TTEthernet is a general purpose communication infrastructure for applications with real-time and/or fault-tolerance requirements. It is based on Ethernet as standardized by the IEEE and allows the integration of mixed-criticality applications in a single physical network. However, currently TTEthernet only operates in wired network settings. With growing industrial demand of the design freedom that comes with wireless communication solutions we are interested in extending TTEthernet to a wireless communication paradigm. In this paper we review the state of the art in deterministic wireless communication approaches. We deduce quality criteria for wireless networks from industrial use cases and outline candidates for a wireless complement to wired TTEthernet.

A system-of-systems (SoS) is a large information processing system formed by the integration of autonomous computer systems, physical systems and humans for the purpose of providing new synergistic services and/or more efficient economic processes. The integration is achieved by the exchange of information among the constituent systems. In a monolithic system, where a single context for the representation of information prevails, the issue of context dependence of information representation is of little concern. With the advent of SoSs the context dependence of the information representation in the diverse constituent systems becomes a central issue that must be dealt with by a proper conceptual model. In this paper we present such a conceptual model for the information transfer in a system-of-systems that takes account of the dissimilar representations of the same semantic content in the diverse constituent systems. We introduce the key concept of an Information Atom, called I tom that comprises data and an explanation of the data in an atomic unit. Depending on the context of interpretation, the representation of the data and the explanation may change, while the semantic content, the information carried by an I tom must remain invariant. In the second part of the paper we focus on the impact of the progression of real-time on the utility of information.

Summary form only given, as follows. Most of today,s machines, e.g., automotive engines, production machinery or even consumer devices, such as a washing machine, are controlled by an embedded computer system. It is assumed that the widespread integration of these existing embedded computer systems and data bases into systems-ofsystems (e.g., the Internet of Things, IoT) will provide new synergistic services, make better use of the available information, lead to new insights, improve current economic processes and thus create greater wealth. Fueled by the dramatic technological progress in the area of wire-bound and wire-less communication, this integration is already happening on a wide scale in industry. From the viewpoint of computer science, the domain of Systems-of-Systems (SoS) is a relatively new field that poses significant new research challenges. In our view, the differentiating characteristics of a SoS compared to a monolithic system are the autonomy of the Constituent Systems (CS), emergent phenomena at the SoS level, uncoordinated evolution of the CSs and most, importantly, that the occurrence of faults in the CSs must be considered normal during the operation an SoS. This presentation will focus on the issues that are posed by the integration of embedded systems into systems of systems and will refer to the research approach taken in the European AMADEOS project 610535 (Architecture for Multi-criticality Agile Dependable Evolutionary Open System-of-Systems). The complete presentations were not made available for publication as part of the conference proceedings.

We propose and analyze a novel roll-forward recovery scheme that is based on state estimation. In this solution, a dedicated monitoring component has the capability to predict future states of the physical environment by periodically analyzing the state of an associated monitored component. These predictions can serve either directly as restart states for a failed component or as facilitators of the recovery process. Our solution combines three key concepts: identification and handling of a component's ground state, resilience of service users to occasional but bounded service outage, and state estimation. The main benefit of the proposed scheme is that it avoids replication and thus provides responsive recovery for components that lack the property of replica-determinism. The aim of this work is recovery of time-critical but not safety-critical components in mixed-criticality real-time systems. We show that the proposed recovery scheme has comparable error-detection and repair efficiency to roll-forward recovery with behavior-based checks introduced by Xu and Randell.

This paper investigates on the security of time -- triggered transmission channels, which are used to establish a predictable and timely message transfer in a distributed embedded system with potential safety constraints. Within such a system, safety and security are closely related, because malicious attacks can have an impact on a system's safety and thereby cause severe damage. An attacker could masquerade as an original sender and try to alter some system parameters by injecting malicious messages in the system. In the embedded real-time systems domain particularly the authenticity of data items is of interest, because a lack of integrity can lead to incorrect or erroneous system behavior. In addition, we address the open research question how a common notion of time can contribute to a system's security. Our solution encompasses an authentication protocol to secure time-triggered transmission channels. We illustrate two attack scenarios (insertion and substitution) that aim at injecting fake messages in such a channel thereby corrupting the internal system state of a receiver. We discuss the feasibility of several key management strategies for embedded systems and describe an authentication protocol using time-delayed release of symmetric keys for time-triggered systems. In a case study we implement the protocol for a prototype Time-Triggered Ethernet (TTE) system. The insight gained from the evaluation is that the computation of the cryptographic algorithms consumes most resources. Our solution shows that authentication can be transparently applied to a time-triggered system exploiting the available global time base and without violating its timeliness properties.

Energy consumption is a major issue in the design of embedded systems that are battery-driven. At the architectural level energy savings can be realized by a diversity of mechanisms. This paper presents the energy-savings mechanisms that are part of the time-triggered architecture (TTA). The paper starts with a general section on energy dissipation in VSLI circuits and an outline of the architectural style of the time-triggered architecture as far as it is relevant for energy efficiency. In the following three Sections we elaborate on the TTA energy-savings mechanisms at the system level, the component level, and of the communication system.

High-integrity systems are deployed in order to realize safety-critical applications. To meet the rigorous requirements in this domain, these systems require a sophisticated approach to design, verification, and certification. Not only safety consideration shave an impact on a product's overall dependability, but also security has to be taken into account. In this paper we analyze the Time-Triggered System-on-Chip (TTSoC) architecture, which is a novel architecture for Multi-Processor System-on-Chip (MPSoC) devices, regarding its security properties. We discuss essential compliance criteria to the Multiple Independent Layers of Security (MILS) architecture, which is a industry-ready architecture for embedded high-integrity systems. We found that both architectures share intrinsic properties and we are able to show that the TTSoC architecture implements the core requirements of a MILS Separation Kernel and thus realizes its elementary security policies by design.

GENESYS Multiprocessor System-on-a-Chip (MPSoC) is the building block of a generic platform for the component-based development of embedded real-time systems in different domains, such as in automotive, aerospace, industrial control, and consumer-electronic applications. The GENESYS MPSoC offers a stable set of domain-independent core services (e.g., common time, message-based communication, and configuration). On top of the core services, higher level services can be implemented by domain-independent and domain-specific system components that customize the platform to the needs of the specific application domain. Through its cross-domain applicability, the GENESYS MPSoC supports the wide reuse of components and realizes the benefits of the economies of scale of the semiconductor technology. Furthermore, the GENESYS MPSoC contributes towards the solution of prevalent technological challenges such as complexity management, robustness, and technology obsolescence. This paper presents the GENESYS MPSoC and provides insights from a prototype implementation, which demonstrates that such a cross-domain MPSoC can be built with today's technology.

The GENESYS (Generic Embedded System) project is a European research project that aims to develop a cross-domain architecture for embedded systems. The requirements and constraints for such an architecture are documented in the ARTEMIS strategic research agenda in the form of seven key challenges. This paper presents the architectural style of GENESYS by listing the key architectural principles, such as: strict component orientation, separation of computation from communication, availability of a common time, hierarchical system structure, adherence to message passing, state awareness, fault isolation and integrated resource manage-ment. This paper explains how these architectural principles contribute to solve the seven key challenges in the ARTEMIS strategic research agenda.

This paper describes an integrated system architecture for automotive electronic systems based on multicore systems-on-chips (SoCs). We integrate functions from different suppliers into a few powerful electronic control units using a dedicated core for each function. This work is fueled by technological opportunities resulting from recent advances in the semiconductor industry and the challenges of providing dependable automotive electronic systems at competitive costs. The presented architecture introduces infrastructure IP cores to overcome key challenges in moving to automotive multicore SoCs: a time-triggered network-on-a-chip with fault isolation for the interconnection of functional IP cores, a diagnostic IP core for error detection and state recovery, a gateway IP core for interfacing legacy systems, and an IP core for reconfiguration. This paper also outlines the migration from today's federated architectures to the proposed integrated architecture using an exemplary automotive E/E system.

System-level integration requires an overall understanding of the interplay of the sub-systems to enable component-based development with portability, reconfigurability and extensibility, together with guaranteed reliability and performance levels. Integration by simple interfaces and plug-and-play of sub-systems, which is the main objective of AUTOSAR, requires solving essential technical problems. We discuss to what degree the existing AUTOSAR standard can support the development of safety- and time-critical software and what is required to move toward the desirable goal of timing isolation when integrating multiple applications into the same execution platform.

Summary form only given. With the ongoing trends of hardware complexity - device density increases, reducing geometries, lower switching threshholds etc - hardware increasingly exhibits transient faults. Software is not perfect and the increasing complexity results in Heisenbugs. Consequently it becomes a complex technological challenge to build dependable embedded systems that can accommodate and mitigate these facts of hardware and software transients such that the user perceived services are not seriously impacted.

Start of the above-titled section of the conference proceedings record.

The ever-increasing functionality and the nonfunctional constraints that must be satisfied by embedded systems lead to an enormous growth in the complexity at the system level In this paper we investigate the notion of cognitive complexity and argue that it is not the embedded system, but the models of the embedded system that must be simple and understandable. The introduction of appropriate levels of abstraction in modeling and the associated concept formation help to reduce the emerging complexity by focusing on the relevant properties and omitting irrelevant detail, thus leading to a simpler representation of the evolving artifact. In the second part of the paper we present examples of basic-level concepts that we find essential in the design of distributed embedded systems and summarize the insights by presenting a set of concise design patterns that support the component-based design of embedded systems.

Today many embedded computer applications are developed under the assumptions that the hardware works always as described in the documentation, the operating system is free of design errors and the clients use the system as specified. These assumptions lead to systems that are fragile - they break if even a single transistor out of a billion transistors chip occasionally malfunctions or a sporadic Heisenbug [J. Gray, 1986] occurs in the operating system.

This paper presents the concepts of switching in the Time-Triggered Network-on-Chip (TTNoC), which is the communication subsystem of the Time-Triggered System on-Chip (TTSoC) architecture. This includes the design of the switching components that make up the network-on-chip (NoC), as well as the switching algorithm applied in those components. Furthermore, we focus on the implications for the operation of the TTNoC entailed by these design choices, and deal with frequently used scenarios in a NoC, particularly multi-casting. Finally, we present results of a prototype implementation based on FPGA technology.

Time-triggered (TT) Ethernet is a new real-time communication protocol that is fully compatible with Ethernet and provides in addition to the standard Ethernet service a deterministic real-time communication service for distributed real-time systems. This paper elaborates on basic concepts in real-time communication, elicits real-time communication requirements and discusses some innate conflicts that must be considered in any realtime protocol design. In the second part, the rationale and the principles of operation of TT-Ethernet are presented and common properties of all members of the TT-Ethernet protocol family are discussed.

Finite state machine (FSM) models are widely used to model the operations of computer systems. Since the basic FSM model is timeless, it is not possible to model within the basic FSM framework system properties that are dependent on the progression of real time, such as the duration of computations or the limited temporal validity of real-time data. To overcome these limitations, efforts have been made to modify the FSM model to include some notion of time. It is the objective of this paper to expand existing work on basic FSMs and timed automata to include the concept of a sparse global time base as a central element of the model. We call such an extended FSM model a periodic finite state machine (PFSM) model. The PFSM model also incorporates the notions of state variables, global time, periodic clock constraints, and time-triggered activities. Thereby, PFSMs enable a concise and intuitive representation of distributed control systems and reduce the gap between a modeled system and its implementation

This paper presents the design of a time-triggered Ethernet (TTE) switch, which is one of the core units of the time-triggered Ethernet system. Time-triggered Ethernet is a communication architecture intended to support event-triggered and time-triggered traffic in a single communication system. The TTE switch distinguishes between two classes of traffic. The event-triggered (ET) traffic is handled in conformance with the existing Ethernet standard, while the time-triggered (TT) traffic is transmitted with temporal guarantees. A TTE switch is used in the time-triggered Ethernet system for exchanging time-triggered messages in a time-predictable way while continuing the support of standard Ethernet traffic in order to use existing networking protocols such as IP, UDP or IPX without any modifications. In this paper we present the mechanisms the TTE switch uses to guarantee a constant transmission delay for time-triggered traffic. Also an experimental validation of these mechanisms is given

Fault-tolerant time-triggered communication relies on the synchronization of local clocks. The startup problem is the problem of reaching a sufficient degree of synchronization after power-on of the system. The complexity of this problem naturally depends on the system assumptions. The system assumptions in this paper were compiled from cooperation with partners in the automotive and aeronautic industry. We present a general startup strategy for safety-critical systems that discusses the solution to the startup problem from an abstract point of view. From this abstract view we derive and analyze a new startup algorithm that is used in a TTP/C research derivative protocol (LTTP). We also analyze the FlexRay startup algorithm and discuss its behavior in presence of simple failures. The analyses were done by exhaustive fault simulation using the SAL model checker. While LTTP was found to tolerate the arbitrary failure of one node, the FlexRay startup shows to be vulnerable to simple failure modes

This paper presents the rational for and an outline of the design of a time-triggered (TT) Ethernet that unifies real-time and non-real-time traffic into a single coherent communication architecture. TT Ethernet is intended to support all types of applications, from simple data acquisition systems, to multimedia systems up to the most demanding safety-critical real-time control systems which require a fault-tolerant communication service that must be certified. TT Ethernet distinguishes between two traffic categories: the standard event-triggered Ethernet traffic and the time-triggered traffic that is temporally guaranteed. The event triggered traffic in TT Ethernet is handled in conformance with the existing Ethernet standards of the IEEE. The design of TT Ethernet has been driven by the requirement of certification of safety-critical configurations and an uncompromising stand with respect to the integration of legacy applications and legacy Ethernet hardware.

The increasing use of electronics in transport systems, such as the automotive and avionic domain, has lead to dramatic improvements with respect to functionality, safety, and cost. However, with this growth of electronics the likelihood of failures due to faults originating from electronic equipment also increases. Although permanent failure rates are constantly diminishing due to improvements in manufacturing, the downsizing of semiconductor features has lead to a significant increase in transient system disturbances. Furthermore, transients are frequently the precursors of upcoming permanent failures. In order to cope with this development, a diagnostic subsystem must especially be designed to detect and analyze such transients to reduce the failure-not-found ratio in today's systems. Therefore, diagnostic detection mechanisms must be devised that refrain from traditional error detection techniques operating only on component-local data in favor of a system-wide view to detect and analyze correlated failures and infer the corresponding fault. In this work, we present out-of-norm assertions (ONAs) as a diagnostic mechanism operating on the distributed state to detect correlated component malfunction. ONAs take the characteristics of faults in the time, value and space domain into account in order to discriminate between different types of faults that are affecting the operation of the distributed system. Since ONAs are specified on the interface state mutual error detection of interface state variables is performed. In contrast to bivalent assertions that need to indisputably decide on correct or incorrect system states at the time of occurrence, the proposed ONAs are also useful in the detection of system irregularities that cannot be forced into the predominant bivalent assessment scheme.

The design of embedded real-time systems requires skills from multiple specific disciplines, including, but not limited to, control, computer science, and electronics. This often involves experts from differing backgrounds, who do not recognize that they address similar, if not identical, issues from complementary angles. Design methodologies are lacking in rigor and discipline so that demonstrating correctness of an embedded design, if at all possible, is a very expensive proposition that may delay significantly the introduction of a critical product. While the economic importance of embedded systems is widely acknowledged, academia has not paid enough attention to the education of a community of high-quality embedded system designers, an obvious difficulty being the need of interdisciplinarity in a period where specialization has been the target of most education systems. This paper presents the reflections that took place in the European Network of Excellence Artist leading us to propose principles and structured contents for building curricula on embedded software and systems.

We consider a component to be an encapsulated hardware-software unit that can be used as a building block in the construction of a larger system and that delivers a specified service across a component interface. The problem of composition of a set of components can be broken down into the following two subproblems, the composition of the component services and the incorporation of the components into an integrated software/hardware architecture. We focus on the problem of component service composition

This paper proposes the integration of internal and external clock synchronization by a combination of a fault-tolerant distributed algorithm for clock state correction with a central algorithm for clock rate correction. By means of hardware and simulation experiments it is shown that this combination improves the precision of the global time base in a distributed single cluster system while reducing the need for high-quality oscillators. Simulation results have shown that the rate-correction algorithm contributes not only in the internal clock synchronization of a single cluster system, but it can be used for external clock synchronization of a multi-cluster system with a reference clock. Therefore, deployment of the rate-correction algorithm integrates internal and external clock synchronization in one mechanism. Experimental results show that a failure in the clock rate correction does not hinder the distributed fault-tolerant clock state synchronization algorithm, since the state correction operates independently from the rate correction. The paper introduces new algorithms and presents experimental results on the achieved improvements in the precision measured in a time-triggered system. Results of simulation experiments of the new algorithms in single-cluster and multi-cluster configurations are also presented.

Summary form only given. A federated architecture is characterized in that every major function of an embedded system is allocated to a dedicated hardware unit. In a distributed control system this implies that adding a new function is tantamount to adding a new node. This has led to a order to achieve some functional coordination. Adding fault-tolerance to a federated architecture, e.g., by the provision of triple modular redundancy (TMR) leads to a further significant increase in the number of nodes and networks. The major advantages of a dedicated architecture are the physical encapsulation of the nearly autonomous subsystems, their outstanding fault containment and their clear-cut complexity management (independent development) in case the subsystems are nearly autonomous. An integrated distributed architecture for mixed-criticality applications must be based on a core design that supports the safety requirements of the highest considered criticality class. This is of particular importance in safety-critical applications, where the physical structure of the integrated system is determined to a significant extent by the independence requirement of fault-containment regions. The central part of an integrated distributed architecture for time-critical systems must provide the following core services: deterministic and timely transport of messages; fault tolerant clock synchronization; strong fault isolation with respect to arbitrary node failures; and consistent diagnosis of failing nodes. Any architecture that provides these core services can be used as a base architecture for an integrated distributed embedded system architecture. An example of such an integrated architecture is the time-triggered architecture (TTA). In this contribution we describe the structure and the services of the TTA that has been developed during the last twenty years and is deployed in a number of safety-critical applications in the transport sector.

This paper discusses measures to make a distributed system based on the time-triggered architecture resistant to arbitrary node failures. The presented approach introduces a central guardian as part of the interconnection network. This guardian acts as a supervising unit to node computers by checking for compliance to the fault hypothesis at the network interface of the node. By implementing appropriate algorithms the guardian is able to transform failure modes (of nodes) that cannot be tolerated by the fault hypothesis of the TTP/C protocol. This transformation ensures that at the interface to correct nodes, even an arbitrarily faulty node will be compliant to the fault hypothesis of the TTP/C communication protocol.

This paper investigates the fault-containment and error-detection mechanisms of distributed safety-critical time-triggered systems. The following critical failure modes of a fault-containment region are introduced and analyzed in detail: babbling idiot failures, masquerading failures, slightly-off-specification (SOS) failures, crash/omission (CO) failures, and massive transient disturbances. After a short description of the two time-triggered protocols TTP/C and FlexRay this paper tries to show how these two protocols handle the listed failure modes at the architecture level.

Over the past fifty years the size of computer applications, as gauged by any reasonable measure, has increased exponentially. In contrast, our cognitive capabilities for understanding have not changed. This discrepancy has forced us to look for more abstract representations of systems to reduce the number of elements we have to consider simultaneously in order to understand the system behavior. In this contribution we argue that the next unit of abstraction, beyond the component concept, will be a subsystem that performs a specified service autonomously despite the occurrence of disturbances that were not foreseen in the original design.

Composition of a system is driven by the (a) identification and specification of basic components, and (b) specification of the interactions across the components, i.e., the communication linkages, that are needed to communicate value and temporal information across the components from which the aggregate system results. This paper addresses compositional design of distributed Real-Time (RT) systems focusing specifically on the role of specification of linking interfaces (LIFs) across components.

The time-triggered architecture (TTA) provides a computing infrastructure for the design and implementation of dependable distributed embedded systems. A large real-time application is decomposed into nearly autonomous clusters and nodes, and a fault-tolerant global time base of known precision is generated at every node. In the TTA, this global time is used to precisely specify the interfaces among the nodes, to simplify the communication and agreement protocols, to perform prompt error detection, and to guarantee the timeliness of real-time applications. The TTA supports a two-phased design methodology, architecture design, and component design. During the architecture design phase, the interactions among the distributed components and the interfaces of the components are fully specified in the value domain and in the temporal domain. In the succeeding component implementation phase, the components are built, taking these interface specifications as constraints. This two-phased design methodology is a prerequisite for the composability of applications implemented in the TTA and for the reuse of prevalidated components within the TTA. This paper presents the architecture model of the TTA, explains the design rationale, discusses the time-triggered communication protocols TTP/C and TTP/A, and illustrates how transparent fault tolerance can be implemented in the TTA.

The Time-Triggered Architecture (TTA) is a distributed computer architecture for highly dependable real-time systems. The core building block of the TTA is the communications protocol TTP/C. This protocol has been designed to provide non-faulty nodes with consistent data in the presence of faulty nodes. To achieve this consistency the protocol assumes that a fault is either a reception fault or a consistent send fault of some node. Although the communications protocol of the TTA uses this rather optimistic failure mode assumption, the TTA can isolate and tolerate a broader class of faults. This is possible by making intensive use of the static knowledge present in a TTA distributed computer system. This off-line available knowledge allows to build interconnection networks which transform failure modes of nodes into failure modes the communications protocol can deal with. This paper will discuss three alternative implementations of interconnection networks for the TTA which have been designed to meet different failure mode assumptions.

The time-triggered architecture is an architecture for distributed embedded real-time systems in high dependability applications. The core element of the architecture is the time-triggered communications protocol TTP/C. This paper shows how TTP/C can be extended by a fault-tolerance layer that performs those functions that are necessary for the implementation of application redundancy. The hardware/software interface of the host computer where the application software is executing, is not changed, neither in the value domain, nor in the temporal domain, by this implementation of fault-tolerance in the communications system. Provided the application software has been properly organized it is thus possible to implement application redundancy transparently, i.e., without any modification of the function and timing of the application system. The paper also discusses the experiences gained from a prototype implementation of the fault-tolerance layer in the microprogram of a TTP/C controller chip.

The primary goal of a universal smart transducer interface is the provision of a framework that helps to reduce the complexity of large distributed real-time systems by introducing precisely specified (in the value domain and in the temporal domain) and small interfaces between smart transducers and their users. This paper presents a universal smart transducer interface that can be implemented on top of different real-time communication systems. It integrates a time-triggered communication protocol with an interface file system that provides the sources and sinks for the exchanged information. The final section discusses an implementation of this interface on a low cost (less than 1 $) commercial off the shelf microcontroller.

One of the challenging application domains of dependable real-time computer technology is the field of automotive electronics. In this paper we describe the characteristics of this exciting field, investigate the present state of the art of computer applications onboard vehicles and speculate about upcoming computer applications, such as intelligent cruise control, and vehicle dynamics control. These safety-critical applications require very high dependability, while the maintenance effort should be minimal. In the final section of the paper we discuss the impact of the automotive electronics developments on other real-time applications.

To manage the complexity of large distributed real-time systems, a system must be partitioned into nearly autonomous subsystems that communicate across small well-specified interfaces. The form and placement of these interfaces determines the system structure and its understandability. This paper investigates two different types of unidirectional information-flow interfaces, the elementary interface and the composite interface. It is argued that systems that interact by elementary interfaces support composability, and are easier to understand and validate than systems that are based on composite interfaces.

To me, the future for autonomous decentralized systems (ADS) looks bright, because of ongoing developments in the following four areas (i) system complexity (ii) hardware architecture (iii) legacy systems (iv) fault-tolerance. Let me discuss some of the issues in each one of these areas in detail.

A real time system must produce the intended results at the intended points of real time determined by its environment, otherwise the system has failed (H. Kopetz, 1997). For the purpose of this discussion, we consider two types of environments that contain real time computer systems: (i) static environments, where the frequency of the service requests on the computer system are constrained by a priori known environmental characteristics; (ii) dynamic environments, where it is possible to specify peak-load-service-request rates probabilistically only, e.g., a military command and control system that has to adapt dynamically to the n priori unknown threats of the enemy. We feel that these two fundamentally different environments of distributed real time computer systems demand different system models and different implementation strategies.

In the design process of distributed real-time systems, a way must be found to cope with the complexity inherent in these systems. An established technique for this purpose is the decomposition of the system into smaller subsystems with well-defined, stable interfaces among them. In this paper, we propose a design method for the development of distributed real-time systems that are intended for safety-critical applications. The method is devised for the Time-Triggered Architecture, which constitutes such a real-time system. For the purpose of decomposition, we introduce a special type of interface, the so-called temporal firewall. In the Time-Triggered Architecture, there are three interfaces of this type-the Communication Network Interface, the Controlled Object Interface and the Gateway Interface-which partition the real-time system into autonomous subsystems. The design method clearly separates system and subsystem issues and focuses on the definition of the three interfaces between the subsystems. The feasibility and relevance of our design method is demonstrated by means of a small example from the automotive industry.

The Time-Triggered Architecture (TTA) is a computer architecture for distributed real-time systems in safety critical applications, such as computer controlled brakes, or computer assisted steering in an automobile. The TTA is a composable architecture for the design of large real-time systems. Its main characteristics are a common notion of time in all subsystems of the architecture and the provision of fully specified interfaces, called temporal firewalls, between these subsystems. This paper gives an overview of the TTA, discusses the architectural principles, describes the sensor/actuator interfaces in the TTA and informs about the implementation of fault-tolerance in the TTA.

The Time-Triggered (TT) model of computation is a model for the representation and analysis of the design of large hard real time systems. Central to this model is the concept of temporal accuracy of real time information. The TT model consists of four building blocks, interfaces that contain temporally accurate data, a communication subsystem that connects interfaces, a host computer that reads input data from interfaces and writes output data to interfaces and a transducer that transforms the information representation in the environment into the digital form of the interface and vice versa. These four building blocks can be used recursively to describe arbitrary large hard real time systems. The TT model separates cleanly the design of the interaction pattern among components from the design of the components themselves. It thus supports a compositional design. In the final section the TT model is compared to the client server model.

The time-triggered (TT) architecture approach supports the spatial partitioning of a large, distributed real-time system into a set of autonomous subsystems with small control-free data-sharing interfaces between them. This paper presents such a TT architecture and gives a detailed description of the interface between an autonomous time-triggered communication subsystem based on the TTP protocol and the host computer within a node of this architecture. This interface acts as a temporal firewall that eliminates the possibility of control error propagation from one subsystem to another subsystem. It thus facilitates the independent development and validation of the subsystems and supports the composability of the distributed architecture with respect to timeliness, validation, and certification.

The provision of a system-wide global time base with a good precision and sufficient accuracy is a fundamental prerequisite for the design of a multicluster distributed real-time system. We investigate the issues of clock synchronization in a multicluster system, where every node can have a different oscillator. Based on the parameter of a typical automotive distributed system we show that a precision and accuracy in the second range is achievable without undue effort.

In recent years, the search for proper extensions of the basic object model to suit the hard-real-time application community has become a critical research issue. We present such an extension of the basic object model and it is called the RTO.k object model. A concrete syntactic structure and unambiguous execution semantics of the model are presented. A major attraction of this model is in that it is effective not only in the variable-degree abstraction of real-time (computer) control systems under design but also in the accurate representation of the application environments. A specification and implementation experiment that involved an application of the RTO.k structuring scheme to the development of an anti-missile defense system together with an application environment simulator was conducted. This experiment reinforced our belief that the RTO.k model had the necessary representational power and also offered an efficient and rigorous way to develop complex real-time systems.>

The Society of Automotive Engineers (SAE) has recently published a set of requirements and a control benchmark which is able to compare the effectiveness of new protocol proposals for safety-critical automotive systems. This paper presents a solution to this benchmark problem that is based on the Time Triggered Protocol (TTP). TTP integrates all services required for the implementation of fault-tolerant hard real-time systems, while trying to minimize the bandwidth requirements.>

The systematic development of fault-tolerant real-time systems with guaranteed timeliness requires an appropriate system architecture and a rigorous design methodology. Those services of the architecture that help to simplify the work of the real-time programmer are described, taking the MARS architecture as an example. Programming in the large activities, i.e., the systematic derivation of task timing parameters from the requirements specification, are then addressed. Programming to meet a time budget is discussed, and the programming interface, the programming environment, and the testing and support tools are presented. The architecture and most of the tools have been implemented and can be demonstrated on a fault-tolerant prototype application.>

The synchronization problem between a communication controller writing a data structure into a common memory and a set of concurrently executing real-time tasks reading this data structure is investigated. Two versions of an adaptable new non-blocking protocol are presented and a schedulability analysis for a task set using these protocols is given.>

The restriction of the significant event occurrences, i.e., the sending and receiving of messages in a distributed real-time system, to the lattice points of a globally synchronized space/time lattice are discussed. One dimension of this space/time lattice represents the progression of time, the other dimension denotes the computational processes in the system. It is shown that this additional constraint simplifies solutions to agreement problems. After an analysis of the interdependence among temporal order, causal order, receive order, and the limits of time measurement in a distributed real-time system, criteria for the selection of the lattice points of this space/time lattice are presented.>

The authors propose a system architecture, MARS, which supports a strict separation of the issues of synchronization and timeliness, data transformation, and the dependability aspects (e.g., error detection, error handling, and redundancy management. The systematic development of fault-tolerant real-time systems with guaranteed timeliness requires an appropriate system architecture and a rigorous design methodology. The authors propose a system with strict separation of the issues of synchronization, dependability aspects, and data transformation. Dependability aspects are handled by the architecture. Synchronization and programming in the large are handled at the design level. The programmer only has to be concerned with a sequential program for which he has to meet a so-called time budget. The architecture and many tools have been implemented and can be demonstrated on a fault-tolerant prototype application.>

In constructing highly reliable LAN systems, a mechanism that enables every active node to maintain timely and consistent knowledge about the health status of all cooperating nodes can be used as a cornerstone. The authors consider the case where maintenance of such knowledge is achieved in a decentralized manner and timely and consistent recognition of newly joining nodes is also facilitated. The authors develop an optimal version of H. Kopetz et al.'s (1985) periodic reception history broadcast (PRHB) method. The authors' version enables detection of failures with minimum latency and is called the PRHB with earliest detection (PRHB/ED). This scheme has much shorter latency than the previous PRHB scheme and is yet equally practical in the sense that it does not increase the communication traffic at all, and the complexity of the algorithm for analyzing the observations exchanged among the active nodes is still bounded by a linear function of the number of nodes in the system.>

A model of a distributed real-time system which supports reasoning about the consistency and accuracy of real-time data and about the performance of real-time communication protocols is presented. The conventional object model is extended into a model of a real-time (RT-) object which incorporates a real-time clock as a mechanism for initiating an object action as a function of real time. The notion of accuracy as referring to the time gap between a state variable in the external world and its representation in a real-time computer system is adopted. The effects of the temporal uncertainties of different classes of communication protocols on the consistency and the accuracy of RT-objects are analyzed. Finally, an approach to structuring fault-tolerant RT-objects in the form of active object replicas is discussed, and the effects of a failure of a task in a replica on the responsiveness of remote objects are analyzed.>

The generation of a fault-tolerant global time base with known accuracy of synchronization is one of the important operating system functions in a distributed real-time system. Depending on the types and number of tolerated faults, this paper presents upper bounds on the achievable synchronization accuracy for external and internal synchronization in a distributed real-time system. The concept of continuous versus instantaneous synchronization is introduced in order to generate a uniform common time base for local, global, and external time measurements. In the last section, the functions of a VLSI clock synchronization unit, which improves the synchronization accuracy and reduces the CPU load, are described. With this unit, the CPU overhead and the network traffic for clock synchronization in state-of-the-art distributed real-time systems can be reduced to less than 1 percent.