wilamowski-b-m-irwin-j-d-industrial-communication-systems-2011

Embedded Networks in Civilian Aircraft Avionics Systems 24-13
The impact of this redundancy mechanism on guaranteed latencies is limited. Of course, average
latency for a single frame improves since Latency = Min (Latency red , Latency blue ), but as we deal with
latency bounds and since latency bounds which are mostly the same on both the red and blue networks,
the final latency bound is unaffected by the redundant network.
24.7 aFDX End-to-End Delay Analysis
As presented before, the main problem is to guarantee that frames exchanged between end systems satisfy
the temporal constraints of transported data. Therefore, the end-to-end delay of each path of each
VL has to be studied. The end-to-end delay of each path of VL includes the following characteristics:
• The lower bound for the end-to-end delay corresponds to the case where there is no waiting service
time for the frame in queues. This can be easily computed by adding transmission times over
the physical links and switching delays.
• The upper bound for the end-to-end delay corresponds to the longest aggregate waiting service
time for the frame in queues. This upper bound is mandatory in avionics context for certification
reasons.
Different approaches have been proposed in order to analyze networks flow’s end-to-end delay and
jitter [ACOR99,C98,CSC01,CSEF06,IETF89,IETF98,JNTW02,SCP95,TC94].
Deterministic network calculus (or worst-case network calculus) has been used, for certification reasons,
to compute AFDX upper bounds [C91,C95]. Network calculus theory uses envelopes of arrival
curves and computes a worst-case scenario on each node visited by a flow, taking into account maximum
possible jitter introduced by previously visited nodes [LB98,LBT01]. This approach is obviously
pessimistic as it can lead to impossible scenarios, but it has been useful to prove the determinism of
an AFDX network as it computes a guaranteed upper bound of end-to-end transmission delay for each
VL on the network. This worst-case communication delay analysis also gives intermediate information
on latency time in switch output ports, which permits the scaling of the switch memory buffers and
avoiding buffer overflows (i.e., frame loss). Moreover, such an approach has been used for the optimization
of a given AFDX configuration [FFG06]. In conclusion, a certifiable network (with no switch buffer
overflow and bounded latency configuration) often underuses AFDX network capabilities.
Nevertheless, the pessimism of the network calculus approach cannot be evaluated by simply comparing
the end-to-end delay measured on a real AFDX configuration with the computed upper bound
because of the fact that rare events are difficult to observe on a real configuration in a reasonable time.
In order to better understand the real behavior of an AFDX network, a simulation approach has also
been proposed. A distribution of observed end-to-end delay on a simulated AFDX network can thereby
be obtained for each flow [CSF06]. Stochastic network calculus as proposed in [H63,VB01,VB02] might
also help to obtain a probabilistic end-to-end delay analysis [SRF09].
The model-checking approach might help to determine an exact worst-case end-to-end delay and the
corresponding scenario since it explores all possible states of the network. Yet up to now model checking
has not been able to be used on a real-size industrial network configuration [CSEF06]. In order to
better evaluate the pessimism of the end-to-end delay upper bound obtained by deterministic network
calculus, the recent trajectory approach seems to be a promising method [MM06]. This approach is
based on the analysis of the worst-case scenario experienced by a packet on its trajectory and not on any
visited node.
24.8 Conclusion
The traditional mono-emitter ARINC 429 data bus has played a major role in the architecture of classic
civilian avionics, but it can no longer cope with the communication needs of new avionics architectures
based on IMA. A first solution was to use a multiplexed data bus such as the ARINC 629 data bus,
© 2011 by Taylor and Francis Group, LLC