[Paper Review] A Brief Overview of the KTA WCET Tool

David Broman|arXiv (Cornell University)|Dec 14, 2017

Real-Time Systems Scheduling23 references3 citations

TL;DR

KTA is a research tool for precise worst-case execution time (WCET) analysis of MIPS machine code, offering two approaches: exhaustive fine-grained timing analysis for path-specific WCET/BCET estimation and abstract search-based analysis using combined abstract interpretation and divide-and-conquer search to compute optimal, sound WCET bounds. The key contribution is a unified, scalable method for optimal WCET analysis at arbitrary program points, implemented via staged CPS code generation and abstract interpretation in OCaml.

ABSTRACT

KTA (KTH's timing analyzer) is a research tool for performing timing analysis of program code. The currently available toolchain can perform two different kinds of analyses: i) exhaustive fine-grained timing analysis, where timing information can be provided between arbitrary timing program points within a function, and ii) abstract search-based timing analysis, where the tool can perform optimal worst-case execution time (WCET) analysis. The latter is based on a technique that combines divide-and-conquer search and abstract interpretation. The tool is under development and currently supports a subset of the MIPS instruction set architecture.

Motivation & Objective

• To develop a tool that provides guaranteed optimal WCET estimates between arbitrary program points in a function, addressing a gap in existing tools that only support function-level analysis.
• To enable both worst-case (WCET) and best-case (BCET) execution time analysis at arbitrary timing points within a function.
• To design a scalable, sound, and optimal WCET analysis framework by integrating control-flow, microarchitecture, and global-bound analysis into a single global phase.
• To support future extensions with cache and pipeline analysis, and to explore integration with polyhedral and multicore analysis models.

Proposed method

• The tool compiles C code to MIPS machine code using a cross-compiler, then decodes the ELF format into an internal representation for analysis.
• For exhaustive fine-grained analysis, the tool performs cycle-accurate simulation with concrete inputs, exploring all input paths to compute exact timing between program points.
• For abstract search-based analysis, the control flow graph is reconstructed and translated into continuous-passing style (CPS) OCaml code, compiled into a staged abstract interpreter.
• The abstract search phase uses a divide-and-conquer strategy over abstract inputs (e.g., intervals) to efficiently explore the input space and converge on the optimal WCET value.
• The analysis is bounded by a maximum time threshold, which is naturally aligned with real-time scheduling constraints, ensuring termination.
• The entire pipeline is implemented in OCaml, leveraging its functional and metaprogramming features to generate and execute abstract interpreters.

Experimental results

Research questions

• RQ1 Can a static analysis tool achieve optimal, sound WCET estimates between arbitrary program points in a function, rather than only at the function level?
• RQ2 Can a combined-phase analysis using abstract interpretation and divide-and-conquer search outperform traditional multi-phase WCET analysis in terms of scalability and precision?
• RQ3 How can cycle-accurate simulation and abstract interpretation be integrated to enable both fine-grained and scalable timing analysis?
• RQ4 Can the abstract search-based method be extended to support complex microarchitectural features like caching and pipelining?
• RQ5 Is it feasible to combine the exhaustive path exploration of fine-grained analysis with the efficiency of abstract search for hybrid analysis?

Key findings

• The KTA tool successfully computes optimal, sound WCET values between arbitrary program points using a unified abstract search-based approach.
• The abstract search-based method achieves scalability by combining abstract interpretation with divide-and-conquer, enabling efficient exploration of the input space.
• The tool’s staged CPS code generation enables the construction of a compiled, executable abstract interpreter that performs precise static analysis.
• The exhaustive fine-grained analysis, while not scalable, provides a foundation for validating the methodology and identifying critical timing paths.
• The tool is extensible and currently being enhanced with support for cache and pipeline analysis, as well as potential integration with non-relational polyhedral domains.
• The abstract search phase is bounded by a maximum time threshold, which ensures termination and aligns with real-time system constraints.