Timing issues in hard real-time / embedded systems

在许多实时应用中，时序要求与其他要求一样重要。考虑一个由软件控制的医疗设备，该设备旨在提供特定剂量的辐射。如果设备提供了正确的辐射量，但时间太长，这是危险的。患者接受辐射的时间长度与器械发出的辐射水平同样重要。这些系统被称为硬实时系统，因为它们有明确的（硬）时间期限。 在上述系统中，存在明显的安全问题。软件必须被开发，以便它是可证明的安全。开发安全关键软件的一个步骤是制定全面的要求。优选地，这些要求应该以数学精度来描述。已经开发了许多方法来记录数学上合理的硬实时系统的时序要求。然而，这些众所周知的方法在现实世界的项目中使用时存在显著的缺陷。例如，它们不能充分科普公差。 其中一些方法的数学基础在存在公差的情况下是无效的。 此外，产生的间隔可能太大，以至于要求变得毫无意义。 我是安大略发电公司（OPG）为安大略核电站创建安全关键软件所用方法的主要开发人员。在过去的四年里，我们与同事和学生一起，正式并扩展了我在OPG开始的工作，因此我们现在可以描述典型的时序要求，并预测其实现的可行性-即使要求和实现包括公差。一个特别值得注意的结果是，我们已经表明，较长的采样间隔可以实现可行的实现，即使一些较短的采样间隔不能。我的研究建立在这个基础上。一个主要目标是开发软件工具，帮助软件专业人员使用这些方法来构建正确的，精确记录的软件应用程序，从而产生可证明安全的系统。

In many real-time applications, timing requirements are as important as any other requirements. Consider a medical device controlled by software that is designed to deliver a specific dosage of radiation. If the device delivers the correct amount of radiation, but for too long a time period, it is dangerous. The length of time over which the patient is irradiated is just as important as the level of radiation emitted by the device. These systems are known as hard real-time systems in that they have definite (hard) timing deadlines.     In a system such as mentioned above, there is an obvious safety concern. The software has to be developed so that it is provably safe. One step in the development of safety-critical software is the formulation of comprehensive requirements. Preferably, these requirements should be described with mathematical precision. A number of approaches have been developed to document timing requirements for hard real-time systems that are mathematically sound. However, these well-known approaches have significant deficiencies when they are used in real-world projects. For example, they do not cope adequately with tolerances.  The mathematical basis for some of these methods  can be shown to be invalid in the presence of tolerances.  Also, the intervals that result may be so large that the requirement becomes meaningless.     I was a key developer of the methodology used by Ontario Power Generation (OPG) to create safety-critical software for Ontario's nuclear plants. Together with colleagues and students, over the past four years we have formalized and extended the work I started at OPG, so that we can now describe typical timing requirements, and also predict the feasibility of their implementations - even when the requirements and implementations include tolerances. One particularly noteworthy result is that we have shown that longer sample intervals can achieve feasible implementations even when some shorter sample intervals cannot. My proposed research builds on this foundation. A primary goal is to produce software tools that help software professionals use these methods to build correct, precisely documented software applications that result in provably safe systems.