FPCL and FPZL Schedulability Analysis

Transcription

1 FP and FPZL Schedulability Analysis Robert I. Davis Real-Time Systems Research Group, Department of Computer Science, University of Yor, YO10 5DD, Yor (UK) Abstract This paper presents the Fixed Priority until Critical Laxity (FP) and Fixed Priority until Zero Laxity (FPZL) and scheduling algorithms for multiprocessor real-time systems. FPZL is similar to global fixed priority pre-emptive scheduling; however, whenever a tas reaches a state of zero laxity it is given the highest priority. FP is a variant of FPZL that introduces no additional scheduling points beyond those present with fixed priority scheduling. FPZL and FP are minimally dynamic algorithms, in that the priority of a job can change at most once during its execution, bounding the number of pre-emptions. Polynomial time and pseudo-polynomial time sufficient schedulability tests are derived which are applicable to both FP and FPZL. These tests are then improved by computing upper bounds on the amount of execution that each tas can perform in the zero-laxity / critical-laxity state. An empirical evaluation shows that FP and FPZL are highly effective, with a significantly larger number of tassets deemed schedulable by the tests derived in this paper, than by state-of-the-art schedulability tests for EDZL scheduling. Extended version This paper builds on the paper FPZL Schedulability Analysis [34] published in the proceedings of RTAS This paper extends the analysis given in [34] to cover the FP scheduling algorithm as well as FPZL. The analysis for FP is a superset of that provided for FPZL in [34] and reduces to it if the critical laxity parameter of each tas is set to zero. In this paper, the experimental evaluation given in [34] has been extended to include schedulability tests and simulation of FP as well as FPZL. We also report on a prototype implementation of FP and FPZL in the Linux ernel, running on an Intel Core 2 Quad processor (Q9650). 1. Introduction Approaches to multiprocessor real-time scheduling, can be categorised into two broad classes: partitioned and global. Partitioned approaches allocate each tas to a single processor, dividing the multiprocessor scheduling problem into one of tas allocation (bin-pacing) followed by uniprocessor scheduling. In contrast, global approaches allow tass to migrate from one processor to another at runtime. Each approach has its distinct advantages and disadvantages. Partitioned scheduling typically has lower overheads in accessing and manipulating run-queues [23], Shinpei Kato Department of Electrical and Computer Engineering Carnegie Mellon University, Pittsburgh, PA USA. shinpei@ece.cmu.edu while global scheduling has advantages in spare capacity sharing, and is more appropriate for use in open systems, as there is no need to run load balancing / tas allocation algorithms when the set of tass changes. Recent wor [16] suggests that global scheduling research should focus on a small to medium number of processors (e.g. 2 to 12 processors) as global scheduling techniques may be most appropriate for clusters of processing cores that share a cache. In such cases, the cost of cache related migration delays were found not to differ substantially from the cost of cache related pre-emption delays [17]. In this paper, we focus on global scheduling techniques with the aim of increasing effectiveness, in terms of the number of tassets that can be guaranteed schedulable, without compromising efficiency, in terms of overheads caused by pre-emption and migration. In this paper, we present minimally dynamic global scheduling algorithms for real-time multiprocessor systems called Fixed Priority until Critical Laxity (FP) and FPZL (Fixed Priority until Zero Laxity). FPZL is based on global fixed priority pre-emptive scheduling, which for brevity we refer to as global FP scheduling. Under FPZL, jobs are scheduled according to the fixed priority of their associated tas, until a situation is reached where the remaining execution time of a job is equal to the time to its deadline, and that job would not be scheduled to execute on the basis of its fixed priority. Such a job has zero laxity and will miss its deadline unless it executes continually until completion. FPZL gives such zero-laxity jobs the highest priority. The schedules produced by FPZL and global FP scheduling are identical until the latter fails to execute a tas with zero laxity. Such a tas will subsequently miss its deadline. Hence FPZL dominates global FP scheduling, in the sense that all priority ordered tassets that are schedulable according to global FP scheduling are also schedulable according to FPZL. FPZL is closely related to EDZL [43], [28], [9], [27], [50], [51], and [30] which applies the same zero-laxity rule to global EDF scheduling. FP is a variant of FPZL that reduces the number of scheduling points with respect to FPZL. Lie global fixed priority pre-emptive scheduling, FP re-schedules only at tas release and completion events. FP is closely related to ED [45], which is a similar variant of EDZL Related wor For a comprehensive survey of multiprocessor real-time scheduling, including early wor on utilisation-based

2 schedulability tests for global FP, and global EDF scheduling of periodic tassets with implicit deadlines, the interested reader is referred to [33]. During the last ten years, sophisticated schedulability tests have been developed for global FP, and global EDF scheduling of sporadic tassets with constrained and arbitrary deadlines. These tests rely on the analysis of response times and processor load rather than utilisation. In 2000, Andersson and Jonsson [1] provided a simple response time test applicable to tassets with constraineddeadlines scheduled using global FP scheduling. In 2003, Baer [6] developed a fundamental schedulability test strategy, based on considering the minimum amount of interference in a given interval that is necessary to cause a deadline to be missed, and then taing the contra-positive of this to form a sufficient schedulability test. This basic strategy underpins an extensive thread of subsequent research into schedulability tests for global EDF [10], [21], [15], [14], global FP [13], [22], [7], [37], and EDZL scheduling [28]. Baer s wor was subsequently built upon by Bertogna et al. [19] in 2005, (see also Bertogna et al. [22]). They developed sufficient schedulability tests for: (i) any wor conserving algorithm, (ii) global EDF, and (iii) global FP scheduling based on bounding the maximum worload in a given interval. In 2007, Bertogna and Cirinei [20] adapted this approach to iteratively compute an upper bound on the response time of each tas, using the upper bound response times of other tass to limit the amount of interference considered. In 2009, Guan et al. [39] extended the response time analysis of Bertogna and Cirinei [20] for global FP scheduling, using ideas from [12]. In 2009 and 2010, Davis and Burns [31], [32] showed that priority assignment is fundamental to the effectiveness of global FP scheduling. They proved that Audsley s optimal priority assignment algorithm [3], [4] is applicable to some of the sufficient tests developed for global FP scheduling, including the simple response time test of Andersson and Jonsson [1] and the deadline-based test of Bertogna et al. [22], but not to others such as the response time tests of Bertogna and Cirinei [20], and Guan et al. [39]. In 1989, Leung [44] considered global Least Laxity First (LLF), referred to in [44] as the Slac Time algorithm. Leung showed that global LLF dominates global EDF, and that determining exact schedulability under LLF, global EDF or global FP is a hard problem (co-np-hard) for m > 1 (more than one processor). The Earliest Deadline first until Zero Laxity (EDZL) algorithm was introduced in 1994 by Lee [43], who showed that EDZL dominates global EDF scheduling, and is suboptimal for two processors (see also Cho et al. [30], Par et al. [51]). Here, sub-optimal is used to mean that EDZL can schedule any feasible set of ready tass. This wea form of optimality is appropriate for online scheduling algorithms, which cannot tae account of future arrival times. In 2006, Piao et al. [50] showed that EDZL is also completion time predictable A simpler proof of predictability was given by Cirinei and Baer [28] in 2007, who also developed a sufficient schedulability test for EDZL based on the fundamental strategy of Baer [6]. In 2008, Baer et al. [9] gave an iterative sufficient test for EDZL based on the approach taen by Bertogna et al. [22] for wor conserving algorithms and global EDF. This test reduces the over-estimation of carry-in interference, a feature of the previous tests, by iteratively calculating a lower bound on the slac for each tas. The empirical evaluation in [9] shows that this iterative test for EDZL outperforms other tests for EDZL given in [28] and, as expected, similar tests for global EDF. Also in 2008, Kato and Yamasai [45], introduced ED, effectively a variant of EDZL, which increases job priority on the basis of critical-laxity at the release or completion time of a job. This has the effect of reducing the maximum number of context switches to two per job, the same as EDF, at the expense of slightly inferior schedulability, when compared to EDZL. Kato and Yamasai [45] also corrected a minor flaw in the polynomial time schedulability test for EDZL given in [28]. In 2009, Kato et al. [53], [47] presented research on RMZL (RMZL and FPZL are names for essentially the same scheduling algorithm). Papers [53] and [47] were initially published in Japanese, with an English language version of [53] subsequently made available in May 2010 as a technical report [48]. Independently, Davis and Burns developed schedulability analysis for FPZL [34], initially published as a technical report in April 2010 [35]. The analysis given for FPZL in [34] is applicable to constraineddeadline tassets with no restrictions on the priority ordering which may be used; whereas the analysis given for RMZL in [48] is limited to implicit-deadline tassets with tas priorities assigned in Rate Monotonic priority order. As well as being more generally applicable, the FPZL analysis dominates, and significantly outperforms the RMZL schedulability test; see [34] for a detailed discussion and empirical comparison Intuition and motivation The research described in this paper is motivated by the need to close the large gap that currently exists between the best nown approaches to global multiprocessor real-time scheduling for sporadic tassets with constrained deadlines and what may be possible as indicated by feasibility / infeasibility tests. Dynamic priority scheduling has the potential to schedule many more tassets than fixed tas or fixed job priority algorithms. However, this theoretical advantage must be balanced against the increased overheads that dynamic changes in priority can bring via a significant increase in the number of pre-emptions / migrations. For example, the LLREF scheduling algorithm [29], which is optimal for periodic tassets with implicit deadlines, and the LRE-TL scheduling algorithm [38] which

3 is optimal for sporadic tassets with implicit deadlines, divide the timeline into intervals that start and end at tas releases/deadlines (referred to as TL-planes in [29]). In each interval, LLREF and LRE-TL ensure that each active tas τ i executes for at least U i t, where U i is the tas s utilisation, and t is the length of the time interval. Hence every tas can in the worst-case execute in every interval between tas deadlines, resulting in n-1 pre-emptions per job release, where n is the number of tass. In systems with a large number of tass, this level of pre-emptions leads to prohibitively high overheads. Minimally dynamic scheduling algorithms, such as FPZL and FP (and EDZL and ED) offer a potential solution to this problem. Note, by minimally dynamic, we mean that the priority of a job changes at most once during its execution, hence bounding the number of pre-emptions / migrations to at most two per job release. By comparison, global FP and global EDF scheduling incur at most one preemption / migration per job release. We note that semi-partitioned scheduling algorithms [2], [40], [46], where a small number of tass are permitted to migrate from one processor to another, offer an alternative approach to achieving enhanced schedulability without excessive overheads, based on partitioned rather than global scheduling Organisation The remainder of the paper is organised as follows: Section 2 describes the terminology, notation and system model used. Section 3 describes sufficient tests for global FP scheduling. These tests are used in Section 4 to derive polynomial time and pseudo-polynomial time sufficient schedulability tests for FP. These schedulability tests are a generalisation of the tests given in [34] for FPZL. The more general tests given in this paper for FP are also applicable to FPZL when the critical laxity parameters are set to zero. Section 4 also shows how the schedulability tests for FP can be improved by bounding the amount of execution that each tas can perform in the critical-laxity state. Section 5 discusses the implementation of FP and FPZL, assuming as a starting point an event driven global FP scheduler. Section 6 provides a brief discussion of priority assignment for FP and FPZL. Section 7 presents an empirical investigation into the effectiveness of FP and FPZL and their schedulability tests. Section 8 describes a prototype implementation of FP and FPZL and illustrates the effectiveness of the algorithms running on a multicore processor. Finally, Section 9 concludes with a summary and suggestions for future research. 2. System model, terminology and notation In this paper, we are interested in FP and FPZL scheduling of an application on a homogeneous multiprocessor system comprising m identical processors. The application or tasset is assumed to comprise a static set of n tass ( τ 1... τ n ), where each tas τ i is assigned a unique priority i, from 1 to n (where n is the lowest priority). Tass are assumed to comply with the sporadic tas model. In this model, tass give rise to a potentially infinite sequence of jobs. Each job of a tas may arrive at any time once a minimum inter-arrival time has elapsed since the arrival of the previous job of the same tas. Each tas τ i is characterised by its relative deadline D i, worst-case execution time C i, and minimum interarrival time or period T i. The utilisation U i of each tas is given by C i / Ti. A tas s worst-case response time R i is defined as the longest time from a job of the tas arriving to it completing execution. It is assumed unless otherwise stated that all tass have constrained deadlines ( Di Ti ). The tass are assumed to be independent and so cannot be bloced from executing by another tas other than due to contention for the processors. Further, it is assumed that once a tas starts to execute it will not voluntarily suspend itself. Intra-tas parallelism is not permitted; hence, at any given time, each job may execute on at most one processor. As a result of pre-emption and subsequent resumption, a job may migrate from one processor to another. The cost of preemption, migration, and the run-time operation of the scheduler is assumed to be either negligible, or subsumed into the worst-case execution time of each tas. Under global FP scheduling, at any given time, the m highest priority ready jobs are executed. Under FPZL scheduling, if a job reaches zero laxity then it is given the highest priority and will execute until completion. The laxity of a job is given by the elapsed time to its deadline less its remaining execution time. Under FPZL, at any given time, at most m tass may be in the zero-laxity state without a deadline being missed. Schedulability analysis for FPZL may identify certain tass as being able to enter the zero-laxity state. We refer to these tass as zero-laxity tass. An upper bound on the maximum amount of execution that a job of tas τ i can perform in the i zero-laxity state is denoted by Z. FP scheduling uses the concept of critical laxity [45]. The laxity of a tas is said to be critical, if at a scheduling point (corresponding to tas release or completion), the laxity of the tas is such that it will inevitably miss its next deadline, if it is not scheduled to execute before the next scheduling point. Schedulability analysis for FP may identify certain tass as being able to enter the critical-laxity state. We refer to these tass as critical-laxity tass. An upper bound on the maximum amount of execution that a job of tas τ i can perform in the critical-laxity state is denoted by K i. Further, the critical laxity parameter X i for tas τ i is defined as the longest time that can elapse between one scheduling point and the next, while tas τ i is ready but not executing. The following notation is used to refer to subsets of tass: hp(i) is the set of tass with priorities higher than i, lpzl(i) is the set of zero-laxity tass with initial priorities lower than i, and similarly lpcl(i) is the set of critical-laxity

4 tass with initial priorities lower than i. Finally, when discussing the schedulability of a given tas τ, we use the term interference to refer to the execution of other tass, at a priority higher than, that can potentially delay the completion of tas τ. 3. Schedulability tests for global FP In this section, we recapitulate two sufficient schedulability tests for global FP scheduling of sporadic tassets. These tests are described in more detail in [32] Deadline Analysis for global FP In [22], Bertogna et al. developed a polynomial time sufficient schedulability test for global FP scheduling based on the approach of Baer [6]. They showed that if tas τ is schedulable in an interval of length L, then an upper bound on the interference over the interval due to a higher priority tas τ i with a carry-in job is given by the following equation 1. (Note a carry-in job is a job that is released strictly prior to the start of the interval, and causes interference within that interval). D D I i ( L, C ) = min( Wi ( L), L C + 1) (1) where Wi D (L) is an upper bound on the worload of tas τ i in an interval of length L, given by: D D D Wi ( L) = N i ( L) Ci + min( Ci, L + Di Ci N i ( L) Ti ) (2) and Ni D (L) is the maximum number of jobs of tas τ i that contribute all of their execution time in the interval: D L + Di Ci N i ( L) = (3) Ti Bertogna et al. [22] used Equation (1), with D as the length of the interval, and strategy of Baer [6] to form a schedulability test for each tas τ : DA test for global FP scheduling: A sporadic tasset is schedulable, if for every tas τ in the tasset, the inequality given by Equation (4) holds: 1 D D C + Ii ( D ) (4) m i hp( ) where hp() is the set of tass with priorities higher than. Note we have re-written Equation (4) in a different form from that presented in [22] for ease of comparison with the response time schedulability test given in [20]. Guan et al. [39] showed that if tas τ is schedulable in an interval of length L, then an upper bound on the interference over the interval due to a higher priority tas τ i without a carry in job is given by: NC NC I i ( L, C ) = min( Wi ( L), L C + 1) (5) where: 1 Note we adopt the approach to time representation used in [22]. Time is represented by non-negative integer values, with each time value t viewed as representing the whole of the interval [t, t+1). This enables mathematical induction on cloc tics and avoids confusion with respect to end points of execution. NC NC NC Wi ( L) = N i ( L) Ci + min( Ci, L N i ( L) Ti ) (6) and NC N i ( L ) = L / Ti (7) The difference between the two interference terms given by Equations (1) and (5) is: DIFF D D NC Ii ( L, C ) = Ii ( L, C ) Ii ( L, C ) (8) Davis and Burns [32] showed that the worst-case scenario for global FP scheduling occurs when there are at most m-1 carry-in jobs. Thus, the approach of Guan et al. [39], can be used to form an improved version of the DA test as follows: DA-LC test for global FP scheduling: A sporadic tasset is schedulable, if for every tas τ in the tasset, the inequality given by Equation (9) holds: 1 NC DIFF D D C + + Ii ( D ) Ii ( D ) m i hp( ) i MD(, m 1) (9) where MD(, m-1) is the subset of the min(, m-1) tass with DIFF D the largest values of Ii ( D ) from the set of tass hp(). We note that the DA-LC test reduces to the DA test if DIFF D the Ii ( D ) term is included for all of the higher priority tass, rather than just those with the m-1 largest values, hence the DA-LC test dominates the DA test Response Time Analysis for global FP Bertogna and Cirinei [20] extended the basic approach used in the DA test to iteratively compute an upper bound response time R for each tas, using the upper bound response times of higher priority tass to limit the amount of interference considered. This approach applies the same logic as [22], while recognising that the latest time that a tas can execute is when it completes with its worst-case response time rather than at its deadline. In [20], Bertogna and Cirinei showed that if tas τ is schedulable in an interval of length L, then an upper bound on the interference in that interval due to a higher priority tas τ i with a carry-in job is given by: R R I i ( L, C ) = min( Wi ( L), L C + 1) (10) where, Wi R (L) is an upper bound on the worload of tas τ i in an interval of length L, taing into account the upper bound response time of tas τ i : R R R Wi ( L) = Ni ( L) Ci + min( Ci, L + Ri Ci Ni ( L) Ti ) (11) and N R i (L) is given by: L + R C R i i Ni ( L) = (12) T i The response time test of Bertogna and Cirinei [20] may be expressed as follows: RTA test for global FP scheduling (Theorem 7 in [20]): A sporadic tasset is schedulable, if for every tas τ in the tasset, the upper bound response time R computed via the fixed point iteration given in Equation

5 (13) is less than or equal to the tas s deadline: 1 R R C + Ii ( R ) (13) m i hp( ) Iteration starts with R = C, and continues until the value of R converges or until R > D, in which case tas τ is unschedulable. We note that using the RTA test, tas schedulability needs to be determined in priority order, highest priority first, as upper bounds on the response times of higher priority tass are required for computation of the R interference term I i ( R ). In [39], Guan et al. showed that at most m-1 higher priority tass with carry-in jobs may contribute interference in the worst-case, and used this result to improve the RTA test as follows: Guan et al. [39] showed that if tas τ i does not have a carry-in job, then the interference term is given by Equation (5). The difference between the two interference terms (Equation (10) and Equation (5)) is then given by: DIFF R R NC Ii ( L, C ) = Ii ( L, C ) Ii ( L, C ) (14) Using this result, Guan et al. [39] improved upon the response time test of Bertogna and Cirinei [20]. RTA-LC test for global FP scheduling: A sporadic tasset is schedulable, if for every tas τ in the tasset, the upper bound response time R computed via the fixed point iteration given in Equation (15) is less than or equal to the tas s deadline: 1 NC DIFF R R + + C Ii ( R ) Ii ( R ) m i hp( ) i MR(, m 1) (15) where MR(, m-1) is the subset of the min(, m-1) tass with DIFF R the largest values of Ii ( R ), given by Equation (14), from the set of tass hp(). Iteration starts with R = C, and continues until the value of R converges or until R > D, in which case tas τ is unschedulable. We note that the RTA-LC test reduces to the RTA test if DIFF R the Ii ( R ) term is included for all of the higher priority tass, rather than just those with the m-1 largest values, hence the RTA-LC test dominates the RTA test. Both the RTA and RTA-LC tests for global FP scheduling are pseudo-polynomial in complexity. 4. Schedulability tests for FP (and FPZL) In this section, we derive polynomial time and pseudopolynomial time sufficient schedulability tests for FP. These tests are applicable to sporadic tassets with constrained deadlines, and are independent of the priority assignment policy used. They are based on the tests described in the previous section for global FP scheduling. We also show how the schedulability tests can be improved by computing a bound on the maximum amount of execution in the critical-laxity (or zero-laxity) state. The FP scheduling algorithm is related to ED [45], but uses a somewhat different approach to determining when priority promotion should tae place. With global FP scheduling (and global EDF scheduling), re-scheduling is only required at tas release or completion, as these are the only times at which the m highest priority tass can change. With FPZL (and EDZL) scheduling, the priority of a tas also changes when the tas reaches zerolaxity, and so additional scheduling points are required. This requires additional support in the operating system for rescheduling at zero-laxity events. Such support adds to both scheduler complexity and overheads. In [45] Kato and Yamasai proposed an alternative method of priority promotion, based on the concept of critical-laxity () which provides most of the benefits of zero-laxity priority promotion, while ensuring that rescheduling taes place only on tas release or completion. The concept of critical laxity is as follows: at each scheduling point, corresponding to tas release or completion, if there are more than m ready tass, then the laxity of each ready tas is evaluated with respect to the maximum time that could potentially elapse until the next scheduling point. If at the next scheduling point, a tas s laxity could be negative, then it is classified as being a critical-laxity tas (-tas) and has its priority promoted to the highest level immediately. With FPZL, each zero-laxity tas has its priority promoted when its laxity reaches zero. In contrast, under FP, each critical-laxity tas τ i has its priority promoted when a scheduling point occurs and the laxity of the tas is less than or equal to the value of its critical-laxity parameter X i. (Note that only tass classified by the schedulability analysis as critical-laxity tass can have their priority promoted in this way by FP). With FP, the critical laxity parameter X i of each critical-laxity tas τ i is set to the smallest value such that the tas is guaranteed to have its priority promoted before its laxity x i (t) becomes negative, despite the fact that priority promotion can only tae place at scheduling points given by tas release or completion. As a job of a critical-laxity tas τ i can have its priority promoted at the earliest on its release, then: X i Di Ci (16) Further, the maximum time between scheduling points during which other tass can execute in preference to tas τ i is constrained by: X i MC( m, hp( i), lpcl( i)) (17) where MC ( m, hp( i), lpcl( i)) returns the mth longest time that any job of a higher priority tas can execute, or any job of a critical-laxity lower priority tas can execute in the critical-laxity state. Combining Equations (16) and (17), we have: X i = min( Di Ci, MC( m, hp( i), lpcl( i))) (18) Note that the value of X i depends on which lower priority tass are critical-laxity tass, and on their execution times K in the critical-laxity state. The set of critical- j

6 laxity tass can be determined by schedulability analysis. For now, we assume that K j = C j for all critical-laxity tass. We return to this point in Section 4.3. We note that if any tas in the tasset releases jobs strictly periodically, then that tas s period can also be used as a constraint on the critical laxity parameters for all tass. We now derive polynomial time and pseudo-polynomial time sufficient schedulability tests for FP. These schedulability tests are a generalization of the tests given for FPZL in [34]. With FPZL, there are additional scheduling points whenever the laxity of a tas reaches zero. Hence with FPZL, the critical laxity parameter X i of each tas τ i is zero. Setting the critical laxity parameter of all tass to zero in a schedulability test for FP provides an equivalent schedulability test for FPZL Deadline Analysis for FP (and FPZL) Schedulability under FP is similar to that under FPZL: 1. Up to m tass may be deemed unschedulable according to analysis of their response times; and yet, due to the critical-laxity rule, the tass will not miss their deadlines. 2. Critical-laxity tass have an additional impact on the schedulability of other tass. We now derive the maximum interference on a higher priority tas τ, in an interval of length L, that could potentially be caused by a lower priority tas τ j executing for at most K in the critical laxity state. j j N ( L) = ( L T j + X j ) / T j (20) and K j ( C j ) is an upper bound on the amount of execution that any job of tas τ j can perform in the criticallaxity state. If tas τ is schedulable in an interval of length L, then an upper bound on the interference in that interval due to a lower priority tas τ j executing in the critical-laxity state is given by: I j ( L, C ) = min( W j ( L), L C + 1) (21) We now show that the interference from tas τ j executing in the critical-laxity state can be maximised without τ j being considered as having a carry-in job. The scenario that maximises interference within an interval is shown in Figure 1. In this scenario, tas τ j appears to have a carry-in job; however, without any reduction in interference in the interval, the first job of tas τ j can be assumed to have become critical at the earliest at the start of the interval, but not before. Hence the first job of τ j need not be in the critical-laxity state prior to the release of the problem job at the start of the interval. Tas τ j does not therefore need to be considered when determining the m-1 tass that contribute the largest amounts of additional carryin interference (i.e. the I i terms see Equation (8)). DIFF D (Effectively, the first job of τ j is only released at a priority higher than at or after the release of the problem job, thus it does not qualify as causing carry-in interference). We now consider the interference from a higher priority critical-laxity tas τ i. In this case, the maximum interference with a carry-in job occurs when the first job of τ i in the interval starts executing at the start of the interval, and completes at its deadline, with all subsequent jobs executing as early as possible, see Figure 2 below. Figure 1: Interference in an interval Figure 1 illustrates the worst-case scenario. This occurs when the last job of τ j in the interval starts executing in the critical-laxity state as early as possible, and completes at the end of the interval, at a time X j prior to its deadline. Further, each previous job of tas τ j is assumed to be released T j prior to the subsequent job, and to execute in the critical laxity state as late as possible, thus completing at its deadline. We return to the precise behaviour of the first job of τ j in the interval later. An upper bound on the amount of critical-laxity worload due to tas τ j in an interval of length L is given by: min( L, K j ) L T j X j W = + + j ( L) K j N j ( L) K j L > T j X j min( K j, L T j + X j N j ( L) T j ) (19) where N j (L) is the number of jobs of tas τ j that contribute all of their critical-laxity execution in the interval, Figure 2 We observe that this is effectively the same scenario that leads to the worst-case interference from a higher priority tas which does not enter the critical-laxity state but completes at its deadline, and is given by Equation (1). Similarly, critical-laxity execution cannot increase the amount of interference from a higher priority tas with no carry-in job, given by Equation (5). This is an important observation. It means that when calculating interference from higher priority tass, we do not need to now if they are critical-laxity tass. Under FP, each tas τ is therefore schedulable without requiring priority promotion if the following inequality holds.

7 NC Ii ( D ) + i hp( ) 1 DIFF D D + + C Ii ( D ) (22) m i MD(, m 1) I j ( D ) j lpcl( ) NC where I i ( D ) is given by Equation (5), DIFF D Ii ( D ) is given by Equation (8), I j ( D ) is given by Equation (21), and lpcl() is the set of criticallaxity tass with lower priorities than. If the inequality in Equation (22) does not hold, then the tas is a critical-laxity tas. Under FP, at most m tass can be critical-laxity tass without a deadline being missed. We note that the critical-laxity status of each tas is unnown until its schedulability is checed via Equation (22), hence tas schedulability needs to be checed in priority order, lowest priority first. Algorithm 1 presents the DA-LC schedulability test for FP. Note, for now we mae the pessimistic assumption that a critical-laxity tas completes all of its execution in the critical laxity state, hence line 9, Compute K can be assumed to set K = C. The DA-LC schedulability test for FP is a polynomial time test requiring O ( n 2 ) operations, assuming that Compute K taes linear time. 1 count = 0 2 for (each priority level, lowest first) { 3 Determine schedulability of τ according to 4 Equation (22) 5 if ( τ is not schedulable) { 6 mar τ as a critical laxity tas 7 count = count Calc X according to Equation (18) 9 Compute K 10 } 11 } 12 if (count > m) 13 return unschedulable 14 else 15 return schedulable Algorithm 1: DA-LC schedulability test for FP (and FPZL) The schedulability test for FP given in Algorithm 1 reduces to the equivalent DA-LC schedulability test for FPZL by simply setting the critical laxity parameters X j = 0 for all tass in Equations (18), (19) and (20). In this case, the tass classified by the test as critical-laxity tass are in fact zero-laxity tass. As Equation (19) is monotonically non-decreasing in X j, then, for any interval length L, Equation (21) yields interference I j ( L, C ) that is no greater when all X j = 0, than it does for positive X j. Thus the DA-LC test for FPZL dominates the DA-LC test for FP, which in turn dominates the DA-LC test for global FP scheduling Response Time Analysis for FP (and FPZL) In this section, we provide a response time test for FP. This sufficient schedulability test is a generalization of the equivalent test for FPZL given in [34]. It reduces to that test for FPZL by setting the critical laxity parameter X i for each tas τ i to zero. The response time test for FP builds on the wor of Bertogna and Cirinei [20] and Guan et al. [39] (Equation (14)). It computes an upper bound R on the response time of each tas τ. If tas τ is schedulable under FP with a response time bounded by R, then an upper bound on the interference in an interval of length R due to a lower priority tas τ j executing in the critical-laxity state can be obtained by substituting R for the length of the interval in Equation (21). An upper bound on the worst-case response time of a tas τ, that is schedulable under FP without requiring priority promotion, can be found using the fixed point iteration given by Equation (23). NC Ii ( R ) + i hp( ) 1 DIFF R + + C Ii ( R ) (23) m i MR(, m 1) I j ( R ) j lpcl( ) NC where I i ( R ) is given by Equation (5), DIFF R Ii ( R ) is given by Equation (14), I j ( D ) is given by Equation (21), and lpcl() is the set of criticallaxity tass with lower priorities than. Iteration starts with R = C, and continues until the value of R converges in which case τ is schedulable, or until R > D. If R > D, then the tas is a criticallaxity tas. Recall that under FP, at most m tass may be critical-laxity tass without a deadline being missed. Using Equation (23), we can construct a sufficient schedulability test for FP based on upper bound response times; however, this requires an iterative approach that computes the upper bound response times of tass in priority order, highest priority first, but then bactracs (restarts) whenever a critical-laxity tas is identified. This bactracing approach is necessary due to the dependency of higher priority tas response times on which lower priority tass are critical-laxity tass and the dependency of lower priority tas schedulability (critical-laxity status) on the response times of higher priority tass. Under FP, the interference term (Equation (21)) due to each lower priority critical-laxity tas τ j depends via the parameter X j (see Equation (18)) on the tass with priorities lower than j that are also critical-laxity tass. The interference term due to each tas τ j is monotonically nondecreasing in X j, and X j is monotonically non-decreasing as additional critical-laxity tass are added to the set lpcl(j), hence interference can only increase as further critical-laxity

8 tass are identified. This dependency implies that once a tas is identified as a critical laxity tas, the critical-laxity parameters and upper bound response times of all higher priority tass must be re-calculated. Algorithm 2 presents the RTA-LC schedulability test for FP. Algorithm 2 initially assumes that there are no critical-laxity tass and starts computing tas response times in priority order, highest priority first (lines 6 and 7). Then, whenever a tas τ is encountered where Equation (23) results in a value of R > D, the tas is mared as a critical-laxity tas and its upper bound response time is set to its deadline (lines 8 and 9). We note that provided that the tasset is schedulable under FP, then this is the correct upper bound response time, as the critical-laxity rule will prevent the tas from actually missing its deadline. 1 count = 0 2 Initialize all R = C, X = 0,and K = 0 3 repeat = true 4 while (repeat) { 5 repeat = false 6 for (each priority level, highest first) { 7 Determine R according to Eq. (23) 8 if ( R > D ) { 9 R = D 10 Calc X according to Equation (18) 11 Compute K 12 if ( τ not mared as a tas) { 13 mar τ as a tas 14 repeat = true 15 count = count if(count > m) { 17 repeat = false 18 brea (exit for loop) 19 } 20 } 21 } 22 [if ( R or K differ from prev. values) 23 repeat = true] 24 } 25 } 26 if (count > m) 27 return unschedulable 28 else 29 return schedulable Algorithm 2: RTA-LC schedulability test for FP (and FPZL) The discovery of a critical-laxity tas effectively invalidates the upper bound response times calculated for all higher priority tass, and also the critical-laxity parameters ( X j ) for all higher priority critical-laxity tass. These values could be too small, and therefore need to be recalculated (line 14). However, if more than m critical-laxity tass have been found, then the critical-laxity rule cannot prevent all deadline misses and the tasset is deemed unschedulable. In this case, the algorithm can exit immediately (lines 16-18). We note that lines are not required when a simple fixed value of K = C is used for the critical-laxity execution time of tas τ. However, when the computed value of K depends on the response times of higher priority tass then this additional convergence chec is required. We return to this point in Section 4.3. We note that the upper bound response time for a tas τ i is monotonically non-decreasing in the amount of critical-laxity execution time of each of the tass with lower priority than i. Hence, the calculation of R i can be made more efficient on subsequent iterations of the while loop (line 4) by using as an initial value, the value of R i computed on the previous iteration. The while loop (lines 4-25) continues to iterate until either m+1 critical laxity tass are found, in which case the tasset is unschedulable under FP, or there are m or fewer critical-laxity tass and the upper bound response times and critical-laxity parameters ( X j ) have been recalculated since the final critical-laxity tas was found. In this case, the tasset is schedulable. Under the assumption that Compute K sets K = C, the RTA-LC schedulability test for FP requires O (mn) response time calculations ((Equation (23)), each of which is pseudo-polynomial in complexity. This can be seen by noting that when Compute K sets K = C, lines are not required, and so the while loop (line 4 to 25) only repeats when repeat is set to true on line 14. This can only happen at most m times, as a result of finding a critical laxity tas, before the tasset is declared unschedulable. Hence the maximum number of times that a response time can be computed (line 7) is O (mn). By comparison, the RTA-LC test for global FP scheduling requires O (n) such response time calculations. The schedulability test for FP given in Algorithm 2 reduces to the equivalent RTA-LC schedulability test for FPZL by simply setting the critical laxity parameters X j = 0 for all tass in Equations (18), (19) and (20). In this case, the tass classified by the test as critical-laxity tass are in fact zero-laxity tass. As Equation (19) is monotonically non-decreasing in X j, then, for any interval length L, Equation (21) yields interference I j ( L, C ) that is no greater when all X j = 0, than it does for positive X j. Thus the RTA-LC test for FPZL dominates the RTA-LC test for FP, which in turn dominates the RTA-LC test for global FP scheduling Bounding critical laxity (zero-laxity) execution time So far, we have made the potentially pessimistic assumption that a tas that can reach the critical-laxity state does so without having started to execute. Hence, we used an upper bound on the critical-laxity execution time of K = C. In this section, we derive a more effective upper bound and use this bound to improve the schedulability tests for FP and FPZL. The analysis we provide is for the general case of FP. This analysis also applies to FPZL when all X j are set to zero. First, we introduce the concept of DC-Sustainability and prove that the schedulability tests for tas τ given by

9 Equations (22) and (23) are DC-Sustainable. A schedulability test for tas τ is referred to as DC- Sustainable if it is sustainable [11] with respect to simultaneous and equal changes in both the execution time and the deadline of the tas. Below we give a formal definition of DC-Sustainability. Definition: A schedulability test S for a tas τ is DC- Sustainable if the following two conditions hold: Condition 1: If tas τ is deemed schedulable by test S with some paired deadline and execution time values D = D v = C v where 0 v C then test S is guaranteed to deem tas τ schedulable for all deadline and execution time pairs D = D w = C w where v w C. Condition 2: If tas τ is deemed unschedulable by test S with some paired deadline and execution time values D = D v = C v where 0 v C then test S is guaranteed to deem tas τ unschedulable for all deadline and execution time pairs D = D w = C w where 0 w v. Theorem 1: Given a fixed set of critical-laxity parameters ( X j ) and a fixed set of critical-laxity tass, Equation (22) is a DC-Sustainable schedulability test for tas τ. Proof: We can re-write Equation (22) as follows: NC Ii ( D ) + i hp( ) 1 DIFF D D + + C Ii ( D ) (24) m i MD(, m 1) I j ( D ) j lpcl( ) Consider the behaviour of Equation (24) for paired deadline and execution time values D = D w = C w as w taes different values in the range 0 w C. The RHS of Equation (24) gives an upper bound on the interference from higher priority tass and lower priority tass executing in the critical-laxity state in an interval of length D = D w. By inspecting the component Equations (1), (2), (3), (5), (6), (7), (8), (19), (20), and (21) it can be seen that this interference is monotonically non-decreasing with respect to the length of the interval D. We must however also consider the dependence of component Equations (5) and (21) on C, which also varies with w. C appears in the second term in the min( ) function of each of these equations in the expression D C + 1. This expression is unchanged by varying w. The RHS of Equations (24) is therefore monotonically non-increasing with respect to increasing values of w. In the case of Condition 1, as the LHS of Equation (24) is unchanged and the RHS is monotonically non-increasing for increasing values of w: 0 w C then it follows that, given that Equation (24) holds for w=v, it must also hold for all values of w: v w C. In the case of Condition 2 as the LHS of Equation (24) is unchanged and the RHS is monotonically non-decreasing for decreasing values of w: 0 w C then it follows that, given that Equation (24) does not hold for w=v, then it cannot hold for any value of w: 0 w v We now prove that Equation (23) is also a DC- Sustainable schedulability test for tas τ, given a fixed set of critical laxity parameters ( X j ) and a fixed set of criticallaxity tass. Below, we re-write Equation (23), using the variable q to indicate the fixed point iteration. NC q I i ( R ) + i hp( ) q+ 1 1 DIFF q R + + C Ii ( R ) (25) m i MR(, m 1) q I j ( R ) j lpcl( ) Recall that iteration begins with R = C (the execution q+1 q time of tas τ ), and ends when either R = R or when q+1 R > D, in which case tas τ is unschedulable. Let R ( D, C) be the response time upper bound given by Equation (25) for tas τ (D, C) with deadline D and execution time C. Similarly, let R ( D + x, C + x) be the response time upper bound given by Equation (25) for tas τ ( D + x, C + x ) with deadline D + x and execution time C + x. Lemma 1: Given a fixed set of critical-laxity parameters ( X j ) and a fixed set of critical-laxity tass, if τ (D, C) is schedulable according to Equation (25) then R ( C + x) R + x. Further, if τ (D, C) is not schedulable according to Equation (25) then neither is τ ( D + x, C + x ). Proof: Let R q (C) be the value computed by the qth iteration of Equation (25) for tas τ (D, C). Similarly, let R q ( C + x) be the value computed by the qth iteration of Equation (25) for tas τ ( D + x, C + x ). We prove the Lemma by induction, showing that on every iteration q until convergence or the deadline of τ (D, q q C) is exceeded, R ( C + x) R + x. Initial condition: in each case iteration starts with an initial value corresponding to the execution time of τ, 0 0 hence R = C and R ( C + x) = C + x, so 0 0 R ( C + x) R + x. q q Inductive step: assume that R ( C + x) R + x, and 1 consider the values computed for R q + ( C + x) and R q + 1 on iteration q+1. The floor function (second term on the RHS of Equation (25)) contains three summation terms; together, these terms give an upper bound on the interference from higher priority tass and lower priority tass executing in the critical-laxity state in an interval of q length R. Inspection of the component Equations ((5), (6), (7), (10), (11), (12), (14), (19), (20), and (21)) shows that this interference term is no smaller for input values q q R ( C + x) R + x, and C = C + x (the latter is used in Equations (10) and (21)) than it is for input values 0

10 R q (C) and C = C, hence once the value of C is added (first term on the RHS of Equation (25)), we have q+ 1 q+ 1 R ( C + x) R + x. We note that if the fixed point iteration for τ (D, C) q+ converges on R ( D, C) R 1 =, then the smallest possible value of R ( D + x, C + x) is R q x. Further, if τ (D, C) is unschedulable, then it follows that R q + 1 > D which implies that R q + 1 ( C + x) > D + x and therefore τ ( D + x, C + x ) must also be unschedulable Theorem 2: Given a fixed set of critical-laxity parameters ( X j ) and a fixed set of critical-laxity tass, Equation (25), and hence Equation (23) is a DC-Sustainable schedulability test. Proof: We can choose an execution time of C = 0 and a deadline of D = D C for tas τ. With these parameters, τ is deemed schedulable by Equation (25). We then consider all possible deadline and execution time pairs D = D w = C w for w from 1 to C (recall that execution times are represented by non-negative integers). Let v be the smallest value of w, if any, for which τ is unschedulable. Lemma 1 tells us that for all larger values of w, τ will also be unschedulable. Proof that Conditions 1 and 2 in the definition of DC-Sustainability hold follows directly from the observation that tas schedulability is monotonically decreasing with respect to increasing values of w We now show how a bound on the critical-laxity execution time of each critical-laxity tas can be derived. Let us assume that we are using the DA-LC schedulability test (Algorithm 1) or the RTA-LC schedulability test (Algorithm 2) for FP, and that tas τ has been identified as a critical-laxity tas by Equation (22) or Equation (23). We now that tas τ cannot be guaranteed to complete all of its execution within its deadline, without entering the critical-laxity state. However, if we can show that τ is guaranteed to complete C = C v units of execution time by an effective deadline of D = D X v 1, then that proves that the tas s laxity is at least X + 1 at D, and so it can execute for at most v units of time in the critical-laxity state. Due to the DC-Sustainability of the single tas schedulability tests given by Equations (22) and (23), each of these equations can be used as the basis of a binary search to determine the smallest value of v ( 0 v C ) such that tas τ is guaranteed to complete C = C v units of execution time by a deadline D = D X v 1, thus computing an upper bound K = v on the amount of time that a job of tas τ can spend executing in the critical-laxity state. The initial minimum value of v for the search is v = 0, while the initial maximum value is v = C which is deemed to result in schedulability, as it is equivalent to τ having zero execution time. In the DA-LC test, a binary search based on Equation (22) can be used to Compute K (line 9 of Algorithm 1), for each critical-laxity tas, improving the effectiveness of the test. As tas schedulability is determined lowest priority first, no further iteration is required. At each priority level, tas schedulability depends on static parameters of higher priority tass, and on the critical-laxity status, parameters ( X j ), and execution times ( K j ) of lower priority tass which have already been computed. In the RTA-LC test, a binary search based on Equation (23) can also be used to Compute K (line 11 of Algorithm 2) for each critical-laxity tas. However, in this case, a further convergence chec (lines 22-23) is required as the critical-laxity execution times computed by the binary searches are dependent on the response times of higher priority tass, and vice-versa. We note that Algorithm 2 will either find more than m critical-laxity tass or converge on unchanging values for the response times, critical-laxity parameters, and critical-laxity execution times. Such convergence is guaranteed because: (i) the response times of higher priority tass are monotonically non-decreasing with respect to increases in the critical-laxity execution time of lower priority tass, and similarly, the criticallaxity execution times of lower priority tass computed by binary search are monotonically nondecreasing with respect to increases in the response times of higher priority tass. (ii) the critical-laxity parameter X j of a tas monotonically non-decreasing in the critical laxity execution times, and critical-laxity status of lower priority tass. τ j is (iii) the critical-laxity execution time K j is monotonically non-decreasing with respect to the critical-laxity parameter X. 5. FP/FPZL and event-driven scheduling In this section, we assume that the operating system already implements an event-driven global FP scheduler, we therefore discuss only the modifications required to support either FP or FPZL. FPZL requires that when the laxity of a job reaches zero its priority is promoted to the highest level. The laxity of a job can reach zero at some intermediate point between tas releases, and the completion of the currently running jobs. FPZL therefore requires support for additional zero-laxity timer events, typically handled via a timer interrupt from a fine-grained hardware timer-counter, with re-scheduling performed on those events, as well as at tas release and completion. FPZL also requires the maintenance of a tas laxity queue of ready, but non-running tass, ordered by increasing laxity. The laxity of the tas at the head of this queue corresponds to the time to the next zero-laxity timer event. In a schedulable hard real-time system using FPZL, there are at most m zero-laxity tass and these tass are nown a priori, hence the tas laxity queue need only trac the laxity of at most m tass. On expiry of a zero-laxity event, the scheduler runs and promotes the priority of the tas at the head of the tas laxity queue to the highest j