Improving WCET Analysis for Synthesized Code from Matlab/Simulink/Stateflow. Lili Tan Compiler Design Lab Saarland University

Size: px

Start display at page:

Download "Improving WCET Analysis for Synthesized Code from Matlab/Simulink/Stateflow. Lili Tan Compiler Design Lab Saarland University"

Adam Fitzgerald
6 years ago
Views:

1 Improving WCET Analysis for Synthesized Code from Matlab/Simulink/Stateflow Lili Tan Compiler Design Lab Saarland University

2 Safety-Criticial Embedded Software WCET bound required for Scheduling >=0 Execution time Overestimation 0 Time WCET t WCET-bound generally unknown Static analysis results: safe

3 Potential Problems State-of-the-Art WCET analysis Need loop/recursion bound Maximal number of iterations? But, automatic detection of these bounds is undecidable in general user annotation may be required

4 Potential Problems (cont.) Infeasible paths Static WCET analysis considers superset of execution paths Safe, fast but potentially overestimation Reason: relations between conditions are often not tracked precisely

5 Motivation Model Matlab: Widely used in industry Not designed for formal verification Not integrated with WCET analysis yet Leverage Models C code Executable ait WCET WCET Automation Precision loops infeasible recursion paths

6 ait WCET Analyzer Leading commercial WCET analyzer Almost push-button technology Well integrated with SCADE problems as just mentioned

7 Matlab/Simulink/Stateflow & WCET Matlab/Simulink/Stateflow Communicating states State: Sub-states and guarded transitions Problems with synthesized code Communication between states: event broadcasting Event broadcasting realized by function calls If senders and potential receivers of events have a common super-state, then funtion calls itself Recursion recursion Stores states in integer variables Static analysis loses precision infeasible paths Automation Precision Event broadcasting Transition dependency

8 Matlab/Simulink/Stateflow: Recursion Recursion is not allowed in safety-critical systems (Automotive coding guide line: MISRA-C Rule 16.2) Yet: Recursive functions are generated without warning! Matlab/Simulink/Stateflow: YES SCADE: NO Source of recursion: Event broadcasting Event broadcasting is an essential part of Stateflow

9 Stateflow: Example Fail.INC INC

10 A Simplified Model Super-state contains communicating states A, B, C State A Sub-state, Transition guarded by tick, broadcasts event1 B Sub-state, Transition guarded by event1, broadcasts event3 C Event dependency Event1 Event3 Event2 Event4

11 Synthezied Code Model: Void EventBroadcasting() switch (state_a) { case : if (Tick) { next_event = event1; EventBroadcasting(); } switch (state_b) { case : if (event1) { next_event = event3; EventBroadcasting(); } switch (state_c) { case : case : }

12 Recursion Bounds from Model Model Longest chain: Event 1? event 2?.. event K? C code Executable Recursion bound ait

13 Dealing with Recursion Avoid recursion in event broadcasting: Idea: Specify the receiver of event e.g. /send (event1, B), or /B.event1 In case, unavoidable Find out recursion bound Specify annotation in ait For the example above: recursion EventBroadcasting max 2;

14 Stateflow & Infeasible Paths Static analysis loses information at control flow joins abstracts all variables like data variables Loss of Information x = 1 x = 2 x = 3 x={1,2,3} true If(x==2) false

15 Possible Paths Not, Not Not, Not Not, Not Not, Not Not, Not Not, Not Not, Not Not, Not Not, Not Not, Not Not, Not Not, Not Not, Not Not, Not Not, Not Not, Not Not, Not Not, Not Not, Not Not, Not Not, Not Not, Not Not, Not Not, Not Not, Not Not, Not Not, Not and more

16 Feasible Paths Model Information Not, Not Only: Event1 Event3 Event2 Event4 Not, Not Not, Not Others infeasible Not, Not Not, Not e.g., feasible sequence event1 event3 Not, Not

17 Infeasible Paths Not, Not Model Information Not, Not Not, Not Only: Event1 Event3 Event2 Event4 Not, Not Not, Not Others infeasible Not, Not Not, Not Not, Not Not, Not Not, Not Not, Not Not, Not e.g., infeasible sequence event1 event4 Not, Not Not, Not Not, Not Not, Not and more Not, Not Not, Not

18 Stateflow & Infeasible Paths Static analysis loses information at control flow joins abstracts all variables like data variables however state/event variables are control variables Real models Many conditionals checking states / events High loss of precision Current solution: Annotate with infeasible paths Provide flow constraints Future work: Treat state and event variables more precisely, Automatic solution

19 Conclusion WCET analysis for Matlab/Simulink/Stateflow Primary observations and Initial results We addressed Automation Event broadcasting and recursion bounds Precision Infeasible paths

20 Challenge Formal semantics needed Want to derive safe recursion bounds Matlab semantics Stateflow manual alone: > pages, defined by examples Formal semantics Rushby et. al for subset of Stateflow Suitable semantics: on-going work

Breaking Up is Hard to Do: An Investigation of Decomposition for Assume-Guarantee Reasoning

Breaking Up is Hard to Do: An Investigation of Decomposition for Assume-Guarantee Reasoning Jamieson M. Cobleigh Dept. of Computer Science University of Massachusetts Amherst, MA 01003, USA jcobleig@cs.umass.edu