Persona Adopted: Senior Systems Software Engineer & Real-Time Architect

Review Group Recommendation: The ideal audience for this material includes Embedded Systems Engineers, Digital Signal Processing (DSP) Architects (Audio/Communication), and Safety-Critical Software Developers (Automotive/Aerospace). These professionals manage deterministic latency and must enforce strict execution constraints to prevent system failure.

Abstract:

This technical presentation details the implementation of compiler-enforced real-time safety using Clang’s recent advancements: Function Effect Analysis (FEA) and the Real-Time Sanitizer (RTSan). The core problem addressed is the preservation of determinism by avoiding "real-time killers" such as dynamic memory allocation, mutex locking, and exception handling within time-critical code paths.

The speaker introduces specific Clang attributes—nonallocating and nonblocking—which provide compile-time guarantees through transitivity and inference, effectively turning real-time constraints into part of the type system. The talk further explores practical strategies for retrofitting legacy codebases, managing third-party library integration via "ignore" macros, and overcoming the limitations of type erasure in std::function by implementing custom non-blocking wrappers. The synthesis of these tools allows developers to "left-shift" real-time bug detection from hardware testing to the compilation phase.

Real-Time Safety via Compiler Constraints: Summary and Key Takeaways

• 0:02:07 Defining Real-Time Requirements: Real-time software is defined by deadlines rather than raw throughput. Correctness depends on timing.
  • Hard Real-Time: Missing a deadline results in total system failure (e.g., automotive braking).
  • Soft Real-Time: Missing a deadline results in service degradation (e.g., VoIP jitter).
• 0:05:41 Determinism Killers: To maintain real-time safety, code must avoid non-deterministic operations:
  • Locks: Risks priority inversion where high-priority threads wait on low-priority ones.
  • Allocations/Deallocations: Heap operations involve OS-level management with unpredictable latency.
  • Syscalls & IO: Context switches to the kernel introduce significant jitter.
  • Exceptions: Throwing and catching typically involve heap allocation.
• 0:08:12 Clang Tooling (FEA & RTSan): Introduction of Function Effect Analysis (compile-time) and Real-Time Sanitizer (runtime) in Clang 20 (and Apple Clang 17). These tools detect violations of real-time constraints automatically.
• 0:14:12 Function Effect Analysis (FEA) Attributes:
  • [[clang::nonallocating]]: Prohibits heap allocation/deallocation and exceptions.
  • [[clang::nonblocking]]: Stricter subset; prohibits all the above plus mutex locking.
  • Transitivity: If Function A is marked nonblocking, every function it calls must also be nonblocking.
• 0:17:16 Inference Mechanism: The compiler can infer safety for unannotated code if the source is visible (e.g., headers or templates). This allows standard library functions like std::pow to be used in non-allocating contexts without manual labeling.
• 0:21:54 Inheritance and Type Safety: Safety attributes follow standard covariance/contravariance rules. You can override a loose base class with a strict (non-blocking) derived implementation, but you cannot loosen a strict interface.
• 0:30:42 Cross-Compiler Compatibility: Use macros to wrap Clang attributes. This ensures code compiles on GCC or older Clang versions while still enforcing checks on modern Clang CI pipelines.
• 0:34:32 Managing Third-Party Code: When calling libraries without annotations, use "ignore" macros to suppress compile-time warnings.
  • Takeaway: This creates a safety gap that must be filled by Real-Time Sanitizer (RTSan), which intercepts malloc or lock calls at runtime to catch lies in third-party documentation.
• 0:46:13 The Problem with Type Erasure: Standard containers like std::function are incompatible with FEA because the internal type-erasure machinery hides the "blockiness" of the callable.
  • Solution: Developers must implement custom non_blocking_function wrappers that explicitly annotate the function call operator.
• 0:52:13 Conditional Safety via Templates: Attributes accept constant expressions. Using a boolean template parameter (template<bool IsRealTime>) allows a single class to be used in both "chill" and "real-time" contexts by toggling the nonblocking attribute.
• 0:54:28 Leaf-First Migration Strategy: When retrofitting a codebase, start annotating at the "leaf" functions (those that call nothing else) and work upward to the interface. This minimizes the volume of temporary "ignore" macros.