Abstract: Real-time embedded system (RTES) needs to guarantee not only logical correctness of the calculation results, but also temporal correctness of the interaction with outside world, so low-level programs must be able to accurately express time behavior in upper-level models. TTI instruction set (time-triggered instruction set) is proposed to try to solve the problem of the lack of timing semantics at the computer instruction set architecture level, and the realization of real-time processing unit (RPU) based on TTI instruction set proves the feasibility and effectiveness of TTI instruction set. However, the current work lacks research on design and analysis method of TTI program. Therefore, based on TTI instruction set and RPU, we propose four types of timing semantics that TTI instruction set can express, give the design paradigm of TTI program. Then, we define the representation of TTI program time behavior — TFG+, which is an extension of TFG. TFG+ distinguishes timing semantic instructions and the common code segments in the TTI program, and TFG+ can represent the control flow information of TTI program, the time behavior specified by the user, and the time attributes related to hardware platform. Finally, we propose time analysis method of TTI program and time safety checking method, which provide the basis for the design and deployment of TTI program.