ait - deterministic ethernet network solution · maintenance and training costs considerably lower...

20
SAE AS6802 DETERMINISTIC ETHERNET NETWORK SOLUTION Ken Bisson Avionics Interface Technologies March 2011 This White Paper provides an overview and general assessment of the new SAE standard AS6802, also known as Deterministic Ethernet or Time- Triggered Ethernet.

Upload: phungcong

Post on 05-May-2018

228 views

Category:

Documents


1 download

TRANSCRIPT

SAE AS6802 DETERMINISTIC ETHERNET NETWORK SOLUTION

Ken Bisson Avionics Interface Technologies

March 2011 This White Paper provides an overview and general assessment of the new SAE standard AS6802, also known as Deterministic Ethernet or Time-Triggered Ethernet.

Avionics Interface Technologies AS6802 DETERMINISTIC ETHERNET NETWORK SOLUTION www.aviftech.com © AIT 2011

Page 2

ABSTRACT Ethernet has proliferated over the past 30 years and has become the universal network solution for web applications, office networking, production facilities, aerospace systems, and a virtually unlimited number of commercial applications. Because Ethernet offers higher bandwidths and increased capability, more applications are using it as the backbone network of choice. Widespread use make Ethernet’s implementation, maintenance and training costs considerably lower than those for many network systems. Ethernet’s current capability, however, does not lend itself well to tasks with time-critical, deterministic or safety-relevant conditions. A new SAE standard called AS6802, also known as Deterministic Ethernet or Time-triggered Ethernet, expands on classic IEEE 802.3 Ethernet and provides a foundation for powerful services to meet time-critical requirements.

AS6802 DETERMINISTIC ETHERNET NETWORK SOLUTION Avionics Interface Technologies © AIT 2011 www.aviftech.com Page 3

FROM LEGACY TO AS6802 TIME-TRIGGERED ETHERNET In order to ease avionics industry cohesion, proprietary specially-defined standardized technologies are developed and used to meet deterministic applications. For example, MIL-STD-1553 has been implemented in military avionics and weapons control applications. Likewise, CANbus and IEEE-1394 are intended to meet the requirements of control and manufacturing applications. In simulation applications, SCRAMnet and reflective memory busses are implemented. While these communication buses continue to be used in various applications, the use of Ethernet for real-time distributed application domains is still evolving. Standard, or legacy ethernet, lacks the capacity to integrate mixed-criticality systems or ensure synchronization. At least twenty different Ethernet enhancement approaches have been proposed or are now struggling for recognition. There include efforts to adapt Ethernet for special requirements, for example, LXI in measurement and test applications or ARINC 664 in the commercial aerospace industry. These specialty databuses cannot be easily integrated with standard Ethernet networks. Typically, gateway products are needed to map data from the proprietary bus to Ethernet devices and services. Likewise, the specially adapted Ethernet networks are also limited by a solution tailored for a specific application domain only. The AS6802 standard combines a proven deterministic, fault-tolerant and real-time technology with the flexibility, dynamics and legacy of “best effort” Ethernet and is therefore well suited for all types of applications and domains. AS6802 TIME-TRIGGERED ETHERNET DESIGN OBJECTIVES The AS6802 Standard sets four major design objectives: first, seamless communication of all applications, including deterministic applications; second, scalable expansion of all applications; third, support for mixed-criticality applications; and fourth, availability of software applications for network design and monitoring. Seamless communication of all applications, including deterministic applications, over Ethernet: Deterministic Ethernet is completely compatible with IEEE 802.3 Ethernet standards. This allows for easy integration with existing networks of conventional PCs, web and office devices, multimedia systems, real-time systems and safety-critical systems. Applications developed for traditional data transmission among different applications can share the same network with devices requiring safety-critical communication requirements. For example, a single backbone network solution can be used for all applications on an aircraft, ranging from the entertainment programs to power management, electronic navigation and guidance system, even internet access in passenger seats. Critical communications have a guaranteed fail-safe and redundancy enables further fault tolerance. In addition, network mechanisms include preventing potential hackers from unauthorized access to critical resources.

Avionics Interface Technologies AS6802 DETERMINISTIC ETHERNET NETWORK SOLUTION www.aviftech.com © AIT 2011

Page 4

Scalable expansion of all applications, including deterministic applications, over Ethernet: Networks that connect uncritical applications are now able to transmit real-time data in distributed controls suited for safety-critical applications. Existing applications do not have to be changed; only their message priority becomes elevated when a device’s functionality on the network is extended. Time-critical messages always take priority over less important messages, leaving standard Ethernet traffic and conventional applications unaffected. The temporal behavior of the time-critical messages is predictable (deterministic) and can be quantified on the Ethernet network.

Support for the mixed-criticality applications simultaneously occuring over Ethernet: Critical control systems, audio/video and standard LAN applications can safely coexist in one Deterministic Ethernet network. Time-Triggered Ethernet is used for safety-critical fail-operational applications. This means that the system remains fully functional even if a failure occurs – supporting single or double faults. Deterministic Ethernet uses redundant network paths and guardians to disconnect with faulty segments or ports. If a node, a switch or a network branch is faulty, the network continues with safe, reliable communication. The redundancy management defined in the AS6802 specification is a key difference between Time-Triggered Ethernet and other ‘safe’ Ethernet networks. For example, industrial applications network systems may detect faults in the network and switch the system to a safe state, but this stops the data flow. In order to secure the availability of the system even if a failure occurs, Time-Triggered Ethernet provides a variety of network services such as a clock synchronization service, a startup service and clique detection and recovery services. The behavior of Time-Triggered Ethernet is precisely predictable and thus formally verifiable.

Availability of software tools for network design and monitoring of Ethernet: Software tools for design, implementation and monitoring must cover the entire life cycle of the network. Automatic and manual modeling tools allow intuitive system design in terms of temporal behavior, network and topology. Software tools must be able to generate configuration data that comply with the communication schedule. Open XML data exchange formats allow the simple and seamless integration with third-party tools. DataLoader software, such as 615A Ethernet dataloaders, load the data into the systems on the network. Monitoring and Network Analysis software, such as Wireshark, display the network traffic on-line and off-line. Additionally, software is available for generating detailed reports for approving a system in compliance with application regulations.

AS6802 DETERMINISTIC ETHERNET NETWORK SOLUTION Avionics Interface Technologies © AIT 2011 www.aviftech.com Page 5

AS6802 TIME-TRIGGERED ETHERNET SYSTEM PROPERTIES SAE AS6802 describes a set of services to meet the requirements of reliable, real-time data delivery in advanced integrated systems. These synchronous services establish and maintain a global time, which is utilized by the close synchronization of local clocks of the devices attached to the network. The global time forms the basis for time-triggered network properties such as temporal partitioning, efficient resource utilization, parallel processing and precise diagnostics.

Figure 1: Clock Synchronization

Temporal Partitioning: The global time service can be used as a powerful isolation mechanism when devices become faulty; we say that the global time operates as a “temporal firewall.” In case of failure, the faulty application is blocked from the network. Depending on the location of the failure, either the communication controller itself or the switch will block faulty transmission attempts. Failures of the switch can be masked by powerful end-to-end arguments such as CRCs contained with the data frames. Efficient Resource Utilization: The global time contributes to efficient resource utilization in several ways. Time-Triggered communication allows minimizing the memory buffers in network devices as the Time-Triggered communication schedule is

TTE

1588

1588

Eth

TTE

TTE

TTE

Eth

TTE

TTE

TTE

TTE

TTE

TTE

TTE

Eth

All nodes are synchronized using a reliable global time base

Avionics Interface Technologies AS6802 DETERMINISTIC ETHERNET NETWORK SOLUTION www.aviftech.com © AIT 2011

Page 6

free of conflicts. Hence, switches do not have to be prepared for bursts of messages that must be delivered over the same physical link. A second way of effective resource utilization is buffer memory in the nodes, which can be minimized as the sensor values can be acquired according to the global time, immediately before sending the message. Parallel Processing: The global time allows the synchronization of network devices in the temporal domain. This means that during the network design process, the communication access pattern on the network can be defined. The network nodes can be coordinated in parallel activities. The network synchronization service guarantees that that the individual devices are stable and operate as a coordinated whole. Precise Diagnostics: A global time stamping service simplifies the process of reconstruction of a chain of distributed events. The synchronous capturing of sensor values on the network allows building snapshots of the state of the overall system and comparing them to the theoretical state to determine the status. SUPPORTED TOPOLOGIES AS6802 enables the synchronization of local clocks in a distributed computer network. This is particularly important for computer networks that must exchange real-time information in messages that are sent on communication links between devices. An AS6802 switched Ethernet supports end systems that are connected through network switches via bi-directional communication links. End systems are synchronized with a second end system or a group of end systems connected to the switch. Also, switches can be synchronized to each other with bi-directional communication links. In this case, the resulting architecture is referred to as a multi-hop architecture and the link between any two switches as the multi-hop link. The AS6802 standard supports single switch domains as well as multi-hop domains. AS6802 A TRANSPARENT SYNCHRONIZATION PROTOCOL AS6802 Time-Triggered Ethernet is a transparent synchronization protocol, it is able to coexist with other Ethernet traffic on the same physical communication backbone network. The standard defines basic time synchronization services that are transparently integrated with standard IEEE 802.3 Ethernet’s message-based communication infrastructures. These services are generally short Ethernet frames (64 bytes) and are indistinguishable from regular IEEE 802.3 Ethernet traffic. The AS6802 time synchronization services are defined in the Data Link layer of the OSI model and implemented above the MAC layer in the IEEE 802.3 Ethernet standard. The diagram below illustrates where the AS6802 time synchronization services reside in the OSI model and IEEE 802.3 standard.

AS6802 DETERMINISTIC ETHERNET NETWORK SOLUTION Avionics Interface Technologies © AIT 2011 www.aviftech.com Page 7

Figure 2: Time Synchronization Services AS6802 TIME-TRIGGERED ETHERNET DATAFLOW The AS6802 time-triggered services are easily integrated with IEEE 802.3 Ethernet. An AS6802 compliant communication controller that implements these services is able to synchronize with other AS6802 compliant communication controllers and switches in the network. In addition, the AS6802 compliant communication controller can also communicate with any standard IEEE 802.3 Ethernet controller that is not implementing time-triggered services. The AS6802 standard enables shared communication among real-time and safety-critical applications, event-driven applications and standard Ethernet communications over the same Ethernet backbone network. On the AS6802 network, three different traffic types of messages are defined:

• Deterministic Time-Triggered (TT) traffic, • Event-driven or rate-constrained (RC) traffic, and • Best-effort (BE) standard Ethernet traffic

The traffic type of the message is identified based on a message’s Ethernet MAC Destination address.

Physical Data Link Network

Transport Session

Presentation Application

ISO/OSI Layer

1

2

3

4

5

6

7

Physical Layer (IEEE 802.3 PHY) 10BaseT 100BaseTx 1000BaseCX

Media Access Control (IEEE 802.3 MAC)

Logical Link Control (IEEE 802.3 LLC)

Architecture, NM, Layers above (TCP,UDP,IP)

SAE AS6802

Avionics Interface Technologies AS6802 DETERMINISTIC ETHERNET NETWORK SOLUTION www.aviftech.com © AIT 2011

Page 8

Figure 3: Traffic Types Messages from higher layer protocols, like IP or UDP, can be “made” deterministic without modifications of the messages’ contents itself. The AS6802 protocol overhead is transmitted in dedicated messages called protocol control frames, which are used to establish system-wide clock synchronization. In short, AS6802 is only concerned with “when” a data message is sent, not with specific contents within in a message. The AS6802 compliant communication controller will send Time-Triggered (TT) messages at points in time derived from this system-wide synchronization. TT messages are used for deterministic applications. All TT messages are sent over the network at predefined times and take priority over all other traffic types. This means that with TT messages, transmit controllers send messages at precise times and receivers expect messages at precise times, all with sub-microsecond precision. More information on TT message schedules follow in the next section. Event-driven or Rate-Constrained (RC) messages are used for applications with less stringent determinism and real-time requirements than strictly TT applications. RC messages guarantee that bandwidth is predefined for each application, but delays and temporal deviations are allowed within defined limits. With RC messages, transmit controllers have guaranteed bandwidth on the network to send messages at specific periodic sub-microsecond precision times, while receivers have no expectations for time of reception. Unlike TT messages, RC messages are not sent with respect to a system-wide synchronized time base. Therefore, different communication controllers may send RC messages at the same point in time to the same receiver. As a result, the RC messages may queue up in the network switches, leading to increased transmission jitter. Because the transmission rate of the RC messages is periodic and policed by the network switches,

AS6802 DETERMINISTIC ETHERNET NETWORK SOLUTION Avionics Interface Technologies © AIT 2011 www.aviftech.com Page 9

an upper bound on the transmission jitter can be calculated off-line and message loss is prevented. Best-effort (BE) messages follow the classical Ethernet method for message transmission. There is no guarantee when messages can be transmitted, what delays occur, and if or when BE messages arrive at the receiver. BE messages use the open bandwidth of the AS6802 Ethernet network and have less priority than TT and RC messages. All legacy Ethernet traffic – internet protocols – without any Quality-of-Service (QoS) requirement can be mapped to this service class. AS6802 Time-Triggered Ethernet implements strong partitioning between non-critical BE traffic and the TT and RC service classes.

Figure 4:Message Cycles NETWORK STRUCTURE AS6802 networks supports all physical layers specified in IEEE 802.3 for switch-based networks. Even sub-networks with different bandwidths are supported. Switches in AS6802 networks have the central role of organizing the data communication. TT messages are routed in the switch according to a predefined schedule with as little delay as possible. Precise planning at the time of system design precludes resource conflicts at runtime. TT messages have the highest priority level. Once the planned transmission time of one of these messages arrives, the message is immediately transmitted. Due to the predefined transmission of the message the switch ensures that the link is free at the time of transmission and delays are precluded. RC messages are routed with little delay. If TT messages are to be transmitted via the same outgoing port at the same time, the TT messages take priority over the RC messages. TT messages can delay RC messages. RC messages are transmitted if no planned transmission of TT messages is pending and the sender observes the minimal transmission distance. The switch is responsible for arranging several RC messages at an outgoing port. Standard Ethernet or BE messages always have low priority. RC and TT messages can delay or discard BE messages at the same outgoing port. The switch uses any open

Avionics Interface Technologies AS6802 DETERMINISTIC ETHERNET NETWORK SOLUTION www.aviftech.com © AIT 2011

Page 10

bandwidth for BE messages if no TT or RC messages are to be transmitted. BE messages are transmitted after all pending RC messages. This method exploits the bandwidth of the network in an optimal way. Network verification tools are used to design a AS6802 network schedule in advance. This ensures that the bandwidth for TT, RC and BE messages is always sufficient according to the requirements of the application and interrupts are reduced to a minimum. Later incremental changes of the system configuration are possible. AS6802 network switches allow the simultaneous distribution of TT messages to groups of end systems or the connection of unsynchronized Ethernet networks. This is how AS6802 networks can be divided into smaller application-specific sub-networks and the design can be facilitated. TIME SYNCHRONIZATION SERVICE The AS6802 time synchronization services are standard Ethernet frames that perform the synchronization among the attached network nodes. These frames are called Protocol Control Frames (PCF). The group of network nodes that will be synchronized is called a Synchronization Domain (SD). Standard IEEE 802.3 Ethernet nodes cannot be a part of the synchronization domain since they cannot transmit the AS6802 PCF. They can communicate with other nodes in the synchronization domain, but will not be synchronized in time.

Figure 5: Synchronization Domain The AS6802 time synchronization service is periodic. All nodes in the synchronization domain are constantly re-synchronized at regular intervals. These intervals are called integration cycles, a typical integration cycle is 1 millisecond.

Sync Domain

AS6802 DETERMINISTIC ETHERNET NETWORK SOLUTION Avionics Interface Technologies © AIT 2011 www.aviftech.com Page 11

In each synchronization domain the AS6802 time synchronization services are performed by two types of nodes:

• Synchronization Master(s): one or more nodes on the network that are used to determine the baseline global clock, and

• Compression Master(s): one or more switches on the network that calculate the global time and transmit this time to all clients in the synchronization domain

Typically, synchronization masters are end systems in the network, and compression masters are switches. The AS6802 time synchronization services can be summarized as a two step process:

• Determine the baseline global time: Synchronization master(s) send frames at the beginning of every integration cycle that is received by compression master(s). The compression master(s) compare the timing associated with these incoming frames and establish the global time through a “voting” technique.

• Synchronize the global time with every node in the synchronization domain: The compression master(s) performs a precise calculation of the average incoming frames from the synchronization master(s) to derive the global time. The compression master(s) then sends out synchronization frames to all nodes in the synchronization domain. Upon reception of the synchronization frames, all clients compute the average global time received from compression master(s) and update their local clock accordingly. This results in every node maintaining a common global time.

Each node maintains its own local clock which is asynchronous to other nodes in the synchronization domain and every node’s clock drifts at different rates. The AS6802 time synchronization services guarantee that all nodes will be re-synchronized every integration cycle and that the global network time is assured. The diagram below illustrates the re-synchronization of disparate clocks every integration cycle.

Avionics Interface Technologies AS6802 DETERMINISTIC ETHERNET NETWORK SOLUTION www.aviftech.com © AIT 2011

Page 12

Figure 6: Clock Integration Cycles Events in AS6802 systems occur at predefined times with single microsecond precision. This includes the transmission of TT messages. The AS6802 network system design predetermines when the TT messages are transmitted by which participants and who shall receive them. This ensures that the network processes TT messages without collisions – that is, without data congestion in the switches – and the recipient can continuously check the quality of the deterministic system if, for example, a message fails to arrive at the predefined time or does not arrive at all. This makes AS6802 suited for applications of the highest safety integrity level. Synchrony among all participants is crucial for the transmission of TT messages. AS6802 networks always transmit clock synchronization messages to keep the clocks of the end systems and switches in unison. For this purpose AS6802 networks rely on a redundant hierarchical master-slave method that has a distributed fault-tolerant majority of master nodes and master switches to provide the time in the system. This guarantees both the fail-safe operation and high quality. An AS6802 network can be combined and synchronized with other network time mechanisms such an IEEE 1588, NTP, or GPS.

Integration cycle

AS6802 DETERMINISTIC ETHERNET NETWORK SOLUTION Avionics Interface Technologies © AIT 2011 www.aviftech.com Page 13

Figure 7: Integration of other Network Time Mechanisms

IEEE 1588 is another master/slave time synchronization protocol for Ethernet that can synchronize node clocks on the same synchronization domain to sub-microseconds granularity. While this sounds the same as the AS6802 network, the difference is the goal of each; for the IEEE 1588, the goal is to insure that a synchronized time stamp is associated with the receipt of every message by nodes on the synchronization domain. The AS6802 network’s goal is to insure that the transmission of TT messages occur at precise time for nodes on the synchronization domain. An IEEE 1588 network can work jointly with an AS6802 network. The global time base of IEEE 1588 can be used to synchronize to AS6802 network nodes. In this example, both network domains will be synchronized.

IEEE1588 on top of TTE - high-precision time base for

legacy boxes

TTE

TTE

TTE

Eth

TTE

1588

TTE

TTE

TTE

TTE + 1588

TTE

1588

Eth

GPS

Service Node Eth

Avionics Interface Technologies AS6802 DETERMINISTIC ETHERNET NETWORK SOLUTION www.aviftech.com © AIT 2011

Page 14

METHOD OF SYNCHRONIZATION AS6802 takes a two-step approach to synchronization. In the first step, synchronization masters send protocol control frames to the compression masters. The compression masters then calculate an averaging value from the relative arrival times of these protocol control frames and send out a new protocol control frame in a second step. This new protocol control frame is then sent to synchronization clients. Requirements on the system architecture control which devices are configured as synchronization masters, synchronization clients and compression masters. End systems can be configured as synchronization masters and switches as compression masters; but system configurations with end systems configured as compression masters and switches as synchronization masters are also possible. Switches and end systems not configured either as synchronization or compression masters will be configured as synchronization clients, as shown below in Figure 8.

Figure 8: Synchronization Methods

AS6802 DETERMINISTIC ETHERNET NETWORK SOLUTION Avionics Interface Technologies © AIT 2011 www.aviftech.com Page 15

SYNCHRONIZATION TOPOLOGY AS6802 distinguishes four different levels in synchronization topology.The lowest level is comprised of synchronization masters, synchronization clients and compression masters. Next, the cluster level groups devices with the same synchronization priority and the same synchronization domain to a single cluster. On the multi-cluster level, several clusters with different synchronization priorities but the same synchronization domain are grouped together. Finally, at the top, the network level groups different clusters – potentially multi-clusters – with different synchronization priorities and different synchronization domains.

Figure 9: Synchronization Topology AS6802 specifies the concept of a cluster: an AS6802 cluster is a group of end systems and switches that have the same synchronization priority and synchronization domain. Multi-clusters could be used in large AS6802 networks, where different clusters shall be able to run in isolation, but shall be able to operate in a master-slave mode, once a high priority cluster joins the network or is powered on. An AS6802 simple cluster consists of a set of end systems that are connected to each other through an optionally redundant set of communication channels, where each communication channel consists of one switch only. In an AS6802 cascaded cluster configuration, each communication channel consists of more than one switch. Different synchronization priorities are also specified with the AS6802 standard. Synchronization in a multi-cluster system is usually done according a master-slave paradigm, where the devices will synchronize towards the highest synchronization priority. AS6802 also specifies different synchronization domains. A synchronization domain is a group of AS6802 clusters that will not synchronize to each other, however,

Avionics Interface Technologies AS6802 DETERMINISTIC ETHERNET NETWORK SOLUTION www.aviftech.com © AIT 2011

Page 16

dataflow between two AS6802 clusters in different synchronization domains can be done using RC or BE traffic. VARIABLE IMPLEMENTATION An AS6802 network can be implemented in hardware or software, depending on such requirements as temporal quality, safety and fault-tolerance. An AS6802 system can always be connected to conventional Ethernet systems without affecting the predefined behavior, but there might be a lack of bandwidth for this additional system. Even standard PCs can participate in an AS6802 system. These scenarios are possible:

• A PC with a conventional Network Interface Card (NIC) can send and receive BE messages, equipped with dedicated software the PC can also receive and analyze TT and RC messages

• A PC with conventional NIC and an AS6802 stack is a software-based end system (SES) that allows the reception and transmission of TT, RC and BE messages, but the PC software is the limiting factor to the temporal precision

• A PC with a specific AS6802NIC can send and receive TT, RC and BE messages with the highest temporal precision

This broad implementation freedom is a result of the standard’s compatibility to the Ethernet standard, only Ethernet messages are used in AS6802. However, there is a natural trade-off between the implementation options and the temporal quality of AS6802. An AS6802 protocol stack that is implemented on a standard PC with standard NICs may, for example, achieve a precision in the hundred microseconds range, while a dedicated hardware implementation will come down to a one digit microsecond precision. Still, the lower temporal quality arising from standard Ethernet controllers is sufficient for a multitude of real-time control processes. In both cases, the deterministic properties of Time-Triggered systems can be maintained. SAFETY AND FAULT-TOLERANCE By design, the AS6802 standard guarantees a high level of safety. There are ingrained safeguards designed to detect failures and irregularities in the network and certain end systems. Of course, more stringent measures need to be taken to achieve the highest levels of safety, availability and fault tolerance. AS6802 networks can be set up with multiple redundant end systems, switches and physical segments. Thus the system will remain in operation even if faults occur. Redundant network paths are designed into AS6802 systems so that the failure of a single system or messages can be tolerated without affecting the network. If multiple redundancies are implemented, multiple faults can be tolerated. It is important that the

AS6802 DETERMINISTIC ETHERNET NETWORK SOLUTION Avionics Interface Technologies © AIT 2011 www.aviftech.com Page 17

entire system remains in operation without interrupts under the same temporal conditions as defined before. For additional fault-tolerance, guardian functions are integrated in AS6802 network switches and end systems. Guardians check if the communication on the network is working in compliance within the predefined parameters. If faulty systems block network segments, the guardian disconnects the network segment or port. Multiple redundant guardians can be implemented to meet the highest safety requirements, as shown in Figure 10 below.

Figure 10: Guardian Functionality

TT

TT

TT

RC ET

RC TT

TT RC

TT

TT ET

Tx R

TT

TT

TT RC ET

RC

TT

TT

RC

TT

TT ET

Tx R

TT

TT

TT

TT

TT

TT

TT

TxR

TT

TT

TT

RC ET RC

TT TT

RC

TT

TT ET

TxR

AS6802t ES1 AS6802 ES2

AS6802t ES3AS6802 ES4

AS6802 Switch

Avionics Interface Technologies AS6802 DETERMINISTIC ETHERNET NETWORK SOLUTION www.aviftech.com © AIT 2011

Page 18

FAULT-TOLERANT CAPABILITIES AS6802 networks include the following fault-tolerant capabilities:

• Redundancy: An AS6802 network can be configured to operate as a fully redundant, multi-domain application. This redundancy enables messages to be sent simultaneously over two separate physical networks. Upon receipt of duplicate messages, the receiver simply passes the first “good” message along to the application, while the duplicate message is thrown away. This method of reception is often referred to as “first valid frame wins.” The fully redundant AS6802 provides the highest degree of fault-tolerance for safety critical applications. Triple redundancy is also possible.

• Tolerance of arbitrary end system failures: The switches in AS6802 networks can be configured to execute a central bus guardian function. This function guarantees that even if a set of end systems becomes arbitrarily faulty, the system-wide impact of these faulty end systems is masked. The arbitrarily faulty failure mode also includes “babbling idiot” behavior and similar failure modes. AS6802 network switches establish fault containment boundaries.

• Tolerance of arbitrary transient disturbances, even in presence of permanent failures: In addition to fault tolerance, AS6802 networks also provides self-stabilization properties. For example, the synchronization will be re-established even after repeated failures in a multitude of devices in the distributed computer system. AS6802 networks stabilize from an arbitrary system state to a synchronized system state. This self-stabilizing property becomes more and more important with decreasing feature sizes of computer chips and, therefore, resulting increase in transient upsets. The design of future reliable distributed computer networks depends on an effective and sound tolerance of multiple transient upsets.

STANDARDIZATION ACTIVITIES At present, SAE AS-2D plans to formally recognize the AS6802 Standard, and to work closely with other standardization bodies in their respective industry – ISO, SAE J, IEEE and others – with target date in 2011. Initial supporters of SAE AS6802 standardization project include Lockheed Martin, Bombardier, Embraer, General Dynamics, Sikorsky Aircraft, Honeywell, BAE Systems, Ultra Electronics, GE Fanuc Intelligent Platforms, and TTTech. More information can be found on the SAE website: www.sae.org

AS6802 DETERMINISTIC ETHERNET NETWORK SOLUTION Avionics Interface Technologies © AIT 2011 www.aviftech.com Page 19

CONCLUSION

The AS6802 Standard enables deterministic communication over Ethernet networks in all application areas. AS6802 provides all necessary mechanisms for applications as diverse as classical web services to time-critical, safety-critical and security-critical networks. Existing networks can easily be upgraded to use AS6802-capable switches and end systems without the need to change existing applications and end systems. The AS6802 network has the ability to meet the needs of extremely demanding industries, particularly aerospace, industrial, simulation, automotive and energy.

AVIONICS INTERFACE TECHNOLOGIES Avionics Interface Technologies is a leading supplier of avionics bus modules, and a wide array of simulation and analyzer products. AIT offers AS6802-compliant end systems, switches, development systems and software tools. Our products feature both custom and commercial-off-the-shelf (COTS) user software and a flexible hardware architecture based on the use of FPGAs. AIT is headquartered in Omaha, NE, with design and production based in Dayton, Ohio, near Wright Patterson AFB, and two regional offices in the US. AIT is a private company led by a US-citizen based Board of Directors, allowing for execution of sensitive and/or classified ITAR program development.

Avionics Interface Technologies 3703 N. 200th Street Omaha, NE 68022 Tel: 402.763.9644 Fax: 402.763.9645 www.aviftech.com

Avionics Interface Technologies AS6802 DETERMINISTIC ETHERNET NETWORK SOLUTION www.aviftech.com © AIT 2011

Page 20

Addendum 1: List of Figures Figure 1: Clock Synchonization page 5 Figure 2: Time Synchronization Services page 7 Figure 3: Traffic Types page 8 Figure 4: Message Cycles page 9 Figure 5: Synchronization Domain page 10 Figure 6: Clock Integration Cycles page 12 Figure 7: Integration of other Network Time Mechanisms page 13 Figure 8: Synchronization Methods page 14 Figure 9: Synchronization Topolofy page 15 Figure 10: Guardian Functionality page 17