Integrating end-system frame scheduling for more accurate AFDX timing analysis

Avionics systems distributed on AFDX networks are subject to stringe nt real-time constraints that require guaranteeing the Worst-Case Traversal Time (WCTT) on the network for each of the data flows. Over the last 10 years, since the initial use of Network Calculus in certification, important progresses have been made in AFDX timing verification. The maximum pessimism for the latencies is now known to range from 10 to 25% on realistic systems. Further progresses towards more accurate timing analysis can still be made by considering additional temporal information. In this paper, we show that integrating the knowledge of the scheduling of the frames that is done within an end-system in the timing analysis enables to dramatically reduce the WCTT bounds computed by Network Calculus. Indeed, in our experiments performed on a realistic configuration provided by Thales Avionics, this technique reduces the WCTT upper bound by 40% on average over all flows. The reason is that the scheduling of the frames shapes the outgoing traffic, reducing thus peaks of load on the outgoing traffic , which can be accounted for in the timing analysis. Importantly, because the scheduling of the frames within the endsystems is in the scope of the network supplier, unlike the scheduling of tasks done at the application level, the approach presented here does not imply major changes in the design process. 1 I n t rodu c t i on 1.1 Context of the study Avionics Full DupleX (AFDX see[8]) is an aeronautic-specific switched Ethernet technology that supports data exchanges among avionics sub-systems with bounded latencies, without requiring the sub-systems to share a common global clock like in TDMA networks. In AFDX, virtual links (VLs) define the unicast and multicast connections there exist between end-systems. The predictable latencies of AFDX can be achieved because the standard enforces appropriate switching mechanisms within the communication switches and because the workload submitted to the network by each sub-system is upper bounded and known in advance. Indeed, to each VL is associated a maximum frame size and a minimum time between the transmission of two successive frames of the same VL. This latter quantity is called the Bandwidth Allocation Gap (BAG) and has to take a value that is a power of two in the range 1 to 128ms. With the increasing amount of critical data exchanged with real -time constraints in on-board aerospace systems, the computation of accurate upper bounds on network traversal times is an industrial requirement. Indeed, it is needed in the certification process to convince the certification authorities that the real -time and safety constraints are met and this should be achieved without over-provisioning the hardware resources. If, for realistic AFDX networks, it is in practice not possible to compute the exact Worst-Case Traversal Time (WCTT), conservative upper bounds on the WCTT can be computed in reasonable