Modeling Control Speculation for Timing Analysis ∗ Xianfeng Li, Tulika Mitra † and Abhik Roychoudhury School of Computing, National University of Singapore, 3 Science Drive 2, Singapore 117543. Abstract. The schedulability analysis of real-time embedded systems requires Worst Case Execution Time (WCET) analysis for the individual tasks. Bounding WCET involves not only language-level program path analysis, but also modeling the performance impact of complex micro-architectural features present in modern pro- cessors. In this paper, we statically analyze the execution time of embedded software on processors with speculative execution. The speculation of conditional branch out- comes (branch prediction) significantly improves a program’s execution time. Thus, accurate modeling of control speculation is important for calculating tight WCET estimates. We present a parameterized framework to model the different branch prediction schemes. We further consider the complex interaction between speculative execution and instruction cache performance, that is, the fact that speculatively executed blocks can generate additional cache hits/misses. We extend our modeling to capture this effect of branch prediction on cache performance. Starting with the control flow graph of a program, our technique uses integer linear programming to estimate the program’s WCET. The accuracy of our method is demonstrated by tight estimates obtained on realistic benchmarks. Keywords. Schedulability Analysis, Worst Case Execution Time, Micro-architectural modeling, branch prediction, instruction cache 1. INTRODUCTION A real-time embedded system contains at least one processor running application-specific programs that communicate with the external envi- ronment in a timely fashion. There are hard deadlines on the execution time of such software. Moreover, many embedded systems are safety critical (e.g., automobiles and power plant applications), and the de- signers of such systems must ensure that all the real-time constraints are satisfied. This requires us to estimate the Worst Case Execution Time (WCET) of the software on the particular processor. One possibility of computing the WCET is to actually run the program and measure its performance on the processor in question. However, this approach is infeasible for most programs due to the large number of program paths corresponding to the different inputs. Consequently, WCET analysis, ∗ Preliminary version of parts of this paper have previously been published as [21] and [14]. † Contact Author. E-mail: tulika@comp.nus.edu.sg c  2004 Kluwer Academic Publishers. Printed in the Netherlands. main.tex; 28/08/2004; 12:55; p.1