TTEthernet
The Time-Triggered Ethernet standard defines a fault-tolerant synchronization strategy for building and maintaining synchronized time in Ethernet networks, and outlines mechanisms required for synchronous time-triggered packet switching for critical integrated applications, IMA and integrated modular architectures. SAE International has released SAE in November 2011.
Time-Triggered Ethernet network devices are Ethernet devices which at least implement:
- SAE AS6802 synchronization services for advanced integrated architectures, fail-operational and safety-critical systems
- time-triggered traffic flow control with traffic scheduling
- per-flow policing of packet timing for time-triggered traffic
- robust internal architecture with traffic partitioning
In addition, such network devices implement other deterministic traffic classes to enable mixed-criticality Ethernet networking. Therefore, TTEthernet networks are designed to host different Ethernet traffic classes without interference.
TTEthernet device implementation expands standard Ethernet with services to meet time-critical, deterministic or safety-relevant requirements in double- and triple-redundant configurations for advanced integrated systems. TTEthernet switching devices are used for integrated systems and safety-related applications primarily in the aerospace, industrial controls and automotive applications.
TTEthernet has been selected by NASA and ESA as the technology for communications between the Orion MPCV and the European Service Module, and is described by the ESA as being "prime choice for future launchers allowing them to deploy distributed modular avionics concepts".
Description
TTEthernet network devices implement OSI Layer 2 services, and therefore it claims to be compatible with IEEE 802.3 standards and coexist with other Ethernet networks and services or traffic classes, such as IEEE 802.1Q, on the same device.Three traffic classes and message types are provided in current TTEthernet switch implementations:
- Synchronization Traffic : Time-Triggered Ethernet network uses protocol control frames to establish and maintain synchronization. The PCFs traffic has the highest priority and it is similar to rate-constrained traffic. PCF traffic establishes a well-defined interface for fault-tolerant clock synchronization algorithms.
- Time-triggered traffic: Ethernet packets are sent over the network at predefined times and take precedence over all other traffic types. The occurrence, temporal delay and precision of time-triggered messages are predefined and guaranteed. Also, "synchronized local clocks are the fundamental prerequisite for time-triggered communication".
- Rate-constrained traffic: Ethernet packets are configured so that they can keep maximum latency and jitter in a closed systems. They used for applications with less stringent determinism and real-time requirements. This traffic class guarantees that bandwidth is predefined for each application and delays and temporal deviations have defined upper bounds.
- Best-effort traffic : Packets are sent via FIFO queues to egress ports. There is no absolute guarantee whether and when these messages can be transmitted, what delays occur and if messages arrive at the recipient. Best-effort messages use the remaining bandwidth of the network and have lower priority than the other two types.
Fault-tolerance
TTEthernet integrates a model of fault-tolerance and failure management. TTEthernet switch can implement a reliable redundancy management and dataflow integration to assure message transmission even in case of a switch failure. The SAE AS6802 implemented on an Ethernet switch supports the design of synchronous system architectures with defined fault-hypothesis.The single-failure hypothesis, dual-failure hypothesis, and tolerance against arbitrary synchronization disturbances define the basic fault-tolerance concept in a Time-Triggered Ethernet network.
Under the single-failure hypothesis, Time-Triggered Ethernet is intended to tolerate either the fail-arbitrary failure of an end system or the fail-inconsistent-omission failure of a switch. The switches in Time-Triggered Ethernet network can be configured to execute a central bus guardian function. The central bus guardian function ensures that even if a set of end systems becomes arbitrarily faulty, it masks the system-wide impact of these faulty end systems by transforming the fail-arbitrary failure mode into an inconsistent-omission failure mode. The arbitrarily faulty failure mode also includes so called "babbling-idiot" behavior. Time-Triggered Ethernet switches therefore establish fault-containment boundaries.
Under the dual-failure hypothesis, Time-Triggered Ethernet networks are intended to tolerate two fail-inconsistent-omission faulty devices. These devices may be two end systems, two switches, or an end system and a switch. The last failure scenario means that Time-Triggered Ethernet network tolerates an inconsistent communication path between end systems. This failure mode is one of the most difficult to overcome.
Time-Triggered Ethernet networks are intended to tolerate transient synchronization disturbances, even in the presence of permanent failures. Under both single- and dual-failure hypothesis, Time-Triggered Ethernet provides self-stabilization properties. Self-stabilization means that synchronization can reestablish itself, even after a transient upset in a multitude of devices in the distributed computer network.
Performance
Time-Triggered Traffic
Time-triggered traffic is scheduled periodically, and depending on the architecture, line speed, topology and computing model with control loops operating at 0.1-5 kHz, using a time-triggered architecture model of computation and communication. Hard real-time is possible at application level due to strict determinism, jitter control and alignment/synchronization between tasks and scheduled network messaging.In L-TTA architectures with synchronous TTEthernet network, but with local computer clocks decoupled from system/network time the performance of control loops may be limited. In this case, time-triggered transmissions are necessarily cyclically scheduled and thus delays between processes in the application layer can be large, e.g. with plesiochronous processes operating on their own local clock and execution cycle, as is observed in systems using cyclic MIL-STD-1553B buses, up to twice the transmission interval due to released packets waiting for scheduled transmission at the source and for the receiving process to run at the destination.
Rate-Constrained Traffic
Rate constrained traffic is another periodic time-sensitive traffic class, and it shall be modeled to align with time-triggered traffic in order to fulfill maximum latency and jitter requirements. However, even where the sum of the allocated bandwidths is less than the capacity provided at every point in the network, delivery is still not guaranteed due, e.g., to potential buffer overflows at switch queues, etc., which simple limitation of bandwidths does not guarantee are avoided.Best Effort Traffic
Best effort traffic will utilize network bandwitdth not used by rate-constrained and time-triggered traffic.In TTEthernet devices, this traffic class cannot interfere with deterministic traffic, as it resides in its own separate buffer memory. Moreover, it implements internal architecture which isolates best effort traffic on partitioned ports, from the traffic assigned to other ports. This mechanism can be associated with fine-grained IP traffic policing, to enable traffic control which is much more robust than VLANs with FIFO buffering.
History
In 2008, it was announced Honeywell would apply the technology to applications in the aerospace and automation industry.In 2010 a switch-based implementation was shown to perform better than shared bus systems such as FlexRay for use in automobiles. Since then, Time-Triggered Ethernet has been implemented in different industrial, space and automotive programs and components.