Using SMT Solving for the Lookup of Infeasible Paths in Binary Programs

International audienceWorst-Case Execution Time (WCET) is a key component to check temporal constraints of realtime systems. WCET by static analysis provides a safe upper bound. While hardware modelling is now efficient, loss of precision stems mainly in the inclusion of infeasible execution paths in the WCET calculation. This paper proposes a new method to detect such paths based on static analysis of machine code and the feasibility test of conditions using Satisfiability Modulo Theory (SMT) solvers. The experimentation shows promising results although the expected precision was slightly lowered due to clamping operations needed to cope with complexity explosion. An important point is that the implementation has been performed in the OTAWA framework and is independent of any instruction set thanks to its semantic instructions

A constraint-based WCET computation framework

National audienceOTAWA is a tool dedicated to the WCET computation of critical real-time systems. The tool was enhanced in order to take into account modern micro-architecture features, through an ADL-based approach. Architecture constraints are expresses such that they can be solved by well known efficient constraint solvers. In this paper, we present how we could describe some complex architecture features using the Sim-nML language. We are also concerned by the validation and the animation point of views

A Framework to Quantify the Overestimations of Static WCET Analysis

International audienceTo reduce complexity while computing an upper bound on the worst-case execution time, static WCET analysis performs over-approximations. This feeds the general feeling that static WCET estimations can be far above the real WCET. This feeling is strengthened when these estimations are compared to measured execution times: generally, it is very unlikely to capture the worstcase from observations, then the difference between the highest watermark and the proven WCET upper bound might be considerable. In this paper, we introduce a framework to quantify the possible overestimation on WCET upper bounds obtained by static analysis. The objective is to derive a lower bound on the WCET to complement the upper bound

Mauve: a Component-based Modeling Framework for Real-time Analysis of Robotic Applications.

Robots are more and more used in very diverse situations (services to persons, military missions, crisis management, . . . ) in which robots must give some guarantees of safety and reliability. To be really integrated in everyday life, robots must fulfil some requirements. Among these requirements, we focus on the nonfunctional requirements on embedded software [1], and more specifically on real-time software requirements. These requirements are most of the time fulfilled by proving the schedulability of the embedded software. Analysing and validating such properties on an existing hand-coded software requires some reverse modelling of the software, leading to approximations of its behaviour. These approximations may have certification authorities not be confident on the robot dependability. This paper proposes an integrated development methodology that starts from software component modelling, and leads to both validation of the embedded software and generation of deployable embedded software

Formal Architecture Specification for Time Analysis

International audienceWCET calculus is nowadays a must for safety critical systems. As a matter of fact, basic real-time properties rely on accurate timings. Although over the last years, substantial progress has been made in order to get a more precise WCET, we believe that the design of the underlying frameworks deserve more attention. In this paper, we are concerned mainly with two aspects which deal with the modularity of these frameworks. First, we enhance the existing language Sim-nML for describing processors at the instruction level in order to capture modern architecture aspects. Second, we propose a light DSL in order to describe, in a formal prose, architectural aspects related to both the structural aspects as well as to the behavioral aspects

Validation of real-time properties of a robotic software architecture

National audienceIn this paper, we propose a mechanism allowing to evaluate the schedulability of a robotic software architecture, and then validate its real-time properties. The robotic software architecture is described through a Domain Specific Language (DSL), MAUVE, that allows to model communicating components. The evaluation of schedulability of the architecture consists in first computing the Worst-Case Execution Time (WCET) of the elementary functions of the components. Then the Worst Case Response Time (WCRT) of the component is computed from the elementary WCET and the component models, allowing to validate the schedulatiblity of the architecture. We illustrate our methodology on the evaluation of a control architecture for a ground mobile robot

Multi-architecture Value Analysis for Machine Code

International audienceSafety verification of critical real-time embedded systems requires Worst Case Execution Time information (WCET). Among the existing approaches to estimate the WCET, static analysis at the machine code level has proven to get safe results. A lot of different architectures are used in real-time systems but no generic solution provides the ability to perform static analysis of values handled by machine instructions. Nonetheless, results of such analyses are worth to improve the precision of other analyzes like data cache, indirect branches, etc. This paper proposes a semantic language aimed at expressing semantics of machine instructions whatever the underlying instruction set is. This ensures abstraction and portability of the value analysis or any analysis based on the semantic expression of the instructions. As a proof of concept, we adapted and refined an existing analysis representing values as Circular-Linear Progression (CLP), that is, as a sparse integer interval effective to model pointers. In addition, we show how our semantic instructions allow to build back conditions of loop in order to refine the CLP values and improve the precision of the analysis. Both contributions have been implemented in our framework, OTAWA, and experimented on the Malardalen benchmark to demonstrate the effectiveness of the approach

Normalisation of Loops with Covariant Variables

AbstractTemporal property verification is utterly important to ensure safety of critical real-time systems. A main component of this verification is the computation of Worst Case Execution Time (WCET) that requires, in turn, the determination of loop bounds. Although a lot of efforts have been performed in this domain, it remains relatively common cases which are unsolved. For example, to our knowledge, no fast automatic method can cope with the loop bound of a simple binary search look-up. In this paper, we present an approach to solve such loops by using arithmetico-geometric series, that is, loops with arithmetic and/or geometric incrementation with several variables. We have implemented and experimented this approach in our tool oRange

Hardware architecture specification and constraint-based WCET computation

International audienceThe analysis of the worst-case execution times is necessary in the design of critical real-time systems. To get sound and precise times, the WCET analysis for these systems must be performed on binary code and based on static analysis. OTAWA, a tool providing WCET computation, uses the Sim-nML language to describe the instruction set and XML files to describe the microarchitecture. The latter information is usually inadequate to describe real architectures and, therefore, requires specific modifications, currently performed by hand, to allow correct time calculation. In this paper, we propose to extend Sim-nML in order to support the description of modern microarchitecture features along the instruction set description and to seamlessly derive the time calculation. This time computation is specified as a constraint solving problem that is automatically synthesized from the extended Sim-nML. Thanks to its declarative aspect, this approach makes easier and modular the description of complex features of microprocessors while maintaining a sound process to compute times

Génération automatique de simulateurs fonctionnels de processeurs

12 pagesLe développement d'un simulateur de processeur est long et fastidieux. Découpler la partie fonctionnelle (émulation) de la partie structure (analyse des temps de traitement) permet de réutiliser plus facilement du code existant (principalement le code d'émulation, les jeux d'instructions évoluant moins vite que les architectures matérielles). Dans ce contexte, plusieurs équipes ont proposé des solutions pour une génération automatique de la partie fonctionnelle d'un simulateur à partir d'une description plus ou moins formelle du jeu d'instructions. S'il est relativement aisé de générer automatiquement un émulateur pour l'architecture DLX, il s'avère plus compliqué de réaliser un générateur supportant à la fois des architectures de type CISC, RISC ou VLIW et produisant un code efficace. Dans cet article, nous décrivons plusieurs techniques mises en œuvre dans l'outil GLISS que nous avons développé et qui se veut aussi « polyvalent » que possible