Timing verification and deterministic bus testing in ARINC 429 ground test systems

Timing verification on ARINC 429 spans three scales: bit and word-gap timing in microseconds, per-label transmit intervals in milliseconds, and the uncertainty on top of both. This note compiles physical-layer tolerances from manufacturer documents, derives word time, bus load and worst-case delay, and compares software and hardware timing, fault injection and loopback against an uncertainty budget.

Scope and sources

The ARINC 429 specification is a paid, copyrighted document [1]. No clause numbers are cited here; values come from vendor tutorials that summarise the specification [1], [2] and from component documents that implement it [3], [4]. A “ground test system” is the rig that stimulates, monitors and times the device under test (DUT): interface cards, a time reference, an independent monitor and recording software.

Physical layer: the parameters that set timing

ARINC 429 is simplex: one transmitter and at most 20 receivers share a shielded twisted pair [1], [2]. Encoding is bipolar return-to-zero (RZ): a 1 is a pulse to about +10 V in the first half of the bit, a 0 a pulse to −10 V, and every bit returns to NULL, so no clock line is needed; word boundaries come from the NULL gap [1].

At the transmitter the differential levels are +10 V ± 1 V (HIGH), 0 V ± 0.5 V (NULL) and −10 V ± 1 V (LOW); receivers must accept ONE at +6.5 to +13 V, NULL within ±2.5 V and ZERO at −6.5 to −13 V [1], [3]. Source impedance is 75 Ω ± 5 Ω, receiver input impedance at least 8 kΩ, and the voltage seen at a receiver depends on line length, stubs and receiver count [1].

Table 1. ARINC 429 timing parameters

The low-speed rows cross-check. With

12 kbit/s gives 83.3 μs and 14.5 kbit/s gives 69.0 μs; the half-bits are 41.7 μs and 34.5 μs, exactly the 34.5–41.7 μs range in the datasheet [3]. At low speed the sources give a rate range 16 to 21% wide rather than a percentage, but not the same range: 12 to 14.5 kbit/s [1], [3] versus 12.5 to 14.5 kbit/s [2]. One oscilloscope mask application takes the 12.5 kbit/s half-bit as 38.0 to 42.0 μs [8], which rejects the 34.5 μs half-bit of valid 14.5 kbit/s traffic. A test plan must name its definition and test both ends of the range. At high speed the bit-rate tolerance is ±1% [1], [3] and the single-bit-time tolerance ±2.5% [1], [2]. The secondary sources do not say how the two relate; a plausible reading is a tight average with looser individual periods, but as this is unconfirmed against the specification, apply both as separate criteria.

Word structure

A word has 32 bits: bits 1–8 label (written in octal), 9–10 source/destination identifier (SDI), 11–29 data, 30–31 sign/status matrix (SSM), 32 odd parity [1], [2]. The label goes out first, most significant bit first (bits 8 down to 1), then bits 9 to 32 [1]. In BNR, bit 29 is the sign and the value is a two's-complement fraction; in BCD each digit takes four bits; for BNR, SSM 11 means normal operation and 00 failure warning [1], [2].

For timing, a receiver knows the label after 8 bits but parity only after bit 32, and the point where a word is timestamped must be defined. IRIG 106 Chapter 10 stores, for each ARINC 429 message, the time from the start of the previous word to the start of this word, in 0.1 μs steps within a 20-bit field [7]. Start-of-word stamps are independent of bit rate; end-of-word stamps are not: across the low-speed range, 32 bits take 2.667 ms at 12 kbit/s and 2.207 ms at 14.5 kbit/s, a 460 μs shift.

What timing verification covers

Bit rate and bit time

Bit rate, individual bit period, pulse width and edge times can only be measured on the waveform. Clean reception by a card proves nothing about compliance: one receiver datasheet accepts bits spaced 8 to 12 samples apart at 1 MHz, i.e. 83–125 kbit/s at high speed and 10.4–15.6 kbit/s at low speed [3]. That window is 17 to 25 times the ±1% transmit tolerance, although the same document's summary claims out-of-tolerance signals are rejected; real acceptance limits must be measured. The same device requires a 1 MHz ± 1% reference [3]; if bit timing is derived from that clock, its error is the bit-rate error, and the entire ±1% high-speed budget is gone. An FPGA core asks for ±0.01% for the same job [4].

Averaging over the 31 T_b between the first and last leading edges gives a per-bit resolution of 2q/31 ≈ 0.65 ns at q = 10 ns quantisation; edge detection, not the counter, becomes the limit.

Word gap

Words must be separated by at least 4 bit times of NULL [1], [4]. The requirement is in bit times: 4 T_b is 333 μs at 12 kbit/s, 320 μs at 12.5 and 276 μs at 14.5. A transmitter that generates the gap with a fixed 330 μs timer leaves 4.1 bits at 12.5 kbit/s and passes, but 3.96 bits at 12 kbit/s and fails. A receiver that waits for an absolute 320 μs rejects valid traffic at 14.5 kbit/s. Neither shows at nominal rate.

The measurement definition matters too. Two independent transmitter datasheets implement the gap the same way: one specifies a bit as 10 clocks, its NULL half as 5 clocks and the gap as 40 clocks (40 μs at 1 MHz) [3]; the other specifies, at 100 kbit/s, a 39.6–40.4 μs gap after the 5 μs NULL half and 36 bit times per word [14]. Either way the continuous NULL on the line is about 45 μs (4.5 T_b). Neither says where the specification measures the gap, so whether a visible NULL of exactly 4 T_b complies cannot be settled from secondary sources; an oscilloscope test must state whether its limit is 4 or 4.5 T_b. According to the first document, the receiver samples for NULL once per bit time after the last bit and enables the next reception when the count reaches 3 [3], which suggests it may accept gaps shorter than 4 bits; this needs confirming by measurement. Gap violations are injected to test the DUT receiver; the DUT transmitter's gap is verified independently.

Per-label transmit interval

The data standard tables of the specification list, for each parameter, a minimum and maximum transmit interval and, for some labels, a maximum transport delay [1], [2]. Tutorial examples give 100–200 ms for airspeed and 250–500 ms for BCD latitude (label 010) [2], but test limits come from the DUT's interface control document (ICD). One hardware study found a unit transmitting more messages than the standard assigned to it [9]; the gap between ICD and actual traffic is part of what gets verified.

Let t_k be the timestamp of the k-th transmission of a label and e_k its deviation from the ideal schedule:

The pass criterion is T_min ≤ min Δ_k and max Δ_k ≤ T_max, with both extremes taken over the whole record. A missing word pushes Δ to about 2T: invisible in the mean, obvious in the maximum. Equation (2) also shows that a transmitter held within ±J of its schedule can produce an interval spread 4J wide.

Timestamps: resolution, uncertainty, rollover

Resolution is one counter step; uncertainty adds clock frequency error, the variability of the stamped event and whether stamping happens in hardware or software. On one interface card the timestamp is a 32-bit counter derived from a 66 MHz clock, with a default increment of 10 μs, adjustable from 1 μs to 1 s [5]; another card offers a selectable range and resolution [6]. A 32-bit counter rolls over after 71.6 minutes at 1 μs and 11.9 hours at 10 μs, so overnight runs need wrap-around handling. The IRIG 106 gap field tops out at 2²⁰ × 0.1 μs = 104.86 ms [7]; across longer silences intervals must be rebuilt using packet header time. Intervals rebuilt by summing successive gaps also accumulate rounding error; absolute stamps from a free-running counter do not.

Derivations: word time, bus load, delay

With a minimum gap, one word occupies 360 μs at high speed and 2.88 ms at 12.5 kbit/s, the same figures an interface card manual gives [5]. Maximum word rate is 2778 words/s at high speed and 333 to 403 words/s at low speed. For a periodic schedule the bus load is

where n_i labels share the scheduled period T_i, chosen inside the ICD window with margin at both ends.

Table 2. Bus load for a hypothetical refresh plan

The same plan uses a quarter of a high-speed bus and cannot be carried at low speed at all (174% even at 14.5 kbit/s). Because a transmitter cannot abort a word, a scheduled word waits for the word in progress plus N_q words queued ahead:

At high speed, single-word blocking is 360 μs; with 20 words queued ahead it is 7.56 ms. One card's high-priority asynchronous mode transmits “immediately upon completion of current transmission” [5], so even the highest priority can be blocked for up to 36 T_b. Because the delay is one-sided (0 to D_max), this term alone gives Δ_min = T − D_max and Δ_max = T + D_max, equivalent to J = D_max/2 in (2); other jitter sources add to it. A 10 ms minor frame holds at most ⌊10 ms / 360 μs⌋ = 27 high-speed words; anything beyond spills into the next frame and distorts intervals systematically.

Deterministic testing: software versus hardware timing

Jitter sources in software timing

A “write a word every 50 ms” loop on a general-purpose OS picks up jitter from three places. Timer granularity: Windows timer resolution is requested in milliseconds, and on Windows 11 an invisible window-owning process is not guaranteed better than the default [11]; minimising the test window can change timing. Scheduling latency: on a server with 24 isolated cores and interference load on the remaining cores, cyclictest maximum latency was reported as 104 μs on stock Linux and 48 μs with PREEMPT_RT [10]. Driver path: the transmitter sends a word as soon as it appears in the FIFO [3], [4], so bus timing inherits the jitter of the software write.

The same study notes that with a longer wake-up period interference is less likely to coincide with a wake-up, so the worst case measured at long periods understates the true one [10]. If an event occurs in a given interval with probability p, the probability of seeing it at least once in N intervals is

For p = 10⁻⁵ and P = 0.95, N ≈ 3.0 × 10⁵, or 8.3 hours for a 100 ms label. A few-minute acceptance run will very likely miss a violation at that rate.

Hardware (FPGA) scheduling and timestamping

With a hardware scheduler, transmit instants come from a counter clocked by the board oscillator; software only updates the schedule and the data. One card specifies 100 μs scheduler resolution, 256 labels per channel and 16 double-buffered minor frames [5]. Determinism means the same inputs reproduce the same bit-level timeline; fine resolution is a separate property. Repeatability is testable: run the same schedule twice from the same trigger and compare the monitor's timestamps word by word; differences should reflect only quantisation and clock offset.

On the receive side the timestamp should be latched in hardware at the threshold crossing of the first bit, from a counter driven by an external reference (for example 10 MHz), so that quantisation and frequency error become known quantities. A stamp taken when software reads the FIFO includes interrupt and read latency and FIFO fill level, and cannot measure transmit intervals.

Repeatable fault injection

Each fault's timing and form must be defined in the hardware schedule and its occurrence on the line recorded by an independent monitor; otherwise “not detected” cannot be told apart from “never generated”.

Table 3. Fault types, generation and independent confirmation

Commercial cards generate rate and parity faults easily, but edge time and amplitude are usually limited to a few fixed settings. Sweeps call for bit-level synthesis on an arbitrary waveform generator, whose fidelity to the 75 Ω source condition must then be checked.

Loopback self-verification

In internal loopback a transceiver connects its transmitter to its receivers on-chip and holds the line driver outputs at NULL [3]. Logic and FIFOs are exercised; the line driver, analogue input, cable and connector are not. In external loopback the transmitter is cabled to a receiver, and some cards compare transmitted and received words in hardware [5]. But if transmit timing and receive timestamps come from the same oscillator, its frequency error cancels in every measured interval: a card running 100 ppm fast measures its own 100 ms as exactly 100 ms. Loopback proves function and repeatability, not absolute timing.

Receiver loading and cable effects

With 20 receivers at 8 kΩ each, R_p = 400 Ω and the differential voltage at the receivers is

One transmitter datasheet specifies its high-speed supply current into exactly a 400 Ω differential load [3]. Ignoring cable resistance, this leaves 1.9 V of margin above the 6.5 V minimum; with the transmitter at 9 V the receiver sees 7.6 V. At 20 pF per receiver [3], 20 receivers add 400 pF, a 30 ns time constant with 75 Ω, negligible next to a 1.5 μs edge; the term that matters is cable capacitance:

C is the total differential capacitance of cable (from its datasheet) and receivers; this first-order estimate ignores reflections, which must be measured on long runs. Most systems stay under 150 ft; 300 ft or more is possible [1].

In a hardware-in-the-loop simulator, NULL-to-HIGH slopes of two transmitters were measured at 5.05 V/μs and 0.937 V/μs, and receivers accepted both; the authors stress that the bus's electrical behaviour differs with cable length and receiver count in every configuration [9]. Assuming a 10 V swing and a 10–90% definition, these correspond to rise times of roughly 1.6 μs and 8.5 μs; the paper does not state the bus speed, so the applicable tolerance is unclear.

Error and uncertainty budget

If each of two timestamps carries a quantisation error uniformly distributed over width q, their difference follows a triangular distribution of half-width q [12]:

A timebase with frequency error ±ε misreads an interval Δ by ±εΔ; assuming a uniform distribution, u_f = εΔ/√3 [12]. On a linear edge the threshold-crossing delay is (the 10–90% time spans 80% of the swing)

At high speed with t_r = 1.5 μs and V_A = 10 V, a threshold anywhere between 2.5 and 6.5 V is crossed after 0.47 to 1.22 μs; at 8.4 V amplitude the upper value becomes 1.45 μs; at low speed (t_r = 5–15 μs) the range is 1.6 to 12.2 μs. For consecutive words from one transmitter this largely cancels, leaving noise over slope: for a 5.3 V/μs slope and an assumed 50 mV rms noise, about 9 ns per crossing and 13 ns (×√2) for the difference of two stamps. When different sources are compared, the whole term enters the uncertainty. Combined uncertainty is u_c = √(Σu_i²) and expanded uncertainty U = ku_c with k = 2 [12].

Table 4. Uncertainty budget for a 100 ms label interval (same source, high speed)

The 100 ppm example is an FPGA core's ±0.01% clock tolerance [4]; use each card's documented value. The software bound is the largest value reported for stock Linux under load [10]; driver and USB/PCIe latency are excluded, so it is a lower bound.

Against millisecond limits, 14 μs or even 120 μs of uncertainty rarely changes a verdict; what matters is whether the worst case was captured. At the microsecond scale the picture reverses: measuring a 40 μs gap with a 10 μs timestamp means ±10 μs, a 25% error. Gap and bit timing belong on an oscilloscope or an FPGA capture sampling at tens of MHz. For comparison, the oscilloscope in one study sampled at 12.5 MHz [9], about 19 samples across a 1.5 μs edge. Near a limit the decision rule must be stated. Under simple acceptance a result at the limit can carry up to a 50% chance of a wrong decision; under guarded acceptance with guard band w = U, the smallest measured interval must exceed T_min + U and the largest must stay below T_max − U [13].

Verification equipment and traceability

Oscilloscope with ARINC 429 decode. Probed differentially with an active probe, it shows amplitude, overshoot, ringing and edge timing through eye-diagram and pulse masks for ones, zeros and NULL [8]. Limited memory makes it unsuitable for hours of interval statistics.

Independent monitor. A listen-only unit separate from the stimulus, preferably on a different clock, records every word with a hardware timestamp and parity and format flags. An IRIG 106 Chapter 10 record carries, per word, gap time, bus speed, parity error, format error and bus number [7].

Reference clock. Tying stimulus card, monitor and scope to a common 10 MHz reference, and ideally a common time code, puts their timestamps on one scale. Transport delay can only be measured this way: the instant a stimulus is applied and the instant the label first carries the new value are stamped by the same clock.

Report traceability. The report lists serial numbers and calibration certificates, reference source and accuracy, software and firmware versions, the schedule table, cable length and receiver count, raw records with hashes, and an uncertainty budget and decision rule per measurement. The specification is said to include an appendix on laboratory verification of the electrical characteristics [1]; procedures should trace to it and to the ICD.

Common mistakes

• Looking at the mean refresh period. The mean confirms the plan, not the ICD limit; a missing word appears only in the maximum Δ.
• Trusting software timestamps. Tails of hundreds of microseconds have been reported under load [10].
• Testing the word gap only at nominal rate. Fixed-duration timer faults appear at the ends of the low-speed range.
• Treating acceptance by a commercial receiver as compliance. Acceptance windows are wide [3], [9].
• Counting internal loopback as a physical-layer test [3], and claiming timing accuracy from a common-clock loopback.
• Short records. By (6), a rare violation may take hours to observe.
• Measuring only at the transmitter and leaving the timestamp point undefined; at low speed start- and end-of-word stamps differ by hundreds of μs.

Where it gets hard in practice

The difficulty lies in the rig, not the method. Generators that sweep edge time and amplitude are scarce, and arbitrary waveform generators bring their own impedance and symmetry to verify. A monitor and stimulus from the same vendor can share one interpretation error. Long records need rollover handling and synchronisation that holds for the whole run. The values here come from secondary sources and do not replace the current specification in an acceptance test.

References

1. AIM GmbH, “ARINC 429 Specification Tutorial,” version 2.2, 2019. https://www.aim-online.com/wp-content/uploads/2019/07/aim-tutorial-oview429-190712-u.pdf
2. GE Intelligent Platforms, “ARINC Protocol Tutorial,” GFT-639A, 2010. https://www.psirep.com/system/files/arinc_protocol_tutorial_wp_gft639a_16.pdf
3. Holt Integrated Circuits, “HI-3593 3.3V ARINC 429 Dual Receiver, Single Transmitter with SPI Interface,” DS3593 Rev. F, March 2018. The current revision on the manufacturer's site requires registration, so the Rev. F copy hosted on the TI E2E forum was used: https://e2e.ti.com/cfs-file/__key/communityserver-discussions-components-files/908/3593_5F00_F.pdf; product page: https://www.holtic.com/products/3026-hi-3593.aspx
4. Microsemi (Microchip Technology), “HB0088: Core429 v3.12 Handbook,” Rev. 6, April 2016. https://ww1.microchip.com/downloads/aemdocuments/documents/fpga/ProductDocuments/SupportingCollateral/core429_hb.pdf
5. United Electronic Industries, “DNx-429-516 ARINC 429 Board User Manual,” 2019. https://www.ueidaq.com/uploads/dnx-429-516-manual.pdf
6. Pickering Interfaces, “41-429 ARINC 429 Interface Module,” datasheet, 2012. https://www.pickeringtest.com/portal/web/256/content/downloads/datasheets/41-429D.pdf
7. IRIG 106 Chapter 10 Handbook, “ARINC 429 Data,” 2014. https://www.irig106.org/wiki/ch10_handbook:arinc_429_data
8. Keysight Technologies, “ARINC 429 Eye-diagram and Pulse-shape Mask Testing,” 5990-9325EN, 2018. https://www.keysight.com/content/dam/keysight/en/doc/gate/application-notes/5990-9325.pdf
9. C. Trask et al., “ARINC 429 Cyber-vulnerabilities and Voltage Data in a Hardware-in-the-Loop Simulator,” arXiv:2408.16714, 2024. https://arxiv.org/abs/2408.16714
10. Z. Deng et al., “Interference-free Operating System: A 6 Years' Experience in Mitigating Cross-Core Interference in Linux,” arXiv:2412.18104, 2024. https://arxiv.org/abs/2412.18104
11. Microsoft, “timeBeginPeriod function (timeapi.h),” Microsoft Learn. https://learn.microsoft.com/en-us/windows/win32/api/timeapi/nf-timeapi-timebeginperiod
12. JCGM 100:2008, “Guide to the expression of uncertainty in measurement,” BIPM, 4.3.7, 4.3.9, 5.1.2, 6.2.1. https://www.bipm.org/documents/20126/2071204/JCGM_100_2008_E.pdf
13. JCGM 106:2012, “The role of measurement uncertainty in conformity assessment,” BIPM, 8.3. https://www.bipm.org/documents/20126/2071204/JCGM_106_2012_E.pdf
14. Renesas Electronics, “HS-3282 CMOS ARINC Bus Interface Circuit,” FN2964 Rev. 2.02, 2022. https://www.renesas.com/en/document/dst/hs-3282-datasheet