## 5 Modelling Rationale
### Modelling Strategy
#### 5.4.2 General Models  
As we have mentioned, we have developed three different general models, one for standard TSN, one for approach A and one for approach B. Nonetheless, all the models share the same structure presented here. Figure 7 shows the different modules that make up the models and how they interact. Specifically, each model has a system evaluation module, a path module, a phase module and a period module. The orange dashed lines represent time information, while the black solid lines represent information related to the state of the model. We next describe each module in more detail. * Module system evaluation. This module decides whether the system has failed according to a set of predefined rules which are applied to the local variables of the path, phase and period modules. Specifically, the system fails if _too many_ streams fail; a stream fails \begin{table}
\begin{tabular}{l c c c} \hline \hline
**Parameter** & **Range** & **Reference** & **Meaning** \\ \hline Mission time & 10 h & 10 h & The time that the system is expected to operate in a continuous manner. We use 10 h in all the experiments as it is typically assumed for evaluating the reliability of critical applications such as throttle-by-wire [34]. \\ TAS window & 1.3 ms & 1.3 ms & The duration of the TAS window in milliseconds. Since we assume that frames are scheduled using CQF, each TAS window must last enough time for a frame to be transmitted, propagated, received and forwarded. Thus, to decide on the TAS window size we have taken into account the transmission and reception time, the propagation time and the forwarding time of a frame through a link and a bridge. These values have been mathematically estimated or measured using a real TSN bridge [35]. This parameter is fixed in all the experiments. \\ Period & 15 TAS windows & 15 The number of TAS windows that lapse between the transmission of frames. This parameter is fix in all the experiments. \\ BER & \(\{1\times 10^{-4},...,1\times 10^{-12}\}\) & \(1\times 10^{-10}\) & The bit error rate of the links. We consider values from \(1\times 10^{-4}\) considered in highly critical applications such as space missions, to \(1\times 10^{-12}\) considered for utility communications. We use \(1\times 10^{-10}\) as reference as it is the most pessimistic assumption while still considering critical applications such as automotive. \\ Frame size & [64, 782, 1500]B & 782 The size of the frames transmitted through the stream in bytes, being 64 the minimum size, 782 the medium size and 1500 the maximum size for Ethernet frames. We use 782 as reference to compare the impact when using smaller and larger frames. \\ \# of replicas & \(\{1,...,4\}\) & 2 The number of replicas transmitted by PTRF-enabled components. This value is always 1 in TSN and we consider up to 4 replicas as our results show that reliability converges with this number of replicas. Our case of reference is 1 replica for TSN and 2 replicas for PTRF as this is the lowest number of replicas that PTRF can transmit while still providing time redundancy. \\ \# of bridges & [2,..., 10] & 6 The number of bridges in the path between the talker and the listener. We consider from 2 to 10 bridges. We select 6 bridges for our case of reference as this is the maximum number of bridges for which TSN ensures tight synchronisations. \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Parameters tuned in the the sensitivity analysis. Figure 7: Modules in the general model. The module system evaluation decides whether the system has failed, the module path models the transmission of frames, and the modules phase and period manage the pass of time in the model. if _too many_ paths fail, and a path fails if all the replicas of a message edition are lost in the path. The result of this module is shared with the path modules so that the affected path modules stop evolving (i.e., making calculations) when the system has already failed. Whenever the number of failures in any of these modules reaches the specified threshold, the whole model stops.