  Timing guarantees are crucial to cyber-physical applications that must bound
the end-to-end delay between sensing, processing and actuation. For example, in
a flight controller for a multirotor drone, the data from a gyro or inertial
sensor must be gathered and processed to determine the attitude of the
aircraft. Sensor data fusion is followed by control decisions that adjust the
flight of a drone by altering motor speeds. If the processing pipeline between
sensor input and actuation is not bounded, the drone will lose control and
possibly fail to maintain flight.
  Motivated by the implementation of a multithreaded drone flight controller on
the Quest RTOS, we develop a composable pipe model based on the system's task,
scheduling and communication abstractions. This pipe model is used to analyze
two semantics of end-to-end time: reaction time and freshness time. We also
argue that end-to-end timing properties should be factored in at the early
stage of application design. Thus, we provide a mathematical framework to
derive feasible task periods that satisfy both a given set of end-to-end timing
constraints and the schedulability requirement. We demonstrate the
applicability of our design approach by using it to port the Cleanflight flight
controller firmware to Quest on the Intel Aero board. Experiments show that
Cleanflight ported to Quest is able to achieve end-to-end latencies within the
predicted time bounds derived by analysis.
