Learning Concise Models from Long Execution Traces

Abstract

models of system-level behaviour have applications in design exploration, analysis, testing and verification. We describe a new algorithm for automatically extracting useful models, as automata, from execution traces of a HW/SW system driven by software exercising a usecase of interest. Our algorithm leverages modern program synthesis techniques to generate predicates on automaton edges, succinctly describing system behaviour. It employs trace segmentation to tackle complexity for long traces. We learn concise models capturing transaction-level, systemwide behaviourexperimentally demonstrating the approach using traces from a variety of sources, including the x86 QEMU virtual platform and the Real-Time Linux kernel.

Model Synthesis for Communication Traces of System-on-Chip Designs

“…Therefore, solving constraint problems generated from such causality graphs incurs similar complexity, and its runtime performance is largely independent of trace lengths. This observation contrasts our method against previous work such as [4].…”

“…This inconsistencies is due to the ambiguities when finding supports for edges. In this example, since we do not know what the other messages should be correlated with message 1, we consider all possibilities by finding supports for all binary sequences starting with message 1, i.e., (1, 2), (1,4), and…”

“…Many methods and approaches, e.g. [1]- [4], have been proposed to mine patterns or models from traces of various forms. They are inadequate to handle the SoC communication traces considered in this work.…”

“…In [12], the deterministic finite automata inference based on the original evidence-driven state merging method [13] is extended and formulated as a graph coloring problem, which is then solved by a Boolean satisfiability solver. Recently, Trace2Model is introduced in [4] that learns non-deterministic finite automata (NFA) models from software execution traces using C bounded model checking technique. Similar work can also be found in [14] The above approaches do not consider the concurrent nature of communication traces of SoC designs, and they rely on temporal dependencies discovered from traces to identify models.…”

“…Fig. 2 shows the model produced using the method in [4]. Even though this model fits the trace perfectly, it contains message sequences that do not make sense with respect to the ground truth flows.…”