Critical Instant

When Corvella Neurotechnik entered liquidation, eleven thousand people were carrying its products inside their skulls. The administrators sold the patents, the building and the coffee machines, and discovered that nobody would buy the obligation to maintain the firmware of a discontinued seizure-control implant. The source code sat in escrow, as the licences required, and in due course the escrow released it, as the licences required, to whoever would take it. What took it was us: the Custody — nine volunteers with signing keys, a bench in a rented unit in Sheffield, and a charter one page long.

The device is called the CL-7. It lives under the scalp of a person with focal epilepsy, watches the brain through two electrode leads, and when it recognises the first signature of a seizure it interrupts with a small measured current, early enough that there is not yet anything to interrupt. Done well, it is the difference between a life arranged around lightning and a life. Mrs Renata Sobczak of Bradford had carried hers for nine years when the Type 4 lead notices began.

The CL-7’s processor cannot be upgraded. It was chosen for its appetite — microwatts — and it is sealed in titanium inside a person, so the hardware review is a funeral. Everything the device does, it does as five tasks on that one small core, each task released on its own clock, each with a measured worst case. Every 4 milliseconds, half a millisecond of sampling. Every 16, four milliseconds of filtering, raw voltage into features. Every 32, three milliseconds of therapy control, the state machine that shapes and meters any stimulation. Every 128, the detector itself: thirty milliseconds of the algorithm that reads the features and decides. And every 512, forty milliseconds of housekeeping — battery, telemetry, the event log.

When two tasks want the processor at once, the one with the shorter period wins and the other waits. That single rule is the whole scheduler. The sampler interrupts the filter, the filter interrupts the detector, and everything interrupts housekeeping, which gets the processor the way a pensioner gets a seat on a bus: eventually, and without any promise about which stop.

Then the field notice. The Type 4 lead — Renata’s lead — could develop hairline fractures. Not a break; a flicker. The fracture opens and closes with posture, and for a few milliseconds the device is listening to a wire that is not there. The advisory board’s instruction was sensible: until each lead can be revised, every device must monitor lead impedance continuously and flag the transient signature of a fracture. Continuously was defined. No less often than ten times per second.

Ten times per second is a task with a period of 100 milliseconds. On the bench we measured the monitor’s worst case honestly and padded it: twelve milliseconds.

You would think the question is whether there is time, and there is time. Add up each task’s share of the processor — its cost over its period — and the five existing tasks come to just over 78 per cent. The monitor at 100 milliseconds adds twelve, call it 90. One core, nine-tenths loaded. A tenth to spare.

But a schedule is not a budget. A budget asks whether the money is there across the year; a schedule asks whether it is there on the afternoon the bill falls due. The detector does not need thirty milliseconds eventually; it needs them inside its own 128, every 128, or a seizure signature sits unread while the current that would have met it is never sent. With fixed priorities there is a famous floor, proved in 1973 by Liu and Layland: keep the total share under a bound — 74.3 per cent for five tasks, 73.5 for six, sliding towards 69 as tasks multiply — and every deadline is met, no matter how the clocks align. Above the bound, the theorem simply stops speaking. Not unschedulable; unpromised.

Here is what stopped me the first evening. Our five tasks were already at 78 per cent. Above their own bound. The device had been living past the edge of the theorem for nine years, in eleven thousand heads, and had never once been late.

I found the licence for that in the oldest design note in the escrow archive, a comment above the task table. All periods are powers of two. This is not tidiness. When each period divides the next, the utilisation test is exact: the set is schedulable precisely when the shares sum below one. Keep it so.

They knew. Four into 16 into 32 into 128 into 512: every clock in the machine strikes together on the beat of the slowest. When the periods divide like that — harmonic, the literature says — nothing ever falls due at an awkward remainder of anything else, and the naive test, add the fractions, is it under one, becomes the whole truth. The 1973 bound is the price of arbitrary periods. The dead engineers had declined to pay it. Their 78 per cent was not past the edge of the theorem; it was resting on a better one.

And the advisory board, thinking in fingers, had written ten. A 100-millisecond task in that family is the first clock that does not divide the others. The moment it ships, the sum-below-one test is no longer valid, the bound is blown at 90 per cent, and the only way left to know is the long way: for each task, compute its worst completion — its own cost, plus one interruption by every faster task for every time that task’s period fits into the answer. The answer appears on both sides, so you iterate to a fixed point and pray the fixed point lands under the deadline. I did it. Six recurrences, all closing. The detector finishes by 81.5 milliseconds against its 128. Housekeeping by 423 against 512. On paper, at 100 milliseconds, the CL-7 is fine.

On paper, in my hand, was the trouble. Our charter has one operative clause, written the week we learned that a company’s assurances die with the company: no change is signed unless its safety case can be checked by any member of the Custody — and, on request, by the bearer. A page of coupled recurrences iterated to fixed points, sensitive to every measured worst case, is a safety case that can be audited. It cannot be checked, not in the sense the charter means, which is the sense in which you check a bill.

The consent visit was mine. The bearer may refuse any update; that is the other half of the clause. Renata Sobczak’s kitchen in Bradford, a pot of tea going cold while I explained fracture flickers and processor shares with a pencil.

“Why ten times a second?” she said.

“The advisory board wrote ‘at least ten’.”

“But why ten?”

I had no answer that wasn’t fingers.

She had tuned pianos for fifty-one years, it turned out — Bradford, Halifax, once a fortnight a Bechstein in Harrogate she spoke of like a difficult relative. “The only interval you leave pure is the octave,” she said. “Everything else you temper. Two strings a true fifth apart sit quiet together, but stack twelve true fifths and you’ve overshot seven octaves; something has to give, so you spread the error and every fifth beats a little. That’s the trade. Now, your machine —” she turned my pencilled task table around — “is all octaves. Four, sixteen, thirty-two. Doublings of doublings. Nothing in it beats against anything. And you’re proposing to tune a tenth of a second into the middle of it.”

“The board said at least ten times a second.”

“At least,” she said. “So go oftener. What does your machine have below a tenth?”

Sixty-four thousandths.

I sat in the car outside her house and did it on the back of the consent form. The monitor at 64 milliseconds runs half again as often as anyone asked — fifteen times a second and change — and costs more, not less: twelve sixty-fourths instead of twelve hundredths. The total rises from 90 per cent to just under 97. And none of that matters, because 64 divides 128 divides 512, the family is whole again, and the exact test speaks: in every 512 milliseconds the six tasks claim 64, 128, 48, 120, 40 and 96 — 496 parts of 512. Under one. Schedulable, full stop, by an addition a child could verify. Sixteen milliseconds in every half-second in which the processor, provably, does nothing at all — and because the schedule repeats exactly with the slowest clock, the same sixteen every time. We had asked the task to do more and it had, by doing more, made room.

Dele, who checks my work, pointed out the honest wrinkle: the 100-millisecond schedule, per the recurrences, left the detector more slack — 81.5 against 107.5. The legible schedule was the tighter one. We put both cases to the nine. The vote was eight to one for the version whose entire proof was six fractions and a sum, on the grounds — Dele’s own grounds, in the end, since the one holdout was tired rather than opposed — that a margin you cannot show the bearer belongs to you, not to her.

There is a last formality, and it is my favourite thing in the field. Liu and Layland proved that the worst instant a task can be born into is the one where every faster task is born beside it — all the clocks striking at once. Survive that, the critical instant, and you survive every alignment there will ever be. In the flesh it never happens, except that it always happens exactly once: at reset, when all six clocks start together from zero. Every reboot is the worst case, run live. On the bench we power-cycled the reference unit and watched the trace: sampler, filter, monitor, therapy, detector, housekeeping, the whole pile-up landing and clearing, the last task signing off with room to spare, and then — first time since power-on — sixteen milliseconds of nothing. We shipped it through the clinic wands that autumn.

The monitor ran in Renata’s device for a little under five years, every 64 milliseconds, roughly two and a half billion times, and said nothing, which was the job. In the fifth year it caught the flicker — posture-dependent, milliseconds wide, weeks at least before the fracture would have found her mid-signature — and she had the lead revised on a scheduled list, with a cup of tea after, rather than on an urgent one. At the follow-up she asked whether the new lead changed the arithmetic. I said no: the same 496 parts in 512. She nodded and let it go, the way, I imagine, you close a lid on an instrument that has held its pitch.