1. Timing Predictability - A Must for Avionics Systems - Reinhard Wilhelm Saarland University, Saarbrücken

2. Run-Time Guarantees for Hard Real-Time Systems Hard real-time embedded systems need offline guarantees for the satisfaction of their timing constraints Timing analysis should determine upper bounds on the execution times of all tasks statically This has become difficult because of the huge variability in the execution time of individual instructions/functions/systems (currently ~factor 100) The timing-analysis tool aiT is in routine use in the aeronautics and automotive industries (in Old Europe) A380 subsystems of the highest criticality level are being certified using aiT Measurement is not an alternative!

3. Run-Time Guarantees for Hard Real-Time Systems Hard real-time embedded systems need offline guarantees for the satisfaction of their timing constraints Timing analysis should determine upper bounds on the execution times of all tasks statically This has become difficult because of the huge variability in the execution time of individual instructions/functions/systems

4. Access Times LOAD r2, _a LOAD r1, _b ADD r3,r2,r1 MPC 5xxPPC 755 x = a + b;

5. Timing Accidents and Penalties The variability of execution times is caused by the many different ways instructions can be executed: Timing Accident – cause for an increase of the execution time of an instruction Timing Penalty – the associated increase Types of timing accidents Cache missTLB miss Pipeline stallMemory refresh of DRAM Bus collisionBranch misprediction Page fault

6. How to Deal with Murphy’s Law? Essentially three different answers: Accepting: Every timing accident that may happen will happen Fighting: Reliably showing that many/most Timing Accidents cannot happen Cheating: measuring “enough” runs to feel comfortable

7. Accepting Murphy’s Law like guaranteeing a speed of 4.07 km/h for this car because variability of execution times on modern processors is in the order of 100

8. Cheating to deal with Murphy’s Law measuring “enough” runs to feel comfortable how many runs are “enough”? Example: Analogy – Testing vs. Verification AMD was offered a verification of the K7. They had tested the design with 80 000 test vectors, considered verification unnecessary. Verification attempt discovered 2 000 bugs! The only remaining solution: Fighting Murphy’s Law!

9. aiT WCET Analyzer IST Project DAEDALUS final review report: "The AbsInt tool is probably the best of its kind in the world and it is justified to consider this result as a breakthrough.” aiT is in routine use in the aeronautics and automotive industries A380 subsystems of the highest criticality level are being certified using aiT

10. Timing Predictability The possibility, the obtainable precision, and the complexity of timing analysis depend on predictability properties of the SuA, e.g. –processor architecture (memory hierarchy, speculation) –communication protocols (deterministic/stochastic) –SW design (model-based design + synthesis) Many “advances” in computer architecture have increased average-case performance at the cost of worst-case performance Computer Architects, 1.forget about increasing average-case performance only 2.look for a good combination of average-case and worst-case performance

11. Design of Layered Systems Separation of Concerns is the Design Principle Virtualization & Abstraction are the means Abstraction from resources, in particular time Very successful, but a disaster for predictability! System Architects: Use Resource-aware Design

12. Alternatives? Over-provisioning Completely deterministic systems will no longer work will not perform

13. A New Research Agenda – Design for Predictability - Architecture design: Reconcile average- case with worst-case performance Programming for analyzability Resource-aware abstraction Exploit synergy between design and analysis Design only what you can analyze!

14. Tremendous Progress during the past 10 Years 1995 20022005 over-estimation 20-30% 15% 30-50% 4 25 60 200 cache-miss penalty Lim et al. Thesing et al.Souyris et al. The explosion of penalties has been compensated by a reduction of uncertainties! 10%