WCET and Timing Analysis in CI: Integrating RocqStat into Your Embedded Pipeline

Hook: Why your embedded CI pipeline should stop ignoring timing analysis

Toolchains for embedded systems are crowded with compilers, linters and unit-test runners — yet many teams still run WCET (worst-case execution time) checks as an afterthought or manually on a separate schedule. For safety-critical products (automotive ADAS, avionics, industrial control), that gap is now a liability: unpredictable timing causes design rework, failed certification cycles and costly recalls. In 2026, after Vector Informatik's acquisition of StatInf’s RocqStat technology, timing analysis is becoming native to mainstream verification toolchains — and your CI must follow.

What this guide gives you (fast)

• Concrete, reproducible patterns to run WCET and timing analysis in CI with RocqStat and VectorCAST.
• Actionable pipeline templates for GitHub Actions, GitLab CI and Jenkins — containerize toolchains and hardware-in-loop (HIL) friendly.
• Practical rules for gating, reporting, and scaling timing checks across branches and teams.
• Advanced strategies (incremental analysis, hybrid measurement + static analysis) and 2026 trends that change how we reason about timing.

The 2026 context: why timing analysis is moving into CI now

Late 2025 and early 2026 solidified a trend: software-defined systems (especially automotive) shifted risk budgets from hardware to software, increasing demand for integrated verification. On Jan 16, 2026 Automotive World reported Vector Informatik acquired StatInf’s RocqStat to integrate static WCET analysis into VectorCAST. That deal makes it easier — and expected — to co-locate timing and functional verification in a single pipeline. As tool vendors unify verification stacks, DevOps teams that embed timing analysis in CI reduce iteration time and certification risk.

"Vector will integrate RocqStat into its VectorCAST toolchain to unify timing analysis and software verification." — Automotive World, Jan 16, 2026

Key concepts (brief)

• WCET: A conservative bound on how long a code path can take to execute under a specified platform model.
• Static timing analysis: Uses program and hardware models to estimate WCET without running the code. RocqStat is a leading static WCET toolset.
• Measurement-based timing: Uses instrumented runs to measure execution time; useful for complementing static results but not a replacement for a safe bound.
• Test harness: The scaffolding (VectorCAST, unit tests, mocks, stubs) that exercises units under test during CI.
• HIL / QEMU: Hardware-in-the-loop or high-fidelity simulation for realistic timing runs.

High-level pipeline pattern

Embed timing analysis as a stable stage in your CI pipeline. The canonical stages are:

1. Checkout & compile (cross-compile if needed)
2. Unit tests / VectorCAST test harness generation
3. Static WCET analysis (RocqStat)
4. Measurement runs (optional HIL/QEMU) and correlation
5. Aggregate results, compare to thresholds, publish artifacts and block merges if regressions

Design principles

• Containerize toolchains so CI agents are reproducible: compilers, VectorCAST/RocqStat, cross-runtimes.
• Cache analysis state (object files, compiled test harnesses, analysis state) to speed incremental runs.
• Fail fast on timing regressions and surface explanatory traces in CI reports.
• Keep static analysis deterministic by pinning tool versions and hardware models; treat results as auditable artifacts.

Preconditions: what you must have before automating

• Licenses for VectorCAST and RocqStat (or vendor-provided Docker images). Consult Vector/StatInf licensing terms post-acquisition for CI usage.
• Repeatable cross-compilation and linker scripts (build reproducibility).
• VectorCAST test harness configurations or an equivalent unit-test harness that can be generated in CI.
• Hardware model(s) that represent the execution platform — caches, pipeline, and timers — for RocqStat.

Step-by-step: local proof-of-concept

Before adding the analysis to your shared CI, validate locally in a container. This minimizes noisy CI runs during setup.

1. Build a base Docker image with your cross-compiler and test harness generator. Example Dockerfile fragment:

   FROM ubuntu:22.04
   RUN apt-get update && apt-get install -y build-essential gcc-multilib qemu-user
   # Add cross toolchain, VectorCAST / RocqStat installers (licensed)
   COPY installers/ /opt/installers/
   # Install VectorCAST and RocqStat with silent install options
   RUN /opt/installers/vectorcast/install.sh --accept-license --prefix=/opt/vectorcast
   RUN /opt/installers/rocqstat/install.sh --accept-license --prefix=/opt/rocqstat
   ENV PATH=/opt/vectorcast/bin:/opt/rocqstat/bin:$PATH
   

2. Check that VectorCAST can generate a test harness and produce an instrumented binary. Example commands (vendor CLI varies):

   # generate harness
   vectorcast --project myproj --generate-harness
   # compile
   make all
   # run VectorCAST unit tests
   vectorcast --run-tests --project myproj
   

3. Run RocqStat analysis on the build artifacts and verify an output file (WCET report):

   # run static timing analysis - placeholder CLI
   rocqstat analyze --project myproj --binary build/myunit.elf --hw-model hw_model.json --output wcet_report.json
   

   Note: Replace options above with the vendor-specific CLI for your installed RocqStat/VectorCAST combination.

4. Validate artifact reproducibility: re-run the container and confirm matching WCET results.

CI Templates

Below are three opinionated pipeline templates. They are intentionally generic where vendor CLIs vary. Replace placeholders and vendor CLI invocations with your installed toolchain commands.

GitHub Actions

name: CI with WCET
on: [push, pull_request]

jobs:
  build-and-wcet:
    runs-on: ubuntu-22.04
    services:
      # optional: QEMU or HIL bridge service
    steps:
      - uses: actions/checkout@v4
      - name: Setup Container
        uses: docker://ghcr.io/yourorg/embedded-ci:2026
      - name: Build
        run: |
          make clean && make all
      - name: Generate VectorCAST harness
        run: |
          vectorcast --project myproj --generate-harness
      - name: Run Unit Tests
        run: |
          vectorcast --run-tests --project myproj --report-format junit --output reports/unit-tests.xml
      - name: Run RocqStat WCET
        run: |
          rocqstat analyze --project myproj --binary build/myunit.elf --hw-model hw_model.json --output reports/wcet.json
      - name: Publish WCET
        uses: actions/upload-artifact@v4
        with:
          name: wcet-reports
          path: reports/
      - name: Enforce Thresholds
        run: |
          python tools/check_wcet_regression.py reports/wcet.json baseline/wcet_baseline.json

GitLab CI (container-first, caches enabled)

stages:
  - build
  - test
  - wcet

variables:
  DOCKER_IMAGE: "registry.example.com/embedded-ci:2026"

cache:
  paths:
    - build/
    - .cache/

build:
  stage: build
  image: $DOCKER_IMAGE
  script:
    - make all
  artifacts:
    paths:
      - build/

unit_tests:
  stage: test
  image: $DOCKER_IMAGE
  script:
    - vectorcast --project myproj --generate-harness
    - vectorcast --run-tests --project myproj --report-format junit --output reports/unit-tests.xml
  artifacts:
    paths:
      - reports/

wcet_analysis:
  stage: wcet
  image: $DOCKER_IMAGE
  script:
    - rocqstat analyze --project myproj --binary build/myunit.elf --hw-model hw_model.json --output reports/wcet.json
    - python tools/check_wcet_regression.py reports/wcet.json baseline/wcet_baseline.json
  dependencies:
    - build
    - unit_tests
  artifacts:
    paths:
      - reports/

Jenkinsfile (Declarative)

pipeline {
  agent any
  environment {
    DOCKER_IMAGE = 'registry.example.com/embedded-ci:2026'
  }
  stages {
    stage('Checkout') {
      steps { checkout scm }
    }
    stage('Build') {
      agent { docker { image "${DOCKER_IMAGE}" } }
      steps { sh 'make all' }
      post { success { archiveArtifacts artifacts: 'build/**', fingerprint: true } }
    }
    stage('Unit Tests') {
      agent { docker { image "${DOCKER_IMAGE}" } }
      steps {
        sh 'vectorcast --project myproj --generate-harness'
        sh 'vectorcast --run-tests --project myproj --report-format junit --output reports/unit-tests.xml'
        junit 'reports/*.xml'
      }
    }
    stage('WCET Analysis') {
      agent { docker { image "${DOCKER_IMAGE}" } }
      steps {
        sh 'rocqstat analyze --project myproj --binary build/myunit.elf --hw-model hw_model.json --output reports/wcet.json'
        sh 'python tools/check_wcet_regression.py reports/wcet.json baseline/wcet_baseline.json'
        archiveArtifacts artifacts: 'reports/**', fingerprint: true
      }
    }
  }
}

Example: check_wcet_regression.py

A small utility helps gate merge requests by comparing current WCET to an approved baseline. The script below shows the logic — assert the new WCET doesn't exceed the baseline by more than a tolerance.

#!/usr/bin/env python3
import json
import sys

NEW = sys.argv[1]
BASE = sys.argv[2]
TOLERANCE_PCT = float(sys.argv[3]) if len(sys.argv) > 3 else 2.0

with open(NEW) as f:
    new = json.load(f)
with open(BASE) as f:
    base = json.load(f)

# assume reports contain {'unit': 'myunit', 'wcet_us': 12345}
new_wcet = new['wcet_us']
base_wcet = base['wcet_us']

if new_wcet > base_wcet * (1 + TOLERANCE_PCT/100.0):
    print(f"WCET regression: {new_wcet}us > baseline {base_wcet}us (+{TOLERANCE_PCT}%)")
    sys.exit(2)
else:
    print(f"WCET OK: {new_wcet}us <= baseline {base_wcet}us")
    sys.exit(0)

Integrating measurement (HIL / QEMU) with static results

Static WCET gives a safe upper bound. Real measurements give insights into typical behaviour and help fine-tune hardware models. Use both:

1. Run RocqStat on object code to get WCET bound.
2. Execute instrumented runs on QEMU or HIL to gather observed timings for the same inputs.
3. Correlate which paths produce the worst-case events; use coverage to ensure the static worst-case path is exercised for confidence.

Automate measurement runs as an optional job that runs nightly or on a schedule (not on every PR) to save CI capacity, but fail fast on merging if static WCET threshold exceeded.

Practical tips and pitfalls

• Pin hardware models: RocqStat’s result is only as good as the hardware model. Treat hw_model.json as a versioned asset in your repo.
• Cache analysis state: full static timing analysis can be expensive; use incremental mode (if supported) and cache intermediate files across CI runs.
• Seed inputs for reproducibility: where a harness drives nondeterministic sources, seed RNGs and mocks to make runs deterministic.
• Beware of compiler optimizations: minor compiler flag changes can alter control flow and timing. Pin toolchain versions and record build IDs in reports.
• Organize baselines by branch and release: maintain baselines per release branch so new feature branches can be compared sensibly.
• Limit scope: run full system WCET nightly, run targeted unit-level WCET on PRs to save compute.

Scaling across large codebases

For large repositories with many units, you need a strategy to avoid exploding analysis time:

• Prioritize critical units — focus WCET CI on safety-critical tasks, and run full-scope offline.
• Parallelize per-unit analysis — split runs by component and run concurrently on CI executors.
• Use incremental analysis — only re-analyze units that changed or whose dependencies changed.
• Shard hardware models — smaller, scoped hardware models quickly analyze local behaviour; use full model for end-to-end nightly builds.

Advanced strategies (2026 and beyond)

1) Hybrid static + ML-driven prioritization

Use lightweight static heuristics and historical CI data to predict which commits are likely to change WCET. Trigger full RocqStat runs only for high-risk commits. Several teams in 2025 started using ML to prioritize heavy analysis jobs — this trend will accelerate in 2026.

2) Signed WCET artifacts for certification

Emit signed analysis artifacts (reports, hardware-model hashes, toolchain fingerprints) so auditors can reproduce results. Treat these artifacts as first-class, immutable CI outputs.

3) Shift-left timing with model-in-the-loop

Developers should get fast, local feedback. Provide lightweight local tooling (fast-mode RocqStat, smaller hardware model) to catch timing issues before pushing code. This reduces CI churn and shortens debugging cycles.

4) Tight VectorCAST + RocqStat integration

Following the Vector acquisition of RocqStat, expect tighter integrations where VectorCAST can automatically produce the binary, metadata and path annotations RocqStat needs. Plan for this tighter coupling in 2026: standardize project layouts and VectorCAST project files to minimize migration effort.

Case study (short): Reducing iteration time for an automotive ECU team

Background: An ECU team ran full WCET analysis manually once per sprint. Cold runs took 8 hours and often missed regressions until integration testing. After automating unit-level RocqStat checks in CI (PR-level incremental analysis + nightly full analysis), they achieved:

• PR-level feedback in ~20 minutes for most changes.
• Identified timing regressions earlier, cutting debug time by ~40%.
• Improved auditability: signed WCET artifacts reduced certification questions in the next safety audit.

Checklist to get started this week

1. Obtain or validate licenses for VectorCAST and RocqStat; confirm CI usage rights and container deployment rules.
2. Build a reproducible container with your cross-toolchain + test harness + RocqStat/VectorCAST installs.
3. Run local POC: generate harness, compile, run RocqStat, and produce a baseline report.
4. Add a WCET stage to your CI template (start as optional), upload artifacts, and implement a regression check script.
5. Iterate: enable strict gating once CI stability and baselines are mature.

Vendor & certification considerations

RocqStat and VectorCAST handle different pieces of a safety argument. In 2026, expect their integrated workflow to simplify generating evidence for standards like ISO 26262 and DO-178C. When preparing artifacts for certification:

• Document tool versions, hardware models and build commands in your certification dossier.
• Retain signed artifacts and reproduction scripts in a separate archived CI job for auditors.
• Engage vendor support early — ask Vector about recommended CI deployment patterns for RocqStat within VectorCAST.

Wrap-up: practical takeaways

• Start small: embed unit-level WCET checks in PR workflows first; schedule full-system WCET nightly.
• Automate baselines and gating: reject PRs that introduce unapproved WCET regressions and surface clear traces for debugging.
• Containerize and cache: reproducible environments and cached analysis state make WCET in CI affordable.
• Mix static and measurement: use RocqStat for safe bounds and HIL/QEMU runs for empirical insight.
• Prepare artifacts for audit: signed outputs, tool fingerprints and hardware model versions are mandatory for certification evidence.

Further reading & resources

• Automotive World — Vector buys RocqStat (Jan 16, 2026).
• VectorCAST documentation (see vendor site for CI/automation guidelines).
• Industry guidance on WCET and certification (ISO 26262 / DO-178C supporting docs).

Call to action

If you run embedded CI at scale and need help integrating RocqStat and VectorCAST into a reproducible pipeline, bitbox.cloud can help. We build containerized toolchains, design incremental WCET strategies and deliver gating/reporting that aligns with certification workflows. Contact us for a migration plan, a custom CI template, or a hands-on workshop to get WCET checks into your CI this quarter.

Related Reading

• How to Audit Your Tool Stack in One Day: A Practical Checklist
• Advanced Strategies: Latency Budgeting for Real‑Time Scraping and Event‑Driven Extraction (2026)
• Serverless Monorepos in 2026: Advanced Cost Optimization and Observability Strategies
• Hands‑On Review: Continual‑Learning Tooling for Small AI Teams (2026 Field Notes)
• Real Estate Investors: What Falling Homebuilder Confidence Means for 1031 Exchanges and Depreciation Schedules
• Poolside Content & Recovery Systems in 2026: Advanced Strategies for Swim Pros and Clubs
• Fan Culture vs. Creator Freedom: When Feedback Becomes a Career Barrier
• Monetizing Ceremony Highlights: Productizing Clips Like Goalhanger
• Memory-Constrained Quantum SDKs: Best Practices to Avoid Out-of-Memory Failures