Building Large,Complex, Distributed Safety-Critical Operating Systems

Safety-critical systems typically operate in unpredictable environments. Requirements for safety and reliability are in conflict with those for real-time responsiveness. Due to unpredictable environmental needs there is no static trade-off between measures to accommodate the conflicting objectives. Instead every feature or operating system service has to be adaptive. Finally, for any design problem, there cannot be any closed-form (formal) approach taking care at the same time of (external) time constraints or deadlines, and synchronization requirements in distributed design. The reason is that these two aspects are causally independent. - In this situation we worked out a heuristic experimental, performance-driven and performance-based methodology that allows in an educated way to start with a coarse system model, with accurate logical expectations regarding its behavior. Through experiments these expectations are validated. If they are found to successfully stand the tests extended expectations and model features are generated for refining the previous design as well as its performance criteria. The refinement is done in such a way that the previous experimental configurations are extreme model cases or data profiles which both logically and experimentally are to reproduce the behavior of the previous modeling step. Thus the novel performance aspects or tendencies could then unambiguously be attributed to the influences of the refined model features. We termed this methodology Incremental Experimentation. As a general methodology it relies on a principle of comparative performance studies rather than on realistic data for narrow application ranges. The paper describes how we applied a 5-step design and refinement procedure for developing, analyzing, and evaluating our distributed operating system MELODY that exhibits novel services for supporting real-time and safety-critical applications in unpredictable environments. Experimental set-ups and theme-related findings are discussed in particular.     

MELODY: A completely decentralized adaptive file system for handling real-time tasks in unpredictable environments

We describe the major features of the completely decentralized adaptive file system MELODY which was designed for realizing anintegrated system design for a distributed real-time system working in a hazardous and unpredictable environment. MELODY's adaptivity mechanisms are based on novel services rendered by the distributed operating system DRAGON SLAYER. The file system, in order to both meet real-time constraints and provide for high availability, allows for replicating, relocating, or deleting file copies. Such copies may also bepublic orprivate. At every site aLocal Task Scheduler tries to schedule the arriving critical tasks, based on the availability of resources at this site such that deadline failures are minimized. Depending on the deadline failure history, status changes as well as file replication, deletion, or relocation are analyzed and managed by the cooperatingLocal File Assigners. In order to analyze MELODY's real-time performance we report on simulation experiments in which its capability of minimizing deadline failures of time-critical tasks was compared to other file system models: an idealbest-case model, abaseline model with no file replication, a file system allowingonly for replication ofprivate copies, and a model which allows forreplication and relocation of public copies only. While the best-case is unrealistic for a distributed implementation, the other models embody only part of MELODY's mechanisms yet have the benefit of a considerably smaller communication overhead. We report on the distributed simulation results which unambiguously show MELODY's superior performance, in addition to the built-in sensitivity to changes in the environment. A DRAGON SLAYER/MELODY prototype has been completed in our labs in order to serve as a distributed real-time testbed in our future work with MELODY.This work was partially supported by IBM Endicott (research Agreement No. 6073-86) by the State of Michigan (IMR-87-146751), and by General Dynamics Land Systems (#DEY-605089).     

Formal timing analysis for distributed real-time programs

A static analysis method for verifying timing properties of real-time distributed programs is presented. The goal is to calculate the worst-case response time of concurrent tasks which run mainly independently but share, and may have to wait for, logical or physical devices. For such tasks, the determination of the worst-case waiting time is a crucial problem because of the unpredictable order of synchronization events. We investigate the class of distributed Client-Server programs in which independent, time-critical tasks (clients) are synchronized only through additional server tasks, playing the role of monitors or resource managers. This model follows well-known real-time design guidelines for distributed ADA programs proposed to enhance schedulability and synchronization analysis. Our formal analysis approach is flow graph oriented. It leads to generating reduced program paths each of which represents a sequence of ordered local and global operations, thus transforming and reducing the original problem of computing the worst-case waiting time of a concurrent task into a graph-theoretic problem of calculating the maximal blocking time for one of its corresponding program paths. While local operations are completely independent global operations require mutually exclusive access to shared resources. We prove that computing the worst-case blocking time for a program path is NP-complete. Even for a reduced problem solution—which would yield a good upper bound for the worst-case blocking time—there was a conjecture maintained over many years that this problem was NP-complete. A major result of this paper is to show that this is wrong. Instead, we construct a polynomial solution algorithm, and we prove its correctness. The effectiveness and complexity of our method are discussed, with particular emphasis on distributed real-time debugging.     

Protokollierung und Arbeitnehmerdatenschutz

Zusammenfassung  Der Umgang mit Protokolldaten birgt aus arbeitsrechtlicher Sicht das grundlegende Problem in sich, das Arbeitnehmer im Missbrauchsfall ihre Rechte selbst durchsetzen müssen. Besser stellt sich die Situation nur dann dar, wenn bestehende Betriebsr?te einschl?gige Regelungen abgeschlossen haben. Prof. Dr. Peter Wedde Professor für Arbeitsrecht und Recht der Informationsgesellschaft im FB 2 — Informatik und Ingenieurwissenschaften und Beh?rdlicher Datenschutzbeauftragter der Fachhochschule Frankfurt am Main     

High‐Throughput Feasible Screening Tool for Determining Enzyme Stabilities against Organic Solvents Directly from Crude Extracts

Biotransformations in organic chemistry frequently suffer from limitations caused by low water‐solubility of substrates and product inhibition. Both, usually are addressed by the addition of organic cosolvents, which often accompanies at the expense of enzyme stability. A common method for measuring enzyme stability is to determine the melting temperature (T_m) of the enzyme. However, current methods are limited to the application of purified enzymes. Herein, for the first time, an easy and fast (<1 h) high‐throughput feasible method to determine enzyme stabilities directly from crude extracts is reported. In pure buffer, the T_m value measured in the crude extract was identical to that obtained for the purified enzyme. Through the addition of different organic compounds, the T_m values in the crude extract differed by up to 2.4 °C from that of the purified enzymes due to the presence of the host‐cell proteins. Thus, the measurement of enzyme stabilities in crude extracts appears to represent conditions in whole‐cell catalysts even better. The applied nano differential scanning fluorimetry technology is further proven to be suitable for whole‐cell catalysts with two overexpressed enzymes; thus representing a tool for the rapid screening of natural and mutant enzyme libraries in terms of process stability for challenging biotransformations.     

Zur Koexistenz von aktiven und passiven Bereichen auf Elektroden in oxidierenden Lösungen. Untersuchungen an einer Zinkelektrode in phosphathaltigen Jodlösungen

The coexistence of active and passive zones on elctrodes in oxidising solutions. Investigation of a zinc electrode in phosphate-containing iodine solutions Earlier work on the coexistence of active and passive zones on an anodically charged zinc electrode in aphosphate solution has been extended to include the condition of the electrode being externally currentless and the anodic partial current being compensated by a cathodic partial current. The cathodic partial reaction comes from the iodine/iodide redox reaction at the zinc electrode. A general theoretical derivation is presented to show the behaviour, with reference to the area of the active zones, as a function of the electrolyte concentration. Two additional borderline cases are discussed, viz. electron-conducting and non-con-ducting covering layers. The theoretical investigations have been compared with the experiment; they show the applicability of the model for the system investigated.     

Dezentrale vernetzte Energiebewirtschaftung (DEZENT) im Netz der Zukunft

Given the sharply rising costs for traditional energy (based on coal, fossil oil or gas etc.) over the past few years renewable energy sources such as wind, sun, water, or seed oil have favorably come into the picture as economically desirable and ecologically clean alternatives. The corresponding power facilities (e.g. wind power stations, solar panels, block heat & power plants) are widely distributed and are quite heterogeneous regarding their productivity (capacity and reliability) yet at the same time transport paths and costs are at a minimal level. (In the near future it will be possible to cover all needs from such sources.) For guaranteeing both the adaptive integration of the diverse facilities and a balanced level of supply under (locally) highly unpredictable energy production we present a bottom-up power grid management architecture. A key novelty of our approach is a completely decentralized management for negotiating the available power supply and needs. This is realized through a safety-critical, real-time multi-agent system where bids and offers are negotiated on the (electrically) shortest time basis of 0.5 sec. While the system is secure against malicious attacks it exhibits a high amount of fault tolerance where the latter corresponds well to the exceptional production safety of the widely distributed facilities. Beyond the high supply reliability under the decentralized management of distributed facilities we demonstrate that both operation costs and consumer prices could be assumed lower than under a centralized management and architecture.