Demand-based Scheduling of Mixed-Criticality Sporadic Tasks on One Processor
DDemand-based Scheduling of Mixed-CriticalitySporadic Tasks on One Processor
Arvind Easwaran
Nanyang Technological University, SingaporeEmail: [email protected]
Abstract —Strategies that artificially tighten high-criticalitytask deadlines in low-criticality behaviors have been successfullyemployed for scheduling mixed-criticality systems. Althoughefficient scheduling algorithms have been developed for implicitdeadline task systems, the same is not true for more generalsporadic tasks. In this paper we develop a new demand-basedschedulability test for such general mixed-criticality task systems,in which we collectively bound the low- and high-criticalitydemand of tasks. We show that the new test strictly dominatesthe only other known demand-based test for such systems. Wealso propose a new deadline tightening strategy based on thistest, and show through simulations that the strategy significantlyoutperforms all known scheduling algorithms for a variety ofsporadic task systems.
I. I
NTRODUCTION
Scheduling problems for mixed-criticality real-time systemshave received increasing attention in the recent past. Thesesystems, first introduced by Vestal [1], comprise of real-timetasks with different criticality levels, all sharing the samehardware. One of the key requirements of such a systemis the following: while all tasks should receive sufficientresources under normal operating conditions, tasks with highercriticality should be given preference over those with lowercriticality when operating conditions deviate from the norm.Several formulations of what constitutes a deviation from thenorm have been presented, including task execution beyondexpected worst-case execution time (WCET) [1], scaling downof processor frequency [2], and task dispatch occurring morefrequently than anticipated [3]. In this paper we focus on theformulation based on deviation from expected WCET.Although several different mechanisms are available forbounding the WCET of a real-time task, they all introducesome level of pessimism to the bounds [4]. Additionally, someapproaches such as those based on tests, may only providea reasonable estimate of the WCET that is valid for almostall execution scenarios (occasional violations can occur). Onemay then wonder what level of confidence is desired whenestimating the WCET of a real-time task. As a system designerwhose focus is on efficient resource utilization, a smallerWCET estimate is desirable. On the other hand, as an authorityresponsible for ensuring the safety of the system (e.g., FederalAviation Authority), an highly reliable estimate is desirable atleast for the high criticality tasks. These seemingly contradic-tory WCET requirements have been formally captured usinga list of WCET estimates for each real-time task, one estimatefor each criticality level [1]. While the actual execution time of each task remains below its lowest (least critical) WCETestimate, the system is assumed to be operating normally andall tasks are required to meet their deadlines. Any deviationfrom this norm has an implication that only certain highcriticality tasks are required to meet their deadlines thereafter.It is important to note that the designer does not expectthis deviation to occur during the system’s lifetime (highlyunlikely). Hence the deadline requirement after the deviationis only to convince the certification authorities that even inthis unexpected situation, the critical tasks will continue toreceive sufficient resources. We will use this mixed-criticalitytask model, and further details are presented in Section II.The sporadic task model, first introduced for non mixed-criticality systems [5], is a generic model for capturing thereal-time requirements of many event-driven systems includingthose with mixed-criticality such as avionics and automotive.It is therefore the model of choice in this work.When designing a scheduling algorithm for any real-timesystem, we believe the following properties are important. P1 : Does the algorithm have a low run-time complexity formaking scheduling decisions? P2 : Does the algorithm have an exact schedulability test (orif exact test is not feasible then tight test) with low timecomplexity? P3 : Does the algorithm, based on its schedulability test,successfully schedule a significantly large proportion offeasible task systems?Property P1 ensures that the scheduling algorithm has a lowimplementation overhead, so that platform resources can beutilized more efficiently for getting actual work done. Property P2 enables off-line validation of the real-time requirements ofthe system in an efficient manner. For instance, certificationauthorities could use this schedulability test as one of themetrics in the certification process. Exactness (or tightness)of the test ensures that a large proportion of task systemsschedulable by the algorithm are successfully identified bythe test. Finally, a scheduling algorithm that satisfies prop-erty P3 can more likely than not successfully schedule asystem in practice. This property could be deduced eitheranalytically (e.g., for optimal algorithms), or through carefullydesigned simulation experiments. Note that for general nonmixed-criticality sporadic task systems it has been shown that A task system is said to be feasible, if there exists some algorithm(clairvoyant or otherwise) that can successfully schedule it. a r X i v : . [ c s . O S ] M a r lgorithm Property P1 Run-time Complexity P2 Test Complexity P3 Simulation PerformanceAMC [6] logarithmic [7] pseudo-polynomial [6] Worst among the fourPLRS [8] quadratic [8] pseudo-polynomial [8] Good at intermediate load,but poor at high loadGREEDY [9] logarithmic [9] pseudo-polynomial [9] Better than AMC and PLRS at high loadECDF (this paper) logarithmic pseudo-polynomial Best (outperforms the rest and performancegap widens with increasing load)
Fig. 1. Comparison of algorithms for general sporadic tasks. Conclusions regarding property P3 are based on observations from simulations (see Section IV-B). determining feasibility is NP-Hard [10]. This indicates thatpolynomial time schedulability tests may, in general, not leadto a good performance for property P3 , and therefore we focuson pseudo-polynomial tests in this paper.Some algorithms have been proposed for the scheduling ofmixed-criticality sporadic task systems on a single processor(e.g., [1], [11], [12], [6], [8], [13], [9]). In Figure 1, wesummarize the performance of these algorithms in relationto the three properties described above. Vestal [1] first pro-posed an algorithm based on Audsley’s priority assignmentstrategy [14], which has since been dominated by anotheralgorithm proposed by Baruah et. al. [6]. Assuming run-timesupport from the platform, this new algorithm adapts taskpriorities once a deviation from the norm is detected. Thisalgorithm is denoted as AMC for ”Adaptive Mixed Criticality”in this paper. As can be seen from Figure 1, AMC has a lowrun-time complexity , and the schedulability test is pseudo-polynomial. But its performance in simulations is relativelypoor, especially when system load is high (see Figures 7 and 8in Section IV-B).Algorithms that assign different priorities to different jobsof the same task have also been proposed in the past [12],[8], [9]. Li and Baruah [12] proposed the ”Own CriticalityBased Priority” algorithm for sporadic task systems, and itsrun-time complexity was improved from pseudo-polynomialto quadratic by Guan et. al. [8] when they proposed the ”Pri-ority List Reuse Scheduling” (PLRS) algorithm. Both pseudo-polynomial tests based on response-time analysis and polyno-mial tests based on system load have been proposed for OCBPand PLRS. But, similar to AMC, these algorithms also haverelatively poor performance in simulations especially when thesystem load is high (see figures in Section IV-B). To overcomethis performance gap in AMC, OCBP, and PLRS algorithms,Ekberg and Yi [9] proposed a greedy search algorithm (calledGREEDY in this paper). This algorithm artificially tightensthe deadline of high-criticality tasks when the system isstill operating normally, so that when the system deviatesfrom the norm, additional time is available to schedule theworkload of these high-criticality tasks. Although GREEDYhas a logarithmic run-time complexity and a schedulabilitytest with pseudo-polynomial complexity, its performance insimulations is better than AMC and PLRS only at high system This complexity can be reduced depending on the kind of support availablein the kernel as well as the number of different priority levels [7]. load. At intermediate load it is actually outperformed by PLRS(see Figure 7 in Section IV-B). Further, as can be seen fromthose figures, GREEDY is still not able to schedule a largefraction of potentially feasible sporadic task systems.
Contributions.
In this paper we propose a new demand-based schedulability test for general mixed-criticality sporadictask systems, and prove that it strictly dominates the only otherknown demand-based test (the one used by GREEDY). Thekey contributing factor for this dominance is an approach tocollectively bound the low- as well as high-criticality demandof tasks in any time interval, as opposed to independent low-and high-criticality bounds that were used in the previous test.We also propose a deadline tightening strategy for high-criticality tasks that uses the improved test, and show throughsimulations that the resulting scheduler significantly outper-forms all known schedulers. In fact, simulation results showthat this performance gap widens with increasing system load.Further, simulations also show that the performance of theproposed strategy is comparable to exhaustive deadline searchbased on the test, when number of tasks in a system are small.II. S
YSTEM M ODEL
A mixed-criticality sporadic task can be specified as τ i =( T i , D i , L i , C i ) , where T i denotes minimum separation be-tween job releases, D i denotes deadline, L i denotes criticalitylevel, and C i is a list of WCET values. In this paper weassume that tasks have only two criticality levels, LC denot-ing low-criticality and HC denoting high-criticality. We alsoassume that tasks are constrained deadline, meaning D i ≤ T i .Note that even for this restricted model, the mixed-criticalityscheduling problem is known to be NP-Hard [15].For a dual-criticality task τ i , L i ∈ { LC, HC } and C i = { C Li , C Hi } , where C Li denotes LC WCET and C Hi denotes HC WCET. We assume that C Li ≤ C Hi for all tasks τ i . Task τ i releases an infinite sequence of jobs, each job has a deadlinethat is D i time units after its release, and successive jobsare released with a minimum separation of T i time units. Asporadic task system is then represented by a set of such tasksand denoted as τ = { τ , . . . , τ n } . The real-time requirementsof such a task system can be summarized as follows:1) As long as no job executes for more than its LC WCET( C Li ), the system is regarded as exhibiting LC behavior,and all job deadlines must be met.) If at some time instant a HC job executes beyond its LC WCET, the system is then regarded as exhibiting HC behavior, and only HC job deadlines are requiredto be met after this time instant.3) If a LC (likewise HC ) job executes beyond its LC (likewise HC ) WCET, then the system is regarded asexhibiting erroneous behavior. Therefore, in our systemmodel, it can be assumed without loss of generality that C Li = C Hi for a LC task τ i .As long as all jobs are executing within their LC WCETs,the system is behaving as expected by the designer, and all jobdeadlines are required to be met. When a HC job executesfor more than its LC WCET, the system has deviated fromthe norm because a job executed for more time than expected.Although this scenario is highly unlikely, the authorities re-sponsible for system safety want to ensure that even in thiscase at least the critical functionalities are operational. In otherwords, they want to ensure that at least all the HC jobs willcontinue to meet their deadlines. This implies that all LC job deadlines after the deviation can be safely ignored. If ascheduling algorithm can satisfy all the above requirementsfor task system τ , then τ is said to be schedulable by thealgorithm. Note the problem of determining when to switchthe system back to LC behavior after a HC behavior isbeyond the scope of this paper, because it has no impact onthe schedulability tests and algorithms that we derive. Scheduling strategy : When the system is in LC behaviorall the tasks will be scheduled using Earliest Deadline First(EDF) strategy, and when the system switches to HC behavior,all the LC jobs will be ignored thereafter and only the HC tasks will be scheduled using EDF strategy. This strategy wasfirst introduced by Baruah et. al. [13] in EDF-VD and isalso used by the GREEDY algorithm [9]. To accommodatethe sudden increase in demand of HC tasks when the sys-tem switches behavior, both EDF-VD and GREEDY proposeartificial tightening of HC task deadlines in LC systembehavior. This ensures that when the behavior switch occurs,all the active HC jobs have some amount of time left untiltheir real deadline to execute any additional demand in the HC behavior. In this scheduling strategy, the key aspect isthe mechanism for determining artificial deadlines. UnlikeEDF-VD, which determines deadlines by evenly distributingremaining LC utilization among the HC tasks, GREEDYperforms a heuristic search in the solution space. In this paper,we propose a new strategy for determining these deadlines,details of which are presented in Section IV-A.Let D Li denote the deadline of task τ i in LC behavior, alsodenoted as tightened deadline to distinguish it from the realdeadline D i . Since deadlines of LC tasks are unmodified, wehave D Li = D i for such tasks. For HC tasks, D Li ≤ D i bydefinition. We also denote the set of all LC tasks in τ by L τ ,and the set of all HC tasks in τ by H τ .The demand bound function (dbf) of a task for a giventime interval length is the maximum demand that the taskcan impose in any time interval of that length. For a mixed-criticality task τ i with LC deadline D Li , we can separately define LC and HC demand bound functions as follows(these functions were first defined for traditional non-mixed-criticality task systems [10]). dbf Li ( t ) = max (cid:26) , (cid:18)(cid:22) t − D Li T i (cid:23) + 1 (cid:19) C Li (cid:27) (1) dbf Hi ( t ) = max (cid:26) , (cid:18)(cid:22) t − D i T i (cid:23) + 1 (cid:19) C Hi (cid:27) (2)Finally, to simplify presentation of equations, the followingshort-cut notation will be used in the paper. M OD ( t, T i ) = t − (cid:22) tT i (cid:23) T i III. S
CHEDULABILITY T ESTS
In this section we present a new schedulability test formixed-criticality sporadic tasks, and show that it strictly dom-inates the only other known dbf-based test presented in [9].
A. Existing schedulability test
Ekberg and Yi [9] presented a dbf-based test by separatelyconsidering LC and HC system behaviors. In LC behavior,each mixed-criticality task τ i can be regarded as a traditionalnon-mixed-criticality task with deadline D Li and worst-caseexecution time C Li . Therefore, EDF schedulability in LC behavior can be checked using existing results as follows. Proposition 1 (From Theorem 1 in [10]):
Task system τ isEDF schedulable in LC system behavior if and only if, ∀ ≤ t ≤ t MAX , (cid:88) τ i ∈ τ dbf Li ( t ) ≤ t, where t MAX is pseudo-polynomial in input size (defined in [10]).In HC behavior, to determine the maximum demand of a HC task τ i , we need to understand what is the contribution ofthe carry-over job of this task. A carry-over job, as shown inFigure 2, is a job of τ i that is released before the time instantwhen the system switched from LC to HC behavior, and has areal deadline after this time instant. When computing demandin HC behavior, we assume that all task deadlines in LC behavior are always satisfied (verifiable using Proposition 1).For an interval of length t = t − t , τ i generates maximumdemand when some job of τ i has a deadline at t , and allprevious jobs of τ i are released and execute as late as possible.This pattern is shown in Figure 2. If D Li of the carry-over jobis before t , then it cannot contribute any execution to theinterval, because it would have finished prior to the behaviorswitch. On the other hand, if D Li is after t as shown in thefigure, then the remaining LC execution of the carry-over jobat t is at most the interval length from t to the tighteneddeadline. Otherwise, the job would not have met its deadline in LC behavior if the switch did not happen at t . Therefore thetotal demand of this carry-over job is at most this remaining LC execution plus C Hi − C Li , which is the additional demandof the job in HC behavior. The following proposition thenpresents the schedulability test for HC behaviors.
0 t t Carry-over job
Time instant when system switches behavior MOD(t -t ,T i ) Job release time Job deadline Executions up to
Executions between and
Fig. 2. Task execution pattern for maximum demand in HC behavior Proposition 2 (From [9]):
Task system τ is EDF schedulablein HC system behavior if, ∀ t : 0 ≤ t ≤ t MAX , (cid:88) τ i ∈H τ dbf Hi ( t ) + (cid:88) τ i ∈S ( t ) ( C Hi − C Li ) + (cid:88) τ i ∈S ( t ) CO ( t ) ≤ t. Here S ( t ) = (cid:8) τ i | τ i ∈ H τ and D i > M OD ( t, T i ) > D i − D Li (cid:9) denotes tasks whose carry-over job will contributeto the demand in an interval of length t , and CO ( t ) = min (cid:8) C Li , M OD ( t, T i ) − ( D i − D Li ) (cid:9) denotes themaximum carry-over executions that can be pending at thebeginning of this interval. B. New schedulability test
One of the main drawbacks of the test in Section III-A isthat it cannot use the demand of tasks in LC behavior todetermine the remaining execution for carry-over jobs at thetime of behavior switch. If the LC demand of tasks is small,then many tasks would finish well before their deadlines. Thismeans that many HC carry-over jobs could also finish wellbefore their tightened deadlines, and then the demand of thesejobs in HC behavior would decrease. The above test fails touse this dependency between LC and HC demands mainlybecause it bounds them individually. In this section we presenta new dbf-based test that collectively bounds the LC and HC demands, and therefore is tighter than the above test.Suppose there is a first deadline miss at some time instant t in the schedule of task set τ , and let t denote a timeinstant when the system switches from LC to HC behaviorsuch that ≤ t ≤ t . When t = 0 this represents a purely HC behavior and when t = t this represents a purely LC behavior, and therefore there is no loss of generality in thisassumption. For purely LC behaviors, that is when t = t (= t say ) , we will continue to use the dbf-based test presentedin Proposition 1 because it is an exact test. In the remainderof this section we therefore only consider scenarios in which t < t . Let J denote any minimal set of jobs of the task set τ whose schedule results in the deadline miss at t . Observethat by definition of minimality there are no idle instants inthe schedule, because otherwise the schedule starting after thelatest idle instant will also have a deadline miss at t and thecorresponding job set will be smaller.We first derive an upper bound on the maximum demandthat jobs of LC tasks can have in this time interval through aseries of lemmas as follows. i
0 t t i i D i D i D i D i Job release time Job deadline
Time instant when system switches behavior MOD(t ,T i ) i Unnecessary job
Fig. 3. Schedule for LC task τ i generating maximum demand Lemma 1: No LC job with deadline greater than t canexecute in the time interval (0 , t ] . Proof:
Suppose LC jobs with deadline greater than t execute in (0 , t ] , and let t denote the latest time instant whenany such job executes. Observe that no job with deadlinesmaller than or equal to t is pending at this instant. Thenthe schedule resulting from jobs released at or after t willalso miss a deadline at t , contradicting the minimality of J .Thus only LC jobs with deadline at most t can executein the interval. Among these, any job released at or after t cannot execute because the system is already in HC behavior.Therefore, apart from jobs that are both released and havedeadline in the interval (0 , t ] , at most one job, called the unnecessary job , can execute for each LC task in (0 , t ] . Thisjob has release time before t and deadline in ( t , t ] . This jobis unnecessary because its deadline is not required to be met,and if we had clairvoyance about the system switch at t , thenwe would never have executed it. This scenario is shown inFigure 3 for task τ i . To generate maximum demand in (0 , t ] ,jobs are released as soon as possible. Further, the demand ofunnecessary job is maximized if we assume that it executescontinuously starting from its release time. Thus the followingbound for demand of LC task τ i can be obtained. Lemma 2:
The maximum demand of LC task τ i in the timeinterval (0 , t ] is given by, dbf i ( t , t ) = dbf Li ( t ) + dbf UNi ( t , t ) , where dbf Li ( t ) is given by Equation (1), and dbf UNi ( t , t ) = min (cid:8) C Li , M OD ( t , T i ) (cid:9) D Li > M OD ( t , T i ) and (cid:106) t T i (cid:107) T i + D Li ≤ t Otherwisedbf
UNi ( t , t ) bounds the demand of unnecessary job oftask τ i . Whenever D Li > M OD ( t , T i ) , the deadline of thelast job released in (0 , t ] is after t . Condition (cid:106) t T i (cid:107) T i + D Li ≤ t then ensures that this deadline is no later than t .To upper bound the demand of a HC task τ i we considerthree different cases. The first case is when t − t ≤ D i − D Li .The following lemma asserts that in this case no job of τ i canexecute in HC behavior. Lemma 3:
No job of HC task τ i satisfying inequality t − t ≤ D i − D Li can execute in the interval ( t , t ] . t t Carry-over job Job release time Job deadline
Time instant when system switches behavior MOD(t -t ,T i ) Executions up to
Executions between and
Fig. 4. Schedule of HC task τ i when carry-over job executes after t Proof:
Suppose a job of τ i has real deadline greater than t , but still executes in the interval ( t , t ] . Let t denote thelatest time instant when this job executes. Note that at t nojob with deadline at most t is pending. Then the resultingschedule considering only jobs released at or after t willalso miss a deadline at time instant t . This contradicts theminimality of job set J .Thus, no job of τ i with real deadline greater than t canexecute in the interval ( t , t ] . Suppose τ i has a job withreal deadline in the interval ( t , t ] . In this case, the tighteneddeadline of this job is at most t because t − t ≤ D i − D Li .Then, the job would have already finished its execution beforethe behavior switch at t . This proves the lemma.Therefore, whenever t − t ≤ D i − D Li , HC task τ i essentially behaves like a LC task, and its demand can bebounded using Lemma 2. An immediate corollary of this factis that when t − t is smaller than the minimum differencebetween real and tightened deadlines of all HC tasks, then no HC job can execute in the interval ( t , t ] , and therefore thedeadline miss scenario at t is not feasible. Corollary 1:
For a HC deadline miss to occur at time t when the system switches behavior at time t ( ≤ t ) , it mustbe the case that t − t > min τ i ∈H τ { D i − D Li } .The second case is when t − t > D i − D Li and thecarry-over job can contribute demand in HC behavior. Thisscenario is depicted in Figure 4. As shown, the carry-over jobcan contribute demand in HC behavior when its tighteneddeadline is greater than t . Further, to maximize overalldemand of task τ i it is necessary to assume that this carry-overjob does not finish before the behavior switch at t . In thiscase, it will contribute an additional demand of C Hi − C Li .The overall demand of task τ i in the interval (0 , t ] ismaximized when the real deadline of a job of this taskcoincides with time instant t , all preceding jobs are releasedas late as possible, and the carry-over job executes as lateas possible. This pattern is shown in Figure 4. Suppose weshift the releases to the right by some amount smaller than T i .Then the demand from the last HC job would decrease by C Hi because its deadline is no longer in the interval. The demandfrom the carry-over job may increase by at most C Hi − C Li ifits tightened deadline moves to a time instant greater than t after the shift. The demand from LC jobs may increase by atmost C Li if an additional LC job can now be accommodated
0 t t Carry-over job Job release time Job deadline
Time instant when system switches behavior MOD(t -t ,T i ) Executions up to
Executions between and
Fig. 5. Schedule of HC task τ i when carry-over job finishes by t in the interval. Therefore, the total increase in demand is atmost C Hi which is no larger than the total decrease in demand.Therefore this task release and execution pattern maximizesthe demand of task τ i in the interval (0 , t ] . The followinglemma derives a bound for the demand of task τ i in this case. Lemma 4:
When D i − D Li < M OD ( t − t , T i ) < D i and (cid:106) t − t T i (cid:107) T i + D i ≤ t , the demand of HC task τ i is given by, dbf i ( t , t ) = dbf Li ( t , t ) + dbf Hi ( t , t ) + dbf COi ( t , t ) , where dbf Li ( t , t ) = max (cid:26) , (cid:18)(cid:22) t − D i T i (cid:23) − (cid:22) t − t − D i T i (cid:23) − (cid:19)(cid:27) C Li ,dbf Hi ( t , t ) = max (cid:26) , (cid:18)(cid:22) t − t − D i T i (cid:23) + 1 (cid:19) C Hi (cid:27) , and dbf COi ( t , t ) = C Hi . Proof:
Condition D i − D Li < M OD ( t − t , T i ) < D i checks for the existence of a carry-over job that is releasedbefore t and has tightened deadline in the interval ( t , t ] .Condition (cid:106) t − t T i (cid:107) T i + D i ≤ t on the other hand checkswhether the interval (0 , t ] is large enough to accommodatethis carry-over job. Hence, if these two conditions are met,there exists a carry-over job that will contribute demandin the interval ( t , t ] . The total demand of this carry-overjob, denoted as dbf COi ( t , t ) , is C Hi because it completesexecution in HC behavior.The total demand of all the HC jobs in the interval ( t , t ] , excluding the carry-over job, is given by the traditionaldefinition of demand bound function for non-mixed-criticalitysystems (see Equation (2)).The total number of jobs in the interval (0 , t ] is (cid:106) t − D i T i (cid:107) +1 . Of these, (cid:106) t − t − D i T i (cid:107) + 1 jobs execute only in the interval ( t , t ] and their demand is considered in dbf Hi ( t , t ) . Addi-tionally, the demand of carry-over job is also accounted for.Therefore, the number of remaining jobs that only contributedemand in the interval (0 , t ] is (cid:106) t − D i T i (cid:107) + 1 − (cid:106) t − t − D i T i (cid:107) − − . Since each such job can execute for a maximum time of C Li , the total demand in this interval, denoted as dbf Li ( t , t ) ,is bounded by (cid:16)(cid:106) t − D i T i (cid:107) − (cid:106) t − t − D i T i (cid:107) − (cid:17) C Li .he third case is when t − t > D i − D Li and the carry-overjob cannot contribute demand in HC behavior. This scenariois depicted in Figure 5. The tightened deadline of the carry-over job is no greater than t and hence the job would finishbefore the system switches to HC behavior. The total demandof all the jobs of τ i in this case is similar to the previous case,except that the carry-over job only contributes C Li instead of C Hi . We record this result in the following lemma. Lemma 5:
When conditions in Lemmas 2 and 4 are notsatisfied, then the demand of HC task τ i is given by, dbf i ( t , t ) = dbf Li ( t , t ) + dbf Hi ( t , t ) + dbf COi ( t , t ) , where dbf COi ( t , t ) = C Li , and dbf Li ( t , t ) and dbf Hi ( t , t ) are given in Lemma 4.Thus, whenever there is a deadline miss at some instant t and the system switches behavior at some instant t ( < t ),an upper bound on the total demand of any minimal job setthat leads to this deadline miss is as discussed above. Sincethere is a deadline miss at t and there are no idle instantsin the interval (0 , t ] , the total demand of this minimal jobset (and therefore its upper bound) must exceed t . Using thecontrapositive of this statement and Corollary 1, we get thefollowing schedulability test. Theorem 1:
Task system τ is EDF schedulable in HC system behavior if, ∀ t : 0 ≤ t ≤ t MAX , ∀ t : 0 ≤ t < t − min τ i ∈H τ (cid:8) D i − D Li (cid:9) , (cid:88) τ i ∈ τ dbf i ( t , t ) ≤ t . Here dbf i ( t , t ) is given by Lemma 2 when τ i is a LC taskor a HC task in case 1, by Lemma 4 if it is a HC task incase 2, and by 5 if it is a HC task in case 3. C. Improved schedulability test
The schedulability test presented in Theorem 1 collectivelybounds the demand of HC and LC tasks. However, thedemand bound in LC behavior (time interval (0 , t ] ) is pes-simistic, and in this section we tighten it.An unnecessary job, as shown in Figure 3, is a job thatis released before t , has a tightened deadline in the interval ( t , t ] , and if the job belongs to a HC task then its realdeadline is after t . The contribution of each such job tothe total demand in Theorem 1 is given by dbf UNi ( t , t ) =min (cid:8) C Li , M OD ( t , T i ) (cid:9) (Lemma 2). That is, the job isassumed to contribute either C Li or the interval length betweenits release time and t , whichever is smaller. This is howeververy pessimistic for some cases, such as the one shownin Figure 6. Here tasks τ i and τ j both have unnecessaryjobs, and therefore their total demand bound as given byTheorem 1 would be M OD ( t , T i ) + M OD ( t , T j ) . But thisis not possible because the two jobs cannot run in parallelon an uniprocessor and cannot execute after t . In fact, themaximum demand that these two jobs can collectively generateis bounded by max { D Li , D Lj } and this can be explained asfollows. By definition, any unnecessary job of τ i or τ j must
0 t t Job release time Job deadline
MOD(t ,T i ) i Unnecessary job of i MOD(t ,T j ) j Unnecessary job of j Fig. 6. Pessimistic demand bound for unnecessary jobs be released in the time interval [ t − max { D Li , D Lj } , t ) . Then,in the worst case, these unnecessary jobs continuously executefrom this earliest release time until t , and therefore their totaldemand cannot exceed max { D Li , D Lj } . This argument can beeasily generalized to an arbitrary number of tasks, and theresulting bound is recorded in the following lemma. Lemma 6:
The total demand of all the unnecessary jobscollectively is given by, dbf UN ( t , t ) =min max τi ∈L τ or τ i ∈H τ and case 1 (cid:8) D Li (cid:9) , (cid:88) τi ∈L τ or τ i ∈H τ and case 1 dbf UNi ( t , t ) , where dbf UNi ( t , t ) is defined in Lemma 2.Another source of pessimism is the LC demand in the timeinterval (0 , t ] . Since there is no deadline miss in the interval (0 , t ] , the total demand in this interval cannot exceed t .We now look at the total demand for the interval (0 , t ] inTheorem 1 and Lemma 6, and identify the minimum of thistotal demand that belongs to the interval (0 , t ] . The followinglemmas determine this minimum demand for different tasks. Lemma 7:
Out of the total demand in interval (0 , t ] for LC tasks and HC tasks in case 1 (Lemmas 2 and 6), the minimumdemand in interval (0 , t ] is given by, dbf L ( t , t ) = dbf UN ( t , t ) + (cid:88) τi ∈L τ or τ i ∈H τ and case 1 dbf Li ( t ) , where dbf UN ( t , t ) is given by Lemma 6 and dbf Li ( t ) isgiven by Equation (1). Proof:
All the unnecessary jobs can only generate demandin (0 , t ] , because they will be ignored after t . The remainingdemand of all LC tasks and HC tasks in case 1 must alsobelong to (0 , t ] because they have their release and deadlinein this interval. Therefore, for both these cases, their entiredemand belongs to the interval (0 , t ] . Lemma 8:
Out of the total demand in interval (0 , t ] for HC tasks in case 2 (Lemma 4), the minimum demand in interval (0 , t ] is given by, dbf L ( t , t ) = (cid:88) τi ∈H τ and case 2 (cid:0) dbf Li ( t , t ) + C Li − CO ( t − t ) (cid:1) , here dbf Li ( t , t ) is given by Lemma 4, and CO ( t − t ) isdefined in Proposition 2. Proof:
For a HC task in case 2, the carry-overjob can potentially generate demand in both the inter-vals (0 , t ] and ( t , t ] . The maximum demand this carry-over job can generate in the interval ( t , t ] is CO ( t − t ) + C Hi − C Li (see Figure 2). CO ( t − t ) =min (cid:8) C Li , M OD ( t − t , T i ) − ( D i − D Li ) (cid:9) is the maximumexecutions that can be pending at time t , because otherwisethe job would not meet its deadline if the system did notswitch to HC behavior. C Hi − C Li is the additional demandgenerated by this job in HC behavior. Therefore, the minimumdemand of this job in the interval (0 , t ] is C Li − CO ( t − t ) .Additionally, the entire demand of dbf Li ( t , t ) is generatedby jobs that are both released and have their deadlines in theinterval (0 , t ] , and therefore it belongs to the same interval. Lemma 9:
Out of the total demand in interval (0 , t ] for HC tasks in case 3 (Lemma 5), the minimum demand in interval (0 , t ] is given by, dbf L ( t , t ) = (cid:88) τi ∈H τ and case 3 (cid:0) dbf Li ( t , t ) + dbf COi ( t , t ) (cid:1) , where dbf Li ( t , t ) and dbf COi ( t , t ) are given by Lemma 5. Proof:
For a HC task in case 3, since the carry-over jobdoes not generate demand in ( t , t ] , its entire demand belongsto the interval (0 , t ] . Additionally, similar to case 2 above, theentire demand of dbf Li ( t , t ) also belongs to this interval.The following theorem then presents an improved EDFschedulability test for HC behaviors. Theorem 2:
Task system τ is EDF schedulable in HC system behavior if, ∀ t : 0 ≤ t ≤ t MAX , ∀ t : 0 ≤ t < t − min τ i ∈H τ (cid:8) D i − D Li (cid:9) , min t , (cid:88) j =1 dbf L j ( t , t ) + (cid:88) τi ∈H τ and case 2 or 3 dbf Hi ( t , t )+ (cid:88) τi ∈H τ and case 2 (cid:0) CO ( t − t ) + C Hi − C Li (cid:1) ≤ t . Here dbf Hi ( t , t ) is given by Lemma 4, dbf L ( t , t ) byLemma 7, dbf L ( t , t ) by Lemma 8, and dbf L ( t , t ) byLemma 9. Also, CO ( t − t ) is defined in Proposition 2. Proof:
From Lemmas 7, 8, and 9, we know that the totalminimum demand in the interval (0 , t ] is dbf L ( t , t ) + dbf L ( t , t ) + dbf L ( t , t ) , and this demand cannot exceed t because there is no deadline miss in (0 , t ] .The remaining demand in interval (0 , t ] is the HC demand dbf Hi ( t , t ) for HC tasks in cases 2 and 3, as well as thecarry-over demand in interval ( t , t ] for HC tasks in case 2.This carry-over demand for a task τ i is C Hi − C Li represent-ing the additional execution required in HC behavior, and CO ( t − t ) representing the maximum remaining executionfor the carry-over job at time instant t . D. Test properties
In this section we show that the test presented in Theorem 2strictly dominates the one presented in Proposition 2. We alsobriefly discuss the test complexity.For LC behaviors, both the existing test as well as the newtest use the same condition presented in Proposition 1. For HC behaviors, the following theorem shows that the new testdominates the existing test. Theorem 3:
If a task system τ is EDF schedulable in HC behaviors based on Proposition 2, then it is also EDFschedulable in HC behaviors based on Theorem 2. Proof:
Consider some time instant t for which the condi-tion in Proposition 2 holds. Now we show that the conditionin Theorem 2 also holds for all t and t such that t − t = t .LHS of condition in Theorem 2 ≤ t + (cid:88) τi ∈H τ andcase 2 or 3 dbf Hi ( t , t )+ (cid:88) τi ∈H τ and case 2 (cid:0) CO ( t − t ) + C Hi − C Li (cid:1) ( dbf Hi ( t , t ) = 0 for HC tasks in case 1 ⇒ ) = t + (cid:88) τ i ∈H τ dbf Hi ( t , t )+ (cid:88) τi ∈H τ and case 2 (cid:0) CO ( t − t ) + C Hi − C Li (cid:1) (Using dbf Hi ( t , t ) = dbf Hi ( t − t ) from Lemma 4, and τ i ∈ S ( t − t ) implies τ i in case 2 from Proposition 2) = t + (cid:88) τ i ∈H τ dbf Hi ( t − t )+ (cid:88) τ i ∈S ( t − t ) (cid:0) CO ( t − t ) + C Hi − C Li (cid:1) (Proposition 2 is satisfied for t = t − t ⇒ ) ≤ t + t − t = t . This shows that whenever the condition in Proposition 2holds for some time t , conditions in Theorem 2 for timeinstants t and t satisfying t − t = t also hold. Therefore,when Proposition 2 holds for all time instants t : 0 ≤ t ≤ t MAX , Theorem 2 also holds for all time instants t and t such that ≤ t ≤ t MAX and t < t .While the above theorem proves dominance of the new test,the following example shows that this dominance is strict. Example 1:
Consider task system comprising of two tasks τ = { , , HC, { , }} and τ = { , , LC, { , }} . Recallrom Section II that a dual-criticality sporadic task is specifiedas τ i = ( T i , D i , L i , C i ) , where T i denotes minimum separationbetween successive job releases, D i denotes deadline, L i denotes criticality level, and C i = { C Li , C Hi } is a list of WCETvalues with C Li denoting the low-criticality (or LC ) WCETand C Hi denoting the high-criticality (or HC ) WCET.Let us assume that the tightened deadlines of these tasksare the same as their real deadlines, that is, D L = D = 4 and D L = D = 5 . It can be easily verified that Proposition 2fails for t = 1 , because it computes the demand of task τ inthis interval as time units. On the other hand, Theorem 2succeeds for this task system, and in fact, this task system iseasily schedulable even if we reserve time units for task τ at all times. Test complexity.
For a given set of time instants t and t ,the condition in Theorem 2 and Proposition 1 can be evaluatedin time proportional to the number of tasks in τ . The boundon time instants ( t MAX ) is a pseudo-polynomial in the size ofthe input (see [10]). Therefore, the overall complexity of theproposed test is also pseudo-polynomial, although there is aquadratic increase in the number of conditions to be evaluatedwhen compared to the existing test.IV. D
EADLINE TIGHTENING STRATEGY
In this section we present a new deadline tightening strategythat uses the schedulability test presented in Theorem 2 andevaluate its performance through extensive simulations.
A. Strategy
Algorithm 1 presents our deadline tightening strategy calledEarliest Carry-over Deadline First (ECDF). It first checksfor satisfaction of the LC schedulability test in Lines 4–10 (Proposition 1), and then for satisfaction of the HC schedulability test in Lines 11–19 (Theorem 2). If the testfor HC behaviors failed for some instants t and t , thenwe identify an appropriate candidate among all the HC tasksand tighten its LC deadline by (Line 15). If the test for LC behaviors failed for some time instant after some deadline wastightened, then we backtrack and increment the deadline by (Line 7). The list of candidate HC tasks is continuouslyupdated in each step, so that a task is removed from this listif its LC deadline cannot be reduced anymore as in Line 16,or if tightening its deadline resulted in a failed test for LC behaviors as in Line 7. Thus, in each step, either some taskdeadline is reduced by one or some task is removed from thelist of candidates, and therefore the while loop in the algorithmis guaranteed to terminate.Function FINDCANDIDATE presented in Algorithm 1identifies the appropriate HC task whose deadline must betightened from among a list of candidates. In Section III-Bwe split the set of HC tasks into three cases for each timeinstant pair t and t . Tasks in case 1 do not generate any HC demand and their demand bound is given by Lemma 2.It is easy to see from this lemma that if the deadline D Li ofthis task is tightened, then it continues to be in case 1 forthe same time instant pair, and further its demand bound may Algorithm 1
ECDF: Earliest Carry-over Deadline First i ←⊥ and candidates ← { τ i | τ i ∈ H τ } . while True do feasible ← true. for t = 0 . . . t MAX do if Proposition 1 fails then If i = ⊥ , return failure. D Li = D Li + 1 and remove τ i in candidates. i ←⊥ and break. end if end for for t = 0 . . . t MAX and t = 0 . . . t − min τ i ∈H τ { D i − D Li } − do if Theorem 2 fails then If t = 0 or candidates = Φ , return failure. i = FINDCANDIDATE(candidates, t , t ). D Li = D Li − . If D Li − < C Li , remove τ i in candidates. feasible ← false and break. end if end for If feasible is true, return success. end while function
FIND C ANDIDATE (candidates, t , t ) Let
DEM denote the excess demand at time instant t (LHS of Theorem 2 - t ). result ←⊥ , DIF F = 0 , DEC = ∞ . for Each task τ i in candidates do if τ i in case 2 and C Hi − C Li ≥ DEM then if MOD ( t − t , T i ) − ( D i − D Li ) < DEC then DEC ← M OD ( t − t , T i ) − ( D i − D Li ) . result ← i and DIF F ← C Hi − C Li . else if M OD ( t − t , T i ) − ( D i − D Li ) = DEC and C Hi − C Li > DIF F then result ← i and DIF F ← C Hi − C Li . end if end if end for Return result. end function only increase. Therefore, these tasks are not good candidatesfor deadline tightening. Now consider a HC task in case 3whose demand bound is given in Lemma 5, that is, a taskwhose carry-over job does not generate any demand in theinterval ( t , t ] . Therefore, the LC deadline D Li of this carry-over job is no later than t , and tightening this deadline willnot change the demand of the carry-over job. It is also easyto see that tightening D Li will not change the demand of anyother job of this task either. Thus, tasks in case 3 are also notgood candidates for tightening the LC deadlines.Now consider a HC task τ i in case 2 whose demand boundis given by Lemma 4. If we tighten its LC deadline D Li sothat D i − D Li > M OD ( t − t , T i ) , then the carry-over jobcan no longer contribute demand in the interval ( t , t ] andherefore its demand would decrease by C Hi − C Li . We usethis property to identify the appropriate candidate in functionFINDCANDIDATE. From among all the tasks in case 2,we choose the task that requires the smallest change in LC deadline to cause this demand reduction (Line 27), and hencethe name Earliest Carry-over Deadline First. If there is a tie,then we break the tie using the largest reduction in demand firststrategy as shown in Lines 30–32 (largest value for C Hi − C Li ).Further, as a small optimization, we only consider those tasksin case 2 whose demand reduction would result in the failedschedulability test for time instant pair t and t now beingsatisfied (check in Line 26). Note that this proposed strategy isalmost identical to the strategy earlier proposed by Ekberg andYi [9], but for two crucial exceptions. One is that we use theimproved test, and the second is our strategy for identifyingan appropriate candidate task (function FINDCANDIDATE). Run-time complexity.
Algorithm 1 uses the schedulabilitytests in Proposition 1 and Theorem 2, both of which havepseudo-polynomial complexity. Function FINDCANDIDATEtakes a constant amount of time for each HC task in the listof potential candidates, and therefore its total complexity islinear in the size of the candidate list for each call. The list ofpotential candidates is initialized with all the HC tasks, andin each iteration of the while loop, either a task is removedfrom this list or some LC deadline is tightened by time unit.Further, when the LC deadline cannot be reduced anymore,the task is also removed from the candidate list. Therefore, inthe worst case, the LC deadline of each HC task is reduceduntil it reaches its LC WCET, and in this case the while loopexecutes (cid:80) τ i ∈H τ ( D i − C Li ) number of times. Therefore, theoverall complexity of Algorithm 1 is also pseudo-polynomial. B. Simulation results
In this section we present simulation results comparingECDF with AMC [6], PLRS [8], and GREEDY [9].
Simulation setting.
The various parameters are as follows. • T i is drawn at random from [5 , . • pCriticality denotes the probability that a task is a HC task, and we choose values for this parameter from theset { . , . } . • LC task utilization is drawn at random from [0 . , . .That is, if T i denotes the minimum separation, then its LC WCET C Li is drawn randomly from the range [ T i ∗ . , T i ∗ . . • Once the LC WCET is fixed, if the task is a HC task,then its HC WCET C Hi is drawn at random from therange [2 ∗ C Li , ∗ C Li ] . • Task deadline D i is drawn at random either from [ C Hi , T i ] (simulations in Figure 7) or from [ C Hi +( T i − C Hi ) / , T i ] (simulations in Figure 8).Tasks are generated using the above parameters one at a timeuntil the following condition on system load is satisfied. max ≤ t ≤ tMAX max (cid:110)(cid:80) τi ∈ τ dbf Li ( t ) , (cid:80) τi ∈H τ dbf Hi ( t ) (cid:111) t ≤ lBound, where lBound ∈ { . , . , . , . , . , . , . , . } , dbf Li ( t ) is given by Equation (1), and dbf Hi ( t ) is given f r a c t i on sc hedu l ab l e load boundECDFGREEDYPLRSAMC (a) pCriticality = 0.5 f r a c t i on sc hedu l ab l e load boundECDFGREEDYPLRSAMC (b) pCriticality = 0.7Fig. 7. Simulation results with deadlines in [ C Hi , T i ] by Equation (2). This condition ensures that the load ofthe resulting task system in a purely LC or HC behaviordoes not exceed lBound . For each pCriticality and lBound values, we generated , task sets and evaluated theirschedulability using the four algorithms mentioned above.Figure 7 shows simulation results when task deadlinesare drawn from the range [ C Hi , T i ] . In these figures, the x-axis denotes the value for lBound and the y-axis plots thefraction of task sets deemed schedulable by the respectivealgorithms. The two figures are for different pCriticality values, where a lower value denotes lower proportion of HC tasks in the task system. As can be seen from these figures,ECDF clearly outperforms all the other algorithms in allscenarios, even in cases when the proportion of HC tasksis small ( pCriticality = 0 . ). Further, this performance gapwidens with increasing system load and proportion of HC tasks. When the proportion of HC tasks is higher, there ismore opportunity for ECDF to tighten task deadlines, andtherefore we can see the improved performance. An interestingobservation is that GREEDY which is also based on a deadlinetightening strategy, does not show a similar improvement withincreasing proportion of HC tasks. We suspect this is mainlybecause of the large pessimism in the schedulability test usedby the algorithm, and the benefits of reducing this pessimismis clearly seen in the case of ECDF.Figure 8 shows simulation results when HC task deadlinesare drawn from the range [ C Hi +( T i − C Hi ) / , T i ] and LC taskdeadlines are drawn from the range [ C Hi , T i ] . Since HC task f r a c t i on sc hedu l ab l e load boundECDFGREEDYPLRSAMC (a) pCriticality = 0.5 f r a c t i on sc hedu l ab l e load boundECDFGREEDYPLRSAMC (b) pCriticality = 0.7Fig. 8. Simulation results with HC deadlines in [ C Hi + ( T i − C Hi ) / , T i ] deadlines are larger when compared to the earlier simulations,deadline tightening strategies ECDF and GREEDY have moreopportunities to tighten HC task deadlines in these systems.As can be seen from the figures, these algorithms indeedsignificantly outperform AMC and PLRS in this scenario. Aneven more interesting observation is that ECDF continues tooutperform GREEDY, and this performance gap widens withincreasing system load and proportion of HC tasks.We also did experiments to evaluate how well ECDFperforms in comparison to exhaustive deadline search (seeFigure 9). We considered two exhaustive strategies for thiscomparison. The first one, denoted SIMULATION, tries allpossible tightened deadline values for the HC tasks and thenevaluates schedulability by simulating EDF strategy for allpossible values of t . The second one, denoted TEST, alsotries all possible tightened deadline values for the HC tasks,but evaluates schedulability using Theorem 2. To make theseexhaustive simulations practically feasible, we only consideredtask sets with a small number of tasks ( or ), limited therange of T i to [10 , , and generated task sets for each pCriticality and lBound values.Figure 9 shows the simulation results for GREEDY, ECDF,TEST, and SIMULATION, when pCriticality = 0 . and HC task deadlines are chosen from [ C Hi + ( T i − C Hi ) / , T i ] .Figure 9(a) (likewise Figure 9(b)) shows the results whennumber of tasks in the task set is (likewise ). As canbe seen in both the cases, ECDF performs almost as wellas TEST, suggesting that the deadline search heuristic is f r a c t i on sc hedu l ab l e load boundSIMULATIONTESTECDFGREEDY (a) tasks per set f r a c t i on sc hedu l ab l e load boundSIMULATIONTESTECDFGREEDY (b) tasks per setFig. 9. Simulation results for comparison with exhaustive search very effective. The gap between SIMULATION and TESTindicates the pessimism still present in the improved test, andas expected this gap widens with increasing number of tasks.V. C ONCLUSIONS
In this paper we derived a new demand-based schedulabilitytest for general mixed-criticality sporadic task systems, andshowed that it strictly dominates the existing demand-basedtest. A key insight used by this test is that by collectivelyconsidering low- as well as high-criticality demand in a timeinterval, the resulting bound can be far less pessimistic thanindependent bounds for low- and high-criticality demands.We also proposed a novel deadline tightening strategy basedon this new test, and showed through simulations that itoutperforms all known algorithms even under high load.The test presented in this paper can only be used forconstrained deadline task systems, and in particular, cannot beused when task deadlines are greater than minimum separation.In the future we will generalize our schedulability test for sucharbitrary deadline sporadic task systems.The proposed test can be generalized to task systems withmore than two criticality levels, by considering all possibletime instants when the system switches between those multiplecriticalities. But the complexity of this resulting test would beexponential in the number of criticality levels. In the future wealso plan to develop a more computationally efficient demand-based test for such task systems.
CKNOWLEDGMENT
This work was supported by Start-up Grant, NTU, Singa-pore. The author would also like to thank his PhD studentXiaozhe Gu for helping with simulation experiments.R
EFERENCES[1] S. Vestal, “Preemptive Scheduling of Multi-criticality Systems withVarying Degrees of Execution Time Assurance,” in
Proceedings of theIEEE Real-Time Systems Symposium (RTSS) , 2007, pp. 239–243.[2] A. French, Z. Guo, and S. Baruah, “Scheduling Mixed-criticalityWorkloads upon Unreliable Processors,” in
Workshop on Models andAlgorithms for Planning and Scheduling Problems (MAPSP) , 2013.[3] S. Baruah and A. Burns, “Implementing Mixed Criticality Systems inAda,” in
Proceedings of the Ada-Europe International Conference onReliable Software Technologies , 2011, pp. 174–188.[4] R. Wilhelm, J. Engblom, A. Ermedahl, N. Holsti, S. Thesing, D. Whal-ley, G. Bernat, C. Ferdinand, R. Heckmann, T. Mitra, F. Mueller,I. Puaut, P. Puschner, J. Staschulat, and P. Stenstr¨om, “The worst-caseexecution-time problem – overview of methods and survey of tools,”
ACM Transactions on Embedded Computing Systems , vol. 7, no. 3, pp.36:1–36:53, 2008.[5] C. Liu and J. Layland, “Scheduling Algorithms for Multiprogrammingin a Hard-Real-Time Environment,”
Journal of the ACM , vol. 20, no. 1,pp. 46–61, 1973.[6] S. Baruah, A. Burns, and R. Davis, “Response-Time Analysis for MixedCriticality Systems,” in
Proceedings of the IEEE Real-Time SystemsSymposium (RTSS) , 2011, pp. 34–43.[7] G. Buttazzo, “Rate Monotonic vs. EDF: Judgment Day,”
Springer Real-Time Systems , vol. 29, no. 1, pp. 5–26, 2005.[8] N. Guan, P. Ekberg, M. Stigge, and W. Yi, “Effective and EfficientScheduling of Certifiable Mixed-Criticality Sporadic Task Systems,” in
Proceedings of the IEEE Real-Time Systems Symposium (RTSS) , 2011,pp. 13–23.[9] P. Ekberg and W. Yi, “Bounding and Shaping the Demand of Mixed-Criticality Sporadic Tasks,” in
Proceedings of the Euromicro Conferenceon Real-Time Systems (ECRTS) , 2012, pp. 135–144.[10] S. Baruah, A. Mok, and L. Rosier, “Preemptively Scheduling Hard-Real-Time Sporadic Tasks on One Processor,” in
Proceedings of the IEEEReal-Time Systems Symposium (RTSS) , 1990, pp. 182–190.[11] S. Baruah and S. Vestal, “Schedulability Analysis of Sporadic Tasks withMultiple Criticality Specifications,” in
Proceedings of the EuromicroConference on Real-Time Systems (ECRTS) , 2008, pp. 147–155.[12] H. Li and S. Baruah, “An Algorithm for Scheduling Certifiable Mixed-Criticality Sporadic Task Systems,” in
Proceedings of the IEEE Real-Time Systems Symposium (RTSS) , 2010, pp. 183–192.[13] S. Baruah, V. Bonifaci, G. D’Angelo, A. Marchetti-Spaccamela, S. VanDer Ster, and L. Stougie, “Mixed-criticality Scheduling of Sporadic TaskSystems,” in
Proceedings of the European Symposium on Algorithms(ESA) , 2011, pp. 555–566.[14] N. Audsley, “Optimal Priority Assignment and Feasibility of StaticPriority Tasks with Arbitrary Start Times,” in
The University of YorkTechnical Report , 1991.[15] S. Baruah, V. Bonifaci, G. D’Angelo, H. Li, A. Marchetti-Spaccamela,N. Megow, and L. Stougie, “Scheduling Real-Time Mixed-CriticalityJobs,”