1 / 27

GameTime : A Toolkit for Timing Analysis of Software

GameTime : A Toolkit for Timing Analysis of Software. Sanjit Seshia and Jonathan Kotker EECS Department, UC Berkeley TACAS 2011, Saarbrücken , Germany. Motivation. Quantitative analysis of programs is crucial for cyber-physical systems: How long does it take?

marius
Télécharger la présentation

GameTime : A Toolkit for Timing Analysis of Software

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. GameTime: A Toolkit for Timing Analysis of Software SanjitSeshia and Jonathan Kotker EECS Department, UC Berkeley TACAS 2011, Saarbrücken, Germany

  2. Motivation Quantitative analysis of programs is crucial for cyber-physical systems: How long does it take? How much energy does it consume? • Safety-critical embedded systems: Does the brake-by-wire software always actuate the brakes within 1 ms? • Energy-limited sensor nets: How much energy must the sensor node harvest for RSA encryption?

  3. Timing Analysis Problems • Worst-case execution time (WCET) estimation • Estimating distribution of execution times • Threshold property: produce test cases that violates program deadline • Software-in-the-loop simulation: predict execution time of particular program path All of the above involve predicting an execution time property!

  4. i1 42 75 i2 LEARNINGALGORITHM online i3 101 … … SMT SOLVER SMT SOLVER The GameTime Approach Game-Theoretic Online Learning + Satisfiability Modulo Theories Generate Control-Flow Graph, Unroll Loops, Inline Functions, and so on CONTROL-FLOW GRAPH (DAG) PROGRAM Compile Program for Platform i3 i2 Extract FEASIBLE BASIS PATHS with corresponding Test Cases TEST SUITE i1 Measure timing on Test Suite directed by Learning Algorithm PREDICT TIMING PROPERTIES (such as worst-case, distribution) Publication: S. A. Seshia and A. Rakhlin, Quantitative Analysis of Systems Using Game-Theoretic Learning, ACM Trans. on Embedded Computing Systems

  5. Theoretical Model and Guarantees Game Formulation: Tool vs. Platform Sample Theoretical Guarantee for WCET: GameTime finds program path leading to WCET with high probability, under certain assumptions on platform behavior (see ACM TECS paper for details) 5

  6. Running Example:Modular Exponentiation • Common operation in cryptography, used for public-key encryption and decryption. • Base number is raised to an exponent, and result is expressed modulo a prime number. • Exponentiation is performed usingsquare-and-multiply, where the exponent is progressively divided by two, while the base is progressively squared.

  7. Modular Exponentiation modexp(base, exponent) { result = 1; for(i=EXP_BITS; i>0; i--) { // EXP_BITS = 2 if ((exponent & 1) == 1) { result = (result * base) % p; } exponent >>= 1; base = (base * base) % p; } return result; } modexp(base, exponent) { result = 1; if ((exponent & 1) == 1) { result = (result * base) % p; } exponent >>= 1; base = (base * base) % p; • if ((exponent & 1) == 1) { • result = (result * base) % p; • } • exponent >>= 1; • base = (base * base) % p; return result; }

  8. 1 3 2 4 5 7 6 8 9 Basis Paths 1 1 1 1 Edge labels indicate Edge IDs and positions in vector representation 3 3 2 2 x1= (1, 0, 1, 1, 1, 1, 0, 0, 1) x2= (1, 1, 0, 0, 1, 0, 1, 1, 1) x3 = (1, 1, 0, 0, 1, 1, 0, 0, 1) x4 = (1, 0, 1, 1, 1, 0, 1, 1, 1) 4 4 5 5 5 5 7 7 6 6 x4= x1+ x2 – x3 8 8 9 9 9 9 (d) Vector representations (a) CFG for modexp (unrolled) (b) Basis paths x1, x2, x3 (c) Additional path x4

  9. 1 3 2 4 5 7 6 8 9 Basis Generation Example 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 Use ILP solver to pick path in graph

  10. 1 3 2 4 5 7 6 8 9 Basis Generation Example 1 1 0 0 1 1 0 0 1 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 Feasible? SMT solver says Yes

  11. 1 3 2 4 5 7 6 8 9 Basis Generation Example 1 1 0 0 1 1 0 0 1 1 0 1 1 1 1 0 0 1 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 Feasible? SMT solver says Yes

  12. 1 3 2 4 5 7 6 8 9 Basis Generation Example 1 1 0 0 1 1 0 0 1 1 0 1 1 1 1 0 0 1 1 1 0 0 1 0 1 1 1 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 Feasible? SMT solver says Yes

  13. 1 3 2 4 5 7 6 8 9 Basis Generation Example 1 1 0 0 1 1 0 0 1 1 0 1 1 1 1 0 0 1 1 1 0 0 1 0 1 1 1 1 0 1 1 0 0 1 1 1 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 Feasible? SMT solver says Yes, but linearly dependent!

  14. 1 3 2 4 5 7 6 8 9 Basis Generation Example 1 1 0 0 1 1 0 0 1 1 0 1 1 1 1 0 0 1 1 1 0 0 1 0 1 1 1 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 Basis paths

  15. Basis Generation ExampleUsing the Unsat-Core void foo (int a, int b) { if (a != b) { c = 1; } switch(c) { case 0: ... break; case 1: ... break; default: ... } ... } 1 3 2 4 5 6 7 8 10 11 9 12

  16. Basis Generation Example 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 1 3 2 Use ILP solver to pick path in graph. 4 5 6 7 8 10 11 9 12

  17. Basis Generation Example 1 0 1 1 1 1 0 0 1 0 0 1 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 1 3 2 4 Feasible? SMT solver says No! 5 6 7 8 10 11 9 12

  18. Basis Generation Example 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 1 3 From unsat-core, add constraint that edges 3, 4, 6, 9 cannot occur together on the same path and retry. 2 4 5 6 7 8 Add constraint x3 + x4 + x6 + x9 <= 3 10 11 9 12

  19. Demo!

  20. Predicted and Measured DistributionsModular Exponentiation with Base 2 and 5-bit exponents StrongARM-1100 Processor

  21. Percentage Error with Different Initial States Modular Exponentiation with Base 15 and 5-bit exponents StrongARM-1100 Processor

  22. Percentage Error with Different Initial States Modular Exponentiation with Base 15 and 5-bit exponents StrongARM-1100 Processor

  23. Predicted and Measured Values Modular Exponentiation with Base 2 and 5-bit exponents TI MSP430 Processor on TelosB Mote

  24. Predicted and Measured Values Modular Exponentiation with Base 15 and 5-bit exponents TI MSP430 Processor on TelosB Mote

  25. Highlights of OtherExperimental Results (details in ICCAD’08, ACM TECS papers) • GameTime is efficient For example, 7 x 1016 total paths vs. < 200 basis paths • Sampling basis paths tells us about longer paths we do not sample Found paths 25% longer than sampled basis • GameTime can accurately estimate the distribution of execution times with few measurements Measure basis paths, predict other paths • GameTimecan demonstrate larger WCET estimateswith test cases than some conservative WCET estimation tools

  26. Availability An alpha version of GameTime will be available online at http://uclid.eecs.berkeley.edu/gametime within the next month.

  27. Thank you! Acknowledgments: Andrew Chan, Sagar Jain, Dorsa Sadigh, Min Xu, Lisa Yan

More Related