Robot swarms have come a long way since the first mobile sensor/actuator networks. Since then, we have seen the rise of operating systems for robots and swarm operating systems that ease the use of robots, and especially of large swarms of them, a lot. Still, the description of a task is often not easy and best done by experts. In this paper we envision future swarm operating systems, where task descriptions take a form which can be realized by non-experts. We describe our idea of hugely increased virtualization in the swarm and how this can be used to realize the aforementioned vision.

When implementing multi-hop mesh network protocols, efficient direct communication, route discovery, and route repair are crucial to achieve high network throughput. To our knowledge, there is no open mesh routing protocol available for ultra low power IEEE 802.11 modules. Previous work relied on single board computers like Raspberry Pi. We implemented the B.A.T.M.A.N. mesh protocol on the popular Espressif ESP32 along with a novel hybrid rate adaptation for the selection of efficient routes. In this demo we showcase challenges and solutions related to the implementation on ESP32 and how the hybrid rate adaptation improves end-to-end throughput.

Mesh routing protocols are widely used in IoT and sensor networks. In recent years, the ESP32 Wi-Fi/BLE SoC became popular for prototyping IoT applications. However, the existing mesh networks for this platform lack efficient node to node communication, fast route discovery and repair, and energy efficiency. This paper addresses the formation of IEEE 802.11 based ad-hoc mesh networks without the delays inflicted by the Station to Access Point association protocol. We implemented the B.A.T.M.A.N. protocol on top of the ESP32 Wi-Fi MAC interface and integrated it into the LwIP network stack. The performance evaluation with respect to UDP/IP and TCP/IP end-to-end throughput shows the general usefulness but also identifies bottlenecks caused by limitations of the existing MAC interface. Overall, this opens an interesting opportunity for research on mesh protocols by providing a simpler platform than full featured Wi-Fi routers; and for wireless IoT applications by providing higher throughput than subGHz and BLE technologies.

Due to new technologies for connectivity, automotive systems shift from a closed to an open system approach.Therefore, automotive systems have a rising demand for security, letting security be an upcoming field in research and practice.Also, the newly published process standard ISO/SAE 21434 demands adjustments in the development process to address cybersecurity.The unique characteristics of automotive systems leave many approaches from other system types inapplicable.This work concentrates on the risk treatment step in the cybersecurity development process.Due to the vast amount of differing terminology, we see the need to define a flexible taxonomy adaptable to several system types and used in systems with normative references.We use this taxonomy to develop a heuristic approach for risk treatment based on a distinct terminology for security requirements.The presented method is extendable to include several trade-off points.

Formal reasoning about the correctness of safetycritical system properties is crucial since such systems may impact their environment when malfunctioning.The Rail Safe Transport Application (RaSTA) Protocol is a protocol for systems used in railway applications such as signaling.It claims to provide highly available and timely communication based on the application's demands.We investigate timeliness, i.e., the property that application data do not become obsolete.We analyze the protocol's specification and provide assumptions necessary to resolve imprecisions.Under the specified error model, we find that the deadlines proposed bound until messages are considered timely is too restrictive, disabling RaSTA's mechanisms to recover from lost messages in time.We formalize the specification of timeliness to provide a counterexample for the proposed bound and create an improved bound that does not lead to violated deadlines under the same assumptions and error model.

Future automotive software needs to deal with an increasing level of dynamicity, reasoned by the wish for connected driving, software updates, and dynamic feature activation. Such functionalities cannot be properly realized with today's classic AUTOSAR development approach, since it relies on the static configuration of all software units at build time.

Hybrid automata are a well-established modelling approach. The formalism is used in many real-time and control systems engineering projects, which makes model composition an increasingly relevant topic. A well-defined composition support allows concurrent engineering activities and the validation o f larger systems. However, many existing publications seldom consider it or make unrealistic assumptions on the model design. The article discusses the common problems with hybrid automata composition and presents a new formalism, called linear time-invariant hybrid automata (LTI-HA), which targets specifically these issues. Our approach considers the superposition principle for flow functions, which makes it specifically useful for practical modelling purposes in the spacecraft and control domain. We compare the approach to well-known related ideas, such as hybrid I/O automata. Several properties of composition, such as commutativity, are proven.

Dependability modeling and analysis relies on the usage of an unambiguous terminology model, in order to avoid misunderstandings and wrong interpretations. In both academia and industry, the most widely accepted approach is the fault-error-failure model, originally created by Avižienis and Laprie. Using this model for describing software faults and errors can help to establish a common vocabulary, but may lead to ambiguities, since the original `fault activation' term relates both to fault-enabling states and the execution of incorrect code. Our proposal encourages a more detailed description of fault activation conditions, while keeping the widely accepted basic vocabulary.

In some cases, tasks may be allowed to migrate from one processor to another, e.g., Due to hardware failures or for workload balancing. If a mixed-criticality setting is considered, it is necessary to decide whether new tasks with different levels of criticality may be accepted by a processor without compromising the already running tasks. Since this decision has to be taken on-line, there is a need for fast but yet accurate schedulability tests for mixed-criticality systems. In this paper, we consider that the EDF-VD algorithm is used to schedule tasks on the different processors. EDF-VD assigns virtual deadlines to high-criticality tasks, i.e., It uniformly downscales their real deadlines, to account for a potential increase in their execution demand. A deadline scaling factor is hence computed for the whole processor. However, in the case where the increase in computation demand strongly differs from one task to another, scaling deadlines uniformly makes EDF-VD incur pessimism. Of course, a scaling factor can be computed for every single task, however, this leads to a considerably more complex algorithm which cannot be used in an on-line setting. As a result, we propose an intermediate solution by introducing a bi-level deadline scaling. This way, high-criticality tasks that experience a small increase of workload are assigned one scaling factor, whereas tasks with a large increase of workload are assigned a separate scaling factor. Our experiments show that the proposed approach dominates the original EDF-VD algorithm while it does not increase complexity allowing for constant-time admission control in mixed-criticality systems.

In this paper we investigate Timed Petri nets (TPN) with fixed, possibly zero, durations and maximal step semantics. We define a new state representation where a state is a pair of a marking for the places and a marking for the transitions (a matrix

Contrary to the optimal scheduling algorithm Earliest Deadline First (EDF), Rate-Monotonic Scheduling (RMS) can lead to non-schedulable task sets for total utilizations below 1 on a uniprocessor. The quantification of this deficiency has been a topic in real-time science for a long time. We show weaknesses of the scheduling algorithm metrics breakdown utilization, utilization upper bound, and numerical optimality degree. Finally, we suggest a new measure of schedulability called Efficiency and calculate its bounds. It turns out that numerical optimality degree might be too optimistic depending on the assumed total utilization distribution. The main results are the application of a power-law total utilization distribution to quantify the RMS-to-EDF Efficiency and a step-by-step derived lower bound of this Efficiency. We apply a differential analysis of schedulability.

Software is getting larger and more complex. To simplify programming, languages with automatic memory management are used. In embedded systems the languages C/C++ are commonly used, which do not provide such functionalities. This paper addresses real-time garbage collection for embedded systems. We developed a conservative collector, which supports C/C++. The collector uses the mark-sweep algorithm and an installation barrier. Synchronisation points ensure termination. Memory fragmentation is avoided by memory partitioning. Compared to existing approaches, our collector provides realtime support without restrictions on the compiler, programming language or to need special hardware. We only use common hardware functionalities normally used by an operating system to avoid compiler modifications and increase performance.

Todays situation is characterized by an increasing pervasiveness of a plethora of mobile devices featuring different capabilities and exhibiting different system interfaces making the handling of these devices and especially the cooperation between different devices a complex task. In this paper, we consider the sum of all these devices as one emerging system (the swarm) and present an approach of a swarm operating system that on a systemic level manages these devices (local devices give up their autonomy) while providing a common interface to user applications. We provide a programming model for distributed mobile applications that abstracts from error-prone aspects such as distribution and concurrency by giving the programmer a systemic view to system resources. The model allows the programmer to define actions that can be restricted in space and time. Together with a high level goal, an entire application emerges implicitly based on those defined actions. In order to execute such applications, we present an architecture for a runtime system that uses virtualization techniques in order to execute multiple independently developed applications in parallel. The system follows a service-oriented architecture: one of the core services is the space-time scheduler that plans applications (a set of actions) in time and space.

Dealing with cyber-physical systems (CPS) puts a strong emphasis on the interaction between computing and non-computing elements. Since the physical world is characterized by being strongly distributed and concurrent, this is also reflected in the co

We suggest an improvement to the RMST assignment scheme by Burchard et al., a heuristics for finding approximate solutions to the NP--complete problem of MP scheduling of RT tasks.

The correctness of systems is frequently proved by demonstrating the non-reachability of certain (incorrect) states with the help of formal frameworks, e.g., Petri nets. Especially for real-time systems, the timely behavior has to be considered. Thus, there exist several extensions that allow the modeling of time in Petri nets. Non-reachability proofs in time-dependent Petri nets are usually done by proving the non-reachability within the time-less skeleton. However, in many cases this approach fails to prove non-reachability, since the skeleton can reach more markings than the timedependent Petri net. In this paper, we introduce a state equation for a class of time-augmented Petri nets and demonstrate in an example application how this state equation can be used to prove non-reachability within the actual timedependent net.

Ideally, a system's design starts with a formal model. However, in the real world, many systems are designed without a formal model in mind. For these systems, it is hard to show that a formal model meets the informal design. We demonstrate on the example of the composable message scheduled system (MSS) architecture how to bridge the gap between a rather informal description and a formal timed Petri net model. We discuss, how modeling can be done in a "natural" way, so that the mapping between system and model components and the composition of model components is rather obvious. Also, we introduce the tool MGen that support the automatic generation of Petri net models for the MSS architecture.

Clusters of networked commercial, off the shelf (COTS) workstations are presently used for computation intensive tasks that were typically assigned to parallel computers in the past. However, it is hardly possible to predict the timing behavior of such systems or to give guarantees about execution times. We show how our SONiC (Shared Objects Net-interconnected Computer) system can control timing and partitioning of a workstation as a step towards a distributed real time system built from COTS components. SONiC provides a class based programming interface for creation of replicated shared objects of arbitrary, user defined sizes. Weak consistency protocols are employed to improve system performance. Our scheduling service ensures the requested interactive behavior of a workstation while simultaneously giving a specified number of CPU cycles to parallel tasks. Using offline scheduling methods we are able to implement real time guaranteed services on COTS workstations.