Computing WCET using symbolic execution

2006

WCET computation is one of the main challenges in the study of HRTS, since it is needed to guarantee the time requirements. Moreover, modern processors have hardware components with a variable latency not known at compilation time which makes the problem even harder. In particular, the WCET computation problem in presence of caches takes exponential complexity. In this work we propose two techniques targeted to compute WCET accurately in presence of both instruction and data caches. Both techniques reduce drastically the number of states to analyze by pruning all the paths located outside the time-critical path.

2011 14th IEEE International Symposium on …, 2011

Estimating the worst-case execution time (WCET) of real-time embedded systems is compulsory for the verification of their correct functioning. Traditionally, the WCET of a program is estimated assuming availability of the program's binary which is disassembled to reconstruct the program, and in some cases its source code to derive useful highlevel execution information. However, in certain scenarios the program's owner requires that the binary of the program not be reverse-engineered to protect intellectual property; and in extreme situations, the program's binary is not available for the analysis, in which case it is substituted by program-execution traces.

2009

Abstract Static analysis can be used to determine safe estimates of Worst Case Execution Time. However, overestimation of the number of loop iterations, particularly in nested loops, can result in substantial pessimism in the overall estimate. This paper presents a method of determining exact parametric values of the number of loop iterations for a particular class of arbitrarily deeply nested loops. It is proven that values are guaranteed to be correct using information obtainable from a finite and quantifiable number of program traces.

12th IEEE International Conference on Embedded and Real-Time Computing Systems and Applications (RTCSA'06), 2006

The estimation of the Worst-Case Execution Time of hard real-time applications becomes very hard as more and more complex processors are used in realtime systems. In modern architectures, estimating the execution time of a single basic block is not trivial due to possible timing anomalies linked to out-of-order execution. The influence of preceding basic blocks on the pipeline state also has to be accounted for. Recently, graphs have been used to model the execution of a block on a dynamically-scheduled pipelined processor [11]. In this paper we extend this model to express instruction-level parallelism so that superscalar processors with multiple functional units can be analyzed. Simulation results show how this extended model estimates WCETs tightly even when a realistic processor is considered. They also give an insight into the complexity of the model in terms of analysis time.

International Workshop on Real-Time Embedded Systems RTES (in conjunction with 22nd IEEE RTSS 2001), 2001

$ EVWUDFW--In this paper we describe the construction of a safe and tight timing model of the Infineon C1 7 proces sor. We performed systematic measurements to assess the execution time of single instructions and of instruction se Tuences. All timing measurements were performed on real hardware not on an emulator. The accurate timing model was implemented in a tool for static WCET analysis. The WCET estimates made by the tool for several benchmark programs are safe and remarkably tight.

Worst-Case Execution Time Analysis, 2009

Validation of embedded hard real-time systems requires the computation of the Worst Case Execution Time (WCET). Although these systems make more and more use of Components Off The Shelf (COTS), the current WCET computation methods are usually applied to whole programs: these analysis methods require access to the whole system code, that is incompatible with the use of COTS. In this paper, after discussing the specific cases of the loop bounds estimation and the instruction cache analysis, we show in a generic way how static analysis involved in WCET computation can be pre-computed on COTS in order to obtain component partial results. These partial results can be distributed with the COTS, in order to compute the WCET in the context of a full application. We describe also the information items to include in the partial result, and we propose an XML exchange format to represent these data. Additionally, we show that the partial analysis enables us to reduce the analysis time while introducing very little pessimism.

ACM SIGPLAN Notices, 2006

Static Worst-Case Execution Time (WCET) analysis is a technique to derive upper bounds for the execution times of programs. Such bounds are crucial when designing and verifying real-time systems. WCET analysis needs a program flow analysis to derive constraints on the possible execution paths of the analysed program, like iteration bounds for loops and dependences between conditionals.

2013

The analysis of the worst-case execution times is necessary in the design of critical real-time systems. To get sound and precise times, the WCET analysis for these systems must be performed on binary code and based on static analysis. OTAWA, a tool providing WCET computation, uses the Sim-nML language to describe the instruction set and XML files to describe the microarchitecture. The latter information is usually inadequate to describe real architectures and, therefore, requires specific modifications, currently performed by hand, to allow correct time calculation. In this paper, we propose to extend Sim-nML in order to support the description of modern microarchitecture features along the instruction set description and to seamlessly derive the time calculation. This time computation is specified as a constraint solving problem that is automatically synthesized from the extended Sim-nML. Thanks to its declarative aspect, this approach makes easier and modular the description of complex features of microprocessors while maintaining a sound process to compute times.

2013

The Abstract State Machines have been around for a while, earning their place in the embedded system world. Their formal background makes them suited for proofs, their refinement design method eases the system engineering and their apparent simplicity steepens the end user's learning curve. The numerous extensions that followed have adapted the ASMs to most of the real-time system needs. Our aim is to provide a safe, precise and adaptable worst-case execution time (WCET) estimation for processors featuring modern components. The safety property implies that among all the possible processor states, generated by the binary for all possible inputs, the ones that cause the maximal execution time must be considered. However, complex architectural components, designed to speedup the average case, make it impossible to infer local timing decisions to the global systems as the monotony is broken by the timing anomalies. Therefore, a large number of states must be analysed, generating a ...

Journal of Molecular Catalysis A-chemical, 2001

This paper describes a method for analyzing and predicting the timing properties of a program fragment. The paper first presents a language implemented to describe a processor's architecture and a static worst case execution time (WCET) estimation method is then presented. The timing analysis starts by compiling a processor's architecture program followed by the disassembling of the program fragment. The