STARS and Metropolis: static and dynamic RTOS modeling

STARS and Metropolis: static and dynamic RTOS modeling Felice Balarin Cadence Berkeley Labs

RTOS modeling Any OS has two basic function: • To create abstraction of computational tasks running concurrently while sharing HW resources like CPU • To offer communication services between tasks and the rest of the world, and between tasks themselves In addition, Real-time OS (RTOS) needs to ensure that computation and communication done by tasks occurs in a predictable time-frame • dynamic or static performance analysis • Metropolis and STARS

An RTOS is modeled by • what it can do • how much it costs : interfaces : time, energy, resource utilization RTOS Scheduler TimeMgr RTOS: a Metropolis architectural component interface RTOSservices extends Port { void send(message m, mailbox b); message receive(mailbox b); … void compute(int time); } medium RTOS implements RTOSservices…{ port MemService Mem; … void compute(int time) { [[ Sheduler.request(B(thisAction),thisProcess); TimeMgr.request(E(thisAction), TimeMgr.A(B(thisAction))+time); Sheduler.request(E(thisAction), rtosProcess); ]] ; } …

MyArchNetlist … … … Bus Arbiter Bus CPU + OS Mem Arbiter Mem RTOS Sched Master Slave Metropolis: architecture netlist Architecture netlist specifies configurations of architecture components. Each constructor - instantiates arch. components, - connects them,

MyFncNetlist P1 P2 M Env2 Env1 MyArchNetlist mP1 mP1 mP2 mP2 Bus Arbiter Bus Mem RTOS OsSched Meta-model: mapping netlist MyMapNetlist B(P1, M.write) <=> B(mP1, mP1.send); E(P1, M.write) <=> E(mP1, mP1.send); B(P1, P1.f) <=> B(mP1, mP1.compute); E(P1, P1.f) <=> E(mP1, mP1.compute); B(P2, M.read) <=> B(P2, mP2.receive); E(P2, M.read) <=> E(mP2, mP2.receive); B(P2, P2.f) <=> B(mP2, mP2.compute); E(P2, P2.f) <=> E(mP2, mP2.compute);

Outline • Background • VCC • STARS • VCC-STARS integration • extend any VCC simulation model with abstractions required by STARS • Automatic abstraction generation • for a class of VCC models

VCC Behavior • network of behavioral blocks • many ways to specify a block (BlackBox C++, WhiteBox C, ...) • simulation used to verify functionality

VCC Architecture • network of architectural blocks • needed to determine performance of behavioral blocks

VCC Mapping • performance of each behavioral block is modeled • simulation is used to verify performance

Request Input Output fifo BlackBox C++ behavioral blocks • the only kind understood by VCC simulation core class fifo: public FxCPPBlackBoxModel { InputPort<int> Request, Input; OutputPort<int> Output; ... }; void fifo::Run() { if(Request.Enabled()&& !empty) Output.Post(FIFOPop()); if (Input.Enabled()) FIFOPush(Input.Value()); ... }

Request Input Output fifo void fifo::Run() { _delayCycles(60); if(Request.Enabled()&& !empty){ Output.Post(FIFOPop()); _delayCycles(80); } _delayCycles(75); if (Input.Enabled()) { _delayCycles(100); FIFOPush(Input.Value()); } ... } estimation CPU model WhiteBox C behavioral blocks void point_entry_run() { if(Request_Enabled()&& !empty) Output_Post(FIFOPop()); if (Input_Enabled()) FIFOPush(Input_Value()); ... }

Outline • Background • VCC • STARS • VCC-STARS integration • extend any VCC simulation model with abstractions required by STARS • Automatic abstraction generation • for a class of VCC models

STatic Analysis of Reactive Systems For all inputs: • Can I process all workload between two ticks? • How much bus traffic will I generate? • How much energy will I use? play tick network request sample control buffer message frame

Outline • STARS • overview • representing signals • representing system components • finding worst-case behaviors • representing timing information

play frame tick SIGNATURE pl tk Fenv rq sm pl = 1 fr = 2 tk = 3 Fcntr Fbfr ms fr SIGNATURE ABSTRACTION STARS overview play tick network request sample • STARS findsworst-case signature of any execution window of a given length • STARS finds the worst-case CPU busy period control buffer message frame

Signatures • in practice, counting “events” • state transitions may be considered events • combinations of events may have separate counters • may need linear constraints over counters • less events is “better than” () more events

system t t+T t t+T q F s,T F( s, T) Signature Abstractions Estimate output signature based on input signature and length • must be conservative 

Signature Abstractions: Environment play tick network request sample • at least 625s between messages • Fms (s, T) = T/625 + 1 • tick has 125s period • Ftk (s, T) = T/125 + 1 • at most 1 play a second • Fpl (s, T) = T/1,000,000 + 1 control buffer message frame

Signature Abstraction: Buffer play tick network request sample BUFFER: if ( present ( frame ) { samples = frame; last = 50; } if ( present ( tick ) && last > 0) { emit sample ( samples[ last -- ] ); if ( last == 20 ) emit request(); } control buffer message frame Frq (s, T) = min( fr, tk/30) Fsm (s, T) = min( tk, 50*fr )

t t+T Fix-point Theorem If: • s = F(s, T), • s is worse than signature of initial state, then s is worse than signature of any execution segment of length T  s

s  W(s) Task 2 Task 1 Idle Workload Function Estimates required processor time from signatures • must be conservative

Workload Function: VM pager play tick network request sample BUFFER: if ( present ( frame ) { samples = frame; last = 50; } if ( present ( tick ) && last > 0) { emit sample ( samples[ last -- ] ); if ( last == 20 ) emit request(); } control buffer message frame 1 line = 10 time units W(s) = 20*fr + 20*sm + ...

STARS • Pick a signature • Chose a signature abstraction F and workload function W and verify they and conservative • Solve s = F(s,T) T = W(s) • T is a bound on response time the processor cannot be continuously busy for more than T time units

Outline • Background • VCC • STARS • VCC-STARS integration • why, what and how • Automatic abstraction generation • for a class of VCC models

VCC ??? ??? ??? Fenv STARS Fcntr Fbfr Why VCC-STARS? play tick network request sample • cannot relate components to their abstractions control buffer message frame pl tk rq sm ms fr

play tick network request sample control buffer message frame monitor pl tk Fenv rq sm Fcntr Fbfr ms fr VCC-STARS: What? • abstract models used by STARS can be validated by VCC simulation

VCC-STARS: How? BlackBox C++ extensions to represent signatures • vectors of counter values • each behavioral block has: • one counter for each input port • one counter for each output port • a counter measuring CPU time usage • optional user-defined counters

Signature: example class fifo: public FxCPPBlackBoxModel { InputPort<int> Request, Input; OutputPort<int> Output; starsCounter numExecutions; ... }; counters: • Output.count • Input.count • Request.count • numExecutions • the one pointed to by processorTimeCounter()

Run() t t+T t t+T sign. starsAbstraction() est. sign. sign. VCC-STARS: How? BlackBox C++ extensions to represent signature abstractions • each block has member function: void starsAbstraction() • sets bounds of output-port,CPU-usage, anduser-definedcounters, based on input-port counters and length of time • must be conservative: 

Signature abstraction example class fifo: public FxCPPBlackBoxModel { InputPort<int> Request, Input; OutputPort<int> Output; starsCounter numExecutions; ... }; void fifo::Run() { numExecutions++; if(Request.Enabled()&& !empty) Output.Post(FIFOPop()); if (Input.Enabled()) FIFOPush(Input.Value()); ... } void fifo::starsAbstraction() { Output.count.setBound( min( Input.count, Request.count)); numExecutions.setBound( Input.count + Request.count); ... }

Signature abstraction example (cont’d) delay_model() { input(Input); input(Request); run(); delay('0.000001'); output(Output); } void fifo::starsAbstraction() { Output.count.setBound(min(Input.count, Request.count)); numExecutions.setBound(Input.count + Request.count); starsCounter * p = processorTimeCounter(); if(p) p->setBound(1000*numExecutions); }

Signature abstractions • may depend on time: void env::starsAbstraction() { Burst.count.setBound(mgr()->timeWindow()/625000+1); } • mgr()is a manager containing STARS info • timeWindow() depends on context • in simulation, it’s the time since monitor creation • in STARS, it can be a constant • in STARS, it can be current estimate of the busy-period

starsAbstraction() • is verified to be conservative by simulation monitors that perform the following check every time an output counter is changed • evaluate starsAbstraction() using current values of input counters • compare output counters with bounds computed by starsAbstraction() • if bounds are violated, warn that starsAbstraction() is not conservative • is used by STARS to compute to compute worst-case bounds of all the counters in the network

Voice Mail Pager • 16 modules • ~ 4000 lines of C++ code annotated with timing estimates • build signature abstractions manually • 150 lines of C code

VMP First experiment • model environment so that a single message is received and then played • same as VCC test-bench • max busy period: • VCC: 82 s (simulating 8s took ~ 30 s) • STARS: 83 s (took 16 ms to compute)

50x125 125 1 2 3 29 30 31 49 50 message, play VMP second experiment • same as first except: • don’t limit the environment to a single message • max busy period: • STARS 148 s (more than 125 s between two ticks) • VCC: can find input that has 146 s 66s wide window in a 6250 s period

Outline • Background • VCC • STARS • other related work • VCC-STARS • BlackBox C++ extensions • Automatic abstraction generation • for WhiteBox C blocks

VCC-STARS VCC-STARS Fcntr Fbfr What? • abstract models can be automatically generated for WhiteBox C blocks play tick network request sample control buffer message frame pl tk Fenv rq sm ms fr

-STARS Hints estimation signature abstraction Automatic abstraction: How? • WhiteBox C flow in VCC WhiteBox C CPU model estimation annotated BlackBox C++

bound propagation code generation Automatic abstraction algorithm starting from: • input counters • user hints, propagate bounds to • statements • output counters for each output counter with a bound set its bound to the minimum of all if each basic block of code has a bound use VCC delay estimates to bound CPU time

Request.count Example void point_entry_run() { starsIncrement(numExecutions); if (Request_Enabled() && !empty ) Output_Post(FIFOPop()); if (Input_Enabled()) FIFOPush(Input_Value()); } void fifo::starsAbstraction() { Output.count.setBound( Request.count ); }

numExecutions D1 Request.count D2 D3 D4 Hints void point_entry_run() { starsIncrement(numExecutions); if (Request_Enabled() && !empty ) Output_Post(FIFOPop()); if (Input_Enabled()) FIFOPush(Input_Value()); } void starsSetBounds() { numExecutions_SetBound(10); } void fifo::starsAbstraction() { numExecutions.setBound( 10 ); int b = min( numExecutions, Request.count); Output.count.setBound( b ); starsCounter * p = processorTimeCounter(); if(p) p->setBound(numExecutions*(D1+D3+D4) + b*D2); }

RESULTS ON AUTOMATIC ABSTRACTION IMMEDIATE • generating signature abstractions automaticallyis undecidable for arbitrary code DATE 2000 • if transition relation of a memory-less component is a Boolean function represented with a BDD then its ideal signature abstraction can be generated automatically SASIMI 2001 • generating signature abstraction automatically is possible for finite-state machines

Related Work • YAPI-STARS, presented at CODES 2000 • systems in YAPI are networks of concurrent processes, similar to Khan’s process networks • YAPI-STARS is good for bounding communication requirements • no performance analysis • Program path analysis (Cinderella), Li and Malik 1999 • intended for timing analysis of embedded software • useful for automatically generating abstractions used by STARS

Conclusions • STARS adds worst-case analysis to simulation • can prove that performance requirements are met • helps find hard performance bugs • requires additional designer effort to specify abstractions • typically |STARS abstractions| < 10% * |simulation models| • even smaller for estimated WhiteBox C • abstractions can be verified by VCC simulations • could be applied to any simulation environment where meaningful counters can be defined

Thank you S T A R S

Outline • Background • VCC • STARS • other related work • VCC-STARS intergration • BlackBox C++ extensions • Automatic abstraction generation • for WhiteBox C blocks

Run() t t+T t t+T sign. starsAbstraction() bound sign. Signature Abstractions Estimate signature of output counters based on the signature of input counters • must be conservative 

Proposal VCC + STARS = VCC-STARS • Black Box C++ extensions: • providing signatures of events on ports • enabling the user to associate a signature abstraction for each BlackBox C++ block

STARS and Metropolis: static and dynamic RTOS modeling