Skip to main content


High-assurance timing analysis for a high-assurance real-time OS


Thomas Sewell, Felix Kam and Gernot Heiser



Worst-case execution time (WCET) analysis of real-time code needs to be performed on the executable binary code for soundness. Obtaining tight WCET bounds requires determination of loop bounds and elimination of infeasible paths. The binary code, however, lacks information necessary to determine these bounds. This information is usually provided through manual intervention, or preserved in the binary by a specially modified compiler. We propose an alternative approach, using an existing translation-validation framework, to enable high-assurance, automatic determination of loop bounds and infeasible paths. We show that this approach automatically determines all loop bounds and many (possibly all) infeasible paths in the seL4 microkernel, as well as in standard WCET benchmarks which are in the language subset of our C parser. We also design and validate an improvement to the seL4 implementation, which permits a key part of the kernel's API to be available to users in a real-time setting.

BibTeX Entry

    publisher        = {Springer},
    journal          = {Real-Time Systems},
    author           = {Sewell, Thomas and Kam, Felix and Heiser, Gernot},
    month            = jul,
    keywords         = {real-time, worst-case execution time, formal verification, sel4, os, timing},
    year             = {2017},
    date             = {2017-7-30},
    title            = {High-Assurance Timing Analysis for a High-Assurance Real-Time {OS}},
    type             = {Journal Article - Refereed}


Served by Apache on Linux on seL4.
Served by Apache on Linux on seL4.