Closing the Loop for the Selective Conversion Approach: A Utilization-based Test for Hard Real-Time Suspending Task Systems

Transcription

1 216 IEEE Real-Time Systems Symposium Closing the Loop for the Selective Conversion Approach: A Utilization-based Test for Hard Real-Time Suspending Task Systems Zheng Dong and Cong Liu Department of Computer Science, University of Texas at Dallas Abstract. This paper studies the problem of scheduling hard real-time sporadic suspending task systems under global earliest-deadline-first. A novel selective suspension-tocomputation conversion approach has been developed, with the fundamental idea of selecting and converting a limited set of jobs suspensions into computation to eliminate suspension-induced pessimism in the analysis. To the best of our knowledge, this approach yields the first utilization-based test for globally-scheduled suspending task systems, which analytically dominates the suspension-oblivious approach and dramatically improves schedulability upon existing tests by over 5% on average, as shown by experiments. We believe this paper closes the loop on applying the methodology of selective suspension-to-computation conversion to analyze realtime suspending task systems. 1 Introduction The problem of analyzing schedulability of real-time task systems that may incur suspensions during execution is receiving much recent attention [1] [1]. The resulting suspension delays due to tasks blocking to access shared recourses or external devices may vary, e.g., delays introduced by disk I/O range from 15μs (for NAND flash) to 15ms (for magnetic disks) per read [11]. Even longer delays are possible when accessing computation accelerators. Unfortunately, such delays cause intractabilities in schedulability analysis [12], even on uniprocessors [13]. According to our past experience, a key challenge in analyzing schedulability when suspensions are present is that multiple tasks (all tasks in the worst case) may have jobs pending (i.e., not completing) and suspending at a non-busy time instant (i.e., when at least one processor is idle). We call such idleness suspensioninduced idleness. For ordinary sporadic task systems, it is safe to assume that at most m 1 (where m denotes the number of processors) tasks have pending jobs at any non-busy instant, which is critical to upper-bound the amount of workload at that instant so that a schedulability condition can be further derived. Unfortunately, with suspension-induced idleness, it is only safe to assume that all tasks have pending jobs at any non-busy instant, thus causing the workload upper bound unnecessarily pessimistic and the final test derivation either impossible or unacceptably pessimistic. A recent set of works [2], [6], [8], [14], [15] have been proposed to analyze hard real-time (HRT) suspending task systems on uniprocessors or multiprocessors. Although the results are promising and quite encouraging, they tend not to directly tackle the challenge due to suspension-induced idleness, but rather to analyze schedulability assuming this (perhaps avoidable) worst-case scenario. For example, the bursty-interference analysis technique [2] discovers a bursty Work supported by NSF grant CNS job arrival pattern by assuming all tasks suspend during non-busy instances and presents methods to upper-bound the resulting bursty workload. Intuitively, however, techniques that take such a detour can be pessimistic as the fundamental issue due to suspension-induced idleness is still upfront and remains unsolved. The selective suspension-to-computation conversion approach. A recent work [1] introduced a new methodology on supporting soft real-time (SRT) suspending task systems under global earliest-deadline-first (GEDF) with bounded tardiness, namely the selective suspension-to-computation conversion (SSCC) approach. The basic idea behind is to selectively convert certain jobs suspensions into computation only when it is necessary to do so to eliminate suspensioninduced idleness. Consider the most commonly used approach for dealing with suspensions in real-time systems, namely the suspension-oblivious approach, which blindly converts all jobs suspensions into computation. The suspension-oblivious approach lies on the extreme-pessimistic side of the SSCC approach, where no smart selection is made for conversion purposes. It yields O(n) utilization loss where n is the number of suspending tasks in the system. In [1], the authors presented a new task-level SSCC approach for SRT suspending task systems with bounded tardiness, which only needs to convert the suspensions of jobs belonging to at most m tasks at any time instant. The resulting test yields O(m) utilization loss, which dominates and dramatically improves upon the suspension-oblivious approach. Challenges under the HRT case. For SRT suspending task systems, a key reason behind the O(m) utilization loss is due to tardy tasks properties. If a task is tardy, then we know that all its tardy jobs will execute and suspend continuously on an idle processor. Thus for each processor, it is good enough to identify only one tardy task and convert all its tardy jobs suspensions into computation within each analysis interval, which eliminates all suspension-induced idleness in that interval. A test with an O(m) utilization loss is thus achieved since for each of the m processors, the utilization of one tardy task needs to be sacrificed due to conversion at any time. Unfortunately, under the HRT case, this nice selection criteria does not exist. Since jobs may complete before deadlines, the interval between a job s completion and its deadline may become naturally idle while another job may suspend during this idle interval. Thus, within a job s execution window on one processor (i.e., from its release to its deadline), multiple jobs of different tasks may cause suspension-induced idleness in different sub-intervals. Such a scenario will force the selection of more than one task on one processor at any time instant to eliminate suspension-induced idleness, which clearly causes the number of tasks selected for conversion to exceed m. This fact makes the HRT case fundamentally more challenging than the SRT case /16 $ IEEE DOI 119/RTSS

2 Figure 1: Example motivating the challenge under the HRT case. (The legends shown herein will be used throughout the paper.) Consider the example shown in Fig. 1, where three suspending tasks are scheduled on two processors (tasks parameters are ignored herein due to unnecessity). Fig. 1 shows three different concrete GEDF schedules. In Fig. 1.(a), all three tasks are required to convert their job suspensions into computation to eliminate all suspension-induced idleness (i.e., intervals [2, 4) and [7, 9)); whereas only two and one tasks are needed for the conversion purpose in Fig. 1(b) and Fig. 1(c), respectively. This example intuitively shows that an O(m) task-level conversion approach may not be possible for the HRT case where a more flexible SSCC approach is required. Motivated by the above insights, instead of trying to identify a task-level SSCC approach, we creatively design in this paper a more flexible job-level SSCC approach to iteratively convert a selected set of jobs suspensions into computation. A key benefit of the job-level SSCC approach is that by selecting a set of jobs that may belong to different tasks (the number of such tasks may be <mor m), we are still able to characterize the utilization loss due to the conversion. We show that this approach works under GEDF for multiprocessor HRT suspending task systems. This approach yields a utilization-based schedulability test that dominates the suspension-oblivious approach. Notably, as we will show in later analysis and experiments, the magnitude of the resulting suspension-induced utilization loss (i.e., utilization loss due to tasks suspension-to-computation conversion at any time instant) can be even smaller than O(m) in many scenarios. Overview of related work. The problem of analyzing schedulability of real-time suspending tasks has received much attention [1] [8], [13], [16] [21]. It has been shown that the feasibility problem for scheduling HRT suspending task systems on a uniprocessor is NP-hard in the strong sense [1]. A recent set of works present several response time analysis techniques that lead to encouraging results on this problem [2], [5] [8]. However, the pessimism behind these analysis can still be significant in many cases due to the fact that they tend to analyze schedulability always assuming the worstcase scenario (i.e., suspension-induced idleness exists at any non-busy instant). However, without directly tackling this fundamental issue, any approach is unlikely to result in good performance. In [1], the authors introduced a new methodology that seeks to eliminate any suspension-induced idleness by selectively converting only a limited set of tasks suspensions into computation. They showed that by applying the introduced SSCC approach, a schedulability test with an O(m) utilization loss can be achieved for SRT suspending tasks with bounded tardiness. In this paper, we seek to develop a new SSCC approach that is applicable to HRT suspending task systems. Contributions. In this paper, we derive a schedulability test showing that any given HRT suspending task system τ is schedulable under GEDF if U sum + v j ei + si m (m 1) max( ), (1) τ i τ p i provided that : K 2 K (2 K n), E i p max, (2) where U sum is the total system utilization, v j is the j th maximum suspension ratio, where a task s suspension ratio is given by the ratio of its suspension length over its period, e i, s i, and p i denotes task τ i s execution time, suspension length, and period, respectively, p max denotes the maximum task period in τ, ande i denotes the i th minimum (e j + s j ) among tasks τ j τ. To establish this test, we invent two novel analysis techniques: the job-level iterative SSCC approach (Sec. 3.1) and the executing/non-executing interval analysis technique (Sec. 3.2). These two approaches are created to handle some of the key challenges caused by suspensions in HRT schedulability analysis. The above test can be intuitively viewed as a suspensionaware version of the classical density test [22] designed for ordinary sporadic task systems, where suspensions of jobs of at most 2 K n tasks must be converted into computation at any time instant, causing an additional O(K) suspensioninduced utilization loss as shown on the left-hand side of Eq. 1. A major constraint lies in Eq. 2 which decides the value of the important variable K, where it is required that the sum of the K minimum additions of computation time and suspension of tasksmustbeatleastp max. If a task system contains even only one task whose period is enormously large compared to the rest n 1 tasks, then our test may still fail. To relax the constraint posed by Eq. 2, we propose an optimization (Sec. 4) that allows Eq. 2 not to consider arbitrary tasks with large periods by adding their utilizations on the left-hand side of Eq. 1. Intuitively, this optimization is efficient because the utilization of a task that has a large period is often small (the effectiveness has also been shown by experiments). We prove the proposed optimization algorithm is optimal while running in only linear-time. Our schedulability test theoretically dominates the suspension-oblivious approach combined with the density test [23]. As demonstrated by experiments, our proposed test significantly improves upon prior methods w.r.t schedulability, by over 5% on average. Notably, results show that the value of K can oftenbe smaller than m, which results in a magnitude of suspension-induced utilization loss that is smaller than O(m). We believe this paper closes the loop on applying the methodology of SSCC to analyze real-time suspending task systems. 2 System Model We consider the problem of scheduling a set τ = {τ 1,τ 2,...,τ n } of n HRT sporadic suspending tasks on m 1 identical processors M 1,M 2,...,M m. Each task is released Under the density test, an implicit-deadline sporadic task system is schedulable under GEDF if U sum m (m 1) u max holds, where u max denotes the maximum task utilization in the system. i=1 34

3 repeatedly, with each such invocation called a job. Jobs alternate between computation and suspension phases. We assume that each job of τ i executes for at most e i time units (across all of its execution phases) and suspends for at most s i time units (across all of its suspension phases). We place no restrictions on how these phases interleave (a job can even begin or end with a suspension phase). The j th job of τ i, denoted τ i,j,is released at time r i,j and has a deadline at time d i,j. Associated with each task τ i are a period p i, which specifies the minimum time between two consecutive job releases of τ i, and a deadline d i, which specifies the relative deadline of each such job, i.e., d i,j = r i,j + d i. We further let u i denote the utilization of τ i, where u i = e i /p i, and the utilization of the task system τ is defined as U sum = n i=1 u i. Successive jobs of the same task are required to execute in sequence. We require e i + s i p i, u i 1, andu sum m; otherwise, deadlines will be missed. A suspending task system τ is said to be an implicit-deadline system if d i = p i holds for each τ i. We focus on implicitdeadline task systems and GEDF scheduling where released jobs are prioritized by their absolute deadlines and scheduled preemptively according to EDF. We assume that ties are broken by task ID (lower IDs are favored). Throughout the paper, we assume that time is integral. Thus, a job that executes or suspends at time instant t executes or suspends during the entire time interval [t, t +1). 3 Schedulability Analysis We now present our new schedulability analysis. Our approach is fundamentally based on the lag-based reasoning which has been used extensively to analyze ordinary sporadic task systems [24] [27]. For the HRT case, we focus on analyzing what happens when a deadline is missed given any suspending task system τ. Lett d denote the first time instant in any such schedule S at which a deadline is missed. Let job τ h,l be the job that misses its deadline d h,l at t d. We focus on analyzing τ h,l and the time interval [,t d ). We first describe the proof setup, then present our new job-level iterative transformation technique in Sec. 3.1, and finally derive a resulting schedulability test using a newly developed executing/nonexecuting interval analysis technique in Sec Definition 1. Ataskτ i is active at time t if there exists a job τ i,v such that r i,v <t<d i,v. Definition 2. A job is considered to be completed if it has finished its last phase (it may be suspension or computation). Let f i,v denote the completion time of job τ i,v.jobτ i,v misses its deadline if it completes after its deadline. Definition 3. Job τ i,v is pending at time t if r i,v <t<f i,v. Definition 4. If job τ i,v is pending, not suspended and does not execute at t, then it is preempted at t. Definition 5. Job set d contains jobs with the following relationship with τ h,l : d = {τ i,v :(d i,v <t d ) (d i,v = t d i h)}. Definition 6. For any given suspending task system τ, a processor share (PS) schedule is an ideal schedule where each task τ i executes with a rate equal to u i when it is active (which Lag-based reasoning has been extensively used to analyze SRT sporadic task systems [24], [26], [27]. A proof sketch on deriving the density test using lag-based reasoning has also been given in a dissertation [25]. ensures that each of its jobs completes exactly at its deadline). Note that suspensions are not considered in the PS schedule. A valid PS schedule exists for τ if U sum m holds. By Def. 5, d is the set of jobs with deadlines at most t d and with priorities at least that of τ h,l. These jobs do not execute beyond t d in the PS schedule. Note that τ h,l is in d. Also note that jobs not in d have lower priorities than those in d and thus do not affect the scheduling of jobs in d. For simplicity, we will henceforth assume that jobs in τ but not in d do not execute in either the GEDF schedule S or the corresponding PS schedule. Our schedulability test is obtained by comparing the allocations to τ in the GEDF schedule S and the corresponding PS schedule, both on m processors, and quantifying the difference between the two. We analyze task allocations on a per-task basis. Let A(τ i,v,t 1,t 2, S) denote the total allocation to job τ i,v in S in [t 1,t 2 ). Then, the total time allocated to all jobs of τ i in [t 1,t 2 ) in S is given by A(τ i,t 1,t 2, S) = v 1 A(τ i,v,t 1,t 2, S) (3) Let PS denote the PS schedule that corresponds to the GEDF schedule S (i.e., the total allocation to any job of any task in PS is identical to the total allocation of the job in S). The difference between the allocation to a job τ i,v up to time t in PS and S, denoted the lag of job τ i,v at time t in schedule S, isdefinedby lag(τ i,v,t,s) =A(τ i,v,,t,ps) A(τ i,v,,t,s). (4) Similarly, the difference between the allocation to a task τ i up to time t in PS and S, denoted the lag of task τ i at time t in schedule S, isdefinedby lag(τ i,t,s) = lag(τ i,v,t,s) v 1 = i,v,,t,ps) A(τ i,v,,t,s)). v 1(A(τ The LAG for τ at time t in schedule S is defined as (5) LAG(τ,t,S) = lag(τ i,t,s). (6) τ i τ Claim 1. LAG(τ,t d, S) >. Proof: Since lag(τ i,t d, S) = holds for any task τ i that does not have a job deadline miss by t d in S, and lag(τ j,t d, S) > holds for any task τ j that has jobs missing deadlines at t d (e.g., τ h ) because all jobs of any such task would complete by t d in PS, by Eq. 6, we have LAG(τ,t d, S) >. Definition 7. A time instant t is busy (resp. non-busy) for a job set J if all (resp. not all) m processors execute jobs in J at t. A time interval is busy (resp. non-busy) for J if each instant within it is busy (resp. non-busy) for J. A time instant t is busy on processor M i (resp. non-busy on processor M i )forjif M i executes (resp. does not execute) a job in J at t. A time interval is busy on processor M i (resp. non-busy on processor M i ) for J if each instant within it is busy (resp., non-busy) on M i for J. A time instant t is idle if all m processors are idle at t. A time interval is idle if each instant within it is idle. 341

4 Figure 2: Transformation intervals w.r.t. M (i%m). The following claim follows from the definition of LAG. Claim 2. If LAG(τ,t 2, S) >LAG(τ,t 1, S), wheret 2 >t 1, then [t 1,t 2 ) is non-busy for τ. Inotherwords,LAGforτ can increase only throughout a non-busy interval for τ. 3.1 Job-level Iterative SSCC By Claim 2 and the discussion in Sec. 1, the pessimism of analyzing suspending task systems is due to the worst-case scenario where all suspending tasks might have pending jobs that suspend at a time instant t, makingt non-busy; this can result in non-busy intervals in which LAG for τ increases. Specifically, we call such a worst-case scenario the suspensioninduced idleness scenario. Thus, our goal is to avoid such a worst case. The way the suspension-oblivious approach avoids it is brute-force: simply converting all tasks suspensions into computation. To reduce pessimism, we invent a novel job-level iterative transformation technique. The key idea behind our new technique is the following: iteratively identifying a limited set of jobs (which may belong to different tasks) pending at non-busy time instants and converting these jobs suspensions into computation to eliminate suspension-induced idleness at such time instants. A key benefit yielded by this approach is that the utilization loss due to the conversion is quantifiable, while effectively eliminating the suspension-induced idleness scenario Description of the Iterative Transformation Method As discussed earlier, we focus on analyzing the interval from time to the first time instant t d in S at which a deadline is missed. Our new technique involves transforming the entire schedule S within [,t d ) from right to left (i.e., from time t d to time ) to obtain a new schedule S as described below. For any job τ i,v, if its suspensions are converted into computation in a time interval [t 1,t 2 ),thenτ i,v is considered to execute in [t 1,t 2 ). We transform S to S step by step, where in the i th step, we identify a specific job and convert its suspensions into computation on the (i mod m) th processor M (i%m).this iterative job selection and suspension-to-computation conversion process stops when a termination condition (i.e., Eq. 7, to be explained later) is reached. Let S = S denote the original schedule, S i denote the transformed schedule after performing the i th transformation step. Each i th transformation step (i.e. to obtain S i ) contains three sub-steps: (i) define the i th transformed job and the corresponding transformation interval, (ii) perform a set of transformation techniques on this interval, and (iii) check the termination condition whether S i = S (i.e., whether S i is the final transformed schedule). Let I i =[A i,b i ).LetJ(A i ) denote the transformed job released at the start of the i th transformation interval, i.e., I i = [A i,b i ) = [r(a i ),f(a i )), where r(a i ) and f(a i ) Such conversions are performed only in the analysis, but not at runtime. denote the release time and completion time of J(A i ), respectively. We first define that I 1 =[A 1,B 1 )=[r h,l,f h,l ) (again, τ h,l is our job of interest that exhibits the first deadline miss at t d ). Similarly, let e(a i ) and s(a i ) denote the execution time and suspension length of J(A i ), respectively. Fig. 2 intuitively illustrates the definition of transformation intervals. The second sub-step is to perform the following Swap, Shift, andconvert operations on I i =[A i,b i ) for J(A i ). Note that since these operations can be generally applied to any I i (i 1), we use I i instead of the specific I 1 in the following description. Note also that after describing the entire transformation process w.r.t. I 1, we will explain how to identify I i+1 (i 1) based on I i to generalize the transformation process. The schedule S i obtained in the i th transformation step is transformed with respect to processor M (i%m). We perform the following three operations on I i. The purpose of the three operations is to convert suspensions of the identified job J(A i ) into computation onto M (i%m) (note that the suspensions and computation of J(A i ) may not originally occur on M (i%m) ). 1. Swap: We assume that all computations of J(A i ) occurring within [r(a i ),f(a i )) happen on M (i%m). This is achieved by swapping any computation of J(A i ) in any interval [t a,t b ) [r(a i ),f(a i )) originally executed on some processor M other than M (i%m) with the computation (if any) occurring in [t a,t b ) on M (i%m), as illustrated in Fig. 3(a). 2. Shift: Then for all intervals in [r(a i ),f(a i )) on M (i%m) where jobs not belonging to J(A i ) execute while J(A i ) suspends, if any of such interval is non-busy (at least one processor is idle in this interval), then we also shift the computation occurring within this interval on M (i%m) to some processor M that is idle in the same interval, as illustrated in Fig. 3(b). This guarantees that all intervals in [r(a i ),f(a i )) on M (i%m) where computations not belonging to J(A i ) execute are busy on all processors. After Swap and Shift, interval [r(a i ),f(a i )) on M (i%m) consists of three types of subintervals: (i) those in which job J(A i ) is executing, (ii) those in which job J(A i ) is suspending (note that jobs of tasks other than J(A i ) may also execute on M (i%m) in such subintervals; if this is the case, then the Shift operation ensures that any such subinterval is busy on all processors), and (iii) those in which job J(A i ) is preempted. Thus, within any non-busy interval on M (i%m) in [r(a i ),f(a i )), J(A i ) must be suspending (for otherwise this interval would be busy on M (i%m) ). Therefore, we perform the third transformation operation as follows. 3. Convert: Within all time intervals that are non-busy on M (i%m) in [r(a i ),f(a i )), convert the suspensions of J(A i ) into computation, as illustrated in Fig. 3(c). After performing the Swap, Shift, and Convert operations on I i = [r(a i ),f(a i ))) as described above, the i th transformation step completes and we obtain S i. After obtaining each S i, we check whether the iterative transformation process terminates. Termination Condition. The iterative transformation process terminates when the following condition is reached in a 342

5 (a) Swap: swap the computation of J(A i ) originally executed on M to M (i%m). (b) Shift: shift the computation of jobs other than J(A i ) from M (i%m) to some idle processor M. (c) Convert: convert the suspensions of J(A i ) that are pending within [A i,b i ) (i.e., [r(a i ),f(a i ))) into computation within all non-busy time intervals on M (i%m) in [A i,b i ). Figure 3: Illustration of Swap, Shift and Convert operations. transformed schedule S i : LAG(τ,A p, S i ) <LAG(τ,A p 1, S i ), (7) for any 1 p i. Then, S = S i, which is the final transformed schedule. If the termination condition does not hold in S i, then we need to identify the next transformation interval (i.e., I i+1, i 1). We will prove later in Lemma 2 that the termination condition will be satisfied in a finite number of steps. Identify I i+1 (i 1). We identify I i+1 by identifying the corresponding transformed job J(A i+1 ). Since the transformation process does not terminate at the i th step, by Eq. 7, we know that LAG(τ,A i, S i ) LAG(τ,A i 1, S i ) LAG(τ,A (8), S i ) >. Similar to the proof of Claim 1, the last > in the above equation holds because in the transformed schedule S i,tasks that do not have a job deadline miss by t d in S i have a zero lag while tasks that have jobs missing deadlines at t d (e.g., τ h ) have a positive lag. By Eqs. 6 and 8, we know that there exists at least one task τ c in τ whose lag at A i is greater than zero. That is, lag(τ c,a i, S i ) >. (9) Because τ c has a positive lag at A i, at least one job τ c,x of τ c released before A i is pending at A i. Let job set J i = {τ c,x,...} denote the jobs pending at A i.letτ(j i ) beatask set, where τ y τ(j i ) if and only if τ y has a job in J i.since t d is the earliest time that any job misses its deadline in S i, and A i A 1 <t d holds, jobs with deadlines earlier than A i complete before A i. Therefore, exactly one job of τ c τ(j i ) released before A i can be pending at A i. We now identify J(A i+1 ), which is the job that satisfies (i) J(A i+1 ) J i,and(ii) J(A i+1 ) has the earliest release time among all jobs in J i (if there are multiple such jobs with the same earliest release time, we arbitrarily pick one such job). Then, the (i +1) th transformation interval is I i+1 = [A i+1,b i+1 )=[r(a i+1 ),f(a i+1 )). Note that J(A i+1 ) exists because J i is not empty. We also know that A i+1 <A i <B i+1 <B i, (1) because the transformed job at the (i+1) th transformation step is released at A i+1, pending at A i, and completes at B i+1.we thus have A i+1 <A i <B i+1. Moreover, B i+1 <B i holds, for otherwise the transformed job released at A i+1 should have been identified in the i th transformation step instead. This is because this transformed job released at A i+1 has an earlier released time than A i but is still pending at B i (if B i+1 B i ). After identifying I i+1, we perform Swap, Shift, and Convert to obtain S i+1, and then check the termination condition, and so on. We provide an example to illustrate this iterative transformation process in Appendix B Properties Associated with S We now describe the properties associated with S. The following two properties are straightforwardly due to the iterative transformation method described earlier. Property 1. For any transformation interval I i = [r(a i ),f(a i )), jobj(a i ) whose suspensions are converted into computation in this interval in the i th transformation step converts at most s(a i ) length of suspensions into computation. Property 2. For any consecutively transformed intervals, e.g., I i 1 =[A i 1,B i 1 ) and I i =[A i,b i ) (i 1), they overlap with each other by Eq. 1, i.e. A i <A i 1 <B i <B i 1. Thus, in S, A i <A i 1 <A i 2 < <A 1 <A = t d holds. The following Lemma holds due to our transformed job identification rule. The detailed proof is given in Appendix A. Lemma 1. Let J(A a ),J(A b ),J(A c ) denote three jobs (if any) whose suspensions are converted to computation in transformation steps a, b, and c, respectively, where A a < A b < A c. Then, J(A a ) completes before A c, which implies that A c A a >e(a a )+s(a a ). Suppose S is transformed to S by z transformation steps, i.e. S = S z. In the rest of the analysis, we choose to focus on analyzing the set of non-overlapping sub-intervals [A z,a z 1 ), [A z 1,A z 2 ),...,[A 1 = r h,l,a = t d ) instead of sub-intervals [A i,b i ). This is because this set already comprises the entire analysis interval [A z,t d ) (assuming S = S z ). We next prove that the above iterative transformation process can always terminate. Lemma 2. There exists a finite integer z such that after the z th transformation step, there exists an interval [A p,a p 1 ] (1 p z) ins z,wherelag(τ,a p, S z ) <LAG(τ,A p 1, S z ). Proof: We prove this lemma by contradiction. Suppose that LAG(τ,A p,s y ) LAG(τ,A p 1,S y ) holds for any y 1 and 1 p y. Sinceτ h,l is the first job that misses its deadline at t d, we know that LAG(τ,t d,s y ) > for any integer y 1. Thus, LAG(τ,A y,s y ) > holds, which implies that there must exist at least one job pending at time A y.since y is infinite (i.e., for any y 1, there always exist at least a job 343

6 pending at A y because LAG(τ,A p,s y ) LAG(τ,A p 1,S y ) holds), the number of jobs that are pending at all time instants A y is also infinite. A contradiction is thus reached since we only have a finite number of jobs released before t d. According to the termination condition and Lemma 2, we know that the iterative transformation will always terminate Validating a Corresponding Processor Share Schedule We now define and validate the PS schedule PS corresponding to the transformed schedule S. Definition 8. Let u i = ei+si p i 1 and u max denote the maximum u i among all tasks in τ. Definition 9. The job execution window of any job τ i,j is [r i,j,d i,j ). Two job execution windows (or two time intervals in general) overlap with each other if at least one time instant is within both intervals. Without applying the transformation method, any task τ i executes in a PS schedule with the rate u i in any of its job execution windows. Thus, if τ i is active throughout [t 1,t 2 ) in PS, then A(τ i,j,t 1,t 2,PS)=(t 2 t 1 )u i holds. On the other hand, after applying the transformation method, since we may convert a certain portion of the suspension time of any job of any task into computation, a task may exhibit increased utilization within different execution windows of its jobs, but clearly upper-bounded by u i. Thus, for any task τ i that is active throughout [t 1,t 2 ) in PS,wehave (t 2 t 1 )u i A(τ i,j,t 1,t 2, PS) (t 2 t 1 )u i. (11) Note that our analysis does not require PS to be specifically defined; rather, only (11) is needed in our analysis. In order for our analysis to be correct, we have to ensure that such a valid PS schedule exists. That is, we have to guarantee that the total utilization of τ is at most m at any time instant t in PS. The following two lemmas give a sufficient condition that can provide such a guarantee. Lemma 3 holds due to Def. 9 and the definition of the implicit-deadline task model. Its detailed proof is provided in Appendix A. Lemma 3. For any interval [t a,t b ) in S, suppose there are k jobs released at or before time instant t a that have job execution widows overlapping with [t a,t b ), then the k jobs are released by k different tasks. Definition 1. Let v i = si p i denote the suspension ratio for task τ i τ. Letv j denote the j th maximum suspension ratio among tasks in τ. Definition 11. Let E j denote the j th minimum (e i +s i ) among tasks in τ. Letp max be the maximum task period among tasks in τ. Lemma 4. A valid PS schedule PS corresponding to S exists if U sum + v j m, (12) provided that : K 2 K (2 K n), E i p max, (13) Proof: Suppose S is transformed to S by z transformation steps, i.e. S = S z.in[,a z ) and [t d, ), the allocations to tasks in τ in PS is the same as the allocations to tasks in i=1 τ in PS schedule, since no jobs suspensions are converted to computation during such intervals. To prove that a valid PS schedule PS corresponding to S exists, it thus suffices to prove that it exists within [A z,t d ). Since interval [A z,t d ) consists of z subintervals which are (from left to right w.r.t. time) [A z,a z 1 ), [A z 1,A z 2 ),...,[A 1,A = t d ), it suffices to prove that PS exists within each of these z subintervals. For any such subinterval [A x,a x 1 ) (1 x z), let y denote the number of jobs whose suspensions are converted into computation with job execution windows overlapped with [A x,a x 1 ). Note that these y jobs must have release times at and before A x. This is because the job execution windows of jobs with release times later than A x 1 clearly do not overlap with [A x,a x 1 ). Also, according to the transformation method, no jobs whose suspensions are converted to computation are released within [A x 1,A x 1 ) (as A x and A x 1 denote the release times of two consecutively transformed jobs). Thus, more specifically, y denotes the number of jobs with release times at and before A x whose suspensions are converted into computation with job execution windows overlapped with [A x,a (x 1) ). This further implies that at any time instant within [A x,a x 1 ) in PS, only these y jobs can cause utilization increment due to suspension-to-computation conversion. First consider y K, where there exist at most K such jobs. By lemma 3, these K jobs are released by K different tasks, which can increase the total utilization of τ at any time instant within [A x,a x 1 ) in PS by at most K vj. By Eq. 12, we prove that PS exists within each of these z subintervals. The lemma thus holds when y K. Now we prove that y > K is impossible by contradiction. Assume that y > K. Let set β = {J(A K+1 ),J(A K ),...,J(A 1 )} denote the K +1 jobs that have the latest release times among all y jobs. Thus, A 1 = A x. Note that jobs in {J(A K+1 ),J(A K ),...,J(A 1 )} may not be selected in consecutive transformation steps, because there may exist transformed jobs released between the release time of J(A l ) β and the release time of J(A v ) β that do not have execution windows overlapped with [A x,a x 1 ).We order jobs in β such that A K+1 <A K < <A 1 = A x holds. Given K 2 by Eq. 13, we know that for any integer q where 1 q K/2, A 2q 1, A 2q,andA 2q+1 exist. There are K/2 possible values for q (a lower floor function is put here since K my be an odd number). Since A 2q+1 <A 2q 1 and J(A 2q+1 ) is released at A 2q+1, according to lemma 1, we will have K/2 following equations, each of which corresponds to a specific value of q: q, 1 q K/2,A 2q 1 A 2q+1 >e(a 2q+1 )+s(a 2q+1 ). (14) According to the discussion, K thus refers to the maximum number of tasks in τ that have jobs whose suspensions are converted into computation at any time instant in PS. Thus, K n holds as defined in Eq. 13. K 2 also holds, for otherwise K cannot be defined by Eq

7 By combining all the above K/2 equations, we have K 2 A 1 A 2 K/2 +1 = (A 2q 1 A 2q+1 ) {by (Eq. 14)} > K 2 q=1 q=1 ( e(a 2q+1 )+s(a 2q+1 ) ) {by (Def. 11)} K 2 q=1 E q. (15) Since K 2 K/2 regardless of whether K is odd or even, we have A K+1 A 2 K/2 +1, thus A 1 {by (Eq. 14)} K+1 A A 1 A 2 K/2 +1 {by (Eq. 15)} K 2 q=1 {by (Eq. 13)} q E p max. (16) Since A 1 = A x, by Eq. 16, we have A x A K+1 p max. By Def. 9, this implies that jobs released at or before A K+1 cannot have an execution window overlapped with [A x,a x 1 ), which contradicts the definition of β, where job J(A K+1 ) released at A K+1 has a job execution window overlapped with [A x,a x 1 )). y>kis thus impossible. Lemma 5. Suppose S is transformed to S by z transformation steps, i.e. S z = S. If Eq. 12 and Eq. 13 hold, then A(τ,A x,a x 1, PS) (A x 1 A x )(U sum + K vj ). Proof: According to Lemma 4, for any instant t within [A z,t d ) in PS, the total system utilization is at most U sum + K vj. By the definition of PS (Def. 6), x(1 x z), A(τ,A x,a x 1, PS) (A x 1 A x )(U sum + K vj ). 3.2 A Utilization-based Schedulability Test In this section, we derive a utilization-based schedulability test (Theorem 1) by analyzing S which is the transformed schedule as described in Sec Our derivation fundamentally leverages two properties of S: (i) there exists an interval [A p,a p 1 ) (p 1) ins, wherelag(τ,a p, S) LAG(τ,A p 1, S) (by Lemma 2), and (ii) Lemma 5. Moreover, we develop a new executing/non-executing interval analysis technique. Many prior works including those using lag-based reasoning [22], [25], [26], [28], [29] on analyzing sporadic task systems apply the busy/non-busy interval analysis technique, which leverages a key observation: if a job J is released before a non-busy interval and does not complete after this interval, the job executes at every time instant within this interval. This allows the workload in a non-busy interval to be safely lower bounded by the length of this interval because at least J is executing within it. However, when applying lag-based reasoning for analyzing suspending tasks, it is essential to compare the allocation to any analyzed job τ x,y in S and in PS. Unfortunately, τ x,y may convert its suspensions into computation (at most s x ) according to our transformation technique within the current analyzed interval, and the exact amount of such conversion is unknown. Thus, it is impossible to apply the busy/non-busy interval analysis technique herein because it can only provide us a lower bound on the allocation to τ x,y in S (since τ x,y may also execute within the busy interval but we cannot assume that), which is too pessimistic to conduct the above-mentioned comparison. To tackle this challenge, we develop a new executing/nonexecuting interval analysis technique, which divides an analyzed interval into two types of subintervals: (i) executing intervals within which τ x,y is executing (note again that τ x,y is considered to be executing within intervals where τ x,y s suspensions are converted into computation), and (ii) nonexecuting intervals within which τ x,y is not executing. A key benefit yielded is that we can characterize the exact allocation to τ x,y in S, thus allowing us to perform a comparison on the allocation to τ x,y in S and in PS. Theorem 1. On m processors, GEDF correctly schedules every sporadic suspending task system τ if U sum + v j m (m 1) u max, (17) provided that : K 2 K (2 K n), E i p max, (18) Proof: We prove by contradiction. Assume that the theorem does not hold. This implies that while Eq. 17 and Eq. 18 hold, one or more jobs miss their deadlines in S. Let t d again denote the earliest time instant at which a deadline miss happens in S. u max < 1 holds because if u max =1,then Eq. 17 holds only if there is only one task in the system (for otherwise the left-hand side of Eq. 17 becomes greater than 1 by the definition of v j ), which contradicts the assumption that deadline misses occur. By applying the transformation technique, we obtain S from S in z transformation steps, where z 1. According to Lemma 2, there exists an interval [A p,a p 1 ) in S, where LAG(τ,A p, S) <LAG(τ,A p 1, S), wherep z. Let τ x,y denote the transformed job which is released at A p = r x,y. Because no job with deadline before t d misses its deadline, all jobs of τ x released before A p complete by A p in S. All of these jobs complete by A p in PS as well. Thus, the lag of τ x at A p is zero, i.e. lag(τ x,a p, S) =. Since either lag(τ x,a p 1, S) or lag(τ x,a p 1, S) <, we consider two cases. Case 1. lag(τ x,a p 1, S) < lag(τ x A p, S) =. Let E (resp., E) denote the cumulative time in [A p,a p 1 ) in which τ x,y is executing (resp., τ x,y is not executing) in S. Thatis, A p 1 A p = E + E. (19) The lag of τ x at A p 1 can be computed as follows. lag(τ x,a p 1, S) = lag(τ x,a p, S)+A(τ x,a p,a p 1, PS) A(τ x,a p,a p 1, S) {Because lag(τ x, A p, S) =.} = A(τ x,a p,a p 1, PS) A(τ x,a p,a p 1, S) {By Eqs. 11 and 19, and A(τ x, A p, A p 1, S) =E.} (E + E) u x E = E (u x 1) + E u x. By lag(τ x,a p 1, S) <, the inequality above, and < u x u max < 1, wehave E (1 ux) E (u x 1) + E u x < = E< (2) u x i=1 345

8 Then, LAG(τ, A p 1, S) LAG(τ,A p, S) = LAG(τ, A p, S)+A(τ, A p,a p 1, PS) A(τ, A p,a p 1, S) LAG(τ, A p, S) = A(τ, A p,a p 1, PS) A(τ,A p,a p 1, S) {by Lemma 5} (A p 1 A p ) (U sum + v j ) A(τ,A p,a p 1, S) {By Eq. 19 and the fact that all m processors are busy when τ x is not executing and A(τ x, A p, A p 1, S) =E.} (E + E) (U sum + v j ) (E m + E) = E (U sum + v j 1) + E (U sum + v j m) {by Eq. 2} <E (U sum + v j 1) + E (1 ux) u x (U sum + v j m). Since LAG(τ,A p 1, S) >LAG(τ,A p, S), wehave E (U sum + v j 1) + E (1 ux) u x (U sum + v j m) > (21) Since E> must hold in order for Eq. 21 to hold, after dividing E from both sides of Eq. 21, we obtain (U sum + U sum + v j 1) + (1 ux) u x (U sum + v j m) > v j >m (m 1) u x m (m 1) u max. This contradicts Eq. 17, which proves Case 1. Case 2, where lag(τ x,a p 1, S) lag(τ x,a p, S) =, is proved similarly as Case 1. The detailed proof is given in Appendix A. 4 Optimization We present an optimization technique that effectively improves schedulability of the derived schedulability test (Theorem 1). It is motivated by observing that the test requires the sum of the K minimum additions of computation time and suspension of tasks to be at least p max (i.e., Eq. 18). If a task system contains even only one task whose period is enormously large compared to the rest n 1 tasks, then the test may still fail, as illustrated by the following example. Example 1. Consider a task system consisting of 13 tasks and 8 processors. The first 12 tasks have the same parameters: e i = s i =2, p i =8, and e 13 = s 13 =1, p 13 = 1. According to Theorem 1, this task system is not schedulable as Eq. 18 cannot be satisfied. As seen in the above example, although the total utilization of this task system is rather small, it is not schedulable due to the single large period of task τ 13. This observation inspires us to develop a technique that can eliminate the need of considering arbitrary tasks (thus any tasks with large periods) in Eq. 18, as proved next. Let τ o denotes the task set that contains all tasks in τ except an arbitrary set of tasks in τ. Letv j (τ o ) denote the j th maximum suspension ratio among tasks in τ o, p max (τ o ) be the maximum task period among tasks in τ o,and τ o denote the number of tasks in τ o. Lemma 6 is proved similarly to Lemma 4. Intuitively, it holds because we apply the same argument given in Lemma 4 to τ o instead of τ while additionally converting the suspensions of all jobs of all tasks in τ \ τ o. Its detailed proof is given in Appendix A. Lemma 6. A valid PS schedule PS corresponding to S exists if U sum + v i + v j (τ o) m, (22) τ i τ\τ o K 2 provided that : K (2 K τ o ), E i p max(τ o) (23) Lemma 7 follows according to Lemma 6. Its detailed proof is given in Appendix A. Lemma 7. Suppose S is transformed to S by z transformation steps, i.e. S z = S. If Eq. 22 and Eq. 23 hold, then A(τ,A x,a x 1, PS) (A x 1 A x )(U sum + τ i τ \τ o v i + K vj (τ o )). Theorem 2 is proved similarly to Theorem 1. Its proof is given in Appendix A. Theorem 2. On m processors, GEDF correctly schedules every sporadic suspending task system τ if U sum + v i + v j (τ o) m (m 1) u max, (24) τ i τ\τ o K 2 provided either : K (2 K τ o ), E i p max(τ o), (25) i=1 i=1 or : τ o =, (26) where τ o denotes an arbitrary subset of tasks in τ. Example 2. Re-consider Example 1. Let τ o = τ \ τ 13. Then, when K =4, K 2 i=1 Ei = E 1 + E 2 =8 p max (τ o )=8and U sum + τ i τ \τ o v i + K vj (τ o )=4.2 m (m 1) u max =4.5. Thus, τ becomes schedulable by Theorem 2. According to Theorem 2, identifying a good task subset τ o becomes critical for a task set to be schedulable. An optimal identification algorithm means it can always identify a subset τ o which satisfies both Eq. 24 and Eq. 25 if there exists one or more such subsets. In the following, we provide an optimal linear-time algorithm O(K)-opt that identifies τ o based on lemma 8 which is proved in Appendix A. Lemma 8. If there exist one or multiple subsets that satisfy both Eq. 24 and Eq. 25, then there is at least one such τ o where any task with a period at most p max (τ o ) is in τ o. Algorithm O(K)-opt: Initially let τ o = τ and then iteratively move the task with the maximum period in τ o out of τ o. There are in total n +1 iterations and n +1 corresponding τ o defined. For each iteration, if the corresponding τ o satisfies Eqs. 24 and 25, then it is feasible and we record the value of 346

9 the corresponding left-hand side of Eq. 24. Among all feasible τ o, let the subset that yields the minimum value of the lefthand side of Eq. 24 be the final τ o. Otherwise, if no feasible τ o is identified during this iterative process, then let τ o =. O(K)-opt seeks to first identify all possible subsets τ o where any task with a period at most p max (τ o ) is in τ o that are feasible, and then choose the one that yields the minimum value of the left-hand side of Eq. 24. By Lemma 8, if there exists a subset that satisfy Eqs. 24 and 25, the τ o identified by O(K)-opt must also satisfy Eq. 24 and Eq Evaluation In this section, we perform both analytical and experimental evaluation to assess schedulability yielded by our derived schedulability tests. 5.1 Theoretical Dominance over the Suspension-Oblivious Approach Our derived schedulability test (Theorem 2 using algorithm O(K)-opt to identify τ o ) analytically dominates the suspension-oblivious approach combined with the density test [22], which yields a test where an implicit-deadline sporadic suspending task system is GEDF-schedulable on m processors if U sum + τ v i τ i m (m 1) u max holds. Theorem 2 at least yields the same scheduability test as the suspension-oblivious approach when τ o is defined to be empty. Thus, if a task set is schedulable under the suspension-oblivious approach, then it is also schedulable under Theorem 2, but the vice versa does not hold. This dominance relationship is fundamentally due to the fact that our schedulability test may convert suspensions of jobs of less than n tasks into computation at any time instant in the analysis. 5.2 Experiments In this section, we describe experiments conducted to evaluate the applicability of the schedulability tests proposed in this work. Our goal is to examine how restrictive the derived schedulability tests utilization caps are. We also evaluate the magnitude of variable K as the value of K directly infers the magnitude of the suspension-induced utilization loss under our tests. Specifically, we evaluated our derived utilizationbased tests given by Theorem 1 and Theorem 2, denoted by O(K) and O(K)-opt, respectively. We compare these two tests against Bursty [2], K 2 U [6], and SO-density which denotes the suspension-oblivious approach combined with the density test [22]. Note that among the three compared tests, SO-density assumes GEDF scheduling, but both Bursty and K 2 U assume fixed-priority scheduling (i.e., rate-monotonic). We still choose to compare against them because they represent the best existing approaches that can handle the general HRT suspending task model on multiprocessors. Experimental setup. In our experiments, task periods were uniformly distributed over [2ms, 2ms]. Task utilizations were distributed differently for each experiment using three uniform distributions. The ranges for the uniform distributions were [.5, ] (light), [,.3] (medium), and [.3,.8] (heavy). Task execution costs were calculated from periods and utilizations. Suspension lengths of tasks were also distributed using three uniform distributions: [.5 (1 u i ) p i, (1 u i ) p i ] (suspensions are short), [ (1 u i ) p i,.3 (1 u i ) p i ] (suspensions are moderate), and [.3 (1 u i ) p i,.8 (1 u i ) p i ] (suspensions are long). The resulting suspension length ranges within [1μs, 16ms], which is wide enough to cover suspension lengths experienced under many application scenarios [1], [11], [3]. We varied the total system utilization U sum within {,,...,m}. For each combination of task utilization distribution, suspension length distribution, and U sum, 1, task sets were generated for systems with m =8processors. Each such task set was generated by creating tasks until total utilization exceeded the corresponding utilization cap, and by then reducing the last task s utilization so that the total utilization equalled the utilization cap. For each generated system, HRT schedulability was checked for the above mentioned five tests. Schedulability. The obtained schedulability results are shown in Fig. 4 (the organization of which is explained in the figure s caption). Each curve plots the fraction of the generated task sets successfully scheduled by the corresponding approach, as a function of total utilization. As seen, in all tested scenarios, O(K)-opt achieves the best performance, in many cases improving upon Bursty and K 2 U by a substantial margin. For example, as seen in Fig. 4(d), when suspension lengths are short and pertask utilizations are heavy, O(K)-opt can achieve 1% schedulability when U sum equals.6 while Bursty and K 2 UfailtodosowhenU sum merely exceeds.3 and.35, respectively. Note that when task suspensions are larger, the improvement margin by O(K)-opt over Bursty and K 2 U increases. This is because in this case, both Bursty and K 2 U will experience an increased suspension-induced utilization loss due to the increased suspension length of all n suspending tasks; while under O(K)-opt, a large suspension length may lead to a decreased value of K, thus a further decreased utilization loss. Also observe that all five tests perform better under heavier pertask utilizations. This is because when u i is larger, both n and s i may become smaller, which clearly helps all five tests achieve higher schedulability. On average, O(K)-opt yields an over 8% (respectively, 55% and 5%) improvement w.r.t. schedulability compared to SOdensity (respectively, Bursty and K 2 U). Magnitude of K. Besides schedulability, the magnitude of variable K is of importance, as it directly infers the suspension-induced utilization loss under our derived schedulaiblity tests. We statistically analyze the value of K in all experiments where task systems are schedulable under O(K)- opt. For illustration purposes, we record the value of K m to demonstrate the magnitude of K. Fig. 5 shows the cumulative K distribution function (CDF) of m. As seen in this figure, K in more than 9% of the cases, m < 1. This implies that the number of tasks whose suspensions are converted into computation by O(K)-opt is less than m in most cases, which demonstrates the effectiveness of our job-level iterative SSCC approach and the resulting schedulability test. 6 Conclusion This paper presents a new job-level iterative SSCC approach for analyzing HRT suspending task systems scheduled under GEDF on multiprocessors. The resulting utilization-based schedulability test theoretically dominates the suspension-oblivious approach and improves upon prior 347