skip to main content
10.1145/3696355.3699707acmotherconferencesArticle/Chapter ViewFull TextPublication PagesrtnsConference Proceedingsconference-collections
research-article
Open access

Leveraging Parallelism in Global Scheduling to Improve State Space Exploration in the SAG Framework

Published: 03 January 2025 Publication History

Abstract

Response-time analysis (RTA) is crucial for ensuring the timeliness of real-time systems. As system complexity increases, there’s a growing need for RTA techniques that can automate the process of finding worst-case response times. The schedule-abstraction graph (SAG), a recent reachability-based RTA, addresses this by systematically exploring the decision space of global job-level fixed-priority (JLFP) scheduling policies for a given task set. SAG significantly outperforms existing RTAs for global scheduling on multicore, e.g., it can identify 12 times more schedulable task sets for global EDF in comparison to sufficient RTAs and operates 400 times faster than some other reachability-based tests.
Despite these achievements, the state-space explored by the SAG can become very large in case the release jitter or the number of cores is large. This is because at present the SAG approach explores one scheduling decision at a time, leaving the parallelism inherent to global scheduling unexploited during state-space exploration. Recognizing that multiple jobs can be dispatched concurrently without interference, we introduce the first state-space-reduction technique for SAG that identifies and analyzes sets of independent jobs in tandem. We apply this technique to both preemptive and non-preemptive SAG frameworks. Our empirical evaluations show that our solution efficiently reduces the number of explored states while maintaining or even enhancing the accuracy of the SAG analysis, enabling it to scale to larger systems. For instance, our method achieves a 6 times reduction in runtime while improving schedulability by 16% for preemptive task sets scheduled using global EDF (e.g., for systems with 2 to 12 cores and 60% utilization).

1 Introduction

Response-time analysis is crucial in designing real-time systems. With over 80% of industrial systems now relying on multicore platforms [1], accurate analysis of global scheduling policies, such as global fixed-priority and EDF, is becoming increasingly important. Supported by operating systems like Linux, RTEMS, and VxWorks, global scheduling improves load balancing and reduces average response times. However, these benefits can only be achieved for real-time systems if we can also guarantee that timing requirements will be met. This requires a response-time analysis that provides accurate bounds on the response times of tasks and that scales effectively with the size of the system.
Related work. Most schedulability analyses for global scheduling policies rely on the quantification of carry-in workload and the concept of busy-window [3, 4, 6, 7, 20, 22, 34, 36, 38, 39]. However, as demonstrated in [8, 18, 24, 25], these analyses tend to be overly pessimistic, especially for larger systems with more tasks or cores.
The literature also includes exact schedulability tests using timed automata [14, 19, 37], linear hybrid automata [33, 35], simulation-based tests [12], reachability analysis via timed-labeled transition systems [17], and other reachability-based methods [5, 9, 10, 11]. Despite steady progress in scalability, these analyses face limitations as the number of tasks or cores increases as shown in [18, 25, 31].
The schedule-abstraction graph (SAG) technique, introduced in [23, 24, 25, 28] is a recent reachability-based response-time analysis that systematically explores the decision space of global job-level fixed-priority (JLFP) scheduling policies. It constructs a directed acyclic graph (DAG) with vertices representing reachable system states and edges representing a scheduling decision (dispatching of a job) that evolves a system state into another. This technique provides highly accurate response-time bounds by automatically identifying interference scenarios under global scheduling. SAG has been applied to preemptive [18] and various non-preemptive scheduling problems [15, 16, 24, 25, 26, 27, 31, 32].
Despite its accuracy and relatively good scalability, the size of a schedule-abstraction graph can grow exponentially when tasks have large release jitter or execution time variations. This growth occurs because the SAG technique explores one scheduling decision at a time, with each edge in the graph representing only a single job. To address this limitation, Ranjha et al. [28, 29, 30] proposed a partial-order reduction (POR) technique for single-core platforms, which combines multiple scheduling decisions during the exploration of the SAG graph by looking ahead into their collective completion time on the processing core. They used a set of heuristics to derive a safe but quick upper bound for the completion time of these jobs. Their technique proved to be very efficient for single-core platforms, reducing the runtime of the SAG by five orders of magnitude.
However, the POR in [28, 29, 30] cannot be directly applied to multicore platforms. Identifying ‘safe’ scenarios for analyzing multiple jobs simultaneously requires fast yet accurate sufficient schedulability tests to ensure no deadline misses among batched jobs. However, the existing ‘fast’ busy-window-based tests are overly pessimistic, often rejecting potentially safe batches. Moreover, Ranjha’s analysis [28, 29, 30] is designed for single-core platforms and does not account for the inherent parallelism offered by global scheduling policies on multicore platforms, where some ready tasks can run independently on different cores and therefore do not interfere with each other.
This paper. We introduce a state-space exploration strategy to reduce the size of the schedule-abstraction graph (SAG) and apply it to the SAG analyses for both preemptive [18] and non-preemptive [25] global job-level fixed-priority (JLFP) scheduling policies (e.g., G-EDF or G-FP). This state-space reduction technique is a form of partial-order reduction (POR) and exploits the inherent parallelism in task execution under global policies. It enables us to identify independent sets of jobs that can execute on different cores without interfering with each other. To effectively implement this technique, we address three research questions.
(RQ1)
How many jobs can start (or resume) their execution independently on the platform in a given system state?
(RQ2)
Which set(s) of jobs may start or resume their execution independently in a given system state?
(RQ3)
What will be the state of the system after dispatching these jobs?
By answering the above questions, we propose a new exploration strategy for the SAG that reduces the number of explored states while maintaining or sometimes improving the accuracy of the SAG analysis according to our empirical evaluations. Our experimental results also demonstrate that for preemptive task sets scheduled by global EDF – one of the most time-consuming problems to analyze with the SAG – our technique reduces the average analysis runtime by 157.3 times (e.g., for systems with 6 to 20 tasks, 60% utilization, and 4 cores).

2 System model and definitions

We focus on deriving response time bounds for a finite set of independent jobs \(\mathcal {J}\) with arbitrary release times on a homogeneous multicore platform with m cores. For example, \(\mathcal {J}\) may represent all jobs released by periodic or multiframe tasks within one or multiple hyperperiod(s) (the least common multiple of the task periods).
A job \(j \in \mathcal {J}\) is defined by its earliest release time rmin (j) (also known as arrival time in Audsley’s terminology [2]), latest release time rmax (j), absolute deadline d(j), best-case execution time (BCET) Cmin (j), worst-case execution time (WCET) Cmax (j), and priority p(j) which is assigned by the scheduling policy. We assume that all the job timing parameters are integer multiples of the processor clock.
We consider a system that employs a global work-conserving job-level fixed-priority (JLFP) scheduling policy, which includes policies such as earliest-deadline first (EDF) and fixed-priority (FP). For example, with EDF, the absolute deadline of a job is also its priority, i.e., p(j) = d(j). We assume that a lower numerical value for p(j) indicates a higher priority, with priority ties broken in an arbitrary but consistent manner. We assume the “ < ” operator implicitly follows this tie-breaking rule.
We assume the scheduling policy can either be preemptive or non-preemptive. If the scheduling policy is non-preemptive, then a job that starts executing will always run to completion, potentially generating blocking for higher-priority jobs. If, on the other hand, the scheduling policy is preemptive, then a lower-priority job may be preempted as soon as a higher-priority job is released.
For ease of notation, we define min {X} and max 0{X} for a set of positive integers X as follows: if X ≠ ∅, then max 0{X} = max {X} and min {X} = min {X} ; else if X = ∅, then max 0{X} = 0 and min {X} = ∞.

3 Schedule-abstraction graph

The SAG analysis constructs a reachability graph representing the system states reachable when considering all possible job dispatch orderings under a given JLFP policy [18, 25]. Each system state v explored during the construction of the SAG tracks the cores availability using m uncertainty intervals, each indicating the earliest and latest times by which x cores (where x ranges from one to m) become simultaneously free. This core availability representation leverages the symmetry of identical cores to reduce the state space. The system state also records information on completed and preempted jobs as follows (see [18, 25]):
Core availability intervals. These intervals A1(v), A2(v),..., Am(v) denote the times at which one, two,..., or m cores may become simultaneously free. The bounds of an interval \(A_x(v) = [A_x^{\min }(v), A_x^{\max }(v)]\) (1 ≤ xm) specifies the earliest time x cores are potentially available (\(A_x^{\min }(v)\)) and the earliest time x cores are certainly available at once (\(A_x^{\max }(v)\)).
Set of completed jobs. \(\mathcal {J}^{\mathit {Co}}(v)\) contains jobs completed before reaching state v. Thus, \(\mathcal {J}\setminus \mathcal {J}^{\mathit {Co}}(v)\) represents the set of jobs that have not yet been dispatched or have been preempted and therefore may appear in the scheduler ready queue in state v.
For preemptive scheduling policies, each state also includes:
Set of preempted jobs. \(\mathcal {J}^{\mathit {Pr}}(v)\) contains the set of jobs that have started but not yet completed their execution. In any state v, \(\mathcal {J}^{\mathit {Pr}}(v) \subseteq \mathcal {J}\setminus \mathcal {J}^{\mathit {Co}}(v)\).
Finish times of preempted jobs. The SAG assumes that a preemption may divide a job into virtual segments: one executed before the preemption and one after. For each preempted job \(j \in \mathcal {J}^{\mathit {Pr}}(v)\), it stores the finish time FT(j, v) of the latest executed segment1.
Remaining execution times of preempted jobs. The remaining execution time of each preempted job \(j \in \mathcal {J}^{\mathit {Pr}}(v)\) is stored in RM(j, v) = [RMmin (j, v), RMmax (j, v)], where RMmin (j, v) and RMmax (j, v) represent the best-case and worst-case remaining execution times of job j in state v, respectively.
Construction of the graph. SAG uses a breadth-first strategy to explore the state-space of possible scheduling decisions in each reachable system state. To do so, it expands each reachable state in a certain depth of the graph and then merges states where the future can be explored together. During expansion, it selects the state with the fewest completed jobs and identifies all potential jobs that may be the first job dispatched in that state, i.e., all jobs that may be at the head of the ready queue in that state. Each of these jobs labels an edge representing a scheduling decision that transitions the current state to a new one.
To decide which jobs may be dispatched next in a system state v, the SAG computes for each job j that has not yet completed its execution, the SAG computes bounds on the earliest start time (EST(j, v)) and the latest start time (LST(j, v)) of j in state v assuming j is the next job dispatched on a core by the scheduler. If EST(j, v) ≤ LST(j, v), then there exists an execution scenario where j is the first job dispatched for execution in system state v. Thus, j is added as the label of an edge evolving state v to a new state. If EST(j, v) > LST(j, v), then there is no scenario such that j may be the first job to start in state v.
The SAG calculates the bounds on EST(j, v) and LST(j, v) considering the work-conversing and JLFP properties of the underlying scheduling policy. Namely, it compares the time when the first core becomes free in sate v with the time at which j and any higher priority job than j becomes ready in system state v.

4 Motivation and challenges

Current shortcomings. Current state-space exploration of the SAG for multicore platforms [18, 25] assesses a job’s eligibility for dispatch in a system state v by considering the availability interval of a single core (i.e., A1), without factoring in the total number of available cores. This approach results in accounting for the dispatch of jobs one at a time, which in turn leads to generating far more states and edges in the SAG than necessary to capture interference scenarios as we show in the following example.
Consider the set of four jobs with release jitter given in Fig. 1 a. Assume they are scheduled with non-preemptive EDF on three cores. Fig. 1 b shows the SAG generated by the existing exploration strategy. Assume that all three cores are initially free at time 0. Since, due to their release jitters, j1, j2, and j3 can all be the first job released, they can all be the first job dispatched and the SAG generates one edge for each of them after the initial state v1. In total, it explores 7 states (v2 to v8) to account for all possible orderings of jobs dispatch decisions taken by the scheduling policy until reaching the state where the three jobs j1, j2, and j3 have started executing (v8). The current SAG analysis framework does not leverage the fact that all cores are available at time 0 and the three jobs j1, j2, and j3 can execute in parallel on those cores. In contrast, our new exploration strategy presented in the next section detects that the start time of j1, j2, and j3 are independent of each other as they certainly run on different cores. It uses that fact to bypass the exploration of states v2 to v7 and directly jump to state v8, thus generating a much smaller SAG as shown in Fig. 1 c.
Our approach fundamentally differs from previously proposed partial-order reduction techniques for single-core SAG analysis [28, 29, 30]. While those POR methods combine scheduling decisions (dispatching of jobs) as long as they do not result in a deadline miss, it does not identify non-interfering jobs as in the method we present in this paper. Instead, they focus on interfering jobs, fast-forwarding the timeline to a future state where all those jobs have been completed. Moreover, as discussed in Sec. 1, Ranjha’s technique is not applicable to multicore platforms because there is no method that is both fast and accurate to estimate the completion time of a set of interfering jobs under global scheduling. Our strategy avoids this issue by focusing on identifying and analyzing non-interfering jobs by leveraging the parallelism of multicore platforms.
Figure 1:
Figure 1: A comparison of state-space exploration strategies, (a) a non-preemptive job set to be scheduled by global EDF on three cores, (b) exploration strategy of [25], (c) our new exploration strategy.
Challenges. While Fig. 1 c illustrates the core concept of our state exploration strategy, it does not fully capture the complexities of identifying a set of independent jobs and creating a new state in the graph. Consider another example (Fig. 2) where the SAG is midway through analyzing a system with three cores, needing to identify the next batch of eligible jobs to dispatch. Fig. 2 a shows the set of jobs that have not yet been dispatched in state v4 (shown in Fig. 2 b).
The first challenge RQ1 is to determine the number of jobs that can be executed in parallel without interfering with one another. Due to timing uncertainties, the exact time each core becomes free is unknown, leaving the exact number of simultaneously available cores uncertain. Additionally, release jitter makes the exact number of pending jobs unpredictable too. For example in Fig. 2, at time 30, either 2 or 3 cores might become available, and any combination of jobs j1, j2, and j3 could be released, resulting in 8 possible scenarios.
The second challenge RQ2 is to determine which jobs can be dispatched together in a batch without causing interference with one another while avoiding the exhaustive exploration of all possible dispatch orders. For instance, job j4 cannot be batched with job j1 because jobs j2 and j3 might be released between the dispatches of j1 and j4, and therefore indirectly interfere with j4.
The final challenge RQ3 is to define the new system state after dispatching a batch of jobs. For example, after dispatching a batch containing jobs j1 and j2 in state v4, we must update the core availability intervals, adjust the remaining execution times of preempted jobs, and perform other state modifications for a batch of jobs.
The next section explains how we address these challenges.
Figure 2:
Figure 2: Challenges of identifying independent jobs, (a) a non-preemptive job set to be scheduled by global EDF on three cores, (b) a system state, (c) our approach for expanding v4.

5 New exploration strategy

Sec. 5.1 and Sec. 5.2 address RQ1 by calculating the maximum number of jobs (denoted by ψ(v)) that can start their execution in parallel in a system state v and therefore have independent start times.
Due to uncertainties in the release (or ready) times of jobs, multiple jobs might possibly be among the first ψ(v) independent jobs that start their execution after state v. Sec. 5.3 and Sec. 5.4 address RQ2, showing how to find sets of independent jobs. Each such set becomes the label of an edge outgoing the state v in the SAG (as shown in Fig. 2 c).
Finally, we address RQ3 in Sec. 5.5 by explaining how to create a new state v′ after a set of independent jobs were dispatched for execution in state v.

5.1 Ready times

To address the challenges introduced in the previous section and decide how many and which jobs may execute in parallel, we must compare the number of ready jobs with the number of free cores.
As in previous work [18], a job j is said to be ready only if it is released, it is not completed and, if previously preempted, its previous segment is completed. Following [18], a lower and upper bound on when job j may be ready are respectively given by Rmin (j, v) and Rmax (j, v) defined as follows:
\begin{align} R^{\min }(j,v) \triangleq \left\lbrace \begin{matrix} r^{\min }(j) & \text{if} j \notin \mathcal {J}^{\mathit {Pr}}(v)\\ \mathit {FT}(j,v) & \text{otherwise}, \end{matrix}\right.\end{align}
(1)
\begin{align} R^{\max }(j,v) \triangleq \left\lbrace \begin{matrix} r^{\max }(j) & \text{if} j \notin \mathcal {J}^{\mathit {Pr}}(v)\\ \mathit {FT}(j,v) & \text{otherwise,} \end{matrix}\right.\end{align}
(2)
where rmin (j) and rmax (j) are the earliest and latest release time of job j, and FT(j, v) is the finish time of j’s latest preempted segment.
Based on the above definition, we define bounds, denoted by \(\mathit {pot\_ready}(k,v)\) and \(\mathit {cert\_ready}(k,v)\), on when k jobs may possibly or certainly become ready in a system state v. These bounds will then be compared to the number of free cores in system state v to decide how many and which jobs may run in parallel without interfering with one another. We define \(\mathit {pot\_ready}(k,v)\) as follows:
\begin{align} \mathit {pot\_ready}&(k,v)\triangleq \min \limits _{\infty } \big \lbrace R^{\min }(j) | j \in \mathcal {J}\setminus \mathcal {J}^{\mathit {Co}}(v), \nonumber \\ \exists \widehat{\mathcal {J}} \subseteq \mathcal {J}\setminus \mathcal {J}^{\mathit {Co}}(v), &|\widehat{\mathcal {J}}| = k \wedge \forall j^{\prime } \in \widehat{\mathcal {J}}, R^{\min }(j^{\prime }) \le R^{\min }(j) \big \rbrace.\end{align}
(3)
Lemma 1
The earliest time at which k job(s) are potentially ready in system state v is \(\mathit {pot\_ready}(k,v)\).
Proof.
Proof by contradiction. Suppose there exists a time t such that \(t \lt \mathit {pot\_ready}(k, v)\) and t is the earliest time at which k jobs are potentially ready. By definition, the earliest time a job j can become ready is Rmin (j). Thus, the time at which the number of ready jobs changes is at the earliest ready time of a job. Consequently, if t were indeed the earliest time at which k jobs are potentially ready, it would imply that t is equal to the earliest ready time of a job among those k jobs. However, \(\mathit {pot\_ready}(k, v)\) is defined as the minimum time at which any subset of k jobs can be ready, considering all possible subsets of k jobs. Therefore, \(\mathit {pot\_ready}(k, v)\) is the minimum of the earliest ready times for all such subsets, making it impossible for t to be smaller than \(\mathit {pot\_ready}(k, v)\). This contradicts the assumption that \(t \lt \mathit {pot\_ready}(k, v)\). □
Lemma 2
The earliest time at which k job(s) are certainly ready in state v is
\begin{align} \mathit {cert\_ready}&(k,v)\triangleq \min \limits _{\infty } \big \lbrace R^{\max }(j) | j \in \mathcal {J}\setminus \mathcal {J}^{\mathit {Co}}(v), \nonumber \\ \exists \widehat{\mathcal {J}} \subseteq \mathcal {J}\setminus \mathcal {J}^{\mathit {Co}}(v), & |\widehat{\mathcal {J}}| = k \wedge \forall j^{\prime } \in \widehat{\mathcal {J}} , R^{\max }(j^{\prime }) \le R^{\max }(j) \big \rbrace\end{align}
(4)
Proof.
The proof is similar to Lemma 1 using certain ready time Rmax  instead of the potential ready time Rmin . □
In a state v, for any arbitrary value l and k, 1 ≤ l < km, it holds that \(\mathit {pot\_ready}(l,v) \le \mathit {pot\_ready}(k,v)\) and \(\mathit {cert\_ready}(l,v) \le \mathit {cert\_ready}(k,v)\). Moreover, we define \(\mathit {pot\_ready\_high}(j,v,k)\) to represent the earliest time at which k higher-priority jobs than j are potentially ready. \(\mathit {pot\_ready\_high}(j,v, k)\) is obtained similarly to Eq. (3) except that it requires all jobs in \(\widehat{\mathcal {J}}\) to be of higher priority than j:
\begin{align} \mathit {pot\_ready\_high}(j,v, &k) \triangleq \min \limits _{\infty }\big \lbrace R^{\min }(j^{\prime }) | j^{\prime } \in \mathcal {J}\setminus \mathcal {J}^{\mathit {Co}}(v), \nonumber \\ p(j^{\prime }) \lt p(j), &\exists \widehat{\mathcal {J}} \subseteq \mathcal {J}\setminus \mathcal {J}^{\mathit {Co}}(v), |\widehat{\mathcal {J}}| = k, \forall j^{\prime \prime } \in \widehat{\mathcal {J}}, \nonumber \\ & p(j^{\prime \prime }) \lt p(j) \wedge R^{\min }(j^{\prime \prime }) \le R^{\min }(j^{\prime }) \big \rbrace.\end{align}
(5)
Similarly, we also define \(\mathit {cert\_ready\_high}(j,v,k)\) to be the earliest time at which k higher-priority jobs than j are certainly ready:
\begin{align} \mathit {cert\_ready\_high}(j,v, &k) \triangleq \min \limits _{\infty }\big \lbrace R^{\max }(j^{\prime }) | j^{\prime } \in \mathcal {J}\setminus \mathcal {J}^{\mathit {Co}}(v), \nonumber \\ p(j^{\prime }) \lt p(j), &\exists \widehat{\mathcal {J}} \subseteq \mathcal {J}\setminus \mathcal {J}^{\mathit {Co}}(v), |\widehat{\mathcal {J}}| = k, \forall j^{\prime \prime } \in \widehat{\mathcal {J}}, \nonumber \\ & p(j^{\prime \prime }) \lt p(j) \wedge R^{\max }(j^{\prime \prime }) \le R^{\max }(j^{\prime }) \big \rbrace.\end{align}
(6)

5.2 Maximum number of independent jobs

As discussed in Sec. 4, we aim to find the maximum number of jobs for which we can guarantee that they can start executing independently (without interfering with one another). By “not interfering”, we mean that the start time of those jobs does not depend on the start time of the others, directly or indirectly. Note that for the remainder of the paper, we use the term start time equivalently for the jobs that start their execution for the first time as well as for jobs that resume their execution after being preempted.
To find the number of jobs that can start independently, we rely on two key properties:
Prop. 1
Clearly, at most m jobs may execute in parallel at any given time on a platform with m cores.
Prop. 2
If there are more jobs ready than available cores, then at least one job will suffer interference from the others.
Using those properties, we prove the following lemmas.
Lemma 3
If ∀i, 1 ≤ ikm, it holds that \(A^{\max }_{i}(v) \le \mathit {pot\_ready}(i,v)\), then the start time of the k first jobs dispatched in system state v are independent from one another.
Proof.
Consider the earliest time at which i jobs may be ready in system state v (i.e., at \(\mathit {pot\_ready}(i,v)\) by Lemma 1) and let j be the job that becomes ready at that time. If \(A^{\max }_{i}(v) \le \mathit {pot\_ready}(i,v)\) then there are at least i cores that are certainly available when job j becomes ready. Thus, it can start immediately. Therefore, if \(A^{\max }_{i}(v) \le \mathit {pot\_ready}(i,v)\) for 1 ≤ ik, then the k first jobs ready in state v start their execution as soon as they become ready and thus their start times are independent of one another. □
Based on Lemma 3, we can calculate the maximum number of jobs dispatched in v whose start times are certainly independent of one another by finding the maximum value of k (1 ≤ km) such that the condition of Lemma 3 is met. This gives us the maximum number of independent jobs for state v (denoted by ψ(v)):
\begin{align} \mathit {\psi }(v) = \underset {1\le k\le m}{\max }\big \lbrace k | k=1 \vee \forall i, 1\le i\le k, A^{\max }_{i}(v) \le \mathit {pot\_ready}(i,v) \big \rbrace\end{align}
(7)
Example 1
In Fig. 2, based on the availability intervals of state v4, one core is certainly available at time \(A_1^{\max } = 16\), two at time \(A_2^{\max } = 26\), and three at time \(A_3^{\max } = 32\). The earliest time one, two, three, or four jobs can be ready are \(\mathit {pot\_ready}(1, v_4) = 20\) (due to job j1), \(\mathit {pot\_ready}(2, v_4) = 30\) and \(\mathit {pot\_ready}(3, v_4) = 30\) (resulting from j2 and j3), and \(\mathit {pot\_ready}(4, v_4) = 40\). Using Lemma 3, the largest k for which \(\forall i, i\le k, A_i^{\max }(v_4) \le \mathit {pot\_ready}(i, v_4)\) is k = 2. It means that the first two jobs that become ready in this state can start their execution independently (regardless of which jobs they are). For example, if j1 and j2 become ready at times 25 and 30, respectively, they start their execution on a core and would not interfere with each other. Similarly, if j2 and j3 are ready at time 30 but j1 is ready later (due to its release jitter), then these two jobs can start their execution independently on different cores. Later in Sec. 5.3.2 and Sec. 5.5, we will see how to find the latest start time of each job in such a set and how to create the new system state.

5.3 Job eligibility for independent execution

In the previous section, we proved that the first ψ(v) jobs to become ready in system state v will also be the first ψ(v) jobs to be dispatched, and that their start times are independent of one another (hence, answering RQ1). In this section, we focus on RQ2 and identify which jobs may be among these first ψ(v) dispatched jobs. To do so, in Sec. 5.3.1 and Sec. 5.3.2, we derive a lower and an upper bound, denoted by EST(j, v) and LST(j, v), respectively, on the start time of every non-completed job j assuming it is among the ψ(v) first jobs dispatched by the scheduler in system state v. If the time interval [EST(j, v), LST(j, v)] is non-empty, job j may potentially be among the ψ(v) first jobs dispatched. Otherwise, it is certainly not among those jobs.

5.3.1 Earliest start time (EST).

A scheduling policy will dispatch a job j for execution only if (i) it is ready and (ii) a core is available. As discussed in Sec. 5.1, the earliest time that job j in state v can be possibly ready is Rmin (j, v), and the earliest time a core becomes available is \(A_1^{\min }(v)\) (recall Sec. 3). Thus, similar to [18, 25], we obtain the earliest time a job j may start executing in state v as
\begin{align} \mathit {EST}(j,v) = \max \big \lbrace R^{\min }(j,v), A_1^{\min }(v) \big \rbrace.\end{align}
(8)

5.3.2 Latest start time (LST).

Let \(\mathcal {J}^{B}\) be a set containing the first ψ(v) jobs dispatched after system state v, and let LST(j, v) be the latest time that job j may start executing assuming \(j \in \mathcal {J}^{B}\), i.e., assuming it is among the first ψ(v) jobs dispatched in system state v. We derive three upper bounds on LST(j, v).
The first upper bound, denoted by twc(v), on the LST(j, v) is derived from the work-conserving property of the scheduler, which dispatches a job as soon as there is a ready job and there is a free core. Thus, the ψ(v) first jobs dispatched by a work-conserving scheduler will start no later than when ψ(v) jobs are certainly ready and ψ(v) cores are certainly free, namely,
\begin{align} t_{wc}(v)= \max \big \lbrace A^{\max }_{\mathit {\psi }(v)}(v) , \mathit {cert\_ready}(\mathit {\psi }(v),v) \big \rbrace.\end{align}
(9)
Lemma 4
Under a work-conserving scheduler, a job \(j \in \mathcal {J}^{B}\) starts executing no later than twc(v).
Proof.
The proof is by contradiction. Assume \(j \in \mathcal {J}^{B}\) and j starts executing after twc(v). Then by definition of twc(v) (i.e., Eq. (9)), at least ψ(v) jobs are certainly ready and ψ(v) cores are certainly free before j starts executing. Since a work-conserving scheduler always executes ready jobs as soon as there are free cores, the scheduler will start executing at least ψ(v) jobs before j starts. Thus, j is not in the first ψ(v) jobs that start executing after state v, i.e., it is not in \(\mathcal {J}^{B}\), which contradicts our initial assumption. □
We derive the second upper bound on LST(j, v) also from the work-conserving property of the scheduler, as stated in Lemma 5.
Lemma 5
Under a work-conserving scheduler, a job \(j \in \mathcal {J}^{B}\) starts executing no later than \(\max \lbrace R^{\max }(j,v), A_1^{\max }(v)\rbrace\).
Proof.
We analyze two different cases: j is the first job dispatched after system state v (Case 1) or j is the ith job dispatched after system state v (with 1 < iψ(v)) (Case 2).
Case 1. If j is the first job dispatched, then, by the work-conserving property, it will be dispatched as soon as it is ready and a core is free. Since j’s ready time is upper bounded by Rmax (j, v) and the first core availability time is upper bounded by \(A_1^{\max }(v)\), we have that \(\mathit {LST}(j,v) \le \max \lbrace R^{\max }(j,v), A_1^{\max }(v)\rbrace\).
Case 2. If j is the ith job dispatched (with 1 < iψ(v)), then, by the definition of ψ(v) given by Eq. (7), we have that for all i such that 1 < iψ(v), \(A^{\max }_{i}(v) \le \mathit {pot\_ready}(i,v)\), i.e., the time at which i cores certainly become free is no later than when i jobs become ready. Therefore, i cores are certainly available when j becomes ready and a work-conserving scheduler will certainly dispatch j for execution. Thus, j’s latest start time is upper bounded by j’s latest ready time, i.e., \(\mathit {LST}(j,v) = R^{\max }(j,v) \le \max \lbrace R^{\max }(j,v), A_1^{\max }(v)\rbrace\). □
The third upper bound on LST(j, v) is derived from the JLFP property of the scheduling policy, namely, a job j is among the first ψ(v) jobs that start their execution after state v only if less than ψ(v) jobs of higher priority than j certainly became ready before or at the same time that j becomes ready. We obtain thigh(j, v) as the earliest time at which ψ(v) higher-priority jobs are certainly ready in state v, i.e.,
\begin{align} t_{high}(j,v)\triangleq \mathit {cert\_ready\_high}(j,v,\mathit {\psi }(v)).\end{align}
(10)
Lemma 6
Under a JLFP scheduler, a job \(j \in \mathcal {J}^{B}\) starts executing no later than thigh(j, v) − 1.
Proof.
The proof is by contradiction. Assume \(j \in \mathcal {J}^{B}\) and j starts executing at or after thigh(j, v). Then by the definition of thigh(j, v) (Eq. (10)), at least ψ(v) jobs of higher priority than j are certainly ready before or when j starts executing. Since a JLFP scheduler always executes the highest priority ready jobs first, it will certainly start executing at least ψ(v) jobs of higher priority than j before j starts. Thus, j is not in the first ψ(v) jobs that start executing after state v, i.e., it is not in \(\mathcal {J}^{B}\), which contradicts our initial assumption. □
Combining Lemmas 4, 5 and 6, we have the following upper bound on the latest start time of a job \(j \in \mathcal {J}^{B}\):
\begin{align} \mathit {LST}&(j,v) = \nonumber \\ &\min \big \lbrace \max \big \lbrace R^{\max }(j,v), A_1^{\max }\big \rbrace , t_{wc}(v), t_{high}(j,v)-1\big \rbrace.\end{align}
(11)
Lemma 7
Under a work-conserving JLFP scheduling policy, a job \(j \in \mathcal {J}^{B}\) will not start executing later than LST(j, v).
Proof.
By Lemmas 4, 5 and 6, \(\max \lbrace R^{\max }(j,v), A_1^{\max }\rbrace\), twc(v), and thigh(j, v) − 1 are all upper bounds on j’s latest start time. Hence, their minimum is also an upper bound on j’s latest start time. □
Example 2
Fig. 2 d shows how the EST and LST of j2 and j3 are calculated. Recall from Example 1 that the maximum number of independent jobs for state v4 is ψ(v4) = 2. According to Eq. (9), \(t_{wc}(v_4) = \max \lbrace A^{\max }_2(v_4), \mathit {cert\_ready}(2, v_4)\rbrace =\max \lbrace 26, 40\rbrace =40\), i.e., the time when two cores are certainly available and two jobs are certainly ready. According to Eq. (10), thigh(j3, v4) is the time when two higher-priority jobs than j3 are certainly ready. For job j3, the higher-priority jobs are j1 and j2. These two jobs will be certainly ready by time 40 = max {35, 40}. It is worth noting that in the original SAG, both twc(v4) and thigh(j3, v4) would be 35.

5.3.3 Eligibility condition.

Now that we have bounds on the start times of the ψ(v) first jobs dispatched after state v, we use those bounds to determine which jobs that are not completed yet may be among those ψ(v) first jobs dispatched (i.e., they are in \(\mathcal {J}^{B}\)).
Lemma 8
Job j may be in \(\mathcal {J}^{B}\) only if EST(j, v) ≤ LST(j, v).
Proof.
Since EST(j, v) is a lower bound on j’s start time after state v, and since LST(j, v) is an upper bound on the start time of j after state v assuming it is in \(\mathcal {J}^{B}\) (by Lemma 7), then if EST(j, v) > LST(j, v) the lower bound is larger than the upper bound leading to a contradiction that those are indeed lower and upper bounds on the EST and LST of the jobs. Therefore, our assumption when calculating those bounds must be false. That is, if EST(j, v) > LST(j, v), then j is not in \(\mathcal {J}^{B}\). Taking the contra-positive of this property proves the lemma. □

5.4 Possible sets of independent jobs

We proved in Sec. 5.2 that the first ψ(v) jobs that start executing after state v (i.e., the jobs in \(\mathcal {J}^{B}\)) execute independently from one another. We then proved that any job j that passes the eligibility condition in Lemma 8 may be in \(\mathcal {J}^{B}\). However, passing the eligibility condition does not ensure that job j will certainly be in \(\mathcal {J}^{B}\). In fact, there may be more eligible jobs than ψ(v) (i.e., the size of \(\mathcal {J}^{B}\)), in which case there may be execution scenarios where \(j \in \mathcal {J}^{B}\) and other execution scenarios where \(j \not\in \mathcal {J}^{B}\).
Example 3
In the example in Fig. 2, three jobs—j1, j2, and j3—are eligible in state v4. However, since the maximum number of independent jobs is two, only the two first jobs that become ready can execute on different cores independently. The uncertainty in the release times of the eligible jobs creates three possible sets, each containing two jobs: {j1, j2}, {j1, j3}, and {j2, j3}. For example, if j1 is released at time 35 but j2 and j3 are released at time 30, then these two jobs start their execution independently on the two available cores before j1 is released. Note that the cores do not need to become available at the same time.
Let \(\mathcal {E}(v)\) be the set of all jobs eligible to be in \(\mathcal {J}^{B}\) in a state v, i.e., \(\mathcal {E}(v) \triangleq \lbrace j | j \in \mathcal {J}\setminus \mathcal {J}^{\mathit {Co}}(v), \mathit {EST}(j, v) \le \mathit {LST}(j, v)\rbrace\). We say that a set \(\mathcal {J}^{B}\subseteq \mathcal {E}(v)\) is valid if there may be an execution scenario such that the ψ(v) jobs in \(\mathcal {J}^{B}\) are the first ψ(v) jobs dispatched after system state v. In Lemmas 9 and 10, we prove that every set \(\mathcal {J}^{B}\) made of ψ(v) jobs in \(\mathcal {E}(v)\) such that no job outside \(\mathcal {J}^{B}\) certainly starts before any job in \(\mathcal {J}^{B}\), is potentially valid.
Lemma 9
A set \(\mathcal {J}^{B}\) is valid only if \(|\mathcal {J}^{B}| = \mathit {\psi }(v)\) and \(\mathcal {J}^{B}\subseteq \mathcal {E}(v)\).
Proof.
By definition of the set \(\mathcal {J}^{B}\), its size must be ψ(v). Furthermore, by Lemma 8, only jobs that meet the condition EST(j, v) ≤ LST(j, v) (i.e., jobs in \(\mathcal {E}(v)\)) may be in \(\mathcal {J}^{B}\). Thus, a valid set \(\mathcal {J}^{B}\) must only contain jobs in \(\mathcal {E}(v)\). □
Lemma 10
If ψ(v) > 1, the set \(\mathcal {J}^{B}\) is valid only if
\begin{align} \nexists j \in \mathcal {E}(v) \setminus \mathcal {J}^{B} \big | \exists j^{\prime }\in \mathcal {J}^{B}, R^{\max }(j,v) \lt \mathit {EST}(j^{\prime }, v).\end{align}
(12)
Proof.
The proof is by contradiction. Assume the condition is not met and there is a job \(j^{\prime } \in \mathcal {J}^{B}\) and an eligible job \(j \in \mathcal {E}(v) \wedge j \notin \mathcal {J}^{B}\) such that Rmax (j, v) < EST(j′, v). Since j′ is one of the first ψ(v) jobs starting to execute after system state v (i.e., \(j^{\prime }\in \mathcal {J}^{B}\)), and because EST(j′, v) is a lower bound on the start time of j′, there must be fewer than ψ(v) jobs that started executing after state v at any time t < EST(j′, v). Since we assume that Rmax (j, v) < EST(j′, v), less than ψ(v) jobs must have started executing when the job j becomes certainly ready. Moreover, by the definition of ψ(v) (Eq. (7) and Lemma 3) we know that, if ψ(v) > 1, the first ψ(v) jobs that become ready in state v can start to execute as soon as they become ready (because \(\forall i, 1\le i\le \mathit {\psi }(v), A^{\max }_{i}(v) \le \mathit {pot\_ready}(i,v)\)). Since we already established that j becomes ready before ψ(v) jobs have started, we have that j starts executing at Rmax (j, v), i.e., it starts executing before j′. This leads to a contradiction with our initial assumption that job j′ is among the first ψ(v) that start executing in state v (i.e., \(j^{\prime } \in \mathcal {J}^{B}\)) but job j is not (i.e., \(j \not\in \mathcal {J}^{B}\)). □
As shown in Algorithm 1 (lines 10 –11), for every valid set \(\mathcal {J}^{B}\), i.e., every combination of ψ jobs that meet the conditions of Lemmas 9 and 10, we create an edge in the SAG that is outgoing from system state v and is labeled with the set of job in \(\mathcal {J}^{B}\). That edge is connected to a new system state v′ resulting from the execution of all jobs in \(\mathcal {J}^{B}\) after state v. Fig. 2 c shows an example of how these potential \(\mathcal {J}^{B}\)s may result in multiple outgoing edges of a state v (where \(\mathcal {E}(v_4) = \lbrace j_1, j_2, j_3\rbrace\) and ψ(v) = 2).

5.5 Deriving a new system state

In this section, we address RQ3, i.e., we explain how a new state can be created after a set \(\mathcal {J}^{B}\) of jobs start their execution in state v. Algorithm 2 provides details of this process. First, the set of completed and preempted jobs are copied to the new state v′ (lines 1-2). Then, it obtains the finishing time intervals of every job in \(\mathcal {J}^{B}\) (line 4). Next, it obtains the remaining execution time of possibly preempted jobs (line 5). Note that if the scheduling policy is non-preemptive, then the remaining execution time will always be 0 if a job starts executing. Next, it updates the set of preempted jobs (lines 7-8). Finally, it calculates the new core availability intervals (lines 12-16).
The remainder of this section provides details of the above steps.

5.5.1 Earliest and latest finish times.

Calculating the earliest and latest completion times for a job (or a job segment, if it can be preempted) after starting the execution of jobs in \(\mathcal {J}^{B}\) in state v depends on whether the scheduling policy is preemptive or not.
If the scheduling policy is preemptive, then, following the approach in [18], we divide the execution of every job j in segments whose executions are bounded by potentially “impactful preemption points”. An impactful preemption point is defined as a time instant at which the preemption of j by a higher priority job may impact the best- or worst-case response time of any job in the system (those points are called time partition boundaries in [18]). It was proven in [18] that only preemptions at the earliest or latest release time of higher priority jobs than j are potentially impactful. We thus compute the earliest and latest finish time of the next segment of a job \(j \in \mathcal {J}^{B}\) as the time until j completes its execution or we reach the next potentially impactful preemption point. Using the same equations as in [18], it is calculated as follows:
\begin{align} &\mathit {EFT}(j,v) =\left\lbrace \begin{matrix} \widehat{\mathit {EFT}}(j,v) & \widehat{\mathit {EFT}}(j,v) \le t_{pr}(j,v),\\ t_{pr}(j,v) & \text{otherwise} \end{matrix}\right.\end{align}
(13)
\begin{align} &\mathit {LFT}(j,v) =\left\lbrace \begin{matrix} \widehat{\mathit {LFT}}(j,v) & \widehat{\mathit {LFT}}(j,v) \le t_{pr}(j,v),\\ t_{pr}(j,v) & \text{otherwise} \end{matrix}\right.\end{align}
(14)
where tpr(j, v) is the next potentially impactful preemption point (see below for its calculation), and \(\widehat{\mathit {EFT}}(j,v)\) and \(\widehat{\mathit {LFT}}(j,v)\) are the earliest and latest finish times assuming j is not preempted and thus runs to completion. Those bounds are calculated using the earliest and latest start time of j added to the BCET and WCET if j was not preempted until reaching state v (i.e., \(j \notin \mathcal {J}^{\mathit {Pr}}(v)\)) or best- and worst-case remaining execution time otherwise. That is,
\begin{align} &\widehat{\mathit {EFT}}(j,v) =\left\lbrace \begin{matrix} \mathit {EST}(j,v)+C^{\min }(j) & j \notin \mathcal {J}^{\mathit {Pr}}(v), \\ \mathit {EST}(j,v) + \mathit {RM}^{\min }(j,v) & \text{otherwise} \end{matrix}\right.\end{align}
(15)
\begin{align} &\widehat{\mathit {LFT}}(j,v) =\left\lbrace \begin{matrix} \mathit {LST}(j,v)+C^{\max }(j) & j \notin \mathcal {J}^{\mathit {Pr}}(v), \\ \mathit {LST}(j,v) + \mathit {RM}^{\max }(j,v) & \text{otherwise} \end{matrix}\right.\end{align}
(16)
For a non-preemptive scheduling policy, jobs run to completion after they start executing. Thus, in that case, the next potential impactful preemption point tpr(j, v) for any job j can be set to + ∞.
For a preemptive scheduling policy, it was proven in [18] that potentially impactful preemption points are in the set \(\mathcal {P}(j,v)\) defined as the set of all earliest and latest release times of jobs with higher priority than j that are potentially released after the earliest start time of j (meaning they are not running, completed or preempted when j starts). Formally,
\begin{align} \mathcal {P}(j,v) \triangleq \Big \lbrace \forall t | t\gt \mathit {EST}(j,v) \wedge \exists j^{\prime } &\in \mathcal {J}\setminus \mathcal {J}^{\mathit {Co}}(v) \setminus \mathcal {J}^{\mathit {Pr}}(v),\nonumber \\ p(j^{\prime })\lt p(j) \wedge \big (t=r^{\min }(j^{\prime }) &\vee t = r^{\max }(j^{\prime })\big)\Big \rbrace.\end{align}
(17)
In [18], the earliest potential impactful preemption point was then calculated as the minimum time t in the set \(\mathcal {P}(j,v)\). In this work, we improve that bound by observing that a job j may only be preempted at a time t if the number of higher-priority jobs potentially ready at t is no less than the number of cores at t. Thus, we define tpr(j, v) as follows.
If the scheduler is non-preemptive, then tpr(j, v)≜ + ∞.
If the scheduler is preemptive:
\begin{align} t_{pr}(j,v) \triangleq \min _{\infty } \big \lbrace t\in \mathcal {P}(j,v) | & \mathit {n\_high\_ready}(j,v,t) \nonumber \\ & \ge \mathit {min\_free\_cores}(v,t) \big \rbrace.\end{align}
(18)
where \(\mathit {n\_high\_ready}(j,v,t)\) is the maximum number of jobs with higher priority than j that are ready at time t, i.e., \(\max \lbrace k | k\ge 0 \wedge \mathit {pot\_ready\_high}(j,v,k) \le t\rbrace\), and \(\mathit {min\_free\_cores}(v,t)\) is the minimum number of cores that are free at time t in system state v, i.e., \(\max _{0}\lbrace k | k\gt 0 \wedge A_k^{\max }(v) \le t\rbrace\).
Lemma 11
There is no potentially impactful preemption point for job j at any time earlier than tpr(j, v).
Proof.
The claim is straightforward if the scheduling policy is non-preemptive. Thus, we focus on preemptive policies.
First, it was proven in [18] that the only time instants at which a potentially impactful preemption may happen are those in the set \(\mathcal {P}(j,v)\). Thus, \(t_{pr}(j,v) \in \mathcal {P}(j,v)\) or if there is no impactful preemption point in \(\mathcal {P}(j,v)\), then tpr(j, v) = +∞.
Second, by the preemptive JLFP property, a job j may only be preempted at time t if the number of jobs with higher priority than j is no less than the number of cores. Thus, a time instant \(t\in \mathcal {P}(v)\) is a potential preemption point only if the maximum number of higher priority jobs ready at t plus the maximum number of cores busy executing higher priority jobs than j at t is larger than or equal to the total number of cores m. The maximum number of higher priority jobs ready at t is upper bounded by \(\mathit {n\_high\_ready}(j,v,t)\). The maximum number of cores busy executing higher priority jobs than j at t is upper bounded by the maximum number of busy cores at t which is upper bounded by \(m - \mathit {min\_free\_cores}(v,t)\). Therefore, an instant \(t \in \mathcal {P}(v)\) is a potential preemption point only if \(\mathit {n\_high\_ready}(j,v,t) + (m-\mathit {min\_free\_cores}(v,t)) \ge m\)\(\mathit {n\_high\_ready}(j,v,t) \ge \mathit {min\_free\_cores}(v,t)\).
Thus, the first potential impactful preemption point for job j is the first instant \(t \in \mathcal {P}(v)\) such that \(\mathit {n\_high\_ready}(j,v,t) \ge \mathit {min\_free\_cores}(v,t)\). This proves the claim. □

5.5.2 Remaining execution times.

Same as in [18], the remaining execution time of a job in the new system state v′ is calculated by subtracting the finishing times of j’s next execution segment (i.e., EFT(j, v) and LFT(j, v)) from the finish time of j when it does not suffer any preemption (i.e., \(\widehat{\mathit {EFT}}(j,v)\) and \(\widehat{\mathit {LFT}}(j,v)\)):
\begin{align} \mathit {RM}^{\min }(j,v^{\prime }) = \widehat{\mathit {EFT}}(j,v) - \mathit {EFT}(j,v),\end{align}
(19)
\begin{align} \mathit {RM}^{\max }(j,v^{\prime }) = \widehat{\mathit {LFT}}(j,v) - \mathit {LFT}(j,v).\end{align}
(20)
Note that if j does not suffer any preemption when dispatched in state v, either because the scheduling policy is non-preemptive or because tpr(j, v) is larger than \(\widehat{\mathit {LFT}}(j,v)\), then the actual and preemption-free finish times are equal and the remaining execution time is 0 in the new system state v′.

5.5.3 New cores availability intervals.

Finally, when creating a new system state v′, we must update the core availability intervals. The update is based on the two following properties.
Property 1
Since the jobs in \(\mathcal {J}^{B}\) are the first ψ(v) jobs that start executing after state v, they must execute on the first ψ(v) cores that become available.
Property 2
Since the jobs in \(\mathcal {J}^{B}\) are the first ψ(v) jobs to execute after state v, no job in the resulting state v′ can start earlier than the earliest time at which all jobs in \(\mathcal {J}^{B}\) started.
By Property 1, the earliest and latest finish time of each job in \(\mathcal {J}^{B}\) also marks the earliest and latest time when the first ψ(v) cores in v become available again in v′.
By Property 2, the largest earliest start time of the jobs in \(\mathcal {J}^{B}\) (i.e., \(\max \lbrace \mathit {EST}(j,v) | j \in \mathcal {J}^{B}\rbrace\)) is a lower bound on the availability of any core to execute new jobs in state v′.
Lines 12-16 in Algorithm 2 calculate the new cores availability intervals according to the above properties using two auxiliary vectors PA and CA that track the lower and upper bounds on when cores could possibly and certainly become available in the new state v′.

5.6 State merging

To reduce the number of states in the graph, we apply a merge rule that combines states with similar futures, allowing for more efficient exploration of their subsequent paths.
Rule 1
(Merge rule from [18]) Two states v and v′ can be merged if \(\mathcal {J}^{\mathit {Co}}(v) = \mathcal {J}^{\mathit {Co}}(v^{\prime })\), and \(\mathcal {J}^{\mathit {Pr}}(v) = \mathcal {J}^{\mathit {Pr}}(v^{\prime })\), and \(\forall j \in \mathcal {J}^{\mathit {Pr}}(v),\mathit {FT}(j,v) = \mathit {FT}(j,v^{\prime })\), and \(\forall x, 1\le x \le m, A_x(v) \cap A_x(v^{\prime }) \ne \varnothing\).
When two states, v and v′, are merged into v′′, the availability interval A(v′′) is constructed to encompass all core-availability scenarios that were possible in either v or v′. Thus,
\begin{equation}A_x(v^{\prime \prime }) = \big [ \min \big \lbrace A_x^{\min }(v), A_x^{\min }(v^{\prime }) \big \rbrace , \max \big \lbrace A_x^{\max }(v), A_x^{\max }(v^{\prime }) \big \rbrace \big ]. \end{equation}
(21)
Eq. (21) ensures that x cores become possibly available in the merged state v′′ only when x cores become potentially available in either of the states v or v′, and x cores are certainly available in v′′ only when x cores are certainly available in both v and v′.
Moreover, the potential remaining execution time of each job j in v′′ is obtained in such a way that it includes the potential remaining execution time of the jobs derived previously for all execution scenarios that lead to either v or v′, and thus to the merged state v′′. Namely, any potential remaining execution time of the job j in state v or state v′ is a potential remaining execution time for the job in state v′′:
\begin{align} \mathit {RM}(j,v^{\prime \prime })=\big [ \min \big \lbrace &\mathit {RM}^{\min }(j,v), \mathit {RM}^{\min }(j,v^{\prime }) \big \rbrace , \nonumber \\ &\max \big \lbrace \mathit {RM}^{\max }(j,v), \mathit {RM}^{\max }(j,v^{\prime }) \big \rbrace \big ].\end{align}
(22)

6 Empirical Evaluation

Figure 3:
Figure 3: (a-d) Experiment1: impact of utilization, (e-h) Experiment2: impact of the number of tasks, (i-l) Experiment3: impact of the number of cores.
We conducted experiments to examine the impact of system utilization (U), the number of tasks (n), the number of cores (m), and release jitter on the effectiveness of our exploration method.
Baseline. We compare our new exploration method for both non-preemptive and preemptive task sets scheduled by global EDF against the traditional SAG exploration methods, i.e., SAG-NP [25] for non-preemptive (code version 2.3.02), and SAG-Pr [18] for preemptive task sets (code version 1.1.03).
Evaluation platform. All methods were executed as a single-threaded C++ program on a computing cluster powered by AMD Rome 7H12 processors clocked at 2.6GHz with 1TB of memory. The runtime of each analysis was reported by measuring its CPU time.
Task set generation. We generated synthetic periodic task sets, where the period Ti of a task in the task set was randomly chosen from the interval 10, 000μs to 100, 000μs with a log-uniform distribution (following Emberson’s method [13]). We then used RandFixedSum [13] to generate random utilizations Ui for each task that sums to the target system utilization for each task set. The WCET of a task is then given by Ui × Ti. For each task, we assumed a release jitter of 20μs, a BCET to be 80% of the WCET, and a deadline equal to the period. We discarded task sets with more than 100,000 jobs per hyperperiod (note that industrial task sets usually have only a few thousand jobs in their hyperperiod [21]).
Each experiment considers 200 randomly generated task sets per data point. Each analysis method is allocated a maximum time budget of 8 hours to complete the analysis.
Experiment1 (impact of utilization). We consider a system with 4 cores, 6 tasks per task set, and vary the total utilization U from \(30\%\) to \(90\%\). As shown in Fig. 3 a, in both preemptive and non-preemptive analyses, we observe a decrease in the schedulability ratio as utilization increases. For the non-preemptive analysis, our new state-space exploration detects the same number of schedulable task sets as SAG-NP. However, for the preemptive analysis, our method shows slightly different schedulability over SAG-Pr. For instance, at \(U=50\%\), our approach detects 97% of task sets as schedulable, compared to 99.5% with SAG-Pr, and at \(U=80\%\), our method shows a slight improvement and detects 36% of task sets as schedulable, compared to 23.5% with SAG-Pr.
We attribute these differences to fewer system states generated by our new exploration method. Consequently, in some cases it causes fewer states to merge, which is an important cause of pessimism in the analysis.
The reduction in number of states is confirmed in Fig. 3 c, which shows the average number of system states generated by each analysis. Our exploration method on average reduces the number of states by 46% compared to SAG-NP, and by 81% compared to SAG-Pr, across all data points.
Fig. 3 b shows that the average runtime of both our new and the original SAG exploration methods is less than a few seconds for both preemptive and non-preemptive systems. However, our new method consistently demonstrates faster performance compared to the original SAG.
Fig. 3 d depicts the runtime for each task set as a function of the number of jobs in their hyperperiod. As shown, generally, preemptive task sets are slower than non-preemptive task sets, and by increasing the number of jobs in the hyperperiod the runtime increases.
Experiment2 (impact of the number of tasks). We consider a system with 4 cores, total utilization of 60%, and vary the number of tasks n from 6 to 20. As shown in Fig. 3 e, the schedulability of non-preemptive tasks generally increases as the number of tasks grows due to a reduction in each task’s utilization and therefore execution time (which leads to shorter blocking time/interference for other tasks). Our method identifies 33.62% of non-preemptive task sets as schedulable, compared to 33.68% identified by SAG-NP. More precisely, out of 1,600 task sets, our new exploration method missed just one of the schedulable sets identified by SAG-NP.
For preemptive task sets, there is no schedulability difference between our exploration method and SAG-Pr  for task sets with 8 to 14 tasks. However, as the number of tasks increases, SAG-Pr  often sees a timeout before reaching a conclusion, whereas our method completes the analysis within the 8-hour limit (taking less than 18 seconds on average). Overall, our analysis identifies 96.75% schedulable task sets, compared to 93.81% identified by SAG-Pr.
These observations confirm that our new exploration method tends to identify more schedulable task sets than the original analysis with very rare cases of missing schedulable task sets (in 5 cases out of 3200 tested sets in this experiment for both preemptive and non-preemptive tasks).
Figure 4:
Figure 4: (a-c) Experiment4: impact of release jitter.
Fig. 3 f demonstrates the average runtime of the analyses as a function of the number of tasks for preemptive and non-preemptive task sets. It can be seen that the runtime increases as the number of tasks grows, but our technique nearly consistently has a smaller runtime than the original SAG. This difference is noticeable for both preemptive and non-preemptive task sets, where our technique cuts the average runtime of preemptive analysis by 157 times compared to SAG-Pr, reducing it from 2826.32 seconds (≈ 47 minutes) to 17.96 seconds. Moreover, for non-preemptive task sets, our method reduced the runtime by 145 times compared to SAG-NP, reducing it from 529.44 seconds (≈ 8 minutes) to 3.65 seconds.
The runtime reduction is mainly due to the reduced number of system states explored by our method, particularly for large preemptive task sets (with many tasks or many jobs), which are hardest to analyze for the current SAG analysis. Fig. 3 g shows the average number of system states generated by each analysis. Our exploration method on average reduces the number of states by 7% compared to SAG-NP, and by 10% compared to SAG-Pr, across all data points. Furthermore, Fig. 3 h shows the average number of edges in the explored graph for each analysis. As shown in Fig. 3 h, the average number of edges—an important indicator of the total number of generated states, both merged and unmerged—is consistently smaller than in the original SAG.
Experiment3 (impact of the number of cores). We varied the number of cores (m) for systems with \(U=60\%\) and n = 1.5 × m tasks. As shown in Fig. 3 i, for non-preemptive task sets, the schedulability generally decreases for both our solution and SAG-NP  as the number of cores increases. In contrast, for preemptive task sets, the schedulability of our method remains unaffected by the increase in cores, while SAG-Pr  experiences a decline due to reaching the timeout limit. Our analysis, however, was completed successfully within the 8-hour timeout. Overall, in this experiment, both methods detect 21.25% of the task sets schedulable for non-preemptive systems. For preemptive systems, however, our method detects 97.5% of task sets schedulable, while SAG-Pr  detects 81.5%.
Fig. 3 j shows that the average runtime increases as the number of cores rises. However, for preemptive systems, SAG-Pr  experiences a much steeper increase in runtime compared to our method. For instance, with 6 cores, our analysis takes an average of 1 second, while SAG-Pr  requires 354 seconds (≈ 6 minutes) to complete. When the number of cores is increased to 10, our analysis takes 280 seconds (≈ 5 minutes), whereas SAG-Pr  requires 12,052 seconds (≈ 200 minutes).
As in the previous experiment, the reduction in runtime is directly related to the number of states and edges, as shown in Fig. 3 k and Fig 3 l. Overall across all data points, for non-preemptive systems, our method generates 66% fewer states than SAG-NP, while for preemptive systems, it produces 7% more states compared to SAG-Pr  because of the less merging and exploring more states before reaching a timeout. On the other hand, overall, our method on average across all data points has 37% fewer edges compared to SAG-NP  for non-preemptive systems and 7% fewer edges compared to SAG-Pr  for preemptive systems. It is worth mentioning that our method generates more states and edges with 12 cores compared to SAG-Pr  because, in 60% of task sets, SAG-Pr  times out before fully exploring all states and providing conclusive results.
Experiment4 (impact of release jitter). We consider a system with 4 cores, 6 tasks per task set, 60% utilization, and vary the release jitter for tasks.
Fig. 4 a shows that schedulability decreases as the release jitter increases. In this experiment, for non-preemptive systems, our method detects 16.875% of the task sets as schedulable, which is the same as SAG-NP. For preemptive systems, our method identifies 76.625% of the task sets as schedulable, compared to 80% detected by SAG-Pr.
As shown in Fig. 4 b, the runtime generally remains constant as the release jitter increases. However, our method consistently outperforms the original SAG in both non-preemptive and preemptive systems. Specifically, for non-preemptive systems, our method completes in 0.002 seconds, while SAG-NP  takes 0.06 seconds. For preemptive systems, our method finishes in 0.06 seconds, whereas SAG-Pr  requires 11.06 seconds. Fig. 4 c shows the average number of states generated by each method. Similar to the trend in previous experiments, our method generates fewer states compared to the original SAG across all data points.

7 Conclusion and future work

This paper presents a new state-space exploration strategy to reduce the size of the schedule-abstraction graph (SAG), a highly accurate reachability-based response-time analysis framework for preemptive and non-preemptive global JLFP scheduling policies. Thus far, the SAG analysis explored only one scheduling decision at a time and did not leverage the inherent parallelism of multicore platforms. In this paper, we demonstrate how to exploit this parallelism to reduce the size of the graph by identifying jobs that can start their execution independently, without interfering with each other, to reduce the graph’s size. We showed how to (i) find the maximum number of independent jobs, (ii) construct such sets of independent jobs, and (iii) capture the impact of such jobs on the next system states. Our empirical evaluations confirm that our state exploration strategy has a large impact on reducing the number of explored states with little to no impact on the accuracy of the SAG analysis (and even improving it in some cases).
For example, our experiments on systems with 4 cores and 6 to 20 preemptive tasks showed that our new exploration strategy reduced the average runtime by up to 154 times and decreased the number of explored states by an average of 10% compared to the original SAG under the global EDF policy.
In the future, we plan to reduce the implementation overhead of our exploration by using better data structures and memorizing intermediate calculations. We also plan to extend our solution to analyze job sets with precedence constraints and a mix of preemptive and non-preemptive jobs.

Acknowledgments

This work used the Dutch national e-infrastructure with the support of the SURF Cooperative using grant no. EINF-5183 and the EU ECSEL Joint Undertaking under grant agreement no. 101007260 (project TRANSACT).

Footnotes

1
In [18], the finish time of a preempted job is represented as an interval [FTmin (j, v), FTmax (j, v)]. However, the same value is always assigned to the two interval bounds FTmin (j, v) and FTmax (j, v) thus effectively limiting the interval to a single point. Therefore, we replace the interval by a single value denoted as FT(j, v).

References

[1]
Benny Akesson, Mitra Nasri, Geoffrey Nelissen, Sebastian Altmeyer, and Robert I Davis. 2020. An empirical survey-based study into industry practice in real-time systems. In 2020 IEEE Real-Time Systems Symposium (RTSS). IEEE, 3–11.
[2]
Neil Audsley, Alan Burns, Mike Richardson, Ken Tindell, and Andy J Wellings. 1993. Applying new scheduling theory to static priority pre-emptive scheduling. Software engineering journal 8, 5 (1993), 284–292.
[3]
Theodore P Baker. 2003. Multiprocessor EDF and deadline monotonic schedulability analysis. In Real-Time Systems Symposium (RTSS). 120–129.
[4]
Theodore P Baker. 2005. An analysis of EDF schedulability on a multiprocessor. IEEE Transactions on Parallel and Distributed Systems 16, 8 (2005), 760–768.
[5]
Theodore P Baker and Michele Cirinei. 2007. Brute-force determination of multiprocessor schedulability for sets of sporadic hard-deadline tasks. In International Conference On Principles Of Distributed Systems. 62–75.
[6]
Sanjoy Baruah. 2007. Techniques for multiprocessor global schedulability analysis. In Real-Time Systems Symposium (RTSS). 119–128.
[7]
Marko Bertogna, Michele Cirinei, and Giuseppe Lipari. 2005. Improved schedulability analysis of EDF on multiprocessor platforms. In Euromicro Conference on Real-Time Systems (ECRTS). 209–218.
[8]
Alessandro Biondi and Youcheng Sun. 2018. On the ineffectiveness of 1/m-based interference bounds in the analysis of global EDF and FIFO scheduling. Real-Time Systems 54 (2018), 515–536.
[9]
Vincenzo Bonifaci and Alberto Marchetti-Spaccamela. 2012. Feasibility analysis of sporadic real-time multiprocessor task systems. Algorithmica 63 (2012), 763–780.
[10]
Artem Burmyakov, Enrico Bini, and Chang-Gun Lee. 2022. Towards a tractable exact test for global multiprocessor fixed priority scheduling. IEEE Trans. Comput. 71, 11 (2022), 2955–2967.
[11]
Artem Burmyakov, Enrico Bini, and Eduardo Tovar. 2015. An exact schedulability test for global FP using state space pruning. In International Conference on Real Time and Networks Systems (RTNS). 225–234.
[12]
Liliana Cucu-Grosjean and Joël Goossens. 2011. Exact schedulability tests for real-time scheduling of periodic tasks on unrelated multiprocessor platforms. Journal of systems architecture 57, 5 (2011), 561–569.
[13]
Paul Emberson, Roger Stafford, and Robert I Davis. 2010. Techniques for the synthesis of multiprocessor tasksets. In Workshop on Analysis Tools and Methodologies for Embedded and Real-time Systems (WATERS). 6–11.
[14]
Mohammed Foughali, Pierre-Emmanuel Hladik, and Alexander Zuepke. 2023. Compositional verification of embedded real-time systems. Journal of Systems Architecture 142 (2023), 102928.
[15]
Pourya Gohari, Mitra Nasri, and Jeroen Voeten. 2022. Data-Age Analysis for Multi-Rate Task Chains under Timing Uncertainty. In Proceedings of the 30th International Conference on Real-Time Networks and Systems. 24–35.
[16]
Pourya Gohari, Jeroen Voeten, and Mitra Nasri. 2023. Response-time Analysis of Fault-Tolerant Hard Real-Time Systems Under Global Scheduling. In 2023 IEEE 29th International Conference on Embedded and Real-Time Computing Systems and Applications (RTCSA). IEEE, 263–264.
[17]
Pourya Gohari, Jeroen Voeten, and Mitra Nasri. 2023. Work-in-Progress: Tight Response-Time Analysis for Periodic Preemptive Tasks Under Global Scheduling. In Real-Time Systems Symposium (RTSS). 451–454.
[18]
Pourya Gohari, Jeroen Voeten, and Mitra Nasri. 2024. Reachability-Based Response-Time Analysis of Preemptive Tasks Under Global Scheduling. In Euromicro Conference on Real-Time Systems (ECRTS). Schloss Dagstuhl–Leibniz-Zentrum für Informatik.
[19]
Nan Guan, Zonghua Gu, Qingxu Deng, Shuaihong Gao, and Ge Yu. 2007. Exact schedulability analysis for static-priority global multiprocessor scheduling using model-checking. In IFIP International Workshop on Software Technologies for Embedded and Ubiquitous Systems. 263–272.
[20]
Nan Guan, Martin Stigge, Wang Yi, and Ge Yu. 2009. New response time bounds for fixed priority multiprocessor scheduling. In Real-Time Systems Symposium (RTSS). 387–397.
[21]
Simon Kramer, Dirk Ziegenbein, and Arne Hamann. 2015. Real world automotive benchmarks for free. In Workshop on Analysis Tools and Methodologies for Embedded and Real-time Systems (WATERS).
[22]
Jinkyu Lee and Insik Shin. 2013. Limited carry-in technique for real-time multi-core scheduling. Journal of Systems Architecture 59, 7 (2013), 372–375.
[23]
Mitra Nasri and Björn B Brandenburg. 2017. An exact and sustainable analysis of non-preemptive scheduling. In Real-Time Systems Symposium (RTSS). 12–23.
[24]
Mitra Nasri, Geoffrey Nelissen, and Björn B Brandenburg. 2018. A response-time analysis for non-preemptive job sets under global scheduling. In Euromicro Conference on Real-Time Systems (ECRTS). 9–1.
[25]
Mitra Nasri, Geoffrey Nelissen, and Björn B Brandenburg. 2019. Response-time analysis of limited-preemptive parallel DAG tasks under global scheduling. In Euromicro Conference on Real-Time Systems (ECRTS). 21–1.
[26]
Geoffrey Nelissen, Joan Marcè i Igual, and Mitra Nasri. 2022. Response-time analysis for non-preemptive periodic moldable gang tasks. In Euromicro Conference on Real-Time Systems (ECRTS).
[27]
Suhail Nogd, Geoffrey Nelissen, Mitra Nasri, and Björn B Brandenburg. 2020. Response-time analysis for non-preemptive global scheduling with FIFO spin locks. In Real-Time Systems Symposium (RTSS). 115–127.
[28]
Sayra Ranjha, Pourya Gohari, Geoffrey Nelissen, and Mitra Nasri. 2023. Partial-order reduction in reachability-based response-time analyses of limited-preemptive DAG tasks. Real-Time Systems 59, 2 (2023), 201–255.
[29]
Sayra Ranjha, Mitra Nasri, and Geoffrey Nelissen. 2021. Work-in-progress: Partial-order reduction in reachability-based response-time analyses. In 2021 IEEE Real-Time Systems Symposium (RTSS). IEEE, 544–547.
[30]
Sayra Ranjha, Geoffrey Nelissen, and Mitra Nasri. 2022. Partial-Order Reduction for Schedule-Abstraction-based Response-Time Analyses of Non-Preemptive Tasks. In Real-Time and Embedded Technology and Applications Symposium (RTAS). 121–132.
[31]
Srinidhi Srinivasan, Mario Gunzel, and Geoffrey Nelissen. 2024. RTA for Limited-Preemptive Self-Suspending and Event-Driven Delay-Induced Tasks. In 2024 IEEE Real-Time Systems Symposium (RTSS). IEEE, to appear.
[32]
Srinidhi Srinivasan, Geoffrey Nelissen, Reinder J. Bril, and Nirvana Meratnia. 2024. Analysis of TSN Time-Aware Shapers using Schedule Abstraction Graphs. In Euromicro Conference on Real-Time Systems (ECRTS). 16:1 – 16:24.
[33]
Youcheng Sun and Giuseppe Lipari. 2014. A weak simulation relation for real-time schedulability analysis of global fixed priority scheduling using linear hybrid automata. In International Conference on Real-Time Networks and Systems (RTNS). 35–44.
[34]
Youcheng Sun and Giuseppe Lipari. 2015. Response time analysis with limited carry-in for global earliest deadline first scheduling. In IEEE Real-Time Systems Symposium. 130–140.
[35]
Youcheng Sun and Giuseppe Lipari. 2016. A pre-order relation for exact schedulability test of sporadic tasks on multiprocessor Global Fixed-Priority scheduling. Real-Time Systems 52 (2016), 323–355.
[36]
Youcheng Sun, Giuseppe Lipari, Nan Guan, and Wang Yi. 2014. Improving the response time analysis of global fixed-priority multiprocessor scheduling. In International Conference on Embedded and Real-Time Computing Systems and Applications (RTCSA). 1–9.
[37]
Beyazit Yalcinkaya, Mitra Nasri, and Björn B Brandenburg. 2019. An exact schedulability test for non-preemptive self-suspending real-time tasks. In 2019 Design, Automation & Test in Europe Conference & Exhibition (DATE). IEEE, 1228–1233.
[38]
Quan Zhou, Guohui Li, and Jianjun Li. 2017. Improved carry-in workload estimation for global multiprocessor scheduling. IEEE Transactions on Parallel and Distributed Systems 28, 9 (2017), 2527–2538.
[39]
Quan Zhou, Guohui Li, Chunyang Zhou, and Jianjun Li. 2020. Limited busy periods in response time analysis for tasks under global EDF scheduling. IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems 40, 2 (2020), 232–245.

Index Terms

  1. Leveraging Parallelism in Global Scheduling to Improve State Space Exploration in the SAG Framework

    Recommendations

    Comments

    Information & Contributors

    Information

    Published In

    cover image ACM Other conferences
    RTNS '24: Proceedings of the 32nd International Conference on Real-Time Networks and Systems
    November 2024
    326 pages
    ISBN:9798400717246
    DOI:10.1145/3696355

    Publisher

    Association for Computing Machinery

    New York, NY, United States

    Publication History

    Published: 03 January 2025

    Check for updates

    Author Tags

    1. Partial-order reduction
    2. schedule-abstraction graph
    3. response-time analysis
    4. state-space exploration
    5. real-time systems
    6. multicore.

    Qualifiers

    • Research-article

    Conference

    RTNS 2024

    Acceptance Rates

    Overall Acceptance Rate 119 of 255 submissions, 47%

    Contributors

    Other Metrics

    Bibliometrics & Citations

    Bibliometrics

    Article Metrics

    • 0
      Total Citations
    • 98
      Total Downloads
    • Downloads (Last 12 months)98
    • Downloads (Last 6 weeks)54
    Reflects downloads up to 20 Feb 2025

    Other Metrics

    Citations

    View Options

    View options

    PDF

    View or Download as a PDF file.

    PDF

    eReader

    View online with eReader.

    eReader

    Login options

    Figures

    Tables

    Media

    Share

    Share

    Share this Publication link

    Share on social media