ES2577777T3 - Data transfer - Google Patents

Description

image 1

DESCRIPTION

Data transfer

The present invention relates to data transfer.

5 Packet switching networks have long been considered as a way to provide systems, including avionics systems, with very large connectivity and bandwidths, avoiding the bottlenecks and limitations associated with division multiplexing protocols. of time (TDM, time division multiplexing), such as MIL-STD-1553B and STANAG 3910. These TDM protocols share network resources by planning transfers consecutively, which requires a significant level of coordination

10 between the different data sources. This coordination of transmissions over the network is not usually a problem when the network is based on a shared medium. In this case, a centralized control function, such as a bus controller, can be used to control all transmissions and ensure there are no conflicts. However, this coordination can be a very important problem in packet switching networks. This is because, in packet switching networks, this centralized control function is

15 difficult to implement (and would be extremely restrictive, if possible), and the distribution of such a function requires tight synchronization of the entire network and, therefore, severely limits the planning mechanisms that can be used in a system of this type.

An option commonly used in commercial packet-switched network protocols, such as Ethernet, is to allow all users to transmit at any time. FIFO queues are then used to store traffic in buffer in the shared resources as long as the loads are temporarily larger than the resource can take. However, these buffer memories will always have a limited capacity to cope with traffic peaks, due to their finite size. Therefore, if they are overloaded, that is, the traffic peaks are too large or last too long, the resource becomes congested, the buffer overflows, and therefore data is lost. Even when the buffer does not overflow, it can be filled

25 so that the delay through it is excessive. Being, in general, both situations unacceptable in real-time systems.

A known procedure to prevent this congestion is to limit the bandwidths of the traffic that shares the resources and to predict the maximum load or the use of the buffer that this will cause. The forecasts can then be compared with the actual sizes of the buffers to show whether or not a

30 overflow, and the delay caused by this use can be used to show whether or not the transfers can be delayed too much.

Buffering introduces an additional delay that does not occur in the TDM protocols; however, this delay is very small compared to the delays that can occur in the sources when the resources are shared by TDM, for example, when the data is waiting for its time slot

35 of assigned transmission, which may reach the data transmission interval (for example, 20 ms for 50 Hz data transfers). Since, in commercial packet switching networks, users can transmit as soon as the data is ready, these networks do not suffer such transmission delays.

The well-known ATM protocol is, in many ways, suitable for transporting data in real-time systems, since it has all the properties necessary to route traffic deterministically and limit the bandwidth. This allows to predict the loads in shared resources and the subsequent delays. ATM performs this routing using virtual channels (VCs, Virtual Channels), which are "conduits" oriented to the connection that transport the data along deterministic paths. The mechanism used to limit bandwidths in ATM is the sharing of hardware-based traffic at the source, and the monitoring of network traffic: the monitoring of traffic on the network effectively fixes the size of the conduit that is a VC, and the

45 traffic sharing at the origin guarantees that the origin does not try to send too much data in this pipeline.

Although ATM can provide deterministic data transfer, it has not spread significantly beyond its niche in telecommunications infrastructure, in part because the complexity of hardware at network interfaces makes them considerably more expensive than equivalent interfaces Fast / Gigabit Ethernet. At the same time, Ethernet is a packet switching network protocol of use

50 much more widespread, virtually ubiquitous, in the commercial sector. Therefore, it is desirable to take advantage of the amplitude of components, such as processor boards, etc., which already incorporate interfaces for the Ethernet protocol. This can reduce the initial costs of avionics systems and reduce ownership costs by reducing obsolescence problems and facilitating performance improvements, that is, by providing higher network bandwidths.

55 Ethernet networks that have to transport this type of deterministic data, in some cases, will already exist and will already be transporting uncontrolled traffic or better effort when the requirements to support deterministic data transfers arise. As a result, protocols that allow a network of this type to satisfy deterministic data requirements will have to be applied after its initiation; the only other alternative would be to contemplate them initially, for example with modified / customized interfaces, with the expectation that these requirements will arise in some subsequent data. Therefore, it is important that the process of updating an existing network has the least possible impact on the system and on the best existing traffic previously existing, that is, it should not be necessary to modify subsystems that do not have to participate in these new ones

image2

5 transfers. Additionally, in some cases, it will be necessary to demonstrate the security of the data, that is, that it is authentic and resistant to modification or unauthorized access.

There may be significant advantages if systems and subsystems can use more advanced planning mechanisms than the cyclical executive, such as priority planning based on priorities. There are also advantages in systems that support software reuse, if data transfers can be made to the

10 natural frequency of the application, which may not be harmonically related to other application frequencies. For example, adding an application that has a natural frequency of 60 Hz to a system in which most applications operate at 50 Hz and subharmonics of these, which is a difficult task when using cyclic planning.

Therefore, it is desirable that any deterministic data transfer uses standard Ethernet interfaces;

15 allows data transfer with security, reliability and / or punctuality requirements; can be applied to existing networks with the minimum impact, that is, allows the non-controlled, inherited traffic to continue using the network and support the maximum possible variety of planning mechanisms, and can previously demonstrate that these deterministic requirements are met. Optional requirements are system failure resistance, that is, over-transmission by subsystems, and network failures, that is, errors of the network components - switches,

20 network interfaces and cables.

Document US2006 / 002370 describes an architecture of the control plane / transport plane for controlling a carrier network formed by Ethernet switches. The carrier edge switches can be logically separated into a single provider edge (PE, Provider edge) and one or more PE edge function. The PE core function can be used to encapsulate incoming Ethernet traffic 25 from the client using MAC type encapsulation and to forward the encapsulated traffic through the carrier network. The VLAN tags are used to provide separation of clients in the logical PE core, with each different client site connected to each edge switch having a unique VLAN tag. The logical PE kernel of an edge switch encapsulates each Ethernet frame in another Ethernet frame using the MAC address of the edge switch as the source address and the MAC address of the appropriate output point (the destination address 30). In the PE core of the edge switch, the original frames are stripped of their encapsulation and sent over a communications link via the PE edge of the edge switch to a client switch. Each switch, upon receiving an Ethernet frame in a port, broadcasts said Ethernet frame in each of the other ports. The process is repeated as the frame is received by other switches. In this way, the plot is disseminated throughout the network. The MAC address self-learning functionality is provided to improve the efficiency of the configuration in switched Ethernet networks. Ethernet frames have source and destination MAC addresses corresponding to their source and destination Ethernet switches. When an Ethernet frame emitted by a source switch is received by an intermediate receiver or destination Ethernet switch, the receiver switch observes the port in which the frame has been received and the source address of the frame. The receiver switch then constructs a forwarding table for use in future frame switching. The VLAN tag defined in IEEE 802.1 q is applied in such a way that the Ethernet switches on the bearer network are aware of VLAN 802.1 q but are configured to use a combination of destination address and VLAN tag to forward data traffic. This is preferably achieved by reusing the existing capabilities in each Ethernet switch to store separate forwarding tables for each configured VLAN tag, with the VLAN tag acting as a mapping (or

45 indexing) for forwarding tables.

WO2006 / 070197 discloses a communication scheme for configuring a network comprising a series of switched switching devices, the scheme comprising: determining in a control plane index header field values to identify traffic without received connection in switching devices for which a connection must be established between a source node and a destination node; provide each switching apparatus necessary to implement a connection, of information of the control plane, allowing said information to feed the switching data forwarding tables with said index header field values in association with output ports of the control apparatus. commutation; and deactivating any other functionality in said switching apparatus that can power the data forwarding tables with index information associated with said output ports of the switching apparatus necessary to establish said

55 connection. The forwarding tables of the switching apparatuses are provided directly with address information associated with outgoing ports of the switching apparatuses. In some embodiments, the control plane feeds the entries in the forwarding table with at least one other Ethernet header field in addition to the destination address field, and also associates a VLAN with an outbound port, or a switch out port. . This VLAN ID is used to extinguish between multiple paths through the communications network.

Document US2005 / 157737 describes a network that includes an edge node configured to define behaviors per hop, using a set of bits in an Ethernet header of a frame, and a central node configured to receive the frame and to forward the frame of agreement with the behaviors per jump.

image3

US 7 369 495 relates to a method and a network device for sharing bandwidth among a group of traffic classes for an interface. The bandwidth can be assigned, at least, to a traffic class of a first priority for the interface. At least part of the unused bandwidth of said at least one traffic class can be assigned, at least, to another traffic class of a second

5 priority for the interface.

In document US2003 / 0154259, a VPN service is provided through a shared network infrastructure comprising a series of interconnected provider edge devices having client edge interfaces. Some of the CE interfaces are assigned to a VPN that supports a series of virtual local area networks (VLANs) and is arranged to exchange traffic data units with

10 CE devices. Each traffic data unit includes a VLAN identifier. At least one virtual connection is established in the shared network infrastructure between two CE interfaces of different PE devices, assigned to said VPN, for forwarding said traffic data units including a VLAN identifier. Said virtual connection (VC, virtual connection) has an identifier determined from said VLAN identifier, and an identifier of said VPN.

Document US2004 / 0213254 discloses a method for servicing subscriber ends using virtual LAN in ADSL (ADSL Termination Unit - Remote, ADSL termination unit - remote) of ADSL, which uses VLAN to generate a series of virtual connections in an ADSL connection, couples computers from each subscriber end to a series of subscriber input / output (I / O) ports in ATU-R, adds a switching center in the ATU-R to identify data tagged in virtual connections, connects each end of the subscriber in the

20 virtual connections to the switchgear via Ethernet, and assigns each subscriber I / O port in the switchboard to one of the virtual connections with a differentiator tag.

None of the patent publications mentioned in the foregoing specifically proposes designating a computing device as the sole source of data on VC in a network in the same way as the present invention, and therefore does not solve the technical problems related to safety and security. congestion that

25 described herein.

The embodiments of the present invention are intended to solve at least some of the problems explained above and provide the transfer of data reliability, punctuality, security and / or fault tolerance requirements through an Ethernet packet switching network , in parallel with ordinary data, better effort, and using standard Ethernet network interfaces. Embodiments can use VCs for reliable, secure and / or timely data transport over a full-duplex switched gigabit Ethernet network that uses the virtual local area network (VLAN) protocol to identify the VCs and the class protocol. service (CoS, Class of Service) to separate the data of these VCs with respect to other data that do not have these requirements. The outputs can be used to demonstrate to a customer or certification body that data transfers between standard Ethernet interfaces on a switched Ethernet network will always satisfy

35 security requirements (the issuer can trust that the data goes only where it should be, and the receiver can trust that it only comes from where it should be), reliability (that the data will not be lost due to the consequences of other traffic, that is, there can be no congestion, in the network) and / or punctuality (that the data arrives within a specified deadline, with respect to its transmission time).

According to a first aspect of the present invention, a data transfer system 40 is disclosed which includes:

at least one switching device configured, during its use, to transfer data, directly or indirectly, between a series of computing devices,

wherein said at least one switching device is configured to provide a series of VLANs within which a virtual channel (VC) can be configured by means of VC data transmitted as frames

45 of Ethernet tagged with a VLAN tag,

the VC data being routed through said at least one switching device, according to a VLAN ID field of the VLAN tag of said frame; characterized in that each of said VLANs is configured as a respective VC when receiving VC data from a computing device designated as the unique VC data source on the respective VC, and because a fixed and predetermined routing of the VC is determined.

50 frame by configuring said at least one switching device.

In embodiments comprising a plurality of said switching devices, each of said switching devices can use VLAN trunking to allow transmission over, and reception from, a series of VLANs, thereby allowing said series to be connected together. switching devices. In this case, the VLAN tag of one of said frames is inserted or externally removed from said at least one

55 switching device.

Said VLAN tag may use any available Tag Protocol (TPID) value, and may designate at least one of said computing devices other than said single source computing device as at least one destination for the data. of VC. Alternatively, when the VC data has security requirements, the VC may be limited to said computing device designated as the sole destination for the VC data (in order to prevent the destinations from receiving spurious data from different, faulted or malicious destinations). , as may occur in conventional VLANs).

image4

At the outputs of said at least one switching device, the VCs can be assigned to a memory

5 VC buffer and routed through it. The routing through the VC buffer can be by means of the CoS protocol described in IEEE 802.1d, and company. A priority code point (PCP) on the VLAN tag can be used to identify the VC data for routing through the VC buffer. The buffer shall receive priority over all other buffers associated with the output of said switching device, so that it does not

10 no other traffic (eg, non-critical) is transmitted from the output when the VC buffer contains some Ethernet data frame.

Each mentioned VC will be assigned a maximum bandwidth. Said at least one switching device may use traffic control messages that limit each said VC individually to its aforementioned maximum allocated bandwidth, for example, by delaying and / or rejecting any traffic that

15 exceeds this limit (determined, for example, by getting too close to the previous frame of the same VC, based on the bandwidth and the tolerated fluctuation for said VC). This can be done, for example, by using the known permissions bucket algorithm ("token bucket") or leaking cube ("leaky bucket").

A maximum fill level can then be calculated for each of the aforementioned VC buffers, and the maximum level of filling can be compared with actual sizes of the buffers to avoid, or

20 reduce the probability of congestion within, or between, buffers allocated to VCs. The end-to-end delays for the VCs can also be calculated, using the fill levels for the buffers through which they are routed, and compared with any time limit requirements for the VCs.

Said at least one computer device may comprise, for example, replaceable avionics units in line (LRUs, Avionic Line Replaceable Units).

Normally, VLANs will comprise IEEE 802.1q VLANs. The series of switches will normally be configured to provide an IEEE 802.3 full duplex switched gigabit Ethernet network.

In accordance with another aspect of the present invention, a communication network is disclosed which includes a data transfer system substantially as described herein, which includes

30 minus a switching device and a series of said computing devices.

In accordance with another aspect of the present invention, there is provided a method for providing data transfer between computing devices, including the method:

configuring at least one switching device, in use, to transfer data, directly or indirectly between a series of computing devices, wherein said at least one switching device is configured

35 to provide a series of VLANs within which a virtual channel (VC) can be configured by means of VC data transmitted as Ethernet frames labeled with a VLAN tag,

the VC data being routed through said at least one switching device, according to a VLAN ID field of the VLAN tag of said frame; characterized in that each of said VLANs is configured as a respective VC when receiving VC data from a computing device designated as the only one

40 VC data source on the respective VC, and because a fixed and predetermined routing of the frame is determined by the configuration of said at least one switching device.

Although the invention has been described in the foregoing, it extends to any inventive combination of features set forth in the foregoing or in the following description. While exemplary embodiments of the invention are described in detail herein with reference to the accompanying drawings, it should be understood that the invention is not limited to these precise embodiments. Thus, many modifications and variations will be apparent to those skilled in the art. Furthermore, it is contemplated that a particular feature described either individually or as part of an embodiment, may be combined with other features described individually, or with parts of other embodiments, even if said other features and embodiments do not mention the particular feature. Therefore, the invention extends to said specific combinations not

50 described.

The invention can be carried out in various ways and, by way of example only, embodiments thereof will be described, reference being made to the accompanying drawings, in which:

Figure 1 schematically shows a communications network that includes a series of switching devices configured to transfer data between a series of computing devices, and

Figure 2 shows the format of an Ethernet frame.

image5

Referring to Figure 1, a communication system is shown that includes a set of switching devices 102A-102C. Each switching device is connected to at least one computing device 104A-104F, which may be a conventional computing device, for example in-line replaceable avionics (LRU) units, and may be configurable to act as a network host equipment. The

5 system components are used to provide an IEEE 802.3 full duplex switched gigabit Ethernet network, in which a number of VLANs, as described in IEEE 802.1 q, and company, are used as VCs for data transfer. Host computers in this system can, through the use of trunked VLANs, be capable of transmitting and receiving from a series of VLANs.

A VLAN is configured as a VC with a critical data source among the computing devices 104.

10 This data is transmitted in the form of Ethernet frames labeled with a VLAN tag, which can use any available TPID value. The VC can have a series of destinations for this data. However, when the data has security requirements, the VC can be limited to a single destination between the computing devices 104 to prevent the destinations from receiving spurious data from different, faulty or malicious sources, such as may occur in VLANs. These VCs / VLANs, are routed through one or several

15 switching devices 102 in their VLAN ID (which is contained within the VLAN tag, as explained below) and have fixed and predetermined paths. The predetermination of the paths is contained within the configuration of said one or more switching device.

Critical data on these VCs can only be transferred from the authorized source and only to authorized destinations. However, this will only apply when the configuration of the network switches is adequately secure. Specifically, the configuration of the switch or switches through which the VCs are routed must be limited to avoid VLAN skip attacks, for example, double labeling and switch spoofing, and may be modified only by authorized means. It is likely that the limits in the configurations include requirements such as that no output of the switch by which one or more VCs are routed can remove VLAN tags. It is likely that the limits on the configuration means include, for example, that the dynamic trunking protocol or the multiple VLAN registration protocol can not be used to modify the VLANs that are used as VCs (which prevents the VCs with critical data being subjected to switch impersonation attacks), and the switch configuration procedures for VLANs used in this way must be adequately secure. There may also be a requirement that host equipment interfaces that receive this critical data on VLAN VCs receive

30 only Ethernet frames that are tagged with VLAN tags, including any non-critical data they may have to receive, where the VLANs used for the non-critical data will be of lower priority (they will have a lower PCP value) than the critical data ( that will prevent the switch outputs connected to these host equipment from having to remove VLAN tags by default from non-critical data, and thus prevent host computers and critical data VCs from being subject to double-label attacks).

For VCs that are configured with a single source and a single destination, the limitations on how VCs are routed through the switch or switches, that is, using the VLAN ID, will ensure that the data received by the destination must proceed of the intended origin: frames that contain the correct VLAN ID that are transmitted by different, erroneous or malicious host computers will not be allowed to join this VC, because there is no routing data supplied to the switch for the inputs to those that are

40 connected said erroneous or malicious host computers. Therefore these VCs are, except for circumstances that involve failures in the network switches and / or in the data protection scheme incorporated in the Ethernet standard, immune to data spoofing attacks.

Switching devices 102 may be core switches and sub-system switches, which satisfy the basic support requirements for IEEE 802.1 q (including trunked VLANs), and for IEEE 802.1p, 45 which allow at least two priority levels with buffers independent for each, and having the buffer memory of high priority traffic, simple priority over the lower one. The specifications of the IEEE 802.1 support are that the switches have to be configurable in such a way that the frames that arrive at a port from the connected host equipment tagged with a specific VLAN ID, are routed only to a subset of the other ports of the switch. In the ideal case, the set of ports to which

50 a given VLAN ID should be specified in each entry, that is, the port ID increments the VLAN ID. However, in common with the normal use of VLANs in COTS networks (commercial off the shelf, available in the market), it is acceptable that the association is made by configuring these other ports so that they have these frames routed to them. The difference being that the first procedure would allow a limited reuse of VLAN IDs within a switch.

Switching devices 102 also have to be configurable in such a way that untagged frames arriving at a port from the connected host equipment can be internally tagged with a default / native VLAN ID specific to that port, and as such so that frames routed internally to these from other ports that are labeled with a default / native VLAN ID, specific to that port, may be stripped of their tags before retransmission.

Switching devices 102 also provide operation at wire speed, i.e., they provide a central switching bandwidth that is at least equal to the sum of the input bandwidths. They use shared buffer storage, centralized, or individual output buffer, and use storage and forwarding switching. Operation at wire speed will ensure that there is no buffer storage in the switches that can lead to a line head lock. The use of shared / centralized or output buffers

image6

5 allows the uses of the buffers to be calculated and compared with the available sizes of the buffers. The storage and forwarding switching requirement ensures that frames are not rerouted to corrupt VLAN IDs, etc.

Switching devices 102 can be configured off-platform, or out-of-band by a single subsystem on the platform. They can also be configured in band by some suitably secure method, for example the well-known simple network administration protocol. In all cases, other unused means of configuring switches will be disabled, specifically the autonomous VLAN configuration and traffic monitoring, including DTP and MVRP, that is, the VCs implemented by the methods described herein will be equivalent to so-called permanent VCs (PVCs, Permanent VCs) used in ATM networks instead of so-called switched VCs (SVCs, Switched

15 VCs).

Switching devices 102 are configured to provide full duplex packet switching network Ethernet implementations. It will be appreciated that the system shown in the figure is only an example, and that the number and arrangement of switching and computing devices may vary. For example, the simplest possible architecture comprises a star, with each host computer 104 connected to one of the ports of a single switching device (this may be duplicated, for example, for redundant networks). When there are more hosts to interconnect than can be connected in a timely manner to a single switch, multiple switches can be used. These switches can be connected together, to allow a host computer connected to one to communicate with host equipment connected to another. These links between switches can then limit transfers, if

There is a need for a significant number of connections between host equipment in one and host equipment in others. This can be simplified by using higher bandwidth connections for these links between switches, that is, using 10 gigabit Ethernet in a generally gigabit Ethernet network.

If more than two switching devices 102 are interconnected, this can then create rings: for example, A connects to B, connects to C, connects to A, etc. Such rings in a single diffusion domain, 30 may cause diffusion traffic to be repeatedly regenerated and, generally, flood the network. A known solution is to use the fast spanning tree protocol to detect such loops and disconnect one of the links in the loop, breaking it in that way and preventing the accumulation of broadcast data. For the VLAN VCs described herein, it is assumed that they will be configured without loops or that the multiple spanning tree protocol will be used to break any loops formed. This can also be

35 a potential network redundancy implementation procedure, with the proviso that it may take at least 3 seconds to reactivate a link if there is a physical layer failure.

The system shown comprises existing components of the standard Ethernet protocol: use of standard device drivers and COTS operating system, etc. The present inventors have investigated the Ethernet standards and have discovered that apparently there was a means of implementing VCs already present in 40 IEEE 802.1q: virtual local area networks (bridge) (VLANs). Initially, this was considered a way to implement a fully COTS equivalent of the well-known AFDX protocol using the VLAN ID instead of the VLink ID. However, after understanding that this would require updating the existing networks in such a way that all traffic used VLANs, the inventors understood that the IEEE 802.1p class of service (CoS) could be used to allow separation of the traffic in the VLANs from the best effort traffic as well as between them,

45 if this best effort traffic is assigned a lower priority, or has it by default.

Figure 2 shows the format of a frame 200 labeled VLAN, which includes a 4-octet VLAN label 202. The Ethernet frames transmitted in a VLAN are identified by a specific value 204 of the 12-bit VLAN ID in label 202, which is introduced in the Ethernet frame in front of the Ethertype field. Another field 206 PCP of 3 bits indicates one of 8 classes of service. The Canonical Format Indicator (CFI, Canonical Format Indicator) 208

50 of a single bit is not used in this embodiment. Some small amount of support data, for example, responses to requests from the address resolution protocol or neighbor discovery protocol, will pass / may pass from the destination or destinations to the origin and be tagged with the ID for the associated VLAN with the VC.

Conventional VLANs were developed to interconnect host groups as if they were, and

Only these, were coupled to the same domain of diffusion, regardless of their physical location. Therefore, a VLAN has the same attributes as a physical LAN, but it allows the host computers to be grouped together logically even if they are not located on the same network switch. Several of these VLANs can share the same physical domain, for example, being connected to the same physical switch, each one being isolated from the others. Switching devices that support IEEE 802.1 VLAN q,

60 do this by means of a set of virtual switches, one for each VLAN, the physical switch ports being associated with a series of these virtual VLAN switches.

image7

Typically, switches that support VLANs transform untagged traffic into a default VLAN upon arrival, that is, they add a label indicating VLAN ID 1 and generally remove this tag in the transmission. They can also be configured to add a label with a different VLAN ID value to a port, route only VLANs with this tag to that port, and remove them in the transmission. This allows

5 that a host computer connected to that port is in a VLAN but, by ignoring it, making the switch all the work. This is known as port-based VLANs and port-based VLAN switching. Therefore, the host computer connected to this port is in the VLAN associated with the port, but ignoring it, and does not have to be compatible with IEEE 802.1q, etc., since it neither adds VLAN tags to its transmissions nor receives any frame tagged However, this is not how the VLANs are used in the present embodiment.

The present inventors considered that each VLAN being isolated from all the others in a port-based VLAN switching is a limitation in which there is a need to connect a host to multiple VLANs, for example, when this host is a server, etc., or when it is necessary to connect multiple switches together, each supporting a fraction of one or more VLANs. Therefore, they decided to use another known operating mode, called trunked VLAN. In this mode, the switch ports

15 can be associated with multiple VLANs, and can leave them tagged when they transmit these frames. A host computer connected to a trunking port then has to add and remove the VLAN tags themselves, and can simultaneously transmit and receive from multiple VLANs. This is how VLANs are used for deterministic traffic in the present embodiment.

In the present embodiment, it is always assumed that the switching of VLANs that carry deterministic data is

20 using VLAN trunking for the deterministic data, and that the VLAN tags that identify these VLANs should never be entered or removed by the switch. As a result of this virtual switching, a VLAN (trunked) that is used to transport only one type of data, where only one host computer is used as the nominal source of this type of data and all other connected host equipment are then destinations of this type of data, becomes, in all significant aspects, a VC.

25 Since VLANs are routed through a virtual switch, instead of through a virtual exchange, the traffic routing identified with a VLAN is also modified by the MAC destination address. In this way, a frame identified with a VLAN and containing a specific MAC address will only go to the port associated with the VLAN and connected to the specified MAC address. However, a broadcast MAC address can be used when the frame is transmitted to all ports associated with the VLAN (except that

30 in which it is received).

As indicated above, field 202 VLAN ID has only 12 bits in size, which limits the number of separately identified VCs to 4094 (a pair of values are reserved). If identification of the VCs is necessary to maintain consistency throughout the system, and this is the only identification, then this means only 4094 VCs throughout the system. However, this would be an artificial limit due to

35 that the VLAN ID values can be reused. With COTS VLAN-compliant switches, the real limit is that there can not be more than 4094 VCs routed through any switch. Therefore, in larger networks, different VCs that are routed through different switches can reuse the same ID. Requirements could then be satisfied for the unique identification of data using, for example, a message type ID in the payload.

40 Switching devices that are compatible with the IEEE 802.1 p CoS can be configured to transmit IEEE 802.1q tagged traffic through independent output buffers. This can be done by setting the source to set the PCP value on the label to a high value (for example, 7) and setting the switch to associate this service class with the high priority buffer. The switches can also be configured to service these high priority buffers, with

45 strict priority over the buffer used for the best effort traffic, which can be configured by default to a lower priority. In this way, when a tagged prioritized frame arrives at an exit, it will be transmitted with a delay caused only by the other high priority traffic and at most by a low priority frame (if there was a newly started one when the first high frame arrives). priority).

At the output of each switching device 102, the VCs are assigned to a buffer and are routed to

50 through it, for example, using the service class protocol (CoS) described in IEEE 802.1d, and company. This buffer receives a simple priority over all other buffers associated with the same output of the switch, so that no other traffic (for example, non-critical) is transmitted from said output when there is some Ethernet data frame contained in it. the VC buffer.

Each VC can be assigned to a maximum bandwidth that it can use. Network switches can

55 use traffic control measures that individually limit each VC to its assigned bandwidth, for example by delaying and / or rejecting any traffic exceeding this limit, determined, for example, by getting too close to the previous frame of the same VC, based on the bandwidth and the tolerated fluctuation for said VC. This can be done, for example, using the known permissions cube or leaky cube algorithms, or an equivalent, that is, an algorithm that strictly limits the nominal data frequency and the

60 maximum traffic fluctuation in an individual VLAN VC, independently between each input and the buffers. The specific requirements for the range and resolution of the bandwidth (nominal range) and the tolerance to fluctuation may vary. However, the range in the nominal range (which is equivalent to the AFDX bandwidth allocation space) should cover intervals from at least 12 μs up to one second. The tolerance to fluctuation should cover a range from zero and up to at least several

image8

5 milliseconds (assumed to be sufficient for multilevel switch hierarchies to at least a 4-layer depth).

Simplifying, permissions cube and leaking cube algorithms measure the average frequency at which data arrive in a VC and the variation around it, essentially, how much earlier they arrive compared to when they should, based on the nominal bandwidth . Basically, the frames should reach the nominal frequency, but

10 some may arrive early, due to fluctuation. However, if more than the expected fluctuation arrives before an "ideal arrival time" (obtained from the nominal frequency), it must have been transmitted too soon, that is, in a bandwidth that is too high, or fluctuated more than allowed, and therefore is abandoned by the traffic surveillance function to protect the buffer.

However, this proposed procedure for fault tolerance of the system (traffic surveillance in the

15 switch inputs), is not supported by the current Ethernet protocols, at least not in relation to VLAN and CoS. However, the functions that provide this feature in the present embodiments are contained entirely within the switch or switches of the core network. Therefore, these features can be implemented while only standard Ethernet features are still used in the subsystems. This means modifying the switch or switches in the core network where tolerance is required.

20 system failures, but since there will be many fewer of these than subsystems, this will be acceptable in most cases.

To ensure that these traffic surveillance functions do not reject legitimate traffic, the bandwidth limit to which a VC is monitored can be adjusted somewhat higher than the bandwidth allocated for the VC, ie the bandwidth that is allows the origin to use in the VC. Similarly, the fluctuation limit can be adjusted somewhat larger than the sum of the variations in the planning at the origin of the VC and the delays between the point at which the transmission and the monitoring function is planned, which must include any variation in the delay between the switch input and the monitoring function. However, this delay may be difficult to measure separately, either as part of characterization or validation versus specification. In this way, it may be necessary to use an overestimated value, for example, the variation in delay between the input and the output of the

30 switch, which necessarily includes delays that precede the monitoring function and delays that occur.

The delays through the switches will comprise two independent types: a type that depends on the traffic flowing through the switch (and, therefore, specific to the system and the network configuration), and a type that, although potentially variable nature, does not depend on the traffic flowing through the switch and, therefore, can be characterized separately from a configuration. By the appropriate specification of the switching devices, for example, with operation at wire speed and output buffers or a centralized and shared buffer which can be modeled as a set of associated virtual output buffers, each one, With a specific switch output, it is possible to ensure that the buffering in the switch associated with the switch outputs is the only source

40 of delays that depend on the traffic flows and, furthermore, that these delays depend only on the traffic routed through the output with which the buffer is associated.

As a consequence of the predetermination of the paths and the limitations applied to the bandwidths of the VCs, the filling levels for, and the consequent delays caused by the switch buffers in the network can be predicted. The maximum levels of filling, either in absolute values or with a probability of occurrence, can then be compared with the actual sizes of the buffers in order to ensure that there can be no congestion within, or between the buffers allocated. to VCs, or that congestion has only a certain probability of occurrence. Therefore, the transport of these frames with VLAN tags over a VC, except losses due to noise and component failures within their paths or host equipment that exceed the allocated bandwidths of other VCs, will be completely reliable or, when

50 the predicted fill levels are probabilistic, it will have a certain probability of success.

Since the bandwidth of each VC can be limited to a known level, it is possible, using known methods, for example network calculation or an equivalent procedure, to predict in advance what the maximum level of filling of each of the buffer in the network for a given set of VCs. These values can then be compared with the buffer sizes available in order to verify that there can be no congestion, that is, that the buffers can not overflow in any case, or that there is a sufficiently low probability that they do it. This can be used to demonstrate the reliability of transfers. The delays that these buffers can cause can also be calculated at the same time, and combined with the other delays, which can be characterized separately from the set of VCs that share the network resources, to provide the maximum delays Extreme, or values whose overcoming has a sufficiently low probability. These can be compared to

5

10

fifteen

twenty

25

30

35

40

Four. Five

fifty

55

60

continuation with any requirements of the deadline for transfers of specific data, to demonstrate that they will be met.

The maximum delay caused by the buffers in the path of a VC can then be added to the non-traffic dependent delays for the same path in order to provide a maximum end-to-end delay in transport, through the network. Similarly, variations in these delays can be added to the path of a VC in order to provide maximum fluctuation in the delivery of the Ethernet frames carrying the critical data. These VCs therefore provide real-time performance.

The use of traffic control in network switches to limit transmissions in VCs will ensure that, except in circumstances involving failures of the network switches and / or the data protection scheme incorporated in the Ethernet standard, the levels of and the predicted maximum delays caused by the buffers in the switches will not be exceeded even in situations in which the host equipment transmitting over other VCs exceeds their assigned bandwidths. The forecasts that there will be no congestion and maximum end-to-end delays, except for the circumstances just listed, will remain valid even in such situations. Therefore, these VCs are, with the exception of the circumstances just listed, immune to denial-of-service attacks which cause congestion and the subsequent loss of data in the buffer output of the buffer.

As a result of using the bandwidth and fluctuations in traffic control, instead of the absolute transmission times for the data, it is possible to use a wide variety of procedures to plan the transmission of critical data, which should be a Facilitator to use advanced planning techniques for the applications that are the origins and receivers of this data. Specifically, the usual cyclic executive procedure can be supported, as well as more advanced techniques such as preferential priority based planning, whenever it is possible to specify the minimum interval between transmissions in a given VC. Also, because the system described herein is based solely on the use of frequency domain techniques in the control and prediction of critical performances, the transmissions may use non-harmonically related update frequencies. This contrasts with procedures that use techniques in the time domain, that is, they synchronize the transmission times over the entire network to avoid conflicts in the shared resources (switch buffers). In these time domain controlled approaches, the transmission frequencies must be essentially subdivisions of a base frequency and, therefore, all transmission frequencies are necessarily harmonically related. For example, the maximum frequency can be set at 50 Hz; in which case, the only minor transmission frequencies that are available will be 25, 12.5 and 6.25 Hz, etc. If this is not the case, then conflicts will occur at a certain frequency determined by their different frequencies. However, in a network using the scheme described herein, one VC may use a transmission frequency of 50 Hz while another, which may have the same origin and / or the same destinations, may use 60 Hz.

Network redundancy to provide fault tolerance of the network is not supported by the current Ethernet protocols. However, again, it is possible to implement this feature, with certain costs, but without departing from the use of COTS and the standard components in the subsystem. A possible way to implement this kind of network redundancy would be in the application layer. A solution of this type consists of using multiple VCs, one through each of the identical networks. These multiple VCs can be extended from applications at the source to applications at the destination. The applications in the destination can then extract data only from one of these, for example, the one that delivers them first. In the context of IMS (integrated modular systems, integrated modular systems) and the TLS (three layer stack), it can be seen that this makes the application layer dependent on the network, since it would not have What to do if the network itself is fault tolerant, etc. However, if the requirements for this fault tolerance are limited to a fraction of potential users, it may happen that supporting network redundancy in the MSUOSL makes these layers dependent on the new platform, or at least adds to them the complexity beyond of the general requirements. In which case, using multiple parallel VCs, despite the additional functionality in the application layer, can be an acceptable solution.

The use of existing components of the Ethernet standards allows the system described herein to be fully compatible with both COTS hardware and COTS software. For example, both Wind River's VxWorks ™ (network equipment edition) and Green Hill's Integrity support IEEE 802.1 and IEEE

802.1 p. Also, the IMS three-layer stack (TLS) currently uses VxWorks ™ device drivers, and therefore should also provide the necessary support. Greenhills Integrity ™ and some versions of Linux also provide support for VLAN and CoS. The embodiments described herein can therefore be used to add deterministic data transfers to new network implementations, i.e., new systems and system updates; and they may also be applicable to systems using existing switched Ethernet networks (and a compatible OS), with minimal impact on existing traffic and operation on such systems. They can also allow the implementation of new systems or new networks knowing that these transfers can be added at a later time without the need to add new interfaces, when they emerge, if they do, the requirements for these transfers. Device drivers, etc., for network interfaces that are not intended to send or receive deterministic traffic will not have

5

10

fifteen

twenty

25

30

35

40

Four. Five

fifty

additional special requirements in relation to their use in system implementations and, therefore, any controller compatible with IEEE 802.3 should be sufficient.

In addition to providing means for demonstrating that criticality requirements will always be met, the embodiments described herein also allow existing Ethernet networks to be updated to support critical data transfers. This is because the implementation uses only the IEEE 802.1q and IEEE 802.1d protocols to identify and route the VCs, and to keep critical data separate from ordinary, non-critical Ethernet traffic. Therefore, VC systems can be implemented using only Ethernet interfaces and device driver software that are compatible with IEEE 802.3-2002 standards or later, incorporating support for IEEE 802.1q VLANs and IEEE 802.1d CoS. Without providing fault tolerance on other host computers, it can be implemented using a switch that is compatible with IEEE 802.3-2002 standards or later, incorporating support for IEEE 802.1q VLANs and IEEE 802.1d CoS. These switches being widely available for both commercial network installations and reinforced for avionics applications, etc. The provision of tolerance to such failures of the system, such as excessive transmission of critical data, will require the modification of the switches used in the system, but will not require modifications of, or in any of the host equipment, nor in those that transmit and receive using the VCs described in this report or those that transmit and receive without using them, provided that these host equipment and its software support VLANs and CoS. Therefore, this procedure for supporting critical systems can be imposed, as an application protocol, on an existing full duplex switched gigabit Ethernet network, with minimal impact on existing host equipment LRUs, and therefore with minimal costs .

The subsystems on some platforms can comprise multiple modules and contain small switches to interconnect them, and connect them to one or more switches of the core network. Others may comprise a single module, and therefore without switching. These sub-system switches will still need to separate better-effort and deterministic traffic (this is also true for any application protocol that adds deterministic transfer to better-effort traffic, such as TTE). In the case of the embodiment described herein, this requires support for both IEEE 802.1 q and IEEE 802.1 p, since it has to recognize and use the PCP in the VLAN tag. For other application protocols, the mechanisms for identifying deterministic data, and, therefore, how the switch determines the priority of traffic, are generally protocol-specific, and will therefore generally require a custom-made switch in this context.

Embodiments of the data transfer system described herein may have the following advantages:

• It's economic:

 Economic to implement or add as an update - the components can be COTS or MCOTS.

 Economical to own -continue to be compatible with future subsystem components, ie, Ethernet chipsets in processor cards, minimizing obsolescence problems associated with the network.

 Economical to update once implemented-minimizes the impact of upgrading to greater physical layer bandwidth (for example, 10 gigabit Ethernet) and / or to a larger network (for example, multiple switches).

• The impact on the functioning of systems and subsystems is minimized:

 It does not prescribe or proscribe traffic planning procedures - it is not necessary to plan cyclically or synchronize transmissions through different subsystems - direct support for advanced planning procedures, for example preferential planning based on priorities.

 Supports acyclic / sporadic transfers

 Supports non-harmonically related transfer frequencies (split frequency procedures are not required).

•

Perfectly suitable for information channeling systems:

 The data can be transferred as soon as they are processed (with preferential planning, they can also be processed as soon as they are received).

•

Low impact against changes - added traffic without changes in other subsystems:

 It is only necessary to recalculate the uses of the buffers to confirm that there is still no congestion and the deadlines are still being met.

•

Compatible with standard protocols of higher layers, for example, internet protocols (UDP, TCP, etc.).

Claims (12)

image 1 1. A data transfer system, which includes: at least one switching device (102) configured, in use, to transfer data, directly or indirectly, between a series of computing devices (104), 5 wherein said at least one switching device is configured to provide a series of virtual local area networks (VLANs), within which a virtual channel (VC) can be configured by means of VC data transmitted as frames of Ethernet (200) labeled with a VLAN tag (202), the VC data being routed through said at least one switching device, according to a VLAN ID field (204) of the VLAN tag of said frame; characterized because: Each said VLAN is configured as a respective VC when receiving VC data from a said computing device designated as a single VC data source on the respective VC, and because the fixed and predetermined routing of said frame is determined by the configuration of said at least one switching device. 2. A system according to claim 1, including a series of switching devices (102), using each 15 one of said trunked VLAN switching devices to allow transmission over, and reception from, a series of VLANs, thereby enabling said series of switching devices to be connected together. A system according to claim 2, wherein the VLAN tag (202) of said frame is inserted or removed externally from said at least one switching device (1102). 4. A system according to any one of the preceding claims, wherein said VLAN tag (202) uses any available tag protocol ID (TPID) value and designates at least one said computing device (104) different from said single originating computing device as at least one destination for the VC data. 5. A system according to any of claims 1 to 3, wherein the VC is limited to a mentioned 25 computer device designated as a single destination for the VC data, in order to prevent destinations from receiving data from other sources. A system according to any one of the preceding claims, wherein at an output of said switching device (102), the VCs can be assigned to, and routed through a VC buffer, and routing through the VC buffer is by means of a service class protocol (CoS) of 30 IEEE 802.1d.

7

 A system according to claim 6, wherein a priority code point (PCP) field (206) is used in the VLAN tag (202) to identify the VC data for routing through the VC buffer.

8

A system according to claim 7, wherein the VC buffer receives priority over any

35 other buffers associated with the output of the switching device (102), so that no other traffic is transmitted from the output when the VC buffer contains some Ethernet data frame. 9. A system according to any of the preceding claims, wherein a maximum bandwidth is assigned to each said VC. 10. A system according to claim 9, wherein said at least one switching device (102) uses traffic control measures that individually limit each said VC to said assigned maximum bandwidth, for example by delaying and / or rejecting any traffic that exceeds the maximum bandwidth. 11. A system according to claim 10, wherein the traffic control measure comprises a permissions cube algorithm or a leaking cube algorithm. 12. A system according to any of claims 9 to 11, wherein a maximum level of filling is calculated for each of said VC buffers and said maximum level of filling is compared with the actual sizes of the buffers. to avoid, or reduce the likelihood of, congestion within, or between, buffers allocated to VCs. A system according to any one of the preceding claims, wherein said at least one computer device (104) comprises an in-line replaceable avionics unit (LRU). 12 image2

14.

A communication network comprising a data transfer system according to any of the preceding claims, which includes at least one switching device (102) and a series of said computing devices (104).

fifteen.

A method for providing data transfer between computing devices (104), the method including configuring at least one switching device (102), in use, to transfer data, directly or indirectly between computing devices using the data transfer system according to any of claims 1 to 13.

13