How to compute worst-case execution time by optimization modulo theory and a clever encoding of program semantics

HenryJulien,; AsavoaeMihail,; MonniauxDavid,; MaïzaClaire,

doi:10.1145/2666357.2597817

Cited by 11 publications

(8 citation statements)

References 30 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We also mention the recent work [20], which also employs the concept of interpolation, but under the SMT framework, to avoid state explosion in WCET analysis. Like [6], this approach is formulated for loop-free programs, and not yet suitable for analyzing programs with loops.…”

Section: Discussion On Scalabilitymentioning

confidence: 99%

Precise Cache Timing Analysis via Symbolic Execution

Chu

Jaffar

Maghareh

2016

2016 IEEE Real-Time and Embedded Technology and Applications Symposium (RTAS)

View full text Add to dashboard Cite

We present a framework for WCET analysis of programs with emphasis on cache micro-architecture. Such an analysis is challenging primarily because of the timing model of a dynamic nature, that is, the timing of a basic block is heavily dependent on the context in which it is executed. At its core, our algorithm is based on symbolic execution, and an analysis is obtained by locating the "longest" symbolic execution path. Clearly a challenge is the intractable number of paths in the symbolic execution tree. Traditionally this challenge is met by performing some form of abstraction in the path generation process but this leads to a loss of path-sensitivity and thus precision in the analysis. The key feature of our algorithm is the ability for reuse. This is critical for maintaining a highlevel of path-sensitivity, which in turn produces significantly increased accuracy. In other words, reuse allows scalability in path-sensitive exploration. Finally, we present an experimental evaluation on well known benchmarks in order to show two things: that systematic path-sensitivity in fact brings significant accuracy gains, and that the algorithm still scales well. I. INTRODUCTIONHard real-time systems need to meet hard deadlines. Static Worst-Case Execution Time (WCET) analysis is therefore very important in the design process of real-time systems.Traditionally, WCET analysis consists of three phases. The first phase, referred to as low-level analysis, involves microarchitectural modeling to determine the maximum execution time for each basic block. The second phase concerns determining the infeasible paths and loop bounds from the program. The third phase computes the aggregated WCET bound, employing the results of the prior phases. In some recent approaches, the second and third phases are fused into one, called generally as high-level analysis. Importantly, for scalability, in the literature low-level analysis and high-level analysis are often performed separately.The main difficulty of low-level analysis comes from the presence of performance enhancing processor features such as caches and pipeline. This paper focuses on caches, since their impact on the real-time behavior of programs is much more than other features [1]. Cache analysis -to be scalableis often accomplished using Abstract Interpretation (AI), e.g., [2]. In particular, we need to analyze the memory accesses of the input program via an iterative fixed-point computation. This process can be efficient, but the results are often not precise. There are two main reasons for the imprecision:(1) The cache states are joined at the control flow merge points. This results in subsequently over-estimating the potential cache misses.

show abstract

Section: Discussion On Scalabilitymentioning

confidence: 99%

Precise Cache Timing Analysis via Symbolic Execution

Chu

Jaffar

Maghareh

2016

2016 IEEE Real-Time and Embedded Technology and Applications Symposium (RTAS)

View full text Add to dashboard Cite

show abstract

“…Two approaches that come close to our technique are that of AlBataineh et al [1] and Henry et al [14]. Al-Bataineh et al use a precise acceleration of timed-automata models (with cyclic behavior) for WCET computation.…”

Section: Related Workmentioning

confidence: 93%

“…Although acceleration helps to scale up their IPET technique for WCET computation, these ideas are not readily applicable to loop acceleration in C programs in the absence of suitable abstractions. Henry et al [14] employ an SMT solver to compute the WCET, by adding additional constraints to ignore infeasible paths. This helps the authors achieve some scalability, albeit under the assumption that the programs are loop-free, or that the loops have been unrolled.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

TIC: a scalable model checking based approach to WCET estimation

Metta

Becker

Bokil

et al. 2016

Proceedings of the 17th ACM SIGPLAN/SIGBED Conference on Languages, Compilers, Tools, and Theory for Embedded Systems

View full text Add to dashboard Cite

The application of Model Checking to compute WCET has not been explored as much as Integer Linear Programming (ILP), primarily because model checkers fail to scale for complex programs. These programs have loops with large or unknown bounds, leading to a state space explosion that model checkers cannot handle. To overcome this, we have developed a technique, TIC, that employs slicing, loop acceleration and over-approximation on timeannotated source code, enabling Model Checking to scale better for WCET computation. Further, our approach is parametric, so that the user can make a trade-off between the tightness of WCET estimate and the analysis time.We conducted experiments on the Mälardalen benchmarks to evaluate the effect of various abstractions on the WCET estimate and analysis time. Additionally, we compared our estimates to those made by an ILP-based analyzer and found that ours were tighter for more than 30% of the examples and equal for the rest.

show abstract

“…As a classical approach, IPET-based WCET analysis commonly has three basic steps [24]: (1) Micro-architecture modeling (or called low-level analysis), regarding pipeline, cache, branch predictor and cycle-accurate timing, etc. ; (2) Control-flow Analysis (or called high-level analysis), such as control-flow reconstruction [25,26], loop bound analysis [27,28], etc.…”

Section: Reasons For Wcet Overestimationmentioning

confidence: 99%

Reducing WCET Overestimations by Correcting Errors in Loop Bound Constraints

Meng

2017

Energies

View full text Add to dashboard Cite

Abstract:In order to reduce overestimations of worst-case execution time (WCET), in this article, we firstly report a kind of specific WCET overestimation caused by non-orthogonal nested loops. Then, we propose a novel correction approach which has three basic steps. The first step is to locate the worst-case execution path (WCEP) in the control flow graph and then map it onto source code. The second step is to identify non-orthogonal nested loops from the WCEP by means of an abstract syntax tree. The last step is to recursively calculate the WCET errors caused by the loose loop bound constraints, and then subtract the total errors from the overestimations. The novelty lies in the fact that the WCET correction is only conducted on the non-branching part of WCEP, thus avoiding potential safety risks caused by possible WCEP switches. Experimental results show that our approach reduces the specific WCET overestimation by an average of more than 82%, and 100% of corrected WCET is no less than the actual WCET. Thus, our approach is not only effective but also safe. It will help developers to design energy-efficient and safe real-time systems.

show abstract

How to compute worst-case execution time by optimization modulo theory and a clever encoding of program semantics

Abstract: The research leading to these results has received funding from the French Agence nationale de la recherche, grant W

Cited by 11 publications

References 30 publications

Precise Cache Timing Analysis via Symbolic Execution

Precise Cache Timing Analysis via Symbolic Execution

TIC: a scalable model checking based approach to WCET estimation

Reducing WCET Overestimations by Correcting Errors in Loop Bound Constraints

Contact Info

Product

Resources

About