Verifying complex Cyber-physical Systems (CPSs) is increasingly important given the push to deploy safety-critical autonomous features. Unfortunately, traditional verification methods do not scale to the complexity of these systems and do not provide systematic methods to protect verified properties when not all the components can be verified. To address these challenges, this article proposes a real-time mixed-trust computing framework that combines verification and protection. The framework introduces a new task model, where an application task can have both an untrusted and a trusted part. The untrusted part allows complex computations supported by a full OS with a real-time scheduler running in a VM hosted by a trusted hypervisor. The trusted part is executed by another scheduler within the hypervisor and is thus protected from the untrusted part. If the untrusted part fails to finish by a specific time, the trusted part is activated to preserve safety (e.g., prevent a crash) including its timing guarantees. This framework is the first allowing the use of untrusted components for CPS critical functions while preserving logical and timing guarantees, even in the presence of malicious attackers. We present the framework, its schedulability analysis, and the coordination protocol between the trusted and untrusted parts. Our implementation on a Raspberry Pi 3 is also discussed along with experiments showing the behavior of the system under failures of untrusted components and a drone application to demonstrate its practicality.

This paper presents a task synchronization mechanism, called co-runner locking, to address the timing interference problem in multi-core real-time systems. It prevents certain subsets of tasks from executing simultaneously on different cores in order to avoid large performance penalties from inter-core interference. We provide the general properties of the co-runner locking mechanism and discuss the runtime control policies that determine the execution order of tasks in a co-runner-locking relationship. For schedulability analysis, we derive a response-time test that upper-bounds the delay from co-runner locking and the slowdown imposed by permitted co-runners by combining two new analytic approaches: job-oriented and load-oriented. In evaluation, we demonstrate that the co-runner locking mechanism is an effective alternative to address the "one-out-of-m" problem and brings about a significant improvement in real-time taskset schedulability.

In this paper we present a new scheduling model for resilient real-time mixed trust systems. This model extends the previous Real-Time Mixed-Trust Computing framework RT-MTC to support degradation modes. Management of these modes has been identified in industrial documents as a key requirement for deploying trusted autonomous vehicles for safe autonomy. RT-MTC uses verified components (known as enforcers) to guarantee that the output of a system is safe by replacing it with a verified safe one if this output is deemed unsafe or is not produced on time. In this paper we extend RT-MTC and develop a scheduling model that uses the digraph scheduling model as a baseline but extends it in four critical ways: (1) it creates extensions for the mixed-preemptive scheduling required by RT-MTC, (2) it enables priority bands in order to separate trusted and untrusted components, (3) it uses these bands in order to calculate intermediate deadlines used by the RT-MTC framework for the scheduling of the trusted components, and (4) it defines system mode semantics to obtain two desirable properties of the new schedulability analysis: low pessimism and low time-complexity. This paper evaluates the new schedulability algorithm and shows that it is efficient in that it only needs to analyze one transition at a time. The new model supports the construction of a resilient autonomous system with provable guarantees protected by verified enforcers within the RT-MTC framework and, more importantly, preserves these guarantees even across failure-triggered mode changes.

The Real-Time Mixed-Trust (RTMT) Framework [2] enables the use of untrusted components in safety-critical CPS functions (e.g., driving a car) by monitoring their actions with verified and trusted components (called enforcers ) that correct unsafe actions to guarantee critical safety properties (e.g., brake to prevent a crash). The enforcers are run within a verified hypervisor that protects them from security attacks or bugs and the untrusted components are run in an unverified virtual machine (VM) on top of the hypervisor. The untrusted and trusted components are executed as a single coordinated sporadic real-time task, called a mixed-trust task , where the untrusted part is known as the guest task (GT, because it runs in the guest VM) and the trusted part running in the hypervisor (HV) is known as the hypertask (HT). The GT is run by a preemptive fixed-priority scheduler in the VM and the HT by a non-preemptive fixed-priority scheduler in the HV. The non-preemptive scheduler prevents interleavings and simplifies the logical verification [4] , [5] . From a timing point of view, the HT monitors that the GT produces a valid output before the deadline, and if not, the HT itself produces a safe output before the deadline elapses. A new set of schedulability equations to evaluate their schedulability were presented in [2] along with a full discussion of the framework.

Verifying complex Cyber-Physical Systems (CPS) is increasingly important given the push to deploy safety-critical autonomous features. Unfortunately, traditional verification methods do not scale to the complexity of these systems and do not provide systematic methods to protect verified properties when not all the components can be verified. To address these challenges, this paper proposes a real-time mixed-trust computing framework that combines verification and protection. The framework introduces a new task model, where an application task can have both an untrusted and a trusted part. The untrusted part allows complex computations supported by a full OS with a realtime scheduler running in a VM hosted by a trusted hypervisor. The trusted part is executed by another scheduler within the hypervisor and is thus protected from the untrusted part. If the untrusted part fails to finish by a specific time, the trusted part is activated to preserve safety (e.g., prevent a crash) including its timing guarantees. This framework is the first allowing the use of untrusted components for CPS critical functions while preserving logical and timing guarantees, even in the presence of malicious attackers. We present the framework design and implementation along with the schedulability analysis and the coordination protocol between the trusted and untrusted parts. We also present our Raspberry Pi 3 implementation along with experiments showing the behavior of the system under failures of untrusted components, and a drone application to demonstrate its practicality.

Consider fixed-priority preemptive partitioned scheduling of constrained-deadline sporadic tasks on a multiprocessor. A task generates a sequence of jobs and each job has a deadline that must be met. Assume tasks have Corunner-dependent execution times; i.e., the execution time of a job J depends on the set of jobs that happen to execute (on other processors) at instants when J executes. We present a model that describes Corunner-dependent execution times. For this model, we show that exact schedulability testing is co-NP-hard in the strong sense. Facing this complexity, we present a sufficient schedulability test, which has pseudo-polynomial-time complexity if the number of processors is fixed. We ran experiments with synthetic software benchmarks on a quad-core Intel multicore processor with the Linux/RK operating system and found that for each task, its maximum measured response time was bounded by the upper bound computed by our theory.

Energy and thermal considerations are increasingly driving system designers to adopt multi-core processors. In this paper, we consider the problem of scheduling periodic real-time tasks on multi-core processors using fixed-priority preemptive scheduling. Specifically, we focus on the partitioned (static binding) approach, which statically allocates tasks to processing cores. The well-established 50% bound for partitioned multiprocessor scheduling [10] can be overcome by task-splitting (TS) [19], which allows a task to be split across more than one core. We prove that a utilization bound of 60% per core can be achieved by the partitioned deadline-monotonic scheduling (PDMS) class of algorithms on implicit-deadline task sets, when the highest-priority task on each processing core is allowed to be split (HPTS). Given the widespread usage of fixed-priority scheduling in commercial real-time and non real-time operating systems (e.g. VxWorks, Linux), establishing such utilization bounds is both relevant and useful. We also show that a specific instance of PDMS_ HPTS, where tasks are allocated in the decreasing order of size, called PDMS_HPTS_ DS, has a utilization bound of 65% on implicit deadline task-sets. The PDMS_ HPTS_ DS algorithm also achieves a utilization bound of 69% on lightweight implicit-deadline task-sets where no single task utilization exceeds 41.4%. The average-case behavior of PDMS_ HPTS_ DS is studied using randomly generated task-sets, and it is seen to have an average schedulable utilization of 88%. We also characterize the overhead of task-splitting using measurements on an Intel Core 2 Duo processor.

In this paper, we study the problem of allocating end-to-end bandwidth to each of multiple traffic flows in a large-scale network. We adopt the QoS-based resource allocation model (Q-RAM) (K-S. Lui et al., 2000), whereby each flow derives an utility based on the amount of its allocated bandwidth. Our goal therefore is to maximize the total utility derived across all network flows. The NP-hard nature of the resource allocation problem is compounded by the need to select an appropriate path between each source-destination pair. We propose a hierarchical decomposition scheme that allows the resource allocation problem to be solved in a decentralized and scalable fashion. The hierarchy we use is based on a (natural) partitioning of the network into subnets, with resource allocation decisions made on a subnet-by-subnet basis. A novel distributed transaction scheme is used to ensure that resource allocations are consistent across all the subnets traversed by each flow. We provide both analytical and experimental evidence to show that our scheme is very scalable and yet does not sacrifice the quality of the allocations.

Many existing and emerging network applications such as voice-over-IP, videoconferencing and online gaming have end-to-end timing requirements. Despite the real-time demands of these applications, they are usually deployed on best-effort networks such as the Internet. This results in unpredictable and often unsatisfactory performance. In this paper we propose a simple and novel task (or packet) scheduling algorithm Diff-EDF (differentiated earliest deadline first) which can meet the real-time needs of these applications while continuing to provide best effort service to nonreal time traffic. In our system we consider each flow as having stochastic traffic characteristics, a stochastic deadline and a maximum allowable miss rate. The Diff-EDF service meets the flow miss rate requirements through the combination of an admission control test and a scheduling algorithm similar to EDF (earliest deadline first). However, unlike standard EDF scheduling each flow receives a deadline bias based on the flow's miss rate requirement. Applying this bias allows the miss rate to be controlled on a flow-by-flow basis. Both the admission control test and the bias selection algorithms can be computed as a linear function of the flow traffic parameters and the logarithms of the miss rate requirements resulting in an efficient implementation. In this paper, we presented the proposed system structure, protocols, algorithms, analysis and experiments. Experiments with randomly generated and real-life data closely match values predicted by the theory.

Summary form only given. We present an extension to our QoS optimization algorithm, Q-RAM, that can improve optimization time by several orders of magnitude when managing highly configurable tasks. A highly configurable task is one with a large number of QoS dimensions and/or a large number of quality levels on those dimensions. For example, an application that has ten QoS dimensions with ten quality levels each will have 10/sup 10/ setpoints, or ways in which it can be configured. While the existing Q-RAM algorithm has been shown to be a very effective resource management tool, it must still explicitly perform computations on all of the setpoints for each task. For tasks with 10/sup 10/ setpoints or more, this is clearly impractical. The key idea presented here is a new approximation algorithm for the concave majorant step in Q-RAM. By using this algorithm in a filtering step, the best performing subset of the setpoints can be quickly found without explicitly examining all of the setpoints. The idea is validated using a phased array radar system as an example application.

As broadband capabilities on wired, wireless and mobile phone networks proliferate, real-time multimedia traffic is expected to consume higher portions of the available bandwidth. Usage models in such networks range from low-cost VoIP to high-cost, high-quality, high-resolution video streams along with many intermediate data streams. Video flows, however, have stochastic processing requirements, and they may result in very low utilization levels if traditional real-time scheduling techniques are used. This calls for new analytical methods. In this paper, we illustrate a set of new techniques for reasoning about the lateness of such stochastic flows, and apply it to engineer a wired multihop real-time network. We make use of 4 dominant parameters to characterize the design space: end-to-end deadline, acceptable lateness, the number of hops and the network workload. Given any three of these parameters, the remaining parameter can be computed. For instance, if a stochastic flow passes through 10 nodes, its end-to-end deadline is 150 ms, and no more than 0.1% of the packets can be late, what is the maximum allowable system workload that would satisfy the lateness requirements? This maximum allowable workload can then be used to develop for the admission control policy to guarantee that the specified timeliness requirements are met. This paper provides insights into real-time network effects and rules of thumb to properly engineer a high utilization real-time EDF (earliest deadline first) network. Simulation and experimental results validate our methods. Our techniques are further applicable to heterogeneous network cases where some nodes on the flow path are bottlenecks or have cross traffic from other flows.

Dynamic real-time systems such as phased-array radars must manage multiple resources, satisfy energy constraints and make frequent on-line scheduling decisions. These systems are hard to manage because task and system requirements change rapidly (e.g. in radar systems, the targets/tasks in the sky are moving continuously) and must satisfy a multitude of constraints. Their highly dynamic nature and stringent time constraints lead to complex cross-layer interactions in these systems. Therefore, the design of such systems has long been a conservative and/or unpredictable mixture of pre-computed schedules, pessimistic resource allocations, cautious energy usage and operator intuition. In this paper, we present an integrated approach that simultaneously maximizes overall system utility, performs task scheduling and satisfies multi-resource constraints. Using a phased-array radar system, we show that our approach can reconfigure settings of 100 tracks at every 0.7 sec in real-time, and performs within 0.1% of the achievable optimal solution.

We present scalable QoS optimization algorithms for allocating resources to tasks in a multi-processor environment. Given a set of tasks, each of which is capable of running at one of several different QoS levels, the algorithms can select a QoS operating point, the number of replicas for fault-tolerance and the processors on which to run the replicas so as to maximize overall system QoS. The algorithms are extensions of Q-RAM (QoS-based Resource Allocation Model) [5] and fix two deficiencies with the basic algorithm. The first is that the existing algorithm is weak in making resource trade-off decisions such as to which processor to map a task. The second was that it was not scalable to very large numbers of resources such as in a large multi-processor system. In this paper we present two new algorithms which significantly enhance the ability of Q-RAM to make resource tradeoff decisions. We also introduce a hierarchical decomposition scheme which enables QoS optimization to be performed on problems with thousands of resources and thousands of tasks.

Reservation-based operating systems provide applications with guaranteed and timely access to system resources. One of their chief benefits is temporal isolation, which prevents the timing mis-behavior of one task from interfering with other tasks. Such a benefit is appealing enough that many systems [2, 8] desire to recursively apply this reservation model to each of their components. This recursive application provides flexible load isolation among applications, users and other high-level resource management entities such as aggregated flows for network bandwith. The hierarchical reservation study can be applied to hierarchical schedulers [5, 6], that support heterogenous scheduling algorithms. We propose and analyze a hierarchical reservation model in the context of fixed-priority scheduling, rate-monotonic and deadline-monotonic, as used in systems such as the Resource Kernel [11]. Detailed schedulability analyses under both deferrable-server and sporadic-server replenishment schemes, including exact completion time tests under hierarchical deadline-monotonic schedulers, are presented. We also derive the least upper scheduling bound for hierarchicalrate-monotonic schedulers. Finally, we describe how to apply multi-reserve PCP [4 ], an extension of the Priority Ceiling Protocol for reservation-based systems, to allow tasks to share non-preemptable resources across the hierarchy.

The quantized earliest deadline first (Q-EDF) scheduling policy assumes a limited number of priority levels available to express task (or packet) deadlines. This situation arises in computer and communication systems in which priority levels must be expressed using a limited number of bits. The range of possible deadlines is partitioned into bins, and a task whose deadline lies within the range of a bin is assigned a quantized deadline equal to the left endpoint of the bin. We assume soft real-time tasks arrive according to a renewal process, have random service requirements, and have random deadlines drawn from a probability distribution. Using real-time queueing theory, a general method for computing the long run fraction of tasks that miss their actual deadlines (or their quantized deadlines) is presented. Results are given for uniform deadline distributions, and the optimal bin partitioning is determined for this distribution. The theoretical results show excellent agreement with simulation results. Finally, assuming only the min, mean, and max task deadlines are specified, we determine the worst-case deadline distribution given any specified priority bin choice, then optimize the priority bin choice to minimize the worst-case lateness relative to EDF. For this Q-EDF partition, we determine the number of bins needed to achieve a given performance relative to EDF. We show that for practical cases with soft deadlines, 3 bits are sufficient to achieve nearly the same performance with Q-EDF as with pure EDF.

Resource allocation policies which signi cantly improve Quality of Service (QoS) while minimizing QoS instability are presented. In a dynamic system in which applications are continuously entering and departing the system, QoS instability occurs when the system over-commits resources and can not meet the resource demands of new admission requests. The system is forced to either reject the request or degrade one or more existing tasks. In this paper we introduce three admission control policies and compare their QoS performance/stability tradeo s. We show that by maintaining a small resource reserve modeled as a competing application in the QoS optimization framework, we can achieve QoS levels that are over 90% of the theoretical maximum while reducing instability by one to two orders of magnitude.

The problem of maximizing system utility by allocating a single finite resource to satisfy discrete Quality of Service (QoS) requirements of multiple applications along multiple QoS dimensions was studied previously. In this paper we consider the more complex problem of apportioning multiple finite resources to satisfy the QoS needs of multiple applications along multiple QoS dimensions. In other words, each application, such as video-conferencing, needs multiple resources to satisfy its QoS requirements. We evaluate and compare three strategies to solve this provably NP-hard problem. We show that dynamic programming and mixed integer programming compute optimal solutions to this problem but exhibit very long running times. We then adapt the mixed integer programming problem to yield near-optimal results with smaller running times. Finally, we present an approximation algorithm based on a local search technique that is less than 5% away from the optimal solution but which is more than two orders of magnitude faster. Perhaps more significantly, the local search technique turns out to be very scalable and robust as the number of resources required by each application increases.

The paper presents new methods to analyze the performance of certain scheduling algorithms for communication networks carrying real time traffic and operating in a packet switched mode. The real time traffic consists of distinct sessions, each of which transmits packets with hard deadlines. Edf and fifo scheduling policies are analyzed in detail. For the single node case, methods based on real time queueing theory and heavy traffic queueing theory are applied to develop closed form expressions for the fraction of packets which miss their deadline as a function of the characteristics of the sessions using the node. The results are extended to a two node non Jackson network. Simulations illustrate the excellent accuracy of the closed form expressions. The formulas developed are used to design system parameters that can attain desired levels of packet lateness.

The QoS based Resource Allocation Model (Q-RAM) proposed by R. Rajkumar et al. (1998) presented an analytical approach for satisfying multiple quality of service dimensions in a resource constrained environment. Using this model, available system resources can be apportioned across multiple applications such that the net utility that accrues to the end users of those applications is maximized. We present several practical solutions to allocation problems that were beyond the limited scope of Q-RAM. We show that the Q-RAM problem of finding the optimal resource allocation to satisfy multiple QoS dimensions is NP hard. We then present a polynomial solution for this resource allocation problem which yields a solution within a provably fixed and short distance from the optimal allocation. Secondly, Q-RAM dealt mainly with the problem of apportioning a single resource to satisfy multiple QoS dimensions. We study the converse problem of apportioning multiple resources to satisfy a single QoS dimension. In practice, this problem becomes complicated, since a single QoS dimension perceived by the user can be satisfied using different combinations of available resources. We show that this problem can be formulated as a mixed integer programming problem that can be solved efficiently to yield an optimal resource allocation. We also present the run times of these optimizations to illustrate how these solutions can be applied in practice. A good understanding of these solutions will yield insights into the general problem of apportioning multiple resources to satisfy simultaneously multiple QoS dimensions of multiple concurrent applications.

In many real time applications, especially those involving computer controlled systems, the application tasks often have a maximal acceptable latency, and small latency is preferred to large. The interaction between choosing task periods to meet the individual latency requirements and scheduling the resulting task set was investigated by D. Seto et al. (1996) using dynamic priority scheduling methods. We present algorithms based on static priority scheduling methods to determine optimal periods for each task in the task set. The solution to the period selection problem optimizes a system wide performance measure, subject to meeting the maximal acceptable latency requirements of each task. The paper also contributes to a new aspect of rate monotonic scheduling, the optimal design of task periods in connection with application related timing specifications and task set schedulability.

This paper presents real-time queueing network theory, the extension of real-time queueing theory introduced by J.P. Lehoczky (1996) to Jackson queueing networks. This theory describes the behavior of standard Jackson queueing networks when the tasks have end-to-end deadlines. This theory is focused on describing the instantaneous multidimensional profiles of the lead-times of all the tasks in all the nodes of the network. The earliest end-to-end deadline first policy is used at all nodes in the network, although the theory permits other scheduling policies and different policies at different nodes. The real-time network problem is formulated in general, but it is analyzed under heavy traffic conditions where the traffic intensity at each node approaches 1. In this case, the multivariate queue length process converges to a Brownian network, a multivariate Brownian motion constrained to the first orthant. The conditional multivariate lead-time profiles at each of the nodes given the queue lengths converge to a deterministic profile. This characterization is borne out by simulation, and is used to design and evaluate queue control policies to reduce task lateness.

Quality of service (QoS) has been receiving wide attention in many research communities including networking, multimedia systems, real-time systems and distributed systems. In large distributed systems such as those used in defense systems, on-demand service and inter-networked systems, applications contending for system resources must satisfy timing, reliability and security constraints as well as application-specific quality requirements. Allocating sufficient resources to different applications in order to satisfy various requirements is a fundamental problem in these situations. A basic yet flexible model for performance-driven resource allocations can therefore be useful in making appropriate tradeoffs. We present an analytical model for QoS management in systems which must satisfy application needs along multiple dimensions such as timeliness, reliable delivery schemes, cryptographic security and data quality. We refer to this model as Q-RAM (QoS-based Resource Allocation Model). The model assumes a system with multiple concurrent applications, each of which can operate at different levels of quality based on the system resources available to it. The goal of the model is to be able to allocate resources to the various applications such that the overall system utility is maximized under the constraint that each application can meet its minimum needs. We identify resource profiles of applications which allow such decisions to be made efficiently and in real-time. We also identify application utility functions along different dimensions which are composable to form unique application requirement profiles. We use a video-conferencing system to illustrate the model.

This paper presents real-time queueing theory, a new theory which embeds the ability of real-time scheduling theory to determine whether task timing requirements are met into the context of queueing models. Specifically, this paper extends the analysis developed in Lehoczky [9] to the GI/M/1 case. The paper also applies these models to study queue control strategies which can control customer lateness. Arriving customers have deadlines drawn from a general deadline distribution. The state variable for the queueing system must include the number in the queue (with supplementary variables as needed to create a Markov model) and the lead-time (deadline minus current time) of each customer; thus the state space is infinite dimensional. One can represent the state of the system as a measure on the real line and can represent that measure by its Fourier transform. Thus, a real-time queueing system can be characterized as a Markov process evolving on the space of Fourier transforms, and this paper presents a characterization of the instantaneous simultaneous lead-time profile of all the customers in the queue. This profile is complicated; however, in the heavy traffic case, a simple description of the lead-time profile emerges, namely that the lead-time profile behaves like a Brownian motion evolving on a particular manifold of Fourier transforms; the manifold depending upon the queue discipline and the customer deadline distributions. This approximation is very accurate when compared with simulations. Real-time queueing theory focuses on how well a particular queue discipline meets customer timing requirements, and focuses on the dynamic rather than the equilibrium behavior of the system. As such, it offers the potential to study control strategies to ensure that customers meet their deadlines. This paper illustrates the analysis and performance evaluation for certain queue control strategies. Generalizations to more complicated models and to queueing networks are discussed.

The paper presents an approach to real time system scheduling. The approach, called real time queueing theory, includes customer timing requirements into queueing models. With real time queueing models, one is able to explicitly characterize the dynamic behavior of the customer lead time profile process where lead time=deadline minus current time. In spite of the infinite dimensionality of these processes, in the heavy traffic case, a simple description of lead time profile process is presented, and this description is shown to be very accurate when compared against simulations. Real time queueing theory offers the promise of providing real time system predictability for systems characterized by substantial stochastic behavior (such as ATM networks and multimedia systems). Possible generalizations are discussed.

Most real-time computer-controlled systems are built in two separate steps, each in isolation: controller design and its digital implementation. Computational tasks that realize the control algorithms are usually scheduled by treating their execution times and periods as unchangeable parameters. Task scheduling therefore depends only on the limited computing resources available. On the other hand, controller design is primarily based on the continuous-time dynamics of the physical system being controlled. The set of tasks resulting from this controller design may not be schedulable with the limited computing resources available. Even if the given set of tasks is schedulable, the overall control performance may not be optimal in the sense that they do not make a full use of the computing resource. We propose an integrated approach to controller design and task scheduling. Specifically, task frequencies (or periods) are allowed to vary within a certain range as long as such a change does not affect critical control functions such as maintenance of system stability. We present an algorithm that optimizes task frequencies and then schedules the resulting tasks with the limited computing resources available. The proposed approach is also applicable to failure recovery and reconfiguration in real-time control systems.

Most existing scheduling algorithms for hard real-time systems apply either to periodic tasks or aperiodic tasks but not to both. In practice, real-time systems require an integrated, consistent approach to scheduling that is able to simultaneously meet the timing requirements of hard deadline periodic tasks, hard deadline aperiodic (alert-class) tasks, and soft deadline aperiodic tasks. This paper introduces the Deferrable Server (DS) algorithm which will be shown to provide improved aperiodic response time performance over traditional background and polling approaches. Taking advantage of the fact that, typically, there is no benefit in early completion of the periodic tasks, the Deferrable Server (DS) algorithm assigns higher priority to the aperiodic tasks up until the point where the periodic tasks would start to miss their deadlines. Guaranteed alert-class aperiodic service and greatly reduced response times for soft deadline aperiodic tasks are important features of the DS algorithm, and both are obtained with the hard deadlines of the periodic tasks still being guaranteed. The results of a simulation study performed to evaluate the response time performance of the new algorithm against traditional background and polling approaches are presented. In all cases, the response times of aperiodic tasks are significantly reduced (often by an order of magnitude) while still maintaining guaranteed periodic task deadlines.>

This paper discusses the problem of jointly scheduling hard deadline periodic tasks and hard deadline aperiodic tasks using fixed priority methods. The approach is based on the slack stealing algorithm developed by the authors, and it assumes that the periodic deadlines must all be met. The paper develops a hard aperiodic acceptance test algorithm for guaranteeing tasks at any priority level, and it corrects an error in the original guarantee algorithm presented in Ramos-Thuel and Lehoczky (1993). It is shown that there is no optimal priority assignment for hard aperiodic task, but guidelines are given for choosing a good priority assignment.>

This paper presents a timing analysis for a quite general hard real-time periodic task set on a uniprocessor using fixed-priority methods. Periodic tasks are composed of serially executed subtasks, where each subtask is characterized by an execution time, a fixed priority and a deadline. A method for determining the schedulability of each task and subtask is presented along with its theoretical underpinnings. This method can be used to analyze the schedulability of any task set on a uniprocessor whose priority structure can be modeled as serially executed subtasks, which can lead to a very complex priority structure. Important examples include task sets that involve interrupts, certain synchronization protocols, certain precedence constraints, nonpreemptible sections, and some message-passing systems. The method is illustrated by a robotics example.>

This paper presents a new algorithm for the on-line scheduling of hard deadline aperiodic tasks in a real-time system in which hard deadline periodic tasks are scheduled using a fixed priority algorithm. The algorithm for jointly scheduling the periodic and aperiodic tasks extends the slack stealing algorithm introduced by Lehoczky and Ramos-Thuel (1992), and thus provides the largest amount of time for aperiodic task processing subject to meeting all periodic task deadlines. The analysis permits the periodic tasks to consist of a set of serially executed subtasks each of which has its own fixed execution priority as defined by (Gonzalez Harbour et al., (1991)) Thus the model permits the direct inclusion of operating system functions as well as certain types of synchronization protocols directly into the schedulability analysis. The methods provide a unified framework for dealing with several related problems including: reclaiming unused periodic and aperiodic execution time, load shedding, balancing hard and soft aperiodic execution time and coping with transient overloads.>

A novel algorithm for servicing soft deadline aperiodic tasks in a real-time system in which hard deadline periodic tasks are scheduled using a fixed priority algorithm is presented. This algorithm is proved to be optimal in the sense that it provides the shortest aperiodic response time among all possible aperiodic service methods. Simulation studies show that it offers substantial performance improvements over current approaches, including the sporadic server algorithm. Moreover, standard queuing formulas can be used to predict aperiodic response times over a wide range of conditions. The algorithm can be extended to schedule hard deadline aperiodics and to efficiently reclaim unused periodic service time when periodic tasks have stochastic execution times.>

The problem of fixed priority scheduling of periodic tasks where each task's execution priority may vary is considered. Periodic tasks are decomposed into serially executed subtasks, where each subtask is characterized by an execution time and a fixed priority and is permitted to have a deadline. A method for determining the schedulability of each task is presented along with its theoretical underpinnings. This method can be used to analyze the schedulability of complex task sets which involve interrupts, certain synchronization protocols, nonpreemptible sections and, in general, any mechanism that contributes to a complex priority structure. The authors introduce a simple but realistic real-time robotics application and illustrate how one uses the schedulability equations presented.>

This paper considers the problem of fixed priority scheduling of periodic tasks with arbitrary deadlines. A general criterion for the schedulability of such a task set is given. Worst case bounds are given which generalize the Liu and Layland bound. The results are shown to provide a basis for developing predictable distributed real-time systems. 1

A simple but efficient architecture for building multiprocessors is to connect several processors to a common backplane bus. The backplane acts as a shared resource in this architecture and contention for its use by different bus modules must be resolved. In a real-time system, this backplane must also provide scheduling support such that the timing behavior of the resulting system is analyzable. In addition, the support primitives for real-time scheduling on a backplane bus must also be constrained by the economic considerations associated with a bus standard that is intended to support both time sharing and real-time applications. The authors review the design considerations to support real-time systems in the IEEE Futurebus+ backplane specification and describe how this backplane can be used to satisfy timing constraints in priority-driven real-time systems.>

An investigation is conducted of two protocols belonging to the priority inheritance protocols class; the two are called the basic priority inheritance protocol and the priority ceiling protocol. Both protocols solve the uncontrolled priority inversion problem. The priority ceiling protocol solves this uncontrolled priority inversion problem particularly well; it reduces the worst-case task-blocking time to at most the duration of execution of a single critical section of a lower-priority task. This protocol also prevents the formation of deadlocks. Sufficient conditions under which a set of periodic tasks using this protocol may be scheduled is derived.>

An exact characterization of the ability of the rate monotonic scheduling algorithm to meet the deadlines of a periodic task set is represented. In addition, a stochastic analysis which gives the probability distribution of the breakdown utilization of randomly generated task sets is presented. It is shown that as the task set size increases, the task computation times become of little importance, and the breakdown utilization converges to a constant determined by the task periods. For uniformly distributed tasks, a breakdown utilization of 88% is a reasonable characterization. A case is shown in which the average-case breakdown utilization reaches the worst-case lower bound of C.L. Liu and J.W. Layland (1973).>

The authors investigate the synchronization problem in the context of priority-driven preemptive scheduling on shared-memory multiprocessors. Unfortunately, a direct application of synchronization mechanisms such as the Ada rendezvous, semaphores, or monitors can lead to uncontrolled priority inversion: a high job being blocked by a lower priority job for an indefinite period of time. A task allocation scheme based on the generalized protocol is outlined.>

Real-time scheduling algorithms that provide responsive aperiodic service in the presence of hard real-time periodic tasks require the creation of a high-priority periodic server task for servicing aperiodic requests. The authors describe the extended priority exchange algorithm, which can provide better aperiodic response than previous aperiodic service algorithms, particularly for cases where the worst-case periodic load is high and little or no utilization is left for a server task. The extended-priority-exchange (EPE) algorithm attains better aperiodic responsiveness by exploiting unused time allocated to periodic tasks for aperiodic service. The average aperiodic response times for the EPE algorithm and four other aperiodic service algorithms (background, polling, deferrable server, and priority exchange) are compared for a range of periodic and aperiodic loads. Simulation results show that for a difference between the average and worst-case periodic load of only 12.5%, the EPE algorithm provides significantly better response times for aperiodic tasks.>

An approach for scheduling the IEEE 802.5 token ring for hard real-time applications is presented that not only guarantees deadlines for synchronous class messages, but also greatly reduces asynchronous class response times. Highly responsive guaranteed service is introduced for alert class asynchronous messages. Conventional use of the IEEE 802.5 token ring provides synchronous communication services using time-domain multiplexing (TDM) while relegating asynchronous class message services to background status. An algorithmic-based scheduling approach is presented that supports a priori schedulability determination for arbitrary synchronous message sets without the costly time-line development, testing, and tuning associated with TDM techniques. This capability allows the IEEE 802.5 to support dynamic, adaptive and reconfigurable run-time environments where the inflexibility of TDM would be prohibitive. Advanced real-time scheduling applied to the IEEE 802.5 token ring greatly enhances the responsiveness of asynchronous class messages while still maintaining guaranteed service for the synchronous class.>

An approach to concurrency control is presented; it is based on the decomposition of both the database and the individual transactions. This approach is a generalization of serializability theory in that the set of permissible transaction schedules contains all the serializable schedules. In addition to providing a higher degree of concurrency than that provided by serializability theory, this approach retains three important properties associated with serializability: the consistency of the database is preserved, the individual transactions are executed correctly, and the concurrency control approach is modular. The authors formalize the last concept. The associated failure recovery procedure is presented, as is the concept of failure safety (i.e. failure tolerance).>

When periodic tasks with hard deadlines communicate over a bus, the problem of hard real-time bus scheduling arises. This paper addresses several problems of hard real-time bus scheduling, including the evaluation of scheduling algorithms and the issues of message packet pacing, preemption, priority granularity and buffering.

This paper presents an analysis of the performance of a special type of voice-data queueing system. The system consists of an integrated circuit-and packet-switched multiplexer resembling that found in the SENET network. A fluid-flow approximation for the data component is introduced to ease study of the voice loss rate and data packet waiting times. In this paper it is shown that very long data queues are possible, with the mean data queue length being proportional to the ratio of the holding time for voice to the holding time for data. The equilibrium distribution is determined, and aspects of the transient behavior are characterized. The question of how much bandwidth to reserve for exclusive use of data and how much to share between voice and data is addressed.

Probabilistic models are presented and investigated to describe the service furnished to messages sent via communications channels on which messages in progress may be "destroyed" by a new message demand. Retries by destroyed messages are modeled. The general approach utilizes diffusion approximations. The quality of the numerical results is evaluated by comparison with simulations, and is found to be satisfactory.