Schedulability Analysis of Task Sets with Upper- and Lower-Bound Temporal Constraints

Transcription

1 Schedulablty Analyss of Task Sets wth Upper- and Lower-Bound Temporal Constrants The MIT Faculty has made ths artcle openly avalable. Please share how ths access benefts you. Your story matters. Ctaton As Publshed Publsher Gombolay, Matthew C., and Jule A. Shah. Schedulablty Analyss of Task Sets wth Upper- and Lower-Bound Temporal Constrants. Journal of Aerospace Informaton Systems, no. 2 (December 204): Verson Author's fnal manuscrpt Accessed Sat Jan 9 07:48:45 EST 209 Ctable Lnk Terms of Use Creatve Commons Attrbuton-Noncommercal-Share Alke Detaled Terms

2 Schedulablty Analyss of Task Sets wth Upper and Lowerbound Temporal Constrants Matthew C. Gombolay and Jule A. Shah Massachusetts Insttute of Technology Cambrdge, MA 0239, USA jule a shah@csal.mt.edu Increasngly real-tme systems must handle the self-suspenson of tasks,.e. lowerbound wat tmes between subtasks, n a tmely and predctable manner. A fast schedulablty test that does not sgnfcantly overestmate the temporal resources needed to execute self-suspendng task sets would be of beneft to these modern computng systems. In ths paper, we present a polynomal-tme test that, to our knowledge, s the frst to handle non-preemptve, self-suspendng tasks sets wth hard deadlnes, where each task has any number of self-suspensons. To construct our test, we leverage a novel prorty schedulng polcy, j th Subtask Frst (JSF), whch restrcts the behavor of the self-suspendng model to provde an analytcal bass for an nformatve schedulablty test. In general, the problem of sequencng accordng to both upperbound and lowerbound temporal constrants requres an dlng schedulng polcy and s known to be NP-Hard. However we emprcally valdate the tghtness of our schedulablty test and schedulng algorthm, and show that the processor s able to effectvely utlze up to 95% of the self-suspenson tme to execute tasks. I. Introducton Real-tme schedulng systems are a vtal component of many aerospace, medcal, nuclear, manufacturng, and transportaton systems. In general, real-tme systems must be able to nteract wth ther envronment n a tmely and predctable manner, and desgners must engneer analyzable systems whose tmng propertes can be predcted and mathematcally proven correct., 2 Analyss s typcally performed usng schedulablty tests, whch are fast methods for determnng whether a system can process a set of tasks wthn specfed, 3 6 temporal constrants. Correspondng Author of 42

3 Increasngly real-tme systems must handle the self-suspenson of tasks and new methods are requred for testng the feasblty of these self-suspendng task sets. 7 0 In processor schedulng, self-suspensons (.e. lowerbound wat tmes between subtasks), can result both due to hardware and software archtecture. At the hardware level, the addton of mult-core processors, dedcated cards (e.g., GPUs, PPUs, etc.), and varous I/O devces such as external memory drves, can necesstate task self-suspensons. Furthermore, the software that utlzes these hardware systems can employ synchronzaton ponts and other algorthmc technques that also result n self-suspensons. Schedulablty tests that do not sgnfcantly overestmate the temporal resources needed to execute self-suspendng task sets would be of beneft to these modern computng systems. The sequencng and schedulng of tasks accordng to upperbound and lowerbound (self-suspenson) temporal constrants s a challengng problem wth mportant applcatons outsde of processor schedulng, as well. Other examples nclude autonomous taskng of unmanned aeral and under-water vehcles, 2, 3 schedulng of factory operatons, 4, 5 and schedulng of arcraft and flght crews. 6 New uses of robotcs for flexble manufacturng are pushng the lmts of current state-of-the-art methods n artfcal ntellgence (AI) and operatons research (OR) and are spurrng ndustral nterest n fast methods for sequencng and schedulng. 4 Solutons to these applcatons typcally draw from methods n AI and OR, 5 8 whch provde complete search algorthms that requre exponental tme to compute a soluton n the worst case. These methods cannot provde fast re-computaton of the schedule n response to dynamc dsturbances for large, real-world task sets. Fast, suffcent schedulablty tests, whle wdely used n processor schedulng, are underutlzed n these applcatons. In ths paper, we present a schedulablty test and complementary schedulng algorthm that handles perodc, non-preemptve, self-suspendng task sets. To our knowledge, our approach s the frst polynomaltme test for non-preemptve, self-suspendng task sets wth any number of self-suspensons n each task. We also generalze our schedulablty test and algorthm to handle deadlne constrants not found n the tradtonal self-suspendng task model, but commonly found n artfcal ntellgence (AI) and operatons research (OR) models. Our schedulablty test and schedulng algorthm utlze a novel schedulng polcy to create problem structure n self-suspendng task networks. Restrctng the behavor of the scheduler sacrfces completeness for ths NP-Hard problem, n general. However, we show that ths restrcton enables the desgn of an nformatve schedulablty test and schedulng algorthm, both of whch produce near-optmal results for many real-world task systems. We begn n Secton II wth the defnton of a self-suspendng task model. Secton III revews pror art n real-tme schedulng of self-suspendng task sets, and Secton IV ntroduces termnology to descrbe 2 of 42

4 our schedulablty test and schedulng algorthm. Secton V dscusses how we restrct the behavor of the scheduler so as to enable the desgn of an nformatve schedulablty test and schedulng algorthm. In Secton VI, we present our schedulablty test wth proof of correctness. Secton VII descrbes our complementary schedulng algorthm, whch successfully executes task sets that pass the schedulablty test. In Secton VIII, we emprcally valdate the performance of our schedulablty test and schedulng algorthm. We show that our schedulablty test s tght, meanng that t does not sgnfcantly overestmate the temporal resources needed to execute the task set. We also show that a processor operatng under our schedulng algorthm ncurs lttle processor dle tme. Lastly, we demonstrate emprcally that our schedulablty test s fast, and derve the computatonal complexty of our test and schedulng algorthm. II. Self-Suspendng Task Model The basc model for the self-suspendng task set 7 s shown n Equaton. τ : (φ, (C, E, C 2, E 2,..., E m, C m ), T, D ) () In ths model, there s a task set, τ, where all tasks, τ τ must be executed by a unprocessor. For each task, there are m subtasks wth m self-suspenson ntervals. C j s the worst-case duraton of the j th subtask of τ, and E j s the worst-case duraton of the jth self-suspenson nterval of τ. Subtasks wthn a task are dependent, meanng that a subtask τ j+ the subtask τ j must start after the fnsh tmes of and the self-suspenson E j. T and D are the perod and deadlne of τ, respectvely, where D T. Lastly, a phase offset delays the release of a task, τ, by the duraton, φ, after the start of a new perod. The self-suspendng task model shown n Equaton provdes a sold bass for descrbng many realworld processor schedulng problems of nterest. In ths work, we augment the tradtonal model to provde addtonal expressveness, by ncorporatng deadlne constrants that upperbound the temporal dfference between the start and fnsh of two subtasks wthn a task. We call these deadlne constrants subtask-tosubtask deadlnes. We defne a subtask-to-subtask deadlne as shown n Equaton 2. ( ) D s2s τ a,τ b : f b s a d s2s τ a,τ b (2) where f b s the fnsh tme of subtask τ b, sa s the start tme of subtask τ a, and d τ a,τ b s the upperbound temporal constrant between the start and fnsh tmes of these two subtasks, such that b > a. Subtask-to-subtask constrants are commonly ncluded n AI and operatons research schedulng models (e.g. 9 2 ) and are vtal n modelng many real-world problems. We augment the self-suspendng task model 3 of 42

5 n ths way to llustrate the relevance of our technques to mportant applcatons other than processor schedulng. Consder the sequencng and schedulng of assembly manufacturng processes. In ths case, each manufactured pece s represented by a unprocessor and the work performed on the pece s represented by the subtasks. The goal s to sequence the work to assemble the pece subject to temporal and precedence constrants among subtasks. Self-suspensons (.e. lowerbound wat tmes between subtasks) may arse due to, for example, cure tmes nvolved n the assembly process. Upperbound temporal constrants also arse naturally; the buld schedule may requre that a sequence of tasks be grouped together and executed n a specfed tme wndow. The problem of sequencng arrvng and departng arcraft on a runway s also analogous to processor schedulng. Here the runway represents the unprocessor, and the constrants that landng arcraft be spaced by a mnmum separaton tme are represented as self-suspensons. Upperbound subtask-to-subtask deadlnes encode the amount of tme an arcraft can reman n a holdng pattern based on fuel consderatons. Whle each doman has ts own nuances n problem formulaton, there s suffcent underlyng commonalty n problem structure to nvestgate the applcaton of real-tme schedulng technques to these problems. In the remander of ths paper, we present a schedulablty test and complementary schedulng algorthm that handles perodc, self-suspendng task sets. We develop the test for non-preemptable subtasks, meanng the nterrupton of a subtask sgnfcantly degrades ts qualty. However, we note that a schedulablty test for non-preemptve subtasks conservatvely bounds the temporal resources necessary to execute a preemptable system. We also generalze our schedulablty test and algorthm to handle subtask-to-subtask deadlnes, to ncrease the applcablty of our technques to real-tme schedulng problems found n varous applcaton domans. III. Background In ths secton we brefly revew the challenges for real-tme schedulng of self-suspendng tasks sets, ncludng pror work n analytcal schedulablty tests and schedulng algorthms. III.A. Challenge Posed by Task Self-Suspenson The problem of schedulng, or testng the schedulablty of a self-suspendng task set, s NP-Hard as can be shown through an analyss of the nteracton of self-suspensons and task deadlnes. 9, 2, 22 Many unprocessor, prorty-based schedulng algorthms, such as Earlest Deadlne Frst (EDF) or Rate-Monotonc (RM) 7, 23 ntroduce schedulng anomales snce they do not account for ths nteracton. A schedulng anomaly arses when a scheduler can produce a feasble schedule for a task set τ, but not for a relaxaton of the task set τ. Relaxatons nclude reducng task costs or decreasng phase offsets. These 4 of 42

6 anomales are present for both preemptve and non-preemptve task sets. Lakshmanan et al. 7 report that fndng an anomaly-free schedulng prorty for self-suspendng task sets remans an open problem. We provde llustratons to exemplfy dfferent types of schedulng anomales n Fgures -2. Each fgure depcts a feasble schedule (top) and an nfeasble schedule resultng from a schedulng anomaly (bottom). Upward arrows ndcate the release of a task, and downward arrows ndcate a task s deadlne. Self-suspensons are represented by a horzontal bar wth a correspondng label. Blocks correspond to the executon cost of each subtask and are numbered accordng to the subtask ndex. For example, a block labeled 2 on a row labeled τ 3 corresponds to τ3 2. III.A.. Schedulng Anomales Produced by Reducng Task Cost The frst type of schedulng anomaly occurs when a reducton n the computaton tme of a subtask causes the processor to volate a deadlne constrant. Ths type of schedulng anomaly was frst descrbed by Rdouard et al. 23 Fgure shows a scenaro where executon of three tasks under the Earlest Deadlne Frst (EDF) algorthm produces ths type of schedulng anomaly. In the top graph, we see a feasble schedule, wth τ2 nterleaved durng self-suspenson E and τ 2 nterleaved durng E2. However, when the executon cost of τ s decreased, τ2 starts earler. In turn, τ2 2 and τ3 are released at the same tme. Because D 2 < D 3, τ2 2 s prortzed over τ3. The result s that the processor dles durng E3 and s unable to satsfy deadlne D 3. Fgure : A schedulng anomaly occurs when the reducton n the computaton tme of a subtask causes the processor to volate a deadlne constrant. The top graph shows a feasble schedule and the bottom graph shows how the same task set s rendered nfeasble due to a reducton n the cost of one subtask C. 5 of 42

7 III.A.2. Schedulng Anomales Produced by Decreasng Phase Offsets Phase offsets also can cause schedulng anomales. Ths type of anomaly occurs when the reducton of a phase offset duraton allows a task to release earler, and thus prevents the processor from satsfyng all deadlne constrants. Fgure 2 shows a scenaro where the executon of two tasks under the Earlest Deadlne Frst (EDF) algorthm produces ths schedulng anomaly. In the top graph, we see a feasble schedule wth τ3 nterleaved durng self-suspenson E2 and τ2 2 nterleaved durng E3. However, when the duraton of phase offset φ 2 decreases to zero, the start tme of τ 2 remans unchanged despte the earler deadlne. Even though the subtasks are effcently nterleaved, the processor cannot satsfy the deadlne for τ 2. Fgure 2: Another schedulng anomaly occurs when the reducton of a phase offset duraton allows a task to release earler, and thus prevents the processor from satsfyng all deadlne constrants. The top graph shows a feasble schedule and the bottom graph shows how the same task set s rendered nfeasble due to a decreased phase offset φ 2. III.B. Schedulablty Testng Gven suffcent computatonal resources, the schedulablty of a self-suspendng task set may be computed offlne usng complete methods However, these approaches are not sutable for determnng schedulablty onlne, as s necessary when the task set changes. To gan computatonal speed, many real-tme systems utlze suffcent analytcal schedulablty tests, that compute the feasblty of a gven task set n polynomal tme. These tests assume that the scheduler s usng a specfc schedulng prorty, such as RM or EDF. The nave method for testng the schedulablty of these task sets s to treat self-suspensons as task costs; however, ths can result n sgnfcant under-utlzaton of the processor f the duraton of self-suspensons s large relatve to task cost. 8 Fast polynomal tmes schedulablty tests have been studed for restrctons of the self-suspendng task model. Km et al. 4 presents two methods for testng task sets where each task has exactly one self-suspenson. 6 of 42

8 Ther frst method bulds on work by Wellngs et al. 3 to transform each task τ wth two subtasks τ and τ 2 nto two, ndependent tasks. Both of the new tasks are released at tme r, but τ 2 experences release jtter to mplctly enforce the temporal dependency between τ and τ 2. An teratve formula s developed3 to calculate the worst-case response tme for τ and τ 2, and, thereby, the schedulablty of the task set. The second method bulds on ths approach 6 to more tghtly bound the amount of self-suspenson tme that must be consdered as task cost, by analyzng whch tasks can be nterleaved durng self-suspenson tme. Both these methods requre a restrcton be made on the specfc tme a task wll self-suspend. Next, Lu and Dev 27 develop analyses for another restrcted form of the task set, namely where one self-suspenson exsts n the entre task set. Ther approaches do not make an assumpton on when a task wll self-suspend. Lu s method analyzes the schedulablty of the task set when t s executed under the fxed-prorty RM schedulng polcy, and treats delays of tasks due to self-suspensons as external blockng events. Ths approach accounts for the stuaton where a hgher-prorty task self-suspends and the selfsuspenson termnates at the same tme a lower-prorty task s released, thus causng the lower-prorty task to be delayed untl the completon of the hgher-prorty task. Dev 27 developed a smlar method for testng the schedulablty of self-suspendng task sets operatng under the EDF dynamc-prorty schedulng algorthm. Recently, Abdeddaïm and Masson ntroduced an approach for testng self-suspendng task sets usng model checkng wth Computatonal Tree Logc (CTL). 24 Whle ther method s easly extended to handle tasks wth multple self-suspensons, the runtme s exponental n the number of tasks. Thus, t does not currently scale to moderately-szed task sets of nterest for real-world applcatons. Lakshmanan et al. also ncrease generalty by developng a pseudo-polynomal-tme test to determne the worst-case nterference mposed on a lower prorty self-suspendng tasks by hgher prorty non-suspendng tasks. However, Lakshmanan et al. report that an exact-case test for multple self-suspensons per task remans an open problem. 8, 28 Fnally, recent works by C. Lu and Anderson analyze preemptve task sets wth multple selfsuspensons per task for soft real-tme requrements. We have not yet seen a schedulablty test for hard, non-preemptve task sets wth multple self-suspensons per task. Our approach seeks to fll ths gap by provdng the frst such analytcal schedulablty test. III.C. Schedulng Algorthms Desgnng schedulng polces for self-suspendng task sets also remans a challenge. Whle not anomalyfree, varous prorty-based schedulng polces have been shown to mprove the onlne executon behavor n practce. 7 of 42

9 Rajkumar 29 presents an algorthm called Perod Enforcer for preemptve, self-suspendng task sets scheduled wth the RM schedulng algorthm. Perod Enforcer works by addng pre-condtons to tasks n the processor queue that force the tasks to behave as deal, perodc tasks. Perod Enforcer handles tasks that self-suspend durng executon (.e., creatng dscrete subtasks) by transformng the task τ nto multple tasks τ, τ, τ, each wth the same deadlne as τ. However, ther approach does not handle non-preemptve task sets, nor s there a complementary, analytcal schedulablty test. Lakshmanan et al. buld on prevous approaches to develop a statc slack enforcement algorthm that delays the release tmes of subtasks to mprove the schedulablty of task sets. The statc slack enforcement algorthm s optmal n that t does not affect the worst-case response tme of a self-suspendng task and t prevents addtonal processng delays of lower-prorty tasks due to hgher-prorty tasks. Whle there exst schedulng algorthms that can handle non-preemptve, self-suspendng tasks sets wth multple suspensons per task, we have not yet seen a such an algorthm that s accompaned by an polynomal-tme schedulablty test. In ths paper, we present a complementary schedulablty test and schedulng algorthm. Furthermore, we extend our methods to handle subtask-to-subtask temporal constrants that are mportant n many schedulng problems outsde of the processor schedulng doman. IV. Termnology In ths secton we ntroduce new termnology to help descrbe our schedulablty test and the executon behavor of self-suspendng tasks, whch n turn wll help us ntutvely descrbe the varous components of our schedulablty test. Defnton A free subtask, τ j In other words, a subtask τ j τ free, s a subtask that does not share a deadlne constrant wth τ j. s free ff for any deadlne D τ a,τ b assocated wth that task, (j a) (b < j). We defne τ as free snce there does not exst a precedng subtask. Defnton 2 An embedded subtask, τ j+ (.e., τ j+ / τ free ). τ free τ embedded =. τ embedded, s a subtask shares a deadlne constrant wth τ j The ntutve dfference between a free and an embedded subtask s as follows: a scheduler has the flexblty to sequence a free subtask relatve to the other free subtasks wthout consderaton of subtask-tosubtask deadlnes. On the other hand, the scheduler must take extra consderaton to satsfy subtask-tosubtask deadlnes when sequencng an embedded subtask relatve to other subtasks. Defnton 3 A free self-suspenson, E j E free, s a self-suspenson that suspends two subtasks, τ j and τ j+, where τ j+ τ free. 8 of 42

10 Defnton 4 An embedded self-suspenson, E j E embedded, s a self-suspenson that suspends the executon of two subtasks, τ j and τ j+, where τ j+ τ embedded. E free E embedded =. In Secton VI, we descrbe how we can use τ free to reduce processor dle tme due to E free, and, n turn, analytcally upperbound the duraton of the self-suspensons that needs to be treated as task cost. We wll also derve an upperbound on processor dle tme due to E embedded. V. Motvatng our j th Subtask Frst (JSF) Prorty Schedulng Polcy Schedulng of self-suspendng task sets s challengng because polynomal-tme, prorty-based approaches such as EDF can result n schedulng anomales. To construct a tght schedulablty test, we desre a prorty method of restrctng the executon behavor of the task set n a way that allows us to analytcally bound the contrbutons of self-suspensons to processor dle tme, wthout unnecessarly sacrfcng processor effcency. We restrct behavor usng a novel schedulng prorty, whch we call j th Subtask Frst (JSF). We formally defne the j th Subtask Frst prorty schedulng polcy n Defnton 5. Defnton 5 j th Subtask Frst (JSF). We use j to correspond to the subtask ndex n τ j. A processor executng a set of self-suspendng tasks under JSF must execute the j th subtask (free or embedded) of every task before any (j + ) th free subtask. Furthermore, a processor does not dle f there s an avalable free subtask unless executng that free task results n temporal nfeasblty due to a subtask-to-subtask deadlne constrant. Enforcng that all j th subtasks are completed before any (j + ) th free subtasks allows the processor to execute any embedded k th subtasks where k > j as necessary to ensure that subtask-to-subtask deadlnes are satsfed. The JSF prorty schedulng polcy offers choce among consstency checkng algorthms. One smple algorthm that ensures deadlnes are satsfed s as follows: when a free subtask that trggers a deadlne constrant s executed (.e. τ j τ free, τ j+ τ embedded ), the subsequent embedded tasks for the assocated deadlne constrant are then scheduled as early as possble wthout the processor executng any other subtasks durng ths duraton. Other consstency-check algorthms that utlze processor tme more effcently and operate on ths structured task model exst VI. Unprocessor Schedulablty Test for Self-Suspendng Task Sets We buld the schedulablty test and prove ts correctness n sx steps, startng wth a smplfed task model and generalzng to the full model. Secton VI.A then summarzes our test for the full task model. The sx steps are as follows: 9 of 42

11 . We restrct τ such that each task only has two subtasks (.e., m = 2, ), there are no subtask-tosubtask deadlnes, and all tasks are released at t = 0 (.e., φ = 0, ). Addtonally, we say that all tasks have the same perod and deadlne (.e., T = D = T j = D j,, j {, 2,..., n}). Thus, the hyperperod of the task set s equal to the perod of each task. Here we wll ntroduce our formula for upperboundng the amount of self-suspenson tme that we treat as task cost, Wfree τ. 2. Next, we allow for general task release tmes (.e., φ 0, ). In ths step, we upperbound processor dle tme due to phase offsets, W τ φ. 3. Thrd, we relax the restrcton that each task has two subtasks and say that each task can have any number of subtasks. 4. Fourth, we ncorporate subtask-to-subtask deadlnes. In ths step, we wll descrbe how we calculate an upperbound on processor dle tme due to embedded self-suspensons W τ embedded. 5. Ffth, we relax the unform task deadlne restrcton and allow for general task deadlnes where D T, {, 2,..., n}. 6. Lastly, we relax the unform perodcty restrcton and allow for general task perods where T T j,, j {, 2,..., n}. Step ) Two Subtasks Per Task, No Deadlnes, and Zero Phase Offsets In step one, we consder a task set, τ wth two subtasks per each of the n tasks, no subtask-to-subtask deadlnes, and zero phase offsets (.e., φ = 0, n). Furthermore, we say that task deadlnes are equal to task perods, and that all tasks have equal perods (.e., T = D = T j = D j,, j {, 2,..., n}). We assert that one can upperbound the dle tme due to the set of all of the E self-suspensons by analyzng the dfference between the duraton of the self-suspensons and the duraton of the subtasks costs that wll be nterleaved durng the self-suspensons. We say that the set of the cost of all subtasks that mght be nterleaved durng a self-suspenson, E, s B. As descrbed by Equaton 3, Bj s the set of all of the jth and (j + ) th subtask costs less the subtasks costs for τ j and τ j+. Note, by defnton, τ j and τ j+ cannot execute durng E j. We further defne an operator B j (k) that provdes the kth smallest subtask cost from B j. We also restrct Bj such that the j th and (j + ) th subtasks must both be free subtasks f ether s to be added. Because we are currently consderng task sets wth no deadlnes, ths restrcton does not affect the subtasks n B In Step 4 (Secton VI), we wll explan why we make ths restrcton on the subtasks n B j. durng ths step. For convenence n notaton, we say that N s the set of all task ndces (.e., N = { {, 2,..., n}}, where n s the number of tasks n the task set, τ ). Wthout loss of generalty, we assume that the frst 0 of 42

12 subtasks τ execute n the order = {, 2,..., n}. B j = {Cy x x N\, y {j, j + }, τ j x τ free, τ j+ x τ free } (3) To upperbound the dle tme due to the set of E self-suspensons, we consder a worst-case nterleavng of subtask costs and self-suspenson duratons, as shown n Equaton 5 and Equaton 6, where W j s an upperbound on processor dle tme due to the set of E j self-suspensons, and W j s an upperbound on processor dle tme due to E j. To determne W j, we frst calculate the amount of processor dle tme W j due to each of the E j selfsuspensons. We calculate W j based on the cost of the fewest number of subtasks (Equaton 4) that wll be processed durng E j ff E j s the domnant contrbuter to processor dle tme from the set of E j, j. We defne the condtons for a self-suspenson to be the domnant contrbutor to processor dle tme n Defnton 6. By then takng the maxmum over all of W j j, we arrve at our upperbound on processor dle tme W due to set of j th self-suspensons {E j N}. Defnton 6 A self-suspenson E j s the domnant contrbutor to processor dle tme from the set of j th self-suspensons {E j N} f t subsumes all dle tme contrbuted by other self-suspensons n the set. If multple self-suspensons subsume all dle tme contrbuted by other self-suspensons, then they are codomnant contrbutors. η j = Bj 2 (4) W j η = max E j j k= B j (k), 0 (5) W j = ( ) max W j E j Efree (6) To prove that our method s correct, we frst show that Equaton 4 lowerbounds the number of free subtasks that execute durng a self-suspenson E, f E s the domnant contrbutor to processor dle tme. We perform ths analyss for three cases: for =, < = x < n, and = n. Second, we wll show that, f at least η j = B 2 subtasks execute durng E, then Equaton 5 correctly upperbounds dle tme due to E. Lastly, we show that f an E j s the domnant contrbutor to dle tme then Equaton 6 holds, meanng W s an upperbound on processor dle tme due to the set of E these three equatons also hold for all E j.) Proof of Correctness for Equaton 4, where j =. self-suspensons. (In Step 3 we wll show that of 42

13 Proof (Proof by Deducton for = ) We currently assume that all subtasks are free (.e., there are no subtask-to-subtask deadlne constrants), thus η j = B 2 = n. We recall that a processor executng under JSF wll execute all j th subtasks before any free (j + ) th subtask. Thus, after executng the frst subtask, τ, there are n other subtasks that must execute before the processor can execute τ 2. Thus, Equaton 4 holds for E rrespectve of whether or not E results n processor dle tme. Corollary From our proof for =, any frst subtask, τ x, wll have at least n x subtasks that execute durng E x f E x causes processor dle tme, (.e., the remanng n x frst subtasks n τ ). Example for Equaton 4, where = Fgure 3 llustrates the proof for = wth an example task set. Actual processor dle tme s shown n red and projected onto the tmelne below. The task set has three tasks as defned here: τ φ C E C 2 B η = {C3, C3, 2 C2, C2} 2 2 = {C3, C3, 2 C, C} 2 2 = 3 0 {C, C, 2 C2, C2} 2 2 At t = 0, all three tasks are released. We can see by nspecton the duraton of E must exceed the processng tme of subtasks τ 2 and τ 3 for E to possbly cause processor dle tme. We can calculate the lowerbound on the fewest subtasks that wll execute durng a domnant contrbutor E as shown n Equaton 7. η = B 2 = 4 2 = 2 (7) Proof 2 (Proof by Contradcton for < = x < n) We assume for contradcton that fewer than n subtasks execute durng E x and E x s the domnant contrbutor to processor dle tme from the set of frst self-suspensons E. We apply Corollary to further constran our assumpton that fewer than x second subtasks execute durng E x. We consder two cases: ) fewer than x subtasks are released before τ 2 x and 2) at least x subtasks are released before τ 2 x. Frst, f fewer than x subtasks are released before r 2 x (wth release tme of τ j x s denoted r j x), then at least one of the x second subtasks, τ 2 a, s released at or after r 2 x. We recall that there s no dle tme durng t = [0, f n]. Thus, E a subsumes any and all processor dle tme due to E x. In turn, E x cannot be the domnant contrbutor to processor dle tme. Second, we consder the case where at least x second subtasks are released before r 2 x. If we complete x of these subtasks before r 2 x, then at least n subtasks execute durng E x, whch s a contradcton. 2 of 42

14 Fgure 3: An example schedule s shown wth three tasks where the self-suspenson E s the domnant contrbutor to processor dle tme. Processor dle tme s shown n red and projected onto the tmelne below. If fewer than x of these subtasks execute before rx, 2 then there must exst a contnuous non-dle duraton between the release of one of the x subtasks, τa 2 and the release of rx, 2 such that the processor does not have tme to fnsh all of the x released subtasks before rx. 2 Therefore, the self-suspenson that defnes the release of that second subtask, Ea, 2 subsumes any and all dle tme due to Ex. Ex then s not the domnant contrbutor to processor dle tme, whch s a contradcton. Example for Equaton 4, where < = x < n Consder the example shown n Fgure 4 where the domnant contrbutor to processor dle tme s E2. We calculate the lowerbound on the fewest subtasks that wll execute durng E2 n Equaton 8. The parameters of the task set for ths example are: τ φ C E C 2 B η = {C 3, C 2 3, C 2, C 2 2} 2 = {C 3, C 2 3, C, C 2 } 2 = {C, C 2, C 2, C 2 2} 2 η 2 = B 2 2 = 4 2 = 2 (8) Proof 3 (Proof by Contradcton for = n) We show that f fewer than n subtask execute durng En, then En cannot be the domnant contrbutor to processor dle tme. As n Case 2: = x, f rn 2 s less than or equal to the release of some other task, τz, then any dle tme due to En s subsumed by Ez, thus En cannot be the domnant contrbutor to processor dle tme. If τn 2 s released after any other second subtask 3 of 42

15 Fgure 4: An example schedule s shown wth three tasks where the self-suspenson E 2 s the domnant contrbutor to processor dle tme. Processor dle tme s shown n red and projected onto the tmelne below. 4 of 42

16 and fewer than n subtasks then at least one subtask fnshes executng after r 2 n. Then, for the same reasonng as n Case 2: = x, any dle tme due to E n must be subsumed by another self-suspenson. Thus, E x cannot be the domnant contrbutor to processor dle tme f fewer than n subtasks execute durng E, where = n. Example for Equaton 4, where = n We now consder an example for the fnal case, where = n. As shown n Fgure 5, the domnant contrbutor to processor dle tme s E3. We calculate the lowerbound on the fewest subtasks that wll execute durng E3 n Equaton 8. The parameters of the task set n ths example are shown here: τ φ C E C 2 B η = {C 3, C 2 3, C 2, C 2 2} 2 = {C 3, C 2 3, C, C 2 } 2 = 3 0 {C, C 2, C 2, C 2 2} 2 η 3 = B 3 2 = 4 2 = 2 (9) Proof of Correctness for Equaton 5, where j =. Proof 4 (Proof by Deducton) If n subtasks execute durng E j, then the amount of dle tme that results from E j s greater than or equal to the duraton of Ej less the cost of the n subtasks that execute durng that self-suspenson. We also note that the sum of the costs of the n subtasks that execute durng E j must be greater than or equal to the sum of the costs of the n smallest-cost subtasks that could possbly execute durng E j. We can therefore upperbound the dle tme due to Ej by subtractng the n smallest-cost subtasks. Next we compute W as the maxmum of zero and E less the sum of the smallest n smallest-cost subtasks. If W s equal to zero, then E s not the domnant contrbutor to processor dle tme, snce ths would mean that fewer than n subtasks execute durng E (see proof for Equaton 4). If W j s greater than zero, then E may be the domnant contrbutor to processor dle tme, and ths dle tme due to E j s upperbounded by W j. Example for Equaton 5, where j = Returnng to our example shown n Fgure 3, the domnant contrbutor to processor dle tme s E. The upperbound on processor dle tme due to ths self-suspenson s shown n Equaton 0. If ether of the other self-suspensons E 2 or E 3 were the domnant contrbutor to processor dle tme, the upperbound on processor dle tme due to those self-suspensons s shown n Equatons and 2, respectvely. 5 of 42

17 Fgure 5: An example schedule s shown wth three tasks where the self-suspenson E 3 s the domnant contrbutor to processor dle tme. Processor dle tme s shown n red and projected onto the tmelne below. 6 of 42

18 η W = max E B(k), 0 k= = max ((2 ( + ))), 0) = 0 η2 W2 = max E2 B2(k), 0 k= = max ((4 ( + ))), 0) = 2 η3 W3 = max E3 B3(k), 0 k= = max (( ( + 2))), 0) (0) () (2) = 0 Fgure 4 shows an example where the domnant contrbutor to processor dle tme s E 2. The upperbound on processor dle tme due to ths self-suspenson s shown n Equaton 4. If ether of the other selfsuspensons E or E 3 were the domnant contrbutor to processor dle tme, the upperbound on processor dle tme due to those self-suspensons s shown n Equatons 3 and 5, respectvely. η W = max E B(k), 0 k= = max ((5 ( + ))), 0) (3) = 3 η2 W2 = max E2 B2(k), 0 k= = max ((7 ( + ))), 0) = 5 η3 W3 = max E3 B3(k), 0 k= = max ((4 ( + 2))), 0) (4) (5) = 7 of 42

19 The domnant contrbutor to processor dle tme n our thrd example (Fgure 5) s E 3. The upperbound on processor dle tme due to ths self-suspenson s shown n Equaton 8. If ether of the other selfsuspensons E or E 2 were the domnant contrbutor to processor dle tme, the upperbound on processor dle tme due to those self-suspensons s shown n Equatons 6 and 7, respectvely. η W = max E B(k), 0 k= = max ((5 ( + ))), 0) (6) = 3 η2 W2 = max E2 B2(k), 0 k= = max ((7 ( + ))), 0) = 5 η3 W3 = max E3 B3(k), 0 k= = max (( ( + 2))), 0) (7) (8) = 8 Proof of Correctness for Equaton 6, where j =. Proof 5 (Proof by Deducton) Here we show that by takng the maxmum over all of W, we upperbound the dle tme due to the set of E self-suspensons. We know from the proof of correctness for Equaton 4 that f fewer than n subtasks execute durng a self-suspenson, E, then that self-suspenson cannot be the domnant contrbutor to dle tme. Furthermore, the domnant self-suspenson subsumes the dle tme due to any other self-suspenson. We recall that Equaton 5 bounds processor dle tme caused by the domnant self-suspenson, say E j q. Thus, we note n Equaton 6 that the maxmum of the upperbound processor dle tme due to any other self-suspenson and the upperbound for E j q s stll an upperbound on processor dle tme due to the domnant self-suspenson. Example for Equaton 6 For the example schedules shown n Fgures 3, 4, and 5, the actual processor dle tmes are 4, 3, and 5, respectvely. We upperbound the processor dle tme for our three examples n Equatons 9, 20, and 2. 8 of 42

20 Example n Fgure 3: W = ( ) max W E j Efree = max(w, W 2, W 3 ) = max(0, 2, 0) (9) = 0 Example 2 n Fgure 4: W = ( ) max W E j Efree = max(w, W 2, W 3 ) = max(3, 5, ) (20) = 5 Example 3 n Fgure 5: W = ( ) max W E j Efree = max(w, W 2, W 3 ) = max(3, 5, 8) (2) = 8 In all three examples, we can see that Equaton 6 correctly upperbounds the processor dle tme due to the set of frst self-suspensons {E n}. Specfcally, 4 W = 0 (Fgure 3), 3 W = 5 (Fgure 4), and 5 W = 8 (Fgure 5). Step 2) General Phase Offsets Next we allow for general task release tmes (.e., φ 0, ). Phase offsets may result n addtonal processor dle tme. For example, f every task has a phase offset greater than zero, the processor s forced to dle at least untl the frst task s released. We also observe that, at the ntal release of a task set, the largest phase offset of a task set wll subsume the other phase offsets. We recall that the ndex of the task τ corresponds to the orderng wth whch ts frst subtask s executed (.e., s s + ). We can therefore conservatvely upperbound the dle tme durng t = [0, f n] due to the frst nstance of phase offsets by takng the maxmum over all phase offsets, as shown n Equaton 22. The quantty W τ φ computed n Step 2 s summed wth W (e.g., Equaton 20) computed n Step to conservatvely bound the contrbutons of frst self-suspensons and frst phase offsets to processor dle tme. Ths summaton allows us to relax the assumpton n Step that there s no processor dle tme durng the nterval t = [0, f n]. 9 of 42

21 Wφ τ = max φ (22) Example for Equaton 22 We extend Example 2 from Fgure 4 to consder non-zero phase offsets. The new task set parameters are shown n the table below: τ φ C E C 2 B η = {C3, C3, 2 C2, C2} 2 2 = {C3, C3, 2 C, C} 2 2 = {C, C, 2 C2, C2} 2 2 The upperbound on processor dle tme due to phase offsets s W φ = 3, as shown n Equaton 23. Wφ τ = max φ = max{0, 2, 3} = 3 (23) Fgure 6: An example schedule s shown for three tasks wth phase offsets. Processor dle tme s shown n red and projected onto the tmelne below. Ths plot ncludes dashed, vertcal lnes separate the tmelne. Wph τ upperbounds dle tme between t = [ ( )] 0, max f, and W upperbounds processor dle tme durng the doman of the frst self-suspenson t = [ ( ) ( )] max f, max f 2. Step 3) General Number of Subtasks Per Task The next step n formulatng our schedulablty test s ncorporatng general numbers of subtasks n each task. As n Step, our goal s to determne an upperbound on processor dle tme that results from the worst-case nterleavng of the j th and (j + ) th subtask costs durng the j th self-suspensons. Agan, we 20 of 42

22 recall that our formulaton for upperboundng dle tme due to the st self-suspensons n actualty was an upperbound for dle tme durng the nterval t = [f n, max (f 2 )]. In Step 2, we upperbounded dle tme resultng from phase offsets. To do ths we determned an upperbound on the dle tme between the release of the frst nstance of each task at t = 0 and the fnsh of τ n. Equvalently, ths duraton s t = [0, max (f )]. It follows then that, for each of the j th self-suspensons, we can apply Equaton 6 to determne an ( ) ( )] upperbound on processor dle tme durng the nterval t = [max f j, max f j+. The upperbound on total processor dle tme for all free self-suspensons n the task set s computed by summng over the contrbuton of each of the j th self-suspensons as shown n Equaton 24. Wfree τ = W j (24) j = ( ) max W j j E j Efree = j η max max E j j E j B j (k), 0 Efree k= However, we need to be careful n the applcaton of ths equaton for general task sets wth unequal numbers of subtasks per task. Let us consder a scenaro were one task, τ, has m subtasks, and τ x has only m x = m subtasks. When we upperbound dle tme due to the (m ) th self-suspensons, there s no correspondng subtask τ m x that could execute durng E m. We note that τx m does exst and mght execute durng E m, but we cannot guarantee that t does. Thus, when computng the set of subtasks, B j, that may execute durng a gven self-suspenson E j, we only add a par of subtasks τ x, j τx j+ f both τx, j τx j+ exst, as descrbed by Equaton 3. We note that, by nspecton, f τx j were to execute durng E j, t would only reduce processor dle tme. Example for Equaton 6 We extend our example from Fgure 6 to nclude multple self-suspensons n each task. The new task set s shown here: τ φ C E C 2 E 2 C 3 E 3 C 4 = = = of 42

23 To upperbound the processor dle tme due to all self-suspensons, we frst upperbound processor dle tme W j for each of the j th self-suspensons {E j n} usng Equaton 6, as shown n Equatons 25 and 26. Second, we apply Equaton 24 to the set of W j terms to compute the total upperbound Wfree τ. For ths example, Wfree τ = 7 (Equaton 27). W ( ) = max W E j Efree = max ( W, W2, W3 ) = max(3, 5, ) (25) = 5 W 2 = ( ) max W E j Efree = max(w 2, W 2 2, W 2 3 ) = max(2, 2, 0) (26) = 2 W τ free = j W j = W + W 2 = = 7 (27) Fgure 7: An example schedule s shown for three tasks wth phase offsets. Processor dle tme s shown n red and projected onto the tmelne below. Ths plot ncludes dashed, vertcal lnes separate the tmelne. Wφ τ upperbounds dle tme between t = [ ( )] 0, max f, and W upperbounds processor dle tme durng the doman of the frst self-suspenson t = [ ( ) ( )] max f, max f of 42

24 Step 4) Subtask-to-Subtask Deadlne Constrants In Steps and 3, we provded a lowerbound for the number of free subtasks that wll execute durng a free selfsuspenson, f that self-suspenson produces processor dle tme. We then upperbounded the processor dle tme due to the set of free self-suspensons by computng the least amount of free task cost that wll execute durng a gven self-suspenson. However, our proof assumed no subtask-to-subtask deadlne constrants. Now, we relax ths constrant and calculate an upperbound on processor dle tme due to embedded selfsuspensons W τ embedded. Recall under the JSF prorty schedulng polcy, an embedded subtask τ j+ may execute before all j th subtasks are executed, contngent on a temporal consstency check for subtask-to-subtask deadlnes. The mplcaton s that we cannot guarantee that embedded tasks (e.g. τ j or τ j+ ) wll be nterleaved durng ther assocated self-suspensons (e.g., E j x, x N\). To account for ths lack of certanty, we conservatvely treat embedded self-suspensons as task cost, as shown n Equatons 28 and 29. Equaton 28 requres that f a self-suspenson, E j s free, then Ej ( xj+ ) = 0. The formula ( x j+ ) s used to restrct our sum to only nclude embedded self-suspensons. Recall that a self-suspenson, E j Second, we restrct B j s embedded ff τ j+ s an embedded subtask. such that the jth and (j + ) th subtasks must be free subtasks f ether s to be added. We specfed ths constrant n Step, but ths restrcton dd not have an effect because we were consderng task sets wthout subtask-to-subtask deadlnes. Thrd, we now must consder cases where η j < n, as descrbed n Equaton 4. We recall that ηj = n f there are no subtask-to-subtask deadlnes; however, wth the ntroducton of these deadlne constrants, we can only guarantee that at least η j = Bj 2 subtasks wll execute durng a gven E j, f Ej dle tme. W τ embedded = n = m E j j= ( x j+ results n processor ) (28) x j =, f τ j τ free 0, f τ j τ embedded (29) Havng bounded the amount of processor dle tme due to free and embedded self-suspensons and phase offsets, we now provde an upperbound on the tme H τ UB the processor wll take to complete all nstances of each task n the hyperperod (Equaton 30). H denotes the hyperperod of the task set, and H τ LB s defned as the sum over all task costs released durng the hyperperod. Recall that we are stll assumng that T = D = T j = D j,, j N; thus, there s only one nstance of each task n the hyperperod. Under ths 23 of 42

25 assumpton, the task set s schedulable under JSF f Hτ UB H. H τ UB = H τ LB + W τ phase + W τ free + W τ embedded (30) H τ LB = Example for Subtask-to-Subtask Deadlne Constrants n = H T m j= C j (3) Consder our example from Fgure 7, whch s now augmented to nclude a subtask-to-subtask deadlne D s2s = 9. The parameters of the task set are repeated here: τ 2,τ 3 τ φ C E C 2 E 2 C 3 E 3 C 4 = = = We apply Equaton 28 to our example to upperbound the processor dle tme due to all embedded selfsuspensons. In ths case there s only one embedded self-suspenson, E; 2 thus, the upperbound on processor dle tme due to embedded self-suspensons s W τ embedded = 5 (Equaton 32). W τ embedded = n = = E 2 m E j j= ( x j+ ) (32) = 5 Because of the addton of ths subtask-to-subtask deadlne D s2s τ 2,τ 3, the upperbound for W free τ must be recomputed. Deadlne D s2s τ 2,τ 3 embeds just one of the 2nd self-suspensons {E 2 n}, so we only need to recompute W 2 ; W s unchanged. Recall that W j s the max over all {W j n} where each assocated self-suspenson Ej s a free self-suspenson. Because E 2 s embedded, we only need to calculate W 2 2 (Equaton 33) and W 2 3 (Equaton 34). η2 2 W2 2 = max E2 2 B2(k) 2, 0 k= = max ((5 ())), 0) (33) = 4 24 of 42

26 η3 2 W3 2 = max E3 2 B3(k) 2, 0 k= = max ((2 ())), 0) (34) = The new upperbound for dle tme due to free self-suspensons s now calculated as shown n Equatons 35 and 36. W 2 = ( ) max W E j Efree = max(w 2 2, W 2 3 ) = max(4, ) (35) = 4 W τ free = j W j = W + W 2 = = 9 (36) Fnally, the upperbound H τ UB on the tme requred to process τ can be computed va Equaton 30. For our example, HUB τ = 35 (Equaton 37). Ths upperbound guarantees that ths task set can be processed f the hyperperod H = T = T j of the task set s greater than or equal to H τ UB = 35. H τ UB = H τ LB + W τ phase + W τ free + W τ embedded = (37) = 35 Fgure 8: An example schedule s shown for three tasks wth a subtask-to-subtask deadlne constrant D s2s τ 2,τ of 42

27 Step 5) Deadlnes Less Than or Equal to Perods Next we allow for tasks to have deadlnes less than or equal to the perod. We recall that we stll restrct the perods such that T = T j,, j N for ths step. When we formulated our schedulablty test of a self-suspendng task set n Equaton 30, we calculated an upperbound on the tme the processor needs to execute the task set, HUB τ. Now we seek to upperbound the amount of tme requred to execute the fnal subtask τ j for task τ, and we can utlze the methods already developed to upperbound ths tme. To compute ths bound we consder the largest subset of subtasks n τ, whch we defne as τ j τ, that mght execute before the task deadlne for τ. If we fnd that H τ j UB Dabs, where D abs s the absolute task deadlne for τ, then we know that a processor schedulng under JSF wll satsfy the task deadlne for τ. We recall that, for Step 5, we have restrcted the perods such that there s only one nstance of each task n the hyperperod. Thus, we have D abs, = D + φ. In Step 6, we consder the more general case where each task may have multple nstances wthn the hyperperod. For ths scenaro, the absolute deadlne of the k th nstance of τ s D abs,k = D + T (k ) + φ. We present an algorthm named testdeadlne(τ,d abs,j) to perform ths test. Pseudocode for testdeadlne(τ,d abs,j) s shown n Fgure 9. Ths algorthm requres as nput a task set τ, an absolute deadlne D abs for task deadlne D, and the subtask ndex (.e., ndex j n τ j ) of the last subtask assocated wth D (e.g., j = m assocated wth D for τ τ ). The algorthm returns true f a guarantee can be provded that the processor wll satsfy D under the JSF, and returns false otherwse. In Lnes -4, the algorthm computes τ j, the set of subtasks that may execute before D. In the absence of subtask-to-subtask deadlne constrants, τ j ncludes all subtasks τ j where N and j {, 2,..., j}. In the case an subtask-to-subtask deadlne spans subtask τ j x (n other words, a deadlne D τ a x,τ b x exsts where a j and b > j), then the processor may be requred to execute all embedded subtasks assocated wth the deadlne before executng the fnal subtask for task τ. Therefore the embedded subtasks of D τ a x,τ b x are also added to the set τ j. In Lne 5, the algorthm tests the schedulablty of τ j usng Equaton 30. Next we walk through the pseudocode for testdeadlne(τ,d abs,j) n detal. Lne ntalzes τ j. Lne 2 terates over each task, τ x, n τ. Lne 3 ntalzes the ndex of the last subtask from τ x that may need to execute before τ j as z = j, assumng no subtask-to-subtask constrants. Lnes 5- search for addtonal subtasks that may need to execute before τ j due to subtask-to-subtask deadlnes. If the next subtask, τ z+ x before τ j does not exst, then τ z x s the last subtask that may need to execute (Lnes 5-6). The same s true f τ z+ x τ free, because τ z+ x wll not execute before τ j under JSF f z + > j (Lnes 7-8). If τx z+ s an embedded subtask, then t may be executed before τ j, so we ncrement z, the ndex of the last subtask, by one (Lne 9-0). Fnally, Lne 3 adds the subtasks collected for τ x, denoted τ x j, to the task subset, τ j. 26 of 42

28 After constructng our subset τ j, we compute an upperbound on the fracton of tme requred by the processor to satsfy some subtask τ j,k constraned by Dabs (Lne 5). If ths fracton s less than or equal to one, then we can guarantee that the deadlne wll be satsfed by a processor schedulng under JSF (Lne 6). Otherwse, we cannot guarantee the deadlne wll be satsfed and return false (Lne 8). To determne f all task deadlnes are satsfed, we call testdeadlne(τ,d abs,j) once for each task deadlne. testdeadlne(τ,d abs,j) : τ j NULL 2: for x = to τ do 3: z j 4: whle TRUE do 5: f τ z+ 6: break 7: else f τ z+ x / (τ free τ embedded ) then x τ free then 8: break 9: else f τx z+ τ embedded then 0: z z + : end f 2: end whle 3: τ x j (φ x, (Cx, Ex, Cx, 2..., Cx), z D x, T x ) 4: end for 5: f H τ j UB /Dabs //Usng Eq. 30 then 6: return TRUE 7: else 8: return FALSE 9: end f Fgure 9: Pseudo-code for testdeadlne(τ, D, j), whch tests whether a processor schedulng under JSF s guaranteed to satsfy a task deadlne, D. Step 6) General Perods Thus far, we have establshed a mechansm for testng the schedulablty of a self-suspendng task set wth general task deadlnes less than or equal to the perod, general numbers of subtasks n each task, non-zero phase offsets, and subtask-to-subtask deadlnes. We now relax the restrcton that T = T j,, j. The prncple challenge of relaxng ths restrcton s there wll be any number of task nstances n a hyperperod, whereas before, each task only had one nstance. To determne the schedulablty of the task set, we frst start by defnng a task superset, τ, where τ τ. Ths superset has the same number of tasks as τ (.e., n), but each task τ τ s composed of H T nstances of τ τ. A formal defnton s shown n Equaton 38, where C j,k and Ej,k are the kth nstance of the j th subtask cost and self-suspenson of τ. τ :(φ, (C,, E,,..., C m,, C,2, E,2,..., C m,2,..., C,k, E,k,..., C m,k ), D = H, T = H) (38) 27 of 42