Algorithmic Complexity of Correctness Testing in MC-Scheduling Rany - - PowerPoint PPT Presentation

▶
algorithmic complexity of correctness testing in mc
SMART_READER_LITE
LIVE PREVIEW

Algorithmic Complexity of Correctness Testing in MC-Scheduling Rany - - PowerPoint PPT Presentation

Jan 22, 2023 152 likes •598 views

Algorithmic Complexity of Correctness Testing in MC-Scheduling Rany Kahil, Dario Socci, Peter Poplavko, Saddek Bensalem VERIMAG, University of Grenoble Alpes RTNS18 Kahil et al. (VERIMAG) Correctness Testing in MCS 1 / 27 RTNS18 Our

slide-1
SLIDE 1

Algorithmic Complexity of Correctness Testing in MC-Scheduling

Rany Kahil, Dario Socci, Peter Poplavko, Saddek Bensalem

VERIMAG, University of Grenoble Alpes

RTNS’18

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 1 / 27

slide-2
SLIDE 2

Our Work

Correctness tests in mixed criticality scheduling and their algorithmic complexity Focus on exact simulation based tests Model the workload of a dual criticality system as a set of independent jobs on a single processor Contrary to what was believed, checking the correctness of a policy is not linear Propose the Economical Correctness Test (ECT) ECT has a lower run-time complexity w.r.t other correctness tests in its class

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 2 / 27

slide-3
SLIDE 3

Motivation

MC-systems are not predictable => testing for correctness is complicated Exact based tests introduce less pessimism and are more accurate than response time analysis Time efficiency of simulation based tests is critical since jobs generated over hyper-periods of periodic tasks can be large in numbers Existing tests have at least a quadratic complexity, whereas our proposed test has a quasilinear complexity

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 3 / 27

slide-4
SLIDE 4

Outline

1

Introduction Mixed-Criticality Systems Example of a Scheduling Problem

2

On the Complexity of Correctness Testing

3

Economical Correctness Test Overview Transformation Algorithm

4

Conclusion and Future Work

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 4 / 27

slide-5
SLIDE 5

Mixed Criticality Systems

Advantages and Complexities

Mixed Criticality (MC) systems integrate applications of different criticality level on the same computational platform

Advantages of integration

Increase efficiency Reduce device count Reduced Size, weight and power consumption

Difficulties in MC-Systems

Scheduling becomes harder Increase schedulability tests complexity (our topic)

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 5 / 27

slide-6
SLIDE 6

Vestal Model (S. Vestal, 2007)

in Dual Criticality Systems

Scheduling in Mixed Criticality System

Very pessimistic estimation of WCET for jobs that undergo certification Risk of very low processor usage Solution: interleaving the execution of jobs of different criticality levels

Vestal Model for finite set of jobs in dual criticality systems

Every job is is classified as hi-criticality (HI) or lo-criticality (LO) Every job is labeled with two Worst Case Execution Times: C(LO) computed with industrial standard tools (realistic estimation) C(HI) computed with tools compliant to certification authority standards (very pessimistic estimation)

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 6 / 27

slide-7
SLIDE 7

Schedulability conditions of Mixed Criticality System

in Vestal Model

Condition 1

If all jobs respect their C(LO), then both HI and LO jobs must meet their deadline

Condition 2

If at least one job’s execution time exceeds its C(LO), then all HI jobs must complete before their deadline (LO jobs may be dropped)

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 7 / 27

slide-8
SLIDE 8

Schedulability conditions of Mixed Criticality System

in Vestal Model

Condition 1

If all jobs respect their C(LO), then both HI and LO jobs must meet their deadline

Condition 2

If at least one job’s execution time exceeds its C(LO), then all HI jobs must complete before their deadline (LO jobs may be dropped) A mode switch occurs at the first instant a job exceeds its C(LO) A mode-aware policy can detect a mode switch and is able to take decisions to drop LO jobs A mode-agnostic policy is not mode aware

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 7 / 27

slide-9
SLIDE 9

Example of scheduling problem

An instance J of the scheduling problem is a set of K jobs A scenario of an instance J is a vector of execution times of all jobs

Example (An instance and two scenarios)

Job A D χ C(LO) C(HI) 1 2 HI 1 2 2 2 LO 1 1 3 5 LO 2 2 4 6 HI 1 3 c1 = (1, 1, 2, 1) c2 = (2, 1, 2, 3)

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 8 / 27

slide-10
SLIDE 10

Example of scheduling problem

An instance J of the scheduling problem is a set of K jobs A scenario of an instance J is a vector of execution times of all jobs

Example (An instance and two scenarios)

Job A D χ C(LO) C(HI) 1 2 HI 1 2 2 2 LO 1 1 3 5 LO 2 2 4 6 HI 1 3 c1 = (1, 1, 2, 1) c2 = (2, 1, 2, 3) Scheduling policies: Criticality Monotonic (CM) policy: prioritizes HI jobs over LO jobs Mode-Aware EDF policy: Uses EDF priorities but in the case of a mode switch, LO jobs are dropped

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 8 / 27

slide-11
SLIDE 11

Example of scheduling problem

An instance J of the scheduling problem is a set of K jobs A scenario of an instance J is a vector of execution times of all jobs

Example (An instance and two scenarios)

Job A D χ C(LO) C(HI) 1 2 HI 1 2 2 2 LO 1 1 3 5 LO 2 2 4 6 HI 1 3 c1 = (1, 1, 2, 1) c2 = (2, 1, 2, 3) Scheduling policies: Criticality Monotonic (CM) policy: prioritizes HI jobs over LO jobs Mode-Aware EDF policy: Uses EDF priorities but in the case of a mode switch, LO jobs are dropped Correctness criteria: In scenario c1 all jobs must meet their deadlines In scenario c2 only HI jobs must meet their deadlines

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 8 / 27

slide-12
SLIDE 12

Example of a scheduling problem

Example (An instance and two scenarios)

Job A D χ C(LO) C(HI) 1 2 HI 1 2 2 2 LO 1 1 3 5 LO 2 2 4 6 HI 1 3 c1 = (1, 1, 2, 1) c2 = (2, 1, 2, 3)

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 9 / 27

slide-13
SLIDE 13

Example of a scheduling problem

Example (An instance and two scenarios)

Job A D χ C(LO) C(HI) 1 2 HI 1 2 2 2 LO 1 1 3 5 LO 2 2 4 6 HI 1 3 c1 = (1, 1, 2, 1) c2 = (2, 1, 2, 3)

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 9 / 27

slide-14
SLIDE 14

Example of a scheduling problem

Example (An instance and two scenarios)

Job A D χ C(LO) C(HI) 1 2 HI 1 2 2 2 LO 1 1 3 5 LO 2 2 4 6 HI 1 3 c1 = (1, 1, 2, 1) c2 = (2, 1, 2, 3)

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 9 / 27

slide-15
SLIDE 15

Example of a scheduling problem

Example (An instance and two scenarios)

Job A D χ C(LO) C(HI) 1 2 HI 1 2 2 2 LO 1 1 3 5 LO 2 2 4 6 HI 1 3 c1 = (1, 1, 2, 1) c2 = (2, 1, 2, 3)

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 9 / 27

slide-16
SLIDE 16

Example of a scheduling problem

Example (An instance and two scenarios)

Job A D χ C(LO) C(HI) 1 2 HI 1 2 2 2 LO 1 1 3 5 LO 2 2 4 6 HI 1 3 c1 = (1, 1, 2, 1) c2 = (2, 1, 2, 3)

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 9 / 27

slide-17
SLIDE 17

Example of a scheduling problem

Example (An instance and two scenarios)

Job A D χ C(LO) C(HI) 1 2 HI 1 2 2 2 LO 1 1 3 5 LO 2 2 4 6 HI 1 3 c1 = (1, 1, 2, 1) c2 = (2, 1, 2, 3)

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 9 / 27

slide-18
SLIDE 18

Example of a scheduling problem

Example (An instance and two scenarios)

Job A D χ C(LO) C(HI) 1 2 HI 1 2 2 2 LO 1 1 3 5 LO 2 2 4 6 HI 1 3 c1 = (1, 1, 2, 1) c2 = (2, 1, 2, 3)

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 9 / 27

slide-19
SLIDE 19

Testing the Schedulability of an Instance

Simulation Based Testing

An instance is schedulable by a policy iff the policy correctly schedules all its valid scenarios Not enough to test only the worst case scenario The CM policy correctly schedules the worst case scenario but fails to schedule a simpler scenario There are exponential number of scenarios An efficient correctness test is required to guarantee that a given policy is able to correctly schedule all valid scenarios without testing all of them

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 10 / 27

slide-20
SLIDE 20

1

Introduction Mixed-Criticality Systems Example of a Scheduling Problem

2

On the Complexity of Correctness Testing

3

Economical Correctness Test Overview Transformation Algorithm

4

Conclusion and Future Work

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 11 / 27

slide-21
SLIDE 21

The Claim of Linear Complexity

In the original version of [Baruah et al. (2012)] it was claimed that if an instance is schedulable then there exists an optimal scheduling policy that can generate a schedule with a linear number of preemptions Show by a counter example that the above claim does not hold in general Revisited lemma. If an instance is MC-schedulable, then there exists an optimal online scheduling policy that preempts each job j

  • nly at time points t such that at time t either some other job is

released, or j has executed for exactly Cj(i) units of time for some 1 ≤ i ≤ L

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 12 / 27

slide-22
SLIDE 22

The Counter Example

Job A D χ C(LO) C(HI) 1 14 HI 6 7 2 11 LO 5 5 3 5 10 HI 2 3

According to the revisited lemma jobs can be preempted only at t = 5 i.e., when J3 arrives Two possibilities at t = 0:

◮ J1 executes ◮ J2 executes Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 13 / 27

slide-23
SLIDE 23

The Counter Example

Job A D χ C(LO) C(HI) 1 14 HI 6 7 2 11 LO 5 5 3 5 10 HI 2 3

Assume job J1 starts the execution

2 4 6 8 10 12 14 J1 (5 units)

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 13 / 27

slide-24
SLIDE 24

The Counter Example

Job A D χ C(LO) C(HI) 1 14 HI 6 7 2 11 LO 5 5 3 5 10 HI 2 3

Assume job J1 starts the execution Assume after t = 5 we have the case where:

◮ J2 does not signal termination before it executes for 5 time units ◮ J3 does not signal termination before it executes for 2 time units

2 4 6 8 10 12 14 J1 (5 units) J2 + J3 (7 units) Deadline Miss

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 13 / 27

slide-25
SLIDE 25

The Counter Example

Job A D χ C(LO) C(HI) 1 14 HI 6 7 2 11 LO 5 5 3 5 10 HI 2 3

Assume job J2 starts the execution

2 4 6 8 10 12 14 J2 (5 units)

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 13 / 27

slide-26
SLIDE 26

The Counter Example

Job A D χ C(LO) C(HI) 1 14 HI 6 7 2 11 LO 5 5 3 5 10 HI 2 3

Assume job J2 starts the execution Assume after t = 5 we have the case where:

◮ J1 does not signal termination before it executes for 7 time units ◮ J3 does not signal termination before it executes for 3 time units

2 4 6 8 10 12 14 J2 (5 units) J1 + J3 (10 units) Deadline Miss

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 13 / 27

slide-27
SLIDE 27

The Counter Example

According to the ‘revisited lemma’ this instance is not schedulable A correct scheduling policy exists but it must preempt jobs at different time than allowed by the lemma In the next slide we give an STTM policy that correctly schedules the instance Single Time Table per Mode (STTM) policy assigns one time triggered table for each criticality mode

◮ In a dual-critical system it has two tables the LO and HI* ◮ The schedule starts by using the LO table and in case of a mode

switch it switches to using the HI* table

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 14 / 27

slide-28
SLIDE 28

The Counter Example

Job A D χ C(LO) C(HI) 1 14 HI 6 7 2 11 LO 5 5 3 5 10 HI 2 3

LO HI* 2 4 6 8 10 12 14 Criticality Mode Time J1 J2 J3 J2 J1 J1 J3 J3 J1 J1

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 15 / 27

slide-29
SLIDE 29

Complexity of Existing Correctness Tests

Using the revisited lemma it was proved that the scheduling problem belongs to class NP After our counter example the authors published an erratum to their proof The problem is in NP but a quadratic number of preemptions is needed instead of linear FPM is a particular case where linear number of preemptions is enough

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 16 / 27

slide-30
SLIDE 30

Complexity of Existing Correctness Tests

So far we considered the number of events needed to simulate one scenario Now consider the number of scenarios that have to be simulated

◮ Total cost = num scenarios x num events per scenario

Existing Canonical Correctness Test (CCT) tests linear number of scenarios

◮ The cost of CCT is at least cubic in general ◮ For FPM the cost is at least quadratic

Propose Economical Correctness Test (ECT) tests two scenarios

◮ The cost of ECT is at least quadratic in general ◮ For FPM the cost is n log n Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 17 / 27

slide-31
SLIDE 31

1

Introduction Mixed-Criticality Systems Example of a Scheduling Problem

2

On the Complexity of Correctness Testing

3

Economical Correctness Test Overview Transformation Algorithm

4

Conclusion and Future Work

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 18 / 27

slide-32
SLIDE 32

The Economical Correctness Test

Overview

ECT is an improvement over CCT CCT needs to test a linear number of scenarios which cover all the rest, ECT tests only two ECT transforms the policy into an equivalent STTM policy

◮ Two policies are equivalent if they successfully schedule the same

set of instances

The tables of the transformed STTM policy are tested for correctness

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 19 / 27

slide-33
SLIDE 33

The Economical Correctness Test

Correctness of STTM

The STTM policy correctly schedules an instance if the following conditions are true: All jobs are scheduled after their arrival and before their deadline Allocate for each job Cj(LO) time units in LO table Allocate for each HI job Cj(HI) time units in HI ∗ table If at any time a switch occurs from LO to HI ∗, then all non-yet-terminated HI jobs will have enough time to continue their execution so as to reach Cj(HI) time units

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 20 / 27

slide-34
SLIDE 34

Generating the LO Table

The LO table is generated by simulating the scheduling policy for the LO basic scenario (where all jobs execute for their C(LO)) In an FPM policy this requires scheduling decisions to be taken

  • nly at arrival and termination times

An event based simulator is used having two events per job Event.Arrive and Event.Terminate

Theorem

In the case of FPM, the complexity of generating the LO table is O(n log n) where n is the number of jobs

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 21 / 27

slide-35
SLIDE 35

Generating the HI* Table

The Idea

A requirement of the HI* table: a non-switched job should not execute in the HI* table for more time than it does in the LO table This requirement guarantees that after a mode switch all non-finished HI jobs will have enough time to terminate if they are given C(HI) execution time in HI* before their deadline A set of enabling/disabling rules are used to prevent jobs from executing in HI* in a way that violates the requirement A disabled job is simply removed from the ready queue until it is enabled again

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 22 / 27

slide-36
SLIDE 36

Generating the HI* Table

Enabling/Disabling Rules

A job Jj is enabled, i.e., it is placed in the ready queue, at time t if it is ready and at least one of the following rules is true:

Enabling/Disabling Rules

1 T LO

j

(t) = Cj(LO)

2 T HI∗

j

(t) < T LO

j

(t)

3 T HI∗

j

(t) = T LO

j

(t) ∧ SLO(t) = Jj T LO

j

(t) (resp. T HI∗

j

(t)) denotes the cumulative execution progress of job Jj by time t in table LO (resp. HI*)

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 23 / 27

slide-37
SLIDE 37

Generating the HI* Table

The Simulation

Information from the LO table is needed in this simulation Additional events are needed to enforce the disabling rules:

◮ Event.LO-START and Event.LO-STOP mark the beginning and

the end of execution times of HI jobs in SLO table

◮ Event.Disable used to remove a job from the ready queue

All jobs are considered disabled at the beginning of the simulation A disabled job is enabled when an Event.LO-START occurs

Theorem

The transformed simulation has the same algorithmic complexity as the non-transformed one which is O(n(log n))

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 24 / 27

slide-38
SLIDE 38

ECT Example

Example (Our Previous Instance)

Job A D χ C(LO) C(HI) 1 2 HI 1 2 2 2 LO 1 1 3 5 LO 2 2 4 6 HI 1 3 c1 = (1, 1, 2, 1) c2 = (2, 1, 2, 3)

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 25 / 27

slide-39
SLIDE 39

ECT Example

Example (Our Previous Instance)

Job A D χ C(LO) C(HI) 1 2 HI 1 2 2 2 LO 1 1 3 5 LO 2 2 4 6 HI 1 3 c1 = (1, 1, 2, 1) c2 = (2, 1, 2, 3)

HI* LO 1 2 3 4 5 6 7 8 Mode Time ECT Test for Mode-Aware EDF Policy J1 J4 J2 J3 J1 Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 25 / 27

slide-40
SLIDE 40

ECT Example

Example (Our Previous Instance)

Job A D χ C(LO) C(HI) 1 2 HI 1 2 2 2 LO 1 1 3 5 LO 2 2 4 6 HI 1 3 c1 = (1, 1, 2, 1) c2 = (2, 1, 2, 3)

HI* LO 1 2 3 4 5 6 7 8 Mode Time ECT Test for Mode-Aware EDF Policy J1 J4 J2 J3 J1 J4 Deadline Miss Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 25 / 27

slide-41
SLIDE 41

ECT Example

Example (Our Previous Instance)

Job A D χ C(LO) C(HI) 1 2 HI 1 2 2 2 LO 1 1 3 5 LO 2 2 4 6 HI 1 3 c1 = (1, 1, 2, 1) c2 = (2, 1, 2, 3) c3 = (1, 1, 2, 3)

c3 c2 c1 1 2 3 4 5 6 7 8 Scenario Time Mode-Aware EDF Policy J1 J4 Deadline Miss J1 J4 J2 J3 J1 J4 J2 J3 Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 25 / 27

slide-42
SLIDE 42

Conclusion and Future Work

Taking scheduling decisions at a linear number of events is not always enough to successfully schedule an instance Proposed the Economical Correctness Test (ECT) to test dual criticality instances on single processor ECT Transforms a policy into an equivalent STTM policy with two time tables The time-complexity of ECT is O(n log n) for FPM which is mode-aware, the same cost as for mode-agnostic FP

Future Work

Identify ECT’s limits and study its applicability on a real system, by evaluating its performance w.r.t. the size of a periodic task system

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 26 / 27

slide-43
SLIDE 43

References I

Baruah, S., Bonifaci, V., D’Angelo, G., Li, H., Marchetti-Spaccamela, A., Megow, N., & Stougie, L. (2012). Scheduling real-time mixed-criticality jobs. IEEE Transactions on Computers, 61(8), 1140–1152.

Kahil et al. (VERIMAG) Correctness Testing in MCS RTNS’18 27 / 27