Mixed-Criticality Systems Based on Time- Triggered Ethernet with Multiple Ring Topologies. University of Siegen Mohammed Abuteir, Roman Obermaisser

Transcription

1 Mixed-Criticality s Based on Time- Triggered Ethernet with Multiple Ring Topologies University of Siegen Mohammed Abuteir, Roman Obermaisser

2 Mixed-Criticality s Need for mixed-criticality systems due to pressing requirement to reduce the number of nodes and cables Integration of functions with different importance and certification assurance levels on a shared computing platform Validation of each subsystem to the respective criticality and modular certification 2

3 Requirements for the Communication Network of Mixed-Criticality s Timing Requirements Fault-tolerant global time with high precision Bounded latency and low jitter Encapsulation and Fault Containment Absence of interference and unintended side-effects due to integration Fault containment using time and space partitioning Foundation for modular certification Heterogeneity of Mixed-Criticality s Multiple assurance levels (e.g.,sil1-4 in IEC61508,Class A-E in DO178B) Different reliability and fault-tolerance requirements Different timing models (e.g., periodic, sporadic and aperiodic activities) 3

4 Real-Time Ethernet in Mixed-Criticality s Avionics Full-Duplex Switched Ethernet (AFDX) Rate-constrained virtual links and priorities Bounded timing effects between virtual links Time-Triggered Ethernet (TTE) Time-triggered communication according to a static TDMA scheme Contention with rateconstrained and best-effort communication resolved using timely blocking, shuffling or preemption 4

5 Fault Assumptions systems, switches and physical links regarded as Fault Containment Regions (FCR) Failure modes based on IEC Component crash Link failures Omission Corruption Delay Babbling idiot Masquerading Single failure of an end system or detectably faulty behavior of switch 5

6 Model of Ring-Based Real-Time Ethernet Architecture Non-redundant and redundant end-systems Connection of end systems to switches in star topology Interconnection of switches in ring topology Interconnection of rings using peripheral switches Switch Switch Switch Switch Switch Switch Peripheral Switch 1 Peripheral Switch 2 Switch Switch

7 s Safety-critical end system RC and TT messages on double channels BE can exploit two channels for higher bandwidth Connection to two switches Non safety-critical end system Non redundant channel to one switch Support for replication of messages at first switch 7

8 Conceptual Switch Model Bridge forwards messages between ingress and egress queues Schedule for timetriggered messages Bandwidth Allocation Gap (BAG) and jitter for each virtual link MAC layer and physical layer based on and

9 Redundancy Management Hides the path and latency of the redundant messages Establishment of redundancy Outgoing time-triggered and rate-constrained messages from non safety-critical end systems First switch that meets rate-constrained or timetriggered traffic creates copies of an incoming message Transmission using redundant paths of the ring Fusion of redundant messages Last switch of a message s path to a non safety-critical end-system Safety-critical end-systems fuse internally 9

10 Redundancy Management (RM) Layer Time-triggered Messages RM layer interfaces with the time-triggered scheduling layer to hide the redundant paths and to perform the deduplication of time-triggered messages RM layer checks the corresponding virtual-link buffer before the sending time and takes the decision to send on of the redundant time-triggered messages accordingly Establishment of deterministic timing (e.g., no effect on timing due to an omission failure on a redundant channel) Rate-constrained messages Sequence number first valid wins policy TT Message VL1 Redundancy Management Decision Redundant TT Message VL1 10

11 Error Detection and Containment Error detection by MAC layer (e.g., CRC) Time-triggered traffic Reception from correct ingress port Specified receiving window Protection of receiving end systems and channels (e.g., babbling idiot, masquerading) Dedicated guaranteed buffer capacity for different virtual links (and different criticalities) Rate constrained traffic Violation of BAG Dedicated guaranteed buffer capacity Best effort Error detection and containment based on standard Ethernet Spanning Tree Protocol 11

12 Fork layer maps messages to applications Time-triggered clock layer transmits messages according to the schedule Rate-constrained shaper enforces BAG at end system TTE controller layer sends messages according to their priority Application #1 BE Priorty TTE controller MAC Layer Physical Layer Application layer Application #2 Application #n Fork Layer RC Shaper MAC interface TT clock MAC Layer Physical Layer 12

13 Evaluation based on Simulation TTEthernet simulation environment based on OPNET Simulation building blocks for switches and end systems Simulation of MAC and physical layer from previous work ES_ 1 ES_ 2 SW_1 Link #2 SW_2 Link #6 ES_ 7 Link #3 Link #5 ES_ 3 SW_4 Link #4 SW_3 ES_ 6 ES_ 4 ES_ 5 13

14 Example Scenario ES_ 1 ES_ 2 SW_1 Link #2 SW_2 Link #6 ES_ 7 Link #3 Link #5 ES_ 3 SW_4 Link #4 SW_3 ES_ 6 ES_ 4 14 ES_ 5

15 Example ES_ 1 ES_ 2 SW_1 Link #2 SW_2 Link #6 ES_ 7 Link #3 Link #5 ES_ 3 SW_4 Link #4 SW_3 ES_ 6 ES_ 4 15 ES_ 5

16 Results (1) ID Application Type App.1 App.4 App.7 App.2 App.7 App.1 App.2 App.4 App.5 App.3 App.5 App.2 App.6 App.3 App.6 Babbling Idiot Omission Fault Free Case Sender Failure (ES3) Failure (SW3) Latency Jitter Latency Jitter Latency Jitter ES 1 0,10 0,00 0,10 0,00 0,10 0,00 ES 1 1,02 0,00 1,02 0,00 1,02 0,00 ES 2 93,97 93,95 97,91 97,89 122,02 122,00 ES 3 134,05 126,00 Fault Injection 146,07 146,02 ES 3 155,19 155,14 Fault Injection 177,25 177,22 ES 4 0,09 0,00 0,09 0,00 0,09 0,00 ES 4 138,79 138,76 158,05 158,02 139,75 139,05 ES 4 2,03 0,00 2,03 0,00 2,03 0,00 ES 4 70,09 68,27 70,09 68,27 97,66 97,64 ES 5 5,07 0,00 5,07 0,00 5,07 0,00 ES 5 61,65 61,64 61,68 61,67 88,26 88,17 ES 6 132,10 132,05 138,81 138,76 100,16 100,13 ES 6 92,00 91,97 100,06 98,86 102,11 102,09 ES 7 0,01 0,00 0,01 0,00 0,01 0,00 ES 7 98,06 78,73 98,14 98,13 112,26 112,25 16

17 Results (2) ID Application Type App.1 App.4 App.7 App.2 App.7 App.1 App.2 App.4 App.5 App.3 App.5 App.2 App.6 App.3 App.6 Omission Link Delay Sender Failure (L2) Failure (L3) Failure (ES5) Latency Jitter Latency Jitter Latency Jitter ES 1 0,10 0,00 0,10 0,00 0,10 0,00 ES 1 1,02 0,00 1,02 0,00 1,02 0,00 ES 2 119,91 119,89 90,01 89,99 93,97 93,95 ES 3 110,30 110,23 76,05 75,99 132,05 124,00 ES 3 151,39 151,37 151,16 151,14 155,19 155,14 ES 4 0,09 0,00 0,09 0,00 0,09 0,00 ES 4 138,79 138,76 142,19 141,85 166,07 166,03 ES 4 2,03 0,00 2,03 0,00 2,03 0,00 ES 4 70,09 68,27 71,05 69,04 70,08 68,26 ES 5 5,07 0,00 5,07 0,00 5,07 0,00 ES 5 57,89 57,88 65,68 65,67 161,65 161,64 ES 6 134,05 126,04 137,20 157,18 132,10 132,05 ES 6 92,00 91,97 96,00 95,98 100,05 100,02 ES 7 0,01 0,00 0,01 0,00 0,01 0,00 ES 7 97,09 88,38 78,09 78,03 98,06 78,73 17

18 Discussion Selective Fault-Tolerance Balanced tradeoff between cost and faulttolerance Fault-tolerance can be adjusted at the level of end systems and individual messages Redundant end-systems with duplicate messages Redundant end-systems with single messages Non redundant end-systems with duplicate messages Non redundant end-systems with single messages 18

19 Discussion Ring Topology Network topologies in the state-of-the-art differ w.r.t. performance metrics such as throughput, maximum channel load, latency and fault-tolerance Backbone: limited scalability and common failure modes Complete graph: prohibitive cost and limited scalability -dimensional mesh with degree of, edge connectivity of, diameter of, and bisection bandwidth of Ring with switches is ideal for single fault hypothesis offering a diameter of, edge connectivity of 2 and bisection bandwidth of 2 19

20 Discussion Ring Topology Network topologies in the state-of-the-art differ w.r.t. performance metrics such as throughput, maximum channel load, latency and fault-tolerance Backbone: limited scalability and common failure modes Complete graph: prohibitive cost and limited scalability Ring with switches is ideal for single fault hypothesis offering a diameter of and edge connectivity of 2 20

21 Conclusion Increasing importance of mixed-criticality systems Heterogeneous requirements concerning timing models, reliability and fault-tolerance Temporal and spatial partitioning is the foundation for mixed-criticality integration and modular certification Ring-based real-time Ethernet network with selective fault-tolerance and balanced tradeoff between cost and reliability 21