SPECIFICATION 629 CP MAC LAYER. fgallon, juanole,

Transcription

1 MODELLING AND ANALYSIS OF THE ARINC SPECIFICION 629 CP MAC LAYER PROTOCOL GALLON, L., JUANOLE, G. and BLUM, I. LAAS-CNRS, 7 avenue du colonel Roche, Toulouse Cedex 4. FRANCE fgallon, juanole, blumg@laas.fr Abstract : the main concepts and the architecture of the 629 CP ARINC protocol are presented. The emphasis is put on the transmitter scheduler with its two main parts : the timers and the transmitter control. The protocol (which includes a lot of time constraints) is modelled with Stochastic Timed Petri Nets. Its real-time and fault tolerance properties are demonstrated. 1 Introduction The ARINC (Aeronautical Radio Inc) specication 629 [Air91] denestheaviation industry standards for transfer of digital data between avionics system elements using, in the MAC layer, a Carrier Sense Multiple Access Collision Avoidance (CSMA/CA) bidirectional protocol. Here we are concerned with the protocol called CP (Combined Mode Operations). This protocol manages periodic and aperiodic (urgent and non urgent) trac exchanges, by means of a bus cycle concept. Real-time and fault tolerance properties are claimed. The operations of this protocol are very complex (ve timers in each station are the kernel of the behaviour). Furthermore these operations are specied by means of a big extended state machine with which it is not easy to follow the dierent aspects of the behaviour and check the properties which are claimed. In order to put trust in this protocol, it is necessary to use formal description techniques which, on the one hand, allow easily to make modular specications and compositions of modules, and, on the other hand, oer means to verify and evaluate the properties. 1 The goal of this paper is precisely to show the interest of the Stochastic Timed Petri Nets model (STPN) [Ata94, JA91, JG95a, JG95b] for making such a study. The STPN model expresses basic mechanisms of distributed systems (parallelism, message exchange, synchronization, ressource sharing, priority,... ) and the time attribute for these mechanisms (stochastic distributions (without memory like exponential and with memory like uniform) and deterministic distributions). This study has been made in the context of a contract on the ARINC 629 MAC layer protocol study, between the laboratory LAAS-CNRS and the Aerospatiale Company [GBJ97]. This paper is divided into three sections : the rst section presents the protocol with its main characteristics, and its architecture. The second section is concerned by the formal modelling using the STPN model. The third section presents the main results which have been obtained about the real time and fault tolerance aspects. 2 ARINC 629 CP MAC layer protocol 2.1 Main mechanisms Bus cycle concept The bus cycle is managed by a station called leader (the other stations are non leader) and is divided into four areas. The rst three areas (still called levels) correpond respectively to the periodic trac (level 1), the urgent aperiodic traf- c (level 2) and the non-urgent aperiodic trac (level 3). The level 3 can still be divided into two sub-levels : level 3 backlog, for the non-urgent aperiodic trac which could not be sent in the previous bus cycle, and the level 3 new for new non-urgent aperiodictrac. A station can't transmit more than one message per level. The sending of one message is mandatory in the level 1. It is potential in the others levels. The leader station is the station which starts the cycle by sending the rst periodic message (beginning of level 1). The beginning of this rst periodic message will be the signal for the other (non leader) stations of the beginning of the new bus

2 cycle (this signal is called Concatenation Event (CE)). The fourth area of the bus cycle allows the synchronisation of the stations at the end of a cycle in order to dene a leader for the new bus cycle (the denition is made by election on local informations) Timers for the operations There are two types of timers : the type 1 concerns three timers which allow the stations to deal with the bus cycle. The behaviour of these timers is bound to the transmission activity on the bus (the information Bus Active (BA) and Bus Quiet (BQ) are fundamental) : { the timer TG (Terminal Gap) which controls the access to the bus in the levels 1, 2 and 3 (each station has a dierent value for TG we have the following relation : 8i j T G j >TG i + 2, being the maximum propagation time on the bus ), allows to specify a static priority scheme and then to implement the collision avoidance mechanism. As soon as we have the signal BA (beginning of a bus activity), the timer TG is reset and as soon as we have the signal BQ (end of a bus activity), the timer TG is running. The timer TG is also reset when the station enters in a new level of a bus cycle (i.e. when becomes elapsed). At the time when the timer TG becomes elapsed, the station can send a message on the bus (if it has not already sent a message in the level). { the timer (Aperiodic Synchronization Gap) which controls the level changes (each station has the same value for : > T G max ). As for the timer TG, as soon as we have the signal BA (BQ), the timer is reset (running). At the time when the becomes elapsed, the station changes level. { the timer (Periodic Synchronization Gap) which allows all the stations to synchronize themselves at the end of the bus cycle (each station has the same value for : = 5:). As for the timers TG and,assoonaswehave the signal BA (BQ), the timer is reset (running). When becomes elapsed, that means that there will be no more transmission in this bus cycle and then we enter the area for the election of a leader and the beginning of a new bus cycle. The type 2 concerns two timers which have the same value in all the stations and which specify the bounds of the bus cycle (constraints imposed by the stations to the different tracs) : { the timer (Transmit Interval) which denes the periodicity of the cycle. It is started at the beginning of the periodic transmission, and becomes elapsed either by a normal run-o or by a CE interruption (beginning of a new bus cycle). In a permanent normal behaviour, the of the leader goes to its normal end and then is restarted immediatly (new bus cycle). It is then the leader which imposes the periodicity of the cycle (). { the timer (Aperiodic Access Time Out) which denes the last instant in a bus cycle for an aperiodic transmission start (we have = ;(+ + MAL), MAL being the Maximum Allowed Length for a message). Figure 1 summarizes these denitions Leader election A station declares for leader when the three following local conditions are satised : is elapsed (there will be no more transmission in the bus cycle in progress), is elapsed (the period is achieved), TG is elapsed (the station has the right to access to the bus). In permanent normal behaviour, the leader does not change Initialization of a station on the bus The initialization is a transient behaviour from the station switch on to the introduction of the station in a bus cycle (i.e. emitting the rst periodic message (level 1)). At rst, a station starts and wants to get the information that the messages transmission of the stations already logged on is ended in the cycle in progress ( elapsed). Then the station starts and tries to introduce itself in the bus as non leader (waiting for a CE

3 Leader periodic transmission CE Station j periodic transmission 1 BUS CYCLE LOGICAL LINK CONTROL L1 TGi TGj L2 L3b L3n Transmitter Scheduler Transmitter TG elapsed = beginning of transmission elapsed = new level elapsed = no more aperiodic transmission elapsed = no more transmission in this cycle elapsed = end of cycle MEDIUM ACCESS CONTROL BA,BQ,BC Messages PHYSICAL LAYER Figure 1: Timers role and then, if CE is received, we will have the transfer in the level 1). In the case of an empty bus, there will not be a CE and then will becomes elapsed. At the time when becomes elapsed, TG is restarted and at the end of TG (TG elapsed) the station becomes leader, starts and its periodic transmission in level 1. Using TG when becomes elapsed allows to control the phenomenon of collision which can occur at the initialization if several stations want to come into the bus simultaneously (the stations have dierent TG). But we cannot avoid all the collisions with this mechanism (that depend on the dephasing between the stations at the switch on which can compensate the dierence between the TG of the stations). This protocol avoids collisions in the permanent behaviour but that we can have collisions in transient phases like the initialization. When a collision occurs, there is a signal Bus Clash (BC) which comes from the physical layer, sent to the MAC entity. The station cannot transmit any more message in this bus cycle, and a re-initialization procedure at the end of the bus cycle (i.e. after the condition elapsed) is started Exception situations Exception situations are caused by an overloading (the duration of the level 1 is greater than because of two long messages), timer drifts, ghost transmissions (for example the lightning induce noise signals), the failure of a station which participate to the bus cycle (deaf station and/or dumb station). 2.2 Architecture Figure 2: Link entity architecture The architecture of the link entity is represented on the gure 2. The medium access control is composed of two main modules : the transmitter scheduler and the transmitter. The transmitter scheduler is the kernel for the implementation of the CSMA/CA mechanism and the cycle bus concept (the signals BA, BQ and BC are basic). It implements the mechanisms for the initialization of a station on the bus (introduction of the station, after its switch on, in the bus), for the determination of the (leader-non leader) attribute and for commanding the transmitter to emit messages in the levels 1, 2 and 3 of the bus cycle (these messages contain the data from the Logical Link Control). The architecture of the transmitter scheduler is represented on the gure 3. It is based on two main modules : the \Timers module" which includes the timers TG,,, and the \Transmitter Control module" which includes the sub-modules initialization, attribute (leader-non leader) determination, levels 1, 2, 3, and a sub-module which memorizes the conditions (elapsed, not elapsed) of the timers, and the BC occurrences. We have also represented on the gure 3 the interactions which are essential for the behaviour of the transmitter scheduler (signals from the physical layer, signals between the timers and the transmitter control). 2.3 Example of scenario We now consider a cycle which is a part of a normal permanent behaviour. By making reference

4 MERS TG TG elapsed, TG not elapsed RECORD TG TRANSMITTER CONTROL TG ELAPSED Initialization (station switch on, after BC) Reset elapsed, not elapsed RECORD ELAPSED Attribute (leader nonleader) determination (permanent behaviour) Reset elapsed, not elapsed RECORD ELAPSED L1 level BC Mem CE, Start, Elapse elapsed, not elapsed Start, Elapse elapsed, not elapsed RECORD RECORD ELAPSED ELAPSED L2 level L3 backlog level L3 new level BA,BQ BA BQ BC Figure 3: Transmitter scheduler architecture BUS CYCLE ( ELAPSED) (LEADER) Start Start Reset Reset Reset Reset Reset i Leader TGl TGj j i TGj j TGk k TGl TGk k TGj j TGi TGj TGi TGj i Leader ( NOT ELAPSED) (NON LEADER) Stop Start Reset Reset Start Start Reset Reset Reset LEVEL 1 LEVEL 2 ( τ NEGLECTED) LEVEL 3 BACKLOG LEVEL WAIT WAIT FOR L3 NEW FOR LEADER ELAPSED Figure 4: Scenario of the normal behaviour

5 to only three stations i, j and k, we consider the following hypothesis : station i is leader but it has not the smallest TG (which is in the station j) station i transmits in the level 1 and 2 station j transmits in the levels 1, 2 and 3 backlog (that means that it had a message to send in level 3 new during the previous bus cycle which could not be sent) station k transmits in the levels 1 and 2 the three stations have nothing to send in the level 3 new. This scenario is represented on the gure 4 by neglecting the time propagation. We indicate, on the one hand, the actions which are undertaken ( t action) in the leader and a non leader, and, in the other hand, the timers games (an horizontal piece of line represents a timer when this piece of ligne ends with an arrow, that means that the timer goes to its end, otherwise there is a reset). We can see that the station i starts the bus cycle and will start the new bus cycle. Furthermore, we observe in the level 2 that it is the station j which sends the rst (because it has the smallest TG). 3 Modelling based on the STPN model 3.1 Methodology The STPN model, as all the Petri net models, allows incremental modelisation : at rst, we model the modules of an architecture (local modelling) with labeled timed Petri nets : { the labels associated to the transitions are of the form Predicates/Actions a Predicate can be a local condition and/or a message reception (?message) an Action can be a local action and/or a message sending (!message) a label can be Predicates/Actions, Predicates/ or /Actions { the time associated to the transition can be either a zero time, which denes immediate transitions (represented by a thin line), or dierent of zero which denes timed transitions (represented by a rectangle). second, we compose the models of the modules (global modelling) by considering the interaction between modules. A module transition which has the label!x is coupled with the transition(s) of all the module(s) which have the label?x. This coupling can be made either by transition merging (that is a synchronous composition which requires time attributes identical for the concerned transitions) or by shared places (that is the asynchronous composition which must be necessarily used if the time attributes of the transitions are dierent). This modelisation methodology has been used by considering the architecture presented in subsection 2.2. We only present here some module models : a timer (TG), the initialization, the attribute (leader-non leader) determination in the permanent behaviour, level L1, level L2. All the module models of the link entity as well as the physical link layer model are given in [GBJ97]. 3.2 Timer TG model The model is given in the gure 5. We have three places, P 1, P 2 and P 3,which represent the three states of the timer : reset, running, elapsed. Place P 1 (reset) is the initial state at the switching on. We gofromp 1 to P 2 as soon as there is a silence on the bus (?BQ). From P 2,wecome back top 1 as soon as there is an activity on the bus (?BA : that results of the activity of a station which has a smaller TG) or the reception of the scheduler message \" (this is the mechanism of recovery after a collision). From P 2 we go to P 3 at the end of the timer which gives right to the bus access (one time per level). From P 3 we gotop 1 either after the detection of a bus activity (?BA : that results of the activity either of this station (emission listening) or of the stations which have higher TG (reception listening)) or after a reception of the scheduler message \Reset TG" (this occurs after the silence which represents the end of the level ( elapsed) or the end of the cycle ( elapsed)). Note that the transitions t 1, t 2, t 3, t 5 and t 6 are immediate transitions (zero duration) and that transition t 4 is a timed transition (timer duration). 3.3 Initialization and attribute (leader-non leader) determination models These models are given on the gure 7 :

6 P11 Wait for TG elapsed (L1) TG reset TG elapsed P25 t19!start t2?bq P1 t1 P2?BA t3 TG running?!tg elapsed t4 t5?/ t6!tg not elapsed?ba/!tg not elapsed P3 TG elapsed Figure 5: Timer TG model P8 L1 Transmission?BQ t20 Wait for L2 access P14!!Reset P15 t21 P20 BC Mem P9 Wait for elapsed (afetr BC) L2 access t22 P22 elapsed Figure 6: Level 1 model on the left side, we have the initialization after the station switching on the ring sequences t 7 t 8 t 10, t 7 t 8 t 9 t 11 and t 7 t 8 t 9 t 15 represent the phases for the introduction in the cycle. In place P 7, the station can become leader (if TG becomes elapsed) by ring the transition t 11 (t 11 represents the decision of sending in the level 1 and the beginning of the transmission) or non leader (if?ba(ce)) by ring transition t 15 note that the station also can become non leader in the place P 6 by ring the transition t 10 (if?ba(ce)) on the middle, we have the initialization after a BC condition exept the condition BC Memory (BC Mem), we have, for the reintroduction in a cycle, identical scenarii to the initialization part (left side) on the right side, we have the attribute (leader-non leader) determination in a permanent behaviour. We nd, from the place P 13, identical scenarii to the ones from the place P 7. The transition t 7 is the only timed transition (it allows to specify the switching on time) of this model, the others are immediate the places in dotted lines are duplicated places. Note that places P 8 and P 11 are common places with the level 1 module model (see gure 6) : place P 8 notify a leader L1 access, place P 11 a non leader L1 access. 3.4 L1 and L2 levels models The L1 model is given at the gure 6 (the places P 11 and P 8 are places common with the model of the gure 7) : the transition t 19 represents the beginning of the transmission in level 1 (as non leader) the transition t 20 represents the end of the transmission (?BQ) and then the station is waiting for the level 2 access (place P 14 ), which occurs when is elapsed (place P 22 ) note that, if in the place P 8 (L1 transmission) a BC occurs (transition t 22 ), we go in the place P 9 (place common with the model represented on the gure 7) to try to recover and to re-introduce itself in the next bus cycle. The level 2 model is given on the gure 9 : the transitions t 23 and t 28 represent the non deterministic sending in this aperiodic level (we have associated a comment between parenthesis to these transitions) the transitions t 24 and t 25 represent respectively the beginning and the end (?BQ ) of the sending of a message in the place P 17 (L2 transmission), we can have a BC detection and we still come back to the model in the gure 7 the place P 21 and the transitions around (t 29 and t 30 ) allow to represent the fact that for being able to send in an aperiodic level, we need not elapsed (if we have elapsed we come back to the model of the gure 7) note that an aperiodic transmission can't be interrupted if becomes elapsed during the transmission (no transition testing P 21 from P 17 ). Finally the transition t 26 represents the access to the level 3 backlog. 3.5 Physical layer model We represent an abstract view of the physical layer which allows us to easily represent the signals BA, BQ and BC.

7 Initialization (station switching on) Initialization (after BC) Attribute (leader non-leader) determination Idle P4 t7 Wait for elapsed (initialization) P5 Wait for elapsed (after BC) P9 Wait for elapsed (permanent behaviour) P12! t9!start!elapse Wait for introduction in the cycle P6 elapsed P23 Wait for L1 P7 access type (initialization, after BC) t8! P20 t13 t15 elapsed BC Mem P24?BA (CE) /!Start!Reset!Reset (non leader) t10 P11 P10 t12! Wait for re-introduction in the cycle t14?ba (CE) /!Start!Elapse!Reset!Reset (non leader)?ba (CE) /!Start!Elapse!Reset!Reset (non leader) Wait for TG elapsed (L1) P13 t17! t16 Wait for L1 access type (permanent behaviour)?ba (CE) /!Start!Elapse!Reset!Reset (non leader) TG elapsed P25 t11!start!start!reset!reset P8 elapsed P23 TG elapsed t18 P25!Start!Start!Reset!Reset L1 Transmission Figure 7: Initialization and (attribute leader non-leader) determination models L2 access P15 (wants to transmit) t23 P20 t43!ba!bq t41 t45!bc t46!bq!bq t42 P22 P24 P25 t44!ba Figure 8: Physical layer model : BA, BQ, BC generation P21 t29 P17 L2 Transmission elapsed P16 t24 t25 Wait for L3b access t30 P12!!Reset Wait for elapsed (permanent behaviour) Wait for TG elapsed (L2) TG elapsed?bq t26 P19 L3b access P22 P25 P18 t27 elapsed (does not want to transmit) BC Mem P9 P20 t28 Wait for elapsed (after BC) Figure 9: Level 2 model

8 (initialization) Station 1 leader 1 Emission to station j Reception from station j * L1 emission start (station 1) * CE for station 2 1 elapsed 2 13 Listening Emission Listening Emission Listening Listening L1 emission end (station 1) TG2 elapsed Bus Junction (emission start, during emission) (Start) (emission end) (end) (reception start, (reception end) during reception) P20 P21 P22 P23 P24 P25 t32 t31 t35 t34 t40 t TG2 elapsed elapsed P26 P27 P31 t from station j P30 Bus t33 t39 P28 to station j P29 t36 Figure 10: Physical layer model : Transmission and listening L1 emission start (station 2) L1 emission end (station 2) elapsed (L1->L2 station 2) 2 elapsed 9 1 elapsed (L1->L2 station 1) STES 1->7 : LEVEL 1 STES 7->9 : LEVEL 1 -> LEVEL 2 (empty) STES 9 ->1 : WAIT FOR NEW BUS CYCLE Figure 11: Bus cycle and level 1 Two ideas are the foundation of the modelling : we consider, from a station, as many connections as there are receiver stations (this consideration obviously gives big size models) we furthermore model the message transmission by representing explicitely the start and the end of the transmission (this consideration still increases the size of the model). The model of the physical layer abstract view is given on the gures 10 and 8 (we model a station i and the transmission with the station j (sending to j, receiving from j)) : the gure 10 represents the transmission on the bus junction (there is a cable between the station and the bus), the bus and the listening aspects the gure 8 represents the generation of the signals BA, BQ and BC. 4 Simulations and analysis All the results, which are presented, are obtained from a randomized state graph (which represents the dynamic behaviour of the global STPN model [JG95a]) and by considering qualitative abstract views on this randomized state graph (with respect to relevant events which depend on the considered point of view). We consider for the timers and the message lengths values which are values of the value range specied in [GBJ97]. 4.1 Normal behaviour We consider two stations : station 1 and station 2. The station 1 is supposed to become leader after the initialization phase. Bus cycle and level 1 (gure 11) : here the level 1 only appears (because we have conditions such that the level 2 is empty andwehave no time for the level 3). We verify : the cycle bus phenomenon with always the station 1 as leader (station which detects the rst the condition \, TG and elapsed") the mandatory sendinginthelevel 1 (after TG elapsed) the interlevel synchronization ( elapsed). Bus cycle and levels 1 and 2 (gure 13) : in addition to mechanisms already seen on the gure 11, we visualize the potentiality of sending in the level Exception situations overload situation (gure 12) : we consider three stations the station 1 is the leader, but the station 2 has the smallest TG. The overload situation occurs because of a too long level 1 (due to the message lengths, the timer of a station times out

9 (initialization) (initialization) 1 L1 leader emission (station 1) 2 TG2 elapsed 3 L1 non-leader emission (station 2) 4 TG3 elapsed L1 non-leader emission (station 3) 5 L1 non-leader emission start (station 3) 6 16 L1 non-leader emission (station 1) L1 leader emission (station 2) 13 TG2 elapsed 12 1 elapsed => overload station 1 2 elapsed 7 10 L1 non-leader emission end (station 3) 3 elapsed elapsed => overload station Figure 12: Overload TG3 elapsed 1 elapsed L2 emission (station 1) L2 emission (station 2) 1 elapsed Station 1 wants to transmit in level Station 2 wants to 4 Station 2 doesn t wants transmit in level 2 to transmit in level Station 1 does not want to transmit in level 2 (1 and 2 elapsed 1 and 2 elapsed TG1 and TG2 elapsed) 1 L1 emission (station 1) 2 L1 emission (station 2) 3 Station 1 does not want to transmit in level elapsed 1 elapsed elapsed Station 1 wants to transmit in level (1 and 2 elapsed 1 and 2 elapsed TG1 and TG2 elapsed) Figure 13: Bus cycle and levels 1 and 2 L2 emission (station 1) before the timers and TG (this TG is the TG which is restarted at the end of the ), and then the bus cycle periodicity is lost). Here the stations 1 and 2 are overloaded (transitions C 6! C 7 and C 8! C 9 ). The station 3 is not aware of this situation. By consequence, the permanent behaviour is broken and we can haveachange of leader (on the gure 12, the station 2 now becomes leader : transition C 13! C 14 ). Failure and reparation (gure 14) : we consider three stations the station 2, which is leader, fails (transition C 4! C 5 ). After the failure and during the reparation of the station 2, the station 1 becomes leader (transition C 5! C 6 ). Then the station 2 (after the reparation) introduces itself on the bus (but now as non leader) and we have a new permanent behaviour with the station 1 as leader (note that we have represented a (failure-reparation) cycle for the station 2). ghost transmissions (gure 15) : we consider two stations (the station 1 is leader) and the occurrence of three ghost transmissions (class C 5 to class C 9 class C 11 to class C 14 class C 17 to class C 20 ). The rst ghost transmission (when it appears) is considered as a CE by the stations 1 and 2 (transitions C 6! C 7 and C 7! C 8 ). Then the ghost transmission is the leader (!) which induces the station 1 to transmit as non leader (transition C 10! C 11 ). During the transmission of the station 1, we have the occurrence of a second ghost transmission, which induces a BC on the station 1. Finally, after a third ghost transmission and a consequent BC with the station 2, the system will recover its permanent behaviour (classes C 24, C 25 and C 26 ). General comment : whatever the exceptional situation may be, the system resynchronizes itself in two steps : at rst, at the end of the (nobody can transmit in the current bus cycle), and second, at the end of the TG. If the leader was implicated in the exceptional situation, we can have a leader change (only if the leader, before the exceptional situation, had not the smallest TG). In any case, werecover a leader and westart again a new permanent behaviour. 4.3 Remark We don't present in this paper any quantitative evaluation because of the temporal specications

10 1 Station 2 L1 emission (initialization) 2 3 Station 3 L1 emission Station 2 failure Station 3 L1 emission Station 2 L1 emission Station 3 L1 emission Station 2 L1 emission Station 2 initialization (after reparation) Station 3 L1 emission Figure 14: Failure and reparation (initialization) 1 2 Station 2 L1 emission elapsed 1 elapsed Ghost transmission start CE (station 1) CE (station 2) Ghost transmission end Station 2 L1 emission 16 TG2 elapsed 17 Ghost transmission start BC station 2 => stop L1 emission 14 Ghost transmission end 19 Ghost transmission end BC station 1 => stop L1 emission 2 elapsed Ghost transmission start Figure 15: Ghost transmissions elapsed 1 elapsed 1 elapsed Station 1 L1 emission Station 2 L1 emission condentiality. But it can be said that, for all the studied temporal specications, an exception situation never induces perturbation during more than one bus cycle. This bus cycle duration depends on the exception situation, but never lasts more then 2. In a normal behaviour, the bus cycle has a duration exactly equal to. 5 Conclusion The study presented in this paper has rst shown the interest of the Stochastic Timed Petri Nets for modelling a protocol with many time constraints. Second, this study has demontrated the good properties of the 629 CP ARINC protocol : real-time properties (managing periodic and aperiodic tracs) and fault tolerance properties (natural recovering after exceptional situations). References [Air91] Airlines Electronic Engineering Comittee. Multi-Transmitter Data Bus. AR- INC Specication : Part 1, Technical Description, Aeronautical Radio Inc. edition, october [Ata94] Y. Atamna. Reseaux de Petri Temporises Stochastiques Classiques et Bien Formes : Denition, Analyse et Application aux Systemes Distribues Temps Reel. PhD thesis, Universite Paul Sabatier de Toulouse (FRANCE), october [GBJ97] L. Gallon, I. Blum, and G. Juanole. Modelisation par Reseaux de Petri Temporises Stochastiques et Analyse du protocole ARINC 629 CP : rapports 1, 2, 3, 4 et 5. Technical Report 96144, 96328, 96411, 96427, 97022, LAAS-CNRS, may [JA91] G. Juanole and Y. Atamna. Dealing with Arbitrary Time Distributions with the Stochastic Timed Petri Net Model. Application to Queueing Systems. In PNPM'91, the Fourth International Workshop on Petri Nets and Performance Models, pages 32{43, Melbourne, Australia, December [JG95a] G. Juanole and L. Gallon. Critical Time Distributed Systems : Qualitative and Quantitative Analysis based on Stochastic Timed Petri Nets. In FORTE'95, the 8 th International IFIP Conference on Formal Description Techniques for Distributed Systems and Communication Protocols, Montreal, Canada, october [JG95b] G. Juanole and L. Gallon. Formal Modelling and Analysis of a Critical Time Communication Protocol. In WFCS'95, IEEE International Worshop on Factory Communication Systems, Lausanne, Switzerland, october 1995.