# Independent WCRT analysis for individual priority classes in Ethernet AVB

- 361 Downloads

**Part of the following topical collections:**

## Abstract

In the high-tech and automotive industry, bandwidth considerations and widely accepted standardization are two important reasons why Ethernet is currently being considered as an alternative solution for real-time communication (compared to traditional fieldbusses). Although Ethernet was originally not intended for this purpose, the development of the Ethernet AVB standard enables its use for transporting high-volume data (e.g. from cameras and entertainment applications) with low-latency guarantees. In complex industrial systems, the network is shared by many applications, developed by different parties. To face this complexity, the development of these applications must be kept as independent as possible. In particular, from a network point of view, progress of all communication streams must be guaranteed, and the performance for individual streams should be predictable using only information regarding the stream under study and the general parameters of the communication standard used by the network. Initial methods to guarantee latency for Ethernet AVB networks rely on the traditional busy-period analysis. Typically, these methods are based on knowledge of the inter-arrival patterns of both the stream under study and the interfering streams that also traverse the network. The desired independence is therefore not achieved. In this paper, we present an independent real-time analysis based on so-called *eligible intervals*, which does not rely on any assumptions on interfering priority classes other than those enforced in the Ethernet AVB standard. We prove this analysis is tight in case there is only a single higher-priority stream, and no additional information on interference is known. In case there are multiple higher-priority streams, we give conditions under which the analysis is still tight. Furthermore, we compare the results of our approach to the two most recent busy-period analyses, point out sources of pessimism in these earlier works, and argue that assuming more information on the sources of interference (e.g. a minimal inter-arrival time between interfering frames) has only limited advantages.

## Keywords

Ethernet AVB Ethernet TSN WCRT analysis Eligible interval Busy period analysis Credit based shaping## 1 Introduction

The increasing use of, for example, cameras in industrial systems, is resulting in an increasing demand for high-volume data transports. Especially in the high-tech and automotive industry, there is a need for high bandwidth communication combined with the possibility to give real-time guarantees. Ethernet is currently being considered as a viable solution to this problem, as it provides a high bandwidth as part of a widely accepted standard. Originally, Ethernet was not intended for this purpose, but the development of the Ethernet AVB standard [from the audio/video bridging task group IEEE (2005)], enables the use of Ethernet for transporting high-volume data with latency guarantees. This standard relies on traffic shaping techniques, and in particular on the standardized credit-based shaper [see IEEE 802.1Q-2014 IEEE (2014)] to be able to guarantee required latencies and throughput for audio/video traffic, while preventing starvation of best-effort traffic. In 2012, the task group was renamed to time sensitive networking (TSN) task group, with the aim to support time-sensitive traffic by introducing time-triggered transmission on top of other traffic classes. This latter enhancement of scheduled traffic [see IEEE 802.1Qbv IEEE (2016)] is not considered in this paper as we only focus on the credit-based shaping.

One of the problems faced by, for example, the automotive industry, is that there is a growing number of connected components present in modern cars and other vehicles. Those components are of a heterogeneous nature, in the sense that some pose hard real-time requirements on the communication network, while others only require soft real-time guarantees, or have no specified requirements at all. Furthermore, different components are often developed by different manufacturers, making it difficult to guarantee specific behavior in the traffic load the components put on the network.

*H*(high priority),

*M*(medium priority), and

*L*(low priority/best-effort traffic). In this paper, we extend the WCRT analysis of the

*M*class in the presence of multiple high priority streams \(H_1, H_2, \ldots , H_p\) and multiple low priority streams \(L_1,L_2, \ldots , L_q\), see right panel in Fig. 1. Within class

*H*and

*M*, a stream of frames is shaped according to the credit-based shaping algorithm, constraining the transmission for those classes to a fraction of the available bandwidth. This prevents starvation of the low priority classes, and in particular enables us to ensure latency guarantees for the

*M*class, which is the main focus of this paper.

Given the mechanisms of the Ethernet AVB standard, and the characteristics of frames and shapers, the worst-case response time of a frame transmission can be bound using formal analysis techniques. Typically, a busy period analysis is performed to estimate the maximum amount of interference from which a transmission may suffer, see Diemer et al. (2012b), Bordoloi et al. (2014), Ashjaei et al. (2017). The problem with using a busy period analysis for the analysis of Ethernet AVB, is that this method was originally developed for non-idling servers. This concern is not explicitly addressed in the works of Diemer et al. (2012b), Axer et al. (2014) and Bordoloi et al. (2014), but it is implicitly solved by simply adding the idling time as additional interference. In Bordoloi et al. (2014), the authors observed that this leads to an overestimation, because some interfering traffic is transmitted during this idling time. This interference should not contribute to the worst-case response time and thus causes pessimism. The authors attempt to compensate for this pessimism, but despite their efforts we show in this paper that their attempt was not entirely successful. Another disadvantage of using busy period analysis is that the analysis requires all detailed traffic models of the interference. This dependence upon traffic model makes the analysis quite complicated, and developers face the problem of an undesired coupling between different applications (often designed by different development teams) when calculating the worst-case performance of their application of interest on the network.

By introducing eligible intervals [see Cao et al. (2016b)] instead of busy periods, we manage to simplify the analysis greatly. As the notion of eligible intervals is tailored to idling servers, we are able to remove the pessimism due to idling present in traditional approaches. Meanwhile, the new analysis is independent of the knowledge of the inter-priority interference other than those assumptions enforced by the Ethernet AVB standard.

The main contribution of this paper is that we extend our previous analysis [see Cao et al. (2016a, b)] to incorporate multiple higher and lower priority streams that individually undergo credit-based shaping. Since the influence of multiple lower priorities is equal to that of a single lower priority, i.e., only one lower priority frame can interfere during an eligible interval, the main challenge lies in the influence of multiple high priorities. For that, we study the variation of the cumulative credit of all higher priority shapers, and find the minimum cumulative credit and the slowest decreasing rate of a set of higher priority shapers to obtain the worst-case relative delay. The difference with our earlier analysis, is that in case of multiple high priority streams it is not always possible to create a worst-case scenario which gives a tight bound. Still, we are able to give sufficient (and conjectured necessary) conditions under which our analysis yields a tight bound on worst-case relative delay. The complexity of our analysis is factorial in the number of high priority classes. Furthermore, it does not rely on recursions of which the depth is dependent on the chosen system parameters, as it is the case in busy period analysis.

In the remainder of this paper, we briefly introduce the earlier work in Sect. 2, and then describe our system model and our model of behavior of credit-based shaping in Sect. 3. Subsequently, we recapitulate the most important parts of the analysis laid out in Cao et al. (2016b) and add our new analysis of the built-up of cumulative credit of higher priorities under mixed interference in Sect. 4, and present our main analysis of the worst-case response time. Next, in Sect. 5, we discuss the conditions for tightness of our approach. Finally, in Sect. 6, we compare our approach and results to those of Axer et al. (2014) and Bordoloi et al. (2014).

## 2 Related work

In this section, we first discuss earlier work that focuses on the timing analysis of credit-based shaping in Ethernet AVB. We mainly discuss their methodology, their coverage of single- or multi-hop networks, their assumptions on interfering traffic, and tightness and complexity of their approach. Next, we briefly discuss other works relating to traffic shaping techniques in the broader scope of Ethernet TSN.

Previous studies of Ethernet AVB can be found in e.g. Imtiaz et al. (2009), Diemer et al. (2012a), Diemer et al. (2012b), Reimann et al. (2013), Bordoloi et al. (2014), Axer et al. (2014), Ashjaei et al. (2017) and Li and George (2017). In Imtiaz et al. (2009), a single-hop timing analysis of Ethernet AVB is presented for a scenario in which a single frame is interfered by both high- and low-priority traffic, but no formal study is executed to prove that the resulting formulas match the worst-case in all possible scenarios. In Reimann et al. (2013), a tight timing analysis is proposed without taking a detailed traffic model into account. This approach is based on modular performance analysis [see Wandeler et al. (2006)], which requires a local timing analysis to study the multi-hop network. However, the proposed approach lacks mathematical proofs and the claim of tightness is not validated.

In Diemer et al. (2012a, b) an extensive formal analysis of Ethernet AVB is given based on busy period analysis (Davis et al. 2007; Bril et al. 2009; Lehoczky 1990). It uses the compositional performance analysis approach (Henia et al. 2005) to take an output event stream of one component and turn it into an input event stream of a connected component for multi-hop network analysis. However, as the busy period analysis is not designed for idling servers, pessimism remains a concern in these works. Axer et al. (2014) and Bordoloi et al. (2014) independently improve on the work of Diemer et al. (2012b) to reduce the existing pessimism. Bordoloi et al. (2014) attempts to address two sources of pessimism: one source is that the high priority traffic is also shaped, and the other source is that the high priority traffic which transmits during idling time should not be counted as interference. This improvement is limited to a single-hop setting, while Axer et al. (2014) attempts to address part of that same improvement, but considers a multi-hop analysis.

Ashjaei et al. (2017) presents a schedulability analysis in Ethernet AVB, which extends the work of Bordoloi et al. (2014) with support for scheduled traffic and further proposes a methodology for allocating network bandwidth to credit-based shapers. The improvement done by Bordoloi et al. (2014) is not considered in Ashjaei et al. (2017), as the improved solution is too complicated to determine the network bandwidth reservation. Li and George (2017) present a schedulability analysis to compute the worst-case delay of messages from classes A and B using the trajectory approach (Martin and Minet 2006) in a multi-hop network. This work partially uses busy period analysis to limit the search space of time within which the worst-case delay upper bound can be found and it provides a tighter analysis compared to Diemer et al. (2012b).

Besides the pessimism, another disadvantage of using busy period analysis is that a detailed traffic model is required, e.g., a periodic/sporadic model in Bordoloi et al. (2014) and Li and George (2017) or arrival curves in Diemer et al. (2012b) and Axer et al. (2014). The dependence on a detailed traffic model makes the timing analysis quite complicated in terms of algorithmic complexity, and meanwhile not robust against traffic flow changes.

In Cao et al. (2016b), we have introduced a relative worst-case response time analysis that makes use of eligible intervals. In the follow-up paper Cao et al. (2016a), we have provided a formal analysis of the medium priority traffic with mixed interference, consisting of a single shaped high-priority stream and an unshaped low-priority stream. By further studying the maximum amount of credit that can build up, we produce a bound on the worst-case relative delay and formally prove that this bound is tight. Furthermore, this proposed analysis is independent of the traffic model of the inter-priority interference. As a result, the complexity of the analysis is considerably low compared to the previous analyses. We presume the linear complexity (for a single high priority) allows the analysis to scale in a multi-hop network, however, the contribution is currently limited to single-hop.

Since 2012, the work on credit-based shaping has become part of a larger standardization initiative in the Ethernet TSN task group. In Ethernet TSN, also other shaping technologies are being developed [see e.g. Thangamuthu et al. (2015)]. Several works have presented timing analysis for these new shapers. For instance, Thiele et al. (2015) has proposed an analysis technique based on busy period analysis for the time-aware shaper and peristaltic shaper, and Thiele and Ernst (2016) has addressed the burst-limiting shaper also using busy period analysis. There are also studies addressing the schedulability analysis of credit-based shaping with support for scheduled traffic, e.g. Maxim and Song (2017) and Ashjaei et al. (2017). The new shapers and the combination of shapers in Ethernet TSN are not covered in this paper, as we only focus on credit-based shaping. However, as part of future work it may be interesting to see if the eligible interval method is applicable to those shapers as well.

## 3 System model

In this section, we first sketch the mechanics of credit-based shaping, relevant for our analysis. Subsequently, we introduce some notation to capture these mechanics. Finally, we give mathematical relationships that characterize the mechanics of credit-based shaping formally. For this, we adopt an axiomatic approach. This means that, instead of describing exactly how a shaper behaves by presenting a construction of its executions, we only specify relations between events and variables that an implemented Ethernet AVB switch should respect. Subsequently, we use these relations to derive properties of the behavior of a shaper. Naturally, in some places we will give explicit constructions of executions, either as illustrations, or as a witness that a derived bound can be achieved in tightness proofs. As a side-effect, these constructions also serve to convince the reader that the axioms we posed are not self-contradictory.

### 3.1 Mechanics of credit-based shaping

We are modeling the behavior of a single switch that is part of an Ethernet AVB network. The goal of this switch is to pass on frames from its inputs to its outputs according to some routing table. However, we are interested only in the time it takes to perform this task, and not in the actual routing of frames. In order to be able to calculate this, it is important to know how a switch schedules its transmissions.

As a basis, Ethernet AVB adopts non-preemptive strict priority scheduling. Frames are gathered in one queue for each priority class, and a frame can start its transmission only if there is no higher priority queue that can start (strict priority), if there are no earlier frames of the same priority in the queue (FIFO), and if there is currently no transmission going on (non-preemptive), see Fig. 1.

*credit*. Whenever credit is above or equal to 0, a frame can start transmission, assuming the other rules also allow this. If credit is lower than 0, frames from lower priority classes are allowed to transmit. Credit for a priority class

*X*starts at 0, and while a frame is in transmission it drops at a rate of \(\alpha _X^-\). If credit is negative, no further frames of that class can be transmitted and credit rises with a rate of \(\alpha _X^+\). Also, if class

*X*has pending frames waiting but cannot transmit, credit rises at a rate of \(\alpha _X^+\). Positive credit is reset to 0 if the queue of class

*X*does not contain any frames anymore. One example of credit-based shaping is illustrated in Fig. 2.

In the standard, \(0 < \alpha _X^+ \le BW\) is set to correspond to the desired bandwidth reservation for class *X*, assuming a total bandwidth of *BW*. Subsequently, \(\alpha _X^- = BW - \alpha _X^+\) is set to the remaining bandwidth. We observe that the maximum utilisation for class *X* is given by \(\frac{\alpha _X^+}{BW}\), see also Fig. 2. When multiple streams are of the same priority class, they share the bandwidth of that class.

Another parameter set in the standard, is the maximum size \(C^\mathrm {max}_X\) that a frame of a given priority class *X* may have. Size, in this case, refers to the number of bits that need to be transmitted in the standard, but for ease of presentation is converted to the maximum amount of time a transmission takes in this paper.

### 3.2 Notation

*Priority* As indicated above, we use the capital letter *X*, but also *Y*, *M*, *H*, and *L*, to denote priority classes, and we write \({\mathbb {P}}\) for the set of all priority classes. This set is considered to be totally ordered, so we may write \(X,Y \in {\mathbb {P}}\) and \(X < Y\) to indicate that *X* has a lower priority than *Y*. Furthermore, in the remainder we sometimes write \({\mathbb {X}} \subseteq {\mathbb {P}}\) if we want to consider a subset of priority classes \({\mathbb {X}}\), and write \(\alpha _{{\mathbb {X}}}^+ = \sum \limits _{X \in {\mathbb {X}}} \alpha _X^+\) and \(\alpha _{{\mathbb {X}}}^- = BW - \alpha _{{\mathbb {X}}}^+\) to indicate the cumulative reservation of such a set and its remainder.

*Frames, streams and sources* To indicate that a frame *x* is of priority class *X* we write \(x \in X\). The set of all frames is denoted by \({\mathbb {F}}\), so that formally we can regard a priority class \(X \subseteq {\mathbb {F}}\) as a set of frames, as well as an element of \({\mathbb {P}}\). However, when discussing the behavior of credit based shaping, it is more natural to speak of a *stream* *X* when considering the flow of frames from input to transmission, and to speak of a *priority class* *X* when considering scheduling decisions on queues. A *source* \(\tau \subseteq X\) is a specific set of frames under investigation, taken from the same priority class, e.g., a set of periodically-generated frames.

*Dynamics and credit* As mentioned before, we follow an axiomatic approach to formally model the dynamics of credit based shaping. In this approach, we consider executions *u*, and give properties under which *u* is considered a valid execution of the system, denoted \(u \in {\mathbb {U}}\). These properties are in terms of events and variables defined by the standard. For example, we write \( CR ^u_X(t)\) to denote the credit of priority class *X* at time \(t \in {\mathbb {R}}^+\) during an execution *u*. As an example of a property, we have that \( CR ^u_X(0) = 0\) for all \(u \in {\mathbb {U}}\), saying that at the start of execution (time 0) the credit of every shaper is 0.

*More on executions* Typically, one may consider an execution *u* to be an ordered set of observations, like events or valuations of variables. But for most of our analysis, it is not important how executions are exactly defined, as long as we can define the necessary functions that keep track of variables and events in the system. The standard does not prescribe the exact implementation of the traffic shapers, it merely gives a specification of possible implementations. Therefore, we strive not to define here what an execution is exactly. It is sufficient to know which axioms need to hold for an execution. This keeps our analysis independent of the chosen implementation. Sometimes we do give examples of valid executions by specifying which events and variable valuations are observed in which order. The purpose of these is either to serve as illustrations, or as witnesses to prove that an execution with certain properties actually exists.

*Arrival time* The behavior of a switch is determined by the arrival time of frames during an execution, and by the order of arrival in case multiple frames arrive at the same point in time. We assume that for any given set of frames we are able to distinguish the first frame that arrived. Technically, let \({\mathbb {F}}^u \subseteq {\mathbb {F}}\) denote those frames that arrive during an execution *u*, and assume (reasonably) that \({\mathbb {F}}^u\) is a countable set. We denote the arrival time of an arbitrary frame \(x \in {\mathbb {F}}^u\) by \(a^u(x) \in {\mathbb {R}}^+\). Furthermore, because it may be the case that multiple frames arrive at the same point in time, we sometimes write \(x <_u x'\) to emphasize the order in which frames arrive. In particular, for some \(x,x' \in {\mathbb {F}}^u\) we may use \(x <_u x' \ \wedge \ a^u(x) = a^u(x')\) to denote that *x* arrived before \(x'\) at the input queue, but their arrival times cannot be distinguished.

*Start, finish, and worst-case response time*For a given frame \(x \in \tau \), the response time in an execution

*u*is defined as the difference between finish time \(f^u(x)\) of that frame and its arrival time \(a^u(x)\). The worst-case response time of a frame

*x*given a set of possible executions \({\mathbb {U}}\) is defined as:

*u*and a related un-interfered execution \(u_0\) without interference, and then calculate the worst-case relative delay.

### Definition 1

(*Un-interfered execution*) Given a priority class *X* and an execution *u*, we define the *un-interfered execution of X* to be an execution \(u_0\) (dependent on *u*) in which only frames of *X* arrive, and arrive at the same time as in *u*. Furthermore, they have the same transmission time. So \({\mathbb {F}}^{u_0} = {\mathbb {F}}^u \cap X\) and for all \(x \in {\mathbb {F}}^{u_0}\) we have \(a^{u_0}(x) = a^u(x)\) and \(C^{u_0}(x) = C^u(x)\). Assuming the scheduling of frames is deterministic, this \(u_0\) is uniquely defined.

*x*in any execution

*u*from that of \(u_0\) by studying the delay in start-times as shown below:

*x*in the set \({\mathbb {U}}_0 = \{ u_0 \mid u \in {\mathbb {U}} \}\) of all un-interfered executions, while the term \(\sup \limits _{u \in {\mathbb {U}}} (s^u(x) - s^{u_0}(x))\) is called the

*worst-case relative delay*of a frame

*x*. In Sect. 4, we seek an upper bound to this relative delay, given that \(x \in \tau \subseteq X\) is a frame from a given priority class

*X*and source \(\tau \). It is assumed that the worst-case response time of a frame

*x*in the un-interfered execution \( WR _{{\mathbb {U}}_0}(x)\) is known.

In Sects. 4 and 5, we analyze the relative delay without restricting \(a^u\) to any particular arrival pattern. In particular, we do not assume the usual periodic or sporadic arrival. In Sect. 6 we compare our results to other work which does depend on periodic/sporadic arrivals, and calculate \( WR _{{\mathbb {U}}_0}(x)\) based on this assumption. Before going into the analysis, however, we first develop the relations we need to derive this upper bound by further formalizing the mechanics of credit based shaping.

### 3.3 Formalization of shaping rules

In this section, we rephrase the earlier descriptions of credit based shaping in terms of mathematical relationships between arrival times, order of arrival, credit, transmission times, start times and finish times. In the subsequent sections, we use these relationships to bound the worst-case response time of frames in credit based shaping. As mentioned before, we adopt an axiomatic approach to defining the behavior of credit-based shaping. The predicates in this section define which executions *u* are valid elements of the set of all executions \({\mathbb {U}}\) of a credit-based shaper. Next, in the analysis, we can then use these predicates to prove properties of these executions.

*Non-preemptive*Let us start by recalling a property mentioned previously. The fact that transmissions are non-preemptive means that for all \(x \in {\mathbb {F}}\) and executions \(u \in {\mathbb {U}}\) we find:

*Single transmission*Since we assume a single transmission at a time, two frames cannot start their transmission at the same time and any frame that starts earlier should finish its transmission before the next frame starts. For all \(x,x' \in {\mathbb {F}}\) and \(u \in {\mathbb {U}}\):

*Non-negative credit*Next, we study the start time of frames in more detail. In particular, we have the rule that in order to transmit a frame, it must first have arrived and its priority class must not have negative credit. So for any priority class \(X \in {\mathbb {P}}\) and frame \(x \in X\) we find in any execution \(u \in {\mathbb {U}}\):

*FIFO*Furthermore, the fact that frames of the same class are queued and transmitted in the order in which they arrive (First-In First-Out), gives us for all executions \(u \in {\mathbb {U}}\), all \(X \in {\mathbb {P}}\), and all \(x_1,x_2 \in X\):

*Strict priority*Similarly, the general notion that frames of higher priority take precedence if credit allows can be formalized by stating that for all \(u \in {\mathbb {U}}\), all \(X,Y \in {\mathbb {P}}\) with \(X < Y\), and all \(x \in X\) and \(y \in Y\) we have

*Eager scheduling*If we combine the previous properties (non-preemptive, single transmission, non-negative credit, FIFO and strict priority) with the assumption that frames are scheduled as soon as credit allows, we obtain the infimum over the above properties as start-time of a frame. For all \(u \in {\mathbb {U}}\), \(X \in {\mathbb {P}}\) and \(x \in X\) we have:

*Credit at start*The only unknown in the equation above, is the credit, for which we already mentioned that it starts at 0 in every execution \(u \in {\mathbb {U}}\) and for any priority class \(X \in {\mathbb {P}}\):

*Credit during transmission*While a frame of priority class \(X \in {\mathbb {P}}\) is in transmission, credit drops at a rate of \(\alpha _X^-\). Therefore, for any two points in time \(t \le t'\) for which there exists a frame \(m \in X\) such that \(s^u(m) \le t\) and \(t' \le f^u(m)\) we find:

*Credit recovery*While credit of priority class \(X \in {\mathbb {P}}\) is negative and

*X*is not transmitting, credit rises with a rate of \(\alpha _X^+\). Therefore, for any two points \(t \le t'\) with \(t' \le t - \frac{ CR ^u_X(t)}{\alpha ^+_X}\) and

*X*not transmitting at

*t*(i.e. \(\forall _{x \in X} \, f^u(x) \le t \ \vee \ s^u(x) > t\)) we find:

*Pending load*Similarly, if there are frames in the queue of priority class \(X \in {\mathbb {P}}\), but this class cannot transmit, this also leads to a credit rise with a rate of \(\alpha _X^+\). We say that a priority class

*X*has

*pending load*at time \(t \in {\mathbb {R}}^+\), denoted \( Pending _X(t)\), if there exists a frame \(m \in X\) such that \(a^u(m) \le t\) and \(f^u(m) > t\). Furthermore, we say that a priority class

*Y*is

*transmitting*at time \(t \in {\mathbb {R}}^+\) if there exists a frame \(n \in Y\) such that \(s^u(n) \le t\) and \(f^u(n) > t\). Now, for any two points \(t \le t''\) such that

*X*has pending load at

*t*but some other class

*Y*is transmitting at every point \(t'\) with \(t \le t' < t''\), we find:

*Credit reset*Finally, we know that credit of priority class \(X \in {\mathbb {P}}\) is reset as soon as there is no pending load. Therefore, at any time \(t \in {\mathbb {R}}^+\) we find:

### Definition 2

(*Credit based shaping*) An execution \(u \in {\mathbb {U}}\) is *credit based shaped* if its arrival, start, and finishing times \(a^u\), \(s^u\) and \(f^u\) satisfy Eq. (5) to Eq. (18).

*Eligible interval* The relations above completely characterize the behavior of credit based shaping. However, during the analysis, we have found that it is convenient to study so-called *eligible intervals* [see also Cao et al. (2016b)].

### Definition 3

(*Eligible interval*) A priority class *X* is *eligible* for transmission at a time *t* if it is either transmitting, or it has both credit and pending load. An eligible interval of *X* is a maximal interval during which *X* is eligible.

- 1.
\( CR ^u_X(E_s)=0\) and \( Pending _X(E_s)\);

- 2.
\( CR ^u_X(E_s-\epsilon )<0\) or \(\lnot Pending _X(E_s - \epsilon )\), for a vanishingly small \(\epsilon >0\);

- 3.
For some frame \(x \in X\) we have \(f^u(x) = E_e\);

- 4.
\( CR ^u_X(E_e) < 0\) or \(\lnot Pending _X(E_e)\);

- 5.
\(E_e\) is the smallest time strictly larger than \(E_s\) with these properties.

*E*on

*u*and

*X*implicit in our notation, since it is always clear from the context which execution and priority is intended. Given this formalization, we are ready to start our analysis.

## 4 Analysis

Our analysis largely follows the outline set up in Cao et al. (2016b). We focus on the behavior at the output port of an Ethernet AVB switch, as depicted in Fig. 1. This means we assume that incoming frames have already been routed to the proper output port, and that the switch can freely transmit at its output. At the output port, frames are queued according to their class, resulting in several streams of frames, one for each class. We keep track of when frames of a certain stream arrive, and when they are transmitted, and we calculate how long a frame may remain in the output buffer. In other words, we are interested in the maximum amount of time between a frame entering the buffer and finishing transmission.

We first recap, in Sections 4.1, 4.2 and 4.3, the most important observations from Cao et al. (2016b), and analyze a few important cases in sequence. We start by assuming a single input stream of a single priority class *X* for which we examine the effect of credit based shaping on the output stream by calculating the start times as the result of shaping. This results in an ordinary FIFO schedule, scaled to the reserved bandwidth. Next, we recall the analysis using so-called *eligible intervals* in which a stream has pending load available (i.e. there are frames to be sent) and also has non-negative credit (i.e. the frames can be sent unless the output port is otherwise occupied) or is transmitting. The main theorem on eligible intervals is that, regardless of the interference, the start time of an eligible interval will always be smaller than or equal to the start time of its first frame in an un-interfered schedule. As a consequence, we can use eligible intervals to calculate a worst-case response time *relative* to an un-interfered schedule. This we do by calculating an upper bound on the start time of each eligible interval. We show this delay is proportional to the credit at the start of transmission of the first frame in the eligible interval, and as a consequence, we conclude that the maximum attainable credit bounds the maximum delay experienced by any frame compared to the un-interfered FIFO schedule.

Next, in Sect. 4.4, we extend the analysis of Cao et al. (2016a) to multiple interfering streams. We bound the maximum attainable credit in case of multiple higher and lower priority shapers, and find a relatively simple expression describing the relationship between the maximum frame sizes in the interfering traffic and the maximum attainable credit. This leads to a similarly simple expression for the worst-case time a frame may remain in its buffer. It is worth emphasizing, that in our analysis, streams are not restricted in the timing of the arrival of frames. A stream *X* or interfering stream *Y* may be periodic, sporadic, bursty, or have any other arrival pattern. In particular, it may represent the combination of several sources of traffic. We only use knowledge of the maximum size of frames that are being transmitted. In Sect. 5, we study the tightness of our approach under this limited set of assumptions on interference, and give conditions under which tightness can be guaranteed. In Sect. 6, we compare our estimates to earlier studies on worst-case response times for Ethernet AVB, paying special attention to the situations where our estimates are not tight, or where additional information on interference might give better results.

### 4.1 Shaping a single un-interfered stream

We start our analysis by considering a single stream *X*, and at this point assume there is no interference from other streams yet. In other words, for the time being we only consider those executions \(u \in {{\mathbb {U}}_0}\) for which \({\mathbb {F}}^{u} \subseteq X\) and hence \(u = u_0\). To emphasize this, we will simply write \(u_0\) for the execution under consideration in the remainder of this section. In the following sections, we will consider how to analyze more complex executions in which there is interference from higher and lower priority streams.

The first frame \(x_0 \in {\mathbb {F}}^{u_0}\) in this stream arrives at \(a(x_0) \ge 0\) and the credit is initially 0 [Eq. (14)]. A frame can only start transmission when the credit is non-negative [Eq. (9)]. Since positive credit is possible only when there is interference [only Eqs. (16) and (17) in Sect. 3.3 allow credit to rise], frames in an un-interfered stream start their transmission with a credit of 0. During the transmission, the credit decreases at a rate of \(\alpha _X^-\). The credit has to recover to zero before any next frame can be transmitted. The recovery time is the product of the frame duration and the ratio \(\alpha _X^-/\alpha _X^+\) (see Fig. 3). This gives us the following recurrence for start times.

### Property 1

*X*in an un-interfered execution \(u_0\), and considering the frame arrivals as a sequence \(x_i\), then the start times are determined by

For a single un-interfered stream *X*, the intervals \(E^i = [s^{u_0}(x_i), s^{u_0}(x_i)+C_{u_0}(x_i))\) represent a series of eligible intervals of *X*. This is illustrated in Fig. 3. In all our figures that display frame transmission, eligible intervals have been marked in gray. Observe, that transmission of frames in *X* always takes place during some eligible interval, meaning that eligible intervals are always separated by intervals without transmission of *X* frames. Note also, that there is no idle time for the switch as a whole within an eligible interval, i.e. no time at which no transmissions take place at all. Of course, these transmissions may be from other streams than *X*. This un-interrupted activity, analogous to the notion of busy-periods in the theory of non-idling servers, makes the behavior within an eligible interval easier to analyse.

Note, that when studying an un-interfered stream, we find that the shape of eligible intervals is rather simple. There is only one frame in each interval *E*, since the credit becomes negative when a frame is sent and no frame can transmit before the credit recovers to zero. Later, we see that in cases of interference, multiple frames may transmit in an eligible interval as well.

Figure 3 also shows that if arrival times are late there can be some additional slack between two eligible intervals. However, in the un-interfered execution, the minimum distance between \(s^{u_0}(x_i)\) and \(s^{u_0}(x_{i+1})\) is \(C^{u_0}(x_i)(1+\alpha _X^-/\alpha _X^+)\). This is captured in the following corollary, which we use in the theorem to determine the start time of an eligible interval in an interfered schedule.

### Corollary 1

*X*in an un-interfered execution \( u_0\), and considering the arrivals of frames as a sequence \(x_i\), we find for all \(x_0 \ldots x_{i+k} \in X\):

Our remaining analysis focusses on determining how interference may induce a deviation from the FIFO schedule described by Property 1.

### 4.2 The start of an eligible interval

In this section we study the stream of an arbitrary priority class *X* during an arbitrary execution *u*, which may encounter interference from other low- or high-priority streams. I.e. \({\mathbb {F}}^u\) may also contain frames that are not from *X*. We show that the start of an eligible interval of *X* under such interference will always be sooner than or equal to the un-interfered start-time of the first transmitted frame of *X* of that eligible interval. For this analysis, we can simply consider interference as the union of all higher and all lower priority frames. Later, the individual higher-priority shapers will be studied for their individual effects.

Due to interference, transmissions of frames in the stream *X* may cluster, and multiple frames can be transmitted in a single eligible interval. But even though the eligible intervals of the interfered execution are different compared to the un-interfered stream, we manage to relate the start-times of the eligible intervals in the interfered execution *u* to the start-times of frames in the un-interfered execution \(u_0\).

Obviously, for \(u_0\) the analysis in the previous subsection may be used, which gives us the start-times \(s^{u_0}(x)\) of the un-interfered execution.

*E*of

*X*in the execution

*u*, and let \(x_e \in {\mathbb {F}}^u \cap X\) be the first frame from

*X*transmitted during

*E*, i.e. the first frame such that \(s^u(x_e) \in E\). We may then recall the first of the two main theorems from Cao et al. (2016b), which states that the start of an eligible interval in

*u*always lies before or at the transmission of the first frame \(x_e\) in \(u_0\): i.e. \(E_s \le s^{u_0}(x_e)\), see Fig. 4. This allows us further on to relate the delay experienced by any frame back to the un-interfered schedule by just studying the interference within an eligible interval.

### Theorem 1

Let \(x_e\) be the first frame of *X* transmitted in an eligible interval \(E = [E_s,E_e)\) of *X* in execution *u*, and let \(u_0\) denote the un-interfered execution of *X* associated with *u*, then \(E_s \le s^{u_0}(x_e)\).

### Proof

The proof proceeds by induction on the sequence of eligible intervals which we denote by \(E^j\) for \(j \ge 1\).

Clearly, the first eligible interval, \(E^1\), starts as soon as there is pending load, i.e. at \(E^1_s = a^u(x_1)\) with \(x_1\) the first frame of *X* in \(E^1\). Incidentally, this is also the start time of \(x_1\) in the un-interfered schedule. The first frame can start as soon as it arrives, i.e., \(a^{u_0}(x_1) = s^{u_0}(x_1)\). By Definition 1, \(a^{u}(x_1) = a^{u_0}(x_1)\), so we have \(E^1_s = s^{u_0}(x_1)\), thus proving the base case.

*X*in \(E^j\) and that frames \(x_k,\ldots ,x_l\) of

*X*are transmitted during \(E^j\) and assume that this theorem holds for \(E^j\), i.e., \(E_s^j \le s^{u_0}(x_k)\). Now we need to show \(E_s^{j+1} \le s^{u_0}(x_{l+1})\), with \(x_{l+1}\) the first frame of

*X*in \(E^{j+1}\). We know by definition of eligible interval that at the start of the interval \(E_s^j\), the credit equals \( CR _X^u(E_s^j) = 0\). Because by definition there is load pending during \(E^j\), credit will fall during the transmission of those frames, and any remaining time in \(E^j\) credit will rise, see Fig. 5. At the end of the interval \(E_e^j\) we therefore find:

### 4.3 Credit represents delay

Now that we have an upper bound on the start time of each eligible interval, we can study the relative delay of frames transmitted within an eligible interval. As it turns out, for those frames, the delay compared to the un-interfered execution is proportional to the credit of the shaper at the start of transmission in the interfered execution, which gives us the second main theorem from Cao et al. (2016b), see Fig. 4.

### Theorem 2

Given a stream *X* in some execution *u*, subject to any interference, and its associated un-interfered execution \(u_0\), for each frame \(x \in {\mathbb {F}}^u \cap X\) we find \(s^u(x) \le s^{u_0}(x) + \frac{ CR ^u_X(s^u(x))}{\alpha _X^+}\).

### Proof

Now, to prove a bound on the delay in a given scenario, we only need to prove a bound on the maximum credit that can be built up in that scenario.

### 4.4 Bounding the credit build up by interference

*X*only builds up while pending frames of

*X*wait for other transmissions to finish. To estimate the maximum amount of interference, particularly from a set of higher-priority shapers \({\mathbb {X}}\), we need to estimate the minimum credit of the set.

### Theorem 3

For a single priority class \(X \in {\mathbb {X}}\) under credit based shaping, we find \( CR _X^{\min } = - \alpha ^-_X \cdot C^{\max }_X\).

### Proof

This was claimed but not proven in Cao et al. (2016a). For completeness, we have added the proof here.

*u*and at any time \(t \in {\mathbb {R}}^+\) we find \( CR ^u_X(t) \ge - \alpha ^-_X \cdot C^{\max }_X\). To see this, assume the opposite, namely that there exists an execution

*v*such that at some point

*t*we have \( CR _X^v(t) < - \alpha ^-_X \cdot C^{\max }_X\). From the shaping rules we know this negative credit is only possible if a shaper is currently in transmission [Eq. (15)], or is recovering [Eq. (16)]. The latter means that there is an earlier time \(t'\) at which the credit is even lower, so without loss of generality we may assume that there exists an execution

*v*and a point

*t*at which the shaper is in transmission and \( CR ^v_X(t) < - \alpha ^-_X \cdot C^{\max }_X\). Let \(x \in X\) be the frame that is under transmission at

*t*, then we may derive that the credit at its start-time would be negative:

*v*can not exist.

Secondly, we have to prove that there exists an execution *u* in which at some time \(t \in {\mathbb {R}}^+\) we actually have \( CR ^u_Y(t) = - \alpha ^-_Y \cdot C^{\max }_Y\). For this, simply consider an execution in which a single frame from *Y* of maximal size is being transmitted, and take *t* to be the finish-time of that transmission. At that time the equation is satisfied. \(\square \)

Now, if next we would like to consider the total credit \( CR _{\mathbb {X}}^u\) of a set of priority classes \({\mathbb {X}} \subseteq {\mathbb {P}}\), we could of course simply add up the minimum credits of each of its elements. However, for sets larger than 1 element, there is no execution in which this sum can actually be reached, because as the transmission from one of the elements of \({\mathbb {X}}\) is proceeding towards the minimum, the credits of other elements in \({\mathbb {X}}\) will be recovering. In the following theorem, we achieve a tight bound by taking this recovery into account.

### Theorem 4

### Proof

We prove this by induction on the size of \({\mathbb {X}}\). The base case, obviously, is the case where \({\mathbb {X}}\) only has one element, and was proven in the previous theorem. Subsequently, as induction hypothesis, assume that our theorem holds for all sets of the form \({\mathbb {X}} {\setminus } X\), with \(X \in {\mathbb {X}}\).

*u*and times

*t*we have \( CR _{\mathbb {X}}^u(t) \ge - \sup \limits _{X \in {\mathbb {X}}}(\alpha _{{\mathbb {X}}}^- \cdot C^\mathrm {max}_X - CR _{{\mathbb {X}}{\setminus } X}^{\min })\). Assume there exists an execution

*v*and time

*t*such that \( CR _{\mathbb {X}}^v(t) < - \sup \limits _{X \in {\mathbb {X}}}(\alpha _{{\mathbb {X}}}^- \cdot C^\mathrm {max}_X - CR _{{\mathbb {X}}{\setminus } X}^{\min })\). Then, in particular, for each individual \(X \in {\mathbb {X}}\) we have

*X*we have negative credit at time

*t*. From the shaping rules, we know that this is only possible if all shapers are currently either transmitting or in recovery. Like in the previous proof, we reason that credit at an earlier point would only be lower if all shapers are in recovery at

*t*, and therefore we may assume without loss of generality that at time

*t*one of the shapers is transmitting. Let \(x \in X\) be the frame that is in transmission at

*t*, and recall that all others are recovering. Furthermore, recall that at the start-time of this transmission we have \( CR _X^v(s^v(x)) \ge 0\), so we may derive:

Secondly, to prove our estimate is tight, we need to construct an execution in which this estimate is actually achieved. This is relatively straightforward, using a recursion over the formula. For a set \({\mathbb {X}}\) containing a single element, the construction is to just transmit a single maximal frame from the one priority class \(X \in {\mathbb {X}}\). For a larger set \({\mathbb {X}}\), we may assume that there is an execution \(u_{{\mathbb {X}} {\setminus } X}\) that achieves the minimum credit of \({\mathbb {X}} {\setminus } X\). We observe that in this execution it will not be necessary at any time to transmit a frame from *X*. Subsequently, we determine which \(X \in {\mathbb {X}}\) achieves the supremum in the formula \(- \sup \limits _{X \in {\mathbb {X}}}(\alpha _{{\mathbb {X}}}^- \cdot C^\mathrm {max}_X - CR _{{\mathbb {X}}{\setminus } X}^{\min })\), and we create \(u_{\mathbb {X}}\) by appending a single transmission of a maximal frame from *X* to the execution \(u_{{\mathbb {X}} {\setminus } X}\), choosing the arrival time of the frame equal to the end of the last transmission in \(u_{{\mathbb {X}} {\setminus } X}\). By construction, this will lead to the minimal credit of \({\mathbb {X}}\). In Sect. 4.6, we give a concrete example of such a construction, and in Sect. 5 we give further illustrations as part of our discussion on the tightness of our entire approach. \(\square \)

Iteratively, for a set \({\mathbb {X}}\) containing *N* priorities classes, the construction of the last transmissions should be a series of *N* maximally-sized frames, one from each priority class, and its order is determined by the calculation of the minimum credit, see the examples in Figs. 8 and 9. The order of the *N* priority classes plays a critical role to reach the minimum credit. To cover all the possibilities of ordering, it needs \(N\cdot (N-1) \cdots 2\cdot 1 = N !\) calculations to ensure the minimum credit. Hence, the complexity of calculation in this theorem is at most factorial.

### 4.5 Bounding the delay caused by interference

To get from the minimum credit to the maximum time a set of shapers can be submitting is less trivial. Notably, we constructed an execution that achieves the minimum credit, but this execution does not achieve the minimum in the slowest way possible. When estimating interference, it is important that the total credit of interfering (higher-priority) shapers drops as slowly as possible. This is the topic of the next theorem.

### Theorem 5

*u*at every point \(t'\) in an interval \([t,t'']\) there is a frame from \({\mathbb {X}}\) transmitting, then the total credit of \({\mathbb {X}}\) decreases with at least a rate \(\alpha _{\mathbb {X}}^-\), i.e.

### Proof

### Corollary 2

*u*at every point \(t'\) in an interval \([t,t'']\) all shapers from \({\mathbb {X}}\) either have pending load or negative credit, then the total credit of \({\mathbb {X}}\) decreases with exactly a rate \(\alpha _{\mathbb {X}}^-\), i.e.

Finally, combining Theorems 4 and 5, we estimate the maximum credit rise of a priority class *X* by adding the possible interference from lower and higher priority classes. From lower priority classes, only a single frame can interfere which started non-preemptively ‘just before’ the arrival of a frame from *X*. In higher priority classes, the same lower priority frame will lead to an increase in the total credit, and the two previous theorems combined determine a bound on the total time it takes before this total credit is depleted.

The following theorem gives the upper bound of the relative delay, i.e., \(\sup \limits _{u \in {\mathbb {U}}} (s^u(x) - s^{u_0}(x))\) in the relative worst-case response time calculation [see Eq. (4)]. That bound, notably, is not necessarily tight, because the execution that leads to a slowest possible decrease in credit is not always also an execution that leads to minimum credit. This is the topic of Sect. 5.

### Theorem 6

*M*and \({\mathbb {H}}\) are under credit based shaping, and \(\alpha _{{\mathbb {H}}}^+ + \alpha _{M}^+ \le BW\). Then, for any execution

*u*with associated un-interfered schedule \(u_0\) and any frame \(m \in M\) we find:

### Proof

*u*, the credit \( CR ^u_M(t)\) is bounded by

*u*into phases of three different types depending on what is in transmission: idling phase (nothing is in transmission),

*L*phase (only \({\mathbb {L}}\) frames transmit) and

*MH*phase (only frames from

*M*or \({\mathbb {H}}\) transmit). Since these three conditions are mutually exclusive and cover all possibilities, a phase only ends when another type of phase takes over.

*Idling Phase*

When nothing is in transmission, either the credit of every priority class in \({\mathbb {H}}\) and the credit of *M* is negative (transmission is not allowed by the shaper), or there is no pending load (positive credit is reset to 0). Hence, at any time *t* in an idling phase, the credit of every stream in \(X \in {\mathbb {H}} \cup \{ M \}\) is less than or equal to 0: \( CR ^u_{X}(t) \le 0\).

*L Phase*

An *L* frame cannot start transmission when either the credit of *M* or the credit of some \(H \in {\mathbb {H}}\) is strictly positive (because this implies pending load of a higher priority class). Therefore, we find those credits are 0 or negative at the start of any *L* transmission. During the transmission, credit of \(X \in {\mathbb {H}} \cup \{ M \}\) rises with a rate *at most* \(\alpha _{X}^+\). Credit of \({\mathbb {H}} \cup \{ M \}\) only rises above 0 if there are frames pending, so the increase may be less. Once credit of \({\mathbb {H}} \cup \{ M \}\) rises strictly above 0 no new *L* transmission can start, but the current one can finish. As a consequence, for any \(X \in {\mathbb {H}} \cup \{M\}\) we find credit at a time *t* in an *L* phase is bounded by the transmission of a single *L* frame: \( CR ^u_{X}(t) \le C^\mathrm {max}_L \cdot \alpha _{X}^+\).

*MH Phase*

The credit variation is more complex in an *MH* phase. Let \(t_s\) denote the start time of a given *MH* phase. To bound the credit of *M* at any time *t* (\(t \ge t_s\)) during this phase, we study the total (cumulative) time during which frames from \({\mathbb {H}} \cup \{ M \}\) transmit in \([t_s,t]\). We denote this by writing \(\delta _X\) for any \(X \in {\mathbb {H}} \cup \{M\}\) and know that \(\sum _{X \in {\mathbb {H}} \cup \{M\}} \delta _X = t - t_s\). Our subsequent reasoning is mainly based on the credit variation rules and the reservation bound \(\alpha _{{\mathbb {H}}}^+ + \alpha _M^+ \le BW\).

*MH*phase, there is always a transmission of some kind going on. Therefore, the credit of some \(X \in {\mathbb {H}} \cup \{M\}\) will rise as long as it is not transmitting itself, and as long as it is negative or has pending load. If there is no pending load, credit will not rise. For a stream \(X \in {\mathbb {H}} \cup \{M\}\) at time

*t*in an

*MH*phase, we therefore know that:

*M*is transmitting and drops with a rate \(\alpha _{\mathbb {H}}^-\) when one of the classes in \({\mathbb {H}}\) is transmitting. Therefore, considering the total credit of the higher priorities, this gives us:

*MH*phase can only follow an idling phase or an

*L*phase. Therefore, the initial credits \( CR ^u_X(t_s)\) are bounded by the results obtained in those cases, and we derive:

### 4.6 An example of relative worst-case response time

*M*given a concrete set-up of the inter-priority interference as shown in Table 1. In this example, \(\alpha _M^+\) is set to 10 Mbps given a 100 Mbps total bandwidth. Note that the value of \(\alpha _M^+\) is relevant to the absolute value of credit

*M*, but is not used in the calculation of the worst-case relative delay. Therefore it is not mentioned in the table.

An example of three high priorities levels (\(H_1> H_2 > H_3\))

\(\alpha ^+\) | \(\alpha ^-\) | \(C^{\max }\) | \( CR ^{\min }\) | |
---|---|---|---|---|

\(H_1\) | 10 | 90 | 3 | \(-\,270\) |

\(H_2\) | 20 | 80 | 2 | \(-\,160\) |

\(H_3\) | 15 | 85 | 4 | \(-\,340\) |

| 5 |

There are three high priorities, \(H_1\), \(H_2\) and \(H_3\), in the order of priority. The total reservation of high priorities \(\alpha _{\mathbb {H}}^+\) is 45 Mbps and the remaining \(\alpha _{\mathbb {H}}^-\) is 55 Mbps. As \(\alpha _M^+\) is set to 10 Mbps, the condition \(\alpha _{\mathbb {H}}^+ + \alpha _M^+ \le BW\) is met, thus guaranteeing that the worst-case response time is finite.

To calculate the minimum credit \( CR _{{\mathbb {H}}}^{\min }\), we mainly use Theorem 4. We start with the minimum credit of a single priority, shown in Table 1, then with the set of two high priorities, and finally with the set of three.

*Credit of the set of two priorities*

*Credit of the set of three priorities*

## 5 Tightness

### 5.1 Tightness for interference by a single higher priority class

To illustrate the worst-case scenario that underlies Theorem 6, we repeat our arguments from Cao et al. (2016a).

Consider the left-most eligible interval in Fig. 7. This figure shows how a maximum credit for class *M*, and hence the maximum delay for a frame from that class, can be achieved in case we have *only a single* higher priority class *H* and one lower priority class *L*. The example, however, also works for multiple lower priority classes, since only one frame of lower priority can transmit in any case. The downward arrows indicate the arrival of frames, the solid rectangles indicate the execution of the combined *H*,*M* and *L* streams, the shaded rectangles indicate how the *M*-stream would execute in a scenario without interference. The graphs below this indicate the total credit level of both shapers, and the individual credit levels of *H* and *M* during execution.

*L*frame of maximum transmission time. Immediately after the start of

*L*, the frame \(m_1\) (our frame of interest) arrives together with an

*H*-frame. As a consequence, credit builds up for

*M*and

*H*. Subsequently, frames from

*H*start transmitting and new frames arrive until the credit built up by the

*L*transmission is exactly depleted. This may take a careful choice of non-maximal frame-sizes. Lastly, a maximal frame of

*H*arrives before credit is entirely depleted, to ensure that the credit of

*H*reaches its minimal value (which in case of a single priority class equals \( CR _H^\mathrm {min} = -\,\alpha _H^- \cdot C_H^{\max }\). Now, frame \(m_1\) is ready to transmit, but at this point the credit of

*M*has reached its maximum value, and therefore frame \(m_1\) has experienced its maximum delay compared to the un-interfered schedule. In the execution that follows in Fig. 7, we see that the total credit keeps on decreasing, and that the maximum credit level of

*M*is never obtained again. Only in case \(\alpha _H^+ + \alpha _M^+ = BW\), a stream

*M*may reach its maximum more than once in a single eligible interval, because the total credit does not decrease.

An example of four priorities levels (\(H_1> H_2> H_3 > H_4\)) in which reaching the minimum credit with the slowest decreasing rate is feasible in the last 4 transmissions

\(\alpha ^+\) | \(\alpha ^-\) | \(C^{\max }\) | \( CR ^{\min }\) | |
---|---|---|---|---|

\(H_1\) | 10 | 90 | 5 | \(-\,450\) |

\(H_2\) | 10 | 90 | 6 | \(-\,540\) |

\(H_3\) | 15 | 85 | 8 | \(-\,680\) |

\(H_4\) | 10 | 90 | 4 | \(-\,360\) |

To prove that the formula developed in the previous section gives a tight bound on the worst-case interference when there is only a single higher priority class, it is enough to realize that the example illustrated in Fig. 7 in fact provides a generic construction of the worst case. For any given medium-priority scenario, the arrival of a low-priority frame and immediately subsequent arrival of a number of high-priority frames of a well-chosen size can delay the transmission of any medium-priority frame by the amount specified in the formula. This construction can be carried out for any frame in a particular shaped stream, as long as we have the freedom to assign a worst case arrival time to a single low priority frame and have the freedom to inject a burst of high priority frames of the right size. Therefore, our approach is tight under the assumptions made in our system model, i.e. the estimate cannot be improved without further knowledge of the interference.

### 5.2 Examples why tightness is not always guaranteed

To understand why tightness is not always guaranteed, recall the way to calculate the minimum credit of a set of *N* priority classes under credit-based shaping, given in Theorem 4. To reach the minimum credit, the critical part is the transmission of *N* frames, on of each priority level, in the order determined by the iterative calculation of the minimum credit. Furthermore, recall that according to Theorem 6, this minimum credit should be reached using the slowest possible descent of the cumulative credit, while Corollary 2 shows that this slowest descent is attained if all credits are increasing at all times, except for the one that is transmitting.

*recovering*before each transmission. This is illustrated in the right panel of Fig. 8. Naturally, these recoveries can only be caused by earlier transmissions.

An example of two priorities levels (\(H_1 > H_2\)) in which reaching the minimum credit with the slowest decreasing rate is not feasible in the last two transmissions

\(\alpha ^+\) | \(\alpha ^-\) | \(C^{\max }\) | \( CR ^{\min }\) | |
---|---|---|---|---|

\(H_1\) | 20 | 80 | 1 | \(-\,80\) |

\(H_2\) | 40 | 60 | 6 | \(-\,360\) |

### 5.3 Tightness for interference of multiple higher priority classes

Now that we have shown tightness for a single interfering higher priority class, and given examples why tightness is not self-evident for multiple higher priority interferences, let us study the latter in more detail. In case of a stream *M* interfered by a set of multiple higher priority classes \({\mathbb {H}}\) and lower priority classes \({\mathbb {L}}\), our claims of tightness are conditional. Of course, still only one lower priority frame can interfere. But as indicated before, if we try to create a scenario that achieves the worst-case, we need to aim for interference by the higher priority classes that at the same time a) reaches the minimum total credit \( CR _{\mathbb {H}}^\mathrm {min}\) and b) achieves this in the slowest way possible. In other words, we need a single scenario that serves as a witness for both Theorems 4 and 5. This is not always possible, but it is possible to turn the combined construction of both witnesses into a sufficient condition for tightness.

### Theorem 7

*M*and \({\mathbb {H}}\) are under credit based shaping and \(\alpha _{{\mathbb {H}}}^+ + \alpha _{M}^+ \le BW\). If there exists a sequence \(H_1...H_N \in {\mathbb {H}}\), with

*N*the number of streams in \({\mathbb {H}}\), such that each priority class only occurs once in the sequence (but not necessarily in order of priority), and if for all \(1 \le n \le N\):

### Proof

Admittedly, the scenario is quite complicated. It consists of five phases, illustrated in Fig. 10. The first-phase consists, like in the single higher-priority case, of a transmission of a lower priority frame, while all other shapers receive pending load just after the transmission of the lower priority frame has started. In the figure, this is indicated by a burst *B*.

In the second phase, the cumulative credit that has increased during the first phase is depleted using the burst *B*, which is a large burst of higher-priority frames of arbitrarily small size \(\delta > 0\). As a consequence, the cumulative credit reaches 0, while all higher priority shapers have pending load at all times, and some higher priority is transmitting at all times. This means, using Corollary 2, that credit drops at its slowest possible speed during this second phase. In the third and fourth phase, which only take an arbitrarily short amount of time, the cumulative credit may drop by a small amount because some (but not all) shapers experience a credit reset. After this reset, a number of arbitrarily small transmissions take place to put the credit of all higher-priority shapers at the right (negative) amount to start with the fifth phase. Finally, in the fifth phase, credit of all higher-priority shapers remains negative at all times, except for the one that needs to transmit, which has credit 0 exactly when needed. We repeatedly use transmissions in order of the sequence \(H_1 \ldots H_N \in {\mathbb {H}}\), with ever larger frame-sizes.

*i*. If furthermore the sequence satisfies the (strictly stronger) conditions given in the theorem, then the last iteration of transmissions \(H_1 \ldots H_N\) consist of maximal frame sizes, resulting in the minimum credit. Therefore, the execution \(u^\epsilon \) is a witness of an arbitrary approximation of the worst-case response time for a frame \(m \in M\). \(\square \)

### Conjecture 1

We conjecture that the conditions given in Theorem 7 are in fact necessary and sufficient for tightness.

The conjecture, of course, is based on the example discussed in the previous section. It is certainly necessary to approximate minimum credit in order to approximate the worst-case response time, and any sequence of transmissions approximating minimum credit has to use frames approximating maximal size. (Assuming otherwise leads to a contradiction, since a larger frame-size immediately leads to lower credit.) The conditions in Theorem 7 exactly describe a possible last sequence of transmissions needed to actually reach minimum credit. We conjecture that this is, in fact, the only possible sequence that leads to minimum credit, but a formal proof of this is left for future research.

Finally, note that the complexity of checking the condition for tightness just involves one inequality check, once the order of the sequence to reach the minimum credit is determined. The complexity of the minimum credit analysis is factorial in the number of higher priority streams as explained in Sect. 4.4.

## 6 Comparison with earlier work

In this section, we perform a comparison with the busy period analyses presented in Axer et al. (2014) and Bordoloi et al. (2014). For this, we focus on scenarios in which there is only a single high priority. In this case, our own approach is tight, assuming there is no additional information regarding interference. However, in the work of Axer et al. (2014) and Bordoloi et al. (2014) interference is assumed to be periodic, or at least have a minimum inter-arrival time. This additional information makes a comparison still interesting. Furthermore, the comparison may illustrate how certain sources of pessimism present in the approaches of Axer et al. (2014) and Bordoloi et al. (2014) have been remedied by the use of eligible intervals.

It turned out to be difficult to perform a fair comparison in case of multiple high priorities. In both Axer et al. (2014) and Bordoloi et al. (2014), there is the implicit suggestion that multiple high priorities may be addressed by summing up the interference from all high priorities. However, no clear calculation was given for this case, and the authors only studied examples that covered a single higher priority in their papers. Therefore, a comparison considering multiple high priorities would be rather artificial and subject to interpretation.

### 6.1 Illustrative example given a single high priority

*M*frame is tightly bound by its worst-case response-time in an un-interfered schedule plus a constant term determined by the maximum frame size of high and low priority traffic and the reservation of the high priority shaper. In order to compute the actual response-time of a frame, just knowing the relative delay compared to an un-interfered schedule is not sufficient. We also need to calculate the worst-case response-time of that un-interfered schedule. For this, it is necessary to make some assumptions on the class

*M*traffic, which causes intra-class interference. Up to this point, such assumptions did not play a part in our system model. For the main result of this paper, it is not important how the un-interfered schedule is analysed, but when comparing our work to that of others, it is important that we have a way to do so.

Example scenario, calculating worst-case response-times for class *M* sources \(\tau _1, \tau _2\) and \(\tau _3\) using the analysis presented in this paper, given a total bandwidth of 100 Mbps

As an arbitrarily chosen illustrative example, let us consider three sources of class *M* traffic: \(\tau _1, \tau _2, \tau _3\). In line with the assumptions in Bordoloi et al. (2014), we assume that each source has periodic behavior characterized by the inter-arrival time \(T_i\), and a maximum frame-size \(C_i\). Note, that we only need to assume this for the class *M* traffic, not for the high- and low-priority sources of interference. For the latter, we only assume maximum frame sizes \(C_L^{\max }\) and \(C_H^{\mathrm {max}}\), and the reservation of high priority \(\alpha _H^+\). This is summarized in Table 4, where we assign values to those parameters. Finally, we assume a bandwidth \(BW = 100\) Mbps in this table, and choose the respective reservations of the shapers to be 40% of this, so: \(\alpha _H^+ = \alpha _M^+ = 40\) Mbps and \(\alpha _H^- = \alpha _M^- = 60\) Mbps.

*M*-priority schedule, we use the fact that this schedule behaves as a FIFO queue with added recovery times. Under the condition that the utilization of the sources is less than the reservation, i.e.: \(\sum \limits _{\tau _i \in M}\frac{C_i}{T_i} \le \frac{\alpha _M^+}{BW},\) we can perform a simple busy period analysis [see appendix in Cao et al. (2016a)] to find that the worst-case response-time for any frame from source \(\tau _i\) is given by:

*M*sources start simultaneously. Then, adding the interference according to Theorem 6 gives us:

### 6.2 Applying Axer et al. (2014) and Bordoloi et al. (2014) to the same example

Now, in order to compare our approach with that of Axer et al. (2014) and Bordoloi et al. (2014), we must first observe that in those approaches more knowledge regarding the interfering traffic is assumed than in ours. In particular, in Bordoloi et al. (2014) it is assumed that also the high priority traffic is characterized as a set of periodic sources. Moreover, a deadline associated with each high-priority task is used in the calculations of Bordoloi et al. (2014) that compensate for the fact that some high-priority traffic transmits during the recovery time. In Axer et al. (2014), the Compositional Performance Analysis approach is used, meaning that high and medium priority traffic are characterized by arrival curves instead of as periodic sources. An arrival curve specifies the maximal and minimal amount of traffic in an arbitrary interval of a certain size. In this comparison, we follow the assumptions of Bordoloi et al. (2014), because it is a strictly stronger assumption than that of Axer et al. (2014). Any periodic source can easily be represented as a (periodic) arrival curve.

Potentially, the addition of information on the interference means that the worst-case performance bounds can be improved over ours, even though our approach is tight for our system model. Further on, we present examples when this is indeed the case, but also examples where both Axer et al. (2014) and Bordoloi et al. (2014) are pessimistic.

*M*is not reached and the worst-case response time predicted by our approach is thus not attained, because there is not enough flexibility to generate the necessary worst-case interference. Next, we set out to identify the sources of the pessimism in Axer et al. (2014) and Bordoloi et al. (2014) that cause the over-estimation of the worst-case response time, and we suggest a solution to improve our own prediction in case details on the limited burst-size are known or computable.

### 6.3 Exploring pessimism

The busy period analyses of Axer et al. (2014) and Bordoloi et al. (2014) start out from the same basic analysis. Both papers initially identify a model in which four sources of interference are identified: high-priority interference, low-priority interference, medium-priority interference, and interference due to shaping. Incidentally this basic analysis in the two papers coincides for periodic sources, and for reference we have added the results of this analysis (under the name ‘basic busy period analysis’) in the figures that occur in this section.

In Fig. 12, we illustrate the influence of this improvement, by considering the same shaper reservations and maximum frame sizes as in the grey parts in Table 4. We determine the worst-case response time of a single medium-priority source with \(C = 3\), and \(T = 30\), interfered by \(n_H\) identical high-priority sources with \(C_i = 1\), \(T_i = D_i = 5 \cdot n_H\), as well as a low-priority stream. Note, that we keep the total utilization of *H* at 20 Mbps (below its reservation \(\alpha _{H}^+\)) as \(n_H\) ranges from 1 to 20.

The result of varying the number of high priority sources, is that the possible burst size of high priority traffic increases. The figure clearly shows how, for low values of \(n_H\), the burst size is smaller than the limits set by the credit based shaper. For those low values, the predictions of Axer et al. (2014) and Bordoloi et al. (2014) turn out to be better than ours, because we do not consider the load generated by high priority sources. For higher values of \(n_H\), the high priority shaping becomes dominant, and those of Axer et al. (2014) and Bordoloi et al. (2014) eventually stabilize at a fixed value, while the basic busy period analysis keeps growing because it does not take high priority shaping into account at all. Our approach always remains the same value, which turns out to be tight and independent of the pattern of high priority traffic.

This is illustrated in Fig. 13, in which we again consider the same shaper reservations and maximum frame sizes as in Table 4. As before, we determine the worst-case response time of a single medium-priority source with \(C = 3\), and \(T = 30\), but this time the interference consists of a low-priority stream, a single high-priority source with \(C = 1\), and \(T = D = 5\), and \(n_M\) medium-priority sources with \(C_i = 1\), \(T_i = D_i = 5 \cdot n_M\).

Finally, if we adapt the scenario in which there are still \(n_M\) interfering medium priority sources, and consider \(n_H = 15\) identical high priority sources instead of just 1, we see a completely different picture, shown in Fig. 14. Now, our approach is tight again, because there is sufficient high priority traffic to deplete the credit to reach its minimum. Furthermore, if we range \(n_M\) from 1 to 100, we see that the approaches of Axer et al. (2014) and Bordoloi et al. (2014) give better estimates than the basic analysis for low values (\(n_M \le 6\)), since the shaping of high-priority is taken into account. For high values, the approach of Axer et al. (2014) coincides with the basic analysis, and shows a ‘staircase’ behavior in its pessimism which indicates that the arrival of high priority interference is the limiting factor in the analysis. Interestingly, the analysis from Bordoloi et al. (2014) suffers from the same over approximation until \(n_M = 47\), and only then merits from the implemented improvements.

The complexity of the approach set out in Bordoloi et al. (2014) makes it difficult to find a satisfactory explanation for the pessimism that still is present. Instead, it may be more promising to consider whether our own approach can be improved in cases where the burstiness of high priority traffic is insufficient to generate the worst-case behavior predicted by our approach.

### 6.4 Adding information

*Burst*during which there can be a continuous transmission of high priority traffic. Considering the scenario in Fig. 11, we claim that, given knowledge of this burst, our worst-case response-time analysis can be adapted to:

*Burst*is smaller than time needed to deplete the built-up credit plus a single maximum high priority frame transmission.

Naturally, one can go even further, and consider the fact that the last transmission must be a frame of maximum size, and that the transmissions preceding this must exactly fit the depletion time of the maximum credit. If those transmissions do not fit exactly (for instance, because frames have a fixed size) the worst-case can also not be attained. But such considerations only complicate the analysis, and are expected to lead to relatively small improvements compared to the results already achieved by our eligible interval analysis.

## 7 Conclusions and future work

In this paper, we analyzed the worst-case response time of transmitting frames under credit-based shaping in an Ethernet AVB switch. We improved our work of Cao et al. (2016a, b), extending its application to the case where there are multiple higher and lower priority classes that interfere with the transmission of a frame. We presented a technique to perform worst-case response time analysis, independent of knowledge of the interfering traffic (except those assumptions enforced by the Ethernet AVB standard), and proved sufficient (and conjectured necessary) conditions under which our analysis yields a tight bound. Notably, the complexity of our worst-case relative delay analysis mainly depends on the complexity of the minimum credit calculation, which is only factorial in the number of higher priority classes (see Theorem 4), and the complexity of checking the sufficient conditions just involves an additional inequality check. Unlike the more traditional busy period analysis, that was proposed in, amongst others, Axer et al. (2014) and Bordoloi et al. (2014), our method does not rely on recursions of which the depth is dependent on the chosen system parameters.

Our comparison with the state-of-the-art [e.g. Axer et al. (2014) and Bordoloi et al. (2014)], focussing on single higher and lower priority streams, suggests that our approach is superior in situations where the burstiness of high priority traffic is large enough. In particular, our approach is superior when the burst is larger than the depletion time of the maximum credit built up by the low priority traffic plus a single maximum high priority frame transmission. Furthermore, given the input models assumed in Axer et al. (2014) or Bordoloi et al. (2014), we conjecture it is fairly easy to estimate the maximum burst size and improve our analysis slightly. This would give an equivalent result to the state at the art. However, such an improvement requires additional assumptions on the sources of interference, which we think is unreasonable considering the increasing number of connected components in a network. Furthermore, the improvements would complicate our algorithm.

We attribute the tightness as well as the simplicity of our approach to the use of eligible intervals, during which there is both pending load and credit available to a shaper. The use of these intervals leads to a separation of concerns in which we first relate eligible intervals to a known un-interfered schedule, and secondly relate the credit at the start of a transmission to the relative delay caused by the interfering traffic. Subsequently, we bound the relative delay by bounding the maximum attainable credit. The main contribution of this paper, is that we show that this approach is still feasible in case of multiple (shaped) priority classes.

As a topic for future research, we intend to investigate whether eligible intervals can be applied in the analysis of other shaping strategies as well. For example, we aim at applying them in the context of the Ethernet TSN standard (IEEE 2012), which is currently being developed. In Ethernet TSN other shapers are considered in combination with credit-based shaping to guarantee low latencies for control frames, adding another source of heterogenity to the analysis. It is interesting to see whether the use of eligible intervals has advantages in the analysis of such shapers in isolation, but also to see whether it can be used when different shapers are being combined. As a further topic of investigation, we would like to see if the Compositional Performance Analysis approach that was used in Axer et al. (2014) can be simplified using eligible intervals. In principle, if our eligible intervals can indeed be used to transform arrival curves into output curves, the study of multi-hop scenarios of idling servers becomes much easier.

## Notes

### Acknowledgements

This research is supported by the Dutch Technology Foundation STW under the Robust CPS Program, Project 12697.

## References

- Ashjaei M, Patti G, Behnam M, Nolte T, Alderisi G, Bello LL (2017) Schedulability analysis of Ethernet audio video bridging networks with scheduled traffic support. Real-Time Syst 53(4):526–577. https://doi.org/10.1007/s11241-017-9268-5 CrossRefzbMATHGoogle Scholar
- Axer P, Thiele D, Ernst R, Diemer J (2014) Exploiting shaper context to improve performance bounds of Ethernet AVB networks. In: Proceedings of the 51st ACM/EDAC/IEEE design automation conference (DAC), pp 1–6. https://doi.org/10.1145/2593069.2593136
- Bordoloi UD, Aminifar A, Eles P, Peng Z (2014) Schedulability analysis of Ethernet AVB switches. In: Proceedings of the 20th IEEE international conference on embedded and real-time computing systems and applications (RTCSA), pp 1–10. https://doi.org/10.1109/RTCSA.2014.6910530
- Bril RJ, Lukkien JJ, Verhaegh WFJ (2009) Worst-case response time analysis of real-time tasks under fixed-priority scheduling with deferred preemption. Real-Time Syst 42(1):63–119. https://doi.org/10.1007/s11241-009-9071-z CrossRefzbMATHGoogle Scholar
- Cao J, Cuijpers PJL, Bril RJ, Lukkien JJ (2016a) Independent yet tight WCRT analysis for individual priority classes in Ethernet AVB. In: Proceedings of the 24th international conference on real-time networks and systems (RTNS), pp 55–64. https://doi.org/10.1145/2997465.2997493
- Cao J, Cuijpers PJL, Bril RJ, Lukkien JJ (2016b) Tight worst-case response-time analysis for Ethernet AVB using eligible intervals. In: Proceedings of the 12th IEEE world conference on factory communication systems (WFCS), pp 1–8. https://doi.org/10.1109/WFCS.2016.7496507
- Davis RI, Burns A, Bril RJ, Lukkien JJ (2007) Controller area network (CAN) schedulability analysis: refuted, revisited and revised. Real-Time Syst 35(3):239–272. https://doi.org/10.1007/s11241-007-9012-7 CrossRefGoogle Scholar
- Diemer J, Rox J, Ernst R (2012a) Modeling of Ethernet AVB networks for worst-case timing analysis. In: Proceedings of the 7th Vienna international conference on mathematical modelling (MATHMOD), pp 848–853. https://doi.org/10.3182/20120215-3-AT-3016.00150 CrossRefGoogle Scholar
- Diemer J, Thiele D, Ernst R (2012b) Formal worst-case timing analysis of Ethernet topologies with strict-priority and AVB switching. In: Proceedings of the 7th IEEE international symposium on industrial embedded systems (SIES), pp 1–10. https://doi.org/10.1109/SIES.2012.6356564
- Henia R, Hamann A, Jersak M, Racu R, Richter K, Ernst R (2005) System level performance analysis—the SymTA/S approach. IEEE Proc Comput Digit Tech 152(2):148–166. https://doi.org/10.1049/ip-cdt:20045088 CrossRefGoogle Scholar
- IEEE (2005) IEEE 802.1 audio/video bridging task group. http://www.ieee802.org/1/pages/avbridges.html
- IEEE (2012) IEEE 802.1 time-sensitive networking task group. http://www.ieee802.org/1/pages/tsn.html
- IEEE (2014) IEEE Std. 802.1Q-2014, standard for local and metropolitan area networks, bridges and bridged networksGoogle Scholar
- IEEE (2016) IEEE Standard 802.1Qbv, standard for local and metropolitan area networks bridges and bridged networks amendment 25: enhancements for scheduled trafficGoogle Scholar
- Imtiaz J, Jasperneite J, Han L (2009) A performance study of Ethernet audio video bridging (AVB) for industrial real-time communication. In: Proceedings of the 14th IEEE conference on emerging technologies factory automation (ETFA), pp 1–8. https://doi.org/10.1109/ETFA.2009.5347126
- Lehoczky J (1990) Fixed priority scheduling of periodic task sets with arbitrary deadlines. In: Proceedings of the 11th real-time systems symposium (RTSS), pp 201–209. https://doi.org/10.1109/REAL.1990.128748
- Li X, George L (2017) Deterministic delay analysis of AVB switched ethernet networks using an extended trajectory approach. Real-Time Syst 53(1):121–186. https://doi.org/10.1007/s11241-016-9260-5 CrossRefzbMATHGoogle Scholar
- Martin S, Minet P (2006) Schedulability analysis of flows scheduled with FIFO: application to the expedited forwarding class. In: Proceedings of the 20th IEEE international parallel distributed processing symposium (IPDPS). https://doi.org/10.1109/IPDPS.2006.1639424
- Maxim D, Song YQ (2017) Delay analysis of AVB traffic in time-sensitive networks (TSN). In: Proceedings of the 25th international conference on real-time networks and systems (RTNS), pp 18–27. https://doi.org/10.1145/3139258.3139283
- Reimann F, Graf S, Streit F, Glas M, Teich J (2013) Timing analysis of Ethernet AVB-based automotive E/E architectures. In: Proceedings of the 18th IEEE conference on emerging technologies factory automation (ETFA), pp 1–8. https://doi.org/10.1109/ETFA.2013.6648024
- Thangamuthu S, Concer N, Cuijpers PJL, Lukkien JJ (2015) Analysis of Ethernet-switch traffic shapers for in-vehicle networking applications. In: Proceedings of the design, automation & test in Europe conference & exhibition (DATE 2015). Piscataway, IEEE Service Center, Grenoble, pp 55–60Google Scholar
- Thiele D, Ernst R (2016) Formal worst-case timing analysis of Ethernet TSN’s burst-limiting shaper. In: Proceedings of the design, automation test in Europe conference exhibition (DATE), pp 187–192. https://doi.org/10.3850/9783981537079_0276
- Thiele D, Ernst R, Diemer J (2015) Formal worst-case timing analysis of Ethernet TSN’s time-aware and peristaltic shapers. In: Proceedings of the IEEE vehicular networking conference (VNC), pp 251–258. https://doi.org/10.1109/VNC.2015.7385584
- Wandeler E, Thiele L, Verhoef M, Lieverse P (2006) System architecture evaluation using modular performance analysis: a case study. Int J Softw Tools Technol Transf 8(6):649–667. https://doi.org/10.1007/s10009-006-0019-5 CrossRefGoogle Scholar

## Copyright information

**Open Access**This article is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits unrestricted use, distribution, and reproduction in any medium, provided you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license, and indicate if changes were made.