An important trend in real-time embedded systems is to integrate applications with different criticality levels into a shared platform in order to reduce resource cost and energy consumption. To ensure the correctness of a mixed-criticality (MC) system, highly critical tasks are subject to certification by Certification Authorities under extremely rigorous and pessimistic assumptions 
. This generally causes large worst-case execution time (WCET) estimation for high-criticality tasks. On the other hand, the system designer needs to consider the timing requirement of the entire system, but under less conservative assumptions. The challenge in scheduling MC systems is to simultaneously guarantee the timing correctness of (1) only high-criticality tasks under very pessimistic assumptions, and (2) all tasks, including low-critical ones, under less pessimistic assumptions.
The scheduling problem of MC systems has been intensively studied in recent years (see Section II for a brief review). In most of previous works, the timing correctness of high-criticality tasks are guaranteed in the worst case scenario at the expense of low-criticality tasks. More specifically, when any high criticality task executes for longer than its low-criticality WCET (and thus the system enters the high-criticality mode), all low-criticality tasks will be completely discarded and the resource are all dedicated for meeting the timing constraints of high-criticality tasks [2, 3, 4, 5]. However, such an approach seriously disturbs the service of low-criticality tasks. This is not acceptable in many practical problems, especially for control systems where the performance of controllers mainly depends on the execution frequency of control tasks .
To overcome this problem, Burns and Baruah in  introduced an MC task model where low-criticality tasks reduce their execution budgets such that low-criticality tasks are guaranteed to be scheduled in high-criticality mode with regular execution frequency (i.e., the same period) but degraded quality111In , the output quality of a task is related to its execution time. The longer a task executes, the better quality results it produces.. Since the idea of reducing execution budgets to keep tasks running is conceptually similar to the imprecise computation model , in this paper we call an MC system with possibly reduced execution budgets of low criticality tasks an imprecise mixed criticality (IMC) system.
In , the authors consider preemptive fixed-priority scheduling for the IMC system model and extend the adaptive mixed criticality (AMC)  approach to provide a schedulability test for the IMC model. In this paper, we study the EDF-VD scheduling of IMC systems. EDF-VD is designed for the classical MC system model, in which EDF is enhanced by deadline adjustment mechanisms to compromise the resource requirement on different criticality levels. EDF-VD has shown strong competence by both theoretical and empirical evaluations [2, 4, 5]. For example,  proves that EDF-VD is a speedup-optimal MC scheduling and in [4, 5] experimental evaluations show that EDF-VD outperforms other MC scheduling algorithms in terms of acceptance ratio. The main technical contributions of this paper include
For the IMC model under EDF-VD, we derive a speedup factor function with respect to the utilization ratios of high criticality tasks and low criticality tasks - see Theorem 4 in Section V. The derived speedup factor function enables us to quantify the suboptimality of EDF-VD and evaluate the impact of the utilization ratios on the speedup factor. We also compute the maximum value of the speedup factor function, which is equal to the speedup factor bound for the classical MC model .
With extensive experiments, we show that for the IMC model, by using our proposed sufficient test, in most cases EDF-VD outperforms AMC  in terms of the number of schedulable task sets. Moreover, the experimental results validate the observations we obtained for speedup factor.
Moreover, the schedulability test and speedup factor results of this paper also apply to the elastic mixed-criticality (EMC) model proposed in , where the periods of low-criticality tasks are scaled up in high-criticality mode, see in Section VI.
The remainder of this paper is organized as follows: Section II discusses the related work. Section III gives the preliminaries and describes the IMC task model and its execution semantics. Section IV presents our sufficient test for the IMC model and Section V derives the speedup factor function for the IMC under EDF-VD. Section VI extends the proposed sufficient test to the EMC model. Finally, Section VII shows our experimental results and Section VIII concludes this paper.
Ii Related Work
Burns and Davis in  give a comprehensive review of work on real-time scheduling for MC systems. Many of these literatures, e.g., , consider the classical MC model in which all low criticality tasks are discarded if the system switches to the high criticality mode. In , Burns and Baruah discuss three approaches to keep some low criticality tasks running in high-criticality mode. The first approach is to change the priority of low criticality tasks. However, for fixed-priority scheduling, deprioritizing low criticality tasks cannot guarantee the execution of the low criticality tasks with a short deadline after the mode switches. . Similarly, for EDF, lowering priority of low criticality tasks leads to a degraded service . In this paper, we consider the IMC model which improves the schedulability of low criticality tasks in high-criticality mode by reducing their execution time. The IMC model can guarantee the regular service of a system by trading off the quality of the produced results. For some applications given in , such trade-off is preferred. The second approach in  is to extend the periods of low criticality tasks when the system mode changes to high-criticality mode such that the low criticality tasks execute less frequently to ensure their schedulability. Su et al.  and Jan et al.  both consider this model. However, some applications might prefer an on-time result with a degraded quality rather than a delayed result with a perfect quality. Some example applications can be seen in . Then, the approach of extending periods is less useful for this kind of applications. The last approach proposed in  is to reduce the execution budget of low criticality tasks when the system mode switches, i.e., the use of the IMC model studied in this paper. In , the authors extend the AMC  approach to test the schedulability of an IMC task set under fixed-priority scheduling. However, the schedulability problem for an IMC task set under EDF-VD , has not yet been addressed. Therefore, in this paper, we study the schedulability of the IMC task model under EDF-VD and propose a sufficient test for it.
This section first introduces the IMC task model and its execution semantics. Then, we give a brief explanation for EDF-VD scheduling  and an example to illustrate the execution semantics of the IMC model under EDF-VD scheduling.
Iii-a Imprecise Mixed-Criticality Task Model
We use the implicit-deadline sporadic task model given in  where a task set includes tasks which are scheduled on a uniprocessor. Without loss of generality, all tasks in are assumed to start at time 0. Each task in generates an infinite sequence of jobs and is characterized by :
is the period or the minimal separation interval between two consecutive jobs;
denotes the relative task deadline, where ;
is a list of WCETs, where and represent the WCET in low-criticality mode and the WCET in high-criticality mode, respectively. For a high-criticality task, it has , whereas for a low-criticality task, i.e., low-criticality task has a reduced WCET in high-criticality mode.
Then each job is characterized by , where is the absolute release time and is the absolute deadline. Note that if low-criticality task has , it will be immediately discarded at the time of the switch to high-criticality mode. In this case, the IMC model behaves like the classical MC model.
The utilization of a task is used to denote the ratio between its WCET and its period. We define the following utilizations for an IMC task set :
For every task , it has , ;
For all low-criticality tasks, we have total utilizations
For all high-criticality tasks, we have total utilizations
For an IMC task set, we have
Iii-B Execution Semantics of the IMC Model
The execution semantics of the IMC model are similar to those of the classical MC model. The major difference occurs after a system switches to high-criticality mode. Instead of discarding all low-criticality tasks, as it is done in the classical MC model, the IMC model tries to schedule low-criticality tasks with their reduced execution times . The execution semantics of the IMC model are summarized as follows:
The system starts in low-criticality mode, and remains in this mode as long as no high-criticality job overruns its low-criticality WCET . If any job of a low-criticality task tries to execute beyond its , the system will suspend it and launch a new job at the next period;
If any job of high-criticality task executes for its time units without signaling completion, the system immediately switches to high-criticality mode;
As the system switches to high-criticality mode, if jobs of low-criticality tasks have completed execution for more than their but less than their , the jobs will be suspended till the tasks release new jobs for the next period. However, if jobs of low-criticality tasks have not completed their () by the switch time instant, the jobs will complete the left execution to after the switch time instant and before their deadlines. Hereafter, all jobs are scheduled using . For high-criticality tasks, if their jobs have not completed their () by the switch time instant, all jobs will continue to be scheduled to complete . After that, all jobs are scheduled using .
Santy et al.  have shown that the system can switch back from the high-criticality mode to the low-criticality mode when there is an idle period and no high-criticality job awaits for execution. For the IMC model, we can use the same scenario to trigger the switch-back. In this paper, we focus on the switch from low-criticality mode to high-criticality mode.
Iii-C EDF-VD Scheduling
The challenge to schedule MC tasks with EDF scheduling algorithm  is to deal with the overrun of high-criticality tasks when the system switches from low-criticality mode to high-criticality mode. Baruah et al. in  proposed to artificially tighten deadlines of jobs of high-criticality tasks in low-criticality mode such that the system can preserve execution budgets for the high-criticality tasks across mode switches. This approach is called EDF with virtual deadlines (EDF-VD).
Iii-D An Illustrative Example
Here, we give a simple example to illustrate the execution semantics of the IMC model under EDF-VD. Table I gives two tasks, one low-criticality task and one high-criticality task , where is the virtual deadline. Figure 1 depicts the scheduling of the given IMC task set, where we assume that the mode switch occurs in the second period of . When the system switches to high-criticality mode, will be scheduled by its original deadline instead of its virtual deadline . Hence, preempts at the switch time instant. Since in high-criticality mode only has execution budget of 2 , i.e., , executes one unit and suspends. Then, completes its left execution () before its deadline.
Iv Schedulability Analysis
In , an AMC-based schedulability test for the IMC model under fixed priority scheduling has been proposed. However, to date, a schedulability test for the IMC model under EDF-VD has not been addressed yet. Therefore, inspired by the work in  for the classical MC model, we propose a sufficient test for the IMC model under EDF-VD.
Iv-a Low Criticality Mode
We first ensure the schedulability of tasks when they are in low-criticality mode. As the task model is in low-criticality mode, the tasks can be considered as traditional real-time tasks scheduled by EDF with virtual deadlines (VD). The following theorem is given in  for tasks scheduled in low-criticality mode.
Theorem 1 (Theorem 1 from ).
The following condition is sufficient for ensuring that EDF-VD successfully schedules all tasks in low-criticality mode:
where is used to uniformly modify the relative deadline of high-criticality tasks.
Since the IMC model behaves as the classical MC model in low-criticality mode, Theorem 1 holds for the IMC model as well.
Iv-B High Criticality Mode
For high-criticality mode, the classical MC model discards all low-criticality jobs after the switch to high-criticality mode. In contrast, the IMC model keeps low-criticality jobs running but with degraded quality, i.e., a shorter execution time. So the schedulability condition in  does not work for the IMC model in the high-criticality mode. Thus, we need a new test for the IMC model in high-criticality mode.
To derive the sufficient test in high-criticality mode, suppose that there is a time interval , where a first deadline miss occurs at and denotes the time instant of the switch to high-criticality mode in the time interval, where . Assume that is the minimal set of jobs generated from task set which leads to the first deadline miss at . The minimality of means that removing any job in guarantees the schedulability of the rest of . Here, we introduce some notations for our later interpretation. Let variable denote the cumulative execution time of task in the interval . denotes a special high-criticality job which has switch time instant within its period , i.e, . Furthermore, is the job with the earliest release time amongst all high-criticality jobs in which execute in . Figure 2 visualizes the defined time instants. Moreover, we define a special type of job for low-criticality tasks which is useful for our later proofs.
A job from low-criticality task is a carry-over job, if its absolute release time is before and its absolute deadline is after the switch time instant, i.e., .
With the notations introduced above, we have the following propositions,
Proposition 1 (Fact 1 from ).
All jobs in that execute in have deadline .
It is easy to observe that only jobs which have deadlines are possible to cause a deadline miss at . If a job has its deadline and is still in set , it will contradict the minimality of .
The switch time instant has
Let us consider a time instant which is the virtual deadline of job . Since executes in time interval , its virtual deadline must be greater than the switch time instant . Otherwise, it should have completed its low-criticality execution before , and this contradicts that it executes in . Thus, it holds that
If a carry-over job has its cumulative execution equal to and , its deadline is .
For a carry-over job , if it has its cumulative execution equal to and , it should complete its execution before . Otherwise, if job has executed time units at time instant , it will be suspended and will not execute after .
Now, we will show that when job completes its execution, its deadline is . We prove this by contradiction. First, we suppose that has its deadline and release time . As shown above, job completes its execution before . Let us assume a time instant as the latest time instant at which this carry-over job starts to execute before . This means that at this time instant all jobs in with deadline have finished their executions. This indicates that these jobs will not have any execution within interval . Therefore, jobs in with release time at or after time instant can form a smaller job set which causes a deadline miss at . Then, it contradicts the minimality of . Thus, carry-over job with its cumulative execution time equal to and has its deadline . ∎
With the propositions and notations given above, we derive an upper bound of the cumulative execution time of low-criticality task .
For any low-criticality task , it has
If , it is trivial to see that Lemma 1 holds. Below we focus on the case when . If a system switches to high-criticality mode at , then we know that low-criticality tasks are scheduled using before and using after . To prove this lemma, we need to consider two cases, where releases a job within interval or it does not. We prove the two cases separately.
Case A (task releases a job within interval ): There are two sub-cases to be considered.
Sub-case 1 (No carry-over job): The deadline of a job of low-criticality task coincides with switch time instant . The cumulative execution time of low-criticality task within time interval can be bounded as follows,
Since according to Proposition 2 and for low-criticality task it has , then
Sub-case 2 (with carry-over job): In this case, before the carry-over job, jobs of are scheduled with its . After the carry-over job, jobs of are scheduled with its . It is trivial to observe that for a carry-over job its maximum cumulative execution time can be obtained when it completes its within its period , i.e., . Considering the maximum cumulative execution for the carry-over job, we then have for low-criticality task ,
Proposition 3 shows as has its cumulative execution equal to , it has . Given for low-criticality task, we have
Case B (task does not release a job within interval ): In this case, let denote the last release job of task before and and are its absolute release time and absolute deadline, respectively. If , we have
If , is a carry-over job. As we discussed above, the maximum cumulative execution time of carry-over job is , so we have
Similarly, according to Proposition 3, we obtain,
Lemma 1 gives the upper bound of the cumulative execution time of a low-criticality task in high-criticality mode. In order to derive the sufficient test for the IMC model in high-criticality mode, we need to upper bound the cumulative execution time of high-criticality tasks.
Proposition 4 (Fact 3 from ).
For any high-criticality task , it holds that
Proposition 4 is used to bound the cumulative execution of the high-criticality tasks. Since in the IMC model the high-criticality tasks are scheduled as in the classical MC model, Proposition 4 holds for the IMC model as well. With Lemma 1 and Proposition 4, we can derive the sufficient test for the IMC model in high-criticality mode.
The following condition is sufficient for ensuring that EDF-VD successfully schedules all tasks in high-criticality mode:
Let denote the cumulative execution time of all tasks in over interval . We have
Since the tasks must be schedulable in low-criticality mode, the condition given in Theorem 1 holds and we have . Hence,
Since time instant is the first deadline miss, it means that there is no idle time instant within interval . Note that if there is an idle instant, jobs from set which have release time at or after the latest idle instant can form a smaller job set causing deadline miss at which contradicts the minimality of . Then, we obtain
By taking the contrapositive, we derive the sufficient test for the IMC model when it is in high-criticality mode:
Note that if , i.e., no low-criticality tasks are scheduled after the system switches to high-criticality mode, our Theorem 2 is the same as the sufficient test (Theorem 2 in ) for the classical MC model in high-criticality mode. Hence, our Theorem 2 actually is a generalized schedulability condition for (I)MC tasks under EDF-VD.
Given an IMC task set, if
then the IMC task set is schedulable by EDF; otherwise, if
then this IMC task set can be scheduled by EDF-VD with a deadline scaling factor arbitrarily chosen in the following range
Total utilization is the exact test for EDF on a uniprocessor system. If the condition in (8) is met, the given task set is worst-case reservation  schedulable under EDF, i.e., the task set can be scheduled by EDF without deadline scaling for high-criticality tasks and execution budget reduction for low-criticality tasks. Now, we prove the second condition given by (9). From Theorem 1, we have,
From Theorem 2, we have
V Speedup Factor
The speedup factor bound is a useful metric to compare the worst-case performance of different MC scheduling algorithms. The speedup factor bound for the classical MC model under EDF-VD  has been shown to be . The following is the definition of the speedup factor for an MC scheduling algorithm.
Definition 2 (from ).
An algorithm has a speedup factor , if any task system that is schedulable on a unit-speed processor by using a hypothetical optimal clairvoyant scheduling algorithm222A ‘clairvoyant’ scheduling algorithm knows all run-time information, e.g., when the mode switch will occur, prior to run-time., can be successfully scheduled on a speed- processor by algorithm .
For notational simplicity, we define
where and . denotes the utilization ratio between and , while denotes the utilization ratio between and .
First, let us analyze the speedup factor of two corner cases. When , i.e., , this means that there is no mode-switch. Therefore, the task set is scheduled by the traditional EDF, i.e., the task set is schedulable if . Since EDF is the optimal scheduling algorithm on a uniprocessor system, the speedup factor is 1. When , i.e., , if the task set is schedulable in high-criticality mode, it must hold by Theorem 2. Then it is scheduled by the traditional EDF and thus the speedup factor is 1 as well.
In this paper, instead of generating a single speedup factor bound, we derive a speedup factor function with respect to . This speedup factor function enables us to quantify the suboptimality of EDF-VD for the IMC model in terms of speedup factor (by our proposed sufficient test) and evaluate the impact of the utilization ratio on the schedulability of an IMC task set under EDF-VD.
First, we strive to find a minimum speed (1) for a clairvoyant optimal MC scheduling algorithm such that any implicit-deadline IMC task set which is schedulable by the clairvoyant optimal MC scheduling algorithm on a speed- processor can satisfy the schedulability test given in Theorem 3, i.e., schedulable under EDF-VD on a unit-speed processor.
Given , , , and
then it guarantees
Below, we prove that is the optimal solution of the optimization problem (13)333 This optimization problem is a non-convex problem and thus we cannot use general convex optimization techniques such as the Karush-Kuhn-Tucker (KKT) approach  to solve it. .
Each of constraints in the optimization problem (13) defines a feasible space in the three-dimension space. In Figure 2(a), the space above the plane is a feasible space satisfying constraint (14), where the plane corresponds to . For constraint (15), draws a plane and the feasible space is above the plane shown in Figure 2(b). Similarly, when constraint (16) makes its right-hand-side equal to the left-hand-side, we draw a vertical curved surface seen in Figure 2(c) and the space outside the vertical surface is the feasible space444As the arrows direct.. As a result, the feasible solutions subject to these three constraints must be above both planes and outside the vertical curved surfaces. Below we will prove the minimum value of in the feasible solution space must be on the vertical surface and one plane.
First assume that we have a point which satisfies all constraints but is not on the vertical surface. If we connect the origin and , this line must have an intersection point with the vertical surface. It is easy to observe that - see in Figure 2(d). This means that any point which is not on the vertical surface can find a point with smaller value of on the vertical surface which satisfies all constraints. Therefore, the point with the minimal must be on the vertical surface. Similarly, the minimal must be on one of the two planes. Otherwise, if it is not on any plane, we always can find a projected point on one plane which has a smaller value of .
We have shown above that to obtain the minimal value of the point must be on the vertical surface and one plane. Then, the two planes have an intersection line and this line intersects with the vertical surface at a point denoted by . By taking constraints (14)(15) and (16), we formulate a piece-wise function of with respect to as follows.
This function covers all points which are on the vertical surface and one plane and at same time satisfy all constraints. By doing some calculus, we know that Eq. (18) is monotonically decreasing in and monotonically increasing in . Therefore, the minimal value of Eq. (18) can be obtained at . The complete proof is given by Lemma 4 in Appendix I. It means that we can obtain the optimal solution of optimization problem (13) by solving the following equation system.
By joining the first two equations we have , and applying it to the last equation in (19) gives
By the well-known Quadratic Formula we get the two roots of the above quadratic equation.
We can prove that is larger than 1 and thus should be dropped (since we require ), while is in the range of . The detailed proof is given by Lemma 5 in Appendix I. As a result, we obtain the optimal solution for Eq. (19). Thus, we have
Therefore, Lemma 2 is proved. ∎
Lemma 2 shows that any IMC task set which is schedulable by an optimal clairvoyant MC scheduling algorithm on a speed- is also schedulable on a unit-speed processor by EDF-VD. As a direct result, we have the following theorem,
The speedup factor of EDF-VD with IMC task sets is upper bounded by
The speedup factor is shown to be a function with respect to and . Figure 4 plots the 3D image of this function and Table II lists some of the values with different and . By doing some calculus, we obtain the maximum value , i.e., , of the speedup factor function when and , which is highlighted in Figure 4 and Table II. We see that the speedup factor bound is achieved when the task set is a classical MC task set.
First, given a fixed , the speedup factor is not a monotonic function with respect to . The relation between and the speedup factor draws a downward parabola. Therefore, a straightforward conclusion regarding the impact of on the speedup factor cannot be drawn.
Given a fixed , the speedup factor is a monotonic decreasing function with respect to increasing . It is seen that increasing leads to a smaller value of the speedup factor. This means that a larger brings a positive effect on the schedulability of an IMC task set.
Vi Extension to Elastic Mixed-Criticality Model
Su and Zhu in  introduced an Elastic Mixed-Criticality (EMC) task model, where the elastic model  is used to model low criticality tasks. When the MC system switches to high criticality mode, low-criticality tasks scale up their original period to a larger period such that low-criticality tasks continue to be scheduled with a degraded service (less frequently). Although the EMC model has been studied by , there is not a utilization-based sufficient test for the EMC model. Therefore, in this section, we prove that the theories proposed in Section IV apply to the EMC model  as well. Here, we use to denote the extended period of a low-criticality task . Since, in the EMC model, the WCETs of a low-criticality tasks are the same in two modes, the utilization of low-criticality task in high-criticality mode is computed as .
Proposition 5 (Lemma 1 from ).
A set of EMC tasks is EMC schedulable under EDF-VD if .
Here, in order to keep the consistence, we use to denote in . Proposition 5 is provided in  to check the schedulability of an EMC task set on a uniprocessor. However, Proposition 5 is a necessary test. This means that even if a given task set satisfies the condition presented in Proposition 5, it is still possible that the task set is unschedulable under EDF-VD. Below, we prove that the theories proposed in Section IV can apply to the EMC model.
First, in low-criticality mode, since the EMC model just behaves like the classical MC model, Theorem 1 holds for the EMC model. Then we discuss the schedulability of the EMC model in high-criticality mode. We have the following definition for the carry-over job of a low criticality task in the EMC model:
In the EMC model, carry-over job of low criticality task has its release time and original deadline .
Then, we prove the following proposition for a carry-over job.
For an EMC carry-over job , if it completes its execution before switch time instant , then its original deadline is .
Consider that carry-over job completes its execution before switch time instant . Suppose that has its original deadline . Let denote the latest time instant at which starts to execute before . At time instant , all jobs in with deadlines then have finished their execution. Therefore, these jobs do not have any execution within interval . This implies that jobs in which are released at or after can form a smaller job set and this smaller job set is sufficient to cause deadline miss at . This contradicts the minimality of . Therefore, in this case we have ∎
Lemma 1 still holds for low-criticality tasks of the EMC model in high-criticality mode.
For the EMC model, we need to consider a special case when carry-over job of low-criticality task has its extended deadline . Since is a deadline miss, a job with deadline will not be scheduled within -see Proposition 1. If , job will not be executed after the switch time instant and the maximum cumulative execution time of can be obtained as job completes its before . Hence, the cumulative execution of task can be bounded by,
The rest of the proof can follow the proof of Lemma 1. A complete proof can be found in Appendix II.
Lemma 3 shows that Lemma 1 can still bound the cumulative execution time of low-criticality tasks of the EMC model in high-criticality mode. Moreover, since there is no difference how the high-criticality tasks are scheduled in the EMC model or in the classical MC model, Proposition 4 still holds for the high-criticality tasks in the EMC model. As a result, Theorem 2 holds for the EMC model as well. Then, we can directly obtain the following theorem,
Theorem 3 is a sufficient test for the EMC model under EDF-VD.
Vii Experimental Evaluation
In this section, we conduct experiments to evaluate the effectiveness of the proposed sufficient test for the IMC model in terms of schedulable task sets (acceptance ratio). Moreover, we conduct experiments to verify the observations obtained in Section V regarding the impact of and on the average acceptance ratio. Our experiments are based on randomly generated MC tasks. We use a task generation approach, similar to that used in , to randomly generate IMC task sets to evaluate the proposed sufficient test. Each task is generated based on the following procedure,
pCriticality is the probability that the generated task is ahigh-criticality task; pCriticality.
Period is randomly selected from range .
In order to have sufficient number of tasks in a task set, utilization is randomly drawn from the range.
For any task , .
denotes the ratio for every high-criticality task. If , we set . It is easy to see that used in the speedup factor function is equal to ;
denotes the ratio for every low-criticality task. If , we set