Method for mitigating temporal interference by compiling configured temporal exclusions

Abstract

Method for scheduling a set of tasks on a multitask computer (30), comprising at least one processing core, said method comprising - for each core, initializing (S1) a scheduling plan (13) subdivided into time intervals from time data (12) obtained for each task (11) of the set provided for said core, - iteratively allocating (S3–S11) fragments for each task in the respective scheduling plan, considering the tasks in an order dependent on precedent links, respecting a set of constraints, and determining (S10) whether all the fragments of the task are allocated in the plan (13) before a deadline associated with this task, defined by said time data - transmitting (S13) all the plans (13) to the computer (30). Figure for abstract: Fig. 3

Description

Title of the invention: Method for mitigating temporal interference by temporal exclusions configured by compilation FIELD OF THE INVENTION

[0001] The present invention relates to real-time multitasking and multi-core systems, and in particular to safety systems implementing time constraints. It applies in particular to on-board systems, for example in aerial vehicles. It can in particular be applied to on-board integrated modular avionics (IMA) systems.

[0002] In the field of avionics, in particular, a high level of performance and compliance with these time constraints is necessary, since the slightest failure can pose considerable risks to the aerial vehicle. Even in the case of an unmanned aerial vehicle commonly called drones or UAS (for "Unmanned Aircraft System" in English), to which the invention can also be applied, the risk of loss of the vehicle remains, in addition to its possible crash into inhabited areas. Similar risks may exist for other types of vehicles (automobiles, railways, naval, etc.), or other systems requiring this type of time constraints (nuclear industry, etc.)

[0003] In critical real-time multitasking systems, strategies are generally implemented for provisioning time quotas to the different tasks, so that each can execute in compliance with its own constraints, in particular rate and latency.

[0004] The time quotas allocated to tasks are generally based on the concept of worst-case execution time (or WCET for "Worst-Case Execution Time") which is previously assigned to each task to be deployed on a multitasking computer.

[0005] Estimating this maximum execution time required to complete a task, WCET, is a well-known research problem and recognized as particularly difficult.

[0006] It becomes even more complex when we consider computers, or multi-core systems, due to the temporal interferences generated by the fact that certain tasks can be deployed on the same time windows (but on different cores) while they require, for example, common hardware resources (input / output ports, internal buses of the computer, etc.)

[0007] In the specific field of avionics, international standards and norms make it possible to specify the requirements that aerial vehicles and the various on-board systems must meet.

[0008] For example, we can cite the DO-178C standard published by the RTCA (for "Radio Technical Commission for Aeronautics" in English) and imposed by numerous regulatory bodies such as the FAA or the EASA, which specifies requirements for on-board software systems.

[0009] More particularly, the document AMC 20-193 defines a possible use of multi-core computers compatible with the higher-level requirements specified by the standard DO-178C. This standard AMC 20-193 details a set of objectives which must be fulfilled by a set of tasks deployed on a multi-core computer to allow certification according to these standards.

[0010] In particular, document AMC 20-193 requires the identification of temporal interferences and the definition of a strategy for tolerating them, or mitigating them (i.e. attenuating them, or even eliminating them):

[0011] “MCP_Resource_Usage _3: The applicant has identified the carnal interference that could permit interference to affect the software applications hosted on the MCP cores, and has verified the applicant's chosen means of mitigating the interference.

[0012] Furthermore, platforms are available to facilitate the specification of tasks to be deployed on a multi-core computer and the determination of a scheduling plan to meet their specific time requirements, as well as to enable their execution in accordance with this scheduling plan.

[0013] As an example, we can cite the ASTERIOS™ software suite developed by the company Asterios Technologies (formerly Krono-Safe).

[0014] It includes a tool (ASTERIOS™ RTK) allowing a set of real-time tasks to be executed on a multi-core computer in accordance with a scheduling plan, for example provided by another tool in the chain (ASTERIOS™ Developer).

[0015] The mechanisms implemented are for example described in patent application WO2015092188A1.

[0016] However, these mechanisms do not allow for taking into account temporal interference between tasks to be deployed on different cores of the multi-core computer.

[0017] An aim of the invention is therefore to improve the current proposals of the state of the art by allowing, in particular, the taking into account of temporal interferences generated between tasks. Summary of the invention

[0018] For these purposes, according to a first aspect, the present invention can be implemented by a method of scheduling a set of tasks on a multitask computer, comprising at least one processing core, said method comprising - for each core of said computer, initialize a scheduling plan subdivided into time intervals from time data obtained for each task of said set provided for said core; - iteratively allocating processing fragments for each task planned for said core in the respective scheduling plan, considering said tasks in an order dependent on temporal precedent links defined for said tasks, and respecting a set of constraints consisting of: - to iteratively consider each interval of said scheduling plan not yet allocated to a task, - to position said fragments in said scheduling plan at the earliest at a time determined from said temporal precedent links and a start date of said task defined by said temporal data, - not positioning said fragments in overlap with fragments of another task with which there is an exclusion constraint, among the set of scheduling plans, and determining whether all of the processing fragments of said task are allocated in said scheduling plan before a due date associated with said task, defined by said time data; - transmitting all of said scheduling plans to said computer.

[0019] According to preferred embodiments, the invention comprises one or more of the following features which can be used separately or in partial combination with each other or in total combination with each other: - iteratively allocating processing fragments for each task planned for said core includes steps of: - calculation of said instant from said temporal precedent links, by searching for the latest of the dates among the start date of said task and the completion dates of the tasks having precedent over said task, - determination of a list of fragments corresponding to tasks having a precedence relationship with said task, - selection of a time interval of said scheduling plan, and, for said selected time interval, determination of empty spaces not yet allocated to a task, from said instant, deletion of the empty spaces associated with an exclusion constraint for said task, then allocation of remaining empty spaces to a fragment of said task; - if the sum of the durations of the intervals allocated to said task is less than the execution time associated with said task and no interval not yet allocated is available before a deadline associated with said task, then the allocations of said task are deleted and an attempt is made to allocate another task; - the method further comprises a step of sorting the tasks of said set of tasks, and a step of selecting a task according to said sorting, and in which trying to allocate another task comprises a new sorting of said tasks, after having checked whether all possible sorts have not been tried; - trying to allocate another task includes a tree traversal within said possible sorts; - the method further comprises, when allocating a processing fragment, an assignment to said fragment of a start date within said scheduling plan as a function of the start date of said time interval; - said start date is assigned to a fragment only if said fragment would not overlap with a fragment of another task with which there is an exclusion constraint on the time interval preceding said time interval. - the method further comprises assigning an end date to a time interval, said end date corresponding to the latest date of the fragments allocated on said time interval in all of said scheduling plans

[0020] Another object of the invention relates to a computer adapted to use the scheduling plans produced by the method previously described. In particular, this object relates to a multitasking computer having a set of cores and adapted to execute a real-time operating system adapted to execute tasks according to a set of scheduling plans determined by a method as previously described.

[0021] Another object of the invention relates to a vehicle comprising at least one such multitask computer.

[0022] Another object of the invention relates to a computer program comprising instructions for implementing a method as previously described when it is executed by a processor of a configuration device.

[0023] Another object of the invention relates to configuration equipment comprising at least one processor and circuits adapted to implement the method as previously described in the form of a scheduling tool.

[0024] Other characteristics and advantages of the invention will appear on reading the following description of a preferred embodiment of the invention, given by way of example and with reference to the appended drawings. BRIEF DESCRIPTION OF THE FIGURES

[0025] The attached drawings illustrate the invention: [Fig.lA] and [Fig.lB] schematically represent a multi-core multitasking computer.

[0026] [Fig.2] schematically illustrates a context for deploying a process according to an embodiment.

[0027] [Fig. 3] schematically represents a simplified flowchart of a method according to one embodiment.

[0028] [Fig.4] illustrates an example of initialization of a plan skeleton scheduling, according to one embodiment.

[0029] [Fig.5] represents an example of application on a set of 4 tasks of a method according to one embodiment.

[0030] [Fig.6A] to [Fig.6C] illustrate a mechanism for assigning a start date to a fragment according to one embodiment.

[0031] [Fig.7A] and [Fig.7B] illustrate an example of two scheduling plans, without and with assignment of an end date to the time intervals, according to one embodiment.

[0032] [Fig.8A] to [Fig.8D] illustrate another example of the progress of the method according to one embodiment.

[0033] DETAILED DESCRIPTION OF EMBODIMENTS OF THE INVENTION

[0034] [Fig.lA] illustrates a schematic and high-level view of a set of tasks, or agents, A deployed on a multi-core multitasking computer 30. In the figure, tasks A1, A2... An are represented.

[0035] The computer 30 may comprise hardware components, such as one or more processors, and associated circuits (in particular RAM-type memories, interface circuits, etc.).

[0036] An intermediate layer comprises a real-time operating system (RTOS). Such an operating system is capable of managing the launch of the different tasks and their preemption according to a rate determined, statically, by a scheduling plan provided.

[0037] This multi-core multitasking computer can be embedded in any system requiring in particular a need for a guaranteed timing of the execution of different tasks, for example for reasons of security or operational safety. It can in particular be a mobile vehicle whose electronic equipment must meet such constraints in order to guarantee that its operation is in accordance with an expected operation and in particular that its direction does not constitute a danger either for itself and its passengers or for other goods or people around it. This mobile system can for example be an aerial vehicle, such as an airplane. It can also be an unmanned vehicle, or drone (or UAS for "Unmaned Aircraft System" or UAV for "Unmaned Aircraft Vehicle" in English).

[0038] The method described can be applied to on-board computers in a critical avionics context, but also to any system that must comply with real-time constraints with an emphasis on operational safety (e.g. civil nuclear, railway, industrial automation, aerospace, etc.).

[0039] [Fig.lB] represents a functional view of a multi-core multitasking computer on which a set of tasks A scheduled according to the proposed method is likely to be deployed.

[0040] This view aims to illustrate the different resources of the computer that this set of tasks can access. Typically by means of a logical bus (referenced BUS in the figure), the agents A can access resources such as one (or more) MEM memories. These memories can be memories of the “random access memory” or RAM type, and mass memories of the “hard disk” type, as examples. Other resources can be INT interfaces with other equipment, typically network interfaces. Other resources can also be embedded in a computer 30 and these examples are only illustrative. Furthermore, other TSK tasks than those managed within the framework of the proposed method can also be deployed and access, concurrently, the resources of the multi-core computer 30.

[0041] As mentioned previously, one challenge is to define a schedule for the different tasks A so that they can all (if possible) be executed according to their time constraints.

[0042] In general, these tasks are recurring, that is to say they must be repeated over time.

[0043] In the context of an aerial vehicle, for example, these different tasks may represent functions of different on-board equipment, which must be executed continuously when the vehicle is in operation.

[0044] For example, functions for controlling the trajectory, the altitude, the various sensors of the vehicle must be continuously in operation, that is to say they must execute processing according to a specific time constraint (for example providing a value every n milliseconds).

[0045] Also, the scheduling can also be repetitive: it therefore concerns one or more time windows planned to be repeated continuously over time.

[0046] Furthermore, some processes are dependent on other processes, for example because they need a value from this other process in order to generate their own outputs. Failure to comply with a time constraint of a task can therefore impact other tasks with which it is in a precedence relationship.

[0047] Furthermore, concurrent management of tasks to the same resources of the computer 30 is necessary to prevent two tasks from blocking or, more commonly, their processing times from being extended by these concurrent accesses beyond the time constraints associated with them. This phenomenon is called interference hereinafter.

[0048] It could be envisaged not to take into account interferences at the level of the scheduling plan provided to the computer and to let the real-time operating system RTOS manage these aspects dynamically, during the execution (or "runtime") of the tasks. However, this way of doing things does not guarantee that at the time of the execution of the tasks the operating system is able to find a solution to order the tasks to be scheduled according to their time constraints and in order to avoid interferences. This type of solution may be acceptable in non-critical contexts where security is not essential, that is to say where all the time constraints are not strictly imperative but can be subject to a certain flexibility.

[0049] Also, it is proposed that the real-time operating system RTOS has a static scheduling plan, making it possible to guarantee that the various constraints are respected. The definition of such a scheduling plan is essential to guarantee the safety of the system associated with the set of tasks A.

[0050] [Fig.2] diagrams a process for defining a set of tasks up to their implementation on a multi-core computer and a method for generating such a scheduling plan.

[0051] Firstly, multitasking applications 11 can be defined according to a design language suitable for implementation on a real-time computer.

[0052] This language makes it possible to define the computer code which must be executed on the computer, as well as the various time constraints which this computer code must respect.

[0053] An example of such a language may be the PsyC language defined by the company Asterios Technologies (formerly Krono-Safe) and adapted to produce files that can be used by the ASTERIOS™ RTK real-time platform mentioned above. This language is based on the C language and includes additional elements for managing aspects related to real-time, parallelism and communications.

[0054] In such an embodiment based on the ASTERIOS platform and the PsyC language, the software applications are defined by agents. These agents are sequences of elementary actions.

[0055] Time constraints can be associated with these elementary actions and specified by the designer of a real-time application. They can be described by language (for example the PsyC language) and include: A wake-up call, A deadline constraint, An execution time constraint, One or more precedent constraints.

[0056] Each elementary action can subsequently be considered as being a task that one seeks to schedule on a multi-core multitask computer core.

[0057] As will be seen later, scheduling includes the allocation of available time of a core of the computer in the form of processing fragments, or frames (from the English "frame" usually used). A time division allowing the allocation of time fragments is for example described in the patent application WO 2010 / 043706, and is known under the terminology RSF for "Repetitive Sequence of Frames" in English (Repetitive sequence of time windows). The structure of an RSF is a series of intervals divided into a head part and a loop part, each interval being a possible container of a processing fragment of a task.

[0058] As has just been seen, each task (or elementary action) has a deadline constraint which corresponds to the time at which it must imperatively have completed its processing.

[0059] The execution time constraint corresponds to the maximum time required for the task to execute. The difference between the execution time and the deadline corresponds to a time during which the task can be preempted (the processors can then execute other concurrent tasks).

[0060] The precedence constraint indicates that the task requires that one or more other tasks must be executed first. In which case, this task cannot therefore not start before the completion of these tasks. In the case where these previous (or preceding) tasks have an execution split into several processing fragments, the completion date of the last frame must be considered.

[0061] In addition, exclusion constraints can be defined in order to eliminate interference between tasks.

[0062] In other words, it is proposed to allow developers of real-time applications to mitigate interference between the different tasks from the design phase by means of exclusions between tasks. The proposed method makes it possible to take these specifications into account for the determination of a scheduling plan. By construction, interference will thus be avoided during the execution of the tasks on the target computer 30.

[0063] More specifically, according to one embodiment, the exclusion constraints between elementary actions of agents of an application written in PsyC language can be expressed through the PsyC language and a related configuration (for example in JSON). These exclusions are naturally carried over to the tasks to be scheduled corresponding to the elementary actions.

[0064] The PsyC language allows you to add identifiers for “advance” instructions, in the form @<M0N IDENTIFIANT> advance ...

[0065] In the JSON configuration, we can use the identifiers of the "advance" instructions to define elementary actions, or scheduling tasks. An elementary action represents a fragment of code that executes between two successive "advance" instructions. Therefore, an elementary action is defined by the identifier of the starting "advance" instruction, the identifier of the ending "advance" instruction, and a unique name to identify it.

[0066] And the specification of exclusion constraints is also done in the JSON configuration, through the definition of exclusion groups. An exclusion group is a set of elementary actions that must not be executed simultaneously.

[0067] A compiler 10 may be provided to take as input the specifications of the tasks 11 constituting the applications in order to generate output files 12 which comprise both object codes intended to be executed on the multitask computer 30, and data intended to be used by a scheduling tool 20. This scheduling tool 20 is provided to generate a scheduling plan 13 from this data provided by the compiler 10.

[0068] This data 12 generated by the compiler may in particular comprise a data structure representing temporal data relating to the compiled tasks.

[0069] In particular, from code 11, the compiler can generate a data structure providing temporal data comprising, for each task, or elementary action, a start date, possibly an end date and the time constraints associated with this task. These time constraints may include deadline constraints, execution time constraints, precedent constraints, wake-up constraints and exclusion constraints.

[0070] According to one embodiment, a method is proposed for generating a scheduling plan 13 taking into account these different types of constraints, for each task (5 in the embodiment described).

[0071] According to an embodiment based on the ASTERIOS™ software suite, this temporal data can take the form of a graph called RATS for “Repetitive Agent Temporal Sequence” in English (or repetitive agent temporal sequence).

[0072] This graph essentially represents a partial scheduling plan for the task. It is a series of intervals that are divided into two parts: a head where the task is executed once, and a loop where the task is executed indefinitely.

[0073] Each of these two parts can be the subject of a part of a scheduling plan 13, the composition of which will provide the final scheduling plan submitted to the target calculator 30.

[0074] In each interval where the task is supposed to be executed, it is subject to the time constraints previously indicated.

[0075] The scheduling plan 13 generated by the scheduling tool 20 may consist of a set of sub-plans, each being associated with a core of the multi-core computer 30. The real-time operating system RTOS embedded in the computer 30 is adapted to orchestrate the executions of the tasks on each of the cores according to the associated sub-plan. In the following, each of these parts of the total plan will also be called, for simplification, “scheduling plan”.

[0076] [Fig. 3] shows an illustrative flowchart of an embodiment of the method implemented by the scheduling tool 20

[0077] In a step SI, for each core of the computer 30, the scheduling tool initializes a scheduling plan 13 subdivided into time intervals from time data 12 obtained for each task (or elementary action of an agent), 11 of the set planned to be deployed on this core.

[0078] This scheduling plan as initialized constitutes a skeleton. The subsequent steps will seek to assign processing fragments of the tasks to the time intervals, in order to constitute the scheduling plan of the core considered.

[0079] This initialization can consist of subdividing an empty scheduling plan, that is to say a simple timeline, by determining milestones corresponding to the start and end dates of all the tasks assigned to the core considered. In other words, if we consider that each task is associated with a time interval bounded by a start date and an end date, the skeleton is formed by the time intervals bounded by two successive dates within this set of dates.

[0080] [Fig.4] illustrates an example of initialization of such a skeleton 13 for a given core. In this example, 3 tasks, A, B, C are to be scheduled. The skeleton 13 is therefore based on the temporal data associated with these 3 tasks, that is to say: - For task A, a start date tAS and an end date t^, - For task B, a start date tBS and an end date tBF, - For task C, a start date tes and an end date tcF.

[0081] Each task can be represented by a time interval in the figure. The skeleton 13 consists of a subdivision of time intervals bounded by two successive dates from the set of dates considered: tAsJap, tBS, tBF, tes, tcF. We thus obtain a skeleton formed from the sequence of intervals [tAS, tBS], [tBs,tcs], [tcs,tBF], [tBFt af], [Iaf, tcF]-

[0082] In a step S2, the different tasks to be scheduled on a given core are sorted in a given order. This sorting is advantageously carried out upstream of the loop which follows, according to the method of this implementation, in order to pool this sorting processing, but according to other embodiments, it could be envisaged to choose a new task to be assigned to each iteration without carrying out this prior sorting.

[0083] This order can be global, that is to say for all the cores of the computer 30. Indeed, this order must in particular take into account the precedence relationships between tasks and this relationship is independent of the cores on which the tasks are deployed.

[0084] This precedence constraint can be taken into account as the first sorting criterion. A second sorting criterion can be the due date of the tasks.

[0085] Thus, the sorting algorithm orders the tasks according to the following rules:

[0086] For each pair of tasks A, B, A is before B if and only if

[0087] There is a precedence constraint where A precedes B, or

[0088] If there is no precedence constraint where B precedes A and - The start date of task A is before the start date of task B, or, if these are equal, - The due date of task A is before the due date of task B, - If these dates are equal, the name of task A precedes the name of task B lexicographically.

[0089] This last condition is an example for providing a sorting rule that is deterministic in all cases. Obviously, other embodiments are possible allowing this same objective of determinism.

[0090] As illustrated in the flowchart of [Fig.3], the subsequent steps are iterative, each iteration considering one of the tasks to be scheduled.

[0091] A step S3 consists of selecting a task according to a given order, this order being able to come from the prior sorting step S2. This selection consists of starting from the first task according to this order then continuing to the following iterations according to this order.

[0092] This allocation of a task can be carried out by fragments, or frames (or "fragments" in English) of processing. Each fragment is allocated to a time interval of the scheduling plan, independently of the other fragments of the same task. In other words, for a given task, its allocation is carried out fragment by fragment.

[0093] The allocation of fragments is subject to constraints including: - A timing constraint: all fragments must be allocated in intervals of the scheduling plan that begin after the task's start date, and end before its due date, - An execution time constraint: the sum of the durations of all fragments of a task must be equal to the execution time of the task (as indicated in the time data provided as input), - A precedence constraint: the first (temporally) fragment of a task must begin after the terminations of the last fragments of the tasks which are in a precedence relationship, - An exclusion constraint: fragments of the task must not overlap fragments of other tasks with which there are exclusion constraints.

[0094] Two preliminary calculation steps S4, S5 may be carried out preferentially before the iteration phase starting at step S6 and considering each time interval of the scheduling plan. As previously, this is a preferred embodiment making it possible to pool processing operations rather than carry them out at each iteration, i.e. for each time interval to be considered. Other embodiments are however conceivable.

[0095] A step S4 aims to determine a time from which the time intervals can be considered to allocate fragments of the task. This time depends both on the start date of this task (which is provided by the time data associated with the task) and on the time precedent links. In other words, this time is determined, or calculated, by the latest date between the start date of the task and the completion dates of the tasks having a precedent relationship with it (these completion dates correspond to the completion dates of the last fragment of these tasks).

[0096] The fragments of the task can be positioned, or allocated, only from this moment.

[0097] A step S5 comprises determining a list of fragments corresponding to tasks having an exclusion relationship with the task being allocated.

[0098] Step S6 consists of selecting a time interval of the scheduling plan between the start date of the task and its due date. The intervals are selected iteratively in the time direction and starting with the interval beginning on the start date of the task.

[0099] In a step S7, a set of empty spaces within this time interval is determined which are not yet allocated to a task, and which begin after the start time calculated in step S4. This step amounts to calculating the intersection between these empty spaces and an interval beginning at the time calculated in step S4.

[0100] In a step S8, the overlaps with the fragments present in the exclusion list determined in step S5 are removed from this set.

[0101] In a step S9, fragments are allocated to the task in the remaining empty spaces.

[0102] When a time interval is considered, step S10 determines whether all of the fragments of the task have been allocated in the scheduling plan, before the task's due date. In other words, the sum of the durations of the different allocated fragments is compared to the execution time of the task, these having to be equal.

[0103] If yes, then a new task can be considered. We then move on to step SI 1.

[0104] Otherwise, two situations can occur: either there are still intervals available time slots in the scheduling plan before the task's due date. In this case, we loop back to step S6 to select a new time slot.

[0105] If, on the contrary, there are no more time intervals before this deadline, this means that all the fragments constituting this task cannot be allocated. A scheduling plan cannot therefore be generated.

[0106] According to one embodiment, we then loop back to step S2 in order to carry out a new sorting of the tasks, after having checked whether all the possible sortings have not already been tried (test S12).

[0107] In a step S1 1, it is determined whether a new task must be selected. If so, it loops back to step S3 to select a task according to a given order, determined in step S2. If not, the scheduling plan is finalized and can be transmitted, or provisioned, in the computer, in a step S13.

[0108] The loop linking step S10 to step S2 represents a backtracking mechanism. Indeed, the iterative phase S3-S11 of allocating tasks in the scheduling plan is dependent on the sorting phase, S2: depending on the order in which we seek to allocate the tasks in the scheduling plan, the result may be different, but above all we may or may not succeed in obtaining a scheduling plan.

[0109] Also, in case of failure (at step S10), another order can be considered in the tasks to be allocated.

[0110] According to one embodiment, a tree traversal is performed within the possible sorts. More precisely, a tree of possibilities can be traversed, and when a given sort (corresponding to a leaf of the tree) generates a failure, the tree is moved up to explore another branch. The method can here follow a classic tree exploration. A failure will be generated when all the branches of the tree have been explored without providing a scheduling plan, during the test step S12 (in the figure, this situation corresponds to the arrow coming out of step S12 to the left).

[0111] [Fig.5] illustrates an example of application of the proposed method on a set Initially, 3 tasks, A, B, C, must be scheduled on a computer with two cores. A fourth task, D, will then be added.

[0112] It is assumed that - tasks A and B are assigned to a first core, and task C is assigned to a second core, - task C has a start date of 0 and a due date of 10. - task C has an execution time equal to 5, - task C has a precedence relationship with task A and must wait for its termination. - Task C has an exclusion constraint with task B.

[0113] It is assumed that tasks A and B have already been allocated on the RSF1 scheduling plan corresponding to the first core.

[0114] Step S3 therefore consists of selecting the last task, C.

[0115] Step S4 of the algorithm consists of calculating an instant by searching for the latest of the dates among the start date of this task (here 0) and the completion dates of the tasks having a precedent over this task, here task A which ends in 3. This instant is therefore worth 3.

[0116] Step S5 consists of determining the list of excluded fragments.

[0117] For simplicity, let's identify the frames by their boundaries. For this example, this list is composed of a single element: [5, 7] (which corresponds to task B).

[0118] The following steps correspond to the loop over the time intervals.

[0119] In this example, there is only one interval in which task C can to run, it is the interval [0, 10].

[0120] Since no fragments are yet allocated in this interval, the empty space where the task can execute is [0, 10].

[0121] In step S7, the intersection of this interval [0, 10] with the interval [3, 10] is calculated. The result is [3, 10].

[0122] In step S8, we remove the overlaps with the intervals in the exclusion list. This divides our empty space into two subspaces: [3, 5] and [7, 10].

[0123] In step S9, fragments can be allocated for task C in these two intervals while respecting the constraints thereof.

[0124] We check in step S10 that the sum of the durations of these two fragments is equal to the execution time of task C, we can stop here (steps S11 and S13).

[0125] If another task D were to be scheduled on the first core, a fragment could for example be allocated to it on the interval [3, 10] provided that it has no exclusion constraints with task C (which executes on the same interval as it), that it has a start date not earlier than time 3 and that it has no precedence constraint with another task, except possibly task A.

[0126] According to one embodiment, the allocated fragments can be assigned a start date within the scheduling plan. This information allows, and requires, the real-time operating system, RTOS, to start the execution of this processing fragment on this date, even if the core concerned is available earlier. It therefore prohibits certain dynamic operations of the real-time operating system.

[0127] This start date is a function of the start date of the time interval in which the fragment is allocated. This date may typically correspond to the start date of the time interval.

[0128] Indeed, certain real-time operating systems may have dynamic orchestration functionalities allowing the start of a fragment to be anticipated.

[0129] Indeed, the processing of a task can be executed more quickly than the execution time planned in the temporal data, which represents a worst case. Therefore, a fragment allocated in the scheduling plan can finish before the end date of the time interval in which it was allocated. The operating system can then plan to start the allocated fragment in the following time interval, in anticipation. This functionality seems interesting in certain situations, since it generally allows faster processing and frees up flexibility for the rest of the scheduling plan.

[0130] However, this anticipation can be harmful in certain situations, particularly in the case where the anticipated fragment overlaps fragments allocated on other cores of the computer with which exclusion constraints exist.

[0131] It may therefore be planned to assign a start date to a fragment if (and in particular only if) this fragment would not overlap with a fragment of another task with which there is an exclusion constraint on the time interval preceding the planned time interval.

[0132] [Fig.6A] illustrates an example of a situation in which the mechanism for assigning a start date to a fragment can be implemented.

[0133] In this example, it is assumed that tasks B and C have an exclusion constraint. Task B was allocated to a time interval [3; 5], following a first time interval [0; 3] to which a task A was allocated. The duration of this interval [0; 3] could be determined during the construction of the skeleton of the RSF1 scheduling plan based on an expected execution duration for task A.

[0134] As illustrated in [Fig.6B], it turns out that the processing of task A is shorter than expected. In the illustrated situation, no mechanism for assigning a start date is put in place: the operating system then anticipates the start of the fragment corresponding to task B in order to benefit from the freed machine time. It then follows that the execution of this task B can cause interference (concurrent access to shared resources) with task C, which can minimally disrupt the operation of these two tasks. The exclusion constraint between two tasks provided for by the generation of the scheduling plans becomes inoperative due to the dynamic anticipation carried out by the RTOS operating system (thus no longer strictly following these scheduling plans RSF1, RSF2).

[0135] In the situation illustrated by [Fig.6C], a start date has been assigned to the fragment of task C, which corresponds to the start date of the time interval to which it was allocated (i.e. the value 5). In this case, the RTOS operating system does not anticipate the start of this fragment but waits for the indicated date before starting its execution.

[0136] As seen previously, it is possible for the developer of a real-time application to define exclusions between tasks, in order to avoid or mitigate interference. This mechanism for assigning a start date for the fragments, determined automatically by the scheduling tool 20, makes it possible to guarantee compliance with these exclusions even in the case where the RTOS operating system performs dynamic orchestrations during the execution of the tasks.

[0137] Furthermore, according to one embodiment of the invention, each time interval of a scheduling plan can be assigned a date from which a background task can be executed.

[0138] By definition, a background task, unlike a task (of the real-time application), is not statically scheduled in the scheduling plan. It is dynamically scheduled and executed in the time left available within a scheduling time interval, after the execution of the critical real-time tasks.

[0139] The execution of these background tasks must not generate temporal interference on other cores, and therefore jeopardize the temporal partitioning of an application.

[0140] In order to avoid these interferences between tasks and background tasks, the exclusion mechanism previously described is extended to background tasks.

[0141] More precisely, the scheduling tool 20 is adapted to assign an end date to at least the time intervals concerned, this end date corresponding to the latest date of the fragments allocated on the time interval in all the scheduling plans (i.e. on all the cores of the computer 30).

[0142] This end date delimits the time interval into a first part reserved for real-time tasks, and a second part in which background tasks can be executed (because they can no longer cause interference with other tasks from other cores).

[0143] [Fig.7A] and [Fig.7B] illustrate an example of two scheduling plans, without and with assignment of an end date to the time intervals.

[0144] In this example, it is assumed that background tasks D can generate interference with task B. It is assumed that the scheduling plans are subdivided into three time intervals [0; 3], [3; 8] and [8; 10].

[0145] In [Fig.7A], within the RSF2 scheduling plan relating to the second core of the computer, the first time interval is allocated to a task C. The second time interval not being allocated to a task, the RTOS operating system triggers the execution of background tasks, likely to generate interference with task B, allocated to this same time interval on the RSF1 scheduling plan associated with the first core of the computer.

[0146] In [Fig.7B], an end date is assigned to this second interval. This end date has as its value the termination date of the different fragments allocated on all the scheduling plans. In this example, only one fragment is allocated in this time interval: that of task B. The end date for this interval therefore takes as its value its termination date, and the RTOS operating system uses this end date to trigger the execution of background tasks D.

[0147] The preceding description is based on time to manage the orchestration of the triggers of the execution of tasks (the “time triggered” approach in English, i.e. “triggered by time”).

[0148] However, instead of managing mutual exclusion by the flow of time, it would be possible to rely on explicit synchronization mechanisms, such as mutexes (for "mutual exclusion" in English) or semaphores. Note that a "time-triggered" approach is generally more favorable to "event-triggered" approaches (or "triggered by event") when operational safety is required. This variation remains particularly interesting because it is fully equipped: it allows the automation of the use of primitives that an operating system makes available to users, but without offering guarantee. Here, our alternative approach would allow safe use of these primitives, which otherwise must be manually verified by application developers.

[0149] [Fig.8A] to [Fig.8D] illustrate another example of the progress of the described method.

[0150] [Fig.8A] illustrates, in the form of a timing diagram, the time data of three tasks, A, B, C.

[0151] We further assume the following constraints: - An exclusion constraint between tasks A and B. - An exclusion constraint between tasks B and C. - Task A is allocated to core 1 (associated with a scheduling plan RSF1) - Task B is allocated to core 2 (associated with an RSF2 scheduling plan). - Task C is allocated to core 3 (associated with an RSF3 scheduling plan).

[0152] The first step, SI, consists of, for each core, initializing a scheduling plan per core, respectively RSF1, RSF2, RSF3, subdivided into time intervals from the time data of the tasks planned for this core.

[0153] In this example, since each task is implemented on a different core, the scheduling plans of the three cores have the same intervals as those of the tasks.

[0154] Step S2 of sorting the tasks can be done on the basis of their completion dates (no precedence being indicated), i.e. the order A, B, C.

[0155] As illustrated in [Fig.8B], we therefore begin to allocate task A, then task B. In trying to allocate task C, we detect an impossibility since the available time interval is shorter than the execution time of this task C.

[0156] A backtracking mechanism is then implemented, by going up the tree of possibilities. The branch corresponding to the initial sort ABC is eliminated, and the immediately neighboring branch (topologically in the tree) is selected: ACB.

[0157] As illustrated in [Fig.8C], we therefore allocate task A first. Then task C, having an exclusion constraint with task C, is allocated after it in the time direction. Task B can then no longer be allocated because there is no more empty space in its RSF2 scheduling plan.

[0158] The backtracking mechanism is again used to explore another branch of the tree. Starting from task A, all branches have been explored, the The exploration mechanism therefore determines to start with the next task in the initial order, i.e. task B. The first branch to explore is then BAC.

[0159] As illustrated in [Fig.8D], we begin to allocate task B.

[0160] Then we allocate task A, which has an exclusion constraint with task B and is therefore allocated to the next time interval.

[0161] Then, we allocate task C. This also has an exclusion constraint with task B, but not with task A. The time interval following the termination of task B is therefore available for it. It is therefore allocated on this interval and executes in parallel with task A.

[0162] The three scheduling plans RSF1, RSF2, RSF3 obtained therefore form a valid solution.

[0163] The proposed method therefore responds to the problems initially exposed and presents numerous advantages compared to current state-of-the-art solutions.

[0164] In particular, it offers a means of mitigating temporal interference by calculating static scheduling plans for each of the execution cores, all of which guarantees temporal exclusion of access to hardware resources shared by the different processes hosted on separate cores. Unlike existing systems, it incorporates mutual exclusion constraints into this scheduling, allowing safe and systematic synchronization of tasks and the scheduler across all cores.

[0165] This method thus meets the objectives of document AMC20-193, applicable to critical aeronautical digital systems based on multi-core hardware components.

[0166] Furthermore, the proposed method also makes it possible to reconcile the scheduling of real-time tasks with non-real-time tasks, while preserving the mutual exclusion constraints.

[0167] Another advantage is being able to mitigate these temporal interferences without necessarily modifying the tool (RTOS operating system) used to execute the tasks on the computer.

[0168] Of course, the present invention is not limited to the examples and the embodiment described and shown, but is defined by the claims. It is in particular susceptible of numerous variants accessible to those skilled in the art.

Claims

Claims

1. Method for scheduling a set of tasks on a multitask computer (30), comprising at least one processing core, said method comprising - for each core of said computer, initialize (SI) a scheduling plan (13) subdivided into time intervals from time data (12) obtained for each task (11) of said set provided for said core, - iteratively allocating (S3-S11) processing fragments for each task planned for said core in the respective scheduling plan, considering said tasks in an order dependent on temporal precedent links defined for said tasks, and respecting a set of constraints consisting of: a. to iteratively consider each time interval of said scheduling plan (13) not yet allocated to a task, b. to position said fragments in said scheduling plan at the earliest at a time determined from said temporal precedent links and a start date of said task defined by said temporal data, c. not to position said fragments in overlap with fragments of another task with which there is an exclusion constraint, among the set of scheduling plans, and determining (S 10) whether all processing fragments of said task are allocated in said scheduling plan (13) before a due date associated with said task, defined by said time data - transmitting (S 13) all of said scheduling plans (13) to said computer (30).

2. A method according to the preceding claim, wherein iteratively allocating processing fragments for each task provided for said core comprises steps of - calculation (S4) of said instant from said temporal precedence links, by searching for the latest of the dates among the start date of said task and the completion dates of the tasks having a precedence over said task, - determination (S5) of a list of fragments corresponding to tasks having a precedence relationship with said task; - selection (S6) of a temporal interval of said scheduling plan (13), and, for said selected temporal interval, determination (S7) of empty spaces not yet allocated to a task, from said instant, deletion (S8) of the empty spaces associated with an exclusion constraint for said task, then allocation (S9) of remaining empty spaces to a fragment of said task.

3. Method according to the preceding claim, in which if (S 10) the sum of the durations of the intervals allocated to said task is less than the execution time associated with said task and no interval not yet allocated is available before a deadline associated with said task, then the allocations of said task are deleted and an attempt is made to allocate another task.

4. Method according to the preceding claim, comprising a step (S2) of sorting the tasks of said set of tasks, and a step (S3) of selecting a task according to said sorting, and in which trying to allocate another task comprises a new sorting (S2) of said tasks, after having checked (S12) whether all possible sorts have not been tried.

5. A method according to the preceding claim, wherein attempting to allocate another task comprises a tree traversal within said possible sorts.

6. Method according to one of claims 2 to 5, comprising, when allocating a processing fragment, an assignment to said fragment of a start date within said scheduling plan as a function of the start date of said selected time interval.

7. A method according to the preceding claim wherein said start date is assigned to a fragment only if said fragment does not would not overlap a fragment of another task with which there is an exclusion constraint on the time interval preceding said selected time interval.

8. Method according to one of the preceding claims comprising an assignment of an end date to a time interval, said end date corresponding to the latest date of the fragments allocated on said time interval in all of said scheduling plans.

9. Computer program comprising instructions for implementing a method according to one of the preceding claims when it is executed by a processor of a configuration device.

10. Configuration equipment comprising at least one processor and circuits adapted to implement the method according to one of claims 1 to 8, in the form of a scheduling tool (20).

11. Multitasking computer having a set of cores and adapted to execute a real-time operating system adapted to execute tasks according to a set of scheduling plans determined by a method according to one of claims 1 to 8.

12. Vehicle comprising at least one multitask computer according to the preceding claim.

Images