An Analytical Solution for Probabilistic Guarantees of Reservation Based Soft Real-Time Systems
Luigi Palopoli, Daniele Fontanelli, Luca Abeni, Bernardo Villalba Frías
aa r X i v : . [ c s . PF ] A p r An Analytical Solution for Probabilistic Guaranteesof Reservation Based Soft Real–Time Systems
Luigi Palopoli , Daniele Fontanelli , Luca Abeni Bernardo Villalba Fr´ıas Dipartimento di Scienza e Ingegneria dell’Informazione Dipartimento di Ingegneria IndustrialeUniversity of Trento, Trento, Italy { luigi.palopoli,daniele.fontanelli,luca.abeni,br.villalbafrias } @unitn.it Abstract —We show a methodology for the computation ofthe probability of deadline miss for a periodic real–time taskscheduled by a resource reservation algorithm. We propose amodelling technique for the system that reduces the computationof such a probability to that of the steady state probability of aninfinite state Discrete Time Markov Chain with a periodic struc-ture. This structure is exploited to develop an efficient numericsolution where different accuracy/computation time trade–offscan be obtained by operating on the granularity of the model.More importantly we offer a closed form conservative boundfor the probability of a deadline miss. Our experiments revealthat the bound remains reasonably close to the experimentalprobability in one real–time application of practical interest.When this bound is used for the optimisation of the overallQuality of Service for a set of tasks sharing the CPU, it producesa good sub–optimal solution in a small amount of time.
Index Terms —Real–time systems, Scheduling, ProbabilisticGuarantees
I. I
NTRODUCTION
The term soft real–time is used for a class of real–time ap-plications that are resilient to occasional and controlled timingfaults. Significant examples include multimedia streaming [1],computer vision and real–time control [2], [3].An effective method to express the timing requirements for asoft real–time application is by associating each deadline witha probability that it will be met: the notion of probabilisticdeadlines [4]. Probabilistic deadlines can be related to theQuality of Service (QoS) delivered by the application [5], [2]and, more generally, enable the expression of a wide rangeof performance requirements, where classic hard real–timesystems can be regarded as a special case.In traditional hard real–time applications, the use of fixedor dynamic scheduling priorities has gained an undisputedprominence. Part of the reasons of this success is in thepresence of efficient numeric techniques that make for theprovision of tight conditions for temporal guarantees [6]. Atleast as important is a group of approximate analytical results.The most famous is the utilisation bound [7], which offers
The research leading to these results has received funding from theEuropean Union FP7 Programme (FP7/2007-2013) under grant agreementn ◦ ICT-2011-288917 “DALi - Devices for Assisted Living” and under grantagreement n ◦ FP7-ICT-257462 “HYCON2 NoE”, and from the EuropeanUnion H2020 programme under grant agreement n ◦ clear guidelines on how to tweak periods and computationtimes in order to meet the deadlines of all tasks in the system.The use of scheduling priorities allows the designer to definea partial order between all the tasks in a set and inevitably cou-ples their timing behaviour. This is acceptable if the purposeis to offer guarantees for the set as a whole. On the contrary,if the designer requires specific QoS levels for each task,scheduling priorities can be too coarse a tool. For this reasonan intense research work has produced alternative schedulingsolutions for soft real–time systems. One of the most popularis the Resource Reservations scheduling (RR) [8], [1], whichenables a fine grained control on the fraction of computingpower (bandwidth) that each task receives. A key propertyof RR scheduling is temporal isolation : the ability for atask to meet its deadlines solely depends on its computationrequirement and on its scheduling parameters. This propertyenables the provision of specific temporal guarantees to eachtask and simplifies system design. RR scheduling is nowavailable in the mainstream Linux Kernel .When the probability distribution of inter–arrival time andof computation time are known independent identically dis-tributed (i.i.d.) stochastic processes, temporal isolation allowsmodelling the evolution of a task scheduled through a RRas a Discrete–Time Markov Chain (DTMC) with an infinitenumber of states [4], [9]. In this paper, we restrict the focusto the analysis of periodic tasks. For this case, we can see thatthe DTMC describing the system takes the form of a Quasi–Birth–Death Process (QBDP) [10]. We introduce a granularityparameter that allows us to reduce the complexity of themodel at the expense of a conservative approximation in thecomputation of the probability. We show a novel analysis thatexploits the specific structure of the transition matrix of thisQBDP. The outcome is an expression for the steady stateprobability of meeting the deadline, which can be used in dif-ferent ways. The first one is for the construction of a numericalgorithm for probabilistic guarantees, with a performancecomparable to the best state of the art techniques for numericsolutions of QBDP. The second one, the most important, is forthe computation of an analytical conservative bound for theprobability of meeting the deadline. This bound proves itself easonably accurate for a large set of synthetic test cases. Wehave also performed a large collection of experimental data fora real–life application, in which the presence of several non–idealities (OS overhead, correlation in the computation times,etc.) challenges the assumptions the method relies on. Thesmall approximation error that we observed in the experimentssuggests the practical applicability of the method at leastin the considered scenario. The application of the bound isvery convenient when solving QoS optimisation problems thatrequire to efficiently identify the minimum bandwith requiredfor a desired probability of deadline miss. We show a realisticexample of this kind where the application of the analyticbound produces a good sub–optimal solution in a tiny fractionof the time required by a numeric approach.The paper is organised as follows. In Section II, we offera brief survey of the related work. In Section III we formallydescribe the problem addressed in the paper. In Section IV,weshow how a resource reservation can be conservatively mod-elled as a QBDP. The computation of our analytical bound isreported in Section V. In Section VI, we prove the validityof the bound in a large set of experiments. In Section VII,we show the concrete application of the method to a QoSoptimisation problem. Finally, in Section VIII we offer ourconclusions and announce the future work directions.II. R ELATED W ORK
The stochastic analysis of performance of soft real–timetasks started two decades ago. The same task model pre-sented in this paper (a triple of period, probability distributionof the task computation time and requested probability ofdeadline miss in the long run) has been also adopted inthe statistical rate monotonic approach [11]. More recently,an important number of research papers has concentrated onthe computation of the response time of systems with fixedor dynamic priority when tasks have stochastic variabilityin computation times [12], [13], [14], in the inter–arrivaltime [15] or in both [16]. Similar techniques have recentlybeen applied to multiprocessor systems [17]. An obviouspoint of differentiation between our technique and the onesdescribes so far is that while these papers propose numerictechniques, we offer an analytic bound that is satisfactorilytight in many cases of interest. A very interesting connectioncan be established with the work of Diaz et al. [12], wherethe authors propose the exact solution for a specific numericexample. Our computation, on the contrary, applies to generalcases. What is more, all the approaches mentioned aboveanalyse the task set as a whole, since real–time schedulersdo not enjoy temporal isolation. This makes QoS optimisationmuch more difficult than in our case.Other authors have analysed scheduling approaches otherthan “traditional” fixed or dynamic priorities. Dong-In etal. [18] have analysed Time Division Multiple Access(TDMA) approaches, Haman et al. [19] have focused on amodel where tasks are split in mandatory and optional parts.This paper is based on reservation–based scheduling [1], [8],which allows us to exploit temporal isolation and analyse each task separately. Abeni and Buttazzo proposed a model for RRscheduling based on queueing theory [4], [9]. The computationof the deadline miss probability requires to numerically solvean eigenvector problem for an infinitely large matrix. Recently,approximated solution techniques have been proposed forefficient numeric computation of a bound for the probabilityof meeting the deadline [20].In this paper, we show how the adoption of the reservationscheduler and the restriction to periodic tasks produces amodel that is a particular instance of a QBDP. Efficientnumeric solutions for QBDP and for M/G/1 queue can befound in the work of Latouche and Ramaswami [21] and ofNeuts [22], who pioneered the application of matrix geomet-ric methods for the solution of infinite M/G/1 queues. Theliterature in the field is rich of optimised methods derivedusing specific properties of the transition matrix. The mostremarkable achievements are summarised in a comprehensivebook [10]. In this paper, we consider numeric methods as abasis for comparison but our main focus is on analytical closedform solutions.Mills and Anderson [23] have recently considered theproblem of stochastic analysis for resource reservations onmultiprocessor systems. The authors main focus is on thecomputation of tardiness and response time bounds for theaverage case. The authors also offer a very conservative resulton the probabilistic deadlines, which is applicable only ifdeadlines much larger than the period are considered.A customary assumption made in the literature on queueingnetworks is that inter–arrival times and service times are i.i.d.processes. In this paper, we stick to the same assumption. Dif-ferent authors have recently questioned on the applicability ofthe i.i.d. assumption in the area of real–time applications [24].Remarkable is the so called notion of probabilistic worstcase execution time [25], which essentially corresponds toassociating a worst case to several execution scenarios thattake place within a given probability. A possible evolution ofthis concept could lead to finding an i.i.d. overapproximationfor a computation process that is not i.i.d. A similar ideaunderpins a recent work by Liu et al. [26], where the authorstackle the correlation problem decomposing the process into adeterministic and an i.i.d. component. In a similar context ourresults could be used to study the evolution of the systemunder the action of the i.i.d. component or of the i.i.d.overapproximation of the process.A complementary issue to our work is how to derivestatistically sound estimates for the probability distribution ofthe computation time. A useful inspiration could come fromthe application of the Extreme Value Theory [27], but thematter is reserved for future investigations.The results shown in this paper take to its natural completiona line of work started a few years ago that has produced anumber of intermediate results. The relation with our priorachievements is detailed in Section VI-C.II. P
ROBLEM D ESCRIPTION
A. Task Model
We consider a set of real–time tasks { τ i } sharing a process-ing unit (CPU). A real–time task τ i consists of a stream of jobs J i,k . Each job J i,k arrives (becomes eligible for execution)at time r i,k , and finishes at time f i,k after executing for atime c i,k . We restrict to periodic tasks, meaning that twoadjacent arrivals are spaced out by a fixed amount of time T i : r i, k +1 = r i k + T i .The computation time of each job c i,k is assumed to be ani.i.d. stochastic process U i . For each k the computation time isa random variable described by the Probability Mass Function(PMF) U i ( c ) = Pr { c i,k = c } .Job J i, k is associated with a deadline d i,k = r i, k + D i (where D i is said relative deadline), that is respected if f i, k ≤ d i, k , and is missed if f i, k > d i, k . In this work, probabilistic deadlines [4] are used instead of traditional harddeadlines d i,k . A probabilistic deadline ( D i , p i ) is respectedif Pr { f i, k > r i, k + D i } ≤ p i . If p i = 0 the deadline is hard. B. The scheduling algorithm
As multiple real–time tasks may be concurrently active,we use a RR scheduler. Each task τ i is associated with areservation ( Q si , T si ) , meaning that τ i is allowed to executefor Q si ( budget ) time units in every interval of length T si ( reservation period ). The fraction of CPU allocated to thetask is said bandwidth B i and is defined as B i = Q si /T si . Theparticular implementation of the RR approach that we consideris the Constant Bandwidth Server ( CBS ) [1]. In the
CBS ,reservations are implemented by means of an Earliest DeadlineFirst (EDF) scheduler. The EDF schedules tasks { τ i } basedon their scheduling deadlines d si,k , which are dynamicallymanaged by the CBS algorithm. When a new job J i,k arrives,the server checks whether it can be scheduled using the lastassigned scheduling deadline d si,k − . In the affirmative case,the scheduling deadline of the job is initially set to currentdeadline d si,k = d si,k − . Otherwise, the initial deadline d si,k isset equal to r i,k + T si . Every time the job executes for Q si time units (i.e., its budget is depleted), its scheduling deadlineis postponed by T si : d si,k = d si,k + T si . This way, the task isprevented from executing for more than Q si units with the samedeadline. As a consequence, each task is reserved an amountof computation time Q si in each server period T si regardlessof the behaviour of the other tasks. This property is called temporal isolation and it holds as long as the system satisfiesthe following schedulability condition : X i B i = X i Q si T si ≤ . (1)The scheduling deadline d si, k has, in general, nothing to dowith the deadline d i, k of the job: it is simply instrumental tothe implementation of the CBS (see [1] for more details).
C. Problem Statement
In view of the temporal isolation property, each task isguaranteed a minimum share of the processor Q si /T si indepen-dently of the behaviour of the other tasks. As a consequence,it is possible to carry out a conservative analysis leading to thecomputation of a lower bound of the probability of respecting adeadline assuming that the task always receives this minimum(as long as Condition (1) is respected). The advantage isthat the behaviour of each task can be studied in isolation.Therefore, we can remove the subscript i meaning that theanalysis refers to one specific task.In this setting, our problem is formulated as follows. Problem 1:
Given a periodic real–time task with a stochas-tic computation time characterised by a PMF U ( c ) , findconditions on the reservation parameters ( Q s , T s ) such thatthe task respects the probabilistic deadline ( D, p ) .A few remarks are in order. First of all, we look for analyticalconditions, which can be inverted and offer easy solutionfor the problem of system design. Second, in order to besafely utilisable, such conditions have to be sufficient (althoughnecessity is certainly a desirable additional requirement).IV. S TOCHASTIC M ODEL
In this section, we first recall some basic definitions onMarkov chains and in particular on QBDP. Then, we showhow a task scheduled by a resource reservation is convenientlymodelled as a QBDP (Theorem 1). Finally, we show how toderive a conservative approximation of this model, which hasa parametric accuracy and which retains the structure of aQBDP.
A. Background on Markov Chains A Discrete–Time Markov Process (DTMP) { X n } is a discrete–time stochastic process such that itsfuture development only depends on the currentstate and not on the past history. This can bestated in formal terms on the conditional PMF: Pr { X n = x n | X = x , X = x , . . . , X n − = x n − } = Pr { X n = x n | X n − = x n − } . A DTMP defined overa discrete state space is said Discrete–Time Markovchain (DTMC). Given a DTMC, let π ( j ) n represent theprobability π ( j ) ( n ) = Pr { X n = j } , π n be the vector π n = [ π (0) n , π (1) n , . . . ] , P = [ p i,j ] be a matrix whosegeneric element p i,j is given by the conditional probability p i,j = Pr { X n = j | X n − = i } . Starting from an initialprobability distribution π , the application of the Bayestheorem and of the properties of the Markov Processes allowus to express the evolution of the distribution by the matrixequation π n +1 = π n P . The matrix P is said probabilitytransition matrix. An equilibrium point for this dynamicequation is a vector ˜ π such that ˜ π = ˜ πP .Consider a state i of a DTMC. Let the random variable T i = min { n > s.t. X n = i | X = i } denote the first returntime to state i . The state i is transient if Pr {T i < ∞} < , i.e., if there is some probability that starting from i thestate will never return to i . The state i is transient if it is notecurrent. The period d i of a recurrent state i is defined asthe greatest common divider of the set of all numbers, n , forwhich Pr { X m = i ∧ X m + n = i } > , ∀ m . A state is said aperiodic if its period d i = 1 . A DTMC is said aperiodic, ifall of its states are aperiodic.The mean recurrence time of a state i is the expected valueof T i : M i = E {T i } . The state i is positive recurrent if M i isfinite, and the DTMC is positive recurrent if all its states arepositive recurrent.A DTMC is said irreducible , if every state can be reachedfrom any other state in a finite number of steps. It can beshown that in an irreducible DTMC all states are of the sametype. So, if one state is aperiodic, so is the DTMC.A very important property of irreducible and positive recur-rent DTMC is the existence of a single equilibrium ˜ π = ˜ πP where the limiting distributions lim n →∞ π n converge startingfrom any initial probability distribution π . This equilibriumis called steady state distribution .A DTMC is called a Quasi–Birth–Death Process (QBDP)if its probability transition matrix P has the following blockstructure: P = C A · · · A A A · · · A A A · · · A A A · · ·· · · · · · · · · · · · · · · (2) When the matrices are scalars, this structure reduces to thestandard Birth–Death Process (BDP).
B. A resource reservation as a Markov Chain
We will denote by F U ( c ) = P ch = c min U ( h ) the CumulativeDistribution Function (CDF) of the execution time. For sim-plicity, we will assume that the server period T s is chosen asan integer sub–multiple of the activation period T : T = N T s .Other choices are possible but make little practical sense.Let d sk denote the latest scheduling deadline used for job J k and introduce the symbol δ k = d sk − r k . The latest schedulingdeadline d sk is an upper bound for the finishing time of thejob (if Equation (1) is respected, then f k ≤ d sk ). Hence, δ k isan upper bound for the job response time. Example 1:
Consider the schedule in Figure 1. The sched-ule in the figure considers two adjacent jobs starting at r k and r k +1 and the reservation period is chosen as one third of thetask period. Job J k , in this case finishes beyond the deadline(which in our periodic model is r k +1 ). More precisely, the lastreservation period that it uses (in which its finishing time lies)is upper–limited by the scheduling deadline d sk .The quantity δ k takes on values in a discrete set: the integermultiples of T s and the probability p of meeting the deadlineis lower bounded by Pr { δ k ≤ D } .The evolution of δ k is described as follows [9]: v = c v k +1 = max { , v k − N Q s } + c k +1 δ k = (cid:24) v k Q s (cid:25) T s (3) r k r k+1 k d ss s T s k+1 d s
2T 5T s s k δ Figure 1. Example schedule of a task by a
CBS . The two colours denotedifferent jobs.
The variable v k cannot be measured directly and it representsthe amount of backlogged execution time that has to be servedby the CBS scheduler when a new job arrives.Since the process U modelling the sequence c k of the com-putation time is assumed a discrete valued and i.i.d. randomprocess, the model in Equation (3) represents a Discrete–TimeMarkov Chain (DTMC) that we define M , where the statesare determined by the possible values of v k and the transitionprobabilities by the PMF of the computation time U ( c ) .This model permits a fine–grained modelling of the be-haviour of the reservation, which can be difficult to treat. Onepossible simplification is to collapse into a single state all thestates for which δ k ≤ D = N T s , which correspond to thevalues of v k such that v k ≤ N Q s . In the modified DTMC M , the state S is defined as S = ( if v k ≤ N Q s i if v k = N Q s + i . By using Equation (3), the transition probabilities for thisDTMC can be written as follows: p i,j = Pr { v k +1 ≤ NQ s | v k = i + NQ s } , if j = 0 Pr { v k +1 = j + NQ s | v k ≤ NQ s } , if i = 0 , j = 0 Pr { v k +1 = NQ s + j | v k = i + NQ s } , if i = 0 , j = 0= Pr { c k ≤ NQ s − i } = F U ( NQ s − i ) , if j = 0 Pr { c k = j + NQ s } = U ( j + NQ s ) , if i = 0 , j = 0 Pr { c k = NQ s + j − i } = U ( j − i + NQ s ) , if i = 0 , j = 0 . . Let ˜ π k be the (infinite) vector where the i th element representthe probability associated with the i th state of the DTMC M after k step of evolution starting from an initial probabilityvector ˜ π . The recursive equation for the evolution of ˜ π k is ˜ π k +1 = ˜ π k P . The objective of our analysis can now be statedas the computation of a lower bound for the first element ofthe steady state probability vector ˜ π = lim k →∞ π k . As longas we are not interested in the distribution of δ k inside theregion δ k ≤ N Q s , collapsing into one state all the values of v k smaller than N Q s does not introduce any error because suchstates do not have influence on the next state ( max { , v k − N Q s } = 0 in Equation (3)).The probability matrix P resulting from the computationabove has the structure shown in Figure 2, where a H + h = p i, i + h = U ( h + N Q s ) b H − i = p i, = F U ( N Q s − i ) , b H a H +1 . . . a n . . .b H − a H a H +1 . . . a n . . .b H − a H − a H a H +1 . . . a n . . .. . . . . . . . . . . . . . . . . .b a . . . a H a H +1 . . . a n . . .a a a . . . a H a H +1 . . . . . . a a a h + H − . . . a H a H +1 . . . a a a . . . a H . . . ... ... ... ... . .. ... .. . , Figure 2. Structure of the transition matrix P and H is the minimum integer such that U ( N Q s + h ) = 0 forall h < H . This structure is recursive: from row H onward,each row is obtained by shifting the previous one to the rightand inserting a in the first position. Furthermore, the firstelement greater than zero of such recursive rows is dubbed a , while the last with a n : n = max { i | a i > } . We nowintroduce a useful notation for sub–matrices. Definition 1:
Let P = ( p i, j ) be a matrix whose elementsare p i,j . Let α = { i i , i , . . . , i n } β = { j i , j , . . . , j m } twoordered set of indexes. The sub–matrix P [ α, β ] is a matrixwhose elements are p i h ,j t for all h ∈ [1 , n ] t ∈ [1 , m ] .Likewise, if π is a vector, we denote π [ α ] the sub–vector whoseelements are π i h for all h ∈ [1 , n ] .From the properties of our transition matrix we can provethe following result [28]. Theorem 1:
Let H be the minimum integer such that U ( N Q s + h ) = 0 for all h < H . Let F be defined as max { n − H, H } . Define α ( i, F ) the set { i, . . . , i + F − } and β ( j, F ) the set { j, . . . , j + F − } . The transition matrix P is block–tri–diagonal with the structure in Equation 2,where A = P [ α ( F, F ) ,β (0 , H )] , A = P [ α (0 , F ) ,β ( F, F )] , A = P [ α ( F, F ) ,β ( F, F )] , C = P [ α (0 , F ) ,β (0 , F )] , are square matrices oforder H. This qualifies the process as a QBDP.The structure of the QBDP exposed in Theorem 1 enables theapplication of efficient numeric solutions for the steady stateprobability [10], as discussed in Section VI.
C. A conservative approximation
In order to make the model tractable from the numeric pointof view, it is useful to introduce a conservative approximation.The notion of conservative approximation that we shall adopthere relies on the concept of first order stochastic dominance (defining an order relation between probability distributions):
Definition 2:
Given two random variables X and Y , withCDFs F x ( x ) and F y ( y ) , X has a first order stochastic domi-nance over Y ( X (cid:23) Y ) iff ∀ x F x ( x ) ≤ F y ( x ) .Based on this definition, a stochastic real–time task can beseen as a conservative approximation of another one if itsprobabilistic deadlines are stochastically dominated by theprobabilistic deadlines of the original task: considering δ k inEquation (3), this plainly means that in the modified systemthe low values of the δ k will have a greater probability and sowill be the probability of the first element of the probabilityvector (associated with the deadline satisfaction). As shown by Diaz et al. [13], if U ′ stochastically dominates U , then a system having the execution times distributedaccording to U ′ is a conservative approximation of the originalsystem (with the execution times distributed according to U ).A simple way to build U ′ to obtain such a conservativeapproximation is to replace c k with a new variable c ′ k whosedistribution is given by: U ∆ ( c ′ ) = ( if c ′ mod ∆ = 0 P k ∆ c =( k − U ( c ′ ) otherwise , (4)where ∆ is a scaling factor chosen as an integer sub–multipleof Q s . The transition matrix of the new DTMC has againthe structure in Fig. 2, where the different elements of thematrix are functions of the parameter ∆ . Large values of ∆ correspond to a smaller size for matrices A , A , A inEquation 2. This reduces the time required for the computationof the steady state probability paying the price of a coarserapproximation for the computed probability.V. A N ANALYTICAL BOUND
This section presents an analytic solution for a QBDPdescribed by the transition matrix reported in Fig. 2. In thediscussion, we assume that the conservative approximationdiscussed in Section IV-C for some ∆ .The first key result of the Section is Theorem 2, whichshows a general expression for the steady state probabilityof respecting the deadline. After introducing an additionalsimplification in the model, this leads to the analytical boundin Theorem 6 and in Corollary 7, which represent the coretheoretical results of the paper. A. A solution for generic QBDP processes
Before going into the theoretic details, let us define thefollowing function γ : N × R → R as γ k,l = k X j =0 α j l k − j , where α j = a j /a . Using this function and the structure of theQBDP, it is possible to write the equation expressing the steadystate equilibrium ˜ π k = ˜ π k P , (where ˜ π k = h ˜ π (0) k , ˜ π (1) k , . . . i ) byexpressing the probabilities ˜ π ( i ) k , i > H , at time k as a functionof ˜ π ( j ) k , ≤ j ≤ H , in the following way: ˜ π ( H ) k = n X j = H +1 α j ˜ π (0) k − H − X j =1 γ j, ˜ π ( H − j ) k , ˜ π ( H + l ) k = γ H − , + n X j = H +1 α j ˜ π ( l ) k − min ( n,l + H ) X j =1 j = H α j ˜ π ( l + H − j ) k , (5) holding for ∀ l > .The steady state solution for generic n > H > is givenby the following theorem: Theorem 2:
Consider a QBDP described by the transitionprobability matrix P given in Fig. 2, in which both a and a n differ from zero.ssume that the matrix W = . . . . . .
00 0 1 . . . . . .
00 0 0 ... . . . ... ... ... ... ... ... ... ... . . . . . . − αn − αn − − αn − . . . w − αH − . . . − α (6) where w = γ H − , + P nj = H +1 α j , has distinct eigenvalues.Let π ( j ) = lim k → + ∞ ˜ π ( j ) k be the steady state distribution ofthe state. One of the two following cases apply:I) if P H − j =0 γ j, ≤ P nj = H +1 ( j − H ) α j then the limitingdistribution is given by: ˜ π ( j ) = lim k → + ∞ ˜ π ( j ) k = 0 , ∀ j, (7)II) if P H − j =0 γ j, > P nj = H +1 ( j − H ) α j then: ˜ π (0) = Y β ∈B s (1 − β ) . (8)In the second case, B s is the set of stable eigenvalues of W (in this context an eigenvalue β is said stable if | β | < ), andthe terms ˜ π ( j ) with < j < H are known linear functions of ˜ π (0) , while the terms ˜ π ( j ) with j ≥ H are given by (5).Before showing the proof, we make two important remarks. Remark 1:
The assumption on the eigenvalues of the matrix W is merely technical (it simplifies the proof of the result)and it is not restrictive. In all our examples (both syntheti-cally generated and using data from real applications), it isrespected. Artificial examples that violate it could probablybe constructed but they are not relevant in practice. Remark 2:
As well as paving the way for Theorem 6,Theorem 2 contains an implicit numeric algorithm for the com-putation of ˜ π (0) , based on the computation of the eigenvaluesof the matrix W . Since the latter is in companion form, in thefollowing we refer to this algorithm as companion . B. Proof of Theorem 2
This section is devoted to the proof of the fundamentalTheorem 2, which will require several definitions and auxiliaryresults. The section can be skipped over if the reader is onlyinterested in the applications of the Theorem.The rationale behind the proof is the following. First, theequilibrium point of the QBDP is expressed as an iterativesystem. The evolution in the iteration step represents theconnection between the probabilities of the different states.Using this representation and some property of convergenceof the Markov chain, we can express all the steady–stateprobabilities as a function of ˜ π (0) , which can eventually befound as a solution of a linear system of equations.We start noticing that having a and a n different from zeroimplies that the Markov chain of the QBDP is irreducible andaperiodic. Therefore, it is guaranteed that the probability ofthe different states converge to a value [29]. Notice, however,that this does not necessarily imply the existence of a steady–state distribution (the distribution could shift toward increasingvalues of the state without ever reaching the equilibrium, withthe probability of each state going to ). a) The case of Positive Recurrent QBDP: If the QBDPis positive recurrent, it admits indeed a unique steady statedistribution. The first step of the proof is then to introducethe following vector: Π j = [˜ π ( j ) , . . . , ˜ π ( j + n − ] T , whosedimension is equal to n . It is possible to exploit (5) and (6) toderive the equilibrium of the QBDP by the following iterativeequation for the vector Π j : Π = ˜ π (1) ˜ π (2) ... ˜ π ( n ) = W Π ⇒ Π j = ˜ π ( j ) ˜ π ( j +1) ... ˜ π ( n − j ) = W j Π . Using this notation the normalisation constraint P ∞ h =0 ˜ π ( h ) =1 can be expressed as ∞ X h =0 ˜ π ( h ) = (cid:2) . . . (cid:3) + ∞ X i =0 Π i = 1 . (9) The characteristic polynomial of the lower–left companionform matrix W reported in (6) is simply given by P ( λ ) = λ n − γ H − , + n X j = H +1 α j λ n − H + n X j =1 j = H α j λ n − j , (10)from which it is trivially derived that the matrix W has onesimple eigenvalue in β = 1 and additional n − eigenvalues β i . Therefore P ( λ ) = ( λ − n Y i =2 ( λ − β i ) . (11)Since each β i verifies P ( β i ) = 0 , the following relation holds β ni − γ H − , + n X j = H +1 α j ! β n − Hi + n X j =1 j = H α j β n − ji = 0 ⇒ γ H − , + n X j = H +1 α j = β i γ H − ,β i + P nj = H +1 α j β n − ji β n − Hi . (12) Since all the eigenvalues are assumed simple, we canuse of the spectral decomposition of the matrix W : W = P n − i =0 β i G i , where the spectral projectors G i are given by G i = V i L i L i V i = N i V i L i , and L i and V i are respectively the leftand right eigenvectors associated with the i –th eigenvalue β i . N i is the normalisation constant needed to satisfy the spectralprojectors basic properties, i.e., G i G j = 0 for i = j and G i G i = G i . As a consequence, Π = W Π = P ni =1 β i G i Π , and, in general, Π j = W j Π = n X i =1 β ji G i Π = n X i =1 β ji N i V i L i Π . (13) Therefore, by combining (13) and (9), one gets: n X i =1 + ∞ X k =0 β ki v (0) i N i L i Π = 1 , (14) where v (0) i is the first element of the right eigenvector. Giventhe expression of the matrix W , the left L i and right V i cane easily found as a function of β i . From the expression ofthe eigenvectors, it follows immediately that N i = 1 L i V i = β niH − X j =0 γ j,β i β n − ji − n X j = H +1 ( j − H ) α j β n − ji . (15) We now state some auxiliary propositions on vector Π . Proposition 1:
The product between the left eigenvector L i and the initial vector of the iteration Π is given by L i Π = β n − H − i ( β i − H − X k =0 H − X j = k γ H − − j,β i ˜ π ( k ) . Proof:
The proof of the proposition follows by firstcomputing the explicit computation of the product L i Π , inwhich each term is substituted with the recursive Equations (5)and the constraint given in (12), and then noticing that β ni − β i − n − X j =0 β ji . See [30] for more details.
Proposition 2:
The initial vector Π is orthogonal to theleft eigenvector associated to β = 1 . Proof:
The proof follows from Proposition 1.
Proposition 3:
For any unstable eigenvalue β i (i.e., suchthat | β i | > ) of W it holds that L i Π = 0 . Proof:
If the QBDP has an equilibrium then (14) holdstrue. The unitary eigenvalue β = 1 does not play any role inthe summation of (14) in view of Proposition 2. Next, supposethat there exists one or more | β i | > . From Equation (14) itfollows that it may be L i Π = 0 , N i = 0 or Π = 0 . Sincethe normalisation factor cannot be null, let us first consider Π = 0 . Using (13) it follows that Π = 0 ⇒ Π j = 0 , ∀ j .Therefore, ˜ π ( j ) = lim k → + ∞ ˜ π ( j ) ( k ) = 0 , ∀ j, and, since the Markov chain is irreducible and aperiodic, theQBDP does not have a unique stationary distribution [29],which contradicts the hypothesis.It then follows that for any unstable eigenvalue L i Π = 0 .From Rouche’s theorem [31] we have that the number ofeigenvalues β i such that | β i | ≥ of the matrix W is exactlyequal to H , where H − have | β i | > . The consequencesof Proposition 3 are twofold. First, it states that Proposition 1defines H − linear equations H − X k =0 H − − k X q =0 γ q ,β i ˜ π ( k ) = 0 , ∀ β i ∈ B ⋆s , (16) where B ⋆s is the set of H − unstable eigenvalues except β = 1 (the unstable eigenvalue β does not play any role byProposition 2). The H unknown probabilities ˜ π (0) to ˜ π ( H − of (16) are also the unknowns of the recursion formulae (5).The second consequence is that X β i ∈B s v (0) i N i − β i L i Π = 1 , (17) where B s is the set of stable eigenvalues. By substitutingin (17) the result given in Proposition 1 and the expression ofthe right eigenvector L i , we get − X β i ∈B s N i β Hi H − X k =0 H − − k X q =0 γ q ,β i ˜ π ( k ) = 1 . (18) By means of Proposition 3, the summation can be extended tothe unstable eigenvalues, except for the first eigenvalue β =1 , which instead induces indefiniteness of (18). The solutionto (18) is derived exploiting the spectral projectors property P ni =1 G i = I n . Indeed, summing the elements in position ( n − H, n − j ) , for ≤ j ≤ H − , we have for each j − n X i =1 N i v ( n − H ) i l ( n − j ) i = − n X i =1 N i β Hi γ j,β i = 0 , and hence − n X i =2 N i β Hi γ j,β i = N γ j, , where N is easily obtained by (15) for β = 1 , i.e., N = 1 H − X j =0 γ j, − n X j = H +1 ( j − H ) α j = 1 D . Moreover, for the elements in position ( n − H + 1 , , we get − n X i =1 N i v ( n − H +1) i l (1) i = n X i =1 N i β H − i α n β i = 0 ⇒ − n X i =2 N i β Hi = N . Substituting these relations in (18) produces the equation H − X k =0 H − − k X q =0 γ q , ˜ π ( k ) = D , (19) which, used in conjunction with the H − equations of (16),determines the set of unknown probabilities.In order to have an analytic solution of this linear systemof H equations in H unknowns, we start by collecting theprobability with the highest index, i.e., ˜ π ( H − + H − X k =0 H − − k X q =0 γ q , ˜ π ( k ) = D ˜ π ( H − + H − X k =0 H − − k X q =0 γ q ,β i ˜ π ( k ) = 0 , β i ∈ B ⋆s , from which it is possible to immediately have the solution ˜ π ( H − = − H − X k =0 H − − k X q =0 γ q ,β H ˜ π ( k ) and the H − new linear equations in H − unknowns H − X k =0 H − − k X q =0 ( γ q , − γ q ,β i ) ˜ π ( k ) = D , β i ∈ B ⋆s , that, by simple algebraic manipulations, leads to H − X k =0 H − − k X q =0 q − X q =0 γ q ,β i ˜ π ( k ) = D − β i , β i ∈ B ⋆s . From the new set of H − equations the element ˜ π ( H − can be collected, thus leading to a recursive solution formula.he recursion can be executed for H steps until the followingfinal equation is obtained ˜ π (0) = D Y β i ∈B ⋆s (1 − β i ) = H − X j =0 γ j, − n X j = H +1 ( j − H ) α j Y β i ∈B ⋆s (1 − β i ) . (20) The result in (20) can be suitably rewritten in a moreuseful way. To this end, we first rewrite the characteristicpolynomial (11) as follows P ( λ ) = ( λ − n − Y i =2 ( λ − β i ) = λ n − + n − X j =1 S j ( β ) λ j − , (21) where S j ( β ) = ( − n − j +1 X J ∈C Y β J + X J ∈C Y β J ! , (22) and where C and C are proper sets of indices comingfrom the explicit computation of the characteristic polynomial.Since the product of all the eigenvalues, except for the firstone, is given by n Y i =2 (1 − β i ) = 1 + n − X j =1 ( − n − j X J ∈C n − j Y β J = 1 + n − X j =1 W j ( β ) , where, by means of (22), W k ( β ) = − P kj =1 S j ( β ) , one gets n Y i =2 (1 − β i ) = 1 − n − H X j =1 j X k =1 S k ( β ) − n − X j = n − H +1 j X k =1 S k ( β ) . (23) From (21) and (10), S k ( β ) = α n − k +1 , for ≤ k ≤ n ,and S k ( β ) = γ H − , + P nj = H +1 α j , for k = n − H + 1 .Substituting these relations in the last two terms of (23), onegets − n − H X j =1 j X k =1 S k ( β ) = − n X j = H +1 ( j − H ) α j , − n − X j = n − H +1 j X k =1 S k ( β ) = ( H − γ H − , − H − X j =1 ( j − α j . Since H − γ H − , − H − X j =1 ( j − α j = H − X j =0 γ j, , Equation (23) is rewritten as n Y i =2 (1 − β i ) = H − X j =0 γ j, − n X j = H +1 ( j − H ) α j = D , (24) that substituted in (20) finally yields Equation (8).At this point we have proved that if the QBDP has anequilibrium , this is given by (8), by the recursive solutionof the linear system of equations (19) and (16), and by therecursion formula (5). b) The case of non–positive recurrent QBDP: If theQBDP is not positive recurrent we can re–write matrix P usingits block–tridiagonal representation in (2). We can immediatelyapply the following theorems. Theorem 3: [29] An irreducible Markov chain has a sta-tionary distribution if and only if all its states are positiverecurrent.
Definition 3:
Assume A = A + A + A is irreducible.Then, by the Perron–Frobenius Theorem, there exists a uniquevector µ > with T µ = 1 and Aµ = µ . The vector µ is called the stationary probability vector of A , while is acolumn vector whose elements are all equal to one. Theorem 4: [21] The QBDP is transient if T A µ < T A µ , null recurrent if T A µ = T A µ and positiverecurrent if T A µ > T A µ .By Theorem 3, the QBDP does not have an equilibrium ifand only if it has at least one state that is transient or nullrecurrent. Without loss of generality, assume that n ≤ H (the case n > H can be equivalently derived), which implies A ∈ R H +1 × H +1 . Since A is irreducible, one immediatelyhas that µ = H +1 , from which it is possible to explicitlycompute T A µ = 1 H + 1 H − X j =0 ( H − j ) a j T A µ = 1 H + 1 n X j = H +1 ( j − H ) a j . From Theorem 4, the QBDP does not have an equilibrium ifand only if T A µ ≤ T A µ or, equivalently, H − X j =0 ( H − j ) a j ≤ n X j = H +1 ( j − H ) a j , that, dividing both terms by a leads to H − X j =0 γ j, ≤ n X j = H +1 ( j − H ) α j . (25) This condition is exactly the one that we formulated inthe case I of the Theorem, and has just been shown to beequivalent to the process being transient on null recurrent.However, since the QBDP is still irreducible and aperiodic, alimiting probability exists, which is given,as in Equation (7),by: ˜ π ( j ) = lim k → + ∞ ˜ π ( j ) ( k ) = 0 , ∀ j, And this ends the proof of Theorem 2.
Remark 3:
When condition (25) strictly applies, the numer-ator of Equation (20) is negative. Since Equation (8) still holdstrue, the denominator of (20) will be negative too. It followsthat in the case of absence of an equilibrium for the QDBP,both (8) and (20) return a coincident value ˜ π (0) > , clearlyunfeasible. C. Computation of the bound
As discussed earlier, the steady state probability of meetingthe deadline can be found by computing the first element ˜ π (0) of the ˜ π that solves the equation ˜ π = ˜ πP , where P is theinfinite transition matrix in Fig. 2 associated with the DTMC . Let us consider a new DTMC whose transition matrix isgiven by: P ′ = b H a H +1 a H +2 . . . a n − a n . . .b H − a H a H +1 . . . a n − a n − a n . . . a ′ H − a H . . . a n − a n − ... . . . a ′ H − a H . . . a n − ... . . . ... ... ... ... ... ... ... , (26) and a ′ H − = b H − = a H − + a H − + . . . + a . Remark 4:
The underlying idea is very simple. Considerthe DTMC associated with matrix P . The terms on the leftof the diagonal are transition probabilities toward states witha smaller delay than the current one. By using P ′ we lumptogether all these transitions to the state immediately on the leftof the current one. For instance, if the current state correspondsto server periods of delay, its only enabled transition to theleft will be to the state associated with delay . The effectof deleting the transition toward states associated with smallerdelays is to slow down the convergence toward small delays,thus decreasing the steady state probability of these states.Let π represent the steady state probability of this system. Wecan easily show the following: Lemma 5:
Let Γ be a random variable representing thestate of the DTMC evolving with transition matrix P and Γ ′ be a random variable describing the state of the DTMCassociated with the transition matrix P ′ . If both DTMC areirreducible and aperiodic, then at the steady state Γ ′ has afirst order stochastic dominance over Γ : Γ ′ (cid:23) Γ , accordingto Definition 2. Therefore, for the first element of the steadystate probability, we have ˜ π (0) ≥ π (0) . Proof:
The proof is omitted for the sake of brevity(see [30]).In view of this Lemma, we can concentrate on the systemassociated to the transition matrix P ′ . In such a case, weimmediately derive that the equilibrium condition π = πP ′ produces the following recursion: π (1) = n X j =2 α j π ,π ( l ) = n X j =2 α j ! π ( l − − min( n,H + l − X j =2 α j π ( l − j ) , (27) where the equalities hold for ∀ l > . This equations, as well as P ′ , have been respectively derived from (5) and P by imposing H = 1 . In such a situation, the following theorem holds. Theorem 6:
Consider a QBDP described by the transitionprobability matrix (26), in which both a n and a ′ H − differ fromzero. Assume that the matrix W in (6) has distinct eigenvaluesafter imposing H = 1 . Then, there exists a limiting probabilitydistribution given by π (0) = lim k → + ∞ π (0) ( k ) = max { − n X j =2 ( j − α j , } == max { − n X j =2 ( j − a j a , } , (28) while the generic terms π ( j ) , with j > , are given by (27). Proof:
The proof follows immediately from the fact that H = 1 implies that β = 1 is the only unstable eigenvalue ifthe QBDP has an equilibrium, i.e., B s of Theorem 2 comprisesall the eigenvalues except β = 1 . Hence, by considering (24)for H = 1 , the proof follows immediately.We complete the section with a remark. The first one is onthe intuitive meaning of the result just proposed. Considera DTMC with transition matrix as in Fig. 2 and assumefor simplicity n = 4 and H = 1 . The analytical bound inTheorem 6 is given by: π (0) = 1 − α − α − α = 1 − a a − a a − a a In the computation of the steady state probability π (0) wehave to consider every possible transition to the right (i.e.,increasing the delay) that the system can make. For each ofthem, we compute the ratio between the probability of takingthe transition and the aggregate probability of moving to theleft (decreasing the delay). In the final computation each ofthis ratio has a state proportional to the delay introduced. Inour example, a corresponds to three steps to the right and isweighted by the factor .The application of this result to our context can be for-malised in the following: Corollary 7:
Consider a resource reservation used to sched-ule a periodic task and suppose that the QBDP producedrespects the assumption in Theorem 2. Then the probabilityof respecting the deadline is greater than or equal to: π (0) = 1 − n X j =2 ( j − U ′ ∆ ( N + j − Q s ) P N − h =0 U ′ ∆ ( hQ s ) (29) This corollary descends from the following facts: 1) the DTMCdescribed by the matrix P in Fig. 2 is a conservative approx-imation of the system, 2) Lemma 5 provides an analyticallytractable approximation of the DTMC with transition matrix P ′ , 3) Theorem 2 and Theorem 6 contain the analyticalbounds. VI. E XPERIMENTAL VALIDATION
We have validated the presented approach in two differentways. First, we have computed the probabilistic deadline usingsynthetic distributions, to compare accuracy and efficiency ofthe analytic bound against several other methods and to assessthe impact of the scaling factor ∆ (Eq. (4)) and of the band-width. This set of experiment reveals a very good performanceof the bound for appropriate choices of the scaling factor ∆ . Itsvery low computation time allows one to select the best choiceof ∆ by testing a number of alternative choices. The tightnessof the bound improves when the bandwidth is sufficient toachieve an acceptable real–time behaviour for the application.In a second set of experiments, we have evaluated themethod on a real robotic application, for which the mathemat-ical assumptions underlying the model do not apply strictly.The results produced are obviously approximate. Still, thegood quality of the approximation makes an interesting casefor the practical applicability of the methodology. . Synthetic Distributions We report the results of the comparison between the nu-meric solution resulting from Theorem 2 and discussed inRemark 2 ( companion ), the analytic approximated bound inCorollary 7 ( analytic ) the Cyclic Reduction algorithm [10]( CR ) and the bound developed by Abeni et al. [32] ( gamma ).We have chosen CR after a selection process in which severalalgorithms for the solution of general QBDP problems andimplemented in the SMCSolver tool–suite [33] were testedon a set of example QBDPs derived from our application.The gamma algorithm is an approximate bound specificallytailored to the analysis of probabilistic guarantees for resourcereservations, so it was considered as as a perfect match forour analytic bound. The different algorithms have beenimplemented in C++ in the PROSIT [34] tool. PROSIT canbe used for analysis and for synthesis purposes (as shownin Section VII). When the tool is used for analysis, the userspecificies activation period and deadline, parameters of theRR ( Q s and T s ), distribution of computation and inter–arrivaltimes and solution algorithm. When the tool is queried in thisway, it computes the distribution of the task response timesand hence the probability of meeting the deadline.As a representative sample of our findings, we report belowthe results obtained for a periodic task with period T =100 ms and random execution time. The computation timewas distributed according to a beta distribution: P { C = c } = f U ( c ) = J ( α, β ) c α − (1 − c ) β − , with support (i.e., thevalidity range for the random variable) c ∈ [0 , µ s, with α = 2 and β = 7 ( J ( α, β ) is a normalisation constant). Thebeta distribution is interesting because it is unimodal and hasa finite support, which make it a good fit to approximate thebehaviour of a large number of real–time applications. Effect of ∆ . A first set of experiments was to evaluate theimpact of the ∆ scaling factor. We considered two possi-ble values for the reservation period: T s = P = 25 ms and T s = P = 50 ms . The budget was chosen equalto Q s = 0 . T s with a bandwidth B = 45% . Figure 3shows the results for the probability π (0) of respecting thedeadline achieved for different values of ∆ (chosen as asub–multiple of Q s ). In accordance with our expectations, CR and companion produce almost the same result interm of probability (differences are from the th digit) andthe probability changes monotonically with ∆ . For example,for T s = 50 ms the value of the probability is . for ∆ = Q s (the coarsest possible granularity), while it is . for ∆ = Q s / . The reason for this decrease is obvious sincere–sampling introduces a conservative approximation and theerror is larger for increasing granularity. For both CR and companion , the computation time changes with ∆ in asubstantial way. For example, for CR and for T s = 50 ms ,it is ms at ∆ = Q s and . ms at ∆ = Q s / . In thisrun of experiments, the computation time of the companion algorithm is slightly smaller than the one reported using CR ,but the results are too close to claim a clear dominance.For the analytic bound the computed probability is not π ( ) Q s / ∆ Probability vs ∆
0 2 4 6 8 10 12 14 16 18 20 22 24 26 28 30 32 34 36 38 40 42 44 C o m pu t a t i on t i m e Q s / ∆ Computation time vs ∆ Analytic, T s = 50 µ sAnalytic, T s = 25 µ sCR, T s = 50 µ s CR, T s = 25 µ sCompanion, T s = 50 µ sCompanion, T s = 25 µ s Gamma, T s = 50 µ sGamma, T s = 25 µ s Figure 3. Impact of the scaling factor ∆ on the accuracy of the computedprobability and on the computation time always monotonic with ∆ . In our example, for T s = 50 ms theprobability grows moving from . at Q s to . at Q s / ,and then decreases, finally becoming . at Q s / . Sharperchanges can be observed for other distributions. The reasonis that in the analytic bound we have two distinct effects(which play in opposite directions). On the one hand, if wereduce Q s we have the same conservative approximation effectas for CR or for any other numeric method. On the other, as ex-plained in Remark 4, lumping together all backward transitionsreduce the recovery of the error when the computation demandis smaller than the allocated bandwidth. In this example, thefirst effect determines the growth of the probability whengoing from ∆ = Q s to ∆ = Q s / ; the second effectdetermines the decrease of the probability form Q s / onward.The probability computed by analytic is very close to theone of the numeric algorithm it derives from ( companion )for ∆ = Q s / , while the computation time is several orders ofmagnitude below. In our experience with different distributions(both synthetic and experimental) the choice of ∆ = Q s / hasconsistently produced an acceptable performance. The gamma bound shows an intermediate performance between numericmethods and the analytic bound both for the accuracy and forthe computation time. Behaviour with changing bandwidth.
In order to comparethe accuracy of the analytic method against the numericsolutions ( CR ) for different bandwidths, we considered atask with the activation and scheduling parameters as in theexperiments reported above. The budget Q s was changedso that the resulting bandwidth ranged in [35% , . Thegranularity ∆ was fixed for CR to a small value ( µ s) toachieve a good approximation and to ∆ = Q s / for the analytic solution.The results reported in Table I show an important gapbetween analytic and CR for small values of the band- able IP ROBABILITY FOR DIFFERENT BANDWIDTH AND ∆ = 50 us Bandwith 35% 40% 45% 50% 60%Analytic Bound 0.602 0.809 0.906 0.956 0.991Cyclic Reduction 0.773 0.878 0.929 0.965 0.992 width. The gap is significantly reduced for bandwidth greaterthan / . Smaller values of the bandwidth produce aprobability level below . , which is not acceptable for mostreal–time applications. The reason for the improvement ofthe analytic bound when the bandwidth increases is probablydue to the fact that the system recovers more easily fromlarge delays and this alleviates the impact of the conservativesimplifications that underlie the analytic model. B. Real application different paths across an area delim-ited by a black line. For each run, we have captured a videostream containing the line. The data sets roughly consisted of frames each and were later used for multiple off–line ex-ecution of the vision algorithm. A first group of ten executionsfor each data set was with the algorithm executed in a taskrunning alone and scheduled with the the maximum real–timepriority (99 for SCHED FIFO). This allowed us to collectstatistics of the computation time associated with the data set.In a second group of executions, we have replicated a real–lifecondition. The vision algorithm was in this case executed ina periodic task processing a frame every T = 40 ms . The taskwas scheduled using SCHED DEADLINE, with server period T s = 20 ms and with different choices of the bandwidth inthe range [35% , . For each data set and for each choiceof the bandwidth, we repeated ten executions recording theprobability of deadline miss. The probability averaged throughthe execution was compared with the one that found usingthe PROSIT tool, executed with different solution methods andwith the distribution estimated from the data set as input. InFigure 4, we report the CDF distributions of the differencebetween the two probabilities for three representative choicesof the bandwidth. The symbol ∆ Analytic denotes the differenceobtained using the analytic method (with different choicesof the scaling factor ∆ ), while ∆ CR denotes the differenceobtained using the cyclic reduction QBDP solver, with ∆ set to µs . The three levels of bandwidth shown in thethree sub–plots produced different probability of meeting thedeadline. For bandwidth equal to , this probability rangedin [75% , . The range was [90 . , for bandwidth Error [%] -5 0 5 10 P r obab ili t y Bandwidth: 60% ∆ CR ∆ Analitical (Q s = ∆ ) ∆ Analitical (Q s = ∆ /2) ∆ Analitical (Q s = ∆ /4) Error [%] -5 0 5 10 P r obab ili t y Bandwidth: 50% ∆ CR ∆ Analitical (Q s = ∆ ) ∆ Analitical (Q s = ∆ /2) ∆ Analitical (Q s = ∆ /4) Error [%] -5 0 5 10 P r obab ili t y Bandwidth: 40% ∆ CR ∆ Analitical (Q s = ∆ ) ∆ Analitical (Q s = ∆ /2) ∆ Analitical (Q s = ∆ /4) Figure 4. Distribution of the difference between the experimental probabilityand the one found with PROSIT tool. equal to % and it was [95 . , for bandwidth equalto %.As we observe in the plot, the numeric algorithm (CR)produces an error between − % and % for all the threevalues of the bandwidth. For the analytic bound, in this specificcase, the most convenient choice was to set the scaling factor ∆ to Q s (in other cases we found a better performance forsmaller values). The bound is evidently less accurate, but: 1.it remains below at least of the times even in themost challenging scenario (small bandwidth), 2. is reduced tobelow for higher values of the bandwidth.We observe that the vision algorithm iteratively builds uponprevious results to produce the estimate. This introduces astrong correlation structure in the process that disrupts theassumptions required for an exact application of the method.In addition, the execution on a “real” operating system comesalong with an inevitable amount of un–modelled overhead.Still, the level of approximation that we have reported could beacceptable in most cases. Similar software applications (video–encoding and decoding) were analysed in a previous work [36]with similar conclusions. Clearly, we are not claiming anygenerality for this fact. We are aware that for other applicationsdropping the time dependency and the correlation structure ofthe computation time process could produce very large errorsin the estimation of the probability. As reported in the relatedwork, this is a very active research area that is likely to attractthe attention of different researchers in the forthcoming years. C. Discussion
In our first conference paper [28], we derived a model forthe evolution of a RR scheduled real–time task. The model wasshown to be a QBDP and was solved using the simple numericalgorithm proposed by Latouche and Ramaswami [21]. Animportant limitation of the model was its pessimism due tohe fact that it neglected the budget shared between adjacentjobs. For instance, in the example in Figure 1, the modelwould ignore the budget used by the second job in the fourthreservation period. In a later work [36], the same model wasinstantiated to the sub–case of periodic tasks, it was furthersimplified in a conservative direction and then used for thecomputation of an analytic bound.In the present paper, we start from the more accurate modelintroduced by Abeni and Buttazzo back in 1998 [4], and weinstantiate it to the case of periodic tasks (Section IV-B).We introduce the scaling factor ∆ (Section IV-C) obtaining,once again, a QBDP. When the model is used for numericcomputations, the ∆ parameter allows us to decide the degreeof pessimism introduced in the analysis. If we set ∆ = 1 , weobtain a close approximation of the actual behaviour of thetask. If we set ∆ = Q s , we recover the conservative modelused in our previous work [28]. As shown in Figure 3, verydifferent trade–offs between computation time and accuracyof the probability result from different choices of ∆ .The key contribution of this paper is found by applying thesame type of analytic reasoning as in [36], but with a fewsubstantial differences in the final result. Indeed, Theorem 2contains an exact formula for the computation of the steadystate probability of meeting the deadline, which is used as abasis for a novel numeric algorithm with competitive perfor-mance with respect to the state of the art. On the contrary, thekey result of [36] is an analytic bound which can sometimesbe very conservative. The same bound is rediscovered in thispaper specialising Theorem 2 to a conservative approximationof the model (see Theorem 6). Once again, we can takeadvantage of the configuration options offered by ∆ to refinethe precision of the result. As shown in Figure 4, the choice ∆ = Q s (which applies the model proposed in [36]) is notguaranteed to be the best one in all cases. Therefore, thegeneralisation shown in this paper is relevant both from thetheoretical and from the practical point of view.VII. P ROBABILISTIC Q UALITY O PTIMISATION
In order to show a practical application of our ap-proach, we have considered a situation where a single com-puting board (e.g., a video server, or a set–top box) isused to process (in real–time) multiple videos at the sametime. This example is based on two different videos (en-coded with a bit–rate of -3.5-3-2.5-2-1.5-1-0.5 0 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 PS NR d r op P{f > d} 200kbps300kbps400kbps500kbps600kbps
Figure 5. PSNR degradation as a function of the deadline miss probabilityfor “BridgeClose” video. P e x e c u t i on t i m e <= c c ( µ s)Ufo BridgeClose Figure 6. Cumulative Distribution Functions for the execution of the decodefor the two streams. player implemented as a periodic real–time task. If a jobmisses its deadline, the video frame is not played back butit is decoded (to allow the incremental decoding of the framesthat follow). In this case, the behaviour of most players is tofill–in the “hole” by simply repeating the last decoded frame.This is perceived by the user as a reduction in quality, whichis well reflected in a degradation of the PSNR. This is visiblein Fig. 5, where we show the quality as a function of theprobability of deadline miss for the first video. This plot hasbeen created using the PSNR–TOOL software [5].The PSNR was interpolated by a line with slope . for “BridgeClose” and . for “ufo”. This difference isexplained by the different nature of the movies (static theformer, and dynamic the latter). Both movies were decodedusing a player executed by a periodic task and scheduledby the SCHED DEADLINE policy. The distributions of theexecution times were recorded on a notebook powered by anIntel Atom Processor, and the resulting CDFs are shown inFig. 6.The problem considered here was to find an optimal al-location of bandwidth between the different tasks. To thisend, we have used the synthesis abilities of PROSIT. WhenPROSIT is used for synthesis, the user specifies for each task:1) activation period and deadline, 2) reservation period, 3)distribution of the computation time 4) solution algorithm forthe probabilistic guarantees, 5) quality as a function of theprobability of meeting the deadline and 6) constraints on theminimal value of the quality. The quality of the differenttasks can be combined into global quality metrics. In this able IIR ESULTS OF P ROBABILISTIC O PTIMISATION
Cyclic Reduction – Computation time:753801758 µ sTask Opt. Budget Estim. Prob. Exact Prob. QualityBridgeClose 3000us 0.7427 0.743592. 39.65Ufo 6449us 0.9995 0.9995 41.58Analytic Bound – Computation time:114524 µ sTask Opt. Budget Estim. Prob. Exact Prob. QualityBridgeClose 3462us 0.7392 0.8292 40.50Ufo 3997us 0.8732 0.9138 37.98 particular example, we have used the infinity norm metric:assuming f i as the quality of the i th task, the cost functionto maximise over the budget Q s and Q s is max i min f i . Foreach candidate choice of Q si the tool evaluates the steady stateprobability using different solvers for probabilistic guarantees.The optimal solution is found by a bisection algorithm, whichuses repeated calls to the algorithm for the computation ofthe probability. As a solver for the probability computationwe have implemented analytic (with ∆ = Q s / ) and CR (with ∆ = 50 µ s).Choosing ms for the activation period (correspondingto fps), setting the server period to ms, and restrictingthe total bandwidth available to (to leave some room forother applications), the tool produces the results in Table II. Weidentified empirically the minimum acceptable PSNR as for“Ufo” and for “BridgeClose”. These values were codifiedas constraints in the optimisation problem. In both cases,the algorithm identified a sub–optimal solution, because theprobability evaluated by the solvers is only a lower bound. Were–evaluated the exact probability for each of the sub–optimalassignment of budgets using the CR solver with ∆ = 1 (whichproduces the exact computation of the probability, within thelimits of numeric errors). This allowed us to compare theactual quality attained by the optimisation algorithm in thetwo different configurations. Because the optimiser maximisesthe worst performance of the two tasks, the algorithm tendsto equalise the QoS achieved by the tasks for the optimalbudget. For both solvers, the optimal solution assigns a largerbandwidth (almost for the CR and almost for the analytic ) to the “Ufo” stream; this is because its qualitydegrades more quickly with the probability of meeting thedeadline for “Ufo” than for “BridgeClose”. In this example,the use of the analytic bound produces an optimal value . which is only away from the value obtained with cyclicreduction, but the computation time (evaluated on an Intel Corei7 with GB of RAM) is four orders of magnitude below.VIII. C ONCLUSIONS AND F UTURE W ORK
In this paper, we have considered the problem of proba-bilistic guarantees for RR scheduled soft real–time periodictasks. We have shown that the evolution of the system can bemodelled as a QBDP. The probability of meeting the deadlineamounts to the computation of the steady state probability ofthis process. We have shown how this is possible by numericmeans with different performance/accuracy tradeoffs. We have also shown an analytical bound and offered a comprehensivevalidation of these results by experiments and simulations.The gap between the analytic bound and precise numericsolution narrows down when the task is required to meet thedeadline with a high probability (e.g., more than ). Forthis reason, the analytic bound appears as a very promisingoption to solve QoS optimisation problems involving multipletasks, when the QoS is a function of the probability for the taskto meet its deadline and an acceptable level of performanceis required to all tasks. In these cases, the frequent callsto the solver to identify the optimal allocation of resources,such as are required by branch and bound or dichotomicsearch optimisation, can lead to substantial reduction of thecomputation time when the analytic bound is used in the faceof an acceptable distance from the optimal solution.
Future work
In our future work, we will investigate furtheron the connection between QoS and probabilistic deadlinesin several application domains, we will extend our analysisand the application of our methods to the case of applicationsbased on multiple tasks and to the case of computation timethat is not i.i.d. R
EFERENCES[1] L. Abeni and G. Buttazzo, “Integrating multimedia applications in hardreal-time systems,” in
Proceedings of the IEEE Real-Time SystemsSymposium , Madrid, Spain, December 1998.[2] D. Fontanelli, L. Greco, and L. Palopoli, “Soft RealTime Scheduling forEmbedded Control Systems,”
Automatica , vol. 49, pp. 2330–2338, July2013.[3] A. Cervin, B. Lincoln, J. Eker, K. Arzen, and G. Buttazzo, “The jittermargin and its application in the design of real-time control systems,”in
Proceedings of the IEEE International Conference on Real-Time andEmbedded Computing Systems and Applications . Gothenburg, Sweden,2004.[4] L. Abeni and G. Buttazzo, “Qos guarantee using probabilistic dealines,”in
Proceedings of the Euromicro Conference on Real-Time Systems ,York, England, June 1999.[5] C. Kiraly, L. Abeni, and R. L. Cigno, “Effects of p2p streaming onvideo quality,” in
Proceedings of the IEEE International Conference onCommunications . IEEE, 2010.[6] M. Joseph and P. Pandya, “Finding response times in a real-time system,”
The Computer Journal , vol. 29, no. 5, p. 390, 1986.[7] C. L. Liu and J. Layland, “Scheduling alghorithms for multiprogram-ming in a hard real-time environment,”
Journal of the ACM , vol. 20,no. 1, 1973.[8] R. Rajkumar, K. Juvva, A. Molano, and S. Oikawa, “Resource kernels:A resource-centric approach to real-time and multimedia systems,” in
Proceedings of the SPIE/ACM Conference on Multimedia Computingand Networking , January 1998.[9] L. Abeni and G. Buttazzo, “Stochastic analysis of a reservation-basedsystem,” in
Proceedings of the IEEE International Parallel and Dis-tributed Processing Symposium. , San Francisco, California, April 2001.[10] D. Bini, G. Latouche, and B. Meini,
Numerical methods for structuredMarkov chains . Oxford University Press, 2005.[11] A. K. Atlas and A. Bestavros, “Statistical rate monotonic scheduling,” in
Proceedings of the IEEE Real-Time Systems Symposium , Madrid, Spain,December 1998.[12] J. L. Diaz, D. F. Garcia, K. Kim, C. G. Lee, L. Lo Bello, J. M. L´opez,S. L. Min, and O. Mirabella, “Stochastic analysis of periodic real-timesystems,” in
Proceedings of the IEEE Real-Time Systems Symposium .IEEE, 2002.[13] J. L. Diaz, J. M. L´opez, M. Garcia, A. M. Campos, K. Kim, andL. Lo Bello, “Pessimism in the stochastic analysis of real-time systems:Concept and applications,” in
Proceedings of the IEEE Real-TimeSystems Symposium . IEEE, 2004.14] D. Maxim and L. Cucu-Grosjean, “Response time analysis for fixed-priority tasks with multiple probabilistic parameters,” in
Proceedings ofthe IEEE Real-Time Systems Symposium , Vancouver, British Columbia,Canada, December 2013.[15] L. Cucu and E. Tovar, “A framework for the response time analysis offixed-priority tasks with stochastic inter-arrival times,”
ACM SIGBEDReview - Special issue: The work-in-progress (WIP) session of the RTSS2005 , vol. 3, no. 1, pp. 7–12, January 2006.[16] G. A. Kaczynski, L. Lo Bello, and T. Nolte, “Deriving exact stochasticresponse times of periodic tasks in hybrid priority-driven soft real-time systems,” in
Proceedings of the IEEE Conference on EmergingTechnologies and Factory Automation , Patras, Greece, September 2007.[17] A. Mills and J. Anderson, “A stochastic framework for multiprocessorsoft real-time scheduling,” in
Proceedings of the IEEE Real-Time andEmbedded Technology and Applications Symposium . Stockholm,Sweden: IEEE, April 2010.[18] D.-I. Kang, R. Gerber, and M. Sakena, “Performance-based design ofdistributed real-time systems,” in
Proceedings of the IEEE Real-TimeTechnology and Applications Symposium , Montreal, Quebec, Canada,June 1997.[19] C.-J. Hamann, L. Reuther, J. Wolter, H. Haertig, J. Loser, and S. Schon-berg, “Quality-assuring scheduling-using stochastic behavior to improveresource utilization,” in
Proceedings of the IEEE Real-Time SystemsSymposium , London, December 2001.[20] K. S. Refaat and P.-E. Hladik, “Efficient stochastic analysis of real-time systems via random sampling,” in
Proceedings of the EuromicroConference on Real-Time Systems , Brussels, Belgium, July 2010.[21] G. Latouche and V. Ramaswami,
Introduction to matrix analytic methodsin stochastic modeling . Society for Industrial Mathematics, 1987, vol. 5.[22] M. F. Neuts,
Matrix-geometric solutions in stochastic models: an algo-rithmic approach . Dover publications, 1995.[23] A. F. Mills and J. H. Anderson, “A multiprocessor server-based schedulerfor soft real-time tasks with stochastic execution demand,” in
Proceed-ings of the IEEE International Conference on Embedded and Real-TimeComputing Systems and Applications , Toyama, Japan, August 2011.[24] M. Santos, B. Lisper, G. Lima, and V. Lima, “Sequential compositionof execution time distributions by convolution,” in
Proceedingsof the Workshop on Compositional Theory and Technology forReal-Time Embedded Systems
Journal of Embedded Computing , vol. 1, no. 2,pp. 179–194, 2005.[26] R. Liu, A. Mills, and J. Anderson, “Independence thresholds: Balancingtractability and practicality in soft real-time stochastic analysis,” in
Proceedings of the IEEE Real-Time Systems Symposium , Rome, Italy,December 2014.[27] L. Cucu-Grosjean, L. Santinelli, M. Houston, C. Lo, T. Vardanega,L. Kosmidis, J. Abella, E. Mezzetti, E. Quinones, and F. Cazorla,“Measurement-based probabilistic timing analysis for multi-path pro-grams,” in
Proceedings of the Euromicro Conference on Real-TimeSystems , Pisa, Italy, July 2012.[28] N. Manica, L. Palopoli, and L. Abeni, “Numerically efficient prob-abilistic guarantees for resource reservations,” in
Proceedings of theIEEE International Conference of Emerging Technologies and FactoryAutomation , Krakow, Poland, September 2012.[29] C. G. Cassandras and S. Lafortune,
Introduction to Discrete EventSystems . Secaucus, NJ, USA: Springer-Verlag New York, Inc., 2006.[30] L. Abeni, D. Fontanelli, and L. Palopoli, “Application of the Quasi-Birth-Death Processes techniques to probablistic guarantees of soft realtimesystems scheduled by resource reservations,” DISI - Universit´a di Trento,Tech. Rep., 2015, http://disi.unitn.it/ ∼ palopoli/publications/QBDP-TR.pdf.[31] N. G. Lloyd, “Remarks on Generalising Rouch’s Theorem,” Journal ofthe London Mathematical Society , vol. s2-20, no. 2, pp. 259–272, 1979.[32] L. Abeni, N. Manica, and L. Palopoli, “Efficient and robust probabilisticguarantees for real-time tasks,”
Journal of Systems and Software , vol. 85,no. 5, pp. 1147–1156, May 2012.[33] D. Bini, B. Meini, S. Steff´e, J. F. P´erez, and B. Van Houdt, “Smcsolverand q-mam: tools for matrix-analytic methods,”
ACM SIGMETRICSPerformance Evaluation Review , vol. 39, no. 4, pp. 46–46, 2012.[34] L. Palopoli, L. Abeni, and D. Fontanelli, “A tool for the optimal design of soft real–time systems,” in
Proceeding of WATERS 2014 workshop ,Madrid Spain, July 2014.[35] D. Fontanelli, F. Moro, T. Rizano, and L. Palopoli, “Vision-based robustpath reconstruction for robot control,”
IEEE T. Instrumentation andMeasurement , vol. 63, no. 4, pp. 826–837, 2014. [Online]. Available:http://dx.doi.org/10.1109/TIM.2013.2289091[36] L. Palopoli, D. Fontanelli, N. Manica, and L. Abeni, “An analyticalbound for probabilistic deadline,” in
Proceedings of the EuromicroConference on Real-Time Systems . Pisa, Italy: IEEE, September 2012.[37] J. Klaue, B. Rathke, and A. Wolisz, “Evalvid - a framework for videotransmission and quality evaluation,” in