offers a new, more predictable service. However, for time sensitive traffic in automotive, avionics or satellite applications, a formal analysis to compute worst-case latencies is needed. Additionally, for an avionics use, worst-case bounds are required to obtain the certification. A first work in erts2finzi17 proposed a detailed analysis of these mixed-criticality solutions.

Additionally, Urgency Based Scheduler (UBS) specht2016urgency is a novel fair scheduler with good modularity and predictability, that had not been considered in erts2finzi17 . In gavrilut2017fault specht2016urgency , they conclude that the implementation complexity is low, in part because they assume the queue selection process is already implemented in the switches thanks to the standardization of 802.1Qci-Per-Stream Filtering and Policing. But while implementing it in higher layer is simple, implementing at the hardware level for avionics is much more complex.

Finally, in erts2finzi17 , we concluded that in the avionics case, the BLS is the most promising solution offering high modularity, fairness, predictability and low complexity.

There are several existing works of BLS formal analysis, the most prominent one being a CPA analysis for automotive applications thiele2016formal . However while very complete, this modelisation is complex to implement and requires computation power. Moreover, as we will show, the model can be optimistic. Additionally, a formal analysis based on the Network Calculus is more scalable compared to one based on CPA Perathoner08 , and Network Calculus has already been used to certified the AFDX grieu2004analyse . Thus, we have proposed two Network Calculus models in Finzi-sies-18 Finzi-wfcs-18 . Both these models are limited to three classes. Hence, in this paper we propose an generalization of the tightest of these two Network Calculus models to multiple classes, multiple BLS and multi-hop networks.

Therefore, our main contributions in this paper are two-fold: (i) first an appropriate system modeling and timing analysis, based on the Network Calculus framework, generalizing the Continuous Credit-based Approach to multiple BLS in multi-hop networks; (ii) second the evaluation of the proposed model, including a use-case with two BLS and a used-case with the concrete challenge of adding the A350 flight control traffic on the AFDX.

First in Section 2 we present the background and related work on the BLS. Then, in Section 3 we present the Network Calculus framework. Next, in Sections 4 and 5 we define the system model and the associated worst-case timing analysis. Finally, in Section 6 we present a performance analysis of the Extended AFDX.

2 Background and Related Work

First in this section, we detail the Burst Limiting Shaper (BLS). Then, we present the existing worst-case timing analysis of this solution.

2.1 Burst Limiting Shaper

The BLS belongs to the credit-based shaper class. Each shaped queue is associated to a class $k$ and has been defined in Gotz2012 by an upper threshold $L_{M}^{k}$ , a lower threshold $L_{R}^{k}$ , such as $0\leqslant L_{R}^{k}<L_{M}^{k}$ , and a reserved bandwidth $BW^{k}$ . Additionally, the priority of a class $k$ shaped by BLS, denoted $p(k)$ , can vary between a high and a low value , denoted $p_{H}(k)$ and $p_{L}(k)$ (with priority 0 the highest priority, and $p_{L}(k)>p_{H}(k)$ ). The low value is usually below the lowest priority of the unshaped traffic. In the avionic context, to guarantee the safety isolation level between the different traffic profiles, the low value associated to the SCT is set to be lower than the RC priority level, but higher than the BE priority. Therefore, when considering one class for each traffic type, i.e. three classes, SCT queue priority oscillates between 0 (the highest) and 2 (see Fig. 1), RC priority is 1 (see Fig. 1) and BE has the priority 3 (the lowest, see Fig. 1). Thus, when SCT traffic is enqueued, BE traffic can never be sent no matter the state of BLS. In this case, RC is the only traffic that can be sent and this only happens when the SCT priority is 2. As a consequence, BE traffic is isolated from SCT and RC traffics.

The credit counter varies as follows:

•

initially, the credit counter starts at 0 and the priority of the queue of the burst limited flows is high (#0);

•

the main feature of the BLS is the change of priority $p(k)$ of the queue of the shaped class, which occurs in two contexts: 1) if $p(k)$ is high and credit reaches $L_{M}^{k}$ ; 2) if $p(k)$ is low and credit reaches $L_{R}^{k}$ ;

•

when a frame is transmitted, the credit increases (is consumed) with a rate of $I_{send}^{k}$ , else the credit decreases (is gained) with a rate of $I_{idle}^{k}$ ;

•

when the credit reaches $L_{M}^{k}$ , it stays at this level until the end of the transmission of the current frame;

•

when the credit reaches [math], it stays at this level until the end of the transmission of the current frame (if any). The credit remains at 0 until a new BLS frame is transmitted.

The behavior of the BLS is illustrated in Fig. 2. As shown, the credit is always between 0 and $L_{M}^{k}$ . The credit rates of the BLS shaper are defined as follows:

•

the decreasing rate is:

[TABLE]

where $C$ is the link speed and $BW^{k}$ is the percentage of bandwidth reserved for BLS frames.

•

the increasing rate is:

[TABLE]

It is worth noting that with the BLS, both the priority of the queue of the shaped class and the state of all the queues, i.e., empty or not, define whether the credit is gained or lost. This aspect is depicted in Fig. 2 for two arrival scenarios. The first one (left figure) shows the case of a bursty traffic, where the maximum of traffic shaped by the BLS is sent when its priority is the highest. Consequently, the other priorities send as much traffic as possible when the priority of the BLS class has the low value. The second one (right figure) is for sporadic traffic, where we can see that when the shaped-class priority is highest but no frame is available, then the credit is regained. However, when the priority is at the low value and the other queues are empty, then shaped-class frames can be transmitted and the credit is consumed.

2.2 Existing Worst-case Timing Analyses of TSN/BLS Shaper

In this section, we present the existing work on the BLS formal analysis. Then, we detail the limitations of the main ones, the Compositional Performance Analysis (CPA) and Network Calculus (NC) models.

There are some interesting approaches in the literature concerning the worst-case timing analysis of TSN network, and more particularly BLS shaper. The first and seminal one in Kerschbaum2013 introduces a first service curve model to deduce worst-case delay computation. However, this presentation published by the TSN task group has never been extended in a formal paper. The second one has detailed a more formal worst-case timing analysis in thangamuthu2015analysis , which also has some limitations. Basically, the proposed model does not take into account the impact of either the same priority flows or the higher ones, which will clearly induce optimistic worst-case delays. Then, a formal analysis of TSN/BLS shaper, based on a CPA method has been proposed in thiele2016formal . This approach has handled the main limitations of the model presented in thangamuthu2015analysis ; and interesting results for an automotive case study have been detailed. However, this method necessitates extensive computation power to solve two maximization problems, an Integral Linear Programming (ILP) problem and a fixed point problem. Additionally, contrary the definition in Gotz2012 , the CPA model considers the BLS as a blocking shaper, i.e. no BLS frame can be sent if their associated credit has reached $L_{M}$ , until the credit has decreased to $L_{R}$ . We will show that this fact may provide optimistic delay bounds and thus false guarantees for messages that will actually miss their deadline in the worst-case.

Finally, two Network Calculus models have been proposed: a Window-based approach (WbA) modelisation in Finzi-sies-18 , and a Continuous Credit-based Approach (CCbA) modelisation in Finzi-wfcs-18 . They are both limited to a specific 3-classes architecture. Next, we compare them to identify the tightest one, before generalizing it in Section5.

CPA model of BLS

The CPA model thiele2016formal computes the impact of the other flows by dividing them in four categories: the lower-priority blocking, the same-priority blocking, the higher priority blocking, and the BLS shaper blocking. The latter is defined as follows for a flow of class $I$ :

[TABLE]

with:

•

$L_{R}^{I}$ , $L_{M}^{I}$ and $I_{idle}^{I}$ BLS parameters of class $I$ ;

•

$t^{R+}_{I}=\lceil\frac{L_{M}^{I}-L_{R}^{I}}{I_{idle}^{I}}\rceil+\max_{j\in lp(I)}\frac{MFS_{j}}{C}$ , with $MFS_{j}$ the Maximum Frame Size of flow $j$ , $lp(I)$ the streams with a priority lower than $I$ : the maximum blocking time, called the replenishment interval

•

$t^{S-}_{I}=\max\Big{\{}\bigg{\lfloor}\frac{L_{M}^{I}-L_{R}^{I}}{I_{send}^{I}}\bigg{\rfloor},\max_{j\in I}\frac{MFS_{j}}{C}\Big{\}}$ the shortest service interval for class $I$ .

We have identified three main limitations in the CPA model, which may lead to over-pessimistic delay bounds, or worse, optimistic delay bounds, when considering the definition of the BLS proposed in Gotz2012 . The first limitation causes pessimism and concerns the maximum replenishment interval $t^{R+}_{I}$ . The additional frame transmission $\max_{j\in lp(I)}\frac{MFS_{j}}{C}$ considers all the priorities lower than $I$ . This computation means two implicit assumptions, which are not necessarily fulfilled in the general case. The first implicit hypothesis is to consider that the priority for I is the BLS high priority. The second implicit hypothesis is the fact that the low BLS priority is the lowest one. The delay caused by $\max_{j\in lp(I)}\frac{MFS_{j}}{C}$ is due to the transmission of a frame while the BLS priority is low, just before the credit reaches the resume level. But only classes with a priority higher than the low BLS priority can be transmitted while BLS frames are enqueued, thanks to the Static Priority Scheduler. Thus, CPA model considers that all the flows are in $lp(I)$ and the BLS low priority is the lowest one. This may not be the case, especially when multiple BLS are considered. As a consequence, the shaper blocking effect may be overestimated, depending on the maximum frame sizes.

The second limitation also causes pessimism and concerns again the replenishment interval $t^{R+}_{I}$ . The definition of $t^{R+}_{I}$ is completely independent from the lower priority traffic rates and bursts. As a consequence, if the replenishment intervals are too large in comparison to the traffic load, the shaper blocking is again overestimated: when no lower priority traffic is available, the BLS flows can be sent no matter the state of the credit. Contrary to the hypothesis set in thiele2016formal , the BLS Gotz2012 is actually a non-blocking shaper: only the state of the queues and their respective priorities matter.

Finally, the third limitation is due to the blocking shaper hypothesis as a whole, stating that BLS frames cannot be sent after their associated credit has reached $L_{M}$ , until the credit has decreased to $L_{R}$ . We will show now that this can lead to optimistic bounds when considering the definition of the BLS from Gotz2012 .

To assess the CPA model optimism, we consider herein a 3-classes case study illustrated in Fig. 1, where the SCT class is shaped by a BLS with the priorities switching between 0 and 2, RC has the priority 1 and BE the priority 3.

To compute the worst-case delay, an usual assumption is to consider all the traffics are backlogged. In the case of the BLS however, we show that this may lead to optimistic bounds.

To compute the worst-case delay, we first detail the case where all classes are backlogged. The resulting credit evolution and the SCT output traffic are visible in Fig. 3 in plain line (1). We can see that this is equivalent to the hypothesis in thiele2016formal stating that the BLS blocks the BLS-frames while the credit is decreasing between $L_{M}$ and $L_{R}$ .

Then, we consider the case where RC traffic is not backlogged between two times $t0$ and $t1$ (dotted lines (2) in Fig. 3):

•

the credit starts at $L_{M}$ at $ti$ and decreases until it reaches $\frac{L_{M}}{2}$ at $t0$ ;

•

then it increases until $t1$ when the credit reaches $L_{M}$ ;

•

finally it decreases until reaching $L_{R}$ at $t2$ .

We see in Fig. 3 that in this particular case, the SCT output corresponding to the dotted line (2) can be below the one corresponding to the plain line (1). This shows that the most intuitive worst-case SCT output, i.e., all traffic are backlogged, is not actually the worst-case SCT output. As a consequence, the shaper blocking hypothesis of the CPA model causes optimism when considering the BLS as defined in Gotz2012 .

From both scenarios presented in Fig. 3, we have computed in Appendix A two Achievable Worst-Case delay bounds for SCT. In Section 6.1, we show the optimism of the CPA model in reference to these achievable worst-case delays.

Existing 3-classes Network Calculus models

The inherent idea of the WbA Finzi-sies-18 is based on the different possible combinations of idle and sending BLS windows to model the minimum and maximum service curves, i.e. availability of the traversed node. However, when taking a closer look at the credit behavior of the BLS covering the worst-case scenario of the minimum service curve, $\beta_{k}^{bls}(t)$ , we found a pessimism inherent to the WbA model. We illustrate this behavior in Fig. 4, where the minimum sending window $\Delta_{send}^{k,min}$ and the maximum idle window $\Delta_{idle}^{k,max}$ introduce a credit discontinuity, which is not a realistic behavior. Moreover, we have also noticed a similar discontinuity when studying the best-case scenario of the maximum service curve.

We notice that the discontinuities of the BLS credit happen between the end of the idle window and the start of the sending window for both the minimum and maximum service curves. This issue is situated around $L_{R}^{k}$ . This highlights the fact that $L_{R}^{k}$ is not taken into account in an accurate way by the WbA model. This led to the second model, CCbA Finzi-wfcs-18 , which is based on the continuity of the credit. The results presented in Finzi-wfcs-18 show the tightness of the CCbA.

Hence, in this paper, we have selected the CCbA model to be generalized.

3 Network Calculus framework

The timing analysis used here is based on Network Calculus theory leboudecthiran12 providing upper bounds on delays and backlogs. Delay bounds depend on the traffic arrival described by the so called arrival curve $\alpha$ , and on the availability of the traversed node described by the so called minimum service curve $\beta$ . The definitions of these curves are explained as following.

Definition 1 (Arrival Curve).

leboudecthiran12 * A function $\alpha(t)$ is an arrival curve for a data flow with an input cumulative function $R(t)$ ,i.e., the number of bits received until time $t$ , iff:*

[TABLE]

Definition 2 (Strict minimum service curve).

leboudecthiran12 * The function $\beta$ is the minimum strict service curve for a data flow with an output cumulative function $R^{*}$ , if for any backlogged period $]s,t]$ 222 $]s,t]$ is called backlogged period if $R(\tau)-R^{*}(\tau)>0,\forall\tau\in]s,t]$ , $R^{*}(t)-R^{*}(s)\geq\beta(t-s)$ .*

Definition 3 (Maximum service curve).

leboudecthiran12 * The function $\gamma(t)$ is the maximum service curve for a data flow with an input cumulative function $R(t)$ and output cumulative function $R^{*}(t)$ iff:*

[TABLE]

To compute end-to-end delay bounds of individual traffic flows, we need the following Theorem.

Theorem 3.1.

(Blind Multiplex of two flows) bouillard2009service Consider two flows $f_{1}$ , $f_{2}$ crossing a system $n$ with the strict minimum service $\beta(t)$ , and with the flows $f_{j}$ $\alpha_{j}$ -constrained, $j\in\{1,2\}$ . Then, the residual minimum service curve offered to $f_{1}$ is:

[TABLE]

Then, to compute the main performance metrics, we need the following results.

Corollary 1.

*(Left-over service curve - NP-SP Multiplex)bouillard2009service

Consider a system with the strict service $\beta(t)$ and $m$ flows crossing it, $f_{1}$ , $f_{2}$ ,.., $f_{m}$ . The maximum frame size of $f_{i}$ is $MFS_{i}$ , its priority is $p(i)$ , $f_{i}$ is $\alpha_{i}$ -constrained, and $\forall i$ , the priorities strictly higher than $p(i)$ , are $\forall j$ , $p(j)<p(i)$ . The flows are scheduled by the NP-SP policy. For each $i\in\{1,..,m\}$ , the strict service curve offered to $f_{i}$ is given by333 $g_{\uparrow}(t)=\max\{0,\sup_{0\leqslant s\leqslant t}g(s)\}$ :*

[TABLE]

Theorem 3.2 (Performance Bounds).

leboudecthiran12 *

Consider a flow $F$ constrained by an arrival curve $\alpha$ crossing a system $\mathcal{S}$ that offers a minimum service curve $\beta$ and a maximum service curve $\gamma$ . The performance bounds obtained at any time $t$ are:

Backlog444v: maximal vertical distance: $\forall~{}t:~{}q(t)\leq v(\alpha,\beta)$

Delay555h: maximal horizontal distance: $\forall~{}t:~{}d(t)\leq h(\alpha,\beta)$

Output arrival curve : $\alpha^{*}(t)=\alpha\oslash\beta(t)$ 666 $f\oslash g(t)=\sup_{s\geq 0}\{f(t+s)-g(s)\}$

Tight Output arrival curve: $\alpha^{*}(t)=\left((\gamma\otimes\alpha)\oslash\beta\right)(t)$ *

The computation of these bounds is greatly simplified in the case of i) leaky bucket arrival curve $\alpha(t)=b+rt$ , with $b$ the maximal burst and $r$ the maximum rate, i.e., the flow is $(b,r)$ -constrained, and ii) Rate-Latency service curve $\beta_{R,T}(t)=R\cdot(t-T)^{+}$ ( $(x)^{+}$ is the maximum between $x$ and 0), with latency $T$ and rate $R$ . In this case, the delay is bounded by $h(\alpha,\beta)=\frac{b}{R}+T$ , and the backlog bound is $v(\alpha,\beta)=b+r\cdot T$ . Moreover, the output arrival curve is $\alpha^{*}(t)=b+r(t+T)$ .

In the case of a piecewise linear input arrival curve and a piecewise linear minimum service curve, we can compute the delay bound as follows:

Corollary 2 (Maximum delay bound under a piecewise arrival curve and piecewise minimum service curve).

Consider a flow $f$ constrained by a piecewise linear arrival curve $\alpha$ such as: $\alpha_{f}(t)=\underset{i}{\min}(\alpha_{r_{i},b_{i}}(t))$ , with $\alpha_{r_{i},b_{i}}(t)=r_{i}\cdot t+b_{i}$ , $i\in[1,n]$ and minimum service curve such as: $\beta_{f}(t)=\underset{j}{\max}\left(\beta_{R_{j},T_{j}}(t)\right)$ , with $\beta_{R_{j},T_{j}}(t)=R_{j}\cdot(t-T_{j})^{+}$ . The maximum latency of flow f is:

[TABLE]

and:

[TABLE]

Proof.

From Theorem 3.2, we know that the maximum delay bound of flow $f$ is the maximal horizontal distance between $\alpha_{f}(t)$ and $\beta_{f}(t)$ . Moreover, from Lemma 1 in boyer2010halfmodeling , we know that the maximum horizontal distance between $\alpha_{f}(t)=\underset{i}{\min}(\alpha_{r_{i},b_{i}}(t))$ and $\beta_{R_{j},T_{j}}(t)=R_{j}\cdot(t-T_{j})^{+}$ is:

[TABLE]

With a few algebraic considerations, we deduce that $x_{k}=\frac{b_{k}-b_{k-1}}{r_{k-1}-r_{k}},y_{k}=b_{k}+r_{k}\cdot\frac{b_{k}-b_{k-1}}{r_{k-1}-r_{k}}\textnormal{, for }2\leqslant k\leqslant n$

Finally, we consider a service curve $\beta_{f}(t)=\underset{j}{\max}(\beta_{R_{j},T_{j}}(t))$ . From Network Calculus concepts in leboudecthiran12 , we know that $delay^{max}_{f}=\inf_{t\geqslant 0}\left\{(\alpha_{f}\oslash\beta_{f})(-t)\leqslant 0\right\}$ . Thus, if we consider a piecewise service curve we have:

[TABLE]

Hence, to compute the maximum delay we can compute the maximum delay for every $\beta_{R_{j},T_{j}}(t)$ and keep the minimum value. ∎

Theorem 3.3 (Concatenation-Pay Bursts Only Once).

leboudecthiran12 *

Assume a flow crossing two servers with respective service curves $\beta_{1}$ and $\beta_{2}$ . The system consisting of the concatenation of the two servers offers a service curve $\beta_{1}\otimes\beta_{2}$ .*

4 System Model

In this section, we present the system model, with first the network model, then the traffic model.

4.1 Network model

We consider multi-hop networks, with traffics generated in End-systems and transmitted through one or several switches before reaching the destination end-systems, as illustrated in Fig. 5.

Hence, in the networks we consider several types of nodes: the end-systems $es$ , the output port multiplexers $mux$ , composed of BLS nodes $bls$ and a NP-SP node $sp$ , as illustrated in Fig. 6.

To assess the performance of the BLS, we use the delay bounds of SCT and RC as a metric, since they both have deadlines contrary to BE. To compute the delays bounds within each node $n\in\{es,bls,sp,mux\}$ we use Th.3.2 under the following assumptions:

(i) leaky-bucket arrival curves for the traffic flows at the input of node $n$ , i.e. $\alpha_{k}^{n}(t)=r_{k}^{n}\cdot t+b_{k}^{n}$ , with $r_{k}^{n}$ is the rate and $b_{k}^{n}$ is the burst of flow $k$ .

(ii) the offered service curve by node $n$ to the traffic class $k$ is a rate-latency curve: $\beta_{k}^{n}(t)=R_{k}^{n}\cdot(t-T_{k}^{n})^{+}$ .

End-System model

For the end-systems, they are implementing a NP-SP scheduler. This scheduler has been already modeled in the literature bouillard2009service through Corollary 1, and the defined strict minimum service curve guaranteed to a traffic class $k\in\{SCT,RC,BE\}$ within an end-system $es$ is as follows:

[TABLE]

Switch model

The AFDX standard manages the exchanged data through the Virtual Link (VL) concept. This concept provides a way to reserve a guaranteed bandwidth for each traffic flow. Furthermore, the AFDX supports a NP-SP scheduler based on two priority levels within switches to enable the QoS features.

For the new extended AFDX, we consider that depending on the constraints of the flows, the different traffics can be separated in several classes: $\{SCT_{1},...SCT_{n}\}$ , $\{RC_{1},...RC_{m}\}$ , and $\{BE_{1},...BE_{l}\}$ , with $n$ , $m$ , $l$ , the number of classes for each type of traffic. Additionally, also depending on the different constraints, any class can be shaped by a BLS at the output port as shown in Fig. 7 to reduce the impact of the considered class on lower priorities.

In Fig. 8, we illustrate the architecture of our extended AFDX switch in the case of 3 classes. It consists of: (i) store and forward input ports to verify each frame correctness before sending it to the corresponding output port; (ii) a static configuration table to forward the received frames to the correct output port(s) based on their VL identifier; (iii) the output ports can handle $k=m+n+l$ priority queues, multiplexed with a NP-SP scheduler, as illustrated in Fig. 7.

As a consequence, for each queue, we associate a class $k$ , and we can set two different priorities: $p_{L}(k)$ and $p_{H}(k)$ . The BLS is only activated if $p_{L}(k)>p_{H}(k)$ (because the priority increases when p(k) decreases, i.e., priority 0 is the highest priority). In this case, a credit counter monitoring the SP dequeuing process is attributed to this queue. The credit manages the selection of the priority of the queue viewed by the NP-SP as described in Fig. 9.

The resulting architecture is very flexible and offers many opportunities to manage each class as needed. For example for homogeneous classes, we can only consider one queue by type of traffic and we can shape the SCT as proposed in Fig. 1. Or, for more heterogeneous classes, we can use two queues by type of traffic and only shape the second queue of both SCT and RC-type traffic classes, leaving the first ones for tighter deadlines, as illustrated in Fig. 10.

4.2 Traffic Model

To compute upper bounds on end-to-end delays of different traffic classes using Network Calculus, we need to model each message flow to compute its maximum arrival curve.

The arrival curve of each flow $f$ in class $k$ at the input of the node $n\in\{es,sw\}$ or a component $n\in\{bls,sp\}$ along its path is a leaky-bucket curve with a burst $b_{k,f}^{n}$ and a rate $r_{k,f}^{n}$ :

[TABLE]

Therefore, the arrival curve of the aggregate traffic in class $k$ at the input (resp. output) of the node $n\in\{es,sw\}$ or a component $n\in\{bls,sp\}$ is: $\alpha_{k}^{n}(t)=\sum\limits_{f\in k}\alpha_{k,f}^{n}(t)$ (resp. $\alpha_{k}^{*,n}(t)=\sum\limits_{f\in k}\alpha_{k,f}^{*,n}(t)$ based on Theorem 3.2).

Each traffic flow $f$ of class $k$ , generated by an end-system, is characterized by $\left(BAG_{f},MFS_{f},J_{f}\right)$ for respectively the minimum inter-arrival time, the maximum frame size integrating the protocol overhead, and the jitter.

Hence, the arrival curve of traffic class $k$ in the end-system $es$ , based on a leaky bucket model, is as follows:

[TABLE]

5 Worst-case Timing Analysis

In this section, we present the worst-case Timing Analysis done using the Network Calculus framework. First, we present the schedulability condition to identify the needed modelisations. Then, we detail the BLS node modelisation, followed by the output port multiplexer modelisation. Finally, we present the computation of the end-to-end delay bounds and we discuss the nature of the BLS as a shaper.

5.1 Schedulability Conditions

To infer the real-time guarantees of our proposed solution, we need first to define a necessary schedulability condition. This consists in respecting the stability condition within the network, where the sum of maximum arrival rates of the input traffic flows $i$ at any crossed node $n$ has to be lower than its minimum guaranteed service rate within the node $n$ . This constraint is denoted as rate constraint:

[TABLE]

Then, we define a sufficient schedulability condition to infer the traffic schedulability, which consists in comparing the upper bound on end-to-end delay of each traffic flow $f$ of a class $k$ to its deadline, denoted $Deadline_{f}^{end2end}$ . This constraint is called deadline constraint:

[TABLE]

For this sufficient schedulability condition, we detail the end-to-end delay expression of a flow $f$ in the class $k$ , $delay_{k,f}^{end2end}$ , along its path $path_{f}$ as follows:

[TABLE]

with $delay_{k,f}^{es}$ the delay within the source end-system $es$ to transmit the flow $f$ of class $k$ and $delay_{k,f}^{prop}$ the propagation delay along the path, which is generally negligible in an avionics network.

The last delay $delay_{k,f}^{sw}$ represents the upper bound of the delay within each intermediate switch along the flow path, and it consists of several parts as shown in Fig. 8:

•

the store and forward delay at the input port, equal to $\frac{MFS}{C}$ , with $MFS$ the length of the frame and $C$ the capacity;

•

the technological latency due to the forwarding process, upper-bounded by 1 $\mu$ s in the pre-specification of the AFDX next generation;

•

the output port multiplexer delay due to the BLS and NP-SP scheduler, denoted $delay_{k,f}^{mux}$ .

Hence, the only unknown is the delays in the output port multiplexer of the switch. To enable the computation of upper bounds on these delays, we need to model the different parts of the multiplexer, and more particularly the BLS node.

5.2 BLS node model: generalized Continuous Credit-based Approach (gCCbA)

In this section, we describe our proposed BLS node model.

We detail here the computation of BLS service curves offered to a BLS class $k$ . The main idea is to compute the consumed and gained credits. Knowing that the credit is continuous and always between 0 and $L_{M}^{k}$ , we use the sum of the consumed and gained credits to compute the minimum and maximum service curves of the BLS node. The main difficulty consists in computing the traffic sent during saturation times, i.e., when the credit is neither gained nor consumed due to the minimum and maximum levels, 0 and $L_{M}^{k}$ , respectively.

The strict minimum and maximum service curves offered to a BLS class k by a BLS node are defined in Theorem 5.1 and in Theorem 5.2, respectively.

Theorem 5.1 (Strict Minimum Service Curve offered to a BLS class k by a BLS node).

Consider a server with a constant rate $C$ , implementing BLS shapers. The traffic of class $k$ crosses this server and is shaped by the BLS. Class $k$ has a high priority denoted $p_{H}(k)$ and a low priority denoted $p_{L}(k)$ (with $p_{L}(k)>p_{H}(k)$ ). We call $HC(k)$ the traffic classes with a priority strictly higher than $p_{H}(k)$ and MC(k) the classes with a priority between $p_{L}(k)$ and $p_{H}(k)$ . The strict minimum service curve guaranteed to the BLS class $k$ is as follows:

[TABLE]

where

[TABLE]

Proof.

We present here only a sketch of proof, the complete proof is available in Appendix B.2. We search a strict minimum service curve defined by a rate-latency curve, i.e., $\beta_{k}^{bls}(t)=\rho\cdot(t-\tau)^{+}$ with rate $\rho$ and latency $\tau$ .

First, to compute $\tau$ , we consider the maximum latency caused by the BLS.

Secondly, to compute $\rho$ , we consider the fact the credit is a continuous function with values between 0 and $L_{M}^{k}$ . Consequently, the sum of the gained and consumed credits is upper bounded by $L_{M}^{k}$ , and the credit can saturate at 0 or $L_{M}^{k}$ . Thus, the credit consumed during a period $\delta$ is not simply the product of the credit increasing rate (denoted $I_{send}^{k}$ ) and the transmission time of the output traffic (denoted $\Delta R^{*}(\delta)$ ). It is actually the product of $I_{send}^{k}$ and the output traffic transmitted while the credit is not saturated. The same is true for the gained credit. Hence, the main issue of the proof is the computation of these saturation times. In particular, we compute the maximum saturation for the MC(k) and HC(k) classes, and the minimum saturation for the class $k$ , as illustrated in Fig. 11. After this, we use the definition of $\beta(t)$ and the limit of $\frac{\Delta R^{*}(\delta)}{\delta}$ toward infinity to compute $\rho$ .

∎

Corollary 3 (Strict Minimum Service Curve offered to SCT by a BLS node).

Consider a server with a constant rate $C$ , implementing a BLS shaping the SCT traffic. The SCT, RC and BE traffics cross this server with the following priorities: $p(SCT)\in\{p_{H}(SCT)=0,p_{L}(SCT)=2\}$ , $p(RC)=1$ , $p(BE)=3$ , as illustrated in Fig. 8.

The strict minimum service curve guaranteed to SCT class is as follows:

[TABLE]

where

[TABLE]

Proof.

We apply Theorem 5.1 in the particular 3-classes case study presented in Fig. 1, with SCT as class $k$ .; thus $HC(k)=\emptyset$ and MC(k)=RC. ∎

Theorem 5.2 (Maximum Service Curve offered to a BLS class k by a BLS node).

Consider a server with a constant rate $C$ , implementing BLS shapers. The traffic of class $k$ crosses this server and is shaped by the BLS. Class $k$ has a high priority denoted $p_{H}(k)$ and a low priority denoted $p_{L}(k)$ (with $p_{L}(k)>p_{H}(k)$ ). We call MC(k) the classes with a priority between $p_{L}(k)$ and $p_{H}(k)$ .

The maximum service curve offered to the class k traffic is as follows. In the absence of backlogged MC(k) traffic: $\gamma_{k}^{bls}(t)=C\cdot t$ ; otherwise, during a backlogged period of MC(k):

[TABLE]

where

[TABLE]

and

[TABLE]

Proof.

We present here only a sketch of proof, the complete proof is available in Appendix B.3. We search a maximum service curve defined by a leaky-bucket curve, i.e., $\gamma_{k}^{bls}(t)=r\cdot t+b$ with rate $r$ and burst $b$ . First, for $r$ we use the fact that the sum of the gained and consumed credits is lower bounded by $-L_{M}^{k}$ . Then, we calculate the bounds of saturation times during a period $\delta$ . In particular, we calculate the minimum and maximum saturations, as illustrated in Fig. 12. Finally, we use the definition of $\gamma(t)$ and the limit toward infinity of $\frac{\Delta R^{*}(\delta)}{\delta}$ to compute $r$ .

∎

Corollary 4 (Maximum Service Curve offered to SCT by a BLS node).

Consider a server with a constant rate $C$ , implementing a BLS shaping the SCT traffic. The SCT, RC and BE traffics cross this server with the following priorities: $p(SCT)\in\{p_{H}(SCT)=0,p_{L}(SCT)=2\}$ , $p(RC)=1$ , $p(BE)=3$ , as illustrated in Fig. 8.

The maximum service curve offered to the SCT traffic class is as follows. In the absence of backlogged RC traffic: $\gamma_{SCT}^{bls}(t)=C\cdot t$ ; otherwise, during a backlogged period of RC:

[TABLE]

where

[TABLE]

and

[TABLE]

Proof.

We apply Theorem 5.2 in the particular 3-classes case study presented in Fig. 1, with SCT as class $k$ ; thus $HC(k)=\emptyset$ and MC(k)=RC. ∎

The maximum output arrival curve of a BLS class $k$ is detailed in the following Corollary:

Corollary 5 (Maximum Output Arrival Curve of a BLS class).

Consider a BLS class $k$ with a maximum leaky-bucket arrival curve $\alpha$ at the input of a BLS shaper, guaranteeing a minimum rate-latency service curve $\beta_{k}^{bls}$ and a maximum service curve $\gamma_{k}^{bls}$ . The maximum output arrival curve is:

[TABLE]

Proof.

To prove Corollary 5, we generalize herein the rule 13 in p. 123 in leboudecthiran12 , i.e., $(f\otimes g)\oslash g\leq f\otimes(g\oslash g)$ , to the case of three functions $f$ , $g$ and $h$ when $g\oslash h\in\mathcal{F}$ , where $\mathcal{F}$ is the set of non negative and wide sense increasing functions:

[TABLE]

According to Theorem 3.2, we have $\alpha^{*}(t)=(\gamma_{k}^{bls}\otimes\alpha)\oslash\beta_{k}^{bls}$ . Moreover, in the particular case of a leaky-bucket arrival curve $\alpha$ and a rate-latency service curve $\beta_{k}^{bls}$ , $\alpha\oslash\beta_{k}^{bls}$ is a leaky-bucket curve, which is in $\mathcal{F}$ . Hence, we have the necessary condition to prove the following:

[TABLE]

∎

5.3 Output port multiplexer service curves

In this section, we compute the strict minimum service curves offered by a switch output port multiplexer $mux$ . Such a multiplexer $mux$ consists of $sp$ and $bls$ nodes as illustrated in Fig. 6.

The strict minimum service curve offered by each output port multiplexer to a $BLS$ class is defined in Theorem 5.3, and the strict minimum service curves offered by each output port multiplexer to a $NBLS$ class, i.e., not shaped by a BLS, is defined in Theorem 5.4.

Theorem 5.3 (Strict Minimum Service Curve offered by an output port multiplexer to a BLS class).

Consider a system implementing a BLS with the strict minimum service $\beta$ .

The strict minimum service curve offered to a BLS class $k$ by an output port multiplexer is:

[TABLE]

with:

•

$\beta_{k\in BLS,p_{L}(k)}^{sp}(t)=(\beta(t)-\sum_{j\in MC(k)\cup HC(k)}\alpha_{j}^{sp}(t)-\max_{j\in LC(k)\cup k}MFS_{j})_{\uparrow}$ * the strict minimum service curve offered by the NP-SP when the class-k BLS priority is low;*

•

$\beta_{k\in BLS}^{bls}(t)$ * the strict minimum service curve offered by the BLS node to class k, defined in Theorem 5.1;*

•

$\beta_{k\in BLS,p_{H}(k)}^{sp}(t)=(\beta(t)-\sum_{j\in HC(k)}\alpha_{j}^{sp}(t)-\max_{j\notin HC(k)}MFS_{j})_{\uparrow}$ * the strict minimum service curve offered by the NP-SP when the class-k BLS priority is high;*

•

$\alpha_{j}^{sp}(t)$ * the input arrival curve of flow $j$ at the $sp$ node, such as:*

[TABLE]

Proof.

The idea is to model the impact of a BLS implemented on top of the NP-SP scheduler on $BLS$ class $k$ . To achieve this aim, we distinguish two possible scenarios. The first one covers the particular case where the class- $k$ priority remains low, i.e., the other queues are empty; whereas the second one covers the general case where the priority of class $k$ oscillates between $p_{L}(k)$ and $p_{H}(k)$ , as explained in Section 2.1. Firstly, the minimum service curve guaranteed within $mux$ in the first scenario is due to the NP-SP scheduler and denoted $\beta^{sp}_{k\in BLS,p_{L}(k)}$ , which is computed via Corollary 1 when considering the class-k priority is $p_{L}(k)$ . Secondly, the minimum service curve guaranteed within $mux$ in the second scenario is computed via Theorem 3.3, through the concatenation of the service curves within the BLS node $\beta_{k\in BLS}^{bls}$ (computed in Theorem 5.1) and the NP-SP node $\beta_{k\in BLS,p_{H}(k)}^{sp}$ (computed via Corollary 1 when class- $k$ priority is high). ∎

Corollary 6 (Strict Minimum Service Curve offered by an output port multiplexer to SCT in the case of three traffic classes).

Consider a server with a constant rate $C$ , implementing a BLS shaping the SCT traffic. The SCT, RC and BE traffics cross this server with the following priorities: $p(SCT)\in\{p_{H}(SCT)=0,p_{L}(SCT)=2\}$ , $p(RC)=1$ , $p(BE)=3$ , as illustrated in Fig. 8.

The strict minimum service curve offered to SCT by an output port multiplexer is:

[TABLE]

with:

•

$\beta_{SCT,2}^{sp}(t)=(C\cdot t-\alpha_{RC}(t)-\max_{j\in BE\cup SCT}MFS_{j})_{\uparrow}$ * the strict minimum service curve offered by the NP-SP when the class-k BLS priority is low;*

•

$\beta_{SCT}^{bls}(t)$ * the strict minimum service curve offered by the BLS node to SCT, defined in Corollary 3*

•

$\beta_{SCT,0}^{sp}(t)=(C\cdot t-\max_{j\in\{SCT,RC,BE\}}MFS_{j})_{\uparrow}$ * the strict minimum service curve offered by the NP-SP when the BLS priority is high;*

Proof.

We apply Theorem 5.3 in the particular 3-classes case study presented in Fig. 1, with SCT as class $k$ . Thus $HC(k)=\emptyset$ , MC(k)=RC, and $\beta(t)=C\cdot t$ . ∎

Theorem 5.4 (Strict Minimum Service Curve offered to a NBLS class by an output port multiplexer).

Consider a system implementing a BLS with the strict service $\beta$ and $m$ flows crossing it, $f_{1}$ , $f_{2}$ ,.., $f_{m}$ . The strict minimum service curve offered to a NBLS class $k$ by an output port multiplexer is:

[TABLE]

with:

•

$\beta_{k\in NBLS}^{sp}=(\beta-\sum_{p_{H}(j)<p(k),j\in BLS}\alpha_{j}\oslash\beta_{j}^{bls}-\sum_{p(j)<p(k),j\in NBLS}\alpha_{j}-\max_{p(j)\geqslant p(k)}MFS_{j})_{\uparrow}$ ;

•

$\beta_{j}^{bls}$ , with $j\in BLS$ , the strict minimum service curve offered by the BLS node to class $j$ , defined in Theorem 5.1;

•

$\beta_{k\in NBLS}^{bls}=(\beta-\sum_{p_{H}(j)<p(k),j\in BLS}\gamma_{j}^{bls}-\sum_{p(j)<p(k),j\in NBLS}\alpha_{j}\\ \quad\quad\quad\quad\quad\quad\quad\text{ }\quad\quad\quad\quad\quad-\max_{p(j)\geqslant p(k)}MFS_{j})_{\uparrow}$ ;

•

$\gamma_{j}^{bls}$ , with $j\in BLS$ , the maximum service curve offered by the BLS node to class $j$ , defined in Theorem 5.2.

Proof.

The proof of Theorem 5.4 is straightforward. Theorem 5.4 is obtained through replacing within the equation of Corollary 1 the arrival curve of higher priority traffic than class $k\in NBLS$ by the curves computed in Corollary 5. ∎

Corollary 7 (Strict Minimum Service Curve offered to RC by an output port multiplexer in the case of three traffic classes).

Consider a server with a constant rate $C$ , implementing a BLS shaping the SCT traffic. The SCT, RC and BE traffics cross this server with the following priorities: $p(SCT)\in\{p_{H}(SCT)=0,p_{L}(SCT)=2\}$ , $p(RC)=1$ , $p(BE)=3$ , as illustrated in Fig. 8.

The strict minimum service curve offered to RC by an output port multiplexer is:

[TABLE]

with:

•

$\beta_{RC}^{sp}(t)=(C\cdot t-\alpha_{SCT}(t)\oslash\beta_{SCT}^{bls}(t)-\max_{j\in\{SCT,RC,BE\}}MFS_{j})_{\uparrow}$ ;

•

$\beta_{SCT}^{bls}(t)$ * the strict minimum service curve offered by the BLS node to SCT, defined in Corollary 3;*

•

$\beta_{RC}^{bls}(t)=(C\cdot t-\gamma_{SCT}^{bls}(t)-\max_{j\in\{SCT,RC,BE\}}MFS_{j})_{\uparrow}$ ;

•

$\gamma_{SCT}^{bls}(t)$ * the maximum service curve offered by the BLS node to SCT, defined in Corollary 4.*

Proof.

We apply Theorem 5.4 to the particular case of the 3-classes case study presented in Fig. 1, with SCT as class $k$ and RC as MC(k). ∎

5.4 Computing End-to-End Delay Bounds

With the BLS node and the output port modeled, we are now able to compute the end-to-end delay bounds. The computation of the end-to-end delay upper bounds follows four main steps:

computing the strict minimum service curve guaranteed to each traffic class $k$ in each node $n$ of type $\{es,mux\}$ , $\beta_{k}^{n}$ , will infer the computation of the residual service curve, guaranteed to each individual flow $f$ of class $k$ , $\beta_{k,f}^{n}$ with Theorem 3.1; 2. 2.

knowing the residual service curve guaranteed to each flow within each crossed node allows the propagation of the arrival curves along the flow path, using Theorem 3.2. We can compute the output arrival curve, based on the input arrival curve and the minimum service curve, which will be in its turn the input of the next node; 3. 3.

the computation of the minimum end-to-end service curve of each flow $f$ in class $k$ , based on Theorem 3.3, is simply the concatenation of the residual service curves, $\beta_{k,f}^{n}$ , $\forall n$ along its path $path_{f}$ ; 4. 4.

given the minimum end-to-end service curve of each flow $f$ in class $k$ along its $path_{f}$ and its maximum arrival curve at the initial source, the end-to-end delay upper bound $delay_{k,f}^{end2end}$ is the maximum horizontal distance between the two curves using Theorem 3.2 and Corollary 2.

Now that we have modeled the proposed network, we use this model to answer the question whether ”shaper” is the correct qualifier for the BLS.

5.5 Discussion: is the BLS really a shaper?

The most common kind of shapers is the greedy shaper, which has been detailed in leboudecthiran12 . According to leboudecthiran12 , a $shaper$ with a shaping curve $\sigma$ is a bit processing device that forces its output to have $\sigma$ as an output arrival curve. A $greedy$ $shaper$ is a shaper that delays the input bits in a buffer, whenever sending a bit would violate the constraint $\sigma$ , but outputs them as soon as possible. A consequence of this definition is that, for an input flow $R$ , the output flow $R^{*}$ is defined by $R^{*}=R\otimes\sigma$ . Moreover, as the service curve $\beta$ and maximum service curve $\gamma$ are defined by $R^{*}\geqslant R\otimes\beta$ and $R^{*}\leqslant R\otimes\gamma$ , this means that $\sigma=\beta=\gamma$ in the case of a greedy shaper. Obviously, this is not the case for the BLS. Another property of the greedy shaper is that the difference between the fluid model and the packetized model is bounded by the maximum sized packet.

From the definition of the BLS gCCbA model in Section 5.2, we can easily compute the corresponding fluid (bit-per-bit) gCCbA model: we do not consider an additional frame due to non-preemption. As a consequence, the defined saturation times are null.

So, when considering the 3-classes case study presented in Fig. 1, we have:

[TABLE]

This shows that the difference between the fluid and packetized models, i.e., $\beta_{k}^{bls,fluid}$ and $\beta_{k}^{bls}$ , is larger than a single maximum sized frame: an additional MC(k) frame is considered in every $\Delta_{inter}^{k,\beta}$ , and an additional frame of class k is considered in each $\Delta_{inter}^{k,\gamma}$ .

Finally, the BLS functioning itself shows that the BLS is not a greedy shaper: if a frame is enqueued and there is no higher priority frame enqueued, then the frame is dequeued no matter the state of the BLS credit. Hence, the BLS is non-blocking contrary to the definition of a greedy shaper. Moreover, if no higher priority traffic is present, then the BLS does not force the output to conform to a certain $\sigma$ , unlike a shaper.

So, if the BLS is not a shaper, what is its nature? The BLS changes the priority of a queue through reordering the priority of the different queues, and it cannot be used without a Static Priority Scheduler. So trying to characterize it on its own is futile. Together with the NP-SP however, they are able to reorganize the output traffic according to the BLS parameters. Because of this, BLS+SP is much closer to schedulers such as Deficit Round Robin (DRR) than shapers.

6 Performance Analysis

In this section, we start with a first 3-classes single-hop use-case to evaluate the tightness and sensitivity of our model, in reference to Achievable Worst-Cases (AWCs) described in Appendix A. Next, we compare the CPA and NC models (WbA and CCbA) under different scenarios. In a second use-case, we consider an multiple-BLS multi-hop architecture to highlight the delay bound reductions and schedulability increases. We finish with a third used-case to add the A350 flight control traffic to the AFDX.

6.1 Use-case 1: sensitivity, tightness and comparison with CPA

In this section, we start by presenting a case study. Then, we analyze our model by assessing, first the impact of the BLS parameters and the utilization rates of SCT and RC on the delay bounds, then its tightness in reference to AWC777Since there is no strict order between the two achievable worst-cases (see Appendix A), we will use the maximum value, denoted AWC=max(AWC-1, AWC-2), as a reference to assess our model tightness..

Case study

Our first case study is based on a single-hop Gigabit network described in Fig. 14, with the 3-class output port presented in Fig. 13 and the traffic profiles presented in Table 2.

As there is only one shaped class: SCT, we use $k=\emptyset$ to simplify, for the non-ambiguous notations, such as $L_{M}^{k}$ or $I_{idle}^{k}$ .

To evaluate our model, we conduct tightness and sensitivity analyses using different scenarios when varying the input rates of SCT and RC and the BLS parameters.

The five scenarios are described by the following vectors:

[TABLE]

Sensitivity Analysis

In this section, we analyze the sensitivity of the BLS model when varying the BLS parameters and utilization rates, i.e., $UR_{SCT}$ , $UR_{RC}$ , $L_{M}$ , $L_{R}$ , $BW$ . The results of the different scenarios are reported in Fig. 15, Fig. 16 Fig. 17, Fig. 18, and Fig. 19.

From our modelisation of the output port multiplexer and the BLS node, we notice that in $\beta_{SCT}^{mux}(t)$ (see Corollary 6) and $\beta_{RC}^{mux}(t)$ (see Corollary 7) the evolution of the strict minimum service curves of SCT and RC follows the maximum of two linear curves: one is the SP part, the other is the BLS part. Consequently, the delay bounds of SCT and RC evolve also following two parts under the different scenarios.

Impact of $UR_{SCT}$

In Fig. 15(a), when the SCT utilization rate increases, we observe an increase of the SCT delay bounds starting close to 0 thanks to a low initial latency and high rate of the guaranteed minimum service curve due to the BLS part. Then, at $UR_{SCT}=20\%$ , the delay bounds due to the BLS part reaches the delay bounds due to the SP part. After this point, the delay follows the maximum rate according to Corollary 6, i.e., the SP part. Furthermore, in Fig. 15(b), when the SCT utilization rate increases, we observe a noticeable increase of the RC delay bounds following the increasing guaranteed rate of the service curve due to the SP part. Then, after $UR_{SCT}=18\%$ , the delay bounds becomes constant since it depends on the strict minimum service curve due to the BLS part, which is constant when the RC utilization rate is constant.

Hence, this analysis shows that the SCT utilization rate has an inherent impact on SCT and RC delay bounds, where:

•

the SCT delay bound is ruled below $UR_{SCT}=20\%$ by the strict minimum service curve due to the BLS part, $(\beta_{SCT,0}^{sp}\otimes\beta_{SCT}^{bls})(t)$ ; whereas after $UR_{SCT}=20\%$ , it is ruled by the strict minimum service curve due to the SP part, $\beta_{SCT,2}^{sp}(t)$ ;

•

the RC delay bound is ruled below $UR_{SCT}=18\%$ by the strict minimum service curve due to the SP part, $\beta_{RC}^{sp}(t)$ ; whereas after $UR_{SCT}=18\%$ , it is ruled by the strict minimum service curve due to the BLS part, $\beta_{RC}^{bls}(t)$ .

These results infer that the variation of $UR_{SCT}$ has a large impact on both the SCT (resp. RC) delay bounds with a maximum variation of 2.5ms (resp. 0.4ms), i.e., the delay bound is multiplied by 24 (resp. 2.3).

Impact of $UR_{RC}$

Similar analysis conducted for $Scenario_{RC}=(UR_{SCT}=20,UR_{RC}\in\left[0.5:72\right],$

$L_{M}=22~{}118,L_{R}=0,BW=0.46)$ in Fig. 16 shows that the RC utilization rate has an inherent impact on SCT and RC delay bounds. We observe a behavior symmetrical to the one noticed in $Scenario_{SCT}$ :

•

the SCT delay bound is ruled below $UR_{RC}=20\%$ by the strict minimum service curve due to the SP part; whereas after $UR_{RC}=20\%$ , it is ruled by the strict minimum service curve due to the BLS part;

•

the RC delay bound is ruled below $UR_{RC}=30\%$ by the strict minimum service curve the BLS part; whereas after $UR_{RC}=30\%$ , it is ruled by the strict minimum service curve the SP part.

These results show that the variation of $UR_{RC}$ has a large impact on both the SCT (resp. RC) delay bounds with a maximum variation of 0.58ms (resp. 2.2ms), i.e., the delay bound is multiplied by 2.8 (resp. 23).

Impact of $L_{M}$

Concerning SCT delay bounds, in Fig. 17(a), before $L_{M}=50~{}000$ bits (which represents sending windows allowing the transmission of 200 consecutive SCT frames) they are ruled by $\beta^{bls}_{SCT}$ . When $L_{M}$ decreases, the minimum service rate of $\beta_{SCT}^{bls}$ increases and its initial latency decreases. Consequently, the SCT delay bounds decrease with CCbA when $L_{M}$ decreases toward $L_{R}$ . After $L_{M}=50~{}000$ bits, the SCT delay bound is constant, because it is ruled by a constant $\beta^{sp}_{SCT,0}$ .

Concerning RC delay bounds, in Fig. 17(b), they are ruled by $\beta_{RC}^{bls}(t)$ (see Corollary 7). When increasing $L_{M}$ , both the rate and initial latency increase. Before $L_{M}=7~{}000$ bits (which represents sending windows allowing the transmission of 24 consecutive SCT frames), the impact of the increasing rate is stronger, resulting in the delay bound decrease; whereas after $L_{M}=7~{}000$ bits, the impact of the initial latency takes over, resulting in a delay bound increase.

These results show that the variation of $L_{M}$ has a limited impact on the SCT delay bounds with a maximum variation of 5%, and a larger effect on RC delay bounds with a variation of 35%.

Impact of $BW$

As shown in Fig. 18(a), when $BW$ is below 40%, the SCT delay bound is constant since it is ruled by $\beta_{SCT,2}^{sp}$ (see Corollary 6): the bandwidth allocated by the BLS is not sufficient to send the SCT traffic. As a consequence, the SCT traffic also uses the bandwidth left by the RC traffic. However, for BW higher than 40%, SCT delay bound decreases. This is due to the fact that $I_{idle}=BW\cdot C$ , thus the guaranteed rate of the SCT minimum service curve $\beta_{SCT}^{bls}$ increases while its initial latency decreases.

Concerning the RC delay bounds, we observe in Fig. 18 the opposite behaviors: for BW higher than 55%, RC delay bound is constant and ruled by $\beta_{RC}^{sp}$ (see Corollary 7); whereas for BW lower than 55%, RC delay bound is ruled by $\beta_{RC}^{bls}$ . Thus, when increasing $BW$ , $I_{idle}$ increases. This leads to decreasing the guaranteed rate of $\beta_{RC}^{bls}$ , and consequently to the delay bounds increase.

These results show that the variation of $BW$ has a high impact on both SCT and RC delay bounds with an increase of 0.60ms (resp. 0.55ms) for SCT (resp. RC), representing an increase of 170% (resp. 137%).

Impact of $L_{R}$

SCT and RC delay bounds when varying $L_{R}$ are shown in Fig. 19. We notice that the SCT delay bound with CCbA remains firmly below the limit set by $\beta_{SCT,2}^{sp}$ , and it is always ruled by $\beta_{SCT}^{bls}\otimes\beta_{SCT,0}^{sp}$ . When $L_{R}$ increases, $L_{M}-L_{R}$ decreases, leading to the slow decrease of the initial latency of $\beta_{SCT}^{bls}$ . Additionally, $MFS_{RC}^{sat}$ decreases until it hits 0 at $L_{R}=MFS_{RC}\cdot\frac{I_{idle}}{C}$ (according to Theorem 4). This happens in Fig. 19 at $L_{R}=0.053\cdot L_{M}$ .

In Fig. 19(b), the RC delay bound is ruled by $\beta_{RC}^{bls}$ . Hence, the RC delay bounds increase when $L_{R}$ increases.

These results show that $L_{R}$ has a limited impact on the SCT delay with a maximum variation of 9%; whereas its impact is higher on RC delay bounds, with a variation of 28%.

To conclude the sensitivity analysis of the CCbA model, both $L_{R}$ and $L_{M}$ have limited impact on the SCT delay bound (under 10%), but a large one on RC delay bounds (around 30%). Moreover, the largest impact is due to the the SCT and RC utilization rates and $BW$ parameter, with delay bound increases up to 137% and 170% for RC and SCT respectively.

Tightness Analysis

Thanks to the modelisation of both the BLS and SP parts of the output port multiplexer, the SCT and RC delay bounds are very tight in reference to AWC, under the different considered scenarios. For instance, as shown in Fig. 15(a), when varying the SCT utilization rate, the maximum gap between the AWC and the NC delay bounds of SCT is $0.5ms$ , which represents an increase of $33\%$ . Moreover, when varying the RC utilization rate, we have similar results: the largest percentage increase of the RC delay bounds happens for a gap of $0.5ms$ and represents $27\%$ in Fig. 16(b). When varying $BW$ , $L_{M}$ and $L_{R}$ , we also have similar results in Fig. 17, Fig. 19 and Fig. 18, for both SCT and RC delay bounds.

Finally, with a gap between AWC and the NC model usually below 15% under the various scenarios, the proposed model can be considered an accurate one.

**Thus, the tightness of the model is very high: the gap between the NC model and AWC is usually less than 15%, with a peak at 28%. **

Comparing NC/CCbA to CPA and NC/WbA

In this section, we compare our proposed model to the CPA and NC/WbA models. We start by comparing the computation times, before studying the SCT and RC delay bounds. These comparison are done on the single-hop case study.

Concerning the NC models, i.e., WbA and CCbA, they lead to identical delay bounds at $L_{R}=0$ (due to identical service curves) and are presented as a single curve for $Scenario_{SCT}$ and $Scenario_{RC}$ .

Computation times

For each scenario, we consider the computation time necessary to obtain all the delays in the corresponding scenario.

With both NC models, we compute each delay bound through simple linear computations. Their computation delays are the same since only the rate and initial latency of the BLS node are different, which does not impact the computation time. With CPA however, the computation is much more complex:

•

SCT delay bounds necessitate finding a maximum using a while-loop;

•

RC delay bounds necessitate solving:

–

a maximization problem;

–

fixed point problems;

–

ILP problems.

We can see clearly in Table 3 that the NC models necessitate much less computation power than the CPA model. In fact, we can notice that the NC models are between 20 000 and 100 000 times faster than the CPA model.

SCT delay bounds

We can see in Fig. 20(a) that the SCT delay bounds of the three models are overlapping for low values of $UR_{SCT}$ . Then, they diverge at $UR_{SCT}=20\%$ . The NC curve starts to follow a linear curve with a lower increase rate. The CPA model however, keeps the same rate.

As a consequence, the gap between CPA and NC curves increases (up to 70%), which shows the increasing pessimism of CPA under high SCT utilisation rates.

The main cause of this pessimism is due to the fact that the so-called CPA shaper blocking impact (see Section 2.2) does not take into account the RC rate. As $BW$ is close to 50%, the idle and send slopes are very close: the replenishment and service intervals are very similar. So, when the SCT utilization rate becomes visibly larger than the RC one (over $UR_{SCT}=20\%$ ), the replenishment intervals are not completely filled: SCT traffic is sent even-though the SCT priority is low. This causes the decreasing SCT delay bounds under the NC models. Similar results are visible when varying the different parameters in Fig. 21(a), Fig. 22(a), Fig. 24(a), and Fig. 23(a), where the delay bounds are generally more pessimistic with CPA model than the ones with NC models.

However, in Fig. 22(a), we can see that SCT delay bounds with CPA are sometimes lower than the ones with NC models. This fact confirms our conclusions in Section 2.2 about the CPA model optimism.

Concerning the comparison of NC/WbA and NC/CCbA, we can see in all figures that the SCT delay bounds with CCbA is consistently equal of lower than with WbA. In particular in Fig. 24(a), we can see that, as expected in Section 2.2, the impact of $L_{R}$ is better taken into account with CCbA, with the SCT delay bounds under CCbA below the delay bounds with WbA for $L_{R}>0$ .

RC delay bounds

Concerning the RC traffic, in Fig. 20(b)) and Fig. 21(b) all three analytical models have the same shape. In NC, this is again thanks to the association of the BLS and SP parts, $\beta_{RC}^{bls}$ and $\beta_{RC}^{sp}$ . In the CPA model, this is thanks to solving an ILP problem, which takes into account the maximum available SCT traffic.

It is worth noting that in the part of the curve ruled by the $sp$ node, NC and CPA have very similar delay bounds; whereas in the part ruled by the $bls$ node, CPA leads to slightly larger delay bounds. This can be explained by the pessimism of maximum replenishment intervals $t_{SCT}^{R+}$ in the ILP problem of CPA: the credit replenishment is over-evaluated as explained in Section 2.2. Hence, the resulting sending interval is also over-evaluated, which adds pessimism to the RC delay bounds.

An exception of this general behavior is visible in Fig. 22(b) where for large $L_{M}$ , the CPA model is less pessimistic than the NC models (up to 10%).

From this analysis, we can point out the low complexity of our model compared to the CPA model. Moreover, concerning the SCT traffic, we have solved the optimism and pessimism issues of the CPA model. Finally, between the two NC models, i.e., WbA and CCbA, we have shown that CCbA is the clear choice as it better takes into account the impact of $L_{R}$ , which results in a better tightness.

6.2 Use-case 2: multiple BLS for 6 classes

In this part, we implement a 6 classes output port architecture to compute the delay in the network presented in Fig. 25. We use gCCbA to compute the delay bounds of SCT and RC traffics.

Then, we do a timing analysis of this network with different traffic and different BLS parameters. In particular, we show the gains in terms of delay bounds and schedulability when using the extended AFDX instead of current AFDX. As BE traffic does not have timing constraint and only impacts the other flow by a single maximum sized frame transmission, we only present here results for SCT and RC traffic.

Output port architecture and traffic

We study an output port architecture with 6 classes: 2 for each type of traffic. As shown in Fig. 26, two BLS are activated: one for the class $SCT_{2}$ and one for the class $RC_{2}$ . The aim is to give a class for very low SCT deadlines: $SCT_{1}$ . A second class $SCT_{2}$ regroups the rest of the SCT traffic with larger deadline requirements. Concerning RC, a first class without shaper, denoted $RC_{1}$ is used for low RC deadlines, and a second class shaped by a BLS is set for larger deadlines. Finally, the BE traffic can also be separated in two classes if necessary. As the current AFDX standard uses a SP scheduler and defines 2 classes, we compare the architecture proposed in Fig. 26 with a 6-classes architecture scheduled with a simple Static Priority. This way, we can compare the proposed architecture with a natural extension of the current AFDX standard.

The flows we consider for each class of traffic are detailed in Table 4. We set for each BLS class $k$ $p_{L}(k)$ higher than the BE priority. Additionally, we kept the order between the high and low priority: $SCT_{2}$ low priority (i.e. 4) is higher than $RC_{2}$ low priority (i.e. 5). Concerning the classification of the different classes in $HC(k)$ , $MC(k)$ , and $LC(k)$ , here is a practical example for class $SCT_{2}$ : $HC(SCT_{2})=\{SCT_{1}\}$ ; $MC(SCT_{2})=\{RC_{1},RC_{2}\}$ ; $LC(SCT_{2})=\{RC_{2},BE_{1},BE_{2}\}$ .

A consequence of this BLS configuration is that the impact $BW_{RC_{2}}$ on $SCT_{2}$ is only due to $\alpha_{RC_{2}}^{sp}=\alpha_{RC_{2}}\oslash\beta_{RC_{2}}^{bls}$ in $\beta_{SCT_{2},5}^{sp}$ in Th.5.3. Hence, the impact of $BW_{RC_{2}}$ is null for the non-BLS classes, i.e., $SCT_{1}$ and $RC_{1}$ , and not noticeable for $SCT_{2}$ .

Each ES generates $n_{k}^{es}$ flows ( $k$ the class of the flow). So the bottleneck utilization rate for a class $k$ in the network presented in Fig. 25 is $UR^{bn}_{k}=16\cdot n_{k}^{es}\cdot\frac{MFS_{k}}{BAG_{k}}$ .

In Table 5, we present the different scenarios considered: in $Scenario_{SCT_{2}}$ , we vary the utilization rate of the $SCT_{2}$ class;in $Scenario_{RC_{1}}$ , we vary the utilization rate of the $RC_{1}$ class;in $Scenario_{RC_{2}}$ , we vary the utilization rate of the $RC_{2}$ class. We call the $defaultconfiguration$ the constant rates used in the different scenarios: 5% for $SCT_{1}$ , $RC_{1}$ and $RC_{2}$ , 25% for $SCT_{2}$ , 15% for $BE_{1}$ and 20% for $BE_{2}$ . We consider that the SCT classes represent 30% of the traffic. Concerning RC classes, which are used by the traffic currently on the AFDX, we considered a future where the current traffic has tripled, going from a maximum rate of 30 Mbps to 100 Mbps for the RC type of traffic. Finally, the BE classes represent 35% of the traffic.

The BLS parameters are identical is every output ports. For a class $k$ , We set the $L_{R}^{k}$ as described in Section 6.1, $L_{R}^{k}=\max_{j\in MC(k)}MFS_{j}\cdot BW^{k}$ . Also following the conclusion of Section 6.1, we set a low value for $L_{M}^{k}$ : $L_{M}^{k}=5\cdot MFS_{k}$ . Finally, we saw in Section 6.1 that $BW^{k}$ is the BLS parameters that influences most the delay bounds, so we will vary this parameter from $0.1$ to $0.9$ in the 3 scenarios.

We chose not to present results of $SCT_{1}$ variations as their conclusions only confirm previous scenarios’ conclusions. As $SCT_{1}$ traffic is not impacted by the variations of other class traffic, the $SCT_{1}$ delay bound is constant for all scenarios and equal to $2.45\cdot 10^{-4}$ s, well below its 1ms deadline.

Impact of the variation of $SCT_{2}$ traffic

In this 1st scenario, we vary $SCT_{2}$ traffic and the reserved bandwidth of $SCT_{2}$ , and $RC_{2}$ , respectively denoted $BW^{SCT_{2}}$ and $BW^{RC_{2}}$ . The results are presented in Fig. 27. As the variation of $BW^{RC_{2}}$ does not impact the delay bounds of $SCT_{2}$ and $RC_{1}$ traffic, we present in Fig. 27(a)(b) the impact of the variation of $BW^{SCT_{2}}$ on $SCT_{2}$ and $RC_{1}$ . In Fig. 27(c)(d) we present the impact of the variations of $BW^{SCT_{2}}$ and $BW^{RC_{2}}$ on $RC_{2}$ .

$SCT_{2}$ * delay bounds*

First in Fig. 27(a), as expected the BLS increases the delay bounds of the $SCT_{2}$ traffic compared to SP. This increase is minimal pour high values of $BW^{SCT_{2}}$ , i.e., when the behavior is close to the SP behavior; and maximal for low values of $BW^{SCT_{2}}$ , i.e., when the BLS is most effective. For $BW^{SCT_{2}}=\{0.10,0.50\}$ , we are able to distinguish the two parts of the service offered, e.g., the BLS parts $\beta_{SCT_{2}}^{bls}$ for low values of $UR_{SCT_{2}}$ , and the SP part $\beta_{SCT_{2},5}^{sp}$ (identical for any values of $BW^{SCT_{2}}$ )for higher values of $UR_{SCT_{2}}$ . With $BW^{SCT_{2}}=\{0.74,0.90\}$ , the SP part is not reached before $UR_{SCT_{2}}=50\%$ .

$RC_{1}$ * delay bounds*

Secondly in Fig. 27(b), we find again a BLS behavior similar to Section 6.1: the BLS limits the $RC_{1}$ delay bound. For low values of $UR_{SCT_{2}}$ , the $RC_{1}$ under the extended AFDX (BLS) is ruled by $\beta_{RC_{1}}^{sp}$ and increases steadily. Then, the $RC_{1}$ delay bound is limited by $\beta_{RC_{1}}^{bls}$ . The $RC_{1}$ delay bound limitation occurs at different $UR_{SCT}$ depending on the value of $BW^{SCT_{2}}$ , i.e., it increases with $BW^{SCT_{2}}$ . As a result, the gain in terms of $RC_{1}$ delay bound, decreases when $BW^{SCT_{2}}$ increases, compared to SP. For example, at $UR_{SCT_{2}}=25\%$ the $RC_{1}$ delay bounds is divided by 2.4 for $BW^{SCT_{2}}=0.5$ , and by 5.25 for $BW^{SCT_{2}}=0.1$ .

$RC_{2}$ * delay bounds*

Thirdly, when varying $BW^{SCT_{2}}$ in Fig. 27(c), the behavior of the $RC_{2}$ delay bound is similar to $RC_{1}$ delay bound, i.e., after a certain point, the $RC_{2}$ delay bound is limited by the BLS part $\beta_{RC_{2}}^{bls}$ . Hence, the impact of the increase of $UR_{SCT_{2}}$ is mitigated by the BLS compare to SP. For example, at $UR_{SCT_{2}}=25\%$ the $RC_{2}$ delay bounds is decreases by 8.3% for $BW^{SCT_{2}}=0.5$ , and by 13.3% for $BW^{SCT_{2}}=0.1$ . The $RC_{2}$ delay bounds can be decreased by up to 33%.

Fourthly, when varying $BW^{RC_{2}}$ in Fig. 27(d),the impact of higher priorities on $RC_{2}$ is again mitigated by the extended AFDX (BLS). For low values of $BW^{RC_{2}}$ , the behavior is ruled by $\beta_{RC_{2},6}^{sp}$ and so the $RC_{2}$ delay bounds under BLS are close to those under the current AFDX (SP). For higher values of $BW^{RC_{2}}$ and $UR_{SCT_{2}}>18\%$ , the behavior under BLS is ruled by $\beta_{RC_{2}}^{bls}$ and the $RC_{2}$ delay bound increases are mitigated with a $RC_{2}$ delay bound decrease up to 50% compared to the delay bounds under the current AFDX (SP).

$SCT_{2}$ * schedulability*

Finally, the extended AFDX (BLS) has a strong impact on the schedulability (when all the deadlines are fulfilled) of the $SCT_{2}$ class. The maximum $UR_{SCT_{2}}$ are presented in Table 6. The results show that the extended AFDX increases the schedulability compared to a standard SP. In particular, at $BW^{SCT_{2}}=0.74$ , i.e., $RC_{1}$ delay bound close to its deadline, the $SCT_{2}$ schedulability is increased by 40%.

These results show the impact of the extended AFDX (BLS) when $SCT_{2}$ varies: with good parameters, the delay bounds of lower priorities can be divided by up to 5.4 times for $RC_{1}$ , and up to 2 for $RC_{2}$ compared to current AFDX (SP). The schedulability of $SCT_{2}$ is also enhanced, up to 40%.

Impact of the variation of $RC_{1}$ traffic

In this 2nd scenario, we vary $RC_{1}$ traffic and the reserved bandwidth of $RC_{2}$ , denoted $BW^{RC_{2}}$ . The results are presented in Fig. 28. As we have extensively studied the impact of variation of $BW^{SCT_{2}}$ , we will not vary $BW^{SCT_{2}}$ here. Also, as the variation of $BW^{RC_{2}}$ does not impact the delay bounds of $SCT_{2}$ and $RC_{1}$ traffic, we present in Fig. 28(a) and (b) the impact of the variation of $RC_{1}$ utilization rate on $SCT_{2}$ and $RC_{1}$ delays for any $BW^{RC_{2}}$ . In Fig. 28(c) we present the impact of the variations of $RC_{1}$ utilization rate and $BW^{RC_{2}}$ on $RC_{2}$ delays. In this scenario, we set $BW^{SCT_{2}}=0.58$ so that $SCT_{2}$ delay bound is just below its 4ms deadline in Fig. 28(a).

$RC_{1}$ * delay bounds*

In Fig. 28(b), the $RC_{1}$ delay bound is largely decreased by the extended AFDX (BLS). At the current utilization rate of the AFDX, i.e., $UR_{RC_{1}}=3\%$ , the $RC_{1}$ delay bound under the extended AFDX (BLS) is divided by 2.7, compared to the bounds under the current AFDX (SP).

$RC_{2}$ * delay bounds*

In Fig. 28(c), the impact of the extended AFDX (BLS) on the $RC_{2}$ delay bounds is less visible. At the current utilization rate of the AFDX, i.e., $UR_{RC_{1}}=3\%$ , the $RC_{2}$ delay bound under the extended AFDX (BLS) is decreased up to 17%, compared to the bounds under SP. The maximum decrease of the $RC_{2}$ delay bound under extended AFDX (BLS) is 20% at $UR_{RC_{1}}=1\%$ , compared to the $RC_{2}$ delay bound under the current AFDX (SP).

$RC_{1}$ * schedulability*

The schedulability of $RC_{1}$ is largely enhanced by the extended AFDX (BLS) compared to the current AFDX (SP). The maximum $RC_{1}$ utilization rate under SP is limited at $UR_{RC_{1}}=2.5\%$ in Fig. 28(b) by the $RC_{1}$ deadline. With the extended AFDX (BLS), the $RC_{2}$ deadline limits the maximum $RC_{1}$ utilization rate at $UR_{RC_{1}}=12\%$ . Hence, the $RC_{1}$ schedulability is multiplied by 4.8 with the extended AFDX compared to the current AFDX (SP).

These results show the impact of the extended AFDX (BLS) when $RC_{1}$ varies: the delay bounds of lower priorities can be divided by 2.7 for $RC_{1}$ and decreased by up to 20% for $RC_{2}$ , compared to the current AFDX (SP).

Impact of the variation of $RC_{2}$ traffic

In this 3rd scenario, we vary $RC_{2}$ traffic and the reserved bandwidth of $RC_{2}$ , denoted $BW^{RC_{2}}$ . The results are presented in Fig. 29. As the variation of $BW^{RC_{2}}$ does not impact the delay bounds of $SCT_{2}$ and $RC_{1}$ traffic, we present in Fig. 29(a) and (b) the impact of the variation of $RC_{1}$ on $SCT_{2}$ and $RC_{1}$ for any $BW^{RC_{2}}$ . In Fig. 27(b) we present the impact of the variations of $BW^{RC_{2}}$ on $RC_{2}$ . In this scenario, as before we set $BW^{SCT_{2}}=0.58$ so that $SCT_{2}$ delay bound is just below its 4ms deadline in Fig. 29(a).

$RC_{1}$ * delay bounds*

In Fig. 29(b), the $RC_{1}$ delay bound is much decreased under the extended AFDX compared to under the current AFDX (SP), i.e., it is divided by 2.1.

$RC_{2}$ * delay bounds*

In Fig. 29(c), the $RC_{2}$ delay bound is positively impacted by the extended AFDX, with a maximum decreased of the $RC_{2}$ delay bounds of 22%. For example, at the current utilization rate of the AFDX, i.e., $UR_{RC_{2}}=3\%$ , the $RC_{2}$ delay bound under the extended AFDX (BLS) is decreased by 16% compared to the delay bounds under the current AFDX (SP).

$RC_{2}$ * schedulability*

As before the extended AFDX (BLS) increases the schedulability compared to the current AFDX (SP). In fact in In Fig. 29(b), with SP, the $RC_{1}$ delay bound is always greater than its deadline. On the contrary, with extended AFDX the $RC_{1}$ deadline is always fulfilled and the limitation to the schedulability is due to the $RC_{2}$ deadline, which is crossed at $UR_{RC_{2}}=12\%$ .

These results confirm the positive impact of the extended AFDX (BLS) when $RC_{2}$ varies, i.e., the $RC_{1}$ delay bounds is divided by 2.1 and the $RC_{2}$ is decreased up to 22% compared to the current AFDX (SP). Additionally, the schedulability of $RC_{2}$ is enhanced from $UR_{RC_{2}}=0$ under the current AFDX (SP), to $UR_{RC_{2}}=12\%$ under the extended AFDX (BLS).

6.3 Use-case 3: adding A350 Flight Control to the AFDX

The flight control traffic is the most important on an aircraft. It is currently on private MIL-STD-1553B networks to keep it isolated from other traffics. In this part, we study the possibility of adding the Flight Control traffic to the AFDX using our proposed 3-classes extended AFDX illustrated in 13.

Defining a new network architecture

The AFDX fulfills the highest avionics requirements and can be used for Safety Critical traffic, such as flight Control traffic. However, the main concern is the way the Flight Control devices can be connected to the AFDX to guarantee the avionics requirements, particularly the safety rule stating that a single failure must not cause the loss of a function. After a reverse-engineering process of the current A350 flight control architecture illustrated in Fig. 30, we have proposed a new architecture connecting the flight control calculators and actuators based on the extended AFDX technology, as illustrated in Fig. 31.

First, to connect the calculators, we use 2 switches (SS1 and SS2), so that we do not lose a full network due to one switch loss. To obtain similar timing results for all actuators, we use the remaining 5 switches (L1, L2, C, R1, R2) to connect the actuators, taking into account the energy supplier network, the type of actuator to fulfill the safety rule, and trying to homogenize the number of connections on each switch. The result is visible in Fig. 31, we obtain a diamond-like structure with central switches (L1, L2, C, R1, R2) connected to 6 or 7 actuators.

In this architecture, the BLS is incorporated within the output ports from SS1/SS2 to the central switches, from the central switches to SS1/SS2, and from SS1/SS2 to the calculators. However, for the output port linking the central switches to the actuators, the BLS is not useful since the flight control traffic is the only type of traffic in these output ports. Hence, we obtain the network presented in Fig. 32, where there is only one BLS along the path of each flow from a calculator to an actuator.

Timing analysis of the proposed solution

In this section, we will consider many different scenarios to assess the performance of the extended AFDX solution in terms of delay bounds. The SCT traffic consists of Flight Control frames and the considered scenarios are described in Table 7.

We use the architecture presented in Fig. 31. Hence, each calculator generates 17 flows with a periodicity $BAG_{SCT}$ and a frame size $MFS_{SCT}$ . Then, the frames arrive in SS1 or SS2. The output port with the heaviest load receives 7 flows from each of the 3 calculators connected to the considered switch, thus a total of 21 flows. Finally, the flows arrive in the central switches. Each central switch output ports receives 6 flows, one from each calculator.

The current heaviest load on the current 100Mbps AFDX is 30%. With the considered 1Gbps network, the heaviest load is 3%. Hence, we consider that in each output port there are $n_{RC}$ flows defined by $MFS_{RC}$ and $BAG_{RC}$ to obtain an utilization rate of 3%:

$n_{RC}=\bigg{\lceil}\frac{3}{100}\cdot C\cdot\frac{BAG_{RC}}{MFS_{RC}}\bigg{\rceil}$

Hence, we obtain:

$\alpha_{RC}(t)=n_{RC}\cdot\left(\frac{MFS_{RC}}{BAG_{RC}}\cdot t+MFS_{RC}\right)$

We use this $\alpha_{RC}$ in both the calculators and the first switch (either SS1 or SS2). The delay bounds are computed with the CCbA modelisation. In Section 6.2, we highlighted the importance of good parameterization. Hence, in this section, the BLS parameters are computed with the tuning method proposed infinzituning .

The computed SCT and RC delay bounds under the different scenarios for the extended and current AFDX are detailed in Table 8. We consider two performance measurements. First, the end-to-end SCT delay bounds between a calculator and an end-system, denoted $delay_{SCT}^{end2end,m}$ for either the extended AFDX ( $m=BLS$ ) or the current AFDX ( $m=SP$ ). The goal is to verify that the end-to-end SCT deadline is fulfilled. Secondly, the RC delay bounds in the switches SS1 and SS2 under BLS. We denote $delay_{RC}^{SW1,m}$ , the delay bound of the RC traffic in the first switch in the considered path, with $SW1$ being SS1 or SS2 depending on the considered flow, with $m\in\{BLS,SP\}$ . It is worth noting that due to the symmetry of the network the delay bound in SS1 is identical to the one in SS2.

From the results in Table 8, we can see that for very diverse configurations, SCT delay bounds still fulfill the deadlines. Additionally, the RC delay bounds with the extended AFDX is always lower than the ones with the current AFDX, up to 49.9% of improvement in SW1. This confirms the efficiency of our proposal to handle mixed-criticality traffic in a realistic situation.

7 Conclusion

To homogenize the avionics communication architecture for heterogeneous traffic, we have proposed a new modelisation of an extension of the AFDX incorporating several TSN/BLS.

First, we have studied the existing BLS models. In particular, we have showed that the existing CPA model thiele2016formal can lead to optimistic bounds. Then, after comparing the two existing 3-classes Network Calculus BLS models, i.e. WbA Finzi-sies-18 and CCbA Finzi-wfcs-18 , we have concluded that the Continuous Credit-based Approach (CCbA) is the most promising. Hence, we have generalized it to multiple classes and multiple BLS.

Secondly, we have presented the system model to specify the considered network and traffic models. In particular, we have detailed an extended AFDX switch output port able to support multiple BLS.

Thirdly, we have generalized the CCbA and proposed a formal timing analysis of the extended AFDX to formally prove that the hard real-time requirements are fulfilled. We have started by detailing the schedulability conditions. Then, we have detailed the modelisation of the BLS and of the extended AFDX output port multiplexer, before presenting the end-to-end delay bound computation. This has led to a discussion on the nature of the BLS showing the BLS is not a greedy shaper, and that it is better to consider the association of the BLS and NP-SP as a scheduler.

Finally, we have done a performance analysis of the extended AFDX. First, sensitivity and tightness analyses have shown the good properties of our modelisation, in particular concerning the impact of $L_{R}$ with CCbA compared to WbA. Then, the comparison to the CPA model has shown that our model is less complex and has solved the optimistic and pessimistic issues of the CPA modelisation of the BLS. A second case study with six classes and two BLS has highlighted the good properties of the BLS and its ability to reduce the RC classes delay bounds (delays divided up to 5.4 times) and enhanced the schedulability of any class (e.g. from 0 to 12%), compared to a Static Priority Scheduler. We have finished with a concrete application, i.e., adding the A350 flight control to the AFDX. Results show that the extended AFDX decreases the delay bounds of the existing AFDX traffic compared to a standard AFDX (up to 49.9%), hence mitigating the impact of the added traffic on existing traffic.

Appendix A Computing Achievable Worst-Cases

We consider the 3-classes case study, where the SCT class is shaped by a BLS, presented in Fig. 13 As there is only one shaped class: SCT, we use $k=\emptyset$ to simplify, for the non-ambiguous notations, such as $L_{M}^{k}$ or $I_{send}^{k}$ . Our aim is to compute Achievable Worst-Cases for SCT and RC delays, i.e., realistic worst-cases.

In this section, we consider several hypothesis :

•

traffics are packetized, i.e., we need to integrate the non-preemption impact;

•

the same frame size for each class SCT, RC and BE, i.e., homogeneous traffic within each traffic class;

We use the four curves presented in Fig. 33 and Fig. 34 to compute two Achievable Worst-Cases for each traffic class, i.e., SCT and RC, for the single-hop network defined in Section 6.1. It is worth noting there is not strict order between the different cases. Based on these scenarios, we will be able to calculate so called Achievable Worst-Case delays to have an idea on the tightness of both RC and SCT delay bounds.

As illustrated in Fig. 33 and Fig. 34, there is an alternation of sending windows (when SCT traffic is sent) and idle windows (when RC traffic is sent). We call a cycle a sending window followed by an idle window (or an idle window followed by a sending window). A so called maximum-sized cycle is made of so called realistic maximum sending and idle windows: $\Delta_{send}^{real}$ , $\Delta_{idle}^{real}$ .

A.1 SCT achievable worst-cases

We start by presenting the methodology, before considering the two BLS behaviours described in Fig. 33.

A.1.1 Methodology

To compute the worst-case delay of the SCT class, $delay_{SCT}^{max}$ , we need to take into account of the following effects:

•

BE class impact due to the non-preemption feature. We need to consider the transmission of a maximum-sized BE frame that may be transmitted before a SCT frame;

•

Transmission time of SCT burst: it is the time needed for the output port multiplexer to transmit the maximum SCT burst $b_{SCT}=n_{SCT}^{in}\cdot MFS_{SCT}$ , with a transmission capacity $C$ , when taking into account the shaping effect of the upstream links. Each one of these link has a capacity $C$ , resulting in the following transmission time:

[TABLE]

•

RC class blocking effect $\Delta_{RC}^{blocking}$ : it is the blocking effect of the shaper, which enforces the presence of $idle$ $windows$ (resp. $sending$ $windows$ ) to send the RC (resp. SCT) traffic.

Thus, we need to compute $\Delta_{RC}^{blocking}$ in each case to obtain the Achievable worst-cases.

The blocking effect depends the number of $realistic$ idle windows $\Delta_{idle}^{real}$ used by the RC traffic, denoted $Ncyle_{RC}^{used}$ . The computation of $Ncyle_{RC}^{used}$ is based on both:

i) $Ncycle_{RC}^{needed}$ , the number of cycles $needed$ to send the RC traffic during $realistic$ idle windows $\Delta_{idle}^{real}$ ;

ii) $Ncycle_{RC}^{available}$ , the number of cycles $available$ to RC while the SCT traffic is being transmitted during $realistic$ sending windows $\Delta_{send}^{real}$ . If a sending window is started, it means that a full idle window $\Delta_{idle}^{real}$ is available to RC. We denote $Ncyle_{SCT}^{used}$ the number of $\Delta_{send}^{real}$ used by the SCT traffic. Hence, we have:

[TABLE]

Thus, we obtain:

[TABLE]

The computation of the number of cycles $Ncycle_{SCT}^{used}$ necessary to compute $\Delta_{RC}^{blocking}$ is based on:

i) the SCT and RC traffics;

ii) realistic windows, which depend on the chosen BLS behaviour and will be computed in each specific case.

So first, we assess the SCT and RC traffics. A strong hypothesis we make while computing the SCT traffic is that we do not consider the SCT traffic that may arrive while the SCT burst is being transmitted. Considering this additional traffic leads to the need of computing a fixed-point problem so we discard it here as it causes acceptable optimism rather than unacceptable pessimism. Hence, the maximum amount of considered SCT traffic is:

[TABLE]

However, not considering the amount of RC traffic arriving while SCT traffic is waiting leads to a large optimism. Hence, to compute the impact of RC, we need to compute the the maximum amount of RC traffic that arrives while the SCT burst is being sent, i.e., during $delay_{SCT}^{max}$ :

[TABLE]

Hence, the SCT delay is as follows:

[TABLE]

As $\Delta_{RC}^{blocking}(delay_{SCT}^{max})$ depends on $delay_{SCT}^{max}$ , $delay_{SCT}^{max}$ can be computed by solving this fixed point problem. We consider $\frac{n_{SCT}^{in}\cdot MFS_{SCT}}{C}$ to be a good starting point.

A.1.2 SCT Achievable Worst-Case 1

We start by computing an Achievable Worst-Case for the SCT class, denoted SCT AWC-1 using the plain line curve (1) in Fig. 33.

1. Computing the RC blocking delay $\Delta_{RC}^{blocking}(delay_{SCT}^{max})$

The RC blocking delay is defined by:

[TABLE]

So, to compute the RC blocking delay, we need to compute the number of $\Delta_{idle}^{real}$ windows used by RC, $Ncycle_{RC}^{used}$ .

To compute the number of cycles, we first need the realistic windows.

2. Computing realistic sending and idle windows

They are computed as the upper integer value of maximum number of frame that can be sent during a minimum window multiplied by the transmission time of a frame. Concerning the sending window, we consider that the window starts at $L_{R}^{min}=\max(0,L_{R}-I_{idle}\cdot\frac{MFS_{RC}}{C})$ . This last hypothesis may be slightly optimistic as the window can in fact starts between $L_{R}$ and $L_{R}^{min}$ depending on the frames transmissions and sizes.

[TABLE]

3. Computing $Ncycle_{RC}^{needed}$

We compute the number of cycles necessary to send the RC traffic $B_{RC}^{max}(delay_{SCT}^{max})$ :

[TABLE]

4. Computing $N{cycle}_{RC}^{available}$

Finally, the number of windows available to RC is:

[TABLE]

A.1.3 SCT Achievable Worst-Case 2

For the second achievable worst-case, denoted SCT AWC-2, we use the dotted curve (2) in Fig. 33.

1. Computing the RC blocking delay $\Delta_{RC}^{blocking}(delay_{SCT}^{max})$

To compute the RC blocking delay, we need to take into account the RC and SCT traffics sent between ti and t1. So, we compute:

i) the SCT traffic sent between t0 and t1;

ii) the RC traffic sent between ti and t0, and the corresponding window $\Delta_{tit0-idle}^{real}$ .

Then, we can compute $N{cycle}_{RC}^{used}$ , the number of maximum-sized cycles, i.e., $\Delta_{send}^{real}+\Delta_{idle}^{real}$ used to send the RC burst remaining after $t1$ , i.e., $B_{RC}^{max}(delay_{SCT}^{max})-\Delta_{tit0-idle}^{real}\cdot C$ .

Thus, we obtain the following RC blocking delay:

[TABLE]

To compute the number of cycles, we first need the realistic windows between ti and t0, and between t0 and t1.

2. Computing realistic sending and idle windows

We consider that during the first idle window, there is no RC traffic backlogged when the credit reaches $\frac{L_{M}}{2}$ . So SCT traffic is sent until there is again RC traffic, i.e., when the credit reaches $L_{R}$ (see Fig. 33).

First, we will use the same realistic maximum sending and idle windows as for AWC-1. We will also compute the realistic sending and idle windows from $L_{R}$ to $\frac{L_{M}}{2}$ and from $\frac{L_{M}}{2}$ to $L_{R}^{min}$ .

[TABLE]

3. Computing $N{cycle}_{RC}^{needed}$

The number of maximum-sized cycles necessary to send the RC traffic after t1 is the numbers of cycles necessary to send the RC burst minus the traffic sent during $\Delta_{tit0-idle}^{real}$ :

[TABLE]

4. Computing $N{cycle}_{RC}^{available}$

To compute the number of cycle available to RC after t1, we consider the remaining SCT burst after t1. Thus, we have:

[TABLE]

A.2 RC achievable worst-cases

We start by presenting the methodology, before considering the two BLS behaviours described in Fig. 34.

A.2.1 Methodology

To compute the worst-case delay of the RC class, $delay_{RC}^{max}$ , we need to do an account of the following effects:

•

BE class impact due to the non-preemption feature. We need to consider the transmission of a maximum-sized BE frame that may be transmitted before a RC frame;

•

Transmission time of RC burst: it is the time needed for the output port multiplexer to transmit the maximum RC burst $b_{RC}=n_{RC}^{in}\cdot MFS_{RC}$ , with a transmission capacity $C$ , when taking into account the shaping effect of the upstream links. Each one of these link has a capacity $C$ , resulting in the following transmission time:

[TABLE]

•

SCT class blocking effect $\Delta_{SCT}^{blocking}$ : it is the blocking effect of the shaper, which enforces the presence of $idle$ $windows$ (resp. $sending$ $windows$ ) to send the RC (resp. SCT) traffic.

Thus, we need to compute $\Delta_{SCT}^{blocking}$ in each case to obtain the Achievable worst-cases.

The blocking effect depends the number of $realistic$ sending windows $\Delta_{send}^{real}$ used by the SCT traffic, denoted $Ncyle_{SCT}^{used}$ . The computation of $Ncyle_{SCT}^{used}$ is based on both:

i) $Ncycle_{SCT}^{needed}$ , the number of cycles $needed$ to send the SCT traffic during $realistic$ sending windows $\Delta_{send}^{real}$ ;

ii) $Ncycle_{SCT}^{available}$ , the number of cycles $available$ to SCT while the RC traffic is being transmitted during $realistic$ idle windows $\Delta_{idle}^{real}$ . If an idle window is started, it means that a full sending window $\Delta_{send}^{real}$ is available to SCT. We denote $Ncyle_{RC}^{used}$ the number of $\Delta_{idle}^{real}$ used by the RC traffic. Hence, we have:

[TABLE]

Thus, we obtain:

[TABLE]

The computation of the number of cycles $Ncycle_{SCT}^{used}$ necessary to compute $\Delta_{SCT}^{blocking}$ is based on:

i) the SCT and RC traffics;

ii) realistic windows, which depend on the chosen BLS behaviour and will be computed in each specific case.

So first, we assess the SCT and RC traffics. A strong hypothesis we make while computing the RC traffic is that we do not consider the RC traffic that may arrive while the RC burst is being transmitted. Considering this additional traffic leads to the need of computing a fixed-point problem so we discard it here as it causes acceptable optimism rather than unacceptable pessimism. Hence, the maximum amount of considered RC traffic is:

[TABLE]

However, not considering the amount of SCT traffic arriving while RC traffic is waiting leads to a large optimism. Hence, to compute the impact of SCT, we need to compute the the maximum amount of SCT traffic that arrives while the RC burst is being sent, i.e., during $delay_{RC}^{max}$ :

[TABLE]

Hence, the RC delay is as follows:

[TABLE]

As $\Delta_{SCT}^{blocking}(delay_{RC}^{max})$ depends on $delay_{RC}^{max}$ , $delay_{RC}^{max}$ can be computed by solving this fixed point problem. We consider $\frac{n_{RC}^{in}\cdot MFS_{RC}}{C}$ to be a good starting point.

A.2.2 RC Achievable Worst-Case 1

We compute an Achievable Worst-Case for the RC class, denoted RC AWC-1 using the plain line curve (1) in Fig. 34.

1. Computing the SCT blocking delay $\Delta_{SCT}^{blocking}(delay_{RC}^{max})$

An important difference between SCT and RC is the presence of an initial maximum sending windows starting at 0, denoted $\Delta_{send,0}^{real}$ . It differs from the usual maximum sending windows which start at $L_{R}$ . Hence, the initial SCT burst sent during this $\Delta_{send,0}^{real}$ must be taken into account throughout this computation of the SCT blocking delay.

To compute the SCT blocking delay, we need to compute:

i) $N{cycle}_{SCT}^{available}$ , the number of cycles available to SCT after t0, taking into account the impact of $\Delta_{send,0}^{real}$ ;

ii) $Ncycle_{SCT}^{needed}$ , the number of cycles needed to send the SCT traffic remaining after t1, i.e., the SCT burst minus the traffic sent during $\Delta_{send,0}^{real}$ .

Finally, we can compute $\Delta_{SCT}^{blocking}$ , the interfering SCT traffic delay due to the shaper blocking effect:

[TABLE]

To compute the number of cycles, we first need the realistic windows.

2. Computing realistic sending and idle windows

They are the same as Section A.1, except for the fact that we consider for $\Delta_{send}^{real}$ that the window starts at $L_{R}$ (instead of $L_{R}^{min}$ ) which may again be slightly optimistic as the window can in fact starts between $L_{R}$ and $L_{R}^{min}$ depending on the frames transmissions and sizes. Additionally, we consider the initial sending window $\Delta_{send,0}^{real}$ .

[TABLE]

3. Computing $Ncycle_{SCT}^{needed}$

Next, we compute the number of window cycles necessary to send the SCT traffic remaining after t0. We must consider the first sending window, $\Delta_{send,0}^{real}$ which starts at [math]:

The amount of traffic sent during this window is:

[TABLE]

Finally, the number of cycles necessary to send the remaining SCT traffic after t0 is:

[TABLE]

3. Computing $N{cycle}_{SCT}^{available}$

tThe first available window is $\Delta_{send,0}^{real}$ , and is taken into account directly in $\Delta_{SCT}^{blocking}(delay_{RC}^{max})$ . So, We must remove 1 from $N{cycle}_{RC}^{used}$ . Finally, we have:

[TABLE]

A.2.3 RC Achievable Worst-Case 2

For the second achievable worst-case, denoted RC AWC-2, we use the dotted curve (2) in Fig. 34.

1. Computing the SCT blocking delay $\Delta_{SCT}^{blocking}(delay_{RC}^{max})$

To compute the SCT blocking delay, we need to take into account the RC and SCT traffics sent between ti and t1. So, we compute:

i) the RC traffic sent between t0 and t1;

ii) the SCT traffic sent between ti and t0, and the corresponding window $\Delta_{tit0-send}^{real}$ .

Then, we can compute $N{cycle}_{SCT}^{used}$ , the number of maximum-sized cycles, i.e., $\Delta_{send}^{real}+\Delta_{idle}^{real}$ used to send the SCT burst remaining after $t1$ , i.e., $B_{SCT}^{max}(delay_{RC}^{max})-\Delta_{t0t1-send}^{real}\cdot C$ .

Thus, we obtain the following SCT blocking delay:

[TABLE]

To compute the number of cycles, we first need the realistic windows between ti and t0, and between t0 and t1.

2. Computing realistic sending and idle windows

We consider that during the first sending window, there is no SCT traffic backlogged when the credit reaches $\frac{L_{M}}{2}$ . So RC traffic is sent until there is again SCT traffic, i.e., when the credit reaches $L_{R}$ (see Fig. 34).

First, we will use the same realistic maximum sending and idle windows as for AWC-1. We will also compute the realistic sending and idle windows from [math] to $\frac{L_{M}}{2}$ and from $\frac{L_{M}}{2}$ to $L_{R}$ .

[TABLE]

3. Computing $N{cycle}_{SCT}^{needed}$

The number of maximum-sized cycles necessary to send the SCT traffic is the numbers of cycles necessary to send the SCT burst minus the traffic sent during $\Delta_{tit0-send}^{real}$ :

[TABLE]

4. Computing $N{cycle}_{SCT}^{available}$

We consider the remaining RC burst after t1. Thus, we have:

[TABLE]

Appendix B Generalized Continuous-Credit-based Approach (gCCbA) model proofs

In this section, we detail the proofs of the strict minimum and maximum service curves. Both proofs are based on three lemmas presented in the next section.

B.1 Continuous-credit Lemmas

We denote $R^{*}_{k}(t)$ the output cumulative function of the class $k$ traffic, and $\Delta R^{*}_{k}(\delta)$ its variation during an interval $\delta$ .

The BLS credit tries to keep an accurate accounting of the traffic sent. There are two situations when it loses track due to non-preempted transmissions:

when the credit reaches $L_{M}^{k}$ and the current class $k$ frame has not finished its transmission; 2. 2.

when the credit reaches [math] and the current frame is still being transmitted.

We call this the saturation of the credit, either at $L_{M}^{k}$ by class $k$ traffic, or at [math] by other traffics. The saturation at $L_{M}^{k}$ can only occur when a class $k$ frame is being transmitted, while the saturation at 0 can not occur when a class $k$ frame is being transmitted.

Hence, we call $\Delta R^{*}_{L_{M}^{k},sat}(\delta)$ (resp. $\Delta R^{*}_{0,sat}(\delta)$ ) the part of $\Delta R^{*}_{k}(\delta)$ (resp. $\delta\cdot C-\Delta R^{*}_{k}(\delta)$ ), that can be sent during any interval $\delta$ while the credit is saturated at $L_{M}^{k}$ (resp. at 0).

We present here three lemmas linked to the credit saturation and necessary to the service curve proofs. First in Lemma 1, we show how to bound the sum of the credit consumed and the credit gained, depending on the credit saturations. Then, we detail the bounds of the credit saturations at $L_{M}^{k}$ in Lemma 2, and at [math] in Lemma 3.

Lemma 1 (Continuous credit bounds).

We consider a shaped class $k$ , with a maximum credit level $L_{M}^{k}$ . $\forall\delta$ , computing the sum of the credit consumed and gained give the following inequations:

[TABLE]

Proof.

In an interval $\delta$ , the accurate consumed credit is the time it takes to send the non-saturating traffic $\frac{\Delta R^{*}_{k}(\delta)-\Delta R^{*}_{L_{M}^{k},sat}(\delta)}{C}$ multiplied by the sending slope:

[TABLE]

And conversely, the accurate gained credit is the remaining time $\delta-\frac{\Delta R^{*}_{k}(\delta)}{C}$ minus the saturation time $\frac{\Delta R^{*}_{0,sat}(\delta)}{C}$ , multiplied by the signed idle slope:

[TABLE]

Thus $\forall\delta\in\mathds{R}^{+}$ , using the fact that $I_{send}^{k}+I_{idle}^{k}=C$ , the sum of the gained credit and the consumed credit is:

[TABLE]

We know that the credit is a continuous function with a lower bound: 0 and an upper bound $L_{M}^{k}$ . So the sum of credit consumed and gained is always bounded by $-L_{M}^{k}$ and $+L_{M}^{k}$ .

[TABLE]

∎

Lemma 2 (credit saturation at [math]).

We consider a shaped class $k$ , with the aggregate traffic of priority strictly higher than $p_{H}(k)$ $\alpha_{h}$ -constrained with $\alpha_{h}=r_{h}\cdot t+b_{h}$ .

$\forall\delta$ , the amount of traffic sent while the traffic is saturated at [math] is such as:

[TABLE]

with:

[TABLE]

Proof.

First, we know that $\Delta R^{*}_{0,sat}(\delta)\geqslant 0$ . Secondly, we consider the impact of MC(k) and HC(k), the impact of LC(k) being taken into account in $\beta_{k}^{sp}(t)$ to compute an upper bound.

Impact of MC(k) on $\Delta R^{*}_{0,sat}(\delta)$

In the presence of class $k$ frames, the saturation of the credit at 0 can occur if an additional frame is sent while the credit is decreasing and about to reach $L_{R}^{k}$ . Due to non-preemption, the frame finishes its transmission even though the class $k$ priority is now higher.

To be able to compute the largest impact of the non-preemption of MC(k) frames on class $k$ traffic, we must find the highest number of non-preempted frames that can be sent during a time interval $\delta$ . Then, we must compute the part of the non-preempted frame sent while the credit is saturated.

So first, we must compute the smallest duration between two occurrences of the phenomenon. Fig. 35 illustrates the following explanation.

After the first non-preempted MC(k) frame has been sent, the priority of the class $k$ queue is high. So, in presence of class $k$ traffic, no MC(k) traffic can be sent until a priority change: $L_{M}^{k}$ must be reached between two non-preempted MC(k) frames.

Thus, we study the intervals of time between the start of two transmissions of non-preempted MC(k) frames starting their transmission just before $L_{R}^{k}$ is reached. The smallest duration of such an interval is equal to the sum of

the transmission time of the non-preempted MC(k) frame , such as at the end of the transmission the credit reaches $L_{R}^{k,min}=\max(L_{R}^{k}-\frac{\max_{j\in MC(k)}MFS_{j}}{C}\cdot I_{idle}^{k},0)$ ; 2. 2.

the duration $\frac{L_{M}^{k}-L_{R}^{k,min}}{I_{send}^{k}}$ because class- $k$ traffic has to be sent continuously in order for the credit to reach $L_{M}^{k}$ in the minimum duration ; 3. 3.

finally $\frac{L_{M}^{k}-L_{R}^{k}}{I_{idle}^{k}}$ because MC(k) traffic has to be sent continuously in order for the credit to return in the minimum duration to $L_{R}^{k}$ .

In total, the minimum duration between the start of the transmission of two non-preempted MC(k) frames (each starting just before $L_{R}^{k}$ is reached), is

[TABLE]

Thus during $\delta$ , the number of time a non-preempted MC(k) frame can be sent is upper bounded by $\lceil\frac{\delta}{\Delta^{k,\beta}_{inter}}\rceil$ .

Secondly, we need to compute the maximum amount data sent while the credit remains at 0 during the transmission of one non-preempted maximum-sized MC(k) frame as illustrated in Fig. 35. This is equal to the maximum size of a MC(k) frame, minus the amount of data transmitted while the credit decreases from $L_{R}^{k}$ to 0:

[TABLE]

Impact of HC(k) on $\Delta R^{*}_{0,sat}(\delta)$

The second way credit can saturate at 0 happens if traffic from HC(k) is sent while the credit remains at 0. We denoted $\alpha_{h}(t)$ the aggregate traffic of HC(k), arriving at a rate of $r_{h}$ , with a burst $b_{h}$ , such as $\alpha_{h}(t)=r_{h}\cdot\delta+b_{h}$ .

As a result, the amount of MC(k) and HC(k) traffic sent while the credit is saturated is such as:

[TABLE]

∎

Lemma 3 (credit saturation at $L_{M}^{k}$ ).

We consider a shaped class $k$ , with the aggregate traffic of priority strictly higher than $p_{H}(k)$ $\alpha_{h}$ -constrained with $\alpha_{h}=r_{h}\cdot t+b_{h}$ .

$\forall\delta$ , the amount of traffic sent while the traffic is saturated at $L_{M}^{k}$ is such as:

[TABLE]

with:

[TABLE]

Proof.

First, we know that $\Delta R^{*}_{L_{M}^{k},sat}(\delta)\geqslant 0$ . Secondly for the upper bound, in the presence of MC(k) frames, the saturation of the credit at $L_{M}^{k}$ can only occur if an additional frame is sent while the credit is increasing and about to reach $L_{M}^{k}$ . Due to non-preemption, the frame finishes its transmission even though the class $k$ priority is now lower.

To be able to compute the largest impact of the non-preemption of class $k$ frames, we must find the highest number of non-preempted frames that can be sent during a time interval $\delta$ . So we must compute the smallest duration between two occurrences of the phenomenon. Fig. 36 illustrates the following explanation. After the first non-preempted class- $k$ frame has been sent, the priority of the class $k$ queue is low, so in presence of MC(k) traffic, no class $k$ traffic can be sent until a priority change: $L_{R}^{k}$ must be reached between two non-preempted class- $k$ frames.

Thus, we study the intervals of time between the start of two transmissions of non-preempted class- $k$ frames starting their transmission just before $L_{M}^{k}$ is reached. The smallest duration of such an interval is equal to the sum of:

the transmission time of the non-preempted class- $k$ frame (at the end of the transmission the credit is equal to $L_{M}^{k}$ ); 2. 2.

the duration $\frac{L_{M}^{k}-L_{R}^{k}}{I_{idle}^{k}}$ because MC(k) traffic has to be sent continuously in order for the credit to reach $L_{R}^{k}$ in the minimum duration ; 3. 3.

finally $\frac{L_{M}^{k}-L_{R}^{k}}{I_{send}^{k}}$ because class $k$ traffic has to be sent continuously in order for the credit to return in the minimum duration to $L_{M}^{k}$ .

In total, the minimum duration between the start of the transmission of two non-preempted class- $k$ frames (each starting just before $L_{M}^{k}$ is reached), is

[TABLE]

Thus during $\delta$ , the number of time a non-preempted class- $k$ frame can be sent is upper bounded by $\lceil\frac{\delta}{\Delta^{k,\gamma}_{inter}}\rceil$ .

As a result, the amount class $k$ traffic sent while the credit is saturated is such as:

[TABLE]

∎

B.2 Th.5.1: gCCbA strict minimum service curve

We search a strict minimum service curve offered to a class $k$ defined by a Rate-Latency curve, i.e., $\beta_{k}^{bls}(t)=\rho\cdot(t-\tau)^{+}$ with rate $\rho$ and initial latency $\tau$ .

The impact of other classes, are separated into three parts: the impact of $LC(k)$ , $MC(k)$ , $HC(k)$ .

According to the definition of the strict minimum service curve, $\forall$ backlogged period $\delta$ :

[TABLE]

For any duration lower than $\tau$ , the variation of the output is lower bounded by 0.

[TABLE]

Thus, the best $\tau$ for our strict service curve is the largest duration during which no class $k$ traffic can be sent. So, when considering the impacts of the different classes we have:

for traffic of Lower Classes $LC(k)$ , the impact is the one computed with Static Priority: it is due to the non-preemption and is taken into account in the Static Priority model; 2. 2.

for traffic of Medium Classes $MC(k)$ : the worst-case occurs if the credit starts at $L_{M}^{k}$ , MC(k) frames are transmitted until $L_{R}^{k}$ is reached and due to non-preemption an additional MC(f) frame is sent. We denote this duration $\Delta_{idle}^{k,\beta}$ . So, we have:

[TABLE] 3. 3.

for Higher Classes $HC(k)$ , the impact is already computed with Static Priority and is not taken into account here.

So finally, we have:

[TABLE]

Concerning the $\rho$ , we search for a strictly positive rate. We use the definition of $\beta_{k}^{bls}$ as a Rate-Latency strict service curve and Eq. (6) to deduce a property of $\rho$ . We notice the limit toward infinity of $\Delta R^{*}_{k}(\delta)$ over $\delta$ will be greater than $\rho$ :

[TABLE]

So we look for a $x>0$ fulfilling the following condition:

[TABLE]

We now use the continuity property of the BLS credit to determine $x$ . From Lemma 1, we know that:

[TABLE]

Thus:

[TABLE]

To find $x$ , we must find a lower bound of $\lim\limits_{\delta\rightarrow+\infty}\frac{\Delta R^{*}_{k}(\delta)}{\delta}$ , so we have:

[TABLE]

We need the lower bound of $\Delta R^{*}_{L_{M}^{k},sat}(\delta)$ , and the upper bound of $\Delta R^{*}_{0,sat}(\delta)$ . We use Lemmas 2 and 3 to compute the bounds. This gives:

[TABLE]

Thus, from Eq. (7), Eq. (8), and Eq. (9), we deduce:

[TABLE]

Finally, we have found a suitable $\rho$ such as: $\lim\limits_{\delta\rightarrow+\infty}\frac{\Delta R^{*}_{k}(\delta)}{\delta}\geqslant\rho$ with

[TABLE]

B.3 Th.5.2: gCCbA maximum service curve

We search a maximum service curve offered to a class $k$ defined by a leaky-bucket curve, i.e., $\gamma_{k}^{bls}(t)=r\cdot t+b$ with rate $r$ and burst $b$ .

From leboudecthiran12 , we know that $\Delta R^{*}_{k}(t-s)\leqslant B(s)+\gamma(t-s)$ , with $B(s)$ the backlog at s. We search for $z$ such as $\Delta R^{*}_{k}(t-s)\leqslant z$ . As $B(s)\geqslant 0$ , we obtain:

[TABLE]

Hence, with $\delta=t-s$ , we select $\gamma(\delta)=z$ , which gives:

[TABLE]

In the absence of other traffic, class $k$ can use the full capacity of the link, so $\Delta R^{*}_{k}(\delta)\leqslant C\cdot t$ . Thus, we deduce that:

[TABLE]

In a MC(k) backlogged period, we use the definition of $\gamma_{k}^{bls}$ as a leaky-bucket maximum service curve to deduce a property of $r$ using Eq. (10).

Computing $r$

We notice the limit toward infinity of $\Delta R^{*}_{k}$ over $\delta$ will be lower than $r$ :

[TABLE]

So we search for a strictly positive rate $x$ , equal or lower than the link output rate $C$ fulfilling the following condition:

[TABLE]

We use the continuity property of the BLS credit to determine $x$ . From Lemma 1, we know that:

[TABLE]

Thus,

[TABLE]

To find $x$ , we must find a lower bound of $\lim\limits_{\delta\rightarrow+\infty}\frac{\Delta R^{*}_{k}(\delta)}{\delta}$ , so we have:

[TABLE]

We need the lower bound of $\Delta R^{*}_{0,sat}(\delta)$ , and the upper bound of $\Delta R^{*}_{L_{M}^{k},sat}(\delta)$ . We use Lemmas 2 and 3 to compute the bounds. This gives:

[TABLE]

Thus, from Eq. (B.3), we deduce:

[TABLE]

We call $\Delta^{k,\gamma,send}_{inter}$ the interval during which class $k$ frames are sent, and $\Delta^{k,\gamma,idle}_{inter}$ the interval during which MC(k) frames are sent such as $\Delta^{k,\gamma}_{inter}=\Delta^{k,\gamma}_{send}+\Delta^{k,\gamma}_{idle}$ .

[TABLE]

Using the definitions of the different expressions, we deduce that:

[TABLE]

Finally, we have found a suitable $r$ , such as: $\lim\limits_{\delta\rightarrow+\infty}\frac{\Delta R^{*}_{k}(\delta)}{\delta}\leqslant r$ with $r=\frac{\Delta^{k,\gamma}_{send}}{\Delta^{k,\gamma}_{inter}}\cdot C$

Now that we have found $r$ , we need to find $b$ such as $\forall$ MC(k) backlogged period $\delta$ :

[TABLE]

Computing $b$

We use the largest class $k$ burst that can be sent with the BLS.

In the presence of MC(k) traffic, the largest period of time during which class $k$ traffic can be sent continuously occurs if the credit started at 0. Then, class $k$ traffic is sent continuously until $L_{M}^{k}$ is reached and the priority is changed to its low value $p_{L}$ . If a new class $k$ frame started its transmission just before the credit reached $L_{M}^{k}$ due to non-preemption, it will finish its transmission before the waiting MC(k) traffic can be sent. Thus, with a link capacity $C$ the largest class $k$ burst is $b^{max}_{k}=\frac{C}{I_{send}^{k}}\cdot L_{M}^{k}+MFS_{k}$ . This gives:

[TABLE]

So this gives: $\forall\delta\geqslant\frac{b^{max}_{k}}{C}$ , $\Delta R^{*}_{k}(\delta)\leqslant\frac{\Delta^{k,\gamma}_{send}}{\Delta^{k,\gamma}_{inter}}\cdot C\cdot\delta+b^{max}_{k}\cdot\frac{\Delta^{k,\gamma}_{idle}}{\Delta^{k,\gamma}_{inter}}$ .

Additionally, we have: $\forall\delta\leqslant\frac{b^{max}_{k}}{C}$ , $\Delta R^{*}_{k}(\delta)\leqslant C\cdot\delta\leqslant\frac{\Delta^{k,\gamma}_{send}}{\Delta^{k,\gamma}_{inter}}\cdot C\cdot\delta+b^{max}_{k}\cdot\frac{\Delta^{k,\gamma}_{idle}}{\Delta^{k,\gamma}_{inter}}$ .

So, we have proved that $\forall\delta\in\mathds{R}^{+}$ ,

[TABLE]

Bibliography22

The reference list from the paper itself. Each links out to its DOI / PubMed record.

1[1] Airlines Electronic Engineering Committee. Aircraft Data Network Part 7, Avionics Full Duplex Switched Ethernet (AFDX) Network, ARINC Specification 664. Aeronautical Radio, 2002.
2[2] Anne Bouillard, Laurent Jouhet, and Eric Thierry. Service curves in Network Calculus: dos and don’ts. Research report, INRIA, 2009.
3[3] Marc Boyer. Half-modeling of shaping in FIFO net with network calculus. In 18th International Conference on Real-Time and Network Systems , pages 59–68, Toulouse, France, November 2010.
4[4] Anaïs Finzi, Emmanuel Lochin, Ahlem Mifdaoui, and Fabrice Frances. Improving RFC 5865 Core Network Scheduling with a Burst Limiting Shaper. In IETF , 2017.
5[5] Anaïs Finzi, Ahlem Mifdaoui, Emmanuel Lochin, and Fabrice Frances. Mixed-Criticality on the AFDX Network: Challenges and Potential Solutions. In ERTS , 2017.
6[6] Anaïs Finzi, Ahlem Mifdaoui, Emmanuel Lochin, and Fabrice Frances. Incorporating TSN/BLS in AFDX for Mixed-Criticality Applications: Model and Timing Analysis. WFCS, 2018.
7[7] Anaïs Finzi, Ahlem Mifdaoui, Emmanuel Lochin, and Fabrice Frances. Network Calculus-based Timing Analysis of AFDX networks with Strict Priority and TSN/BLS Shapers. SIES, 2018.
8[8] Anaïs Finzi, Ahlem Mifdaoui, Emmanuel Lochin, and Fabrice Frances. Performance Enhancement of Extended AFDX via Bandwidth Reservation for TSN/BLS Shapers. RTN, 2018.

TL;DR

Contribution

Findings

Abstract

Peer Reviews

Videos

Taxonomy

Network Calculus-based Timing Analysis of AFDX networks incorporating multiple TSN/BLS traffic classes

Abstract

Contents

1 Introduction

2 Background and Related Work

2.1 Burst Limiting Shaper

2.2 Existing Worst-case Timing Analyses of TSN/BLS Shaper

3 Network Calculus framework

Definition 1** (Arrival Curve).**

Definition 2** (Strict minimum service curve).**

Definition 3** (Maximum service curve).**

Theorem 3.1.

Corollary 1**.**

Theorem 3.2 (Performance Bounds).

Corollary 2** (Maximum delay bound under a piecewise arrival curve and piecewise minimum service curve).**

Proof.

Theorem 3.3 (Concatenation-Pay Bursts Only Once).

4 System Model

4.1 Network model

4.2 Traffic Model

5 Worst-case Timing Analysis

5.1 Schedulability Conditions

5.2 BLS node model: generalized Continuous Credit-based Approach (gCCbA)

Theorem 5.1 (Strict Minimum Service Curve offered to a BLS class k by a BLS node).

Proof.

Corollary 3** (Strict Minimum Service Curve offered to SCT by a BLS node).**

Proof.

Theorem 5.2 (Maximum Service Curve offered to a BLS class k by a BLS node).

Proof.

Corollary 4** (Maximum Service Curve offered to SCT by a BLS node).**

Proof.

Corollary 5** (Maximum Output Arrival Curve of a BLS class).**

Proof.

5.3 Output port multiplexer service curves

Theorem 5.3 (Strict Minimum Service Curve offered by an output port multiplexer to a BLS class).

Proof.

Corollary 6** (Strict Minimum Service Curve offered by an output port multiplexer to SCT in the case of three traffic classes).**

Proof.

Theorem 5.4 (Strict Minimum Service Curve offered to a NBLS class by an output port multiplexer).

Proof.

Corollary 7** (Strict Minimum Service Curve offered to RC by an output port multiplexer in the case of three traffic classes).**

Proof.

5.4 Computing End-to-End Delay Bounds

5.5 Discussion: is the BLS really a shaper?

6 Performance Analysis

6.1 Use-case 1: sensitivity, tightness and comparison with CPA

6.2 Use-case 2: multiple BLS for 6 classes

6.3 Use-case 3: adding A350 Flight Control to the AFDX

7 Conclusion

Appendix A Computing Achievable Worst-Cases

A.1 SCT achievable worst-cases

A.1.1 Methodology

A.1.2 SCT Achievable Worst-Case 1

A.1.3 SCT Achievable Worst-Case 2

A.2 RC achievable worst-cases

A.2.1 Methodology

A.2.2 RC Achievable Worst-Case 1

A.2.3 RC Achievable Worst-Case 2

Appendix B Generalized Continuous-Credit-based Approach (gCCbA) model proofs

B.1 Continuous-credit Lemmas

Lemma 1 (Continuous credit bounds).

Proof.

Lemma 2 (credit saturation at [math]).

Proof.

Lemma 3 (credit saturation at LMkL_{M}^{k}LMk​).

Proof.

B.2 Th.5.1: gCCbA strict minimum service curve

B.3 Th.5.2: gCCbA maximum service curve

Definition 1 (Arrival Curve).

Definition 2 (Strict minimum service curve).

Definition 3 (Maximum service curve).

Corollary 1.

Corollary 2 (Maximum delay bound under a piecewise arrival curve and piecewise minimum service curve).

Corollary 3 (Strict Minimum Service Curve offered to SCT by a BLS node).

Corollary 4 (Maximum Service Curve offered to SCT by a BLS node).

Corollary 5 (Maximum Output Arrival Curve of a BLS class).

Corollary 6 (Strict Minimum Service Curve offered by an output port multiplexer to SCT in the case of three traffic classes).

Corollary 7 (Strict Minimum Service Curve offered to RC by an output port multiplexer in the case of three traffic classes).

Lemma 3 (credit saturation at $L_{M}^{k}$ ).