Dissertations / Theses on the topic 'Reliability of real-time distributed systems'

Nowadays, different companies use Ethernet for different industrial applications. Industrial Ethernet has some specific requirements due to its specific applications and environmental conditions which is the reason that makes it different than corporate LANs. Real-time guarantees, which require precise synchronization between all communication devices, as well as reliability are the keys in performance evaluation of different methods [1].  High bandwidth, high availability, reduced cost, support for open infrastructure as well as deterministic architecture make packet-switched networks suitable for a variety of different industrial distributed hard real-time applications. Although research on guaranteeing timing requirements in packet-switched networks has been done, communication reliability is still an open problem for hard real-time applications. In this thesis report, a framework for enhancing the reliability in multihop packet-switched networks is presented. Moreover, a novel admission control mechanism using a real-time analysis is suggested to provide deadline guarantees for hard real-time traffic. A generic and flexible simulator has been implemented for the purpose of this research study to measure different defined performance metrics. This simulator can also be used for future research due to its flexibility. The performance evaluation of the proposed solution shows a possible enhancement of the message error rate by several orders of magnitude, while the decrease in network utilization stays at a reasonable level.

A new approach to the evaluation of the reliability of electrical systems is presented. In this approach a Graph Trace Analysis based approach is applied to integrated system models and reliability analysis. The analysis zones are extended from the traditional power system functional zones. The systems are modeled using containers with iterators, where the iterators manage graph edges and are used to process through the topology of the graph. The analysis provides a means of computationally handling dependent outages and cascading failures. The effects of adverse weather, time-varying loads, equipment age, installation environment, operation conditions are considered. Sequential Monte Carlo simulation is used to evaluate the reliability changes for different system configurations, including distributed generation and transmission lines. Historical weather records and loading are used to update the component failure rates on-the-fly. Simulation results are compared against historical reliability field measurements. Given a large and complex plant to operate, a real-time understanding of the networks and their situational reliability is important to operational decision support. This dissertation also introduces using an Integrated System Model in helping operators to minimize real-time problems. A real-time simulation architecture is described, which predicts where problems may occur, how serious they may be, and what is the possible root cause.<br>Ph. D.

[eng] When Distributed Embedded Systems (DESs) operate in evolving environments, changing requirements might be imposed on the system, and thus the system needs the ability to adapt to them. Furthermore, when such systems are employed for real-time (RT) critical applications, both support for satisfying stringent RT guarantees and attaining a high level of reliability must be provided. The Flexible Time-Triggered (FTT) communication paradigm provides support for changing real-time traffic requirements in adaptive RT DESs, i.e., it provides RT flexibility. The different implementations of FTT on Ethernet have recently added to FTT advantages of Ethernet such as high bandwidth, low cost and, since Ethernet is the de facto Link Layer standard of many communication systems, also an easier potential integration. A specific FTT implementation on Ethernet, called Flexible Time-Triggered Ethernet Star (FTTRS), has been recently proposed to add mechanisms to tolerate faults in the channel as a means to increase the reliability of the final system. However, it is known that to reach a very high level of system reliability it is crucial to also tolerate faults in the computation nodes. This is so because the computation nodes are usually the most complex components of a DES and, hence, they are less reliable than most of the components that constitute the channel, e.g. the links. This thesis proposes a node replication architecture and appropriate node faulttolerance (FT) mechanisms so as to attain a high level of reliability for critical RT DES. The proposed architecture and FT mechanisms are based on an active node replication strategy with distributed majority voting. The mechanisms are designed on top of FTTRS in order to take advantage of the features that the FTT paradigm and the FTTRS communication subsystem already provide in terms of channel RT flexibility and channel fault tolerance. We start by introducing the concepts, terminology and methodology used to specify, design and test a fault-tolerant system. Special attention has been paid to describing the specific fault-tolerance techniques used in this dissertation. Also, we present the foundations on top of which we develop our node FT mechanisms. In particular we present the FTT communication paradigm and the details of the FTTRS itself. Then, we describe the main contributions of this dissertation. We start by a general description of the overall system. Then, we clarify what types of faults (fault model) we address, and we thoroughly describe and classify all the manners in which these faults may manifest (failure model). Afterwards we focus on describing the proposed FT mechanisms based on both active node replication and FTTRS. Once this description is completed, we propose a realization of the designed FT mechanisms for the specific case of control applications. Moreover, in order to test and verify the correctness of our node replication architecture and FT mechanisms, we present a simulation model as well as a real prototype. We use these simulation model and real prototype to thoroughly inject faults (in terms of all the manners in which faults can manifest according to the failure model) and, then, we inspect if the mechanisms function as intended in both of them. Finally, we build a dependability model to quantify the level of reliability attainable by a DES relying on our node replication architecture and FT mechanisms. By means of the work described in the current dissertation we prove the following thesis statement: “It is possible to attain high levels of reliability of adaptive critical RT DES that rely on a reliable and flexible RT communication subsystem based on an FTT implementation on Ethernet by providing FT mechanisms for the nodes.”<br>[spa] Los sistemas empotrados distribuidos son sistemas compuestos por un conjunto de nodos interconectados que trabajan para lograr un objetivo común y que forman parte de un sistema mecánico o eléctrico más grande. Los nodos suelen estar interconectados por medio de una red de comunicación. En cuanto a las redes de comunicación, en las últimas décadas Ethernet se ha convertido en una de las tecnologías más populares debido a sus muchas ventajas tales como simplicidad, anchos de banda siempre crecientes y bajo coste, entre otras. Cuando los sistemas empotrados distribuidos forman parte de sistemas más grandes que ejecutan aplicaciones críticas, a menudo existe la necesidad de proporcionar un soporte para requisitos de respuesta en tiempo real y para la consecución de una muy elevada fiabilidad. La tecnología original de Ethernet no proporciona ningún soporte de este tipo. Por lo tanto, en esta disertación usamos el recientemente propuesto subsistema de comunicación que recibe el nombre de Flexible Time-Triggered Replicated Star (FTTRS) como medio para interconectar los nodos de los sistemas empotrados distribuidos que ejecutan aplicaciones críticas. FTTRS toma la tecnología de red Ethernet como base y sobre ella proporciona mecanismos para soportar respuesta en tiempo real y elevada fiabilidad. La respuesta en tiempo real es proporcionada por el uso del paradigma de comunicación Flexible Time-Triggered (FTT) implementado sobre el protocolo Ethernet el cual, además de la provisión de garantías de tiempo real, también proporciona flexibilidad, en concreto, la capacidad de modificar el comportamiento de la red en tiempo de ejecución mientras se mantienen las garantías de tiempo real comprometidas. La elevada fiabilidad en FTTRS se logra mediante mecanismos que toleran los fallos que podrían afectar a la comunicación entre nodos. Sin embargo, proporcionar tolerancia a fallos únicamente al subsistema de comunicación no es suficiente para satisfacer los requisitos de fiabilidad más exigentes de las aplicaciones críticas. Para alcanzar altos niveles de fiabilidad, los fallos en los propios nodos del sistema empotrado distribuido también deben ser tratados. En consecuencia, hemos diseñado varios mecanismos de tolerancia a fallos para tratar los fallos que puedan afectar al correcto funcionamiento de los nodos. Estos mecanismos aprovechan las características del subsistema de comunicación FTTRS y del paradigma de comunicación FTT subyacente. Concluyendo, en esta tesis veremos cómo podemos, con la introducción de mecanismos específicos para tolerar los fallos de los nodos de un sistema empotrado distribuido basado en FTTRS, lograr muy elevados niveles de fiabilidad para el sistema en su conjunto. Además del diseño de los mecanismos de tolerancia a fallos de los nodos, también mostraremos cómo se puede evaluar la fiabilidad resultante y estableceremos cuál es el beneficio obtenido, comparando dicha fiabilidad con la de una versión no tolerante a fallos del mismo sistema.<br>[cat] Els sistemes encastats distribuïts són sistemes composts per un conjunt de nodes interconnectats que treballen per aconseguir un objectiu comú i que formen part d’un sistema mecànic o elèctric més gran. Els nodes solen estar interconnectats mitjançant una xarxa de comunicació. Quant a les xarxes de comunicació, en les últimes dècades Ethernet s’ha convertit en una de les tecnologies més populars a causa dels seus molts avantatges tals com a simplicitat, amples de banda sempre creixents i baix cost, entre d’altres. Quan els sistemes encastats distribuïts formen part de sistemes més grans que executen aplicacions crítiques, sovint existeix la necessitat de proporcionar un suport per a requisits de resposta en temps real i per a la consecució d’una molt elevada fiabilitat. La tecnologia original d’Ethernet no proporciona cap suport d’aquest tipus. Per tant, en aquesta dissertació usem el recentment proposat subsistema de comunicació que rep el nom de Flexible Time-Triggered Replicated Star (FTTRS) com a mitjà per interconnectar els nodes dels sistemes encastats distribuïts que executen aplicacions crítiques. FTTRS pren la tecnologia de xarxa Ethernet com a base i sobre ella proporciona mecanismes per suportar resposta en temps real i elevada fiabilitat. La resposta en temps real és proporcionada per l’ús del paradigma de comunicació Flexible Time-Triggered (FTT) implementat sobre el protocol Ethernet el qual, a més de la provisió de garanties de temps real, també proporciona flexibilitat, en concret, la capacitat de modificar el comportament de la xarxa en temps d’execució mentre es mantenen les garanties de temps real compromeses. L’elevada fiabilitat en FTTRS s’aconsegueix mitjançant mecanismes que toleren les fallades que podrien afectar a la comunicació entre nodes. En qualsevol cas, proporcionar tolerància a fallades únicament al subsistema de comunicació no és suficient per satisfer els requisits de fiabilitat més exigents de les aplicacions crítiques. Per aconseguir alts nivells de fiabilitat, les fallades en els propis nodes del sistema encastat distribuït també han de ser tractades. En conseqüència, hem dissenyat diversos mecanismes de tolerància a fallades per tractar les fallades que puguin afectar al correcte funcionament dels nodes. Aquests mecanismes aprofiten les característiques del subsistema de comunicació FTTRS i del paradigma de comunicació FTT subjacent. Concloent, en aquesta tesi veurem com podem, amb la introducció de mecanismes específics per tolerar les fallades dels nodes d’un sistema encastat distribuït basat en FTTRS, aconseguir molt elevats nivells de fiabilitat per al sistema en el seu conjunt. A més del disseny dels mecanismes de tolerància a fallades dels nodes, també mostrarem com es pot avaluar la fiabilitat resultant i establirem quin és el benefici obtingut, comparant aquesta fiabilitat amb la d’una versió no tolerant a fallades del mateix sistema.

CRAFTERS (Constraint and Application Driven Framework for Tailoring Embedded Real-time System) project aims to address the problem of uncertainty and heterogeneity in a distributed system by providing seamless, portable connectivity and middleware. This thesis contributes to the project by investigating the techniques that can be used in a distributed real-time embedded system. The conclusion is that, there is a list of specifications to be meet in order to provide a transparent and real-time distributed system. This thesis has implemented a basic system that provides support of scalability, accessibility, fault tolerant and consistency. The system is tested in di_erent areas and it shows its potentials to be a well transparent real-time system. This built the basis for further development.

<p>Simulation is a good way to gain insight into a system, for example during development, without having to run or build the actual system. This is especially true for real-time systems, which often operate in hazardous environments or control critical entities in the 'real' world, making testing of these systems in their real environment unsafe during development.</p><p>When building simulations, one simulator is not likely to fit every type of simulation project. Therefore, different simulators, which focus on different aspects of simulation, are built. The High Level Architecture (HLA) from the Defense Modeling and Simulation Office (DMSO) is an architecture for distributed simulations providing a means to communicate between different simulations.</p><p>However, the HLA standard has limitations if viewed from a real-time perspective. For example, there is no built-in support for fault tolerance. In this thesis some of the limitations in HLA are identified and an extended architecture that uses a distributed active real-time database as a way to overcome these limitations is presented. One of the major advantages with this new extended HLA architecture is that it is still compliant with HLA, i.e., no modifications have been made to the HLA interfaces.</p>

<p>Recovery is a fundamental service in database systems. In this work, we present a new mechanism for diskless real-time recovery in fully replicated distributed real-time database systems. Traditionally, recovery has relied on disk-resident redundant data. Unfortunately, disks cannot always be used in real-time systems since these systems are sometimes used in environments which do not allow the use of disks. Also, minimizing the amount of hardware can save money, especially in mass-produced products. Instead of loading the database from disk, our recovery mechanism enables a restarted node to retrieve a copy of the database from an arbitrary remote node. The recovery mechanism does not violate timeliness during normal processing and, during recovery, all nodes except for the recovering node can guarantee the timeliness of critical transactions. The mechanism uses fuzzy checkpointing to copy the database to the recovering node. Fuzzy checkpointing has been chosen since it copies the database without regard to concurrency control and, thus, does not increase data contention in the database. We conclude that the suggested recovery mechanism is a feasible option for fully replicated distributed real-time database systems.</p>

<p>Development of distributed real-time applications, in contrast to best effort applications, traditionally have been a slow process due to the lack of available standards, and the fact that no commercial off the shelf (COTS) distributed object computing (DOC) middleware supporting real-time requirements have been available to use, in order to speed up the development process without sacrificing any quality.</p><p>Standards and DOC middlewares are now emerging that are addressing key requirements of real-time systems, predictability and efficiency, and therefore, new possibilities such as component decomposition of real-time systems arises.</p><p>A number of component decomposed architectures of the distributed active real-time database system DeeDS is described and discussed, along with a discussion on the most suitable DOC middleware. DeeDS is suitable for this project since it supports hard real-time requirements and is distributed. The DOC middlewares that are addressed in this project are OMG's Real-Time CORBA, Sun's Enterprise JavaBeans, and Microsoft's COM/DCOM. The discussion to determine the most suitable DOC middleware focuses on real-time requirements, platform support, and whether implementations of these middlewares are available.</p>

Nowadays, real-time systems are ubiquitous in several application domains.Such an emergence led to an increasing need of performance (resources,availability, concurrency, etc.) and initiated a shift from theuse of single processor based hardware platforms, to large setsof interconnected and distributed computing nodes. This trend introduced the birthof a new family of systems that are intrinsically distributed, namelyemph{Networked Embedded Systems}.Such an evolution stems from the growing complexity of real-time softwareembedded on such platforms (e.g. electronic control in avionicsand automotive domains), and the need to integrate formerly isolated systems so thatthey can cooperate, as well as share resources improving thus functionalitiesand reducing costs.Undoubtedly, the design, implementation and verification of such systems areacknowledged to be very hard tasks since theyare prone to different kinds of factors, such as communication delays, CPU(s)speed or even hardware imprecisions, which increases considerably the complexity ofcoordinating parallel activities.In this thesis, we propose a rigorous design flow intended forbuilding distributed real-time applications.We investigate timed automata based models, with formally defined semantics, in orderto study the behavior of a given system with some imposed timing constraints when deployedin a distributed environment. Particularly, we study emph{(i)} the impact of the communicationdelays by introducing a minimum latency between actions executions and the effectivedate at which actions executions have been decided,and emph{(ii)} the effect of hardware imperfections, more precisely clocks imprecisions,on systems execution by breaking the perfect clocks hypothesis, often adopted duringthe modeling phase. Nevertheless, timed automata formalism is intended to describe a highlevel abstraction of the behavior of a given application.Therefore, we use an intermediate representation ofthe initial application that, besides having say{equivalent} behavior, explicitly expressesimplementation mechanisms, and thus reduces the gap between the modeling and the concreteimplementation. Additionally, we contribute in building such systems by emph{(iii)}proposing a knowledge based optimization method that aims to eliminate unnecessarycomputation time or exchange of messages during the execution.We compare the behavior of each proposed model to the initial high level model and study therelationships between both. Then, we identify and formally characterize the potential problemsresulting from these additional constraints. Furthermore, we propose execution strategies thatallow to preserve some desired properties and reach a say{similar} execution scenario,faithful to the original specifications<br>Aujourd'hui, les systèmes temps réel sont omniprésents dans plusieurs domaines.Une telle expansion donne lieu à un besoin croissant en terme de performance (ressources,disponibilité, parallélisme, etc.) et a initié par la même occasion une transition del'utilisation de plateformes matérielles à processeur unique, à de grands ensemblesde nœuds de calcul inter-connectés et distribués. Cette tendance a donné la naissanceà une nouvelle famille de systèmes connue sous le nom de emph{Networked Embedded Systems},qui sont intrinsèquement distribués.Une telle évolution provient de la complexité croissante des logiciels temps réelembarqués sur de telles plateformes (par exemple les système de contrôle en avioniqueet dans domaines de l'automobile), ainsi que la nécessité d'intégrer des systèmes autrefoisisolés afin d'accomplir les fonctionnalités requises, améliorant ainsi les performanceset réduisant les coûts.Sans surprise, la conception, l'implémentation et la vérification de ces systèmes sontdes tâches très difficiles car ils sont sujets à différents types de facteurs, tels que lesdélais de communication, la fréquence du CPU ou même les imprécisions matérielles,ce qui augmente considérablement la complexité lorsqu'il s'agit de coordonner les activités parallèles.Dans cette thèse, nous proposons une démarche rigoureuse destinée à la construction d'applicationsdistribuées temps réel.Pour ce faire, nous étudions des modèles basés sur les automates temporisés, dont la sémantiqueest formellement définie, afin d'étudier le comportement d'un système donné avec des contraintes de tempsimposées lorsqu'il est déployé dans un environnement distribué. En particulier, nous étudionsemph{(i)} l'impact des délais de communication en introduisant une latence minimale entreles exécutions d'actions et la date à laquelle elles ont été décidées,et emph{(ii)} l'effet des imperfections matérielles, plus précisément les imprécisionsd'horloges, sur l'exécution des systèmes.Le paradigme des automates temporisés reste néanmoins destiné à décrire une abstractiondu comportement d'une application donnée.Par conséquent, nous utilisons une représentation intermédiaire del'application initiale, qui en plus d'avoir un comportement say{équivalent}, exprimeexplicitement les mécanismes mis en œuvre durant l'implémentation, et donc réduit ainsil'écart entre la modélisation et l'implémentation réelle.De plus, nous contribuons à la construction de tels systèmes en emph{(iii)}proposant une optimisation basée sur la emph{connaissance}, qui a pour but d'éliminer lestemps de calcul inutiles et de réduire les échanges de messages pendant l'exécution. Nous comparons le comportement de chaque modèle proposé au modèle initial et étudionsles relations entre les deux. Ensuite, nous identifions et caractérisons formellement lesproblèmes potentiels résultants de ces contraintes supplémentaires. Aussi, nous proposonsdes stratégies d'exécution qui permettent de préserver certaines propriétés souhaitéeset d'obtenir des scénarios d'exécution say{similaires}, et fidèles aux spécificationsde départs

In the past, network clock synchronization has been sufficient for the needs of traditional distributed systems, for such purposes as maintaining Network File Systems, enabling Internet mail services and supporting other applications that require a degree of clock synchronization. Increasingly real time systems arc requiring high degrees of time synchronization. Where this is required, the common approach up until now has been to distribute the clock to each processor by means of hardware (e.g. GPS and cesium clocks) or to distribute time by means of an additional dedicated timing network. Whilst this has proved successful for real time systems, the use of present day high speed networks with definable quality of service from the protocol layers has lead to the possibility of using the existing data network to distribute the time. This thesis demonstrates that by using system integration and implementation of commercial off the shelf (COTS) products it is possible to distribute and coordinate the time of the computer time clocks to microsecond range. Thus providing close enough synchronization to support real time systems whilst avoiding the additional time, infrastructure and money needed to build and maintain a specialized timing network.

Software testing is an important phase the of software development cycle which reveals faults and ensures correctness of the developed software. Distributed real-time systems are mostly safety critical systems for which the correctness and quality of the software is much more significant. However, majority of the current testing techniques have been developed for sequential (non real-time) software and there is a limited amount of research on testing distributed real-time systems. In this thesis, a proposed approach in the academic literature testing distributed real-time systems using a distributed test architecture is implemented and compared to existing software testing practices in a software development company on a case study. Evaluation of the results show the benefits of using the considered distributed test approach on distributed real-time systems in terms of software correctness.

<p>From the field of control theory, we can see that varying communication delays in a control system may be hard or even impossible to handle. From this point of view it is preferable to have these delays bounded and as small and as possible in order to adapt the control process to them. On the other hand, in some cases delays are inevitable and must be handled by the control system.</p><p>A control system may for different reasons be distributed, e.g., because of a distributed environment or severe environment demands such as heat or dust at some locations. Information in such a system will suffer from delays due to transportation from one place to another. These delays often show up in a random fashion, especially if a general network is used for transportation. Another source of delays is the system environment itself. For predictability reasons a real-time database is preferable if the delays are to be controlled.</p><p>A straightforward way of handling delays in a control system is to build the system such that delays are constant, i.e., to build a time invariant system. The time from sensor reading to actuation is made constant either by adding a suitable delay to achieve a total constant delay or by using time-triggered reading and actuation. These are simple ways of controlling the delays, but may be very inefficient because worst-case execution time must always be used. Other ways of handling varying delays are by using more tolerant control algorithms. There are two suitable control models proposed by Nilsson (1998) for this purpose. The tolerant algorithm approach is assumed in this work.</p><p>This thesis uses a distributed active real-time database system as a basis for building control systems. One of the main objectives is to determine how active functionality can be used to express the control system, i.e., how rules in the database can be used to express the control algorithm and for handling propagation of information. Another objective is to look at how the choice of consistency level in the database affects the result of the control system, i.e. how different consistency level affects the delays. Of interest is also to characterize what type of applications each level is suited for.</p>

This thesis is concerned with the modeling and the analysis of distributedreal-time systems. In distributed systems, components evolve partlyindependently: concurrent actions may be performed in any order, withoutinfluencing each other and the state reached after these actions does notdepends on the order of execution. The time constraints in distributed real-timesystems create complex dependencies between the components and the events thatoccur. So far, distributed real-time systems have not been deeply studied, andin particular the distributed aspect of these systems is often left aside. Thisthesis explores distributed real-time systems. Our work on distributed real-timesystems is based on two formalisms: time Petri nets and networks of timedautomata, and is divided into two parts.In the first part, we highlight the differences between centralized anddistributed timed systems. We compare the main formalisms and their extensions,with a novel approach that focuses on the preservation of concurrency. Inparticular, we show how to translate a time Petri net into a network of timedautomata with the same distributed behavior. We then study a concurrency relatedproblem: shared clocks in networks of timed automata can be problematic when oneconsiders the implementation of a model on a multi-core architecture. We showhow to avoid shared clocks while preserving the distributed behavior, when thisis possible.In the second part, we focus on formalizing the dependencies between events inpartial order representations of the executions of Petri nets and time Petrinets. Occurrence nets is one of these partial order representations, and theirstructure directly provides the causality, conflict and concurrency relationsbetween events. However, we show that, even in the untimed case, some logicaldependencies between event occurrences are not directly described by thesestructural relations. After having formalized these logical dependencies, wesolve the following synthesis problem: from a formula that describes a set ofruns, we build an associated occurrence net. Then we study the logicalrelations in a simplified timed setting and show that time creates complexdependencies between event occurrences. These dependencies can be used to definea canonical unfolding, for this particular timed setting.

Thesis (M.S. in Computer Science) Naval Postgraduate School, September 1998.<br>"September 1998." Thesis advisor(s): Man-Tak Shing, Michael Holden. Includes bibliographical references (p. 121-123). Also available online.

<p>Today we are very much dependent on different kinds of real time systems. Usually,a real time system is a system which is interacting with a physical environmentwith sensors or activators. There are many advantages by replacing mechanicalcomponents with electrical ones. For instance, it is usually cheaper and possibleto add new functions to the device without replacing the electronic part, whichwould have been necessary with a mechanical one.The possibility of simulating a distributed system is used throughout the vehi-cle industry. With the simulation of connected sub systems, using modeled busesand real time kernels, one could increase the correctness of the behavior of the sys-tem and consequently decrease the amount of time spent later in the developingprocess.In this master thesis we used modeled CAN-buses and real time models tosimulate the connection and execution time of the systems. The simulation resultsare used to validate the functionality of the distributed system. Additionally, aworst-case response time analysis is made to set timing constraints on the systemto fulfill given deadlines.During the work, different settings of the network are tested to analyze thesystem frequency needed to sustain deadlines and correctness on the network.</p>

A distributed real-time computer system consists of several processing nodes interconnected by communication channels. In a safety critical application, the real-time system should maintain timely and dependable services despite component failures or transient overloads due to changes in application environment. When a component fails or an overload occurs, the hard real-time tasks may miss their timing constraints, and it is desired that the system to degrade in a graceful, predictable manner. The approach adopted to the problem in this thesis is by integrating the resource scheduling with fault tolerance mechanism. This thesis provides a basis for the modelling and design of an adaptive fault tolerant distributed real-time computer system. The main issue is to determine a priori the worst case timing response of the given hard realtime tasks. In this thesis the worst case timing response of the given hard real-time task of the distributed system using the Controller Area Network (CAN) communication protocol is evaluated as to whether they can satisfy their timing deadlines. In a hard real-time system, the task scheduling is the most critical problem since the scheduling strategy ensures that tasks meet their deadlines. In this thesis several fixed priority scheduling schemes are evaluated to select the most efficient scheduler in terms of the bus utilisation and access time. Static scheduling is used as it can be considered to be most appropriate for safety critical applications since the schedulability can easily be verified. Furthermore for a typical industrial application, the hard real-time system has to be adaptable to accommodate changes in the system or application requirements. This .goal of flexibility can be achieved by integrating the static scheduler using an imprecise computation technique with the fault tolerant mechanism which uses active redundant components.

<p> A CrazyRadio is a 2.4GHZ usb bluetooth dongle and a Crazyflie is a programmable quadrotor used by researchers in the field of distributed computing. A Crazyflie is controlled remotely from a computer or a smartphone through a Crazyradio. However the communication protocol on the CrazyRadio can communicate only with one Crazyflie after pairing, therefore implementing a swarm requires many changes which are prone to failures. This thesis proposes a communication protocol for distributed and highly dynamic systems. The proposed protocol is a combination of two communication protocols: Slotted-Aloha and time division multiple access (TDMA).The implementation of the proposed protocol is done on Crazyradios and Crazyflies. With the proposed protocol a Crazyradio communicates with multiple Crazyradios and Crazyflies. Communication between Crazyradios facilitates realtime data transfer between any type of bots connected to these Crazyradios, adding towards the implementation of swarms of robots. </p><p>

Doutoramento em Engenharia Electrónica<br>Distributed computer-control systems (DCCS) are widely disseminated, appearing in applications ranging from automated process and manufacturing control to automotive, avionics and robotics. Many of these applications comprise real-time activities, that is, activities that must be performed within strict time bounds. Due to its distributed nature, these systems comprise multiple autonomous processing units that, despite being autonomous, need to exchange data in order to achieve control over the environment. For this reason the data exchange among different nodes is also subject to real-time constraints, and thus the communication subsystem must be able to deliver data within specific time bounds. Many DCCS applications are complex and heterogeneous, comprising different sets of activities with different properties and requirements. For instance, they commonly include periodic activities, e.g. resulting from closed loop control, and sporadic activities resulting from events that occur at unpredictable instants in time in the environment under control. These types of activities can have distinct levels of criticalness and timeliness requirements, independently of their activation nature. On the other hand, flexibility is becoming increasingly important in DCCS, due both to the need of reducing the costs of set-up, configuration changes and maintenance, and also to the recent use of DCCS in new types of applications, such as agile manufacturing, real-time databases with variable number of clients, automotive, mobile robotics in unstructured environments and automatic traffic control systems, that must deal with environments that are inherently dynamic. To cope with such high degree of complexity and dynamism, distributed real-time systems must support both time and event-triggered communication services under timing constraints and, at the same time, they must be operationally flexible, supporting on-the-flv changes to the computational activities they execute. Concerning specifically the communication subsystem, existing real-time protocols do not generally fulfill these requirements. In systems eminently time-triggered, event-triggered services are either non-existing or handled inefficiently, while in systems eminently event-triggered, interesting properties of time-triggered services are normally lost. On the other hand, flexibility and timeliness are often considered as conflicting: systems that provide timeliness guarantees are based on a static configuration of the communication activities while systems that support dynamic changes to the communication activities do not provide timeliness guarantees. The communication paradigm herein presented, the Flexible Time-Triggered communication (FTT) paradigm, centralizes the communication requirements and scheduling of synchronous traffic in a single node and uses a master/multi-slave schedule distribution technique that requires low overhead and is independent of the particular scheduling algorithm employed. This architecture facilitates the implementation of on-line scheduling, which supports dynamic changes to the message set properties, and the implementation of on-line admission control, which permits to ensure that changes to the message set are only accepted if the timeliness requirements are all met. In some application domains DCCS are also facing a trend towards higher flexibility in order to support on-line Qualitv-of-Service (QoS) management. This feature is generally useful to increase the efficiency in the utilization of system resources since typically there is a direct relationship between resource utilization and delivered QoS. On-line QoS management requires a high level of flexibility, and thus this dissertation also describes how the FTT communication paradigm can support such type of services. This dissertation presents the FTT paradigm and argues that this paradigm allows to combine in the same communication system different types of traffic, with the ability to change their properties and the respective scheduling policy at run-time, without relinquishing predictability guarantees and achieving efficient use of network bandwidth. The FTT paradigm presented in this thesis has its roots in the FTT-CAN protocol. After some work performed over the FTT-CAN protocol, it was realized that the main concepts could be abstracted and used to build a generic communication paradigm, which could be implemented in distinct communication networks. To assess the performance of the FTT paradigm, this dissertation includes some contributions to the FTT-CAN protocol, mainly in what concerns scheduling and response-time analysis. Moreover, it also presents an implementation over Ethernet (FTT-Ethernet), which aims at more resource demanding applications, supporting for instance multimedia activities. For this reason, in the scope of the FTT-Ethernet protocol most of the work presented is related to on-line QoS management.<br>Os sistemas distribuídos controlados por computador (Distributed Computer-Contrai Systems / DCCS) encontram-se largamente disseminados, cobrindo aplicações que vão desde automação e controlo de processos industriais à aviónica, robótica e controlo automóvel. Muitas destas aplicações incluem actividades com características de tempo-real, i.e., actividades que tem de ser executadas durante janelas temporais bem definidas. Pela sua natureza distribuída, estes sistemas compreendem múltiplas unidades de processamento as quais, apesar de autónomas, necessitam de comunicar entre si para assegurar o controlo global do sistema. Assim, a troca de dados entre nodos encontra-se também sujeita a restrições temporais, donde o sistema de comunicação tem de garantir que esta ocorre de acordo com as restrições temporais requeridas pela aplicação. Muitas aplicações de DCCS são complexas e heterogéneas, incluindo diferentes conjuntos de actividades, as quais exibem diferentes propriedades e requisitos. Por exemplo, encontram-se frequentemente actividades periódicas, resultando por exemplo de controladores operando cm malha fechada, c actividades esporádicas resultantes de eventos que ocorrem cm instantes imprevisíveis no ambiente a controlar. Todavia, a importância c tipos de requisitos temporais destas actividades são independentes da natureza da sua activação. Por outro lado, cm sistemas DCCS a flexibilidade tem vindo a crescer de importância, em resultado quer da necessidade de reduzir custos de instalação, configuração c manutenção, quer do uso deste tipo de sistemas cm aplicações emergentes, como manufactura ágil (flexible manufacturing), bases de dados de temporal com número variável de clientes, robótica móvel cm ambientes não estruturados c controlo automático de tráfego, que tem de lidar com ambientes que são inerentemente dinâmicos. Aplicações exibindo este grau de complexidade c dinamismo requerem sistemas suportando serviços activados quer pela passagem do tempo {time-triggered ) quer por eventos (event-triggered) com garantias temporais c ao mesmo tempo exibindo flexibilidade operacional, suportando alterações dinâmicas às características das actividades que compreendem. No que respeita especificamente ao sistema de comunicação, os protocolos existentes genericamente não preenchem estes requi¬sitos. Em sistemas eminentemente tiine.-trigge.red, os serviços eve.nt-trigge.red não existem ou são implementados de uma forma ineficiente, enquanto cm sistemas eminentemente eve.nt-trigge.red algumas das propriedades mais interessantes exibidas pelos sis¬temas time.-trigge.red são perdidas. Por outro lado flexibilidade c garantias temporais tem sido consideradas como propriedades conflituosas; sistemas que providenciam serviços com garantias temporais frequentemente requerem a especificação estática dos requisitos de comunicação, enquanto sistemas que suportam alte¬rações dinâmicas aos requisitos de comunicação usualmente não fornecem garantias temporais. O paradigma de comunicação apresentado nesta tese, denomi¬nado Flexible Time-Triggered communication (FTT), concentra os requisitos de comunicação e o escalonamento de tráfego num único nodo c utiliza uma técnica para distribuição do escalona¬mento denominada master/multi-slave. Esta caracteriza-se por consumir pouca largura de banda c por ser independente do al¬goritmo de escalonamento utilizado. Esta arquitectura facilita não só a implementação de escalonamento on-line., suportando portanto alterações aos requisitos de comunicação durante o fun¬cionamento do sistema, como também a implementação on-line. de controlo de admissão, o que permite rejeitar alterações que comprometam as garantias temporais do sistema, assegurando assim um comportamento previsível.Em alguns domínios específicos de aplicação de DCCS, verifica-se uma necessidade crescente de suporte a gestão on-line de Quali¬dade de Serviço (Quality of Service. / QoS). Genericamente, esta funcionalidade permite aumentar a eficiência da exploração dos recursos do sistema, pois habitualmente verifica-se uma relação directa entre o grau de recursos alceados às actividades de um sistema c o respectivo QoS. A gestão dinâmica de QoS requer um alto grau de flexibilidade, donde esta tese também descreve como o paradigma FTT suporta este tipo de serviço no que concerne ao tráfego.Esta tese apresenta o paradigma FTT c defende que este permite combinar no mesmo sistema de comunicação diferentes tipos de tráfego, com a possibilidade de alterar as suas propriedades, exe¬cutar gestão de QoS c alterar a politica de escalonamento durante o funcionamento, sem comprometer as garantias temporais gran¬jeadas ao tráfego c atingindo uma elevada eficiência no uso da largura de banda.O paradigma FTT apresentado nesta tese teve a sua génese no protocolo FTT-CAN. Após algum trabalho realizado sobre este protocolo verificou-se que os conceitos principais poderiam ser abstraídos, resultando um paradigma de comunicação genérico, passível de implementação em diversos meios de comunicação. Para verificar a performance do paradigma FTT, esta dissertação inclui algumas contribuições relativas ao protocolo FTT-CAN, nomeadamente no que concerne ao estudo do desempenho cm termos de escalonamento c análise de tempos de resposta. Por outro lado é também apresentada a implementação do paradigma FTT sobre Ethernet (FTT-Ethernet), a qual se destina a aplica¬ções mais exigentes no que respeita a poder de processamento c largura de banda, por exemplo aplicações integrando tráfego multimédia. No que respeita a este último protocolo explora-se essencialmente assuntos como a gestão dinâmica de QoS.

Advanced embedded systems can consist of many sensors, actuators and processors that are deployed on one or several boards, while having a demand of interacting with each other and sharing resources. Communication between different components usually has strict timing constraints. There is thus a strong need to provide solutions for time critical communication. This thesis focuses on both the support of real-time services over standard switched Ethernet networks and the improvement of systems' real-time characteristics, such as reducing delay and jitter in processors and on communication links. Switched Ethernet has been chosen in this work because of its major advantages in industry; it supports higher bit-rates than most other current LAN (Local Area Network) technologies, including field buses, still at a low cost. We propose using a star network topology with a single Ethernet switch. Each node is connected to a separate port of the switch via a full-duplex link, thereby eliminating collisions. A solid real-time communication protocol for switched Ethernet networks is proposed in the thesis, including a real-time layer between the Ethernet layer and the TCP/IP suite. The network has the capability of supporting both real-time and non real-time traffic and assuring adaptation to the surrounding protocol standards. Most embedded systems work in a dynamic environment, where the precise behavior of the network traffic can usually not be predicted. To support real-time services, we have chosen the Earliest Deadline scheduling algorithm (EDF) because of its optimality, high efficiency and suitability for being used in adaptive schemes. To be able to increase the amount of guaranteed real-time traffic, the notion of Asymmetric Deadline Partitioning Scheme (ADPS) is introduced. ADPS allows distribution of the end-to-end deadline of a message, sent from any source node in the network to any destination node via the switch, into two sub-deadlines, one for each hop according to the load of the physical link that it must traverse. For the EDF scheduling algorithm, the feasibility test is one of the most important techniques that provides us with information about whether or not the real-time traffic can be guaranteed by the network. With the same computational complexity as the feasibility test, a method has been developed to compute the minimum EDF-feasible deadline for a real-time task. The importance of this method in real-time applications lies in that it can be effectively used to reduce the response times of specific control activities or limit their input-output jitter. To allow more flexibility in the control of delay and jitter in real-time systems, a general approach for reducing task deadlines according to the requirements of individual tasks has been developed. The method allows the user to specify a deadline reduction factor for each task in order to better exploit the available slack according to the tasks' actual requirements.<br><p>Ingår även i serien: Technical report. D / Department of Computer Science and Engineering, Chalmers University of Technology, 1653-1787 ; 28</p>

The concept of Industrial Internet of Things (IIoT) is the tangible building block for the realisation of the fourth industrial revolution. It should improve productivity, efficiency and reliability of industrial automation systems, leading to revenue growth in industrial scenarios. IIoT needs to encompass various disciplines and technologies to constitute an operable and harmonious system. One essential requirement for a system to exhibit such behaviour is reliable exchange of information. In industrial automation, the information life-cycle starts at the field level, with data collected by sensors, and ends at the enterprise level, where that data is processed into knowledge for business decision making. In IIoT, the process of knowledge discovery is expected to start in the lower layers of the automation hierarchy, and to cover the data exchange between the connected smart objects to perform collaborative tasks. This thesis aims to assist the comprehension of the processes for information exchange in IIoT-enabled industrial automation- in particular, how reliable exchange of information can be performed by communication systems at field level given an underlying wireless sensor technology, and how data analytics can complement the processes of various levels of the automation hierarchy. Furthermore, this work explores how an IIoT monitoring system can be designed and developed. The communication reliability is addressed by proposing a redundancy-based medium access control protocol for mission-critical applications, and analysing its performance regarding real-time and deterministic delivery. The importance of the data and the benefits of data analytics for various levels of the automation hierarchy are examined by suggesting data-driven methods for visualisation, centralised system modelling and distributed data streams modelling. The design and development of an IIoT monitoring system are addressed by proposing a novel three-layer framework that incorporates wireless sensor, fog, and cloud technologies. Moreover, an IIoT testbed system is developed to realise the proposed framework. The outcome of this study suggests that redundancy-based mechanisms improve communication reliability. However, they can also introduce drawbacks, such as poor link utilisation and limited scalability, in the context of IIoT. Data-driven methods result in enhanced readability of visualisation, and reduced necessity of the ground truth in system modelling. The results illustrate that distributed modelling can lower the negative effect of the redundancy-based mechanisms on link utilisation, by reducing the up-link traffic. Mathematical analysis reveals that introducing fog layer in the IIoT framework removes the single point of failure and enhances scalability, while meeting the latency requirements of the monitoring application. Finally, the experiment results show that the IIoT testbed works adequately and can serve for the future development and deployment of IIoT applications.<br>SMART (Smarta system och tjänster för ett effektivt och innovativt samhälle)

This thesis addresses the problem of generating executable code for distributed embedded systems in which computing nodes communicate using the Controller Area Network (CAN). CAN is the dominant network in automotive and factory control systems and is becoming increasingly popular in robotic, medical and avionics applications. The requirements for functional and temporal reliability in these domains are often stringent, and testing alone may not offer the required level of con dence that systems satisfy their specications. Consequently, there has been considerable research interest in additional techniques for reasoning about the behaviour of CAN-based systems. This thesis proposes a novel approach in which system behaviour is specifed in a high-level language that is syntactically similar to Esterel but which is given a formal semantics by translation to bCANDLE, an asynchronous process calculus. The work developed here shows that bCANDLE systems can be translated automatically, via a common intermediate net representation, not only into executable C code but also into timed automaton models that can be used in the formal verification of a wide range of functional and temporal properties. A rigorous argument is presented that, for any system expressed in the high-level language, its timed automaton model is a conservative approximation of the executable C code, given certain well-defined assumptions about system components. It is shownthat an off-the-shelf model-checker (UPPAAL) can be used to verify system properties with a high-level of confidence that those properties will be exhibited by the executable code. The approach is evaluated by applying it to four representative case studies. Our results show that, for small to medium-sized systems, the generated code is sufficiently efficient for execution on typical hardware and the generated timed automaton model is sufficiently small for analysis within reasonable time and memory constraints.

Thesis (Ph. D.)--Massachusetts Institute of Technology, Dept. of Electrical Engineering and Computer Science, 1995.<br>Includes bibliographical references (p. 267-274) and index.<br>by Roberto Segala.<br>Ph.D.

<p>The focus of this dissertation is on large-scale and long-running networked real-time multiplayer games. In this type of games, each player controls one or many entities, which interact in a shared virtual environment. Three attributes - scalability, security, and fault tolerance - are considered essential for this type of games. The normal approaches for building this type of games, using a client/server or peer-to-peer architecture, fail in achieving all three attributes. We propose a server-network architecture that supports these attributes. In this architecture, a cluster of servers collectively manage the game state and each server manages a separate region of the virtual environment. We discuss how the architecture can be extended using proxies, and we compare it to other similar architectures. Further, we investigate how a distributed database management system can support the proposed architecture. Since efficiency is very important in this type of games, some properties of traditional database systems must be relaxed. We also show how methods for increasing scalability, such as interest management and dead reckoning, can be implemented in a database system. Finally, we suggest how the proposed architecture can be validated using a simulation of a large-scale game.</p>

Formal methods offer a way to deal with the complexity of information systems. They are adapted to a variety of domains like design, verification, model-checking, test and supervision. But information systems are also more and more often distributed, first because of the generalization of information networks, but also because inside a single device, like a computer, the numerous components run concurrently. The problem is that concurrency is known to be a major difficulty for the use of formal methods because it causes a combinatorial explosion of the state space of the systems. This difficulty comes sometimes with another one due to time when it plays an important role in the behaviour of the systems, for instance when the execution time is a critical parameter. These two difficulties, concurrency and real-time, have guided my research works. Sometimes I have tackled one of these two aspects separately, but in many of my works, I have dealt with the problems that arise when one studies systems that are both concurrent and real-time. In my habilitation thesis, I give an overview of my recent research works on dependencies between events in real-time distributed systems and on implementability issues for these systems.

In any system, good management depends on access to good information. In real-time systems, however, it is not enough to have access to correct data; that data should also be referenced to time. In distributed systems the validity of data is affected by many factors. Besides the errors that can occur because of hardware or software failures, inconsistency can occur through other factors such as uncontrolled access to distributed data, or because of uncompleted access to duplicated data. Many factors contribute to the incorrectness of data in the domains of value and time. This thesis sets out to investigate the requirements for handling hard real-time data in distributed databases, and suggests an architecture that allows access to such data in a timely and controllable manner. The nature of real-time data, and the requirements for accessing it in the presence of hard real-time and distributed-access constraints, are investigated. Current techniques that maintain the correctness of concurrent access to data in systems were investigated and found to be inappropriate in hard real-time situations. The need for suitable real-time techniques is therefore obvious and urgent, and so an approach that maintains the correctness of distributed access to data under real-time constraints, is proposed here. An experimental attempt to implement and measure the effectiveness of the proposed techniques using an existing environment is described, followed by a proposal for a more complete, fieldbus-based environment. The thesis concludes by showing the results of the work, as well as further research that could be done to obtain solutions to the problems described and partially solved in this thesis.

The OSI-based data communication standards, and particularly the MAP-selected profile, have provided a genuine, vendor-independent communication environment, crucial to multiple computer-based control applications. One of the vital components in the Application Layer of these standards, aimed directly at supporting communications between programmable devices in manufacturing environments, is the 'Manufacturing Message Specification' (MMS). Although MMS has been acknowledged as vitally important in standardizing communications between shop-floor devices, and despite having been developed specifically for industrial environments, it does not have the capacity to support directly the time-critical services which are vital to real-time applications. Effort, therefore, needs to be expended in extending the current MMS concepts to fulfil real-time requirements. This thesis is dedicated to tackling this problem. It first analyzes the real-time requirements and the related OSI-based standards, especially MMS. Then it proposes services and functions which should be included within both the inherent OSI supporting structures and MMS itself, in order to fulfil these real-time requirements. The thesis also provides background comments on the support required from the associated computer architectures. Finally, it reviews a prototype implementation of the proposals and analyzes the results obtained. The original contribution of this work lies in the proposed extensions to the core MMS proposal - these being based on a fundamentally radical architecture, which it is suggested, is necessary to support a genuine real-time distributed computer control system.

In our modern life, embedded systems are playing an essential role. An embedded system is a computer system embedded into a certain device, in order to achieve computing functions. Beyond all doubt, as a validated system, the functional correctness must be guaranteed. However, for many embedded systems, timeliness also plays an important role in addition to the correctness of the functionalities. For example, in an automotive braking system, the braking function needs to be processed within a limited time duration in order to avoid accidents. Such systems are known as real-time embedded systems. In these systems, there can be plenty of software programs (called tasks) sharing limited computing resources (e.g. processors, memories). If the system executes tasks in a random way, the whole system will become unpredictable. As a result, the system designers will not be able to verify if the system design can fulfill all the timing requirements or not. In other words, the system is not guaranteed to be safe. Therefore, system designers need to carefully implement algorithms to schedule all the tasks in a predictable manner. Regarding each scheduling algorithm, schedulability analyses are proposed which are used to check if the requirements can be satisfied. Unfortunately, many real-time systems reserve too much computing resource for the sake of fulfilling timing requirements, without taking into account resource utilization. As a result, system resources cannot be efficiently utilized, which can cause significant resource waste in reality. Therefore, in this thesis, we aim to improve resource utilization in modern distributed real-time embedded systems. We try to tackle this problem from the following two aspects. Investigating tighter timing analyses. Due to the difficulty in performing precise mathematical schedulability analyses, most of the existing analyses include varying degrees of pessimism. In other words, the actual performance of the system can be much better than the predictions. If we can reduce the pessimism in schedulability analyses, we can then admit more workload into the system. Proposing new scheduling frameworks. It is difficult to find a scheduling algorithm which is suitable for all the situations. Therefore, we need different mechanisms to handle specific system characteristics in order to improve the resource utilization.<br>START

In this dissertation, we consider scheduling distributed soft real-time tasks in unreliable (e.g., those with arbitrary node and network failures) and untrustworthy systems (e.g., those with Byzantine node behaviors). We present a distributed real-time scheduling algorithm called Gamma. Gamma considers a distributed (i.e., multi-node) task model where tasks are subject to Time/Utility Function (or TUF) end-to-end time constraints, and the scheduling optimality criterion of maximizing the total accrued utility. The algorithm makes three novel contributions. First, Gamma uses gossip for reliably propagating task scheduling parameters and for discovering task execution nodes. Second, Gamma achieves distributed real-time mutual exclusion in unreliable environments. Third, the algorithm guards against potential disruption of message propagation due to Byzantine attacks using a mechanism called Launcher-Attacker-Infective-Susceptible-Immunized-Removed-Consumer (or LAISIRC). By doing so, the algorithm schedules tasks with probabilistic termination-time satisfactions, despite system unreliability and untrustworthiness. We analytically establish several timeliness and non-timeliness properties of the algorithm including probabilistic end-to-end task termination time satisfactions, optimality of message overheads, mutual exclusion guarantees, and the mathematical model of the LAISIRC mechanism. We conducted simulation-based experimental studies and compared Gamma with its competitors. Our experimental studies reveal that Gammaâ s scheduling algorithm accrues greater utility and satisfies a greater number of deadlines than do competitor algorithms (e.g., HVDF) by as much as 47% and 45%, respectively. LAISIRC is more tolerant to Byzantine attacks than competitor protocols (e.g., Path Verification) by obtaining as much as 28% higher correctness ratio. Gammaâ s mutual exclusion algorithm accrues greater utility than do competitor algorithms (e.g., EDF-Sigma) by as much as 25%. Further, we implemented the basic Gamma algorithm in the Emulab/ChronOS 250-node testbed, and measured the algorithmâ s performance. Our implementation measurements validate our theoretical analysis and the algorithm's effectiveness and robustness.<br>Ph. D.

Modern distributed control systems comprise of a set of processors which are interconnected using a suitable communication network. For use in real-time control environments, such systems must be deterministic and generate specified responses within critical timing constraints. Also, they should be sufficiently robust to survive predictable events such as communication or processor faults. This thesis considers the problem of coordinating and synchronizing a distributed real-time control system under normal and abnormal conditions. Distributed control systems need to periodically coordinate the actions of several autonomous sites. Often the type of coordination required is the all or nothing property of an atomic action. Atomic commit protocols have been used to achieve this atomicity in distributed database systems which are not subject to deadlines. This thesis addresses the problem of applying time constraints to atomic commit protocols so that decisions can be made within a deadline. A modified protocol is proposed which is suitable for real-time applications. The thesis also addresses the problem of ensuring that atomicity is provided even if processor or communication failures occur. Previous work has considered the design of atomic commit protocols for use in non time critical distributed database systems. However, in a distributed real-time control system a fault must not allow stringent timing constraints to be violated. This thesis proposes commit protocols using synchronous communications which can be made resilient to a single processor or communication failure and still satisfy deadlines. Previous formal models used to design commit protocols have had adequate state coverability but have omitted timing properties. They also assumed that sites communicated asynchronously and omitted the communications from the model. Timed Petri nets are used in this thesis to specify and design the proposed protocols which are analysed for consistency and timeliness. Also the communication system is mcxielled within the Petri net specifications so that communication failures can be included in the analysis. Analysis of the Timed Petri net and the associated reachability tree is used to show the proposed protocols always terminate consistently and satisfy timing constraints. Finally the applications of this work are described. Two different types of applications are considered, real-time databases and real-time control systems. It is shown that it may be advantageous to use synchronous communications in distributed database systems, especially if predictable response times are required. Emphasis is given to the application of the developed commit protocols to real-time control systems. Using the same analysis techniques as those used for the design of the protocols it can be shown that the overall system performs as expected both functionally and temporally.