Scalable and precise estimation and debugging of the worst-case execution time for analysis-friendly processors: a comeback of model checking

Abstract

Estimating the Worst-Case Execution Time (WCET) of an application is an essential task in the context of developing real-time or safety-critical software, but it is also a complex and error-prone process. Conventional approaches require at least some manual inputs from the user, such as loop bounds and infeasible path information, which are hard to obtain and can lead to unsafe results if they are incorrect. This is aggravated by the lack of a comprehensive explanation of the WCET estimate, i.e., a specific trace showing how WCET was reached. It is therefore hard to spot incorrect inputs and hard to improve the worst-case timing of the application. Meanwhile, modern processors have reached a complexity that refutes analysis and puts more and more burden on the practitioner. In this article we show how all of these issues can be significantly mitigated or even solved, if we use processors that are amenable to WCET analysis. We define and identify such processors, and then we propose an automated tool set which estimates a precise WCET without unsafe manual inputs, and also reconstructs a maximum-detail view of the WCET path that can be examined in a debugger environment. Our approach is based on Model Checking, which however is known to scale badly with growing application size. We address this issue by shifting the analysis to source code level, where source code transformations can be applied that retain the timing behavior, but reduce the complexity. Our experiments show that fast and precise estimates can be achieved with Model Checking, that its scalability can even exceed current approaches, and that new opportunities arise in the context of "timing debugging".

Imprecision in WCET estimates due to library calls and how to reduce it (WIP paper)

“…The annotations in lines 1 and 3 increment a global variable _time according to processor cycles taken by the underlying instructions, and can be obtained as in [3,6]. The fundamental limitation of source-level analysis occurs in line 4 with the call to function log10, which is not available as source code.…”

“…Context-Agnostic Approach: Table 1 illustrates that assuming the worst case for non-source callees leads to bad estimates. It quantifies the overestimation in a sourcelevel WCET analysis [3] that has been carried out on the Mälardalen adpcm benchmark [12], listing several functions without sources. We compare their observed WCETs during simulation runs (not necessarily occurring together in the same run) with their respective WCET estimates.…”

“…Note that this might not be the most efficient encoding, since that depends on the used source analysis method. To enhance scalability, semantic simplifications and flow-aware overapproximations can be applied [3], but are beyond the scope of this paper. Difficulties: In general source and binary flows have different structure, primarily due to compiler optimizations.…”

“…The main reasons for this are: (1) The binary is a more specific characterization of the target's execution behavior of the program than source code (e.g., it shows which instructions the compiler has used to implement high-level behavior), and (2) compiler optimizations, which impact WCET, are difficult to anticipate and account for at source level. Recent advances in source-level WCET analysis [3,6], have however addressed some of these limitations.…”

“…In particular, computing call contexts or excluding infeasible flows is hard or even intractable at binary level, enforcing both overapproximations [5,22] and frequent user input [15]. In contrast, source code allows for precise identification of flow constraints and call contexts, which relieves the user from specifying flow constraints and can provide better estimates due to the semantic information [3]. However, the unavailability of source code for some library functions forces source-level analyzers to assume pessimistic upper bounds on the WCET of such functions, as well as on their side effects on rest of the program.…”