Recovery Time Considerations in Real-Time Systems Employing Software Fault Tolerance

Safety-critical real-time systems like modern automobiles with advanced driving-assist features must employ redundancy for crucial software tasks to tolerate permanent crash faults. This redundancy can be achieved by using techniques like active replication or the primary-backup approach. In such systems, the recovery time which is the amount of time it takes for a redundant task to take over execution on the failure of a primary task becomes a very important design parameter. The recovery time for a given task depends on various factors like task allocation, primary and redundant task priorities, system load and the scheduling policy. Each task can also have a different recovery time requirement (RTR). For example, in automobiles with automated driving features, safety-critical tasks like perception and steering control have strict RTRs, whereas such requirements are more relaxed in the case of tasks like heating control and mission planning. In this paper, we analyze the recovery time for software tasks in a real-time system employing Rate-Monotonic Scheduling (RMS). We derive bounds on the recovery times for different redundant task options and propose techniques to determine the redundant-task type for a task to satisfy its RTR. We also address the fault-tolerant task allocation problem, with the additional constraint of satisfying the RTR of each task in the system. Given that the problem of assigning tasks to processors is a well-known NP-hard bin-packing problem we propose computationally-efficient heuristics to find a feasible allocation of tasks and their redundant copies. We also apply the simulated annealing method to the fault-tolerant task allocation problem with RTR constraints and compare against our heuristics

Hierarchical Reservation Support in Resource Kernels

Reservation-based operating systems provide applications with guaranteed and timely access to system resources. One of the chief benefits of the approach is temporal isolation, which prevents the timing mis-behavior of one task from hurting other tasks. Such a benefit is appealing enough that applications desire to recursively apply this reservation model to each of their components [2, 8]. In this paper, we study such a hierarchical reservation model in the context of fixed-priority scheduling as used in systems such as the Resource Kernel [13]. We perform detailed analyses under both deferrable-server and sporadic-server replenishment schemes using a hierarchical deadline-monotonic scheduler. We also provide a least upper scheduling bound for a hierarchical rate-monotonic scheduler. Finally, we describe the implementation of this hierarchical scheme in CMU's Linux/RK and demonstrate its functional behavior of providing hierarchical temporal isolation