Railways provide a critical service and operate under strict regulatory frameworks for implementing changes or upgrades. Despite their impact on the public, these frameworks do not define means or mechanisms for transparency towards the public, leading to reduced trust and complex tracking processes.We analyse the German guideline for railway-infrastructural modifications from proposal to approval, using the guideline as a motivating example for modelling decisions in processes using digital signatures and zero-knowledge proofs. Therein, a verifier can verify that a process was executed correctly by the involved parties and according to specification without learning confidential information such as trade secrets or identities of the participants. We validate our system by applying it to the railway process, demonstrating how it realises various rules, and we evaluate its scalability with increased process complexities. Our solution is not railway-specific but also applicable to other contexts, helping leverage zero-knowledge proofs for public transparency and trust.

Updating safety-critical applications, e.g. to adapt to a changed interface specification, is expensive due to the required recertification. We describe a concept based on the Simplex architecture for trusted systems to update the implementation of a backwardcompatible interface with unchanged safety properties. We show that safety can be inherited from an existing trusted controller at the cost of reducing the overall system's availability. The applicability is shown via a case study in the railway sector, where we see a shift toward standardized interfaces. EULYNX is the European railway interface standardization initiative. Due to the long lifetimes of railway systems, vendors are building EULYNX-compatible products while the standard is still under active development. In our case study, we build a EULYNX-compatible object controller for train-detecting axle counting modules, relying on the proven safety of an object controller implementing the older NeuPro protocol.

With the increasing reach and applicability of software systems in railway infrastructure, their complexity and the demand for constant change increases. Main factors include the use of unreliable COTS components, technical obsolescence, increasing centralization, international harmonization of technical and operational standards as well as IT-security concerns. Statically assessing the functional safety of a software-based railway system (offline assurance) is thus insufficient to maintain continued operation.Applying simplex architectures on multiple layers of the system architecture can alleviate this problem: Using a simple decision logic component, simplex controls the complexity of an evolving and multi-faceted system while maintaining the level of dependability that is required for safe passenger transport. We argue that the introduction of online assurance marks a paradigm shift in the railway domain, where the system safety today is guaranteed by expert assessments.

Abstract Certain workloads such asin‐memory databasesare inherently hard to scale‐out and rely on cache‐coherent scale‐up non‐uniform memory access (NUMA) systems to keep up with the ever‐increasing demand for compute resources. However, many parallel programming frameworks such as OpenMP do not make efficient use of large scale‐up NUMA systems as they do not consider data locality sufficiently. In this work, we presentPGASUS, a C++ framework for NUMA‐aware application development that provides integrated facilities for NUMA‐aware task parallelism and data placement. The framework is based on an extensive review of parallel programming languages and frameworks to incorporate the best practices of the field. In a comprehensive evaluation, we demonstrate thatPGASUSprovides average performance improvements of and peak performance improvements of up to across a wide range of workloads.

Summary Graphics processing units (GPUs) are unarguably vital to keep up with the perpetually growing demand for compute capacity of data‐intensive applications. However, the overhead of transferring data between host and GPU memory is already a major limiting factor on the single‐node level. The situation intensifies in scale‐out scenarios, where data movement is becoming even more expensive. By augmenting the CloudCL framework with 842‐based compression facilities, this article demonstrates that transparent on‐the‐fly I/O link compression can yield performance improvements between 1.11× and 2.07× across tested scale‐out GPU workloads.

In modern trains, a juridical recording unit logs events that occur during operation. This data is used to reconstruct the exact chain of events in case of failures and crashes. To ensure data recovery after an accident, the recorder is hardened against physical damage and secured against tampering; however, it is a single proprietary device and by no means indestructible.This paper presents ZugChain, a distributed, blockchain-based juridical recording unit that opportunistically utilizes on-train hardware. ZugChain offers high reliability via replication and tamper-resistance due to the nature of blockchains. It implements a permissioned blockchain based on a Byzantine fault-tolerant agreement protocol suitable for diverse communication systems. To utilize the logged data for advanced services, e. g., predictive maintenance, ZugChain securely and continuously exports traces to private data centers. We demonstrate ZugChain's feasibility with an implementation running on real train hardware, where we show that ZugChain orders data within 14 ms using at maximum 15 % of the total available shared CPU resources, thus fulfilling requirements of juridical recorders.

The digitalization of railway systems should increase the efficiency of the train operation to achieve future mobility challenges and climate goals. But this digitalization also comes with several new challenges in providing a secure and reliable train operation. The work resulting in this paper tackles two major challenges. First, there is no single university curriculum combining computer science, railway operation, and certification processes. Second, many railway processes are still manual and without the usage of digital tools and result in static implementations and configurations of the railway infrastructure devices. This case study occurred as part of the Digital Rail Summer School 2021, a university course combining the three mentioned aspects as cooperation of several German universities with partners from the railway industry. It passes through all steps from a digital Control-Command and Signalling (CCS) planning in ProSig 7.3, the transfer, and validation of the planning in the PlanPro data format and toolbox, to the generation of code of an interlocking for the digital CCS planning to contribute to the vision of test automation. This paper contributes the experiences of the case study and a proof-of-concept of the whole lifecycle for the Digital Testfield of Deutsche Bahn in Scheibenberg. This proof-of-concept will be continued in ongoing and following projects to fulfill the vision of test automation and automated launching of new devices.

Federated learning allows a group of distributed clients to train a common machine learning model on private data. The exchange of model updates is managed either by a central entity or in a decentralized way, e.g. by a blockchain. However, the strong generalization across all clients makes these approaches unsuited for non-independent and identically distributed (non-IID) data.

Data transfers impose a major bottleneck in heterogenous system architectures. As a mitigation strategy, compute resources can be introduced in places where data occurs naturally. The increased diversity of compute resources in turn affects programming models and practicalities of software development for near-data compute kernels and raises the question of how those resources can be made accessible to users and applications.

Embedded systems have been used to control physical environments for decades. Usually, such use cases require low latencies between commands and actions as well as a high predictability of the expected worst-case delay. To achieve this on small, low-powered microcontrollers, Real-Time Operating Systems (RTOSs) are used to manage the different tasks on these machines as deterministically as possible. However, with the advent of the Internet of Things (IoT) in industrial applications, the same embedded systems are now equipped with networking capabilities, possibly endangering critical real-time systems through an open gate to interrupts.This paper presents our initial study of the impact network connections can have on real-time embedded systems. Specifically, we look at three aspects: The impact of network-generated interrupts, the overhead of the related networking tasks, and the feasibility of sharing computing resources between networking and real-time tasks. We conducted experiments on two setups: One treating NICs and drivers as black boxes and one simulating network interrupts on the machines. The preliminary results show that a critical task performance loss of up to 6.67% per received packet per second could be induced where lateness impacts of 1% per packet per second can be attributed exclusively to ISR-generated delays.

Hybrid testbeds are popular for testing distributed software systems, like network protocols and distributed applications, since the beginning of the 2000s. Combining physical and virtual resources for testing these networked computer systems allows to leverage the advantages and mitigate the disadvantages of either one. However, hybrid testbeds introduce novel challenges, e.g. regarding plausibility, heterogeneity, and controllability. To counter these challenges, we introduce the Hybrid Applications Testbed for Fault Injection (Hatebefi) which combines two approaches: On the one hand, Hatebefi aims to increase the plausibility by integrating hybrid testbeds with domain-specific simulators (e.g. for traffic simulation). This integration also addresses the heterogeneity of contemporary distributed applications. On the other hand, our framework allows for efficient creation and execution of complex test scenarios with a high degree of controllability by offering an event-based execution model. To demonstrate the feasibility of our approach, we implemented a basic set of arbitrarily combinable events to cover the most common scenarios. Both features combined pave the way to test distributed software systems, like Internet of Things applications involving connected vehicles or smart cities.

The release of Intel's Software Guard Extensions (SGX) refueled the interest in trusted computing approaches across industry and academia. The corresponding hardware is available, but practical usage patterns and applications are still lacking notable prevalence rates. This paper addresses this gap by approaching trusted computing from the point of view of a software engineer. To help developers in overcoming the initial hurdles of integrating SGX with existing code bases, a small helper library is presented. Furthermore, hardening strategies are identified and applied in a case study based on the simple KISSDB database, demonstrating how SGX can be used in practice.

Distributed dataflow systems like MapReduce, Spark, and Flink help users in analyzing large datasets with a set of cluster resources. Performance modeling and runtime prediction is then used for automatically allocating resources for specific performance goals. However, the actual performance of distributed dataflow jobs can vary significantly due to factors like interference with co-located workloads, varying degrees of data locality, and failures.We address this problem with Ellis, a system that allocates an initial set of resources for a specific runtime target, yet also continuously monitors a job's progress towards the target and if necessary dynamically adjusts the allocation. For this, Ellis models the scale-out behavior of individual stages of distributed dataflow jobs based on previous executions. Our evaluation of Ellis with iterative Spark jobs shows that dynamic adjustments can reduce the number of constraint violations by 30.7-75.0% and the magnitude of constraint violations by 70.6-94.5%.

Modern distributed systems have reached a level of complexity where software bugs and hardware failures are no longer exceptional, but a permanent operational threat. This holds especially for cloud infrastructures, which need to deliver resources to their customers under well-defined service-level agreements. Dependability need to be assessed carefully. This article presents a structured approach for dependability stress testing in a cloud infrastructure. We automatically determine and inject the maximum amount of simultaneous non-fatal errors in different variations. This puts the existing resiliency mechanisms under heavy load, so that they are tested for their effectiveness in corner cases. The starting point is a failure space dependability model of the system. It includes the notion of fault tolerance dependencies, which encode fault-triggering relations between different software layers. From the model, our deterministic algorithm automatically derives fault injection campaigns that maximize dependability stress. The article demonstrates the feasibility of the approach with an assessment of a fault tolerant OpenStack cloud infrastructure deployment.

Mobility-as-a-Service (MaaS) describes a class of applications where traditional real-time control systems are enhanced by backbone services accessed via the mobile Internet. In order to implement MaaS, new architectures for multi-stage real-time systems with several layers of control loops have to be implemented. Using approaches such as analytic redundancy, hard real-time control loops are extended with software-defined sensors that deliver data with soft real-time semantics. We describe a real-time control experiment that has been implemented in our Distributed Control Lab with four stages - an extended digital Carrera race track (D132), custom built sensor/actuator boards, a control PC, and an outer control loop established via web services - and present a timing analysis. Our architecture allows for decoupling of hard real-time processing on embedded control units and soft real-time data acquisition on the outer layers.

The increasing usage of third-party software and complexity of modern software systems makes dependability, in particular robustness against faulty code, an ever more important concern. To compare and quantitatively assess the dependability of different software systems, dependability benchmarks are needed. We present a configurable tool for dependability benchmarking, Hovac, which uses DLL API hooking to inject faults into third party library calls. Our fault classes are implemented based on the Common Weakness Enumeration (CWE) database, a community maintained source of real life software faults and errors. Using two example applications, we discuss a detailed and systematic approach to benchmarking the dependability of C/C++ applications using our tool.

InstantLab is our online experimentation platform that is closely linked to our MOOC platform openHPI. InstantLab is used for hosting exercises and experiments for operating systems and software engineering courses at HPI. Within this paper, we discuss challenges and solutions for scaling InstantLab to provide experiment infrastructure for thousands of users. InstantLab is based on our XCloud architecture. It uses a combination of a private HP converged cloud at HPI combined with public cloud infrastructures such as Windows Azure and Amazon AWS via cloudbursting. XCloud focuses on cloud infrastructure aspects, such as VM co-location and VM placement, management of heterogeneous compute devices (such as GPGPU) as well as on maintaining of user activity via VM introspection. The latter is crucial when running experiments on a scale of thousands of users. Besides infrastructure, the paper discusses our approach to automatic management of experiment feedback and user grading based on learning success and successful completion of operating systems and software engineering experiments.

Blind Signal Separation is an algorithmic problem class that deals with the restoration of original signal data from a signal mixture. Implementations, such as Fast ICA, are optimized for parallelization on CPU or first-generation GPU hardware. With the advent of modern, compute centered GPU hardware with powerful features such as dynamic parallelism support, these solutions no longer leverage the available hardware performance in the best-possible way. We present an optimized implementation of the FastICA algorithm, which is specifically tailored for next-generation GPU architectures such as Nvidia Kepler. Our proposal achieves a two digit factor of speedup in the prototype implementation, compared to a multithreaded CPU implementation. Our custom matrix multiplication kernels, tailored specifically for the use case, contribute to the speedup by delivering better performance than the state-of-the-art CUBLAS library.

Modern server and desktop systems combine multiple computational cores and accelerator devices into a hybrid architecture. GPUs as one class of such devices provide dedicated processing power and memory capacities for data parallel computation of 2D and 3D graphics. Although these cards have demonstrated their applicability in a variety of areas, they are almost exclusively used by special purpose software. If such software is not running, the accelerator resources of the hybrid system remain unused. In this paper, we present an operating system extension that allows leveraging the GPU accelerator memory for operating system purposes. Our approach utilizes graphics card memory as cache for virtual memory pages, which can improve the overall system responsiveness, especially under heavy load. Our prototypical implementation for Windows proves the potential of such an approach, but identifies also significant preconditions for a widespread adoption in desktop systems.

Within the Fontane project medical data has to be transmitted using public cellular networks. The most frequently transmitted data has only weak timing requirements. But in particular cases we also transmit streaming data that typically has soft real-time requirements. Regardless of the real-time nature of transmission though, the data being transmitted has associated priorities. However, public cellular networks have varying transmission characteristics and do not consider any kind of data priority on application level. We suggest using network specific information and priority aware mechanisms on client and server side to improve the behavior of our application. In public cellular networks each cell has a unique identifier that may be used to locate the sender within the network. We use the location area identity - a part of the cell identity - and the priority of the medical data to control the data transmission of our application. In addition to catering for data priority during transmission, we avoid bur sty traffic, which reduces adverse effects on other traffic flows that coexist in the same network. In this paper we present our traffic control protocol and the algorithm which is used to calculate the minimum priority level for each location area. The minimum priority is the least priority that the user data must have in order to be sent. Furthermore, we show how this protocol will be integrated into our middleware.

SUMMARY Over many decades, advances in computer system design and processor manufacturing have resulted in an ever‐increasing per‐chip transistor count, which, in combination with increased clock frequencies, has led to a tremendous increase in single‐thread performance in desktop and server CPUs. The trend to higher integration in processor manufacturing will continue for the next couple of years. However, the increased transistor count leads to additional compute cores within a CPU, rather than to an increased single‐thread performance. Programming and utilizing these future CPUs impose a number of problems commonly referred to as themulticore challenge. These trends primarily affect server computers, whereas on client systems, a break‐even between users' willingness to pay for compute power and today's CPU implementation seems to be reached. In this paper, we argue that the full exploitation of many‐core architectures on the server demands better support by the operating system. This relates to the support of new application programming models, the seamless integration of internal and external services, security, as well as on monitoring and (self‐adaptive) management of such server environments. Within this paper, we discuss three major trends that will drive the adoption of server operating systems to modern many‐core hardware: dynamic parallelism, dynamic partitioning, and dynamic provisioning. Copyright © 2011 John Wiley & Sons, Ltd.

Many industrial and medical scenarios today are building on mobile devices as their end systems. These devices are typically connected to backend systems via the mobile phone network with their corresponding data services. Today's network protocols are optimized for reliable transfer of voice traffic, however, available bandwidth and latency for data traffic may vary significantly with location and motion speed of a mobile device. Within this paper, we report on experiences from our eHealth project "Fontane", where real-time streaming data from electrocardiographic devices has to be transferred from patient's home to doctors at a telemedicine center. In order to deal with varying bandwidth and transmission characteristics on the radio link, we propose a predictive model that allows for pro-active application reconfiguration in order to adapt to anticipated bandwidth variations. Our model is being integrated into a self-adaptive middleware for mobile communication. We present our initial study on network bandwidth estimation, which reveals that the measurement of the available bandwidth using standard end-to-end methods does not work well for mobile cellular networks due to a fairly high number of interference factors in wireless environments. We therefore propose a multilevel forecast model to better predict the network bandwidth of the immediate future.

Todays commercial off-the-shelf computer systems are multicore computing systems as a combination of CPU, graphic processor (GPU) and custom devices. In comparison with CPU cores, graphic cards are capable to execute hundreds up to thousands compute units in parallel. To benefit from these GPU computing resources, applications have to be parallelized and adapted to the target architecture. In this paper we show our experience in applying the NQueens puzzle solution on GPUs using Nvidia's CUDA (Compute Unified Device Architecture) technology. Using the example of memory usage and memory access, we demonstrate that optimizations of CUDA programs may have contrary results on different CUDA architectures. Evaluation results will point out, that it is not sufficient to use new programming languages or compilers to achieve best results with emerging graphic card computing.

When studying operating systems, students need to understand user-mode system interfaces (U), they need to learn about tools to monitor and measure OS behavior (M), and they finally should understand central implementation details of the OS kernel (K). Following the UMK approach, even complex projects such as modifying the memory management inside the Windows kernel can be carried out in an undergraduate OS curriculum.

Debuggers and instrumentation tools have been proven valuable for understanding the inner workings of software systems. Although these tools are essential for various people, e.g., system administrators, developers, or teachers, they have one major drawback, especially in multi-threaded environments: They completely ignore data races.

This paper introduces ReDAC, a new algorithm for dynamic reconfiguration of multi-threaded applications. In order to achieve high reliability and availability, distributed component software has to support dynamic reconfiguration. Typical examples include the application of hot-fixes to deal with security vulnerabilities. ReDAC can be implemented on top of the modern component-platforms Java and .NET. We extend the statical term component, denoting a unit of deployment, to runtime by defining a capsule (runtime component instance) to be a set of interconnected objects. This allows us to apply dynamic updates at the level of components during runtime without stopping whole applications. Using system-wide unique identifiers for threads (logical thread IDs), we can detect and also bring capsules into a reconfigurable state by selectively blocking threads, relying on data structures maintained by additional logic integrated into the capsules using aspect-oriented programming. An important contribution of this paper is that ReDAC supports the dynamic reconfiguration of distributed multi-threaded and re-entrant components with cyclic call dependencies.

Virtual machine-based programming languages, such as Java and C#have made the programming of desktop computer systems simpler, less error-prone and more efficient. Embedded systems development rarely benefits from this advantages. This is because the disciplines special needs, such as direct hardware access and timelininess, are rarely considered in these environments. In particular, virtual machines usually do not allow for accessing hardware directly, making it impossible to express substantial parts of embedded systems inside the virtual environment. By specifying additional rules, describing an implementation of a conforming compiler, and presenting examples, we show how the virtual machine defined by the ECMA standard 335 can be carefully extended to support hardware-near programming

An operating system (OS) is a program that manages computer hardware. And although today's commercial-off-the-shelf desktop operating systems appear to be an integral part of PCs and workstation to many users, a fundamental understanding of the algorithms, principles, heuristics, and optimizations used is crucial for creating efficient application software. Furthermore, many of the principles in OS courses are relevant to large system applications like databases and web servers.Within this paper, we present our approach towards teaching OS concepts based on the Windows family of operating systems. In contrast to many stable Unix-based curricula, a Windows-based OS curriculum has to take into account the OS as a moving target. And although Windows source code has been made available to academic institutions, managing complexity is among the biggest challenges when teaching OS concepts based on Windows.Teaching experiences reported within this paper have lead to development of the Curriculum Resource Kit (CRK), an entire Windows-based OS curriculum that is freely available for download.

Adaptation to changing environmental conditions is a major challenge for most distributed applications. The service-oriented programming paradigm leads to an increasing number of applications that are not only meant to provide services through standard user-interfaces hosted on desktop computers, but are to be accessible from small mobile devices as well. The integration of the different programming environments on desktop (i.e.; Windows) and mobile computers (i.e.; Java Micro Editions - J2ME) puts an extra burden on the programmer of this kind of applications. In addition, unstable conditions caused by modern infrastructures for mobile applications and varying properties of computational devices have to be considered during runtime of the application. Dynamic reconfiguration provides a powerful mechanism for adaptive computing. Within this paper, we elaborate on the extension of our previously developed Adaptive.Net framework towards CORBA and Java. With the introduction of new connector types, our framework is able to provide seamless support for adaptive, heterogeneous applications based on .Net, Java, and CORBA. In context of our framework, applications consist of components which interact via so-called connectors. The component/connector model allows for mediating between component frameworks (Java, .Net) as well as between communication protocols (CORBA, .Net Remoting, sockets, etc.). Within the paper we give an overview of our adaptation framework Adaptive.Net, that includes a monitoring infrastructure, a reconfiguration platform and tools for building adaptive applications. Using a proof-of-concept application, we experimentally evaluate our connector architecture and study interoperability of Java, CORBA, and .Net objects.

Dynamic reconfiguration provides of powerful mechanism to adapt component-based distributed applications to changing environmental conditions. We have designed and implemented a framework for dynamic component reconfiguration on the basis of the Microsoft .NET environment. Within this paper we present an experimental evaluation of our infrastructure for dynamic reconfiguration of component-based applications. Our framework supports the description of application configurations and profiles and allows for selection of a particular configuration and object/component instantiation based on measured environmental conditions. In response to changes in the environment, our framework will dynamically load new configurations, thus implementing dynamic reconfiguration of an application. Configuration code for components and applications has to interact with many functional modules and therefore is often scattered around the whole application. We use aspect-oriented programming techniques to handle configuration aspects separately from functional code. The timing behavior of dynamic reconfiguration depends heavily on properties of the underlying programming environment and the operating system. We have studied to which extend and with which performance impact the Microsoft .NET Platform/sup 1/ supports dynamic reconfiguration. The paper thoroughly discusses our experimental results.

The Common Object Request Broker Architecture (CORBA) is a widely-accepted, standardized open system integration framework based on distributed object technologies, which has been successfully used for implementation of open Web services. CORBA is focused on facilitating general computing environments and does not explicitly address quality-of-service parameters neither for its communication links nor its endsystems. However efforts like the Real-Time CORBA Special Interest Group (SIG) at OMG and the "pluggable protocols" proposal will ultimately lead to support of quality-of-service properties for CORBA communication links. We concentrate on architectural approaches for fault-tolerant, highly available endsystems. We present the Observer approach for implementation of reliable CORBA clients. Consensus protocols based on the Composite Objects technique is our solution for constructing CORBA servers with high predictability regarding timely and reliable method execution. Our middleware uses commercial off-the-shelf (COTS) technology and aims at conversion of legacy applications into reliable Web-services. We present Java-based Web-interfaces to the Balancing Robots soft real-time simulation. Also, we demonstrate a fault-tolerant version of the Netscape Navigator based on our Observer technique.

The Common Object Request Broker Architecture (CORBA) is a widely-accepted, standardized system integration framework based on distributed object technologies. CORBA is focused on facilitating general computing environments and does not explicitly address the needs of responsive (fault-tolerant, real-time) computing. Therefore, the question remains how to extend today's CORBA implementations for support of responsive computing. In this paper we propose a CORBA-based distributed framework for responsive execution of CORBA method invocations. The framework exploits consensus for synchronization, reliable communication, and fault diagnosis among replicated server objects. Within the replicated server objects, we use the "Composite Objects" technique for predictable integration of CORBA and responsive computing. We present a methodology for creating objects which interface to CORBA while simultaneously supporting fault-tolerance and real-time requirements.

The Object Management Group's (OMG) Common Object Request Broker Architecture (CORBA) is an important and popular technology that supports the development of object based, distributed applications. The benefits promised by CORBA (abstraction, heterogeneity, etc.) are appealing in many application domains, including those that satisfy real time requirements-such as manufacturing. Unfortunately, CORBA was not specified in light of real time requirements, and so the question remains whether existing object request brokers (ORBs) can be used in real time settings, or whether developers of real time systems must await future extensions of CORBA that address real time issues or use non CORBA compliant ORBs. We describe the application of an off the shelf ORB in a real time manufacturing system developed at National institute of Standards and Technology (NIST) and tools which have been developed at the SEI for the analysis of CORBA's impact on the behavior of the system. Based on our experiences, we believe that today's ORBs can be used in real time settings, with certain caveats as outlined in the article. We also outline the concept of "composite objects", an approach for extending the range of non real time ORBs into a greater variety of real time settings.

Clusters of networked commercial, off the shelf (COTS) workstations are presently used for computation intensive tasks that were typically assigned to parallel computers in the past. However, it is hardly possible to predict the timing behavior of such systems or to give guarantees about execution times. We show how our SONiC (Shared Objects Net-interconnected Computer) system can control timing and partitioning of a workstation as a step towards a distributed real time system built from COTS components. SONiC provides a class based programming interface for creation of replicated shared objects of arbitrary, user defined sizes. Weak consistency protocols are employed to improve system performance. Our scheduling service ensures the requested interactive behavior of a workstation while simultaneously giving a specified number of CPU cycles to parallel tasks. Using offline scheduling methods we are able to implement real time guaranteed services on COTS workstations.