Search

The role of AI evolves from human assistance over human/machine collaboration towards fully autonomous systems. As the push towards more autonomy subsequently removes the reliance on a human overseeing the system, means of self supervision must be provided to enable safe operations. This work explores dynamic reconfiguration to provide resilience to unforeseen environmental conditions that exceed the systems capabilities, but also against normal faults. We focus on providing the means for this in an ARINC 653 compliant environment, since we target avionics platforms. Scheduling and communication are two major aspects of dynamic reconfiguration. Hence, we discuss multiple respective implementation approaches. The third pillar of reconfiguration, the process of deciding when to reconfigure is also investigated. Combining these yields the building blocks for a self-supervising system.

The architecture of ARINC-653 partitioned scheduling has been widely applied to avionics systems owing to its robust temporal isolation among applications. However, this partitioning mechanism causes the problem of how to optimize the partition scheduling of a complex system while guaranteeing its schedulability. In this paper, a model-based optimization approach is proposed. We formulate the problem as a parameter sweep application, which searches for the optimal partition scheduling parameters with respect to minimum processor occupancy via an evolutionary algorithm. An ARINC-653 partitioned scheduling system is modeled as a set of timed automata in the model checker UPPAAL. The optimizer tentatively assigns parameter settings to the models and subsequently invokes UPPAAL to verify schedulability as well as evaluate promising solutions. The parameter space is explored with an evolutionary algorithm that combines refined genetic operators and the self-adaptation of evolution strategies. The experimental results show the applicability of our optimization method. The architecture of ARINC-653 partitioned scheduling has been widely applied to avionics systems owing to its robust temporal isolation among applications. However, this partitioning mechanism causes the problem of how to optimize the partition scheduling of a complex system while guaranteeing its schedulability. In this paper, a model-based optimization approach is proposed. We formulate the problem as a parameter sweep application, which searches for the optimal partition scheduling parameters with respect to minimum processor occupancy via an evolutionary algorithm. An ARINC-653 partitioned scheduling system is modeled as a set of timed automata in the model checker UPPAAL. The optimizer tentatively assigns parameter settings to the models and subsequently invokes UPPAAL to verify schedulability as well as evaluate promising solutions. The parameter space is explored with an evolutionary algorithm that combines refined genetic operators and the self-adaptation of evolution strategies. The experimental results show the applicability of our optimization method.

In order to reduce the failure rate of Integrated Modular Avionics (IMA) partition software, due to the reliability block diagram (RBD) method, fault tree analysis (FTA) method and GO method cannot describe the state transition process of partition software, according to the ARINC 653 standard and the actual running status of the partition software, this paper determines the state machine and conversion delay of the partition software, and establishes the stochastic Petri nets (SPN) reliability quantitative model of the partition software. By proving that each transition in the SPN model of the partition software approximately obeying exponential distribution, and according to the reachable state tree of the SPN isomorphic to a homogeneous Markov chain (MC), the steady-state probability of the partition software in the fault state is calculated to be $5.2778^\ast 10^{-9}$ by using MC stochastic process theory. The factors affecting the reliability of the partition software are obtained, and the sensitivity of each factor to the model is studied. Finally, the relevant conclusions are drawn to provide guidance for improving the reliability of partition software.

The demand for high-performance computing leads to the adoption of modern Multi-Processor System-on-Chip platforms in the avionics domain, where many applications are safety-critical. To fulfill the safety requirements, it is vital to avoid the platform’s overheating. In this paper, we propose a task mapping method, MultiPAWS, for thermal-aware allocation of the safety-critical avionics workloads under time isolation constraints. With the help of MultiPAWS, we jointly find an optimal number of scheduling windows and their lengths and optimal mapping of the workload to these windows and available CPU cores. To guide the optimization, we introduce a thermal model based on power-characteristic coefficients, which we experimentally identify for a benchmark dataset on NXP i.MX8QuadMax platform (based on ARMv8 big.LITTLE architecture). Furthermore, to mimic the execution of safety-critical avionics applications, we introduce DEmOS, an open-source Linux-based scheduler. DEmOS provides a time-partitioned scheduling similar to the ARINC 653 standard. We use DEmOS for the experimental evaluation on the i.MX8 platform. The experimental results suggest that MultiPAWS achieves over a 12% decrease of the platform temperature compared to the minimum-utilization-based approach. Moreover, we demonstrate how MultiPAWS can be used in design space exploration for finding the tradeoff between the platform temperature and the length of the scheduling hyper-period.

A multitude of cloud-native applications take up a significant share of today's world wide web, the majority of which implicitly require soft-real-time guarantees when hosted on servers at various data centers across the globe. With the rapid development of cloud computing and virtualization techniques, many applications have been moved onto cloud and edge platforms that require efficient virtualization techniques. This means a set of applications must be executed on a Virtual Machine (VM) and multiple VMs must be temporally and spatially scheduled on a set of CPUs. Designed to leverage the cloud infrastructure model, many of these cloud-native applications such as media servers strongly demand low data latency and high compute-resource availability, both of which must be predictable. However, state-of-art VM schedulers fail to satisfy these requirements simultaneously. The scheduling of cloud-native applications on VMs and the scheduling of VMs on physical resources (CPUs), collectively need to be real-time in nature as specified by the Hierarchical Real-Time Scheduling (HiRTS) framework. Conforming to the specifications of this framework, the Regularity-based Resource Partitioning (RRP) model has been proposed that introduces the concept of regularity to provide a near-ideal resource supply to all VMs. In this paper, we make the theoretically superior Regularity-based Resource Partitioning (RRP) model ready for prime time by implementing its associated resource partitioning algorithms for the first time ever on the popular x-86 open-source hypervisor Xen, i.e., RRP-Xen. This paper also compares and contrasts the real-time performance of RRP-Xen against contemporary Xen schedulers such as Credit and RTDS. Our contributions include: (1) a novel implementation of the RRP model on Xen's x-86 based hypervisor, thereby providing a test-bed for future researchers; (2) the first-ever multi-core ARINC 653 VM scheduler prototype on Xen; and (3) numerous experiments and theoretical analysis to determine the real-time performance of RRP-Xen under a stringent workload environment.

Existing standards for airborne-embedded software systems impose a number of requirements applicable to the software development cycle of hard real-time operating systems found in modern aircraft. The measures taken are meant to reduce the risks of undesired consequences, but have strongly varying costs. Dynamic instrumentation and static analysis are common practices used to automatically find software defects, from strictly non-conforming code constructions to memory corruptions or invalid control flow. LLVM analyser and sanitizer infrastructure, while regularly applied to general-purpose software, originally was not thought to be introduced to heavily restricted environments. In this paper we discuss the specifics of airborne systems with regards to dynamic instrumentation and provide practical considerations to be taken into account for the effective use of general-purpose instrumentation tools. We bring a complete LLVM stack support to JetOS, a prospective onboard real-time operating system currently being developed at ISP RAS in collaboration with GosNIIAS. As an example, we port AddressSanitizer, MemorySanitizer, and UndefinedBehaviorSanitizer and provide the details against the caveats on all relevant sides: a sanitizer, a compiler, and an operating system. In addition we suggest uninvolved optimisations and enhancements to the runtimes to maximise the effects of the tools., 7 pages

Avionic software is the subject of stringent real time, determinism and safety constraints. Software designers face several challenges, one of them being the interferences that appear in common situations, such as resource sharing. The interferences introduce non-determinism and delays in execution time. One of the main interference prone resources are cache memories. In single-core processors, caches comprise multiple private levels. This breaks the isolation principle imposed by avionic standards, such as the ARINC-653. This standard defines partitioned architectures where one partition should never directly interfere with another one. In cache-based architectures, one partition can modify the cache content of another partition. In this paper, we propose a method based on cache locking to reduce the non-determinism and the contention on lower level memories while improving the time performances.

The ARINC-653 standard defines temporal partitioning that enables multiple avionics applications to execute independently from each other without interference in terms of CPU resources. Though partitioning has been mainly discussed from the viewpoint of manned aircraft, it can also efficiently integrate multiple applications on civilian Unmanned Aerial Vehicles (UAVs) that have even severer limitations on size, weight, power, and cost. In order to employ ARINC-653 temporal partitioning to civilian UAVs, its implementation must be flexible enough to be applied to diverse run-time software environments and computing hardware platforms. In this paper, we suggest a portable and configurable implementation of ARINC-653 for small-sized civilian UAVs aiming for low cost, easy development, and easy extension. Our implementation provides the Operating System (OS) abstraction layer that defines the essential OS-level features and the OS-independent interfaces to the upper layer that actually implements the ARINC-653 standard. Our implementation is also modularized so that the policies of resource management in CPU scheduling and memory allocation can be easily extended and selectively configured. In addition, we implement the advanced resource management schemes to promote the benefits of multi-core processors that are already widely deployed in Commercial Off-The-Shelf (COTS) systems. We show that our ARINC-653 implementation is portable across different OS, such as Linux and RTEMS, reusing the most of source codes thanks to the layered and modular design. We also analyze the overheads of the ARINC-653 APEX interfaces and multi-core scheduling. Moreover, we conduct a case study for a small-sized quad-copter.

The creation of reliable unmanned aerial vehicles (drones) now is an important task in the science and technology, because such devices can have a lot of use-cases in the digital economy and modern life, so we need to ensure the reliability here. In this article, it is proposed to assemble a quadcopter from low-cost components in order to obtain a hardware prototype and to develop a software solution for the flight controller with high-reliability requirements, which will meet avionics software standards using existing open-source software solutions, and also apply the results as a model for teaching courses “Components of operating systems” and “Software verification”. In the study, we proceed to analyse the structure of quadcopters and flight controllers for them, represent a self-assembly solution. We describe Ardupilot as open-source software for unmanned aerial vehicles, the appropriate APM controller and methods of PID control. Today's avionics standard of reliable software for flight controllers is a real-time partitioning operating system that is capable of responding to events from devices with an expected speed, as well as sharing processor time and memory between isolated partitions. A good example of such OS is the open-source POK (Partitioned Operating Kernel). In the repository, it contains an example design of a system for the quadcopters using AADL language for modeling its hardware and software. We apply such a technique with Model-driven engineering to a demo system that runs on real hardware and contains a flight management process with PID control as a partitioned process. Using a partitioned OS brings the reliability of flight system software to the next level. And to increase the level of control logic correctness we propose to use formal verification methods and provide examples of verifiable properties at the level of code using the deductive approach as well as at the level of the cyber-physical system using Differential dynamic logic to prove the stability.

Avionics Application Standard Software Interface (ARINC 653) is a software specification for space and time partitioning in safety-critical avionics real-time operating systems. Correctly designed task schedulers are crucial for ARINC 653 running systems. This paper proposes a model-checking-based method for analyzing and verifying ARINC 653 scheduling model. Based on priced timed automata theory, an ARINC 653 scheduling system was modeled as a priced timed automata network. The schedulability of the system was described as a set of temporal logic expressions, and was analyzed and verified by a model checker. Our research shows that it is feasible to use model checking to analyze task schedulability in an ARINC 653 hierarchical scheduling system. The method discussed modeled preemptive scheduling by using the stop/watch features of priced timed automata. Unlike traditional scheduling analysis techniques, the proposed approach uses an exhaustive method to automate analysis of the schedulability of a system, resulting in a more precise analysis

Modern avionics systems have several safety critical control software that need to be accurate and provide deterministic response in real-time. Accuracy of such responses is determined by the real-time operating system (RTOS) on which the software applications run. Standards provide guidelines to ensure correctness with high assurance. The conformance of a RTOS to a standard can be achieved by executing a set of test cases against the properties listed in the standard. Conventional testing methodologies are inadequate for conformance testing due to cost and time constraints and lack of guarantees of correctness. We propose a formal methods based technique for conformance testing of a safety critical RTOS to the ARINC 653 standard. We model a space and time partitioned RTOS as a network of timed automata using UPPAAL model checker and verify conformance to functional and timing requirements. Our approach is illustrated in the context of HAL-OS, a proprietary RTOS used in avionics systems.

Aiming at the shortcomings of standardized design and early verification of integrated modular avionics systems, this paper proposes a non-functional attribute modeling and verification method for integrated modular avionics system. We extract an architecture-centric design process for integrated modular avionics system, propose automatic transformation from SysML-based functional models to AADL-based architecture models, design AADL-Hazard sub-language, put forward AADL-based scheduling analysis for ARINC 653 system and safety analysis based on FMECA. Finally, aviation air compressor control system is chosen as a case to verify the correctness and feasibility of the method proposed in this paper. The method in this paper improves the AADL’s ability to model and verify for integrated modular avionics system, help engineersuse standardized design, multi-dimensional analysis methods in the early stage of the product, and reduces later product rework.

The self-* properties commonly associated with the concept of autonomic computing are capabilities desirable for avionics software platforms. They decrease the configuration effort and inherently provide new fault tolerance and resource savings possibilities. The rigid certification process and the requirements for a static and predetermined system behavior are, however, in contradiction with the adaptive and flexible nature of autonomic computing systems. We propose a partition-based architecture providing autonomic features for avionics software platforms while being compliant to regulations and accepted technologies, such as ARINC 653. The core is a platform consciousness based on a domain-specific model and a novel MAP-QE-K cycle. Moreover, we suggest a planning intelligence, a virtual qualification authority, and a minimized execution unit. For each component we define the required design assurance level and possible realization techniques. We discuss the overall feasibility and point out central challenges in the fields of runtime verification and models at runtime. These challenges need to be solved up to the realization of autonomic avionics, e.g. a virtual security assessment and a qualifiable domain-specific model database., Comment: 7 pages, 5 figures

Data Distribution Service (DDS) middleware facilitates interoperability and portability of components by building the underlying communication network in mixed-criticality systems with real-time requirements, especially those in conformity with Future Airborne Capability Environment (FACE) technical standard. Partitioning is the key technology permitting applications with different levels of criticality to execute in a same hardware on strict isolation in time and space. A system architecture is proposed to realize the integration of DDS into partitioned real-time embedded systems compliant with ARINC- 653 specification. The architecture allows communications among applications through the DDS middleware, whether they are executed in a partitioned system or not. Then an Unmanned Aerial Vehicle (UAV) combat scenario is simulated to exemplify the design feasibility. Evaluation tests show the communication stability can be obtained whether an ARINC-653 compliance system interconnect with heterogeneous systems or homogeneous systems. Based on the reliable configuration, the average communication time is stable at around 272.60μs in former situation and 281.32μs in the latter. And the specific performance difference between the two cases is further analyzed.

ARINC 653 introduces the concept of partition that allows time and space isolation in real-time avionic systems. Tasks are assigned to partitions according to various objective functions or constraints such as safety, performance, and security. Some of these objective functions may be conflicting as an improvement of one objective leads to a decrease of another. For example, improving safety by active redundancy may decrease performance. In this paper, we investigate the conflicting aspect between schedulability and security in Time and Space Partitioning (TSP) systems. Many researches have shown that enforcing the security of a system results in an overhead affecting its schedulability. We formulate a design space exploration (DSE) process with a meta-heuristic to explore solutions defined by the tasks to partitions assignment according to security requirements and timing constraints. Experiments are conducted with the Cheddar scheduling analyzer to characterize applications that are concerned by this conflicting issue and to evaluate the tradeoffs between schedulability and security.

Integrated Modular Avionics (IMA) has become the mainstream in avionics system because of its advanced design and excellent performance. However, the disadvantage of the high price, not published source code and limited resource problems makes the development and verification of avionics software more and more complicated. It is of great significance to provide a software testing environment on the general operating system in avionics software development and system integration. In this paper, a virtual ARINC 653 system simulation platform is designed and built by using virtual experiment technology. The platform contains partition management, communication management and health monitoring management, and effectively solves the limited test resources of avionics system. Experimental results show that the performance of the proposed platform is excellent, and meets the real-time requirements of applications.

The avionics industry is converging toward the next generation of software standards produced by The Open Group via the Future Airborne Capability Environment (FACE) consortium and related FACE Technical Standard. The standard combines ARINC 653, a previous avionics standard, with subsets of POSIX 1003.1 that are closely aligned with the POSIX realtime profiles PSE52, PSE53, and PSE54. In this paper, we describe our approach to design, implement, and certify a system with FACE Conformance to the FACE Operating System Segment Safety Base profile. Our approach integrates the ARINC 653-compliant Deos with RTEMS, an open-source real-time operating system (RTOS). Our goal in combining Deos/RTEMS was to achieve certification of FACE Conformance in a low-cost manner by relying on existing, mature software that already provides the majority of the functionality required by the FACE Technical Standard. We reached our goal with under 10,000 source lines of code (SLOC) written to integrate RTEMS into Deos and implement any additional POSIX application programming interfaces (APIs) and tests needed for certification.

Memory corruption attacks such as code injection, code reuse, and non-control data attacks have become widely popular for compromising safety-critical Cyber-Physical Systems (CPS). Moving target defense (MTD) techniques such as instruction set randomization (ISR), address space randomization (ASR), and data space randomization (DSR) can be used to protect systems against such attacks. CPS often use time-triggered architectures to guarantee predictable and reliable operation. MTD techniques can cause time delays with unpredictable behavior. To protect CPS against memory corruption attacks, MTD techniques can be implemented in a mixed time and event-triggered architecture that provides capabilities for maintaining safety and availability during an attack. This paper presents a mixed time and event-triggered MTD security approach based on the ARINC 653 architecture that provides predictable and reliable operation during normal operation and rapid detection and reconfiguration upon detection of attacks. We leverage a hardware-in-the-loop testbed and an advanced emergency braking system (AEBS) case study to show the effectiveness of our approach.

Multicore architecture is applied to contemporary avionics systems to deal with complex tasks. However, multicore architectures can cause interference by contention because the cores share hardware resources. This interference reduces the predictable execution time of safety-critical systems, such as avionics systems. To reduce this interference, methods of separating hardware resources or limiting capacity by core have been proposed. Existing studies have modified kernels to control hardware resources. Additionally, an execution model has been proposed that can reduce interference by adjusting the execution order of tasks without software modification. Avionics systems require several rigorous software verification procedures. Therefore, modifying existing software can be costly and time-consuming. In this work, we propose a method to apply execution models proposed in existing studies without modifying commercial real-time operating systems. We implemented the time-division multiple access (TDMA) and acquisition execution restitution (AER) execution models with pseudo-partition and message queuing on VxWorks 653. Moreover, we propose a multi-TDMA model considering the characteristics of the target hardware. For the interference analysis, we measured the L1 and L2 cache misses and the number of main memory requests. We demonstrated that the interference caused by memory sharing was reduced by at least 60% in the execution model. In particular, multi-TDMA doubled utilization compared to TDMA and also reduced the execution time by 20% compared to the AER model.

Nowadays the complexity of embedded systems is constantly increasing and several different types of applications concurrently execute on the same computational platform. Hence these systems have to satisfy real-time constraints and support real-time communication. The design and verification of these systems is very complex, full formal verification is not always possible and the run-time verification is the only feasible path to follow. In this context, the possibility to simulate their behavior becomes a crucial aspect. This paper proposes a SystemC modular RTOS model to assist the design and the verification of real-time embedded systems. The model architecture has been designed to capture all the typical functionalities that every RTOS owns, in order to easily reproduce the behavior of a large class of RTOS. The RTOS model can support functional simulation for design space exploration to rapidly evaluate the impact of different RTOS configurations (such as scheduling policies) on the overall system performances. Moreover the model can be used for software verification by implementing specific RTOS APIs over the generic services provided by the model, allowing the simulation of a real application without changing any instruction. The proposed approach enables the user to model non-deterministic behaviors at architectural and application level by means of probabilistic distributions. This allows to assess system performances of complex embedded systems under uncertain behavior (e.g. execution time). A use case is proposed considering an instance of the model compliant with the ARINC 653 specification, which requires spatial and temporal segregation, and where typical RTOS performances are assessed given the probability distributions of execution time and aperiodic task activation.

Latest developments in virtualization technologies made it useful for a large selection of general purposes solutions to be integrated easily in multiple platforms. This technology is used for data centers in order to reduce cost, space and power which are the reasons why this technology is successful. Various markets are currently assessing the utilization of virtualization technology for hosting their services and infrastructures. Virtualization performances and innovations have significantly in terms of performances over the last couple of years. At the same time it still faces some challenges regarding performances for real-time applications. Xen is a well-known open-source type 1 hypervisor, which is the reason why it was used in this experiment. Another bare metal hypervisor called XtratuM will be used to explore the characteristics of the ARINC 653 scheduler. Performances of applications are influenced by the scheduling and network I/O tasks. The main contribution of this paper is that it compares the performances of real time schedulers of these two hypervisors; it also presents data performances of these schedulers on two different architectures, on an x86 based processor and also on ARM processors.

The Open Group Future Airborne Capability Environment (FACE ™ ) Consortium has developed a reference architecture and standard for real-time embedded avionics systems. The FACE Technical Standard defines required capabilities for real-time operating systems (RTOS), portable components, and a shared data model to facilitate information exchange between components. FACE RTOS requirements are based on ARINC 653 and POSIX 1003.1b with tailoring to address the safety and security needs of avionics systems. Deos is a safety-certified RTOS that supports ARINC 653 but not POSIX. In contrast, RTEMS is an open source RTOS that supports POSIX but not ARINC 653. Integrating a paravirtualized RTEMS with Deos combines the strengths of both and provides a path to conformance with the FACE Safety Base operating system profile. This paper presents the FACE operating system profiles and discusses the technical challenges of the paravirtualization and integration effort.

Avionics systems are complex and time-critical systems that are progressively adopting more flexible (though equally robust) architectural designs. Although a number of current avionics systems follow federated architectures, the Integrated Modular Avionics (IMA) paradign is becoming the dominant style in the more modern developments. The reason is that the IMA concept promotes modular designs where applications with different levels of criticality can execute in an isolated manner in the same hardware. This approach complies with the requirements of cost, safety, and weight of the avionics systems. FACE standard (Future Airborne Capability Environment) defines the architectural baseline for easing integration in avionics systems, including the communication functions across distributed components. As specified in FACE, middleware will be integrated into avionics systems to ease development of portable components that can interoperate effectively. This paper describes the usage of publish-subscribe middleware (precisely, DDS – Data Distribution Service for real-time systems) into a fully distributed partitioned system. We describe, from a practical point of view, the integration of the middleware communication overhead into the hierarchical scheduling (as compliant with ARINC 653) to allow the usage of middleware in the partitions. We explain the design of a realiable communication setting, exemplified on a distributed monitoring application in a partitioned environment. The obtained implementation results show that, given the stable communication overhead of the middleware, it can be integrated in the time windows of partitions.

It may be useful to analyze and reuse some components of legacy systems during development of new systems. By using a model-based approach it is possible to build an architecture model from the existing source code of the legacy system. The purpose of using architecture models is to analyze the system’s static and dynamic features during the development process. These features may include real-time performance, resources consumption, reliability etc. The architecture models can be used as for system analysis as well as for reusing some components of the legacy system in the new design. In many cases it will allow to avoid creation of a new system from scratch. For creation of the architectural models various modeling languages can be used. In the present work Architecture Analysis & Design Language (AADL) is used. The paper describes an algorithm of extracting architectural information from source code of ARINC 653-compatible application software. ARINC 653 specification defines the requirements for software components of Integrated Modular Avionics (IMA) systems. To access the various services of ARINC 653 based OS an application software uses function calls defined in the APplication/Executive (APEX) interface. Architectural information in source code of application software compliant with ARINC 653 specification includes different objects and their attributes such as processes in each partition, objects for interpartition and intrapartition communications, as well as global variables. To collect the architectural information, it is necessary to extract all APEX calls from source code of application software. The extracted architectural information can be further used for creation the architecture models of the system. For source code analysis an approach based on Counterexample-guided abstraction refinement (CEGAR) algorithm is used. CEGAR algorithm explores possible execution paths of the program using its representation in the form of Abstract Reachability Graph (ARG). In a classical CEGAR algorithm a path in a program to be explored is called a counterexample and it means a path to the error state. In CPAchecker tool the basic predicate-based CEGAR algorithm has been extended for explicit-value analysis. In this paper the extended for explicit-value analysis CEGAR algorithm is applied for the task of extracting architecture information from source code. The main contribution of this paper is the application the ideas of counterexample and path feasibility check for the task of extracting the architectural information from source code.

This paper develops an offset-based response-time analysis technique for analyzing complex distributed real-time systems where processing and communication resources use the time-partitioning strategy to isolate the operation of separate software components. Time partitioning may be provided in the processors by an ARINC 653 compliant operating system, and in the networks via the TTP communication protocol. The software components executed by the system may themselves be distributed and complex, composed of many concurrent tasks and with one or more end-to-end flows that may have end-to-end timing requirements. The developed analysis supports hierarchical scheduling where a primary scheduler performs time partitioning into separate partitions, and secondary fixed-priority schedulers dispatch the different concurrent tasks inside each partition. It also supports end-to-end flows that are either synchronized with the partition schedule or not. This is the first time that this kind of analysis is developed. An evaluation of an improvement introduced in the analysis is discussed. Two representative case studies are described.

Many cyber-physical systems in the avionics domain are mission- or safety-critical systems. In this context, standard distribution middleware has recently emerged as a potential solution to interconnect heterogeneous partitioned systems, as it would bring important benefits throughout the software development process. A remaining challenge, however, is reducing the complexity associated with current distribution middleware standards which leads to prohibitive certification costs. To overcome this complexity, this work explores the use of the DDS distribution middleware standard on top of a software platform based on the ARINC-653 specification. Furthermore, it discusses how both technologies can be integrated in order to apply them in mission and safety-critical scenarios. We present and discuss a set of feasible system architectures to combine DDS and ARINC-653 standards as a solution to the future development of heterogeneous mixed-criticality systems.We analyse the integration of DDS and ARINC-653 by identifying the issues that may compromise the integration of both standards, and we also propose solutions to address them.We analyze and evaluate a case-study from the avionics domain to demonstrate the validity of the approach.The approach represents a further step towards the development of a safety-critical profile for DDS.

Cyber--physical systems typically target a dedicated purpose; their embedded real-time control system, such as an automotive control unit, is designed with a well-defined set of functionalities. On the software side, this results in a large amount of implicit and explicit static knowledge about the system and its behavior already at compile time. Compilers have become increasingly better at extracting and exploiting such static knowledge. For instance, many optimizations have been lifted up to the interprocedural or even to the whole-program level. However, whole-program optimizations generally stop at the application--kernel boundary: control-flow transitions between different threads are not yet analyzed. In this article, we cross the application--kernel boundary by combining the semantics of a real-time operating system (RTOS) with deterministic fixed-priority scheduling (e.g., OSEK/AUTOSAR, ARINC 653, μITRON, POSIX.4) and the explicit application knowledge to enable system-wide, flow-sensitive compiler optimizations. We present two methods to extract a cross-kernel, control-flow--graph that provides a global view on all possible execution paths of a real-time system. Having this knowledge at hand, we tailor the operating system kernel more closely to the particular application scenario. For the example of a real-world safety-critical control system, we present three possible use cases. (1) Runtime optimizations, by means of specialized system calls for each call site, allow one speed up the kernel execution path by 28% in our benchmark scenario. Furthermore, we target transient hardware fault tolerance with two automated software-based countermeasures: (2) generation of OS state assertions on the expected system behavior, and (3) a system-wide dominator-region based control-flow error detection, both of which leverage significant robustness improvements.