Mode-Changes in COTS Time-Triggered Network Hardware without Online Reconfiguration

Transcription

1 Mode-Changes in COTS Time-Triggered Nework Hardware wihou Online Reconfiguraion Florian Heilmann, Ali Syed and Gerhard Fohler Chair of Real-ime Sysems Technische Universiä Kaiserslauern, Germany ABSTRACT Time-riggered neworks are widely used for safey-criical applicaions. Being offline scheduled, flexibiliy and adapiviy ypically come a he price of very low resource uilizaion, if possible a all. In his paper, we presen he Sacked Scheduling Approach (SSA) for ime riggered neworks o enable mode changes and implici adapaion in such neworks by enabling reuse of nework bandwidh. We describe SSA in deail and conduc a case sudy o show ha SSA can be implemened in COTS ime riggered nework hardware and validae he approach by implemening an example in COTS TTEherne hardware. Keywords Time Triggered Neworks; Scheduling; Mode Changes 1. INTRODUCTION Safey-criical applicaions require a high degree of reliabiliy and predicabiliy. In he nework domain, imeriggered (TT) neworks are widely used o saisfy hese requiremens. Safey-criical applicaions, however, may also require a high degree of flexibiliy and adapiviy o deal wih changes in sysem sae, environmen or applicaion requiremens. This is a problem for TT neworks, because hey are scheduled offline. Flexibiliy and adapiviy in such neworks can only be achieved eiher a he price of very low resource uilizaion, or canno be achieved a all. This limiaion resuls in various approaches o augmen TT nework echnologies o enable adapive behavior. These approaches increase he flexibiliy of COTS TT neworks, however, hey have drawbacks, which eiher manifes hemselves in expensive online reconfiguraions or he aforemenioned inefficien use of already scarce nework bandwidh. The inegraion of mode changes or adapaion mechanisms, ha use nework bandwidh efficienly and do no require reconfiguraion, ino he specificaions of exising TT neworking echnologies is infeasible. Such an inegraion would incur significan cos and design overheads since proocols and hardware would require redesign and recerificaion. To he bes of our knowledge, no exising work enables adapaion and mode changes in exising TT nework echnologies wihou performing online reconfiguraion or sacrificing bandwidh. In his paper, we presen he Sacked Scheduling Approach (SSA) which makes use of he sysem specificaion o idenify muually exclusive messages (i.e. messages ha are never ready o ransmi a he same ime) and sack hem ino he same scheduled TT ransmission windows. This approach enhances exising TT neworks wih increased flexibiliy. We ouline how SSA can be used o enable sysem wide mode changes as well as node-local adapaion. We conduc a case sudy showing ha COTS TT nework hardware can eiher execue schedules creaed wih an SSA enabled scheduler direcly, or require only minor changes ha do no affec heir specificaion or cerificaion. In addiion, by reusing nework bandwidh wih he help of SSA, previously reserved bandwidh can now be reused o implemen more funcionaliy or even add funcionaliy o exising sysems incremenally wihou compromising reliabiliy and safey. The remainder of his paper is srucured as follows: Secion 2 focuses on relaed work while Secion 3 presens he sysem model and erminology used in his paper. Secion 4 compares differen mode change implemenaions. We presen he Sacked Scheduling Approach in Secion 5 and perform a case sudy on SSA in TTEherne in Secion 6 before concluding he paper in Secion RELATED WORK The sae of he ar explores several opions o provide adapaion in TT neworks. One possible approach is he inclusion of adapaion suppor ino he nework echnology iself. Time Triggered Neworks like TTCAN [5] or FlexRay [3] provide limied flexibiliy o safey-criical sysems by pariioning he nework bandwidh ino saic and dynamic segmens. While he dynamic segmens do no assign nework bandwidh o specific message and hus can provide a plaform for adapaion, he response ime of a message in his segmen depends on wheher i wins or (repeaedly) loses arbiraion, which makes i difficul o provide response ime guaranees [13]. Anoher example is he Time Triggered Proocol (TTP) proposed by Kopez e al. [9], which includes he suppor for adapaion hrough mode changes in is specificaion [10]. The number of mode changes is, however, limied. Moreover, TTP provides less bandwidh and is no able o service even-riggered (ET) raffic alongside TT raffic which may be desired by he sysem designer. The adapabiliy hrough mode changes allows sysems o adap o major changes in he environmen [4] or sysem sae, e.g. faul recovery. In [10], Kopez e al. idenified wo differen ypes of mode changes, which are riggered by a hos node by firing a mode change reques. In deferred mode changes, all sysem nodes change mode afer he reques a he end of he hyperperiod. In immediae mode changes,

2 only one sysem node changes operaion mode soon afer he reques, i.e. before he end of he hyperperiod. The principle for he former is consisency while for he laer, speed. Kopez e al. [10] poined ou ha immediae mode change may lead o consisency problems for he applicaions and herefore a number of asks or messages mus be abored bu should no go in an undefined sae. This noion of an (immediae) mode change requires careful applicaion design and heir igh coupling wih he scheduler. However in [4], Fohler assered ha consisency is required in boh mode change ypes o keep schedulabiliy during and afer he mode changes. This noion of a mode change decouples he applicaion from he scheduler and hence is more suied for complex sysems. Anoher possible approach o provide adapaion enables mode change suppor using online reconfiguraion by recompuing a suiable TT schedule on he fly. This approach is invesigaed by Klobedanz e al. in [6], [7] and [8] for FlexRay, and Ashjaei e al. in [1] for FTT-Swiched Eherne. The common issue wih his approach comes wih he overheads incurred by hese reconfiguraions. Online recompuaion of TT schedules may ake significan amouns of ime, during which he nework may or may no be available. Moreover hese works focus on faul-olerance or admission conrol specifically. Craciunas and Oliver invesigaed he synhesis of TTEherne schedules in [2]. Their implemenaion, however leads o he assumpion ha mode-changes can only be implemened by aggregaing all messages from all nodes ino a single super-schedule, an approach similar o he one invesigaed by Klobedanz e al. in [7] where frame-packing is used o dynamically aler he conens of scheduled messages. These super-schedules allow he nework o exhibi behavior akin o seamless online mode changes. Due o all messages of all modes being assigned heir own windows in such super-schedules, collisions canno happen and reliable operaion is ensured. However, his mehod wases nework bandwidh, as he super-schedule reserves nework bandwidh for all modes a all imes, which leaves he nework bandwidh reserved for inacive modes idle. This approach limis he funcionaliy ha can be inegraed ino a TTEherne nework, since he fixed amoun of nework bandwidh is quickly exhaused if all modes are aggregaed ino one schedule. 3. SYSTEM MODEL AND TERMINOLOGY In his paper, a generic TT nework Θ is modeled by he uple δ Θ, µ Θ, N Θ, L Θ (1) where δ Θ is he delay inroduced due o he processing and propagaion of messages in he TT nework. In a sysem wih varying delays, δ Θ is he maximum delay. µ Θ represens he ime granulariy of he TT nework. For a given nework ype, he lower limi for he ime granulariy µ Θmin is defined by he hardware. The applicaion designer may selec µ Θ > µ Θmin, based on he applicaion requiremens. N Θ and L Θ collecively represen he nework opology. N Θ is a se of communicaion nodes, i.e. swiches and processing nodes, and L Θ is a se of communicaion links, i.e. he links beween swich/processing nodes or a bus. A link l L Θ is furher defined by he uple N l, υ l, where N l defines he se of nodes conneced by he link l and υ l is he link speed. X o1 X o2 s w1 e w1 w 1 w 2 w 3 m 3 ψ m3 m 1 m 2 ψ m1 m 4 Figure 1: Example schedule for a link l For swiched neworks, N l is represened by an ordered pair n a, n b, which defines a direced logical communicaion link connecing wo nodes n a, n b N Θ. The nework is a full duplex nework when n a, n b l i, here exiss n b, n a l j. Moreover, δ Θ denoes he hop-delay for he swiches and he processing nodes, while υ l can be differen for differen links, i.e. muli-speed links. For a bus based nework, N l = N Θ. An applicaion model is represened by a se of operaion modes O. An operaion mode o is defined by P o, G o, where P o defines he flow or roue of he messages hrough he links L Θ in he swiched nework and an empy se in a bus based nework. G o(m o, X o) is an undireced graph, where M o is he se of verices in G o represening he messages o be scheduled and X o is he se of edges in G o defining he muual exclusion beween he messages M o. A message m M o is represened by he uple φ m, ψ m, ρ m, γ m (2) where φ m is he iniial phase afer which a message is ready o be sen or received, ψ m is he message ransmission ime and ρ m defines he message period. γ m is defined by γ s, γ r, where γ s is he sender node and γ r is he se of receiver nodes. For muli-speed neworks, ψ m is a funcion of p m P o, while for single speed neworks, ψ m is a consan. We assume ha he message deadlines are implici (i.e. equal o he message period ρ m) and he message phase φ m is consrained by he message period ρ m, i.e. 0 φ m < ρ m. Furhermore, we assume ha m M o, he sender/receiver nodes γ m and he pahs p m P o are known and fixed. As we are focusing on he TT messages, all aciviies are assumed o be riggered by he passage of ime. The se of TT windows W l provides bandwidh reservaion for all he messages on he link l. A TT window w W l is defined by he uple s w, e w, M w (3) where s w is he sar ime of he window, e w is he end ime and M w is he se of messages scheduled in window w. The parameers s w and e w are inegral muliples of he granulariy µ Θ. Noe ha he parameers s w, e w and υ l collecively define he reserved bandwidh for messages M w. The scheduling able T is generaed offline by he message scheduler and is defined by a se of W l and he hyperperiod HP, i.e. he LCM of all messages periods ρ m. An example schedule for link l is shown in Figure 1. In he figure, w i denoes he TT windows, m j denoes he messages and X ok denoes he ses of muually exclusive messages in mode o. The figure assumes ha M w1 = {m 1, m 3}.

3 4. COMPARISON OF MODE CHANGE IM- PLEMENTATION O 1/2 m 1 m 2 m 3 m 4 o 2 o 1 o 2 o m 1 m 2 (a) Super schedule m 3 m (b) Deferred mode change schedule m 3 m 4 m 1 m (c) Immediae mode change schedule Figure 2: Comparison of mode change implemenaions To compare he shorcomings and bolenecks of differen implemenaions of mode changes, scheduling ables for a link l are presened in he Figure 2. The figure assumes mode o 1 wih messages m 1 and m 2 and mode o 2 wih messages m 3 and m 4. For all messages, he phase φ m = 0, while he period ρ m is consan. All messages have uni ransmission ime excep m 3 which requires 2 unis for ransmission. The super schedule approach is presened in Figure 2a, where all messages are scheduled sequenially, irrespecive of heir operaion mode. The advanage of his approach is is ease of implemenaion. However, using his approach scheduling is hard for more han rivial loads. Moreover, his approach leads o exreme overprovisioning, has very bad bandwidh uilizaion and does no suppor adapaion. The scheduling ables for neworks capable of handling mode changes can be seen in he Figure 2b and 2c. In his paper, his approach is refered as individual schedule approach. This approach is easy o implemen and o schedule. However, he scope of muual exclusion in his approach is limied o operaion modes, and implici adapaion (see Secion 5.4.2) is no possible wihou overprovisioning. The dark circles on he imeline in Figure 2c represen mode change blackou [4]. A mode change blackou defines ha changing modes a his poin in ime will lead o eiher a message no compleely being ransmied or a queued message being discarded. In COTS nework conrollers, mode change blackou informaion canno be uilized, which furher limis he scope of individual schedule approach. 5. STACKED SCHEDULING APPROACH 5.1 Definiions The descripion of SSA requires he definiion of wo erms. SSA makes use of he muual exclusiviy of wo or more messages o generae sacked TT windows in he TT schedules of he nework. The definiion for he muual exclusion relaion beween wo messages in a sysem is provided in Definiion 1. Definiion 1. Two or more messages are muually exclusive, if only one of he messages is ready o be ransmied during a TT window w W l based on sysem or environmenal sae. Examples for muually exclusive messages include messages sen from a node o differen nodes based on differen environmenal/sysem sae (XOR consrains in [4]) or messages sen during differen modes of operaions. The definiion of sacked TT window is provided in Definiion 2. Definiion 2. A TT window w W l is ermed a sacked TT window, if M w > 1 and all messages m i M w are muually exclusive o each oher. An example for a sacked TT window is provided in Figure 1 where w 1 is a sacked windows wih wo messages, m 1 and m 2 assigned o i. 5.2 Mehodology SSA can be implemened as an exension o exising TT nework schedulers. During scheduling, he scheduler can assign he message i is currenly scheduling o a window which already conains one or more messages if he resuling message se only conains muually exclusive messages. Wihou SSA, hese wo messages would be assigned o separae windows. This resuls in a single schedule, which uilizes nework bandwidh more efficienly han a super-schedule approach (see Figure 2a) by occupying less TT windows and does no require online nework reconfiguraion since only a single schedule is used. In order o use SSA wih exising TT neworks, only he following wo condiions need o be saisfied during runime: Condiion 1. Muual exclusion consrains hold during sysem operaion. Condiion 2. The nework conroller acceps schedules conaining sacked windows and services requess for all messages conained in sacked TT windows during runime. Condiion 1 can be saisfied by sysem designer by, for example, using mode changes and making sure ha all nodes swich modes simulaneously. Condiion 2 relaes o he capabiliies of he COTS nework conroller. Due o he sacking of he TT windows, differen modes of operaion and (implici) adapaions are now possible. 5.3 Advanages Using SSA in a TT nework provides numerous advanages o he sysem designer. Compared o scheduling echniques wihou SSA, less nework bandwidh is now required, which allows o implemen addiional funcionaliy or augmen exising funcionaliy. SSA can provide he abiliy o add funcionaliy o legacy sysems. In such sysems, he exising funcionaliy is already scheduled. SSA can be used o creae sacked TT windows conaining legacy messages

4 and new messages if hey are muually exclusive o each oher. Finally, compared o oher approaches such as superschedules, SSA can, in some cases, improve he response ime of messages by moving he message o an earlier TT window conaining only muually exclusive messages. 5.4 Applicaions Mode Changes By definiion, wo modes of operaions o 1 and o 2 are muually exclusive o each oher. We exploi his propery of he operaion modes and employ SSA o suppor muliple operaion modes in COTS TT nework conrollers ha do no implemen mode change funcionaliy. Deferred mode changes can be implemened using SSA wihou major modificaions o he scheduler for sysems wih consrained deadlines. In addiion o sacking he messages of he differen modes, a message for mode change requess has o be added o he nework. This message is used o exchange mode change requess among he nodes. If such a message is received, he processing nodes change modes a he end of he HP. In order o implemen immediae mode changes using SSA, he following condiions, corresponding o he argumenaion in he Secion 2, have o be saisfied in addiion o Condiions 1 and 2 in Secion 5.1. Condiion 3. Mode change blackou [4] informaion is provided by he scheduler. Condiion 4. Changing mode in a node and no in he ohers also leads o a valid operaion mode. Noe ha, in he case of an immediae mode change using SSA, a TT message for a mode change reques is no required Implici Adapaion Mode changes allow he sysem o swich beween saes ha influence a large porion of he sysem. However, some adapaions may be oo minor o warran a full mode change of he sysem, because hey are limied o a single node or a single applicaion. These implici adapaions focus on changes in he message parameers (see uple 2 in Secion 3). Wih SSA sysem designers can implemen small, implici adapaions by defining muliple redundan messages wih differen parameer ses and sacking hem ino one TT window. During run-ime, he node will selec he message wih he parameer se ha is bes suied for he applicaions curren requiremens. Since consequenly one message from he sacked window is seleced a any given ime, he muual exclusiviy is ensured (Condiion 1 of Secion holds). Example: Elecronic Sabiliy Program (ESP). We illusrae such an implici adapaion by defining he following example: A car manufacurer wans o develop a new elecric car, wih one moor used for acceleraion as well as braking of each ire. The car is also equipped wih an Elecronic Sabiliy Program (ESP), which helps he driver o avoid overor under-seering by selecively braking a single ire. The nework opology is depiced in Figure 3. The ESP applicaion is running on a single ECU (n ESP ) buil ino he dash of he car. A swiched Eherne nework, consising of a single swich (n SW ) and five physical links (l 1 hrough l 5), n ESP n F ronrigh l 1 l 2 l 3 n F ronlef n SW l 4 l 5 n RearRigh n RearLef Figure 3: ESP Example Nework Topology is used o ransmi messages from n ESP o he nodes conrolling he ire moors (n F ronrigh, n F ronlef, n RearRigh and n RearLef ). The ransmission of messages is modeled hrough flows, for which a schedule is generaed offline and sored in all involved devices. We compare wo approaches o schedule he ransmission of hese messages wihou he use of SSA and one approach uilizing SSA. Single Flow wihou SSA(SF-noSSA) A single mulicas flow is used o carry he informaion for all 4 ire nodes. The advanage of his approach lies in he efficien usage of ransmission windows, since only one scheduled window has o be used on all nework links. However, his approach also inroduces unnecessary nework aciviy in all links from n SW o nodes of ires ha do no need o brake. On hese links, messages ha carry no acive informaion are ransmied. This inacive load consumes bandwidh ha could be used by non-ime-riggered raffic. Individual Flows wihou SSA (IF-noSSA) Four individual unicas flows are used o carry he informaion for each respecive ire node. n ESP can now, depending on which ire has o brake, release a message which will only be roued o ha specific ire. As a resul, no inacive load will be inroduced o he links from n SW o he ires ha do no need braking. However he overhead in he schedule, especially on l 1 is significan for his approach. Four separae ransmission windows have o be allocaed o he messages of he ESP funcionaliy, even hough only one window will have a message ha is ready a any given ime. Moreover, assuming ha n ESP, independen on which ire needs o brake, releases a message a he same ime, some messages may have a larger response ime han he ohers because hey have o wai longer for heir scheduled ransmission window. Individual Flows wih SSA (IF-SSA) As wih he previous approach, four individual unicas flows are used for each respecive ire node. However, hese ransmission windows for hese messages are now sacked on l 1. As a resul, one signular ransmission window on l 1 is uilized regardless of which ire has o brake and he response ime for all four ires is idenical. Finally, as in IF-noSSA, no inacive load is inroduced on he links o he hree ires which are no supposed o brake. In his example, SSA allows o combine he efficien usage of schedule space of he SF-noSSA approach and flexibiliy of he IF-noSSA approach. While no significan, some minor overheads may be inroduced in he nodes and swiches by using SSA. Nodes have o selec he appropriae message parameer se and swiches need o service sacked TT. As a resul, he sysem in his example can now adap o applicaion requiremens implicily wihou requiring a mode change of he whole sysem.

5 5.5 Limiaion: Overprovisioning TT neworks can suffer from overprovisioning. Overprovisioning resuls in nework bandwidh ha is eiher reserved bu no used, meaning ha during run-ime bandwidh may be available, bu no usable by ohers because of reservaions. Even hough SSA, compared o oher approaches, frees up nework bandwidh, here migh be siuaions in which SSA does no lead o maximum bandwidh reuse. Based on he relaion beween he window size (e w s w) and he message ransmission ime ψ m, he following cases can lead o overprovisioning: Case 1: Inernal OP (e w s w) = max m Mw (ψ m) This overprovisioning is due o he fac ha a message always has o fi inside one TT window. As a resul, he windows have o be sized according o he larges message of he se M w. As a resul, if a smaller message is acivaed in he window, he remainder of he nework bandwidh in he window is no uilized. An example for Case 1 is shown in Figure 1. Boh m 1 and m 3 are sacked ino he same TT window w 1. However, m 3 does no fully occupy w 1, leading o inernal OP in ha window when m 3 is acivaed. Case 2: Ineviable OP (e w s w) > max m Mw (ψ m) Similar o Case 1, due o limiaions in he sysem sofware or he TT nework hardware, i may be impossible o choose an arbirarily small window size. Insead, a window size, which is larger han all messages m M w, has o be used. In Figure 1 depics ineviable OP in w 2. Even hough m 2 is he only message assigned o his window, he window size is larger han he message size, and hus nework bandwidh remains unused. In addiion o hese wo cases, anoher source of overprovisioning, no relaed o message ransmission ime and window size, has o be considered. Case 3: Sequenial OP While SSA can improve he nework bandwidh usage efficiency by making use of muually exclusive messages, in some scenarios, messages may no be perfecly sackable. Such messages have o be assigned o differen TT windows. If, during runime, he sysem is in a mode of operaion where he messages assigned o hese windows are no acive, he nework bandwidh remains unused. The resuling overprovisioning of he nework is ermed Sequenial OP. An example for sequenial OP due o muually inclusive messages is depiced in Figure 1. m 2 and m 4 are no sacked ino w 2, because hey are muually inclusive and can hus no be assigned o he same window. 6. CASE STUDY: TTETHERNET In a TTEherne nework, SSA can be applied for boh deferred mode changes, where messages from all nodes may be sacked if hey are muually exclusive, as well as immediae mode changes, where we only allow messages from he same source node o be sacked. This helps o ensure ha Condiion 4 from Secion is saisified. 6.1 Nework Descripion TTEherne is a ime riggered Eherne based nework. I combines even riggered ransmission of packes in compliance wih he Avionics Full Duplex Swiched Eherne (AFDX) wih scheduled ransmission of TT messages. TT- Eherne specifies a global synchronizaion proocol o synchronize he whole nework o a global ime base. This synchronizaion proocol, along wih specialized swiches and nework conrollers faciliae he ransmission of TT messages according o offline compued schedules. TTEherne considers hree raffic ypes: Time Triggered raffic (TT) for scheduled ime-riggered messages. Rae Consrained raffic (RC) for even-riggered message a a consrained rae. Bes Effor raffic (BE) for non safey-criical raffic. TTEherne makes use of virual links for sending messages. A virual link (VL) defines a unidirecional virual message ransmission channel from one sender o one or more receivers. A virual link can eiher be TT (TT VL) or ET (RC VL). TT VLs uilize schedules compued offline o ransmi messages hrough he nework, while RC VLs allow for ransmission a a conrolled rae wihou explici ransmission windows. If, during a scheduled ransmission window, a TT message is ready, i is ransmied hrough he nework, if no, pending RC or BE messages are ransmied. If a TT message arrives a a swich or nework conroller ouside of is scheduled window, i is considered invalid and discarded. For his case sudy, we focus on TT raffic and assume no RC or BE raffic o be presen in he nework. The TTEherne schedule is divided ino macroicks (nework parameer µ Θ from Secion 3). The size of he macroick and he window size (s w e w) are equal. Each macroick hus conains one ransmission window for a TT message. The size of he macroick can vary from several nanoseconds o a few hundred microseconds and is chosen during sysem design depending on hardware and sofware choices [2]. The schedules for a TTEherne nework are compued offline and uploaded o he devices before he sysem commences normal operaion. If he schedule in he nework should be changed, a full reconfiguraion is required. A reconfiguraion consiss of uploading he new schedules o all devices and performing a nework rese. During his rese, synchronizaion is los, and as a resul, such an reconfiguraion may resul in significan service ouages of he nework. 6.2 Scheduler Implemenaion The scheduler implemenaion uses he Ieraive Deepening A* (IDA*) [11] search algorihm o consruc schedules for TTEherne. The search-ree node represens a (parial/ complee) schedule for all physical links for all modes of operaion unil ime, where is an inegral muliple of µ Θ. The search-ree nodes are generaed for each phase as a resul of he phase generaion mehod for sricly periodic aciviies defined by Marouf e al.[12]. The cos of a search-ree node depics he earlies message response ime. In order for earlier eliminaion of he wrong pah in he search-ree, any search-ree node leading o a deadline miss is pruned. Moreover, in his case sudy, we only consider deferred mode changes o simplify he scheduler implemenaion. The generaed schedules are loaded ino he TTEherne developmen swiches. To do so, we pu he sacked ransmission windows ino he XML files uilized by he TTTech oolchain. The oolchain hen convers hese XML files ino binary device configuraions, which can hen be uploaded o he swiches and end sysems. In Secion 6.4 we show ha

6 hese modified configuraions do no impair he operaion of he TTEherne nework. The scheduling able generaed using he scheduler incorporaing SSA for mode change implemenaion performed as expeced, i.e. he sacked TT windows forwarded messages from all operaion modes. SSA also enabled implici adapaion in TTEherne based neworks, which do no explicily suppor adapabiliy in TT raffic. Since he purpose of he scheduler implemenaion was o prove he applicabiliy of SSA for mode changes in TT neworks, quaniaive measuremens are no required. 6.3 Overprovisioning Revisied As discussed in Secion 6.1, he size of he TT windows can be larger han he maximum message size (see case 2 and 3 in Secion 5.5), and hus TTEherne can suffer from inernal and ineviable OP. Depending on he muual exclusiviy of he messages, SSA can also suffer from sequenial OP. Wih sacked TT windows, he sequenial OP of SSA is, however, much lower han oher approaches ha work on exising hardware and don require reconfiguraion (superschedule). 6.4 Proof of Concep In order o show ha Sacked Scheduling Approach can be implemened in exising hardware, we implemen he example described in Secion We synhesized schedules boh for he IF-noSSA approach as well as he IF-SSA approach and uploaded he schedules o he AVIonics NEwork Laboraory (AVINEL) of he Real-Time Sysems Deparmen of TU Kaiserslauern. We deermine packe-loss by couning packes on all sacked virual links using Wireshark, deermine he validiy of he ransmied messages by using a TTEherne end sysem as desinaion and invesigae he impac of SSA on packe iner-arrival ime. Firs experimens showed he following resuls: Applying SSA o he TTEherne schedule did no resul in packe loss. Transmied packes were no ransmied ouside heir scheduled windows (he receiving TTEherne end sysem considered all incoming packes as valid) SSA has no measurable impac on he packe inerarrival ime 7. CONCLUSION Time-riggered neworks are widely used for safey-criical applicaions bu lack he flexibiliy and adapiviy hese applicaions may require. Exising approaches incur significan drawbacks, eiher by resuling in low nework bandwidh uilizaion or requiring expensive online reconfiguraions. In his paper, we proposed he sacked scheduling approach o enable mode changes wihou online reconfiguraion for TT neworks. SSA enables suppor for mode changes and implici adapaions in COTS TT neworks. The drawbacks of exising soluions, for example exensive resource usage or expensive online reconfiguraion are no presen in SSA. We described he requiremens and limiaions of SSA and performed a case sudy using COTS TTEherne nework hardware. We showed he benefis of SSA over radiional scheduling approaches and verified, ha SSA can be implemened he COTS TT nework hardware wihou impairing normal operaion. 8. REFERENCES [1] M. Ashjaei, P. Pedreiras, M. Behnam, L. Almeida, and T. Nole. Dynamic Reconfiguraion in Muli-Hop Swiched Eherne Neworks. In 6h Workshop on Adapive and Reconfigurable Embedded Sysems, [2] S. S. Craciunas and R. S. Oliver. SMT-based Taskand Nework-level Saic Schedule Generaion for Time-Triggered Neworked Sysems. In Proceedings of he 22nd Inernaional Conference on Real-Time Neworks and Sysems, [3] FlexRay Consorium. FlexRay communicaions sysem proocol specificaion version Proocol Specificaion, [4] G. Fohler. Flexibiliy in Saically Scheduled Real-Time Sysems. PhD hesis, TNF, Wien, Öserreich, April [5] T. Fuehrer, B. Muller, W. Dieerle, F. Harwich, R. Hugel, and M. Walher. Time riggered communicaion on CAN (Time Triggered CAN-TTCAN). 7h inernaional CAN Conference, [6] K. Klobedanz, G. B. Defo, W. Mueller, and T. Kersan. Disribued coordinaion of ask migraion for faul-oleran FlexRay neworks. In Inernaional Symposium on Indusrial Embedded Sysem (SIES), [7] K. Klobedanz, A. Koenig, and W. Mueller. A reconfiguraion approach for faul-oleran FlexRay neworks Design, Auomaion & Tes in Europe, [8] K. Klobedanz, A. Koenig, W. Mueller, and A. Reberg. Self-Reconfiguraion for Faul-Toleran FlexRay Neworks. In Objec/Componen/Service-Oriened Real-Time Disribued Compuing Workshops (ISORCW), h IEEE Inernaional Symposium on, [9] H. Kopez and G. Grunseidl. TTP-a proocol for faul-oleran real-ime sysems. Compuer, [10] H. Kopez, R. Nossal, R. Hexel, A. Krueger, D. Millinger, R. Pallierer, C. Temple, and M. Krug. Mode handling in he Time-Triggered Archiecure. Conrol Engineering Pracice, [11] R. E. Korf. Deph-firs ieraive-deepening: An opimal admissible ree search. Arificial Inelligence, [12] M. Marouf and Y. Sorel. Schedulabiliy condiions for non-preempive hard real-ime asks wih sric period. In 18h Inernaional Conference on Real-Time and Nework Sysems RTNS 10, [13] T. Pop, P. Pop, P. Eles, Z. Peng, and A. Andrei. Timing analysis of he flexray communicaion proocol. Real-Time Sysems, 2008.