Reinhold Heckmann

The worst-case execution-time problem—overview of methods and survey of tools

The determination of upper bounds on execution times, commonly called worst-case execution times (WCETs), is a necessary step in the development and validation process for hard real-time systems. This problem is hard if the underlying processor architecture has components, such as caches, pipelines, branch prediction, and other speculative components. This article describes different approaches to this problem and surveys several commercially available tools1 and research prototypes.

Reliable and Precise WCET Determination for a Real-Life Processor

The USES-groupat the Universitat des Saarlandes follows an approach to compute reliable run-time guarantees which is both wellbased on theoretical foundations and practical from a software engineering and an efficiency point of view. Several aspects are essential to the USES approach: the resulting system is modular by structuring the task into a sequence of subtasks, which are tackled with appropriate methods. Generic and generative methods are used whenever possible. These principles lead to an understandable, maintainable, efficient, and provably correct system. This paper gives an overview of the methods used in the USES approach to WCET determination. A fully functional prototype system for the Motorola ColdFire MCF 5307 processor is presented, the implications of processor design on the predictability of behavior described, and experiences with analyzing applications running on this processor reported.

The influence of processor architecture on the design and the results of WCET tools

The architecture of tools for the determination of worst case execution times (WCETs) as well as the precision of the results of WCET analyses strongly depend on the architecture of the employed processor. The cache replacement strategy influences the results of cache behavior prediction; out-of-order execution and control speculation introduce interferences between processor components, e.g., caches, pipelines, and branch prediction units. These interferences forbid modular designs of WCET tools, which would execute the subtasks of WCET analysis consecutively. Instead, complex integrated designs are needed, resulting in high demand for memory space and analysis time. We have implemented WCET tools for a series of increasingly complex processors: SuperSPARC, Motorola ColdFire 5307, and Motorola PowerPC 755. In this paper, we describe the designs of these tools, report our results and the lessons learned, and give some advice as to the predictability of processor architectures.

An abstract interpretation-based timing validation of hard real-time avionics software

Hard real-time avionics systems like flight control software are expected to always react in time. Consequently, it is essential for the timing validation of the software that the worst-case execution time (WCET) of all tasks on a given hardware configuration be known. Modern processor components like caches, pipelines, and branch prediction complicate the determination of the WCET considerably since the execution time of a single instruction may depend on the execution history. The safe, yet overly pessimistic assumption of no cache hits, no overlapping executions in the processor pipeline, and constantly mispredicted branches results in a serious overestimation of the WCET. Our approach to WCET prediction was implemented for the Motorola ColdFire 5307. It includes a static prediction of ∗ This work was partly supported by the RTD project IST-1999-20527 “DAEDALUS” of the European FP5 program. cache and pipeline behavior, producing much tighter upper bounds for the execution times. The WCET analysis tool works on real applications. It is safe in the sense that the computed WCET is always an upper bound of the real WCET. It requires much less effort, while producing more precise results than conventional measurement-based methods.

T-CREST

Real-time systems need time-predictable platforms to allow static analysis of the worst-case execution time (WCET). Standard multi-core processors are optimized for the average case and are hardly analyzable. Within the T-CREST project we propose novel solutions for time-predictable multi-core architectures that are optimized for the WCET instead of the average-case execution time. The resulting time-predictable resources (processors, interconnect, memory arbiter, and memory controller) and tools (compiler, WCET analysis) are designed to ease WCET analysis and to optimize WCET performance. Compared to other processors the WCET performance is outstanding.The T-CREST platform is evaluated with two industrial use cases. An application from the avionic domain demonstrates that tasks executing on different cores do not interfere with respect to their WCET. A signal processing application from the railway domain shows that the WCET can be reduced for computation-intensive tasks when distributing the tasks on several cores and using the network-on-chip for communication. With three cores the WCET is improved by a factor of 1.8 and with 15 cores by a factor of 5.7.The T-CREST project is the result of a collaborative research and development project executed by eight partners from academia and industry. The European Commission funded T-CREST.

Pipeline Modeling for Timing Analysis

In hard real-time systems, the worst-case execution times of programs must be known. Obtaining safe upper bounds for these times by measuring actual executions is rarely possible, since the worst case input is normally not known. We apply static program analysis methods to determine an upper bound for the WCET. While this approach is not new, we believe to be the first to have developed a tool that implements these techniques for all the features of a real-life, non-trivial processor, the Motorola ColdFire 5307. Our tool is, to the best of our knowledge, the first one that can determine a safe and rather precise WCET bound for a processor that has caches and pipelines and performs branch prediction and instruction prefetching.Our approach to use a pipeline model in the analysis of the processor behavior opens up new perspectives towards a generative analysis approach and can prove helpful in investigating other processor properties. The emphasis of this paper is on the modeling of the pipeline behavior as input to the derivation of a pipeline analysis.

Power domain constructions

Abstract The variety of power domain constructions proposed in the literature is put into a general algebraic framework. Power constructions are considered algebras on a higher level: for every ground domain, there is a power domain whose algebraic structure is specified by means of axioms concerning the algebraic properties of the basic operations empty set, union, singleton, and extension of functions. A host of derived operations is introduced and investigated algebraically. Every power construction is shown to be equipped with a characteristic semiring such that the resulting power domains become semiring modules. Power homomorphisms are introduced as a means to relate different power constructions. They also allow to define the notion of initial and final constructions for a fixed characteristic semiring. Such initial and final constructions are shown to exist for every semiring, and their basic properties are derived. Finally, the known power constructions are put into the general framework of this paper.

Spaces of Valuations

Valuations are measurelike functions mapping the open sets of a topological space X into positive real numbers. They can be classified into finite, point continuous, and Scott continuous valuations. We define corresponding spaces of valuations VfX⊂ VpX⊂VX. The main results of the paper are that VpX is the soberification of VfX, and that VpX is the free sober locally convex topological cone over X. From this universal property, the notion of the integral of a real‐valued function over a Scott continuous valuation can be easily derived. The integral is used to characterize the spaces VpX and VX as dual spaces of certain spaces of real‐valued functions on X.

A Functional Language for the Specification of Complex Tree Transformations

Transformations of trees and rewriting of terms can be found in various settings e.g. transformations of abstract syntax trees in compiler construction and program synthesis.

Power domains and second-order predicates

Abstract Lower, upper, sandwich, mixed, and convex power domains are isomorphic to domains of second-order predicates mapping predicates on the ground domain to logical values in a semiring. The various power domains differ in the nature of the underlying semiring logic and in logical constraints on the second-order predicates.