The paper presents a panel discussion on the issues and challenges in dependable embedded system from both the academic and industrial perspectives. The panelists are Jacob Abraham from the University of Texas at Austin-USA, Stefan Poledna from TTTech-Austria, Avi Mendelson from Intel-Israel, and Subhasish Mitra from Stanford University-USA.

Fault-tolerant real-time systems are typically based on active replication where replicated entities are required to deliver their outputs in an identical order within a given time interval. Distributed scheduling of replicated tasks, however, violates this requirement if on-line scheduling, preemptive scheduling, or scheduling of dissimilar replicated task sets is employed. This problem of inconsistent task outputs has been solved previously by coordinating the decisions of the local schedulers such that replicated tasks are executed in an identical order. Global coordination results either in an extremely high communication effort to agree on each schedule decision or in an overly restrictive execution model where on-line scheduling, arbitrary preemptions, and nonidentically replicated task sets are not allowed. To overcome these restrictions, a new method, called timed messages, is introduced. Timed messages guarantee deterministic operation by presenting consistent message versions to the replicated tasks. This approach is based on simulated common knowledge and a sparse time base. Timed messages are very effective since they neither require communication between the local scheduler nor do they restrict usage of on-line flexible scheduling, preemptions and nonidentically replicated task sets.

This paper presents a new conceptual model, the XBW-model. Distributed computing is becoming a cost effective way to implement safety critical control systems. To support the development of such systems the XBW conceptual model was developed. The model describes the time behavior and distribution properties of a system in such a way that static scheduling and systematic fault tolerance can be applied. The conceptual model also enables the definition of an appropriate fault model. This fault model along with the XBW-model allow efficient and systematic use of well known software based error detection methods. A distributed steer-by-wire control system is described, which is developed according to the model. The XBW-model is developed within in the European Brite-EuRam III project X-By-Wire.

Real-time systems that have to respond to environmental state changes within a very short latency period often use event-triggered task activation. If the system has to function correctly in the presence of sensor faults, event-triggered task activation is not reliable. Faulty sensors may cause task activations to occur too early, too late, or task activations are omitted entirely. In particular, early task activations can overload the system. Time-triggered task activation is reliable, but by defining a competitiveness ratio it is shown that the processor utilization for highly responsive tasks is unacceptably low. To overcome the problems of event-triggered task activation while preserving its good performance the task-splitting model is introduced. The task-splitting model integrates fault tolerance into the analysis and construction of hard real-time systems by using a combination of event-triggered and time-triggered task activation. Based on a general task model, it is independent of any particular scheduling algorithm. The result of this work has influenced the design of a new operating system which will be applied in a robust automotive engine controller of the next generation.>

Real-time systems which have to respond to environmental state changes within a very short latency period are often using event-triggered task activation. If the system has to work even in case of sensor failures, event-triggered task activation is not reliable. Task activations may occur too early, thus causing a system overload, they may occur too late or are entirely omitted. To overcome these problems the task-splitting model is introduced, which integrates fault tolerance into the analysis and construction of hard real-time systems. This model controls event-triggered task activations to handle faults while guaranteeing timely reponse to changes of environmental states. The task-splitting model is independent of any particular scheduling algorithm, it is based on a general task model. The result of this work has influenced the design of a robust engine controller of the next generation.>