Utilization-Based Scheduling of Flexible Mixed-Criticality Real-Time Tasks

Transcription

1 1 Utlzaton-Based Schedulng of Flexble Mxed-Crtcalty Real-Tme Tasks Gang Chen, Nan Guan, D Lu, Qngqang He, Ka Huang, Todor Stefanov, Wang Y arxv: v1 [cs.dc] 29 Sep 2017 Abstract Mxed-crtcalty models are an emergng paradgm for the desgn of real-tme systems because of ther sgnfcantly mproved resource effcency. However, formal mxed-crtcalty models have tradtonally been characterzed by two mpractcal assumptons: once any hgh-crtcalty task overruns, all low-crtcalty tasks are suspended and all other hgh-crtcalty tasks are assumed to exhbt hghcrtcalty behavors at the same tme. In ths paper, we propose a more realstc mxed-crtcalty model, called the flexble mxed-crtcalty (FMC model, n whch these two ssues are addressed n a combned manner. In ths new model, only the overrun task tself s assumed to exhbt hgh-crtcalty behavor, whle other hgh-crtcalty tasks reman n the same mode as before. The guaranteed servce levels of low-crtcalty tasks are gracefully degraded wth the overruns of hgh-crtcalty tasks. We derve a utlzaton-based technque to analyze the schedulablty of ths new mxed-crtcalty model under EDF-VD schedulng. Durng run tme, the proposed test condton serves an mportant crteron for dynamc servce level tunng, by means of whch the maxmum avalable executon budget for low-crtcalty tasks can be drectly determned wth mnmal overhead whle guaranteeng mxed-crtcalty schedulablty. Experments demonstrate the effectveness of the FMC scheme compared wth state-of-the-art technques. Index Terms EDF-VD Schedulng, Flexble Mxed-Crtcalty System, Utlzaton-Based Analyss 1 INTRODUCTION A mxed-crtcalty (MC system s a system n whch tasks wth dfferent crtcalty levels share a computng platform. In MC systems, dfferent degrees of assurance must be provded for tasks wth dfferent crtcalty levels. To mprove resource effcency, MC systems [26] often specfy dfferent WCETs for each task at all exstng crtcalty levels, wth those at hgher crtcalty levels beng more pessmstc. Normally, tasks are scheduled wth less pessmstc WCETs for resource effcency. Only when the less pessmstc WCET s volated, the system swtches to the hgh-crtcalty mode and only tasks wth hgher crtcalty levels are guaranteed to be scheduled wth pessmstc WCETs thereafter. There s a large body of research work on specfyng and schedulng mxed-crtcalty systems (see [8] for a comprehensve revew. However, to ensure the safety of hgh-crtcalty tasks, the classc MC model [4], [5], [1], [3], [2] apples conservatve restrctons to the mode-swtchng scheme. In the classc MC model, whenever any hghcrtcalty task overruns, all low-crtcalty tasks are mmedately abandoned and all other hgh-crtcalty tasks are assumed to exhbt hgh-crtcalty behavors. Ths modeswtchng scheme s not realstc n the followng two mportant respects. Frst, t s pessmstc to mmedately abandon all low-crtcalty tasks, because low-crtcalty tasks requre a certan tmng performance as well [17], [25]. Second, t s pessmstc to bnd the mode swtches of all hgh-crtcalty tasks together for the scenaros where the mode swtches of hgh-crtcalty tasks are naturally ndependent [12], [22]. Ths paper has been submtted to IEEE Transacton on Computers (TC on Sept-09th-2016, and revsed for two tmes on Jan-19th-2017 and Aug- 28th The submsson number on TC s TC Ths paper s stll under revew by TC wth mnor revson. The screenshot of submsson hstory s also attached n appendx D. Emal: chengang@cse.neu.edu.cn;csguannan@comp.polyu.edu.hk;y@t.uu.se Although there has been some research on solvng the frst problem,.e., statcally reservng a certan degraded level of servce for low-crtcalty executon [7], [25], [24], [16], to our knowledge, lttle work has been done to date to address the second problem. In ths paper, we propose a flexble MC model (denoted as FMC on a un-processor platform, n whch the two aforementoned ssues are addressed n a combned manner. In FMC, the mode swtches of all hgh-crtcalty tasks are ndependent. A sngle hgh-crtcalty task that volates ts low-crtcalty WCET trggers only tself nto hgh-crtcalty mode, rather than trggerng all hgh-crtcalty tasks. All other hgh-crtcalty tasks reman at ther prevous crtcalty levels and thus do not requre to book addtonal resources at mode-swtchng ponts. In ths manner, sgnfcant resources can be saved compared wth the classc MC model [1], [2], [3]. On the other hand, these saved resources can be used by low-crtcalty tasks to mprove ther servce qualty. More mportantly, the proposed FMC model adaptvely tunes the servce level for low-crtcalty tasks to compensate for the overrun of hgh-crtcalty tasks, thereby allowng the system workload to be balanced wth mnmal servce degradaton for low-crtcalty tasks. At each ndependent mode-swtchng pont, the servce level for low-crtcalty tasks s dynamcally updated based on the overruns of hgh-crtcalty tasks. By dong so, the qualty of servce (QoS for low-crtcalty tasks can be sgnfcantly mproved. Snce the servce level for low-crtcalty tasks s dynamcally determned durng run tme, the decson-makng procedure should be lght-weghted. For ths purpose, utlzaton-based schedulng s more desrable for run-tme decson-makng because of ts smplcty. However, usng utlzaton-based schedulng for our FMC model brngs new challenges due to the ntrnsc dynamcs of ths model, such as the servce level tunng strategy. In partcular, utlzatonbased schedulablty analyss reles on whether the cumula-

2 2 tve executon tme of low-crtcalty tasks can be effectvely upper bounded. In FMC, the servce levels for low-crtcalty tasks are dynamcally tuned at each mode swtchng pont. Therefore, the cumulatve executon tme of low-crtcalty tasks strongly depends on when mode swtches occur. In general, such nformaton s dffcult to explctly represent pror to real executon, because the ndependence of the mode swtches n FMC results n a large analyss space. It s computatonally nfeasble to analyze all possbltes. To resolve ths challenge, we propose a novel approach based on mathematcal nducton, whch allows the cumulatve executon tme of low-crtcalty tasks to be effectvely upper bounded. In ths work, we study the schedulablty of the proposed FMC model under EDF-VD schedulng. A utlzaton-based schedulablty test condton s derved by ntegratng the ndependent trggerng scheme and the adaptve servce level tunng scheme. A formal proof of the correctness of ths new schedulablty test condton s presented. Based on ths test condton, an EDF-VD-based MC schedulng algorthm, called FMC-EDF-VD, s proposed for the schedulng of an FMC task system. Durng run tme, the optmal servce level for low-crtcalty tasks can be drectly determned va ths condton wth mnmum overhead, and mxed-crtcalty schedulablty can be smultaneously guaranteed. In addton, we explore the feasble regon of the vrtual deadlne factor for FMC model. Smulaton results show that FMC- EDF-VD provdes benefts n supportng low-crtcalty executon compared wth state-of-the-art algorthms. 2 RELATED WORK Mxed-crtcalty schedulng s a research feld that has receved consderable attenton n recent years. As stated n [7], much exstng research work [1], [2], [3] on MC schedulng makes the pessmstc assumpton that all lowcrtcalty tasks are mmedately abandoned once the system enters hgh-crtcalty mode. Instead of abandonng all lowcrtcalty tasks, some efforts [7], [25], [24], [16], [19] have been made to provde solutons for offerng low-crtcalty tasks a certan degraded servce qualty when the system s n hgh-crtcalty mode. Nevertheless, these studes stll use a pessmstc mode-swtch trggerng scheme n whch, whenever one hgh-crtcalty task overruns, all other hghcrtcalty tasks are trggered to exhbt hgh-crtcalty behavor and book unnecessary resources. Recent work presented n [12], [22], [15] offers solutons for mprovng performance for low-crtcalty tasks by usng dfferent mode-swtch trggerng strateges. Huang et al. [15] proposed an nterference constrant graph to specfy the executon dependences between hgh-crtcalty and lowcrtcalty tasks. However, ths approach stll uses hghconfdence WCET estmates for all hgh-crtcalty tasks when determnng system schedulablty, and therefore does not address the second problem dscussed above. Gu et al. [12] presented a component-based strategy n whch the component boundares offer the solaton necessary to support the executon of low-crtcalty tasks. Mnor overruns can be handled wth an nternal mode swtch by droppng off all low-crtcalty jobs wthn a component. More extensve overruns wll result n a system-wde external mode swtch and the droppng off of all low-crtcalty jobs. Therefore, the mode swtches at the nternal and external levels stll use pessmstc strategy n whch all lowcrtcalty tasks are abandoned once a mode swtch occurs at the correspondng level. The two problems mentoned above stll exst at both levels. In addton, the system schedulablty s tested usng a demand bound functon (DBF based approach. The complexty of the schedulablty test s exponental n the sze of the nput [12], resultng n costly computatons. Ren and Phan [22] proposed a parttoned schedulng algorthm based on group-based Pfar-lke schedulng [14] for mxed-crtcalty systems. Wthn a task group, a sngle hghcrtcalty task s encapsulated wth several low-crtcalty tasks. The tasks are scheduled va Pfar-lke schedulng [14] by breakng them nto quantum-length sub-tasks. Sub-tasks that belong to dfferent groups are scheduled on an earlestpseudo-deadlne-frst (EPDF bass. Pfar schedulng s a well-known optmal schedulng method for schedulng perodc real-tme tasks on a multple-resource system. However, Pfar schedulng poses many practcal problems [14]. Frst, the Pfar algorthm ncurs very hgh schedulng overhead because of frequent preemptons caused by the small quantum lengths. Second, the task groups are explctly requred to be well synchronzed and to make progress at a steady rate [27]. Therefore, the work presented n [22] strongly reles on the perodc task models. In addton, the system schedulablty n [22] s determned by solvng a MINLP problem, whch n general has NP-hard complexty[11]. Because of ths complexty, the scalablty problem needs to be carefully consdered. Compared wth the exstng work [12], [22], the proposed FMC model and ts schedulng technques offer both smplcty and flexblty. In partcular, our work dffers from these approaches n the followng respects. Compared wth the Pfar-based schedulng method [22] whch reles on perodc task models, our paper derves an EDF-VD-based schedulng scheme for sporadc mxed-crtcalty task systems, that ncorporates an ndependent mode-swtch trggerng scheme and an adaptve servce level tunng scheme. EDF-VD has shown strong competence n both theoretcal and emprcal evaluatons [4]. Compared wth the work presented n [12], our approach uses a more flexble strategy that allows a component/system to abandon low-crtcalty tasks n accordance wth run-tme demands. Therefore, both of the problems stated above are addressed n our approach. In contrast to the work of [12], [22], our approach s based on a utlzaton-based schedulablty analyss. The system schedulablty can be effectvely determned. From the desgner s perspectve, our utlzaton-based approach requres smpler specfcatons and reasonng compared wth the work of [22], [12]. In terms of flexblty, our approach can effcently allocate executon budgets for low-crtcalty tasks durng runtme n accordance wth demands, whereas the approaches presented n [12], [22] requre that lowcrtcalty tasks should be executed n accordance wth the dependences between low-crtcalty and hgh-crtcalty tasks that have been determned n off-lne.

3 3 3 SYSTEM MODELS AND BACKGROUND 3.1 FMC mplct-deadlne sporadc task model Task model: We consder an MC system wth two dfferent crtcalty levels, and. The task set γ contans n MC mplct-deadlne sporadc tasks whch are scheduled on a un-processor platform. Each task τ n γ generates an nfnte sequence of jobs and can be specfed by a tuple {T,L,C }. Here,T denotes the mnmum job-arrval ntervals. L {,} denotes the crtcalty level of a task. Each task s ether a low-crtcalty task or hgh-crtcalty task. γ and γ (where γ = γ γ denote lowcrtcalty task set and hgh-crtcalty task set, respectvely. C {C,C } s the lst of WCETs, where C and C denote the low-crtcalty and hgh-crtcalty WCETs, respectvely. For hgh-crtcalty tasks, the WCETs satsfy C C <. For low-crtcalty tasks, ther executon budget s dynamcally determned n FMC based on the overruns of hgh-crtcalty tasks. To characterze the executon behavor of low-crtcalty tasks n hgh-crtcalty mode, we now ntroduce the concept of the servce level on each modeswtchng pont, whch specfes the guaranteed servce qualty after the mode swtch. Servce level: Instead of completely dscardng all lowcrtcalty tasks, Burns and Baruah n [7] proposed a more practcal MC task model n whch low-crtcalty tasks are allowed to statcally reserve resources for ther executon at a degraded servce level n hgh-crtcalty mode (.e., a reduced executon budget. By contrast, n FMC, the executon budget s dynamcally determned based on the run-tme overruns rather than statcally reserved as n [7]. To model ths dynamc behavor, the servce level concept defned n [7] should be extended to apply to ndependent mode swtches. Therefore, we defne the servce level z k when the system has undergone k mode swtches. Defnton 1. (Servce level z k when k mode swtches have occurred. If low-crtcalty task τ s executed at servce level z k when the system has undergone k mode swtches, up to z k C tme unts can be used for the executon of τ n one perod T. When τ runs n lowcrtcalty mode, we sayτ s executed at servce levelz 0, where z 0 = 1. The servce level defnton gven above s complant wth the concept of the mprecse computaton model developed by Ln et al.[18] to deal wth tme-constraned teratve calculatons. Imprecse computaton model s partly motvated by the observaton that many real-tme computatons are teratve n nature, solvng a numerc problem by successve approxmatons. Termnatng an teraton early can return useful mprecse results. Wth ths motvaton n mnd, the mprecse computaton model can be used n a natural way to enhance graceful degradaton [20]. The practcalty of mprecse computaton model has been deeply nvestgated and verfed n [9]. Imprecse computaton model provdes an approxmate but tmely result, whch may be acceptable n many applcaton areas. Examples of such applcatons are optmal control [6], multmeda applcatons [21], mage and speech processng [10], and fault-tolerant schedulng problems [13]. In FMC, when an overrun occurs, low-crtcalty tasks wll be termnated before completon and sacrfce the qualty of the produced results to ensure ther tmng correctness. Assumptons: For the remander of the manuscrpt, we make the followng assumptons: (1 Regardng the compensaton for the k th overrun of a hgh-crtcalty task, we assume that z k zk 1. After the k th mode-swtchng pont, the allowed executon tme budget n one perod should thus be reduced from z k 1 c to z k c. (2 Accordng to [4], f + u 1, then all tasks can be perfectly scheduled by regular EDF under the worst-case reservaton strategy. Therefore, we here consder meanngful cases n whch +u > 1. Utlzaton: Low and hgh utlzaton for a task τ are defned as = c T and u = c T, respectvely. The system-level utlzaton for task set γ are defned as = τ γ, = τ γ, and u τ γ u =. The system utlzaton of low-crtcalty tasks after k th mode-swtchng pont can be defned as u k = τ γ z k u. To guarantee the executon of the mandatory portons of low-crtcalty tasks, the mandatory utlzaton can be defned as u man = τ γ z man, where z man s the mandatory servce level for task τ as specfed by the users. 3.2 Executon semantcs of the FMC model The man dfferences between our FMC executon model and the classc MC executon model le n the ndependent mode-swtch trggerng scheme for hgh-crtcalty tasks and the dynamc servce tunng of low-crtcalty tasks. In contrast to the classc MC model, the FMC model allows an ndependent trggerng scheme n whch the overrun of one hgh-crtcalty task trggers only tself nto hgh-crtcalty mode. Consequently, the hgh-crtcalty mode of the system n FMC depends on the number of hgh-crtcalty tasks that have overrun. Therefore, we ntroduce the followng defnton: Defnton 2. (k-level hgh-crtcalty mode. At a gven nstant of tme, f k hgh-crtcalty tasks have entered hgh-crtcalty mode, then the system s n k-level hghcrtcalty mode. For low-crtcalty mode, we say that the system s n 0-level hgh-crtcalty mode. Based on Def. 2, the executon semantcs of the FMC model s llustrated n Fg. 1. Intally, the system s n lowcrtcalty mode (.e., 0-level hgh-crtcalty mode. Then, the overruns of hgh-crtcalty tasks trgger the system to proceed through the hgh-crtcalty modes one by one untl the condton for transtonng back s satsfed. Accordng to Fg. 1, the executon semantcs can be summarzed as follows: Low-crtcalty mode: All tasks n γ start n 0-level hgh-crtcalty mode (.e., low-crtcalty mode. As long as no hgh-crtcalty task volates ts C, the system remans n 0-level hgh-crtcalty mode. In ths mode, all tasks are scheduled wth C. Transton: When one job of a hgh-crtcalty task that s beng executed n low-crtcalty mode overruns ts C, ths hgh-crtcalty task mmedately swtches nto hgh-crtcalty mode. However, the overrun

4 4 Low Mode k=0 overrun K=k+1 transton&update Idle Interval return Hgh Mode k-level Fgure 1. Executon semantcs of the FMC model. overrun k=k+1 transton&update of ths task does not trgger other hgh-crtcalty tasks to enter hgh-crtcalty mode. All other hghcrtcalty tasks stll reman n the same mode as before. Correspondngly, the system transtons to a hgher-level hgh-crtcalty mode 1. Updates: At the k th transton pont (correspondng to tme nstant ˆt k n Fg. 1, a new servce level z k s determned and updated to provde degraded servce for low-crtcalty tasksτ to balance the resource demand caused by the overrun of the hgh-crtcalty task. At ths tme, f any low-crtcalty jobs have completed more thanz k c tme unts of executon (.e., have used up the updated executon budget for the current perod, those jobs wll be suspended mmedately and wat for the budget to be renewed n the next perod. Otherwse, low-crtcalty jobs can contnue to use the remanng tme budget for ther executon. Return to low-crtcalty mode: When the system detects an dle nterval [7], [23], the system wll transton back nto low-crtcalty mode. 3.3 EDF-VD schedulng EDF-VD [4], [5] s a schedulng algorthm for mplementng classc preemptve EDF schedulng n MC systems. The man concept of EDF-VD s to artfcally reduce the (vrtual deadlnes of hgh-crtcalty tasks when the system s n low-crtcalty mode. These vrtual deadlnes can be used to cause hgh-crtcalty tasks to fnsh earler to ensure that the system can reserve a suffcent executon budget for the hgh-crtcalty tasks to meet ther actual deadlnes after the system swtches nto hgh-crtcalty mode. In ths paper, we study the schedulablty under EDF-VD schedulng for the proposed FMC model. 4 FMC-EDF-VD SCHEDULING ALGORITHM In ths secton, we provde an overvew of the proposed EDF-VD-based schedulng algorthm for our FMC model, called FMC-EDF-VD. The proposed schedulng algorthm conssts of an off-lne step and a run-tme step. We mplement the off-lne step pror to run tme to select a feasble vrtual deadlne factor x for tghtenng the deadlnes of hgh-crtcalty tasks. Durng run tme, the servce levels z k for low-crtcalty tasks are dynamcally tuned based on the overrun of hgh-crtcalty tasks. Here, we present the operaton flow of FMC-EDF-VD. 1. Wthout loss of generalty, we assume that the system s n k-level hgh-crtcalty mode. Off-lne step: In accordance wth Thm. 1, we frst determne u x as. Then, to guarantee the schedulablty of FMC- 1 EDF-VD, the determned x value should be valdated by testng condton Eqn. (24 n Thm. 5. Note that f condton Eqn. (24 s not satsfed, then t s reported that the specfed task set cannot be scheduled usng FMC-EDF-VD. Run-tme step: The run-tme behavor follows the executon semantcs presented n Secton 3.2. In low-crtcalty mode, all hgh-crtcalty tasks are scheduled wth ther vrtual deadlnes. At each mode-swtchng pont, the followng two procedures are trggered: Reset the deadlne of overrun hgh-crtcalty task from ts vrtual deadlne to the actual deadlne. The deadlne settngs of other hgh-crtcalty tasks reman the same as before. Update the servce levels for low-crtcalty tasks n accordance wth Thm. 2. Note that varous run-tme tunng strateges can be specfed by the user as long as the condton n Thm. 2 s satsfed. For the purpose of demonstraton, a unform tunng strategy and a droppng-off strategy are dscussed n ths paper. Complete descrptons of these strateges are provded n Secton 6. Table 1 Example task set L T C C τ 1,τ 2,τ 3,τ τ τ Motvatonal example In ths secton, we present a motvaton example to show how the global trggerng scheme n FMC-EDF-VD can effcently support low-crtcalty task executon. The unform tunng strategy (see Thm. 6, n whch all low-crtcalty tasks share the same servce level settngz k durng run tme (.e., τ γ,z k = zk, s adopted for ths demonstraton. Example 1. For clarty of presentaton, we consder a task set that contans four dentcal hgh-crtcalty tasks and two low-crtcalty tasks, as lsted n Tab. 1. We specfy u man = 0 for demonstraton. From Tab. 1, one can derve, and u = 4 5. = 2 5, u = 3 10 Accordng to Thm. 6, we can compute the unform servce levels z k for all possble mode-swtchng scenaros. The results are lsted n Tab. 2. Table 2 Low-crtcalty servce levels Number of Overrun k Utlzaton u k Servce Level z k Executon Budget of τ Executon Budget of τ As shown n Tab. 2, FMC-EDF-VD can effcently support low-crtcalty task executon by dynamcally tunng the low-crtcalty executon budget based on overrun demand. When only one hgh-crtcalty task overruns, low-crtcalty

5 5 task τ 5 and τ 6 can use up to 22.5 and tme unts per perod for executon. In ths case, low-crtcalty tasks can mantan 75% executon. Only when all hgh-crtcalty tasks overrun therc L, low-crtcalty tasks are all dropped. For comparson, the global trggerng strategy used n [7], [19] are always requred to drop all low-crtcalty tasks regardless of how many overruns occur durng run tme because of the overapproxmaton of the overrun workload. From a probablstc perspectve, the lkelhood that all hghcrtcalty tasks wll exhbt hgh-crtcalty behavor s very low n practce. Therefore, n a typcal case, only a few hghcrtcalty tasks wll overrun therc L durng a busy nterval. In most cases, FMC-EDF-VD wll only need to schedule resources for a porton of hgh-crtcalty tasks based on ther overrun demands and can mantan the servce level for low-crtcalty task executon to the greatest possble extent. In ths sense, FMC-EDF-VD can provde better and more graceful servce degradaton. 5 SCHEDULABILITY TEST CONDITION In ths secton, we present a utlzaton-based schedulablty test condton for the FMC-EDF-VD schedulng algorthm. We start by ensurng the schedulablty of the system when t s operatng n low-crtcalty mode (Thm. 1. Then, we dscuss how to derve a suffcent condton to ensure the schedulablty of the algorthm after k mode swtches (Thm. 2. Based on several sophstcated new technques, the correctness of ths new schedulablty test condton can be proven and the formal proof s provded n Secton 5.3. Fnally, we derve the regon of x that can guarantee the feasblty of the proposed schedulng algorthm. 5.1 Low-crtcalty mode In low-crtcalty mode, the system behavors n FMC are exactly the same as n EDF-VD [4]. Therefore, we can use the followng theorem presented n [4] to ensure the schedulablty of tasks n low-crtcalty mode. Theorem 1. The followng condton s suffcent to ensure that EDF-VD can successfully schedule all tasks n lowcrtcalty mode: + u x 1 (1 5.2 Hgh-crtcalty mode after k mode swtches In ths secton, we analyze the schedulablty of the FMC- EDF-VD algorthm durng the transton phase. Wth ths analyss, we provde the answer to the queston of how much executon budget can be reserved for low-crtcalty tasks whle ensurng a schedulable system for mode transtons. Wthout loss of generalty, we consder a general transton case n whch the system transtons from (k 1- level hgh-crtcalty mode to k-level hgh-crtcalty mode. Here, we frst ntroduce the derved schedulablty test condton n Thm. 2. Then, the formal proof of the correctness of ths schedulablty test condton s provded n Secton 5.3. Recall that u k denotes the utlzaton of low-crtcalty tasks for the k th mode-swtchng pont and s defned as u k = τ γ z k u. Theorem 2. The system s n (k 1-level hgh-crtcalty mode. For the k th mode-swtchng pont ˆt k, when hghcrtcalty task τˆt k overruns, the system s schedulable at ˆt k f the followng condtons are satsfed: ˆt k (1 u ˆt k u k uk 1 + (2 (1 x z k zk 1 ( τ γ (3 where andu ˆt denote low and hgh utlzaton, respectvely, for the hgh-crtcalty k taskτˆt k ˆt k that undergoes a mode swtch at ˆt k. In Thm. 2, we present a general utlzaton-based schedulablty test condton for the FMC model. Now, let us take a closer look at the condtons specfed n Thm. 2. We observe the followng nterestng propertes of FMC-EDF-VD: In Thm. 2, the desred utlzaton balance between low-crtcalty and hgh-crtcalty tasks s acheved. As constraned by Eqn. (3, the utlzaton of lowcrtcalty tasks should be further reduced when a new overrun occurs. As shown n Eqn. (2, the utlzaton reducton u k uk 1 ˆt k (1 u ˆt k s bounded by (1 x for utlzaton balance. Another mportant observaton s that the bound on the utlzaton reducton s determned only by the overrun of hgh-crtcalty task τˆt k (as shown n Eqn. (2. Ths means that the effects of the overruns on utlzaton reducton are ndependent. Moreover, the occurrence sequence of hgh-crtcalty task overruns has no mpact on the utlzaton reducton. Thm. 2 also provdes us wth a generc metrc for managng the resources of low-crtcalty tasks when each ndependent mode swtch occurs. In general, varous run-tme tunng strateges can be appled durng the transton phase, as long as the condtons n Thm. 2 are satsfed. 5.3 The proof of correctness We now prove the correctness of the schedulablty test condton presented n Thm. 2. We start wth the proof by ntroducng some mportant concepts. Then, we propose a key technque to obtan the bound of the cumulatve executon tme for low-crtcalty and hgh-crtcalty tasks (Lem. 1, Lem. 2, and Lem. 3. Based on these derved bounds, the utlzaton-based test condton can be derved Challenges Incorporatng the FMC model nto a utlzaton-based EDF- VD schedulng analyss ntroduces several new challenges. The ndependent trggerng scheme and the adaptve servce level tunng scheme n the FMC model allow flexble system behavors. However, ths flexblty also makes the system behavor more complex and more dffcult to analyze. In partcular, t s dffcult to effectvely determne an upper bound on the cumulatve executon tme for low-crtcalty tasks. In the FMC model, the servce levels for low-crtcalty tasks are dynamcally tuned at each mode-swtchng pont. Therefore, the cumulatve executon tme of low-crtcalty tasks strongly depends on when each mode swtch occurs.

6 6 η k (ak, ˆtk 0 ˆt k j a k ˆt k d k Fgure 2. The executon scenaro for a k-carry-over job. However, ths nformaton s dffcult to explctly represent pror to real executon because the ndependence of the mode swtches n the FMC model results n a large analyss space. Ths makes t computatonally nfeasble to analyze all possbltes. Moreover, apart from the tmng nformaton of multple mode swtches, the dervaton of the cumulatve executon tme also depends on the servce tunng decsons made at prevous mode swtches. Determnng how to extract statc nformaton (.e., utlzaton to formulate a feasble suffcent condton from these varables s another challengng task Concepts and notaton Before dvng nto the detaled proofs, we ntroduce some commonly used concepts and notaton that wll be used throughout the proofs. To derve a suffcent test, suppose that there s a tme nterval [0,t f ] such that the system undergoes the k th mode swtch and the frst deadlne mss occurs at t f. Let J be the mnmal set of jobs released from the MC task set γ for whch a deadlne s mssed. Ths mnmalty means that f any job s removed from J, the remander of J wll be schedulable. Here, we ntroduce some notaton for later use. ˆt k denotes the tme nstant of the k th mode swtch caused by hgh-crtcalty task τˆt k. The absolute release tme and deadlne of the job of τˆt that k overruns at ˆt k are denoted by aˆt k and dˆt k, respectvely. η k(t 1,t 2 denotes the cumulatve executon tme of task τ when the system s operatng n k-level hgh-crtcalty mode durng the nterval (t 1,t 2 ]. Next, we defne a specal type of job for low-crtcalty tasks, called a carry-over job, and ntroduce several mportant propostons that wll be useful for our later proofs. Defnton 3. A job of low-crtcalty task τ s called a k- carry-over job f thek th mode swtch occurs n the nterval [a k,dk ], where ak and d k are the absolute release tme and deadlne of ths job, respectvely. Fg. 2 shows how a k-carry-over job s executed durng the nterval [a k,dk ]. The black box represents the cumulatve executon tme η k(ak,ˆt k of the k-carry-over job before the k th mode-swtchng pont ˆt k. Proposton 1. (From [4], [5] All jobs executed n [ˆt k,t f ] have a deadlne t f. Proposton 2. The k th mode-swtchng pont ˆt k satsfes ˆt k aˆt +x (t k f aˆt k. Proof. Snce a hgh-crtcalty job ofτˆt trggers k thekth mode swtch at ˆt k, ts vrtual deadlne aˆt k +x (dˆt k aˆt k must be greater than ˆt k. Otherwse, the hgh-crtcalty job would have completed ts executon before the tme nstant of the swtch. t f t Proposton 3. For ak-carry-over job of low-crtcalty taskτ, fη k(ak,ˆt k 0, then the followng holds: d k aˆt k +x (t f aˆt k. Proof. There are two cases to consder: a k aˆt and k ak < aˆt k. Case 1 (a k aˆt k: In ths case, for the k-carry-over job to be executed after aˆt k, the k-carry-over job should have a deadlne no later than the vrtual deadlneaˆt k+x(dˆt k aˆt k of the hgh-crtcalty job that trggered the k th mode swtch. As a result, becausedˆt t k f, we haved k (aˆt +x (t k f aˆt k. Case 2 (a k < aˆt k: We prove the correctness of ths case by contradcton. Suppose that the k-carry-over job of lowcrtcalty task τ, wth ts deadlne of d k > (aˆt + x k (t f aˆt k, were to be executed before aˆt k. Let t denote the latest tme nstant at whch ths k-carry-over job s executed before aˆt k. At tme nstant ˆt k, all prevous (k 1 mode swtches are known to the system 2. At t, we know that there should be no pendng job wth a deadlne of (aˆt + x (t k f aˆt k. Ths means that jobs that are released at or after t wll also suffer a deadlne mss at t f, whch contradcts the mnmalty of J. Therefore, d k (aˆt +x (t k f aˆt k. Usng the propostons and notaton presented above, we now derve an upper bound on the cumulatve executon tme η k (0,t f for low-crtcalty tasks (Lem. 1 and hghcrtcalty tasks (Lem. 2 and Lem Bound for low-crtcalty tasks As dscussed above, t s dffcult to derve an upper bound on the cumulatve executon tme of low-crtcalty tasks durng the nterval[0,t f ] because of the large analyss space. In ths secton, we propose a novel dervaton strategy to resolve ths challenge. The overall dervaton strategy s based on the specfed dervaton protocol (Rule 1-Rule 4 and mathematcal nducton. The purpose of the dervaton protocol s to specfy unfed ntermedate upper bounds for dfferent executon scenaros. The advantage of ntroducng these ntermedate upper bounds s that we can vrtually hde the nfluence of the prevous k 1 mode swtches. For nstance, n Rule 1 (see Eqn. (4, the nfluence of the prevous k 1 mode swtches s hdden n the term sup{η k(0,dl }. In ths way, the kth mode swtch and the prevous k 1 mode swtches are decorrelated. Throughout the remander of ths secton, we wll use sup{η k(t 1,t 2 } to denote the ntermedate upper bounds on η k(t 1,t 2 for dfferent executon scenaros, whch represent the upper bounds under specfc condtons. Let ˆt k j (j > 0 denote the last mode-swtchng pont before a k (as shown n Fg. 2. z k j denotes the updated servce level at ˆt k j. d l denotes the absolute deadlne for the last job3 of τ durng [0,t f ]. Now, we present the rules for dervng sup{η k(0,t f} and sup{η k(ak,dk }, as summarzed n Eqn. (4 and Eqn. (5. 2. At ˆt k, all prevous k 1 mode swtches have already occurred. 3. Here, the last job means the last job wth a deadlne of t f.

7 7 k (0,t f } sup{η { = sup{η k (0,d l }+(t f ˆt k z k d l < ˆt k (Rule 1 sup{η k (0,d k }+(t f d k z k Otherwse (Rule 2 (4 k (a k,d k } sup{η { = (d k a k z k j η k (a k,ˆt k 0 (Rule 3 (d k a k z k Otherwse (Rule 4 (5 The detaled descrpton and proof are presented n Appendx A. In Rule 1-Rule 4, one may notce that there are several dfferent executon scenaros n whch only one mode swtch s consdered. When n mode swtches are allowed, the combnaton space for all executon scenaros wll ncrease exponentally wth n. In general, t s very dffcult to derve a bound on the cumulatve executon tme for low-crtcalty tasks because of ths large combnaton space. To solve ths problem, we analyze the dfference between sup{η k(0,t f} and sup{η k 1 (0,t f } and fnd that ths dfference can be unformly bounded by a dfference term ψ k (see Lem. 1. Ths fndng s formally proven n Lem. 1 through mathematcal nducton. Before the proof, we frst present a fact that wll be useful for later nterpretaton. Fact 1. For the k th mode-swtchng pont ˆt k, at tme nstant t 0 such that t 0 ˆt k, η k (0,t 0 = η k 1 (0,t 0. Proof. The k th mode swtch can only begn to affect lowcrtcalty task executon after the correspondng modeswtchng pont ˆt k. Before ˆt k, the k th mode swtch has no mpact. Thus, we have η k(0,t 0 = η k 1 (0,t 0. Lemma 1. For all k 1, the cumulatve executon tme η k(0,t f can be upper bounded by t f + ψ j (6 x(z j zj 1 where the dfference term ψ j s defned as (t f aˆt j(1. Proof. Instead of provng the orgnal statement, we wll prove an alternatve statement P(k, whch s defned as follows: The ntermedate upper bounds sup{η k(0,t f} under dfferent executon scenaros can be unformly upper bounded by Eqn. (6. Snce η k(0,t f sup{η k(0,t f}, the orgnal statement wll be proven correct f the statement P(k s proven to be correct. Now, we wll prove that the statement P(k s correct for all possble ntegers k based on mathematcal nducton. Recall that d l s the absolute deadlne for the last job of τ durng [0,t f ]. Step 1 (base case: We wll prove that P(1 s correct for k = 1. Proof. We consder two cases, one n whch a carry-over job does not exst at the frst mode-swtchng pont ˆt 1 (.e., d l < ˆt 1 and one n whch such a job does exst (.e.,d l ˆt 1. Case 1 (d l <ˆt 1 : Accordng to Rule 1 and Prop. 2, we have the followng: sup{η(0,t 1 f } = sup{η(0,d 1 l }+(t f ˆt 1 z 1 = d l +(t f ˆt 1 z 1 snce d l < ˆt 1 aˆt 1 +x (t f aˆt 1 < t f z 1 t f +ˆt 1 (1 z 1 (replace d l wth ˆt 1 +(t f aˆt 1(1 x(z1 1 (replace ˆt 1 dfference term ψ 1 Case 2 (d l ˆt 1 : In ths case, we consder the two followng executon scenaros. S1 (η 1 (a1,ˆt 1 0: Accordng to Rule 2, Rule 3, and Prop. 3, we have the followng: sup{η 1 (0,t f } =sup{η 1 (0,a 1 }+sup{η 1 (a 1,d 1 }+(t f d 1 z 1 =a 1 +(d 1 a 1 +(t f d 1 z 1 =t f +(t f d 1 (z 1 1 snce d 1 aˆt 1 +x (t f aˆt 1 t f +(t f aˆt 1(1 x(z1 1 dfference term ψ 1 (replace d 1 S2 (η 1 (a1,ˆt 1 = 0: Accordng to Rule 2, Rule 4, and Prop. 2, we have the followng: sup{η 1 (0,t f } =sup{η 1 (0,a 1 }+sup{η 1 (a 1,d 1 }+(t f d 1 z 1 =a 1 +(d 1 a 1 z 1 +(t f d 1 z 1 =t f +(t f a 1 (z 1 1 snce a 1 < ˆt 1 aˆt 1 +x (t f aˆt 1 t f +(t f aˆt 1(1 x(z1 1 dfference term ψ 1 Therefore, P(1 s correct for k = 1. (replace a 1 Step 2 (nducton hypothess: Assume that P(k 0 1 s correct for some possble ntegers k 0 1. Step 3 (nducton: We now prove that P(k 0 s correct by the nducton hypothess. Proof. Snce ˆt k0 1 ˆt k0, we need to consder the followng three cases. Case 1 (d l <ˆt k0 1 ˆt k0 : In ths case, nether a (k 0 1-carry-over job nor a k 0 -carry-over job exsts. Accordng to Rule 1 and Fact 1, we have the followng: (0,t f } = 1 (0,d l }+(t f ˆt k0 1 z k 0 1 (0,t f } = (0,d l }+(t f ˆt k 0 z k 0 1 (0,d l } = (0,d l } 1 Snce ˆt k0 ˆt k0 1 and z k0 z k0 1, we have (0,t f } 1 (0,t f }+(t f ˆt k 0 (z k 0 z k 0 1 (7 Accordng to Prop. 2, we can replace ˆt k0 wth aˆt k 0 + x(t f aˆt k 0 n Eqn. (7. Then, sup{η k0 (0,t f } can be bounded by 1 (0,t f }+(t f aˆt k 0 (1 x (z k 0 z k 0 1 dfference term ψ k 0 Case 2 (ˆt k0 1 ˆt k0 d l : In ths case, both a (k 0 1- carry-over job and a k 0 -carry-over job exst. Recall that d k0 1 s the absolute deadlne for the (k 0 1-carry-over job. Two sub-cases, one wth ˆt k0 d k0 1 and one wth ˆt k0 > d k0 1, as shown n Fg. 3(a and Fg. 3(b, need to be consdered.

8 8 z k 0 0 a k 0 ˆt k 0 j 1 ˆt k 0 1 ˆt k 0 d k 0 1 (a k0 th mode swtch wth ˆt k 0 d k a k 0 ˆt k 0 j 1 ˆt k 0 1 d k 0 1 a k 0 z k 0 ˆt k 0 d k 0 (b k th 0 mode swtch wth ˆt k 0 > d k 0 1 Fgure 3. Mode swtch from ˆt k0 1 to ˆt k 0. Accordng to Fact 1, we have the followng: η k 0 (0,a k 0 = η k 0 1 (0,a k 0 (8 Case 2-A (ˆt k0 d k0 1 : Ths executon scenaro s llustrated n Fg. 3(a. In ths case, the(k 0 1-carry-over job and the k 0 -carry-over job are the same job. Therefore, we have a k0 = a k0 1 and d k0 = d k0 1. In the followng, we use a k0 1 and d k0 1 n place of a k0 and d k0, respectvely. In Case 2-A, the followng two scenaros are consdered: S1 (η k0 (a k0 1,ˆt k0 0: Accordng to Rule 3 and Rule 4, we have the followng 4 : (a k 0 1,d k 0 1 } = 1 (a k 0 1,d k 0 1 { } (d k 0 1 a k 0 1 z k 0 j η k (a k 0 1,ˆt k0 1 0 = (9 otherwse (d k 0 1 a k 0 1 z k 0 1 Accordng to Rule 2, Eqn. (8 and Eqn. (9, we have the followng: (0,t f } = (0,a k 0 1 }+ (a k 0 1,d k 0 1 } +(t f d k 0 1 z k 0 = 1 +(t f d k 0 1 = 1 (0,a k 0 1 z k 0 1 }+ 1 (a k 0 1,d k 0 1 +(t f d k 0 1 (z k 0 (0,t f }+(t f d k 0 1 (z k 0 } t f t f z k 0 1 z k 0 1 Accordng to Prop. 3, by replacng d k0 1 wth aˆt k 0 +x (t f aˆt k 0, sup{η k0 (0,t f } can be bounded by 1 (0,t f }+(t f aˆt k 0 (1 x (z k 0 (a k0 1 z k 0 1 dfference term ψ k 0 t t (10 S2 (η k0,ˆt k0 = 0: Accordng to Rule 2, Rule 4, and Eqn. (8, we have the followng: (0,t f } = (0,a k 0 1 }+ (a k 0 1,d k 0 1 } +(t f d k 0 1 z k 0 = 1 +(t f d k 0 1 = 1 (0,a k 0 1 z k 0 1 }+ 1 (a k 0 1 +(t f a k 0 1 (z k 0 (0,t f }+(t f a k 0 1 (z k 0,d k 0 1 } z k 0 1 z k 0 1 Accordng to Prop. 2 and a k0 1 < ˆt k0, sup{η k0 (0,t f } can be bounded by 1 (0,t f }+(t f aˆt k 0(1 x(z k 0 z k 0 1 (11 dfference term ψ k 0 4. Accordng to the proof of Rule 3 (see Appendx A, we have a smlar result: (a k 0 1,d k 0 1 } = (d k 0 1 a k 0 1 z k 0 1 because η k(ak 0 1,ˆt k0 1 = 0. Case 2-B: (d k0 1 < ˆt k0 : Ths executon scenaro s llustrated n Fg. 3(b. In ths case, the(k 0 1-carry-over job and the k 0 -carry-over job are dfferent jobs. For ths case, we wll consder the followng two scenaros: S1 (η k0 (a k0,ˆt k0 0: Accordng to Rule 2, Rule 3, and Eqn. (8, we have the followng: (0,t f } = (0,a k 0 }+ (a k 0,d k 0 } +(t f d k 0 z k 0 = 1 (0,a k 0 } +(t f a k 0 z k 0 1 +(t f d k 0 (z k 0 z k 0 1 = 1 (0,t f }+(t f d k 0 (z k 0 z k 0 1 Agan, by replacng d k0 n accordance wth Prop. 3, we obtan the followng bound: 1 (0,t f }+(t f aˆt k 0(1 x(z k 0 z k 0 1 dfference term ψ k 0 (12 S2 (η k0 (a k0,ˆt k0 = 0: Accordng to Rule 2, Rule 4, and Eqn. (8, we have the followng: (0,t f } = (0,a k 0 }+ (a k 0,d k 0 } +(t f d k 0 z k 0 = 1 (0,a k 0 } +(t f a k 0 z k 0 1 +(t f a k 0 (z k 0 z k 0 1 = 1 (0,t f }+(t f a k 0 (z k 0 z k 0 1 Agan, accordng to Propo. 2 and a k0 < ˆt k0, sup{η k(0,t f} can be upper bounded by 1 (0,t f }+(t f aˆt k 0(1 x(z k 0 z k 0 1 dfference term ψ k 0 (13 For case 2, we can conclude that sup{η k(0,t f} can be upper bounded by sup{η k0 1 (0,t f } + ψ k0 accordng to Eqns. (10-(13. Case 3 (ˆt k0 1 d l < ˆt k0 : In ths case, a (k 0 1-carryover job exsts but a k 0 -carry-over job does not. Accordng to Rule 1, we have the followng: (0,t f } = (0,d l }+(t f ˆt k 0 z k 0 Snce d l < ˆt k0 < t f, we can derve 1 (0,t f } = 1 (0,d l }+(t f d l z k 0 1 Accordng to Fact 1 and d l < ˆt k0, we have (0,t f } 1 (0,t f }+(t f ˆt k 0 (z k 0 z k 0 1 Agan, accordng to Propo. 2, sup{η k(0,t f} can be upper bounded by 1 (0,t f }+(t f aˆt k 0(1 x(z k 0 z k 0 1 dfference term ψ k 0 For the three cases above, we can conclude that sup{η k(0,t f} can be upper bounded by sup{η k0 1 (0,t f } + ψ k0. Thus, P(k 0 s correct by the nducton hypothess. Hence, through mathematcal nducton, P(k s proven correct for all possble k. Under dfferent executon scenaros, the cumulatve executon tme η k (0,t f can be bounded by the ntermedate upper boundsup{η k (0,t f}. SnceP(k s correct, the orgnal statement s correct.

9 Bound for hgh-crtcalty tasks Recall that τˆt k s the hgh-crtcalty task that suffers an overrun at ˆt k. Snce the mode swtches are ndependent, the hgh-crtcalty tasks can be dvded nto two sets, namely, the sets of tasks that have and have not already entered hgh-crtcalty mode at mode-swtchng pont ˆt k, whch can be denoted by γ (ˆt k and γ (ˆt k, respectvely. Now, we derve the upper bounds on the cumulatve executon tme for both types of hgh-crtcalty tasks. Lemma 2. For hgh-crtcalty task τˆt j n task set γ (ˆt k (j k, the cumulatve executon tme η k (0,t τˆt j f can be bounded as follows: sup{η k (0,t τˆt j f} = aˆt j u ˆt j +(t f aˆt j u ˆt j (14 Proof. For the proof, refer to case 2 of fact 3 n [4]. Lemma 3. For hgh-crtcalty taskτ n task set γ (ˆt k, the cumulatve executon tme η k(0,t f can be bounded as follows: sup{η k (0,t f } = ( aˆt k x +(t f aˆt ku (15 Proof. For the proof, refer to the fact 3 n [4] Puttng t all together Now, we are ready to establsh the schedulablty test condton. To prove Thm. 2, we frst ntroduce two auxlary theorems, Thm. 3 and Thm. 4. In Thm. 3, the schedulablty test condton s derved based on Lem. 1, Lem. 2, and Lem. 3. Ths test condton should rely on the prevous mode swtches. Thm. 4 demonstrates the consstency of the test condton, by whch the dependences among mode swtches can be removed. Theorem 3. At the k-th mode-swtchng pont ˆt k, k (k 1 hgh-crtcalty tasks τˆt 1,τˆt 2,,τˆt k have swtched nto hgh-crtcalty mode. The system s schedulable f the servce level z j at ˆt j satsfes the followng condtons for all j such that 1 j k. z j zj 1 (16 u ˆt j +(1 x(u j uj 1 u + ˆt j ( 1 0 (17 Proof. The condtonz j zj 1 s a basc assumpton of our model, whch guarantees the satsfacton of Lem. 1, Rule 3, and Rule 4. Therefore, z j zj 1 needs to be satsfed. Let Nγ k denote the cumulatve executon tme of task set γ durng the nterval [0,t f ] when the k th mode swtch occurs. To calculate Nγ k, let us sum the the cumulatve executon tme of all tasks over [0,t f ]. For the low-crtcalty task set γ, we can bound Nγ k accordng to Lem. 1. Nγ k (t f + ψ j (18 τ γ For the hgh-crtcalty task set γ (ˆt k, whch contans k hgh-crtcalty tasks (.e., γ (ˆt k = k, we can derve the cumulatve executon tme accordng to Lem. 2. N k γ (ˆt k (aˆt j u ˆt j +(t f aˆt j u ˆt j (19 For the hgh-crtcalty tasks n γ (ˆt k, whch have not entered hgh-crtcalty mode at ˆt k, we can derve the cumulatve executon tme accordng to Lem. 3. N k γ (ˆt k τ γ (ˆt k ( aˆt k x +(t f aˆt ku (snce x < 1 and aˆt k t f τ γ (ˆt k t f x u (20 Based on Eqn. (18, Eqn. (19 and Eqn. (20, Nγ k can be bounded as shown n Eqn. (21. The complete dervaton s gven n Appendx B because of space lmtatons. N k γ = Nk γ + N k γ + (ˆtk Nk γ (ˆtk ( t f + (t f aˆt j u ˆt j + (1 x(u j uj 1 + u ˆt j ( 1 (21 Snce the frst deadlne mss occurs at tme nstant t f, the followng holds 5 : Nγ k > t f Therefore, ( (t f aˆt j u ˆt j +(1 x(u j u uj 1 + ˆt j Takng the contrapostve, we obtan ( (t f aˆt j u ˆt j +(1 x(u j uj 1 u + ˆt j ( 1 > 0 ( 1 0 (22 Sncet f aˆt j > 0, to guarantee the system schedulablty of task set γ at the k th mode swtch, t s suffcent to ensure that the term ndcated n Eqn. (22 s less than 0 for all j such that 1 j k. j such that 1 j k : u ˆt j +(1 x(u j u uj 1 + ˆt j ( 1 0 (23 In Thm. 3, at the k th mode-swtchng pont, addtonal condtons are mposed on the prevous k 1 mode swtches. Therefore, to remove ths dependence, we requre that these mposed condtons should be consstent wth the decsonmakng at the prevous mode-swtchng ponts ˆt j (j < k. We demonstrate ths consstency n Thm. 4. Theorem 4. The new condtons mposed on u 1,u2,,uk 1 by the k th mode swtch are consstent wth the decsons that have been made at the prevous mode-swtchng ponts. Proof. The condtons gven n Thm. 3 for decsons that have been made at the prevous k 1 mode-swtchng ponts ˆt j (1 j k 1 are exactly the same as the new condtons mposed on u 1,u2,,uk 1 wth the k th mode swtch. Therefore, ther consstency s guaranteed. FMC schedulablty: Now, we are ready to prove Thm. 2 usng Thm. 3 and Thm Note that there s no dle nstant wthn the nterval [0,t f ]. Otherwse, jobs from set J wth release tmes at or after the latest dle nstant could form a smaller job set causng a deadlne mss att f, whch would contradct the mnmalty of J.

10 10 Proof. Accordng to Thm. 4, the constrants n Thm. 3 that are mposed on u 1,u2,,uk 1 wth the kth mode swtch have already been covered by the prevous k 1 mode swtches. Therefore, we need to check only two condtons: Eqn. (16 and Eqn. (17 wth j = k. 5.4 Feasblty of Algorthm In ths secton, we nvestgate the regon of x values that can guarantee the feasblty of the run-tme algorthm. The selecton of any x from ths regon durng the off-lne phase can guarantee that a feasble soluton as determned by Thm. 2 can always be found durng run tme. To derve ths regon, we frst ntroduce several defntons and propertes that wll be useful for the later proof of feasblty. u ˆt k Accordng to Eqn. (2 n Thm. 2, when u ˆt k (1 > 0, we do not need to reduce the utlzaton of lowcrtcalty tasks. The overrun of the hgh-crtcalty task at ths mode-swtchng pont s covered by the system resource margn. Only when u ˆt k (1 u 0, u ˆt k k should be decreased to compensate for the overrun of the hghcrtcalty task. For smplcty, we defne a dscrmnant functon φ(τ for each hgh-crtcalty task τ to ndcate whether the overrun of τ can be covered by the system resource margn. Defnton 4. φ(τ = u (1 u (τ γ Defnton 5. A hgh-crtcalty taskτ s called margn hghcrtcalty task f φ(τ > 0. Otherwse, τ s called compensaton hgh-crtcalty task. Defnton 6. The margn hgh-crtcalty task set and the compensaton hgh-crtcalty task set are defned as γ = {τ γ φ(τ > 0} and γ = {τ γ φ(τ 0}, respectvely. γ = γ γ. Wth the defntons gven above, we can now perform the feasblty analyss for x. Theorem 5. Gven the mandatory utlzaton u man, any x that satsfes the followng condton can guarantee that a feasble soluton as determned by Thm. 2 can always be found durng run tme. (1 x( uman + φ(τ 0 (24 τ γ Proof. Recall that γ (ˆt k s the set of hgh-crtcalty tasks that have entered hgh-crtcalty mode at ˆt k. By teratng the condtons n Thm. 2, a drect soluton for u k can be obtaned as follows: φ(τ u k u + τ γ γ (ˆt k (1 x (25 To guarantee the executon of the mandatory portons of low-crtcalty tasks, the followng condton should be satsfed for all k: φ(τ u man uk u + τ γ γ (ˆt k (26 (1 x Snce the rght-hand sde of Eqn. (26 s non-ncreasng wth respect to the number of overrun hgh-crtcalty tasks (.e., k, the worst-case scenaro s that all hgh-crtcalty tasks n γ enter hgh-crtcalty mode. If mandatory servce can be guaranteed n ths worst-case scenaro, then the feasblty of the proposed algorthm s ensured. Therefore, condton Eqn. (26 can be rewrtten as Eqn. (27. φ(τ + τ γ u man (1 x (1 x( uman + τ γ φ(τ 0 (27 Note that u man s the mandatory utlzaton defned as u man = τ γ z man, where the temz man can be consdered as a mandatory part whch affects the correctness of the result n mprecse computaton model [18]. Now, we use the followng example to llustrate how to test the feasblty of FMC-EDF-VD. Example 2. Consderng the task system n Example 1, = 1 2 we can derve x = u accordng to Thm For hgh-crtcalty tasks, one can compute dscrmnant functons φ(τ 1 = φ(τ 2 = φ(τ 3 = φ(τ 4 = 1 20 n accordance wth Def. 4. The feasblty of x s valdated by checkng condton Eqn. (24 n Thm. 5. (1 x( u man + φ(τ =( = 0 τ γ Thus, we know x = 1 2 that s feasble for schedulng usng FMC-EDF-VD. 6 SERVICE LEVEL TUNING STRATEGY Thm. 2 provdes an mportant crteron for run-tme servce level tunng. By checkng the condtons n Thm. 2, one can determne how much utlzaton can be reserved for lowcrtcalty task executon to compensate for the overruns. In general, varous tunng strateges can be specfed by the user as long as the condton n Thm. 2 s satsfed durng run tme. In ths paper, we present a unform tunng strategy and a droppng-off strategy to demonstrate the performance of FMC. 6.1 Droppng-off strategy To compensate for overruns, the droppng-off strategy partally drops low-crtcalty tasks by assgnng z k = 0 for dropped tasks. To maxmze the utlzaton of low-crtcalty tasks, the tasks to be dropped can be selected accordng to ther utlzaton. At each mode-swtchng pont ˆt k, tasks wth less utlzaton are gven hgher prorty for droppng. To mplement ths selecton strategy, we can create a task table TA durng the off-lne phase by sortng the lowcrtcalty tasks n ascendng order of ther utlzaton. Durng run tme, the utlzaton reducton UR k that s requred to compensate for thek th mode swtch s determned accordng to Thm. 2. Based on TA, the set γ k of tasks that are dropped at the k th mode-swtchng pont s determned va bnary search. Note that other selecton crtera, such as job completon percentage, can also be appled to select the lowcrtcalty tasks to be dropped.

11 Unform tunng strategy In ths secton, we present a unform tunng strategy n whch z k = zk holds for all low-crtcalty tasks. The servce levelsz k of all low-crtcalty tasksτ are unformly set toz k at the k th mode-swtchng pont. By applyng z k = zk n the condtons gven n Thm. 2, the unform servce level z k can be drectly computed usng Eqn. (28 n Thm. 6. Theorem 6. The system s schedulable at the k 1 th modeswtchng pont wth a unform z k 1. At the k th modeswtchng pont ˆt k, the system s stll schedulable f z k s determned as follows: ( 0 z k z k 1 +mn 0, ˆt k (1 u ˆt k (28 (1 x denote low and hgh utlzaton, where and u ˆt k ˆt respectvely, of the k hgh-crtcalty task τˆt k that suffers an overrun at ˆt k. Proof. In the unform tunng strategy, z k = z k holds for any low-crtcalty task τ. Recall that u k = τ γ z k. Thus, we can obtan Eqn. (28 by combnng the two condtons expressed n Eqn. (2 and Eqn. (3 n Thm Case study In ths case study, we frstly use the task system n Example 1 to llustrate how unform tunng strategy and droppngoff strategy work n FMC. Then, we mplement the unform tunng strategy n our smulaton framework (presented n Appendx C to demonstrate the graceful low-crtcalty servce degradaton of FMC. Frst of all, we consder the generalzed condtons presented n Thm. 2, whch determne how much utlzaton can be reserved for low-crtcalty task executon to compensate for the overruns. By applyng the task system presented n Example 1 to Thm. 2, we can the followng utlzaton condtons u u k uk 1 ˆt k (1 u ˆt k = 1 (1 x 10 (29 z k zk 1 ( τ γ (30 Snce the hgh-crtcalty tasks are dentcal, each overrun wll result n dentcal utlzaton reducton of 1 10, as shown n Eqn. (29. Now, we llustrate how unform tunng strategy and droppng-off strategy work based on these generalzed condtons Eqn. (29 and Eqn. (30. For droppng-off strategy by assgnng z k = 0 for dropped tasks, the system s requred to drop off a porton of low-crtcalty tasks to compensate for the overruns of one hgh-crtcalty task. For example, when one hgh-crtcalty task overruns ts C L, lowcrtcalty task τ 5 may decrease ts executon budget from 30 to 10, whle low-crtcalty task τ 6 s executed wthout degradaton. By ths way, the servce degradaton of τ 5 results n utlzaton reducton of 1 10 to accommodate one hgh-crtcalty overrun. The droppng-off process s summarzed n Tab. 3. For unform tunng strategy by restrctng z k = z k for all low-crtcalty tasks, each overrun wll result n an dentcal reducton of 0.25 n z k, such that the Servce level FMC-LB FMC-UP IMC The number of mode swtches Fgure 4. Servce level of low-crtcalty tasks under the dfferent number of mode swtches. condton Eqn. (29 s satsfed. Therefore, the servce levelz k for operaton n k-level hgh-crtcalty mode can be expressed as z k = k. By contrast, f one were to apply IMC [19] to ths task set, the guaranteed servce level would be 0. Ths means that any overrun would result n the droppng off of all low-crtcalty tasks. Table 3 Low-crtcalty servce levels Number of Overrun k Utlzaton u k Executon Budget of τ Executon Budget of τ Next, we evaluate the mplementaton of the FMC- EDF-VD run-tme system n our smulaton framework to demonstrate the graceful low-crtcalty servce degradaton of FMC. In ths case study, the unform tunng strategy s appled for demonstraton. We ran the smulaton for tme unts, whch contans hgh-crtcalty jobs. We set the hgh-crtcalty job behavor probablty to 0.1. The smulaton process s detaled n Appendx C. Fg. 4 shows the run-tme servce levels for both FMC and IMC [19]. The lower bounds on the servce levels wth dfferent numbers of mode swtches, as dscussed above, for FMC and IMC are represented by red and black lnes, respectvely, n Fg. 4. The dashed green lne represents servce levelz k 1 for operaton n(k 1-level hgh-crtcalty mode for FMC. The collected run-tme servce levels as scheduled by FMC are represented n the form of box-whsker plots wth blue dots. As shown n Fg. 4, FMC can gracefully degrade the low-crtcalty servce level as the number of mode swtches ncreases. By contrast, IMC fals to respond to the varablty n the workload. As long as not all hgh-crtcalty tasks overrun durng run tme, the executon budget determned by FMC always outperforms that of IMC. Another nterestng observaton s that the collected runtme servce levels are bounded by the red and green lnes. Ths observaton matches the FMC executon semantcs presented n Secton 3.2. In the k th transton phase, the executon budget for low-crtcalty jobs wll be reduced fromzk 1 C tozk C. Accordng to the FMC executon semantcs, two cases can be consdered: Case 1: Low-crtcalty jobs that have already exhausted ther executon budget of z k C at the