Determining the Worst-case Synchronous Message Response Time in ...

Determining the Worst-case Synchronous Message Response Time in FDDI Networks S IJING Z HANG1 , E. S TEWART L EE2

AND

A LAN BURNS3

1 School of Mathematics and Computing, University of Derby, Kedleston Road, Derby DE22 1GB, UK 2 Centre for Communications Systems Research, University of Cambridge, 10 Downing Street,

Cambridge CB2 3DS, UK 3 Real-Time Systems Group, Department of Computer Science, University of York, Heslington,

York YO1 5DD, UK Email: [email protected] Finding the worst-case message response time is important for guaranteeing message deadlines in any hard real-time communication environment. This paper proposes an O(n)-time algorithm for exactly capturing the worst-case synchronous message response time in an FDDI network for any given set of synchronous message streams whose message deadlines are no longer than periods. The proposed algorithm can be used to form an optimal test on whether or not a given setting of network parameters can meet the message deadline constraints for a considered synchronous message set with deadlines no longer than periods. Received 10 August 1999; revised 22 November 2000

1. INTRODUCTION There is increasing use of distributed computer systems to support real-time applications. The key to successfully developing such systems is to have a communication network that supports the timely delivery of inter-task messages. In a distributed system for hard real-time application, communication through message exchange between tasks residing on different nodes has to happen in bounded time, in order to ensure that end-to-end deadline requirements are met. The Fiber Distributed Data Interface (FDDI) network [1] supports hard real-time communication not only due to its high speed but also because of its inherent timing property of bounded medium access time. It is this special property of the bounded access time, which is necessary for guaranteeing deadlines of real-time messages, that has made the FDDI network one of the most suitable and attractive candidate networks for distributed hard real-time applications [2, 3]. Many embedded real-time applications use FDDI as a backbone network. For example, FDDI has been adopted by the US Navy Next Generation Computer Resources Program as part of its Survivable Adaptable Fiber Optic Embedded Network (SAFENET) [4]. FDDI has also been selected as the backbone network for NASA’s space station Freedom [5]. FDDI uses, at its medium access control (MAC) layer [1], the timed token protocol whose basic ideas were first proposed by Grow [6]. With this protocol, messages are distinguished into two types: synchronous and asynchronous. Synchronous messages are periodic T HE C OMPUTER J OURNAL,

messages which arrive at regular intervals and have delivery time constraints. Asynchronous messages are nonperiodic and have no time constraints. During network initialization time, all nodes negotiate a common value for the target token rotation time (TTRT) which should be small enough to satisfy the response-time requirements of all nodes. Each node i is assigned a fraction Hi of the TTRT as its synchronous bandwidth, which is the maximum amount of time the node is allowed to transmit its synchronous messages every time it receives the token. Whenever node i receives the token, it transmits its synchronous messages (if any) first for a time up to Hi . Asynchronous messages can then be sent, but only if the token has arrived at node i earlier than expected. That is, synchronous traffic is assigned a guaranteed bandwidth while the leftover bandwidth (unallocated, unused or both) is dynamically shared among all the nodes for asynchronous traffic. Due to its suitability for distributed real-time applications, the timed token protocol has attracted considerable attention in the past few years. Extensive research has been done on the use of FDDI networks to support hard realtime applications, with focus on appropriate allocation of synchronous bandwidth. Synchronous bandwidth, defined as the maximum time for which a node is permitted to transmit its synchronous messages whenever it captures the token, has proved to be a key sensitive network parameter for timely transmission of synchronous traffic [7]. If the synchronous bandwidth allocated to a node is too small, the node may not have enough network access time to transmit its synchronous messages before their deadlines. On the Vol. 44, No. 1, 2001

32

S. Z HANG , E. S. L EE AND A. B URNS

other hand, allocating too much synchronous bandwidth to nodes can result in a long token rotation time, which can also cause message deadlines missed. Much work has been done on appropriate allocation of synchronous bandwidth and as a result many synchronous bandwidth allocation (SBA) schemes for guaranteeing synchronous message deadlines have been developed [3, 5, 7, 8, 9, 10, 11, 12, 13]. Besides synchronous bandwidths, another critical network parameter that can significantly affect the network performance in guaranteeing synchronous traffic is the TTRT. A smaller TTRT leads to a smaller amount of effective synchronous bandwidth and less available network utilization. Conversely, if the TTRT is too large, a node may not receive the token often enough to meet message deadlines. Studies on how to select TTRT so that the guarantee ability of a previously-proposed SBA scheme of good performance can be maximized has recently been reported [5, 14]. These studies focus on careful assignment of all network parameters (i.e. selection of TTRT and allocation of synchronous bandwidth in an integrated way) in order to enhance the network’s overall ability to guarantee timed-constrained synchronous traffic. While more and better SBA schemes as well as a few good guidelines on selection of TTRT have been proposed in the context of deadline guarantees of synchronous messages, the problem of how to determine whether or not a given setting of network parameters (i.e. the TTRT plus synchronous bandwidths allocated to all nodes of the network) can guarantee the timely transmission of all synchronous messages before their deadlines become more urgent. A synchronous message set is said to be schedulable (or able to be guaranteed) under a given setting of network parameters if the network parameters can ensure that all synchronous messages will be transmitted without missing deadlines, i.e. if they satisfy not only the protocol constraint (of the FDDI network) but also the deadline constraint (of the considered synchronous message set) [15]. The method widely used in the past for testing the deadline constraint is to estimate the minimum time available for each node i to transmit synchronous messages between the arrival of a synchronous message and the expiration of the message’s deadline, denoted as Xi , and then check if it is no less than the message’s requested transmission time. To test the deadline constraint correctly in this way, an exact value of Xi is required. Unfortunately, due to the extreme complexity of the timing behaviours of the FDDI MAC protocol, so far no one, to the best of our knowledge, has derived a general formula which can calculate the exact value of Xi . The previous expressions on available transmission time (which were wrongly supposed to be Xi expressions by the original authors at the time they were published), first derived by Chen et al. [9, 16] and later improved by Zhang and Burns [17], only give a lower bound on Xi and may produce too pessimistic a result of available transmission time which could be much smaller than that actually obtained in practice [15]. The research presented in this paper was motivated by the idea of tackling the problem of testing the message T HE C OMPUTER J OURNAL,

deadline constraint in a different way. Instead of striving for derivation of an exact Xi expression (for calculating the exact value of Xi ), we shall propose a way to exactly capture the worst-case message response time which is defined, in this paper, as the longest possible delay between the arrival of a message and the completion of its transmission. Clearly, a message can always be transmitted before its deadline if its worst-case response time is no longer than the message’s relative deadline. This paper proposes, for the first time, an algorithm that can search the longest possible delay experienced by a synchronous message from its arrival (at the transmitting buffer of the sending node) to the completion of its transmission. As an important application, the proposed algorithm can be used to form an optimal test on whether or not a considered synchronous message set with deadlines no longer than periods (interarrival times) is schedulable under a given setting of network parameters. The rest of this paper is organized as follows. In Section 2, we describe the framework under which this research is conducted. In Section 3 we state the worstcase situation for transmission of synchronous traffic. We then present in Section 4 an analysis of how to capture the worst-case synchronous message response time by an algorithmic method. Finally, the paper concludes with Section 5. In Appendix A, we show an application of the proposed algorithm in testing the schedulability of synchronous message sets, and compare different testing methods by numerical examples, all of which demonstrate the superiority of the proposed method to others. 2. PRELIMINARIES In this section, we first introduce the network and message models suitable for real-time applications. Then we briefly review the timed token protocol employed by FDDI networks. Finally we address necessary constraints on network parameters for guaranteeing synchronous traffic. 2.1. Network and message models The network is assumed to consist of n nodes forming a ring and to run normally with no failures. Message transmission is controlled by the FDDI MAC protocol. Due to the inevitable overheads involved, such as ring latency, the total bandwidth available for synchronous message transmission during one complete traversal of the token around the ring is less than TTRT. Let τ be the portion of TTRT unavailable for transmitting synchronous messages. Without losing generality [7], each node i is assumed to have one stream of synchronous messages, denoted as Si . A total of n synchronous message streams forms a synchronous message set M, i.e. M = {S1 , S2 , . . . , Sn }. Each stream Si is characterized by a triple (Ci , Di , Pi ), i.e. Si = (Ci , Di , Pi ) where •

Ci is the time required to transmit a maximum-size message from stream Si ,

Vol. 44, No. 1, 2001

S YNCHRONOUS M ESSAGE R ESPONSE T IME • •

Di is the relative deadline of messages from stream Si , i.e. if a message from stream Si arrives at time t, it must be transmitted by time t + Di , and Pi is the period length of synchronous messages from stream Si , i.e. the minimum message inter-arrival time for messages from Si .

Each node can also have asynchronous messages to send, which are nonperiodic and do not have a hard real-time deadline requirement. This paper is related to guaranteeing synchronous messages with deadlines no longer than periods. In the rest of this paper we assume Dj ≤ Pj (j = 1, 2, . . . , n) for any synchronous message set considered. Because under this assumption a synchronous message must be transmitted before the arrival of the next message from the same stream (in order to meet the message deadline), we assume that a node cannot transmit two successive synchronous messages from the same stream during any one single token visit. We also assume in this study that the packet size in transmission time (for packets from stream Si ) is the same as the amount of synchronous bandwidth allocated (i.e. Hi for node i); and that the message length Ci is calculated such that all other overheads incurred (except those signified by τ ), such as the packet head and the time spent in packetizing, etc., have been taken into account. 2.2. FDDI MAC protocol

•

•

•

Token rotation timer of node i (TRT i ): this timer is initialized to TTRT and is always enabled. TRT i counts down until it either expires (i.e. TRT i = 0) or until the token is received early (i.e. earlier than expected since the token’s last arrival at the node). In either situation, the TRT i is reinitialized to TTRT and enabled again (starting the counting down process). Late counter of node i (LCi ): this counter is initialized to zero and used to keep track of the number of times that TRT i has expired since the token last arrived at node i. LCi is incremented each time TRT i expires and is reset to zero whenever node i receives the token. The token is said to arrive early at node i if LC i = 0 at the time of its arrival. Otherwise, if LC i > 0 (normally LC i = 1), the token is considered to be late.1 Token holding timer of node i (THT i ): this timer is set to the current value of TRT i on a token’s arrival at node i (only if the token arrives early). This timer also counts down, but is enabled only during asynchronous

1 During normal ring operation LC should not exceed one. But if i LCi > 1, the ring recovery process will be initiated.

T HE C OMPUTER J OURNAL,

FDDI N ETWORKS

33

transmission in order to control the amount of time for which the node i can transmit asynchronous messages. When the token arrives early at node i, the current value of TRT i is placed in THT i , and TRT i is then reset to TTRT. Synchronous frames, if any, can be transmitted for a time not to exceed its allocated synchronous bandwidth (Hi ). The node may then transmit its asynchronous frames (if any) until THT i or TRT i expires (i.e. as long as both THT i and TRT i are greater than zero). On the other hand, when the token is late on its arrival at node i (i.e. LCi = 1), the LCi is reset to zero. In this case, node i is still permitted to transmit synchronous frames for a time no more than Hi , but no asynchronous frames are allowed to transmit. Due to space limitation, we shall not further describe this protocol here. Interested readers can refer to [1, 18, 19, 20] for more details. 2.3. Requirements on network parameters Synchronous bandwidths allocated to all nodes in the network (i.e. all Hi ’s together) are usually represented by an allocation vector HE , i.e. HE = (H1 , H2 , . . . , Hn ). In order to guarantee timely transmission of all synchronous messages before their deadlines, network parameters (i.e. HE and TTRT) must be appropriately selected and set such that the following two constraints are met [7]. •

Scheduling messages for transmission over FDDI networks is the function of the FDDI MAC protocol. FDDI employs the timed token access protocol which was first proposed by Grow [6]. The basic ideas of the protocol have been briefly stated in Section 1. In this subsection we further review some relevant features of the FDDI MAC protocol. With this protocol, each node has two timers and one counter.

IN

Protocol constraint: the sum total of the synchronous bandwidths allocated to all nodes in the ring should not be greater than the available portion of the TTRT, i.e. n X

Hj ≤ TTRT − τ.

(1)

j =1

•

Deadline constraint: every synchronous message must be transmitted before its deadline. That is, if a message from Si (with deadline Di ) arrives at time t, it must be transmitted by time t + Di .

One way to test the deadline constraint is to find the worstcase response time of a synchronous message and then to compare it with the message’s (relative) deadline. Let Ri be the worst-case message response time for a synchronous message from stream Si (i.e. the longest possible delay between the arrival of a message from Si and the completion of the message’s transmission); then the deadline constraint is met if and only if Ri ≤ Di .

(2)

Note that the above test given by (2) is both sufficient and necessary (and thus optimal). That is, violation of (2), i.e. Ri > Di , implies that the deadline constraint of synchronous message stream Si cannot be met in the worst case. The testing method widely used in the past is with the aid of a lower bound on Xi (where Xi is the minimum time available for node i to transmit its synchronous messages during Di , i.e. in the interval (t, t +Di ]). Let XiLB (XiLB ≥ 0) Vol. 44, No. 1, 2001

34

S. Z HANG , E. S. L EE AND A. B URNS

represent a lower bound on Xi , then the deadline constraint can be met if XiLB ≥ Ci .

(3)

It should be stressed here that unlike (2), the test through (3) is only sufficient (but not necessary). That is, if XiLB < Ci , whether the given setting of network parameters can satisfy the deadline constraint remains unknown (and this, in any sense, does not mean that the given network parameters cannot satisfy the deadline constraint). An assignment (i.e. a given setting) of network parameters is said to be feasible if it meets both the protocol and deadline constraints for a considered synchronous message set (and in this case we also say that the given setting of network parameters can guarantee the message set). A synchronous message set is said to be schedulable (or able to be guaranteed) by a given setting of network parameters if the network parameters satisfy both the protocol and deadline constraints. Since the test via (2) on the message deadline constraint is optimal, (2) and (1) together will form an optimal test on whether or not a considered synchronous message set is schedulable under a given setting of network parameters. The research presented in this paper contributes to the optimal test by proposing an algorithm that can find the exact value of Ri . In [21] a necessary constraint for a feasible assignment of network parameters has been derived: n X

min{Hj , Cj } ≤ min{Dmin − TTRT − τ, TTRT − τ }

T HEOREM 1. The worst-case situation for transmission of a synchronous message from stream Si (of a synchronous message set with message deadlines no longer than periods) happens with some time instant t0 at which node i receives the token, subject to the following conditions: (1) there is not a synchronous message ready to be sent in node i at time t0 , so the transmission right is internally passed on to asynchronous traffic within the same node i. But, just at that moment (i.e. immediately after t0 ), a message from Si arrives and becomes ready for transmission; (2) in any early visit of the token to a node after time t0 inclusive there are enough asynchronous messages to send such that all available asynchronous bandwidth can be consumed; (3) in the immediately-previous token rotation ending with time t0 , there were no messages, neither synchronous nor asynchronous, ready to be sent on the token’s visit to each node; (4) in the previous token rotation ending at time t0 , a synchronous message from each stream Sj (j 6= i) arrived in node j immediately after the token was passed on to the subsequent node (because no asynchronous messages were available to transmit, as stated in (3) above), and another message from the same stream Sj keeps arriving every Pj units of time. A formal proof to Theorem 1 can be found in [22]. Interested readers can also refer to [15] for an informal explanation of the worst-case scenario.

j =1

4. THE ALGORITHM

(where Dmin = min{D1 , D2 , . . . , Dn }). (4) This constraint may help determine the unschedulability for some unschedulable synchronous message sets. The violation of (4) means that the considered synchronous message set cannot be guaranteed (i.e. is unschedulable) under the given setting of network parameters. 3. THE WORST-CASE SCENARIO The worst-case situation for transmission of a message from Si is defined as the situation where the message experiences the longest possible response time. When such a message unfortunately happens to be transmitted in the worst-case situation, its transmission will experience the maximum possible (overall) interference caused by the transmission of both synchronous messages from all other nodes and asynchronous traffic from every node on the ring. If the message can meet its deadline in the worst-case situation, it will certainly be guaranteed in any non-worst-case situation. Zhang and Lee [22] studied the worst-case scenario for transmission of a synchronous message from any of a set of synchronous message streams with message deadlines no longer than periods in an FDDI network. They have derived the conditions under which the worst-case situation can happen, as formally stated in the following theorem. T HE C OMPUTER J OURNAL,

In this section we propose an algorithm, Alg Ri, for calculating the exact value of Ri . 4.1. Definition of terms We first define and explain some new terms to be used by the Alg Ri algorithm (or in its description later on). To help understand and follow the Alg Ri algorithm, all terms used by Alg Ri are summarized in Table 1. •

•

Token visits to nodes are indexed by a pair of integers, say, c, j , where c and j indicate respectively the token cycle and the node being visited. That is, visit c, j denotes the token’s cth visit to node j . The following natural ordering is assumed: visit c, j is followed by visit c, j + 1 if 1 ≤ j < n or by visit c + 1, 1 if j = n. If j = 1 when c, j − 1 is used to denote the visit before c, j ; then c, j − 1 should be taken to be c − 1, n. Similarly, if j = n, c, j + 1 should be taken to be c + 1, 1. To simplify presentation, we may use c, j + 1 to mean the visit immediately after c, j although visit c, j + 1 can be exactly expressed as c + bj/nc, (j mod n) + 1 (where mod n represents modulo n operation which ensures that the pair (of integers) of the immediately subsequent visit fall into the valid range and are

Vol. 44, No. 1, 2001

S YNCHRONOUS M ESSAGE R ESPONSE T IME

IN

FDDI N ETWORKS

35

TABLE 1. Glossary of terms. Term n Sj Cj Dj Pj Rj TTRT Hj HE τ mod n c, j c, j − 1 c, j + 1 h(c, j ) a(c, j ) τ (c, j ) t0 t (c, j ) t (1, i) t (0, i) tsrj nomj

• •

•

•

•

Definition The number of nodes on the ring. The synchronous message stream at node j (1 ≤ j ≤ n). The length (i.e. transmission time) of a message from Sj . The relative deadline of a message from Sj . The inter-arrival time (i.e. period) of messages from Sj . The worst-case message response time for a message from Sj . The target token rotation time. The synchronous bandwidth allocated to node j . An allocation vector, i.e. HE = (H1 , H2 , . . . , Hn ). The time unavailable for message transmission in one complete token rotation. The ‘modulo n’ operation. A pair of integers used to index the token’s cth visit to node j . The visit immediately before c, j . The visit immediately after c, j . The time spent transmitting synchronous messages in visit c, j . The time spent transmitting asynchronous messages in visit c, j . The overheads involved in the visit of c, j . Assume τ (c, j ) = τ/n. The worst-case instant specified in Theorem 1. Assume t0 = 0 (the absolute time zero). The time instant when the token makes its cth arrival at node j . t (1, i) = t0 (the worst-case instant for transmission of a message from Si ). The starting instant of the previous token rotation ending with t (1, i). The time still required for completing transmission of the current message from Sj . The number of messages that has arrived so far from Sj (1 ≤ j ≤ n, j 6= i) since time t (0, i).

correctly represented as the natural ordering defined above). Similarly, we may use c, j − 1 to refer to the visit immediately before c, j . Signs ≤ and ≥ can be used to link two visits. x, y ≤ c, j (x, y ≥ c, j ) means that visit x, y is no later than (no earlier than) visit c, j . Let t (c, j ) be the time when the token makes its cth arrival at node j . For easy construction of the proposed algorithm and simple reference to time, let t (1, i) be the absolute time zero and assume that the time t0 (the worst-case instant), specified in Theorem 1, happens at time t (1, i), i.e. t0 = t (1, i) = 0. With t (1, i) = t0 = 0 we can use t (0, i) to represent the starting time of the immediately previous token rotation before time t0 . Let tsr j denote the time still required before the message deadline expires, for finishing the transmission of the current message from Sj (in the transmitting buffer of node j ), which could be either an untransmitted whole message or a partially transmitted (but unfinished) message from stream Si . Thus, tsrj ≤ Cj . Let nomj be the number of messages that have arrived so far from stream Sj after t (0, i). This variable is useful for checking whether a new message from Sj has arrived. Let τ (c, j ) denote the amount of various overheads possibly involved (which is unavailable for message transmission) in visit c, j , i.e. between t (c, j ) and t (c, j + 1). To simplify calculation we assume that the amount of overheads involved in every visit is the same, i.e. τ (c, j ) = τ/n (c ≥ 0; 1 ≤ j ≤ n). T HE C OMPUTER J OURNAL,

•

Let h(c, j ) represent the time spent in transmitting synchronous traffic on visit c, j . According to the FDDI MAC protocol [1], each node j can transmit its synchronous messages for a time up to Hj . So we have h(c, j ) ≤ Hj . Further, each node j will use the available synchronous bandwidth no more than the required amount (of tsrj ) although its allocated amount (of Hj ) can be more than the required amount.2 That is, h(c, j ) ≤ tsrj . Finally, because it makes no sense (for a hard real-time system) to continue transmitting a deadline-missed message, the transmission of an unfinished synchronous message should stop immediately after the message deadline expires, i.e. h(c, j ) ≤ the time left (at time t (c, j )) before the message deadline (of the latest unfinished message from Sj ) expires where ‘the time left . . . ’ is assumed to have a value of zero when the message deadline has already missed at time t (c, j ) (since h(c, j ) can never have a negative value). Based on the above analysis, considering all the constraints on h(c, j ), we have h(c, j ) ≤ min{Hj , tsr j , the time left (at time t (c, j )) before the message deadline expires}. (5)

2 For example, to complete the transmission of a long message from stream Sj , node j may need several successive visits (of the token to the node), and the synchronous bandwidth required to send the last frame of the long message (on the last token visit), which is reflected by variable tsr j , can be less than the available allocated amount of Hj .

Vol. 44, No. 1, 2001

36 •

S. Z HANG , E. S. L EE AND A. B URNS Let a(c, j ) be the times spent in transmitting asynchronous traffic on visit c, j . According to the specification of the FDDI MAC protocol [1], each node j can transmit its asynchronous messages only when the time elapsed since the previous token arrival at the same node j is less than TTRT and the transmission can last up to the amount of time by which the token arrived early. So we have a(c, j ) ≤ max{0, TTRT − [t (c, j ) − t (c − 1, j )]}. (6) Further, based on the protocol, any node cannot hold the token for more than TTRT units of time. So, a(c, j ) ≤ TTRT − h(c, j ).

(7)

Combining (6) and (7) into one, we get a(c, j ) ≤ min{TTRT − h(c, j ), max(0, TTRT − t (c, j ) + t (c − 1, j ))}. (8) •

The duration of visit c, j (i.e. t (c, j + 1) − t (c, j )) can be expressed as the sum of h(c, j ), a(c, j ) and τ (c, j ), i.e. t (c, j + 1) − t (c, j ) = h(c, j ) + a(c, j ) + τ (c, j ) = h(c, j ) + a(c, j ) + τ/n. That is, t (c, j + 1) = t (c, j ) + h(c, j ) + a(c, j ) + τ/n. (9)

4.2. Outline of the algorithm The basic idea for the design of the algorithm is to construct the worst-case situation based on Theorem 1 and then to trace the worst-case system behaviour, until the complete message has been transmitted, according to the rules of the FDDI MAC protocol (which govern the normal operation of the FDDI network), so that the worst-case synchronous message response time can be captured in the course of tracing. Note that the worst-case scenario for transmission of a message from Si , specified by Theorem 1, is independent of the message length Ci . That is, the worst-case scenario remains true for a message (from Si ) of any length. Since the Alg Ri algorithm is designed to find the exact value of Ri which is independent of Di and Pi , both Di and Pi are not input parameters of Alg Ri. The input of the algorithm includes all given protocol parameters (i.e. HE , TTRT and τ ) and the message parameters (except Di and Pi ) of the considered synchronous message set. The output from the algorithm is the exact value of Ri . One purpose for us in devising Alg Ri is to develop an optimal test on the feasibility of any given assignment of network parameters. Because any given setting of network parameters that violates (4) is infeasible, we assume (4) holds for the given network parameters and for the considered synchronous message set in the following discussion of the algorithm. Based on the above idea, we construct Alg Ri (whose pseudo code is shown in Figure 1) with two distinct phases: Phase 1, Initialization (lines 01–06); and Phase 2, Tracing the worst-case system behaviour for stream Si (lines 07–22). T HE C OMPUTER J OURNAL,

In Phase 1, some variables are initialized such that the initial setting of the worst-case environment is exactly established according to Theorem 1. In Phase 2, the worst-case system behaviour, which leads to the maximum possible interference (to the transmission of a message of stream Si ) from both asynchronous traffic of all nodes on the ring and synchronous traffic of any other node j (j 6= i), is mimicked and traced exactly according to the MAC protocol rules, in an iterative approach (controlled by a while statement in line 08). The tracing process is conducted on a from-visit-to-visit basis, with each iteration (line 09–19) tracing operations in only one particular visit (visit x, y in node y, as shown in Figure 1). Within each iteration the algorithm calculates the time spent transmitting synchronous and asynchronous traffic (i.e. h(x, y) and a(x, y)) so that the time elapsed in this visit in the worst case can be derived. With the derived elapse time during the currently-traced visit and the token arrival time (i.e. t (x, y)) corresponding to the very beginning of the current visit, the token arrival time of the subsequent visit (i.e. t (x, y + 1)) can be obtained via (9). Fortunately, through a recurrence relation (embedded in (9)) inherent with the FDDI MAC protocol, the tracing process has been largely simplified and it moves on from visit to visit by simply updating t (x, y) iteratively. In particular, in each iteration (corresponding to visit x, y), t (x, y + 1) is derived from t (x, y) and t (x − 1, y) based on (9). Note that t (x − 1, y) is embedded in calculation of a(x, y) according to (8). The iterative tracing terminates when the visit to be traced next is the last visit required in which the last frame of the message (if Ci > Hi ) from Si (which arrives and becomes ready to be transmitted immediately after t0 ) will be transmitted. When this happens, Alg Ri accounts in the last required amount of time for transmitting the last remaining part of the message to obtain the exact value of Ri (line 21). 4.3. Detailed algorithm description In Phase 1, the iterative structure (lines 02–04) initializes t (x, y) (0, i + 1 ≤ x, y ≤ 1, i − 1) for all (n − 1) successive visits immediately before 1, i (according to (3) of Theorem 1 with the assumed reference time of t (1, i) = t0 = 0), tsrj (based on (4) of Theorem 1 because before t (1, i) the transmitting buffer of each node j holds a whole synchronous message of length Cj waiting to be sent) and nomj (because between t (0, i + 1) and t (1, i) inclusive only one message from Sj arrived to node j ) for every node j (j = 1, 2, . . . , n, j 6= i). Note that visit b(i + j − 1)/nc, [(i + j − 1) mod n] + 1 changes from 0, i + 1 to 1, i − 1 as j changes from 1 to n − 1. The variable nomj is useful for judging, at a later time t (x, j ) (x, j > 1, i and j 6= i) in Phase 2, whether a new message from Sj has arrived. There is no need to set up nomi because this algorithm is to search the worst-case message response time for only one message from stream Si and the searching (tracing) process terminates when this message has been completely transmitted. In line 05, variable t (1, i) is initialized to 0, the absolute Vol. 44, No. 1, 2001

S YNCHRONOUS M ESSAGE R ESPONSE T IME

IN

FDDI N ETWORKS

37

Input: HE , TTRT, τ , C1 , C2 , . . . , Cn ; Pj and Dj for j = 1, 2, . . . , n, j 6= i. Output: Ri 01: {Phase 1: Initialization} 02: for j = 1 to n − 1 do      i+j −1 n−j 03: t , [(i + j − 1) mod n] + 1 := − τ; n n tsr[(i+j −1) mod n]+1 := C[(i+j −1) mod n]+1 ; nom[(i+j −1) mod n]+1 := 1; 04: 05: 06:

      i n−1 t (1, i) := 0; tsri := Ci ; t 1 + , (i mod n) + 1 := TTRT − τ; n n   i x := 1 + ; y := (i mod n) + 1; n endfor

07: {Phase 2: Tracing the worst-case system behaviour for stream Si }   Ci 08: while x, y 6= + 1, i Hi 09:

if y 6= i then

    t (x, y) − t (1 − d(y − i)/ne, y) + 1 − nomy · Cy , tsry ; Py   t (x, y) − t (1 − d(y − i)/ne, y) nomy := + 1; Py        y−i h(x, y) := min Hy , tsry , max Dy − t (x, y) − t 1 − ,y n     t (x, y) − t (1 − d(y − i)/ne, y) − · Py , 0 ; Py

11: 12:

13: 14: 15: 16: 17: 18: 19: 20: 21: 22:



tsry := max

10:

else h(x, y) := Hi ; endif tsry := tsry − h(x, y); a(x, y) := min{max{TTRT − t (x, y) + t (x − 1, y), 0}, TTRT − h(x, y)}  jy k  τ t x+ , (y mod n) + 1 := t (x, y) + h(x, y) + a(x, y) + ; n n jy k x := x + ; y := (y mod n) + 1; n endwhile    Ci Ri := t + 1, i + tsri ; Hi return (Ri ) FIGURE 1. Pseudocode for the Alg Ri algorithm.

time zero, as assumed. tsri is set to Ci to reflect the arrival of a synchronous message from Si immediately after time t (1, i). Because the tracing process of Phase 2 is arranged to start from t (1, i + 1), the algorithm further initializes t (1, i + 1) according to (1) and (2) of Theorem 1. As the token arrived at node i, at time t (1, i), earlier than expected by TTRT − τ (according to Theorem 1), we have a(1, i) = TTRT − τ under (2) of Theorem 1. Besides, we know h(1, i) = 0 under (1) of Theorem 1. So we obtain the following result (by which the last item of line 05 is formed):     i , (i mod n) + 1 t (1, i + 1) = t 1 + n = t (1, i) + [h(1, i) + a(1, i) + τ (1, i)] T HE C OMPUTER J OURNAL,

h τi = 0 + 0 + (TTRT − τ ) + n   n−1 τ. = TTRT − n Note that up to time t (1, i + 1) both tsrj (1 ≤ j ≤ n) and nomj (1 ≤ j ≤ n, j 6= i) remain unchanged. Line 06 initializes visit x, y to the visit immediately after 1, i (i.e. visit 1, i + 1) as the tracing process in Phase 2 starts from time t (1, i + 1). In Phase 2, the tracing process starts from t (1, i + 1) and proceeds until the whole message (of length Ci ) from Si has been completely transmitted. The worst-case system behaviour is traced from the initial setting of the worstcase environment established in Phase 1, and under the Vol. 44, No. 1, 2001

38

S. Z HANG , E. S. L EE AND A. B URNS

assumption that every node has inexhaustible asynchronous messages to send (see (2) of Theorem 1) and that synchronous messages keep arriving at the corresponding nodes periodically (see (4) of Theorem 1). The tracing process proceeds by updating t (x, y) iteratively, through a recurrence relation embedded in (9) and (8). Specifically, in each iteration controlled by the while statement (line 08), t (x, y + 1) is derived from t (x, y) and t (x − 1, y). At the beginning of each iteration, the algorithm checks (line 08) if the visit to be traced next has reached dCi /Hi e + 1, i. Because a whole message from Si arrived immediately after t (1, i), node i starts transmitting the first frame of this message actually at time t (2, i) (in visit 2, i) and the last frame in visit dCi /Hi e + 1, i (because in each token’s visit to node i, at most Hi units of time can be spent transmitting synchronous messages). So the iterative tracing process proceeds, from visit to visit, until visit dCi /Hi e + 1, i exclusive, i.e. until time t (dCi /Hi e + 1, i) when node i receives the token to send the last frame of this message. When visit dCi /Hi e + 1, i has been reached, the algorithm quits the iterative process and calculates (and sets) the worst-case response time by accounting in the last required amount of time for transmitting the last remaining part of the message (line 21) before it terminates with the returned value of Ri (line 22). When visit dCi /Hi e + 1, i has not yet been reached, the tracing proceeds with the current iteration (lines 09–19). Within each iteration, the algorithm calculates h(x, y) (lines 09–15), a(x, y) (line 17) and t (x, y + 1) (line 18) respectively before adjusting x, y to the next visit followed, i.e. visit x, y + 1 (line 19) for the next possible iteration. The calculation of a(x, y) and t (x, y + 1) is easy to understand according to (8), under (2) of Theorem 1, and (9). The calculation of h(x, y) is treated differently in two different situations. When the current visit is a visit to node i (i.e. if y = i), h(x, y) (i.e. h(x, i)) should be set to Hi (line 14) because all frames (of this message) except the last one will be sent by using as much synchronous bandwidth as possible. For a visit of the token to any other node y (y 6= i), the algorithm calculates h(x, y) as follows (lines 10– 12). First, tsry needs to be updated to reflect the possible arrival of a new message from stream Sy (line 10). With the assumption of t (1, i) = t0 , it is easy to check that during the token rotation (starting from t (0, i)) ending with t (1, i), the token arrival time at node y can be expressed as t (1 − d(y − i)/ne, y). So, according to (4) of Theorem 1, we see that a message from Sy arrived at an empty transmitting buffer of node y immediately after time t (1 − d(y − i)/ne, y). Thus, the total number of messages that arrived from Sy in the time interval between t (1 − d(y − i)/ne, y) and t (x, y) is given by b(t (x, y) − t (1 − d(y − i)/ne, y))/Py c + 1. With this result, we can know whether a new message from Sy has arrived since t (x − 1, y) (i.e. since the token’s last arrival to the same node y) by checking, at time t (x, y), if there is a change on the total number of arrived messages (i.e. those messages from Sy that have arrived since t (0, i)). This is T HE C OMPUTER J OURNAL,

done (line 10) by subtracting the old record on this number (kept in the variable nomy at t (x − 1, y), on visit x − 1, y) from the latest result (obtained at time t (x, y)) on the total number. A difference of zero means no arrival of a new message from Sy since t (x − 1, y) while a difference of one means arrival of a new message.3 If a new message has not yet arrived, tsr y (whose value can never exceed Cy ) will remain unchanged. Otherwise, the new message will replace (override) the old one in the transmitting buffer of node y (because the arrival of a new message implies the deadline missing of the old message (under Dy ≤ Py ) if the transmission of the old message has not finished), and tsr y is updated accordingly to Cy for transmission of the whole message. That is, in this case, tsr y is set to Cy , in spite of its old value which could be zero (when the previous message from the same stream Sy has been transmitted before t (x, y)) or nonzero (but certainly less than Cy ) (when the previous message fails to be transmitted before its deadline). After updating tsr y , nomy is also updated (line 11) to record the latest result on the total number of arriving messages until time t (x, y). The calculation of h(x, y) (line 12), in the case where y 6= i, is based on (5). Let us now consider how to determine, at time t (x, y), the amount of time left before the message deadline expires. The time elapsed between the arrival (at t (1 − d(y − i)/ne, y)) of the first message from Sy (after time t (0, i)) and the current arrival (at time t (x, y)) of the token at node y can be expressed as t (x, y) − t (1 − d(y − i)/ne, y), and the elapse time between the arrival of the first message and the arrival of the last (latest) message by time t (x, y) can be expressed as b(t (x, y) − t (1 − d(y − i)/ne, y))/Py c · Py . So the time elapsed between the arrival of the last message (by time t (x, y)) and the current token arrival to node y (at t (x, y)) can be derived by      y−i ,y t (x, y) − t 1 − n   t (x, y) − t (1 − d(y − i)/ne, y) · Py − Py and the last message should not miss its deadline at t (x, y) if the above elapse time is less than Dy . That is, if      y−i ,y Dy − t (x, y) − t 1 − n    t (x, y) − t (1 − d(y − i)/ne, y) · Py > 0 (10) − Py then the message deadline has not yet expired and thus node y can continue to transmit the message. Otherwise, the message deadline has expired4 and thus there is no need to use any of the available synchronous bandwidth (Hy ). In 3 In no case can the difference exceed one because P ≥ D > 0, y y and Dy , as assumed, is long enough to ensure that there is at least one token visit to node P y during Dy even in the worst case, as indicated by Dmin ≥ TTRT + nj=1 min{Hj , Cj } + τ , embedded in (4). 4 Note that the expiration of the message deadline does not necessarily

Vol. 44, No. 1, 2001

S YNCHRONOUS M ESSAGE R ESPONSE T IME this case, h(x, y) should be set to zero. Note that the lefthand side of (10), if greater than zero, is the time left before the deadline expires and the synchronous bandwidth used in visit x, y must not exceed this amount. By (5) of Section 4.1 we get    h(x, y) ≤ min Hy , tsr y , max Dy − t (x, y)     y−i ,y −t 1− n   t (x, y) − t (1 − d(y − i)/ne, y) − Py   (11) · Py , 0 . As the algorithm is now tracing the maximum possible interference from the transmission of synchronous traffic in visit x, y, h(x, y) should be set to the maximum allowed amount. So the equal sign in (11) should hold. After the calculation of h(x, y) (lines 12 or 14), the algorithm adjusts the variable tsry (line 16) to reflect the amount of synchronous traffic just transmitted. 4.4. Correctness and complexity of the algorithm The Alg Ri algorithm is correct because it is developed exactly based upon the FDDI MAC protocol rules under which the FDDI network runs, and the worst-case situation for transmission of synchronous traffic stated by Theorem 1 which has been formally proved in [22]. Also, Alg Ri can terminate with the exact value of Ri . The following theorem shows the time complexity of the proposed algorithm.

IN

FDDI N ETWORKS

39

key to obtain time complexity of Phase 2 is to find out the total number of visits possibly involved in tracing the worstcase system behaviour before the message from stream Si is completely transmitted. Because the iterative tracing process for stream Si starts with t (1, i + 1) and ends with t (dCi /Hi e + 1, i) (and each rotation consists of n successive token visits, corresponding to n iterations), the number of visits between t (1, i + 1) and t (dCi /Hi e + 1, i) is (dCi /Hi e · n − 1). Thus, the time complexity of Phase 2, based on the above analysis, is O(n). That is, the algorithm achieves a O(n)-time worst2 case complexity. 5. CONCLUSIONS This paper addresses issues related to guaranteeing synchronous messages with deadlines no more than periods in an FDDI network. We have proposed, for the first time, an algorithm (named Alg Ri) for exactly capturing the worstcase synchronous message response time. This result is important for guaranteeing timely delivery of synchronous traffic in a hard real-time environment. The proposed Alg Ri algorithm, which has been shown to achieve a polynomial time worst-case complexity, can also be used to form an optimal test on schedulability of a considered synchronous message set under any given setting of network parameters. The proposed algorithm can be run off-line during the system design stage to let the system developers and the network manager be well cognizant of whether or not the synchronous message set being considered can be guaranteed by the FDDI network under the current assignment of network parameters. REFERENCES

T HEOREM 2. The time complexity of the Alg Ri algorithm is O(n). Proof. Clearly, Phase 1 (lines 02–06) that initializes variables to set up the initial worst-case environment is trivial and the time complexity of Alg Ri is dominated by the steps involved in the iterative tracing process of Phase 2 (lines 08–20), which mimic and trace the worst-case system behaviour in an iterative approach (controlled by a while statement). The tracing process is carried out on a fromvisit-to-visit basis,5 with each iteration (lines 09–19) tracing the worst-case behaviour for only one particular visit x, y (at node y), as shown in Figure 1. Since the operations of each visit in the tracing process are similar and can be simply (roughly) treated as one step,6 the mean that the last message has missed its deadline. The message may have been completely transmitted before its deadline expires (and consequently there is no synchronous message from Sy waiting to be sent in the transmitting buffer of node y at time t (x, y)). 5 After finishing tracing the worst-case behaviour in visit x, y (at node y), the algorithm moves onto the subsequent visit, i.e. visit x, y + 1, to trace the activities that may happen in the worst case in that visit (at node (y + 1)). 6 Although the time spent in each visit (of the tracing process) may change from visit to visit, but is certainly bounded for any particular visit, and a common upper bound can be easily formed for all visits involved.

T HE C OMPUTER J OURNAL,

[1] Fiber Distributed Data Interface (FDDI)—Token Ring Media Access Control (MAC). ANSI Standard X3.139, 1987. [2] Chen, B., Kamat, S. and Zhao, W. (1995) Fault-tolerant realtime communication in FDDI-based networks. In Proc. 16th IEEE Real-Time Syst. Symp., Pisa, Italy, pp. 141–150. IEEE Computer Society Press, Los Alamitos, CA. [3] Zhang, S. and Burns, A. (1995) An optimal synchronous bandwidth allocation scheme for guaranteeing synchronous message deadlines with the timed-token MAC protocol. IEEE/ACM Trans. Networking, 3, pp. 729–741. [4] Survivable Adaptable Fiber Optic Embedded Network (SAFENET). US Department of Defence, Washington DC, MIL-STD-2204A, January 1994. [5] Malcolm, N. and Zhao, W. (1994) The timed-token protocol for real-time communications. Computer, 27, 35–41. IEEE Computer Society. [6] Grow, R. M. (1982) A timed token protocol for local area networks. In Proc. Electro’82, Token Access Protocols, May 1982, Paper 17/3, pp. 1–7. [7] Agrawal, G., Chen, B., Zhao, W. and Davari, S. (1994) Guaranteeing synchronous message deadlines with the timed token medium access control protocol. IEEE Trans. Comp., 43, 327–339. [8] Agrawal, G., Chen, B. and Zhao, W. (1993) Local synchronous capacity allocation schemes for guaranteeing

Vol. 44, No. 1, 2001

40

S. Z HANG , E. S. L EE AND A. B URNS

TABLE A1. The worst-case synchronous message response times searched by algorithm Alg Ri against available transmission times calculated by previously derived XiLB expressions. Hi (of HE )

XiLB by Chen et al. [9]

XiLB by Zhang et al. [3]

Ri by Alg Ri

Message set A

1 24 170 175 2 50 167 167 Schedulable (under HE and TTRT)?

12 23

24 51 Yes

36 66 Yes

135 139 Yes

Message set B

1 30 125 217 2 55 230 235 Schedulable (under HE and TTRT)?

30 18

37 54 Unknown

37 56 Yes

98 199 Yes

Message set C

1 17 100 100 2 131 315 320 Schedulable (under HE and TTRT)?

17 22

17 110 Unknown

17 130 Unknown

89 299 Yes

Message set D

16 31

41 90 Unknown

44 93 Unknown

191 191 No

i

Ci

Di

Pi

1 48 190 200 2 90 194 200 Schedulable (under HE and TTRT)?

[9]

[10]

[11]

[12]

[13]

[14]

[15]

message deadlines with the timed token protocol. In Proc. IEEE INFOCOM’93, San Francisco, CA, pp. 186–193. Chen, B., Agrawal, G. and Zhao, W. (1992) Optimal synchronous capacity allocation for hard real-time communications with the timed token protocol. In Proc. IEEE Real-Time Systems Symp., December 1992, pp. 198–207. IEEE Computer Society Press, Los Alamitos, CA. Han, C.-C. and Shin, K. G. (1995) A polynomial-time optimal synchronous bandwidth allocation scheme for the timedtoken MAC protocol. In Proc. IEEE Infocom’95, April 1995, pp. 875–882. IEEE Computer Society Press, Los Alamitos, CA. Zhang, S. and Burns, A. (1995) On the schedulability of synchronous message sets with the minimum message deadline less than 2 · TTRT in an FDDI network. In Proc. 4th Int Conf. on Computer Communications and Networks (IC3N’95), Las Vegas, Nevada, September 1995, pp. 498– 501. IEEE Computer Society Press, Los Alamitos, CA. Zhang, S., Burns, A. and Wellings, A. (1996) An efficient and practical local synchronous bandwidth allocation scheme for the timed-token MAC protocol. In Proc. 15th IEEE Annual Joint Conference on Computer Communications (Infocom’96), San Francisco, March 1996, vol. 2, pp. 920– 927. IEEE Computer Society Press, Los Alamitos, CA. Zhang, S., Cheng, T. H., Yang, H., Subramanian, K. R., Tan, C. H. and Zhang, L. (1997) Improving the normalized proportional allocation scheme for time-critical communication in FDDI networks. In Proc. 1st Int. Conf. on Information, Communication and Signal Processing, September 1997, vol. 3, pp. 1436–1440. IEEE Computer Society Press, Los Alamitos, CA. Hamdaoui, M. and Ramanathan, P. (1995) Selection of timed token parameters to guarantee message deadlines. IEEE/ACM Trans. Networking, 3, 340–351. Zhang, S., Cheng, T. H., Subramanian, K. R., Zhang, L. and Tan, C. H. (1997) Testing the feasibility of synchronous bandwidth allocation for time-critical communication in FDDI networks. In Proc. 6th Int. Conf. on Computer Communications and Networks (IC3N’97), Las Vegas,

T HE C OMPUTER J OURNAL,

[16]

[17]

[18]

[19] [20]

[21]

[22]

September 1997, pp. 326–331. IEEE Computer Society Press, Los Alamitos, CA. Chen, B. and Zhao, W. (1992) Properties of the Timed Token Protocol. Technical Report 92-038, Computer Science Department, Texas A&M University. Zhang, S. and Burns, A. (1997) Timing properties of the timed token MAC protocol. In Proc. 6th Int. Conf. on Computer Communications and Networks (IC3N’97), Las Vegas, Nevada, September 1997, pp. 481–486. IEEE Computer Society Press, Los Alamitos, CA. Jain, R. (1994) FDDI Handbook—High-Speed Networking Using Fiber and Other Media. Addison-Wesley, Reading, MA. Ross, F. E. (1986) FDDI—A tutorial. IEEE Communication Magazine, 24, 10–17. Ross, F. E. (1989) An overview of FDDI: the Fiber Distributed Data Interface. IEEE J. Selected Areas Comm., 24, 1043– 1051. Zhang, S. and Lee, E. S. (1999) Searching the Worst-Case Synchronous Message Response Time in FDDI Networks. Technical Report, Centre for Communications Systems Research, University of Cambridge (UK). Zhang, S. and Lee, E. S. (1999) The worst-case scenario for transmission of synchronous traffic in an FDDI network. In Proc. IEEE LCN’99 (24th IEEE Annual Conference on Local Computer Networks), October 1999, pp. 192–201. IEEE Computer Society Press, Los Alamitos, CA.

APPENDIX A: COMPARISON OF SCHEDULABILITY-TEST METHODS In this appendix we shall give some numerical examples to demonstrate the superiority of the testing method using the Alg Ri algorithm (based on (2)) over the previous XiLB -aided method (based on (3)) in testing the feasibility of a given setting of network parameters. For simplicity, we assume that τ = 0 and TTRT = 50, and consider synchronous message sets consisting of only two synchronous message streams with Pj ≤ Dj (j = 1, 2). Vol. 44, No. 1, 2001

S YNCHRONOUS M ESSAGE R ESPONSE T IME Four considered synchronous message sets (A, B, C and D) and their corresponding given allocations of synchronous bandwidths are listed in the left half of Table A1. Clearly, four given sets of network parameters all meet the protocol constraint (1). So, the feasibility of the given network parameters depends on whether or not the deadline constraint is satisfied for the considered message sets A, B, C and D. All the results for testing the deadline constraint using different methods (i.e. the worst-case message response times obtained through Alg Ri and the available

T HE C OMPUTER J OURNAL,

IN

FDDI N ETWORKS

41

transmission times calculated by previously-derived XiLB , for message sets A, B, C and D) are listed in the right half of Table A1. From these testing results we see clearly that the test with the Alg Ri algorithm performs best and the test with XiLB by Chen et al. performs the poorest among all these three testing methods. The test through Alg Ri can always correctly determine whether a given assignment of network parameters is feasible for the considered synchronous message set to be guaranteed, in spite of whether or not the XiLB -aided method (with either previous XiLB ) can, due to its optimality.

Vol. 44, No. 1, 2001