gametime a toolkit for timing analysis of software n.
Download
Skip this Video
Loading SlideShow in 5 Seconds..
GameTime : A Toolkit for Timing Analysis of Software PowerPoint Presentation
Download Presentation
GameTime : A Toolkit for Timing Analysis of Software

Loading in 2 Seconds...

play fullscreen
1 / 27

GameTime : A Toolkit for Timing Analysis of Software - PowerPoint PPT Presentation


  • 101 Views
  • Uploaded on

GameTime : A Toolkit for Timing Analysis of Software. Sanjit Seshia and Jonathan Kotker EECS Department, UC Berkeley TACAS 2011, Saarbrücken , Germany. Motivation. Quantitative analysis of programs is crucial for cyber-physical systems: How long does it take?

loader
I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
capcha
Download Presentation

PowerPoint Slideshow about 'GameTime : A Toolkit for Timing Analysis of Software' - marius


An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
gametime a toolkit for timing analysis of software

GameTime: A Toolkit for Timing Analysis of Software

SanjitSeshia and Jonathan Kotker

EECS Department, UC Berkeley

TACAS 2011, Saarbrücken, Germany

motivation
Motivation

Quantitative analysis of programs is

crucial for cyber-physical systems:

How long does it take?

How much energy does it consume?

  • Safety-critical embedded systems: Does the brake-by-wire software always actuate the brakes within 1 ms?
  • Energy-limited sensor nets: How much energy must the sensor node harvest for RSA encryption?
timing analysis problems
Timing Analysis Problems
  • Worst-case execution time (WCET) estimation
  • Estimating distribution of execution times
  • Threshold property: produce test cases that violates program deadline
  • Software-in-the-loop simulation: predict execution time of particular program path

All of the above involve predicting an execution time property!

the gametime approach

i1

42

75

i2

LEARNINGALGORITHM

online

i3

101

SMT SOLVER

SMT SOLVER

The GameTime Approach

Game-Theoretic Online Learning + Satisfiability Modulo Theories

Generate Control-Flow Graph, Unroll Loops, Inline Functions, and so on

CONTROL-FLOW

GRAPH (DAG)

PROGRAM

Compile Program for Platform

i3

i2

Extract FEASIBLE BASIS PATHS with corresponding Test Cases

TEST SUITE

i1

Measure timing on Test Suite directed by Learning Algorithm

PREDICT TIMING PROPERTIES (such as worst-case, distribution)

Publication: S. A. Seshia and A. Rakhlin, Quantitative Analysis of Systems Using Game-Theoretic Learning, ACM Trans. on Embedded Computing Systems

theoretical model and guarantees
Theoretical Model and Guarantees

Game Formulation: Tool vs. Platform

Sample Theoretical Guarantee for WCET: GameTime finds program path leading to WCET with high probability, under certain assumptions on platform behavior

(see ACM TECS paper for details)

5

running example modular exponentiation
Running Example:Modular Exponentiation
  • Common operation in cryptography, used for public-key encryption and decryption.
  • Base number is raised to an exponent, and result is expressed modulo a prime number.
  • Exponentiation is performed usingsquare-and-multiply, where the exponent is progressively divided by two, while the base is progressively squared.
modular exponentiation
Modular Exponentiation

modexp(base, exponent) {

result = 1;

for(i=EXP_BITS; i>0; i--) {

// EXP_BITS = 2

if ((exponent & 1) == 1) {

result = (result * base) % p;

}

exponent >>= 1;

base = (base * base) % p;

}

return result;

}

modexp(base, exponent) {

result = 1;

if ((exponent & 1) == 1) {

result = (result * base) % p;

}

exponent >>= 1;

base = (base * base) % p;

  • if ((exponent & 1) == 1) {
  • result = (result * base) % p;
  • }
  • exponent >>= 1;
  • base = (base * base) % p;

return result;

}

basis paths

1

3

2

4

5

7

6

8

9

Basis Paths

1

1

1

1

Edge labels indicate Edge IDs and positions in vector representation

3

3

2

2

x1= (1, 0, 1, 1, 1, 1, 0, 0, 1)

x2= (1, 1, 0, 0, 1, 0, 1, 1, 1)

x3 = (1, 1, 0, 0, 1, 1, 0, 0, 1)

x4 = (1, 0, 1, 1, 1, 0, 1, 1, 1)

4

4

5

5

5

5

7

7

6

6

x4= x1+ x2 – x3

8

8

9

9

9

9

(d) Vector representations

(a) CFG for modexp (unrolled)

(b) Basis paths x1, x2, x3

(c) Additional path x4

basis generation example

1

3

2

4

5

7

6

8

9

Basis Generation Example

1 0 0 0 0 0 0 0 0

0 1 0 0 0 0 0 0 0

0 0 1 0 0 0 0 0 0

0 0 0 1 0 0 0 0 0

0 0 0 0 1 0 0 0 0

0 0 0 0 0 1 0 0 0

0 0 0 0 0 0 1 0 0

0 0 0 0 0 0 0 1 0

0 0 0 0 0 0 0 0 1

Use ILP solver to pick path in graph

basis generation example1

1

3

2

4

5

7

6

8

9

Basis Generation Example

1 1 0 0 1 1 0 0 1

0 1 0 0 0 0 0 0 0

0 0 1 0 0 0 0 0 0

0 0 0 1 0 0 0 0 0

0 0 0 0 1 0 0 0 0

0 0 0 0 0 1 0 0 0

0 0 0 0 0 0 1 0 0

0 0 0 0 0 0 0 1 0

0 0 0 0 0 0 0 0 1

Feasible?

SMT solver says Yes

basis generation example2

1

3

2

4

5

7

6

8

9

Basis Generation Example

1 1 0 0 1 1 0 0 1

1 0 1 1 1 1 0 0 1

0 0 1 0 0 0 0 0 0

0 0 0 1 0 0 0 0 0

0 0 0 0 1 0 0 0 0

0 0 0 0 0 1 0 0 0

0 0 0 0 0 0 1 0 0

0 0 0 0 0 0 0 1 0

0 0 0 0 0 0 0 0 1

Feasible?

SMT solver says Yes

basis generation example3

1

3

2

4

5

7

6

8

9

Basis Generation Example

1 1 0 0 1 1 0 0 1

1 0 1 1 1 1 0 0 1

1 1 0 0 1 0 1 1 1

0 0 0 1 0 0 0 0 0

0 0 0 0 1 0 0 0 0

0 0 0 0 0 1 0 0 0

0 0 0 0 0 0 1 0 0

0 0 0 0 0 0 0 1 0

0 0 0 0 0 0 0 0 1

Feasible?

SMT solver says Yes

basis generation example4

1

3

2

4

5

7

6

8

9

Basis Generation Example

1 1 0 0 1 1 0 0 1

1 0 1 1 1 1 0 0 1

1 1 0 0 1 0 1 1 1

1 0 1 1 0 0 1 1 1

0 0 0 0 1 0 0 0 0

0 0 0 0 0 1 0 0 0

0 0 0 0 0 0 1 0 0

0 0 0 0 0 0 0 1 0

0 0 0 0 0 0 0 0 1

Feasible?

SMT solver says Yes,

but

linearly dependent!

basis generation example5

1

3

2

4

5

7

6

8

9

Basis Generation Example

1 1 0 0 1 1 0 0 1

1 0 1 1 1 1 0 0 1

1 1 0 0 1 0 1 1 1

0 0 0 1 0 0 0 0 0

0 0 0 0 1 0 0 0 0

0 0 0 0 0 1 0 0 0

0 0 0 0 0 0 1 0 0

0 0 0 0 0 0 0 1 0

0 0 0 0 0 0 0 0 1

Basis paths

basis generation example using the unsat core
Basis Generation ExampleUsing the Unsat-Core

void foo (int a, int b) {

if (a != b) {

c = 1;

}

switch(c) {

case 0: ... break;

case 1: ... break;

default: ...

}

...

}

1

3

2

4

5

6

7

8

10

11

9

12

basis generation example6
Basis Generation Example

1 0 0 0 0 0 0 0 0 0 0 0

0 1 0 0 0 0 0 0 0 0 0 0

0 0 1 0 0 0 0 0 0 0 0 0

0 0 0 1 0 0 0 0 0 0 0 0

0 0 0 0 1 0 0 0 0 0 0 0

0 0 0 0 0 1 0 0 0 0 0 0

0 0 0 0 0 0 1 0 0 0 0 0

0 0 0 0 0 0 0 1 0 0 0 0

0 0 0 0 0 0 0 0 1 0 0 0

0 0 0 0 0 0 0 0 0 1 0 0

0 0 0 0 0 0 0 0 0 0 1 0

0 0 0 0 0 0 0 0 0 0 0 1

1

3

2

Use ILP solver to pick path in graph.

4

5

6

7

8

10

11

9

12

basis generation example7
Basis Generation Example

1 0 1 1 1 1 0 0 1 0 0 1

0 1 0 0 0 0 0 0 0 0 0 0

0 0 1 0 0 0 0 0 0 0 0 0

0 0 0 1 0 0 0 0 0 0 0 0

0 0 0 0 1 0 0 0 0 0 0 0

0 0 0 0 0 1 0 0 0 0 0 0

0 0 0 0 0 0 1 0 0 0 0 0

0 0 0 0 0 0 0 1 0 0 0 0

0 0 0 0 0 0 0 0 1 0 0 0

0 0 0 0 0 0 0 0 0 1 0 0

0 0 0 0 0 0 0 0 0 0 1 0

0 0 0 0 0 0 0 0 0 0 0 1

1

3

2

4

Feasible?

SMT solver says No!

5

6

7

8

10

11

9

12

basis generation example8
Basis Generation Example

1 0 0 0 0 0 0 0 0 0 0 0

0 1 0 0 0 0 0 0 0 0 0 0

0 0 1 0 0 0 0 0 0 0 0 0

0 0 0 1 0 0 0 0 0 0 0 0

0 0 0 0 1 0 0 0 0 0 0 0

0 0 0 0 0 1 0 0 0 0 0 0

0 0 0 0 0 0 1 0 0 0 0 0

0 0 0 0 0 0 0 1 0 0 0 0

0 0 0 0 0 0 0 0 1 0 0 0

0 0 0 0 0 0 0 0 0 1 0 0

0 0 0 0 0 0 0 0 0 0 1 0

0 0 0 0 0 0 0 0 0 0 0 1

1

3

From unsat-core, add constraint that edges 3, 4, 6, 9 cannot occur together on the same path

and retry.

2

4

5

6

7

8

Add constraint

x3 + x4 + x6 + x9 <= 3

10

11

9

12

predicted and measured distributions modular exponentiation with base 2 and 5 bit exponents
Predicted and Measured DistributionsModular Exponentiation with Base 2 and 5-bit exponents

StrongARM-1100 Processor

slide21
Percentage Error with Different Initial States Modular Exponentiation with Base 15 and 5-bit exponents

StrongARM-1100 Processor

slide22
Percentage Error with Different Initial States Modular Exponentiation with Base 15 and 5-bit exponents

StrongARM-1100 Processor

predicted and measured values modular exponentiation with base 2 and 5 bit exponents
Predicted and Measured Values Modular Exponentiation with Base 2 and 5-bit exponents

TI MSP430 Processor on TelosB Mote

predicted and measured values modular exponentiation with base 15 and 5 bit exponents
Predicted and Measured Values Modular Exponentiation with Base 15 and 5-bit exponents

TI MSP430 Processor on TelosB Mote

highlights of other experimental results
Highlights of OtherExperimental Results

(details in ICCAD’08, ACM TECS papers)

  • GameTime is efficient

For example, 7 x 1016 total paths vs. < 200 basis paths

  • Sampling basis paths tells us about longer paths we do not sample

Found paths 25% longer than sampled basis

  • GameTime can accurately estimate the distribution of execution times with few measurements

Measure basis paths, predict other paths

  • GameTimecan demonstrate larger WCET estimateswith test cases than some conservative WCET estimation tools
availability
Availability

An alpha version of GameTime

will be available online at

http://uclid.eecs.berkeley.edu/gametime

within the next month.

thank you

Thank you!

Acknowledgments: Andrew Chan, Sagar Jain, Dorsa Sadigh, Min Xu, Lisa Yan