High-integrity Real-time Systems Research Articles

A deterministic run-time environment for Ada-05 on the ATmega16 microcontroller

Microcontrollers account for more than 90% of total microprocessors sold, yet their capabilities are seldom explored in computer science courses. A simple 8-Bit microcontroller can be used in a computer language programming course to facilitate the study of computer architecture and fundamental programming concepts. Through hands-on experience, students can appreciate using a computer language such as Assembly or ADA to develop applications for embedded devices. ADA is not often used in small embedded systems because of ADA's high overhead. We can overcome this problem by using a subset of ADA, such as the Ravenscar Profile. The goal of this paper is to describe how ADA can be used to develop high-integrity real-time systems supporting the Ravenscar tasking model of ADA-05 on the Atmel AVR ATmega16 microcontroller.

Temporal isolation with the ravenscar profile and Ada 2005

Modern methodologies for the development of high-integrity real-time systems build on abstract representations or models instead of code artifacts. Since analysis techniques are applied to models, it is important that system properties asserted during the analysis and the assumptions made for the analysis to hold are preserved across implementation and execution. In this paper we contend that the extent of properties preservation we require cannot be warranted using exclusively the language constructs allowed by the Ravenscar Profile. Hence, in the light of the new Ada 2005 features, we propose the formalization of a new augmented profile, fit for the purpose and yet still adhering to the pristine Ravenscar rationale.

Architecture description languages for high-integrity real-time systems

Safety-critical systems, such as those in the avionics, automotive, power, space, and medical industries, are predominantly driven by real-time embedded software and are often referred to as high-integrity real-time systems (HIRTS). In these systems, safety is of paramount importance. Safety is broadly defined as freedom from accidents and loss. When no safe alternative to normal service exists, a system must be dependable to be safe, that is, it must have reliable ways to deliver a certain quality of service. Our collaborations with industrial partners have focused on HIRTS modeling techniques. Initially, we explored the potential benefits that the most successful software architecture and modeling approaches could bring to the safety-critical domain. We subsequently designed the architecture information modeling language. AIM lets us exploit the available technologies from the same platform and thus provide stronger support for the safety case. A safety case, a key element in HIRTS certification, typically consists of a high-level argument and supporting evidence. The HLA sets the principles on which the design is based and reasons why the design should satisfy the safety requirements.

An approach to formal verication of real time concurrent Ada programs

The SPARK system provides static analysis tools for a highly restricted sequential Ada subset, including a proof checking tool for verifying partial correctness properties. Recently, SPARK Ada has been extended to include much of the Ravenscar Tasking Pro le which supports construction of high integrity real time systems. However, the veri cation machinery has not been changed, and can only handle purely sequential properties of the code. This paper sketches an approach to reasoning about the concurrent and real-time aspects that SPARK cannot handle. The approach involves compiling an abstract model of the Ada program that can be embedded in a general purpose theorem prover (e.g. PVS). The compilation makes heavy use of SPARK's existing static analysis tools.

Execution-time clocks and Ravenscar kernels

The kind of high-integrity real-time systems to which the Ada Ravenscar profile is targeted often require overrun detection for enhanced reliability in the time domain Execution-time clocks and timers have been proposed to fulfill this need, but only programming patterns based on asynchronous transfer of control, and thus incompatible with the profile, have been provided up to now. In this paper an assessment of the compatibility of the proposed execution-time mechanisms with the Ravenscar profile is made, and some programming patters for using them are proposed. The patterns are intended to provide basic overrun detection and handling capabilities to high-integrity real-time systems.

Code analysis of saftey-critical and real-time software using ASIS

The Ravenscar Profile is a restricted tasking profile that supports applications requiring separate threads of control yet would satisfy the certification requirements of high-integrity (safety-critical) real-time systems. If the Ravenscar Profile were to be used for systems having safety-critical and real-time requirements, it would be valuable to demonstrate that the application satisfies the restrictions. Code analysis is an important technique to support this demonstration. Ada Semantic Interface Specification (ASIS) based tools provide an excellent capability for the automatic identification of violations to that set of the Ravenscar Profile restrictions, which can be determined through static code analysis. All but one of these restrictions can be identified using static code analysis using ASIS. This paper provides an approach to building such an ASIS-based tool. This tool might promote the use of automatic tools for the analysis of the Ravenscar Profile and other tasking profiles to support safety-critical and real-time requirements. This paper should be viewed as work in progress.

Tasking profiles (session summary)

The objective of this session was to identify one or more restricted tasking profiles that would satisfy the certification requirements of high-integrity (safety-critical) real-time systems. Such a profile would also be likely to offer improved performance. Consideration was not given to the sequential parts of the language as they are being addressed by the HRG (annex H Rapporteur Group).