STARS and Metropolis: static and
dynamic RTOS modeling
Felice Balarin
Cadence Berkeley Labs
RTOS modeling
Any OS has two basic function:
• To create abstraction of computational tasks running
concurrently while sharing HW resources like CPU
• To offer communication services between tasks and the rest of
the world, and between tasks themselves
In addition, Real-time OS (RTOS) needs to ensure that
computation and communication done by tasks occurs in a
predictable time-frame
• dynamic or static performance analysis
• Metropolis and STARS
RTOS: a Metropolis architectural component
An RTOS is modeled by
: interfaces
• what it can do
• how much it costs : time, energy, resource utilization
interface RTOSservices extends Port {
void send(message m, mailbox b);
message receive(mailbox b);
…
void compute(int time);
}
TimeMgr
RTOS
Scheduler
medium RTOS implements RTOSservices …{
port MemService Mem; …
void compute(int time) {
[[
Sheduler.request(B(thisAction),thisProcess);
TimeMgr.request(E(thisAction),
TimeMgr.A(B(thisAction))+time);
Sheduler.request(E(thisAction), rtosProcess);
]]
;
}
…
Metropolis: architecture netlist
Architecture netlist specifies configurations of architecture components.
Each constructor
- instantiates arch. components,
- connects them,
MyArchNetlist
…
…
…
CPU +
OS
Master
Arbiter
RTOS
Bus
Slave
Mem
Mem
Sched
Bus
Arbiter
Meta-model: mapping netlist
MyMapNetlist
B(P1, M.write) <=> B(mP1, mP1.send); E(P1, M.write) <=> E(mP1, mP1.send);
B(P1, P1.f) <=> B(mP1, mP1.compute); E(P1, P1.f) <=> E(mP1, mP1.compute);
B(P2, M.read) <=> B(P2, mP2.receive); E(P2, M.read) <=> E(mP2, mP2.receive);
B(P2, P2.f) <=> B(mP2, mP2.compute); E(P2, P2.f) <=> E(mP2, mP2.compute);
MyFncNetlist
MyArchNetlist
P1
Env1
M
P2
Env2
mP1
mP2
RTOS
Bus
Mem
OsSched
Bus
Arbiter
Outline
• Background
– VCC
– STARS
• VCC-STARS integration
– extend any VCC simulation model with abstractions required by
STARS
• Automatic abstraction generation
– for a class of VCC models
VCC Behavior
• network of behavioral blocks
• many ways to specify a block (BlackBox C++, WhiteBox C, ...)
• simulation used to verify functionality
VCC Architecture
• network of architectural blocks
• needed to determine performance of behavioral blocks
VCC Mapping
• performance of each behavioral block is modeled
• simulation is used to verify performance
BlackBox C++ behavioral blocks
•the only kind understood by VCC simulation core
class fifo:
public FxCPPBlackBoxModel {
InputPort<int> Request, Input;
OutputPort<int> Output;
...
};
void fifo::Run() {
if(Request.Enabled()&& !empty)
Output.Post(FIFOPop());
if (Input.Enabled())
FIFOPush(Input.Value());
...
}
Request
Input
fifo
Output
WhiteBox C behavioral blocks
void point_entry_run() {
Request
if(Request_Enabled()&& !empty)
Input
Output
Output_Post(FIFOPop());
fifo
if (Input_Enabled())
FIFOPush(Input_Value());
...
}
void fifo::Run() {
_delayCycles(60);
if(Request.Enabled()&& !empty){
Output.Post(FIFOPop());
_delayCycles(80);
estimation
}
_delayCycles(75);
if (Input.Enabled()) {
_delayCycles(100);
FIFOPush(Input.Value());
CPU model
} ...
}
Outline
• Background
– VCC
– STARS
• VCC-STARS integration
– extend any VCC simulation model with abstractions required by
STARS
• Automatic abstraction generation
– for a class of VCC models
STatic Analysis of Reactive Systems
play request
network message control
frame
tick
buffer
sample
For all inputs:
• Can I process all workload between two ticks?
• How much bus traffic will I generate?
• How much energy will I use?
Outline
• STARS
– overview
– representing signals
– representing system components
– finding worst-case behaviors
– representing timing information
STARS overview
play request
network message control
frame
tick
buffer
play
sample
frame
tick
SIGNATURE
pl
Fenv
ms
Fcntr
tk
rq
fr
Fbfr
sm
pl = 1
fr = 2
tk = 3
SIGNATURE ABSTRACTION
• STARS finds worst-case signature of any execution window of a
given length
• STARS finds the worst-case CPU busy period
Signatures
• in practice, counting “events”
– state transitions may be considered events
– combinations of events may have separate counters
– may need linear constraints over counters
• less events is “better than” () more events
Signature Abstractions
Estimate output signature based on input signature and length
• must be conservative
system
t
t+T
t
t+T

q
s,T
F
F( s, T)
Signature Abstractions: Environment
play request
network message control
frame
tick
buffer
• at least 625s between messages
– Fms (s, T) = T/625 + 1
• tick has 125s period
– Ftk (s, T) = T/125 + 1
• at most 1 play a second
– Fpl (s, T) = T/1,000,000 + 1
sample
Signature Abstraction: Buffer
play request
network message control
frame
BUFFER:
if ( present ( frame ) {
samples = frame; last = 50; }
if ( present ( tick ) && last > 0) {
emit sample ( samples[ last -- ] );
if ( last == 20 ) emit request(); }
Frq (s, T) = min( fr, tk/30)
Fsm (s, T) = min( tk, 50*fr )
tick
buffer
sample
Fix-point Theorem
If:
• s = F(s, T),
• s is worse than signature of initial state,
then s is worse than signature of any execution segment of
length T
t
t+T
s
Workload Function
Estimates required processor time from signatures
• must be conservative
s
 W(s)
Task 2
Task 1
Idle
Workload Function: VM pager
play request
network message control
frame
BUFFER:
if ( present ( frame ) {
samples = frame;
last = 50; }
if ( present ( tick ) && last > 0) {
emit sample ( samples[ last -- ] );
if ( last == 20 )
emit request(); }
W (s) = 20*fr + 20*sm + ...
tick
buffer
sample
1 line = 10 time units
STARS
1Pick a signature
2Chose a signature abstraction F and workload function W and
verify they and conservative
3Solve
s = F(s,T)
T = W(s)
4T is a bound on response time
the processor cannot be continuously busy for more than
T time units
Outline
• Background
– VCC
– STARS
• VCC-STARS integration
– why, what and how
• Automatic abstraction generation
– for a class of VCC models
Why VCC-STARS?
VCC
play request
network message control
frame
???
???
Fenv
pl
tick
buffer
sample
???
STARS
ms
Fcntr
tk
rq
fr
Fbfr
• cannot relate components to their abstractions
sm
VCC-STARS: What?
• abstract models used by STARS can be validated by VCC
simulation
play request
network message control
frame
tick
buffer
sample
monitor
pl
Fenv
ms
Fcntr
tk
rq
fr
Fbfr
sm
VCC-STARS: How?
BlackBox C++ extensions to represent signatures
• vectors of counter values
• each behavioral block has:
– one counter for each input port
– one counter for each output port
– a counter measuring CPU time usage
– optional user-defined counters
Signature: example
class fifo: public FxCPPBlackBoxModel {
InputPort<int> Request, Input;
OutputPort<int> Output;
starsCounter numExecutions;
... };
counters:
• Output.count
• Input.count
• Request.count
• numExecutions
• the one pointed to by processorTimeCounter()
VCC-STARS: How?
BlackBox C++ extensions to represent signature abstractions
• each block has member function: void starsAbstraction()
• sets bounds of output-port, CPU-usage, and user-defined
counters, based on input-port counters and length of time
• must be conservative:
Run()
t
t+T
t
t+T

sign.
sign.
starsAbstraction()
est. sign.
Signature abstraction example
class fifo: public FxCPPBlackBoxModel {
InputPort<int> Request, Input;
OutputPort<int> Output;
starsCounter numExecutions;
... };
void fifo::Run() {
numExecutions++;
if(Request.Enabled()&& !empty) Output.Post(FIFOPop());
if (Input.Enabled()) FIFOPush(Input.Value());
... }
void fifo::starsAbstraction() {
Output.count.setBound( min( Input.count, Request.count));
numExecutions.setBound( Input.count + Request.count);
... }
Signature abstraction example (cont’d)
delay_model()
{
input(Input);
input(Request);
run();
delay('0.000001');
output(Output);
}
void fifo::starsAbstraction() {
Output.count.setBound(min(Input.count,
Request.count));
numExecutions.setBound(Input.count
+ Request.count);
}
starsCounter * p = processorTimeCounter();
if(p) p->setBound(1000*numExecutions);
Signature abstractions
• may depend on time:
void env::starsAbstraction() {
Burst.count.setBound(mgr()->timeWindow()/625000+1);
}
•mgr() is a manager containing STARS info
• timeWindow() depends on context
– in simulation, it’s the time since monitor creation
– in STARS, it can be a constant
– in STARS, it can be current estimate of the busy-period
starsAbstraction()
• is verified to be conservative by simulation monitors that perform
the following check every time an output counter is changed
– evaluate starsAbstraction() using current values of input
counters
– compare output counters with bounds computed by
starsAbstraction()
– if bounds are violated, warn that starsAbstraction() is not
conservative
• is used by STARS to compute to compute worst-case bounds of
all the counters in the network
Voice Mail Pager
• 16 modules
• ~ 4000 lines of C++ code annotated with timing estimates
• build signature abstractions manually
– 150 lines of C code
VMP First experiment
• model environment so that a single message is received and
then played
– same as VCC test-bench
• max busy period:
– VCC: 82 s (simulating 8s took ~ 30 s)
– STARS: 83 s (took 16 ms to compute)
VMP second experiment
• same as first except:
– don’t limit the environment to a single message
• max busy period:
– STARS 148 s (more than 125 s between two ticks)
– VCC: can find input that has 146 s
50x125
125
1
2
3
29 30 31
message, play
49 50
66s wide window in a 6250 s period
Outline
• Background
– VCC
– STARS
– other related work
• VCC-STARS
– BlackBox C++ extensions
• Automatic abstraction generation
– for WhiteBox C blocks
What?
• abstract models can be automatically generated for WhiteBox C
blocks
pl
Fenv
ms
Fcntr
tick
buffer
sample
VCC-STARS
VCC-STARS
play request
network message control
frame
tk
rq
fr
Fbfr
sm
Automatic abstraction: How?
• WhiteBox C flow in VCC -STARS
Hints
WhiteBox C
CPU model
estimation
annotated
BlackBox C++
signature
abstraction
Automatic abstraction algorithm
starting from:
– input counters
– user hints,
propagate bounds to
bound
propagation
– statements
– output counters
for each output counter with a bound
set its bound to the minimum of all
if each basic block of code has a bound
use VCC delay estimates to bound CPU time
code
generation
Example
void point_entry_run() {
starsIncrement(numExecutions);
if (Request_Enabled()
&& !empty
)
Output_Post(FIFOPop());
if (Input_Enabled())
FIFOPush(Input_Value());
}
Request.count
void fifo::starsAbstraction() {
Output.count.setBound( Request.count );
}
Hints
D1
D2
D3
D4
void point_entry_run() {
starsIncrement(numExecutions);
if (Request_Enabled()
&& !empty
)
Output_Post(FIFOPop());
if (Input_Enabled())
FIFOPush(Input_Value());
}
numExecutions
Request.count
void starsSetBounds() {
numExecutions_SetBound(10);
}
void fifo::starsAbstraction() {
numExecutions.setBound( 10 );
int b = min( numExecutions, Request.count);
Output.count.setBound( b );
starsCounter * p = processorTimeCounter();
if(p) p->setBound(numExecutions*(D1+D3+D4) + b*D2);
}
RESULTS ON AUTOMATIC ABSTRACTION
IMMEDIATE
• generating signature abstractions automatically is undecidable
for arbitrary code
DATE 2000
• if transition relation of a memory-less component is a Boolean
function represented with a BDD then its ideal signature
abstraction can be generated automatically
SASIMI 2001
• generating signature abstraction automatically is possible for
finite-state machines
Related Work
• YAPI-STARS, presented at CODES 2000
– systems in YAPI are networks of concurrent processes, similar to
Khan’s process networks
– YAPI-STARS is good for bounding communication requirements
– no performance analysis
• Program path analysis (Cinderella), Li and Malik 1999
– intended for timing analysis of embedded software
– useful for automatically generating abstractions used by STARS
Conclusions
• STARS adds worst-case analysis to simulation
– can prove that performance requirements are met
– helps find hard performance bugs
• requires additional designer effort to specify abstractions
– typically |STARS abstractions| < 10% * |simulation models|
– even smaller for estimated WhiteBox C
• abstractions can be verified by VCC simulations
• could be applied to any simulation environment where
meaningful counters can be defined
Thank you
Outline
• Background
– VCC
– STARS
– other related work
• VCC-STARS intergration
– BlackBox C++ extensions
• Automatic abstraction generation
– for WhiteBox C blocks
Signature Abstractions
Estimate signature of output counters based on the signature of
input counters
– must be conservative
Run()
t
t+T
t
t+T

sign.
sign.
starsAbstraction()
bound
Proposal
VCC + STARS = VCC-STARS
• Black Box C++ extensions:
– providing signatures of events on ports
– enabling the user to associate a signature abstraction for
each BlackBox C++ block