Configuration processes of real-time networks are costly both in terms of time and engineering effort and require the system to be shutdown during the reconfiguration phase thus resulting in significant down time as well. The convergence of IT/OT technologies is bringing a whole world of possibilities for the configuration and management of real-time networks for the automation industry. With software defined networking (SDN) features like the separation of the data and control plane and standards like IEEE 802.1 developed with the goal of adding deterministic capabilities to traditionally dynamic switched Ethernet networks, the plug and play paradigm is almost around the corner. In this paper, we go one step further and start looking into the self-configuration of real-time networks. To achieve that we propose to introduce a Configuration Agent in the network, an entity that continuously monitors the network to detect changes and automatically update the configuration to adapt to such changes while maintaining desired quality of service. We present here the complete framework for the Configuration Agent that will provide self-configuration capabilities to real-time networks. The proposed framework has IEEE 802.1 as its core, but also shows how the set of standards need to be extended in order to achieve the self-configuration requirements. Concretely we examine the role of existing communication protocols like NETCONF and OPC-UA and propose the essential ingredients (managed objects) for a YANG model for the learning aspects in the bridges, including different working modes.

We present online tunable diagnostic and membership protocols for generic time-triggered (TT) systems to detect crashes, send/receive omission faults, and network partitions. Compared to existing diagnostic and membership protocols for TT systems, our protocols do not rely on the single-fault assumption and also tolerate non-fail-silent (Byzantine) faults. They run at the application level and can be added on top of any TT system (possibly as a middleware component) without requiring modifications at the system level. The information on detected faults is accumulated using a penalty/reward algorithm to handle transient faults. After a fault is detected, the likelihood of node isolation can be adapted to different system configurations, including configurations where functions with different criticality levels are integrated. All protocols are formally verified using model checking. Using actual automotive and aerospace parameters, we also experimentally demonstrate the transient fault handling capabilities of the protocols.

TT Ethernet is a communication architecture which allows the integration of the standard Ethernet traffic and real-time Ethernet traffic in the same network without invalidating the real-time properties of the real-time traffic. The TT Ethernet switch distinguishes between two classes of traffic. The standard Ethernet traffic is handled in conformance with the existing (standard) Ethernet, whereas the real-time traffic is transmitted with a constant transmission delay. In order to guarantee a constant message transmission delay, the TT Ethernet switch preempts, if necessary, the transmission of standard Ethernet messages, and retransmit the preempted Ethernet message as soon as the transmission of the real-time Ethernet message is finished. The message can be preempted several times before it is successfully transmitted, which decreases the throughput of standard Ethernet messages. In this paper, we propose a segmentation mechanism for standard Ethernet frames in order to increase the throughput. The segmentation mechanism does not change the format of Ethernet frame and is transparent to higher levels of a protocol stack such as TCP/IP.

We present a tunable diagnostic protocol for generic time-triggered (TT) systems to detect crash and send/receive omission faults. Compared to existing diagnostic and membership protocols for TT systems, it does not rely on the single-fault assumption and tolerates malicious faults. It runs at the application level and can be added on top of any TT system (possibly as a middleware component) without requiring modifications at the system level. The information on detected faults is accumulated using a penalty/reward algorithm to handle transient faults. After a fault is detected, the likelihood of node isolation can be adapted to different system configurations, including those where functions with different criticality levels are integrated. Using actual automotive and aerospace parameters, we experimentally demonstrate the transient fault handling capabilities of the protocol.

This paper presents the design of a time-triggered Ethernet (TTE) switch, which is one of the core units of the time-triggered Ethernet system. Time-triggered Ethernet is a communication architecture intended to support event-triggered and time-triggered traffic in a single communication system. The TTE switch distinguishes between two classes of traffic. The event-triggered (ET) traffic is handled in conformance with the existing Ethernet standard, while the time-triggered (TT) traffic is transmitted with temporal guarantees. A TTE switch is used in the time-triggered Ethernet system for exchanging time-triggered messages in a time-predictable way while continuing the support of standard Ethernet traffic in order to use existing networking protocols such as IP, UDP or IPX without any modifications. In this paper we present the mechanisms the TTE switch uses to guarantee a constant transmission delay for time-triggered traffic. Also an experimental validation of these mechanisms is given

This paper presents the rational for and an outline of the design of a time-triggered (TT) Ethernet that unifies real-time and non-real-time traffic into a single coherent communication architecture. TT Ethernet is intended to support all types of applications, from simple data acquisition systems, to multimedia systems up to the most demanding safety-critical real-time control systems which require a fault-tolerant communication service that must be certified. TT Ethernet distinguishes between two traffic categories: the standard event-triggered Ethernet traffic and the time-triggered traffic that is temporally guaranteed. The event triggered traffic in TT Ethernet is handled in conformance with the existing Ethernet standards of the IEEE. The design of TT Ethernet has been driven by the requirement of certification of safety-critical configurations and an uncompromising stand with respect to the integration of legacy applications and legacy Ethernet hardware.

This paper proposes the integration of internal and external clock synchronization by a combination of a fault-tolerant distributed algorithm for clock state correction with a central algorithm for clock rate correction. By means of hardware and simulation experiments it is shown that this combination improves the precision of the global time base in a distributed single cluster system while reducing the need for high-quality oscillators. Simulation results have shown that the rate-correction algorithm contributes not only in the internal clock synchronization of a single cluster system, but it can be used for external clock synchronization of a multi-cluster system with a reference clock. Therefore, deployment of the rate-correction algorithm integrates internal and external clock synchronization in one mechanism. Experimental results show that a failure in the clock rate correction does not hinder the distributed fault-tolerant clock state synchronization algorithm, since the state correction operates independently from the rate correction. The paper introduces new algorithms and presents experimental results on the achieved improvements in the precision measured in a time-triggered system. Results of simulation experiments of the new algorithms in single-cluster and multi-cluster configurations are also presented.

Arbitrary faults of a single node In a time-triggered architecture (TTA) bus topology system may cause error propagation to correct nodes and may lead to inconsistent system states. This has been observed in validation work using software implemented fault injection (SWIFI) and heavy-ion fault injection techniques in a TTA cluster. In a TTA system, the membership and the clique avoidance algorithms detect state inconsistencies and force the nodes that do not have the same state with the state of majority of nodes, to restart. Changing the interconnection structure of the cluster to a star topology allows the use of star couplers that will isolate faults of a node, thus guaranteeing consistency, even in the presence of arbitrary node failures. The same SWIFI and heavy-ion fault injection experiments that caused error propagation in bus-based TTA clusters, were performed in the star configuration. No error propagation was observed in a TTA system with the star topology during the execution of SWIFI and heavy-ion experiments.