Hardware-in-the-loop based WCET analysis with KLEE

Semiconductor technology evolution suggests that permanent failure rates will increase dramatically with scaling, in particular for SRAM cells. While well known approaches such as error correcting codes exist to recover from failures and provide fault-free chips, they will not be affordable anymore in the future due to their growing cost. Consequently, other approaches like fine-grained disabling and reconfiguration of hardware elements (e.g. individual functional units or cache blocks) will become economically necessary. This fine-grained disabling will degrade performance compared to a fault-free execution. To the best of our knowledge, all static worst-case execution time (WCET) estimation methods assume fault-free processors. Their result is not safe anymore when fine-grained disabling of hardware components is used. In this paper we provide the first method that statically calculates a probabilistic WCET bound in the presence of permanent faults in instruction caches. The proposed method derives a probabilistic WCET bound for a program, cache configuration, and probability of cell failure. As our method relies on static analysis to bound the longest path, its probabilistic nature only stems from the probability that faults actually occur. Our method is computationally tractable because it does not require an exhaustive enumeration of all the possible combinations of faulty cache blocks. Experimental results show that it provides WCET estimates very close to, but never below, the method that derives probabilistic WCETs by enumerating all possible locations of faulty cache blocks. The proposed method not only allows to quantify the impact of permanent faults on WCET estimates, but, most importantly, can be used in architectural exploration frameworks to select the most appropriate fault management mechanisms and design parameters for current and future chip designs.

Static Worst-Case Execution Time (WCET) estimation techniques operate upon the binary code of a program in order to provide the necessary input for schedulability analysis techniques. Compilers used to generate this binary code include tens of optimizations, that can radically change the flow information of the program. Such information is hard to be maintained across optimization passes and may render automatic extraction of important flow information, such as loop bounds, impossible. Thus, compiler optimizations, especially the sophisticated optimizations of mainstream compilers, are typically avoided. In this work, we explore for the first time iterative-compilation techniques that reconcile compiler optimizations and static WCET estimation. We propose a novel learning technique that selects sequences of optimizations that minimize the WCET estimate of a given program. We experimentally evaluate the proposed technique using an industrial WCET estimation tool (AbsInt aiT) over a set of 46 benchmarks from four different benchmarks suites, including reference WCET benchmark applications, image processing kernels and telecommunication applications. Experimental results show that WCET estimates are reduced on average by 20.3% using the proposed technique, as compared to the best compiler optimization level applicable.

The well-known model of Vestal aims to avoid excessive pessimism in the quantification of the processing requirements of mixed-criticality systems, while still guaranteeing the timeliness of higher-criticality functions. This can bring important savings in system costs, and indirectly help meet size, weight and power constraints. This efficiency is promoted via the use of multiple worst-case execution time (WCET) estimates for the same task, with each such estimate characterised by a confidence associated with a different criticality level. However, even this approach can be very pessimistic when the WCET of successive instances of the same task can vary greatly according to a known pattern, as in MP3 and MPEG codecs or the processing of ADVB video streams. In this paper, we present a schedulability analysis for the multiframe mixed-criticality model, which allows tasks to have multiple, periodically repeating, WCETs in the same mode of operation. Our work extends both the analysis techniques for Static Mixed-Cricality scheduling (SMC) and Adaptive Mixed-Criticality scheduling (AMC), on one hand, and the schedulability analysis for multiframe task systems on the other. Our proposed worst-case response time (WCRT) analysis for multiframe mixed-criticality systems is considerably less pessimistic than applying the SMC, AMC-rtb and AMC-max tests obliviously to the WCET variation patterns. Experimental evaluation with synthetic task sets demonstrates up to 63.8% higher scheduling success ratio (in absolute terms) compared to the best of the frame-oblivious tests.

Caches play an important role in embedded systems by bridging the performance gap between high speed processors and slow memory. At the same time, caches introduce imprecision in Worst-case Execution Time (WCET) estimation due to unpredictable access latencies. Modern embedded processors often include cache locking mechanism for better timing predictability. As the cache contents are statically known, memory access latencies are predictable, leading to precise WCET estimate. Moreover, by carefully selecting the memory blocks to be locked, WCET estimate can be reduced compared to cache modeling without locking. Existing static instruction cache locking techniques strive to lock the entire cache to minimize the WCET. We observe that such aggressive locking mechanisms may have negative impact on the overall WCET as some memory blocks with predictable access behavior get excluded from the cache. We introduce a partial cache locking mechanism that has the flexibility to lock only a fraction of the cache. We judiciously select the memory blocks for locking through accurate cache modeling that determines the impact of the decision on the program WCET. Our synergistic cache modeling and locking mechanism achieves substantial reduction in WCET for a large number of embedded benchmark applications.

To predict the worst case execution time (WCET) of real-time tasks, we should consider various factors (e.g., caching, pipelining, and infeasible paths) that affect the accuracy of the prediction. However some of them are inherently difficult to analyze statically, and thus may give rise to significant overestimation in WCET prediction. Therefore, for more accurate WCET prediction, we need to identify, such overestimation sources and analyze how much each of them can make overestimation. Then, such analysis results can be used to refine existing timing analysis techniques. In this paper we do not propose any new timing analysis techniques, but present quantitative analysis results on the impacts of overestimation sources on the accuracy of the worst case timing analysis. For this purpose, we use variance analysis based on a simulation-based methodology to make our analysis independent of any existing techniques. The results show that the dominant factor is pipelining analysis when the cache miss penalty is small and instruction caching analysis when the cache miss penalty is larger than 10 cycles. The results also show that although the impact of data caching analysis is small compared with that of pipelining or instruction caching analysis, if we ignore its effect in the WCET estimation, the WCET can be overestimated up to 275% even when the effects of the other factors are completely analyzed. Finally, the results show that the effects of infeasible paths are largely orthogonal to other analysis features and depend on program characteristics. Also, as for data caching, if infeasible paths are ignored in the WCET estimation, the accuracy of the WCET estimation is degraded significantly (up to 564%).

The use of networks-on-chip (NoC) in real-time safety-critical multicore systems challenges deriving tight worst-case execution time (WCET) estimates. This is due to the complexities in tightly upper-bounding the contention in the access to the NoC among running tasks. Probabilistic Timing Analysis (PTA) is a powerful approach to derive WCET estimates on relatively complex processors. However, so far it has only been tested on small multicores comprising an on-chip bus as communication means, which intrinsically does not scale to high core counts. In this paper we propose pTNoC, a new tree-based NoC design compatible with PTA requirements and delivering scalability towards medium/large core counts. pTNoC provides tight WCET estimates by means of asymmetric bandwidth guarantees for mixed-criticality systems with negligible impact on average performance. Finally, our implementation results show the reduced area and power costs of the pTNoC.

In this article we give an overview of the worst-case execution time (WCET) analysis research performed by the WCET group of the ASTEC Competence Centre at Uppsala University. Knowing the WCET of a program is necessary when designing and verifying real-time systems. The WCET depends both on the program flow, such as loop iterations and function calls, and on hardware factors, such as caches and pipelines. WCET estimates should be both safe (no underestimation allowed) and tight (as little overestimation as possible). We have defined a modular architecture for a WCET tool, used both to identify the components of the overall WCET analysis problem, and as a starting point for the development of a WCET tool prototype. Within this framework we have proposed solutions to several key problems in WCET analysis, including representation and analysis of the control flow of programs, modeling of the behavior and timing of pipelines and other low-level timing aspects, integration of control flow information and low-level timing to obtain a safe and tight WCET estimate, and validation of our tools and methods. We have focussed on the needs of embedded real-time systems in designing our tools and directing our research. Our long-term goal is to provide WCET analysis as a part of the standard tool chain for embedded development (together with compilers, debuggers, and simulators). This is facilitated by our cooperation with the embedded systems programming-tools vendor IAR Systems.

Multithreaded processors, in the context of real-time systems, create the opportunity to mix, on the same hardware platform, the execution of a complex real-time workload and the execution of non-critical applications. But resources sharing, inherent to multithreading, hinders the timing analysis of concurrent tasks. Such analyses are critical to real-time tasks which have timing deadlines that must be met and enforced.In this paper, we present the PRETI, Partitioned REal-TIme shared cache scheme, a flexible, low implementation-overhead, shared cache partitioning scheme. PRETI can preclude inter-task conflicts on shared caches, and their pessimistic impact on timing estimates, by allocating private cache space to real-time tasks. Therefore, uniprocessor, i.e. unithread, worst-case execution time (WCET) estimation techniques can be used. The remaining cache space, not reserved for currently running real-time tasks, is shared by all tasks running on the processor, in particular the non-critical ones, enabling high performances for these tasks.Experiments are presented to show that the PRETI cache scheme allows for easing and guaranteeing the schedulability of a set of real-time tasks with tight timing constraints, and enabling high performance for the non-critical tasks.

In the last three decades a number of methods have been devised to find upper-bounds for the execution time of critical tasks in time-critical systems. Most of such methods aim to compute Worst-Case Execution Time (WCET) estimates, which can be used as trustworthy upper-bounds for the execution time that the analysed programs will ever take during operation. The range of analysis approaches used include static, measurement-based and probabilistic methods, as well as hybrid combinations of them. Each of those approaches delivers its results on the assumption that certain hypotheses hold on the timing behaviour of the system as well that the user is able to provide the needed input information. Often enough the trustworthiness of those methods is only adjudged on the basis of the soundness of the method itself. However, trustworthiness rests a great deal also on the viability of the assumptions that the method makes on the system and on the user's ability, and on the extent to which those assumptions hold in practice. This paper discusses the hypotheses on which the major state-of-the-art timing analyses methods rely, identifying pitfalls and challenges that cause uncertainty and reduce confidence on the computed WCET estimates. While identifying weaknesses, this paper does not wish to discredit any method but rather to increase awareness on their limitations and enable an informed selection of the technique that best fits the user needs.

An accurate and safe estimation of a task's worst case execution time (WCET) is crucial for reasoning about the timing properties of real-time systems. In RISC processors, the execution time of a program construct (e.g., a statement) is affected by various factors such as cache hits/misses and pipeline hazards, and these factors impose serious problems in analyzing the WCETs of tasks. To analyze the timing effects of RISC's pipelined execution and cache memory, this paper proposes extensions of the original timing schema (Shaw, 1989) where the timing information associated with each program construct is a simple time-bound. We associate with each program construct what we call a WCTA (Worst Case Timing Abstraction), which contains detailed timing information of every execution path that might be the worst case execution path of the program construct. This extension leads to a revised timing schema that is similar to the original timing schema except that concatenation and pruning operations on WCTAs are newly defined to replace the add and max operations on time-bounds in the original timing schema. Our revised timing schema accurately accounts for the timing effects of pipelined execution and cache memory not only within but also across program constructs. This paper also reports on preliminary results of WCET analyses for a pipelined processor. Our results show that up to 50% tighter WCET bounds can be obtained by using the revised timing schema. >

Chronos: A timing analyzer for embedded software

Automated static timing analysis methods provide a safe but usually overestimated worst-case execution time (WCET) due to infeasible execution paths. In this paper, we propose a visual language, User Constraint Language (UCL), to obtain a tight WCET estimation. UCL provides intuitive visual notations with which users can easily specify various levels of flow information to characterize valid execution paths of a program. The user constraints specified in UCL are translated into finite automata. The combined automaton, constructed by a cross-production of the automata for program and user constraints, reflects the static structure and possible dynamic behavior of the program. It contains only the execution paths satisfying user constraints. A case study using part of a software program for satellite flight demonstrates the effectiveness of UCL and our approach.

Timing validation is a critical step in the design of real-time systems, that requires the estimation of Worst-Case Execution Times (WCET) for tasks. A number of different methods have been proposed, such as Static Deterministic Timing Analysis (SDTA). The advent of Probabilistic Timing Analysis, both Measurement-Based (MBPTA) and Static Probabilistic Timing Analyses (SPTA), offers different design points between the tightness of WCET estimates, hardware that can be analyzed and the information needed from the user to carry out the analysis. The lack of comparison among those techniques makes complex the selection of the most appropriate one for a given system. This paper makes a first attempt towards comparing comprehensively SDTA, SPTA and MBPTA, qualitatively and quantitatively, under different cache configurations implementing LRU and random replacement. We identify strengths and limitations of each technique depending on the characteristics of the program under analysis and the hardware platform, thus providing users with guidance on which approach to choose depending on their target application and hardware platform.

The paper investigates the problem of ensuring the security of real-time cyber-physical systems (RFCs) that operate in environments with tight time constraints and are often implemented in programming languages ​​without built-in memory protection, such as C/C++. Traditional security mechanisms designed for general-purpose computing systems create significant additional costs and limit performance, which makes their application in RF CFS problematic. The main goal of the work is to increase the level of security of these systems with minimal impact on the time characteristics of task performance. To achieve this goal, adaptive mechanisms for ensuring the integrity of data flows, control flow, and pointers using conservative estimates of worst-case execution time (WCET) and slack time are proposed. Reserve time is used to dynamically perform additional checks without violating deadlines, which allows you to formally guarantee the timely operation of the system. Data flows and control flow are formalized as graphs with adjacency and reachability matrices, which provides an accurate assessment of the compliance of actual operations with predefined security policies. For pointers, a context-dependent selective check is applied, which reduces the time spent on control. A generalized optimization model has been developed, which allows balancing the level of security and productivity by using the available time reserve and adaptive scheduling of tasks. The proposed step-by-step method includes system modeling, analysis of protection mechanisms, evaluation and use of slack time, adaptive task scheduling, integration of spatial and temporal isolation, dynamic security management, and testing with validation. Empirical studies confirm the effectiveness of the approach: it ensures timely execution of critical tasks, minimizes additional costs for inspections, increases the level of security without compromising productivity. The obtained models and methods create a scientific basis for the further development of adaptive safety mechanisms of the RF CFS and their integration into resource-efficient real-time systems.

Multi-core processors improve performance, but they can create unpredictability owing to shared resources such as caches interfering. Cache partitioning is used to alleviate the Worst-Case Execution Time (WCET) estimation by isolating the shared cache across each thread to reduce interference. It does, however, prohibit data from being transferred between parallel threads running on different cores. In this paper we present (SRCP) a cache replacement mechanism for partitioned caches that is aware of data being shared across threads, prevents shared data from being replicated across partitions and frequently used data from being evicted from caches. Our technique outperforms TA-DRRIP and EHC, which are existing state-of-the-art cache replacement algorithms, by 13.34% in cache hit-rate and 10.4% in performance over LRU (least recently used) cache replacement policy.