**5.1 Mode changes with deadlines less than or equal to periods**

We must find the WCRT for both old-mode tasks and new-mode tasks defined in the mode-change model. We first consider analysis for the old-mode task set. The analysis gives exact (both necessary and sufficient) bounds on the worst-case response time of each task.

In the second case ( eq. 5), *wrem* ≥ *Cj* and there is another full execution of the task within *wrem*: it is not really necessary to abort the task. The remaining time is greater than *Cj* but less than the period. Again the interference is the minimum value between *Cj* and *wrem*. Once the task completes there is no further releases in the remaining time. Therefore, the amount of interference is *Cj*. In any case, the partial interference is always the minimum of the intervals

Schedulability Analysis of Mode Changes with Arbitrary Deadlines 55

*x* −

*Cj* <sup>+</sup> min

Combining both terms (6) and (2), the total interference from higher-priority aborted tasks

Higher-priority new-mode tasks do not preserve their mode-change periodicity. The analysis must account for the fact that these tasks are released with an offset *Yj* from the *MCR*. Their

As discussed in section 3, unchanged new-mode tasks preserve the mode-change periodicity.

Combining all the interference terms, we obtain the total interference suffered from the

*wi*(*x*) − � *<sup>x</sup>*

*Cj* <sup>+</sup> min

∀ *τj*(*U*) *hp τ<sup>i</sup>*

*Cj* + ∑

*Tj*

*x* −

*Tj*

*wi* − *x* − *Yj Tj*

 *x Tj*  *Tj*, *Cj* 

*x* −

 *x Tj*

0

�*Tj* − *Zj*

 *x Tj*  *Tj*, *Cj*

*wi*(*x*) − � *<sup>x</sup>*

 +

�*Tj* − *Zj*

0

*Cj* (10)

*Tj*

*Tj*

0

 *Tj*, *Cj* *Cj* (8)

*Cj* (9)

(6)

(7)

*wrem* and *Cj*. Therefore, the amount of partial (or aborted) interference is given by:

*Ihp*(*A*)*rem* <sup>=</sup> min

 *<sup>x</sup> Tj*

interference interval is therefore reduced to *wi* − *x* − *Yj* and expressed as:

*Ihp*(*N*) = ∑

5.1.1.4 Interference from higher-priority unchanged new-mode tasks

This term is derived by Real & Crespo (2004), and given by:

*Ihp*(*N*)<sup>−</sup> *per* <sup>=</sup> ∑

*Cj* + ∑

∀ *τj*(*A*) *hp τ<sup>i</sup>*

*wi* − *x* − *Yj Tj*

old-mode task *τ<sup>i</sup>* across the mode change:

∑ ∀ *τj*(*N*) *hp τ<sup>i</sup>*

 *x Tj*

*Imc* = ∑

∀ *τj*(*O*) *hp τ<sup>i</sup>*

∀ *τj*(*N*) *hp τ<sup>i</sup>*

∀ *τj*(*U*) *hp τ<sup>i</sup>*

 *<sup>x</sup> Tj*

0

*Ihp*(*A*) = ∑

5.1.1.3 Interference from higher-priority new-mode tasks

∀ *τj*(*A*) *hp τ<sup>i</sup>*

is:

#### **5.1.1 Analysis of old-mode tasks**

Old-mode tasks suffer the interference from higher-priority aborted tasks before the mode change, and from higher-priority completed tasks before and after the mode change (Fig. 1). During the mode change, old-mode tasks are also preempted by higher-priority new-mode tasks. Clearly, there is no interference from aborted tasks during the transition. We now show the interference terms for each type of task.

#### 5.1.1.1 Interference from higher-priority old-mode completed tasks

Old-mode, higher-priority completed tasks *τ<sup>j</sup>* will interfere with task *τ<sup>i</sup>* mostly over the interval *x*. This interference extends to the mode-change window as the higher-priority tasks still run in order to complete their execution. The total interference is formulated as the ceiling function of *x*/*Tj* as follows:

$$I\_{hp(O)} = \sum\_{\forall \ \tau\_{f(O)} \ hp \ \tau\_{\forall}} \left[ \frac{x}{T\_j} \right] \mathbf{C}\_j \tag{1}$$

#### 5.1.1.2 Interference from higher-priority aborted tasks

Aborted tasks will interfere over a lower-priority task *τ<sup>i</sup>* during the interval *x*. Within the interval *x* there is an integral number of periods *Tj* of the higher-priority aborted task *τj*, and therefore a set of instances that complete their execution. It is only the last release that runs across the *MCR* and has to be aborted. The interference from completed releases of task *τ<sup>j</sup>* before the *MCR* is given by:

$$\sum\_{\mathbf{r}\_{j\in\mathsf{T}\_{j(A)}}\triangleq\mathsf{h}p\ \mathsf{T}\_{l}} \left\lfloor \frac{\mathbf{x}}{T\_{j}} \right\rfloor \mathsf{C}\_{j} \tag{2}$$

We also need to consider the amount of aborted execution time of a higher-priority task in the old mode: This occurs during the remaining time *wrem*, which is a fraction of the period of the aborted task preceding the *MCR*, and is given by:

$$w\_{rem} = \propto - \left\lfloor \frac{\chi}{T\_j} \right\rfloor T\_j \tag{3}$$

The *remaining time wrem* can be large enough to: 1) allow only a partial execution of the task *τ<sup>j</sup>* (equation (4)), since *wrem* < *Cj*, or 2) accommodate an additional execution of the higher-priority aborted task (equation (5)), since *wrem* ≥ *Cj*):

$$0 < x \quad -\left\lfloor \frac{x}{T\_j} \right\rfloor T\_j < C\_j \tag{4}$$

$$\mathbf{C}\_{\bar{j}} \le \mathbf{x} - \left\lfloor \frac{\mathbf{x}}{T\_{\bar{j}}} \right\rfloor T\_{\bar{j}} \le T\_{\bar{j}} \tag{5}$$

In the first case (eq. 4), *wrem* < *Cj* and the interference is the minimum value between *Cj* and *wrem*, since there is only a partial execution of the aborted task (i.e. *Ihp*(*A*)*rem* = min(*wrem*, *Cj*). 8 Real Time System

Old-mode tasks suffer the interference from higher-priority aborted tasks before the mode change, and from higher-priority completed tasks before and after the mode change (Fig. 1). During the mode change, old-mode tasks are also preempted by higher-priority new-mode tasks. Clearly, there is no interference from aborted tasks during the transition. We now show

Old-mode, higher-priority completed tasks *τ<sup>j</sup>* will interfere with task *τ<sup>i</sup>* mostly over the interval *x*. This interference extends to the mode-change window as the higher-priority tasks still run in order to complete their execution. The total interference is formulated as the ceiling

∀ *τj*(*O*) *hp τ<sup>i</sup>*

Aborted tasks will interfere over a lower-priority task *τ<sup>i</sup>* during the interval *x*. Within the interval *x* there is an integral number of periods *Tj* of the higher-priority aborted task *τj*, and therefore a set of instances that complete their execution. It is only the last release that runs across the *MCR* and has to be aborted. The interference from completed releases of task *τ<sup>j</sup>*

> *x Tj*

> > *x Tj*

We also need to consider the amount of aborted execution time of a higher-priority task in the old mode: This occurs during the remaining time *wrem*, which is a fraction of the period of the

The *remaining time wrem* can be large enough to: 1) allow only a partial execution of the task *τ<sup>j</sup>* (equation (4)), since *wrem* < *Cj*, or 2) accommodate an additional execution of the

> *x Tj*

> > *x Tj*

In the first case (eq. 4), *wrem* < *Cj* and the interference is the minimum value between *Cj* and *wrem*, since there is only a partial execution of the aborted task (i.e. *Ihp*(*A*)*rem* = min(*wrem*, *Cj*).

∑ ∀ *τj*(*A*) *hp τ<sup>i</sup>*

*wrem* = *x* −

0 < *x* −

*Cj* ≤ *x* −

 *x Tj* *Cj* (1)

*Cj* (2)

*Tj* (3)

*Tj* < *Cj* (4)

*Tj* ≤ *Tj* (5)

*Ihp*(*O*) = ∑

**5.1.1 Analysis of old-mode tasks**

function of *x*/*Tj* as follows:

before the *MCR* is given by:

the interference terms for each type of task.

5.1.1.1 Interference from higher-priority old-mode completed tasks

5.1.1.2 Interference from higher-priority aborted tasks

aborted task preceding the *MCR*, and is given by:

higher-priority aborted task (equation (5)), since *wrem* ≥ *Cj*):

In the second case ( eq. 5), *wrem* ≥ *Cj* and there is another full execution of the task within *wrem*: it is not really necessary to abort the task. The remaining time is greater than *Cj* but less than the period. Again the interference is the minimum value between *Cj* and *wrem*. Once the task completes there is no further releases in the remaining time. Therefore, the amount of interference is *Cj*. In any case, the partial interference is always the minimum of the intervals *wrem* and *Cj*. Therefore, the amount of partial (or aborted) interference is given by:

$$I\_{hp(A)rem} = \min\left(\mathbf{x} - \left\lfloor \frac{\mathbf{x}}{T\_j} \right\rfloor T\_{j\prime} \mathbf{C}\_j \right) \tag{6}$$

Combining both terms (6) and (2), the total interference from higher-priority aborted tasks is:

$$I\_{hp(A)} = \sum\_{\forall \ \pi\_{j(A)} \text{ } hp \ \pi\_i} \left( \left\lfloor \frac{\ge}{T\_j} \right\rfloor \mathbb{C}\_j + \min \left( \ge - \left\lfloor \frac{\ge}{T\_j} \right\rfloor T\_j, \mathbb{C}\_j \right) \right) \tag{7}$$

#### 5.1.1.3 Interference from higher-priority new-mode tasks

Higher-priority new-mode tasks do not preserve their mode-change periodicity. The analysis must account for the fact that these tasks are released with an offset *Yj* from the *MCR*. Their interference interval is therefore reduced to *wi* − *x* − *Yj* and expressed as:

$$I\_{hp(N)} = \sum\_{\forall \ \tau\_{f(N)} \ hp \ \tau\_i} \left[ \frac{w\_i - \ x - Y\_j}{T\_j} \right]\_0 \mathbf{C}\_j \tag{8}$$

#### 5.1.1.4 Interference from higher-priority unchanged new-mode tasks

As discussed in section 3, unchanged new-mode tasks preserve the mode-change periodicity. This term is derived by Real & Crespo (2004), and given by:

$$I\_{hp(N)\_-per} = \sum\_{\forall \ \mathbf{r}\_{j(\mathcal{U})} \text{ } hp \ \mathbf{r}\_i} \left[ \frac{w\_i(\mathbf{x}) - \lceil \frac{\mathbf{x}}{T\_j} \rceil T\_j - Z\_j}{T\_j} \right] \mathbf{C}\_j \tag{9}$$

Combining all the interference terms, we obtain the total interference suffered from the old-mode task *τ<sup>i</sup>* across the mode change:

$$I\_{\rm mc} = \sum\_{\forall \begin{subarray}{c} \tau\_{j(\rm O)} \ hp \ \tau\_{i} \end{subarray}} \left[ \frac{\mathbf{x}}{T\_{j}} \right] \mathbf{C}\_{j} + \sum\_{\forall \begin{subarray}{c} \tau\_{j(\rm O)} \ hp \ \tau\_{i} \end{subarray}} \left( \left\lfloor \frac{\mathbf{x}}{T\_{j}} \right\rfloor \mathbf{C}\_{j} + \min\left( \mathbf{x} - \left\lfloor \frac{\mathbf{x}}{T\_{j}} \right\rfloor T\_{j}, \mathbf{C}\_{j} \right) \right) +$$

$$\sum\_{\forall \begin{subarray}{c} \tau\_{\rm f(\rm O)} \ hp \ \tau\_{i} \end{subarray}} \left[ \frac{w\_{i} - \mathbf{x} - Y\_{j}}{T\_{j}} \right] \mathbf{C}\_{j} + \sum\_{\forall \begin{subarray}{c} \tau\_{j(\rm O)} \ hp \ \tau\_{i} \end{subarray}} \left[ \frac{w\_{i}(\mathbf{x}) - \left\lceil \frac{\mathbf{x}}{T\_{j}} \right\rceil T\_{j} - Z\_{j}}{T\_{j}} \right] \mathbf{C}\_{j} \tag{10}$$

**5.2 Mode-changes with arbitrary deadlines**

from higher-priority computation (*Ihp*), as follows:

beginning and end of the busy period regarding a mode change.

1994):

Lehoczky describes qualitative analysis which can determine the worst-case response time of a given task with such arbitrary deadlines (Lehoczky, 1990). Tindell et al. (1994) derived analysis from that of M. & Pandya (1986) and using the approach of Lehoczky, for static priority pre-emptive systems that permit tasks to have arbitrary deadlines, release jitter, and behave as sporadically periodic tasks. His analysis illustrates how using a window approach to finding worst-case response times for these tasks is an appropriate way of obtaining an analysis tailored to the behavior of real-time tasks. In single mode, steady-state systems, the busy period *wi*,*<sup>q</sup>* for a task *τ<sup>i</sup>* with arbitrary deadlines is calculated as follows (Tindell et al.,

Schedulability Analysis of Mode Changes with Arbitrary Deadlines 57

Where the term *Ihp* is the interference from higher-priority tasks, and *q* is the number of instances of task *τ<sup>i</sup>* during the *busy period*. Equation 15 is the basis to extend current analysis of mode changes to allow arbitrary deadlines. Therefore, for the analysis of mode changes with arbitrary deadlines, we need to: 1) review the notion of busy period in the light of mode changes, specifically the definition of the beginning and end of the busy period; 2) find the number of instances *q* of a task *τ<sup>i</sup>* to be analyzed, and 3) determine the amount of interference

• *Busy periods*: A *level-i* busy period is defined as *the maximum time for which a processor executes tasks of priority greater than or equal to the priority of task τi*. Lehoczky shows how the worst-case response time of a task *τ<sup>i</sup>* can be found by examining a number of busy periods, each starting at an arrival of task *τ<sup>i</sup>* (hence some multiple of *Ti* before the current invocation of task *τ<sup>i</sup>* ). The busy period ends when a lower-priority task is able to begin execution. To find the worst-case response time, all invocations of task *τ<sup>i</sup>* in this busy period must be examined. In Fig. 2 task *τ<sup>i</sup>* completes when the given busy period finishes, but arrives at some point in time after the start of the busy period. By knowing the width of the busy period and when the busy period starts (relative to arrival of task *τi*) then we can find the corresponding response time. The width of the busy period is equal to the higher-priority computation that is released in it. The WCRT of task *τ<sup>i</sup>* is the longest of the response times corresponding to each of the examined busy periods. In the next section we discuss the

• *Number of instances to analyze*: If a task has a *WCRT* greater than its period, then the possibility exists for a task to re-arrive before the previous invocation has completed. In this case we assume that the new arrival is deemed to have a lower priority, and is therefore delayed from executing until after the previous invocation terminates. Fig. 3 illustrates the response time of a task *τi*, with its deadline larger than its period, executing across a mode change as an old-mode completed task. The *MCR* arrives during the execution of an arbitrary invocation of task *τi*. To facilitate the analysis we assume, without loss of generality, that the *MCR* arrives while the third invocation of task *τ<sup>i</sup>* is under execution. In a busy period without a mode change, the 4*th* and 5*th* invocations are released and execute regularly. However, with the arrival of a *MCR*, the 4*th* and the 5*th* invocations do not need to be released anymore, according to the mode-change model. The cancellation of both the 4*th* and the 5*th* releases will shorten the length of the busy period, causing the lower-priority task (*task low*) to begin execution earlier. Therefore, we need to apply the

*wi*,*<sup>q</sup>* = (*q* + 1)*Ci* + *Ihp* (15)

By adding the Worst-Case Execution Time (WCET) *Ci* of the old-mode task being analyzed, we obtain the *WCRT* of task *τ<sup>i</sup>* as follows:

$$\begin{split} w\_{i}(\mathbf{x}) &= \mathbb{C}\_{i} + \sum\_{\forall \ \tau\_{j(\mathbf{O})} \ hp \ \tau\_{i}} \left[ \frac{\mathbf{x}}{T\_{j}} \right] \mathbb{C}\_{j} + \sum\_{\forall \ \tau\_{j(\mathbf{A})} \ hp \ \tau\_{i}} \left[ \frac{\mathbf{x}}{T\_{j}} \right] \mathbb{C}\_{j} + \min \left( \mathbf{x} - \left\lfloor \frac{\mathbf{x}}{T\_{j}} \right\rfloor T\_{j}, \mathbf{C}\_{j} \right) + \\ &\quad \sum\_{\forall \ \tau\_{\overline{j}(\mathbf{O})} \ hp \ \tau\_{\overline{i}}} \left[ \frac{w\_{i} - \mathbf{x} - Y\_{\overline{j}}}{T\_{\overline{j}}} \right] \mathbb{C}\_{j} + \sum\_{\forall \ \tau\_{\overline{j}(\mathbf{O})} \ hp \ \tau\_{\overline{i}}} \left[ \frac{w\_{i}(\mathbf{x}) - \left\lceil \frac{\mathbf{x}}{T\_{\overline{j}}} \right\rceil T\_{\overline{j}} - Z\_{\overline{j}}}{T\_{\overline{j}}} \right] \mathbb{C}\_{j} \end{split}$$

The solution to equation (11) is obtained by forming a recurrence equation on *wi*, to find the smallest positive integer that satisfies it. Since many values of *x* give the same WCRT, the significant values of *x* are the ones that lead to new values for the ceiling and floor functions. The set of significant values *x* is the set of all positive values in the domain of *wi*(*x*) such that:

$$\begin{aligned} \text{fix } \varepsilon \left( 0, \varepsilon, T\_{\dot{\jmath}} + \varepsilon, \mathfrak{T}T\_{\dot{\jmath}} + \varepsilon, \mathfrak{T}T\_{\dot{\jmath}} + \mathfrak{e}, \dots \mathfrak{R}\_{i}^{\text{ss}} \right) \forall \ \mathfrak{r}\_{\dot{\jmath}(O)} \ h p \ \mathfrak{r}\_{\dot{\imath}} \text{ and} \\ \text{x } \varepsilon \left( 0, \mathbb{C}\_{\dot{\jmath}}, T\_{\dot{\jmath}} + \mathbb{C}\_{\dot{\jmath}}, \mathfrak{T}T\_{\dot{\jmath}} + \mathbb{C}\_{\dot{\jmath}}, \dots \mathbb{R}\_{i}^{\text{ss}} \right) \forall \ \mathfrak{r}\_{\dot{\jmath}(A)} \ h p \ \mathfrak{r}\_{\dot{\imath}} \end{aligned} \tag{12}$$

where *�* is the time quantum, which we assume to be 1 and *Rss <sup>i</sup>* is the steady-state WCRT of task *τi*.

#### **5.1.2 Analysis of new-mode tasks**

In the worst-case scenario, all old-mode tasks are released momentarily before the mode change, thus sharing a critical instant with the window *wi*. The interference from higher-priority new-mode tasks upon a new-mode task *τ<sup>i</sup>* must account for the offset of the interfering task, during which there is no interference. The interference from unchanged new-mode tasks must account for the offset *Zj*, from the end of the period of the preceding old-mode version. The worst-case response time of a new-mode task across a mode change is given by: (Pedro & Burns, 1998; Real & Crespo, 2004)

$$\begin{aligned} \left| w\_i \right| &= \mathbf{C}\_{i(N)} + \sum\_{\forall \ \tau\_{j(\mathcal{O})} \, hp} \mathbf{C}\_{\bar{f}} + \sum\_{\forall \ \tau\_{j(N)} \, hp} \left[ \frac{w\_i - Y\_j}{T\_j} \right]\_0 \mathbf{C}\_j + \\ &\quad \sum\_{\forall \ \tau\_{j(\mathcal{O})} \, hp} \left( \mathbf{C}\_j + \left[ \frac{w\_i - T\_j - Z\_j}{T\_j} \right]\_0 \mathbf{C}\_j \right) \end{aligned} (13)$$

This equation must also be solved using recurrence relation as before. Considering that task *τ<sup>i</sup>* is released with an offset *Yi* after the mode change, then to obtain the value of *Ri* window *wi* must be decreased by *Yi*:

$$R\_i = w\_i - \, \text{Y}\_i \tag{14}$$

If the expression *wi* − *Ci*(*n*) ≤ *Yi* holds, the amount of interference over new-mode task *τ<sup>i</sup>* is smaller than the value of its mode-change offset *Yi*. Therefore, the new-mode task *τ<sup>i</sup>* is released in the steady state after all old-mode tasks have completed.

We now turn to the analysis of tasks across a mode change with arbitrary deadlines.

#### **5.2 Mode-changes with arbitrary deadlines**

10 Real Time System

By adding the Worst-Case Execution Time (WCET) *Ci* of the old-mode task being analyzed,

 *x Tj*

*Cj* + ∑

The solution to equation (11) is obtained by forming a recurrence equation on *wi*, to find the smallest positive integer that satisfies it. Since many values of *x* give the same WCRT, the significant values of *x* are the ones that lead to new values for the ceiling and floor functions. The set of significant values *x* is the set of all positive values in the domain of *wi*(*x*) such that:

*<sup>i</sup>* ) ∀ *τj*(*O*) *hp τ<sup>i</sup>* and

In the worst-case scenario, all old-mode tasks are released momentarily before the mode change, thus sharing a critical instant with the window *wi*. The interference from higher-priority new-mode tasks upon a new-mode task *τ<sup>i</sup>* must account for the offset of the interfering task, during which there is no interference. The interference from unchanged new-mode tasks must account for the offset *Zj*, from the end of the period of the preceding old-mode version. The worst-case response time of a new-mode task across a mode change is

∀ *τj*(*U*) *hp τ<sup>i</sup>*

*x �* (0, *Cj*, *Tj* + *Cj*, 2*Tj* + *Cj*, ..*Rss*

*Cj* + min

 *x* −

*wi*(*x*) − � *<sup>x</sup>*

 *x Tj*

*Tj*

*Tj*

 *Tj*, *Cj* +

�*Tj* − *Zj*

0

*<sup>i</sup>* ) ∀ *τj*(*A*) *hp τ<sup>i</sup>* (12)

*<sup>i</sup>* is the steady-state WCRT of

*Cj* (11)

we obtain the *WCRT* of task *τ<sup>i</sup>* as follows:

∀ *τj*(*O*) *hp τ<sup>i</sup>*

∑ ∀ *τj*(*N*) *hp τ<sup>i</sup>*

*x �* (0, *�*, *Tj* + *�*, 2*Tj* + *�*, 3*Tj* + *�*, ..*Rss*

**5.1.2 Analysis of new-mode tasks**

*wi* = *Ci*(*N*) + ∑

*wi* must be decreased by *Yi*:

 *x Tj*

*wi* − *x* − *Yj Tj*

where *�* is the time quantum, which we assume to be 1 and *Rss*

given by: (Pedro & Burns, 1998; Real & Crespo, 2004)

*Cj* + ∑

released in the steady state after all old-mode tasks have completed.

∀ *τj*(*N*) *hp τ<sup>i</sup>*

*wi* − *Yj Tj*

This equation must also be solved using recurrence relation as before. Considering that task *τ<sup>i</sup>* is released with an offset *Yi* after the mode change, then to obtain the value of *Ri* window

If the expression *wi* − *Ci*(*n*) ≤ *Yi* holds, the amount of interference over new-mode task *τ<sup>i</sup>* is smaller than the value of its mode-change offset *Yi*. Therefore, the new-mode task *τ<sup>i</sup>* is

We now turn to the analysis of tasks across a mode change with arbitrary deadlines.

∑ ∀ *τj*(*U*) *hp τ<sup>i</sup>*

0 *Cj* +

> *Cj* +

 *wi* <sup>−</sup> *Tj* <sup>−</sup> *Zj Tj*

*Ri* = *wi* − *Yi* (14)

0 *Cj* 

(13)

∀ *τj*(*O*) *hp τ<sup>i</sup>*

*Cj* + ∑

∀ *τj*(*A*) *hp τ<sup>i</sup>*

0

*wi*(*x*) = *Ci* + ∑

task *τi*.

Lehoczky describes qualitative analysis which can determine the worst-case response time of a given task with such arbitrary deadlines (Lehoczky, 1990). Tindell et al. (1994) derived analysis from that of M. & Pandya (1986) and using the approach of Lehoczky, for static priority pre-emptive systems that permit tasks to have arbitrary deadlines, release jitter, and behave as sporadically periodic tasks. His analysis illustrates how using a window approach to finding worst-case response times for these tasks is an appropriate way of obtaining an analysis tailored to the behavior of real-time tasks. In single mode, steady-state systems, the busy period *wi*,*<sup>q</sup>* for a task *τ<sup>i</sup>* with arbitrary deadlines is calculated as follows (Tindell et al., 1994):

$$w\_{i,q} = (q+1)\mathbf{C}\_i + I\_{hp} \tag{15}$$

Where the term *Ihp* is the interference from higher-priority tasks, and *q* is the number of instances of task *τ<sup>i</sup>* during the *busy period*. Equation 15 is the basis to extend current analysis of mode changes to allow arbitrary deadlines. Therefore, for the analysis of mode changes with arbitrary deadlines, we need to: 1) review the notion of busy period in the light of mode changes, specifically the definition of the beginning and end of the busy period; 2) find the number of instances *q* of a task *τ<sup>i</sup>* to be analyzed, and 3) determine the amount of interference from higher-priority computation (*Ihp*), as follows:


MODE-CHANGE REQUEST (MCR) OLD MODE NEW MODE

Schedulability Analysis of Mode Changes with Arbitrary Deadlines 59

MODE CHANGE

Ti

not released

Ti

time

(16)

T

WHOLLY-NEW TASK <sup>Y</sup>

Ti

x

Ti

TASK HIGH

TASK i

TASK LOW

Fig. 3. Mode-Change with Arbitrary Deadlines

invocations of task i

Level i busy period

From the definition of latency of mode changes (section 3), it follows that the end of the busy period falls inside the mode-change window. This is because task *τlow* is an old-mode completed and the mode change is not over until all the old-mode tasks have completed.

Consider the three instances of task *τ<sup>i</sup>* before the *MCR* in Fig. 3. Instances 1 and 2 are called the steady-mode instances, since they are released and completed before the *MCR*. We are interested in finding the *WCRT* for the third instance, the *old-mode completed instance*, which runs across the *MCR* and executes through the mode change. When the old-mode completed invocation begins, the steady-mode invocations have already completed. Therefore, their

By defining the beginning and the end of the busy period as above we can reuse the work from Pedro & Burns (1998) and Real (2000) by including in their analysis the multiple *WCET*s introduced by the steady-mode releases (i.e. previous invocations of task *τi*) during window *x*. In our example, the third invocation is delayed by the first and second invocations.

There are no further releases of the old-mode completed task after the *MCR*, according to the mode-change protocol. As we increase the value of *x* in the analysis, more steady-state invocations of task *τ<sup>i</sup>* appear before the *MCR*, potentially delaying the old-mode completed task *τi*. The impact of a mode change on the analysis of old-mode tasks is that there are less releases of task *τ<sup>i</sup>* to be analyzed than in steady-state analysis. The number of instances *q* of

> *x Ti*

*qi* =

schedulability is guaranteed by steady-state analysis (Audsley et al., 1993).

task *τ<sup>i</sup>* that need to be analyzed before the mode change is given by:

1st 2nd 3rd 4th 5th

Ti

Fig. 2. A level *i* busy period (Lehoczky, 1990), (Tindell et al., 1994)

schedulability analysis only for the first three invocations. However, it is only the third invocation that needs to be analyzed using mode-change analysis. The first and second invocations can be analyzed using the steady-state equations derived by Tindell et al. (1994).

• *Higher-priority interference*: Fig. 2 also illustrates a higher-priority unchanged task (*Thigh*). Clearly, other types of tasks such as wholly new and changed new-mode tasks may interfere with the execution of task *τi*. While an invocation of *Thigh* may be delayed by a previous invocation, the number of instances of *Thigh* interfering with task *τ<sup>i</sup>* is not affected by the introduction of arbitrary deadlines. Therefore, the calculation of higher-priority computation under the assumption of arbitrary deadlines remains the same as the one from previous work (Real & Crespo, 2004).

We now look at the analysis of old-mode tasks.

### **5.2.1 Analysis of old-mode tasks**

We begin by extending the notion of busy period for old-mode tasks: *A level "i" busy period for an old-mode task across a mode change is defined as the maximum time for which a processor executes tasks of priority greater than or equal to the priority of task. A busy period begins at a time x before the arrival of a mode-change request* (*MCR*)*. The busy period ends during the transition, with the completion of the last invocation q of task τ<sup>i</sup> before the steady-state new mode, when a lower-priority task is able to begin execution.*

12 Real Time System

Level i busy period

schedulability analysis only for the first three invocations. However, it is only the third invocation that needs to be analyzed using mode-change analysis. The first and second invocations can be analyzed using the steady-state equations derived by Tindell et al.

• *Higher-priority interference*: Fig. 2 also illustrates a higher-priority unchanged task (*Thigh*). Clearly, other types of tasks such as wholly new and changed new-mode tasks may interfere with the execution of task *τi*. While an invocation of *Thigh* may be delayed by a previous invocation, the number of instances of *Thigh* interfering with task *τ<sup>i</sup>* is not affected by the introduction of arbitrary deadlines. Therefore, the calculation of higher-priority computation under the assumption of arbitrary deadlines remains the same as the one

We begin by extending the notion of busy period for old-mode tasks: *A level "i" busy period for an old-mode task across a mode change is defined as the maximum time for which a processor executes tasks of priority greater than or equal to the priority of task. A busy period begins at a time x before the arrival of a mode-change request* (*MCR*)*. The busy period ends during the transition, with the completion of the last invocation q of task τ<sup>i</sup> before the steady-state new mode, when a lower-priority*

1st 2nd 3rd 4th 5th

Ti

Ti

Ci

Ti

time

T

Ti

Ti

Fig. 2. A level *i* busy period (Lehoczky, 1990), (Tindell et al., 1994)

from previous work (Real & Crespo, 2004).

We now look at the analysis of old-mode tasks.

**5.2.1 Analysis of old-mode tasks**

*task is able to begin execution.*

TASK HIGH

TASK i

TASK LOW

(1994).

invocations of task i

Fig. 3. Mode-Change with Arbitrary Deadlines

From the definition of latency of mode changes (section 3), it follows that the end of the busy period falls inside the mode-change window. This is because task *τlow* is an old-mode completed and the mode change is not over until all the old-mode tasks have completed.

Consider the three instances of task *τ<sup>i</sup>* before the *MCR* in Fig. 3. Instances 1 and 2 are called the steady-mode instances, since they are released and completed before the *MCR*. We are interested in finding the *WCRT* for the third instance, the *old-mode completed instance*, which runs across the *MCR* and executes through the mode change. When the old-mode completed invocation begins, the steady-mode invocations have already completed. Therefore, their schedulability is guaranteed by steady-state analysis (Audsley et al., 1993).

By defining the beginning and the end of the busy period as above we can reuse the work from Pedro & Burns (1998) and Real (2000) by including in their analysis the multiple *WCET*s introduced by the steady-mode releases (i.e. previous invocations of task *τi*) during window *x*. In our example, the third invocation is delayed by the first and second invocations.

There are no further releases of the old-mode completed task after the *MCR*, according to the mode-change protocol. As we increase the value of *x* in the analysis, more steady-state invocations of task *τ<sup>i</sup>* appear before the *MCR*, potentially delaying the old-mode completed task *τi*. The impact of a mode change on the analysis of old-mode tasks is that there are less releases of task *τ<sup>i</sup>* to be analyzed than in steady-state analysis. The number of instances *q* of task *τ<sup>i</sup>* that need to be analyzed before the mode change is given by:

$$q\_i = \left\lceil \frac{\mathbf{x}}{T\_i} \right\rceil \tag{16}$$

As seen in section 5.2, the pattern of interference from higher computation over *τ<sup>i</sup>* is not affected by the introduction of arbitrary deadlines. As with the analysis for old-mode tasks, the new-mode task is delayed by its previous invocations. Therefore, equation (13) is

Schedulability Analysis of Mode Changes with Arbitrary Deadlines 61

*wi* − *Yj Tj*

�, in the analysis of new-mode tasks the number of instances *q* to be inspected

∑ ∀ *τj*(*U*) *hp τ<sup>i</sup>* 0 *Cj*+

*wi*(*q*) < (*q* + 1)*Ti* (22)

*Ri* = *wi*,*<sup>q</sup>* − *qt* − *Yi* (23)

 *wi* <sup>−</sup> *Tj* <sup>−</sup> *Zj Tj*

0 *Cj* 

(21)

 *Cj* +

reformulated as follows:

examined by � *<sup>x</sup>*

**6. Example**

*wi* = (*q* + 1)*Ci*(*N*) + ∑

*Ti*

over increasing values of *q* can stop if:

∀ *τj*(*O*) *hp τ<sup>i</sup>*

*Cj* + ∑

∀ *τj*(*N*) *hp τ<sup>i</sup>*

Unlike the analysis of old-mode tasks, which limits the number of busy periods to be

has no direct correlation with the beginning or end of the mode change. The above iteration

The first *qT* of level *i* busy period falls before the current invocation of task *τ<sup>i</sup>* is released. The response time corresponding to the given level *i* busy period starting time *qt* before the current invocation of task *τ<sup>i</sup>* is therefore given by: *wi*,*<sup>q</sup>* − *qt*. The response time can occur at

Where *q* = {0, 1, 2...}. This equation specifies an infinite number of busy periods. Only a finite number need to be examined because the search can stop if a level *i* busy period is found which finishes before the invocation of task *τ<sup>i</sup>* following the current one. The longest

In this section we present an example of the mode change analysis based upon the Generic Avionics Platform (GAP) task set described by Locke et al. (1991). We consider the example of two modes of aircraft operation: *Level flight* and *Defense Mode*, described in tables 1 and 2 respectively (Pedro, 1999), and we analyze the schedulability of the transition from level-flight to defense mode. The level-flight mode contains four tasks which are not originally defined in the GAP set: auto−pilot, mission−advisor, fuelling−management and display−graphic−2. The task set used in the defense mode is the original task set defined (Locke et al., 1991),

Tasks printed in boldface in table 1 denote completed old-mode tasks that are replaced by the corresponding boldfaced wholly-new tasks in table 2 (e.g. Weapon−Release replaces Auto−Pilot). Tasks in the defense mode are carried out as new-mode changed tasks. Display <sup>−</sup>Hook−Update is an aborted task. In order to increase the schedulability of the task set, all new-mode tasks lose their periodicity during the transition. Table 3 illustrates the

any one of these response times, and thus the worst-case response time is given by:

busy period that needs to be examined is bounded by the *LCM* of task periods.

except that the Timer−Interrupt task has been removed.

and it is only the last invocation that requires mode-change analysis. The interference suffered by the mode-changing task includes the types of tasks from the mode-change model, i.e. old-mode aborted, old-mode completed, new-mode changed, unchanged and wholly-new tasks as previously analyzed. Taking these remarks into consideration, the analysis of a mode-change for an old-mode task with arbitrary deadlines is given by:

$$w\_{l}(\mathbf{x}) = (q+1)\mathbf{C}\_{l} + \sum\_{\forall \ \mathbf{r}\_{\bar{f}(\mathbf{c})} \; hp \ \mathbf{z}\_{l}} \left[ \frac{\mathbf{x}}{T\_{\bar{f}}} \right] \mathbf{C}\_{\bar{f}} + \sum\_{\forall \ \mathbf{r}\_{\bar{f}(\mathbf{c})} \; hp \ \mathbf{z}\_{l}} \left( \left\lfloor \frac{\mathbf{x}}{T\_{\bar{f}}} \right\rfloor \mathbf{C}\_{\bar{f}} + \min \left( \mathbf{x} - \left\lfloor \frac{\mathbf{x}}{T\_{\bar{f}}} \right\rfloor T\_{\bar{f}}, \mathbf{C}\_{\bar{f}} \right) \right) + \sum\_{\forall \ \mathbf{r}\_{\bar{f}} \; hp \ \mathbf{z}\_{l}} \left[ \mathbf{C}\_{\bar{f}} \mathbf{x} - \mathbf{C}\_{\bar{f}} \right] \right) + \sum\_{\forall \ \mathbf{r}\_{\bar{f}} \; hp \ \mathbf{z}\_{l}} \left[ \mathbf{C}\_{\bar{f}} \mathbf{x} - \mathbf{C}\_{\bar{f}} \right]\_{\mathbf{r}\_{\bar{f}}} \left[ \mathbf{C}\_{\bar{f}} \mathbf{x} - \mathbf{C}\_{\bar{f}} \right]\_{\mathbf{r}\_{\bar{f}}} \quad (27)$$

$$\sum\_{\mathbf{x}\_{i}\neq\tau\_{\hat{\eta}(\mathbf{X})}\ h p} \left[ \frac{w\_{i}(\mathbf{x}) - \mathbf{x} - \mathbf{Y}\_{j}}{T\_{j}} \right] \mathbf{C}\_{j} + \sum\_{\forall\ \tau\_{\hat{\eta}(\mathbf{U})}\ h p} \left[ \frac{w\_{i}(\mathbf{x}) - \left| \sideset{}{}{}{\mathbf{T}\_{j}}}{T\_{j}} \right| \mathbf{C}\_{j} \right] \mathbf{C}\_{j} \tag{17}$$

In single-mode, steady-state systems, windows for increasing values of *q* need to be determined. The sequence is finite, however, because the search can stop if a level *i* busy period is found which finishes before task *τ<sup>i</sup>* starts (i.e. the processor is released to process lower-priority tasks) - since the processor is executing lower priority tasks there can be no impact on task *τ<sup>i</sup>* from previous invocations of task *τ<sup>i</sup>* in busy periods starting earlier. The above iteration over increasing values of *q* can stop if:

*wi*(*q*) < (*q* + 1)*Ti* (18)

The response time corresponding to the window starting q*Ti* before the current invocation of task *τ<sup>i</sup>* is therefore given by:

$$(w\_i(q) - qT\_i) \tag{19}$$

Now, as mentioned above, the worst-case response time can occur at any one of these response times, and thus the WCRT is given by:

$$r\_i = \max(w\_i(q) - qT\_i) \quad q = 1, 2, 3... \left\lceil \frac{\chi}{T\_i} \right\rceil \tag{20}$$

In the analysis with arbitrary deadlines and single mode systems, windows for increasing values of *q* need to be determined; variable *x* is not present in the analysis. In the WCRT analysis of mode changes with deadlines less than or equal to periods we need to apply all significant values of *x*, and the analysis is not a function of *q*. Clearly, the analysis of tasks with arbitrary deadlines across a mode change is a function of both *x* and *q*, and *q* is limited by *x* (for old-mode tasks).

#### **5.2.2 Analysis of new-mode tasks**

A level *i* busy period for a new-mode task is defined as: *The maximum time for which a processor executes tasks of priority greater than or equal to the priority of task τi. A busy period begins with the arrival of a mode-change request MCR. It ends when a task with lower priority than τ<sup>i</sup> is able to begin execution during the mode-change window.*

As seen in section 5.2, the pattern of interference from higher computation over *τ<sup>i</sup>* is not affected by the introduction of arbitrary deadlines. As with the analysis for old-mode tasks, the new-mode task is delayed by its previous invocations. Therefore, equation (13) is reformulated as follows:

$$\begin{aligned} w\_{\boldsymbol{i}} &= (q+1)\mathbf{C}\_{\boldsymbol{i}(N)} + \sum\_{\forall \ \boldsymbol{\tau}\_{\boldsymbol{j}(\boldsymbol{\ell})} \text{ } \boldsymbol{h}p \text{ } \boldsymbol{\tau}\_{\boldsymbol{\ell}}} \mathbf{C}\_{\boldsymbol{j}} + \sum\_{\forall \ \boldsymbol{\tau}\_{\boldsymbol{j}(\boldsymbol{N})} \text{ } \boldsymbol{h}p \text{ } \boldsymbol{\tau}\_{\boldsymbol{\ell}}} \left[ \frac{w\_{\boldsymbol{i}} - \boldsymbol{Y}\_{\boldsymbol{j}}}{T\_{\boldsymbol{j}}} \right]\_{\boldsymbol{0}} \mathbf{C}\_{\boldsymbol{j}} + \\ &\quad \sum\_{\forall \ \boldsymbol{\tau}\_{\boldsymbol{\ell}(\boldsymbol{\ell})} \text{ } \boldsymbol{h}p \text{ } \boldsymbol{\tau}\_{\boldsymbol{\ell}}} \left( \mathbf{C}\_{\boldsymbol{j}} + \left\lceil \frac{w\_{\boldsymbol{i}} - \boldsymbol{T}\_{\boldsymbol{j}} - \boldsymbol{Z}\_{\boldsymbol{j}}}{T\_{\boldsymbol{j}}} \right\rceil\_{\boldsymbol{0}} \mathbf{C}\_{\boldsymbol{j}} \right) \end{aligned} (21)$$

Unlike the analysis of old-mode tasks, which limits the number of busy periods to be examined by � *<sup>x</sup> Ti* �, in the analysis of new-mode tasks the number of instances *q* to be inspected has no direct correlation with the beginning or end of the mode change. The above iteration over increasing values of *q* can stop if:

$$w\_i(q) \, < \, (q+1)T\_i \, \tag{2}$$

The first *qT* of level *i* busy period falls before the current invocation of task *τ<sup>i</sup>* is released. The response time corresponding to the given level *i* busy period starting time *qt* before the current invocation of task *τ<sup>i</sup>* is therefore given by: *wi*,*<sup>q</sup>* − *qt*. The response time can occur at any one of these response times, and thus the worst-case response time is given by:

$$R\_i = w\_{i,q} - qt - \mathcal{Y}\_i \tag{23}$$

Where *q* = {0, 1, 2...}. This equation specifies an infinite number of busy periods. Only a finite number need to be examined because the search can stop if a level *i* busy period is found which finishes before the invocation of task *τ<sup>i</sup>* following the current one. The longest busy period that needs to be examined is bounded by the *LCM* of task periods.

#### **6. Example**

14 Real Time System

and it is only the last invocation that requires mode-change analysis. The interference suffered by the mode-changing task includes the types of tasks from the mode-change model, i.e. old-mode aborted, old-mode completed, new-mode changed, unchanged and wholly-new tasks as previously analyzed. Taking these remarks into consideration, the analysis of a

*Cj* + ∑

0

∀ *τj*(*A*) *hp τ<sup>i</sup>*

*Cj* + ∑

In single-mode, steady-state systems, windows for increasing values of *q* need to be determined. The sequence is finite, however, because the search can stop if a level *i* busy period is found which finishes before task *τ<sup>i</sup>* starts (i.e. the processor is released to process lower-priority tasks) - since the processor is executing lower priority tasks there can be no impact on task *τ<sup>i</sup>* from previous invocations of task *τ<sup>i</sup>* in busy periods starting earlier. The

The response time corresponding to the window starting q*Ti* before the current invocation of

Now, as mentioned above, the worst-case response time can occur at any one of these response

In the analysis with arbitrary deadlines and single mode systems, windows for increasing values of *q* need to be determined; variable *x* is not present in the analysis. In the WCRT analysis of mode changes with deadlines less than or equal to periods we need to apply all significant values of *x*, and the analysis is not a function of *q*. Clearly, the analysis of tasks with arbitrary deadlines across a mode change is a function of both *x* and *q*, and *q* is limited

A level *i* busy period for a new-mode task is defined as: *The maximum time for which a processor executes tasks of priority greater than or equal to the priority of task τi. A busy period begins with the arrival of a mode-change request MCR. It ends when a task with lower priority than τ<sup>i</sup> is able to begin*

*ri* = max(*wi*(*q*) − *qTi*) *q* = 1, 2, 3..

 *x Tj*

∀ *τj*(*U*) *hp τ<sup>i</sup>*

*Cj* + min

*wi*(*x*) − � *<sup>x</sup>*

*wi*(*q*) < (*q* + 1)*Ti* (18)

(*wi*(*q*) − *qTi*) (19)

 *x Ti*  *x* − *x Tj*

*Tj*

*Tj*

�*Tj* − *Zj*

 *Tj*, *Cj*

0

 +

*Cj* (17)

(20)

mode-change for an old-mode task with arbitrary deadlines is given by:

 *x Tj*

*wi*(*x*) − *x* − *Yj Tj*

∀ *τj*(*O*) *hp τ<sup>i</sup>*

above iteration over increasing values of *q* can stop if:

*wi*(*x*)=(*q* +1)*Ci* + ∑

task *τ<sup>i</sup>* is therefore given by:

by *x* (for old-mode tasks).

**5.2.2 Analysis of new-mode tasks**

*execution during the mode-change window.*

times, and thus the WCRT is given by:

∑ ∀ *τj*(*N*) *hp τ<sup>i</sup>*

> In this section we present an example of the mode change analysis based upon the Generic Avionics Platform (GAP) task set described by Locke et al. (1991). We consider the example of two modes of aircraft operation: *Level flight* and *Defense Mode*, described in tables 1 and 2 respectively (Pedro, 1999), and we analyze the schedulability of the transition from level-flight to defense mode. The level-flight mode contains four tasks which are not originally defined in the GAP set: auto−pilot, mission−advisor, fuelling−management and display−graphic−2. The task set used in the defense mode is the original task set defined (Locke et al., 1991), except that the Timer−Interrupt task has been removed.

> Tasks printed in boldface in table 1 denote completed old-mode tasks that are replaced by the corresponding boldfaced wholly-new tasks in table 2 (e.g. Weapon−Release replaces Auto−Pilot). Tasks in the defense mode are carried out as new-mode changed tasks. Display <sup>−</sup>Hook−Update is an aborted task. In order to increase the schedulability of the task set, all new-mode tasks lose their periodicity during the transition. Table 3 illustrates the

*τ* T D C P Y x *Rss*

Table 3. Feasibility Analysis of GAP Task Set Across a Mode Change

Schedulability Analysis of Mode Changes with Arbitrary Deadlines 63

*<sup>i</sup>*(*O*) *Ri*(*mc*) *<sup>R</sup>ss*

*<sup>i</sup>*(*N*) TEST


Table 1. Task Set Description in Aircraft Level-Flight Mode

schedulability analysis for the mode change from the level-flight mode to the defense mode. Each column represents the period *T*, deadline *D*, *WCET* C, priority *P*, the worst-case arrival time for an old-mode task *x*, the steady-state response time for a task in the old mode *Rss i*(*O*) , the *WCRT* of a task during the mode change *Ri*(*mc*) and the steady-state WCRT of a new-mode task *Rss i*(*N*) . Tasks with a lower value of *P* have a higher priority. All times are specified in milliseconds with a multiplication factor of 10.

The latency of the mode change is given by new-mode task *τ*34(*c*), which completes its first execution at time 21400 (i.e. *Ri*(*n*) + *Yi* = 2140 ms) after the MCR. The worst-case response times of all tasks are less than the deadlines, and hence the task set is schedulable across the mode change.


Table 2. Task Set Description in Aircraft Defense Mode

If task WCRT's are much less than their periods (i.e. *Ri* << *Ti*) then the analysis will converge immediately for values of *q* = 0. There are no extra invocations (q = 1,2,3..) in the busy period. Task *τ*13(*O*) is an exception: it has a period *T*<sup>13</sup> = 1100 and deadline *D*<sup>13</sup> = 1550 (D > T). Its WCRT is 1227 and it occurs when the task arrives at time x = 801 before the MCR. In the worst-case, *τ*13(*O*) is delayed by one single invocation (i.e. q = 1) before the MCR, but it is still able to meet its deadline.

16 Real Time System

schedulability analysis for the mode change from the level-flight mode to the defense mode. Each column represents the period *T*, deadline *D*, *WCET* C, priority *P*, the worst-case arrival time for an old-mode task *x*, the steady-state response time for a task in the old mode *Rss*

*WCRT* of a task during the mode change *Ri*(*mc*) and the steady-state WCRT of a new-mode

The latency of the mode change is given by new-mode task *τ*34(*c*), which completes its first execution at time 21400 (i.e. *Ri*(*n*) + *Yi* = 2140 ms) after the MCR. The worst-case response times of all tasks are less than the deadlines, and hence the task set is schedulable across the

If task WCRT's are much less than their periods (i.e. *Ri* << *Ti*) then the analysis will converge immediately for values of *q* = 0. There are no extra invocations (q = 1,2,3..) in the busy period. Task *τ*13(*O*) is an exception: it has a period *T*<sup>13</sup> = 1100 and deadline *D*<sup>13</sup> = 1550 (D > T). Its WCRT is 1227 and it occurs when the task arrives at time x = 801 before the MCR. In the worst-case, *τ*13(*O*) is delayed by one single invocation (i.e. q = 1) before the MCR, but it is still

*τ* Behavior *τ* Behavior *τ*2(*W*) **Weapon**−**Release \*** *τ*20(*C*) Tracking−Target−Upd *τ*4(*C*) Radar−Tracking−Filter *τ*22(*W*) **Weapon**−**Protocol \*** *τ*6(*C*) RWR−Contact−Mgmt *τ*24(*C*) Nav−Steering−Cmds *τ*8(*C*) Data−Bus−Poll−Device *τ*26(*C*) Display−Stores−Updates *τ*10(*W*) **Weapon**−**Aiming \*** *τ*28(*C*) Display−Keyset *τ*12(*W*) **Radar**−**Target**−**Update** *τ*30(*C*) Display−Stat−Update *τ*14(*C*) Nav−Update *τ*32(*C*) BET−E−Status−Update *τ*16(*C*) Display−Graphic *τ*34(*C*) Nav−Status *τ*18(*C*) Display−Hook−Update — —

. Tasks with a lower value of *P* have a higher priority. All times are specified in

*i*(*O*) , the

*τ* Behavior *τ* Behavior *τ*1(*O*) **Auto**−**pilot** *τ*19(*O*) Tracking−Target−Upd *τ*3(*<sup>O</sup>* Radar−Tracking−Filter *τ*21(*O*) **Display**−**Graphic**−**2 \*** *τ*5(*O*) RWR−Contact−Mgmt *τ*23(*O*) Nav−Steering−Cmds *τ*7(*O*) Data−Bus−Poll−Device *τ*25(*O*) Display−Stores−Updates *τ*9(*O*) **Mission**−**advisor \*** *τ*27(*O*) Display−Keyset *τ*11(*O*) **Fuelling**−**Mgmt \*** *τ*29(*O*) Display−Stat−Update *τ*13(*O*) Nav−Update *τ*31(*O*) BET−E−Status−Update *τ*15(*O*) Display−Graphic−1 *τ*33(*O*) Nav−Status *τ*17(*A*) Display−Hook−Update — —

Table 1. Task Set Description in Aircraft Level-Flight Mode

milliseconds with a multiplication factor of 10.

Table 2. Task Set Description in Aircraft Defense Mode

task *Rss i*(*N*)

mode change.

able to meet its deadline.


Table 3. Feasibility Analysis of GAP Task Set Across a Mode Change

but assumes a fixed message set with one single mode of operation. Before we tackle the schedulability analysis of messages across a mode change in a CAN bus, we need to be familiar with the schedulability analysis of mode changes with arbitrary deadlines, such as

Schedulability Analysis of Mode Changes with Arbitrary Deadlines 65

Audsley, N., Burns, A., Richardson, M., Tindell, K. & Wellings, A. J. (1993). Applying new

Bailey, C. M. (1993). Hard real time operating system kernel: Investigation of mode

Davis, R. I., Burns, A., Bril, R., & Lukkien, J. (2007). Controller area network (can)

Degani, A. & Kirlik, A. (1995). Modes in human-automation interaction:initial observations

Degani, A., Shafto, M. & Kirlik, A. (1999). Modes in human-machine systems:

Fohler, G. J. (1994). *Flexibility in Statically Scheduled Hard Real-Time Systems*, PhD thesis,

Howe, D. (1997). Free On-line Dictionary of Computing. http://wombat.doc.ic.ac.uk /foldoc

Lehoczky, J. (1990). Fixed priority scheduling of periodic task set with arbitrary deadlines,

Locke, C. D., Vogel, D. & Mesler, T. (1991). Building a Predictable Avionics Platform in Ada: A Case Study, *Proceedings of the 12th Real-Time Systems Symposium (Dec.)*, pp. 181–189. M., J. & Pandya, P. (1986). Finding response times in a real-time system, *BCS Computer Journal*

Martins, P. & Burns, A. (2008). On the meaning of modes in uniprocessor real-time systems,

Papadopoulos, Y. (1996). Real-Time Safety Administration by Using Safety Cases, *Technical Report Oct*, The University of York, Computer Science,2nd Year Thesis Proposal. Pedro, P. (1999). *Schedulability of Mode Changes in Flexible Real-Time Distributed Systems*, PhD

Pedro, P. & Burns, A. (1998). Schedulability analysis for mode changes in flexible real-time

Poller, M. F. & Garter, S. K. (1984). The Effects of Modes on Text Editing by Experienced Editor

Real, J. (2000). *Protocolos de Cambio de Modo para Sistemas de Tiempo Real*, PhD thesis,

*Proceedings of the 2008 ACM symposium on Applied computing*, SAC '08, ACM, New

systems, *Real-Time Systems, 1998. Proceedings. 10th Euromicro Workshop on*, pp. 172

Technische Universitat Wien, Institut fur Technische Informatik.

*Proceedings of the 11th Real Time Systems Symposium*, pp. 201–209.

Norman, D. A. (1981). Categorization of action slips, *Psychological Review* 1(88): 1–15.

scheduling theory to static priority pre-emptive scheduling, *Software Engineering*

change, task 14 deliverable on estsec contract 9198/90/nl/sf, *Technical report*, British

schedulability analysis: Refuted, revisited and revised, *Real-Time Systems* 35: 239–272.

about a modelling approach, *Proceedings of the IEEE International Conference on*

Review, classification, and application, *International Journal of Aviation Psychology*

the one derived in this chapter.

*Journal* 8: 284–292.

9(2): 125–138.

/index.html.

29(05): 390–395.

–179.

York, NY, USA, pp. 324–325.

thesis, The University of York.

Aerospace Systems Ltd.

*Systems, Man, and Cybernetics (SMC)*, pp. 1–15.

URL: *http://doi.acm.org/10.1145/1363686.1363770*

Users, *Human Factors*, Vol. 26(4), pp. 449–462.

Universidad Politecnica de Valencia.

**8. References**
