From aerospace to energy: The formative years of TTEthernet

Safety-critical systems in sectors such as automotive, industrial automation, and aerospace, defense, or critical infrastructure share common challenges in terms of safety, security, and reliability. In the early 2000s, the aviation industry began talking about the “ten to the power of minus 9 (10^-9) challenge”. 10^-9 stands for the probability of a catastrophic failure, which must not occur more than once in one billion flight hours, as per civil aviation standards. With the onset of increasingly software-driven aircraft systems like fly-by-wire and integrated modular avionics, more subsystems were introduced on aircraft, which increased the probability of faults and malfunctions. The market demand was to increase the reliability and security of critical systems while integrating more functionality into fewer computing cabinets, and not to increase system complexity. An additional requirement was the introduction of Ethernet to aviation through AFDX^® (Avionics Full‑Duplex Switched Ethernet), trademarked by Airbus and standardized in ARINC 664 part 7 by 2005.

One answer was found in a Time-Triggered Architecture approach, using Ethernet-based switches in the data network. There was research at the Technical University of Vienna on how to apply time-triggered communication to Ethernet and allow data of different criticality levels (e.g., safety-critical command and control data vs. non-critical video streams) to use the same network infrastructure. With this type of network, the number of computers and amount of cabling could be reduced, while still ensuring the highest reliability and fail-safe operation, with guaranteed message delivery based on an agreed time schedule. Another problem that can be solved with this type of architecture is non-silent faults, which relate to a component sending incorrect messages at times, and the rest of the system having to determine whether the message is correct or not. As the component does not simply stop/shut down, the system needs to determine how to deal with the information received and ensure high-integrity and proper functioning.

In this article, we are taking a closer look at TTEthernet^®, a commercial implementation of Deterministic Ethernet that incorporates this Time-Triggered approach and solves the challenges described above. We describe how it was developed, what its main features are, how it is being implemented by customers worldwide, and what kind of future applications are possible.

Deterministic Ethernet – the reliable core

Deterministic Ethernet is a networked communication technology that enhances standard IEEE 802.3 Ethernet to allow for reliable real-time communication. It uses bandwidth allocation/traffic “policing” and time scheduling to ensure bounded latency of critical communication with minimal jitter, while allowing non-critical traffic transmission on the same network. Having one network means reduced system complexity, which simplifies implementation and maintenance, especially when redundant systems are required.

Deterministic Ethernet is used in a wide range of applications – from automated driving to machine-to-machine communication, and aerospace flight controls - where guaranteed latency is needed either for reasons of operational efficiency or functional safety.

Find out more about
Deterministic Ethernet

TTEthernet – origins in academic research, further developed with NASA

TTEthernet implements the Time-Triggered Architecture developed at the Technical University of Vienna by Professor Hermann Kopetz, which was also the starting point for TTTECH. Following the footsteps of the Time-Triggered Protocol (TTP), TTEthernet was born out of successful European R&D projects in the early 2000s which were soon followed by the co-development of the first products with industrial partners in several domains.

In 2009, TTTECH signed a Space Act Agreement with NASA to co-develop an open Ethernet-based standard for highly dependable embedded systems and to enable mixed-criticality data communication on a single network, resulting in the creation of the Time-Triggered Ethernet standard (SAE AS6802) for Ethernet networks which “synchronize themselves” without an external master clock.

In the global space sector, SAE AS6802 is both referenced in the ECSS-E-ST-50-16C Time-Triggered Ethernet engineering standard and in the International Avionics Systems Interoperability Standards (IASIS) in which NASA and its international space agency partners designate TTEthernet as technology base for international deep space missions. These standards ensure interoperability across international space programs and simplify deployment of Deterministic Ethernet in spacecraft.

The makeup of TTEthernet and its benefits for safety-critical applications

TTEthernet enables three traffic classes to use the same physical medium for data transmission – Time-Triggered Ethernet traffic acc. to SAE AS6802, rate-constrained traffic acc. to ARINC 664 part 7, and best-effort acc. to IEEE 802.3:

Based on Ethernet: Ethernet is a standard communication technology (according to the open standard IEEE 802.3) for local area networks (LAN), which is used universally and is easy to implement.
Determinism added: Synchronization for time-scheduled messaging within a defined network and bandwidth allocation for asynchronous traffic. This ensures that different types of messages, from critical control data to standardized LAN messages or multimedia streams, can be transferred safely and without mutual interference on the same network. The time-scheduling part of TTEthernet is based on the open technology standard SAE AS6802 (Time-Triggered Ethernet) that focuses on mechanisms to achieve network-wide time synchronization. The definition of virtual links and their bandwidth limitations follow the open ARINC 664 part 7 standard used in the aviation industry.

These two ingredients enable the setup of mixed-criticality networks where non-critical and critical data can be transferred reliably and timely to ensure:

Reliable data transfer: Scheduled messages cannot get delayed or lost, independent of the network utilization. Thanks to the virtual separation of data traffic classes (partitioning) denial of service attacks can be prevented to also ensure secure transmission.
High-performance networks: Today’s machines and systems need to be able to gather and process a lot more data; time scheduling helps to reach bandwidth utilization of over 90%.
Scalability and interoperability: TTEthernet enables the scaling of systems without compromising safety, security, or performance.
Certifiability for highest functional safety: TTEthernet is based on open standards and certifiable for fail-operational safety systems with its built-in redundancy and fault-tolerance measures. Most of these measures also support network security.
Reduced complexity and weight: The use of a single bi-directional network for different types of data simplifies system design and wiring. Fewer wires mean less weight.

Learn how NASA and TTTECH collaborated to standardize Time‑Triggered Ethernet:
Time-Triggered Ethernet slims down critical data systems

TTEthernet – successful implementations across industries

The following examples show how TTEthernet has been implemented over the past two decades in safety- and mission-critical applications. The experience gained in these projects has allowed TTTECH to create a diverse range of TTEthernet-based products and solutions, compliant with international standards. TTTECH also collaborates with the industry ecosystem and standardization bodies on the further development and future-proofing of these standards.

Energy sector

Distributed control system for wind turbines

Among the first customers to use a TTEthernet implementation was Vestas, one of the largest manufacturers of wind turbines worldwide.

Vestas approached TTTECH about 15 years ago, when they were developing a new internal control system for their wind turbines. The control systems for different wind turbine models used at the time varied widely, requiring significant architecture redesigns for each new turbine model. The safety and non-safety functions were also physically separated to avoid interference and ensure safe operation. However, they also required a lot of external wiring between sensors, actuators and controllers, thus complicating maintenance and service. The goal was to have more flexible control systems with a consolidated, modular design.

TTTECH brought deep expertise in functional safety and technical knowledge in safety-critical systems to the table, which was required to design a new distributed control system (DCS) for the wind turbines that would fulfill all relevant safety requirements and could be reused in multiple turbine models.

The DCS ensures safe and reliable data connectivity within the wind turbine, acting like a nervous system: the central computer (the brain) sends information to individual systems in the wind turbine (e.g., the rotor blades). This information is received and processed simultaneously in multiple local control systems, and actions are derived (e.g., aligning the rotor blades according to the wind’s direction). It uses TTEthernet, a commercial implementation of Deterministic Ethernet, as a backbone.

This enables highly reliable transmission of safety-critical data and non-safety critical data from multiple controllers via a single network cable, reducing wiring and system complexity, and making the DCS easier to maintain and service. It is also possible to extend the system by adding more controllers, as more data can be shared on one network, making optimum use of available bandwidth.

Since 2016, the DCS has been integrated and deployed in the field in more than 18,000 Vestas wind turbines, with thousands of wind turbines being added each year. The first integration was in a 4 MW wind turbine, but by now the DCS has been rolled out and scaled for a wide range of variants, including the 15MW offshore turbine V236-15.0 MW^™.

A key building block of DCS’ digital backbone is the TTEthernet switch module core which was designed by TTTECH for mission-critical networks in the energy and aviation markets. It is used at the core of Ethernet-based networks to ensure timely and accurate transmission of data at high data transfer rates and meets criteria for certification according to stringent standards for design assurance. TTEthernet addresses cross-industry market needs in terms of bandwidth, redundancy, and fault-tolerance. It offers two or three independent channels, microsecond precision (fixed latency/minimal jitter), and enables mixed-criticality networks where safety and non-safety data share the same physical medium. One of the main benefits of TTEthernet networks are lifecycle savings – once these networks have been set up, they run like a perfect clockwork in the background and allow smooth upgrades with limited incremental qualification efforts – e.g. a turbine with a newer power generator or an improved rotor, with additional networked nodes or different bandwidth needs for a subset of the nodes in the network can be developed and qualified at reduced cost.

Read more about the collaboration with Vestas:
Case study
Press release

Commercial off-the-shelf switching solutions for nuclear power plants

A new application for TTEthernet switches is with Worldgrid, an ALTEN company, collaborating on an operational control system for future nuclear power plants to be qualified at safety class 2 (per IEC 61513).

TTTECH’s track record in safety-certification and the company’s cross-industry expertise were among the selection criteria for this application in critical infrastructure.

Aerospace

In aerospace, TTEthernet has found applications in a range of applications, from avionics systems in aircraft, rotorcraft, and advanced air mobility (AAM), to spacecraft and transportation vehicles, as well as space station data networks. Some of the major international programs using the technology:

New European launcher Ariane 6

TTTECH Aerospace had already been working with NASA and Honeywell on the Orion program, where TTEthernet is being used. In 2013, TTTECH Aerospace joined the European Space Agency’s (ESA) Future Launchers Preparatory Programme (FLPP) as subcontractor to the company that later became Airbus Defence and Space. This led to the development of a radiation-hardened TTEthernet controller chip and associated software that was qualified for use in space together with ArianeGroup which had selected TTEthernet as data backbone for the Ariane 6.

Base requirements in the development of Ariane 6 were modular avionics and higher data throughput than in Ariane 5: a new data network with ten times more bandwidth, and at least the same reliability as the robust but outdated MIL-1553 buses previously used. TTEthernet fulfilled those requirements with competitive recurring cost per vehicle and significant savings over the product lifecycle of the launcher driven by reduced software complexity and software qualification and maintenance efforts.

TTTECH Aerospace supplies highly reliable TTEthernet-Controller ASICs and software that connect more than 50 avionic units that handle computing, power distribution, and thrust-vector actuation. These commercial off-the-shelf (COTS) components allow for deterministic, high-speed data transfer of critical (e.g., guidance, navigation, and control) and non-critical (e.g., monitoring or video) data on a single, TTEthernet network with redundant paths for high-availability networking, the launcher’s nervous system.

The launcher’s TTEthernet network is scalable and allows for simpler integration and operation. The first new application to be added to the network will be the modified on-board camera system provided by Réaltra Space Systems Engineering.

In addition, Réaltra and TTTECH Aerospace have jointly developed a modular TTEthernet switch for use in space transportation and orbital infrastructure. This “TTE-Switch MYTHOS” is a box-level offering that can be easily integrated into the avionic system. It only needs power and standard Ethernet connections and enables the integration of payloads with an Ethernet interface or mission-critical units with a TTEthernet interface like inertial measurement units.

Read how TTTECH Aerospace supported the development of
Ariane 6 avionics backbone

NASA Artemis – from the Lunar Gateway to NASA Orion and beyond

NASA’s Artemis program is an international endeavor to bring humanity back to the Moon. NASA and its international space agency partners from Europe (ESA), Canada (CSA), Japan (JAXA), and the United Arab Emirates, as well as private companies are developing and building modules of the Lunar Gateway space station and collaborating on the NASA Orion capsule that will transport the astronauts to the Gateway.

TTEthernet is the data network of choice in all these rather complex systems of systems. Modularity, scalability, and dual fault-tolerance were the main drivers for the use of TTEthernet as avionics backbone. The use of TTEthernet throughout the program allows for the seamless integration of new elements and modules, thus ensuring that systems can grow and adapt as requirements change over the course of their lifetime.

The Lunar Gateway consists of a range of modules that fit together to form a waystation and laboratory base for the exploration of the Moon. TTTECH Aerospace currently supplies networking and computing platforms for the data network for all Lunar Gateway modules together with Beyond Gravity Austria - among them the Habitation and Logistics Module (HALO) and the Power and Propulsion Element (PPE), as well as the Lunar International Habitation Module (Lunar I-Hab) and the refueling module Lunar View, in addition to the Canadarm 3.

NASA Orion was among TTTECH Aerospace’s first space programs, in collaboration with Honeywell, Lockheed Martin, and NASA. TTTECH Aerospace supplies TTEthernet Switch and End System products that form the core of this spacecraft’s avionics network. The TTEthernet network enables the integration of safety-critical and non-critical data on a single, Deterministic Ethernet network to optimize space, weight, and power usage. NASA Orion has flown successfully in 2014 and 2022, and the first crewed flight around the Moon will take place very soon.

Learn more on our reference pages:
Gateway space station
NASA Orion spacecraft

Aviation

Another field of application for mixed-criticality networks based on Ethernet and TTEthernet technology lies in the aviation sector. Here, the focus is on safety-critical applications in a highly regulated field. Standards compliance and certification are key for all systems, including those being developed for the Advanced Air Mobility (AAM) sector.

Honeywell Aerospace is a long-time customer of TTTECH. Honeywell is using TTEthernet-based products in two of its recent programs:

Honeywell Anthem^™ is a modular, integrated flight deck that can scale across a range of aircraft types and sizes - from passenger planes and business aircraft to defense, general aviation, and AAM vehicles. TTTECH Aerospace supplies high-performance TTEthernet switches, end systems, embedded software, as well as tooling and development equipment to enable reliable data transfers in the avionics backbone that connects all functions on the flight deck.
Honeywell’s next generation Flight Management System (nFMS) for commercial aircraft platforms will use TTTECH Aerospace’s TTEthernet End System solutions for data transfer according to IEEE 802.3, ARINC 664 part 7, and SAE AS6802. This provides enhanced connectivity with these networking standards and supports the scalability of Honeywell’s nFMS for current and future aircraft programs.

Automotive

A use case for TTEthernet in the automotive industry is in the central platform control unit “zFAS” developed together with Audi from 2013 until 2017.

This electronic control unit (ECU) can incorporate more than 30 different driver assistance functions. It includes several multicore processors for automated driving, communicating over its on-board real-time capable TTEthernet network, which serves as the reliable backbone for mixed-criticality data communication.

TTTECH provided all building blocks for an FPGA-based System-on-Chip that integrates a 5-port Deterministic Ethernet switch that connects the processing units of different vendors and ensures reliable real-time transfer of data for sensor fusion.

Where do we go from here – the future of TTEthernet in cross-industry applications

TTEthernet is used across different industries which share these characteristics:

Local data networks (scalable, but not completely open – as there is an upper limit for the number of connected nodes)
System integrators control data scheduling on the network and gain composability which leads to simplified integration, verification and testing
High reliability and fault-tolerance of the data network are key in reaching rapid system safety qualification (certification)

In the past twenty years, TTEthernet has been successfully applied in several domains and is now a mature technology with qualified off-the-shelf components, equipment, and development tools from a number of vendors.

Its use in programs like Vestas’ distributed control system (DCS), Ariane 6, or the Lunar Gateway means that key TTEthernet products, know-how and technical support will be available for at least another 25 years.

The related, but newer family of TSN standards is fully supported by TTTECH, and TSN can be very well combined with TTEthernet. In critical applications, TTEthernet may be the right choice for a certifiable digital backbone, while some subsystems are connected via TSN. Both technologies use the same physical Ethernet networks, connectors, data logging, and analysis tools. Another important point is that migration from TTEthernet to TSN is feasible and vice versa – as well as the migration from regular Ethernet to TTEthernet when needed, e.g., due to higher real-time performance or safety requirements. A project with Frontgrade Gaisler, for example, envisages the addition of TSN features to a TTEthernet chip core by means of software.

Talking about software – ever-increasing processing power allows more and more end systems to be connected via a newly developed safe software stack, as off-loading processors by means of a separate TTEthernet interface card is not needed any longer. TTEthernet is also being continuously improved as we learn from the world’s most challenging applications – for example, when we recently developed an alternative approach to clock synchronization via TTEthernet switches alone together with US partners.