Worst-Case Timing Analysis of AFDX Networks With Multiple TSN/BLS Shapers

This paper addresses the problem of worst-case timing analysis of extended Avionics Full Duplex Switched Ethernet (AFDX) networks, incorporating Time-Sensitive Networking (TSN) shapers called Burst Limiting Shapers (BLS), to enable the interconnection of different avionics domains with mixed-criticality levels, e.g., current AFDX traffic, Flight Control and In-Flight Entertainment. Conducting such an analysis is a challenging issue when considering multiple BLS-shaped traffic classes, due to the sophisticated inter-dependencies between the different shapers sharing the same output capacity. We tackle this problem through extending the applicability domain of our previous work for computing maximum delay bounds using Network Calculus and considering only one BLS class, called Continuous Credit-based Approach (CCbA), to handle multiple TSN/BLS classes. We provide further insights into the sensitivity and tightness issues of worst-case delay bounds yielded with the Generalized CCbA (GCCbA). Our assessments show that the tightness ratio is up to 85%, with reference to Achievable Worst-Case delays. We also show the improvements against recent state-of-the-art approaches in terms of tightness and complexity, where the computation time is up to 105 faster. Finally, we evaluate the efficiency of GCCbA for realistic avionics case studies, e.g., adding A350 flight control traffic to the AFDX. Results show the good applicability of GCCbA and confirm the efficiency of the extended AFDX, which decreases the delay bounds of the existing AFDX traffic by up to 49.9%, in comparison with the current AFDX standard.


I. INTRODUCTION
The growing number of interconnected end-systems and the expansion of exchanged data in avionics have led to an increase in complexity of the communication architecture. To cope with this trend, a first communication solution based on a high rate backbone network, i.e., the AFDX (Avionics Full Duplex Switched Ethernet) [1], has been implemented by Airbus in the A380, to interconnect critical subsystems. Moreover, some low rate data buses, e.g., CAN [10], are still used to handle some specific avionics domains, such as the I/O process and the Flight Control Management. Although this architecture reduces the time to market, it conjointly leads to inherent heterogeneity and new challenges to guarantee the real-time requirements.
To handle these emerging issues, with the maturity and reliability progress of the AFDX after a decade of successful use, The associate editor coordinating the review of this manuscript and approving it for publication was Moayad Aloqaily . a homogeneous avionic communication architecture based on such a technology to interconnect different avionics domains may bring significant advantages, such as quick installation and maintenance and reduced weight and costs.
Furthermore, this new communication architecture needs to support, in addition to the current AFDX traffic profile, called Rate Constrained (RC) traffic, at least two extra profiles. The first, denoted by Safety-Critical Traffic (SCT), is specified to support flows with hard real-time constraints and the highest criticality level, e.g., flight control data; whereas the second is for Best-Effort (BE) flows with no delivery constraint and the lowest criticality level, e.g., In-Flight Entertainment traffic.
In [4], we have assessed the most relevant existing solutions enabling mixed-criticality on the AFDX [7], [8], [11], [12], [14] and selected the Burst-Limiting Shaper (BLS) [7] proposed by the Time Sensitive Networking (TSN) task group as the most promising one vs avionics requirements. In particular, BLS offers high fairness and predictability, and VOLUME 8, 2020 This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/ a low complexity. The specification of an extended AFDX, incorporating BLS shaper, has been detailed and the preliminary evaluation of such a proposal has been conducted through simulations. Results showed the noticeable enhancement of the latencies of the current AFDX traffic (RC) in presence of the highest priority one (SCT) with our extended AFDX, with reference to the current AFDX. This was encouraging to pursue this line through providing formal timing analysis to prove certification requirements, a key point in avionics.
There are some interesting approaches in the literature concerning the formal timing analysis of BLS shaper and the most prominent one is based on the Compositional Performance Analysis (CPA) [13]. However, we will show in Section IV that this approach can lead to optimistic delay bounds. To cope with this issue, we have proposed a first approach based on Network Calculus [9], called Window-based Approach (WbA), in [6]. Computed delay bounds confirmed our first conclusions in [4] and highlighted the benefit of BLS to mitigate the impact of SCT traffic on RC one. However, as it will be detailed in Section IV, the WbA model does not accurately take into account the impact of one of the BLS parameter (i.e., the resume level), which may lead to pessimistic delay bounds. Hence, we have introduced in [5] an improved model based also on Network Calculus, called Continuous-Credit-based Approach (CCbA). This approach has been validated on a single-hop network when considering only one BLS-shaped class. However, incorporating many BLS shapers within each crossed AFDX switch may offer a higher flexibility to handle mixed-criticality traffic.
Hence, in this paper, our contributions are: • First, we introduce a generalized CCbA approach (GCCbA) to analyze the impact of incorporating multiple BLS within AFDX switches on SCT and RC traffic performance and prove the required service curves under Network Calculus; • Second, we conduct a deep sensitivity analysis of the delay bounds yielded by GCCbA with respect to various flow and BLS parameters. Moreover, we assess their tightness in comparison with an achievable worst-case delay (AWC) and benchmark the related work (CPA and WbA) results against ours. Our assessments show that the tightness ratio is up to 85% and the computation time is up to 10 5 lower than with CPA; • Finally, the efficiency of our proposal to provide timing guarantees is illustrated for two realistic avionics case studies. The remainder of this paper is organized as follows. We first present the system model and some preliminaries in Section II. Section III details our extended approach, GCCbA, to handle multiple BLS classes within AFDX switches and compute the delay bounds of SCT and RC traffic. Afterwards, we assess the sensitivity and tightness of GCCbA, as well as the yielded improvements with GCCbA against the main state-of-the-art approaches in Section IV. Finally, we highlight the applicability and efficiency of our approach for two realistic avionics case studies in Section V.

II. PRELIMINARIES AND SYSTEM MODEL
In this section, we detail the considered system model based on Network Calculus. First, we present the main concepts of a BLS shaper and Network Calculus that are used in this paper. Afterwards, we describe the network and flow models. The notations will be introduced as they are needed and are also gathered in Table 1.

A. BURST LIMITING SHAPER
The BLS belongs to the credit-based shaper class. Each shaped queue is associated to a class k and has been defined in [7] by an upper threshold L k M , a lower threshold L k R , such as 0 L k R < L k M , and a reserved bandwidth BW k . Additionally, the priority of a class k shaped by BLS, denoted p(k), can vary  between a high and a low value, denoted p H (k) and p L (k) (with priority 0 the highest priority, and p L (k) > p H (k)). The low value is usually below the lowest priority of the unshaped traffic. In the avionic context, to guarantee the safety isolation level between the different traffic profiles, the low value associated to the SCT is set to be lower than the RC priority level, but higher than the BE priority. For instance, when considering one class for each traffic type multiplexed according to Non-Preemptive Strict-Priority policy (NP-SP) as shown in Fig. 1, SCT queue priority oscillates between 0 (the highest) and 2, RC priority is 1 and BE has the priority 3 (the lowest).
It is worth noting that with the BLS, both the priority of the queue of the shaped class and the state of all the queues, i.e., empty or not, define how the credit varies. This aspect is depicted in Fig. 2 for two arrival scenarios. The first one (left figure) shows the case of a bursty traffic, whereas the second one (right figure) is for sporadic traffic.
Thus, the credit counter varies as follows: • initially, the credit counter starts at 0 and the priority of the queue of the burst limited flows is high (#0); • the main feature of the BLS is the change of priority p(k) of the queue of the shaped class, which occurs in two contexts: 1) if p(k) is high and credit reaches L k M ; 2) if p(k) is low and credit reaches L k R ; • when a frame is transmitted, the credit increases (is consumed) with a rate of I k send , else the credit decreases (is gained) with a rate of I k idle : where C is the link speed and BW k is the percentage of bandwidth reserved for BLS frames; • when the credit reaches L k M , it stays at this level until the end of the transmission of the current frame; • when the credit reaches 0, it stays at this level until the end of the transmission of the current frame (if any). The credit remains at 0 until a new BLS frame is transmitted.

B. NETWORK CALCULUS FRAMEWORK
Our timing analysis is based on Network Calculus theory [9] providing upper bounds on delays and backlogs. Delay bounds depend on the traffic arrival described by the so called arrival curve α, and on the availability of the traversed node described by the so called minimum service curve β.
The definitions of these curves are explained as following. Definition 1 (Arrival Curve [9]): A function α(t) is an arrival curve for a data flow with an input cumulative function R(t),i.e., the number of bits received until time t, iff: Definition 2 (Strict Minimum Service Curve [9]): The function β is the minimum strict service curve for a data flow with an output cumulative function R * , if for any backlogged period ]s, t], 2 Definition 3 (Maximum Service Curve [9]): The function γ (t) is the maximum service curve for a data flow with an input cumulative function R(t) and output cumulative function R * (t) iff: To compute end-to-end delay bounds of individual traffic flows in multiple-hop networks, we need the following results.
Theorem 1 (Blind Multiplex of Two Flows [3]): Consider two flows f 1 , f 2 crossing a system n with the strict minimum service β(t), and with the flows f j α j -constrained, j ∈ {1, 2}. Then, the residual minimum service curve offered to f 1 is: [3]): Consider a system with the strict service β(t) and m flows crossing it, f 1 ,f 2 ,..,f m . The maximum frame size of f i is MFS i , its priority is p(i), f i is α i -constrained, and ∀i, the priorities strictly higher than p(i), are ∀j, p(j) < p(i). The flows are scheduled by the NP-SP policy. For each i ∈ {1, .., m}, the strict service curve offered to f i is given by 3 : Theorem 2 (Performance Bounds [9]): Consider a flow F constrained by an arrival curve α crossing a system S that  offers a minimum service curve β and a maximum service curve γ . The performance bounds obtained at any time t are: Theorem 3 (Concatenation-Pay Bursts Only Once [9]): Assume a flow crossing two servers with respective service curves β 1 and β 2 . The system consisting of the concatenation of the two servers offers a service curve β 1 ⊗ β 2 .

C. NETWORK MODEL
We consider multi-hop AFDX networks incorporating TSN/BLS shapers, with traffic generated in end-systems and transmitted through one or several switches before reaching the destination end-systems, as illustrated in Fig. 3.
The end-systems are implementing a NP-SP policy. According to Corollary 1, the strict minimum service curve guaranteed to a traffic class k ∈ {SCT , RC, BE} within an end-system es is as follows: For the AFDX switches incorporating multiple TSN/BLS shapers, we consider that any class can be shaped by a BLS at the output port multiplexer as shown in Fig. 4 to reduce the impact of the considered class on lower priorities. 4 v: maximal vertical distance 5 h: maximal horizontal distance 6 The resulting architecture is flexible and offers many opportunities to manage each class as needed.
As illustrated in Fig. 4, the minimum service curve guaranteed to a traffic class k ∈ {SCT , RC, BE} within a switch sw depends mainly on the one guaranteed within the output port multiplexer mux, β mux k . The latter depends in its turn on the minimum service curves guaranteed within both components the BLS bls and the NP-SP scheduler sp, which are β bls k and β sp k , respectively.

D. TRAFFIC MODEL
To compute upper bounds on end-to-end delays of different traffic classes using Network Calculus, we need to model each message flow through its maximum arrival curve.
The arrival curve of each flow f in class k at the input of the node n ∈ {es, sw} or a component n ∈ {bls, sp} along its path is a leaky-bucket curve with a burst b n k,f and a rate r n k,f : Therefore, the arrival curve of the aggregate traffic in class k at the input (resp. output) of the node n ∈ {es, sw} or a component n ∈ {bls, sp} is α n based on Theorem 2). In particular, each traffic flow f of class k, generated by an end-system, is characterized by BAG f , MFS f , J f for respectively the minimum inter-arrival time, the maximum frame size integrating the protocol overhead, and the jitter.
Hence, the arrival curve of traffic class k in the end-system es, based on a leaky bucket model, is as follows:

III. GENERALIZED CONTINUOUS CREDIT-BASED APPROACH
In this section, we first present an overview of our approach GCCbA, with the main steps to compute the end-to-end delay bounds for each traffic class. Then, we detail the required service curves of BLS and NP-SP components to enable this computation

A. OVERVIEW
Our timing analysis approach GCCbA is based on the following four steps: 1) computing the strict minimum service curve guaranteed to each traffic class k in each node n of type {es, mux}, β n k , will infer the computation of the residual service curve, guaranteed to each individual flow f of class k, β n k,f with Theorem 1; 2) knowing the residual service curve guaranteed to each flow within each crossed node allows the propagation of the arrival curves along the flow path, using Theorem 2. We can compute the output arrival curve, based on the input arrival curve and the minimum service curve, which will be in its turn the input of the next node; 3) the computation of the minimum end-to-end service curve of each flow f in class k, based on Theorem 3, is simply the concatenation of the residual service curves, β n k,f , ∀n along its path path f ; 4) given the minimum end-to-end service curve of each flow f in class k along its path f and its maximum arrival curve at the initial source, the end-to-end delay upper bound is the maximum horizontal distance between the two curves using Theorem 2.
Knowing the service curve of an end-system (Eq. 3), the main issue here is to compute the unknown service curve of an output port multiplexer. As illustrated in Fig. 4, an output port mux consists of a NP-SP component sp and one or many BLS components bls. We denote BLS classes the classes shaped by a BLS, and NBLS classes the classes not shaped by a BLS. Hence, modeling the BLS component and computing its service curve, β bls k , are necessary to compute the service curve of an output port mux, β mux k , for a class k ∈ {BLS, NBLS}.

B. BLS SERVICE CURVES
We detail here the computation of BLS service curves offered to a BLS class k. The main idea is to compute the consumed and gained credits. Knowing that the credit is continuous and always between 0 and L k M , we use the sum of the consumed and gained credits to compute the minimum and maximum service curves of the BLS node. The main difficulty consists in computing the traffic sent during saturation times, i.e., when the credit is neither gained nor consumed due to the minimum and maximum levels, 0 and L k M , respectively.
The strict minimum and maximum service curves offered to a BLS class k by a BLS node are defined in Theorem 4 and in Theorem 5, respectively.
Theorem 4 (Strict Minimum Service Curve Offered to a BLS Class k by a BLS Node): Consider a server with a constant rate C, implementing BLS shapers. The traffic of class k crosses this server and is shaped by the BLS. Class k has a high priority denoted p H (k) and a low priority denoted p L (k) (with p L (k) > p H (k)). We call HC(k) the traffic classes with a priority strictly higher than p H (k) and MC(k) the classes with a priority between p L (k) and p H (k). The strict minimum service curve guaranteed to the BLS class k is as follows: where: We present here only a sketch of proof, the complete proof is available in the first Appendix. We search a strict minimum service curve defined by a rate-latency curve, i.e., β bls k (t) = ρ · (t − τ ) + with rate ρ and latency τ . First, to compute τ , we consider the maximum latency caused by the BLS.
Secondly, to compute ρ, we consider the fact the credit is a continuous function with values between 0 and L k M . Consequently, the sum of the gained and consumed credits is upper bounded by L k M , and the credit can saturate at 0 or L k M . Thus, the credit consumed during a period δ is not simply the product of the credit increasing rate (denoted I k send ) and the transmission time of the output traffic (denoted R * (δ)). It is actually the product of I k send and the output traffic transmitted while the credit is not saturated. The same is true for the gained credit. Hence, the main issue of the proof is the computation of these saturation times. In particular, we compute the maximum saturation for the MC(k) and HC(k) classes, and the minimum saturation for the class k, as illustrated in Fig. 5. After this, we use the definition of β(t) and the limit of R * (δ) δ toward infinity to compute ρ. Corollary 2 (Strict Minimum Service Curve Offered to SCT by a BLS Node): Consider a server with a constant rate C, implementing a BLS shaping the SCT traffic. The SCT, RC and BE traffics cross this server with the following priorities: p(SCT ) ∈ {p H (SCT ) = 0, p L (SCT ) = 2}, p(RC) = 1, p(BE) = 3, as illustrated in Fig. 1.
The strict minimum service curve guaranteed to SCT class is as follows: We apply Theorem 4 in the particular 3-classes case study presented in Fig. 1, with SCT as class k.; thus HC(k) = ∅ and MC(k) = RC.
Theorem 5 (Maximum Service Curve Offered to a BLS Class k by a BLS Node): Consider a server with a constant rate C, implementing BLS shapers. The traffic of class k crosses this server and is shaped by the BLS. Class k has a high priority denoted p H (k) and a low priority denoted p L (k) (with p L (k) > p H (k)). We call MC(k) the classes with a priority between p L (k) and p H (k).
The maximum service curve offered to the class k traffic is as follows. In the absence of backlogged MC(k) traffic: We present here only a sketch of proof, the complete proof is available in the first Appendix. We search a maximum service curve defined by a leaky-bucket curve, i.e., γ bls k (t) = r · t + b with rate r and burst b. First, for r we use the fact that the sum of the gained and consumed credits is lower bounded by −L k M . Then, we calculate the bounds of saturation times during a period δ. In particular, we calculate the minimum and maximum saturations, as illustrated in Fig. 6. Finally, we use the definition of γ (t) and the limit toward infinity of R * (δ) δ to compute r. Corollary 3 (Maximum Service Curve Offered to SCT by a BLS Node): Consider a server with a constant rate C, implementing a BLS shaping the SCT traffic. The SCT, RC and BE traffics cross this server with the following priorities: Fig. 1. The maximum service curve offered to the SCT traffic class is as follows. In the absence of backlogged RC traffic: γ bls SCT (t) = C · t; otherwise, during a backlogged period of RC: Proof: We apply Theorem 5 in the particular 3-classes case study presented in Fig. 1, with SCT as class k; thus HC(k) = ∅ and MC(k) = RC.
The maximum output arrival curve of a BLS class k is detailed in the following Corollary: Corollary 4 (Maximum Output Arrival Curve of a BLS Class): Consider a BLS class k with a maximum leaky-bucket arrival curve α at the input of a BLS shaper, guaranteeing a minimum rate-latency service curve β bls k and a maximum service curve γ bls k . The maximum output arrival curve is: Proof: To prove Corollary 4, we generalize herein the rule 13 in p. 123 in [9], i.e., (f ⊗ g) g ≤ f ⊗ (g g), to the case of three functions f , g and h when g h ∈ F, where F is the set of non negative and wide sense increasing functions: According to Theorem 2, we have α * (t) = (γ bls k ⊗ α) β bls k . Moreover, in the particular case of a leaky-bucket arrival curve α and a rate-latency service curve β bls k , α β bls k is a leaky-bucket curve, which is in F. Hence, we have the necessary condition to prove the following:

C. OUTPUT PORT MULTIPLEXER SERVICE CURVES
In this section, we compute the strict minimum service curves offered by a switch output port multiplexer mux. Such a multiplexer mux consists of sp and bls components as illustrated in Fig. 4. The strict minimum service curve offered by each output port multiplexer to a BLS class is defined in Theorem 6, and the strict minimum service curves offered by each output port multiplexer to a NBLS class, i.e., not shaped by a BLS, is defined in Theorem 7.
Theorem 6 (Strict Minimum Service Curve Offered by an Output Port Multiplexer to a BLS Class): Consider a system implementing a BLS with the strict minimum service β. The strict minimum service curve offered to a BLS class k by an output port multiplexer is: with:

strict minimum service curve offered by the NP-SP when the class-k BLS priority is low;
• β bls k∈BLS (t) the strict minimum service curve offered by the BLS node to class k, defined in Theorem 4;

strict minimum service curve offered by the NP-SP when the class-k BLS priority is high;
• α sp j (t) the input arrival curve of flow j at the sp node, such as: The idea is to model the impact of a BLS implemented on top of the NP-SP scheduler on BLS class k. To achieve this aim, we distinguish two possible scenarios.
The first one covers the particular case where the class-k priority remains low, i.e., the other queues are empty; whereas the second one covers the general case where the priority of class k oscillates between p L (k) and p H (k), as explained in Section II-A. Firstly, the minimum service curve guaranteed within mux in the first scenario is due to the NP-SP scheduler and denoted β sp k∈BLS,p L (k) , which is computed via Corollary 1 when considering the class-k priority is p L (k). Secondly, the minimum service curve guaranteed within mux in the second scenario is computed via Theorem 3, through the concatenation of the service curves within the BLS node β bls k∈BLS (computed in Theorem 4) and the NP-SP node β sp k∈BLS,p H (k) (computed via Corollary 1 when class-k priority is high).

Corollary 5 (Strict Minimum Service Curve Offered by an Output Port Multiplexer to SCT in the Case of Three Traffic
Classes): Consider a server with a constant rate C, implementing a BLS shaping the SCT traffic. The SCT, RC and BE traffics cross this server with the following priorities: Fig. 1.
The strict minimum service curve offered to SCT by an output port multiplexer is: with:

minimum service curve offered by the NP-SP when the class-k BLS priority is low;
• β bls SCT (t) the strict minimum service curve offered by the BLS node to SCT, defined in Corollary 2 • β sp SCT ,0 (t) = (C · t − max j∈{SCT ,RC,BE} MFS j ) ↑ the strict minimum service curve offered by the NP-SP when the BLS priority is high; Proof: We apply Theorem 6 in the particular 3-classes case study presented in Fig. 1, with SCT as class k. Thus HC(k) = ∅, MC(k) = RC, and β(t) = C · t.
Theorem 7 (Strict Minimum Service Curve Offered to a NBLS Class by an Output Port Multiplexer): Consider a system implementing a BLS with the strict service β and m flows crossing it, f 1 ,f 2 ,..,f m . The strict minimum service curve offered to a NBLS class k by an output port multiplexer is: with: with j ∈ BLS, the strict minimum service curve offered by the BLS node to class j, defined in Theorem 4; • γ bls j , with j ∈ BLS, the maximum service curve offered by the BLS node to class j, defined in Theorem 5. Proof: The proof of Theorem 7 is straightforward. Theorem 7 is obtained through replacing within the equation VOLUME 8, 2020   Fig. 1.
The strict minimum service curve offered to RC by an output port multiplexer is: with: • β bls SCT (t) the strict minimum service curve offered by the BLS node to SCT, defined in Corollary 2; the maximum service curve offered by the BLS node to SCT, defined in Corollary 3. Proof: We apply Theorem 7 to the particular case of the 3-classes case study presented in Fig. 1, with SCT as class k and RC as MC(k).

IV. PERFORMANCE EVALUATION
In this section, we assess the sensitivity and the tightness of our model, in reference to analytical Achievable Worst-Cases (AWCs). The computation of these AWCs is detailed in Appendix 8.1 of [2]. Furthermore, we conduct a comparative analysis with the main interesting state-of-the-art approaches, CPA [13] and WbA [6].
The considered case study in this section is a single-hop Gigabit AFDX network described in Fig. 7, with the 3-class output port multiplexer (as in Fig. 1) and the traffic profiles presented in Table 2. We will analyze the delay bounds of SCT and RC traffic yielded by GCCbA when varying the utilization rates of SCT and RC and the BLS parameters, i.e., UR SCT , UR RC , L M , L R , BW .   To assess the impact of each parameter, we will vary one parameter at a time, which leads to the five following scenarios: The computed delay bounds under the different scenarios are reported in Figures 8, 9, 10, 11 and 12, respectively.

A. SENSITIVITY ANALYSIS
We analyze the sensitivity of GCCbA model when varying the considered parameters. As we can notice, under the different scenarios, we can distinguish two main parts in the curves of SCT and RC delay bounds yielded by GCCbA. This fact is inherent to our model of the output port multiplexer: β mux SCT (t) (see Corollary 5) and β mux RC (t) (see Corollary 6). The evolution of the strict minimum service curves of SCT and RC follows the maximum of two linear curves: one is due to the NP-SP component and the other is due to the BLS one.
First, we focus on the impact of UR SCT on the SCT and RC delay bounds as shown in Fig. 8. In the left graph, when the SCT utilization rate increases, we observe an increase of the SCT delay bounds starting close to 0 thanks to a low initial latency and high rate guaranteed by the BLS component. Then, at UR SCT = 20%, the delay bounds are mainly due to the SP component. Furthermore, in the right graph, when the SCT utilization rate increases, we observe a noticeable increase of the RC delay bounds due to the SP component. Then, after UR SCT = 18%, the delay bounds becomes constant since it depends on the BLS component, which offers a constant service curve to RC traffic when the RC utilization rate is constant. These results infer that the variation of UR SCT has a large impact on both the SCT and RC delay bounds. For instance, we have a maximum variation of 2.5ms for SCT (resp. 0.4ms for RC); thus the delay bound of SCT (resp. RC) is multiplied by 24 (resp. by 2.3).
In Fig. 9, when varying the RC utilization rate, we observe a symmetrical behavior of SCT and RC delay bounds to the one under SCT utilization rate variation: • the SCT delay bound is ruled below UR RC = 20% by the NP-SP component; whereas after UR RC = 20%, it is ruled by the BLS component; • the RC delay bound is ruled below UR RC = 30% by the the BLS component; whereas after UR RC = 30%, it is ruled by the NP-SP component. Furthermore, the variation of UR RC has also a noticeable impact on both the SCT (resp. RC) delay bounds, where the delay bounds are multiplied by up to 2.8 for SCT (resp. up to 23 for RC). Now, we assess the impact of the BLS parameters on the SCT and RC delay bounds. Figures 10 and 11 show these metrics when varying the maximum and resume credit levels, L M and L R , respectively. These results show that the variation of L M (resp. L R ) has a limited impact on the SCT delay bounds with a maximum variation of only 5% (resp. 9%); whereas it has a larger effect on RC delay bounds with a maximum variation of 35% (resp. 28%).
Concerning SCT delay bounds yielded by GCCbA, when varying L M in Fig. 10(a), before L M = 50 000 bits (which represents sending windows allowing the transmission of 200 consecutive SCT frames), they decrease when L M decreases towards L R . In this case, the SCT delay bounds are ruled by the BLS component offering an increasing minimum service rate when L M decreases; thus improving the delay bounds. After, L M = 50 000 bits, the SCT delay bounds are constant when L M increases, since they are ruled by NP-SP component offering a constant service curve when the traffic rate is constant. In Fig. 11(a), when L R increases, the SCT delay bounds decrease. These delays are actually ruled by the BLS component offering a minimum service curve with a decreasing initial latency when L R increases, i.e., L M − L R decreases.
Concerning RC delay bounds, we observe in Fig. 10(b) when varying L M that before L M = 7 000 bits (which represents sending windows allowing the transmission of 24 consecutive SCT frames), the delay bounds decrease and then increase just after this L M level. This is due to the fact that RC delay bounds are ruled by the BLS component offering both an increasing rate and initial latency when L M increases. So before L M = 7 000 bits, the impact of the increasing rate is stronger, resulting in the delay bound decrease; whereas after L M = 7 000 bits, the impact of the initial latency takes over, resulting in a delay bound increase. In Fig. 11(b), the RC delay bounds increase when L R decreases, since they are ruled by the BLS component offering a decreasing service curve when L R increases.
Finally, we focus on the impact of the last BLS parameter, BW , on the SCT and RC delay bounds as illustrated in Fig. 12. These results show that the variation of BW has a high impact on both SCT and RC delay bounds with an increase of 0.60ms (resp. 0.55ms) for SCT (resp. RC), representing an increase of 170% (resp. 137%). In the left graph, when BW is below 40%, the SCT delay bound is constant; whereas it decreases for BW higher than 40%. This is again related to the output port multiplexer behavior, which is ruled by the NP-SP component when BW is below 40% and the BLS component after that threshold. The NP-SP component offers to SCT traffic a constant service when RC rate is constant; thus constant delay bounds. Afterwards, the BLS component is guaranteeing an increasing service curve when BW becomes higher than a given threshold (40%); thus delay bounds decrease. In the right graph, we observe an opposite behavior for the RC delay bounds when varying BW . For BW higher than 55%, RC delay bound is constant; whereas for BW lower than 55%, RC delay bound increases. These results are compliant with the output port multiplexer behavior, which offers a decreasing service to RC traffic when BW increases and a constant service ruled by the NP-SP component after a given BW threshold (55%).
Key Points: The sensitivity analysis of the GCCbA model shows that both L R and L M have limited impact on the SCT delay bound (under 10%), but a large one on RC delay bounds (around 30%). Moreover, the largest impact is due to the SCT and RC utilization rates and BW parameter, with a delay bound increase of up to 137% and 170% for RC and SCT, respectively.

B. TIGHTNESS ANALYSIS
In this section, we assess the tightness of the GCCbA model, in reference with the AWC. As we can observe under the different scenarios, both curves have the same shape, i.e., the delay bound and the AWC increase and decrease similarly. Furthermore, the gap between the computed delay bounds and the AWC is in average less that 15% and up to 30% for the different scenarios.
For instance, as shown in Fig. 8, when varying the SCT utilization rate, the maximum gap between the AWC and the NC delay bounds of SCT is 0.5ms, which represents an increase of 30%. Moreover, when varying the RC utilization rate, we have similar results: the largest percentage increase of the RC delay bounds is 0.5ms and represents 27% in Fig. 9(b). When varying L M , L R and BW , we also have similar results in Fig. 10, Fig. 11 and Fig. 12 for both SCT and RC delay bounds.
Key Points: The tightness of the GCCbA model is high since the gap between the NC model and AWC is in average less than 15%. This is mainly due to the model of the output multiplexer, which takes into account the impact of both BLS and NP-SP components.

C. COMPARISON WITH STATE-OF-THE-ART APPROACHES
In this section, we compare the delay bounds yielded by GCCbA model to the CPA one in [13] and the WbA model in [6], in terms of tightness but also computation times.
In Figures 8, 9, 11 and 12, we observe that generally the SCT and RC delay bounds yielded by GCCbA are tighter than the ones computed with CPA and WbA models, except for the scenario consisting in varying the maximum credit level of BLS, L M , in Fig. 10 where the delay bounds yielded by CPA are smaller than the NC-based models. We will detail these behaviors and give some explanations for the pessimism or optimism of some bounds herein.
First, we focus on the SCT delay bounds computed for the different scenarios with the three models. We can see in Fig. 8(a) that both NC-based models lead to identical SCT delay bounds when L R = 0 and the three models are overlapping for low values of UR SCT . Then, they diverge at UR SCT = 20%. After this threshold, the SCT delay bounds yielded by NC-based models start to follow a linear curve with a lower increase rate than the one with CPA model, which keeps the same rate. As a consequence, the gap between CPA and NC models increases (up to 70%), which shows the increasing pessimism of CPA under high SCT utilisation rates.
The main cause of CPA pessimism is due to overestimating the BLS blocking effect on the BLS class. This is related to the replenishment interval definition in [13] (i.e. maximum blocking time) that is completely independent from the lower priority traffic rates and bursts. However, the BLS is actually a non-blocking shaper: only the state of the queues and their respective priorities matter. As a consequence, when no lower priority traffic is available, the BLS class can be sent no matter the state of the credit. This issue is detailed in the second Appendix.
For instance, in Fig. 8(a), since BW is close to 50%, the idle and send slopes are very close; thus the replenishment and service intervals are very similar under CPA model. So, when the SCT utilization rate becomes visibly larger than the RC one (over UR SCT = 20%), the replenishment intervals are not completely filled by RC traffic: SCT traffic is sent even-though the SCT priority is low. This causes the decreasing SCT delay bounds under the NC models unlike the CPA one. However, in Fig. 10(a), we can see that SCT delay bounds with CPA are sometimes optimistic in reference with the AWC. This issue is detailed in the second Appendix and it is mainly due to considering in CPA that the worst-case corresponds to the scenario where all the traffic classes are backlogged. However, we show through a simple example in the second Appendix that this assumption can lead to optimistic delay bounds since the BLS is a non-blocking shaper.
Concerning both NC-based models, we can see in all figures that the SCT delay bounds with GCCbA are consistently equal or lower than with WbA. In particular in Fig. 11(a), we can see that the impact of L R is better taken into account with GCCbA, where the SCT delay bounds are tighter for L R > 0 than with WbA.
We focus now on the RC delay bounds with the three models. In Fig. 8(b)) and Fig. 9(b) all three analytical models have the same shape. Under NC-based models, this is due to the modeling of the association of BLS and SP components. In the CPA model, this is thanks to solving an ILP problem, which takes into account the maximum available SCT traffic.
It is worth noting that when the service is ruled by the sp component, NC and CPA models have very similar delay bounds; whereas in the part ruled by the bls component, CPA model leads to larger delay bounds. This can be explained by the over-pessimism of maximum replenishment intervals under CPA.  Concerning the computation times, we have computed the time necessary to obtain the delay bounds under each scenario with the different models and the results are in Table 3.
Both NC models have the same complexity since only the rate and initial latency of the BLS curve are different, which does not impact the computation time. With CPA however, the computation is much more complex, since the SCT delay bounds computation necessitates finding a maximum using a while-loop; whereas the RC delay bounds computation necessitates solving a fixed point problem.
We can see clearly in Table 3 that the NC-based models necessitate much less computation time than the CPA model. For instance, the NC models are between 20 000 and 100 000 times faster than the CPA model.
Key Points: The comparative tightness analysis of the existing approaches have highlighted that the delay bounds yielded by GCCbA model are safe in comparison to CPA model (that can lead to optimistic bounds), and are tighter than the ones with WbA model. Furthermore, the NC-based models have lower complexity than the CPA model.

V. AVIONICS CASE STUDIES A. AN AFDX NETWORK WITH 2 BLS CLASSES
We consider the network presented in Fig. 13 where the output port of switches manages 6 classes, as illustrated in Fig. 14.
The output port architecture with 6 classes (2 for each type of traffic) manages two BLS classes: one for the class SCT 2 and one for the class RC 2 . The aim is to give a class for small SCT deadlines: SCT 1 . A second class SCT 2 regroups the rest of the SCT traffic with larger deadlines. Concerning RC, a first class without shaper, denoted RC 1 is used for low RC deadlines, and a second class shaped by a BLS is set for   larger deadlines. Finally, the BE traffic can also be separated in two classes if necessary.
The characteristics of the traffic classes are detailed in Table 4. We set for each BLS class k the priority p L (k) higher than the BE priority. Additionally, we kept the order between the high and low priorities: SCT 2 low priority (i.e. 4) is higher than RC 2 low priority (i.e. 5).
Each ES generates n es k flows (k the class of the flow). So the bottleneck utilization rate for a class k in the network presented in Fig. 13 is UR bn k = 16 · n es k · MFS k BAG k . Our aim is to conduct a timing analysis using GCCbA model of this network when varying the traffic rates (through varying n es k ) and BLS parameters. The different scenarios considered herein are described in Table 5. It is worth noting that for a class k the BLS parameters are identical in all output ports. Based on the sensitivity analysis results in Section IV, we set L k R = max j∈MC(k) MFS j · BW k and a low value for L k M as L k M = 5 · MFS k . Moreover, since BW k is the BLS parameter that influences most the delay bounds, we will vary this parameter from 0.1 to 0.9 in the 3 scenarios.
As BE traffic does not have timing constraint and only impacts the other flow by a single maximum-sized frame transmission, we focus only on SCT and RC traffic. As SCT 1 traffic is not impacted by the variations of other class traffic, the SCT 1 delay bound is constant for all scenarios and equal to 2.45 · 10 −4 s, well below its 1ms deadline. Therefore, only the delay bounds yielded by GCCbA of SCT 2 , RC 1 and RC 2 classes are illustrated in Figures 15, 16 and 17 under the three scenarios described in Table 5, respectively. In particular, we will discuss the gains in terms of delay bounds when using this extended AFDX (incorporating BLS and denoted BLS in figures) instead of the current AFDX (implementing only NP-SP scheduler and denoted SP in figures).
Impact of the Variation of SCT 2 Traffic: In this first scenario, we vary SCT 2 traffic and the reserved bandwidth of SCT 2 , and RC 2 , denoted BW SCT 2 and BW RC 2 , respectively. The results are presented in Fig. 15. As the variation of BW RC 2 does not impact the delay bounds of SCT 2 and RC 1 traffic, we present in Fig. 15(a)(b) the impact of the variation of BW SCT 2 on SCT 2 and RC 1 . In Fig. 15(c)(d) we present the impact of the variations of BW SCT 2 and BW RC 2 on RC 2 .
First in Fig. 15(a), as expected the BLS increases the delay bounds of the SCT 2 traffic compared to SP. This increase is minimal for high values of BW SCT 2 , i.e., when the behavior is close to the SP behavior; and maximal for low values of BW SCT 2 , i.e., when the BLS is most effective.
Secondly in Fig. 15(b), we find again a BLS behavior similar to Section IV: the BLS limits the RC 1   BW SCT 2 . As a result, the gain in terms of RC 1 delay bound, decreases when BW SCT 2 increases, compared to SP. For example, at UR SCT 2 = 25% the RC 1 delay bound is divided by 2.4 (resp. 5.25) for BW SCT 2 = 0.5 (resp. BW SCT 2 = 0.1).
Thirdly, when varying BW SCT 2 in Fig. 15(c), the behavior of the RC 2 delay bound is similar to RC 1 delay bound, i.e., after a certain point, the RC 2 delay bound is limited by the BLS component. Hence, the impact of the increase of UR SCT 2 is mitigated by the BLS, in comparison to SP. The RC 2 delay bounds can be decreased by up to 33%.
Fourthly, when varying BW RC 2 in Fig. 15(d), the impact of higher priorities on RC 2 is again mitigated by the extended AFDX (BLS). For low values of BW RC 2 , the behavior is ruled by NP-SP component and so the RC 2 delay bounds under BLS are close to those under the current AFDX (SP). For higher values of BW RC 2 and UR SCT 2 > 18%, the RC 2 delay bound increases are mitigated due to BLS component with a RC 2 delay bound decrease up to 50% under extended AFDX (BLS), in comparison with the current AFDX (SP).
Key Points: These results show the impact of the extended AFDX (BLS) when SCT 2 varies: with good parameters, the delay bounds of lower priorities can be divided by up to 5.4 times for RC 1 , and up to 2 for RC 2 compared to current AFDX (SP).
Impact of the Variation of RC 1 Traffic: In this second scenario, we vary RC 1 traffic and the reserved bandwidth of RC 2 , denoted BW RC 2 . The results are presented in Fig. 16. As we have extensively studied the impact of variation of BW SCT 2 , we will not vary BW SCT 2 here. Also, as the variation of BW RC 2 does not impact the delay bounds of SCT 2 and RC 1 traffic, we present in Fig. 16(a) and (b) the impact of the variation of RC 1 utilization rate on SCT 2 and RC 1 delays for any BW RC 2 . In Fig. 16(c) we present the impact of the variations of RC 1 utilization rate and BW RC 2 on RC 2 delays. In this scenario, we set BW SCT 2 = 0.58 so that SCT 2 delay bound is just below its 4ms deadline in Fig. 16(a).
In Fig. 16(b), the RC 1 delay bound is largely decreased by the extended AFDX (BLS). At the current utilization rate of the AFDX, i.e., UR RC 1 = 3%, the RC 1 delay bound under the extended AFDX (BLS) is divided by 2.7, in comparison to the current AFDX (SP).
In Fig. 16(c), the impact of the extended AFDX (BLS) on the RC 2 delay bounds is less visible. At the current utilization rate of the AFDX, i.e., UR RC 1 = 3%, the RC 2 delay bound under the extended AFDX (BLS) is decreased up to 17%, compared to the bounds under SP. The maximum decrease of the RC 2 delay bound under extended AFDX (BLS) is 20% at UR RC 1 = 1%, in comparison to the current AFDX (SP).
Key Points: These results show the impact of the extended AFDX (BLS) when RC 1 varies: the delay bounds of lower priorities can be divided by 2.7 for RC 1 and decreased by up to 20% for RC 2 , compared to the current AFDX (SP).
Impact of the Variation of RC 2 Traffic: In this third scenario, we vary RC 2 traffic and the reserved bandwidth of RC 2 , denoted BW RC 2 . The results are presented in Fig. 17. As the variation of BW RC 2 does not impact the delay bounds of SCT 2 and RC 1 traffic, we present in Fig. 17(a) and (b) the impact of the variation of RC 2 on SCT 2 and RC 1 for any BW RC 2 . In Fig. 17(c) we present the impact of the variations of BW RC 2 on RC 2 . In this scenario, as before we set BW SCT 2 = 0.58 so that SCT 2 delay bound is just below its 4ms deadline.
In Fig. 17(b), the RC 1 delay bound is much decreased under the extended AFDX compared to under the current AFDX (SP), i.e., it is divided by 2.1.
In Fig. 17(c), the RC 2 delay bound is positively impacted by the extended AFDX, with a maximum decreased of the RC 2 delay bounds of 22%. For example, at the current utilization rate of the AFDX, i.e., UR RC 2 = 3%, the RC 2 delay bound under the extended AFDX (BLS) is decreased by 16%, in comparison to the current AFDX (SP). Key Points: These results confirm the positive impact of the extended AFDX (BLS) when RC 2 varies, i.e., the RC 1 delay bounds is divided by 2.1 and the RC 2 is decreased up to 22% compared to the current AFDX (SP).

B. ADDING FLIGHT CONTROL TO THE AFDX NETWORK FOR A350
The AFDX fulfills the highest avionics requirements and can be used for Safety Critical traffic, such as flight Control traffic. However, the main concern is the way the Flight Control devices can be connected to the AFDX to guarantee the avionics requirements, particularly the safety rule stating that a single failure must not cause the loss of a function. After a reverse-engineering process of the current A350 flight control architecture, we have proposed a new architecture connecting the flight control calculators and actuators based on the extended AFDX incorporating BLS shapers with 3 priorities, as illustrated in Fig. 1.
First, to connect the calculators, we use 2 switches (SS1 and SS2), so that we do not lose a full network due to one switch loss. To obtain similar timing results for all actuators, we use the remaining 5 switches (L1, L2, C, R1, R2) to connect the actuators, taking into account the energy supplier network, the type of actuator to fulfill the safety rule, and trying to homogenize the number of connections on each switch. The result is visible in Fig. 18. We obtain a diamond-like structure with central switches (L1, L2, C, R1, R2) connected to 6 or 7 actuators.
In this architecture, the BLS is incorporated within the output ports from SS1/SS2 to the central switches, from the central switches to SS1/SS2, and from SS1/SS2 to the calculators. However, for the output port linking the central switches to the actuators, the BLS is not useful since the flight control traffic is the only type of traffic in these output ports.
In this section, we will consider different scenarios to assess the performance of the extended AFDX solution in terms of delay bounds. The SCT traffic consists of Flight Control frames and the considered scenarios are described in Table 6. VOLUME 8, 2020  The computed SCT and RC delay bounds under the different scenarios for the extended and current AFDX are detailed in Table 7. We consider first the end-to-end SCT delay bounds between a calculator and an end-system, denoted delay e2e,m SCT for either the extended AFDX (m = BLS) or the current AFDX (m = SP). The goal is to verify that the end-toend SCT deadline is fulfilled. Secondly, we compute the RC delay bounds in the switches SS1 and SS2 under BLS. We denote delay SW 1,m RC , the delay bound of the RC traffic in the first switch in the considered path, with SW 1 being SS1 or SS2 depending on the considered flow and m ∈ {BLS, SP}. It is worth noting that due to the symmetry of the network the delay bound in SS1 is identical to the one in SS2.
From the results in Table 7, we can see that for very diverse configurations, SCT delay bounds still fulfill the deadlines. Additionally, the RC delay bounds with the extended AFDX is always lower than the ones with the current AFDX, with up to 49.9% of improvement in SW1. This confirms the efficiency of our proposal to handle mixed-criticality traffic for a realistic avionics case study.

VI. CONCLUSIONS
In this paper, we proposed a worst-case timing analysis approach based on Network Calculus, called GCCbA, of extended AFDX networks incorporating several TSN/BLS shapers.
This approach have been evaluated on several aspects: (i) we studied the sensitivity of the model to traffic and BLS parameters. We found that the traffic utilization rates and the BW parameter of BLS have the largest impact on the delay bounds yielded by GCCbA, with a delay bound increase of up to 137% and 170% for RC and SCT, respectively; (ii) we evaluated the tightness of the model with reference to AWC and achieved a ratio up to 85%; (iii) we compared our approach with state-of-the-art approaches and we showed improvements in terms of tightness and complexity, e.g., a computation time up to 10 5 faster than CPA; (iv) we highlighted the applicability of our approach for realistic avionics use cases. Results showed that the extended AFDX decreases the delay bounds of the existing AFDX traffic compared to a standard AFDX (up to 49.9%); thus mitigating the impact of the added traffic on existing one.

APPENDIX GENERALIZED CONTINUOUS-CREDIT-BASED APPROACH (GCCbA) MODEL PROOFS
In this section, we detail the proofs of the strict minimum and maximum service curves. Both proofs are based on three lemmas presented in the next section.

A. CONTINUOUS-CREDIT LEMMAS
We denote R * k (t) the output cumulative function of the class k traffic, and R * k (δ) its variation during an interval δ. The BLS credit tries to keep an accurate accounting of the traffic sent. There are two situations when it loses track due to non-preemptive transmissions: 1) when the credit reaches L k M and the current class k frame has not finished its transmission; 2) when the credit reaches 0 and the current frame is still being transmitted.
We call this the saturation of the credit, either at L k M by class k traffic, or at 0 by other traffics. The saturation at L k M can only occur when a class k frame is being transmitted, while the saturation at 0 can not occur when a class k frame is being transmitted.
Hence, we call R * L k M ,sat (δ) (resp. R * 0,sat (δ)) the part of R * k (δ) (resp. δ · C − R * k (δ)), that can be sent during any interval δ while the credit is saturated at L k M (resp. at 0). We present here three lemmas linked to the credit saturation and necessary to the service curve proofs. First in Lemma 8, we show how to bound the sum of the credit consumed and the credit gained, depending on the credit saturations. Then, we detail the bounds of the credit saturations at L k M in Lemma 9, and at 0 in Lemma 10.

Lemma 8 (Continuous Credit Bounds):
We consider a shaped class k, with a maximum credit level L k M . ∀δ, computing the sum of the credit consumed and gained give the following inequations: In an interval δ, the accurate consumed credit is the time it takes to send the non-saturating traffic C multiplied by the sending slope: And conversely, the accurate gained credit is the remaining , multiplied by the signed idle slope: Thus ∀δ ∈ R + , using the fact that I k send + I k idle = C, the sum of the gained credit and the consumed credit is: We know that the credit is a continuous function with a lower bound: 0 and an upper bound L k M . So the sum of credit consumed and gained is always bounded by −L k M and +L k M .
Lemma 9 (Credit Saturation at 0): We consider a shaped class k, with the aggregate traffic of priority strictly higher ∀δ, the amount of traffic sent while the traffic is saturated at 0 is such as: Proof: First, we know that R * 0,sat (δ) 0. Secondly, we consider the impact of MC(k) and HC(k), the impact of LC(k) being taken into account in β sp k (t) to compute an upper bound.
Impact of MC(k) on R * 0,sat (δ): In the presence of class k frames, the saturation of the credit at 0 can occur if an additional frame is sent while the credit is decreasing and about to reach L k R . Due to non-preemption, the frame finishes its transmission even though the class k priority is now higher.
To be able to compute the largest impact of the non-preemption of MC(k) frames on class k traffic, we must find the highest number of non-preempted frames that can be sent during a time interval δ. Then, we must compute the part of the non-preempted frame sent while the credit is saturated.
So first, we must compute the smallest duration between two occurrences of the phenomenon. Fig. 19 illustrates the following explanation.
After the first non-preempted MC(k) frame has been sent, the priority of the class k queue is high. So, in presence of class k traffic, no MC(k) traffic can be sent until a priority change: L k M must be reached between two non-preempted MC(k) frames.
Thus, we study the intervals of time between the start of two transmissions of non-preempted MC(k) frames starting their transmission just before L k R is reached. The smallest duration of such an interval is equal to the sum of 1) the transmission time of the non-preempted MC(k) frame, such as at the end of the transmission the credit reaches L k,min because class-k traffic has to be sent continuously in order for the credit to reach L k M in the minimum duration; 3) finally because MC(k) traffic has to be sent continuously in order for the credit to return in the minimum duration to L k R . In total, the minimum duration between the start of the transmission of two non-preempted MC(k) frames (each starting just before L k R is reached), is Thus during δ, the number of time a non-preempted MC(k) frame can be sent is upper bounded by δ k,β inter . Secondly, we need to compute the maximum amount data sent while the credit remains at 0 during the transmission of one non-preempted maximum-sized MC(k) frame as illustrated in Fig. 19. This is equal to the maximum size of a MC(k) frame, minus the amount of data transmitted while the credit decreases from L k R to 0: Impact of HC(k) on R * 0,sat (δ): The second way credit can saturate at 0 happens if traffic from HC(k) is sent while the credit remains at 0. We denoted α h (t) the aggregate traffic of HC(k), arriving at a rate of r h , with a burst b h , such as As a result, the amount of MC(k) and HC(k) traffic sent while the credit is saturated is such as: ∀δ, the amount of traffic sent while the traffic is saturated at L k M is such as: Proof: First, we know that R * L k M ,sat (δ) 0. Secondly for the upper bound, in the presence of MC(k) frames, the saturation of the credit at L k M can only occur if an additional frame is sent while the credit is increasing and about to reach L k M . Due to non-preemption, the frame finishes its transmission even though the class k priority is now lower.
To be able to compute the largest impact of the non-preemption of class k frames, we must find the highest number of non-preempted frames that can be sent during a time interval δ. So we must compute the smallest duration between two occurrences of the phenomenon. Fig. 20 illustrates the following explanation. After the first non-preempted class-k frame has been sent, the priority of the class k queue is low, so in presence of MC(k) traffic, no class k traffic can be sent until a priority change: L k R must be reached between two non-preempted class-k frames. Thus, we study the intervals of time between the start of two transmissions of non-preempted class-k frames starting their transmission just before L k M is reached. The smallest duration of such an interval is equal to the sum of: 1) the transmission time of the non-preempted class-k frame (at the end of the transmission the credit is equal to L k M ); 2) the duration because MC(k) traffic has to be sent continuously in order for the credit to reach L k R in the minimum duration; 3) finally because class k traffic has to be sent continuously in order for the credit to return in the minimum duration to L k M . In total, the minimum duration between the start of the transmission of two non-preempted class-k frames (each starting just before L k M is reached), is Thus during δ, the number of time a non-preempted class-k frame can be sent is upper bounded by As a result, the amount class k traffic sent while the credit is saturated is such as: We search a strict minimum service curve offered to a class k defined by a Rate-Latency curve, i.e., β bls k (t) = ρ · (t − τ ) + with rate ρ and initial latency τ .
The impact of other classes, are separated into three parts: the impact of LC(k), MC(k), HC(k).
According to the definition of the strict minimum service curve, ∀ backlogged period δ: For any duration lower than τ , the variation of the output is lower bounded by 0.
Thus, the best τ for our strict service curve is the largest duration during which no class k traffic can be sent. So, when considering the impacts of the different classes we have: 1) for traffic of Lower Classes LC(k), the impact is the one computed with Static Priority: it is due to the non-preemption and is taken into account in the Static Priority model; 2) for traffic of Medium Classes MC(k): the worst-case occurs if the credit starts at L k M , MC(k) frames are transmitted until L k R is reached and due to non-preemption an additional MC(f) frame is sent. We denote this duration k,β idle . So, we have: 3) for Higher Classes HC(k), the impact is already computed with Static Priority and is not taken into account here. So finally, we have: Concerning the ρ, we search for a strictly positive rate. We use the definition of β bls k as a Rate-Latency strict service curve and (4) to deduce a property of ρ. We notice the limit toward infinity of R * k (δ) over δ will be greater than ρ: So we look for a x > 0 fulfilling the following condition: We now use the continuity property of the BLS credit to determine x. From Lemma 8, we know that: To find x, we must find a lower bound of lim δ , so we have: We need the lower bound of R * L k M ,sat (δ), and the upper bound of R * 0,sat (δ). We use Lemmas 9 and 10 to compute the bounds. This gives: Thus, from (5), (6), and (7), we deduce: Finally, we have found a suitable ρ such as: lim

C. TH. 5: GCCbA MAXIMUM SERVICE CURVE
We search a maximum service curve offered to a class k defined by a leaky-bucket curve, i.e., γ bls k (t) = r · t + b with rate r and burst b.
From [9], we know that R * k (t − s) B(s) + γ (t − s), with B(s) the backlog at s. We search for z such as R * k (t − s) z. As B(s) 0, we obtain: Hence, with δ = t − s, we select γ (δ) = z, which gives: In the absence of other traffic, class k can use the full capacity of the link, so R * k (δ) C · t. Thus, we deduce that: In a MC(k) backlogged period, we use the definition of γ bls k as a leaky-bucket maximum service curve to deduce a property of r using (8).
Computing r: We notice the limit toward infinity of R * k over δ will be lower than r: So we search for a strictly positive rate x, equal or lower than the link output rate C fulfilling the following condition: We use the continuity property of the BLS credit to determine x. From Lemma 8, we know that: To find x, we must find a lower bound of lim δ→+∞ R * k (δ) δ , so we have: We need the lower bound of R * 0,sat (δ), and the upper bound of R * L k M ,sat (δ). We use Lemmas 9 and 10 to compute the bounds. This gives: · C Now that we have found r, we need to find b such as ∀ MC(k) backlogged period δ: Computing b: We use the largest class k burst that can be sent with the BLS.
In the presence of MC(k) traffic, the largest period of time during which class k traffic can be sent continuously occurs if the credit started at 0. Then, class k traffic is sent continuously until L k M is reached and the priority is changed to its low value p L . If a new class k frame started its transmission just before the credit reached L k M due to non-preemption, it will finish its transmission before the waiting MC(k) traffic can be sent. Thus, with a link capacity C the largest class k burst is b max k = C I k send · L k M + MFS k . This gives: .

APPENDIX CPA MODEL ANALYSIS
The CPA model [13] computes the impact of the other flows by dividing them in four categories: the lower-priority blocking, the same-priority blocking, the higher priority blocking, and the BLS shaper blocking. We have identified three main limitations in the CPA model, which may lead to over-pessimistic delay bounds, or worse, optimistic delay bounds, when considering the definition of the BLS proposed in [7]. The first limitation causes pessimism and concerns the maximum replenishment interval t R+ I . The additional frame transmission max j∈lp(I )

MFS j C
considers all the priorities lower than I . This computation means two implicit assumptions, which are not necessarily fulfilled in the general case. The first implicit hypothesis is to consider that the priority for I is the BLS high priority. The second implicit hypothesis is the fact that the low BLS priority is the lowest one. The delay caused by max j∈lp(I )

MFS j C
is due to the transmission of a frame while the BLS priority is low, just before the credit reaches the resume level. But only classes with a priority higher than the low BLS priority can be transmitted while BLS frames are enqueued, thanks to the Static Priority Scheduler. Thus, CPA model considers that all the flows are in lp(I ) and the BLS low priority is the lowest one. This may not be the case, especially when multiple BLS are considered. As a consequence, the shaper blocking effect may be overestimated, depending on the maximum frame sizes. The second limitation also causes pessimism and concerns again the replenishment interval t R+ I . The definition of t R+ I is completely independent from the lower priority traffic rates and bursts. As a consequence, if the replenishment intervals are too large in comparison to the traffic load, the shaper blocking is again overestimated: when no lower priority traffic is available, the BLS flows can be sent no matter the state of the credit. Contrary to the hypothesis set in [13], the BLS [7] is actually a non-blocking shaper: only the state of the queues and their respective priorities matter. Finally, the third limitation is due to the blocking shaper hypothesis as a whole, stating that BLS frames cannot be sent after their associated credit has reached L M , until the credit has decreased to L R . We will show now that this can lead to optimistic bounds when considering the definition of the BLS from [7].
To assess the CPA model optimism, we consider herein a 3-classes case study, where the SCT class is shaped by a BLS with the priorities switching between 0 and 2, RC has the priority 1 and BE the priority 3 (as illustrated in Fig. 1) To compute the worst-case delay, a usual assumption is to consider all the traffic classes are backlogged. In the case of the BLS however, we show that this may lead to optimistic bounds.
To compute the worst-case delay, we first detail the case where all classes are backlogged. The resulting credit evolution and the SCT output traffic are visible in Fig. 21 in plain line (1). We can see that this is equivalent to the hypothesis in [13] stating that the BLS blocks the BLS-frames while the credit is decreasing between L M and L R .
Then, we consider the case where RC traffic is not backlogged between two times t0 and t1 (dotted lines (2) in Fig. 21): • the credit starts at L M at ti and decreases until it reaches L M 2 at t0; • then it increases until t1 when the credit reaches L M ; • finally it decreases until reaching L R at t2. We see in Fig. 21 that in this particular case, the SCT output corresponding to the dotted line (2) can be below the one corresponding to the plain line (1). This shows that the most intuitive worst-case SCT output, i.e., all traffic are backlogged, is not actually the worst-case SCT output. As a consequence, the shaper blocking hypothesis of the CPA model causes optimism when considering the BLS as defined in [7].