Timing Budgets
A timing budget allocates a control period among its stages so that the sum, in the worst case, provably fits within the deadline with margin.
Budgeting Time Like a Resource
A timing budget treats the available time in a control cycle as a fixed resource to be divided among the work that must happen. Just as a mass budget assigns kilograms to subsystems, a timing budget assigns microseconds to sensing, computation, communication, and actuation, and requires that the worst-case total stay inside the period.
Building the Budget
Start from the deadline and subtract each stage's worst-case contribution. For a loop running at a fixed period, a budget might look like this:
- Sampling and ADC conversion: worst-case bounded time
- Data transfer to the processor: bounded bus or network latency
- Control-law computation: WCET of the algorithm
- Output conversion and actuator command: bounded write time
- Reserve margin: unallocated headroom for growth and uncertainty
Margin Is Not Optional
A budget that plans to consume the entire period is fragile. Estimates have error, hardware behavior drifts, and future changes add work. Prudent designs reserve a substantial fraction of the period as unallocated margin, so that the system remains schedulable when reality exceeds the nominal estimates. The margin is the difference between a design that survives its first modification and one that does not.
Interference Between Tasks
On a shared processor, a task's budget must also account for preemption by higher-priority tasks and blocking on shared resources. The end-to-end budget therefore includes interference terms, not just the task's own work. This is where the budget connects to schedulability analysis: the budget is the human-readable expression of the same worst-case arithmetic the analysis formalizes.
Using the Budget
A living timing budget is checked against measurement. Instrument each stage, compare observed maxima against the allocated figures, and investigate any stage approaching its allotment. A budget that is written once and never verified provides false confidence; one that is continuously reconciled with measured worst cases is a genuine guarantee.