A scheduling method of a hybrid priority scheduling architecture for an AFDX network

Abstract

The application discloses a hybrid priority scheduling architecture for AFDX network, which is composed of a plurality of end systems and at least one AFDX switch, wherein the end systems are connected with the switch through full-duplex Ethernet links; the end system is configured with a plurality of virtual links, and each virtual link is previously determined with a forwarding path and resource constraints in a configuration phase. The scheduling method includes time triggering on the end system side, gating on the switch side and joint scheduling. The application achieves better comprehensive performance in predictability, fairness and robustness on the premise of meeting the SCT delay constraint, and has better three-dimensional trade-off compared with SP and WRR.

Description

Technical Field

[0001] This invention relates primarily to the field of aviation communication technology, and in particular to a scheduling method for a hybrid priority scheduling architecture for AFDX networks. Background Technology

[0002] Avionics systems on civil aircraft are evolving towards higher integration, higher bandwidth, and higher reliability. Traditional low-speed buses such as ARINC 429 and CAN are no longer sufficient to meet the demands of large-scale data interaction in complex mission scenarios. As an avionics evolution solution based on Ethernet technology, Avionics Full-Duplex Switched Ethernet (AFDX) provides deterministic bandwidth and end-to-end latency guarantees for avionics systems through virtual links (VL), bandwidth allocation gaps (BAG), maximum frame size (MFS), and redundant link mechanisms. It has been widely used in various domestic and international civil aircraft.

[0003] Although AFDX provides deterministic guarantees for data transmission through virtual links, the business models and requirements of avionics systems are still evolving rapidly, bringing new challenges to data flow scheduling within AFDX. Current airborne networks are generally in a hybrid mode where multiple architectures coexist: in addition to AFDX, traditional low-speed buses are still retained for I / O processing and some dedicated areas. This hybrid architecture increases the difficulty of airborne network design and maintenance and also restricts the expansion of airborne network functions. Facing the trend towards a single high-speed avionics communication architecture, the expanded AFDX gradually carries control commands, monitoring data, and information service services originally transmitted by buses such as ARINC429 and CAN. The number of data flows in the network has increased significantly, and the service criticality also exhibits a clear "hybrid criticality" characteristic. Based on the importance of business data flows, they can be divided into the following categories: Safety-Critical Traffic (SCT) is extremely sensitive to latency upper bounds and jitter; Mission-Critical Traffic (MCT) requires good real-time performance and bandwidth assurance; Best-Effort Mission Traffic (BEMT) aims to achieve a certain level of latency and throughput while ensuring mission completion; Best-Effort Traffic (BET) mainly focuses on bandwidth utilization and overall throughput, and usually has no latency requirements.

[0004] Currently, AFDX switches and end systems generally employ non-preemptive static priority (SP) scheduling: each output port has multiple queues set up according to priority from high to low, and during scheduling, data frames at the header of the highest priority queue are always sent first. This mechanism is simple to implement and friendly to high-priority flows, but it faces the following problems in mixed criticality scenarios: 1. In sudden high load scenarios, high-priority SCT / MCT flows may occupy the link for a long time, while medium and low-priority BEMT / BET flows are severely squeezed or even "starved" and cannot obtain a reasonable share of service, resulting in insufficient fairness. 2. Although the SCT stream has the highest priority, its service relies entirely on queue contention. Its worst-case latency upper bound and latency jitter are greatly affected by the arrival patterns of other streams, making it difficult to meet the requirements of the next generation of avionics for "strong predictability". 3. Once the number of VLs, traffic configuration, or sudden load changes, the existing scheduling algorithm is difficult to balance predictability and fairness, and there may be situations where data flow exceeds the latency limit, resulting in insufficient robustness.

[0005] To address the aforementioned issues, academia and industry have proposed various improved scheduling and shaping schemes. For example, under an event-triggered framework, weighted round-robin (WRR), credit-based shaper (CBS), and burst-limiting shaper (BLS) are introduced to improve the service fairness of low- and medium-priority services. Under a time-triggered framework, time-triggered Ethernet (TTE) and time-aware shaper (TAS) are adopted to enhance the latency determinism of high-priority services. However, from the perspective of the overall requirement for the coexistence of mixed critical services in the extended AFDX network, existing solutions still have two prominent shortcomings: First, most work only focuses on local optimization of one or a few dimensions of predictability, fairness, and robustness, lacking a unified evaluation framework and a systematic parameter configuration method, making it difficult to conduct quantifiable and balanced comprehensive design among the three in engineering practice; Second, some time-triggered solutions rely on global high-precision clock synchronization and strict time slot configuration, requiring the construction of a unified time base across the entire machine and its long-term synchronization, which is inherently incompatible with the existing asynchronous scheduling characteristics of AFDX and the architectural foundation of the deployed system. Summary of the Invention

[0006] In view of the above-mentioned deficiencies of the prior art, the technical problem to be solved by the present invention includes: How can we design a scheduling mechanism suitable for mixed-criticality scenarios while keeping the AFDX asynchronous architecture and virtual link traffic constraints unchanged, and comprehensively optimize the performance in terms of predictability, fairness and robustness without relying on a global high-precision clock?

[0007] To achieve the above objectives, the present invention provides a hybrid priority scheduling architecture for AFDX networks, comprising several end systems and at least one AFDX switch. The end systems are connected to the switch via full-duplex Ethernet links. Each end system is configured with multiple virtual links, and the forwarding path and resource constraints of each virtual link are pre-determined during the configuration phase.

[0008] Furthermore, the configuration file of the virtual link contains at least two key parameters: bandwidth allocation interval and maximum frame length. The bandwidth allocation interval is used to limit the minimum time interval between two consecutive allowed transmissions of the virtual link, thereby constraining the average transmission rate of the service over time. The maximum frame length is used to limit the maximum length of a single message on the virtual link. Combined with the link rate, the time cost required to send one frame in the worst case can be calculated.

[0009] Furthermore, the virtual link is divided into four categories: safety-critical services, mission-critical services, mission-related services, and best-effort services. The safety-critical services carry safety-related information such as flight control and are extremely sensitive to end-to-end latency upper bounds and jitter. The mission-critical services carry mission execution-related data and have high requirements for real-time performance and bandwidth assurance. The mission-related services are usually related to the mission but have relatively relaxed time limits. The best-effort services are not sensitive to latency and focus more on bandwidth utilization and overall throughput.

[0010] A scheduling method based on the aforementioned hybrid priority scheduling architecture for AFDX networks includes end-system-side time triggering, switch-side gating, and joint scheduling.

[0011] Furthermore, the end-system-side time triggering involves introducing a time-triggered sending module and a local time schedule to periodically window-based send control of virtual links for safety-critical services, thereby reducing time competition between safety-critical services and other services from the source.

[0012] Furthermore, the end-system-side time triggering specifically involves, during the engineering configuration phase, reading the configuration parameters of all safety-critical service virtual links on the end system using a configuration tool, including the bandwidth allocation interval, maximum frame length, and optional end-to-end latency budget for each safety-critical service virtual link; using the greatest common divisor of the bandwidth allocation intervals of the safety-critical service virtual links as the basic period; using the least common multiple of the bandwidth allocation intervals of the safety-critical service virtual links as the matrix period; and when determining the window length, calculating the time required to send a single frame based on the maximum frame length and port rate of each virtual link, using this time as the lower bound of the window length, and adding a certain time margin on this basis to absorb local clock errors and software processing overhead.

[0013] Furthermore, the switch-side gating specifically involves setting up four independent FIFO queues on each output port, corresponding to security-critical services, mission-critical services, mission-related services, and best-effort services, respectively; and configuring a gating period and a security-critical service gating time window on each output port. When a switch receives an AFDX message, it parses the message header, extracts the virtual link identifier, looks up the service category and target output port corresponding to the virtual link in the local configuration table, and inserts the message into the corresponding queue of the output port. The gating period is selected to be the same as or an integer multiple of the period of the end system matrix. The output port internally maintains the local clock and the start time of the current gating period, and calculates the relative position of the current time within the gating period. Based on the pre-configured gating time window, when the current time falls within the range of a certain security-critical business window, the gating logic marks the security-critical business queue as eligible for scheduling; when the current time is not within any security-critical business window, the gating logic temporarily blocks the security-critical business queue, and does not participate in scheduling even if there are messages in the queue.

[0014] Furthermore, the switch-side gating also includes a burst-limiting shaping mechanism introduced at the output port for mission-critical services. This mechanism maintains a credit value and corresponding upper and lower threshold parameters for each mission-critical service queue at each output port, while configuring a time-related credit change rate. When a port repeatedly selects a mission-critical service queue to send packets within a certain time period, the credit value is gradually adjusted upwards according to a preset rule based on the transmission duration. When a port does not select a mission-critical service queue for a certain period, but instead sends other types of packets or remains idle, the credit value is adjusted downwards according to a preset recovery rate. When the credit value reaches or exceeds the upper threshold, it indicates that the mission-critical service is consuming a large amount of bandwidth recently, and the shaping module temporarily adjusts the mission-critical service queue from a higher priority to a lower priority, allowing mission-related service queues to obtain more service opportunities. When the credit value drops below the lower threshold, it indicates that the mission-critical service is underserved for a period of time, and the shaping module restores its priority to a higher level to ensure its average bandwidth and latency constraints.

[0015] Furthermore, the joint scheduling involves, on each switch output port, employing a hierarchical control logic based on the queue structure of security-critical services, task-critical services, task-related services, and best-effort services, gating configuration, and burst restriction shaping mechanism credit status maintenance. This logic employs a time window determination followed by asynchronous scheduling within the window. The output port maintains its local clock and the starting time of the gating cycle. When a scheduling trigger event occurs, the relative time within the gating cycle is first calculated based on the difference between the current time and the starting time of the gating cycle. Based on this, it is determined whether the port is currently within the security-critical service gating window or outside the asynchronous scheduling interval.

[0016] Furthermore, the joint scheduling also includes the following: when it is determined that the current time falls within the security-critical business gating window, the gating logic opens the security-critical business channel and closes other business channels, allowing only the security-critical business queue to participate in this round of dequeueing; when it is determined that the current time is not within the security-critical business gating window, that is, in the asynchronous window scheduling stage, the gating logic closes the security-critical business queue, and security-critical business messages do not participate in dequeueing during this period.

[0017] Compared with existing technical solutions, the technical advantages of the present invention are as follows: Existing AFDX technology employs non-preemptive SP scheduling. Although SCT has the highest priority, it is still blocked at the output port by the first frame of the previous frame's MCT / BEMT / BET queue. End-to-end worst-case latency and jitter are affected by other flow behavior, leading to insufficient predictability. This invention introduces a time-triggered mechanism at the end system and switch output ports to plan periodic transmission / forwarding windows for SCT. Through local timetables and gating windows, service opportunities are reserved for SCT in terms of timing, avoiding competition between SCT and other data flow types. The upper bounds of SCT's worst-case latency and jitter are significantly tightened, improving the predictability of the AFDX scheduling algorithm.

[0018] In traditional SP scheduling, when SCT / MCT load is high, low-priority flows, especially BEMT, often experience prolonged periods of unserved traffic, exhibiting a typical "starvation" phenomenon. This results in a severe imbalance in resource allocation based on service importance, leading to insufficient fairness. This invention introduces BLS (Browser Rank Indexing) at the output port of the MCT, dynamically adjusting the MCT's priority state to periodically provide service to BEMT, while maintaining SCT latency constraints. This significantly improves the service share of BEMT and BET without sacrificing the average latency constraints of the MCT, alleviating the starvation problem and significantly improving fairness.

[0019] Many existing time-triggered solutions (TTE, TAS, etc.) rely on a globally high-precision clock and strict time slot alignment, requiring the construction of a unified time base across the entire system and its long-term synchronization. This is incompatible with the existing asynchronous scheduling characteristics and deployed system architecture of AFDX, making it difficult to directly introduce as an incremental solution into existing AFDX networks. This invention proposes a time-triggered gating design based on a local clock and a weak synchronization mechanism. It does not require globally high-precision synchronization, relying only on port-local periodic counting and periodic alignment to control clock deviation within a calculable and safe range. Time-triggered windows can be deployed without introducing a system-wide time synchronization mechanism. The engineering modifications are limited to the end system and the internal control logic of the switch, maintaining good compatibility with the existing AFDX protocol stack and hardware architecture, while ensuring a calculable safety margin in the timing design. Attached Figure Description

[0020] Figure 1 This is a schematic diagram of the architecture of an embodiment of the present invention; Figure 2 This is a schematic diagram illustrating the construction of a local timetable according to an embodiment of the present invention; Figure 3 This is a schematic diagram of BLS shaping according to an embodiment of the present invention. Detailed Implementation

[0021] The following description, with reference to the accompanying drawings, illustrates several preferred embodiments of the present invention to make its technical content clearer and easier to understand. The present invention can be embodied in many different forms, and the scope of protection of the present invention is not limited to the embodiments mentioned herein.

[0022] This embodiment addresses the scenario of coexistence of hybrid critical services in an extended AFDX network, presenting a hybrid priority scheduling method for AFDX networks and its specific application in end systems and switches. The airborne network described in this embodiment adopts a typical AFDX architecture, consisting of several end systems (ES) and at least one AFDX switch. The end systems are connected to the switch via full-duplex Ethernet links. According to the avionics system design, each end system is configured with multiple virtual links (VLs). During the configuration phase, the forwarding path and resource constraints of each virtual link are pre-determined. For each virtual link, the configuration file contains at least two key parameters: Bandwidth Allocation Gap (BAG) and Maximum Frame Size (MFS). BAG limits the minimum time interval between two consecutive allowed transmissions on the virtual link, thus constraining the average transmission rate of the service over time. MFS limits the maximum length of a single packet on the virtual link; combined with the link rate, the time overhead required to send one frame in the worst-case scenario can be calculated.

[0023] In mixed-criticality service scenarios, this embodiment divides virtual links into four categories: Safety-Critical Traffic (SCT), Mission-Critical Traffic (MCT), Best-Effort Mission Traffic (BEMT), and Best-Effort Traffic (BET). SCT primarily carries safety-related information such as flight control and is extremely sensitive to end-to-end latency upper bounds and jitter. MCT carries mission execution-related data and has high requirements for real-time performance and bandwidth assurance. BEMT is typically mission-related but has relatively lenient time constraints. BET services are not sensitive to latency and focus more on bandwidth utilization and overall throughput. These four types of services share the same AFDX network. If all are scheduled using traditional static priority (SP), the following problems may arise: First, although SCT has the highest priority, it can still be blocked by preceding frames, making it difficult to tighten worst-case latency. Second, in high-load scenarios, low- and medium-priority services, especially BEMT, may be unable to receive service for extended periods, resulting in a severe lack of fairness.

[0024] The Hybrid Priority Scheduling (HPS) proposed in this embodiment adopts a layered design in its overall architecture, consisting of "end-system-side time-triggered scheduling + switch-side gating + BLS + SP joint scheduling," as follows: Figure 1 As shown: A Time-Triggered Transmission (TTS) module is set up on the end system side to regulate the transmission time of SCT and suppress burst traffic, thereby improving its predictability from the source. A gate module is set up on the switch side to isolate SCT from other types of services in the time domain and provide dedicated transmission opportunities for SCT within the gate window, thereby improving its predictability. A Burst Limit Shaper (BLS) module is set up on the switch side to perform credit control and dynamic priority adjustment of MCT within the asynchronous window, thereby improving the service fairness between MCT and BEMT and enhancing the overall robustness of the system.

[0025] I. Hybrid Priority Scheduling Mode on the End System Side

[0026] On the end system side, this embodiment first uses a configuration tool during the engineering configuration phase to read the configuration parameters of all SCT-type virtual links on the end system, including the BAG, MFS, and optional end-to-end latency budget for each SCT-VL. To facilitate periodic timing planning for SCT services, a set of timing parameters needs to be determined based on the BAG of all SCT-VLs, including: basic period, matrix period, and transmission window length.

[0027] The greatest common divisor of the BAGs of each SCT-VL can be used as the basic period; the least common multiple of the BAGs of each SCT-VL can be used as the matrix period; when determining the window length, the time required to send a single frame is calculated based on the MFS and port rate of each virtual link, and this time is used as the lower bound of the window length. On this basis, a certain time margin is added to absorb local clock errors and software processing overhead.

[0028] For example, a certain end system has three SCT virtual links with BAGs of 2ms, 4ms, and 8ms, and MFSs of 512 bytes, 1024 bytes, and 256 bytes, respectively. Under a typical configuration with a port rate of 100 Mbit / s, the transmission time of a single frame message on the three virtual links is approximately 0.04096ms, 0.08192ms, and 0.02048ms, respectively. Based on the above principles, the basic period can be chosen as 2ms (the greatest common divisor of 2ms, 4ms, and 8ms), the matrix period can be chosen as 8ms (the least common multiple of 2ms, 4ms, and 8ms), and the window length can be chosen as 0.1ms. Within an 8ms matrix period, the first virtual link theoretically has 4 transmission opportunities, the second virtual link has 2 transmission opportunities, and the third virtual link has 1 transmission opportunity. The final result is as follows... Figure 2 As shown.

[0029] The above time planning results are compiled into a local SCT timetable on the end system. Each record includes at least: the time offset relative to the start of the matrix period, the window length, and the bound SCT virtual link identifier. This timetable is distributed to the end system in the form of a configuration file and loaded by the time-triggered sending module when the system starts. During software runtime, the time-triggered sending module is inserted between the virtual link shaping logic and the network card driver: upper-layer applications and middleware still encapsulate service data into AFDX packets and submit them to the corresponding virtual links through existing interfaces. For MCT / BEMT / BET type services, the protocol stack continues to send directly in an event-triggered manner according to BAG constraints; for SCT type services, the packets first enter the SCT sending buffer managed by the time-triggered sending module, which controls the specific sending time according to the local timetable.

[0030] Through the above mechanism, this embodiment realizes time-triggered windowed scheduling of SCT services on the end system side, so that each SCT virtual link can obtain periodic and structured transmission opportunities at the source end, which significantly reduces the degree of competition between SCT and other services at the end system exit and lays the foundation for the predictability of end-to-end latency.

[0031] II. Hybrid Priority Scheduling Mode on the Switch Side

[0032] On the switch side, this embodiment sets up four independent FIFO queues on each output port, corresponding to SCT, MCT, BEMT, and BET services, respectively. When the switch receives an AFDX message, it parses the message header, extracts the virtual link identifier, looks up the service category and target output port corresponding to the virtual link in the local configuration table, and inserts the message into the corresponding queue of the output port. To coordinate with the time-triggered transmission mechanism on the end system side, this embodiment configures a gating period and an SCT gating time window on each output port. The gating period is selected to be the same as or an integer multiple of the end system matrix period. The output port maintains a local clock and the start time of the current gating period internally, and calculates the relative position of the current time within the gating period based on this. According to the pre-configured gating time window, when the current time falls within a certain SCT window range, the gating logic marks the SCT queue as eligible for scheduling; when the current time is not within any SCT window, the gating logic temporarily blocks the SCT queue, and it will not participate in scheduling even if there are messages in the queue. In addition, near the boundaries of the SCT gated window, the output port retains an appropriate daemon time to limit the initiation of long message transmission near the start or end of the window, so as to prevent the transmission of non-SCT messages from crossing the window boundary and affecting the scheduling of SCT messages.

[0033] For MCT services, this embodiment introduces a Burst Limiting Shaping (BLS) mechanism at the output port. This mechanism maintains a credit value and corresponding upper and lower threshold parameters for the MCT queue at each output port, while configuring a time-related credit change rate. When a port repeatedly selects the MCT queue to send packets within a certain time period, the credit value is gradually adjusted upwards according to a preset rule based on the transmission duration. When a port does not select the MCT queue for a certain period, but instead sends other types of packets or remains idle, the credit value is adjusted downwards according to a preset recovery rate. When the credit value reaches or exceeds the upper threshold, it indicates that the MCT has recently consumed a large amount of bandwidth. The shaping module temporarily adjusts the MCT queue from a higher priority to a lower priority, allowing the BEMT queue to obtain more service opportunities. When the credit value drops below the lower threshold, it indicates that the MCT has been underserved for a period of time. The shaping module restores its priority to a higher level to ensure its average bandwidth and latency constraints. By accumulating and decaying credit scores over time, this embodiment suppresses bursty MCT behavior and balances bandwidth allocation between MCT and low-to-medium priority services without modifying the service configuration itself.

[0034] Figure 3This example demonstrates a specific instance of BLS shaping of MCTs. In this example, we fix the priority of BEMT at 2, while the priority of MCTs switches between 1 and 3 (the smaller the number, the higher the priority). During the time period t2-t4, the priority of MCT is higher than that of BEMT, so MCTs are sent first. At time t4, the credit value of MCT reaches the upper threshold, at which point the BLS shaper lowers the priority of MCT (adjusting it to 3). Now, the priority of MCT is lower than that of BEMT, so BEMTs are sent first. This achieves periodic service for BEMT, improving fairness.

[0035] Regarding the joint scheduling process, this embodiment employs a hierarchical control logic of "first determining the time window, then scheduling BLS+SP within the asynchronous window" on each switch output port, based on the aforementioned four queue structures, gating configuration, and BLS credit status maintenance. The output port maintains its local clock and the starting time of the gating cycle. When a scheduling trigger event occurs, it first calculates the relative time within the gating cycle based on the difference between the current time and the starting time of the gating cycle, and then determines whether the port is currently within the SCT gating window or outside the asynchronous scheduling interval.

[0036] When the current time falls within the SCT gating window, the gating logic opens the SCT channel and closes other service channels, allowing only the SCT queue to participate in this round of dequeueing. The scheduling module then directly checks the SCT queue status. If the SCT queue is not empty, it takes a packet from the head of the queue and sends it, maintaining a FIFO (First-In, First-Out) sending order, and no longer performs competitive scheduling for the MCT, BEMT, and BET queues. By implementing this single-queue priority sending strategy within the SCT window, service opportunities with a periodic structure can be constructed for safety-critical services at the physical port level, avoiding competition with other services during that time period.

[0037] When it is determined that the current time is not within the SCT gating window, i.e., in the asynchronous window scheduling phase, the gating logic closes the SCT queue, and SCT packets do not participate in dequeueing during this period. In this embodiment, a joint scheduling strategy combining BLS credit control and static priority is enabled at this time. The scheduling module first updates the MCT credit value based on the interval between the current time and the end time of the previous frame transmission: if the previous frame packet came from the MCT queue, it is considered that the MCT occupied link resources during this period, and the credit value is increased according to the preset transmission rate; if the previous frame packet did not come from the MCT queue or the port is idle, it is considered that the MCT is in the recovery phase, and the credit value is decreased according to the preset recovery rate, and the credit value is limited to the configured upper and lower threshold range. Subsequently, based on the updated credit value and its relationship with the upper and lower thresholds, it is determined whether the MCT is currently in a "high-priority state" or a "low-priority state": when the credit value exceeds the upper threshold, the MCT is temporarily removed from the high-priority queue set, reducing its priority relative to BEMT and BET; when the credit value is below the lower threshold, the MCT's high-priority state is restored, allowing it to regain priority service opportunities. After obtaining the current priority state of the MCT, the scheduling module combines the static priority configuration to form the priority order for this round of scheduling. For example, when the MCT is in a high-priority state, the order is MCT > BEMT > BET; when the MCT is in a low-priority state, the order is BEMT > MCT > BET. Then, the MCT, BEMT, and BET queues are checked in this order, and the queue with the highest priority and not empty is selected. A message frame is taken from the head of the queue and sent, and it is recorded whether this transmission comes from the MCT queue and the transmission end time, providing a basis for the next round of credit update; if all queues are empty within the current asynchronous window, the output port enters an idle state until the next scheduling trigger event occurs.

[0038] Through the collaboration between the end system and the switch side, this embodiment achieves joint scheduling of time-triggered and event-triggered services for mixed-criticality services without changing the AFDX asynchronous architecture and traffic constraint mechanism. This significantly improves the predictability of latency for security-critical services, enhances the service fairness of low- and medium-priority services, and improves the system's robustness to load changes and parameter disturbances. Those skilled in the art can implement the mixed-priority scheduling algorithm of this invention on existing AFDX hardware and software platforms.

[0039] Technical Advantages: This invention differs from schemes that only modify the scheduling algorithm on the switch side. It introduces time-triggered transmission on the end system side and SCT gating and BLS+SP joint scheduling on the switch side, achieving end-to-end consistent hybrid priority control. This significantly improves service fairness for low- and medium-priority services while enhancing the predictability of SCT latency. The entire scheme does not change the AFDX packet format, VL configuration method, or asynchronous scheduling characteristics. It only connects the gating and BLS modules in series on the existing FIFO+SP port architecture, resulting in a simple structure and clear modification boundaries.

[0040] Performance metrics: Under a typical aircraft avionics network topology, this invention can be quantitatively compared with default algorithms such as SP and WRR in terms of worst-case SCT latency, latency jitter, maximum queue length for low-priority flows, average latency, and link utilization. Simulation results show that, under the premise of satisfying SCT latency constraints, this invention achieves superior overall performance in predictability, fairness, and robustness, and has a better three-dimensional trade-off compared to SP and WRR.

[0041] Production Implementation: This invention does not change the asynchronous characteristics of AFDX or the existing flow constraint model. The modifications to the peer system and switch are mainly concentrated on the sending-side buffer management and the internal control, shaping, and scheduling logic of the output port. It is an incremental extension based on the existing implementation and has low integration difficulty.

[0042] Application Scenarios: This invention is applicable to the avionics network design of large civil aircraft, regional jets, and business jets. It can uniformly carry mixed-criticality services such as flight control, mission management, monitoring and alarm, and cabin information services on the same AFDX network. Its hybrid priority scheduling approach and implementation architecture can also be migrated to high-reliability industrial networks using AFDX or TSN technologies, such as rail transit train control and ship integrated monitoring, to improve network determinism and overall service quality.

[0043] Other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of the invention are indicated by the following claims.

[0044] It should be understood that the present invention is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. A hybrid priority scheduling architecture for AFDX networks, characterized in that: It consists of several end systems and at least one AFDX switch. The end systems are connected to the switch via full-duplex Ethernet links. Each end system is configured with multiple virtual links, and the forwarding path and resource constraints of each virtual link are pre-determined during the configuration phase.

2. The scheduling architecture according to claim 1, characterized in that: The configuration file of the virtual link contains at least two key parameters: bandwidth allocation interval and maximum frame length. The bandwidth allocation interval is used to limit the minimum time interval between two consecutive allowed transmissions of the virtual link, thereby constraining the average transmission rate of the service over time. The maximum frame length is used to limit the maximum length of a single message on the virtual link. Combined with the link rate, the time cost required to send a frame in the worst case can be calculated.

3. The scheduling architecture according to claim 2, characterized in that: The virtual links are divided into four categories: safety-critical services, mission-critical services, mission-related services, and best-effort services. The safety-critical services carry safety-related information such as flight control and are extremely sensitive to end-to-end latency upper bounds and jitter. The mission-critical services carry mission execution-related data and have high requirements for real-time performance and bandwidth assurance. The mission-related services are usually related to the mission but have relatively relaxed time limits. The best-effort services are not sensitive to latency and focus more on bandwidth utilization and overall throughput.

4. A scheduling method based on the hybrid priority scheduling architecture for AFDX networks as described in any one of claims 1-3, characterized in that: This includes time-triggered events on the end system side, gating on the switch side, and joint scheduling.

5. The scheduling method according to claim 4, characterized in that: The time triggering on the end system side involves introducing a time triggering sending module and a local time schedule to periodically window the sending of virtual links for safety-critical services, thereby reducing time competition between safety-critical services and other services from the source.

6. The scheduling method according to claim 5, characterized in that: The aforementioned end-system-side time triggering specifically involves, during the engineering configuration phase, reading the configuration parameters of all safety-critical business virtual links on the end system using a configuration tool. This includes the bandwidth allocation interval, maximum frame length, and optional end-to-end latency budget for each safety-critical business virtual link. The greatest common divisor of the bandwidth allocation intervals of the safety-critical business virtual links is used as the basic period. The least common multiple of the bandwidth allocation intervals of the safety-critical business virtual links is used as the matrix period. When determining the window length, the time required to send a single frame is calculated based on the maximum frame length and port rate of each virtual link. This time is used as the lower bound of the window length, and a certain time margin is added on top of this to absorb local clock errors and software processing overhead.

7. The scheduling method according to claim 4, characterized in that: The switch-side gating specifically involves setting up four independent FIFO queues on each output port, corresponding to security-critical services, mission-critical services, mission-related services, and best-effort services, respectively; and configuring a gating period and a security-critical service gating time window on each output port. When a switch receives an AFDX message, it parses the message header, extracts the virtual link identifier, looks up the service category and target output port corresponding to the virtual link in the local configuration table, and inserts the message into the corresponding queue of the output port. The gating period is selected to be the same as or an integer multiple of the period of the end system matrix. The output port internally maintains the local clock and the start time of the current gating period, and calculates the relative position of the current time within the gating period. Based on the pre-configured gating time window, when the current time falls within the range of a certain security-critical business window, the gating logic marks the security-critical business queue as eligible for scheduling; when the current time is not within any security-critical business window, the gating logic temporarily blocks the security-critical business queue, and does not participate in scheduling even if there are messages in the queue.

8. The scheduling method according to claim 7, characterized in that: The switch-side gating also includes introducing a burst limiting and shaping mechanism at the output port for mission-critical business services; the burst limiting and shaping mechanism maintains a credit value and corresponding upper and lower threshold parameters for the mission-critical business service queue at each output port, and configures a time-related credit change rate. When a port repeatedly selects a critical service queue to send messages within a certain period, the credit value is gradually adjusted upwards according to preset rules based on the duration of transmission. When a port does not select a critical service queue for a certain period and instead sends other types of messages or remains idle, the credit value is adjusted downwards according to a preset recovery rate. When the credit value reaches or exceeds the upper threshold, it indicates that the critical service has been consuming a lot of bandwidth recently. The shaping module temporarily adjusts the critical service queue from a higher priority to a lower priority, allowing task-related service queues to obtain more service opportunities. When the credit value drops below the lower threshold, it indicates that the critical service has been underserved for a period of time. The shaping module restores its priority to a higher level to ensure its average bandwidth and latency constraints.

9. The scheduling method according to claim 8, characterized in that: The joint scheduling involves, on each switch output port, employing a hierarchical control logic based on the queue structure of security-critical services, task-critical services, task-related services, and best-effort services, gating configuration, and burst restriction shaping mechanism credit status maintenance. This logic employs a time window determination followed by asynchronous scheduling within the window. The output port maintains its local clock and the starting time of the gating cycle. When a scheduling trigger event occurs, the relative time within the gating cycle is calculated based on the difference between the current time and the starting time of the gating cycle. This determines whether the port is currently within the security-critical service gating window or outside the asynchronous scheduling interval.

10. The scheduling method according to claim 9, characterized in that: The joint scheduling also includes the following: when it is determined that the current time falls within the security-critical business gating window, the gating logic opens the security-critical business channel and closes other business channels, allowing only the security-critical business queue to participate in this round of dequeueing; when it is determined that the current time is not within the security-critical business gating window, that is, in the asynchronous window scheduling stage, the gating logic closes the security-critical business queue, and security-critical business messages do not participate in dequeueing during this period.

Images