Laboratory for Foundations of Computer Science. An Unfolding Approach. University of Edinburgh. Model Checking. Javier Esparza

Transcription

1 An Unfoling Approh to Moel Cheking Jvier Esprz Lbortory for Fountions of Computer Siene University of Einburgh

2 Conurrent progrms Progrm: tuple P T 1 T n of finite lbelle trnsition systems T i A i S i i s 0i 1 i n where A i is n lphbet of tions, S i is finite set of (lol) sttes, i S i A i i is trnsition reltion, n s 0i S i is the initil stte

3 REQ0 b0:=f ENT0 REQ1 b1:=f ENT1 b0:=t t=1 b1=f b1:=t t=0 b0=f Exmple t:=0 b0=f t=0 t:=1 b1=f t:=0 b0:=t b0:=f t:=1 t:=0 b1:=t b1:=f t:=1 b0=t t=1 b1=t

4 Semntis The behviour of P is efine by the (rehble subset of) the globl trnsition system where T P A S s 0 A A 1 A n (A prtitione into visible n invisible tions), S S 1 S n (s i enotes the ith omponent of s S), s 0 s 01 s 0n, s s iff for every 1 i n A i s i s i i, n A i s i s i

5 Reuing the moel heking problem The moel heking problem for progrm P T 1 T n n be reue to (severl instnes of) the following problems: The forbien tre problem (FT) Given: Progrm P, tion To eie: Does T P exhibit forbien tre, ie, tre n A suh tht n? The forbien infinite tre problem (FIT) Given: Progrm P, tion To eie: Does T P exhibit forbien infinite tre, ie, n infinite tre A ω suh tht i for infinitely mny i 0? The livelok problem (L) Given: Progrm P, tion To eie: Does T P exhibit livelok, ie, n infinite tre A ω suh tht i for some i, n j is invisible for every j i?

6 A first nlysis Complexity of FT, FIT n L: PSPACE-omplete Stnr solution: ompute the globl trnsition system TP, n use well-known grph lgorithms Time n spe omplexity O TP, but in prtie often O TP 2 Problem: exponentil in the size of P for very esy instnes, eg for ompletely inepenent proesses Our solution: work on the unfoling of the system Compt proof objets, exponentilly smller thn TP in fvourble ses Proof objets of size O TP for FT, n of size O TP 2 for FIT n L In this tlk: only FT n FIT (L more tehnil)

7 b Running exmple s0 r0 b s1 s2 r1 T1 T2

8 The unfoling s0 s0 s0 r0 r0 r0 s1 s1 s1 s2 s2 s2 r1 r1 r1 b b b b b

9 First tree s0 b s1 s2 b b s0 s0 b b s1 s2 s1 s2

10 Seon tree r0 r1 r0 r1 r0 r1

11 An exmple with n 1 In this se P T1 TP s0 s0 s1 s2 s1 s2 s1 s1 s2 s1 s2 s1 s1 s2 s1 s1 s2 s1 s2 s1 s2 s1 s1 s2 s1 s2

12 Solving FT for n 1 Proof tree: Prefix of the unfoling of P A noe n is terminl if (I) it is rehe by n event lbelle by, or (II) the proof tree onstrute so fr ontins noe n lbelle by the sme stte s n A tbleu is (miniml) proof tree suh tht ll leves re terminls A terminl n is suessful if it is of type I A proof tree is suessful if it hs t lest one suessful terminl Theorem: P exhibits forbien tre iff P hs suessful proof tree

13 Generliztion to n 1 First ttempt Problem: Terminls re lol sttes, but terminl s efinition must refer to globl sttes Ie [MMilln 92, 95]: Assoite to eh noe n of the unfoling globl stte GS n s follows: let Hist n be the history of n; let GS n be the result of exeuting Hist n New efinition of terminl: A noe n is terminl if (I) it is rehe by n event lbelle by, or (II) the proof tree onstrute so fr ontins noe n suh tht GS n GS n A terminl n is suessful if it is of type I

14 s0 s0 s0 r0 r0 r0 s1 s1 s1 s2 s2 s2 r1 r1 r1 b b b b b

15 p0 p1 p2 p3 p4 p5 p6 p7 p8 p9 p10 p11 The ttempt fils! p1 1 2 p1 p2 p3 p p5 p6 p7 p8 p5 p6 p7 p p9 p9 p10 p10

16 Aequte orers GS n GS n too wek for terminl An orer on histories is equte if it is well-foune, preserves uslity: if h prefix of h then h h, n is preserve by finite extensions: if h h h h h for ll h h, then We sy n n if Hist n Hist n New efinition of terminl: A noe n is terminl if (I) it is rehe by n -trnsition, or (II) the proof tree onstrute so fr ontins noe n n suh tht GS n GS n A terminl n is suessful if it is of type I Theorem: P hs forbien tre iff it hs suessful tbleu

17 Problem: n n is n itionl onition less ples re terminls proof trees n be bigger! In [MMilln 92]: h h if size of h smller thn size of h Tbleux n be exponentilly bigger thn T P In [E,Römer,Vogler 96, E, Römer 99]: Totl orers Theorem: Any tbleux in whih the events re e in -orer hs size O T P

18 A solution to FIT for n 1 A noe n is terminl if Hist n ontins noe n lbelle with the sme stte s n A terminl n is suessful if Hist n Hist n (the pth from n to n) ontins some -lbelle trnsition Theorem: P exhibits forbien infinite tre iff P hs suessful tbleu Problem: tbleux n be exponentilly lrger thn T P

19 s1 s2 s2 s2 s4 s1 s1 s2 s1 s2

20 A better solution for n 1 New efinition of terminl: A noe n is terminl if there is noe n lbelle with the sme stte s n suh tht n belongs to Hist n, or n oes not belong to Hist n, n Hist n ontins t lest s mny -lbelle trnsitions s Hist n A terminl n is suessful if n belongs to Hist n n Hist n Hist n ontins some -lbelle trnsition Theorem: P hs forbien infinite tre iff it hs suessful tbleu The size of ny tbleu in whih events re e in -orer is O T P 2

21 1 s0 s1 s2 2 3 s1 s2 s s1 s1 s2 9 10

22 Generliztion to n 1 Definition of terminl: A noe n is terminl if there is noe n suh tht GS n GS n, n n n belongs to Hist n, or n oes not belong to Hist n, n Hist n ontins t lest s mny -lbelle trnsitions s Hist n A terminl n is suessful if n belongs to Hist n n Hist n Hist n ontins some -lbelle trnsition Theorem: T P hs forbien infinite tre iff it hs suessful tbleu With the equte orers of [E,Römer,Vogler 96] n [E, Römer 99] the size of ny tbleu is t most O T P 2

23 A suessful tbleu s0 r0 s1 s2 r1 s0 r0 s1 s2 r1

24 System Struture Petri net Prefix BDD size (sle) Ples Trns Globl Sttes Ples Trns (Petrify) CY(12) DPD(7) SR(10) EL(4) PC CP DME(64) RW(10)

25 CY : Cyler (Milner) DPD: Philosophers with elok voine SR: Slotte ring protool EL: Elevtor PC: Proution ell CP: Conurrent Pushers (Heimer) DME: STG speifition of iruit for istribute mutul exlusion RW: Reers n writers (Hellwgner)

26 Unfolings vs BDDs Coneptul similrities n ifferenes: Both tehniques ompress the stte spe BDDs exploit regulrity Unfolings exploit onurreny Consequenes: Robustness: Unfolings less sensitive to hnges in the system Compression: Prefix smller for loosely ouple systems, BDDs smller for tightly ouple systems

27 100 rnom tbles with right-hne, left-hne, n mbiextrous philosophers BDD for the set of rehble sttes (Petrify) Nr of BDD size phil Averge Min Mx StDev Aver/StDev

28 100 rnom tbles with right-hne, left-hne, n mbiextrous philosophers Noes of the omplete prefix (PEP) Nr of Prefix size phil Averge Min Mx StDev Aver/StDev

29 Cheking elok-freeom with BDDs 100 rnom tbles with right-hne, left-hne, n mbiextrous philosophers SMV on SUN Ultr 60, 2 proessors, 640 MB Nr of Time in seons phil Averge Min Mx StDev Aver/StDev

30 Cheking elok-freeom with unfolings 100 rnom tbles with right-hne, left-hne, n mbiextrous-philosophers PEP + stble moels on SUN Ultr 60, 2 proessors, 640 MB Nr of Time in seons phil Averge Min Mx St Dev Aver/St Dev

31 Unfolings vs stubborn sets Coneptul similrities n ifferenes: Both tehniques exploit onurreny Stubborn sets isr informtion Unfolings ompress informtion Stubborn sets re onservtive: smll overhe is gurntee, t the prie of suboptiml reution Unfolings tke risks : lrge overhe is possible, but optiml ompression Consequenes: No loss of informtion All rehbility properties hekble on the sme prefix Cuslity informtion vilble (ex lrm ptterns) Lrger overhes for tightly ouple systems

32 Cheking elok-freom with stubborn sets n unfolings 1 left-hne, 1 right-hne, n n 2 mbiextrous philosophers SUN Ultr 60, 2 proessors, 640 MB Nr of Time in seons phil PROD PEP + smoels

33 Tenttive rules of thumb BDDs more suitble for very regulr systems Stubborn sets n unfolings more suitble for irregulr but onurrent systems Stubborn sets more suitble for systems with little onurreny Unfolings more suitble for highly onurrent systems