System security requires a solid foundation in both development and operation. During development, performance trade-offs result in security infrastructures that are more or less effective, but usually imperfect. Hence, during operation, runtime monitoring and anomaly detection continuously check for security issues.In this paper, we show how development and operation can be linked. We demonstrate how information and data from development and operation can be aggregated in a digital twin and/or digital thread which is used as the basis for runtime monitoring and anomaly detection. In particular, we address the trade-off between system security and performance in a concrete smart grid system.

Time-sensitive networks are designed to meet stringent Quality of Service (QoS) requirements for mixed-criticality traffic with diverse performance demands. Ensuring deterministic guarantees for such traffic while reducing deployment costs remains a significant challenge. This paper proposes a cost-efficient partial deployment strategy for Time Sensitive Networking (TSN) devices within legacy Ethernet network. At the core of our approach is the CreditBased Shaper (CBS), a key TSN scheduling mechanism. Unlike cost-prohibitive full CBS deployment, our approach selectively integrates CBS where it is most needed to enhance performance while reducing costs. Combining Network Calculus for schedulability verification and a heuristic optimization method for CBS configuration and placement, our proposal minimizes deployment costs while improving schedulability for medium-priority traffic and mitigating blocking delays for high-priority traffic. The feasibility and benefits of our approach are validated on a realistic automotive TSN use case with up to 70 % of reduction in TSN devices requirements compared to a full deployment.

The Credit-Based Shaper (CBS) enforces bandwidth control of high-priority traffic, thereby improving fairness by reducing delays for medium and low priorities. However, CBS can introduce latency for high priorities, especially when multiple crossed CBS are involved. To address this challenge in time-sensitive networks, we introduce a partial CBS deployment approach, wherein CBS is implemented only in selected nodes in the network. This approach aims to minimize as much as possible latency degradation for high priorities, while guaranteeing deadlines for medium and low priority flows. Additionally, this approach offers cost, complexity and legacy interoperability advantages over the full deployment of CBS. Through a motivational example, we highlight the need for an adequate approach to select the placement and configuration of CBS. Finally, we discuss the problem formulation as an optimization problem, and provide insights for appropriate solution methods.

Packet replication and elimination functions are used by time-sensitive networks (as in the context of IEEE TSN and IETF DetNet) to increase the reliability of the network. Packets are replicated onto redundant paths by a replication function. Later the paths merge again and an elimination function removes the duplicates. This redundancy scheme has an effect on the timing behavior of time-sensitive networks and many challenges arise from conducting timing analyses. The replication can induce a burstiness increase along the paths of replicates, as well as packet mis-ordering that could increase the delays in the crossed bridges or routers. The induced packet mis-ordering could also negatively affect the interactions between the redundancy and scheduling mechanisms such as traffic regulators (as with per-flow regulators and interleaved regulators, implemented by TSN asynchronous traffic shaping). Using the network calculus framework, we provide a method of worst-case timing analysis for time-sensitive networks that implement redundancy mechanisms in the general use case, i.e., at end-devices and/or intermediate nodes. We first provide a network calculus toolbox for bounding the burstiness increase and the amount of reordering caused by the elimination function of duplicate packets. We then analyze the interactions with traffic regulators and show that their shaping-for-free property does not hold when placed after a packet elimination function. We provide a bound for the delay penalty when using per-flow regulators and prove that the penalty is not bounded with interleaved regulators. Finally, we use an industrial use-case to show the applicability and the benefits of our findings.

Time-Sensitive Networking (TSN) describes a set of features extending the functionalities and Quality of Service (QoS) of standard Ethernet to enable determinism, reliability and reconfigurability, key requirements for Industry 4.0. The TSN profile for industrial automation (IEC/IEEE 60802 standard) defines specific options to favor reliability and reconfigurability. Nevertheless, there are multiple possible options for scheduling to guarantee determinism. Today, the scheduling standards in TSN can be categorized according to the implemented communication paradigm: asynchronous or synchronous. This paradigm is of utmost importance to quantify the synchronization need and the reconfigurability effort. The main contribution of this work is the specification of an asynchronous TSN-compliant network for Industry 4.0, FactoRing, that bridges the gap between both paradigms to guarantee low bounded jitters and latencies, without the need of synchronization and complex network planning. Moreover, FactoRing supports ring-based topologies to significantly reduce installation wiring and costs. In this paper, we first present the main industry 4.0 requirements and assess the ability of recommended TSN mechanisms for industrial automation versus such requirements. Afterwards, we detail the main features of Factoring including QoS, reliability and reconfiguration management. Finally, preliminary results on performance metrics like jitters, latencies and buffer usage are discussed and the first conclusions on the promises of Factoring to meet Industry 4.0 requirements are derived.

For time-sensitive networks, as in the context of IEEE TSN and IETF Detnet, cyclic dependencies are associated with certain fundamental properties such as improving availability and decreasing reconfiguration effort. Nevertheless, the existence of cyclic dependencies can cause very large latency bounds or even global instability, thus making the proof of the timing predictability of such networks a much more challenging issue. Cyclic dependencies can be removed by reshaping flows inside the network, by means of regulators. We consider FIFO-per-class networks with two types of regulators: perflow regulators and interleaved regulators (the latter reshape entire flow aggregates). Such regulators come with a hardware cost that is less for an interleaved regulator than for a perflow regulator; both can affect the latency bounds in different ways. We analyze the benefits of both types of regulators in partial and full deployments in terms of latency. First, we propose Low-Cost Acyclic Network (LCAN), a new algorithm for finding the optimum number of regulators for breaking all cyclic dependencies. Then, we provide another algorithm, Fixed- Point Total Flow Analysis (FP-TFA), for computing end-to-end delay bounds for general topologies, i.e., with and without cyclic dependencies. An extensive analysis of these proposed algorithms was conducted on generic grid topologies. For these test networks, we find that FP-TFA computes small latency bounds; but, at a medium to high utilization, the benefit of regulators becomes apparent. At high utilization or for high line transmission-rates, a small number of per-flow regulators has an effect on the latency bound larger than a small number of interleaved regulators. Moreover, interleaved regulators need to be placed everywhere in the network to provide noticeable improvements. We validate the applicability of our approaches on a realistic industrial timesensitive network.

Conducting worst-case timing analyses for wormhole Networks-on-chip (NoCs) is a fundamental aspect to guarantee real-time requirements, but it is known to be a challenging issue due to complex congestion patterns that can occur. In that respect, we introduce in this paper a new buffer-aware timing analysis of wormhole NoCs based on Network Calculus. Our main idea consists in considering the flows serialization phenomena along the path of a flow of interest (foi), by paying the bursts of interfering flows only at the first convergence point, and refining the interference patterns for the foi accounting for the limited buffer size. Moreover, we aim to handle such an issue for wormhole NoCs, implementing a fixed priority-preemptive arbitration of Virtual Channels (VCs), that can be assigned to an arbitrary number of traffic classes with different priority levels, i.e. VC sharing, and each traffic class may contain an arbitrary number of flows, i.e. priority sharing. It is worth noting that such characteristics cover a large panel of wormhole NoCs. The derived delay bounds are analyzed and compared to available results of existing approaches, based on Scheduling Theory as well as Compositional Performance Analysis (CPA). In doing this, we highlight a noticeable enhancement of the delay bounds tightness in comparison to CPA approach, and the inherent safe bounds of our proposal in comparison to Scheduling Theory approaches. Finally, we perform experiments on a manycore platform, to confront our timing analysis predictions to experimental data and assess its tightness.

Worst-case timing analysis of Networks-on-Chip (NoCs) is a crucial aspect to design safe real-time systems based on manycore architectures. In this paper, we present some potential extensions of our previously-published buffer-aware worst-case timing analysis approach to cope with bursty traffic such as real-time audio and video streams. A first promising lead is to improve the algorithm analyzing backpressure patterns to capture consecutive-packet queueing effect while keeping the information about the dependencies between flows. Furthermore, the improved algorithm may also decrease the inherent complexity of computing the indirect blocking latency due to backpressure.

To cope with the increasing quantity of wires, thus the weight and integration costs in avionics, an implementation of a new avionics communication architecture with less cables will clearly improve the efficiency of aircraft, while reducing the deployment costs. Furthermore, such a communication architecture shall be efficient to meet the design requirements, in terms of predictability and availability, for the least amount of money. Therefore, the AFDX compatibility, a minimized (re)-configuration effort and costs are among the most important issues to guarantee. On the other hand, the recent research effort towards defining new communication solutions, to guarantee a high availability level with limited cabling complexity for realtime applications, has renewed the interest in ring topology. Therefore, the main objective of this paper is benchmarking the most relevant solutions, based on Ethernet technology and supporting ring topology, vs avionics requirements, and we particularly focus on the main Performance Indicators, specified in IEC 61784-2, of each one of them.

We define a novel core network router scheduling architecture to carry and isolate time constrained and elastic traffic flows from best-effort traffic. To date, one possible solution has been to implement a core DiffServ network with standard fair queuing and scheduling mechanisms as proposed in the well-known “A Differentiated Services Code Point (DSCP) for Capacity-Admitted Traffic” from RFC5865. This architecture is one of the most selected solutions by internet service provider for access networks (e.g. Customer-Premises Equipment or satellite PEP). In this study, we argue that the proposed standard implementation does not allow to efficiently quantify the reserved capacity for the AF class. By using a novel credit based shaper mechanism called Burst Limiting Shaper, we show that we can provide the same isolation for the time constrained EF class while better quantifying the part allocated to the AF class.

The ring networks guarantee a high availability level, while limiting cabling costs. However, their performance analysis is still a relevant concern due to cyclic dependencies. In this paper, we handle this challenging issue based on Network Calculus formalism. We propose a new approach, Pay Multiplexing Only at Convergence points (PMOC), to compute accurate delay bounds while integrating the impact of cyclic dependencies. We first define and prove the end-to-end service curve, guaranteed for a now of interest under Arbitrary multiplexing. Afterwards, we detail the methodology of delay bounds computation and illustrate it in a special case of ring networks, called regular ring networks. Finally, we analyse the sensitivity and tightness of the derived delay bounds, and compare them against the related work results. We highlight a noticeable enhancement of delay bounds accuracy, thus network resource efficiency and scalability.

Avionics implementation with less cables will clearly improve the efficiency of aircraft while reducing weight and maintenance costs. To fulfill these emerging needs, an innovative avionics communication architecture, based on Gigabit Full Duplex Ethernet ring, is proposed in this paper. To adapt this COTS technology to safety-critical avionics, an adequate tuning process of the communication protocol and the choice of reliability mechanisms to achieve timely and reliable communications are first detailed. Then, efficient timing analyses of such a proposal based on Network Calculus are conducted, accounting the impact of a ring topology and the specified reliability mechanisms. Third, these general analyses are illustrated in the case of a realistic avionic application, to replace the AFDX backup network with AeroRing, to reduce wires, while guaranteeing timely communications.

To reduce the aircraft weight and maintenance costs while guaranteeing system performance and reliability, an alternative avionic communication architecture based on Ultra Wide Band (UWB) and TDMA protocol is proposed to replace the back-up part of safety-critical avionics network. The analysis and performance optimization of such a proposal is tackled as follows. First, appropriate system modeling and timing analysis, using Network Calculus and Integer Linear Programing (ILP) approach, are provided to evaluate the end-to-end delays and verify system predictability. Then, an optimization approach to find the optimal TDMA cycle duration, which minimizes the end-to-end delays, is proposed. Finally, the efficiency of our proposal to enhance the system performance is validated through a realistic avionic case study.

The increasing heterogeneity and asymmetry in wireless network environments makes QoS guarantees in terms of delays and throughput a challenging task. In this paper, we study a novel scheduling algorithm for multipath transport called Delay Aware Packet Scheduling (DAPS) which aims to reduce the receiver's buffer blocking time considered as a main parameter to enhance the QoS in wireless environments. We develop an analytical model of maximum receiver's buffer blocking time and extend the DAPS algorithm considering implementation issues. Performance evaluations based on ns-2 simulations highlight the enhanced QoS that DAPS can provide. With reference to the classical multipath transport protocol CMT-SCTP, we observe a significant reductions of the receiver's buffer occupancy, down by 77%, and the application delay, down by 63%.

For distributed safety-critical systems, such as avionics and automotive, shared networks represent a bottleneck for timing predictability, a key issue to fulfill certification requirements. To control interferences on such shared resources and guarantee bounded delays, the Time Division Multiple Access (TDMA) protocol is considered as one of the most interesting arbitration protocols due to its deterministic timing behavior and fault-tolerance features. This paper addresses the problem of computing the worst-case end-to-end delay bounds for traffic flows sharing a TDMA-based network using Network Calculus. First, we extend classic timing analysis to integrate the impact of non-preemptive message transmission and various service policies in end-systems, e.g., First In First Out (FIFO), Fixed Priority (FP) and Weighted Round Robin (WRR). Afterwards, the proposed models are refined using Integer Linear Programming (ILP) to obtain tighter end-to-end delay bounds. Finally, this general analysis is illustrated and validated in the case of a TDMA-based Ethernet network for I/O avionics applications. Results show the efficiency of the proposed models to provide stronger guarantees on system schedulability, compared to classic models.

The increasing complexity and heterogeneity of avionics networks make resource optimization a challenging task. In contrast to many previous approaches pursuing the optimization of traffic-source mapping and backbone network analysis, our work presented herein mainly focuses on the optimization of interconnection devices for multi-cluster avionics networks. In this paper, we introduce an optimized interconnection device, integrating novel frame packing strategies and schedulability analysis to enhance the communications between an AFDX-like backbone network and various peripheral sensor/actuator networks in terms of resource savings. The performance analysis conducted on a representative avionics communication architecture highlights the efficiency of our proposal to save resources particularly consumed bandwidth. These latter is considered as an important feature for avionics applications to guarantee easy incremental design during the long lifetime of an aircraft.

The current avionics communication architecture has recently arisen some limitations for meeting the emerging requirements of new generation aircraft in terms of modularity, weight and integration costs. In order to cope with these limitations, an alternative avionics communication architecture based on a multi-cluster embedded network is proposed in this paper. The critical avionics subsystems still are interconnected via the backbone network AFDX, however the sensors and actuators are grouped to be interconnected via CAN buses, independently of the associated avionics subsystems. The obtained clusters will be interconnected via specific gateways to handle the heterogeneity between the AFDX and CAN buses. This paper focuses first on the relevant aspects of our proposal and the offered real time guarantees required by critical avionics applications. Then, since an efficient bandwidth consumption is inherently important to guarantee an easy incremental design process, an optimized gateway design with a new frame packing strategy is proposed and evaluated in our context.

Current military communication network is a generation old and is no longer effective in meeting the emerging requirements imposed by the next-generation military embedded applications. A new communication network based upon Full Duplex Switched Ethernet is proposed in this paper to overcome these limitations. To allow existing military subsystems to be easily supported by a Switched Ethernet network, our proposal consists in keeping their current centralized communication scheme by using an optimized master/slave transmission control on Switched Ethernet thanks to the Flexible Time Triggered (FTT) paradigm. Our main objective is to assess the performance of such a proposal and estimate the quality-of-service we can expect in terms of latency. Using the Network Calculus formalism, schedulability analysis are determined. These analysis are illustrated in the case of a realistic military embedded application extracted from a real military aircraft network, to highlight the proposal's ability to support the required time constrained communications.

Over the last thirty years, the MIL-STD 1553B data bus has been used in many embedded systems, like aircrafts, ships, missiles and satellites. However, the increasing number and complexity of interconnected subsystems lead to emerging needs for more communication bandwidth. Therefore, a new interconnection system is needed to overcome the limitations of the MIL-STD 1553B data bus. Among several high speed networks, full duplex switched Ethernet is put forward here as an attractive candidate to replace the MIL-STD 1553B data bus. However, the key argument against switched Ethernet lies in its non-deterministic behavior that makes it inadequate to deliver hard time-constrained communications. Hence, our primary objective in this paper is to achieve an accepted QoS level offered by switched Ethernet, to support diverse "1553B"-based applications requirements. We evaluate the performance of traffic shaping techniques on full duplex switched Ethernet with an adequate choice of service strategy in the switch, to guarantee the real-time constraints required by these specific 1553B-based applications. An analytic study is conducted, using the network calculus formalism, to evaluate the deterministic guarantees offered by our approach. Theoretical analysis are then investigated in the case of a realistic "1553B"-based application extracted from a real military aircraft network. The results herein show the ability of profiled full duplex switched Ethernet to satisfy 1553B-like real-time constraints

Full-Duplex Switched Ethernet is a forecasted new technology for advanced military aircraft system interconnection. However, it was not originally developed to meet the requirements of real-time communications. Therefore, in this paper, we analyze traffic shaping and a priority handling approach over switched Ethernet to achieve reliable transmission with bounded delays that conform to the real-time constraints, required by military applications.