Worst-Case Execution Time on the Reflex Path

Every reflex-path stage carries a statically provable upper bound on execution time; the loop is only certified when their sum fits the deadline with margin.

Why static bounds, not benchmarks

Benchmarks tell you what happened; a worst-case execution time (WCET) bound tells you what can happen. Safety loops are certified on the latter. On the FPGA datapath, WCET is structural: the logic has a fixed depth and a fixed clock, so the cycle count is exact and the time is the cycle count divided by the clock frequency.

def wcet_ns(cycles, clk_hz):
    return cycles / clk_hz * 1e9

# a validation + control-law block: fixed pipeline depth
print(round(wcet_ns(cycles=250, clk_hz=250e6), 1))   # 1000.0 ns

def path_wcet(stage_cycles, clk_hz):
    # sum of fixed-depth stages: still exact, no distribution
    return sum(wcet_ns(c, clk_hz) for c in stage_cycles)

Where iteration is forbidden

Any construct whose runtime depends on data — an unbounded loop, a variable-length search, a solver iterating to a tolerance — is banned from the reflex path because its WCET is unbounded or hard to certify. Such work is pushed up to the supervisory or twin tiers, whose outputs enter L1 only as pre-validated, clamped setpoints.

• Allowed on fast path: affine control laws, table lookups, comparators, fixed-tap filters.
• Banned on fast path: dynamic allocation, unbounded iteration, recursion, blocking I/O.
• Pushed upstream: MPC optimization, equilibrium reconstruction, surrogate inference.

This discipline also shapes how new capability is added. When a feature needs iteration or search, the design does not smuggle it onto the fast path with a generous timeout; it splits the work, running the unbounded computation in the supervisory or twin tier and passing only a pre-validated, clamped result down to L1. The reflex path stays a fixed-depth datapath whose WCET can be recomputed exactly, so certification is a re-run of arithmetic rather than a new measurement campaign.

The certified WCET of the whole path is compared against the deadline in the latency budget; the difference is the jitter margin defended in determinism bounds. A change that grows any stage's cycle count reopens the budget for review.