Ingomar Wenzel

Automatic Timing Model Generation by CFG Partitioning and Model Checking

We present a new measurement-based worst-case execution time (WCET) analysis method. Exhaustive end-to-end measurements are computationally intractable in most cases. Therefore, we propose to measure execution times of subparts of the application. We use heuristic methods and model checking to generate test data, forcing the execution of selected paths to perform run-time measurements. The measured times are used to calculate the WCET in a final computation step. As we operate on the source code level, our approach is platform independent except for the run-time measurements performed on the target host. We show the feasibility of the required steps and explain our approach by means of a case study.

Measurement-Based Timing Analysis

In this paper we present a measurement-based worst-case execution time (WCET) analysis method. Exhaustive end-to-end execution-time measurements are computationally intractable in most cases. Therefore, we propose to measure execution times of subparts of the application code and then compose these times into a safe WCET bound.

Principles of timing anomalies in superscalar processors

The counter-intuitive timing behavior of certain features in superscalar processors that cause severe problems for existing worst-case execution time analysis (WCET) methods is called timing anomalies. In this paper, we identify structural sources potentially causing timing anomalies in superscalar pipelines. We provide examples for cases where timing anomalies can arise in much simpler hardware architectures than commonly supposed (i.e., even in hardware containing only in-orderfunctional units). We elaborate the general principle behind timing anomalies and propose a general criterion (resource allocation criterion) that provides a necessary (but not sufficient) condition for the occurrence of timing anomalies in a processor. This principle allows to state the absence of timing anomalies for a specific combination of hardware and software and thus forms a solid theoretic foundation for the time-predictable execution of real-time software on complex processor hardware.

Measurement-based worst-case execution time analysis

In the last years the number of electronic control systems has increased significantly. In order to stay competitive more and more functionality is integrated into more and more powerful and complex computer hardware. Due to these advances in control systems engineering new challenges for analyzing the timing behavior of real-time computer systems arise. The two identified main challenges are execution-time modeling of the hardware and the path problem that forbids capturing the worst-case execution time (WCET) by end-to-end measurements due to limits in computational complexity. This work presents the cornerstones of our new measurement-based WCET analysis method that successfully addresses these problems. We clearly identify our research goals and the relevance of our research. Especially, the novel aspects of our approach are emphasized. The conclusion is formed by a brief presentation of an industrial-size case study application.

Using model checking to derive loop bounds of general loops within ANSI-C applications for measurement based WCET analysis

Knowing the boundaries of loops is an important prerequisite for both, static and dynamic worst case execution time (WCET) analysis. However, loop bound calculation is a complex task of its own, and often more effort than planned has to be put into it. This paper describes a simple and quick method for loop bound calculation using a model checker that cannot only find loop bounds for integer iterator variables but works with practically all kind of loops.

Interface Design for Hardware-in-the-Loop Simulation

This paper presents a scalable approach to interface between a time-triggered distributed hardware-in-the-loop (HIL) simulator and the system under test (SUT) via smart virtual transducers (SVTs). An SVT is an element of an HIL simulator and implements two interfaces - a standardized digital interface to a time-triggered transducer network and a transducer-specific interface. The main contribution of the approach is a separation of the execution of the simulation model and the deterministic interaction via an arbitrary transducer interface. The benefit of such separation is the temporal decoupling between simulation model execution and interaction with the SUT. Furthermore, the approach leads to a reduction of complexity of the simulation setup. The application of the approach is shown by an SVT prototype that is used to simulate a temperature sensor

Cross-platform verification framework for embedded systems

Many innovations in the automotive sector involve complex electronics and embedded software systems. Testing techniques are one of the key methodologies for detecting faults in such embedded systems. In this paper, a novel cross-platform verification framework including automated test-case generation by model checking is introduced. Comparing the execution behavior of a program instance running on a certain platform to the execution behavior of the same program running on a different platform we denote cross-platform verification. The framework supports various types of coverage criteria. It turned out that end-to-end testing is of high importance due to defects occurring on the actual target platform for the first time. Additionally, formal verification can be applied for checking requirements resulting from the specification using the same model generation mechanism that is used for test data generation. Due to a novel self-assessment mechanism, the confidence into the formal models is increased significantly. We provide a case study for the Motorola embedded controller HCS12 that is heavily used by the automotive industry. We perform structural tests on industrial code patterns using a wide-spread industrial compiler. Using our technique, we found two severe compiler defects that have been corrected in subsequent releases.

Using a Runtime Measurement Device with Measurement-Based WCET Analysis

The tough competition among automotive companies creates a high cost pressure on the OEMs. Combined with shorter innovation cycles, testing new safety-critical functions becomes an increasingly difficult issue [4]. In the automotive industry about 55% of breakdowns can be traced back to problems in electronic systems. About 30% of these incidents are estimated to be caused by timing problems [7]. It is necessary to develop new approaches for testing the timing behavior on embedded and real-time systems. This work describes the integration of runtime measurements using an external measurement device into a framework for measurement-based worst-case execution time calculations. We show that especially for small platforms using an external measurement device is a reasonable way to perform execution time measurements. Such platforms can be identified by the lack of a time source, limited memory, and the lack of an external interface. The presented device uses two pins on the target to perform run-time measurements. It works cycle accurate for frequencies up to 200MHz, which should be sufficient for most embedded devices.

Impact of Dependable Software Development Guidelines on Timing Analysis

The knowledge of the worst-case execution time (WCET) of real-time tasks is mandatory to ensure correct timing behavior of real-time systems. However, in practice an exact WCET analysis is often intractable due to limitations in computability and analysis complexity of real-size programs. In this paper we analyze how development guidelines for dependable software support and simplify WCET analysis. We investigate three guidelines and their impact on WCET analyzability. DO-178B as a production guide for avionics software expresses requirements that are relevant for timing analysis. The MISRA guidelines include C programming guidelines that improve the WCET analyzability of software. Finally, ARINC 655, a standard for software architectures of avionic systems, provides examples on how to simplify timing analysis already at the design level as early as in system design. The argument of this paper is that careful system design and programming improves the timing analyzability of real-time systems

Portable data exchange for remote-testing frameworks

To communicate between heterogeneous computer systems, mechanisms for data conversion are necessary. In this paper we present a portable, asymmetric data conversion method that is suitable for remote testing frameworks in embedded systems development. The described method takes the resource limitations of embedded systems into account by doing the data conversion at the testing host. The method can be implemented as platform-independent source code and it avoids the need of recompiling the code of a communication partner if the code of the other communication partner is migrated to a different platform