The design of real-time systems is based on assumptions about environmental conditions in which they will operate. We call this their safe operational envelope. Violation of these assumptions, i.e., out-of-envelope environments, can jeopardize timeliness and safety of real-time systems, e.g., by overwhelming them with interrupt storms. A long-lasting debate has been going on over which design paradigm, the time- or event-triggered, is more robust against such behavior. In this work, we investigate the claim that time-triggered systems are immune against out-of-envelope behavior and how event-triggered systems can be constructed to defend against being overwhelmed by interrupt showers. We introduce importance (independently of priority and criticality) as a means to express which tasks should still be scheduled in case environmental design assumptions cease to hold, draw parallels to mixed-criticality scheduling, and demonstrate how event-triggered systems can defend against out-of-envelope behavior.

翻译：实时系统的设计基于对其运行环境条件的假设，我们称之为安全运行包络。这些假设的违反（即超包络环境）可能危及实时系统的时效性与安全性，例如通过中断风暴使系统过载。长期以来，关于时间触发与事件触发这两种设计范式何者对此类行为更具鲁棒性的争论持续存在。本研究探讨了时间触发系统对超包络行为具有免疫力的主张，并研究如何构建事件触发系统以防御中断洪流的冲击。我们引入重要性（独立于优先级与关键性）作为表达当环境设计假设失效时仍应调度哪些任务的手段，将其与混合关键性调度进行类比，并论证事件触发系统如何实现对超包络行为的有效防御。