Embedded Software for SoC - Grupo de Mecatrônica EESC/USP

16 Chapter 2
techniques for timing validation are increasingly unreliable with growing
application and architecture complexity. Therefore‚ formal timing analysis
techniques which consider conservative min/max behavioral intervals are
becoming more and more attractive as an alternative or supplement to
simulation. We expect that‚ ultimately‚ certification will only be possible using
a combination of agreed-upon test patterns and formal techniques. This can
be augmented by run-time techniques such as deadline enforcement to deal
with unexpected situations (not considered here).
A major challenge when applying formal analysis methodologies is to
calculate tight performance bounds. Overestimation leads to poor utilization
of the system and thus requires more expensive target processors‚ which is
unacceptable for high-volume products in the automotive industry.
Apart from conservative performance numbers‚ timing analysis also yields
better system understanding‚ e.g. through visualization of worst case scenarios.
It is then possible to modify specific system parameters to assess their impact
on system performance. It is also possible to determine the available headroom
above the calculated worst case‚ to estimate how much additional functionality
could be integrated without violating timing constraints.
In the following we demonstrate that formal analysis is consistently applicable
for single processes‚ RTOS overhead‚ and single ECUs‚ and give an
outlook on networked ECUs‚ thus opening the door to formal timing analysis
for the certification of automotive software.
5.1. Single process analysis
Formal single process timing analysis determines the worst and best case
execution time (WCET‚ BCET) of one activation of a single process assuming
an exclusive resource. It consists of (a) path analysis to find all possible paths
through the process‚ and (b) architecture modeling to determine the minimum
and maximum execution times for these paths. The challenge is to make both
path analysis and architecture modeling tight.
Recent analysis approaches‚ e.g. [9]‚ first determine execution time intervals
for each basic block. Using an integer linear programming (ILP) solver‚
they then find the shortest and the longest path through the process based on
basic block execution counts and time‚ leading to an execution time interval
for the whole process. The designer has to bound data-dependent loops and
exclude infeasible paths to tighten the process-level execution time intervals.
Pipelines and caches have to be considered for complex architectures to
obtain reliable analysis bounds. Pipeline effects on execution time can be
captured using a cycle-accurate processor core model or a suitable measurement
setup. Prediction of cache effects is more complicated. It first requires
the determination of worst and best case numbers for cache hits and misses‚
before cache influence on execution time can be calculated.
The basic-block based timing analysis suffers from the over-conservative
assumption of an unknown cache state at the beginning of each basic block.