Dependable Real-time Systems Research Articles

Towards a standard-based model of system dependability requirements

System dependability is a quality factor indicates that system is able to provide trusted services and system failures will not cause catastrophic or unexpected events. The identification of dependability requirements help to develop dependable real-time critical systems in order to build the user's trust. The review of literature shows that there is no standard-based model that captures dependability requirements for all types of real-time critical systems. This paper presents a standard-based model for capturing system dependability requirements of real-time critical systems by identifying dependability requirements using the concepts existing in ISO25010 and ISO19761 international standards. Further, this paper presents an approach that demonstrates the practical steps needed to build a dependability requirements model. An experiment is conducted using the requirements specifications of an aircraft control system is presented to verify the applicability of the proposed standard-based model to model the required dependability requirements of such real-time system.

Exploiting primary/backup mechanism for energy efficiency in dependable real-time systems

Abstract Primary/Backup has been well studied as an effective fault-tolerance technique. In this paper, with the objectives of tolerating a single permanent fault and maintaining system reliability with respect to transient faults, we study dynamic-priority based energy-efficient fault-tolerance scheduling algorithms for periodic real-time tasks running on multiprocessor systems by exploiting the primary/backup technique while considering the negative effects of the widely deployed Dynamic Voltage and Frequency Scaling (DVFS) on transient faults. Specifically, by separating primary and backup tasks on their dedicated processors, we first devise two schemes based on the idea of Standby-Sparing (SS): For Paired-SS, processors are organized as groups of two (i.e., pairs) and the existing SS scheme is applied within each pair of processors after partitioning tasks to the pairs. In Generalized-SS, processors are divided into two groups (of potentially different sizes), which are denoted as primary and secondary processor groups, respectively. The main (backup) tasks are scheduled on the primary (secondary) processor group under the partitioned-EDF (partitioned-EDL) with DVFS (DPM) to save energy. Moreover, we propose schemes that allocate primary and backup tasks in a mixed manner to better utilize system slack on all processors for more energy savings. On each processor, the Preference-Oriented Earliest Deadline (POED) scheduler is adopted to run primary tasks at scaled frequencies as soon as possible (ASAP) and backup tasks at the maximum frequency as late as possible (ALAP) to save energy. Our empirical evaluations show that, for systems with a given number of processors, there normally exists a configuration for Generalized-SS with different number of processors in primary and backup groups, which leads to better energy savings when compared to that of the Paired-SS scheme. Moreover, the POED-based schemes normally have more stable performance and can achieve better energy savings.

Modular formal analysis of the central guardian in the Time-Triggered Architecture

The Time-Triggered Protocol TTP/C constitutes the core of the communication level of the Time-Triggered Architecture for dependable real-time systems. TTP/C ensures consistent data distribution, even in the presence of faults occurring to nodes or the communication channel. However, the protocol mechanisms of TTP/C rely on a rather optimistic fault hypothesis. Therefore, an independent component, the central guardian, employs static knowledge about the system to transform arbitrary node failures into failure modes that are covered by the fault hypothesis. This paper presents a modular formal analysis of the communication properties of TTP/C based on the guardian approach. Through a hierarchy of formal models, we give a precise description of the arguments that support the desired correctness properties of TTP/C. First, requirements for correct communication are expressed on an abstract level. By stepwise refinement we show both that these abstract requirements are met under the optimistic fault hypothesis, and how the guardian model allows a broader class of node failures to be tolerated. The models have been developed and mechanically checked using the specification and verification system PVS.

Temporal composability [real-time embedded systems

The constructive design of dependable distributed real-time systems out of pre-validated components requires precise interface specifications of the components in the temporal domain and in the value domain. This paper focuses on the temporal specification of interfaces in composable distributed real-time systems and establishes four principles of composability (independent development of nodes, stability of prior services, performability of the communication system, and replica determinism). It presents the temporal firewall interface that forms a fully specified operational interface of a component. The paper explains how the temporal firewall interface supports the four principles of composability. It then classifies interfaces from the point of view of composability and shows how these interfaces correspond to the time-triggered and event-triggered communication paradigms.

Formal validation of fault-tolerance mechanisms inside GUARDS

Abstract In this paper we report the experiments carried out during the specification and validation of the fault-tolerance mechanisms developed in the European project Generic Upgradable Architecture for Real-time Dependable Systems (GUARDS). These mechanisms are the components of an architecture developed for embedded safety-critical systems. The validation approach is based on model-checking techniques and exploits the verification methodology supported by the Just Another Concurrency Kit (JACK) environment. The properties that guarantee the desired behaviour of the mechanisms are specified as temporal logic formulae; the JACK model-checker is then used to verify that the behaviour of the mechanisms satisfy such properties also in the presence of faults.

Replica determinism and flexible scheduling in hard real-time dependable systems

Fault-tolerant real-time systems are typically based on active replication where replicated entities are required to deliver their outputs in an identical order within a given time interval. Distributed scheduling of replicated tasks, however, violates this requirement if on-line scheduling, preemptive scheduling, or scheduling of dissimilar replicated task sets is employed. This problem of inconsistent task outputs has been solved previously by coordinating the decisions of the local schedulers such that replicated tasks are executed in an identical order. Global coordination results either in an extremely high communication effort to agree on each schedule decision or in an overly restrictive execution model where on-line scheduling, arbitrary preemptions, and nonidentically replicated task sets are not allowed. To overcome these restrictions, a new method, called timed messages, is introduced. Timed messages guarantee deterministic operation by presenting consistent message versions to the replicated tasks. This approach is based on simulated common knowledge and a sparse time base. Timed messages are very effective since they neither require communication between the local scheduler nor do they restrict usage of on-line flexible scheduling, preemptions and nonidentically replicated task sets.

Editorial: special section on dependable real-time systems

VER time, the discipline of computing systems has evolved and expanded in a multifaceted manner to cover many distinct and (sometimes) disparate streams. These encompass themes in system architecture, performance modeling, real-time, and fault tolerance, among several others. Many of these areas (fortunately or unfortunately?) have evolved separately and become established as discrete fields, although the overall design of computers and applications still, and inherently, involves their synergistic association. To open a topic of debate: This synergism is often lacking or, if present, not particularly acknowledged as coming from the pertinent area and, at times, reinvented. Among the offshoots of the broad discipline of computing systems, fault tolerance and real-time, in particular, are increasingly being viewed as areas with potential for synergy. The concept of fault tolerance is expanding in scope to address the broader area of dependability: reliability, performability, availability, safety, the consideration of temporal properties in defining “correct” services towards the goal of reliably delivering desired services at specified times. Similarly, the real-time community is increasingly incorporating notions of dependability within its definitions of provision of timely services. Realistically, the entire range of current system designs is reaching a complexity level that necessitates joint consideration of fault tolerance and real-time features, regardless of which gets primary emphasis. Examples abound: communication networks, transaction processing, and flight, industrial, medical, or automotive control all clearly require consideration of both dependability and timeliness. It is of interest to note that the two communities tackle largely overlapping sets of problems which can be broadly stated as: “assured delivery of correctly executed services” and constraints, i.e., “resource management, guarantees, and efficiency.” Interestingly, the fields of fault tolerance and real-time address these problems with different perspectives and aim at optimizing different sets of objectives within the same problems. For example, the fault tolerance emphasis involves reliability of the mechanisms providing for delivery of correctly executed services; the real-time community puts the emphasis on guaranteeing delivery of services in a timely manner. Similarly, resource management issues are addressed as redundancy management issues, versus issues of efficient use of uniprocessor/multiprocessors for task allocation from the realtime systems perspective. It is actually quite a long list of issues that get addressed differently by the fault-tolerant and real-time viewpoints. Moreover, the two fields rely on very similar fundamentals and techniques from engineering, mathematics, and theory. Indeed, at times this fosters a very healthy development of ideas and solutions from varied perspectives; often enough, it involves reinventing the wheel. Both the disciplines of fault tolerance and real-time have matured, with their individual seminal contributions, development of terminology, and conceptual basis. Perhaps this maturity now fosters a better chance in understanding complementary issues which have, over time, been developed with different perspectives, emphasis, and presentation. However, as they do tackle the common problem of “assured delivery of correctly executed services,” it is the intent of this special issue to address and encourage the integration of these two (perceived?) diverse areas toward a cohesive formulation of dependable real-time service and systems. In many ways, the notion and popularity of the term “Quality of Service (QoS)” already represents the juxtaposition of many fault-tolerant and real-time services. This special issue on dependable real-time systems endeavors to develop the area of systems with composite attributes of real-time and dependability within a common framework. The thrust is on understanding system models, identifying issues and concepts used across both communities for design and analysis, and elucidating the context and relevance of concepts synergistically across the areas of dependability and real time. The flavor of this special issue is both theoretical and experimental in scope to expand the underlying principles of the areas of both dependability and real-time. We paraphrase some topics from the call for papers which we believe depict some of the areas where there is significant work needed to link the fields of dependability and real-time. These include (in part):

GUARDS: a generic upgradable architecture for real-time dependable systems

The development and validation of fault-tolerant computers for critical real-time applications are currently both costly and time consuming. Often, the underlying technology is out-of-date by the time the computers are ready for deployment. Obsolescence can become a chronic problem when the systems in which they are embedded have lifetimes of several decades. This paper gives an overview of the work carried out in a project that is tackling the issues of cost and rapid obsolescence by defining a generic fault-tolerant computer architecture based essentially on commercial off-the-shelf (COTS) components (both processor hardware boards and real-time operating systems). The architecture uses a limited number of specific, but generic, hardware and software components to implement an architecture that can be configured along three dimensions: redundant channels, redundant lanes, and integrity levels. The two dimensions of physical redundancy allow the definition of a wide variety of instances with different fault tolerance strategies. The integrity level dimension allows application components of different levels of criticality to coexist in the same instance. The paper describes the main concepts of the architecture, the supporting environments for development and validation, and the prototypes currently being implemented.

The HCI component of dependable real-time systems

The operator interface is an important aspect of any real-time system. If the system is a safety-critical one, the HCI components must themselves be dependable. Such applications constrain the time an operator has to assimilate and respond to system data. This paper focuses on the specific constraints these hard real-time applications present. Attention is focused on the interface between the application code and the HCI components. An architecture is outlined that allows these interfaces to be specified, and thus enables the application software and the HCI components to be designed and implemented separately.