ARINC specification 653-2 describes the interface between application software and underlying middleware in a distributed real-time avionics system. The real-time workload in this system comprises of partitions, where each partition consists of one or more processes. Processes incur blocking and preemption overheads and can communicate with other processes in the system. In this work we develop compositional techniques for automated scheduling of such partitions and processes. At present, system designers manually schedule partitions based on interactions they have with the partition vendors. This approach is not only time consuming, but can also result in under utilization of resources. In contrast, the technique proposed in this paper is a principled approach for scheduling ARINC-653 partitions and therefore should facilitate system integration.

In a paper that was presented at the recently-concluded real-time systems symposium, Vestal proposed a new real-time task model that is able to represent the fact that the worst-case execution time (WCET) of a single task may be determined to different levels of accuracy with different degrees of confidence. In systems with multiple criticality requirements -different tasks need to be assured of meeting their deadlines with different levels of confidence - such multiple specifications of WCET may be exploited to obtain better processor utilization.This paper conducts a thorough study of the feasibility and schedulability questions for such multi-criticality real-time task systems when implemented upon preemptive uniprocessor platforms.

This paper is based on a conjecture that the more confidence one needs in a task execution time bound (the less tolerant one is of missed deadlines), the larger and more conservative that bound tends to become in practice. We assume different tasks perform functions having different criticalities and requiring different levels of assurance. We assume a task may have a set of alternative worst-case execution times, each assured to a different level of confidence. This paper presents ways to use this information to obtain more precise schedulability analysis and more efficient preemptive fixed priority scheduling. These methods are evaluated using workloads abstracted from production avionics systems.

The Avionics Full Duplex Switched Ethernet (AFDX) has been developed to provide reliable data exchange with strong data transmission time guarantees in internal communication of the aircraft. The AFDX design is based on the principle of a switched network with physically redundant links to support availability and be tolerant to transmission and link failures in the network. In this work, we develop a formal model of the AFDX frame management to ascertain the reliability properties of the design. To capture the precise temporal semantics, we model the system as a network of timed automata and use Uppaal to model-check for the desired properties expressed in CTL. Our analysis indicates that the design of the AFDX frame management is vulnerable to faults such as network babbling which can trigger unwarranted system resets. We show that these problems can be alleviated by modifying the original design to include a priority queue at the receiver for storing the frames. We also suggest communicating redundant copies of the reset message to achieve tolerance to network babbling.

We present a new model of real-time periodic distributed asynchronous computation in which information flows through sequences of periodic tasks, where task inputs are obtained by sampling other task's outputs as well as sampling the environment. We introduce a metric for end-to-end timing called the age of an output, which is the time since the external inputs on which an output value is based were sampled. We present some bounds on age scheduling efficiency, reduce the problem of finding a feasible distributed age schedule to finding a solution for a system of nonlinear constraints, and discuss use of a commercial solver to find a solution to a large problem derived from a real-world system.

We describe two languages and associated tools for capturing and analyzing two different views of the architecture of an embedded system. One language is tailored to address guidance, navigation, and feedback control issues, while the other is tailored to address real-time, fault-tolerance, secure partitioning, and scalable multiprocessor issues. Both languages have tools that perform analyses appropriate for the issues each addresses, and tools to automatically configure the application software from a sufficiently detailed specification. The integrated languages and tools are intended to support a development process based on reusing an easily configurable generic architecture developed for a family of products.

We discuss the use of architecture specification languages to drive both automated analytic modeling and automated system implementation. We "co-generate" various formal models and an implementation from an architecture specification in a way that provides high assurance that the analysis results accurately predict implementation behavior. This approach enables improved system quality and functionality due to early and reliable design trade-off studies, rapid and low-cost system development and evolution, and increased assurance of correctness.

Several formal results exist that allow an analytic determination of whether a particular scheduling discipline can feasibly schedule a given set of hard real-time periodic tasks. In most cases, these results provide little more than a 'yes' or 'no' answer. In practice, it is also useful to know how sensitive scheduling feasibility is to changes in the characteristics of the task set. This paper presents algorithms that allow a system developer to determine, for fixed-priority preemptive scheduling of hard real-time periodic tasks on a uniprocessor, how sensitive schedule feasibility is to changes in the computation times of various software components. The algorithms allow a system developer to determine what changes in task computation times can be made while preserving schedule feasibility (or what changes are needed to achieve feasibility). Both changes to the computation time of a single task and changes to the computation times of a specified subset of the tasks are analyzable. The algorithms also allow a decomposition of tasks into modules, where a module may be a component of multiple tasks.>

This paper describes certain aspects of an architecture description language (MetaH) and associated toolset used to specify, analyze, and automatically assemble software for real-time, fault-tolerant, secure, multi-processor systems. One goal in the design of this language and toolset was to provide design-time analysis that accurately characterizes the behavior of the actual implementation. Currently, our toolset consists of tools to automatically assemble the application software and to perform a real-time schedulability analysis for that application.>