CS5270 Lecture 31 Uppaal, and Scheduling, and Resource Access Protocols CS 5270 Lecture 3

2 Assignment 1… Eight questions Some reading may be required… Hand in Feb 16

CS5270 Lecture 33 Last week… Some system examples Time triggered architectures Requirements for hard RT systems –Functional –Temporal –Dependability/safety Clocks The design challenge…(not done…)

CS5270 Lecture 34 This week… The design challenge. Uppaal Scheduling overview Scheduling algorithms –RMS – Rate Monotonic Scheduling –EDF – Earliest Deadline First Resource Access overview (if time)

CS5270 Lecture 35 Uppaal: Website…

CS5270 Lecture 36 Uppaal: License…

CS5270 Lecture 37 Uppaal: Download…

CS5270 Lecture 38 Uppaal: Download…

CS5270 Lecture 39 Uppaal: Instructions…

CS5270 Lecture 310 Uppaal: Extract/unzip…

CS5270 Lecture 311 Uppaal: Click on Jar file…

CS5270 Lecture 312 Uppaal: The application…

CS5270 Lecture 313 Uppaal: Help…

CS5270 Lecture 314 Uppaal: Load up demo…

CS5270 Lecture 315 Uppaal: Look at TTS…

CS5270 Lecture 316 Uppaal: Simulation…

CS5270 Lecture 317 Uppaal: Simulation…

CS5270 Lecture 318 Uppaal: Simulation…

CS5270 Lecture 319 Uppaal: Verification…

CS5270 Lecture 320 Scheduling

CS5270 Lecture 321 Non-preemptive scheduling

CS5270 Lecture 322 Preemptive scheduling

CS5270 Lecture 323 Scheduling terms Feasible – a schedule is termed feasible if all tasks can be completed within the constraints specified Schedulable – a task set is schedulable if a particular scheduling algorithm produces a feasible schedule

CS5270 Lecture 324 Constraints for scheduling Timing (deadlines for tasks) Precedence (which task comes first) Resource (shared access) Hard and Soft constraints

CS5270 Lecture 325 Deadlines Each task runs for time Cj, and must complete before a deadline

CS5270 Lecture 326 Periodic tasks

CS5270 Lecture 327 Precedence between tasks

CS5270 Lecture 328 Resource Access Protocols Multiple tasks. Uniprocessor Shared resources. –Need proper protocols for accessing shared resources. –Resource access protocols. Avoid priority inversion!

CS5270 Lecture 329 Resource constraints Critical resource constraints Mutual exclusion Critical sections

CS5270 Lecture 330 Critical sections

CS5270 Lecture 331 Critical Section Critical section: –A piece of code belonging to task executed under mutual exclusion constraints. Mutual exclusion enforced by semaphores. –wait(s)  Blocked if s = 0. – signal(s)  s is set to 1 when signal(s) executes.

CS5270 Lecture 332 Structure of Critical Sections.

CS5270 Lecture 333 Wait State A task waiting for an exclusive resource is blocked on that resource. Tasks blocked on the same resource are kept in a wait queue associated with the semaphore protecting the resource. A task in the running state executing wait(s) on a locked semaphore (s = 0) enters the waiting state. When a task currently using the resource executes signal(s), the semaphore is released. When a task leaves its waiting state (because the semaphore has been released) it goes into the ready state:

CS5270 Lecture 334 Task access to resources

35 Blocking via Exclusive Resource J 1 has higher priority than J 2. Preemption is in play. Only one processor available.

CS5270 Lecture 336 Scheduling algorithms - RMS

CS5270 Lecture 337 A Classic Policy Rate Monotonic Scheduling. –Task set : {J 1, J 2, …, J n } –Each task is periodic. T 1, T 2,.., T n –  i = 0 for each i. –D i = T i for each i. –Each task runs for time C i –Pre-emption allowed, only one processor, no precedence constraints, no shared resources.

CS5270 Lecture 338 RMS The RMS algorithm: –Assign a static priority to the tasks according to their periods.  Priority of a task does not change during execution. – Tasks with shorter periods have higher priorities. –Preemption policy:  If T i is executing and T j arrives which has higher priority (shorter period), then preempt T i and start executing T j.

CS5270 Lecture 339 RMS Example (3, 2) (5, 1) Period Duration TiTi CiCi

CS5270 Lecture 340 RMS Example (3, 1) (5, 2)

CS5270 Lecture 341 RMS Results RMS is optimal. – If a set of of periodic tasks (satisfying the assumptions set out previously) is not schedulable under RMS then no static priority algorithm can schedule this set of tasks. RMS requires very little run time processing.

CS5270 Lecture 342 Schedulability

CS5270 Lecture 343 Process Utilization Factor Task set = {T 1, T 2, …, T n } Process Utilization Factor –  C i / T i –C 1 / T 1 + C 2 / T 2 + … C n / T n If this factor is GREATER than 1 then the task set can not be scheduled. –Why? If UF ≤ 1 it may be RMS-schedulable.

CS5270 Lecture 344 RMS Schedulability Task set = {T 1, T 2, …, T n } If UF  U lub then it is guaranteed to be schedulable. U lub - The least upper bound of processor utility. For RMS, U lub = n( 2 1/n – 1)

CS5270 Lecture 345 Process Utilization Factor Task set = {T 1, T 2, …, T n } If UF  U lub then it is guaranteed to be schedulable. But if UF is greater than U lub and not greater than 1, we must check explicitly whether the task set is RMS-schedulable.

46 RMS Schedulability nU lub  This is only a sufficient criterion! This criterion may fail and yet an RMS may exist.

CS5270 Lecture 347 RMS Example (Guaranteed) (3, 1) (5, 2) UF = = 0.73 U lub = (U F ≤U lub )

CS5270 Lecture 348 RMS Example (still schedulable) (3, 2) (5, 1) UF = = 0.86 U lub = (U F >U lub )

CS5270 Lecture 349 Scheduling algorithms - EDF

CS5270 Lecture 350 EDF Earliest Deadline First. – Tasks with earlier deadlines will have higher priorities. –Applies to both periodic and aperiodic tasks. –EDF is optimal for dynamic priority algorithms. – A set of periodic tasks is schedulable with EDF iff the utilization factor is not greater than 1.

CS5270 Lecture 351 An Example {T1, T2} T1 = ( 5, 2) T2 = (7, 4) UF = = 0.97

CS5270 Lecture 352 An RMS Schedule? Time-Overflow

CS5270 Lecture 353 The Example UF = = 0.97 Guaranteed to be schedulable under EDF!

CS5270 Lecture 354 An EDF Schedule

CS5270 Lecture 355 Priority inversion

CS5270 Lecture 356 Priority Inversion J 1 > J 2 > J 3 [3, 6] priority inversion period. J 1 waits for the execution of J 2 and the critical section of J 3 J1J1 J2J2 J3J3

CS5270 Lecture 357 Priority Inversion The Mars pathfinder Mission in 1997 ran into serious problem. The spacecraft began experiencing total system resets with loss of data each time. It turned out to be due to priority inversion. See the web page and the links there in the IVLE area!

CS5270 Lecture 358 Avoiding Priority inversion Disallow preemption during the execution of a critical section. –Works only if critical sections are short. –Might unneccesarily block higher priority processes that do not even use any shared resources! Resource access protocols: –Priority inheritance protocol. –Priority ceiling protocol.

CS5270 Lecture 359 Resource access - PIP

CS5270 Lecture 360 Priority Inheritance Protocol Tasks have nominal and active priorities. –Nominal priority:  assigned by the scheduling algorithm (RMS, EDF,..) – Active priority  assigned by the protocol –dynamically- to avoid priority inversion.

CS5270 Lecture 361 Priority Inheritance Protocol Basic idea : – When J i blocks higher-priority tasks, then its active priority is set to the highest of the priorities of the tasks it blocks. –J i inherits -temporarily – the highest priority of the blocked tasks. –This prevents medium priority tasks from preempting J i and prolonging the blocking duration of the higher priority tasks.

CS5270 Lecture 362 Priority Inheritance Protocol The Protocol: Jobs are scheduled based on their active priorities. If J i tries to enter a critical section and the corresponding resource is being held by J j then J i is blocked; it is said to be blocked by J j. When a job is blocked on a semaphore, it transmits its active priority to the job that holds the semaphore; in general, a task inherits the highest priority of the jobs blocked by it.

CS5270 Lecture 363 Priority Inheritance Protocol The Protocol: When J k exits a critical section, it unlocks the semaphore; the job with the highest priority that is blocked on the semaphore, if any, is awakened. The priority of J k is set to the highest priority of the job it is currently blocking. If none, its priority is set to its nominal one.

CS5270 Lecture 364 Example

CS5270 Lecture 365 Nested Critical Sections

CS5270 Lecture 366 Priority Inheritance Protocol Good news: – If there are m distinct semaphores that can block a job J then J can be blocked for at most the duration of at most one critical section, one for each of the semaphores. –It can never be as long as the WCET of a lower priority task.

CS5270 Lecture 367 Priority Inheritance Protocol Bad news: Chained Blocking: – J can get blocked on n critical sections held by n distinct lower priority jobs. Deadlocks.

CS5270 Lecture 368 Resource access - PCP

CS5270 Lecture 369 Chained Blocking

CS5270 Lecture 370 Deadlock

CS5270 Lecture 371 Priority Ceiling Protocol Extension of the Priority Inheritance Protocol. Avoids chained blocking and deadlocks. Basic Idea: –A task is not allowed to enter a critical section if there are already locked semaphores which could block it eventually (due to a sub-critical section nested within the entering critical section). –Hence, once a task enters a critical section, it can not be blocked by lower priority tasks till its completion.

CS5270 Lecture 372 Priority Ceiling Protocol The Protocol : Each semaphore S is assigned a priority ceiling C(S). It is the priority of the highest priority task that can lock S. This is a static value. Suppose J is currently running and it wants to lock the semaphore S. J is allowed to lock S only if the priority of J is strictly higher than the priority ceiling C(S’) of the semaphore S’ where: –S’ is the semaphore with the highest priority ceiling among all the semaphores which are currently locked by jobs other than J. –In this case, J is said to blocked by the semaphore S’ (and the job currently holding S’).

CS5270 Lecture 373 Priority Ceiling Protocol The Protocol : When J gets blocked by S’ then the priority of J is transmitted to the job that currently holds S’. When J’ leaves a critical section guarded by S’ then it unlocks S’ and the highest priority job, if any, which is blocked by S’ is awakened. The priority of J’ is set to the highest priority of the job that is blocked by some semaphore that J’ is still holding. If none, the priority of J’ is set to be its nominal one.

CS5270 Lecture 374 Example

CS5270 Lecture 375 C (S0) = P0 C(S1) = P0 C(S2) = P1 Example

CS5270 Lecture 376 C (S0) = ? C(S1) = ? C(S2) = ? Example

CS5270 Lecture 377 t2 t2 : J1 can not lock S2. Currently J2 is holding S2 and C(S2) = P1 and the current priority of J1 is also P1.

CS5270 Lecture 378 t5 t5 : J0 can not lock S0. Currently J2 is holding S2 and S1 and C(S1) = P0 and the current priority of J0 is also P0. The (inherited) priority of J2 is now P0.

CS5270 Lecture 379 t6 t6 : J2 unlocks S1. It awakens J0. But J2’s (inherited) priority is now only P1 while P0 > C(S2) = P1. So J0 preempts J2 and runs to completion.

CS5270 Lecture 380 t7 t7 : J2 resumes execution with priority P1.

CS5270 Lecture 381 t8 t8 : J2 unlocks S2 and goes back to its nominal priority P2. So J1 preempts J0 and runs to completion.

CS5270 Lecture 382 Two Key Properties Under priority ceiling protocol, a job can be blocked for at most the duration of one critical section. The priority ceiling protocol prevents deadlocks.