Formal Modeling and Analysis of the AFDX Frame Management Design

Abstract

The Avionics Full Duplex Switched Ethernet (AFDX) has been developed to provide reliable data exchange with strong data transmission time guarantees in internal communication of the aircraft. The AFDX design is based on the principle of a switched network with physically redundant links to support availability and be tolerant to transmission and link failures in the network.In this work, we develop a formal model of the AFDX frame management to ascertain the reliability properties of the design. To capture the precise temporal semantics, we model the system as a network of timed automata and use UPPAAL to model-check for the desired properties expressed in CTL. Our analysis indicates that the design of the AFDX frame management is vulnerable to faults such as network babbling which can trigger unwarranted system resets. We show that these problems can be alleviated by modifying the original design to include a priority queue at the receiver for storing the frames. We also suggest communicating redundant copies of the reset message to achieve tolerance to network babbling. Comments Copyright 2006 IEEE. Reprinted from the 9th IEEE International Symposium on Object-oriented Real-time Distributed Computing (ISORC 2006), pages: 393-399This material is posted here with permission of the IEEE. Such permission of the IEEE does not in any way imply IEEE endorsement of any of the University of Pennsylvania's products or services. Internal or personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution must be obtained from the IEEE by writing to pubs-permissions@ieee.org. By choosing to view this document, you agree to all provisions of the copyright laws protecting it.

Reliability Enhancement of Redundancy Management in AFDX Networks

“…3. Furthermore, traffic policing is applied in switches to protect the network from babbling-idiot failures [13]. In addition, the technology latency in a switch, which is the time required to process frames that should be less than 100 µs irrespective of traffic load [9].…”

“…In [36], mixed-criticality traffic scheduling was investigated to enhance resource efficiency. In [13], the frame management in AFDX networks is analyzed and a modified design with a priority queue is proposed. Although it can offer a better data integrity and a higher QoS, the improvement is achieved at the expense of higher latencies.…”

Deterministic end-to-end delay analysis in an avionics network

“…a frame at a time, and all on-time arrivals are being received in the sequence order. Due to the fact that this phenomenon has not been taken into account in the FIFO scheduling calculation, equation (18) brings counteractive effects to the delay estimation. In order to optimize the delay calculation and obtain a better result, the potential side effects from sharing in a single physical link among multiple virtual links should be eliminated in the FIFO scheduling calculation.…”

“…16,17 The model checking approach can help you better understand the network behavior, but it cannot be applied to a realistic network configuration due to combinatorial explosion. 18,19 Owing to clear model and less complexity, the network calculus theory has become widely used in recent years to analyze and evaluate the real-time performance for communication networks, especially in the worst-case delay analysis. [20][21][22][23] Georges et al 24,25 propose a general representation to model a switched Ethernet network using buffers, multiplexers, and other elementary components, and then apply network calculus to calculate the maximum end-to-end delay in the industrial communication scenarios.…”

Runtime Verification

“…Recall that the outcome for each of the B i , denoted b i , is 1 if the simulation satisfies φ and 0 otherwise. Let p ′ = ( m i=1 b i )/m, then Chernoff-Hoeffding bound [13] gives P r(|p ′ − p| > δ) < 2e − mδ 2 4 . As a consequence, if we take m≥ 4…”