Interval-based resource usage verification by translation into Horn clauses and an application to energy consumption

Abstract

In many applications it is important to ensure conformance with respect to specifications that constrain the use of resources such as execution time, energy, bandwidth, etc. We present a configurable framework for static resource usage verification where specifications can include data size-dependent resource usage functions, expressing both lower and upper bounds. Ensuring conformance with respect to such specifications is an undecidable problem. Therefore, our framework infers resource usage functions (of the same type as the specifications, i.e., data-size dependent, and providing upper and lower bounds), which safely approximate the actual resource usage of the program, and which are safely compared against the specification. We start by reviewing how this framework is parametric with respect to the programming language by a) translating programs to an intermediate representation based on Horn clauses, and b) using the configurability of the framework to describe the resource semantics of the input language. We then provide a more detailed formalization of the approach and extend the framework so that the outcome of the static checking of assertions can generate intervals of the input data sizes for which assertions hold or not, i.e., a given specification can be proved for some intervals but disproved for others. We also generalize the specifications to support preconditions expressing intervals within which the input data size of a program is supposed to lie. Most importantly, we provide new techniques which extend the classes of resource usage functions that can be checked, such as functions containing logarithmic or summation expressions, or some functions with multiple variables. We also report on and provide results from an implementation within the Ciao/CiaoPP framework, as well as on a practical tool built by instantiating this framework for the verification of energy consumption specifications for imperative/embedded programs written in the XC language and running on the XS1-L architecture. Finally, we illustrate with an example how embedded software developers can use this tool, in particular for determining values for program parameters that ensure meeting a given energy budget while minimizing the loss in quality of service.

A General Framework for Static Cost Analysis of Parallel Logic Programs

“…For the remaining cases, where a max(e 1 , e 2 ) appears, we try to eliminate the max operator by proving either e 1 ≤ e 2 or e 2 ≤ e 1 , for any input. In order to do that, we use the function comparison capabilities of CiaoPP, presented in [19,20]. In cases where e 1 and/or e 2 contains non-closed recurrence functions, we use the Z3 SMT solver [7] to find, if possible, a proof either for e 1 ≤ e 2 or e 2 ≤ e 1 , treating the non-closed functions as uninterpreted functions, assuming that they are positive and non-decreasing.…”

Type-Driven Verification of Non-functional Properties

“…To the best of our knowledge, existing approaches are generally limited to a single resource. The few approaches that do trade energy requirements with performance constraints [3,51], with one notable exception [33], treat both properties as a constraint within the compilation/optimisation stage, and do not allow the programmer to reason about them. Conversely, and since the approach presented here builds upon, and uses, existing tools, it is both possible and simple to express assertions about multiple non-functional properties at the program level.…”

“…The aforementioned notable exception, the Ciao Preprocessor system (CiaoPP) [20,33,41], enables the programmer to infer resource usage, and reason about the correctness of programs with respect to resource usage information. CiaoPP achieves this by translating annotated programs in high-level languages, e.g.…”

“…CiaoPP uses its HC IR to derive resource usage information: reporting static resource analyses for both time and energy [33], and memory and the transmission of bits [41]. To the best of our knowledge, no security analyses have thus far been a subject of CiaoPP resource usage analysis.…”

“…Moreover, unlike Drive, CiaoPP does not reflect resource usage values into the original program and thus this information cannot be used in a first-class way. Whilst it should be noted that the underlying Ciao does facilitate first-class resource usage values, CiaoPP does not propagate those values back into the original language [33].…”