A dual-redundant TTE bus topology and scheduling method

Abstract

The application discloses a kind of dual-redundancy TTE bus topological structure and scheduling method, it is related to the technical field of spacecraft avionics network and mixed key communication scheduling.The structure includes physically isolated network plane A, B, each is equipped with two core switches;Domain controller and host computer are accessed by independent port, and equipment-intensive domain is cascaded terminal through access switch.The scheduling method is based on traffic parameters and fault set, calculates the conflict-free time slot of TT flow primary and standby path in supercycle, and calculates link reserved bandwidth according to RC flow maximum frame length and BAG.When running, each node sends and forwards according to local scheduling table;After detecting link or switch failure, corresponding standby scheduling item is activated, and redundant core switch forwards in reserved port time slot, and receiving end equipment eliminates duplicate frame according to flow identification and frame sequence number.The application can realize bounded latency switching without online recalculation of scheduling table, improve the determinacy of mixed key traffic and network resource utilization.

Description

Technical Field

[0001] This invention relates to the technical field of spacecraft avionics networks and hybrid critical communication scheduling, and in particular to a dual-redundant TTE bus topology and scheduling method. Background Technology

[0002] Suborbital space tourism spacecraft typically include flight control, propulsion, telemetry, tracking, and command (TT&C), energy, and cockpit intelligence domains. Traffic generated by these different domains varies significantly in terms of safety level, frequency, burstiness, and deadlines. Contention-based access in standard Ethernet makes it difficult to guarantee deterministic latency for critical control data; single-plane, single-core, or single-link structures are prone to single points of failure. Existing dual-network redundancy schemes often focus on copying transmissions without simultaneously specifying executable backup paths and their port time slots in the event of a core switch failure within the network plane. If routing is temporarily changed after a failure, the original TT flow traffic on the backup switch may compete with the takeover traffic for the same output port. Furthermore, reserving RC flow bandwidth only at a fixed ratio cannot adapt to changes in maximum frame length, bandwidth allocation intervals, and route aggregation, easily leading to insufficient bandwidth or wasted resources. Summary of the Invention

[0003] This invention provides a dual-redundant TTE bus topology and scheduling method. The network solution provided by this invention can unify the offline scheduling design of dual-plane, dual-core, cascaded access, and fault status awareness. This invention eliminates single-point faults through multi-layer redundancy at the plane level, core switch level, and link level, and simultaneously calculates the primary / backup port time slots under normal and preset fault conditions during the offline phase, ensuring that the redundant core switch does not conflict with its original TT flow traffic when taking over fault traffic. Furthermore, the reserved bandwidth of the link is calculated based on the traffic contract of the RC flow, allowing the mixed traffic of TT, RC, and BE flows to share network resources while satisfying deterministic and worst-case delay constraints. This dual-redundant bus topology can be applied to time-triggered Ethernet (TTE) communication mechanisms and is suitable for multi-domain control systems of suborbital space tourism spacecraft.

[0004] Firstly, a dual-redundant TTE bus topology is provided, which includes a network plane A and a network plane B that are physically isolated from each other; the ports, cabling paths and power supply channels of the two network planes A and B are independent of each other, and logically they both carry the same set of data streams; both network plane A and network plane B include two mutually redundant core switches, which are a first core switch and a second core switch, respectively. The dual-redundant TTE bus topology also includes multiple domain controllers; each domain controller has an independent network interface group belonging to network plane A and network plane B respectively, and is connected to the first core switch and the second core switch in the corresponding network plane through the independent network interface group respectively. In each network plane, a primary path via the first core switch and a backup path via the second core switch are established respectively. The primary path and the backup path are redundant to each other, so as to form plane-level redundancy between the two network planes and core switch-level redundancy in each network plane. The dual-redundant TTE bus topology also includes a receiving device; the receiving device performs consistency checks on data frames received from different redundant paths based on the stream identifier, sender identifier, frame sequence number and check result, receives the first data frame that arrives and is correctly checked, and discards subsequent duplicate frames with the same frame sequence number. The nodes of the dual-redundant TTE bus topology include receiving devices, domain controllers, and core switches. Each node in the dual-redundant TTE bus topology has a local port scheduling table, wherein the network plane has a terminal system port scheduling table, and the core switch in each network plane has a switch port scheduling table. Each port scheduling table includes a primary scheduling item under normal conditions and a backup scheduling item corresponding to a preset fault identifier. When the system is running, each node in the dual-redundant TTE bus topology establishes a global time base and sends or forwards frames of the TT stream at a specified time according to the primary scheduling item of the local port scheduling table. After a link or core switch failure is detected, the backup scheduling item corresponding to the fault identifier is activated according to the port scheduling table, so that the affected TT flow is forwarded through the reserved port time slot of the redundant core switch. Each of the primary and backup scheduling items includes the TT stream set and the RC stream set; The method for determining the TT flow set includes: calculating the basic period and super period based on the period of each TT flow, and generating candidate paths for each TT flow that are located in two network planes and whose links do not intersect; for each fault state in the normal state and the preset fault set, jointly calculating the primary transmission time slot and backup transmission time slot of each TT flow on each switch port, so that the frames of TT flows on the same port do not overlap and satisfy the hop-by-hop forwarding order constraint and the end-to-end deadline constraint; The method for determining the RC stream set includes: calculating the reserved bandwidth for each link's RC streams based on the maximum frame length and bandwidth allocation interval of each RC stream; The remaining bandwidth after deducting the equivalent bandwidth occupied by the TT flow, the reserved bandwidth of the RC flow, and the guard interval is used as the available bandwidth for the BE flow.

[0005] In conjunction with the first aspect, in some implementations of the first aspect, the nodes of the dual-redundant TTE bus topology further include access switches and terminal devices. The access switches are used for interaction between the terminal devices and the domain controller. The domain controller is connected to at least two access switches or one access switch with dual uplink ports, so that the uplink links of the access switches are mapped to independent communication channels of network plane A and network plane B, respectively.

[0006] In conjunction with the first aspect, in some implementations of the first aspect, the dual-redundant TTE bus topology includes: a flight control domain controller, a power domain controller, and a cockpit intelligence domain controller, wherein the access switch is cascaded to the cockpit intelligence domain controller, and the terminal devices cascaded to the access switch include at least one of the following: a seat display terminal, an environmental sensor, and an occupant service terminal.

[0007] In conjunction with the first aspect, in some implementations of the first aspect, network plane A and network plane B employ different implementations in at least one of the following: physical transmission medium, physical layer transceiver, core switch hardware platform, power supply source, or cable laying area.

[0008] In conjunction with the first aspect, in some implementations of the first aspect, the receiving device is the computing unit of the main control computer. The main control computer includes multiple computing units, each of which is connected to network plane A and network plane B through an independent port, and is used to receive data frames of the same data stream transmitted on different redundant paths.

[0009] In conjunction with the first aspect, in some implementations of the first aspect, let the first... The period of each TT stream is Basic cycle It is the least common multiple of the TT flow cycles; when the TT flow cycle is... TT flow is a link When the TT stream is on, the first A TT stream in the link The last time occupied according to Calculation, where For TT stream Maximum frame length, For Ethernet frame protocol overhead, For link Link speed, For link The protection interval covers clock synchronization error, switching jitter, and transmit / receive switching time. The constraint model is constructed using time slot mutual exclusion constraints under the same fault state of the same link, sequential constraints of adjacent forwarding links, redundant path separation constraints, clock synchronization error constraints, and end-to-end deadline constraints. The port scheduling table is obtained by solving the problem using mixed integer programming, satisfiability model theory, or constraint programming.

[0010] In conjunction with the first aspect, in some implementations of the first aspect, for the link RC stream reserved bandwidth according to The calculation is performed, where the summation range is the path traversed by the links. Each RC flow , For RC flow Maximum effective payload length, For frame protocol overhead, For RC flow Bandwidth allocation interval, A safety factor of not less than 1 is used; and under the conditions that the worst-case end-to-end delay of the RC flow does not exceed its cutoff period and the total link utilization does not exceed a preset upper limit, the minimum value that meets the conditions is selected. .

[0011] In conjunction with the first aspect, in some implementations of the first aspect, for multiple backup scheduling items that will not be activated simultaneously under the single failure assumption, multiple backup scheduling items are allowed to reuse the same time interval; for primary and backup frames sent from the same output port under the same failure state, non-overlapping port time slots are allocated so that the redundant core switch does not conflict with the traffic of its original TT flow when taking over the fault traffic.

[0012] Secondly, a scheduling method for a dual-redundant TTE bus topology is provided, wherein the dual-redundant TTE bus topology is as described in any of the implementations of the first aspect above, and the scheduling method includes: The network topology and preset fault set of the dual-redundant TTE bus topology are obtained, and the TT flow set, RC flow set, and BE flow set are determined to form a port scheduling table for the dual-redundant TTE bus topology. Specifically, the basic period and super-period are calculated based on the period of each TT flow, and candidate paths located in two network planes with non-intersecting links are generated for each TT flow. For the normal state and each fault state in the preset fault set, the primary and backup transmission time slots for each TT flow on each switch port are jointly calculated to ensure that the frames of TT flows on the same port do not overlap and satisfy hop-by-hop forwarding order constraints and end-to-end deadline constraints. The reserved bandwidth for each RC flow is calculated based on the maximum frame length and bandwidth allocation interval of each RC flow, and the remaining bandwidth after deducting the bandwidth occupied by TT flows, the reserved bandwidth of RC flows, and the protection interval is allocated to the BE flow. Write the calculated port scheduling table into the corresponding node of the dual-redundant TTE bus topology.

[0013] Thirdly, a computer-readable storage medium is provided having program instructions stored thereon, which, when executed by a processor, implement the scheduling method as described in any of the implementations of the second aspect above.

[0014] Compared with the prior art, the solution provided by the present invention has at least the following beneficial technical effects: 1) Two physically isolated network planes together with the dual-core switches in each plane form multi-layer redundancy, which can tolerate the failure of a pre-set single link or single core switch; the risk of common cause failure is reduced by the optional differences in media, hardware, power supply and laying.

[0015] 2) By incorporating the fault status into the offline time slot joint solution, the backup core switch obtains executable port-level backup scheduling items, avoiding conflicts of the same port TT flow caused by temporary rerouting after a fault occurs, and the switching delay can be limited to the preset basic period or TT flow instance boundary.

[0016] 3) The RC flow bandwidth is calculated based on the maximum frame length, BAG, route aggregation and worst-case delay constraints, which can reduce the resource waste caused by fixed proportion reservation while meeting the RC flow deadline; the inactive spare window can be used by the BE flow traffic, improving the link utilization under normal conditions.

[0017] 4) End systems and switches only perform switching based on local scheduling tables and fault identifiers, and there is no need to solve the entire network scheduling online after a fault; receiving devices eliminate duplicate frames by using frame sequence numbers and verification results to ensure the continuous and deterministic delivery of critical control data. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the dual-redundant TTE bus topology of the present invention.

[0019] Figure 2 This is the overall flowchart of the scheduling method of the present invention.

[0020] Explanation of reference numerals in the attached diagram: 100 - Main control computer; 101, 102, 103 - Computing units; 200 - TEthernet network plane A; 210 - Core switch A1; 220 - Core switch A2; 300 - TEthernet network plane B; 310 - Core switch B1; 320 - Core switch B2; 410 - Flight control domain controller; 420 - Power domain controller; 430 - Cockpit intelligence domain controller; 440 - Access switch; 510 - Seat display terminal; 520 - Environmental sensor; 530 - Crew service terminal. Detailed Implementation

[0021] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments.

[0022] Figure 1 This is a schematic diagram of the dual-redundant TTE bus topology of the present invention. The dual-redundant TTE bus topology includes a TTEthernet network plane A 200 (hereinafter referred to as network plane A 200) and a TTEthernet network plane B 300 (hereinafter referred to as network plane B 300), which are physically isolated from each other. Figure 1 The solid line represents a link in network plane A, and the dashed line represents a link in network plane B. The ports, cabling paths, and power supply channels of network planes A 200 and B 300 are independent of each other, but logically they both carry the same set of data flows.

[0023] Network plane A 200 includes mutually redundant core switches A1 210 and A2 220. Network plane B 300 includes mutually redundant core switches B1 310 and B2 320. The dual-redundant TTE bus topology may also include multiple domain controllers. Each domain controller has an independent network interface group belonging to both network plane A and network plane B, and is connected to the two core switches in the corresponding network plane through the independent network interface group, so as to form plane-level redundancy between the two network planes and core switch-level redundancy within each network plane.

[0024] exist Figure 1In the illustrated embodiment, the dual-redundant TTE bus topology includes a flight control domain controller 410, a power domain controller 420, and a cockpit intelligence domain controller 430. Each domain controller connects to two network planes via independent network interfaces, and within each network plane, a primary path via a first core switch and a backup path via a second core switch are established, thus forming a multi-layered redundancy of "dual-plane-dual-core-star branch". No shared switching links necessary for fault switching are set between different network planes, avoiding the creation of new single points of failure through shared links.

[0025] Specifically, in Figure 1 In the illustrated embodiment, the flight control domain controller 410 establishes interaction paths with both core switches A1 210 and A2 220 of network plane A 200; the power domain controller 420 establishes interaction paths with both core switches A1 210 and A2 220 of network plane A 200; and the cockpit intelligence domain controller 430 establishes interaction paths with both core switches A1 210 and A2 220 of network plane A 200. Similarly, the flight control domain controller 410 establishes interaction paths with both core switches B1 310 and B2 320 of network plane B 300; the power domain controller 420 establishes interaction paths with both core switches B1 310 and B2 320 of network plane B 300; and the cockpit intelligence domain controller 430 establishes interaction paths with both core switches B1 310 and B2 320 of network plane B 300.

[0026] In a dual-redundant TTE bus topology, the receiving device performs consistency checks on data frames received from different redundant paths based on the stream identifier, sender identifier, frame sequence number, and check result. It receives the first arriving data frame that has passed the check and discards subsequent duplicate frames with the same sequence number. For example, the dual-redundant TTE bus topology also includes a master computer 100, which comprises multiple computing units, such as... Figure 1 The computing units 101, 102, and 103 shown are each connected to network plane A and network plane B via independent ports, and are used to receive data frames of the same data stream transmitted on different redundant paths. Each computing unit can constitute a receiving end device for network plane A and network plane B.

[0027] Furthermore, the dual-redundant TTE bus topology may also include access switches and terminal devices. The access switches facilitate interaction between the terminal devices and a domain controller, which may be a domain controller in a device-intensive domain. The domain controller is connected to at least two access switches or one access switch with dual uplink ports, such that the uplink links of the access switches are mapped to independent communication channels in network plane A 200 and network plane B 300, respectively. For example, as... Figure 1 As shown, for cockpit intelligent domains with a large number of terminal devices, the cockpit intelligent domain controller 430 is cascaded with an access switch 440. The access switch 440 connects to at least one of the following: seat display terminal 510, environmental sensor 520, and occupant service terminal 530. The access switch 440 uses dual uplink channels mapped to network plane A 200 and network plane B 300 respectively. Other domain controllers can directly connect to the core switch or use a connection with the core switch, depending on the number of ports and security level. Figure 1 The same cascaded structure.

[0028] Furthermore, to suppress common-cause faults and reduce the probability of simultaneous failure of both network planes due to common-cause faults, the two network planes can adopt different implementation methods in at least one of the following: physical transmission medium, physical layer transceiver, core switch hardware platform, power supply source, or cable laying area. For example, network plane A uses a fiber optic link and power supply A, while network plane B uses a shielded cable link and power supply B.

[0029] like Figure 2 As shown, the present invention also provides a scheduling method for a dual-redundant TTE bus topology. Figure 2 This paper illustrates the process of fault set modeling, redundant path generation, joint solution of primary / standby time slots for TT flows, reserved bandwidth calculation for RC flows, scheduling table download, and online fault switching. The scheduling method employs a strategy of "offline joint planning of fault states and online local scheduling execution." Offline planning does not only generate a schedule under normal conditions, but simultaneously generates primary / standby scheduling items with fault identifiers for both normal conditions and preset fault states such as single-link faults and single-core switch faults. Specifically, this includes the following steps.

[0030] Step S1: For Figure 1 The dual-redundant TTE bus topology shown is used to establish topology, traffic, and fault models.

[0031] Step S1.1: Represent the network topology of the dual-redundant TTE bus topology as a directed graph. Node set Includes end systems, domain controllers, access switches, and core switches, and link sets. Each link in With link rate Propagation delay and exchange / processing delay. In directed graphs... In the middle, each TT stream At least the source node , destination node set ,cycle Maximum frame length End-to-end deadline Allowing jitter and redundancy levels; each RC flow At least include the maximum frame length Bandwidth allocation interval Deadline and routing. Determine the preset fault set for the dual-redundant TTE bus topology. Including normal state Multiple fault states, each of the following: single link out of circuit, single core switch failure.

[0032] Step S1.2: For the TT flow, generate redundant candidate paths.

[0033] For each critical TT flow, the basic period and super-period are calculated based on the period of each TT flow. Link-disjoint paths are generated in network plane A and network plane B respectively. Within each network plane, a primary path via the first core switch (corresponding to core switch A1 210 and core switch B1 310) and a backup path via the second core switch (corresponding to core switch A2 220 and core switch B2 320) are generated. For each fault state... Remove paths associated with faulty links or faulty switches to form a set of available paths. .

[0034] Step S1.3: Determine the scheduling period for the TT stream.

[0035] Let the period of all TT streams be... to Basic cycle Take the greatest common divisor of all periods, and consider the super-period. Take the least common multiple of all periods. A TT flow in supercycle Internal generation One instance. This flow is in the link. The last time occupied according to Calculation, where For Ethernet frame protocol overhead, The protection interval is designed to cover clock synchronization errors, switching jitter, and transmit / receive switching time.

[0036] Step S1.4: For TT streams, determine the primary / standby time slots.

[0037] For each fault state in the normal state and the preset fault set, the primary and backup transmission time slots of each TT stream on each switch port are jointly calculated to ensure that the frames of the TT streams on the same port do not overlap and satisfy the hop-by-hop forwarding order constraint and the end-to-end deadline constraint.

[0038] Specifically, using the start time of transmission of each TT flow instance on each link as a variable, the following constraints are established: the frame occupancy intervals of any two TT flows under the same link and the same fault state do not overlap; the transmission time of the next hop of the same frame is not earlier than the sum of the end time of transmission of the previous hop and the propagation and processing delays; the completion time of the last hop of each TT flow instance does not exceed its end-to-end deadline; the traffic of the same TT flow does not intersect on the critical path links of network plane A and network plane B. The primary time slot corresponds to the primary scheduling item in subsequent steps, and the backup time slot corresponding to the primary time slot corresponds to the backup scheduling item in subsequent steps. Each backup time slot corresponds to a preset fault identifier. The primary time slot and its corresponding backup time slot satisfy the above constraints. Mixed integer programming, satisfiability modular theory, or constraint programming are used to solve the problem, outputting the system transmission time and the forwarding time of each switch output port.

[0039] Optionally, under the single-fault assumption, standby scheduling items with different fault states that will not be activated simultaneously are allowed to reuse the same time interval; however, under any specific fault state, if the primary traffic and the takeover traffic need to be sent from the same output port, then non-overlapping time slots are allocated for the two.

[0040] Optionally, the spare time slot can be opened to traffic of the BE stream under normal conditions. Once the corresponding fault flag is set, the port scheduler shuts down the transmission of the BE stream and activates the spare scheduling item at a predetermined boundary.

[0041] Step S1.5: For RC streams, determine the reserved bandwidth for RC streams.

[0042] The reserved bandwidth for each link's RC stream is calculated based on the maximum frame length and bandwidth allocation interval of each RC stream.

[0043] Specifically, for the link First, calculate the aggregate committed rate of all RC flows passing through this link: ,in A safety factor of not less than 1 is used to cover measurement bias, clock error, and design margin. Subsequently, network calculus or worst-case response time analysis is used to calculate the worst-case end-to-end delay for each RC flow; this is done assuming all RC flows meet their cutoff times, and... Under the condition that the link utilization limit is not exceeded, select the minimum value that meets the condition. Therefore, the RC flow share is calculated based on the flow contract and delay constraints, rather than using a fixed percentage.

[0044] Step S1.6: For the BE stream, determine the available bandwidth of the BE stream.

[0045] The available bandwidth for the BE stream is the remaining bandwidth after deducting the equivalent bandwidth occupied by the TT stream, the reserved bandwidth for the RC stream, and the guard interval.

[0046] S2: Download the scheduling table and synchronize it online.

[0047] The offline-generated end-system port scheduling tables and switch port scheduling tables are written into the TTE end systems and switches in the network. Each port scheduling table includes a primary scheduling item under normal conditions and a backup scheduling item corresponding to a preset fault identifier. Each port scheduling table includes at least a flow identifier, fault identifier, path identifier, transmission time, duration, and output port. During system operation, each node (including the network plane and core switches) establishes a global time base according to the fault-tolerant time synchronization mechanism of SAE AS6802 Time Triggered Ethernet, and sends or forwards TT stream frames at specified times according to the local scheduling table, without the need for a central scheduler to issue instructions frame by frame.

[0048] S3: Fault detection, backup scheduling activation and duplicate frame elimination.

[0049] Upon detecting a link or core switch failure, the backup scheduling item corresponding to the failure identifier is activated, causing the affected TT flow to be forwarded through the reserved port slots of the redundant core switch.

[0050] Specifically, domain controllers and switches generate fault identifiers based on physical link status, consecutive frame loss, port error counts, and synchronization status. When a fault identifier meets preset confirmation conditions, the local scheduler selector, starting from the next basic cycle or the next available TT flow instance, disables the primary scheduler affected by the fault and activates the corresponding backup scheduler. Redundant core switches independently complete the reception and forwarding of takeover traffic within the offline reserved input / output port time slots, without needing to first receive data forwarded by another core switch, nor needing to recalculate the entire network scheduling table online. The receiving device receives the first correct frame based on the flow identifier and frame sequence number and eliminates duplicate frames, thus making the handover transparent to the application layer.

[0051] Example 1 This embodiment uses a 100Mbit / s TTEthernet link for construction. Figure 1The network is shown. Network plane A uses core switches A1 210 and A2 220, and network plane B uses core switches B1 310 and B2 320. The flight control domain controller 410 has independent ports leading to A1, A2, B1, and B2, respectively. Each of the three computing units of the main control computer 100 has at least one receiving device port belonging to one of the two network planes. For example, flight attitude data is defined as a TT stream. Its maximum frame length is 256 bytes, and its period is... The timeout is 20ms, and the end-to-end cutoff time is 5ms; the fault set includes single link outages and single core switch failures.

[0052] Scheduling table calculation and normal transmission process: The scheduling tool uses the least common multiple of all TT stream periods as the timeout. The solver generates candidate paths via A1, A2, B1, and B2 for the attitude TT stream. For normal operation, the solver selects the dual-plane primary path via A1 and B1, for example, by simultaneously sending two copies with the same stream identifier and frame sequence number by the flight control domain controller 410 at the 10th ms of each 20ms cycle. Simultaneously, for the backup path via A2 and B2, conditional backup schedule entries are generated on the relevant input ports and the output ports leading to the main control computer 100. The original TT stream traffic in A2 can be forwarded simultaneously on different output ports; if the same output port as the backup path is required, the offline solver schedules it in a time interval that does not overlap with the backup time slot. Under normal conditions, A1 and B1 forward attitude frames in their respective predetermined forwarding time slots. The receiving device receives the first arrived and correctly verified frame and discards the subsequent copies.

[0053] Fault handover process: Assume the link between flight control domain controller 410 and core switch A1 210 is broken. The controller confirms the fault identifier based on port disconnection and consecutive frame loss, and disables the primary scheduling item via A1 and activates the backup scheduling item via A2 220 at the next basic cycle boundary. At this time, the controller directly sends the attitude frame to A2 in the backup transmission time slot corresponding to the original TT instance; A2 forwards the data to the master computer 100 in the output port time slot reserved for this fault state according to the conditional backup entry in its own port scheduling table. A2 does not generate data for A1, nor does it need to forward A1's data via the internal interconnection link between A1 and A2. It only executes the pre-configured backup path for the same source TT stream. The primary transmission of B1 on network plane B remains unchanged, and the receiving device still obtains at least one correct frame within the limited receiving window. Since the takeover time slot of A2 has been staggered with the traffic of its original TT stream on the same port, the entire handover process does not generate new TT stream conflicts, and the end-to-end delay remains within the upper limit of offline verification.

[0054] Example of RC stream bandwidth calculation: Suppose two RC streams are aggregated on a 100 Mbit / s link, with maximum frame lengths of 512 bytes and 256 bytes respectively after including protocol overhead, and BAGs of 4ms and 2ms respectively. Then the aggregated committed rate of the two RC streams is 1.024 Mbit / s. If the link security factor is... If we take 1.2, then the initial RC flow reserved bandwidth... The speed is 2.458 Mbit / s. The scheduling tool further performs worst-case end-to-end delay checks. If any RC flow fails to meet the deadline, the reservation value is increased, the route is adjusted, or the TT flow window is rearranged until the deadline and link utilization limit are met. The frame length, BAG, and safety factor in this example are only used to illustrate the calculation process. The actual values ​​are determined by the interface control files and safety margin requirements of each domain of the spacecraft.

[0055] In other implementations, the fault set can be expanded to include access switch failure, synchronous master clock failure, or specific combinations of dual faults; correspondingly, only available paths and conditional backup scheduling items need to be generated for the newly added fault states during the offline phase, while the online execution mechanism remains unchanged. Network plane A and network plane B can also use the same link medium while maintaining isolation only for power supply, ports, and cabling paths, or different physical layers can be used under the requirements of mission reliability analysis.

[0056] Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make possible changes and modifications without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope defined in the claims of the present invention.

Claims

1. A dual-redundant TTE bus topology, characterized in that, The dual-redundant TTE bus topology includes network plane A and network plane B, which are physically isolated from each other. The ports, cabling paths and power supply channels of network plane A and network plane B are independent of each other, but logically they both carry the same set of data streams. Both network plane A and network plane B include two mutually redundant core switches, which are the first core switch and the second core switch, respectively. The dual-redundant TTE bus topology also includes multiple domain controllers; each domain controller has an independent network interface group belonging to network plane A and network plane B respectively, and is connected to the first core switch and the second core switch in the corresponding network plane through the independent network interface group respectively. In each network plane, a primary path via the first core switch and a backup path via the second core switch are established respectively. The primary path and the backup path are redundant to each other, so as to form plane-level redundancy between the two network planes and core switch-level redundancy in each network plane. The dual-redundant TTE bus topology also includes a receiving device; the receiving device performs consistency checks on data frames received from different redundant paths based on the stream identifier, sender identifier, frame sequence number and check result, receives the first data frame that arrives and is correctly checked, and discards subsequent duplicate frames with the same frame sequence number. The nodes of the dual-redundant TTE bus topology include receiving devices, domain controllers, and core switches. Each node in the dual-redundant TTE bus topology has a local port scheduling table, wherein the network plane has a terminal system port scheduling table, and the core switch in each network plane has a switch port scheduling table. Each port scheduling table includes a primary scheduling item under normal conditions and a backup scheduling item corresponding to a preset fault identifier. During system operation, each node in the dual-redundant TTE bus topology establishes a global time base and sends or forwards TT stream frames at a specified time according to the primary scheduling item in the local port scheduling table; after detecting a link or core switch failure, the backup scheduling item corresponding to the fault identifier is activated according to the port scheduling table, so that the affected TT stream is forwarded through the reserved port time slot of the redundant core switch. Each of the primary and backup scheduling items includes the TT stream set and the RC stream set; The method for determining the TT flow set includes: calculating the basic period and super period based on the period of each TT flow, and generating candidate paths for each TT flow that are located in two network planes and whose links do not intersect; for each fault state in the normal state and the preset fault set, jointly calculating the primary transmission time slot and backup transmission time slot of each TT flow on each switch port, so that the frames of TT flows on the same port do not overlap and satisfy the hop-by-hop forwarding order constraint and the end-to-end deadline constraint; The method for determining the RC stream set includes: calculating the reserved bandwidth for each link's RC streams based on the maximum frame length and bandwidth allocation interval of each RC stream; The remaining bandwidth after deducting the equivalent bandwidth occupied by the TT flow, the reserved bandwidth of the RC flow, and the guard interval is used as the available bandwidth of the BE flow.

2. The dual-redundant TTE bus topology according to claim 1, characterized in that, The nodes of the dual-redundant TTE bus topology also include access switches and terminal devices. The access switches are used for interaction between the terminal devices and the domain controller. The domain controller is connected to at least two access switches or one access switch with dual uplink ports, so that the uplink links of the access switches are mapped to independent communication channels of network plane A and network plane B, respectively.

3. The dual-redundant TTE bus topology according to claim 2, characterized in that, The dual-redundant TTE bus topology includes: a flight control domain controller, a power domain controller, and a cockpit intelligence domain controller. The access switch is cascaded with the cockpit intelligence domain controller, and the terminal devices cascaded with the access switch include at least one of the following: a seat display terminal, an environmental sensor, and an occupant service terminal.

4. The dual-redundant TTE bus topology according to claim 1, characterized in that, Network plane A and network plane B employ different implementation methods in at least one of the following: physical transmission medium, physical layer transceiver, core switch hardware platform, power supply source, or cable laying area.

5. The dual-redundant TTE bus topology according to claim 1, characterized in that, The receiving device is the computing unit of the main control computer. The main control computer includes multiple computing units, each of which is connected to network plane A and network plane B through an independent port to receive data frames transmitted on different redundant paths of the same data stream.

6. The dual-redundant TTE bus topology according to claim 1, characterized in that, Let the first The period of each TT stream is Basic cycle The greatest common divisor of each TT flow cycle, and the supercycle. It is the least common multiple of the TT flow cycles; when the TT flow cycle is... TT flow is a link When the TT stream is on, the first A TT stream in the link The last time occupied according to Calculation, where For TT stream Maximum frame length, For Ethernet frame protocol overhead, For link Link speed, For link The protection interval covers clock synchronization error, switching jitter, and transmit / receive switching time. The constraint model is constructed using time slot mutual exclusion constraints under the same fault state of the same link, sequential constraints of adjacent forwarding links, redundant path separation constraints, clock synchronization error constraints, and end-to-end deadline constraints. The port scheduling table is obtained by solving the problem using mixed integer programming, satisfiability model theory, or constraint programming.

7. The dual-redundant TTE bus topology according to claim 6, characterized in that, For links RC stream reserved bandwidth according to The calculation is performed, where the summation range is the path traversed by the links. Each RC flow , For RC flow Maximum effective payload length, For frame protocol overhead, For RC flow Bandwidth allocation interval, A safety factor of not less than 1; Under the conditions that the worst-case end-to-end delay of the RC flow does not exceed its cutoff period and the total link utilization does not exceed a preset upper limit, the minimum value that meets the conditions is selected. .

8. The dual-redundant TTE bus topology according to claim 1, characterized in that, For multiple backup scheduling items that will not be activated simultaneously under the single-failure assumption, multiple backup scheduling items are allowed to reuse the same time interval; For primary and backup frames that will be sent from the same output port under the same fault condition, non-overlapping port time slots are allocated so that the redundant core switch does not conflict with the traffic of its original TT flow when taking over the fault traffic.

9. A scheduling method for a dual-redundant TTE bus topology, characterized in that, The dual-redundant TTE bus topology is as described in any one of claims 1 to 8, and the scheduling method includes: The network topology and preset fault set of the dual-redundant TTE bus topology are obtained, and the TT flow set, RC flow set, and BE flow set are determined to form a port scheduling table for the dual-redundant TTE bus topology. Specifically, the basic period and super-period are calculated based on the period of each TT flow, and candidate paths located in two network planes with non-intersecting links are generated for each TT flow. For the normal state and each fault state in the preset fault set, the primary and backup transmission time slots for each TT flow on each switch port are jointly calculated to ensure that the frames of TT flows on the same port do not overlap and satisfy hop-by-hop forwarding order constraints and end-to-end deadline constraints. The reserved bandwidth for each RC flow is calculated based on the maximum frame length and bandwidth allocation interval of each RC flow, and the remaining bandwidth after deducting the bandwidth occupied by TT flows, the reserved bandwidth of RC flows, and the protection interval is allocated to the BE flow. Write the calculated port scheduling table into the corresponding node of the dual-redundant TTE bus topology.

10. A computer-readable storage medium having program instructions stored thereon, characterized in that, When the program instructions are executed by the processor, the scheduling method as described in claim 9 is implemented.

Images