xTune: A Formal Methodology for Cross-layer Tuning of Mobile Real-time Embedded Systems

1. xTune: A Formal Methodology for Cross-layer Tuning of Mobile Real-time Embedded Systems Minyoung Kim PhD Defense UC Irvine July 2008

2. Mobile Real-time Embedded Systems • Rich set of applications with different timing/QoS needs • Batterypowered mobile devices operate indistributed and dynamicenvironments. Adaptationstrategies need to be aware ofglobalsystem state and exploit it.

3. Challenges • A unified framework is needed to derive, analyze, and validate cross-layer policies/parameters. • Adaptation for mobile real-time embedded systems involves • Complexity • Policies made at one layer can (sometimes adversely) affect behavior at other layers. • Verification • Providing a notion of guarantee on various properties pertaining to energy usage, delays, etc. • Dynamicity • Ensuring adequate application QoS and optimizing resource utilization at all layers of system when the system evolves dynamically over time

4. Timing Plays a Critical Role • Timing determines application semantics. • e.g., Multimedia application vs. mission critical applications • The ability to compensate on-the-fly timing violations is important. • Sources of unpredictability and timing violations in a distributed network • System level optimizations can interfere with the timing properties of executing applications. • Relaxed stringent timing needs can be exploited for better end-to-end resource utilization. • Timing can be an anchor to address reliability, security, etc..

5. Cross-Layer Adaptation User QoS Expectation Application (power-aware video codec) e.g., proactive PBPAIR mobile2 Zone 0 Zone 3 Zone 2 Zone 1 User satisfaction (Video quality feedback) Mobility Network status Middleware (network related policy) e.g., transcoding, traffic shaping, mobility monitor mobile1 Video encoding info. (workload variation) Execution profile (slack time) OS (task level power management) e.g., Greedy, Cluster, DVS Operating voltage NIC power control Residual energy Hardware (device level power management) e.g., timeout-based shutdown • Layer interactions

6. Existing Cross-Layer Adaptation proxy Application device Middleware network OS Hardware • On-Device cross layer adaptation • W. Yuan et al. [IEEE Trans. Mobile Comp. ’06] • GRACE hierarchical adaptation at OS layer • http://www.cs.uiuc.edu/grace Application device Middleware OS Hardware • End-to-End Proxy based cross layer adaptation • S. Mohapatra et al. [IEEE JSAC ’07] • DYNAMO distributed middleware framework • http://dynamo.ics.uci.edu

7. Our Focus Therefore, we focus on • A unified framework is needed to derive, analyze, and validate cross-layer adaptation. • Compositional cross-layer optimization • The notion of quantifiable guarantee on solutions is an issue. • How we can ensure/verify the quality of selected cross-layer policies. • Simple yet powerfulcross-layer adaptation is required. • How we can support cross-layer adaptation while individual sub-layer optimizers perform its own optimization. • We need a way of reflectingdynamics. • When the system evolves over time, how we can accommodate it.

8. Goal Complexity APP MW OS Network status N1 QoS constraint Q1 Video stream S1 … HW Input : App. policy2 param2 OS policy2 param2 … Output : • with some notion of guarantee on solution quality Verification • Supporting needs in aquantifiablemanner for a cross-layer optimization under dynamicity Zone 1 Zone 0 Zone 2 Network status N0 QoS constraint Q0 Video streamS0 … Input : Zone 3 Zone 4 Dynamicity App. policy1 param1 OS policy1 param1 … Output :

9. Approach • Cross layer adaptation of mobile real-time embedded systems • by exploiting coordination among policies at different layers • Unified framework; xTune (http://xtune.ics.uci.edu) • to address iterative system tuning • by integrating two synergistic approaches: • light-weight formal verification • statistical analysis on probabilistic properties • model refinement from system realization • enables dynamic adaptation by refining the model

10. Supporting Adaptation under timing Constraints • This problem will be much more complex if we consider that the system and environment may keep evolving, requiringdynamic adaptation. • Timing can affect, and be affected by several system and resource parameters such as • Power/Timing Tradeoffs: • DVS  deadline misses due to slower execution • Quality/Timing Tradeoffs: • lower quality video  less coding time • Buffering/Timing Tradeoffs: • larger buffer  relaxed timing constraints • Error Resilience/Timing Tradeoffs: • high fidelity  more coding time due to integrity check or retransmission

11. Big Picture Verification Engine Monitoring System Tuning Module Deploying System network xTune

12. Research Contributions • A novel framework for iterative tuning that [sigbed’08, formats’07, rtas-wip’06] • employs formal executable specification and system realization • performs statistical analysis for quantifiable solution quality • allows model refinement to reflect system dynamics • Compositional cross-layer optimization [date’08] • via constraint refinement • Theoretical foundation [fmoods’07] • integrate probabilistic formal methods with cross-layer optimization • Sub-layer techniques for cross-layer optimization [ipdpsw’05] • PBPAIR: application/network layer [mc2r’06, siumi’05, dipes’08] • energy aware co-synthesis: OS/architecture layer [tecs’08, codes-isss’06] • hybrid DPM/DVS: application/OS layer [lctes’01] • Working demo for application driver [estimedia’03] • Linux based implementation on Compaq iPAQs

13. Outline • Introduction • Problem Statement • Technical Approach • Formal Modeling & Statistical Analysis • Compositional Optimization • Iterative Tuning • Concluding Remarks

14. Design Space User QoS Expectation Application (power-aware video codec) QoS feedback Mobility Network status Middleware (network related policy) workload Execution profile (slack time) OS (task level power management) Operating voltage NIC power control Residual energy HW (device level power management) • Goal: exploring cross-layer tradeoffs with some notion of guarantees under dynamicity • Application driver: mobile multimedia communication • Energy aspect: encoding energy • QoS aspect: PSNR • Reliability aspects: network loss resiliency, delay tolerance timing violation tolerance

15. Application Layer Policy: Video Codec • Proactive PBPAIR • A priori information on user’s mobility {current zone, speed, trajectory} and network status (e.g., packet loss rate, delay) • Policy selection/parameter tuning can be done beforehand. APP • PBPAIR (Probability Based Power Aware Intra Refresh) • [Kim et al., ACM Mob. Comp. Comm. Rev.’06] • Partial intra-coding MW Network OS HW frame loss • The IntraTh(Intra threshold) parameter • Control the amount ofintra-coding to increase robustnessof bitstream • Effects: tradeoffs among coding efficiency, energy consumption, robustness time

16. OS Layer Policy: Task Level PM In this work, we control • At Application Layer; IntraThofPBPAIR and BufSize • At OS Layer; DPM, Deadline Completion Ratio of DVS to tradeoff quality with energy consumption of reliable mobile multimedia data communication Lower supply voltage APP • Dynamic Power Management; DPM • Power/Clock Shutdown • Dynamic Voltage Scaling; DVS • Supply Voltage Reduction • to guarantee certain deadline completion ratio [Hua et al., DAC ’03] • e.g., to guarantee 100% task completion within deadline • e.g., what if we can allow 50% deadline miss MW OS HW P P Distribution of task execution time T T wcet deadline deadline

17. Objective: Cross-layer Adaptation Network status N0 QoS constraint Q0 Video streamS0 … Network status N1 QoS constraint Q1 Video stream S1 … Input : Input : We propose xTune framework that supports • Statistical formal analysis from abstraction [FMOODS’07] • Cross-layer optimization by composition [DATE’08] • For iterative cross-layer system tuning [FORMATS’07] PBPAIR (IntraTh0) DVS PBPAIR (IntraTh1) Greedy Output : Output : • Static analysis for policy/parameter instantiation • Dynamic analysis for policy/parameter tuning • Proactive control Zone 1 Zone 0 Zone 2 Zone 3 Zone 4

18. Outline • Introduction • Problem Statement • Technical Approach • Formal Modeling & Statistical Analysis • Compositional Optimization • Iterative Tuning • Concluding Remarks

19. Overall Approach • Formal specification 1. Specify a system in Maude 2. Add observer and/or property checker in Maude specification • Monitoring 3. Execute Maude specification to extract observables • Statistical analysis 4. Hypothesis testing for statistical model checking 5. Statistical formal method for quantitative analysis

20. Modeling Cross-Layer Adaptation Layer interactions User QoS Expectation Application (power-aware video codec) e.g., proactive PBPAIR mobile2 Zone 0 Zone 3 Zone 2 Zone 1 User satisfaction (Video quality feedback) Mobility Network status Middleware (network related policy) e.g., transcoding, traffic shaping, mobility monitor mobile1 Video encoding info. (workload variation) Execution profile (slack time) OS (task level power management) e.g., Greedy, Cluster, DVS Operating voltage NIC power control Residual energy Hardware (device level power management) e.g., timeout-based shutdown Final Defense Jul 8th, 2008 #20

21. What to Model? (1/4) • Application layer: PBPAIR Application (PBPAIR) e.g., Intra_th (algorithmic parameter) Video encoding info. (workload variation) Mobility Network status Residual energy Execution profile (slack time) • User QoS expectation: Tolerable QoS drop • In PBPAIR: • Selecting Intra_Th parameter (lower than user expectation) affects user satisfaction (image quality/robustness) and energy consumption. • Generates encoding workload profile as a form of distribution function e.g., uniform [bcet, wcet], Gaussian • Profile: when encoding starts/ends? how much time is required?

22. What to Model? (2/4) • Middleware layer: network related operation Video encoding info. (workload variation) Mobility Network status Middleware e.g., mobility, network status monitor Execution profile (slack time) Residual energy • User mobility: {current zone, speed, trajectory} • Zone information: network delay, packet drop within the zone • Network delay modeling: exponential inter-arrival time (Poisson) with mean • Packet drop modeling: given PLR (packet loss rate)  derive uniform, Gilbert-Elliott packet erasure model • User satisfaction • QoS (PSNR/bad pixel/deadline miss), energy consumption • How to evaluate effect of adaptation?  feedback channel

23. What to Model? (3/4) • OS layer: OS-level power management Video encoding info. (workload variation) Execution profile (slack time) OS (power management policy) e.g., Always-on, Greedy, Cluster, DVS Operating voltage NIC power control Residual energy • Various power management schemes (based on worst-case scenario) • Always-ON, Greedy, Cluster, DVS (dynamic voltage scaling) • Various scheduling algorithms (for multitasking) • EDF (earliest deadline first), RM (rate monotonic) • Generates execution profile • based on workload variation (from application layer) • as a form of distribution function e.g., uniform, Gaussian

24. What to Model? (4/4) Operating voltage NIC power control Residual energy Hardware (enabling technology) e.g., uP DVS, NIC shutdown • Processors • wakeup/sleep delay, DVS characteristic • power consumption for different operating mode/voltage-frequency • Report residual energy • Peripheral devices (e.g., NIC) • wakeup/sleep delay • power consumption for different operating mode • Report residual energy • Hardware layer

25. Formal Modeling • Formal specification can be instrumented to provide trace observations for subsequent analysis. • Roles of formal method • Abstracted model of each layers • Enabler for reasoning about properties • Basis of subsequent statistical analysis and model refinement • Maude formal executable specification based onrewriting logic • http://maude.csl.sri.com • Rewriting Logic: An extension of equational logic with local rewrite rules to express concurrent change and inference rules

26. The Maude System • Maude is a language and environment based on rewriting logic • http://maude.csl.sri.com • Rewriting Logic: An extension of equational logic with local rewrite rules to express • concurrent change over time • inference rules

27. Maude Specification • The dynamics is then specified by rewrite rules of the form where C is a term representing the system configuration. C  C’ if condition is true • The system state (configuration) is typically represented as a multiset of objects and messages < ObjectName : ClassName | Attribute1 : Value1, ..., Attributen : Valuen >

28. Example of Object: Application Layer Timing Parameter Buffering Timing QoS

29. Monitoring & Formal Analysis • We explore statistical formal methods for analyzing QoS/energy tradeoffs across layers to ensure properties. • Probability that a system can survive with given residual energy for time T is more/less than threshold. • Expected value of energy consumption for time T with confidence interval and error bound. op batteryExpires : Configuration -> Bool . eq batteryExpires(< CPU : HW | residualEnergy : F, atts > C:Configuration) = (if (F <= 0.0) then true else false fi) . • Extract observables from executable system specification • Statistical formal analysis

30. Revisiting “Correctness”: Statistical Properties • Energy perspective • Probability thata system can survive with given residual energy in T time unitsis more than A%. • QoS perspective • Probability that deadline miss ratio becomes over A% frame drop ratio becomes over A% number of consecutive deadline miss becomes more than A number of consecutive frame drop becomes more than A in T time unitsis less than B%.

31. Light-weight Formal Method Model-Checker accept Continue untilline is crossed Error: , continue Number of positiveobservations Yes Verify  oversample paths Probability that a system can survive with given residual energy for time T is more/less than threshold. reject Start here No Number of observations Property • Courtesy of Younes’s CAV’02 talk • Statistical approach based on Monte Carlo simulation • Sequential testing [Youne et al., CAV’02]

32. Outline • Introduction • Problem Statement • Technical Approach • Formal Modeling & Statistical Analysis • Compositional Optimization • Iterative Tuning • Concluding Remarks

33. Preliminaries • Parameters: e.g., IntraTh, BufSize, DeadlineCompletionRatio • Observables: e.g., energy consumed, deadline miss rate, etc. • Requirements: for each aspects (e.g., energy, bandwidth, etc.) • System utility; the objective function • Weighted sum of the evaluation functions of each component • e.g., energy, timing, drop, bandwidth, buffer. • The subjective matter of utility function is out of scope of this work. • If the observables cannot satisfy hard requirements, utility will be zero. • Zero utility is considered as a failure.

34. Limitation of Single Point Solution Therefore, we focus on • providing a solution region with certain property (e.g., small variation) rather than a single point • cooperative composition by constraint refinement xTune sol. Traditional sol. • Lack of compositionality • One optimizer can over-restrict the solution space of the other optimizer • Lack of robustness • Under high dynamicity, reliable optimization becomes an issue.

35. Constraint Refinement Parameter y Parameter x • Iterative sampling • By using interval-based description • Generic constraint-based interface General consensus Constraint Refinement Optimizer B (restrict z) Optimizer A (restrict x, y) Single Point Solution High chance of oscillation

36. Compositional Cross-layer Optimization Compositional opt. Global opt. Local opt. User QoS Expectation Application (power-aware video codec) User satisfaction (Video quality feedback) Mobility Network status Middleware (network related policy) Video encoding info. (workload variation) Execution profile (slack time) OS (task level power management) Operating voltage NIC power control Residual energy Hardware (device level power management) In particular, we propose • Composition of sub-layer optimizers • via constraint refinement • Goal: cross-layer optimization

37. Composition by Constraint Refinement Compositional opt. Constraint refinement • Each layer only restrictsits own parameters • App. Optimizer: PBPAIR restricts IntraTh, BufSize parameters • OS Optimizer: DVS restricts deadline completion ratio parameter • Exchangethem as constraint deadline completion ratio BufSize IntraTh OS Layer Opt. (DVS) App. Layer Opt. (PBPAIR)

38. Experimental Sets Compositional Local Global • Simulated Annealing vs. Constraint Refinement • Simulated Annealing • On step width adaptation in simulated annealing for continuous parameter optimization. [Nolle et al., Fussy Days on Computational Intelligence, Theory and Applications, pages 589–598, 2001] • Global vs. Local vs. Compositional cross-layer optimization • Constraint refinement is used as an interface for subsequent iterations.

39. Constraint Refinement vs. Simulated Annealing Constraint refinement provides • a solution region for robust/stable parameter setting • that allows compositional optimization • Simulated annealing • Constraint refinement Utility Region with utility statistics Higher utility for most cases Parameter Settings Abrupt/constant parameter change More deterministic

40. Cross-layer Optimization Failure Close to Global Opt. Compositional optimization can • achieve reasonably close solutions to global optimization with less complexity and high stability • enable parallel processing of local optimizers with its own objective • Compositional • Local • Global

41. Outline • Introduction • Problem Statement • Technical Approach • Formal Modeling & Statistical Analysis • Compositional Optimization • Iterative Tuning • Concluding Remarks

42. Dynamicity Requires Model Refinement • Network status change • Network status change • Effect of different parameter setting • Network status change • Effect of different parameter setting • Input can change: data dependency • We need to reflect the actual executions from continuous observation of system dynamics

43. Iterative Tuning Cycle policy/ parameter • Informed selection from formal model and analysis • Enhanced by integrating it with observations of system • Adaptive reasoning and proactive control system realization system model • Role of continuous observation of system execution behavior • improve the formal model to reflect dynamics (model refinement) pre- testing policy/parameter selection & formal verification model refinement

44. Controller & System Realization Interaction Maude Formal Executable Specification Control Refined system behavior Observables Controller Interface Control Dynamic system execution behavior Policies/parameters - PBPAIR as the application layer policy with DVS as the OS layer policy - Intra_th parameter for the PBPAIR Simulation information - Debugging purposes Application profile - Timing (deadline miss, BCET/WCET) - QoS (PSNR, frame drop, buffer overflow) Network profile - Network status (packet loss/delay pattern) - Mobility (current zone, speed, trajectory) OS profile - CPU utilization Hardware profile - Energy consumption • Timing (BCET, WCET) and network related information • Model refinement and proactive control System Realization

45. Model Refinement and Proactive Control Zone 0 Optimization for zone 1 Optimization for zone 2 phase 2 phase 2 Model refinement policy/ parameter event 1 event 2 event 3 Model refinement Zone 3 Zone 2 Zone 1 policy/parameter selection & formal verification pre- testing phase 1 phase 3 phase 1 phase 3 system model system realization event 2 event 4 model refinement Proactive Control event 7 event 6 event 5 t8 t0 t1 t2 t3 t4 t5 t6 t7 A user resides in zone 1 zone 2 System realization Formal analysis Controller Device time

46. Concluding Remarks • This thesis proposes xTune framework that • enables iterative tuning of policies and parameters of resource constrained mobile real-time embedded systems • by light-weight formal verification with model refinement from system execution behavior • On top of xTune, we perform compositional cross-layer optimization • by coordinated interaction among local optimizers • through constraint refinement • to achieve multi-faceted (energy/QoS/reliability) goal

47. Future Research Directions • Simultaneous consideration of cross-cutting concerns: • Composition of non-functional needs (e.g., security) cannot be addressed in a single layer or device due to their inherent dependencies. • Reasoning on heterogeneous cross-devices with coordination: • Constraint language need to become more expressive and provide a way for distributed cooperative constraint refinement. • A balance between autonomy and cooperation among layers/devices need to be studied. • Repurposing the Instrumented Cyber Physical Spaces (ICPSs): • [M. Kim, D. Massaguer, N. Dutt, S. Mehrotra, S. Ren, M.-O. Stehr, N. Venkatasubramanian. C. Talcott., WEBS’08 in part of CPSWEEK] • We propose an idea of developing a semantic framework that can customize the operations of ICPS to meet the varying needs of applications and users, based on observe-analyze-adapt philosophy.

48. Publications • Journal Articles • [J3] Minyoung Kim, Sudarshan Banerjee, Nikil Dutt, Nalini Venkatasubramanian, “Energy-aware Co-synthesis of Real Time Multimedia Applications on MPSoCs”, ACM Transactions on Embedded Computing Systems (TECS). 7(2): article 9, 2008. • [J2] Minyoung Kim, Hyunok Oh, Nikil Dutt, Alex Nicolau, Nalini Venkatasubramanian, PBPAIR: An Energy-efficient Error-resilient Encoding Using Probability Based Power Aware Intra Refresh, ACM SIGMOBILE Mob. Comput. Commun. Rev. 10(3): 58-69, 2006. • [J1] Minyoung Kim and Soonhoi Ha, "Hybrid Run-time Power Management Technique for Real-time Embedded System with Voltage Scalable Processor”, ACM SIGPLAN Notice. 36(8): 11-19, 2001. • Conference/Workshop Papers • [C12] Kyoungwoo Lee, Minyoung Kim, Nikil Dutt, Nalini Venkatasubramanian, “Error-Exploiting Video Encoder to Extend Energy/QoS Tradeoffs for Mobile Embedded Systems” to appear in IFIP Working Conference on Distributed and Parallel Embedded Systems (DIPES’08) • [C11] Minyoung Kim, Daniel Massaguer, Nikil Dutt, Sharad Mehrotra, Shangping Ren, Mark-Oliver Stehr, Carolyn Talcott, Nalini Venkatasubramanian, “A Semantic Framework for Reconfiguration of Instrumented Cyber Physical Spaces”, Second Workshop on Event-based Semantics(WEBS’08), in part of CPSWEEK’08 • [C10] Minyoung Kim, Mark-Oliver Stehr, Carolyn Talcott, Nikil Dutt, Nalini Venkatasubramanian, “Constraint Refinement for Online Verifiable Cross-Layer System Adaptation", IEEE/ACM Design Automation and Test in Europe (DATE’08) • [C9] Minyoung Kim, Nikil Dutt, Nalini Venkatasubramanian, Carolyn Talcott, “xTune: Online Verifiable Cross-Layer Adaptation for Distributed Real-Time Embedded Systems", IEEE International Real-Time Systems Symposium (RTSS’07) Ph.D. ForumBest Overall Idea Award & Best System Architecture Award • [C8] Minyoung Kim, Mark-Oliver Stehr, Carolyn Talcott, Nikil Dutt, Nalini Venkatasubramanian, “Combining Formal Verification with Observed System Execution Behavior to Tune System Parameters", International Conference on Formal Modelling and Analysis of Timed Systems (FORMATS’07), guest conference of the ESWEEK’07 • [C7] Minyoung Kim, Mark-Oliver Stehr, Carolyn Talcott, Nikil Dutt, Nalini Venkatasubramanian, “A Probabilistic Formal Approach to Cross-layer Optimization in Distributed Embedded Systems", IFIP Conference on Formal Methods for Open Object-Based Distributed Systems (FMOODS’07) • [C6] Minyoung Kim, Sudarshan Banerjee, Nikil Dutt, Nalini Venkatasubramanian, “Design Space Exploration of Real-time Multi-media MPSoCs with Heterogeneous Scheduling Policies”, IEEE/ACM/IFIP Conference on Hardware/Software Codesign and System Synthesis (CODES-ISSS’06) • [C5] Minyoung Kim, Nikil Dutt, Nalini Venkatasubramanian, “Policy Construction and Validation for Energy Minimization in Cross Layered Systems: A Formal Method Approach”, IEEE Real-Time and Embedded Technology and Applications Symposium (RTAS’06) Work-in-Progress • [C4] Minyoung Kim, Hyunok Oh, Nikil Dutt, Alex Nicolau, Nalini Venkatasubramanian, “Probability Based Power Aware Error Resilient Coding”, Workshop on Services and Infrastructures for the Ubiquitous and Mobile Internet (SIUMI’05) in conjunction with IEEE ICDCS'05 • [C3] Shivajit Mohapatra, Radu Cornea, Hyunok Oh, Kyoungwoo Lee, Minyoung Kim, Nikil Dutt, Rajesh Gupta, Alex Nicolau, Sandeep Shukla, Nalini Venkatasubramanian, "A Cross-Layer Approach for Power-Performance Optimization in Distributed Mobile Systems", Workshop on NSF Next Generation Software Program (NSFNGS’05) in conjunction with IEEE IPDPS’05 • [C2] Dohyung Kim, Minyoung Kim, Soonhoi Ha, "A Case Study of System Level Specification and Software Synthesis of Multi-mode Multimedia Terminal”, IEEE Workshop on Embedded Systems for Real-time Multimedia (ESTIMedia’03) in conjunction with IEEE/ACM/IFIP CODES-ISSS’03 • [C1] Minyoung Kim , Soonhoi Ha, "Hybrid Run-time Power Management Technique for Real-time Embedded System with Voltage Scalable Processor”, ACM SIGPLAN/SIGBED Conference on Languages, Compilers, and Tools for Embedded Systems (LCTES’01)

49. Thank you.minyounk@ics.uci.eduhttp://xtune.ics.uci.edu

50. Maude Specification • Formal executable specification • the system state (configuration) is typically represented as a multiset of objects and messages < ObjectName : ClassName | Attribute1 : Value1, ..., Attributen : Valuen > • Time elapse is expressed by mte (maximum time elapse) and delta (effect of time elapse) • Rules can either be instantaneous or tick rules of the form C  delta (C, T) in time T if T mte(C) where C is a term representing the system configuration.