Application Layer Specification & Modeling for a

Modular Wireless Sensor Network (MWSN) in

Avionics domain
Marco Carloni Luca Manica
Applied Research and Technology (ART) Applied Research and Technology (ART)
2022 IEEE/AIAA 41st Digital Avionics Systems Conference (DASC) | 978-1-6654-8607-1/22/$31.00 ©2022 IEEE | DOI: 10.1109/DASC55683.2022.9925764

Collins Aerospace Collins Aerospace

Rome, Italy Rome, Italy
marco.carloni@collins.com luca.manica@collins.com

Abstract—The paper provides specification and modeling of communication rate and with an interesting estimation on the
the application protocol for a Modular Wireless Sensor number of wireless nodes [1]. WAIC initiative primary
Network (MWSN) in aircraft. We propose a generic protocol focuses on the physical layer and the spectrum allocation that
able to identify the data produced by the devices belonging to remain the main concerns in wireless communication. As a
the distributed embedded systems in a modern aircraft and fit consequence, WAIC’s effort currently lacks investigating
them into application packets. The protocol acquires the higher protocol layers. We concentrate our effort on the
application requirements to guarantee and verifies that they application protocol for providing connectivity between
are maintained when data are transmitted over a wireless
terminal nodes, the wireless multi-sensor/actuator modules
communication network, as the one envisioned by Wireless
(WSMs), and a smaller set of wireless data concentrators
Avionics Intra-Communications (WAIC) initiative.
(WDCs), which deliver the sensed data to the dedicated Line
Keywords— Wireless Networks, Application layer, WSN, Replaceable Units (LRUs) and receiving back from them the
Safety, Scalability, WAIC control commands. As use case, we target the aircraft
braking system in which the final LRU hosts the brake
control unit (BCU). This system belongs to the LO class of
I. INTRODUCTION TABLE I. scheme and its communication infrastructure can
The paper aims of specifying and modeling a Distributed be implemented as part of a wider WSN. The most of the
Application Layer over a Modular Wireless Sensor Network work in literature on WSNs focuses on routing protocols [14-
(MWSN) in avionics domain. The avionics wireless 19]. A reasonable justification of this interest derives from
communication network was first promoted by the Wireless the challenging assumption of connecting a great number of
Avionics Intra-Communications (WAIC) initiative [1]. In nodes that have strong energy constraints to satisfy.
2017, Aerospace Vehicle Systems Institute (AVSI) [2] Consequently, nodes have a very small transmission power
relaunched the WAIC project of removing wires from to spend in directly reaching their destination in a single hop.
aircraft with special focus on communication wires. WAIC However, there are many situations in designing a distributed
will support data, voice, and video communications between system, especially for industrial domain, where it is still not
systems to monitor different areas on the aircraft, including clear if a multi-hop approach will be, first, necessary and,
communications systems used by crew. Furthermore, the second, represent the best solution to satisfy the application
replacement of wires on embedded applications, such as requirements. For this reason, we retain WSN routing a
structural, environmental, and mechanical health monitoring, secondary problem to solve while the higher application
sensing, control, and actuation, represents the big challenge layer becomes central. We propose an application protocol
to guarantee reliable, secure, and effective operations as layer able to identify and shape, for the transmission over a
required by the International Civil Aviation Organization MWSN, not only the data incoming from the sensors of the
(ICAO). braking system but also, to be general and extensible, the
data produced by the nodes belonging to all the embedded
TABLE I. WAIC APPLICATION CLASSIFICATION
systems in aircraft, estimated in WAIC. To note that generic
and extensible are two relevant properties thinking at the
Num. of variations we may have on different types of aircrafts and
Class Data Rate Installation
Nodes
inside metallic or
consequently sensors, number of applications, etc. For
Low Inside low (< 10
conductive composite ~3500 example, if we look at the braking system its network
(LI) kbit/s) requires to scale on the number of wheels; consequently, the
enclosures
Low Outside low (< 10 outside aircraft
~900
format of the exchanged message and the addressing
(LO) kbit/s) structure mechanism will need to support this type of requirement.
high (> 10 This consideration leads to study two important aspects of
High Inside inside aircraft
kbit/s burst rate ~100
(HI)
per node)
structure the MWSN: first, the modularity/similarities of the types of
High Outside high (> 10 outside aircraft nodes composing the different distributed systems in terms
~300 of properties and capabilities; second, from communication
(HO) kbit/s) structure
International Telecommunication Union (ITU) proposes perspective all these systems, under a WAIC vision, will
the general classification of TABLE I. for the different types need to work in accordance to maximize the exploitation of
of aircraft applications, based on their location and the common wireless communication resources. Network
coordination facilitates the satisfaction of the overall safety
This research has been funded by the European Union’s Clean Sky 2 requirement of the flight. The proposed high layer protocol
Research and Innovation program ICO-Brake under grant No. 945535.

Authorized licensed use limited to: J.R.D. Tata Memorial Library Indian Institute of Science Bengaluru. Downloaded on August 19,2023 at 02:14:21 UTC from IEEE Xplore. Restrictions apply.
 specifies the following functionality: 1) a mechanism of
signal encapsulation/decapsulation in messages and their
interpretation 2) the format of the application packet for
carrying the message exchange. We may think to have
several different types of data from different sensors and
control units travelling on the air and filtered up at
destination till the application layer 3) global system
coordination helps to improve the safety of the system and
maximize the exploitation of the common wireless medium.
For example, according to the different phases of flight we
may have different bandwidth allocation and priority
changes 4) a data priority identification in the exchanged
information is a relevant aspect that can be exploited by the
application protocol in requesting the services to the lower
layers 5) some safety methods for assuring data integrity and
managing communication quality of services, access
priorities and redundancy. We model, validate and integrate
this application layer to our MWSN simulator used to
vehicle the traffic produced by the sensors and the control
units. Both the specification and the model allow to virtually
explore different safety solutions for the future MWSN in
aircraft.
The paper is organized as follows: in the next section, we
describe the application protocol layer, data format, packet
format, properties and functionalities. Section 3 details the
method to validate the derived protocol model. Section 4
considers an intelligent wireless wheel braking system and
shows the challenges and some possible design decisions for
realizing the wireless communication among its distributed
components. Section 5 provides the analysis of the
application protocol through the adoption of an abstract
wireless communication medium able to test the application
under different level of impairments. Finally, section 6
summarizes conclusions and future work.
II. APPLICATION PROTOCOL LAYER
Fig. 1. Abstract Wireless Avionics Network
Fig. 1 shows an abstract view of a wireless network
responsible for transporting signals inside a modern aircraft
as envisaged by WAIC [1]; effectively a multitude of nodes
located inside and outside the aircraft that produce different
rates of traffics. The exact deployment of nodes is a
complex task that requires many factors to account and
poses severe limitations in the accuracy of a priori wireless
link characterization. We can assume that nodes need to be
close to the related embedded devices. The size of the
aircraft classifies the range type of the wireless
communication as a particular local area network having
both outdoor and indoor parts. The short-range characteristic
is also a recommendation to reduce interference among
aircrafts during ground operations at the airport. Moreover,
Authorized licensed use limited to: J.R.D. Tata Memorial Library Indian Institute of Science Bengaluru. Downloaded on August 19,2023 at 02:14:21 UTC from IEEE Xplore. Restrictions apply.
an important distinctive of the network is the highly
predictable behavior required by the served systems.
Therefore, its design must stress determinism in any choice
such as fixed node position and predefined traffic in any
aircraft condition. Nodes can be shared by different
applications or be dedicated to manage the communication
for a single specific application. Most of them are terminal
nodes interfacing with the plants of the different systems by
sensors and actuators. We generically call these nodes
wireless sensor modules (WSM). There are other nodes with
higher capabilities that interact with the control and
monitoring systems hosted by different LRUs. These nodes
are wireless data concentrators (WDC). They play the role
of access points or gateways to create bridges to other
networks in and out the aircraft.
Fig. 2. MWSN communication protocol stack
Typically, the functionality for a wireless sensor
communication can be identified by the scheme shown in
Fig. 2: the sensed signal is acquired by the application and
transmitted over the stack of communication layers to its
destination where the value of the signal is consumed. We
assume that the entire functionality, both sender and receiver
side, sketched in Fig. 2, characterizes the MWSN adapter for
each node in the network. Accordingly, both WSMs and
WDCs have a MWSN adapter to allow the flowing back and
forward of signals. in particular datalink (DL) and physical
(PHY) may directly be or derive from one of the following
wireless communication standard: 802.15.4 ([2],[4]),
Bluetooth [6], Wi-Fi/802.11 family ([7], [8], [9], [10], [11],
[12]). Similar reasoning could be done on the network layer
(NW) where we have the multi-hop solution, promoted by
Zigbee protocol [13] for WSN, that still presents significant
limitations compared to the widely adopted solution of
single-hop WLAN relied on an IP wired backbone [14].
Worth to say that the choice of the wireless technology in
avionics domain is still under discussion [21], if not still
under design definition as demonstrated by the WAIC
initiative. Our goal is to investigate and build a common
application layer in support to the massive adoption of
wireless communication in aircraft. We identify 5 major
challenging properties, defined in TABLE II. , the protocol
must have.
TABLE II. APPLICATION PROTOCOL PROPERTIES
Property Definition
completeness condition of having all the necessary parts
genericity
capacity to organize applications into classes and to
describe regularities
ability to extend a system while minimizing the effort
extensibility
required to implement the extension
property of a system to handle a growing amount of
scalability
work by adding resources to the system
adaptability quality of being able to adjust to new conditions
 The layer coordinates the communication traffic to
satisfy the requirements of the different distributed
embedded control systems. It collects specific functions
running on the computational platforms that ensure data
integrity and managing communication assets and
redundancy. Finally, the developed associated model can
both virtually justify some design decision and test the
capability of current available wireless protocol technologies,
like the ones mentioned above.
Fig. 3. MWSN Application Layer
Fig. 3 shows the structure of the application layer. The
protocol is composed of the following main functions or
modules: 1) smart multi transducer module 2) message
sequentializer and message dispatcher 3) application traffic
management module 4) wireless technology adaptation
sublayer.
A. Smart Multi Transducer Module (I/O)
over the network, 2) manage their transmission according to
the application requirements defined by the application
traffic management block 3) interpret the values at the
receiver side to be correctly consumed. As mentioned before,
the structure of the data encoding scheme can be reviewed
and extended to match specific needs.
B. Message Sequentializer and Dispatcher
Smart transducer submodules can concurrently generate
messages at different rates inside a WSM or a WDC. The
messages will be sequentially processed by the application
traffic management. The Message Sequentializer is
responsible for avoiding message collision playing the role
of a “fair” multi-input single-output switch. This function is
crucial to avoid starvation1 of one or more of its input lines.
At receiver side the data message dispatcher has a more
complex operation since it must read the signalId attribute
contained in each message and check if the identifier belongs
to the subset of the ones processed by the node. It is a
protocol choice, defined in the application traffic
management block of each node, if messages are transmitted
together in the payload of the same application packet or
individually in separated packets. In the first case, when a
packet is received a set of tokens fires the dispatcher.
Therefore, the dispatcher must support the rate transition
from packet to messages and route each message (token) to
the correct output line. The job of these two blocks correctly
works only if a complete transducer addressing scheme is
defined for the entire MWSN.

TABLE III. TRANSDUCER ADDRESSING SCHEME AND BINDING:

EXAMPLE

Sub
Node Signal
Comm Nodes system Signal Nature In Out
Id Id
Id
WSM1(Wheel1) 1 1 Temperature 1 1121
WSM1(Wheel1) 1 1 Wear 2 1122
WSM1(Wheel1) 1 1 Fan Control 1 1211
WDC1(BCU) 1 2 Temperature 1 1121
WDC1(BCU) 1 2 Wear 2 1122
Fig. 4. Smart Multi Transducer Module & Signal Data Structure WDC1(BCU) 1 2 Fan Control 1 1211
WDC1(BCU) 1 2 Temperature 3 1321
We define the Multi Transducer Module sketched in Fig. WDC1(BCU) 1 2 Wear 4 1322
4. The module collects a set of sub-modules, one for each
WDC1(BCU) 1 2 Fan Control 2 1231
physical signal arriving from the plant to a WSM or for each
WSM2(Wheel2) 1 3 Temperature 1 1321
actuation command produced by the control unit connected
WSM2(Wheel2) 1 3 Wear 2 1322
to a WDC. In case of sensed signal, signals are properly
WSM2(Wheel2) 1 3 Fan Control 1 1231
analog to digital converted by identifying its required
sampling frequency, or refresh rate, and its quantization size. TABLE III. shows an example of the resulting addressing
The digital to analog inverse operation is performed in case scheme by our implemented algorithm. We consider 3 nodes
of actuation. As reported in Figure 4, each smart transducer of the MWSN that are part of subsystem 1: 2 WSMs located
module implements a data encoding scheme that smartly on a couple of right-left wheels respectively and 1 WDC
transforms the signal values to messages and vice versa. attached the associated BCU. The algorithm assigns a unique
Messages are defined as a signal data structure, i.e., a SignalId to each signal transmitted in the MWSN, based on
generic data format common to all embedded Avionics its genesis position in the MWSN architecture. The
applications. A message is composed of the following six identifier, last column in TABLE III. , is the result of the
fields: timestamp of the sampled value, signalId representing combination of four fields: the subsystem identifier, the
a unique identification number of the signal, data containing hosting source node Id, the destination node Id, the output
the sampled value, dataType setting its data type, port number of the smart multi transducer module message
dataMeasuredUnit defining its measuring unit and
dataPriority for ranking the relevance of the data in the 1
In computer science, resource starvation is a problem encountered in
network through an integer value, lower priority number concurrent computing where a process is perpetually denied necessary
signifies higher priority value. The defined fields serve three resources to process its work. Starvation may be caused by errors in a
main purposes: 1) quantify the volume of data transmitted scheduling or mutual exclusion algorithm, but it can also be caused by
resource leaks.

Authorized licensed use limited to: J.R.D. Tata Memorial Library Indian Institute of Science Bengaluru. Downloaded on August 19,2023 at 02:14:21 UTC from IEEE Xplore. Restrictions apply.
 generator. Particular attention is given to the subsystem
identifier field. This field is the key to manage the scalability
of the MWSN as we analyze in section V.B. The signalId is
used for the binding operation, visualized by colors in the
relative column. The implemented algorithm literally binds a
smart transducer module message generator to a smart
transducer module message receptor. Finally, the signalId
sets the value of the homonymous message attribute. Each
node in the network is then configured to send and receive
two separated subsets of messages creating a point-to-point
communication at application level.
Fig. 5. Sensor Message Dispatcher Mask
Fig. 5 shows the mask of the modeled message dispatcher
block with the subset of accepted signalIds. In this
configuration, Node 1 accepts messages belonging to
subsystem 1, transmitted from 2 and directed to outport 1 and
2. The service time parameter allows to set the speed
requirement in processing each incoming message without
losing any of them.
C. Application Traffic Management Module
The block represents the core of the application layer. At
the sender side, it is responsible of sequentially processing
incoming messages for their packetization and transmission.
At the receiver side, it must provide the inverse operation
from packet to message. These functions must be performed
respecting the quality of service required by each application.
For this purpose, we classify aircraft applications based on
the two main communication requirements of latency and
correctness. Latency, or Time, requirement imposes that the
data transmitted inside the packet are meaningful for the
application until they meet the specified deadline. If the time
expires then the content in the packet becomes useless. To
achieve this requirement, we need a wireless technology with
a transmission speed able to support the traffic produced by
all applications of the MWSN. Correctness requirement
imposes that the data transmitted inside the packet is always
relevant and it must be correctly delivered to the intended
recipient in the network to avoid a failure. To achieve this
requirement in a lossy network, we specify an acknowledge
mechanism that commands a packet retransmission in case of
transmission timer expiration.
TABLE IV. APPLICATION CATEGORIES
Categories Latency Correctness
1 Y Y offered by the protocol to improve their communication
2 Y N effectiveness.
3 N Y
4 N N
Authorized licensed use limited to: J.R.D. Tata Memorial Library Indian Institute of Science Bengaluru. Downloaded on August 19,2023 at 02:14:21 UTC from IEEE Xplore. Restrictions apply.
TABLE IV. defines four categories. Category 1
represents the category with the most stringent requirements,
both latency and correctness are necessary; distributed
control systems, that must promptly react to the last received
data from the sensors, belong to this category. On the
opposite side, category 4 contains applications with the
loosest communication requirements. The application traffic
management block specifies the mechanism for message
encapsulation and decapsulation. It defines an application
packet encoding scheme that is presently composed of the
following fields: timestamp of the packet generation, pktId is
the progressive number associated to the generated packet,
srcId is the address of the source node, dstId is the address of
the destination node, appId is an enumerative property used
to identifies the aircraft application univocally in the
network, pktPriority is set by the highest data priority value
collected during an application period, pktLength is the
length of the payload in messages, signalDataStructureArray
is the array of messages generated by the smart transducer
modules during an application period to be transmitted.
Fig. 6. Application Packet Format Scheme
Fig. 6 sketches the application packet format that travels
over the MWSN. According to the data transfer decision
imposed by the application needs, a data refresh policy
establishes the packet rate for the node. The packet rate
results constant if the selected data refresh policy is based on
the maximum sampling frequency among the input signals.
The rate will be, otherwise variable if the decision prepends
to send packets only on significant data value changes. In the
second case, a refresh timer is used to send a confirmation
packet in case the signal did not significantly change in the
last period. The data refresh policy has consequently an
impact on the protocol decision if sending a single message
per packet or aggregating them in a single packet. For
example, observing a typical control algorithm, it may be
reasonable assuming that it needs all new inputs before
computing, but the assumption may be not always true for all
applications. The dstId field contains the address of the
recipient nodes. Its value is set according to the selected
communication mode. The protocol supports unicast,
multicast and broadcast transmissions. Differently from
unicast transmission that targets one node or broadcast that
transmits to all nodes, the multicast solution defines
destination addresses for transmitting packets that only
subsets of subscriber nodes can receive. In-aircraft
applications can leverage the communication mode option

cat1: latency
& in the future. However, we retain notable to remind two
correctness
Fig. 7. Application Traffic Management: model mask
Fig. 7 shows the mask of the application packet traffic
generator model receiving messages from four smart
transducer blocks. The mask lists the configurable
parameters of the traffic generator block. In this example, the
block belongs to node 3 and it is configured to transmit
packets in multicast mode at the interval time of 0.5s.
Another feature of the application protocol is the node
coordination of packets transmission in the entire MWSN to
avoid collisions. The packet generation start type parameter
serves this scope by statically configure the instant of start
transmission for each node according to specific modality:
random or deterministic. The application ID parameter
identifies the in-aircraft application. Its value is used to
classify the generated packets, by setting the related appId
field, in one of the four categories of TABLE IV. In case of
multiple applications running on the same node, the appId
also provides the priority order of packet processing at both
communication ends. For demonstration purpose, in current
model implementation we assume that the number of
distributed applications in a generic aircraft is equal to 40
partitioned in the four equally sized categories of TABLE
IV. For example, a value from 1 to 10 means to belong to
category 1 and the value equal to 1 means the top priority
application in the entire MWSN. For applications of category
1, that must satisfy both correctness and latency
requirements, the protocol adds to the specified acknowledge
mechanism the additional constraint on the timer for
retransmission to be much lower than the latency
requirement. This constraint guarantees a proportional
number of retransmissions attempts before the deadline
expires. Differently from other communication networks, a
characteristic of the WSN is that communication is initiated
from data generated by sensors at a rate equal or higher than
the application traffic transmission rate. The fact simplifies
the retransmission scheme since the packet has not to be
maintained in a queue, but it can be simply overwritten at
transmission side. This even provides an advantage in terms
of less storage capacity needed by the node. The design
decision on the maximum number of retransmissions may
result from a trade-off analysis between the application needs
and the wireless technology selection. We aid the design
supporting this kind of analysis.
D. Technology Adaptation Sublayer
The technology adaptation sublayer serves to map the
defined application protocol to the lower-level wireless
communication protocol, such as the mentioned IEEE
standard protocols [3-13] or even a new defined WAIC
Authorized licensed use limited to: J.R.D. Tata Memorial Library Indian Institute of Science Bengaluru. Downloaded on August 19,2023 at 02:14:21 UTC from IEEE Xplore. Restrictions apply.
protocol [1,2]. In this work, we just mention the adaptation
sublayer. We plan to explore in detail the possible alternative
points: first, how the requirements imposed by the
application can dramatically impact both the choice of the
lower protocol and its configuration. Second, the importance
of having a common application layer to optimize the
utilization of the selected communication technology.
III. APPLICATION PROTOCOL MODEL VALIDATION
The model of the protocol was entirely developed in
Matlab/Simulink framework [24]. The model is organized in
a library characterized by modular basic blocks and
hierarchical multi-level blocks resulting from the integration
of other library blocks. The library supports the virtual
creation of distributed systems by providing top level
wireless communication adapter blocks. Adapters are
instances of a hierarchical model available in the library that
implements the node of the MWSN containing the behavior
of the specified application protocol layer. We adopt the
SimEvents toolbox [25] to support the model transition from
continuous time domain, typical of control systems acting on
plants, to discrete event domain, typical of communication
networks and vice versa. This transition in a Simulink
schematic is materialized by the Smart Multi Transducer
modules converting signals into messages. The resulting
schematic supports hybrid simulation analyses. Inspecting a
generic control application schematic, once partitioned its
functions in a distributed system architecture it is possible to
group all point-to-point connections between two
architectural parts, cut them and connect the broken lines to a
couple of wireless adapters. This operation reflects the
essence of the communication-based design methodology in
performing a communication refinement [26]. Similarly, we
previously validated basic functionalities, like the message
dispatching toward the desired smart transducer or packet
encapsulation and decapsulation, by applying a peer process
technique at message level and application packet level. This
technique simply consists in short circuiting the sender side
to the receiver side. After having validated two
communicating blocks we refine their connection by
interposing a couple of new blocks that introduce more
details to the communication and we pass to test the new
enriched functionality. A second level of protocol validation
consists in introducing communication impairments.
Communication resources are limited, and wireless medium
is lossy and shared by all communicating nodes due to its
broadcast nature.
Fig. 8. Abstract Wireless Technology medium model
 Fig. 9. Intelligent wireless wheel braking: 3-node wireless network model
Therefore, to test the resilience of the application layer
with respect to the defined application QoS we implement
the abstract wireless technology medium model of Fig. 8.
The model acts as application tester by mimic the wireless
communication of all the packets transmitted over the
MWSN. Its configurable capabilities allow the estimation of
the following behaviors: 1) the performance of the lower
wireless technology protocol in terms of offered packet
transmission rate. Its value is correlated to the selected
technology [1-13] and it is achieved by assuming an
appropriate received signal strength, which is specified by
the radio vendors as the radio receiver sensitivity 2) the
impact of the wireless channel loss on the transmission rate
in terms of Packet Error Rate (PER) 3) the propagation
delay, i.e., the time required for a packet to reach its
destination.
IV. INTELLIGENT WIRELESS WHEEL BRAKING MODEL
Fig. 1 shows the schematic of the distributed control
system made of two wheels, and one LRU hosting their
control. The three parts wirelessly communicate through
MWSN adapters, forming a 3-node network: two WSMs for
the plants and one WDC for the LRU respectively. For each
wheel the WSM receives two analog signals from the plant,
representing the evolution of two physical variables, and it
provides two received actuation signals acting on the plant.
The WDC receives the four sensed signal values from the
two wheels and dispatch them to the correct inputs of the
control block. The control block is responsible to provide
four actuation commands that are taken as inputs by the
WDC and sent as answer to the plants. This schematic is
enough generic and exhaustive to cover all cases. It is
possible to increment the number of physical variables or the
number of actuation commands by replicating the number of
Smart Transducer Modules inside the MWSN adapters in
input or output to match any type of distributed control
application. The special case of applications that just monitor
the plant, i.e., pure WSN applications without actuation, are
modeled straightforward by simply removing the input
modules to the WDC. We detail in section V.B that even
scaling the MWSN, by replicating the number of wireless
nodes (WSM or WDC) in the model, is easily possible.
Authorized licensed use limited to: J.R.D. Tata Memorial Library Indian Institute of Science Bengaluru. Downloaded on August 19,2023 at 02:14:21 UTC from IEEE Xplore. Restrictions apply.
Wheel brake actuation in today passenger aircrafts is a
mechanical system made by multiple, independent hydraulic
systems backed up by accumulators. These systems allow for
several layers of failure without resulting in total loss of
braking capability. Anti-skid, auto-brake, brake temperature
indicators and brake fans are part of distributed safety
systems which enhance the performance of the aircraft wheel
brakes [22]. We consider two applications of the wheel
braking system: the Anti-skid Brake Control Application
(ABCtrlA) and the Active Brake Cooling Application
(ABCoolA). ABCtrlA is a safety critical application of the
braking system. It performs the anti-skid operation by
receiving inputs from the pressure sensor and the wheel
speed transducer. The purpose is to increase the traction and
avoid wheel locking by acting on the valve that controls the
amount of hydraulic pressure applied on the wheel brakes.
Independent brake controls are employed for inboard and
outboard brakes. ABCoolA works on fans embedded in the
wheels. The large amount of heat generated during aircraft
braking is dissipated by means of passive or active cooling.
Passive cooling occurs due to natural conduction of heat
through the disc material and to surrounding components,
radiation of heat off the brake and wheel assembly, and
convection as air flows past and through the brake assembly.
Active cooling is achieved by using fans that force air
through the brakes. Fans are either built into the wheel or
part of the external ground support equipment that is
positioned against the wheel and removed once sufficient
temperature drop has occurred [23].
Our goal is to demonstrate the importance of having a
common application layer along with a model-based
methodology in facing the challenge of bringing these
applications into a wireless network. Therefore, we limit the
description of ABCtrlA and ABCoolA just highlighting the
fact that they can be accurately modeled too. We are
interested in their exchanged signals, their frequency and
range of values, and the communication requirements
characterizing their traffic. To simulate the impact of
wireless communication in the behavior of these
applications, we use the model of Fig. 1. by attaching their
I/O signals to the application layer model.
 TABLE V. INTELLIGENT WHEEL BRAKING APPLICATIONS: I/O
SIGNALS

I/O signals (L/R) ABCtrlA (cat1) ABCoolA (cat2)

Sensor(1/2)1 Brake Pressure L/R Brake Temperature L/R

Sensor(1/2)2 Wheel Speed L/R Brake Wear L/R

Actuation(1/2)1 Brake Cmd L/R Fan Cmd L/R

Actuation(1/2)2 Secondary Cmd L/R Secondary Cmd L/R Fig. 10. 4-Wheel Safety Architecture Braking System: 6-node wireless
network model

TABLE V. describes how the signals in the model are The schematic duplicates the model of Fig. 1 making the
assigned for the two applications. Given their different applications more resilient to failures. The resulting wireless
objectives we can assume ABCtrlA belongs to category 1 network is composed of six nodes: four WSMs and two
and ABCoolA belongs to category 2 of TABLE IV. We WDCs. Safety is based on redundancy principle. The two
assume they have a different Process Safety Time (PST), i.e., subsystems, one for inboard brakes and the other for
the absolute maximum time delay for suitable safety outboard brakes, work in parallel controlling the two couples
communication completion. From PST we derive a of wheels without interfering to each other. The relative
reasonable required packet transmission rate for each messages are generated by different nodes and thus travel on
application. different packets. In case of ABCtrlA in normal operating
condition, the commands to all the wheels require a coherent
V. HIGH LEVEL DESIGN EXPLORATION system effect but the actions, i.e., the transmitted values, may
be different, since they are produced by two control units
Different MWSN schematics were built starting from the working independently based on the status of the different
generic scheme of Fig. 1. Relevant common configuration wheel couples under control. In case of emergency wheel
parameters are given in TABLE VI. 10 simulation runs for braking, that is when either the inboard or the outboard brake
each configuration were executed. system fails, the opposite braking system either inboard or
the outboard braking system is available. As result, the anti-
TABLE VI. SIMULATION PARAMETERS skid braking applies to the functioning subset of brakes.
Parameter Value
Simulation Time 100.25 [sec]
Simulation Runs per
10
Configuration
Application Category 1/2
Node Required Packet Rate
2/20 pkt/sec
(a-priori)
Message Aggregation Y
Unicast/Broadcast
Communication Mode
/Multicast
Max Num. of Retransmission 10/20

In this section we perform some safety analyses on the

studied applications to see the impact of different
transmission design decisions on different lossy channel
conditions. For this exploration, we ideally assume the
propagation delay equal to zero and the transmission rate
equal to infinite. In other words, we do not impose
technology constraints, but we test the application protocol
under a set of different wireless channel conditions captured
by different PER input values. We define the following
safety metrics: Message Error Rate (MER) is the rate of
messages not delivered in time to the intended consumer in
the network. Availability or success rate (A) is 1 – MER. We
evaluate the impact of different application requirements and
communication modes on MER and the resulting required
packet rate. Message transmission is performed aggregating
in a single packet at the required rate all messages produced
by a node.
A. Safety Analysis
We study the 4-Wheel Safety Architecture Braking
System schematic reported in Fig. 10.
Fig. 11. Application Category 2 (ABCoolA case): all broadcast Txs,
PER=0, MER=0
Fig. 11 shows the number of transmitted/received
messages and packets at the end of one simulation run of
100.25 [sec] in the baseline ideal scenario of infinite
communication resources and PER=0 for the ABCoolA case
(appCat=2). Packet transmission is performed in broadcast
mode and without acknowledge. Each node transmits 2pkt/s
and receive from everyone. As previously described in
section III, each WSM transmitted packet (red bars 1/2/4/5)
carries two sensor messages (cyan bars 1/2/4/5) and receives
two actuation messages (blue bars 1/2/4/5) in the reply
packet (green bars 1/2/4/5) from the associated WDC. Each
WDC packet (red bars 3/6) transmits four messages (cyan
bars 3/6) and receives four messages (blue bars 3/6) from the
two incoming WSM packets (green bars 3/6) in each
application period. As expected, MER=0 but it is evident
from the histogram that broadcast transmission is not a good
choice in this case, since nodes are only interested in a
portion of the overall transmitted messages: WSMs are
interested in 1/5 of them while WDCs in 2/5 of them. After

Authorized licensed use limited to: J.R.D. Tata Memorial Library Indian Institute of Science Bengaluru. Downloaded on August 19,2023 at 02:14:21 UTC from IEEE Xplore. Restrictions apply.
 packet reception, the useless residual messages are correctly
discarded in each node, but only after being processed.
two subsystems failed at that rate, but we still have MER=0
in emergency wheel braking operation. Moreover, MER in
normal operation can be returned to zero by rising the
maximum number of retransmissions from 10 to 20, as
showed in the successive row. After PER=0.21, MER
becomes greater than 0 in normal operation even setting 20
maximum retransmissions. However, correct behavior is still
preserved in emergency case even when PER=0.3 (last row)
that represents a very severe condition imposed by the
wireless channel. This last result is obtained by adding a
retransmission overhead, reported in column 4, that is more
than double of the value when PER=0 (first row).

TABLE VII. APPLICATION CATEGORY 1 (ABCTRLA): SIMULATION

RESULTS

ABCtrlA
Req. NW Effective ABCtrlA
NW Max (emergency
Rate NW Rate (normal op.)
Fig. 12. Application Category 2 (ABCoolA): unicast WSM txs and PER Retrans. op.)
(pkt/s) (pkt/s) MER
multicast WDC txs, PER=0, MER=0 MER
0 10 120 279.86 0.00E+00 0.00E+00
Fig. 12 shows the result of a second simulation in which 0.03 10 120 297.60 0.00E+00 0.00E+00
we improve reception performance by selecting different 0.06 10 120 318.05 0.00E+00 0.00E+00
communication modes in different node types. We configure 0.09 10 120 340.14 0.00E+00 0.00E+00
WSM nodes to transmit unicast packets towards the intended 0.12 10 120 362.47 0.00E+00 0.00E+00
WDC and WDC nodes to transmit multicast packets towards
0.12 20 120 366.19 0.00E+00 0.00E+00
the intended couple of WSMs. Comparing the green bars of
Fig. 11 and Fig. 12 is clearly visible the reduction of 0.15 10 120 393.71 6.24E-05 0.00E+00
processed packets by each node in the network. This 0.15 20 120 394.16 0.00E+00 0.00E+00
configuration optimizes communication still respecting the 0.18 10 120 421.71 2.50E-04 1.25E-04
application needs. All nodes process the exact number of 0.18 20 120 426.44 0.00E+00 0.00E+00
required packets while the residual ones are correctly filtered 0.21 10 120 453.90 8.13E-04 5.00E-04
out by the addressing mechanism. At the end of the 0.21 20 120 458.79 6.24E-05 0.00E+00
simulation, in each of the two subsystems, the WDC node 0.24 10 120 460.04 2.65E-03 2.50E-03
receives all the 400 packets cumulative transmitted by its
0.24 20 120 497.26 6.24E-05 0.00E+00
WSMs and replies to them transmitting 200 multicast
packets carrying the actuation commands intended, required, 0.27 10 120 478.35 5.30E-03 4.38E-03
and received only by them. In the ideal case of PER=0, 0.27 20 120 537.95 1.12E-03 0.00E+00
correctness is a priori solved. Therefore, adopting an 0.30 10 120 450.66 9.64E-03 7.79E-03
acknowledge mechanism for checking correct delivery, as 0.30 20 120 589.92 2.31E-03 0.00E+00
required by appCat=1, results in a useless waste of
communication resources. This is the reason why Fig. 11 and B. Scalability Analysis
Fig. 12 refers only to ABCoolA application and the ack bars A peculiarity of the wheel braking system is the need to
in transmission and reception are not present. In the next scale on the number of wheels because to generate the
numerical assessment, we maintain the efficient necessary frictional forces, large commercial transport
communication modality showed in Fig. 12 and we perform aircraft typically require multiple brakes on most, if not all,
a set of simulations by varying the level of wireless channel of their wheels. As example, an A380 has 22 wheels
impairment for ABCtrlA case, and so referring to an distributed on five landing gear legs to support its massive
application belonging to category 1. In this application, each weight: two nose wheels on a leg beneath the nose of the
node transmits 20pkt/s for total network speed requirement aircraft, eight wing wheels split between two legs that fold
of 120pkt/s. TABLE VII. reports the cumulative results of out from under the fuselage to support the left and right
several runs. Column 4 shows the effective network speed wings, and 12 body wheels split between two inboard
required to correctly complete all network transactions. In landing gear legs under the fuselage. Many of these wheels
row 1, in which network PER=0, even if there are no have brakes [23].
retransmissions, the overhead produced by the acknowledge
mechanism is 133% resulting from doubling each unicast
packet and tripling each multicast packet since intended to
two recipients. In fact, we consider a multicast transaction
complete when WDC receives ack packets from the two
WSMs. Increasing PER, we record a monotonic increment in
the values of column 4, as expected. The increment is due to
packet retransmissions that maintain MER in the last two
columns equal to 0, i.e., all messages in the network are
delivered correctly and on time. When PER=0.15 we start to
see MER greater than 0. We have a failure rate of 6.24E-05
Fig. 13. 18-node wireless network serving a 12-wheel braking system
in normal wheel braking operation condition, i.e., one of the

Authorized licensed use limited to: J.R.D. Tata Memorial Library Indian Institute of Science Bengaluru. Downloaded on August 19,2023 at 02:14:21 UTC from IEEE Xplore. Restrictions apply.
 Fig. 14. Application Category 1 (ABCtrlA) : 18-node wireless network model, PER=0.2, MER=4.18E-4; signal scopes and communication report.
We scale the 2-wheel control system from 1 to 6 building
the model of Fig. 13. We perform a similar analysis as the
one done in the previous subsection. The developed model
library has capability to track information about all
transactions in the built network. In particular, the wireless
adapter model can deliver the carried signal values to the
plant models and control models that were attached to it. As
example, Fig. 1 summarizes the features, in terms of
reporting, provided by a simulation run in the 18-node
wireless network scenario with PER=0.2 and resulting
MER=4.18E-4. On top left I/O signals transmitted over the
MWSN from/to the distributed control system. In general,
physical variables are modeled in continuous time domain.
From the scopes it is possible to visually compare them to
their delayed discrete versions received by the control block
after wireless transmission. In the same manner, even the
evolution of the system behavior can be monitored. On
bottom left the communication view is summarized by the
histogram representing the distribution of all the messages,
data packets and acknowledges transmitted and received by
the 18 nodes during the simulation run. The right side of the
figure shows an extraction of the generated report
quantifying all transactions and performance metrics for each
node and cumulative for the entire network.
VI. CONCLUSION AND FUTURE WORK
We developed a higher layer protocol for managing the
communication of multiple distributed embedded
applications in a modern aircraft. The protocol transforms
application signals in smart data messages that can be
transmitted in packets through a mechanism of data
encapsulation/decapsulation and interpretation over a
common wireless medium. The protocol specifies a common
format of the application packet and the procedures for data
priority identification of the exchanged information,
transmission system coordination, application requirement
elicitation and some safety methods for assuring data
integrity with respect to given application quality of services.
We model and validate by simulation a library of
Authorized licensed use limited to: J.R.D. Tata Memorial Library Indian Institute of Science Bengaluru. Downloaded on August 19,2023 at 02:14:21 UTC from IEEE Xplore. Restrictions apply.
components reflecting the behavior of the protocol to build
wireless networks that can virtually explore the impact of
wireless communication in the design of distributed
application in aircraft. The scalability propriety of the
modeled protocol permits to create and rapidly reconfigure
systems that would be very hard and time consuming to
physically setup in a real test environment. We present some
safety analyses of the proposed application protocol applied
to a generic avionic wheel braking system.
Our future work addresses several directions of model-
based design and wireless communication for in-aircraft
applications. We work to build and simulate multi-
application scenarios with applications belonging to different
categories that the developed protocol can make their
communication safely co-exist. Moreover, we will analyze
the impact of timing constraints in adopting some wireless
standard technology. Finally, in our simulation runs we
desire to test the protocol during all flight phases. Therefore,
improving our models to speed-up their execution time is
another relevant aspect of our research that will allow to
explore more rapidly different network design solutions.
REFERENCES
[1] ITU, Technical characterstics and operational objectives for wireless
avionics intra-communication (WAIC), (ITU-R M.2197), 2010.
[2] Aerospace Vehicle Systems Institute (AVSI), Wireless Avionics Intra-
Communications (WAIC) project https://waic.avsi.aero/
[3] IEEE Std 802.15.4: Wireless Medium Access Control (MAC) and
Physical Layer (PHY) Specifications for Low-Rate Wireless Personal
Area Networks (WPANs), IEEE, 2006.
[4] IEEE Standard for Local and metropolitan area networks--Part 15.4:
Low-Rate Wireless Personal Area Networks (LR-WPANs)" (PDF).
IEEE Standards. September 5, 2011.
[5] IEEE Std 802.15.4e: Low-Rate Wireless Personal Area Networks
(LR-WPANs) Amendment 1: MAC sublayer, IEEE, 2012.
[6] Bluetooth Special Interest Group, Covered Core Package Version:
5.0, Bluetooth System Specification, 2016.
[7] IEEE Std 802.11a Part 11: Wireless LAN Medium Access Control
(MAC) and Physical Layer (PHY) specifications: High Speed
Physical Layer in the 5 GHz band, IEEE, 1999.
 [8] IEEE Std 802.11b Part 11: Wireless LAN Medium Access Control
(MAC) and Physical Layer (PHY) specifications: Higher Speed
Physical Layer (PHY) Extension in the 2.4 GHz band, IEEE, 1999.
[9] IEEE Std 802.11e Part 11: Wireless LAN Medium Access Control
(MAC) and Physical Layer (PHY) Specifications - Amendment 8:
Medium Access Control (MAC) Quality of Service Enhancements,
IEEE, 2005.
[10] IEEE Std 802.11n Part 11: Wireless LAN Medium Access Control
(MAC) and Physical Layer (PHY) Specifications; Amendment 5:
Enhancements for Higher Throughput, IEEE, 2009.
[11] IEEE Std 802.11ac Part 11: Wireless LAN Medium Access Control
(MAC) and Physical Layer (PHY) Specifications; Amendment 4:
Enhancements for Very High Throughput for Operation in Bands
below 6 GHz, IEEE, 2013.
[12] Cisco Corp. IEEE 802.11ax: The Sixth Generation of Wi-Fi,
Technical Report, 2018.
[13] ZigBee Alliance: ZigBee Pro Specification - Connectivity Standards
Alliance - ZigBee Document version 05-3474-21, August 5, 2015.
[14] J. N. Al-Karakin, A. E. Kamal, “Routing techniques in wireless
sensor networks: a survey,” IEEE Wireless Comm., vol. 11, no. 6, pp.
6-28, Dec. 2004.
[15] S. De, C. Qiao and H. Wu, “Meshed multipath routing: an efficient
strategy in wireless sensor networks,” IEEE Wireless Comm. and
Net., WCNC 2003, vol. 3, pp. 1912-1917, 2003.
[16] J. H. Chang, and L. Tassiulas, “Energy conserving routing in
Wireless Ad Hoc Networks,” Proceedings 19th Conference IEEE
Communications Society (INFOCOM), 2000, pp. 21-31
[17] A. Rao, S. Ratnasamy, C. Papadimitriou, S. Shenker, I. Stoica,
“Geographic routing without location information,” Proceedings
9th Annual International Conference on Mobile Computing and
Networking (MOBICOM), 2003, pp. 96-108.
Authorized licensed use limited to: J.R.D. Tata Memorial Library Indian Institute of Science Bengaluru. Downloaded on August 19,2023 at 02:14:21 UTC from IEEE Xplore. Restrictions apply.
[18] E. Manjeshwar, and D.P. Agrawal, “TEEN: A routing protocol for
enhanced efficiency in wireless sensor networks,” Proceedings 15th
International Parallel and Distributed Processing Symposium
(IPDPS), 2001, pp. 2009–2015.
[19] Y. Xu, J. Heidemann, D. Estrin, “Geography-informed energy
conservation for Ad Hoc Routing,” Proceedings 7th Annual
International Conference on Mobile Computing and Networking
(MOBICOM), 2001, pp. 70–84.
[20] A. Aijaz, “High-Performance industrial wireless: achieving reliable
and deterministic connectivity over IEEE 802.11 WLANs," IEEE
Open Journal of the Industrial Electronics Society, vol. 1, pp. 28-37,
2020.
[21] P. Park, P. Di Marco, J. Nah and C. Fischione, "Wireless Avionics
Intracommunications: a survey of benefits, challenges, and solutions,"
IEEE Internet of Things Journal, vol. 8, no. 10, pp. 7745-7767, May
2021.
[22] SKYbrary “Brakes” Category: Flight Technical, General Aviation at:
https://skybrary.aero/articles/brakes
[23] Eric Olson “How do aircraft brakes work?” Available at:
https://insights.globalspec.com/article/12903/how-do-aircraft-brakes-
work October 30, 2019 .
[24] The MathWorks I.: Simulink - Simulation and Model-Based Design.
Available at: http://www.mathworks.com/products/simulink
[25] The MathWorks I.: SimEvents - Model and simulate message
communication and discrete-event systems.
https://www.mathworks.com/products/simevents.html
[26] A. Sangiovanni-Vincentelli, M. Sgroi, and L. Lavagno, “Formal
Models for Communication-Based Design,” Proceedings of 11st
International Conference on Concurrency Theory (CONCUR2000),
2000, pp. 29-47.