Time-Triggered Scheduling of Mixed-Criticality Systems

Siam Review, 2010

Many safety-critical embedded systems are subject to certification requirements; some systems may be required to meet multiple sets of certification requirements, from different certification authorities. Certification requirements in such "mixed-criticality" systems give rise to some interesting scheduling problems, that cannot be satisfactorily addressed using techniques from conventional scheduling theory. It had previously been shown that determining whether a system specified in this model can be scheduled to meet all its certification requirements is highly intractable. Prior work [4] had also introduced a simple, prioritybased scheduling algorithm called OCBP for mixed criticality systems, and had quantified, via the metric of processor speedup factor, the effectiveness of OCBP in scheduling dual-criticality systems -systems subject to two sets of certification requirements.

IEEE Transactions on Computers

Mixed-criticality models are an emerging paradigm for the design of real-time systems because of their significantly improved resource efficiency. However, formal mixed-criticality models have traditionally been characterized by two impractical assumptions: once any high-criticality task overruns, all low-criticality tasks are suspended and all other high-criticality tasks are assumed to exhibit highcriticality behaviors at the same time. In this paper, we propose a more realistic mixed-criticality model, called the flexible mixed-criticality (FMC) model, in which these two issues are addressed in a combined manner. In this new model, only the overrun task itself is assumed to exhibit high-criticality behavior, while other high-criticality tasks remain in the same mode as before. The guaranteed service levels of low-criticality tasks are gracefully degraded with the overruns of high-criticality tasks. We derive a utilization-based technique to analyze the schedulability of this new mixed-criticality model under EDF-VD scheduling. During run time, the proposed test condition serves an important criterion for dynamic service level tuning, by means of which the maximum available execution budget for low-criticality tasks can be directly determined with minimal overhead while guaranteeing mixed-criticality schedulability. Experiments demonstrate the effectiveness of the FMC scheme compared with state-of-the-art techniques.

IEEE Transactions on Computers

In this paper, we study the scheduling problem of the imprecise mixed-criticality model (IMC) under earliest deadline first with virtual deadline (EDF-VD) scheduling upon uniprocessor systems. Two schedulability tests are presented. The first test is a concise utilizationbased test which can be applied to the implicit deadline IMC task set. The suboptimality of the proposed utilization-based test is evaluated via a widely-used scheduling metric, speedup factors. The second test is a more effective test but with higher complexity which is based on the concept of demand bound function (DBF). The proposed DBF-based test is more generic and can apply to constrained deadline IMC task set. Moreover, in order to address the high time cost of the existing deadline tuning algorithm, we propose a novel algorithm which significantly improve the efficiency of the deadline tuning procedure. Experimental results show the effectiveness of our proposed schedulability tests, confirm the theoretical suboptimality results with respect to speedup factor, and demonstrate the efficiency of our proposed algorithm over the existing deadline tunning algorithm. In addition, issues related to the implementation of the IMC model under EDF-VD are discussed.

2017

This paper presents the practical implementation of a multi-core mixed-criticality scheduling algorithm. The goal of this work is to show the practical platform utilisation gain by allowing the concurrent execution of applications having different levels of criticality. We implemented the port of an existing industrial application provided by Thales Research & Technology on an embedded real-time operating system featuring task execution budget control, multi-core scheduling and multiple execution mode changes. We evaluated our solution by measuring the time that remains available for a low-criticality application running concurrently with the high-criticality use case mentioned above.

IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, 2022

Many safety-critical real-time systems are considered certified when they meet failure probability requirements with respect to the maximum permitted incidences of failure per hour. In this paper, the mixed-criticality task model with multiple worst-case execution time (WCET) estimations is extended to incorporate such system-level certification restrictions. A new parameter is added to each task, characterizing the distribution of the WCET estimations-the likelihood of all jobs of a task finishing their executions within the less pessimistic WCET estimates. Efficient algorithms are derived for scheduling mixed-criticality systems represented using this model for both uniprocessor and multiprocessor platforms for independent tasks. Furthermore, a 0/1 covariance matrix is introduced to represent the failure-dependency between tasks. An efficient algorithm is proposed to schedule such failure-dependent tasks. Experimental analyses show our new model and algorithm outperform current state-of-the-art mixed-criticality scheduling algorithms.

Journal of computing science and engineering, 2020

Currently, mixed-criticality systems (MCSs) are rapidly adopted by the automotive industry, with the shift in electricalelectronic architecture from federated to integrated design to reduce developmental costs, pull in the development schedule, and easy reconfiguration of the system with service-oriented architecture. Several studies have been based on Vestal's original MCS model, in which the criticality modes are the same as criticality levels. However, the MCS model does not fit the automotive industry or the safety perspective. In this study, we identify the divergence of theory and automotive practice for real-time MCS. We also propose a generalized MCS model close to industry practice and a priority assignment algorithm along with schedulability analysis for both online and offline phases. Further, we present a practical example of memory partition and decomposition tasks based on AUTomotive Open System Architecture (AUTOSAR). The proposed design is currently being developed for battery management systems of electric and plug-in hybrid electric vehicles.

2015

The real-time system design targeting multiprocessor platforms leads to two important complications in realtime scheduling. First, to ensure deterministic processing by communicating tasks the scheduling has to consider precedence constraints. The second complication factor is mixed criticality, i.e., integration upon a single platform of various subsystems where some are safety-critical (e.g., car braking system) and the others are not (e.g., car digital radio). Therefore we motivate and study the multiprocessor scheduling problem of a finite set of precedence-related mixed criticality jobs. This problem, to our knowledge, has never been studied if not under very specific assumptions. The main contribution of our work is an algorithm that, given a global fixed-priority assignment for jobs, can modify it in order to improve its schedulability for mixed-criticality setting. Our experiments show an increase of schedulable instances up to a maximum of 25% if compared to classical solutions for this category of scheduling problems.

2020 9th Mediterranean Conference on Embedded Computing (MECO), 2020

Real-time embedded systems that combine processes of various criticalities (i.e. mixed-criticality real-time systems) represent an emerging research that faces many issues. This paper describes a new ASIC design of a coprocessor that realizes process scheduling for mixed-criticality real-time systems. The solution proposed in this paper uses Robust Earliest Deadline (RED) algorithm. Due to the on-chip implementation of the scheduler, all scheduler operations always take two clock cycles to execute. The proposed solution was verified by simulations that applied millions of random inputs. Chip area costs are evaluated by synthesis into ASIC using 28 nm TSMC technology. The proposed RED-based scheduler is compared with an existing EDF-based scheduler that supports hard realtime processes only. Even though the RED-based scheduler costs more chip area, it can handle any combinations of process criticalities, variations of process execution times and deadlines, achieves higher CPU utilization and can be used for scheduling of non-real-time, soft real-time and hard real-time processes combined within one system.

Sensors, 2023

This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY

2016 28th Euromicro Conference on Real-Time Systems (ECRTS), 2016

Many reactive systems must be designed and analyzed prior to deployment in the presence of considerable epistemic uncertainty: the precise nature of the external environment the system will encounter, as well as the run-time behavior of the platform upon which it is implemented, cannot be predicted with complete certainty prior to deployment. The widely-studied Vestal model for mixed-criticality workloads addresses uncertainties in estimating the worst-case execution time (WCET) of real-time code. Different estimations, at different levels of assurance, are made about these WCET values; it is required that all functionalities execute correctly if the less conservative assumptions hold, while only the more critical functionalities are required to execute correctly in the (presumably less likely) event that the less conservative assumptions fail to hold but the more conservative assumptions do. A generalization of the Vestal model is considered here, in which a degraded (but non-zero) level of service is required for the less critical functionalities even in the event of only the more conservative assumptions holding. An algorithm is derived for scheduling dual-criticality implicitdeadline sporadic task systems specified in this more general model upon preemptive uniprocessor platforms, and proved to be speedup-optimal.