Self-adaptive fault-tolerant mixed criticality scheduling method for autonomous controllable operating system

Abstract

The invention relates to a self-adaptive fault-tolerant hybrid criticality scheduling method for an autonomous controllable operating system. The method comprises the following steps: constructing a layered intelligent scheduling framework AFT-MCS; an earliest deadline priority (EDF) preemptive scheduling algorithm is adopted, at any moment, a task with an earliest absolute deadline in a system ready queue is endowed with the highest priority, and in AFT-MCS, scheduling in each processor core follows an EDF strategy so as to ensure basic real-time performance. Aiming at key requirements of an embedded operating system in intelligent transformation of a power system, through an innovative architecture combining a multi-dimensional fault-tolerant mechanism and a reinforcement learning decision, the bottleneck problem that a traditional mixed criticality scheduling algorithm coarsely discards low-criticality tasks when the system is overloaded is solved.

Description

TECHNICAL FIELD

[0001] The application relates to the field of system scheduling, in particular to an adaptive fault-tolerant mixed-criticality scheduling method for an autonomous controllable operating system. BACKGROUND

[0002] With the accelerated construction of new power systems, intelligent terminals taking the autonomous controllable embedded operating system as the core play a vital role in ensuring the safe, stable and efficient operation of power grids. Power system terminal tasks have typical mixed-criticality characteristics, that is, they contain both high-criticality safety protection tasks and low-criticality monitoring communication tasks. In order to ensure the determinacy of high-criticality tasks, traditional mixed-criticality scheduling (MCS) algorithms usually sacrifice or even completely discard all low-criticality tasks when the system is overloaded or has a transient fault, which seriously weakens the situational awareness and data analysis capability of smart grids, and is contrary to the development goal of smart grids. SUMMARY

[0003] In order to solve the above problems, the purpose of the application is to provide an adaptive fault-tolerant mixed-criticality scheduling method for an autonomous controllable operating system, which solves the bottleneck problem of "roughly discarding low-criticality tasks" of traditional mixed-criticality scheduling algorithms in system overload through the innovative architecture of combining multi-dimensional fault-tolerant mechanism with reinforcement learning decision.

[0004] To achieve the above purpose, the application adopts the following technical scheme:

[0005] The adaptive fault-tolerant mixed-criticality scheduling method for the autonomous controllable operating system comprises the following steps:

[0006] A hierarchical intelligent scheduling framework AFT-MCS is constructed, the bottom layer is a deterministic scheduler based on partitioned EDF, which guarantees the basic real-time performance, the middle layer is a task management layer, which distinguishes high-criticality tasks and low-criticality tasks through a task classifier and manages tasks of different criticalities by using a task queue, and the top layer is an adaptive decision engine based on reinforcement learning, which is responsible for resource adjustment when the system has an exception;

[0007] An earliest deadline first (EDF) preemptive scheduling algorithm is adopted, at any time, the task with the earliest absolute deadline in the system ready queue is given the highest priority, and in the AFT-MCS, the scheduling in each processor core follows the EDF strategy to ensure the basic real-time performance.

[0008] Further, the system comprises A multi-core embedded system with a number of isomorphic processor cores, the processors communicate through shared memory, the overhead of task migration is considered in the model; the task model adopts a dual-criticality sporadic task model, reflecting the coexistence of periodic monitoring and event-driven protection tasks in power systems; a task set is composed of an independent aperiodic task, each task is defined by a tuple:

[0009] ;

[0010] where, is the minimum inter-arrival time of the task, indicating the minimum interval between the arrival times of two consecutive instances of the task; is the relative deadline of the task, indicating the time window within which each job of the task must complete execution from its arrival time; is the worst-case execution time of the task in the low-criticality mode; is the worst-case execution time of the task in the high-criticality mode; for low-criticality tasks, define because the system does not guarantee that it can still execute after ; is the criticality level of the task, representing high criticality, representing low criticality; is the normalized static value metric, indicating the utility of the system for successfully completing a job of the task .

[0011] Further, the scheduling objective is to design an online scheduling strategy that maximizes the total utility of the system over a long period of time under the following two core conditions:

[0012] (1) Hard real-time correctness guarantee: for any high-criticality task , each of its jobs must be completed within its relative deadline , even if its actual execution time reaches its high-criticality WCET ;

[0013] (2) Weighted utility maximization: under the premise of ensuring correctness guarantee, the scheduling strategy should maximize the total value of the system. The total value of the system is defined as the sum of the values of all successfully completed low-criticality task jobs within a given time window :

[0014] ; ​

[0015] where, is an indicator function, if task is successfully completed at time , then , otherwise 0; the scheduling problem is converted into an online stochastic optimization problem under hard constraints, which fits the smart grid's demand for security and intelligence.

[0016] Further, the AFT-MCS adopts a partition scheduling model. In the system initialization phase, all tasks are assigned to each processor core according to their utilization in the low criticality mode using the worst-fit decreasing heuristic algorithm.

[0017] Further, the worst-fit decreasing heuristic algorithm is as follows:

[0018] (1) Calculate the utilization of each task in the task set ;

[0019] (2) Sort all tasks according to their utilization from large to small;

[0020] (3) Take out the sorted task one by one and assign it to the core with the smallest total utilization (i.e., the largest remaining capacity) among all the current processor cores;

[0021] (4) Repeat step (3) until all tasks are assigned.

[0022] Further, when an execution timeout event occurs on a core, the scheduler of the core will call a pre-trained lightweight Q-Learning agent to decide the optimal action next:

[0023] (1) State space

[0024] The state is defined as a discretized vector that can succinctly and effectively describe the current core state:

[0025] ;

[0026] where, is the total utilization of the current core; is the minimum margin of all activated high criticality tasks on the current core; is the number of low criticality tasks in the ready queue of the current core; is the value of the low criticality task with the lowest priority in the current ready queue;

[0027] For the low criticality task with the lowest priority on the current core , the decision engine selects one of the following actions:

[0028]

[0029] wherein, to allow the current high-criticality task to continue execution, and keep low-criticality tasks unchanged; to abort the current low-criticality task's job, and temporarily double its minimum inter-arrival interval, thus halving its resource demand; to attempt to migrate low-criticality tasks to other processor cores within the system with lower load; to abort and discard the current low-criticality task's job, only if all other methods fail to guarantee the safety of high-criticality tasks;

[0030] When action is taken in state , the system moves to new state , and the immediate reward the agent gets is defined as:

[0031]

[0032] wherein, is an indicator variable, which is 1 if action eventually leads to the successful completion of some low-criticality task , and 0 otherwise; the reward size is proportional to its value ; is an indicator variable, which is 1 if after action , any high-criticality task in the system misses its deadline, and 0 otherwise; is the cost of different actions, defined as ; is the weight coefficient; the training of Q-Table is done offline through simulation, using the standard Bellman equation for updating, and after the training is completed, the generated Q-Table is solidified into the operating system kernel for use in runtime decision-making;

[0033] AFT-MCS introduces a dynamic promotion mechanism, and the system maintains a continuous unfinished counter for each low-criticality task ;

[0034] Whenever a job of is dropped or degraded, its counter is incremented by 1;

[0035] whenever One of the assignments was successfully completed, and its counter... Reset to zero;

[0036] At each scheduling decision, the task's "dynamic value" Calculated as:

[0037]

[0038] in It is an adjustable hunger penalty factor.

[0039] The present invention has the following beneficial effects:

[0040] 1. This invention addresses the key needs of embedded operating systems in the intelligent transformation of power systems. Through an innovative architecture combining multi-dimensional fault tolerance mechanisms and reinforcement learning decision-making, it solves the bottleneck problem of traditional hybrid criticality scheduling algorithms that crudely discard low-criticality tasks when the system is overloaded.

[0041] 2. This invention replaces the traditional task discarding strategy with a reduction in task activation frequency and multi-dimensional fault tolerance methods for task migration, thereby maximizing the preservation of service quality for low-criticality tasks. Secondly, it introduces a value-based dynamic enhancement mechanism, which dynamically adjusts task priority factors based on historical execution data to prevent the loss of critical low-criticality data streams due to long-term resource starvation. Finally, it constructs a lightweight Q-Learning decision model to dynamically select the optimal scheduling action based on multi-dimensional system states during runtime, achieving online adaptive optimization of the scheduling strategy. Attached Figure Description

[0042] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0043] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments:

[0044] refer to Figure 1 In this embodiment, an adaptive fault-tolerant hybrid criticality scheduling method for an autonomous and controllable operating system is provided, characterized by the following steps:

[0045] A hierarchical intelligent scheduling framework, AFT-MCS, is constructed. The bottom layer is a deterministic scheduler based on partitioned EDF, which ensures basic real-time performance. The middle layer is a task management layer, which distinguishes high and low criticality tasks through a task classifier and uses task queues to manage tasks of different criticalities. The top layer is an adaptive decision engine based on reinforcement learning, which is responsible for resource adjustment when system anomalies occur.

[0046] The system employs the earliest deadline first (EDF) preemptive scheduling algorithm, where at any given time, the task with the earliest absolute deadline in the system's ready queue is given the highest priority. In AFT-MCS, scheduling within each processor core follows the EDF strategy to ensure basic real-time performance.

[0047] In this embodiment, the system includes A multi-core embedded system with homogeneous processor cores, where processors communicate via shared memory, and the overhead of task migration is considered in the model; the task model adopts a dual-critical sporadic task model to reflect the coexistence of periodic monitoring and event-driven protection tasks in power systems; a task set Depend on It consists of several independent, non-periodic tasks. Each task Defined by a tuple:

[0048] ;

[0049] in, The minimum arrival interval for a task represents the task's minimum arrival time. The minimum interval between the arrival times of two consecutive instances (jobs); The relative deadline for a task represents the time window during which each job of the task must be completed from its arrival time. This represents the worst-case execution time of the task in low-criticality mode. The worst-case execution time for the task in high-criticality mode; for low-criticality tasks, define... Because the system does not guarantee that it will exceed [the specified limits]. It can still be executed afterward. For high-criticality tasks, there are usually... ; This represents the criticality level of the task. This represents a high criticality. This represents a low criticality. A normalized static value measure, representing the successful completion of a task. The utility of a task on the system is an extension of the standard MCS model, enabling the scheduler to make value-based decisions. For example, the value of a communication task used to report potential fault alarms... Its value may be far greater than that of a routine status reporting task. For high-criticality tasks, its value is even greater. It is usually a very large value because its completion is mandatory.

[0050] In this embodiment, the scheduling objective is to design an online scheduling strategy that maximizes the long-term overall utility of the system while satisfying the following two core conditions:

[0051] (1) Hard real-time correctness guarantee: for any high-criticality task Each of its tasks must be completed within its relative deadline. It is completed within the timeframe, even if its actual execution time reaches its high criticality WCET. ;

[0052] (2) Weighted utility maximization: Under the premise of ensuring correctness, the scheduling strategy The goal should be to maximize the total value of the system. The total value of the system is defined as the total value within a given time window. The sum of the values ​​of all successfully completed low-criticality tasks:

[0053] ;

[0054] in, It is an indicator function, if the task An assignment in time Successful completion, Otherwise, it is 0; the scheduling problem is transformed into an online stochastic optimization problem under hard constraints, which is in line with the needs of smart grids in ensuring safety and intelligence.

[0055] AFT-MCS is shown in the figure below:

[0056] (1) Offline stage:

[0057] Task partitioning: The task set is partitioned using the worst-case adaptive decreasing heuristic algorithm. Static allocation to On each processor core.

[0058] Q-Table Training: Through extensive offline simulations, various system loads and fault scenarios are simulated to train the Q-Learning agent and generate an optimal policy Q-Table.

[0059] (2) Online phase:

[0060] Partitioned EDF scheduling: Within each core, tasks are scheduled according to the standard preemptive EDF strategy.

[0061] Runtime monitoring: The kernel continuously monitors the actual execution time of each task.

[0062] Anomaly trigger: When the execution time of any task exceeds its... When this occurs, an abnormal event is triggered.

[0063] Enhanced decision-making: Abnormal events trigger the Q-Learning decision engine. The engine queries the pre-trained Q-Table based on the current system state and selects the optimal fault-tolerant action.

[0064] Action execution: The scheduler executes the selected action, such as adjusting task parameters or initiating task migration.

[0065] Value enhancement: An independent backend mechanism periodically checks for tasks that are starving and dynamically enhances their value as needed.

[0066] In this embodiment, AFT-MCS adopts a partitioned scheduling model. During the system initialization phase, all tasks are scheduled based on their utilization rate in low-criticality mode. The worst-fit decreasing heuristic algorithm is used to allocate the processor cores.

[0067] In this embodiment, the worst-fit decreasing heuristic algorithm is as follows:

[0068] (1) Calculate each task in the task set utilization rate ;

[0069] (2) Sort all tasks in descending order of their utilization rate;

[0070] (3) Take out the sorted tasks in sequence and assign them to the core with the lowest total utilization (i.e. the largest remaining capacity) among all current processor cores;

[0071] (4) Repeat step (3) until all tasks have been assigned.

[0072] To achieve fine-grained adaptive control, AFT-MCS relies on the operating system kernel's ability to precisely monitor task execution time. This is typically achieved through hardware performance counters or by updating the cumulative execution time of the currently running task at each clock interrupt. When a task... Any task, its actual execution time Exceeding its low threshold WCET However, before completion, the kernel triggers an "execution timeout" event. This event signals the start of the adaptive decision engine. Unlike traditional mobile edge servers where a global mode switch is triggered by a high-critical task timeout, AFT-MCS's triggering mechanism is more universal and flexible:

[0073] (1) If the timeout is for the HI-crit task: This indicates that the system has entered a potentially dangerous state and measures must be taken immediately to ensure its completion.

[0074] (2) If the timeout is for the LO-crit task: This indicates that the task's timeout is due to... The estimate is overly optimistic, or the system may be experiencing other interference. While it doesn't directly threaten security, it still indicates resource constraints and the need for adjustments.

[0075] This event-triggered mechanism based on individual jobs can better cope with local and transient system overloads and avoid unnecessary global performance penalties.

[0076] In this embodiment, when an execution timeout event occurs on a core, the scheduler of that core will invoke a pre-trained lightweight Q-Learning agent to determine the optimal next action:

[0077] (1) State space

[0078] The state is defined as a discretized vector that concisely and effectively describes the current kernel state:

[0079] ;

[0080] in, This represents the total utilization of the current core; this value is the total number of tasks allocated to this core. The sum of the low critical utilization rates is discretized into 4 levels: [0-0.7] (low), [0.7-0.9] (medium), [0.9-1.0] (high), and greater than 1.0 (overload); This represents the minimum margin for all currently active high-criticality tasks on the core; that is, the time remaining until the deadline minus the remaining C(HI) execution time. This value reflects the urgency level of the high-criticality tasks, discretely categorized into three levels: safe, alert, and dangerous. The number of low-criticality tasks in the current kernel's ready queue reflects the queuing pressure of low-criticality tasks, and is discretely divided into three levels: few, medium, and many. The value of the lowest priority, low-criticality task in the current ready queue is discretized into three levels: low, medium, and high.

[0081] For the lowest priority low-criticality task on the current core The decision engine selects one of the following actions:

[0082]

[0083] in, To allow currently timed-out high-critical tasks to continue execution, while maintaining low-critical tasks... No change. This action is the default option and is only possible when there is sufficient margin. To suspend the current low-criticality task The task is to temporarily double the minimum arrival interval of its subsequent tasks, thereby halving its resource requirements; To attempt to handle low-criticality tasks The process involves migrating to a lower-load processor core within the system. This requires querying a global load table to find a core that meets the schedulability criteria and initiating a migration request. To abort and discard the current low-criticality task The task should only be executed when all other methods fail to guarantee the safety of the high-criticality task.

[0084] When in state Take action below Afterwards, the system transitions to a new state. Instant rewards earned by agents The definition is as follows:

[0085]

[0086] in, It is an indicator variable, if the action This ultimately led to a low-criticality task. If the task is successfully completed, the reward is 1; otherwise, it is 0. The reward size is related to its value. Proportional; It is an indicator variable, if the action Afterwards, if any high-criticality task in the system misses its deadline, the value is 1; otherwise, it is 0. It is the cost of different actions, defined ; These are the weighting coefficients; where It is set to a very large positive number to create a huge negative feedback, ensuring that the agent learns that high-criticality tasks cannot be sacrificed under any circumstances.

[0087] The Q-Table is trained through offline simulation and updated using the standard Bellman equation. After training, the generated Q-Table is embedded into the operating system kernel for runtime decision-making.

[0088] To prevent high-value, low-criticality tasks with long minimum arrival intervals from being continuously suppressed, thus disrupting critical data flow, AFT-MCS introduces a dynamic boosting mechanism. The system will boost each low-criticality task... Maintain a continuous incomplete counter ;

[0089] whenever A job is dropped or deleted, its counter Add one;

[0090] whenever One of the assignments was successfully completed, and its counter... Reset to zero;

[0091] At each scheduling decision, the task's "dynamic value" Calculated as:

[0092]

[0093] in It is an adjustable hunger penalty factor. This dynamic value This will be used for reward calculation and value enhancement judgment in Q-Learning. This forms a negative feedback loop: the longer a task is suppressed, the higher its dynamic value, and thus the more likely it is to be preserved in subsequent scheduling decisions, effectively preventing tasks from remaining unexecuted.

[0094] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0095] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0096] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0097] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0098] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. An adaptive fault-tolerant mixed criticality scheduling method for autonomously controllable operating systems, characterized in that, Comprising the following steps: A hierarchical intelligent scheduling framework AFT-MCS is constructed, the bottom layer is a deterministic scheduler based on partitioned EDF, which guarantees the basic real-time performance; the middle layer is the task management layer, which distinguishes high and low criticality tasks through the task classifier and manages tasks of different criticality by using task queues; The top layer is an adaptive decision engine based on reinforcement learning, which is responsible for resource adjustment when the system appears abnormal; The earliest deadline first (EDF) preemptive scheduling algorithm is adopted, at any time, the task with the earliest absolute deadline in the system ready queue is given the highest priority, and the scheduling in each processor core in AFT-MCS follows the EDF strategy to ensure the basic real-time performance.

2. The adaptive fault-tolerant mixed criticality scheduling method for autonomous controllable operating systems of claim 1, wherein, The system is a multi-core embedded system including a plurality of homogeneous processor cores, the processors communicate through shared memory, and the overhead of task migration is considered in the model; the task model adopts a double-criticality sporadic task model, reflecting the characteristics of coexistence of periodic monitoring and event-driven protection tasks in power systems; a task set is composed of a plurality of independent aperiodic tasks, each task is defined by a multi-tuple: ； wherein, is the minimum inter-arrival time of tasks, representing the minimum interval between the arrival times of two consecutive instances of a task ; is the relative deadline of a task, representing the time window within which each job of a task must complete execution from its arrival time; is the worst-case execution time of a task in low-criticality mode; is the worst-case execution time of a task in high-criticality mode; for low-criticality tasks, define , because the system does not guarantee that it can still execute beyond ; is the criticality level of a task, representing high criticality, representing low criticality; is the normalized static value metric, representing the utility of the system by successfully completing a job of a task .

3. The adaptive fault-tolerant mixed criticality scheduling method for autonomous controllable operating systems of claim 2, wherein, The scheduling goal is to design an online scheduling strategy to maximize the total utility of long-term system operation under the following two core conditions: (1) Hard real-time correctness guarantee: for any high-criticality task whose each job must be completed within its relative deadline even if its actual execution time reaches its high-criticality WCET ; (2) Weighted utility maximization: Under the premise of ensuring correctness, the scheduling strategy The goal should be to maximize the total value of the system. The total value of the system is defined as the total value within a given time window. The sum of the values ​​of all successfully completed low-criticality tasks: ； in, It is an indicator function, if the task An assignment in time Successful completion, Otherwise, it is 0; the scheduling problem is transformed into an online stochastic optimization problem under hard constraints, which is in line with the needs of smart grids in ensuring safety and intelligence.

4. The adaptive fault-tolerant mixed criticality scheduling method for autonomous controllable operating systems of claim 3, wherein, The AFT-MCS adopts a partitioned scheduling model, at the system initialization phase, all tasks are assigned to each processor core according to their utilization in the low-criticality mode , using a worst-fit decreasing heuristic algorithm.

5. The adaptive fault-tolerant mixed criticality scheduling method for autonomous controllable operating systems of claim 4, wherein, The worst adaptive decreasing heuristic algorithm is as follows: (1) calculating the utilization of each task in the task set ;​ (2) Sort all tasks according to their utilization from large to small; (3) Take out the sorted tasks one by one and assign them to the processor core with the smallest total utilization (i.e., the largest remaining capacity) among all processor cores; (4) Repeat step (3) until all tasks are assigned.

6. The adaptive fault-tolerant mixed criticality scheduling method for autonomous controllable operating systems of claim 1, wherein, When an execution timeout event occurs on a certain core, the scheduler of the core will call a pre-trained lightweight Q-Learning agent to determine the optimal action for the next step: (1) State space The state is defined as a discrete vector that can succinctly and effectively describe the current state of the core: ； wherein, is the total utilization of the current core; is the minimum slack of all activated high-criticality tasks on the current core; is the number of low-criticality tasks in the ready queue of the current core; is the value of the lowest-priority low-criticality task in the current ready queue; the current core to the lowest priority low-criticality task the decision engine selects one of the following actions: in, To allow currently timed-out high-critical tasks to continue execution, while maintaining low-critical tasks... constant; To suspend the current low-criticality task The task is to temporarily double the minimum arrival interval of its subsequent tasks, thereby halving its resource requirements; To attempt to handle low-criticality tasks Migrate to other processor cores with lower load within the system; To abort and discard the current low-criticality task The task should only be executed when all other methods fail to guarantee the safety of the high-criticality task. When in state Take action below Afterwards, the system transitions to a new state. Instant rewards earned by agents The definition is as follows: wherein, is an indicator variable, 1 if action results in the successful completion of some low criticality task , 0 otherwise; the reward size is proportional to its value ; is an indicator variable, 1 if action misses a deadline for any high criticality task in the system, 0 otherwise; is the cost of different actions, defined ; is the weight coefficient; the training of the Q-Table is done offline through simulation, using the standard Bellman equation for updating, and after the training is completed, the generated Q-Table is solidified into the operating system kernel for use in runtime decision-making; AFT-MCS introduces a dynamic promotion mechanism, the system will be for each low criticality task maintain a continuous unfinished counter ; Whenever a job is dropped or degraded, its counter is incremented. Whenever one job is successfully completed, its counter is cleared; At each scheduling decision, the "dynamic value" of a task is computed as: Vd = Vd + (Vd - Vd) wherein is an adjustable starvation penalty factor.

Images