Mixed Criticality Scheduling for Industrial Wireless Sensor Networks

Wireless sensor networks (WSNs) have been widely used in industrial systems. Their real-time performance and reliability are fundamental to industrial production. Many works have studied the two aspects, but only focus on single criticality WSNs. Mixed criticality requirements exist in many advanced applications in which different data flows have different levels of importance (or criticality). In this paper, first, we propose a scheduling algorithm, which guarantees the real-time performance and reliability requirements of data flows with different levels of criticality. The algorithm supports centralized optimization and adaptive adjustment. It is able to improve both the scheduling performance and flexibility. Then, we provide the schedulability test through rigorous theoretical analysis. We conduct extensive simulations, and the results demonstrate that the proposed scheduling algorithm and analysis significantly outperform existing ones.

those of pre-heaters. Usually, in mixed criticality networks, when the important equipment has an exception, its sensed data have to be quickly and reliably delivered to the control room. This process needs more network resources. In a network, flows with different levels of importance coexist. For resource-constrained WSNs, when resources cannot guarantee the requirements of all levels, the data flows that belong to less importance levels should be discarded. The discard strategy is applied in almost all of the mixed criticality systems [12]. Thus, the flows are dynamic in mixed criticality networks. To guarantee the real-time performance and reliability, previous works on industrial single criticality WSNs apply totally centralized methods to manage networks, e.g., [5,13,14]. However, the totally centralized methods have difficulty coping with dynamic flows. Intuitively, two types of methods can be used to schedule data flows in mixed criticality WSNs. The first type is to schedule flows based on criticality monotonic priorities. The criticality monotonic scheduling assigns the higher priority to the important flows and schedules them first. This method does not cope with the dynamism and transmits important flows as soon as possible. In this method, the criticality is considered as the temporality. However, actually, they are not equivalent. The criticality means the importance, while the temporality means the urgency. The temperature data of the rotary kiln are the most important, but the pressure data of pre-heaters are more urgent than those, since the change of pressure is the most frequent. If the temperature data are transmitted first, the urgent pressure data will miss their deadline, even though there are idle network resources after their deadlines. Thus, the criticality monotonic scheduling algorithm cannot utilize resources efficiently and is not suitable for mixed criticality systems. This has also been demonstrated in [15]. The second type is to use the algorithms that have been proposed for previous mixed criticality systems, such as uniprocessor/multiprocessor systems [16][17][18] and networks [19][20][21], to solve our problem. However, industrial WSNs are different from the previous systems. To guarantee the strict requirements on the real-time performance and reliability, the main problem to be solved is how to avoid the collision and interference between parallel data flows. Mixed criticality uniprocessor/mulitprocessor systems only consider independent processors and do not have the interference between parallel tasks. Mixed criticality wired networks and IEEE 802.11-based wireless networks are based on CSMA (carrier sense multiple access) protocols, which are unacceptable by industrial WSNs due to the unpredictability (we give more clarifications on the differences between our system and others in Section 2). Therefore, previous algorithms cannot be used without modification in mixed criticality industrial WSNs. In this paper, we present a holistic scheduling solution to guarantee the real-time and reliability requirements of data flows in resource-constrained industrial WSNs. Our scheduling method is implemented in the application layer. According to the generated schedules, each network node transmits or receives packets in the MAC (medium access control) layer. The scheduling method of the application layer manages all data flows based on global information. Thus, it can get the optimized solution. Some MAC protocols, e.g., [22,23], are proposed to improve the real-time performance and reliability for industrial wireless sensor networks. They are flexible and scalable, but are difficult to optimize globally because they transmit packets based on local information. We list our contributions as follows.
First, we introduce the concept of mixed criticality into resource-constrained industrial WSNs. The mixed criticality concept distinguishes important data flows from less important data flows. It provides a new vision for resource-constrained networks to meet the high performance requirement of important flows.
Second, we propose a scheduling algorithm for the mixed criticality network. The scheduling algorithm not only implements the optimized global management for all flows, but also reserves network resources for dynamic adjustments to enhance the real-time performance and reliability of important flows. It makes a trade-off between the scheduling performance and the flexibility. Performance evaluations demonstrate that the proposed scheduling algorithm outperforms existing ones.
Third, we present a schedulability analysis for the proposed scheduling algorithm. We analyze end-to-end delay for flows and determine whether they are all schedulable. Simulation results show that our schedulability analysis is more effective than existing ones.
The rest of the paper is organized as follows. Section 2 introduces related works. Section 3 presents our system model. Section 4 formulates our problem as a satisfiability modulo theories instance. Section 5 proposes a heuristic scheduling algorithm for mixed criticality WSNs. Section 6 presents the delay analysis and the schedulability test. Section 7 shows simulation results. Section 8 concludes this paper.

Related Works
Scheduling algorithms and schedulability analysis methods have been widely studied in single criticality WSNs. The work in [13] proposes a real-time scheduling algorithm and analyzes the schedulability for industrial WSNs with linear topology, and the work in [24] presents similar methods for binary-tree networks. Based on the above two works, the work in [25] takes the impact of packet copying into account to enhance the channel utilization, and the work in [14] supports spatial reuse to improve the schedulability. For mesh topology networks, the authors of [5,6,26] propose a scheduling analysis, a fixed priority scheduling algorithm and two dynamic priority scheduling algorithms to meet the real-time requirement of industrial applications. However, these previous works do not consider the mixed criticality requirement.
Mixed criticality is first proposed in uniprocessor systems [16,27]. Then, it is introduced to multiprocessor systems [17,18], controller area networks [19], network-on-chips [28,29], wired networks [20,30] and IEEE 802.11-based wireless networks [21]. Uniprocessor systems [16,27] and controller area networks [19] do not support parallel tasks (or data flows); while the serial mode is unsuitable for industrial WSNs. The works in [17,18] focus on homogeneous multiprocessor systems. As there is no interference between executing tasks, they do not need to consider how to avoid the interference. However, in industrial WSNs, the interference must be avoided. Network-on-chips use wormhole switching. For one data flow, the network-on-chip has to provide all nodes that the data flow uses simultaneously [28,29], whereas the industrial WSN only provides two nodes for one hop. Wired networks [20,30] and IEEE 802.11-based wireless networks [21] are based on the CSMA protocol, which is unacceptable by reliable industrial systems. Therefore, the previous system models are different from industrial WSNs.
In WSNs, some works about critical data flows have been proposed. The IEEE 802.15.4 standard, which is widely used by WSNs, supports a hybrid TDMA/CSMA MAC protocol. In the TDMA frame, the guaranteed time slots (GTSs) can be assigned for transmitting critical data flows. For the hybrid protocol, the works in [31,32] propose time slot assignment algorithms to improve the performance of critical data flows. However, due to the unpredictability of the CSMA protocol, industrial WSNs cannot apply the hybrid protocol. The work in [22] considers a pure TDMA protocol. It proposes the PriorityMAC protocol, which is a distributed method and allows critical data flows to be transmitted as soon as possible. The PriorityMAC protocol assumes that the most important data flows are urgent; while in the mixed criticality industrial WSN, the importance and the urgency are independent of each other. We have researched mixed criticality industrial WSNs in our previous work [33]. In that work, the network adopts a totally centralized management, and the end-to-end delay is calculated. However, this strict centralized management is not flexible enough, and all exceptions have to be submitted to the centralized manager and wait to be processed. In this paper, our proposed mixed criticality network supports the dynamic adaptive strategy. The classical RM (rate-monotonic) scheduling policy, which first schedules the flow with a shorter period, is a basic scheduling strategy and has been widely used in industrial WSNs [1,2]. We will extend the classical RM policy and allow the important data flows to preempt the resources assigned to less important data flows. Then, we will analyze the schedulability of our extended RM policy.

System Model
Industrial WSNs must support the strict requirements on real-time performance and reliability. Therefore, we consider an industrial WSN as follows. It consists of a gateway and some sensor devices (as shown in Figure 1). We use the node set N = {n 1 , n 2 , ...} to denote these nodes. The physical layer of our industrial WSNs is specified by the IEEE 802.15.4 protocol. It supports 16 non-overlapping channels. However, due to external interference, not all of them can be accessed all of the time. We denote the number of available channels as M (1 ≤ M ≤ 16). Our network serves the flow set Each flow f i periodically generates a packet at its period T i and then sends it to the destination via the routing path Π i . The relative deadline of each packet is equal to the period T i , i.e., a packet is released at the time t, and it must be delivered to its destination before the time (t + T i + 1). In industrial wireless protocol, e.g., [1,2], periods conform to the expression: where a is an integer value and b is the unit-period.
To keep consistent with related works on mixed criticality systems, our network also supports two criticality levels, L-crit (low criticality) and H-crit (high criticality). The dual-criticality model can be easily extended to the multi-criticality model. If the flow f i is important, its criticality level χ i is denoted as H. Otherwise, its criticality level χ i is L. When the system is running in the normal mode without any exception, all flows are delivered to their destinations within deadlines. If an important equipment has an exception, the corresponding data must be submitted frequently and via two paths to avoid faults on a single path. Thus, in our system model, the H-crit flows have two parameter sets: the L-crit parameters < T i (L), Π i (L) > in the normal mode; the H-crit parameters < T i (H), Π i (H) > in the exception mode and T i (H) ≤ T i (L). Π i (L) is a path that is used by the H-crit flow in the normal mode. Π i (H) contains two paths that are used by the H-crit flow in the exception mode, and the two paths transmit the same packet to improve the reliability. In order to clearly distinguish these paths, they are denoted as Π i (L) = {π * i } and Π i (H) = {π i , π i }. The path π * i (and π i , π i ) is the set of links from the source to the destination. In this paper, we do not consider how to select routing paths. We assume all paths have been given before generating schedules. The dynamism this paper addresses refers to using different parameters in different modes. Transmitting a packet through the j-th link of the path π * i (or π i , π i ) is called the transmission τ * ij (and τ ij , τ ij ). Each transmission has two attributes < n α , n β >, which denote the transmission's source and destination, respectively. As the constrained-resources must provide enough services to H-crit flows, the L-crit flows cannot be transmitted when exceptions happen. Therefore, L-crit flows only have a parameter set < T i (L), Π i (L) >.
To improve the reliability of industrial networks, we adopt the TDMA scheme in the MAC layer. The network manager, which is connected to the gateway, assigns a time slot and a channel offset to each transmission. A transmission only is scheduled at the given time slot and on the given channel offset. Packets are generated periodically, and the schedules of corresponding transmissions have the same period. The schedules with the same period are organized within a superframe [2]. Transmitting a packet from the source to the destination has to be done in a superframe. Thus, superframes repeat themselves periodically, and then, flows can be transmitted successfully. Figure 2a shows a simple network, which contains two flows f 1 and f 2 . When the system is in normal mode, the flows use their L-crit parameters. Their periods are eight time slots and four time slots, and their paths are {e 52 , e 21 } and {e 98 , e 87 , e 74 , e 41 }, where e ij denotes the link from the node n i to the node n j . Figure 2b shows their superframes with different periods. CH and TS denote channel offset and time slot. Two types of improper schedules will lead to transmission interference, which seriously affects the network reliability. The first type, called node interference, is that more than one transmission uses the same node at the same time slot. Each node is only equipped with one transmitter. Therefore, one node cannot serve more than one transmission at the same time. The second type is called scheduling interference, which means that more than one transmission is scheduled at the same time slot and on the same channel. These overlapping transmissions cannot be separated. To avoid transmission interference between different superframes, we consider all superframes as a hyper-frame whose period is the lowest common multiple of all superframes. According to the period's Expression (1), the hyper-period T = LCM(T 1 , Figure 2c shows the hyper-frame of the simple example. We only consider how to schedule flows in the first hyper-period, since after that, all schedules are repeated periodically. The network manager generates all schedules under two situations: Situation 1: when the network is deployed; and Situation 2: when the deployment is changed. Due to the requirement of industrial applications being fixed, the deployment is not often changed. Thus, the schedules may be generated several times, but not frequently. According to this schedule information, it obtains the working modes of each node at every time slot and then delivers them to the corresponding nodes. For the schedules in Figure 2c, from TS1 to TS4, working modes of the node n 2 are {receive, send, idle, idle}. When a node intends to send a transmission of L-crit flows, it waits for a constant time and then listens whether its channel is used. If the channel is used by H-crit flows, the node discards its transmission. Otherwise, the node sends the transmission. Note that although the node uses the carrier sense technique to determine whether an L-crit transmission is discarded or not, it is different from the CSMA scheme. Since for L-crit flows, the node performs carrier sense within time slots of the TDMA frame, if the L-crit transmission is not discarded, it is also scheduled based on the TDMA scheme. When a node intends to send a transmission of H-crit flows, it immediately sends it at the beginning of the assigned time slot. The scheduling algorithm assigns the proper time slot and channel for each transmission and prevents H-crit transmissions from interfering with other H-crit transmissions. Therefore, H-crit transmissions are sent directly without checking the channel. In this way, the H-crit flow can steal slots from L-crit flows when it needs more resources to cope with exceptions [34]. Note that the H-crit flow using H-crit parameters is not permitted to steal slots that are used by any other H-crit flows even if these H-crit flows are using L-crit parameters. Figure 2d shows an example of mixed criticality schedules. The period of the H-crit flow f 1 is changed from eight to four, and the new path {e 56 , e 63 , e 31 } begins to be used. In this case, there are not enough time slots. The H-crit transmission 3 → 1 (the gray block) steals the resource of the L-crit transmission 7 → 4. Based on the stealing strategy, the dynamic adjustment can be supported.
The schedulable flow set is defined as follows. When the system is in the normal mode, the flow set is schedulable if all flows characterized by L-crit parameters can hit their deadlines. When there are exceptions in the system, the flow set is schedulable if all H-crit flows can hit their deadlines no matter which parameters they are using.

Mixed Criticality Scheduling Problem Statement
Based on the above system model, we describe the mixed criticality scheduling problem as follows. Given the network and the flow set F, our objective is to schedule transmissions in the time slot and channel dimensions, such that the flow set is schedulable.
To explain the problem more clearly, we formulate the problem as a satisfiability modulo theories (SMT) specification. The transmission τ * ij (and τ ij , τ ij ) is assigned the s * ij -th (and s ij -th, s ij -th) time slot and the r * ij -th (and r ij -th, r ij -th) channel offset. Note that a transmission is scheduled periodically. Therefore, the transmission uses all of the time slots s ij + g · T i (∀g ∈ [0, T T i )) in a hyper-frame. These assignments must respect the following constraints.
(a) Channel offset constraint: For each transmission, its assigned channel offset must be in M available channels. This expression is for transmissions in the path π * i . Other transmissions τ ij and τ ij in paths π i and π i have the same constraint, and we omit them for simplicity. (b) Releasing sequence constraint: In a routing path, the transmission τ i,j+1 is released after the transmission τ i,j is scheduled. We still omit paths π i and π i . (c) Real-time constraint: All transmissions cannot miss deadlines. Likewise, s i,|π i | and s i,|π i | have the same constraint.
(d) Interference constraint: Assigning resources to transmissions must prevent the happening of node interference and scheduling interference. We use δ(τ a , τ b ) to denote whether there exists interference between τ a and τ b , Thus, the interference constraint in the normal mode and exception mode are as follows.
The mixed criticality scheduling problem is NP-hard [11]. Our SMT specification can be solved by some solvers, such as Z3 [35] and Yices [36]. These solvers can find satisfying assignments for quite many problems, and their solutions have been the excellent standard to evaluate the effectiveness of other methods [37]. However, the running time may be unacceptable for complex networks and flow sets. Therefore, we propose a heuristic scheduling algorithm in Section 5 to solve the problem.

Scheduling Algorithm
In this section, we first introduce how to schedule transmissions, and then, based on these schedules, we determine working modes of each node at every time slot.

A Slot-Stealing Scheduling Algorithm
We propose a slot-stealing scheduling algorithm based on RM (StealRM). The proposed StealRM optimizes the solution according to the global information and permits transmissions to share the same resource when the transmissions have different levels of criticality. Hence, the schedules can be adaptively adjusted based on the requirements of H-crit flows.
The proposed StealRM is shown in Algorithm 1. Each flow is assigned as the RM priority. If two flows have the same RM priority, the flow with the smaller ID has the higher priority. The transmission's priority is equal to its flow's priority. The set R contains all of schedulable transmissions (Lines 1 and 17), and the set R denotes released transmissions at the current time slot (Line 3). At every time slot t, we first sort elements of R according to the decreasing order of priorities, and τ 1 in the set R has the highest priority (Line 4). Then, for each transmission τ a in the set R , we check whether it can be scheduled at the current time slot without any interference (lines between 7 and 21). Let F (τ a ) denote the flow that the transmission τ a belongs to (Line 6). The set Y HL t contains the transmissions that have been scheduled at the time slot t and belong to H-crit flows with L-crit parameters. The sets Y H t and Y L t correspond to those in H-crit flows with H-crit parameters and L-crit flows, respectively. The transmissions in the set Y and the transmission τ a cannot steal slots from each other. According to the criticality level of τ a , the set Y is assigned different transmissions (lines between 7 and 12). If the transmission τ a belongs to an H-crit flow with H-crit parameters, then it cannot steal slots from other H-crit transmissions (lines between 7 and 8). Y H and Y HL may contain the transmissions belonging to the same flow with τ a . These transmissions do not interfere the scheduling of τ a . Thus, the set {∀τ * ig } needs to be excluded from Y H and Y HL (Line 8). Similarly, if the transmission τ a belongs to an H-crit flow with L-crit parameters, then it cannot steal slots from any other transmissions (lines between 9 and 10). If the transmission τ a belongs to an L-crit flow, then its slots cannot be stolen by L-crit flows and H-crit flows with L-crit parameters (lines between 11 and 12). When there is no node interference between τ a and Y and at least one channel is idle (Line 13), the transmission τ a can be scheduled at this current time slot. Θ(Y ) denotes the channels that have been used by Y . However, if the current time slot has exceeded its deadline, the flow set is unschedulable (Lines 14 and 15). Otherwise, the time slot and channel offset of the transmission τ a are assigned (Line 16), and the schedulable transmission set R and the scheduled transmission set Y H t (Y L t and Y HL t ) are updated (lines between 17 and 23).
sort R according to the decreasing order of priorities; 5: for each a from 1 to |R | do 6: i ← F (τ a ); else if χ i == H and τ a ∈ Γ * i then 10: 14: if t exceeds the deadline of f i then 15: return unschedulable; 16: s a ← t; r a ← a random channel that is not in Θ(Y );

Node Working Mode
Nodes have three working modes, including transmit mode (S), receive mode (R) and idle mode. We use w H α,t =< S (or R), r a > to denote that at the time slot t, the node n α transmits (or receives) H-crit flows on the channel r a . Similarly, w L α,t denotes that the node n α serves L-crit flows. Algorithm 2 determines the working mode for each node. For each transmission, we have assigned a time slot and a channel offset in Algorithm 1. According to the assignments, the working modes of the sender node and receiver node of the transmission can be obtained (lines between 4 and 9). The time complexity of Algorithm 2 is O(|Γ| T T min ).

7:
else 8: ∀h ∈ [0, T T i (L) ), w L α,s a +T i (L)×h ←< S, r a >; 9: ∀h ∈ [0, T T i (L) ), w L β,s a +T i (L)×h ←< R, r a >; 10: return all w L * , * and w H * , * ; Note that a node may serve two flows at the same time slot, but the two flows must have different criticality levels. Otherwise, node interference occurs. At the beginning of the time slot t, the node works in mode w H α,t . Then, in a constant time, if it needs to send an H-crit flow or has received a flow, it continues working as the same mode at this time slot. Otherwise, it works in mode w L α,t . However, when its mode w L α,t is S, it must determine whether the assigned channel is clear or not before it sends the flow. If the channel has been occupied by H-crit flows, the flow has to be discarded. The switch time between different modes is very short compared with a time slot. For example, the switch time of the transceiver CC2420 is just 200 µs, while a time slot is 10 ms. Generally, at a time slot, most nodes only serve one flow or are idle, while only a few nodes serve two flows.

Scheduling Analysis
In this section, we analyze the worst case end-to-end delay for each flow and use the delay to test the schedulability of the flow set. If the worst case delay of all flows does not exceed deadlines, the flow set is schedulable. For the sake of simplicity, we first explain how to compute the worst case delay in single-criticality networks (in Section 6.1) and then extend it to mixed criticality networks (in Section 6.2).

Analyzing Method for Single-Criticality Networks
Besides transmitting time, the end-to-end delay is introduced by the interference from higher priority flows. Therefore, in Section 6.1.1, we present the analyzing method of the total interference. In Section 6.1.2, we distinguish the different types of interference and compute the worst case delay.

Total Interference
During the time interval between the release and completion of the flow f k , all of the active transmissions that belong to the higher priority flows may have node interference or scheduling interference to the flow f k . Therefore, in the worst case, the total interference is equal to the number of those higher-priority transmissions. The method of computing the workload in a period has been proposed in multiprocessor systems [38]. The mapping between the multiprocessor system model and the network model has been explained in the work [6], in which a channel corresponds to a processor and a flow is scheduled as a task. Therefore, we propose our analyzing method based on the work [38], which is the start-of-the-art analysis for multiprocessor systems. To make our paper self-contained, we first simply introduce the method of multiprocessor systems and then present our method.
For the simplicity of expression, the multiprocessor system uses the same notations as our network model. For multiprocessor systems, the calculation of the worst case delay of the task f k is based on the level-k busy period (as shown in Definition 1).

Definition 1. Level-k busy period for multiprocessor systems: The level-k busy period is the time interval
[t 0 , t k ), in which t k is the finish time of the task f k , and t 0 satisfies the following conditions: 1. t 0 < t r where t r is the release time of the task f k . 2. ∀t ∈ [t 0 , t r ], at the time t, all processors are occupied by higher-priority tasks. 3. ∀t < t 0 , ∃t ∈ [t, t 0 ], at the time t , at least one processor is occupied by lower-priority tasks.
If there is no t 0 that satisfies all conditions, then t 0 = t r .
The level-k busy period is determined by the workload of all higher-priority tasks. The setP( f k ) contains the tasks with higher priority than the task f k . If the task f i ( f i ∈P( f k )) has a job that is released earlier than the level-k busy period and its deadline is in the busy period, then the task f i has the carry-in workload in the level-k busy period. Otherwise, the task has no carry-in workload. The two types of workloads are presented as follows, and the length of the level-k busy period is x.
(1) In the level-k busy period, if the task f i has no carry-in workload, the upper bound of its workload is: where c i is the execution time of the task f i . (2) If the task f i has the carry-in workload, the upper bound of its workload is: , c i − 1} and D i is the worst case delay of the task f i .
Based on the upper bounds of workload, two types of interference of the task f i to the task f k are as follows: Therefore, the total interference suffered by the task f k is: whereP NC ( f k ) andP CI ( f k ) denote the set of tasks without carry-in workload and the set of tasks with carry-in workload, respectively. In a busy period, at most M − 1 higher-priority tasks have carry-in workload. Therefore, the setP CI contains M − 1 tasks that have maximal values of . Other tasks are in the setP NC . In the following, we propose our analyzing method. Industrial WSNs apply strict periodic schedules based on superframes, which can reduce system complexity and run time overhead. While in multiprocessor systems and previous works about WSNs, schedules are variable, i.e., the assigned time slots to a task (or a flow) are non-periodic, so our workload bounds are not the same as previous ones. Our workload bounds are computed with Theorem 1. Definition 2 defines the level-k busy period in the network.

Definition 2.
Level-k busy period for networks: The level-k busy period is the time interval [t 0 , t k ), in which t k is the finish time of the flow f k and t 0 satisfies the following conditions: 1. t 0 < t r where t r is the release time of the flow f k . 2. ∀t ∈ [t 0 , t r ], at the time t, all channels are occupied by higher-priority flows or there exists node interference between the scheduled flows and the flow f k . 3. ∀t < t 0 , ∃t ∈ [t, t 0 ], at the time t , there is no node interference, and at least one channel is occupied by lower-priority flows or idle.
If there is no t 0 that satisfies all conditions, then t 0 = t r .
Theorem 1. The workload bounds can be computed with: where c i is the number of hops in the path π i , i.e., c i = |π i | Proof of Theorem 1. The computation of the non-carry-in workload W NC k ( f i , x) is shown in Figure 3a. There are x T i complete periods and a scheduling window (x mod T i ). In the scheduling window, at most c i workloads exist. Therefore, the expression of the non-carry-in workload is shown as Equation (2).
In the following, we compute W CI k as shown in Figure 3b. The notations A and B denote the two incomplete periods, respectively. We know that A < T i , B < T i and A + B = (x mod T i ) or (x mod T i + T i ). We discuss the two cases as follows.
Case 1: A + B = x mod T i . We draw out the windows A and B in Figure 4a. We consider four different value ranges of the windows A and B as shown in Table 1 then all execution time c i must be the available workload. In this case, the workload can also be expressed as min{B, c i }. Therefore, only if A < T i − D i , the workload is min{B, c i }. If A ≥ T i − D i and B < D i , the time interval T i − D i does not contain any workload. Therefore, the available window A + B is equal to In Case 1, we can get that the total workload is: The notation C1 denotes the workload in the incomplete period as shown in Table 1. It is equal to min{B, c i } or min{x mod T i − (T i − D i ), c i }.
Case 2: A + B = x mod T i + T i , which is shown in Figure 4b. In this case, there are x−T i T i complete periods. In the windows A and B, at most c i + min{x mod T i , c i } workloads exist. Therefore, the workload of Case 2 is: Comparing with Equations (3) and (4), the upper bound of workload is Equation (4). Since (x mod T i ) is not less than B and (x mod T i ) − (T i − D i ), Equation (4) is the same as Equation (2). The theorem holds.
Due to the two types of workload having the same computing formula, we do not distinguish them in the following and use W k ( f i , x) to denote them. Based on the workload bound, the interference of the flow f i to the flow f k is: Thus, the total interference suffered by the flow f k is: 6.1.2. Worst Case Delay in Single-Criticality Networks Ω n k (x,P( f k )) and Ω s k (x,P( f k )) denote node interference and scheduling interference suffered by the flow f k in the level-k busy period. If there exists a node interference at a time slot, the flow f k cannot be transmitted at this time slot, no matter how many channels are idle, i.e., the flow f k is delayed one time slot due to the node interference. However, only when M transmissions are scheduled at a time slot, the flow f k suffers scheduling interference and is delayed for one time slot. In the worst case, all of the node interference and scheduling interference will introduce delay to the flow f k . Therefore, the worst case delay is: From Equation (5), we know that node interference introduces more delay. Since the sum of node interference and scheduling interference is Ω total k (x,P( f k )), so when as much as possible node interference occurs, the end-to-end delay is the worst case.
The upper bound of node interference introduced by h consecutive hops of the flow f i to the flow f k is computed as: {|{τ iy |∀τ iy , y ∈ [a, a + h], ∃τ kz such that τ iy ∩ τ kz = ∅}|} Thus, the workload introduced by transmissions that have node interference is: Then, we can get that the worst case delay of the flow f k in the single-criticality network is: From the definition of the level-k busy period, we know that the length x is the upper bound of the delay D k (shown in Theorem 2).

Theorem 2.
For the flow f k and the level-k busy period, the following holds: x ≥ D k Proof of Theorem 2. We assume by contradiction that x < D k . From the definition of the level-k busy period (Definition 2), we know that the finish times of the busy period and the flow f k are the same, and t 0 must be less than (the first condition) or equal to t r (when t 0 does not satisfy at lest one condition). If x < D k , then t r < t 0 , as shown in Figure 5. It is not consistent with the definition. The above assumption does not hold. According to Theorem 2, the solution of Equation (6) is the upper bound of end-to-end delay D k .
Equation (6) can be solved by the iterative fixed point search [39]. The iterative calculation of x starts with x = c k ; until the value of x does not change.

Mixed Criticality Scheduling Analysis
In dual-criticality networks, there are three types of worst case delay.
for H-crit flows with L-crit parameters, the interference set is An H-crit flow with its H-crit parameter suffers the interference from H-crit flows with H-crit parameters. The H-crit flow has two sub-flows f k and f k . For these sub-flows, their interference set is , and then, D H k = max{D H k , D H k }. According to the above delays, the schedulability test is as follows. For the L-crit flow f k , if D L k ≤ T k (L), it is schedulable; otherwise, unschedulable. For the H-crit flow f k , if D HL k ≤ T k (L) and D H k ≤ T k (H), it is schedulable; otherwise, unschedulable. If all flows in a flow set are schedulable, the set is schedulable.

Evaluation
In this section, we conduct experiments to evaluate the performance of our proposed methods.

Scheduling Algorithm
We consider three comparison methods: (1) SMT uses the Z3 solver [35], which is a high-performance solver being developed at Microsoft Research and whose solution has been regarded as an excellent standard, to solve our SMT specification (Section 4); (2) noStealRM applies the RM priority and does not allow slots to be stolen; (3) StealCM allows slots to be stolen and applies the criticality monotonic priority. Our method is StealRM. The performance metric we used is the schedulable ratio, which is defined as the percentage of flow sets for which a scheduling algorithm can find a schedulable solution.
We randomly generate a number of test cases to evaluate these methods. For each test case, the number of channels M and the number of nodes |N| are given. According to the suggestion in the work [40], these nodes are placed randomly in the square area A, and A = |N|d 2 √

2π
, where the transmitting range d is 40 m. Except the gateway, each node has a data flow from itself to the gateway or vice versa. There are two necessary schedulability conditions for flow sets: (1) the network utilization U is not larger than one; (2) the utilization of each node is not larger than one. If a flow set does not satisfy the two conditions, it cannot be scheduled. Thus, in order to make flow sets available, we specify the network utilization U(U < 1) and use the method UUniFast [41] to assign the utilization u i for each flow, where U = ∑ ∀ f i ∈F u i . Then, if the flow set can satisfy the condition (2), it is an available flow set. Otherwise, discard it, and repeat the process until an available set is found. The period of each flow can be obtained according to T i = c i u i . The high-crit probability of the flows is controlled by the parameter ρ. Routing paths are selected randomly.
In order to make test cases solvable by the Z3 solver, the parameters are set as ρ = 0.3, M = 2 and U = 0.8. For each configuration, 100 test cases are checked using the four algorithms. Figure 6 shows their schedulable ratios. Our algorithm StealRM is close to the result of Z3. In these simple test cases, the method StealCM has similar results with our algorithm StealRM. Figure 7 shows the average execution time of the solvable test cases in Figure 6. When the number of nodes is 25, the execution time of the method SMT is about 16.5 min. We also use the method SMT to solve the network with 30 nodes, but cannot get the result within 3 h. Except the method SMT, the execution time of other methods is not more than 10 milliseconds. Therefore, from the perspective of execution time, heuristic algorithms are significantly more efficient than the method SMT.   Since the execution time of the method SMT is too long, the following experiments do not contain it. Figure 8 shows the schedulable ratios of the three scheduling algorithms. For each point in the figure, 500 test cases are randomly generated. From the figure, we can know that our algorithm StealRM has the highest schedulable ratio no matter with which parameters, while the algorithm noStealRM has the worst result. Therefore, the stealing mechanism can significantly improve the algorithm's performance. Our algorithm StealRM has better performance than the algorithm StealCM, especially when the node numbers are higher. This demonstrates that: (1) the priority should correspond to the urgency, but not the importance, while the stealing mechanism reflects the importance; (2) the urgency and the importance have to be distinguished, except in very small networks. Comparing among these subfigures, we observe that schedulable ratios decrease with the increases of ρ, |N|, U and M. The reasons are as follows. An H-crit flow can be regarded as two L-crit flows. Thus, a larger value of the parameter ρ leads to more flows, which are hard to schedule. A test case contains |N| − 1 flows. Likewise, the larger |N| makes scheduling hard. The network utilization U corresponds to the network workload. Heavy workloads lead to scheduling failures. Note that comparing with Figure 8a, Figure 8d has three additional channels, but its schedulable ratios decrease. Because the two subfigures generate test cases according to the respective numbers of channels. Their test cases are different. Although the number of channels increases, the utilization is not changed. When the utilization U is constant, with the increase of the number of channels M, the packets that need to be transmitted increase. The increased packets will introduce more interference, which have a negative impact on the scheduling performance. Therefore, Figure 8d has a lower schedulable ratio than Figure 8a.

Analyzing Method
The comparison method is SingleAna, in which flow sets are tested using the single-criticality analysis. Our mixed criticality analysis method is MixedAna. The performance metrics are the analyzable ratio (the percentage of flow sets which are tested as schedulable by an analyzing method) and the pessimism ratio (the proportion of analyzed delay to the delay observed in StealRM). Figure 10 shows the comparison of the analyzable ratios. For each point, 500 test cases are analyzed. Our method MixedAna outperforms SingleAna. The analyzable ratios decrease with the increases of these parameters. The reasons are similar to those in Figure 8. The increases of U and M lead to more packets, and the increases of |N| and ρ lead to more flows. These will cause more interference. Thus, the analysis introduces more pessimism, and the analyzable ratios decrease. Figure 11 shows the pessimism ratios of experiments in Figure 10. The pessimism ratios of MixedAna are less than two, while the pessimism ratios of SingleAna are all larger than two. This is because the interference that does not exist between H-crit and L-crit flows is eliminated in MixedAna.

Conclusions
Multiple criticality levels coexist in advanced industrial applications. They share the network resource, but their requirements for the real-time performance and reliability are different. In this paper, we propose a scheduling algorithm to guarantee their different requirements and then analyze the schedulability for this scheduling algorithm. Simulation results show that our scheduling algorithm and analysis have more performance than existing ones. In the future work, we will propose a routing algorithm for mixed criticality WSNs to enhance the reliability and design a network deployment method and a parameter adjustment method to improve the schedulability. Finally, we will implement these algorithms in a real network.