Schedulability Analysis for Controller Area Network (CAN) with FIFO Queues Priority Queues and Gateways

Transcription

1 Schedulability Aalysis for Cotroller Area Network (CAN) with FIFO Queues Priority Queues ad Gateways Robert I. Davis Real-Tie Systes Research Group, Departet of Coputer Sciece, Uiversity of York, YO10 5DD, York, UK Steffe Kolla, Victor Pollex, Frak Sloka Istitute of Ebedded Systes / Real-Tie Systes Ul Uiversity, Albert-Eistei-Allee 11, Ul, Geray {steffe.kolla, victor.pollex, Abstract Cotroller Area Network (CAN) is widely used i autootive applicatios. Existig schedulability aalysis for CAN is based o the assuptio that the highest priority essage ready for trasissio at each ode o the etwork will be etered ito arbitratio o the bus. However, i practice, soe CAN device drivers ipleet FIFO rather tha priority-based queues ivalidatig this assuptio. I this paper, we itroduce respose tie aalysis ad optial priority assiget policies for CAN essages i etworks where soe odes use FIFO queues while other odes use priority queues. We show, via a case study ad experietal evaluatio, the detrietal ipact that FIFO queues have o the real-tie perforace of CAN. Further, we show that i gateway applicatios, if it is ot possible to ipleet a priority queue, the it is preferable to use ultiple FIFO queues each allocated a sall uber of essages with siilar trasissio deadlies. Exteded versio This paper fors a exteded versio of the paper, "Cotroller Area Network (CAN) Schedulability Aalysis with FIFO queues [18] published i ECRTS The aalysis give i that paper has bee exteded via the iclusio of the followig ew aterial: I sectio 1.2 we have added exaples of CAN devices that provide hardware support for FIFO queues. Sectio 4.6 has bee added, providig foral proofs that the schedulability tests give i sectios 4.2 ad 4.3 are sufficiet (Theores 2 ad 3) ad selfsustaiable (Theores 4 ad 5). I sectio 5.2, we have added a foral proof that trasissio deadlie ootoic priority orderig is optial whe all essages have the sae axiu trasissio tie (Theore 7). I sectio 7, we have exteded the experietal evaluatio to show how the perforace degradatio due to FIFO queues depeds o the uber of essages i each queue. Sectios 6.1 ad 7.1 have bee added, explorig the effects of ipleetig oe or ore FIFO queues i gateway odes that are resposible for trasferrig essages fro oe etwork to aother. 1. Itroductio Cotroller Area Network (CAN) [6], [25] was desiged as a siple, efficiet, ad robust, broadcast couicatios bus for i-vehicle etworks. Today, typical aistrea faily cars cotai Electroic Cotrol Uits (ECUs), ay of which couicate usig CAN. As a result of this wholesale adoptio of CAN by the autootive idustry, aual sales of CAN odes (8, 16 ad 32-bit icrocotrollers with o-chip CAN cotrollers) have grow fro uder 50 illio i 1999 to aroud 750 illio i I autootive applicatios, CAN is typically used to provide high speed etworks (500Kbits/s) coectig chassis ad power-trai copoets, for exaple egie aageet ad trasissio cotrol. It is also used for low speed etworks (100 or 125Kbits/s) coectig body ad cofort electroics. Data required by odes o differet etworks is typically trasferred betwee the differet CAN buses by a gateway ode coected to both. CAN is a asychroous ulti-aster serial data bus that uses Carrier Sese Multiple Access / Collisio Resolutio (CSMA/CR) to deterie access to the bus. The CAN protocol requires that odes wait for a bus idle period before atteptig to trasit. If two or ore odes attept to trasit essages at the sae tie, the the ode with the essage with the lowest ueric CAN Idetifier will wi arbitratio ad cotiue to sed its essage. The other odes will cease trasittig ad ust wait util the bus becoes idle agai before atteptig to re-trasit their essages. (Full details of the CAN physical layer protocol are give i [6], with a suary i [14]). I effect CAN essages are set accordig to fixed priority o-preeptive schedulig, with the idetifier (ID) of each essage actig as its priority Related work I 1994, Tidell et al. [36] showed how research ito fixed priority schedulig for sigle processor systes could be adapted ad applied to the schedulig of essages o CAN. The aalysis of Tidell et al. provided a ethod of calculatig the axiu queuig delay ad hece the worst-case respose tie of each essage o the etwork. Tidell et al. [36], [37], [38] also recogised that with fixed priority schedulig, a appropriate priority assiget 1 Figures fro the CAN i Autoatio (CiA) website

2 policy is key to obtaiig effective real-tie perforace. Tidell et al. suggested that essages should be assiged priorities i Deadlie ius Jitter ootoic priority order [40]. The seial work of Tidell et al. lead to a large body of research ito schedulig theory for CAN [8], [9], [10], [11], [21], [22], [30], [31], [32], [34], ad was used as the basis for coercial CAN schedulability aalysis tools [12]. I 2007, Davis et al. [14] foud ad corrected sigificat flaws i the schedulability aalysis give by Tidell et al. [36], [37], [38]. These flaws could potetially result i the origial aalysis providig guaratees for essages that could i fact iss their deadlies durig etwork operatio. Further, Davis et al. [14] showed that the Deadlie ius Jitter ootoic priority orderig, claied by Tidell et al. to be optial for CAN, is ot i fact optial; ad that Audsley s Optial Priority Assiget (OPA) algorith [1], [3] is required i this case. Prior to the advet of schedulability aalysis ad appropriate priority assiget policies for CAN, essage IDs were typically assiged siply as a way of idetifyig the data ad the sedig ode. This eat that oly low levels of bus utilisatio, typically aroud 30%, could be obtaied before deadlies were issed. Further, the oly eas of obtaiig cofidece that essage deadlies would ot be issed was via extesive testig. Usig the systeatic approach of schedulability aalysis, cobied with a suitable priority assiget policy, it becae possible to egieer CAN based systes for tiig correctess, providig guaratees that all essages would eet their deadlies, with bus utilisatios of up to about 80% [16], [12] Motivatio Egieers usig schedulability aalysis to aalyse etwork / essage cofiguratios ust esure that all of the assuptios of the specified schedulig odel hold for their particular syste. Specifically, whe usig the aalysis give by Davis et al. i [14], it is iportat that each CAN cotroller ad device driver is capable of esurig that wheever essage arbitratio starts o the bus, the highest priority essage queued at that ode is etered ito arbitratio. This behaviour is essetial if essage trasissio is to take place as if there were a sigle global priority queue ad for the aalysis to be correct. As oted by Di Natale [19], there are a uber of potetial issues that ca lead to behaviour that does ot atch that required by the schedulig odel give i [14]. For exaple, if a CAN ode has fewer trasit essage buffers tha the uber of essages that it trasits, the the followig properties of the CAN cotroller hardware ca prove probleatic: (i) iteral essage arbitratio based o trasit buffer uber rather tha essage ID (Fujitsu MB90385/90387, Fujitsu 90390, Itel 87C196 (82527), Ifieo XC161CJ/167 (82C900)); (ii) o-abortable essage trasissio (Philips 82C200) [20]; (iii) less tha 3 trasit buffers [28] (Philips 8xC592 (SJA1000), Philips 82C200). CAN cotrollers which avoid these potetial probles iclude, the Atel AT89C51CC03 / AT90CAN32/64 the Microchip MPC2515, ad the Motorola MSCAN o-chip peripheral, all of which have at least 3 trasit buffers, iteral essage arbitratio based o essage ID rather tha trasit buffer uber, ad abortable essage trasissio. The CAN device driver / software protocol layer ipleetatio also has the potetial to result i behaviour which does ot atch that required by the stadard schedulig odel [14]. Issues iclude, delays i refillig a trasit buffer [24], ad FIFO queuig of essages i the device driver or CAN cotroller. A uber of CAN cotroller hardware ipleetatios provide specific support for FIFO queues. These iclude: o The BXCAN ad BECAN for the ST7 ad ST9 Microcotrollers fro STMicroelectroics which icludes hardware support for both priority-queued ad FIFO-queued essage trasissio [35]. o The XILINX CAN Cotroller Core (LogiCORE IP AXI Cotroller) which provides a trasit buffer FIFO of cofigurable depth (up to 64 essages) ad a sigle additioal high priority trasit buffer that takes precedece over the FIFO [39]. o The Microchip PIC32MX which has 32 FIFOs each of which ca hold up to 32 essages. Arbitratio betwee the idividual FIFOs takes place o the basis of a priority assiged to each FIFO or the FIFO uber i the case of ties, hece all of the essages i a high priority FIFO are set before ay of the essages i a lower priority FIFO. (We ote that as there are 32 FIFOs, the PIC32MX ca effectively provide prioritybased queuig for up to 32 trasit essages, each utilisig a idividual FIFO). o The Avet MC-ACT-XCANF which is a sall FPGA footprit CAN Cotroller for use with Actel prograable logic devices [1]. The MC-ACT- XCANF has a sigle trasit FIFO ad a sigle receive o FIFO. The Reesas R32C/160 [33] is a icrocotroller fro the M16C faily, specific to vehicle etwork applicatios. The o-chip CAN peripheral has 32 essage buffers / ailboxes ad provides the optio of a FIFO ailbox ode. I this ode, 4 ailboxes are cofigured as a 4-stage trasit FIFO ad 4 ailboxes as a 4-stage receive FIFO. Di Natale [19] otes that usig FIFO queues i CAN device drivers / software protocol layers ca see a attractive solutio because of its siplicity ad the illusio that faster queue aageet iproves the perforace of the syste. This is ufortuate, because FIFO essage queues uderie the priority-based bus arbitratio used by CAN. They ca itroduce sigificat priority iversio ad result i degraded real-tie perforace. Nevertheless, FIFO queues are a reality i soe coercial CAN device

3 drivers / software protocol layers. Oe area i which the use of FIFO queues ca have a particularly detrietal effect is i gateway applicatios. The uber of essages trasitted oto a etwork by a gateway ode ca easily exceed the uber of hardware trasit buffers available i the CAN cotroller it uses. A siple desig solutio to this proble is to use a sigle FIFO queue for all of these essages; however, such a choice ca sigificatly degrade the real-tie perforace of the etwork. As far as we are aware, there is o published research 2 itegratig FIFO queues ito respose tie aalysis for CAN. This paper focuses o the issue of FIFO queues. We provide respose tie aalysis ad appropriate priority assiget policies for Cotroller Area Networks coprisig soe odes that use FIFO queues ad other odes that use priority queues Orgaisatio The reaider of this paper is orgaised as follows: I sectio 2, we itroduce the schedulig odel, otatio, ad teriology used i the rest of the paper. I sectio 3 we recap o the sufficiet schedulability aalysis for CAN give i [14]. Sectio 4 the exteds this aalysis to etworks where soe odes ipleet priority-based queues while others ipleet FIFO queues. Sectio 5 discusses priority assiget for ixed sets of FIFOqueued ad priority-queued essages. Sectio 6 presets the results of a case study explorig the ipact of FIFO queues o essage respose ties ad etwork schedulability. Sectio 7 evaluates the effect of priority assiget ad FIFO queues o the axiu achievable etwork utilisatio. Fially, sectio 8 cocludes with a suary ad recoedatios. 2. Syste odel, otatio ad teriology I this sectio we describe a syste odel ad otatio that ca be used to aalyse the worst-case respose ties of CAN essages. This odel is based o that used i [14] with extesios to describe FIFO queues. Note that here we give oly a high level descriptio ecessary to uderstad the essage schedulig behaviour of CAN. Readers iterested i the uderlyig lower level CAN protocol ad its teriology are directed to sectio 2.1 of [14]. The syste is assued to coprise a uber of odes (icroprocessors) coected to a sigle CAN bus. Nodes are classified accordig to the type of essage queue used i their device driver. Thus FQ-odes ipleet a FIFO essage queue, whereas PQ-odes ipleet a priority queue. PQ-odes are assued to be capable of esurig that, at ay give tie whe bus arbitratio starts, the highest priority essage queued at the ode is etered ito arbitratio. FQ-odes are assued to be capable of esurig that, at ay give tie whe bus arbitratio starts, the oldest essage i the FIFO queue is etered ito arbitratio. 2 The coercial tool NETCAR-Aalyzer ( addresses the case of FIFO queues. The syste is assued to cotai a static set of hard real-tie essages, each statically assiged to a sigle ode o the etwork. Each essage has a distict fixed Idetifier (ID) ad hece a uique priority. As priority uiquely idetifies each essage, i the reaider of the paper we will overload to ea either essage or priority as appropriate. We use hp () to deote the set of essages with priorities higher tha, ad siilarly, lp () to deote the set of essages with priorities lower tha. Each essage has a axiu trasissio tie of C (see [14] for details of how to copute the axiu trasissio tie of essages o CAN, takig ito accout the uber of data bytes ad bit-stuffig). The evet that triggers queuig of essage is assued to occur with a iiu iter-arrival tie of T, referred to as the essage period. Each essage has a hard deadlie D, correspodig to the axiu peritted tie fro occurrece of the iitiatig evet to the ed of successful trasissio of the essage, at which tie the essage data is assued to be available o the receivig odes that require it. Tasks o the receivig odes ay place differet tiig requireets o the data, however i such cases we assue that D is the shortest such tie costrait. We assue that the deadlie of each essage is less tha or equal to its period ( D T ). Each essage is assued to be queued by a software task, process or iterrupt hadler executig o the sedig ode. This task is either ivoked by, or polls for, the evet that iitiates the essage, ad takes a bouded aout of tie, betwee 0 ad J, before the essage is i the device driver queue available for trasissio. J is referred to as the queuig jitter of the essage ad is iherited fro the overall respose tie of the task, icludig ay pollig delay 3. The trasissio deadlie E of essage is give by E = D J, ad represets the axiu peritted tie fro the essage beig queued at the sedig ode to it beig received at other odes o the bus. The axiu queuig delay w, correspods to the logest tie that essage ca reai i the device driver queue or CAN cotroller trasit buffers, before coecig successful trasissio o the bus. I this paper, we defie the worst-case respose tie R of a essage as the axiu possible trasissio delay fro the essage beig queued util it is received at the receivig odes 4. Hece: R = w + C (1) As oted by Broster [10], receivig odes ca access essage followig the ed of (essage) frae arker 3 I the best case, the task could arrive the istat the evet occurs ad queue the essage iediately, whereas i the worst-case, there could be a delay of up to the task s period before it arrives ad the a further delay of up to the task s worst-case respose tie before it queues the essage. 4 Note this is a differet way of defiig respose tie to that used i [14] which icludes queuig jitter. To copesate for ot icludig queuig jitter i the respose tie, i this paper we copare respose ties with trasissio deadlies to deterie schedulability.

4 ad before the 3-bit iter-frae space. The aalysis give i the reaider of this paper is therefore slightly pessiistic i that it icludes the 3-bit iter-frae space i the coputed worst-case respose ties. To reove this sall degree of pessiis, it is valid to siply subtract 3τ bit fro the coputed respose tie values, where τ bit is the trasissio tie for a sigle bit o the bus. A essage is said to be schedulable if its worst-case respose tie is less tha or equal to its trasissio deadlie ( R E ). A syste is said to be schedulable if all of the essages i the syste are schedulable. The followig additioal otatio is used to describe the properties of a set of essages that are trasitted by the sae FQ-ode ad so share a FIFO queue. The FIFO group M () is the set of essages that are trasitted by the FQode that trasits essage. The lowest priority of ay essage i the FIFO group M () is deoted by L. MAX MIN C ad C are the trasissio ties of the logest SUM ad shortest essages i the FIFO group, while C is the su of the trasissio ties of all of the essages i MIN the group. E is the shortest trasissio deadlie of ay essage i the group. We use f to deote the axiu bufferig tie fro essage beig queued util it is able to take part i priority-based arbitratio. For a FIFO-queued essage f equates to the tie fro the essage beig etered ito the FIFO queue to it becoig the oldest essage i that queue. For a priority-queued essage f = 0. As well as deteriig essage schedulability give a particular priority orderig, we are also iterested i effective priority assiget policies. Defiitio 1: Optial priority assiget policy: A priority assiget policy P is referred to as optial with respect to a schedulability test S ad a give etwork odel, if ad oly if there is o set of essages that are copliat with the odel that are deeed schedulable by test S usig aother priority assiget policy, that are ot also deeed schedulable accordig to test S usig policy P. We ote that the above defiitio is applicable to both sufficiet schedulability tests such as those give i sectios 3 ad 4, as well as exact schedulability tests. A schedulig algorith is said to be sustaiable [5] with respect to a syste odel, if ad oly if schedulability of ay set of essages copliat with the odel iplies schedulability of the sae set of essages odified by: (i) decreasig trasissio ties, (ii) icreasig periods or iter-arrival ties, ad (iii) icreasig deadlies. Siilarly, a schedulability test is referred to as sustaiable if these chages caot result i a set of essages that was previously deeed schedulable by the test becoig uschedulable. We ote that the odified set of essages ay ot ecessarily be deeed schedulable by the test. A schedulability test is referred to as self-sustaiable [4] if such a odified set of essages is always deeed schedulable by the test. 3. Schedulability Aalysis with Priority Queues I this sectio, we recapitulate the siple sufficiet schedulability aalysis give i [14]. For etworks of PQodes, coplyig with the schedulig odel give i sectio 2, CAN effectively ipleets fixed priority opre-eptive schedulig. I this case, Davis et al. [14] showed that a upper boud o the respose tie R of each essage ca be foud by coputig the axiu queuig delay w usig the followig fixed-poit iteratio: w J k + τ bit w = ax( B, C ) + C k (2) T k hp( ) k where τ bit is the trasissio tie for a sigle bit, ad B is the blockig factor described below. Iteratio starts with a 0 suitable iitial value such as w = C, ad cotiues util +1 either w + C > E i which case the essage is ot +1 schedulable, or w = w i which case the essage is schedulable ad its worst-case respose tie is give by: +1 R = w + C (3) As CAN essage trasissio is o-pre-eptable, the trasissio of a sigle lower priority essage ca cause a delay of up to B (referred to as direct blockig) betwee essage beig queued ad the first tie that essage could be etered ito arbitratio o the bus. B represets the axiu blockig tie due to lower priority essages: B = ax ( C ) (4) k lp( ) Alteratively, i soe cases, the trasissio of the previous istace of essage could delay trasissio of a higher priority essage causig a siilar delay (referred to as push-through blockig 5 ) of up to C. Both direct ad push-through blockig are accouted for by the 1 st ter o the RHS of (2). The 2 d ter represets iterferece fro higher priority essages that ca wi arbitratio over essage ad so delay its trasissio. Note that oce essage starts successful trasissio it caot be preepted, so the essage s overall respose tie is siply the queuig delay plus its trasissio tie (give by (3)). Usig (2) ad (3), egieers ca deterie upper bouds 6 o worst-case respose ties ad hece the schedulability of all essages o a etwork coprisig solely PQ-odes. Although the aalysis ebodied i (2) ad (3) is pseudo-polyoial i coplexity i practice it is tractable o a desktop PC for coplex systes with hudreds of essages. (A uber of techiques are also available for icreasig the efficiecy of such fixed poit iteratios [15]). 4. Schedulability Aalysis with FIFO Queues I this sectio, we derive sufficiet schedulability aalysis for essages o etworks with both PQ-odes ad FQ-odes. The aalysis we itroduce is FIFO-syetric, by this we ea that the sae worst-case respose tie is 5 See [14] for a explaatio of why push-through blockig is iportat. 6 Equatio (2) is sufficiet rather tha exact due to the fact that push through blockig ay ot ecessarily be possible. k

5 attributed to all of the essages i a FIFO group. We ote that FIFO-syetric aalysis icurs soe pessiis i ters of the worst-case respose tie attributed to the higher priority essages i a FIFO group; however, i practice this pessiis is likely to be sall. This is because the order i which essages are placed i a FIFO queue is udefied, ad so i the worst case, the highest priority essage i a FIFO group has to wait for a istace of each lower priority essage i the group to be trasitted Priority-queued essages We ow derive a upper boud o the worst-case queuig delay for a priority-queued essage, i a syste with both PQ-odes ad FQ-odes. I the case of systes with oly PQ-odes, Davis et al. [14] showed that the worst-case queuig delay for a priorityqueued essage occurs for a istace of that essage queued at the begiig of a priority level- busy period 7 that starts iediately after the logest lower priority essage begis trasissio. Further, this axial busy period begis with a so-called critical istat where essage is queued siultaeously with all higher priority essages ad the each of these higher priority essages is subsequetly queued agai after the shortest possible tie iterval. Equatio (2) provides a sufficiet upper boud o this worst-case queuig delay. The aalysis ebodied i (2) assues that higher priority essages are able to copete for access to the bus (i.e. eter bus arbitratio) as soo as they are queued; however, this assuptio does ot hold for FIFO-queued essages. Istead a FIFO-queued essage k ay have to wait for up to a axiu tie f k before it becoes the oldest essage i its FIFO queue, ad ca eter prioritybased arbitratio. A FIFO-queued essage k ca therefore be thought of as becoig priority queued after a additioal delay of f k. Stated otherwise, i ters of its iterferece o lower priority essages, a FIFO-queued essage k ca be viewed as if it were a priority-queued essage with its jitter icreased by f k. (Note, we will retur to how f k is calculated for FIFO-queued essages later). A upper boud o the queuig delay for a priorityqueued essage ca therefore be calculated via the fixed poit iteratio give by (5). w J k f k + τ bit w = ax( B, C ) + C k (5) k hp( ) Tk As with (3), iteratio starts with a suitable iitial value such as w 0 = C +1, ad cotiues util either w + C > E i +1 which case the essage is ot schedulable, or w = w i which case its respose tie is give by: +1 R = w + C (6) Note that the queuig delay ad respose tie are oly valid with respect to the values of f k used. We retur to this poit later. 7 A priority level- busy period is a cotiguous iterval of tie durig which there is always at least oe essage of priority that has ot yet copleted trasissio FIFO-queued essages We ow derive a upper boud o the worst-case queuig delay for a FIFO-queued essage, i a syste with both PQ-odes ad FQ-odes. As our aalysis is FIFO-syetric, we will attribute the sae upper boud respose tie to all of the essages set by the sae FQ-ode. Our aalysis derives this sufficiet respose tie by cosiderig a arbitrary essage fro the FIFO group M (). For the sake of siplicity, we will still refer to this essage as essage ; however our aalysis will be idepedet of the exact choice of essage fro the FIFO group. At each stage i our aalysis we will ake worst-case assuptios, esurig that the derived respose tie is a correct upper boud. For exaple, we will frae our calculatio of the queuig delay w by assuig the lowest priority L of ay essage i the FIFO group. As every essage j i M () has D j T j the i a schedulable syste, whe ay arbitrary essage fro M () is queued, there ca be at ost oe istace of each of the other essages i M () ahead of it i the FIFO queue. The axiu trasissio tie of these essages, ad hece the axiu iterferece o a arbitrary essage, due to essages set by the sae FQ-ode, is therefore upper bouded by: SUM MIN C C (7) Idirect blockig could also occur due to the o-preeptive trasissio of a previous istace of ay oe of the essages i M (). This idirect blockig is upper MAX bouded by C. As a alterative, direct blockig could occur due to trasissio of ay of the essages of lower priority tha L set by other odes. Fially, i ters of iterferece fro higher priority essages set by other FQ-odes ad PQ-odes, the arguet about icreased jitter ade i the previous sectio applies, ad so the iterferece ter fro (5) ca agai be used. Cosiderig all of the above, a upper boud o the queuig delay for a arbitrary essage belogig to the FIFO group M () is give by the solutio to the followig fixed poit iteratio: + 1 MAX SUM w = ax( B, C ) + ( C C MIN ) + L w + J k + f k + τ bit Ck k hp L k M T k (8) ( ) ( ) Iteratio starts with a value of w 0 = ax( B, MAX L C ) SUM MIN + ( C C ) ad cotiues util either +1 MIN MIN w + C > E i which case the set of essages +1 M () is declared uschedulable, or w = w i which case all of the essages i M () are deeed to have a respose tie of: +1 MIN R = w + C (9) Equatios (8) ad (9) ake the worst-case assuptio that iterferece fro higher priority essages ca occur up MIN to a tie C before trasissio of essage copletes. We ote that this is a pessiistic assuptio with respect to those essages belogig to the FIFO group

6 that have trasissio ties 8 MIN loger tha C Schedulability test with arbitrary priorities We ow derive a schedulability test fro (5) & (6) ad (8) & (9). The basic idea is to avoid havig to cosider the potetially coplex iteractios betwee the FIFO queues of differet odes. This is achieved by abstractig the FIFO behaviour of essages set by other odes as siply additioal jitter f k before each essage k ca eter priority based arbitratio o the bus. Whe calculatig the respose tie of a give essage, we therefore eed oly cosider the behaviour of the ode that seds that essage (PQ-ode or FQ-ode) ad the bufferig delays of essages set by other odes 9. A upper boud o the bufferig tie f of a FIFOqueued essage is: MIN f = R C (10) 1 repeat = true 2 iitialise all f k = 0 3 while(repeat){ 4 repeat = false 5 for each priority, highest first{ 6 if ( is FIFO-queued){ 7 calc R accordig to Eqs (8) & (9) 8 if( R > E MIN ) { 9 retur uschedulable 10 } 11 if( f! = w ){ 12 f = w 13 repeat = true; 14 } 15 } 16 else { 17 calc R accordig to Eqs (5) & (6) 18 if( R > E ) { 19 retur uschedulable 20 } 21 } 22 } 23 } 24 retur schedulable Algorith 1: FIFO Syetric Schedulability Test Whe the priorities of essages i differet FIFO groups are iterleaved, this leads to a circular depedecy i the respose tie calculatios. For exaple, let ad k be the priorities of essages i two differet FIFO groups with iterleaved priorities (i.e. k hp( L ) ad hp( L k ) ). The respose tie R of essage k, ad hece its bufferig k 8 I practice all essages set o CAN ofte have the axiu legth (8 data bytes) so as to iiise the relative overheads of the other fields i the essage (ID, CRC etc). I this case, o additioal pessiis is itroduced by this assuptio. 9 If the essage belogs to a PQ-ode, the the other essages set by the sae ode have bufferig delays of zero, if it belogs to a FQ-ode, the the bufferig delays for other essages set by the sae ode are ot eeded i the calculatios (8) &(9). tie f k, deped o the bufferig tie f of essage as hp( L k ) ; however, the bufferig tie f of essage depeds o its respose tie R which i tur depeds o f k as k hp( L ). This apparet proble ca be solved by otig that the respose ties calculated via (5) & (6) ad (8) & (9) are ootoically o-decreasig with respect to the bufferig ties, ad that the bufferig ties give by (10) are ootoically o-decreasig with respect to the respose ties calculated via (8) & (9). Hece by usig a outer loop iteratio, ad repeatig respose tie calculatios util the bufferig ties o loger chage, we ca copute correct upper boud respose ties ad hece schedulability for all essages, as show i Algorith 1. (Note, to speed up the schedulability test, for each essage, the value of w coputed o oe iteratio of the while loop (lies 3 to 23) ca be used as a iitial value o the ext iteratio). Algorith 1 provides a sufficiet schedulability test for FIFO-queued ad priority-queued essages i ay arbitrary priority orderig Partial priority orderig withi a FIFO group I this sectio, we cosider a appropriate priority orderig for essages withi a FIFO group. Defiitio 2: A FIFO-adjacet priority orderig is ay priority orderig whereby all of the essages sharig a FIFO queue are assiged adjacet priorities. Theore 1: If a priority orderig Q exists that is schedulable accordig to the FIFO-syetric schedulability aalysis of Algorith 1 the a schedulable FIFO-adjacet priority orderig P also exists. Proof: Let be a FIFO-queued essage that is ot the lowest priority essage i its FIFO group. Now cosider a priority trasforatio whereby essage is shifted dow i priority so that it is at a priority level iediately above that of the lowest priority essage i its FIFO group. We will refer to the old priority orderig as Q ad the ew priority orderig as Q. We observe fro (5) ad (8), that give the sae fixed set of bufferig ties f k, the (i) the respose tie coputed for essage is the sae for both priority orderigs, ad (ii) the respose ties coputed for all other essages are o larger i priority orderig Q tha they are i priority orderig Q. Due to the utual ootoically o-decreasig relatioship betwee essage bufferig ties ad respose ties, ad the fact that Algorith 1 starts with all the bufferig ties set to zero, this eas that o every iteratio of Algorith 1, the respose ties ad bufferig ties coputed for each essage uder priority orderig Q are o larger tha those coputed o the sae iteratio for priority orderig Q. Hece if priority orderig Q is schedulable, the so is priority orderig Q. Applyig the priority trasforatio described above to every FIFO-queued essage that is ot the lowest priority essage i its FIFO group trasfors ay schedulable priority orderig Q ito a FIFO-adjacet priority orderig P, without ay loss of schedulability

7 Theore 1 tells us that regardless of the priority assiget applied to priority-queued essages, we should esure that all of the essages that share a sigle FIFO queue have adjacet priorities. I ters of CAN essage IDs we ote that this does ot require that cosecutive values are used for the IDs, oly that there is o iterleavig with respect to the priorities of other essages. I practice essage IDs ca be chose to eet these requireets, while also providig appropriate bit patters for essage filterig Schedulability test for FIFO-adjacet priorities I this sectio, we derive a iproved schedulability test that is oly valid for FIFO-adjacet priority orderigs. Recall that Davis et al. [14] showed that the worst-case queuig delay for a priority-queued essage occurs withi the priority level- busy period that starts with a critical istat. Provided that a FIFO-adjacet priority orderig is used, the the sae situatio also represets the worst-case sceario whe higher priority essages are set by either PQ-odes or FQ-odes. This ca be see by cosiderig the iterferece o a priority-queued essage fro a higher priority FIFO-queued essage k. As essage k is of higher priority tha essage, the so are all of the other essages i the sae FIFO group (i.e. M (k) ). Thus ay essage i M (k) that is queued prior to the start of trasissio of essage will be set o the bus before essage, irrespective of the order i which the essages i M (k) are placed i the FIFO queue. I effect all of the additioal jitter o essage k is already accouted for by iterferece o essage fro other essages i the sae FIFO group ( M (k) ). I this case, there is o additioal jitter o essage k caused by essages of lower priority tha. Hece for each FIFO essage k, we ca set f k = 0, ad use (5) & (6) to calculate the queuig delay ad worstcase respose tie of each essage. The sae arguet applies whe we cosider the schedulability of a FIFOqueued essage. I this case we ca use (8) & (9) to calculate the queuig delay ad worst-case respose tie, with all bufferig ties f k = 0. Further, as the bufferig ties are all fixed at zero, a sigle pass over the priority levels is all that is eeded to deterie schedulability. I other words, lies of Algorith 1 ca be oitted whe cosiderig FIFO-adjacet priority orderigs. This revised schedulability test therefore doiates the test give i sectio 4.3 (i.e. Algorith 1 with lies preset). The siplified aalysis give i this sectio is siilar to that provided for FP/FIFO schedulig of flows i [27] ad for OSEK/VDX tasks i [7], [23] Sufficiecy ad sustaiability of the FIFOsyetric schedulability tests I this sectio, we prove that treatig all of the essages i a FIFO queue as havig the lowest priority L of ay essage i that queue, leads to a worst-case respose tie that is o saller tha the actual worst-case respose tie of each essage. Thus, we show that the FIFO-syetric schedulability test give i Sectio 4.2, by (8) ad (9) (i.e. Algorith 1), is sufficiet i the case of a geeral priority orderig (Theore 2), ad also i the special case of a FIFO-adjacet priority orderig whe the bufferig delays are set to zero (Theore 3). We also show that the FIFOsyetric schedulability test is self-sustaiable [4] i these two cases (Theores 4 ad 5). Lea 1: Cosider a syste G coprisig a set of odes coected via a CAN bus, with a static set of hard real-tie essages set o the bus. We assue that the ode trasittig essage is a FQ-ode, which trasits a FIFO-group of essages M (), ad that essages fro all other odes are priority queued. Further, the priorities of the essages i the FIFO-group M () are arbitrary, with a lowest priority of L. Let H be a syste that is idetical to syste G, with the exceptio that all of the essages i the FIFO-group M () have priority L. The worst-case respose tie of each essage i M () i syste G is o greater tha the worst-case respose tie of the equivalet essage uder syste H. Proof: We prove a stroger hypothesis: that for ay valid sequece of essage releases, the respose tie of every istace of every essage i M () is o greater i syste G tha it is i syste H. We observe that for ay valid sequece of essage releases, the duratio of each priority level L busy period (durig which there are ready essages of priority L or higher) is the sae i both systes. This is the case because fixed priority o-pre-eptive schedulig is workcoservig, essage release ties are the sae i both systes, ad the oly differece betwee the is the priority orderig of essages with priorities o lower tha L. As a cosequece, the ties at which essages with priorities lower tha L start to be trasitted are the sae i both systes. Note the order i which essages of priority L ad higher are set i a priority level L busy period ay be differet i the two systes. We prove the hypothesis by cotradictio: For soe arbitrary sequece of essage releases, let x be the first istace of a essage i M () with a loger respose tie i syste G tha it has i syste H. To copare the respose ties of essage istace x i the two systes, we eed oly cosider the priority level L busy period that cotais trasissio of x. Let t be the start of this busy period. The tie s at which x starts to be trasitted i syste H is give by: s = t + B + CP( t) + I ( t) (11) k k hp( L ) k M ( ) where B is blockig due to a lower priority essage (if ay) that starts trasissio at the start of the busy period, CP (t) is the total trasissio tie for istaces of essages i M () released durig the busy period prior to the release of x, ad I k (t) is the total trasissio tie of istaces of higher priority essage k released durig the busy period, prior to tie s. As (11) holds for syste H, it ust be the case i syste G that x ca start trasissio o later tha s, as its priority is o lower tha L. This cotradicts the hypothesis that x is the first istace of a essage i M ()

8 with a loger respose tie i syste G tha it has i syste H. Hece there ca be o such istace x Theore 2: The FIFO-syetric schedulability test give i Sectio 4.2, (8) ad (9), is sufficiet. Proof: Lea 1 shows that the worst-case respose ties for a set of FIFO-queued essages M () with arbitrary priorities, the lowest of which is L, are upper bouded by the worst-case respose ties of those sae essages coputed for a syste that is equivalet except for the fact that all of the essages i M () have priority L. Sufficiet values for the worst-case respose ties of FIFOqueued essages ay therefore be calculated accordig to these assuptios as described i Sectio 4.2. Note that the assuptio that all essages set by other odes are priority queued is dealt with by Equatio (8) via odellig each essage k set by aother FQ-ode as a priority queued essage with release jitter icreased by the bufferig delay f k Lea 2: Whe priorities are i FIFO-adjacet priority order, the the worst-case respose tie for a essage k occurs durig a priority level-k busy period startig at a critical istat where all of the essages fro higher priority FIFO-groups ad priority queued essages set by other odes are queued siultaeously just after a lower priority (blockig) essage begis trasissio (i.e. the sae critical istat as the priority-queued case). Proof: With FIFO-adjacet priority orderig, the if k lp( L ), the all of the essages i M () have a higher priority tha essage k. Thus all ready essages i M () ust be set prior to the start of trasissio of essage k. It follows that the worst-case iterferece fro essages i M () occurs whe all of those essages are queued siultaeous at the start of a priority level-k busy period ad are queued agai as soo as possible. Further, with FIFO-adjacet priority orderig, at ay give tie there ca be o essages of priority higher tha k that are ready, but waitig i a queue behid a essage of priority k or lower. Hece iediately prior to the start of a priority level-k busy period there ca be o ready (previously queued) essages of priority k or higher, ad so there ca be o additioal jitter / bufferig delays that eed to be accouted for. The worst-case sceario for iterferece fro FIFO-queued essages set by other odes is therefore the sae as the priority-queued case. (Note that bufferig delays ca still occur, but their oly effect is to re-order the trasissio of essages i M (), without chagig the overall iterferece o essage k) Theore 3: With a FIFO-adjacet priority orderig, the FIFO-syetric schedulability test give i Sectio 4.2, (8) ad (9), is sufficiet with the bufferig delays set to zero. Proof: Follows directly fro Lea 2 ad aalysis of the priority queued case Theore 4: With a FIFO-adjacet priority orderig, the FIFO-syetric schedulability test of sectio 4.5 (Algorith 1 with lies oitted) is self-sustaiable [4]. Meaig that ay set of essages deeed schedulable by the test will also be deeed schedulable by the test if those essages are odified by: (i) decreasig trasissio ties, (ii) icreasig periods or iter-arrival ties, ad (iii) icreasig deadlies. Proof: The proof is i three parts: (i) Decreasig trasissio ties. Proof of this aspect of self-sustaiability follows fro the fact that the queuig delay w of essage, give by (5) ad (8), is oicreasig with respect to ay decrease i the trasissio tie of essage or ay other essages. Note that i (8), MIN the trasissio tie C of the shortest essage i the FIFO queue caot becoe saller by a aout x without at least a equivalet reductio i the su of the essage SUM trasissio ties C, hece the value of SUM MIN C C caot icrease. Fro (6) ad (9), it follows that the essage respose tie R is also o-icreasig with respect to a decrease i essage trasissio ties, ad so the test is self-sustaiable with respect to reductios i essage trasissio ties. (ii) Icreasig periods or iter-arrival ties. As essage periods appear oly i the deoiator of the ceilig fuctios i (5) ad (8), icreases i these values caot result i a icrease i essage queuig delays or respose ties. Hece the test is self-sustaiable with respect to icreases i essage periods. (iii) Icreasig deadlies. As icreases i essage deadlies MIN ca oly icrease the trasissio deadlies E ad E, such icreases caot result i a essage that was previously schedulable accordig to the test becoig uschedulable accordig to the test. Hece the test is selfsustaiable with respect to icreases i essage deadlies Theore 5: The FIFO-syetric schedulability test of sectio 4.5 (Algorith 1 with lies preset) is selfsustaiable [4] i the geeral case with a arbitrary priority orderig. Proof: Follows fro the proof of Theore 4, otig that the bufferig delay f is equal to the queuig delay w (see (9) ad (10)), ad so f is also o-icreasig with respect to ay decrease i essage trasissio ties, or icrease i essage periods. Note that the proof of Theore 5 does ot require ay chages to the priority order of the essages. They will still reai schedulable accordig to the FIFO-syetric schedulability test with the origial priority orderig. 5. Priority Assiget Policies The schedulability test preseted i sectio 4.5 is applicable irrespective of the overall priority orderig, provided that essages sharig the sae FIFO queue are assiged adjacet priorities. Choosig a appropriate priority orderig aog the priority-queued essages ad the FIFO groups is however a iportat aspect of achievig overall schedulability ad hece effective realtie perforace. I this sectio, we cosider the assiget of essages to priority bads, where a priority bad coprises either a

9 sigle priority level cotaiig oe priority-queued essage, or a uber of adjacet priority levels cotaiig a FIFO group of essages. We derive priority assiget policies that are optial with respect to the schedulability aalysis give i sectio Optial priority assiget Davis et al. [14], showed that, assuig solely priority queuig, Audsley s Optial Priority Assiget (OPA) algorith [1], [3] provides the optial priority assiget for CAN essages. We ow show that with a appropriate odificatio to hadle FIFO groups, Audsley s algorith is also optial with respect to the schedulability test give i sectio 4.5. The pseudo code for this OPA-FP/FIFO algorith is give i Algorith 2. Note that oly oe essage fro each FIFO group is cosidered i the iitial list, as oce this essage is assiged to a priority bad, the so are the other essages i the sae FIFO group. for each priority bad k, lowest first { for each essage sg i the iitial list { if sg is schedulable i priority bad k accordig to schedulability test S with all uassiged priorityqueued essages / other FIFO groups assued to be i higher priority bads { assig sg to priority bad k if sg is part of a FIFO group { assig all other essages i the FIFO group to adjacet priorities withi priority bad k } break (cotiue outer loop) } } retur uschedulable } retur schedulable Algorith 2: Optial Priority Assiget (OPA-FP/FIFO) I [17] Davis ad Burs showed that Audsley s OPA algorith is optial with respect to ay schedulability test that eets three specific coditios. Accordig to Theore 1, we eed oly cosider the priority bads assiged to each priority-queued essage, ad each FIFO group (as all essages i a FIFO group have adjacet priorities i a optial priority orderig). We therefore restate these three coditios i the cotext of priority-queued essages ad FIFO groups. The three coditios refer to properties or attributes of the essages. Message properties are referred to as idepedet if they have o depedecy o the priority assiged to the essage. For exaple the logest trasissio tie, deadlie, ad iiu iter-arrival tie of a essage are all idepedet properties, while the worstcase respose tie typically depeds o the essage s priority ad so is a depedet property. Coditio 1: The schedulability of a essage / FIFO group idetified by, ay, accordig to test S, deped o ay idepedet properties of other essages / FIFO groups i higher priority bads tha, but ot o ay properties of those essages / FIFO groups that deped o their relative priority orderig. Coditio 2: The schedulability of a essage / FIFO group idetified by ay, accordig to test S, deped o ay idepedet properties of the essages / FIFO groups i lower priority bads tha, but ot o ay properties of those essages / FIFO groups that deped o their relative priority orderig. Coditio 3: Whe the priorities of ay two adjacet priority bads are swapped, the the essage / FIFO group beig assiged the higher priority bad caot becoe uschedulable accordig to test S, if it was previously schedulable i the lower priority bad. (As a corollary, the essage / FIFO group beig assiged the lower priority bad caot becoe schedulable accordig to test S, if it was previously uschedulable i the higher priority bad). Theore 6: The OPA-FP/FIFO algorith is a optial priority assiget algorith with respect to the FIFOsyetric schedulability test of sectio 4.5 (Algorith 1 with lies oitted). Proof: It suffices to show that coditios 1-3 hold with respect to the schedulability test give by Algorith 1 with lies oitted. Coditio 1: Ispectio of (5) & (6) ad (8) & (9), assuig all f k are fixed at zero, shows that the respose tie of each essage is depedet o the set of essages i higher priority bads, but ot o their relative priority orderig. Coditio 2: Ispectio of (5) & (6) ad (8) & (9), shows that the respose tie of each essage is depedet o the set of essages i lower priority bads via the direct blockig ter, but ot o their relative priority orderig. Coditio 3: Ispectio of (5) & (6) ad (8) & (9), assuig all f k are fixed at zero, shows that icreasig the priority bad of essage caot result i a loger respose tie. This is because although the direct blockig ter ca get larger with icreasig priority this is always couteracted by a decrease i iterferece that is at least as large; hece the legth of the queuig delay caot icrease with icreasig priority, ad so either ca the respose tie For N priority-queued essages / FIFO groups, the OPA-FP/FIFO algorith perfors at ost N(N-1)/2 schedulability tests ad is guarateed to fid a schedulable priority assiget if oe exists. It does ot however specify a order i which essages should be tried i each priority bad. This order heavily iflueces the priority assiget chose if there is ore tha oe orderig that is schedulable. I fact, a poor choice of iitial orderig ca result i a priority assiget that leaves the syste oly just schedulable. We suggest that, as a useful heuristic, priority-queued essages ad FIFO groups are tried at each priority level i order of trasissio deadlie (i.e. E or MIN E ), largest value first. This will result i a priority orderig reflectig trasissio deadlies if such a orderig is schedulable. Alteratively, approaches which

10 result i a robust priority assiget ca be developed fro the techiques described i [16] TDMO-FP/FIFO priority assiget I idustrial practice, CAN cofiguratios are ofte desiged such that all of the essages are of the sae axiu legth (8 data bytes). This is doe to aeliorate the effects of the large overhead of the other fields (arbitratio, CRC etc) i each essage. Defiitio 3: Trasissio deadlie ootoic priority orderig for FP/FIFO (TDMPO-FP/FIFO) is a priority assiget policy that assigs priority bads to priority queued essages ad FIFO groups accordig to their trasissio deadlies; with a shorter trasissio deadlie iplyig a higher priority. (Recall that the trasissio deadlie of a FIFO group is give by the shortest trasissio deadlie of ay essage i that group). Figure 1 illustrates the TDMPO-FP/FIFO priority assiget policy. I this sectio, we show that the TDMPO-FP/FIFO priority assiget policy is optial, with respect to the sufficiet schedulability test give i sectio 4.5 (i.e. Algorith 1 with lies oitted) whe all essages have the sae worst-case trasissio tie (C). Corollary 1: For etworks where all of the essage trasissio ties are the sae, the the blockig factor, used i both the sufficiet schedulability test give by Davis et al. i [14] (recapitulated i sectio 3) ad the sufficiet schedulability tests give i sectio 4 of this paper, is the sae for every essage, ad is equal to the worst-case essage trasissio tie (C). Lea 3: Let i ad j be the idices of two adjacet priority bads i a priority orderig that is schedulable accordig to the sufficiet schedulability test give i sectio 4.5 (i.e. Algorith 1 with lies oitted). Assue that i is of higher priority tha j, ad that the trasissio deadlie E X of the priority-queued essage / FIFO group (X) iitially i priority bad i is loger tha the trasissio deadlie E Y of priority-queued essage / FIFO group (Y) iitially i priority bad j. If the priorities of X ad Y are swapped, so that X is i the lower priority bad j, ad Y is i the higher priority bad i, the X reais schedulable, provided that the set of essages all have the sae worstcase trasissio tie (C). Proof: Let R Y, j be the respose tie of Y i priority bad j, (with X i the higher priority bad i). Siilarly, let R X, j be the respose tie of X i priority bad j, (with Y i the higher priority bad i). As Y is schedulable whe it is i the lower priority bad, the, RY, j EY, thus as E Y < E X, it follows that to prove the Lea, we eed oly show that R X, j RY, j. Further, as all essages have the sae worstcase trasissio tie (C), ad so the respose ties are equal to the queuig delays plus C, we eed oly copare the two queuig delays, referred to for coveiece as w X, j ad w Y, j. Below we give forulae for w X, j ad w Y, j based o (5) & (6) ad (8) & (9). We have separated out the iterferece ters for X ad Y. Further, we use B ( j) to represet the blockig factor, ad I ( i, w) to represet the iterferece fro essages i higher priority bads. B( j) = ax( B j, C) = C w + J k + τ bit I i w C k hp i Tk (, ) = ( ) (i) Queuig delay w X, j (siplified by cacellig out the blockig factor C ad the C fro ( C X SUM C )) is give by: w 1 X, j + J k + τ + SUM bit w X, j = C X + C + I( i, w) (12) k Y T k Note, i (12), if X is a priority-queued essage, the C SUM X = C, also, if Y is a priority-queued essage, the there is oly oe essage k Y preset i the suatio ter; siilarly for (13) below. (ii) Queuig delay w Y, j : w 1 Y, j + J k + τ + SUM bit wy, j = CY + C + I( i, w) (13) k X T k We ca siplify (13) by otig that as Y is schedulable accordig to the assuptio give i the Lea, the it ust be the case that: R = w + C E < E = i( D J ) i( T J ) Y, j Y, j Y X k k X k k k X As C > τ bit, we have w Y, j + J k + τ bit < Tk ad so the ceilig fuctio i (13) evaluates to at ost oe; idicatig that at ost oe istace of each essage i X ca cotribute to the iterferece ter. Hece (13) siplifies to: + 1 SUM SUM wy, j = CY + C X + I( i, w) (14) Now let us cosider the iterative solutio to (12), for all values of w E C < i( T J ) τ X, j Y k k bit, k X I this case, as C > τ bit, we have w X, j + J k + τ bit < Tk ad so the ceilig fuctio i (12) evaluates to at ost oe; idicatig that at ost oe istace of each essage i Y ca cotribute to the iterferece ter. Hece, provided that wx, j EY C, the (12) reduces to: + 1 SUM SUM wx, j = C X + CY + I( i, w) (15) The right had sides of (14) ad (15) are the sae. As we kow that (14) coverges o a value wy, j EY C, the (15) ust coverge o the sae value, hece w X, j = wy, j, ad so R X, j = RY, j Theore 7: TDMPO-FP/FIFO is a optial policy for assigig priority-queued essages ad FIFO groups to priority bads, with respect to the sufficiet schedulability test give i sectio 4.5 (Algorith 1 with lies oitted), provided that all essages have the sae worstcase trasissio tie. Proof: We prove the theore by showig that ay orderig Q of priority bads that is schedulable accordig to the sufficiet schedulability test give i sectio 4.5 ca be k