SAE AS 6802-2011 技术报告：自愿出版与版权声明

需积分: 10 146 浏览量更新于2024-07-14 收藏 879KB PDF 举报

SAE AS 6802-2011 是一份由美国汽车工程师学会 (SAE) 发布的技术报告，该报告旨在推动工程和技术科学领域的进步。这份文档并非强制性执行的标准，而是用户自愿采纳的参考材料。报告的应用范围和在特定场景中的适用性，包括由此可能产生的专利侵权问题，完全由使用者自行负责。SAE强调，每五年至少对技术报告进行一次审查，可能包含重审、更新或撤销的操作，以便确保其持续的有效性和准确性。报告的版权归SAE International所有，未经事先书面许可，任何形式的复制、存储、检索、传输，无论是电子方式（如扫描、网络下载）还是机械手段（如复印），都必须得到SAE的明确授权。对于想获取文档的读者，可以通过多种途径联系SAE，如拨打美国国内的877-606-7323，国际长途则为+1724-776-4970，或者通过传真724-776-0790，电子邮件至CustomerService@sae.org。SAE的官方网站也为用户提供服务，网址是http://www.sae.org。 SAE作为全球知名的工程技术组织，重视知识产权保护，同时欢迎用户对报告提出书面的意见和建议，以促进技术发展和知识共享。购买或获取文档时，需遵循严格的版权规定，确保合规操作。这份报告在汽车工程、机械设计以及其他相关领域具有重要的参考价值，它可能包含先进的工程实践、设计原则、测试方法等专业知识，对从事这些行业的专业人士和研究人员来说是一份宝贵的资源。

SAE AS6802 Page 16 of 108

b. Calculation of the permanence point in time: The application of the transparent clock mechanism makes it possible to

reestablish PCF order and relative timing with high accuracy.

1. Calculate the worst case delay offline.

2. Upon reception of the PCF, delay each PCF for worst case delay minus dynamic delay, where the dynamic delay

is added to the PCF as it flows through the communication channel. The point in time at the worst case delay

minus dynamic delay, after the reception point in time, is the permanence point in time.

The message dispatch order is extremely important for fault-tolerant algorithms, particularly fault-tolerant synchronization

algorithms. Any fault-masking synchronization protocol that ensures synchronization of local clocks in a distributed

computer network requires a reestablished PCF dispatch order.

In addition to reestablishment of the dispatch order of PCFs, the permanence point in time is also used for remote clock

reading during synchronized operation, as depicted in Figure 8. In this example, the clock of the generator of a PCF is

slower than the clock of the consumer of the PCF. At the dispatch point in time of the PCF, the local clock in the

consumer is already 5 s ahead of the generator. This example assumes the following static configuration:

a. A precision (worst-case offset between any two correct local clocks in the system) of 10 s.

b. A scheduled point in time, given by the worst-case transmission delay (max_transmission_delay), of 50 s.

c. A scheduled window, which is statically defined as a ± precision window around the scheduled point in time.

Next, instead of directly calculating the clock difference, the following dynamic computations will be executed upon receipt

of the PCF:

a. The consumer calculates the permanence delay (8 s).

b. At 8 s after the reception of the PCF, the permanence point in time of the respective message is generated.

c. The difference between this permanence point in time and the scheduled point in time equals the clock difference

value.

The benefit of this approach is the independent size of the scheduled window from the transmission delays in the

network, which only depends on the precision in the system. Also, in the case of multiple PCF generators, the

permanence function allows for clock difference values, which measure in increasing order, simplifying further fault-

tolerant calculations.

The permanence function constitutes an algorithmic interface to the clock synchronization algorithm. The single network-

dependent configuration parameter is the max_transmission_delay, which defines the position of the receive window in

time.

SAE AS6802 Page 18 of 108

A B C D E FCorrect I/O

Fail-Silence I/O A B

Fail-Omission I/O

A C F

Fail-Arbitrary I/O X Y C K L

Real-Time

FIGURE 9 - FAILURE MODES OVERVIEW

FAIL-SILENCE FAILURE MODE: A device fails silently, when it simply stops producing output.

FAIL-OMISSION FAILURE MODE: In contrast to the fail-silence failure mode, a device that fails in fail-omission failure

mode will fail to send and/or receive an arbitrary number of frames.

FAIL-INCONSISTENT FAILURE MODE: This failure mode impacts transmissions from a single sender to multiple

receivers. Fail-inconsistent means the sender fails in such a way that different receivers perceive the message differently.

For example, one receiver may qualify the message as correct while another one qualifies the message as incorrect

FAIL-INCONSISTENT-OMISSION FAILURE MODE: This mode is a combination of the fail-inconsistent and fail-omission

failure modes. A faulty device can arbitrarily classify a subset of received messages as correct, while classifying the

remaining messages (potentially correct) as incorrect. The faulty device can also arbitrarily select message

communication port destinations.

FAIL-ARBITRARY FAILURE MODE: A device that fails arbitrarily can generate messages with random contents at

arbitrary points in time. Furthermore, the fail-arbitrary device may send its messages on an arbitrary selection of outputs.

3.3.2 Failure Hypothesis

Time-Triggered Ethernet has been designed to support single-failure and dual-failure hypotheses.

SINGLE-FAILURE HYPOTHESIS: Under the single-failure hypothesis, Time-Triggered Ethernet is intended to tolerate

either the fail-arbitrary failure of an end system or the fail-inconsistent-omission failure of a switch. The switches in Time-

Triggered Ethernet network can be configured to execute a central bus guardian function. The central bus guardian

function ensures that even if a set of end systems becomes arbitrarily faulty, it masks the system-wide impact of these

faulty end systems by transforming the fail-arbitrary failure mode into an inconsistent-omission failure mode. The

arbitrarily faulty failure mode also includes babbling-idiot behavior. Time-Triggered Ethernet switches establish fault-

containment boundaries.

DUAL-FAILURE HYPOTHESIS: Under the dual-failure hypothesis, Time-Triggered Ethernet networks are intended to

tolerate two fail-inconsistent-omission faulty devices. These devices may be two end systems, two switches, or an end

system and a switch. The last failure scenario (i.e., end system and switch failure) means that Time-Triggered Ethernet

network tolerates an inconsistent communication path between end systems. This failure mode is one of the most difficult

to overcome.

Time-Triggered Ethernet allows a more cost-efficient realization of system architectures, requiring the tolerance of

multiple concurrent failures in the system. For example, a system architecture that consists of only two independent

communication channels can tolerate an inconsistent failure mode. Previous realizations of communication architectures

that tolerated this failure mode required at least three independent communication channels.

SAE AS6802 Page 19 of 108

ARBITRARY DISTURBANCES: Time-Triggered Ethernet networks are intended to tolerate transient disturbances, even

in the presence of permanent failures. Under both single- and dual-failure hypothesis, Time-Triggered Ethernet provides

self-stabilization properties. Self-stabilization means that synchronization can reestablish itself, even after a transient

upset in a multitude of devices in the distributed computer network. Time-Triggered Ethernet networks stabilize from an

arbitrary to a synchronized system state. This is of particular importance in synchronous systems to solve the "clique

problem". Cliques are formations of subsets of Time-Triggered Ethernet devices, such that the devices are synchronized

within the subset, but not over subset boundaries. Each such subset is called a clique.

The single-failure hypothesis, dual-failure hypothesis, and tolerance against arbitrary disturbances define the basic fault-

tolerance concept in a Time-Triggered Ethernet network. In addition to this basic fault-tolerance concept, the system-of-

system features as discussed in the next section and in Chapter 10 can contribute to an even higher level of fault

tolerance. This system-of-systems approach supports system-level fault-tolerance: the overall failure or power-down of a

Time-Triggered Ethernet-based system can be mitigated by other redundant Time-Triggered Ethernet-based systems.

When different Time-Triggered Ethernet-based systems are up and running, Time-Triggered Ethernet also specifies an

algorithm for system-of-system synchronization.

The design of fault-tolerant, real-time distributed algorithms is notoriously difficult and prone to error. The combination of

faults, interleaving concurrent events, and variations in real-time durations leads to a case or system state explosion that

adversely challenges designers. Consequently, the development of Time-Triggered Ethernet fault-tolerant algorithms

included formal methods for proving the correctness of the algorithms.

3.4 System-of-Systems Support

Time-Triggered Ethernet provides native support to system-of-systems communication by implementing synchronization

priorities and synchronization domains.

3.4.1 Synchronization Domains

Synchronization domains within a Time-Triggered Ethernet network specify independent Time-Triggered Ethernet

systems with respect to their synchronization. Hence, two components belonging to different synchronization domains in

one Time-Triggered Ethernet network will never synchronize their local clocks to each other. Communication between two

components of different synchronization domains is only possible with non-time-triggered traffic classes, e.g., rate-

constrained or best-effort traffic. Still, a frame that is communicated within a synchronization domain as time-triggered

may be forwarded as non-time-triggered when it crosses a synchronization domain boundary.

3.4.2 Synchronization Priorities

There may be several synchronization priorities within a synchronization domain, and each Time-Triggered Ethernet

device belongs to exactly one synchronization priority (see Chapter 10).

3.5 Normative Description

3.5.1 Dataflow Requirements

A Time-Triggered Ethernet device shall provide the following traffic classes, at a minimum:

a. Protocol control frames

b. Time-triggered traffic

A Time-Triggered Ethernet device should assign the traffic class priorities in the following order (from high to low):

Protocol control frames

Time-triggered traffic

Rate-constrained traffic, if implemented

Best-effort traffic, if implemented

SAE AS6802 Page 20 of 108

NOTE: More priorities can be implemented as necessary. The use of traffic classes with priorities higher than that of the

protocol control frame can have a significant impact on the delay of the protocol control frames in the system. See

Chapter 11 for calculation of the bounds.

The worst-case queueing delay as introduced by dataflow of higher priority than PCFs shall be bounded.

NOTE: These bounds cover the worst-case scenario. Further guidance for calculating these bounds can be found in

Chapter 11 (shuffle delay, maximum shuffle delay).

A Time-Triggered Ethernet device shall implement a non-preemptive dataflow integration algorithm.

NOTE: A Time-Triggered Ethernet device may also implement a preemptive dataflow integration algorithm. A preemptive

dataflow integration algorithm has side effects to be considered. For example, when a frame with high priority is to

be transmitted on a given communication link, a preemptive dataflow algorithm will truncate the ongoing

transmission of a frame with low priority. As a result, the receiver has to anticipate the reception of truncated

frames. It is possible that the truncation of a frame results in a valid Ethernet frame whose CRC matches its

contents.

A Time-Triggered Ethernet device that implements both preemptive and non-preemptive integration algorithms shall

provide a configurable parameter, specifying which algorithm the component will use during operation.

Mechanisms to ensure partitioned access to shared resources (e.g., frame memory) shall be implemented.

NOTE: Guidelines for implementation of these partitioning mechanisms are out of scope of this document and are

defined for example in ARINC 653.

3.5.2 Failure Hypothesis Requirements

In a Time-Triggered Ethernet cluster configured to tolerate a single faulty component, either a synchronization master or a

compression master, documentation shall be provided that argues that the failure behavior of all compression masters

and all switches is fail-silence or fail-inconsistent-omission.

NOTE: One way to achieve an inconsistent-omission failure mode is a high-integrity design, see Appendix B.

NOTE: At the time of the writing of this standard document, ongoing research is concerned with extending the algorithms

defined in this document in a way that the requirement of an inconsistent-omission failure mode for certain Time-

Triggered Ethernet devices can be removed. These extensions are intended to be incorporated in upcoming

releases of this standard.

In a Time-Triggered Ethernet cluster configured to tolerate a single faulty component, either a synchronization master or a

compression master, documentation shall be provided that the failure behavior of all synchronization masters is fail-

silence, fail-inconsistent-omission, or fail-arbitrary.

In a Time-Triggered Ethernet cluster configured to tolerate multiple faulty components, documentation shall be provided

that the failure behavior of any compression masters, synchronization masters, and switches is fail-silence or fail-

inconsistent-omission.

NOTE: One way to satisfy an inconsistent-omission failure mode is to use a high-integrity design, see Appendix B.

NOTE: The inconsistent-omission failure behavior is NOT satisfied by a posteriori notification of a faulty transmission. All

Ethernet frames that are output from a high-integrity Time-Triggered Ethernet device are either correct or

detectably faulty within the receiving Time-Triggered Ethernet device.

A Time-Triggered Ethernet device that is able to relay time-triggered traffic shall be configurable to accept a time-

triggered-transferred frame only when the transfer is received within a defined acceptance window.

NOTE: This mechanism is depicted in Figure 5. The acceptance window is opened and closed at a point in time derived

from the synchronized timebase. The length of this acceptance window is configurable.

剩余107页未读，继续阅读

tianmen431906

粉丝: 4
资源: 71

SAE AS 6802-2011 技术报告：自愿出版与版权声明

SAEAS6802-2011

SAE AS6802 Time-Triggered Ethernet.pdf

SAE AS6802协议标准下载

"TLIN2021A-Q1.pdf：符合汽车应用标准的故障保护 LIN 收发器

SAE J1939-21.pdf

sae j2012_da.pdf

sae-as-5643a-2006

sae j1979-da

sae j2716-2010下载

sae j1979-da下载

最新资源