We study a methodology for constructing scheduled systems by restricting successively the behavior of the processes to be scheduled. Restriction is used to guarantee the satisfaction of two types of constraints: schedulability constraints characterizing timing properties of the processes, and constraints characterizing particular scheduling algorithms including process priorities, non-idling, and preemption. The methodology is based on a controller synthesis paradigm. The main results deal with the characterization of scheduling policies as safety constraints and the simpli cation of the synthesis process by applying a composability principle.

This paper provides a brief overview of ve projects in which Honeywell has successfully used or developed model checking methods in the veri cation and synthesis of safety-critical systems. 1