Get started
Work

Flexibility and Intrusion Resilience for Time-Triggered Real-Time Systems in Open Safety-Critical Environments

Year: 2026
Type: dissertation
Abstract: The Time-Triggered Architecture (TTA) has long served as a foundational model for safety-critical distributed real-time systems in domains such as avionics and automotive control, offering strong guarantees regarding extra-functional properties such as determinism, temporal predictability, fault containment, temporal composability and the ability to satisfy complex timing constraints. Historically, these systems relied on a closed-world assumption where they functioned in fully controlled environments and interfaced exclusively with design-time-known and trusted components. However, the evolving requirements of modern safety-critical real-time systems are driving a shift away from closed architectures toward open, integrated platforms characterized by high connectivity, increased complexity, adaptive resource demands, interaction with non-real-time components, and extended autonomous mission durations. This shift exposes two structural limitations of TTA. First, its static design restricts flexibility when systems must handle dynamic workloads. Second, its original fault model, which focuses solely on accidental faults, fails to address intelligent adversaries who exploit predictable temporal structures and extended mission times for time-domain and resource-exhaustion attacks. In this thesis, we examine the combined challenges of flexibility and intrusion resilience in open TTA-based systems and propose solutions that preserve TTA's extra-functional properties. As a first step, we investigate and classify the dependencies between TTA's core dependability services and its extra-functional properties, thereby establishing a foundation that enables architects to identify which aspects of TTA are essential and which can be modified or replaced while preserving the desired system properties. Building on this foundation, the thesis advances two central objectives. In the first objective, we advance flexibility within time-triggered systems. We introduce dynamic time-triggered schedulers that allocate computation slots at runtime while preserving the timing guarantees established through offline scheduling. The Dynamic Task Set Scheduler (DTSS) represents our solution within this class and supports operation with static and dynamic granularity. We enable DTSS to admit, remove and modify aperiodic tasks at runtime under time-triggered operation by integrating the Remaining Processor Capacity Analysis (RPCA) into its mechanisms. We design RPCA as part of this work to provide the analysis required for these runtime adaptations. We further examine the integration of periodic and sporadic tasks into time-triggered systems with dynamic schedulers and develop exact feasibility tests for this purpose. For sporadic tasks, we also develop runtime exact tests, the (Quick) Processor Demand Analysis ((Q)PDA*), which use periodic-demand preprocessing and quick convergence to determine feasibility within practical computational limits (achieving two to three orders of magnitude better runtime performance compared to state-of-the-art methods and our exact tests without these techniques). Our scheduler and exact tests improve flexibility under time-triggered operation while preserving TTA's extra-functional properties. In the second objective, we focus on analyzing the vulnerability of TTA-based systems to time-domain attacks, designing resource- and synchrony-exhaustion attacks targeting TTA nodes and their local bus guardians, and developing corresponding countermeasures. We establish an impossibility result for synchronizing network-agnostic guardians in the presence of malicious nodes and design our countermeasures to circumvent this limitation, thereby strengthening the resilience of time-triggered systems against intruders. Our countermeasures rely on a replica-aware rejuvenation service integrated into a trusted hardware component named SyncGuard. This component operates as a local network-agnostic guardian that coordinates network access with proactive and reactive node rejuvenation. It maintains synchrony, defends the system against resource-exhaustion attacks, and enables collision-free communication across heterogeneous network topologies without incurring the substantial overhead associated with classical network-aware variants. The contributions in this thesis establish a basis for the next generation of intrusion-tolerant and flexible distributed real-time systems, preserving the stringent dependability guarantees of the time-triggered architecture while meeting the flexibility requirements of modern open architectures.
DOI: 10.26204/kluedo/13606
Language: English
Open Access status: green
OpenAlex ID: W7214101444
Cites:
Cited by:
Related to: