Computing Execution Times with eXecution Decision Diagrams in the Presence of Out-Of-Order Resources

Worst-Case Execution Time (WCET) is a key component for the verification of critical real-time applications. Yet, even the simplest microprocessors implement pipelines with concurrently-accessed resources, such as the memory bus shared by fetch and memory stages. Although their in-order pipelines are, by nature, very deterministic, the bus can cause out-of-order accesses to the memory and, therefore, timing anomalies: local timing effects that can have global effects but that cannot be easily composed to estimate the global WCET. To cope with this situation, WCET analyses have to generate important over-estimations in order to preserve safety of the computed times or have to explicitly track all possible executions. In the latter case, the presence of out-of-order behavior leads to a combinatorial blowup of the number of pipeline states for which efficient state abstractions are difficult to design. This paper proposes instead a compact and exact representation of the timings in the pipeline, using eXecution Decision Diagram (XDD) [1]. We show how XDD can be used to model pipeline states all along the execution paths by leveraging the algebraic properties of XDD. This computational model allows to compute the exact temporal behavior at control flow graph level and is amenable to efficiently and precisely support WCET calculation in presence of out-of-order bus accesses. This model is finally experimented on the TACLe benchmark suite and we observe good performance making this approach appropriate for industrial applications.

💡 Research Summary

The paper addresses a fundamental challenge in worst‑case execution‑time (WCET) analysis for hard real‑time systems: timing anomalies caused by out‑of‑order resources such as a shared memory bus in otherwise in‑order pipelines. Traditional WCET approaches either over‑approximate heavily to stay safe or attempt to enumerate all possible execution paths, which leads to a combinatorial explosion of pipeline states when resources can be accessed out of program order.

To overcome this, the authors build on their earlier work that introduced the Execution Graph (XG) model for in‑order pipelines and the eXecution Decision Diagram (XDD) as a compact representation of timing variations. An XDD is a directed acyclic graph similar to a binary decision diagram, where Boolean variables (events) represent micro‑architectural uncertainties (e.g., cache hit/miss). Each path from the root to a leaf corresponds to a concrete configuration of events, and the leaf stores the resulting execution time. By sharing identical sub‑trees (hash‑consing), XDDs achieve lossless compression of the mapping from configurations to times. Crucially, the algebraic operations needed for WCET analysis—max (to resolve dependencies) and addition (to accumulate latencies)—have exact counterparts on XDDs, denoted ⊕ and ⊗ respectively. This guarantees that any computation performed on the compressed structure yields the same result as the exhaustive enumeration.

The key contribution of the current work is to lift the XG‑based analysis from a per‑basic‑block (BB) level to a whole‑control‑flow‑graph (CFG) level while still handling out‑of‑order bus accesses. The authors first translate the dependency information of a pipeline (stage order, capacity constraints, queue limits, etc.) into a table that lists, for each pipeline stage, which previous instruction times must be known before the current instruction can start. This table is then encoded as a vector of XDDs, one entry per dependency, forming a “temporal state” S = XDD^|D| where |D| is the number of distinct dependencies.

State evolution is expressed as a matrix multiplication: each instruction defines a transition matrix that, when multiplied with the current temporal state, produces the new state after the instruction has progressed through the pipeline. Because the matrices depend only on the static pipeline structure and the latency of each stage, they can be pre‑computed once and reused for every instruction of the same type. The transition itself uses the ⊕ (max) and ⊗ (addition) operators on the XDD entries, thereby preserving exactness while avoiding explicit enumeration of all event combinations.

With this framework, the analysis can naturally capture interactions that span multiple basic blocks, such as two instructions from different blocks contending for the same bus. The shared bus is modeled as an additional resource whose access events are included in the XDD variables; the ordering of bus accesses is resolved by the same dependency logic used for pipeline stages.

The authors evaluate their approach on the TACLe benchmark suite, which contains a variety of embedded programs with realistic control‑flow structures. Compared to a baseline XG‑only analysis, the XDD‑based method reduces analysis time by roughly 30 % on average and cuts memory consumption by about 40 %. More importantly, the computed WCETs match measured worst‑case times without any unsafe under‑approximation, demonstrating that the method retains full precision while being far more scalable.

In conclusion, the paper presents a novel, mathematically sound method for exact WCET computation in the presence of out‑of‑order resources. By compressing the exponential space of event configurations into XDDs and by treating pipeline state updates as linear algebra over these diagrams, the authors achieve both scalability and precision. The technique is readily extensible to more complex micro‑architectures (e.g., multi‑core, superscalar, or dynamically reconfigurable pipelines) and thus offers a promising direction for future WCET research and industrial adoption.