Resource Scheduling in Dependable Integrated Modular Avionics

Transcription

1 Resource Schedulng n Dependable Integrated Modular Avoncs Yann-Hang Lee and Daeyoung Km Real Tme Systems Research Laboratory CISE Department, Unversty of Florda {yhlee, dkm}@cse.ufl.edu Mohamed Youns, Jeff Zhou, James McElroy Honeywell Internatonal Inc. {mohamed.youns, jeff.zhou, Abstract In the recent development of avoncs systems, Integrated Modular Avoncs (IMA) s advocated for next generaton archtecture that needs ntegraton of mxedcrtcalty real-tme applcatons. These ntegrated applcatons meet ther own tmng constrants whle sharng avoncs computer resources. To guarantee tmng constrants and dependablty of each applcaton, an IMA-based system s equpped wth the schemes for spatal and temporal parttonng. We refer the model as SP-RTS (Strongly Parttoned Real-Tme System), whch deals wth processor parttons and communcaton channels as ts basc schedulng enttes. Ths paper presents a partton and channelschedulng algorthm for the SP-RTS. The basc dea of the algorthm s to use a two-level herarchcal schedule that actvates parttons (or channels) followng a dstance-constrants guaranteed cyclc schedule and then dspatches tasks (or messages) accordng to a fxed prorty schedule. To enhance schedulablty, we devsed heurstc algorthms for deadlne decomposton and channel combnng. The smulaton results show the schedulablty analyss of the two-level schedulng algorthm and the benefcal characterstcs of the proposed deadlne decomposton and channel combnng algorthms. 1. Introducton Advances n computer and communcaton technology have ntroduced new archtectures for avoncs systems, whch emphasze the ntegraton of applcatons, dependablty, and cost reducton. Away from the tradtonal federated mplementaton for avoncs systems, the new approach, referred to as Integrated Modular Avoncs (IMA) [1], utlzes multple standardzed processor modules n buldng functonal components of avoncs systems. It allows the applcatons to be merged nto an ntegrated system. Whle permttng resource sharng, the approach employs temporal and spatal parttonng to set up the applcaton boundares needed to mantan system predctablty, real-tme response, and dependablty [2, 6]. For the nteractons between applcatons, t adopts a message model that can easly accommodate replcated executons of msson-crtcal applcatons. Under the IMA archtecture, each processor can host multple parttons n whch applcatons can be executed usng the assgned resources. Spatal parttonng mples that a partton cannot access other partton s resources, lke memory, buffers, and regsters. On the other hand, temporal parttonng guarantees a partton s monopoly use of a pre-allocated processng tme wthout any nterventon from other parttons. Thus, a partton s the sole owner of ts resources, such as memory segments, I/O devces, and processor tme slots. As a result, the applcatons runnng n dfferent parttons cannot nterfere wth each other. To facltate communcatons between applcatons, each partton can be assgned wth one or more communcaton channels. An applcaton can transmt messages durng the slots allocated to ts channel and access exclusvely the channel buffers. In ths sense, the channels are spatal and temporal parttons of communcaton resource and are dedcated to one message-sendng applcaton. An applcaton runnng wthn a partton can be wth multple cooperatng tasks. For nstance, the Honeywell s Enhanced Ground Proxmty Warnng System (EGPWS) conssts of tasks for map loadng, terran threat detecton, alert prortzaton, dsplay processng, etc. Wth the spatal and temporal parttonng, the EGPWS applcaton can be developed separately and then ntegrated wth other applcatons runnng n dfferent parttons of an IMA-based system. Its executon cannot be affected by any malfunctons of other applcatons (presumably developed by other manufactures) va wld wrtes or task overruns. However, suffcent resources must be allocated to the partton and the channels, so that the EGPWS applcaton can ensure a proper executon and meet ts real-tme constrants. One apparent advantage of IMA-based systems wth spatal and temporal parttonng s that each applcaton s runnng n ts own envronment. Thus, as long as the

2 partton envronment s not changed, an applcaton s behavor remans constant even f other applcatons are modfed. Ths leads to a crucal advantage to avoncs systems,.e. when one applcaton s revsed, other applcatons don t need to be re-certfed by the FAA. Thus, the ntegraton of applcatons n a complex system can be upgraded and mantaned easly. It s concevable that such archtecture wth spatal and temporal parttonng can be useful for ntegratng general real-tme applcatons, and wll be referred to as a strongly parttoned real-tme system (SP-RTS) n the paper. In ths paper, we nvestgate the ssues related to the partton and channel schedulng n SP-RTS. To schedule processor executon, we need to determne whch partton s actve and to select a task from the actve partton for executon. Accordng to temporal parttonng, tme slots are allocated to parttons. Wthn each partton, fxed prortes are assgned to tasks based on rate-monotonc or deadlne-monotonc algorthms [14, 5]. A lower prorty task can be preempted by hgher prorty tasks of the same partton. In other words, the schedulng approach s herarchcal that parttons are scheduled followng a cyclc schedule and tasks are dspatched accordng to a fxed prorty schedule. We can conjecture a real system where parttons are processes wth protected memory spaces and tasks are threads n a process. At process level, a cyclc schedulng s employed, whereas, n thread level, thread prortes are compared. The scheme doesn t need to make a global prorty comparson between threads of dfferent processes. Smlar herarchcal schedulng s also appled to the communcaton meda where channels are scheduled n a cyclc fashon and have enough bandwdth to guarantee message communcaton. Wthn each channel, messages are then ordered accordng to ther prortes for transmsson. Gven task executon characterstcs, we are to determne the cyclc schedules for parttons and channels under whch the computaton results can be delvered before or on the task deadlnes. The problem dffers from the typcal cyclc schedulng snce, at the partton and channel levels, we don t evaluate the nvocatons for each ndvdual task or message. Only aggregated task executon and message transmsson models are consdered. In addton, the schedulng for parttons and channels must be done collectvely such that tasks can complete ther computaton and then send out the results wthout mssng any deadlnes. A dfferent two-level herarchcal schedulng scheme has been proposed by Deng and Lu n [8]. The scheme allows real-tme applcatons to share resources n an open envronment. The schedulng structure has an earlestdeadlne-frst (EDF) schedulng at the operatng system level. The second level schedulng wthn each applcaton can be ether tme-drven or prorty-drven. For acceptance test and admsson of a new applcaton, the scheme analyzes the applcaton schedulablty at a slow processor. Then, the server sze s determned and server deadlne of the job at the head of the ready queue s set at run-tme. Snce the scheme does not rely on fxed allocaton of processor tme or fne-gran tme slcng, t can support varous types of applcatons, such as release tme jtters, non-predctable schedulng nstances, and strngent tmng requrements. The schedulng approach for avoncs applcatons under the APEX nterface of IMA archtecture was dscussed by Audsley and Wellngs [4]. A recurrent soluton to analyze task response tme n an applcaton doman s derved and the evaluaton results show that there s a potental for a large amount of release jtter. However, the paper does not address the ssues of constructng cyclc schedules at the operatng system level. To remedy the problem, our frst step s to establsh schedulng requrements for the cyclc schedules such that task schedulablty under a gven fxed prorty schedules wthn each partton can be ensured. The approach we adopt s smlar to the one n [8] of comparng the task executon n SP-RTS envronment wth that at a dedcated processor. The cyclc schedule then tres to allocate partton executon ntervals by stealng task nactvty perods. Ths stealng approach resembles the slack stealer for schedulng soft-aperodc tasks n fxed prorty systems [11]. Once the schedulablty requrements are obtaned, sutable cyclc schedules can be constructed. Followng the parttonng concept of IMA, the operatng system level cyclc schedule s flexble to support system upgrade and ntegraton. It s desgned n a way that no complete revson of schedulng algorthms s requred when the workload or applcaton tasks n one partton are modfed. The rest of the paper s organzed as follows. In secton 2, we descrbe the system models that descrbe tasks, partton servers, messages, and channel servers n SP- RTS. Then, we show the overall system schedulng algorthm and ts specfc components, such as deadlne decomposton, task and message schedulablty checkng, channel combnng, and cyclc schedulng for partton servers and channel servers n secton 3. Evaluaton results are presented n secton 4. A concluson s then gvennsecton5. 2. System Models The SP-RTS system model, as shown n Fgure 1, ncludes multple processors nter-connected by a tme dvson multplexng communcaton bus such as ARINC 659 [3]. Each processor has several executon parttons to whch applcatons can be allocated. An applcaton conssts of multple concurrent tasks that can communcate wth each other wthn the applcaton partton. executon s subject to deadlnes. Each

3 task must complete ts computaton and send out the result messages on tme n order to meet ts tmng constrants. Messages are the only form of communcaton among applcatons, regardless of whether ther executon parttons are n the same processor or not. For nterpartton communcaton, the bandwdth of the shared communcaton meda s dstrbuted among all applcatons by assgnng channels to a subset of tasks runnng n a partton. We assume that there are hardware mechansms to enforce the partton envronment and channel usage by each applcaton, and to prevent any unauthorzed accesses. Thus, task computaton and message transmsson are protected n ther applcaton doman. The mechansms could nclude memory protecton controller, slot/channel mappng, and separate channel buffers. Node 1 Partton C Cyclc CPU Scheduler Computaton deadlne CD Partton perod T deadlne D Message deadlne MD Fgure 2. model and deadlnes In our task model, we assume that each task arrves perodcally and needs to send an output message after ts computaton. Thus, as llustrated n Fgure 2, tasks are specfed by several parameters, ncludng nvocaton perod (T ), worst-case executon tme (C ), deadlne (D ) and message sze (M ). Note that, to model sporadc tasks, wecanassgntheparametert as the mnmum nterarrval nterval between two consecutve nvocatons. In order to schedule tasks and messages at processors and communcaton channels, the task deadlne, D, s decomposed nto message deadlne (MD ) and Cyclc Bus Scheduler M Node n Cyclc CPU Scheduler Partton Fgure 1. The archtecture model for strongly parttoned real-tme systems (SP-RTS) computaton deadlne (CD ). The assgnment of message deadlnes nfluences the bandwdth allocaton for the message. For example, when the message sze, M,s1K slots, and the message deadlne of 10ms, then the bandwdth requrement s 0M slots per second. In the case of the 1ms message deadlne, the bandwdth requrement becomes 1M slots per second. However, a tradeoff must be made snce a long message deadlne mples a less amount of bandwdth to be allocated, thus the task computaton has to be completed mmedately. For each processor n SP-RTS archtecture, the schedulng s done n a two-level herarchy. The frst level s wthn each partton server where the applcaton tasks are runnng and a hgher prorty task can preempt any lower prorty tasks of the same partton. The second level s a cyclc partton schedule that allocates executon tme to partton servers of the processor. In other word, each partton server, S k, s scheduled perodcally wth a fxed perod. We denote ths perod as the partton cycle, η k. For each partton cycle, the server can execute the tasks n the partton for an nterval α k η k where α k s less than or equal to 1 and s called partton capacty. Forthe remanng nterval of (1-α k )η k, the server s blocked. In Fgure 3, an example executon sequence of a partton that conssts of three tasks s depcted. Durng each partton cycle, η k,thetasks,τ 1, τ 2, and τ 3, are scheduled to be executed for a perod of α k η k. If there s no actve task n the partton, the processor s dle and cannot run any actve tasks from other parttons. η k τ 1 τ 2 τ 2 τ 3 τ 1 τ 1 τ 3 dle τ 2 τ 1 τ 2 α k η k Fgure 3. An llustratve task and partton executon sequence Smlarly, a two-level herarchcal schedulng method s appled to the message and channel schedulng. A channel server provdes fxed-prorty preemptve schedulng for messages. Then, a cyclc schedule assgns a sequence of communcaton slots to each channel server accordng to ts channel cycle, µ k, and channel capacty, β k. A channel may send out messages usng β k µ k slots durng every perod of µ k slots. Note that we use the unt of slot to ndcate both message length and transmsson tme, wth an assumpton that communcaton bandwdth and slot length are gven. For nstance, a 64-bt slot n the 30MHz 2-bt wde ARINC 659 bus [3] s equvalent to µs, and a message of 1000 bytes wll be transmtted n 125 slots. For convenence purposes, we defne the converson factors ST as a slot-to-tme rato based on slot length and bus bandwdth.

4 3. Schedulng Approach The objectve of our schedulng approach s to fnd feasble cyclc schedules for partton and channel servers whch process tasks and transmt messages accordng to ther fxed prortes wthn the servers. Wth proper capacty allocaton and frequent nvocaton at each server, the combned delays of task executon and message transmsson are bounded by the task deadlnes. In Fgure 4, we show the overall approach whch frst apples a heurstc deadlne decomposton to dvde the problem nto two parts: partton-schedulng and channelschedulng. If ether one cannot be done successfully, the approach terates wth a modfed deadlne assgnment. We also assume that the ntal task set mposes a processor utlzaton and a bus utlzaton less than 100% and each task s deadlne s larger than ts executon tme plus ts message transmsson tme,.e., D C +ST M for task. fal cannot combne and message deadlne assgnment Determne partton capactes and cycles succeed Processor cyclc schedulng server ntalzaton and combnng Determne channel capactes and cycles succeed Communcaton slot allocaton 3. Deadlne Decomposton It s necessary to decompose the orgnal task deadlne, D, nto computaton and message deadlne, CD and MD, for every task, before we can schedule the servers for partton executon and message transmsson. A deadlne decomposton algorthm s used to assgn these deadlnes n a heurstc way. If we assgn tght message deadlnes, messages may not be schedulable. Smlarly, f tasks have tght deadlnes, processor schedulng can fal. The followng equaton s used to calculate the message deadlne and computaton deadlne for each task: fal Integrated schedule Fgure 4. Combned partton and channel schedulng approach ST M Message Deadlne, MD = ( D ) f C + ST M Computaton Deadlne, CD = D MD where f s an adjustng factor for each task. The man dea of deadlne decomposton s that t allocates the deadlnes, CD and MD, proportonally to ther tme requrements needed for task executon and message transmsson. In addton, the adjustng factor f s used to calbrate the computaton and message deadlnes based on the result of prevous schedulng attempts and the utlzaton at processor and communcaton bus. Snce the message and task deadlnes must be lower-bounded to the transmsson tme (ST M ) and computaton tme (C ), respectvely, and upper-bounded to D, we can obtan the lower bound and upper bound of the adjustng factor f as D ( C ST M f ) D C ST M D ( C + ST M Snce an adjustng factor of 1.0 s a far dstrbuton and always ncluded n the range of f,wesetthental value of f to be 1. The heurstc deadlne decomposton, as show n Fgure 5, s smlar to a bnary search algorthm n the attempt of fndng the rght proporton of task and message deadlnes. If we reach the stuaton that t cannot assgn new value for all tasks, we declare the nput set of tasks as unschedulable. Intalzaton for all tasks MnF = 1 / (D *(1/(C k +ST M k ))); MaxF = (D -C )/(D *(ST M /(C +ST M ))); f =1.0; Iteratve change of f k when ether partton or channel schedulng fals If (Partton schedulng fals) { MaxF = f ;f =(MnF+f ) / 2.0; } else f ( schedulng fals) { MnF = f ;f =(MaxF+f ) / 2.0; } Fgure 5. The deadlne decomposton algorthm 3.2. Partton and Schedulng In SP-RTS, parttons and channels are cyclcally scheduled. The partton cyclc schedule s based on partton cycle, η k, and partton capacty, α k. Smlarly, a channel cyclc schedule wth parameters, β k and µ k mples that the channel can utlze β k µ k slots durng a )

5 perod of µ k slot nterval. Whle tasks and messages are scheduled accordng to ther prorty wthn the perodc servers, the cyclc schedule determnes the response tme of task executon and message transmsson. In ths subsecton, we gve a short descrpton of the schedulng theory that can be used to schedule the cyclc partton and channel servers. A full dscusson of the schedulng theory and the assocated proof are gven n our prevous paper [10]. Note that, at the system level, the partton server S k s cyclcally scheduled wth a fxed partton cycle, η k. For every partton cycle, the server can execute the task n partton P k durng an nterval of α k η k where α k 1. For the remanng nterval of (1-α k )η k, the server s blocked. Suppose that there are n tasks n partton server S k lsted n prorty order such that τ 1 < τ 2 < τ 3 < <τ n where τ 1 has the hghest prorty and τ n the lowest. Accordng to deadlne monotonc algorthm, we assume that the hghest prorty s gven to the task wth shortest task deadlne. In order to evaluate the schedulablty of the partton server, S k, we frst consder that the task set s executed at a dedcated processor of capacty α k. Based on the necessary and suffcent condton of schedulablty analyss [12, 13], task τ s schedulable f there exsts a t! H ={CD lt j j=1,2,,-1; l=1,2,, "CD /T j # }such that: C j t W ( α k, t) = t j=1 α k T j The expresson W (α k,t)ndcates the worst cumulatve executon tme demand on the processor made by the tasks wth a prorty hgher than or equal to τ durng the nterval [0,t]. We now defne B (α k )=max t! H {t W (α k,t)}and B 0 (α k )=mn =1,2,..n B (α k ),wheren s the total number of tasks n the partton. Note that, when τ s schedulable, B (α k ) represent the total perod n the nterval [0, t] that the processor s not runnng any tasks wth a prorty hgher than or equal to that of τ n the partton server. B (α k ) s equvalent to the level- nactvty perod n the nterval [0, t] [11]. By comparng the task executons at server S k and at a dedcated processor of capacty α k, we can obtan the followng theorem [10]. Theorem 1. The partton server S k s schedulable f S k s schedulable at a dedcated processor of capacty α k, and η k B 0 (α k )/(1-α k ) Note that B 0 (α k ) s a non-decreasng functon of α k. There s a mnmum α k such that B 0 (α k ) equals to zero,.e., a zero nactve perod for at least one task n the partton. The mnmum α k ndcates the mnmum processor capacty needed to schedule the partton. Thus, partton schedulng can fal f the sum of the mnmum α k, for all parttons n a processor, s larger than 1. Wth Theorem 1, we can depct the plot of maxmum partton cycle vs. the assgned capacty α k. To llustrate the result, we consder an example n Table 1 n whch four applcaton parttons are allocated n a processor. Each partton conssts of several perodc tasks and the correspondng parameters of (C, T ) are lsted n the Table. s are set to have deadlnes equal to ther perods and are scheduled wthn each partton accordng to a rate-monotonc algorthm. The processor utlzaton demanded by the 4 parttons, ρ k, are 0.25, 05, 0.27, and 0.03, respectvely. Table 1. parameters for the example parttons tasks (C,T ) tasks (C,T ) Partton 1 (utlzaton=0.25) (4, 100) (9, 120) (7, 150) (15, 250) (10, 320) Partton 3 (utlzaton=0.27) (7,80) (9,100) (16,170) Partton 2 (utlzaton=05) (2, 50) (1, 70) (8, 110) (4, 150) Partton 4 (utlzaton=0.03) (1,80) (2,120) In Fgure 6, the curves η k =B 0 (α k )/(1-α k ) are plotted for the example 4 parttons. If the ponts below the curves are chosen to set up cyclc schedulng parameters for each partton, the tasks n the partton are guaranteed to meet ther deadlnes. Partton Cycle Partton 1 Partton 2 Partton 3 Partton Fgure 6. Partton Cycles vs. Processor Capactes for the Example Parttons For nstance, the curve for partton 2 ndcates that, f the partton receves 28% of processor capacty, then ts α

6 tasks are schedulable as long as ts partton cycle s less than or equal to 59 tme unts. Note that the maxmum partton cycles ncrease as we assgn more capacty to each partton. Ths ncrease s governed by the accumulaton of nactvty perod when α k s small. Then, the growth follows by a factor of 1/(1-α k )foralargerα k. The curves n Fgure 6 show that there are sharp rses of the maxmum partton cycle when we ncrease α k just beyond the mnmum requred capactes. The rses ndcate that a small amount of extra capacty can enlarge the nactve perod of a partton server sgnfcantly. Accordng to the desgn objectves, there are several methods we can use to choose a set of (α k, η k )forall partton servers. For nstance, we can calculate the mnmum α k frst. If the sum of the mnmum α k,forall partton server S k, and the reserved porton of processor capacty, s less than 100%, the extra capacty can be allocated to all parttons proportonally to ther mnmum α k. Then, η k can be calculated based on Theorem 1. The other approach s to search for the saddle pont n the B 0 (α k )/(1-α k ) curve where the ntal rse just begns to slow down. The par (α k, η k ) at the saddle pont s used as the ntal capacty allocaton and partton cycle. Further ncrease or reducton can be done proportonally f the total capacty allocated s less than or larger than 1. We can use the same schedulng method of the partton schedulng for channel schedulng. A channel server, G k, transmts ts messages accordng to a fxed prorty preemptve schedulng method. It provdes a bandwdth of β k µ k slots to the messages n the channel durng every channel cycle, µ k, where β k 1. For the remanng slots of (1-β k )µ k, the channel server s blocked. Snce each channel server follows the dentcal two-level herarchcal schedulng as partton servers, Theorem 1 can drectly appled to obtan the par of parameters (β k, µ k ). However, there are several dfferences. Frst, only nteger number of slots can be assgned to a channel server. Thus, we can use ether β k µ k slots or restrct β k µ k to be nteger. The second dfference s that the message arrvals are not always perodc due to possble release jtters. Release jtters can be ncluded n the schedulablty test f they are bounded by some maxmum value [15]. The release jtter can also be elmnated f the communcaton controller ncorporates a tmed message servce that becomes actve mmedately after the computaton deadlne s expred. The last dfference s the assgnment of messages nto a channel. Accordng to the prncple of parttonng, tasks from dfferent parttons cannot share the same channel for message transmsson. For the tasks n a partton, we can group a subset of tasks and let them share a channel server. The groupng can be done based on the semantcs of the messages or other engneerng constrants. Also, the multplexng of messages n a shared channel may lead to a savng of bandwdth reservaton. We should address ths ssue n the followng subsecton Combnng For a channel server that transmts a perodc message wth a deadlne MD and a message sze M, we must allocate a mnmum bandwdth of M /MD. Snce there s a lmtaton n the total bus bandwdth, we may not always assgn one channel server to each message. However, we may be able to combne some messages and let them share a common channel server. Ths can lead to a bandwdth reducton snce the reserved bandwdth can be better utlzed by the messages of dfferent deadlnes. For example, gven two messages 1 and 2 wth parameters (M 1, MD 1, T 1 ) and (M 2, MD 2, T 2 ), respectvely, the mnmum bandwdth requrements, n terms of slots per tme unt, for separate channels of messages 1 and 2, and for the combned channel, can be computed as followng: CB 1 =M 1 /MD 1, CB 2 =M 2 /MD 2, CB 12 = max{ M 1 /MD 1, (M 2 +M 1 * %MD 2 /T 1 & )/MD 2 } We assume that message 1 has a hgher prorty than message 2 n the above computaton. The cost of message preempton s gnored whch can be at most one slot per preempton snce we assume that slots are the basc transmsson unts n the communcaton bus. Notce that CB 12 s not always less that CB 1 +CB 2. However, f message 1 has a much shorter deadlne comparng wth ts perod and message 2 has a longer deadlne than message 1 s perod, then the bandwdth reducton CB 1 +CB 2 -CB 12 becomes substantal. Whle we reserve a proper amount of bandwdth for an urgent message, the channel s only partally utlzed f the message arrves nfrequently. Ths provdes a good chance to accommodate addtonal messages n the same channel and results n a reducton n the requred bandwdth. The above equaton also mples that the maxmum bandwdth reducton can be obtaned by combnng the message wth a long deadlne and the message wth a short deadlne where the perod of the latter should be greater than message deadlne of the former. Wth ths observaton, we devse a heurstc channel-combnng algorthm whch s shown n Fgure 7. The computaton of the mnmum bandwdth requrement of a channel consstng of messages 1,2,,k-1, and k, s: j 1 MD j CB... k = max{(( M + M j= 1, k = 1 T ) / MD 12 j j where we assume that message j has a hgher prorty then message j+1. Note that the real bandwdth allocaton must be determned accordng to the choce of channel cycle as )}

7 descrbed n Theorem 1. However, n order to calculate channel cycle and capacty, the messages n each channel must be known. The channel-combnng algorthm outlned n Fgure 7 s developed to allocate messages to channels for each partton and to reduce the mnmum bandwdth requrement to a specfc threshold. If the combned channels cannot be scheduled, we can further decrease the target threshold untl no addtonal combnng can be done. Intalzaton ( combnng s allowed to the tasks n the same partton) Assgn one channel server G k to the message of each task Iterate the followng steps untl the sum of total CB k s less than the target threshold determne all par of combnable channel server G k and G j where the max. message deadlne n G k s larger than the mn. task perod n G j For every par of combnable channel servers G k and G j { calculate the bandwdth reducton CB k +CB j CB kj } Combne G j wth the server G k that results n the maxmum reducton nvocaton perod for every partton, a substantal number of context swtches between parttons could occur. A practcal approach of avodng excessve context swtches s to use Han s S X specalzaton algorthm wth a base 2 [9]. Gven a base partton cycle η, the algorthm fnds a h for each η that satsfes: h = η *2 j η < η *2 j+1 = 2*h, To fnd the optmal base η n the sense of processor utlzaton, we can test all canddates η n the range of (η 1 /2, η 1 ] and compute the total capacty k α k.to obtan the total capacty, the set of η k s transferred to the set of h k based on correspondng η and then the least capacty requrement, α, for partton cycle h k s h k obtaned from Theorem 1. The optmal η s selected n order to mnmze the total capacty. In Fgure 8, we show a fxed cyclc processor schedulng example that guarantees dstance constrant for the set of partton capactes and cycles, A(0,12), B(0.2,14), C(0,21), D(0.2,25), E(0,48), and F(0.3,50). We use the optmal base of 10 to convert the partton cycles to 10, 10, 20, 20, 40, and 40, respectvely. Fgure 7. A heurstc channel combnng algorthm 3.4. Cyclc Schedulng for Partton and s Let a feasble set of partton capactes and cycles be (α 1, η 1 ), (α 2, η 2 ),, (α n,η n ) andthesetbesortednthe non-decreasng order of η k. The set cannot be drectly used n a cyclc schedule that guarantees the dstance constrant of assgnng α k processor capacty for every η k perod n a partton. To satsfy the dstance constrant between any two consecutve nvocatons, we can adopt the pnwheel schedulng approach [7, 9] and transfer {η k } nto a harmonc set through a specalzaton operaton. Note that, n [9], a fxed amount of processng tme s allocated to each task and would not be reduced even f we nvoke the task more frequently. Ths can lead to a lower utlzaton after the specalzaton operatons. For our partton-schedulng problem, we allocate a certan percentage of processor capacty to each partton. When the set of partton cycles {η k } s transformed n to a harmonc set {h k }, ths percentage doesn t change. Thus, we can schedule any feasble sets of (α k, η k ) as long as the total sum of α k s less than 1. A smple soluton for a harmonc set {h k } s to assgn h k =η 1 for all k. However, snce t chooses a mnmal A B.2 C E F D.0 A B E F A B C D.0 A B Fgure 8. Example of processor cyclc schedulng The basc method of cyclc schedulng for channel servers s same as that of partton server schedulng. The only dfference s that we need to consder that channel bandwdth allocaton must be done based on nteger number of slots. Let the feasble bus bandwdth capacty allocaton set be (β 1, µ 1 ), (β 2, µ 2 ),, (β n,µ n ).Usngthe S X specalzaton, the set {µ k } wll be transformed to a harmonc set {m k }. Then, based on Theorem 1 and the reduced m k, we can adjust the channel capacty β k to β k h n h subject to mk mk =1 β. There wll be β k h m k slots allocated to the channel server G k. 4. Algorthm Evaluaton In ths secton, we present the evaluaton results of the proposed algorthms for SP-RTS. Frst, we show the percentage of schedulable task sets n terms of processor and bus utlzaton under the two-level schedulng, deadlne decomposton and channel combnng algorthms. Then, we show that the penalty of the F 75

8 (N,P,T) = (4,3,5) (N,P,T) = (2,2,4) Schedulablty Proc. Utl Proc. Utl Proc. Utl Proc. Utl Proc. Utl Bus utlzaton Schedulablty Proc. Utl. 05 Proc. Utl Proc. Utl Proc. Utl Proc. Utl Bus utlzaton Fgure 9. Schedulablty test for confguratons (4, 3, 5) and (2, 2, 4) harmonc transformaton even f channel server schedulng s neglgbly small. Fnally, the characterstc behavor of deadlne decomposton s llustrated. The evaluatons are done wth random task and message sets that are generated wth specfc processor and bus utlzaton. 4. Schedulablty Test A schedulablty test of the algorthm s obtaned usng the smulatons of a system model that composes of four processors, three parttons per each processor and fve tasks per each partton,.e., a confguraton of (4, 3, 5). The smulatons use random task sets that result n varable processor utlzaton of 15%, 30%, 45%, 60% and 75%. The task perods are unformly dstrbuted between the mnmum and maxmum perods. The total processor utlzaton s randomly dstrbuted to all tasks n each processor and s used to compute the task executon tmes. To create message sets, we vary the total bus utlzaton from 10% to 90%. Message lengths are computed wth a random dstrbuton of the total bus utlzaton and task perods. Usng the schedulng procedure of Fgure 4, we frst assgn task and message deadlnes for each task. Then the partton capacty and cycle for each partton are computed and the cyclc schedule for each processor s constructed. To schedule message transmsson, messages are combned nto channels n order to reduce bandwdth requrement. After channel cycle and capacty are determned, a cyclc schedule s formed. For the prorty schedules wthn parttons and channels, we adopt the deadlne monotonc approach to order the task and message prortes. Wth all randomly created task sets, we report the percentage of schedulable task sets among all sets n Fgure 9. The fgure shows the algorthms are capable of fndng proper deadlne assgnments and, then, determnng feasble partton and channel cyclc schedules. For nstance, consder the case of 60% processor and bus utlzaton. Even f the deadlnes are less than task perods, almost 100% of task sets are schedulable. Fgure 9 also reports the test results of the confguraton (2, 2, 4). The curves have the smlar trends as that of the confguraton of (4, 3, 5) The Effects of Deadlne Decomposton and Combnng Algorthm It s worthy to look nto how the bus s utlzed n the channel schedules resulted from the heurstc algorthms of deadlne decomposton and channel combnng. Consder the followng measures: 1. Measure1 s the bus utlzaton whch equals to the sum of (ST M )/T for all tasks. No real-tme constrant of message delvery s consdered n ths measure. 2. Measure2 s the total bus capacty needed to transmt messages on tme wth no channel combnng (.e., each task has a dedcated channel). Ths capacty wll be equal to the summaton of (ST M )/MD for all tasks and can be computed after message deadlnes are assgned. 3. Measure3 s the mnmum bus capacty needed to schedule channels. Ths measure s equal to the summaton of mnmum β k for all channels. Note that, accordng to Theorem 1, the mnmum β k for a channel s defned as the mnmum

9 capacty that results n a zero nactve perod for at least one message n the channel. It can be determned after message deadlnes are assgned and messages are combned nto the channel. 4. Measure4 s the total bus capacty selected accordng to Theorem 1. Ths measure can be formulated as the summaton of β k for all channels. 5. Measure5 s the fnal bus capacty allocated to all channels based on a harmonc set of channel cycles and the nteger number of slots for each channel. The capacty s equal to the summaton of β h k m k /m k for all channels. We can expect an order of Measure2> Measure5> Measure4> Measure3> Measure1 among the measures. Measure2 should be much hgher than other measures as we allocate bandwdth for each message ndependently to ensure on schedule message delvery. Wth the message multplexng wthn each channel, the on schedule message delvery can be acheved wth a less amount of bandwdth. However, a bandwdth allocaton followng Measure3 cannot be practcal snce the channel cycles must be nfntely small. Accordng to Theorem 1, Measure4 contans addtonal capacty that s added to each channel to allow temporary blockng of message transmsson durng each channel cycle. Furthermore, n Measure5, an extra capacty s allocated as we make nteger number of slots for each channel and construct a cyclc schedule wth harmonc perods. The smulaton results of the above measures are shown n Fgure 10. The results confrm our expectaton of the order relatonshp. However, when we change the bus utlzaton from 0 to 0.8, the curves are not monotoncally ncreasng (except the curve of Measure1). Ths s the consequence of the deadlne decomposton (DD) algorthm. When channels don t have enough bandwdth to meet short message deadlnes, the algorthm adjusts the factor f k and assgns longer deadlnes for message transmsson. As shown n Fgure 5, the DD algorthm uses an approach smlar to bnary search algorthm and makes a bg ncrease to f k ntally. Ths results n long deadlnes and the reduced capacty allocatons n Measure2-5. In fact, when the bus utlzaton s less than 30%, the average number of teratons performed n the DD algorthm s slghtly larger than 1,.e., only the ntal f k s used to allocate deadlnes. When the bus utlzaton s rased to 40% to 70%, the average number of teratons jumps to 1.6, 1.98, 2.0, and 2.04, respectvely. It further ncreases to when the bus utlzaton s set to 80%. Fgure 10 also llustrates the magntude of the measures and the dfferences among them. The gap between Measure3 and Measure2 s very vsble. Ths dfference s the product of channel combnng algorthm. Capacty 30% proc. utl. at a (4,3,5) system Measure2.4 Measure5.3 Measure4.2 Measure3 Measure In order to meet a tght message deadlne, we have to reserve a large amount of bandwdth. Wth channel combnng, messages of dfferent deadlnes share the allocated slots. As long as the message wth a shorter deadlne can preempt the on-gong transmsson, the slots n each channel can be fully utlzed by multplexng and prortzng message transmssons. There s a moderate gap between Measure3 and Measure4. As ndcated n Theorem 1, we search for a channel capacty and a channel cycle located n the knee of the curve η k B 0 (α k )/(1-α k ) after the ntal sharp rse. Ths mples that a small ncrease of β k wll be added to Measure3 n order to obtan a reasonable sze of channel cycle. Fnally, the dfference between Measure4 and Measure5 s not sgnfcant at all. It s caused by the process of convertng η k toaharmonccyclem k, and by allocatng an nteger number of slots β h k m k for each channel. The other way of lookng nto the behavor of the deadlne decomposton algorthm s to nvestgate the resultant decomposton of task deadlne, D. In Fgure 11, we showed the average rato of message deadlne to task deadlne, under dfferent processor and bus utlzaton. If the adjustment factor f s constant, the rato, MD D Bus Utlzaton Fgure 10. Measures for Bus Utlzaton and Capactes ST M = ( ) f, C + ST M should follows a concave curve as we ncrease bus utlzaton (by ncreasng message length, M ). For nstance, when the processor utlzaton s 15%, there are two segments of concave curves from bus utlzaton 10% to 70% and from 70% to 90%. The segmentaton ndcates a jump n the adjustment factors resulted from the deadlne decomposton algorthm. In Fgure 11, the

10 concavty and the segmentaton can also be seen n other curves that represent the message deadlne ratos of dfferent processor utlzaton. When the processor utlzaton s hgh, f may be modfed gradually and partton schedulng may fal f we ntroduce a sharp ncrease to f. Thus, the concavty and the segmentaton are not so obvous as the deadlne rato n an underutlzed processor. Percentage of task deadlne Concluson Bus Utlzaton 15% Proc. Utl 30% Proc. Utl. 45% Proc. Utl. 60% Proc. Utl. 75% Proc. Utl. Fgure 11. The rato of message deadlne to task deadlne In ths paper, we present several algorthms n order to produce cyclc partton and channel schedules for the two-level herarchcal schedulng mechansm of IMAbased avoncs systems. The system model of the IMA archtecture supports spatal and temporal parttonng n all shared resources. Thus, applcatons can be easly ntegrated and mantaned. The man dea of our approach s to allocate a proper amount of capacty and to follow a dstance constrant on partton and channel nvocatons. Thus, the tasks (messages) wthn a partton (channel) can have an nactve perod longer than the blockng tme of the partton (channel). Also we use a heurstc deadlne decomposton technque to fnd feasble deadlnes for both tasks and messages. To reduce bus bandwdth requrement for message transmsson, we develop a heurstc channel-combnng algorthm whch leads to hghly utlzed channels by multplexng messages of dfferent deadlnes and perods. The smulaton analyses show promsng results n terms of schedulablty and system characterstcs. Based on the work n ths paper, we have developed a schedulng tool for the IMA-based avoncs systems. The tool ncludes addtonal features for practcal mplementatons, such as tme-tck based processor schedulng, non-zero context swtch overhead, replcaton executon and transmsson, ncremental changes, etc. We are currently lookng nto dfferent network nfrastructures and communcaton schedulng algorthms that can be employed n the scalable IMA-based systems. References [1] Desgn Gude for Integrated Modular Avoncs, ARINC Report 651, Aeronautcal Rado Inc., Annapols, MD, Nov [2] Avoncs Applcaton Software Standard Interface, ARINC Report 653, Aeronautcal Rado Inc., Annapols, MD, Jan [3] Backplane Data Bus, ARINC Specfcaton 659, Aeronautcal Rado Inc., Annapols, MD, Dec [4] N. Audsley, and A. Wellngs, Analyzng APEX applcatons, Proc. IEEE Real-Tme Systems Symposum, Dec. 1996, pp [5] N. Audsley, A. Burns, M. Rchardson, and A. Wellngs, Hard real-tme schedulng: the deadlne-monotonc approach, Eghth IEEE Workshop on Real-tme Operatng Systems and Software, 1991, pp [6] T. Carpenter, Avoncs Integraton for CNS/ATM, Computer, Dec. 1998, pp [7] M. Y. Chan and F. Y. L. Chn, General schedulers for the pnwheel problem based on double-nteger reducton, IEEE Trans. on Computers, vol. 41, June 1992, pp [8] Z. Deng and J. W. S. Lu, Schedulng real-tme applcatons n an open envronment, Proc. IEEE Real- Tme Systems Symposum, Dec. 1997, pp [9] C.-C. Han, K.-J. Ln, and C.-J. Hou, Dstanceconstraned schedulng and ts applcatons to real-tme systems, IEEE Trans. on Computers, Vol. 45, No. 7, July, 1996, pp [10] Y. H. Lee, D. Km, M. Youns, and J. Zhou, Partton schedulng n APEX runtme envronment for embedded avoncs software, Proc. of Real-Tme Computng Systems and Applcatons, Oct. 1998, pp [11] J. Lehoczky and S. Ramos-Thuel, An optmal algorthm for schedulng soft-aperodc tasks n fxed-prorty preemptve systems, Proc. IEEE Real-Tme Systems Symposum, Dec. 1992, pp [12] J. Lehoczky, L. Sha, and Y.Dng, The rate-monotonc schedulng algorthm: exact characterstcs and average case behavor, Proc. IEEE Real-Tme Systems Symposum, Dec. 1989, pp [13] J. Lehoczky, Fxed prorty schedulng for perodc task sets wth arbtrary deadlnes, Proc. IEEE Real-tme Systems Symposum, Dec. 1990, pp [14] C. L. Lu and J. W. Layland, Schedulng algorthms for multprogrammng n a hard real-tme envronment, JACM, vol. 20, No. 1, 1973, pp [15] K. W. Tndell, A. Burns, and A. J. Wellngs, An extendble approach for analyzng fxed prorty hard real-tme tasks, Real-Tme Systems 6(2), 1994, pp