# Scheduling Complex Cyber-Physical Systems with Mixed-Criticality Components

^{1}

^{2}

^{*}

## Abstract

**:**

## 1. Introduction

- (1)
- We propose a new system goal for complex CPSs, called component-MC schedulability, which considers the balance between resource efficiency and safety assurance under component-based MC systems.
- (2)
- Under the component-MC schedulability, we propose a new scheduling framework called component-based MC scheduling with dynamic resource allocation (CMC-DRA), for component-based MC systems. In the framework, we develop scheduling semantics and a mode-switching algorithm for the CMC-DRA framework.
- (3)
- We derive an online schedulability analysis of CMC-DRA for runtime scenarios. We also derive an offline feasibility analysis of the CMC-DRA.
- (4)
- We evaluate the effectiveness of the CMC-DRA scheme through randomly generated synthetic workloads compared to the existing approaches.

## 2. Background

#### 2.1. System Model

**Component Model.**As Figure 1 illustrates, we consider a component-based system with multiple MC components: $Sys\stackrel{\mathsf{def}}{=}\{{O}_{1},{O}_{2},\cdots ,{O}_{j}\}$. Each MC component ${O}_{j}$ is characterized by component interface ${I}_{j}$ and component workload ${W}_{j}$, where ${W}_{j}$ is a set of tasks: ${W}_{j}\stackrel{\mathsf{def}}{=}\{{\tau}_{1},{\tau}_{2},\cdots ,{\tau}_{i}\}$.

**Task Model.**For simplicity, we consider dual criticality levels: HC and LC. We define an MC task model: task ${\tau}_{i}$ is characterized by $({T}_{i},{C}_{i}^{L},{C}_{i}^{H},{\chi}_{i},{\varphi}_{i})$, where ${T}_{i}$ represents the minimum inter-job separation time, ${C}_{i}^{L}$ is a low-criticality worst-case execution time (LO-WCET), ${C}_{i}^{H}$ indicates a high-criticality WCET (HI-WCET), ${\chi}_{i}$ is the task criticality level ($\mathsf{HC}$ or $\mathsf{LC}$), and ${\varphi}_{i}$ denotes the isolation property ($\mathsf{true}$ or $\mathsf{false}$). Task ${\tau}_{i}$ has a relative deadline equal to ${T}_{i}$. Given conservative assumptions for HI-WCETs, we assume that $0<{C}_{i}^{L}\le {C}_{i}^{H}\le {T}_{i}$.

**Behavior Model.**We consider the behavioral model of HC and LC tasks in runtime scheduling. Each task ${\tau}_{i}$ has a task mode (denoted as ${M}_{i}$) indicating its behavior. For HC tasks, we assume some degree of uncertainty about each job’s execution time. A job demonstrates LC behavior if the job completes within its LO-WCET or exhibits HC behavior otherwise. Task ${\tau}_{i}$ is in LC mode (${M}_{i}=\mathsf{LC}$) if it does not show HC behavior and in HC mode (${M}_{i}=\mathsf{HC}$) otherwise.

**System Goal.**In existing MC systems, MC schedulability is defined as follows: for a given MC task set, the system is MC-schedulable if- HC tasks are always schedulable, and
- LC tasks are schedulable if no mode-switch occurs.

**Definition**

**1.**

**component-MC-schedulable**if

**Comp-MC-A**: HC tasks are always schedulable;**Comp-MC-B**: LC tasks are schedulable if no mode-switch occurs; and**Comp-MC-C**: The schedulability of isolated LC tasks is unaffected by the behavior outside the component.

#### 2.2. Review of MC Scheduling Algorithms

- (1)
- Scheduling policy: Initially, all LC tasks start in active mode. All HC tasks except HC-mode-preferred tasks start in LC mode (HC-mode-preferred HC tasks are enforced to execute consistently in HC mode). The deadline-based scheduler assigns the highest priority to the task with the earliest effective deadline: For an HC task, the scheduler executes the task based on its VD if it is in LC mode and based on its real deadline otherwise. For an LC task, the scheduler executes the task based on its real deadlines.
- (2)
- Mode-switching algorithm: When an HC task mode-switches from LC to HC, the scheduler may suspend LC tasks due to the increased resource demand of the HC task (the increased upper bound of task execution time from LO-WCET to HI-WCET). Based on an online schedulability test (presented later), the scheduler chooses to suspend LC tasks.

**Definition**

**2.**

- ${\tau}_{H1}$: LC mode, HC task set (${\tau}_{H1}\stackrel{\mathsf{def}}{=}\{{\tau}_{i}\in {\tau}_{H}|{M}_{i}=\mathsf{LC}\}$),
- ${\tau}_{H2}$: HC mode, HC task set (${\tau}_{H2}\stackrel{\mathsf{def}}{=}\{{\tau}_{i}\in {\tau}_{H}|{M}_{i}=\mathsf{HC}\}$) including the mode-switching task,
- ${\tau}_{L1}$: active LC task set (${\tau}_{L1}\stackrel{\mathsf{def}}{=}\{{\tau}_{i}\in {\tau}_{L}|{M}_{i}=\mathsf{active}\}$), and
- ${\tau}_{L2}$: suspended LC task set (${\tau}_{L2}\stackrel{\mathsf{def}}{=}\{{\tau}_{i}\in {\tau}_{L}|{M}_{i}=\mathsf{suspended}\}$) including LC tasks that are being suspended at a mode-switch.

## 3. Component-Based Mixed-Criticality Scheduling Framework

#### 3.1. Challenges and Approaches

#### 3.2. Process Overview

#### 3.3. The CMC-DRA Scheduling Algorithm

**Definition**

**3.**

#### 3.3.1. CMC-DRA Component Resource Manager

- (1)
- Mandatory resource adjustment: This step is vital to guarantee the component-MC schedulability of a component.
- (a)
- If the mandatory component resources ($\mathsf{ComputeMan}({S}_{j}^{\mathsf{C}})$) exceed the previously assigned component resource (${\Gamma}_{j}^{\mathsf{P}}$), we increase ${\Gamma}_{j}$ from ${\Gamma}_{j}^{\mathsf{P}}$ to $\mathsf{ComputeMan}({S}_{j}^{\mathsf{C}})$.
- (b)
- If the available resources (${\Gamma}_{j}^{\mathsf{P}}+\mathsf{IdleRes}$) are smaller than the mandatory component resource, the mode-switch is changed to external (Figure 3b). For the external mode-switch, the component resource manager should request the component’s resource deficiency ($\mathsf{ReqRes}$) from the system resource manager: $\mathsf{ReqRes}\stackrel{\mathsf{def}}{=}\mathsf{ComputeMan}({S}_{j}^{\mathsf{C}})-({\Gamma}_{j}^{\mathsf{P}}+\mathsf{IdleRes})$.

- (2)
- Optional resource adjustment (if $\mathsf{IdleRes}>0$): This step is optional to reduce the suspension of LC tasks. We increase ${\Gamma}_{j}$ by $min(\mathsf{ComputeOpt}({S}_{j}^{\mathsf{C}}),$$\mathsf{IdleRes})$.

- (1)
- Find a component ${O}_{k}$ s.t. ${O}_{k}\ne {O}_{j}$ and ${\Gamma}_{k}^{\mathsf{P}}>\mathsf{ComputeMan}({S}_{k}^{\mathsf{C}})$.
- (a)
- ${O}_{k}$ can reduce its component resources from ${\Gamma}_{k}^{\mathsf{P}}$ to $\mathsf{ComputeMan}({S}_{k}^{\mathsf{C}})$. We let ${\Gamma}_{k}^{\mathsf{D}}$ be the maximum possible resource donation: ${\Gamma}_{k}^{\mathsf{D}}\stackrel{\mathsf{def}}{=}{\Gamma}_{k}^{\mathsf{P}}-\mathsf{ComputeMan}({S}_{k}^{\mathsf{C}})$.
- (b)
- If $\mathsf{ReqRes}>{\Gamma}_{k}^{\mathsf{D}}$, we reduce the component resources of ${O}_{k}$ maximally and update $\mathsf{ReqRes}:=\mathsf{ReqRes}-{\Gamma}_{k}^{\mathsf{D}}$.
- (c)
- Otherwise, we reduce the component resources of ${O}_{k}$ only by $\mathsf{ReqRes}$ and update $\mathsf{ReqRes}:=0$.

- (2)
- Repeat the above procedure until $\mathsf{ReqRes}=0$. A feasible system passing the offline feasibility test (which will be presented in Section 3.4) must be terminated.

#### 3.3.2. CMC-DRA Mode-Switching Algorithm

#### 3.4. Schedulability Analysis of CMC-DRA

#### 3.4.1. Online Schedulability Analysis

**Theorem**

**1.**

#### 3.4.2. Offline Feasibility Analysis and Interface Computation

**Lemma**

**1.**

**Proof.**

**Lemma**

**2.**

**Proof.**

**Lemma**

**3.**

**Proof.**

**Theorem**

**2.**

**Proof.**

**Theorem**

**3.**

**Proof.**

## 4. Evaluation

#### 4.1. Simulation Setup

- (1)
- Component utilization, ${U}_{j}$, is a real number drawn from the range $[0.05,0.2]$.
- (2)
- The ratio of isolated tasks over total LC tasks, ${\alpha}_{j}$, is a real number drawn from the range $[0.25,0.75]$.
- (3)
- For a task ${\tau}_{i}$,
- -
- Task utilization, ${u}_{i}$, is a real number drawn from the range $[0.02,0.1]$.
- -
- The ratio of ${u}_{i}^{H}/{u}_{i}^{L}$, ${R}_{i}$, is a real number drawn from the range $[1,4]$.
- -
- The probability that the task is an HC task, ${P}_{i}$, is a real number from the range [0, 1]. If ${P}_{i}<{P}^{\mathsf{HC}}$ (default value of ${P}^{\mathsf{HC}}$ is 0.5), set ${\chi}_{i}:=\mathsf{LC}$. Otherwise, set ${\chi}_{i}:=\mathsf{HC}$.

- (4)
- We repeat the steps to generate a task in the component until $max({U}_{j,H}^{L}+{U}_{j,L}^{L},\phantom{\rule{3.33333pt}{0ex}}{U}_{j,H}^{H})$ exceeds ${U}_{j}$. Then, we discard the task added last.

#### 4.2. Simulation Results

#### 4.2.1. System Feasibility for Scheduling Algorithms

- (1)
- A variant of the MC-ADAPT scheduling algorithm [18] for component-based systems: When a mode-switch occurs in a component, the algorithm selectively suspends LC tasks in the component. The mode-switch does not propagate to other components.
- (2)
- A variant of the EDF-VD scheduling algorithm [15] for component-based systems: When a mode-switch happens in a component, the algorithm suspends all LC tasks in the component. The mode-switch does not propagate to other components.

#### 4.2.2. System Feasibility for Alpha Parameters

#### 4.2.3. Runtime Performance (Deadline Miss Ratio of LC Tasks)

- (1)
- The EDF-VD scheduling algorithm [15] is a non-component-based MC scheduling algorithm suspending all LC tasks at any mode-switch.
- (2)
- The CMC-DRA-v1 scheduling algorithm is a simplified version of the CMC-DRA algorithm without considering the component state and resource manager. At the mode-switch in a component, the algorithm suspends all LC tasks in the mode-switching component and suspends all shared LC tasks in other components.
- (3)
- The CMC-DRA-v2 scheduling algorithm is the proposed CMC-DRA algorithm, which strictly follows Section 3.3.

## 5. Discussion

#### 5.1. Implementation in Autonomous Driving Mini Vehicles

#### 5.2. Implementation with Virtualization Platforms

#### 5.3. Limitations

## 6. Conclusions

## Author Contributions

## Funding

## Institutional Review Board Statement

## Informed Consent Statement

## Data Availability Statement

## Conflicts of Interest

## Notation

${O}_{j}$ | An MC component |

${W}_{j}$ | The workload of component ${O}_{j}$ (a set of tasks $\left\{{\tau}_{i}\right\}$) |

${\tau}_{i}$ | An MC task ${\tau}_{i}$=(${T}_{i}$, ${C}_{i}^{L}$, ${C}_{i}^{H}$, ${\chi}_{i}$, ${\varphi}_{i}$) |

${T}_{i}$ | Task period of ${\tau}_{i}$ |

${C}_{i}^{L}$ | LO-WCET of ${\tau}_{i}$ |

${C}_{i}^{H}$ | HI-WCET of ${\tau}_{i}$ |

${\chi}_{i}$ | Task criticality of ${\tau}_{i}$ ($HC$ or $LC$) |

${\varphi}_{i}$ | Isolation property for LC tasks (true or false) |

$\tau $ | The set of tasks in all components in the system |

${\tau}_{H}$ | A set of tasks whose task criticality is $HC$: ${\tau}_{H}=\{{\tau}_{i}\in \tau |{\chi}_{i}=\mathsf{HC}\}$ |

${\tau}_{L}$ | A set of tasks whose task criticality is $LC$: ${\tau}_{L}=\{{\tau}_{i}\in \tau |{\chi}_{i}=\mathsf{LC}\}$ |

${\tau}_{I}$ | A set of LC tasks whose isolation property is true: ${\tau}_{I}=\{{\tau}_{i}\in {\tau}_{L}|{\varphi}_{i}=\mathsf{true}\}$ |

${\tau}_{S}$ | A set of LC tasks whose isolation property is false: ${\tau}_{S}=\{{\tau}_{i}\in {\tau}_{L}|{\varphi}_{i}=\mathsf{false}\}$ |

${M}_{i}$ | Task mode of ${\tau}_{i}$ indicating runtime task behavior |

${\tau}_{H1}$ | LC mode HC task set ${\tau}_{H1}=\{{\tau}_{i}\in {\tau}_{H}|{M}_{i}=\mathsf{LC}\}$ |

${\tau}_{H2}$ | HC mode HC task set ${\tau}_{H2}=\{{\tau}_{i}\in {\tau}_{H}|{M}_{i}=\mathsf{HC}\}$ |

${\tau}_{L1}$ | Active LC task set ${\tau}_{L1}=\{{\tau}_{i}\in {\tau}_{L}|{M}_{i}=\mathsf{active}\}$ |

${\tau}_{L2}$ | Suspended LC task set ${\tau}_{L2}=\{{\tau}_{i}\in {\tau}_{L}|{M}_{i}=\mathsf{suspended}\}$ |

S | System state indicating runtime state of the system: $S=({\tau}_{H1},{\tau}_{H2},{\tau}_{L1},{\tau}_{L2})$ |

x | A system-wide virtual deadline tuning parameter |

${\tau}_{F}$ | HC-mode-preferred tasks ${\tau}_{F}=\{{\tau}_{i}\in {\tau}_{H}|{u}_{i}^{L}/x>{u}_{i}^{H}\}$ |

${S}_{j}$ | Component state indicating runtime state of component ${O}_{j}$: ${S}_{j}=({\tau}_{H1,j},{\tau}_{H2,j},{\tau}_{L1,j},{\tau}_{L2,j})$ |

${S}_{j}^{\mathsf{C}}$ | Current component state of ${O}_{j}$ |

${S}_{j}^{\mathsf{ST}}$ | Initial component state of ${O}_{j}$ |

${S}_{j}^{\mathsf{EM}}$ | The worst-case component state of ${O}_{j}$ when external mode-switches but no internal mode-switches occur |

${S}_{j}^{\mathsf{IM}}$ | The worst-case component state of ${O}_{j}$ when internal mode-switches occur |

${\Gamma}_{j}$ | Component resource indicating proportional share of the system resource for component ${O}_{j}$ |

${\Gamma}_{j}^{\mathsf{C}}$ | The minimum component resource to schedule ${O}_{j}$ when ${S}_{j}={S}_{j}^{\mathsf{C}}$ |

${\Gamma}_{j}^{\mathsf{P}}$ | The previously assigned component resource of ${O}_{j}$ |

${\Gamma}_{j}^{\mathsf{D}}$ | The maximum possible resource donation of ${O}_{j}$ |

${\Gamma}_{j}^{\mathsf{ST}}$ | The minimum component resource to schedule ${O}_{j}$ when ${S}_{j}={S}_{j}^{\mathsf{ST}}$ |

${\Gamma}_{j}^{\mathsf{EM}}$ | The minimum component resource to schedule ${O}_{j}$ when ${S}_{j}={S}_{j}^{\mathsf{EM}}$ |

${\Gamma}_{j}^{\mathsf{IM}}$ | The minimum component resource to schedule ${O}_{j}$ when ${S}_{j}={S}_{j}^{\mathsf{IM}}$ |

${\mathsf{DEM}}_{\mathsf{i}}(t)$ | Resource demand of ${\tau}_{i}$ over time interval length t |

$\mathsf{ComputeMan}({S}_{j}^{\mathsf{C}})$ | The mandatory component resource to schedule ${O}_{j}$ for component-MC schedulability |

$\mathsf{ComputeOpt}({S}_{j}^{\mathsf{C}})$ | The optional component resource to reduce the suspension of LC tasks in ${O}_{j}$ |

$\mathsf{IdleRes}$ | The remaining system resource that is not distributed to any component |

$\mathsf{ReqRes}$ | The deficiency of component resource to provide the mandatory component resource |

## Appendix A

**Proof of Theorem**

**1.**

**Case 1**(${S}_{j}$ is ${S}_{j}^{\mathsf{0}}$)**.**We show that the collective demands over $[0,{t}_{1})$ are equal to or less than ${\Gamma}_{j}\xb7{t}_{1}$:$$\begin{array}{cc}\hfill \mathsf{DEM}({t}_{1})& =\sum _{{\tau}_{i}\in {\tau}_{L,j}}{\mathsf{DEM}}_{\mathsf{i}}({t}_{1})+\sum _{{\tau}_{i}\in {\tau}_{H,j}}{\mathsf{DEM}}_{\mathsf{i}}({t}_{1})\hfill \\ \hfill \phantom{\rule{1.em}{0ex}}& =(\sum _{{\tau}_{i}\in {\tau}_{L,j}}{u}_{i}^{L}+\sum _{{\tau}_{i}\in {\tau}_{H,j}}{u}_{i}^{L}/x)\xb7{t}_{1}\phantom{\rule{19.91684pt}{0ex}}(byLemma5.4in[18])\hfill \\ \hfill \phantom{\rule{1.em}{0ex}}& =({U}_{L,j}^{L}+\frac{{U}_{H,j}^{L}-{U}_{F,j}^{L}}{x}+{U}_{F,j}^{H})\xb7{t}_{1},\hfill \end{array}$$**Case 2**(${S}_{j}$ is not ${S}_{j}^{\mathsf{0}}$)**.**Assume that the current component state ${S}_{j}$ is transited from a feasible component state ${S}_{j}^{\mathsf{P}}$ (${S}_{j}^{\mathsf{0}}$ is also a feasible system state) by one mode-switch. Let ${J}^{*}$ be the mode-switching job of task ${\tau}_{i}$ before time ${t}_{1}$ and ${a}^{*}$ be the release time of ${J}^{*}$. Let ${\mathsf{DEM}}_{\mathsf{i}}^{\mathsf{P}}(t)$ be ${\mathsf{DEM}}_{\mathsf{i}}(t)$ on ${S}_{j}^{\mathsf{P}}$. Task ${\tau}_{q}$ denotes the HC task which the latest mode-switching job before ${t}_{1}$ belongs to.We only need to show that the collective demands over $[0,{t}_{1}]$ are equal to or less than ${t}_{1}$. Since ${S}_{j}^{\mathsf{P}}$ is a feasible component state, we have ${\sum}_{i}{\mathsf{DEM}}_{\mathsf{i}}^{\mathsf{P}}(t)\le {\Gamma}_{j}\xb7t$ for any t. We calculate the collective demand by dividing the cases depending on ${t}_{1}$.**Case 2-A.**(${t}_{1}\le {a}_{q}^{*}+x{T}_{q}$)**.**The collective demand is calculated as$$\begin{array}{cc}\hfill \mathsf{DEM}({t}_{1})& =\sum _{i}{\mathsf{DEM}}_{\mathsf{i}}({t}_{1})\hfill \\ \hfill \phantom{\rule{1.em}{0ex}}& \le \sum _{i}{\mathsf{DEM}}_{\mathsf{i}}^{\mathsf{P}}({t}_{1})\phantom{\rule{65.44133pt}{0ex}}(byLemma5.8in[18])\hfill \\ \hfill \phantom{\rule{1.em}{0ex}}& \le {\Gamma}_{j}\xb7{t}_{1}.\phantom{\rule{82.51299pt}{0ex}}(bytheassumptionon{\mathsf{DEM}}_{\mathsf{i}}^{\mathsf{P}})\hfill \end{array}$$**Case 2-B.**(${t}_{1}>{a}_{q}^{*}+x{T}_{q}$)**.**The collective demand is calculated as$$\begin{array}{cc}\hfill \mathsf{DEM}({t}_{1})& =\sum _{i}{\mathsf{DEM}}_{\mathsf{i}}({t}_{1})\hfill \\ \hfill \phantom{\rule{1.em}{0ex}}& \le \sum _{i}{\mathsf{DEM}}_{\mathsf{i}}^{\mathsf{P}}({a}_{q}^{*})+({t}_{1}-{a}_{q}^{*})({U}_{L1,j}^{L}+\frac{{U}_{H1,j}^{L}}{x}+x{U}_{L2,j}^{L}+{U}_{H2,j}^{H})\phantom{\rule{65.44133pt}{0ex}}(byLemma5.9in[18])\hfill \\ \hfill \phantom{\rule{65.44133pt}{0ex}}& \hfill \\ \hfill \phantom{\rule{1.em}{0ex}}& \le \sum _{i}{\mathsf{DEM}}_{\mathsf{i}}^{\mathsf{P}}({a}_{q}^{*})+({t}_{1}-{a}_{q}^{*}){\Gamma}_{j}\phantom{\rule{65.44133pt}{0ex}}(byEquation(4)with{S}_{j})\hfill \\ \hfill \phantom{\rule{1.em}{0ex}}& \le {\Gamma}_{j}\xb7{a}_{q}^{*}+{\Gamma}_{j}({t}_{1}-{a}_{q}^{*})\phantom{\rule{42.67912pt}{0ex}}(bytheassumptionon{\mathsf{DEM}}_{\mathsf{i}}^{\mathsf{P}})\hfill \\ \hfill \phantom{\rule{1.em}{0ex}}& ={\Gamma}_{j}\xb7{t}_{1}.\hfill \end{array}$$

## References

- Henzinger, T.; Matic, S. An Interface Algebra for Real-Time Components. In Proceedings of the 12th IEEE Real-Time and Embedded Technology and Applications Symposium (RTAS’06), San Jose, CA, USA, 4–7 April 2006; pp. 253–266. [Google Scholar] [CrossRef]
- Prisaznuk, P. Integrated modular avionics. In Proceedings of the Aerospace and Electronics Conference, NAECON 1992, Dayton, OH, USA, 18–22 May 1992; Volume 1, pp. 39–45. [Google Scholar] [CrossRef]
- ARINC653—An Avionics Standard for Safe, Partitioned Systems; Wind River Systems/IEEE Seminar. 2008. Available online: https://docplayer.net/287772-Arinc-653-an-avionics-standard-for-safe-partitioned-systems.html (accessed on 20 February 2023).
- Abeni, L.; Balsini, A.; Cucinotta, T. Container-Based Real-Time Scheduling in the Linux Kernel. SIGBED Rev.
**2019**, 16, 33–38. [Google Scholar] [CrossRef] - Cucinotta, T.; Abeni, L.; Marinoni, M.; Balsini, A.; Vitucci, C. Reducing Temporal Interference in Private Clouds through Real-Time Containers. In Proceedings of the 2019 IEEE International Conference on Edge Computing (EDGE), Milan, Italy, 8–13 July 2019; IEEE Computer Society: Los Alamitos, CA, USA, 2019; pp. 124–131. [Google Scholar] [CrossRef]
- ISO/DIS 26262-1; Road Vehicles Functional Safety Part 1 Glossary. Technical Report; ISO: Geneva, Switzerland, 2009.
- Gall, H. Functional safety IEC 61508/IEC 61511 the impact to certification and the user. In Proceedings of the AICCSA, IEEE Computer Society, Doha, Qatar, 31 March–4 April 2008; pp. 1027–1031. [Google Scholar]
- AUTOSAR. AUTomotive Open System Architecture. Available online: www.autosar.org (accessed on 29 April 2023).
- Ren, J.; Phan, L.T.X. Mixed-Criticality Scheduling on Multiprocessors Using Task Grouping. In Proceedings of the 2015 27th Euromicro Conference on Real-Time Systems (ECRTS), Lund, Sweden, 8–10 July 2015; pp. 25–34. [Google Scholar] [CrossRef]
- Gu, X.; Easwaran, A.; Phan, K.M.; Shin, I. Resource Efficient Isolation Mechanisms in Mixed-Criticality Scheduling. In Proceedings of the 2015 27th Euromicro Conference on Real-Time Systems (ECRTS), Lund, Sweden, 8–10 July 2015; pp. 13–24. [Google Scholar] [CrossRef]
- Burns, A.; Baruah, S. Towards A More Practical Model for Mixed Criticality Systems. In Proceedings of the First Workshop of Mixed Criticality Systems (WMC 2013), Vancouver, BC, Canada, 3–6 December 2013; pp. 1–6. [Google Scholar]
- Vestal, S. Preemptive Scheduling of Multi-criticality Systems with Varying Degrees of Execution Time Assurance. In Proceedings of the 28th IEEE International Real-Time Systems Symposium, RTSS 2007, Tucson, AZ, USA, 3–6 December 2007; pp. 239–243. [Google Scholar] [CrossRef]
- Burns, A.; Davis, R.I. A Survey of Research into Mixed Criticality Systems. ACM Comput. Surv.
**2017**, 50, 1–37. [Google Scholar] [CrossRef] - Baruah, S.; Burns, A.; Davis, R. Response-Time Analysis for Mixed Criticality Systems. In Proceedings of the 2011 IEEE 32nd Real-Time Systems Symposium (RTSS), Vienna, Austria, 29 November–2 December 2011; pp. 34–43. [Google Scholar] [CrossRef]
- Baruah, S.; Bonifaci, V.; D’Angelo, G.; Li, H.; Marchetti-Spaccamela, A.; van der Ster, S.; Stougie, L. The Preemptive Uniprocessor Scheduling of Mixed-Criticality Implicit-Deadline Sporadic Task Systems. In Proceedings of the 2012 24th Euromicro Conference on Real-Time Systems (ECRTS), Pisa, Italy, 11–13 July 2012; pp. 145–154. [Google Scholar]
- Guan, N.; Ekberg, P.; Stigge, M.; Yi, W. Effective and Efficient Scheduling of Certifiable Mixed-Criticality Sporadic Task Systems. In Proceedings of the 2011 IEEE 32nd Real-Time Systems Symposium (RTSS), Vienna, Austria, 29 November–2 December 2011; pp. 13–23. [Google Scholar] [CrossRef]
- Huang, P.; Kumar, P.; Stoimenov, N.; Thiele, L. Interference Constraint Graph—A new specification for mixed-criticality systems. In Proceedings of the 2013 IEEE 18th Conference on Emerging Technologies Factory Automation (ETFA), Cagliari, Italy, 10–13 September 2013; pp. 1–8. [Google Scholar] [CrossRef]
- Lee, J.; Chwa, H.S.; Phan, L.T.X.; Shin, I.; Lee, I. MC-ADAPT: Adaptive Task Dropping in Mixed-Criticality Scheduling. ACM Trans. Embed. Comput. Syst.
**2017**, 16, 163:1–163:21. [Google Scholar] [CrossRef] - Chen, G.; Guan, N.; Hu, B.; Yi, W. EDF-VD Scheduling of Flexible Mixed-Criticality System with Multiple-Shot Transitions. IEEE Trans.-Comput.-Aided Des. Integr. Circuits Syst.
**2018**, 37, 2393–2403. [Google Scholar] [CrossRef] - Lee, J.; Lee, J. MC-FLEX: Flexible Mixed-Criticality Real-Time Scheduling by Task-Level Mode Switch. IEEE Trans. Comput.
**2022**, 71, 1889–1902. [Google Scholar] [CrossRef] - Lackorzyński, A.; Warg, A.; Völp, M.; Härtig, H. Flattening Hierarchical Scheduling. In Proceedings of the Tenth ACM International Conference on Embedded Software; EMSOFT’12. ACM: New York, NY, USA, 2012; pp. 93–102. [Google Scholar] [CrossRef]
- Lackorzynski, A.; Völp, M.; Warg, A. Flat but Trustworthy: Security Aspects in Flattened Hierarchical Scheduling. SIGBED Rev.
**2014**, 11, 8–12. [Google Scholar] [CrossRef] - Deos: A Time & Space Partitioned DO-178 Level A Certifiable RTOS. Available online: http://www.ddci.com/products_deos.php (accessed on 29 April 2023).
- O’Kelly, M.; Zheng, H.; Karthik, D.; Mangharam, R. F1TENTH: An Open-source Evaluation Environment for Continuous Control and Reinforcement Learning. In Proceedings of the NeurIPS 2019 Competition and Demonstration Track; Escalante, H.J., Hadsell, R., Eds.; PMLR: Vancouver, BC, Canada, 2020; Volume 123, pp. 77–89. [Google Scholar]
- Kang, W.; Chung, S.; Kim, J.Y.; Lee, Y.; Lee, K.; Lee, J.; Shin, K.G.; Chwa, H.S. DNN-SAM: Split-and-Merge DNN Execution for Real-Time Object Detection. In Proceedings of the 2022 IEEE 28th Real-Time and Embedded Technology and Applications Symposium (RTAS), Milano, Italy, 4–6 May 2022; pp. 160–172. [Google Scholar] [CrossRef]
- Cinque, M.; Cotroneo, D.; De Simone, L.; Rosiello, S. Virtualizing mixed-criticality systems: A survey on industrial trends and issues. Future Gener. Comput. Syst.
**2022**, 129, 315–330. [Google Scholar] [CrossRef] - Struhár, V.; Behnam, M.; Ashjaei, M.; Papadopoulos, A.V. Real-Time Containers: A Survey. In Proceedings of the 2nd Workshop on Fog Computing and the IoT (Fog-IoT 2020); Cervin, A., Yang, Y., Eds.; Schloss Dagstuhl–Leibniz-Zentrum fuer Informatik: Dagstuhl, Germany, 2020; Volume 80, pp. 7:1–7:9. [Google Scholar] [CrossRef]

**Figure 1.**The hierarchy of components and tasks: a system consists of multiple MC components (${O}_{1}$, ${O}_{2}$, ⋯); an MC component consists of HC tasks, the shared LC tasks, and the isolated LC tasks.

**Figure 2.**The behavioral model of tasks: an HC task initially starts in LC mode, and switches to HC mode when it executes more than LO-WCET (${C}_{i}^{L}$); an LC task initially starts in the active mode (executing up to LO-WCET (${C}_{i}^{L}$)), and is suspended by a scheduling decision at a mode-switch of some HC task.

**Figure 3.**Mode-switch in CMC-DRA. (

**a**) Internal mode-switch affects only LC tasks inside the component. (

**b**) A mode-switch is changed to be external if the required resource demand is not satisfied, even if all internal LC tasks are suspended. Then, the external mode-switch affects internal LC tasks and the shared LC tasks in other components.

**Figure 6.**System feasibility of CMC-DRA varying the probability to be an HC task (${P}^{\mathsf{HC}}$) for different alpha parameters.

**Figure 7.**Runtime Performance (Deadline Miss Ratio of LC tasks) for EDF-VD [15], CMC-DRA-v1, and CMC-DRA-v2.

EDF-VD | CMC-DRA-v1 | CMC-DRA-v2 | |
---|---|---|---|

Total simulation time | 737,419 ms | 769,343 ms | 731,906 ms |

Simulation time per each workload | 16.387 ms | 17.097 ms | 16.265 ms |

Disclaimer/Publisher’s Note: The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content. |

© 2023 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons.org/licenses/by/4.0/).

## Share and Cite

**MDPI and ACS Style**

Lee, J.; Koh, K.
Scheduling Complex Cyber-Physical Systems with Mixed-Criticality Components. *Systems* **2023**, *11*, 281.
https://doi.org/10.3390/systems11060281

**AMA Style**

Lee J, Koh K.
Scheduling Complex Cyber-Physical Systems with Mixed-Criticality Components. *Systems*. 2023; 11(6):281.
https://doi.org/10.3390/systems11060281

**Chicago/Turabian Style**

Lee, Jaewoo, and Keumseok Koh.
2023. "Scheduling Complex Cyber-Physical Systems with Mixed-Criticality Components" *Systems* 11, no. 6: 281.
https://doi.org/10.3390/systems11060281