Reliability Guaranteed Energy-Aware Frame-Based Task Set Execution Strategy for Hard Real-Time Systems

Transcription

1 Reliability Guaranteed Energy-Aware Frame-Based ask Set Exeution Strategy for Hard Real-ime Systems Zheng Li a, Li Wang a, Shuhui Li a, Shangping Ren a, Gang Quan b a Illinois Institute of ehnology, Chiago, IL 60616, USA b Florida International University, Miami, FL 33174, USA Abstrat In this paper, we study the problem of how to exeute a real-time frame-based task set on DVFS-enabled proessors so that the system s reliability an be guaranteed and the energy onsumption of exeuting the task set is minimized. o ensure the reliability requirement, proessing resoures are reserved to re-exeute tasks when transient faults our. However, different from ommonly used approahes that the reserved proessing resoures are shared by all tasks in the task set, we judiiously selet a subset of tasks to share these reserved resoures for reovery purposes. In addition, we formally prove that for a give task set, the system ahieves the highest reliability and onsumes the least amount of energy when the task set is exeuted with a uniform frequeny (or neighboring frequenies if the desired frequeny is not available). Based on the theoreti onlusion, rather than heuristially searhing for appropriate exeution frequeny for eah individual task as used in many researh work, we diretly alulate the optimal exeution frequeny for the task set. Our simulation results have shown that with our approah, we an not only guarantee the same level of system reliability, but also have up to 15% energy saving improvement over other fault reovery-based approahes existed in the literature. Furthermore, as our approah does not require frequent frequeny hanges, it works partiularly effetive on proessors where frequeny swithing overhead is large and not negligible. Keywords: ransient fault, real-time, energy saving, frame-based task set 1. Introdution Reliability and power/energy effiieny have inreasingly beome one of the ritial issues in real-time system designs. As aggressive saling of CMOS tehnology ontinues, transistors also beome more vulnerable than ever before to radiation related external impats [5, 7, 14], whih often lead to rapid system reliability degradation. he system reliability problem is further worsened by ever inreasing system omplexity and dramatially inreased operating temperature [8, 15]. As a result, omputing systems beome more and more suseptible to both transient and permanent faults [15]. Furthermore, as more and more transistors are integrated into a single hip, operation power onsumption of the hip has also inreased exponentially. he dramati power onsumption inrease not only exaerbates the power supply problem for power onstrained platforms suh as portable devies, but also aggravates the operational ost for power-rih platforms suh as data enters. herefore, more and more aggressive power aware redution tehniques have been proposed [6, 9]. However, for real-time system, power/energy onservations and reliability enhanement are usually at odds. aking the Dynami Voltage and Frequeny Saling (DVFS) tehnique as an example, as we know the DVFS is one of the widely used means addresses: zli80@iit.edu (Zheng Li), lwang64@iit.edu (Li Wang), sli38@iit.edu (Shuhui Li), ren@iit.edu (Shangping Ren), gang.quan@fiu.edu (Gang Quan) for power management [13], by dynamially lowering down the supply voltage and working frequeny, the DVFS an redue system s power onsumption. However, reduing the system s working frequeny may also prolong task exeution times and potentially ause tasks to miss their deadlines. In addition, existing work [23] has shown that the transient fault rate inreases when the supply voltage on an IC hip is saled down. In other words, lowering down system s supply voltage an potentially degrade the system s reliability. Hene, for systems demanding reliability and deadline guarantees and low energy onsumption, suh as satellite and surveillane systems [20], it is a hallenge to design a task exeution strategy that guarantees the satisfation of both system reliability and deadline requirements, but at same time onsumes the least amount of energy. As transient faults are found more frequent than permanent faults [4, 9], in this work, we fous on the transient fault and explore using bakward fault reovery tehniques. he bakward fault reovery tehnique stores system s safe state. In ase of a failure ourrene, the system is restored to its previous safe state and the omputation after the safe state point is repeated [12], to tolerate transient faults and guarantee system reliability requirement. As both the bakward fault reovery tehniques for reliability guarantee and the DVFS for energy savings depend on task s available slak time, i.e., the temporal differene between a task s deadline and its ompletion time, whih is limited for hard real-time system, therefore, the problem we are interested is, how to effetively utilize the limited slak time to design a system with guaranteed reliability and Preprint submitted to Journal of Systems and Software July 11, 2013

2 minimum energy onsumption. A few researhes have been published in the literature whih are losely related to our work. For example, Zhu et al. [19] proposed a reliability-aware power management sheme whih aims to minimize energy onsumption while maintaining system s reliability at the same level as if all tasks were exeuted at the highest proessor frequeny. However, as saling down task exeution frequenies for energy saving purpose often degrades system s reliability, hene, the basidea behind the sheme is to reserve some slak time exlusively for fault reovery to maintain system s reliability at the target level. We all the reserved slak time for fault reovery as reovery blok. A few heuristis as to how to deide the size of reovery blok and the task exeution frequenies, suh as the longest task first (LF) and the slak usage effiieny fator (SUEF), are developed [20]. Zhao et al. [17] improved the approah and developed the shared reovery (SHR) tehnique whih allows all tasks share the same reserved reovery blok, but only allow a single fault reovery during the entire task set exeution. Reently, Zhao et al. [18] extended the work and developed the Generalized Shared Reovery ehnique (GSHR) approah whih allows multiple fault reoveries by reserving multiple reovery bloks. As the GSHR approah allows sharing the reovery blok among different tasks, the slak time is more effiiently used and thus has a better energy saving performane omparing to its predeessors. Zhao et al also developed a heuristi, i.e. the Inremental Reliability Configuration Searh (IRCS), to determine the proessor frequenies for different tasks. he IRCS essentially adopts a dynami programming approah and searhes for a suitable frequeny for eah task to maximize energy savings. he tehniques mentioned above work well when task exeution times in a given task set do not have large variations and the available slak time, i.e., the temporal differene between the deadline and its earliest ompletion time of the task set, is large. However, when the slak time is limited, if there is a task whose exeution time is muh larger than the other tasks in the task set, the aforementioned approahes need to reserve a reovery blok long enough to aommodate the outlier task, whih not only results in low usage of the reserved blok for short tasks, but also less slak time an be used to sale down the proessing frequeny for energy saving purposes. In this paper, we present the Generalized Subset Shared Reovery tehnique (GSSR) to guarantee hard real-time system s reliability and at the same time minimize energy onsumption of exeuting a given task set. he essene of the developed GSSR approah is to judiiously partition a given task set into two subsets: fault-unproteted task set and fault-proteted task set. o guarantee the reliability, the fault-unproteted task set is exeuted with the highest proessor frequeny; while the exeution frequenies for fault-proteted tasks are saled down and tasks in the fault-proteted task set share reovery blok in ase of a failure ourrene. As suh, our approah an effetively redue unneessary resoure reservations and leave more slak time to adjust tasks proessing frequenies for energy saving. We also formally prove that, if a task set remains ative in an interval, exeuting the task set under a uniform frequeny is the 2 optimal strategy to maximize task set reliability and minimize the energy onsumption. If suh a frequeny is not available, then using two neighboring frequenies, i.e. adjaent frequenies, beome the optimal hoie. herefore, different from the IRCS that different tasks may run at different frequenies, we employ two (if the desired saled-down frequeny is available), or at most three, different proessor frequenies for the entire task set. Our extensive experimental study has shown that, omparing to reent work in the literature, suh as the IRCS, the proposed GSSR approah an ahieve up to 15% more energy saving without sarifiing reliability and deadline guarantees. he remainder of the paper is organized as follows: Setion 2 introdues the system models and definitions. In Setion 3, we present a motivating example and formally formulate the task set exeution strategy (SES) deision problem to be addressed. We disuss the proposed approah in Setion 5. Setion 6 presents the performane evaluation. We onlude the paper in Setion Models and Definitions In this setion, we introdue the models and terms used in the paper Proessor and ask Model We assume the proessor is DVFS enabled and has a finite set (F ) of working frequenies, i.e. F = {f 1,..., f q } with f i < f j if i < j, where f i and f i+1 are alled neighboring frequenies. he minimum and maximum frequeny f 1 and f q are denoted as f min and f max, respetively. he values are normalized with respeted to f max, i.e. f max = 1. As the proessor s proessing frequeny is almost linearly related to supply voltage 1 and the supply voltage adjustment will result in proessing frequeny saling, hene, in this paper, we use frequeny saling to stand for both supply voltage and frequeny adjustment. he task set Γ being onsidered is a frame-based task set 2. It has n tasks, i.e. Γ = {τ 1,, τ i,, τ n } with j if i < j where is the worst-ase exeution time (WCE) of task τ i under the maximum frequeny f max. When a lower working frequeny f i (f i < f max ) is used, the exeution time of a task is extended to i f i. For simpliity, we use f(τ i ) to denote the exeution frequeny of task τ i. asks in a given task set may or may not be independent. o ease the representation, we first assume that tasks are independent, then in Setion 5.3, we explain why the proposed tehnique an also be applied to a dependent task set. 1 f = a (V dd V t ) 2, where a is onstant, f, V V dd and V t are the proessing dd frequeny, supply voltage and threshold voltage, respetively [2]. 2 A frame-based task set is a task set of whih all tasks have the same arrival time and deadline [16].

3 2.2. Energy Model he energy model used in this paper is adopted from Aydin et al. s work [1, 21, 23]. For self ontainment, we give a short summary here. In partiular, the system s ative power (P a ) under operating frequeny f onsists of frequeny independent and frequeny dependent power, i.e. P a = P ind + P dep = P ind + C ef f θ (1) where P ind, C ef, and θ are system dependent onstants and θ 2 [1, 2]. If the task τ i is exeuted under f(τ i ), its power onsumption is represented as: E(f(τ i ), ) = (P ind + C ef f(τ i ) θ ) f(τ i ) = P ind f(τ i ) + C ef f(τ i ) θ 1 (2) From (2), it is lear that saling down the proessing frequeny redues frequeny dependent energy (C ef f(τ i ) θ 1 ) but it also inreases the frequeny independent energy (P i ind beause of longer exeution time due to lower proessing frequeny. Hene, there is a balaned point, i.e. the Energy- Effiient Frequeny (f ee ). Further saling down the proessing frequeny below f ee will inrease the total energy onsumption. Early studies [21, 23] onludes that P f ee = θ ind (3) C ef (θ 1) f(τ i) ) 2.3. Fault and Reliability Model Although both permanent and transient faults may our during the exeution of task sets, transient faults are found more frequent than permanent faults [4, 9]. Hene, in this paper, we fous only on transient faults and adopt the same fault arrival rate model as given in [18, 20, 23]: If the reserved reover blok B is for task τ i, the length of the blok is equal to τ i s WCE under f max, i.e. len(b) =. If k ( 1) reserved reovery bloks are shared among tasks in the task set Γ, the total duration of the reserved bloks equals to the sum of the first k longest tasks WCEs under f max, i.e. k len(b i) = k, where j if i < j. Fault-Proteted ask (τ p ): a fault-proteted task is a task that is allowed to share a reserved reovery blok for re-exeution if a fault ours during its exeution. Fault-Proteted ask Set (Γ p ): a fault-proteted task set is a task set of whih all its member tasks are fault-proteted, i.e. τ Γ p, τ is fault-proteted. Fault-Unproteted ask (τ u ): a fault-unproteted task is the task whih is not allowed to use a reserved reovery blok for fault reovery even if faults our during its exeution. Fault-Unproteted ask Set (Γ u ): a fault-unproteted task set is a task set of whih all its member tasks are fault-unproteted. We have Γ u Γ p = Γ and Γ u Γ p =. ask Set Exeution Strategy (Ψ): for a given task set Γ, the task set exeution strategy deides the number of reserved reovery bloks (k), the protet task set (Γ p ), and exeution frequeny for task τ i. In other words, Ψ(Γ) = ( f(τ i ) τi Γ, Γ p, k), where f(τ ) τi Γ is the abbreviation for [(f(τ 1 ), 1 f(τ ),, 1) (f(τ n ), n f(τ )], i.e. exeuting task τ n) i with frequeny f(τ i ) for f(τ time duration, f(τ i) i) F, and Γ p Γ. ask Set Reliability under a Given Exeution Strategy (R): for a given task set (Γ) and its proessing strategy (Ψ(Γ) = ( f(τ i ) τi Γ, Γ p, k)), the task set reliability (R) is defined as the probability of suessfully exeuting all tasks under the given exeution strategy. 3. Motivation and Problem Formulation λ(f) = ˆλ 0 10 ˆdf where ˆλ 0 = λ 0 10 d 1 f min, ˆd = (4) d 1 f min, d (> 0) is a systemdependent onstant, and λ 0 is the average fault arrival rate under f max. he reliability of task τ i under exeution frequeny f(τ i ) is defined as the probability of finishing its exeution without enountering any transient faults, whih is expressed as [18, 20]: γ(f(τ i ), ) = e λ(f(τi)) where λ(f(τ i )) is given by Equation (4). f(τ i ) (5) 2.4. Definitions In this subsetion, we introdue the terms and notations to be used later in the paper. Reserved reovery blok (B): a reserved reovery blok is a time blok reserved exlusively for task re-exeution in the presenes of faults. 3 Before we formulate the researh problem, we first give a motivating example A Motivating Example Considering a task set with four independent tasks, i.e. Γ = {A, B, C, D}, their exeution times under f max are 10ms, 5ms, 4ms and 3ms, respetively. hese tasks arrive at the same time and have the same deadline 35ms. he reliability onstraint for the task set is R g = τ i {A,B,C,D} γ(f max, ), whih is the probability of suessfully exeuting all four tasks under f max with zero fault ourrene. Fig. 1(a) depits the setting. Assume the available frequenies on a proessor are from f min = 0.1 to f max = 1 with step value of 0.1, transient fault arrival follows Poisson distribution with average arrival rate as λ 0 = 10 6 as given in [18]. We evaluate system reliability and energy onsumption of two well reognized reliability-aware power management approahes, i.e. the approahes with [18] and without [20] reserved reovery blok sharing, respetively. Without Sharing Reserved Reovery Blok the Longest ask First (LF) Approah [20]

4 Figure 1: Motivating Example he LF approah, as the name suggested, always hooses the task with longest worst-ase exeution time in the task set and applies frequeny saling to the task. For the given example, as task A has the longest WCE of 10ms, it is hosen for using frequeny saling. A reserved reovery blok of size 10ms is alloated for task A in ase faults our during its exeution. he other three tasks are exeuted with maximal frequeny f max = 1. he remaining slak time of 3ms is hene used for saling down the proessing frequeny for task A. In this ase, task A should be exeuted under frequeny of 10/13 = Hene, the nearest available frequeny 0.8 is hosen. Fig. 1(b) illustrates the exeution strategy under LF. It is not diffiult to alulate that the total energy ost, normalized to the energy ost when all tasks are exeuted with f max, is 84%. he task set reliability, normalized to the reliability requirement of R g, is %. Globally Sharing Reserved Reovery Blok the Generalized Shared Reovery (GSHR) Approah [18] With the GSHR approah, reserved reovery bloks are shared among all tasks in the task set. he Inremental Reliability Configuration Searh (IRCS) heuristis developed [18] to searh a suitable frequeny for eah task. In partiular, task A, B, C and D are exeuted under frequeny of 0.9, 0.9, 0.8 and 0.9, respetively. he reovery blok is shared by all four tasks and has the length of 10ms. Fig. 1() depits the result of IRCS. he normalized energy onsumption under the IRCS sheme is 79% and the normalized task set reliability is %. he example shows that the results derived from both the LF and the IRCS satisfy the reliability and deadline requirements. However, the IRCS approah performs better than the LF approah from energy onsumption perspetive. Our Observations In order to allow all tasks be able to share the same reovery blok, the IRCS approah needs to reserve 10ms as its reovery blok. If, on the other hand, we exlude the longest task, 4 i.e. task A, from sharing the reovery blok, we only need to reserve 5ms for the reovery blok, whih means more slak time an be used for frequeny saling. It is very interesting that, when we run task A at the maximum frequeny and task B, C, and D at frequeny 0.6, the normalized energy onsumption is only 68% and the normalized reliability is %. Under this exeution strategy, we not only satisfy the reliability and deadline requirements, but also save 11% more energy omparing to the IRCS approah. Fig. 1(d) shows the proessing strategy that outperforms the IRCS approah. his example indiates that if we judiiously selet a subset of tasks to share the reovery blok, we an save more energy without ompromising reliability and deadline onstraints. Another observation is that the IRCS uses a heuristi approah to searhing a suitable frequeny for eah task in the task set. When the searh spae, i.e. the number of available frequenies and the number of tasks in the task set, is large, due to the heuristi nature, the hane of finding a good solution for every task redues and hene the performane of the IRCS approah degrades. Simulation results in Setion 6 onfirm this observation. herefore, our seond motivation is to develop a task set exeution strategy searh algorithm whih is independent of the number of available frequenies and the number of tasks in a task set Problem Formulation In this subsetion, we formulate the researh problem the rest of the paper to address, i.e. to find a reliability and deadline guaranteed task set exeution strategy that minimizes energy onsumption. We all the problem the ask Set Exeution Strategy deision problem, the SES problem for short. Problem 1 (he SES Deision Problem). Given a task set with n independent tasks, i.e. Γ = {τ 1,, τ n } with j if i > j where is the τ i s WCE under f max, and a DVFS enabled proessor with q different proessing frequenies, i.e. F = {f 1,, f q }, where f 1 = f min, f q = f max, and f i < f j if i < j. he reliability and deadline onstraints are R g and D, respetively, deide a task set proessing strategy Ψ(Γ) = ( f(τ i ) τi Γ, Γ p, k) with Objetive: Subjet to: min τ i Γ E(f(τ i ), ) (6) R( f(τ i ) τi Γ, Γ p, k) R g (7) k f(τ i ) D τ i Γ len(b i ) (8) where len(b i ) = p i is the ith longest WCE of fault-proteted task τ p i Γ p, and Γ p Γ. It is worth pointing out that we assume fault detetions are done at the end of eah task exeution using tehniques suh as sanity or onsisteny heks [12] and the time overhead is

5 ounted as part of task s worst-ase exeution time. Although, frequeny swithing has extra time and energy overhead, we leave the frequeny swithing overhead disussion to Setion Generalized Subset Shared Reovery As we have observed from the motivating example given in Setion 3.1 that reovery blok sharing has its superiority over the tehniques that do not share the reovery blok. When tasks worst-ase exeution times in a given task set are lose to eah other, i.e. the variation among task s WCEs is small, globally sharing a reserved reovery blok among all tasks in the given task set performs well as evidened in [18]. However, when there is a large variation among the worst-ase exeution times, as shown in the motivating example, sharing the reserved reovery blok among a judiiously seleted subset of tasks performs better than globally sharing the blok among all tasks in the task set. he intuition behind the onlusion is as follows. For a given task set Γ of size n, when the variation of their worst-ase exeution times is large, k (1 k n) reserved reovery bloks may oupy most of the slak time, hene leave only a small portion for frequeny saling. However, if we exlude the outliers, for instane, the first few longest tasks, and only allow a subset of tasks to share the reovery bloks, we an redue the total length of the reovery bloks and leave more slak time for energy saving. Based on the intuition, we propose a generalized subset shared reovery (GSSR) tehnique. It is not diffiult to see that the GSHR is a speial ase of the proposed GSSR tehnique, i.e. when Γ p = Γ, the GSSR degenerates to the GSHR. With the GSSR tehnique, a given task set Γ is partitioned into two subsets, i.e. fault-proteted task set Γ p and faultunproteted task set Γ u, where all fault-unproteted tasks are exeuted under the maximum frequeny f max, i.e. τ u Γ u, f(τ u ) = f max. Furthermore, fault-unproteted tasks are not allowed to use the reserved reovery bloks to do fault reoveries. On the other hand, tasks in the fault-proteted task set are exeuted under saled down frequenies and share the reserved reovery bloks for fault reoveries. Given a task set Γ, and an exeution strategy Ψ(Γ) = ( f(τ i ) τi Γ, Γ p, k), where Γ p = {τ p 1,, τ m}, p reliability of the task set Γ is the produt of the reliability of fault-proteted task set and the reliability of fault-unproteted task set, i.e. R( f(τ i ) τi Γ, Γ p, k) = R k (Γ p ) τ j Γ Γ p γ(f(τ j ), j ) (9) where the alulation of the reliability of fault-proteted task set sharing k reserved reovery bloks (R k (Γ p )) is reursively defined given below [18]: R k (τ p 1,, τ p m) = γ(f(τ p 1 ), p 1 ) Rk (τ p 2,, τ p m)+ (1 γ(f(τ p 1 ), p i )) γ(f max, p 1 ) Rk 1 (τ p 2,, τ p m) (10) he value of R k (τ p 1,, τ p m) an be found using dynami programming and the time omplexity is O(km). As the probability of fault ourrenes is relatively small, the expeted energy onsumption for fault reoveries is negligible omparing to the energy ost of exeuting all tasks in the task set. Hene, the expeted energy onsumption under given Ψ(Γ) = ( f(τ i ) τi Γ, Γ p, k) an be defined as: E(( f(τ i ) τi Γ, Γ p, k)) = τ i Γ E(f(τ i ), ) (11) From formula (9) and (11), we an see that the task set exeution strategy Ψ has diret impat on the task set reliability and energy onsumption. Next setion, we present our approah to finding a task exeution strategy that minimizes the energy onsumption and at the same time guarantees the satisfation of both reliability and deadline onstraints. 5. GSSR-based ask Set Exeution Strategy As we have observed from our motivating example that if we judiiously selet a fault-proteted task set (Γ p Γ) and orresponding task exeution frequenies for Γ p, we an save more energy without ompromising the satisfation of reliability and deadline onstraints. In this setion, we present in detail the generalized subset shared reovery (GSSR) based task set exeution strategy. In partiular, we first onsider for a given fault-proteted task set (Γ p ), what should be its exeution strategy ( f(τ i ) τi Γ, Γ p, k). Seond, for a given task set (Γ), how to judiiously deide the fault-proteted task set (Γ p Γ) Deiding ask Set Exeution Strategy for a Given Fault- Proteted ask Set In this subsetion, we disuss for a given task set (Γ), if a judiiously seleted fault-proteted task set (Γ p Γ) is given, what proessing frequenies f(τ i ) τi Γ should be used to exeute the fault-proteted tasks and how many bloks (k) need be reserved for shared reovery among all fault-proteted tasks (τ p Γ p ). As fault-unproteted tasks are not allowed to do fault reoveries, to ahieve their highest reliability, they are always exeuted under f max. Hene, we only need to determine the exeution frequenies for fault-proteted tasks, i.e. f(τ i ) τi Γ p. Before we onsider the exeution frequenies for a given task set, we first investigate the exeution strategy for a single task without onsidering fault reovery. he following lemma states that among all exeution strategies taking the same amount of time to omplete a task s exeution, the exeution strategy that uses a uniform frequeny, or neighboring frequenies if the desired frequeny is not available, to exeute the task for the fixed duration provides the maximal reliability (γ), i.e. the maximal probability of suessfully exeuting a task without enountering a fault. Lemma 1. Given a task τ, its WCE, time duration ( ), and available frequenies F = {f min, f 2, f max } with f i < f j for i < j, if frequeny swithing is allowed during task τ s exeution, we have the following onlusions: 5

6 1. if f u = f max F, then γ(f u, ) = max{ 2. otherwise q γ(f i, t i ) f i F, γ([(f j, t), (f j+1, t)]) q = max{ γ(f i, t i ) f i F, q t i = } q t i = } where f j < f u < f j+1, f j, f j+1 F and q f it i = f max. Proof. We use notation (f i, t i ) q = [(f 1, t 1 ),..., (f q, t q )] to denote the strategy of exeuting a task with frequeny f i F for t i time units, where t i 0, q f it i = f max and q t i =. Hene, the reliability of the task under (f i, t i ) q an be represented as: γ( (f i, t i ) q ) = q If f u = f max the exeution strategy is (f max the reliability is: γ(f i, t i ) = e q λ(fi)ti F is used for the whole duration, then q γ(f max, ) = e λ(, ) = ( q fiti q ti f i t i q t i ) q ti, q t i), and As λ(x) is a onvex funtion 3, based on onvex funtion property (12), we have: q q λ(f i )t i λ( f it i q q t )( t i ) i Furthermore, as e x is a dereasing funtion, we have γ(f max, ) γ( (f i, t i ) q ), whih onludes the proof for ase 1). If f max / F and f j < f max < f j+1, the reliability of task under [(f j, t), (f j+1, t)] an be expressed as: (λ(fj)t+λ(fj+1)( t)) γ([(f j, t), (f j+1, t)]) = e Aording to formula (12), we have: q λ(f i )t i λ(f j )t + λ(f j+1 )( t) 3 If g(x) is a onvex funtion, q( 2) I +, x i, t i R + and x i < x k if i < k, then we have: q q g(x i )t i g(x j )t j + g(x j+1 )t j+1 g( x it i q q t )( t i ) (12) i Where x j t j + x j+1 t j+1 t j + t j+1 = q t i. = q x it i, x j < q x it i r t i < x j+1, and 6 (λ(fj)t+λ(fj+1)( t)) Hene, e e q λ(fi)ti, whih implies γ([(f j, t), (f j+1, t)]) γ( (f i, t i ) q ). hese onlude the proof. Lemma 1 an easily be extended to a task set (Γ) by treating the single task s exeution time as the summation of, i.e. = τ i Γ. We formulate the extension as Lemma 2. Lemma 2. Given a task set Γ = {τ 1,, τ n } with task τ i s worst-ase exeution time, available frequeny F = {f min, f 2,, f max } with f i < f j for i < j, and fixed exeution time duration ( τ Γ i), when shared reovery blok k = 0, the exeution strategy of using a uniform frequeny f u = f max τ i Γ i if f u F, or neighboring frequenies f i and f i+1 with f i < f u < f i+1 if f u / F, to exeute the task set provides the highest reliability. More speifily, we have τ 1. if f u = f i Γ i max F, then R( (f u, ) τi Γ, φ, 0) f u = max{r( (f(τ i ), 2. otherwise, R([(f j, t), (f j+1, t)], φ, 0) = max{r( (f(τ i ), f(τ i ) ) τ i Γ, φ, 0) f(τ i ) F, τ i Γ f(τ i ) ) τ i Γ, φ, 0) f(τ i ) F, τ i Γ f(τ i ) = } (13) f(τ i ) = } where f j t + f j+1 ( t) = n f max, or t = n j=1 i fj+1, f j < f u < f j+1 and f j, f j+1 F f j f j+1 (14) We skip the proof for Lemma 2 as it is very similar to the one given for Lemma 1. Rizvandi [13] studied the relationship between task exeution frequeny and energy onsumption and onluded that when the energy model is a onvex funtion of frequeny, using a uniform, or neighboring frequenies if the desired frequeny is not available, is the optimal strategy for energy saving purpose. With this onlusion, we derive the Lemma 3. Lemma 3. Given a task set Γ = {τ 1,, τ n } with task τ i s worst-ase exeution time, available frequeny F = {f min, f 2,, f max } with f i < f j for i < j, and fixed exeution time duration ( τ Γ i), when shared reovery blok k = 0, then using one uniform frequeny f u = fmax τ i Γ i, or neighboring frequenies f j and f j+1 with f j < f u < f j+1 if f u / F, to exeute the task set onsumes the least energy. Proof. Sine the exeution time duration is fixed as and the energy model (formula (2)) is a onvex funtion of proessing frequeny, hene, exeuting the task set under frequeny f u = fmax τ i Γ i, or neighboring frequenies f j and f j+1 with f j < f u < f j+1 if f u / F, onsumes the least energy [13]. In addition, based on Lemma 2, exeuting the task

7 set under frequeny f u, or the neighboring frequenies f j and f j+1 with f j < f u < f j+1 if f u / F, an also ahieve the highest reliability. Hene, we get the onlusion summarized as Lemma 3. From Lemma 2 and Lemma 3, we have the following theorem. heorem 1. Given a task set Γ = {τ 1,, τ n } with task τ i s worst-ase exeution time, available frequeny F = {f min, f 2,, f max } with f i < f j for i < j, and fixed exeution time duration ( τ Γ i), when shared reovery blok k = 0, then the exeution strategy of using a uniform frequeny f u = f max τ i Γ i if f u F, or neighboring frequenies f j and f j+1 with f j < f u < f j+1 if f u / F, to exeute the task set provides the highest reliability and onsumes the least energy. Proof. he proof of the theorem an be diretly derived from the proof of Lemma 2 and Lemma 3. heorem 1 gives the exeution strategy that has the highest reliability, but onsumes the least energy for a task set when zero reovery is onsidered. We argue that when k reovery bloks are alloated for fault-proteted task set, the onlusions stated in heorem 1 still holds. he intuition behind it is that if a strategy under whih exeuting the task set has the highest reliability, i.e. the probability to suessfully exeute the task set without enountering a fault, it simply implies that exeuting the task set with the strategy has the least probability to enounter a fault, hene, has the least probability to require a reovery. herefore, when a given number of reovery bloks beome available, the strategy will perform the best, i.e. provide the highest reliability among all other strategies. As task set exeution energy onsumption is independent of reovery bloks as shown in (11), the exeution strategy that leads to the minimal energy onsumption under zero reovery bloks will remain to be the optimal one when there are k reserved reovery bloks. It is worth pointing out that when f u = fmax τ i Γ i / F, based on (14), we need to use f j and f j+1 to exeute for t and t time units, respetively, where f j < f u < f j+1, n f j, f j+1 F, and t = i fj+1 f j f j+1. he question is if frequeny swithing is only allowed at the beginning of eah task, and t happens to be in the middle of a task τ m s exeution time, i.e. m 1 < f j t < m, where 1 m n. In this ase, we hoose a onservative approah, i.e. use higher frequeny f j+1 to exeute task τ m to guarantee reliability. Now, we are ready to give the task set exeution strategy for a given fault-proteted task set Γ p with deadline D and reliability onstraint R g. he basidea is we start with 0 reovery bloks, i.e. k = 0, and use Lemma 2 and (5) to alulate the reliability R with = D. If R R g, then the exeution strategy is Ψ = ( (f u, i f u ) τi Γ p, Γ p, 0), if f u = f max or Ψ = ([ (f j, i f j ) i<m, (f j+1, i τ i Γ i F ; f j+1 ) m i n ], Γ p, 0). Otherwise, we alloate one reovery blok, i.e. k = 1, then the available time for task exeution is = D p 1, where p 1 = 7 max τi Γ p { } is the longest WCE in the fault-proteted task set Γ p. We then use Lemma 2 and (10) to alulate reliability R, if R R g, we have obtained the exeution strategy with k = 1. Otherwise, we iterate the proess with k = i and = D i j=1 p j until the reliability is satisfied, where p j is jth longest WCE in the fault-proteted task set Γ p. We use an example to explain the proedure. Example 1. Assume a fault-proteted task set has three tasks A, B, and C with WCE under f max of 8ms, 6ms, and 4ms, respetively. he deadline for the task set is D = 30ms and the reliability onstraint is R g = τ i {A,B,C} γ(f max, ). he available disrete frequenies F = {0.1, 0.2,..., 1}. able 1: Exeution Strategy for Fault-Proteted ask Set k f u ( f l, f u ) f(τ i ) = f(τ i ) = f l f u R R g (%) (0.6, 0.6) A, B, C A, B, C (0.8, 0.9) A, B C he exeution strategy is determined in two iterations. First, when no reovery blok is reserved, i.e. k = 0, all tasks are assigned to frequeny f u = = 0.6. Based on formula (9), the normalized reliability is 99.85%, whih implies that the reliability onstraint is not satisfied. Hene, we inrease k to 1 and the desired frequeny is f u = = / F. he neighboring frequenies (0.8, 0.9) are used for exeuting the tasks. he alulated optimal frequeny swithing point is t = 18, whih is found in the middle of task C s exeution. herefore, we exeute A and B under 0.8 and C under 0.9. he normalized reliability under this exeution strategy is % whih satisfies the reliability requirement. Hene, the exeution strategy is to reserve one reovery blok of size 8ms, and exeute task A and B with frequeny 0.8, task C with frequeny 0.9. able 1 gives the exeution detail. he algorithm of using a uniform or neighboring frequenies saling (UNS) for task set exeution under a given faultproteted task set is illustrated in Algorithm 1. We start from reserving zero reovery blok, i.e, k = 0 (line 3) to find the uniform frequeny f u (line 4), if f u is not available, using neighboring frequenies f u and f l instead (line 8-16). If the reliability requirement is satisfied, we stop and return the solution (line 17-19). Otherwise, reserving one more reovery blok and repeat the above steps until reliability onstraint is satisfied or slak time is used up (Line 3-21). he time omplexity of this algorithm is dominated by the while loop (line 3-21). he time omplexity of alulating the reliability R( f(τ i ) τi Γ, Γ p, k) is O(n 2 ) and the number of iterations of while loop (Line 3) is O(n) sine the number of tasks in the task set is n. Hene, the total time omplexity should be O(n 3 ) Deiding the Fault-olerated ask Set he previous subsetion assumes the fault-tolerated task set (Γ p ) is given. In this subsetion, we disuss how to judiiously selet the set.

8 Algorithm 1 UNS(Γ p, R g, D, F = {f 1,..., f q }) 1: fl = f u = f q, f(τ i ) = f q 2: k = 0, = D, m = Γ p, slak = m p i 3: while slak > 0 do m 4: f u = p i 5: id = min{i f i f u f i F } 6: fu = f id 7: f(τ i ) = f u, τ p i Γ p 8: if f u f u then 9: fee = min{f i f i f ee f i F } 10: if f u > f 1 f u > f ee then 11: fl = f id 1 12: t = m p i f u f l f u 13: id = max{j j p i f l t} 14: f(τ i ) = f l, i id 15: end if 16: end if 17: if R( f(τ i ) τi Γ p, Γ p, k) R g then 18: break 19: end if 20: k = k + 1, = p k, slak = slak p k 21: end while 22: return ( f(τ i ) τi Γ p, k) Lemma 4. For the given task set (Γ) and the reserved reovery bloks, we have: R( f(τ i ) τi Γ, Γ p, k) > R( f(τ i ) τi Γ, Γ p, k) if Γ p Γ p where k is the number of reserved reovery bloks. Proof. Let Γ u = Γ Γ p and Γ v = Γ p Γ p = {τ i, τ i+1,..., τ j } (j > i), then based on formula (10), we have: and, R k (Γ p ) > γ(f(τ i ), ) R k (Γ p {τ i }) i+1 > γ(f(τ l ), l ) R k (Γ p {τ i, τ i+1 }) l=i >... > τ l Γ v γ(f(τ l ), l ) R k (Γ p) Aording to formula (9), we have: R( f(τ i ) τi Γ, Γ p, k) = R k (Γ p ) R( f(τ i ) τi Γ, Γ p, k) = R k (Γ p) τ j Γ Γ p γ(f(τ j ), j ) τ l Γ v γ(f(τ l ), l ) τ j Γ Γ p γ(f(τ j ), j ) Hene, R( f(τ i ) τi Γ, Γ p, k) > R( f(τ i ) τi Γ, Γ p, k). 8 Based on Lemma 4, we should maximize the number of tasks that an share the reserved reovery bloks. If k reovery bloks are reserved, the total duration of the reovery bloks is the summation of WCEs of the first k longest tasks that share the reovery bloks. Hene, when we exlude the long tasks in the task set from sharing the reovery bloks to redue the reserved reovery blok size, at the same time, we need to inlude as many short tasks as possible to share the reovery bloks for maximizing the reliability without inreasing the total reovery blok size. However, we do not have any prior knowledge as to how many long tasks should be exluded, hene, a heuristi approah is needed to find the answer. We first let the initial faultproteted task set Γ p to be the given task set, i.e. Γ p = Γ. At eah iteration, we remove the longest task from Γ p and let all the remaining tasks in Γ p to share the reovery bloks. Hene, n different seletions of Γ p will be generated. For eah Γ p, we use Algorithm 1 (UNS) to determine its exeution strategy and selet the one that onsumes the least energy. he details of this GSSR-UNS based iterative searh (IS) algorithm is given in Algorithm 2. Algorithm 2 GSSR-UNS-IS (Γ, R g, D, F ) 1: Γ p = Γ 2: f(τ i ) = f max, τ i Γ 3: E 0 = + 4: Ψ(Γ) = ( f(τ i ) τi Γ, Γ p, 0) 5: for j = 1 to Γ do 6: D = D τ i Γ Γ p 7: R g = R g τ i Γ Γp γ(fmax,i) 8: ( f(τ i ) τi Γ p, k) = UNS(Γ p, R g, D, F ) 9: if E(( f(τ i ) τi Γ, Γ p, k)) < E 0 then 10: Ψ(Γ) = ( f(τ i ) τi Γ, Γ p, k) 11: E 0 = E(Ψ(Γ)) 12: end if 13: remove the longest task from Γ p 14: end for 15: return Ψ(Γ) Line 1-4 initialize the variables, and line 5-14 iteratively searh for the best fault-proteted task set Γ. When Γ p is determined, the exeution strategy Ψ(Γ) is also obtained. he time omplexity of the algorithm is dominated by the for loop (line 5-14). he time ost for step 8 is O(n 3 ). Hene, the overall time omplexity is O(n 4 ). It is worth pointing out that though the idea of iterative searh for the fault-proteted task set is simple, simulation results given in Setion 6 show the obtained results are nearoptimal Disussion Dealing with Dependent asks When tasks have preedene onstraints, for instane, the tasks derived from Strassen matrix multipliation and Fast

9 Fourier ransform (FF) [3] appliations, their exeution order must satisfy the preedene onstraints. As in our proposed GSSR-UNS-IS approah, the proedure of determining tasks working frequenies is independent of task exeution orders, hene, the GSSR-UNS-IS approah an be diretly applied to tasks with dependenies. Frequeny Swithing Overhead It is well-known that DVFS is an effetive way to redue energy onsumption. However, reent studies [10, 11] have notied that frequeny swithing is not free. It has both time and energy onsumption overhead. Furthermore, frequent frequeny swithing may derease hardware omponents life span [10]. As with the IRCS or the LF approah, different tasks may need different exeution frequenies, the frequeny swithing overhead is high. With our strategy, however, two, or at most three different frequenies are used to exeute the whole task set, i.e. f max for fault-unproteted tasks and one or two frequenies (if desired frequeny is not available) for faultproteted tasks. If the tasks are independent, we an adjust the exeution order suh that tasks under the same frequeny are exeuted suessively, then at most two frequeny hanges are needed resulting in low frequeny swithing overhead whih is another advantage of the proposed GSSR-UNS-IS approah. If the task set has preedene onstraints, in order to minimize frequeny swithing overhead, we need to re-onsider the partition of fault-proteted and fault-unproteted task sets, and the tasks frequeny assignment, whih will be our future work. 6. Performane Evaluation In this setion, we intend to evaluate our proposed GSSR- UNS-IS approah by omparing it with the two baseline approahes, i.e., LF [20] and IRCS [18], whih are the representatives of no reovery blok sharing, and globally shared reovery blok (GSHR) based approahes, respetively Simulation Setting In our simulations, the system parameters, suh as, transient fault average arrival rate and power model, are listed in able 2. hese values are onsidered realisti and widely used by the researh ommunity [18, 22]. able 2: Parameter Settings λ 0 P ind d C ef θ requirement R g to evaluate the sensitivity of our proposed approah to R g hange. he results shown in the following figures are the average values of repeating the experiments with 1, 000 different task sets. We evaluate the performane of the approahes from the following five aspets: 1. proessor utilization (U) impat on the approahes 2. the approahes sensitivity to task worst-ase exeution time variation (V) 3. the approahes salability with respet to the size of task set (n = Γ ) 4. the approahes salability with respet to the size of task ( min = min τi Γ{ }) 5. the approahes sensitivity with respet to the reliability requirement (R g ) hange where proessor utilization is defines as τ Γ U = D (15) and the variation of task worst-ase exeution times is max V = (16) min where min and max are the minimum and maximum worst-ase exeution times of the given task set Γ, respetively, i.e. max = max τi Γ{ }, min = min τi Γ{ }. As our proposed GSSR-UNS-IS approah onsists of two algorithms, i.e. uniform/neighbroing frequenies saling for task set exeution (UNS) and iterative searh for the faultproteted task set (IS), in order to provide an insight of performane of these two algorithms, before giving the above omparisons, we ompare GSSR-UNS-IS with the following three approahes to inspet the UNS and IS algorithms. GSHR-UNS: use the proposed UNS approah to find task set exeution frequenies assuming all tasks are faultproteted. GSHR-BF: use brute-fore approah to find the optimal task exeution frequenies assuming all tasks are faultproteted. GSSR-UNS-BF: use the proposed UNS approah for faultproteted task set frequeny assignment and use brutefore approah to explore all the possible fault-proteted task sets to find the optimal one. For eah task set, its task worst-ase exeution times are randomly generated with values uniformly distributed in a predefined range. he energy onsumption of exeuting a task set under different exeution strategies is normalized to the energy ost when all tasks are exeuted with f max. We set R 0 as the reliability of the task set when all the tasks are exeuted under the maximum frequeny, i.e. R 0 = Π τi Γγ(f max, ). We first set the reliability requirement as the one when all tasks are exeuted under f max, i.e. R g = R 0. We then vary the reliability 9 he GSHR-UNS and the GSHR-BF have the same faultproteted task set but with different task set exeution strategies. By omparing these two, we an evaluate the effetiveness of the UNS algorithm. he GSSR-UNS-IS and the GSSR-UNS- BF approahes have the same task set exeution strategy, but with different fault-proteted task set seletion algorithms, by omparing them, we an assess our proposed fault-proteted task set seletion algorithm.

10 Figure 2: Evaluation of UNS and IS (n = 5, min = 20ms, V = 4, R g = R 0 ) Figure 3: Proessor Utilization Impat (n = 20, min = 20ms, V = 4, R g = R 0 ) 6.2. Simulation Results and Disussions Evaluation of UNS and IS In this set of experiments, eah task set has 5 tasks (n = 5), the minimum tasks WCE is set as 20ms ( min = 20ms), the variation of task worst-ase exeution times is 4 (V = 4), the reliability requirement R g = R 0. As brute-fore approahes are timing-onsuming, we an only limit the experiments with small task sets. From the results depited in Fig. 2, we an see the GSHR- UNS and the GSHR-BF nearly overlap with eah other and the GSSR-UNS-IS and the GSSR-NS-BF are also overlapped, whih indiates that our task set exeution algorithm, i.e. UNS, is losed to the brute-fore approah, and our fault-proteted task set seletion algorithm, i.e. IS, is near-optimal. In addition, we find that when U > 0.6, the GSSR based approahes, i.e. the GSSR-UNS-IS and the GSSR-UNS-BF approah have better energy saving performane than both the GSHR-UNS and the GSHR-BF approahes. his is due to the advantage of exluding some long tasks from fault protetion, and hene inreases the opportunities to sale down tasks working frequenies for energy saving. However, when the slak time is long enough, fault-unproteted tasks will adversely restrit the energy saving performane as their working frequenies are not allowed to be adjusted. Under this ase, the optimal faultproteted task set is the whole task set ontaining all tasks in the task set and the GSSR degenerates to the GSHR, hene, these four algorithms have the similar energy saving performane when U < Comparison of GSSR-UNS-IS with LF and IRCS In the following set of experiments, eah task set has 20 tasks, the minimum tasks WCE is set as 20ms, the variation of task worst-ase exeution times is 4 and the reliability requirement is set as R g = R 0. When a speifi aspet is evaluated, for instane, when the impat of proessor s utilization on exeution strategies is evaluated, the other parameters are kept as onstants. Utilization Impat Fig. 3 shows the performane of different exeution strategies when the proessor s utilization dereases from 1 to 0.3. As depited in Fig. 3, the LF always onsumes the most energy. Comparing with the IRCS, the GSSR-UNS-IS onsumes less energy when U > 0.8 and U < 0.6. However, in the middle range, i.e. when 0.7 U 0.8, these two have the similar behaviors. he reason is that the IRCS simply assumes all the tasks are fault-proteted, hene, under high proessor s utilization, the slak time is limited, proteting long tasks will inevitably redue the opportunities to sale down tasks working frequenies and hene restrits the energy saving performane. Furthermore, the IRCS searhes the suitable frequeny for eah task in a heuristi manner, when the searh spae is small, the hane to find a good solution is high. However, under lower proessor utilization, more frequeny levels are adoptable, whih results in larger searh spae, hene, the hane to hit a good solution is redued and its energy saving performane dereases. Rather than always proteting the whole task set, our proposed approah judiiously selets the fault-proteted task set. In addition, instead of heuristially searhing for tasks suitable working frequenies, we diretly alulate the best proessing frequeny or neighboring frequenies and assign them to the whole task set. he alulation is independent of the searh spae. Hene, the proposed GSSR-UNS-IS approah outperforms the IRCS both under high (U > 0.8) and low (U < 0.6) proessor utilization. When 0.7 U 0.8, GSSR degenerates to GSHR, while the searh spae is not large enough to deviate the heuristi IRCS from finding a good solution, hene, it has the similar energy saving performane as the GSSR-UNS-IS. Sensitivity to the Variation of ask Worst-ase Exeution imes his set of experiments is to investigate how sensitive eah exeution strategy is to the variation of task worst-ase exeution times in a given task set. he simulation results are depited in Fig. 4. From the figure, we an see that the LF approah still behaves the worst from energy onsumption perspetive. However, it is insensitive to the hange of the variations of task worst-ase exeution times. On the other hand, 10

11 Figure 4: Sensitivity to Variation of ask Worst-ase Exeution imes (n = 20, min = 20ms, U = 0.6, R g = R 0 ) Figure 6: Salability with Respetive to Size of ask (n = 20, V = 4, U = 0.6, R g = R 0 ) Figure 5: Salability with Respet to the Size of ask Set ( min = 20ms, V = 4, U = 0.6, R g = R 0 ) the energy onsumption of the IRCS ontinues growing when the value of V inreases, although the GSSR-UNS-IS based approah also onsumes more energy under larger V, but ompared to the IRCS, the inrease rate is muh slower. When V = 1, the IRCS and our proposed approah perform the same. However, when the variation of task worst-ase exeution times beomes large, for instane, when V = 10, GSSR-UNS-IS an save as muh as 13% more energy than the IRCS. Salability with Respetive to the Size of ask Set Fig. 5 shows the omparison by varying the number of tasks. he energy onsumption of the LF approah is not sensitive to task set size, but it always onsumes the most energy. However, when the number of tasks inreases, even when the total proessor utilization remains the same, it impats the energy saving performane of both IRCS and our GSSR-UNS-IS approahes, but in different diretions. More speifially, when the number of tasks inrease, IRCS onsumes more energy while GSSR- UNS-IS an save more. For instane, when the number of tasks is set to 70, the GSSR-UNS-IS approah an save about 15% more energy when ompared to the IRCS. his is still due to the limitations of the heuristi IRCS as 11 addressed above, i.e. inreasing the task set size expands the searh spae, hene results in the performane degradation. Salability with Respetive to the Size of ask In this experiment, we fix the variation of task worst-ase exeution times V = 4, and hange the min from 1ms to 100ms. Hene, all tasks WCEs hange aordingly. From Fig. 6, we an see that the energy onsumption of IRCS inreases muh faster than GSSR-UNS-IS when min inreases. When min = 1ms, GSSR-UNS-IS and IRCS have the same energy onsumption, while when min = 100ms, IRCS onsumes 13% more energy than GSSR-UNS-IS. LF still onsumes more energy, but it is insensitive to the variation of task exeution times. Sensitivity with Respetive to the Reliability Requirement his set of the experiments is to evaluate the proposed approah s sensitivity to the reliability requirement R g hange. As R 0 is defined as the reliability of the task set when all the tasks are exeuted under f max, then 1 R 0 is the orresponding probability of failure during the exeution of task set. We sale the probability of failure to vary the reliability requirement, in partiularly, we set R g = 1 (1 R 0 )/S, where S is saling fator. As LF only works when R g = R 0, hene we exlude it from this set of experiments. he results are shown in Fig. 7. From the figure, we an observe when S inreases, i.e. the reliability requirement R g inreases, both the IRCS and GSSR-UNS-IS approahes onsume more energy. his is due to the need for reserving more reovery bloks to meet the target reliability, hene less slak time is available for frequeny saling to save energy. With respet to the energy onsumption inreasing rate, both of the approahes have about the same energy onsumption inreasing rate. 7. Conlusion Reliability and power/energy onservation are two of the most ritial design issues in today s real-time system design. However, they are often at odds in system resoure usage. In this paper, we have developed a new resoure sharing tehnique