STARS and Metropolis: static and dynamic RTOS modeling

1
STARS and Metropolis static and dynamic RTOS
modeling

• Felice Balarin
• Cadence Berkeley Labs

2
RTOS modeling

• Any OS has two basic function
• To create abstraction of computational tasks
  running concurrently while sharing HW resources
  like CPU
• To offer communication services between tasks and
  the rest of the world, and between tasks
  themselves
• In addition, Real-time OS (RTOS) needs to ensure
  that computation and communication done by tasks
  occurs in a predictable time-frame
• dynamic or static performance analysis
• Metropolis and STARS

3
RTOS a Metropolis architectural component
medium RTOS implements RTOSservices port
MemService Mem void compute(int time)
Sheduler.request(B(thisAction),thisProcess)
TimeMgr.request(E(thisAction),
TimeMgr.A(B(thisAction))time)
Sheduler.request(E(thisAction), rtosProcess)

interface RTOSservices extends Port void
send(message m, mailbox b) message
receive(mailbox b) void compute(int
time)
4
Metropolis architecture netlist
Architecture netlist specifies configurations of
architecture components.
Each constructor - instantiates arch.
components, - connects them,
5
Meta-model mapping netlist
MyMapNetlist
B(P1, M.write) ltgt B(mP1, mP1.send) E(P1,
M.write) ltgt E(mP1, mP1.send) B(P1, P1.f) ltgt
B(mP1, mP1.compute) E(P1, P1.f) ltgt E(mP1,
mP1.compute) B(P2, M.read) ltgt B(P2,
mP2.receive) E(P2, M.read) ltgt E(mP2,
mP2.receive) B(P2, P2.f) ltgt B(mP2,
mP2.compute) E(P2, P2.f) ltgt E(mP2,
mP2.compute)
6
Outline

• Background
• VCC
• STARS
• VCC-STARS integration
• extend any VCC simulation model with abstractions
  required by STARS
• Automatic abstraction generation
• for a class of VCC models

7
VCC Behavior

• network of behavioral blocks
• many ways to specify a block (BlackBox C,
  WhiteBox C, ...)
• simulation used to verify functionality

8
VCC Architecture

• network of architectural blocks
• needed to determine performance of behavioral
  blocks

9
VCC Mapping

• performance of each behavioral block is modeled
• simulation is used to verify performance

10
BlackBox C behavioral blocks

• the only kind understood by VCC simulation core

• class fifo
• public FxCPPBlackBoxModel
• InputPortltintgt Request, Input
• OutputPortltintgt Output
• ...
• void fifoRun()
• if(Request.Enabled() !empty)
• Output.Post(FIFOPop())
• if (Input.Enabled())
• FIFOPush(Input.Value())
• ...

11
WhiteBox C behavioral blocks

• void point_entry_run()
• if(Request_Enabled() !empty)
• Output_Post(FIFOPop())
• if (Input_Enabled())
• FIFOPush(Input_Value())
• ...

12
Outline

• Background
• VCC
• STARS
• VCC-STARS integration
• extend any VCC simulation model with abstractions
  required by STARS
• Automatic abstraction generation
• for a class of VCC models

13
STatic Analysis of Reactive Systems
play
tick
network
request
sample
control
buffer
message
frame

• For all inputs
• Can I process all workload between two ticks?
• How much bus traffic will I generate?
• How much energy will I use?

14
Outline

• STARS
• overview
• representing signals
• representing system components
• finding worst-case behaviors
• representing timing information

15
STARS overview
play
tick
network
request
sample
control
buffer
message
frame

• STARS finds worst-case signature of any execution
  window of a given length
• STARS finds the worst-case CPU busy period

16
Signatures

• in practice, counting events
• state transitions may be considered events
• combinations of events may have separate counters
• may need linear constraints over counters
• less events is better than (?) more events

17
Signature Abstractions

• Estimate output signature based on input
  signature and length
• must be conservative

?
18
Signature Abstractions Environment
play
tick
network
request
sample
control
buffer
message
frame

• at least 625?s between messages
• Fms (s, T) T/625 1
• tick has 125?s period
• Ftk (s, T) T/125 1
• at most 1 play a second
• Fpl (s, T) T/1,000,000 1

19
Signature Abstraction Buffer
play
tick
network
request
sample
control
buffer
message
frame

• BUFFER
• if ( present ( frame )
• samples frame last 50
• if ( present ( tick ) last gt 0)
• emit sample ( samples last -- )
• if ( last 20 ) emit request()

Frq (s, T) min( fr, tk/30) Fsm (s, T) min(
tk, 50fr )
20
Fix-point Theorem

• If
• s F(s, T),
• s is worse than signature of initial state,
• then s is worse than signature of any execution
  segment of length T

? s
21
Workload Function

• Estimates required processor time from signatures
• must be conservative

22
Workload Function VM pager
play
tick
network
request
sample
control
buffer
message
frame
1 line 10 time units

• BUFFER
• if ( present ( frame )
• samples frame
• last 50
• if ( present ( tick ) last gt 0)
• emit sample ( samples last -- )
• if ( last 20 )
• emit request()

W (s) 20fr 20sm ...
23
STARS

• Pick a signature
• Chose a signature abstraction F and workload
  function W and verify they and conservative
• Solve
• s F(s,T)
• T W(s)
• T is a bound on response time
• the processor cannot be continuously busy for
  more than T time units

24
Outline

• Background
• VCC
• STARS
• VCC-STARS integration
• why, what and how
• Automatic abstraction generation
• for a class of VCC models

25
Why VCC-STARS?
play
tick
network
request
sample
control
buffer
message
frame
pl
tk
rq
sm
ms
fr

• cannot relate components to their abstractions

26
VCC-STARS What?

• abstract models used by STARS can be validated by
  VCC simulation

27
VCC-STARS How?

• BlackBox C extensions to represent signatures
• vectors of counter values
• each behavioral block has
• one counter for each input port
• one counter for each output port
• a counter measuring CPU time usage
• optional user-defined counters

28
Signature example

• class fifo public FxCPPBlackBoxModel
• InputPortltintgt Request, Input
• OutputPortltintgt Output
• starsCounter numExecutions
• ...
• counters
• Output.count
• Input.count
• Request.count
• numExecutions
• the one pointed to by processorTimeCounter()

29
VCC-STARS How?

• BlackBox C extensions to represent signature
  abstractions
• each block has member function void
  starsAbstraction()
• sets bounds of output-port, CPU-usage, and
  user-defined counters, based on input-port
  counters and length of time
• must be conservative

?
30
Signature abstraction example

• class fifo public FxCPPBlackBoxModel
• InputPortltintgt Request, Input
• OutputPortltintgt Output
• starsCounter numExecutions
• ...
• void fifoRun()
• numExecutions
• if(Request.Enabled() !empty)
  Output.Post(FIFOPop())
• if (Input.Enabled()) FIFOPush(Input.Value())
• ...
• void fifostarsAbstraction()
• Output.count.setBound( min( Input.count,
  Request.count))
• numExecutions.setBound( Input.count
  Request.count)
• ...

31
Signature abstraction example (contd)

• delay_model()
• input(Input)
• input(Request)
• run()
• delay('0.000001')
• output(Output)
• void fifostarsAbstraction()
• Output.count.setBound(min(Input.count,
• Request.count))
• numExecutions.setBound(Input.count
  
• Request.count)
• starsCounter p processorTimeCounter()
• if(p) p-gtsetBound(1000numExecutions)

32
Signature abstractions

• may depend on time
• void envstarsAbstraction()
• Burst.count.setBound(mgr()-gttimeWindow()/625000
  1)
• mgr() is a manager containing STARS info
• timeWindow() depends on context
• in simulation, its the time since monitor
  creation
• in STARS, it can be a constant
• in STARS, it can be current estimate of the
  busy-period

33
starsAbstraction()

• is verified to be conservative by simulation
  monitors that perform the following check every
  time an output counter is changed
• evaluate starsAbstraction() using current values
  of input counters
• compare output counters with bounds computed by
  starsAbstraction()
• if bounds are violated, warn that
  starsAbstraction() is not conservative
• is used by STARS to compute to compute worst-case
  bounds of all the counters in the network

34
Voice Mail Pager

• 16 modules
• 4000 lines of C code annotated with timing
  estimates
• build signature abstractions manually
• 150 lines of C code

35
VMP First experiment

• model environment so that a single message is
  received and then played
• same as VCC test-bench
• max busy period
• VCC 82 ?s (simulating 8s took 30 s)
• STARS 83 ?s (took 16 ms to compute)

36
VMP second experiment

• same as first except
• dont limit the environment to a single message
• max busy period
• STARS 148 ?s (more than 125 ?s between two ticks)
• VCC can find input that has 146 ?s

66?s wide window in a 6250 ?s period
37
Outline

• Background
• VCC
• STARS
• other related work
• VCC-STARS
• BlackBox C extensions
• Automatic abstraction generation
• for WhiteBox C blocks

38
What?

• abstract models can be automatically generated
  for WhiteBox C blocks

play
tick
network
request
sample
control
buffer
message
frame
pl
tk
rq
Fenv
sm
ms
fr
39
Automatic abstraction How?

• WhiteBox C flow in VCC

WhiteBox C
CPU model
estimation
annotated BlackBox C
40
Automatic abstraction algorithm

• starting from
• input counters
• user hints,
• propagate bounds to
• statements
• output counters
• for each output counter with a bound
• set its bound to the minimum of all
• if each basic block of code has a bound
• use VCC delay estimates to bound CPU time

41
Example

• void point_entry_run()
• starsIncrement(numExecutions)
• if (Request_Enabled()
• !empty )
• Output_Post(FIFOPop())
• if (Input_Enabled())
• FIFOPush(Input_Value())

void fifostarsAbstraction()
Output.count.setBound( Request.count )
42
Hints

• void point_entry_run()
• starsIncrement(numExecutions)
• if (Request_Enabled()
• !empty )
• Output_Post(FIFOPop())
• if (Input_Enabled())
• FIFOPush(Input_Value())

void starsSetBounds() numExecutions_SetBound(1
0)
void fifostarsAbstraction()
numExecutions.setBound( 10 ) int b min(
numExecutions, Request.count)
Output.count.setBound( b ) starsCounter p
processorTimeCounter() if(p)
p-gtsetBound(numExecutions(D1D3D4) bD2)
43
RESULTS ON AUTOMATIC ABSTRACTION

• IMMEDIATE
• generating signature abstractions automatically
  is undecidable for arbitrary code
• DATE 2000
• if transition relation of a memory-less component
  is a Boolean function represented with a BDD then
  its ideal signature abstraction can be generated
  automatically
• SASIMI 2001
• generating signature abstraction automatically is
  possible for finite-state machines

44
Related Work

• YAPI-STARS, presented at CODES 2000
• systems in YAPI are networks of concurrent
  processes, similar to Khans process networks
• YAPI-STARS is good for bounding communication
  requirements
• no performance analysis
• Program path analysis (Cinderella), Li and Malik
  1999
• intended for timing analysis of embedded software
• useful for automatically generating abstractions
  used by STARS

45
Conclusions

• STARS adds worst-case analysis to simulation
• can prove that performance requirements are met
• helps find hard performance bugs
• requires additional designer effort to specify
  abstractions
• typically STARS abstractions lt 10
  simulation models
• even smaller for estimated WhiteBox C
• abstractions can be verified by VCC simulations
• could be applied to any simulation environment
  where meaningful counters can be defined

46

Thank you
S T A R S

47
Outline

• Background
• VCC
• STARS
• other related work
• VCC-STARS intergration
• BlackBox C extensions
• Automatic abstraction generation
• for WhiteBox C blocks

48
Signature Abstractions

• Estimate signature of output counters based on
  the signature of input counters
• must be conservative

?
49
Proposal

• VCC STARS VCC-STARS
• Black Box C extensions
• providing signatures of events on ports
• enabling the user to associate a signature
  abstraction for each BlackBox C block