Dependability properties of bi-directional and braided rings are well recognized in improving communication availability. However, current ring-based topologies have no mechanisms for extreme integrity and have not been considered for emerging high-dependability markets where cost is a significant driver, such as the automotive "by-wire" applications. This paper introduces a braided-ring architecture with superior guardian functionality and complete Byzantine fault tolerance while simultaneously reducing cost. This paper reviews anticipated requirements for high-dependability low-cost applications and emphasizes the need for regular safe testing of core coverage functions. The paper describes the ring's main mechanisms for achieving integrity and availability levels similar to SAFEbus/spl reg/ but at low automotive costs. The paper also presents a mechanism to achieve self-stabilizing TDMA-based communication and design methods for fault-tolerant protocols on a network of simplex nodes. The paper also introduces a new self-checking pair concept that leverages braided-ring properties. This novel message-based self-checking-pair concept allows high-integrity source data at extremely low cost.

A cyclic redundancy code (CRC), when used properly, can be an effective and relatively inexpensive method to detect data corruption across communication channels. However, some systems use CRCs in ways that violate common assumptions made in analyzing CRC effectiveness, resulting in an overly optimistic prediction of system dependability. CRCs detect errors with some finite probability, which depends on factors including the strength of the particular code used, the bit-error rate, and the message length being checked. Common assumptions also include a passive network inter-stage, explicit data words, memoryless channels, and random independent symbol errors. In this paper we identify some examples of CRC usage that compromise ultra-dependable system design goals, and recommend alternate ways to improve system dependability via architectural approaches rather than error detection coding approaches.

Honeywell is completing integration of the new Boeing 777 integrated Airplane Information Management System (AIMS). AIMS functions range from hard real-time to non-real-time, include flight-critical and non-essential functions, and must all reside on the same distributed multiprocessor system. This system, based on Aeronautical Radio Inc's ARINC 659 specification, allows for high resource utilization while providing strict partitioning and provable performance via pre-scheduling of processing and communication resources. Such scheduling presents significant theoretical and practical problems. This paper describes these scheduling requirements with the intent of providing the research community with practical bounds for problem definition.>

Honeywell is completing design and will build hardware for the new Boeing 777 integrated Airplane Information Management System (AIMS). AIMS functions have time constraints from hard real-time to non-real-time, and criticality levels from flight critical to nonessential. The challenge is that these functions share time, memory, and input/output (I/O) on a redundant, distributed multiprocessor. An innovative offline scheduling tool and table driven bus protocol control data transfers and Ada process synchronization with verifiable resource allocation, latency control, and performance. >