An Experiment With Lustre and Real-Time Calculus Introduction du - - PowerPoint PPT Presentation

▶
an experiment with lustre and real time calculus
SMART_READER_LITE
LIVE PREVIEW

An Experiment With Lustre and Real-Time Calculus Introduction du - - PowerPoint PPT Presentation

Aug 08, 2023 193 likes •754 views

Introduction RTC Lustre Lustre+MPA Conclusion An Experiment With Lustre and Real-Time Calculus Introduction du cours Matthieu Moy Verimag Grenoble France December 1, 2008 Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1,

slide-1
SLIDE 1

Introduction RTC Lustre Lustre+MPA Conclusion

An Experiment With Lustre and Real-Time Calculus

Introduction du cours Matthieu Moy

Verimag Grenoble France

December 1, 2008

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 1 / 32 >

slide-2
SLIDE 2

Introduction RTC Lustre Lustre+MPA Conclusion

Summary

1

Introduction : Modular Performance Analysis

2

Real-Time Calculus

3

Lustre

4

Using Lustre inside MPA

5

Conclusion

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 2 / 32 >

slide-3
SLIDE 3

Introduction RTC Lustre Lustre+MPA Conclusion

Motivations

The goal: performance analysis

◮ Timing ◮ Energy (?)

The tools: Formal methods

◮ Will it scale?

The context:

◮ Background in simulation, synchronous systems ◮ ... trying to work with performance models

Who:

◮ Verimag, “synchronous team” ◮ ETHZ, Lothar Thiele and his team ◮ (Combest project) Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 3 / 32 >

slide-4
SLIDE 4

Introduction RTC Lustre Lustre+MPA Conclusion

Modular Performance Analysis (MPA): The Big Picture

events events events events events

Module

(Transformer)

Module

(Transformer)

Module

(Transformer)

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 4 / 32 >

slide-5
SLIDE 5

Introduction RTC Lustre Lustre+MPA Conclusion

Modular Performance Analysis (MPA): The Big Picture

Module

(Transformer)

Module

(Transformer)

Module

(Transformer) behavior timed behavior timed behavior timed behavior timed behavior timed

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 4 / 32 >

slide-6
SLIDE 6

Introduction RTC Lustre Lustre+MPA Conclusion

Modular Performance Analysis (MPA): The Big Picture

Module

(Transformer)

Module

(Transformer)

Module

(Transformer) behavior timed behavior timed behavior timed behavior timed behavior timed

Computed Abstractions Modelling

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 4 / 32 >

slide-7
SLIDE 7

Introduction RTC Lustre Lustre+MPA Conclusion

Modular Performance Analysis: Content

Module

(Transformer)

Module

(Transformer)

Module

(Transformer) behavior timed behavior timed behavior timed behavior timed behavior timed

Computed Abstractions Modelling

What can “timed behavior” be?

◮ Number of events per time unit? ◮ Bounds for number of events? Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 5 / 32 >

slide-8
SLIDE 8

Introduction RTC Lustre Lustre+MPA Conclusion

Modular Performance Analysis: Content

Module

(Transformer)

Module

(Transformer)

Module

(Transformer) behavior timed behavior timed behavior timed behavior timed behavior timed

Computed Abstractions Modelling

What can “timed behavior” be?

◮ Number of events per time unit? ◮ Bounds for number of events? ◮ MPA uses “arrival curves”. Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 5 / 32 >

slide-9
SLIDE 9

Introduction RTC Lustre Lustre+MPA Conclusion

Modular Performance Analysis: Content

Module

(Transformer)

Module

(Transformer)

Module

(Transformer) behavior timed behavior timed behavior timed behavior timed behavior timed

Computed Abstractions Modelling

What can “Modules” be?

◮ FIFO + processing element? ◮ “Service curve” Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 6 / 32 >

slide-10
SLIDE 10

Introduction RTC Lustre Lustre+MPA Conclusion

Modular Performance Analysis: Content

Module

(Transformer)

Module

(Transformer)

Module

(Transformer) behavior timed behavior timed behavior timed behavior timed behavior timed

Computed Abstractions Modelling

What can “Modules” be?

◮ FIFO + processing element? ◮ “Service curve” ◮ Can also be a “program” Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 6 / 32 >

slide-11
SLIDE 11

Introduction RTC Lustre Lustre+MPA Conclusion

The Question...

Module

(Transformer)

Module

(Transformer)

Module

(Transformer) behavior timed behavior timed behavior timed behavior timed behavior timed

Computed Abstractions Modelling

Can we put Lustre in the modules?

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 7 / 32 >

slide-12
SLIDE 12

Introduction RTC Lustre Lustre+MPA Conclusion

Summary

1

Introduction : Modular Performance Analysis

2

Real-Time Calculus

3

Lustre

4

Using Lustre inside MPA

5

Conclusion

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 8 / 32 >

slide-13
SLIDE 13

Introduction RTC Lustre Lustre+MPA Conclusion

Arrival Curves

time events

αu(t): max number of events in any window of size t. αl(t): min number of events in any window of size t.

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 9 / 32 >

slide-14
SLIDE 14

Introduction RTC Lustre Lustre+MPA Conclusion

Arrival Curves

time events #events αu αl 1 2 3 4 5 6 7 1 3 5 6 7 ∆t 4 2

αu(t): max number of events in any window of size t. αl(t): min number of events in any window of size t.

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 9 / 32 >

slide-15
SLIDE 15

Introduction RTC Lustre Lustre+MPA Conclusion

Arrival Curves

time events #events αu αl 1 2 3 4 5 6 7 1 3 5 6 7 ∆t 4 2 ∆t = 2 2

αu(t): max number of events in any window of size t. αl(t): min number of events in any window of size t.

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 9 / 32 >

slide-16
SLIDE 16

Introduction RTC Lustre Lustre+MPA Conclusion

Arrival Curves

time events #events αu αl 1 2 3 4 5 6 7 1 3 5 6 7 ∆t 4 2 ∆t = 2 2 ∆t = 4 4

αu(t): max number of events in any window of size t. αl(t): min number of events in any window of size t.

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 9 / 32 >

slide-17
SLIDE 17

Introduction RTC Lustre Lustre+MPA Conclusion

Service Curves

βu βl αu αl αu′ αl′ βu′ βl′ Element Processing Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 10 / 32 >

slide-18
SLIDE 18

Introduction RTC Lustre Lustre+MPA Conclusion

Service Curves

βu βl αu αl αu′ αl′ βu′ βl′ Element Processing Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 10 / 32 >

slide-19
SLIDE 19

Introduction RTC Lustre Lustre+MPA Conclusion

Service Curves

βu βl αu αl αu′ αl′ βu′ βl′ Element Processing αu′ = ((αu⊕βu)⊕βl) ∧ βu αl′ = ((αl⊗βu)⊗βl) ∧ βl βu′ = (βu − αl)⊗0 βl′ = (βl − αu)⊗0 Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 10 / 32 >

slide-20
SLIDE 20

Introduction RTC Lustre Lustre+MPA Conclusion

RTC: pros and cons

Nice things with RTC

◮ Can model: event flows, simple scheduling policies ◮ Scales up nicely ◮ Library of common behaviors available ◮ Exact hard bounds

Less nice things with RTC

◮ Cannot model: state-based behavior, arbitrary scheduling policies. ◮ Hardly models behavior not in the library (“Hire another Ph.D”

approach).

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 11 / 32 >

slide-21
SLIDE 21

Introduction RTC Lustre Lustre+MPA Conclusion

Allowing more complex behaviors in MPA

αu′ αl′ αl αu back-adapter adapter (Generator?) (Observer?) X

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 12 / 32 >

slide-22
SLIDE 22

Introduction RTC Lustre Lustre+MPA Conclusion

Allowing more complex behaviors in MPA

αu′ αl′ αl αu back-adapter adapter (Generator?) (Observer?) X

X = Arbitrary program ⇒ testing (ETHZ)

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 12 / 32 >

slide-23
SLIDE 23

Introduction RTC Lustre Lustre+MPA Conclusion

Allowing more complex behaviors in MPA

αu′ αl′ αl αu back-adapter adapter (Generator?) (Observer?) X

X = Arbitrary program ⇒ testing (ETHZ) X = Timed automata ⇒ model-checking (Y. Liu in Verimag, K. Lampka in ETHZ, CATS tool by Uppsala).

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 12 / 32 >

slide-24
SLIDE 24

Introduction RTC Lustre Lustre+MPA Conclusion

Allowing more complex behaviors in MPA

αu′ αl′ αl αu back-adapter adapter (Generator?) (Observer?) X

X = Arbitrary program ⇒ testing (ETHZ) X = Timed automata ⇒ model-checking (Y. Liu in Verimag, K. Lampka in ETHZ, CATS tool by Uppsala). X = Lustre ⇒ why we’re here now.

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 12 / 32 >

slide-25
SLIDE 25

Introduction RTC Lustre Lustre+MPA Conclusion

Allowing more complex behaviors in MPA

αu′ αl′ αl αu back-adapter adapter (Generator?) (Observer?) X

Adapted for systems where the complex behavior is local Scales nicely if the complex behavior “islands” are small enough. But: loss of information on the way back to RTC!

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 13 / 32 >

slide-26
SLIDE 26

Introduction RTC Lustre Lustre+MPA Conclusion

Summary

1

Introduction : Modular Performance Analysis

2

Real-Time Calculus

3

Lustre

4

Using Lustre inside MPA

5

Conclusion

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 14 / 32 >

slide-27
SLIDE 27

Introduction RTC Lustre Lustre+MPA Conclusion

Reminder about Lustre

data-flow, synchronous language node counter(x: bool) returns (y: int) let y = 0 -> (if x then pre(y) + 1 else pre(y)); tel pre(y) value of y at the previous instant x -> y x at the first clock tick, y otherwise.

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 15 / 32 >

slide-28
SLIDE 28

Introduction RTC Lustre Lustre+MPA Conclusion

Summary

1

Introduction : Modular Performance Analysis

2

Real-Time Calculus

3

Lustre

4

Using Lustre inside MPA

5

Conclusion

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 16 / 32 >

slide-29
SLIDE 29

Introduction RTC Lustre Lustre+MPA Conclusion

Allowing more complex behaviors in MPA

αu′ αl′ αl αu back-adapter adapter (Generator?) (Observer?) X

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 17 / 32 >

slide-30
SLIDE 30

Introduction RTC Lustre Lustre+MPA Conclusion

Lustre in MPA: Why

First exercise to understand MPA Use of a real programming language to program the behavior. Use of abstract interpretation tools (may scale better that timed-automata model-checking).

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 18 / 32 >

slide-31
SLIDE 31

Introduction RTC Lustre Lustre+MPA Conclusion

Lustre in MPA: The approach

The question: Given a stream of events conforming to αu, αl, what is the best provable curve αu′, αl′ that the output stream conforms with?

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 19 / 32 >

slide-32
SLIDE 32

Introduction RTC Lustre Lustre+MPA Conclusion

Lustre in MPA: The approach

The question: Given a stream of events conforming to αu, αl, what is the best provable curve αu′, αl′ that the output stream conforms with? Natural approach: Generate a stream conforming to αu, αl, and discover the invariant on the output.

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 19 / 32 >

slide-33
SLIDE 33

Introduction RTC Lustre Lustre+MPA Conclusion

Lustre in MPA: The approach

The question: Given a stream of events conforming to αu, αl, what is the best provable curve αu′, αl′ that the output stream conforms with? Natural approach: Generate a stream conforming to αu, αl, and discover the invariant on the output. Simpler approach: Given an arbitrary input stream, find the best αu′, αl′ such that we can prove (input | = αu, αl) ⇒ (output | = αu′, αl′)

◮ We find the curve using a binary search, point by point, ◮ We need only observers. Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 19 / 32 >

slide-34
SLIDE 34

Introduction RTC Lustre Lustre+MPA Conclusion

Lustre in MPA: How

Limitations:

◮ Discrete time ◮ Discrete event ◮ Finite arrival curves

⇒ arrival curves are merely arrays of integers.

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 20 / 32 >

slide-35
SLIDE 35

Introduction RTC Lustre Lustre+MPA Conclusion

RTC Observer in Lustre: the idea

time

n1 n2 n3 n4 n5 n6 n7 # events

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 21 / 32 >

slide-36
SLIDE 36

Introduction RTC Lustre Lustre+MPA Conclusion

RTC Observer in Lustre: the idea

time

n1 n2 n3 n4 n5 n6 n7 # events c4 c3 c2 c1 Key ideas:

◮ At time t, check time windows [t − ∆, t]. Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 21 / 32 >

slide-37
SLIDE 37

Introduction RTC Lustre Lustre+MPA Conclusion

RTC Observer in Lustre: the idea

time

n1 n2 n3 n4 n5 n6 n7 # events c4 c3 c2 c1 c4 c3 c2 c1 Key ideas:

◮ At time t, check time windows [t − ∆, t]. ◮ At time t + 1, reuse counters for time t. Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 21 / 32 >

slide-38
SLIDE 38

Introduction RTC Lustre Lustre+MPA Conclusion

RTC Observer in Lustre: the idea

time

n1 n2 n3 n4 n5 n6 n7 # events c4 c3 c2 c1 c4 c3 c2 c1 c2 = c1+n6 = +n6 c3 c2 Key ideas:

◮ At time t, check time windows [t − ∆, t]. ◮ At time t + 1, reuse counters for time t. Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 21 / 32 >

slide-39
SLIDE 39

Introduction RTC Lustre Lustre+MPA Conclusion

RTC Observer in Lustre: the code

  • - deterministic observer, with 3 counters
  • - (one for each size of interval)

node AC_det (i: int) returns (OK: bool); count1, count2, count3: int; let count1 = i; count2 = i->(pre(count1) + i); count3 = i->(pre(count2) + i); OK = m1 <= count1 and count1 <= M1 and m2 <= count2 and count2 <= M2 and m3 <= count3 and count3 <= M3 and (true -> pre(OK)); -- never be true again

  • - after being false once.

tel (modulo uninteresting details)

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 22 / 32 >

slide-40
SLIDE 40

Introduction RTC Lustre Lustre+MPA Conclusion

RTC and Lustre: the Main Node

node main(in_seq: int) returns (ok: bool) var

  • ut_seq: int;

in_ok: bool;

  • ut_ok: bool

let

  • k = out_ok or (not in_ok);
  • ut_ok = output_observer(out_seq);
  • ut_seq = transformer(in_seq);

in_ok = input_observer(in_seq); tel (modulo uninteresting details)

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 23 / 32 >

slide-41
SLIDE 41

Introduction RTC Lustre Lustre+MPA Conclusion

Writing the module in Lustre: Example

  • - simplest transformer ever:
  • - process everything immediately!

node trivial_transformer (in_seq: int) returns (out_seq: int) let

  • ut_seq = in_seq;

tel

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 24 / 32 >

slide-42
SLIDE 42

Introduction RTC Lustre Lustre+MPA Conclusion

Writing the module in Lustre: Example (2)

  • - shaper: process as fast as possible, but no
  • - faster than max_speed events per ticks.
  • - Accumulate other events in a buffer.

node queue_transformer (in_seq: int; max_speed: int) returns (out_seq: int) var backlog: int; work: int; empty_queue: bool; let

  • - things to do at the current instant (new + past)

work = in_seq -> (in_seq + pre(backlog));

  • - whether we’ll empty the queue at the current instant.

empty_queue = (work <= max_speed);

  • ut_seq = if (empty_queue) then work else max_speed;

backlog = if (empty_queue) then 0 else work - out_seq; tel

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 25 / 32 >

slide-43
SLIDE 43

Introduction RTC Lustre Lustre+MPA Conclusion

Causality Issue

We wanted: (input | = αu, αl) ⇒ (output | = αu′, αl′) We wrote (Lustre):

  • k = out_ok or (not in_ok);

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 26 / 32 >

slide-44
SLIDE 44

Introduction RTC Lustre Lustre+MPA Conclusion

Causality Issue

We wanted: (input | = αu, αl) ⇒ (output | = αu′, αl′) We wrote (Lustre):

  • k = out_ok or (not in_ok);

Not equivalent in general: always(in_ok) ⇒ always(out_ok) = always(in_ok ⇒ out_ok) Condition on in_ok must be causal i.e. any execution verifying in_ok can be continued indefinitely.

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 26 / 32 >

slide-45
SLIDE 45

Introduction RTC Lustre Lustre+MPA Conclusion

Causality problem: Forbidden Regions

∆t #events αl αu

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 27 / 32 >

slide-46
SLIDE 46

Introduction RTC Lustre Lustre+MPA Conclusion

Causality problem: Forbidden Regions

∆t #events αl αu

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 27 / 32 >

slide-47
SLIDE 47

Introduction RTC Lustre Lustre+MPA Conclusion

Causality problem: Forbidden Regions

∆t #events αl αu αu

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 27 / 32 >

slide-48
SLIDE 48

Introduction RTC Lustre Lustre+MPA Conclusion

Causality problem: Forbidden Regions

∆t #events αl αu αu Unsatisfiable

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 27 / 32 >

slide-49
SLIDE 49

Introduction RTC Lustre Lustre+MPA Conclusion

Causality problem: Forbidden Regions

  • ∆t

#events αl αu

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 27 / 32 >

slide-50
SLIDE 50

Introduction RTC Lustre Lustre+MPA Conclusion

Causality problem: our solution

For a given αu, αl, one can compute another αu∗, αl∗ which is causal, and accepts the same behaviors. while (not fixed point) remove unreachable regions make the curve sub-additive end while; αu∗, αl∗ is tighter that αu, αl αu∗, αl∗ is indeed the tightest possible pair of arrival curves.

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 28 / 32 >

slide-51
SLIDE 51

Introduction RTC Lustre Lustre+MPA Conclusion

Summary

1

Introduction : Modular Performance Analysis

2

Real-Time Calculus

3

Lustre

4

Using Lustre inside MPA

5

Conclusion

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 29 / 32 >

slide-52
SLIDE 52

Introduction RTC Lustre Lustre+MPA Conclusion

Summary: the ac2lus toolbox

Works with discrete-time, discrete-event, finite arrival curves. Can generate deterministic observer in Lustre. Curve normalization to make the curves causal before generating the observer. Compute the output curve with a binary search, using nbac. A few simple transformers implemented.

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 30 / 32 >

slide-53
SLIDE 53

Introduction RTC Lustre Lustre+MPA Conclusion

Remaining Issues

Analysis still slow and limited Loss of information when computing output arrival curves Binary search can probably be replaced with invariant discovery.

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 31 / 32 >

slide-54
SLIDE 54

Introduction RTC Lustre Lustre+MPA Conclusion

Future Works

Try tools other than nbac (aspic?) Try variations of the approach

◮ Generators instead of observer ◮ Non-deterministic observer ◮ Specific generator/observers for classes of curves

Performance/precision comparison with other approaches (timed automata, pure RTC, ...).

Matthieu Moy (VerimagGrenobleFrance) RTC/Lustre December 1, 2008 < 32 / 32 >