Implementing a Redundant Network Driver on VxWorks for High Availability

Implementing a Redundant Network Driver on VxWorks for High Availability

Modern embedded systems increasingly rely on Ethernet as their primary communication infrastructure. In aerospace, defense, industrial automation, transportation, and marine applications, network interruptions can have serious operational consequences. As system availability requirements continue to rise, network redundancy has become a fundamental design consideration.

This article explores the implementation of a redundant network driver on VxWorks, leveraging the operating system’s modular networking architecture to provide seamless failover between two physical Ethernet interfaces. By introducing a virtual network device and a custom protocol layer, two physical network interface cards (NICs) are presented as a single logical interface that shares one IP address and one MAC address.

The resulting architecture delivers automatic failover, minimal packet loss, and switching times consistently below 10 milliseconds without requiring modifications to existing physical drivers.

🌐 Why Network Redundancy Matters

#

Ethernet has become the de facto networking standard due to its:

• High bandwidth
• Low deployment cost
• Broad hardware support
• Mature ecosystem

However, traditional single-interface designs introduce a critical single point of failure.

In mission-critical environments such as:

• Flight control systems
• Shipboard automation
• Industrial robotics
• Defense platforms

even a brief network interruption can result in:

• Lost telemetry
• Control instability
• Process interruption
• Safety risks

Conventional redundancy solutions often operate at the application layer, relying on periodic link monitoring and manual reconfiguration. While functional, these approaches introduce unnecessary latency and complexity.

Implementing redundancy directly within the network driver stack provides significantly faster failover and complete transparency to upper-layer applications.

⚙️ Target Platform and System Architecture

#

The implementation described here was developed on:

The design aggregates two physical Intel i210 controllers into a single logical interface:

Physical NIC A (Master)
          │
          ▼
   Virtual Redundant Driver
          ▲
          │
Physical NIC B (Backup)

Applications and the TCP/IP stack interact exclusively with the virtual interface, while the redundant driver manages master-backup transitions internally.

🏗️ Understanding the VxWorks Network Architecture

#

VxWorks uses the Scalable Enhanced Network Stack (SENS), which separates protocol processing from device-level hardware interactions.

A simplified architecture looks like:

Application Layer
        │
        ▼
TCP/IP Protocol Stack
        │
        ▼
      MUX Layer
        │
        ▼
   END Drivers
        │
        ▼
 Ethernet Hardware

The Role of the MUX Layer

#

The Multiplexer (MUX) layer acts as an abstraction layer between:

• Protocol stacks
• Network drivers

This design enables:

• Virtual devices
• Custom protocol modules
• Driver extensibility
• Hardware independence

Because the MUX layer already supports dynamic bindings between protocol handlers and network devices, it provides an ideal insertion point for implementing redundancy.

🔧 Designing the Redundant Driver

#

The redundancy solution consists of two major virtual components:

1. Virtual Device Driver
2. Virtual Protocol Layer

Together, they allow two physical interfaces to behave as a single logical network device.

🖥️ Virtual Device Driver Layer

#

The virtual device serves as the interface presented to the operating system and application software.

Unlike traditional drivers, it does not directly control hardware resources such as:

• DMA engines
• PHY devices
• Interrupt controllers

Instead, it acts as a management layer for the underlying physical interfaces.

Responsibilities

#

The virtual device:

• Aggregates two physical NICs
• Presents a single logical interface
• Maintains one IP address
• Maintains one MAC address
• Routes outgoing traffic through the active master NIC

MAC Address Management

#

During initialization:

1. The driver reads the MAC address from one physical NIC.
2. The address is assigned to the virtual interface.
3. Both physical interfaces are synchronized to use the same MAC address.

This ensures network transparency and eliminates address conflicts.

Upper-Layer Configuration

#

All network configuration is applied only to the virtual interface:

• IP address
• Netmask
• Gateway
• Routing configuration

Applications remain completely unaware of the underlying redundancy mechanisms.

🔄 Virtual Protocol Layer

#

A custom protocol layer is attached to both physical network devices using the VxWorks muxBind() interface.

This layer continuously monitors the health and state of each physical interface.

Core Callback Functions

#

These callbacks allow the driver to react immediately to network events without introducing application-level polling delays.

🚀 Initialization Workflow

#

System startup follows a structured initialization sequence.

Step 1: Initialize Physical Drivers

#

Each Intel i210 driver is initialized independently and registered with the MUX framework.

Step 2: Synchronize Network Identity

#

Both physical interfaces are configured to share:

• Common MAC address
• Redundancy state information

Step 3: Register the Virtual Interface

#

The virtual redundant device is created and registered with the MUX layer.

Step 4: Attach to the TCP/IP Stack

#

The logical interface is connected to the networking stack using:

ipAttach()

Step 5: Establish Roles

#

The first healthy interface detected becomes:

Master

while the remaining interface becomes:

Backup

🔁 Redundancy Switching Mechanism

#

The failover system relies on two state variables maintained for each physical interface.

Interface Status

#

Each NIC is classified as:

• Normal
• Disconnected
• Error

Interface Role

#

Each NIC is assigned one of two roles:

• Master
• Backup

⚡ Failover Logic

#

When a fault occurs:

1. Link-down or error event is detected.
2. Interface status is updated.
3. If the failed interface is the master:
   • Backup health is verified.
   • Backup becomes the new master.
4. Traffic immediately begins flowing through the new active interface.

The transition is entirely automatic.

No application restart or network reconfiguration is required.

📡 Gratuitous ARP Handling

#

After a role transition, the driver transmits a Gratuitous ARP packet through the newly active interface.

This updates:

• Switch forwarding tables
• ARP caches
• MAC learning entries

As a result, network infrastructure quickly redirects traffic toward the new active path.

This significantly reduces convergence time following a failover event.

📨 Packet Transmission Flow

#

Outgoing traffic follows a straightforward path:

Application
      │
      ▼
TCP/IP Stack
      │
      ▼
 muxSend()
      │
      ▼
Virtual Driver
      │
      ▼
Master Physical NIC
      │
      ▼
Ethernet Network

The virtual driver determines which physical interface is currently active and forwards packets accordingly.

📥 Packet Reception Flow

#

Incoming traffic is handled through the protocol layer.

Physical NIC
      │
      ▼
Interrupt Handler
      │
      ▼
Physical Driver
      │
      ▼
stackRcvrRtn()
      │
      ▼
Virtual Device
      │
      ▼
TCP/IP Stack

Traffic Handling Rules

#

Unicast Traffic

#

Once network switches learn the active MAC location, unicast packets arrive only through the active master interface.

Broadcast and Multicast Traffic

#

Broadcast and multicast traffic may arrive through both interfaces.

The virtual protocol layer:

• Filters duplicates
• Aggregates valid frames
• Prevents redundant delivery

This ensures consistency without packet duplication.

📊 Performance Validation

#

A comprehensive test environment was built to evaluate failover performance.

Test Configuration

#

The client transmitted UDP packets every:

1 millisecond

Nine failover events were introduced by manually disconnecting and reconnecting network cables.

📈 Test Results

#

More than:

100,000 packets

were analyzed during testing.

The results demonstrated:

• No communication interruption
• No measurable packet loss
• Stable packet intervals
• Consistent failover performance

Switching Performance

#

All failover events completed in:

Less than 10 milliseconds

This significantly outperforms typical application-layer redundancy approaches that depend on periodic monitoring and reconfiguration.

✅ Key Advantages

#

Transparency

#

Applications interact with a single network interface.

No changes are required to:

• User applications
• Protocol stacks
• Existing network services

Fast Recovery

#

Driver-level failover eliminates delays associated with:

• Polling loops
• Network reconfiguration
• Application restarts

Hardware Independence

#

The design does not require modifications to existing physical drivers.

Although validated using Intel i210 controllers, the architecture can be adapted to:

• Intel NICs
• Broadcom NICs
• Realtek NICs
• Other END-compliant drivers

Resource Efficiency

#

The implementation leverages existing VxWorks components:

• SENS
• END drivers
• MUX framework

without requiring invasive kernel modifications.

Improved Reliability

#

The solution supports:

• Automatic failover
• Hot-plug recovery
• Continuous communication
• High-availability networking

🔮 Future Enhancements

#

Several opportunities exist for expanding the design.

Potential enhancements include:

Multi-NIC Redundancy

#

Extending support beyond two interfaces to:

N-way redundancy groups

for larger fault-tolerant systems.

Network Management Integration

#

Adding support for:

• SNMP monitoring
• Telemetry reporting
• Health analytics

to improve operational visibility.

Industrial Redundancy Protocols

#

Integration with standards such as:

• PRP (Parallel Redundancy Protocol)
• HSR (High-availability Seamless Redundancy)

could further enhance reliability in industrial environments.

Advanced Fault Detection

#

Additional monitoring techniques could include:

• Heartbeat packets
• Watchdog supervision
• Link quality analysis
• PHY diagnostics

to accelerate fault identification and recovery.

🏁 Conclusion

#

Implementing redundancy at the driver level provides an elegant and highly effective solution for high-availability networking in embedded systems.

By combining a virtual network device with a custom protocol layer, VxWorks can transparently aggregate multiple physical Ethernet interfaces into a single logical connection while delivering rapid failover and uninterrupted communication.

The architecture offers:

• Sub-10 ms failover performance
• Hardware independence
• Full compatibility with existing applications
• Minimal implementation overhead
• Strong fault tolerance

For aerospace, defense, transportation, marine, and industrial control systems where communication continuity is critical, this approach demonstrates how VxWorks’ modular networking framework can be leveraged to build highly reliable networking infrastructure without sacrificing performance or maintainability.