Controls and Data Services (CDS), part of the Rolls-Royce® Group, designs and manufactures a range of products for the aerospace gas turbine market. These products include Level A DO-178B/DO-178C compliant software.
One of the issues faced by software developers working to DO-178C is the need to find the Worst-Case Execution Time (WCET) of their software. CDS had previously addressed this through the use of their own in-house static analysis tool.
CDS developed a new microprocessor, VISIUMCORETM to address a number of strategic needs. VISIUMCORE is the newest iteration of the CDS obsolescence-protected and harsh environment microprocessor intended for DO-254 Level A environments. It provides increased performance over previous iterations and is tailored to the specific requirements of CDS.
With the introduction of the VISIUMCORE, the complexity of the processor had advanced to the point where the accurate model of the processor required by the previous static analysis approach became harder to implement.
Under CDS’ development approach, a unit test framework is used to execute individual units on the test code. A key requirement for CDS was to collect timing information as individual units are executed, rather than waiting until the complete system has been developed.
Rapita Systems worked closely with CDS to develop, implement and validate a WCET process that works with the development approach favoured by CDS.
In this process RapiTime is integrated into the unit test mechanism (see Figure 1). This means that in the course of performing a unit test, the code under test is instrumented by RapiTime and then passed on to the compiler.
Once built, the code is executed on target. This process results in a time stamped execution trace, which is captured by an RTBx (data logger developed by Rapita Systems). Once captured, the trace is processed and passed to RapiTime for analysis.
The VISIUMCORE provides facilities to non intrusively collect a complete execution trace complete with timestamps. It also provides support for outputting a user-specified value and time stamp.
This allows the measurement of timing to be done on the same object code that will be executed on the target application.
RapiTime provides a WCET view for each tested unit.
These per-unit values are then combined to give an overall system value.
As a result of this work, worst-case execution time analysis results are now generated automatically as unit testing proceeds.
Generating WCET in this way means that the timing results are available significantly earlier in the development process than the approach used by other companies of deriving WCET at system test time.
Because the measurement of timing and the derivation of WCET is built into the process, timing can be measured at every unit test with little additional overhead.
The report comparison feature of RapiTime could be used to highlight differences in timing between subsequent reports, which could demonstrate the success of optimization activities, or highlight possible increases in execution time.
By using a Rapita DO-178C qualification kit for RapiTime, CDS can produce evidence from this approach that will be acceptable to certification authorities.