Improving the Precision of INCA by Preventing Spurious Cycles Λ

Transcription

1 Improving the Preision of INCA by Preventing Spurious Cyles Λ Stephen F. Siegel Deprtment of Computer Siene University of Msshusetts Amherst, MA George S. Avrunin Deprtment of Mthemtis nd Sttistis University of Msshusetts Amherst, MA ABSTRACT The Inequlity Neessry Condition Anlyzer (INCA) is finite-stte verifition tool tht hs been ble to hek properties of some very lrge onurrent systems. INCA heks property of onurrent system by generting system of inequlities tht must hve integer solutions if the property n be violted. There my, however, be integer solutions to the inequlities tht do not orrespond to n exeution violting the property. INCA thus epts the possibility of n inonlusive result in exhnge for greter trtbility. We desribe here method for eliminting one of the two min soures of these inonlusive results. Ctegories nd Subjet Desriptors D.2.4 [Softwre Engineering]: Softwre/Progrm Verifition Generl Terms Design, Relibility, Verifition Keywords INCA, finite-stte verifition, yles, integer progrmming. INTRODUCTION Finite-stte verifition tools dedue properties of finitestte models of omputer systems. They n be used to hek suh properties s freedom from dedlok, mutully exlusive use of resoure, nd eventul response to request. If the model represents ll the exeutions of system (perhps by mking use of some bstrtion), finite-stte verifition tool n tke into ount ll the exeutions of Λ Reserh prtilly supported by the Ntionl Siene Foundtion under grnt CCR The views, findings, nd onlusions presented here re those of the uthors nd should not be interpreted s neessrily representing the offiil poliies or endorsements, either expressed or implied, of the Ntionl Siene Foundtion, or the U.S. Government. Permission to mke digitl or hrd opies of ll or prt of this work for personl or lssroom use is grnted without fee provided tht opies re not mde or distributed for profit or ommeril dvntge nd tht opies ber this notie nd the full ittion on the first pge. To opy otherwise, or republish, to post on servers or to redistribute to lists, requires prior speifi permission nd/or fee. ISSTA '00, Portlnd, Oregon. Copyright 2000 ACM /00/0008 $5.00. the system. Moreover, finite-stte verifition tools n be pplied t ny stge of system development twhih n pproprite model n be onstruted. Suh tools thus represent n importnt omplement to testing, espeilly for onurrent systems where nondeterministi behvior n led to very different exeutions rising from the sme input dt. The min obstle to finite-stte verifition of onurrent systems is the stte explosion problem: the number of sttes onurrent system n reh is, in generl, exponentil in the number of onurrent proesses in the system. This problem onfronts the nlyst immeditely even for smll systems, the number of rehble sttes n be lrge enough so tht strightforwrd pproh tht exmines eh stte is ompletely infesible nd omplexity results tell us tht there is no wy to void it ompletely. Every method for finite-stte verifition of onurrent systems must py some prie, in ury or rnge of pplition, for prtility. The Inequlity Neessry Conditions Anlyser (INCA) is finite-stte verifition tool tht hs been used to hek properties of some systems with very lrge stte spes. The INCA pproh is to formulte set of neessry onditions for the existene of n exeution of the progrm tht violtes the property. If the onditions re inonsistent, no exeution n violte the property. If the onditions re onsistent, the nlysis is inonlusive; sine the onditions re neessry but not suffiient, it my still be the se tht no exeution of the progrm n violte the property. INCA thus epts the possibility of n inonlusive result in exhnge for greter trtbility. There re two min soures of inonlusive results. In this pper, we show how one of these, used by yles in finite stte utomt representing the omponents of the onurrent system, n be eliminted t wht seems to be only moderte ost. In the next setion, we desribe the INCA pproh. Setion 3 explins our tehnique for improving INCA's preision, nd the fourth setion presents some preliminry dt on its pplition. The finl setion summrizes the pper nd disusses other issues relted to the preision of INCA. 2. INCA A omplete disussion of the INCA pproh, long with reful nlysis of its expressivepower, is ontined in [8]. In this pper, we will use smll (nd quite ontrived) exmple to sketh the bsi INCA pproh nd show how ertin 9

2 yles in the utomt orresponding to the omponents of onurrent system n led to impreision in the INCA nlysis. We refer reders who wnt more detil to [8]. 2. Bsi Approh The bsi INCA pproh is to regrd onurrent system s olletion of ommuniting finite stte utomt (FSAs). Trnsitions between sttes in these FSAs orrespond to events in n exeution of the system. INCA trets eh FSA s network with flow, nd regrds eh ourrene of trnsition from stte s to stte t, orresponding to n event e, s unit of flow from node s to node t. The sequene of trnsitions in prtiulr FSA orresponding to events in segment of n exeution of the system thus represents flow from one stte of the FSA to nother. To hek property of onurrent system using INCA, n nlyst speifies the wys tht n exeution might violte the property in terms of sequene of segments of n exeution. Suppose tht n nlyst wnts to show tht event b n never be preeded by event in ny exeution of the system. A violtion of this property is n exeution in whih ours nd then b ours. In INCA this ould be speified s single segment running from the strt of the exeution until the ourrene of b, with the requirement tht n our somewhere in the segment. (It ould lso be speified s sequene of two segments, the first running from the strt of the exeution until n ourrene of n, nd the seond strting immeditely fter the first nd ending with b. The former speifition is generlly more effiient, but the ltter my provide dditionl preision in some ses. See Setion 2.2.) INCA provides query lnguge llowing the nlyst to speify vrious spets of the segments (lled intervls" in the INCA query lnguge) of exeution. By generting the equtions desribing flow within eh FSA (requiring tht the flow into node equl the flow out) ording to the speified sequene of segments of system exeution, nd dding equtions nd inequlities relting ertin trnsitions in different FSAs ording to the semntis of ommunition in the system, INCA produes system of equtions nd inequlities. Any exeution tht stisfies the nlyst's speifition (nd therefore violtes the property being heked) orresponds to n integer solution of this system of equtions nd inequlities. INCA then uses stndrd integer liner progrmming (ILP) methods to determine whether there is n integer solution. If no integer solution exists, no exeution n violte the property, nd the property holds for ll exeutions of the onurrent system. If there is n integer solution, however, we do not know tht the property n be violted. The system of equtions nd inequlities represents only neessry onditions for the existene of n exeution violting the property, nd it is possible for solution to exist tht does not orrespond to rel exeution. To see more onretely how this works, onsider the Ad progrm shown in Figure. This progrm desribes three onurrent proesses (tsks). Tsk t begins by rendezvousing with tsk t2 t the entry. It then enters loop. At the selet sttement, t nondeterministilly hooses to rendezvous with t2 t entry or with t3 t entry b, if both re redy to ommunite t the pproprite entries. If t pkge simple is tsk t is tsk t2 is entry ; end t2; entry b; entry ; tsk t3 is end t; end t3; end simple; pkge body simple is tsk body t is tsk body t2 is begin begin ept ; t.; loop loop selet t.; ept ; end loop; loop end t2; selet ept ; or ept ; exit; tsk body t3 is end selet; begin end loop; t.b; or end t3; ept b; loop ept ; end loop; end selet; end loop; end t; end simple; Figure : A smll exmple epts ommunition from t2 t entry, itthenenters loop in whih it epts rendezvous t entry until it epts one t entry. If t insted epts ommunition from t3 t entry b, it then tries forever to repetedly rendezvous with t2 t entry. Figure 2 shows the FSAs onstruted by INCA for this progrm. The sttes nd trnsitions re numbered for referene. Eh trnsition in this exmple represents the ourrene of rendezvous between two tsks; in the figure, eh trnsition is lbeled with the entry t whih the orresponding rendezvous tkes ple. Suppose tht we wishtohek tht n ourrene of rendezvous t entry b nnot be preeded by rendezvous t entry. As desribed erlier, we my speify the violtion s segment of n exeution running from the strt of exeution until the ourrene of rendezvous t b nd ontining rendezvous t. The flow equtions for eh tsk will then desribe the possible flows from the initil stte of the tsk to one of the sttes in whih tht tsk ould be t the end of the segment. Sine the segment ends with rendezvous t the entry b, represented by the trnsition numbered 2 in the FSA orresponding to tsk t nd the trnsition numbered 9 in the FSA orresponding to tsk t3, we know tht the FSA t must be in stte 3 nd the FSA t3 must be in stte 8t the end of the segment. Our flow equtions for t therefore desribe flow strting in stte nd ending in stte 3, while the flow equtions for t3 desribe flow strting in stte 7 nd ending in stte 8. For t2, the ft tht rendezvous t ours in the segment implies tht tht FSA must be in stte 6 t the end of the segment, so the flow equtions for t2 desribe flow from stte 5 to stte 6. To produe these flow equtions, let x i be vrible mesur- 92

3 3 b t t2 Figure 2: FSAs for exmple 8 5 t b 6 8 ing the flow long the trnsition numbered i. At eh stte, we generte n eqution setting the flow in equl to the flow out. We must, however, tke into ount the impliit flow of into the initil stte of eh FSA nd the impliit flow of out of the end stte of the flow. Thus, for exmple, the eqution for stte is =x sine the flow in is beuse stte is the initil stte nd the only flow out is on trnsition. Similrly, the eqution for stte 8 is x 9 = sine the only flow in is on trnsition 9 nd there is impliit flow out of sine the flow in this FSA ends in stte 8. To omplete the system of equtions nd inequlities, we must dd equtions to reflet the ft tht the two tsks prtiipting in rendezvous must gree on the number of times it ours. For instne, we need the eqution x 3 + x 4 + x 5 = x 8 sying tht the number of ourrenes of the rendezvous t entry in the FSA for t is the sme s in the FSA for t2. We lso need n inequlity to express the requirement tht there is t lest one ourrene of rendezvous t. We use x 8 to stte this. The full system of equtions nd inequlities used to hek the property tht rendezvous t entry b nnot be preeded by rendezvous t entry is shown in Figure 3. (The desription here is tully somewht oversimplified; INCA performs severl optimiztions to redue the size of the system of inequlities nd the rel system of inequlities produed by INCA would be smller. For exmple, INCA would observe tht there nnot be flow long trnsition 3 in violting exeution (beuse the segment of exeution must end with trnsition 2), nd would eliminte the vrible x 3 from the system. It would lso do form of onstnt propgtion to eliminte other vribles nd equtions.) Flow Equtions: Stte Eqution =x 2 x + x 6 = x 2 + x 4 3 x 2 + x 3 = x x 4 + x 5 = x 5 + x 6 5 =x 7 6 x 7 + x 8 = x =x 9 8 x 9 = Communition Equtions: Entry Eqution x 3 + x 4 + x 5 = x 8 b x 2 = x 9 x + x 6 = x 7 Requirement Inequlity: ours x 8 Figure 3: System of equtions nd inequlities for exmple Essentilly ll reserh on finite-stte verifition tools n be viewed s imed t meliorting the stte explosion problem for some interesting systems nd properties. The pproh tken by INCA voids enumerting the rehble sttes of the system nd is inherently ompositionl, in the sense tht tht the equtions nd inequlities re generted from the utomt orresponding to the individul proesses, rther thn from single utomton representing the full onurrent system. The size of the system of equtions nd inequlities is essentilly liner in the number of proesses in the system (ssuming the size of eh proess is bounded). Furthermore, the use of properly hosen ost funtions in solving the problems n guide the serh for solution. ILP is itself n NP-hrd problem in generl, nd the stndrd tehniques for solving ILP problems (brnh-nd-bound methods) re potentilly exponentil. In prtie, however, the ILP problems generted from onurrent systems hve lrge totlly unimodulr subproblems nd seem prtiulrly esy to solve. Experiene suggests tht the time to solve these problems grows pproximtely qudrtilly with the size of the system of inequlities (nd thus with the number of proesses in the system). Comprisons of this pproh with other finite-stte verifition methods [2, 3, 4, 5] show tht the performne of eh method vries onsiderbly with the system nd property being verified, but tht INCA frequently performs s well s, or better thn, suh tools s SPIN nd SMV. The INCA pproh hs lso been extended to hek timing properties of rel-time systems [, 6] nd to prove tre equivlene of ertin lsses of systems [7]. 2.2 Soures of Impreision The systems of equtions nd inequlities generted by INCA represent neessry onditions for there to be violtion of the property being verified. As noted erlier, however, they only represent neessry, not suffiient, onditions. A solution of the system of equtions nd inequlities my not orrespond to n tul exeution. 93

4 There re two min resons for this. The first hs to do with the order in whih events our. Stritly speking, the equtions nd inequlities generted by INCA refer only to the totl number of ourrenes of the vrious events in eh segment of the exeution, nd do not diretly impose restritions on the order in whih those events our within the segment. In ft, the flow equtions for single FSA typilly imply firly strong onditions on order, but the ommunition equtions relting the ourrene of events in different FSAs do not impose strong restritions on the order of ourrene of events from different proesses. To see why, onsider system omprising two proesses. The first proess begins by trying to ommunite with the seond proess on hnnel A nd then, fter ompleting tht ommunition, tries to ommunite with the seond proess on hnnel B. The seond proess tries to omplete the ommunitions in the reverse order. This system will obviously dedlok, but the equtions generted by INCA would sy only tht the number of ommunitions on eh hnnel in the first proess is equl to the number in the seond proess, llowing solution in whih eh ommunition ours. (This is slight over-simplifition. INCA would tully detet the dedlok in this se, but not in more omplited exmples with severl proesses.) The only mehnism INCA provides for diretly onstrining the order of events in different proesses is the use of dditionl segments of the exeution. While this is often enough to eliminte solutions tht do not orrespond to rel exeutions of the system, it is expensive nd restrits the rnge of pplition of INCA. We will return to this point in the finl setion of this pper. The seond soure of impreision is the existene of yles in the FSAs. Consider the flow eqution for stte 3 tht is shown in Figure 3. Trnsition 3 is self-loop t stte 3, nd flow long tht trnsition ounts both s flow into stte 3 nd out of stte 3. The eqution x 2 + x 3 = x 3 + does not onstrin the vrible x 3 t ll; we n simply nel the x 3 terms. Similrly, thevribles x 5 nd x 8 re not onstrined by the flow equtions in whih they pper. These vribles re onstrined only by the ommunition eqution tht sys x 2 + x 3 + x 5 = x 8. Sine three of these vribles re otherwise unonstrined, this eqution does not restrit the solution set. In ft, lthough the system of Figure hs no exeution in whih prefix ending with rendezvous t entry b ontins rendezvous t entry, there is solution to the system of equtions nd inequlities shown in Figure 3 with x, x 2, x 5, x 7, x 8, nd x 9 ll equl to, nd x 3, x 4, nd x 6 ll equl to 0. In this solution, the requirement tht the number of rendezvous t be t lest is met by setting the unonstrined vribles x 5 nd x 8 to. Figure 4 shows the FSAs with the trnsitions hving flow indited by bold rs. The flow in the FSA for t hs two onneted omponents, one from the initil stte to stte 3, s expeted, nd one mde up of flow in the yle t stte 4, not onneted to the flow from stte to stte 3. It is obvious tht the flow in eh FSA orresponding to n tul exeution must be onneted, so this is spurious solution, one tht does not orrespond to rel exeution. This exmple illustrtes the problem but is not of muh 3 b t t2 8 5 t b 6 8 Figure 4: Solution with disonneted yle independent interest. The sme problem, however, ours with some frequeny in the nlysis of more interesting systems. For instne, in our reent nlysis of the Chiron user interfe development system [2], we enountered solutions with disonneted yles in trying to verify 2 of the 0 properties we heked. In those ses, we were ble to reformulte the properties by speifying dditionl segments, verifying other properties tht llowed us to eliminte some solutions, or hoosing other events to represent the highlevel requirement. These modifitions, however, represent onsiderble expense in inresed nlyst effort nd verifition time. In the next setion, we desribe tehnique for eliminting these solutions with more thn one omponent of flow innfsa. 3. ELIMINATING SPURIOUS CYCLES 3. A Strightforwrd Approh A relted problem is well known in the optimiztion literture. When formulting the Trveling Slesmn Problem s n integer progrmming problem, it is essentil to ensure tht the solution represents single tour visiting ll the ities, rther thn olletion of disonneted subtours eh visiting proper subset of the ities. A stndrd pproh for eliminting solutions with disonneted subtours is to dd inequlities tht prevent the solution from visiting ities in subset U unless the solution inludes n r from ity not in U to one in U. Thus, if the vrible x i;j is if the solution represents tour in whih the slesmn goes diretly from ity i to ity j, nd 0 otherwise, the stndrd formultion of the Trveling Slesmn problem would inlude, for eh j, the inequlity X i x i;j = () to enfore the requirement tht eh ity is entered nd left extly one. To eliminte the possibility of subtour in the subset U we would dd the inequlity X i=2u;j2u x i;j, (2) whih requires tht the slesmn trvel from ity outside U to ity inu. (Of ourse, we need n inequlity like (2) 94

5 for every subset U of size t lest 2 nd t most N 2, where N is the number of ities.) In our se, to prevent solution in whih there is flow in disonneted yle C, we n dd n inequlity requiring tht, when there is flow in C, there must be flow entering C from outside. This is little more omplited thn the sitution for the Trveling Slesmn Problem. In tht se, we knowby () tht the solution must enter eh ityextly one. In our se, we do not wnt to require flow into one of the sttes mking up C unless there is flow long one of the trnsitions in C. For instne, we only wnt to require flow on trnsition 4 in our exmple when there is flow on trnsition 5. To do this in generl, we would need qudrti inequlity suh s x 4x 5 x 5. (3) Integer qudrti progrmming is, however, muh hrder thn integer liner progrmming nd we would like to void introduing qudrti inequlities. The stndrd tehnique is to impose n upper bound B on ll the vribles (i.e., to ssume tht no trnsition ours more thn B times), nd to reple the qudrti inequlity (3) with the liner inequlity x 5 Bx 4» 0. (4) The integer solutions of (3) hving x 4;x 5» B re extly the sme s those of (4). (We note tht imposing n upper bound on ll the vribles would men tht INCA's nlysis is no longer stritly onservtive. If the system of inequlities hs no solutions with the x i ll less thn or equl to B, we only know tht no exeution on whih eh trnsition ours t most B times n violte the property. Sine B n be tken to be quite lrge, suh s0; 000 or 00; 000, this restrition is unlikely to be serious one in prtie.) The problem with these pprohes is tht they my require too mny extr inequlities. The number of subtours tht hve to be eliminted in the Trveling Slesmn Problem is essentilly the number of subsets of the set of ities nd is lerly exponentil in the number of ities. Similrly, the number of yles in n FSA n be essentilly equl to the number of subsets of its set of sttes. We hve onstruted smll onurrent Ad progrm with only 90 lines of ode in whih the FSA for one tsk hs only 42 sttes but hs,60,290,624 distint subsets of sttes eh forming t lest one yle. An integer progrmming problem with tht mny inequlities is infesible. A better method is required. 3.2 A More Prtil Method In this setion, we desribe method for preventing spurious yles tht requires, for eh FSA nd segment of exeution, S + T new vribles nd S +2T new inequlities, where S is the number of sttes in the FSA nd T is the number of trnsitions. The bsi ide is essentilly s follows. Suppose we hve solution to the system of equtions nd inequlities originlly generted by INCA. For eh FSA nd eh segment of exeution, we ttempt to onstrut subgrph with the sme verties s the FSA but whose edges re subset of those tht hve positive flow in the solution. We require tht (i) if there is flow intovertex v in the solution, some edge terminting in v must our in the subgrph, nd (ii) eh vertex v of the subgrph n be ssigned depth" d v in suh wy tht the depth of given node is greter thn tht of ny of its predeessors in the subgrph. If the originl solution hs no disonneted yles, we n hoose for our subgrph spnning tree for the edges with flow nd tke the depth of vertex to be the distne from the root of the tree to the vertex. If the solution hs disonneted yle C, however, we nnot onstrut suh subgrph. To see why, suppose we ould onstrut the subgrph, nd let v be vertex in C for whih d v» d u for ll u 2 C. Sine there is flow into v in the solution, v must hve some predeessor u in the subgrph. Sine the yle C is disonneted from the flow strting t the initil stte of the FSA, the stte u must lso lie in C. But if u is predeessor of v in the subgrph, we hve d v >d u, ontrditing the minimlity ofd v on C. Of ourse, we do not wnt to onsider the possible solutions to the system of equtions nd inequlities generted by INCAonet time, ttempting to onstrut the subgrph seprtely for eh solution. Insted, we dd new vribles nd inequlities, leding to n ugmented system of equtions nd inequlities whose integer solutions orrespond extly to the integer solutions of the originl system for whih the pproprite subgrph n be onstruted. We desribe the proedure for generting this ugmented system for the se of single FSA F nd single segment of exeution. For eh vrible x i in the originl system orresponding to trnsition in F,weintrodue new vrible s i with bounds 0» s i». (5) This vrible will be ifthe orresponding edge is in the subgrph, nd 0 otherwise. For eh stte v in F,weintrodue new vrible d v with bounds 0» d v» N, (6) where N is some integer whih is t lest the mximum length of ny non-self-interseting pth through the FSA. For instne, N nbetken to be the numberofsttesin F. The vrible d v will be the depth of v. We then generte inequlities involving these new vribles. Eh vrible s i orresponds to trnsition from some stte u of F to stte v. We generte the inequlities x i s i (7) d v d u +(N +)s i N. (8) The first inequlity sys tht s i must be 0 if x i is 0, so tht the orresponding edge n be in the subgrph only if the solution hs positive flow long tht edge. The seond inequlity requires tht d v be greter thn d u if the edge from u to v is in the subgrph. If the edge is not in the subgrph (i.e., if s i is 0), the inequlity reds d v d u N, nd the bounds on d v nd d u mke thtvuous. Finlly, let In(v) denote the number of trnsitions into the stte v. For eh sttev of F, other thn the initil stte, 95

6 we generte the inequlity B In(v) X j s j X j x j, (9) where the sums re tken over ll trnsitions into the stte v nd B is n upper bound on ll the vribles. (As noted erlier, B n be tken to be quite lrge.) If ll the x j re 0, this inequlity isstisfiedvuously, but if ny x j is positive, the inequlity fores some s j to be positive. This mens tht, in solution with flow into stte v, some edge terminting in v belongs to the subgrph. The rgument skethed t the beginning of this setion proves the following theorem, showing tht this method elimintes only solutions with disonneted yles. Theorem. Let P be the system of equtions nd inequlities generted by INCA to hek prtiulr property of given onurrent system. Let P 0 be the ugmented system onstruted from P s desribed bove. A solution of P 0 ssigns vlues to ll the vribles in P s well s dditionl vribles; we thus obtin n ssignment of vlues to the vribles in P from solution to P 0 by projetion. The set of integer solutions of P with ll vribles tking vlues t most B ndnodisonneted yles is extly equl to the set of projetions of integer solutions of P 0 with ll vribles tking vlues t most B. In generl, query n speify more thn one exeution segment, so the sitution is bit more omplited. In the generl se, INCA onstruts flowgrph s follows. First, it retes one opy of eh FSA for eh segment speified in the query. Eh opy n then be optimized independently, removing unneessry sttes or trnsitions, bsed on the restritions imposed in the query for tht segment. As seen in the exmple in Setion 2., INCA n determine from the query the sttes in whih eh FSA ould be t the end of eh segment. It then dds onnet" edge from eh of the possible end sttes for segment i to the orresponding stte in segment i +. These edges onnet the flow representing events in one segment of n exeution to flow inthe next segment. Finlly, n initil node is dded with onnet edges to ertin sttes in the first segment ofeh tsk, nd finl node is dded with inoming onnet edges from the possible end sttes in the finl segment of eh tsk. This flowgrph is the tul struture whih INCA uses to generte the ILP system. The lgorithm desribed in this setion n tully be pplied to ny subset of verties in the flowgrph, rther thn to the whole flowgrph, thereby eliminting only those spurious solutions in whih there is disonneted yle ontined in tht subset. For given subset W of verties of the flowgrph, one n form new grph V s follows. Crete vertex in V for eh vertex in W, nd lso dd n initil nd finl vertex to V. For eh edge joining two verties in W, rete orresponding edge in V. For eh edge originting outside W nd terminting in W, rete orresponding edge in V from the initil vertex to the orresponding vertex. For eh edge originting in W nd terminting outside of W, rete orresponding edge in V from the orresponding vertex to the finl vertex. Eh edge in V hs ssoited to it n ILP vrible, whih is the vrible ssoited to the orresponding edge in the originl flowgrph. So we n pply the lgorithm to V, generting new vribles nd inequlities whih re dded to those INCA originlly produed from the flowgrph, nd the sme rguments given bove go through. Restriting the lgorithm in this wy hs mny prtil pplitions. Suppose, for exmple, tht solution ontins single disonneted yle. It is ler tht tht yle must lie within single segment of single tsk in the flowgrph. Tht is beuse there re no edges from stte in one segment to stte in preeding segment, nd there re no edges from sttes of one tsk to nother. Now, to pply the yle-elimintion lgorithm to the entire flowgrph mightbe very expensive, both in terms of the time nd memory to generte the new vribles nd onstrints, nd the time nd memory needed by the ILP tool to solve the new system. In this se, it mkes sense to pply the lgorithm only to the problemti segment of the problemti tsk. Typilly, the segments behve quite independently, nd the existene of spurious yles in one segment is not relted to the existene of spurious yles in other segments. One might be tempted to be s onservtive s possible nd pply the yle-elimintion lgorithm to only those verties involved in the offending yle. This is usully fruitless, s, more often thn not, nother spurious solution will be found by expnding the yle to inlude other verties. However, no mtter how muh the yle expnds, it still must lie entirely in the single segment of the single tsk, nd therefore the best strtegy might be to pply the lgorithm to the entire problemti segment in tht tsk s soon s one spurious yle ppers there. 4. PRELIMINARY EXPERIMENTS The urrent version of INCA onsists of bout 2,000 lines of Common Lisp. INCA writes out file desribing the system of equtions nd inequlities in stndrd formt (the MPS formt), nd we then use ommeril pkge lled CPLEX to red this file nd solve the system. (We lso use seprte progrm to trnslte Ad progrms into the ntive input lnguge of INCA). The optimiztions INCA uses to redue the numberof vribles nd inequlities mke the introdution of new vribles nd inequlities somewht omplited, nd integrting our method into INCA will involve substntil progrmming effort. For our initil explortion of the effet of pplying our method, we hve therefore hosen to proeed by modifying the MPS file produed by INCA. We hve written Jv progrm tht reds this file, nd file desribing the flowgrph, nd produes new MPS file representing the ugmented system of equtions nd inequlities. We n then ompre the performne of CPLEX on the originl system nd the ugmented system. At this stge, however, we nnot mesure how long it would tke INCA to generte the ugmented system of equtions nd inequlities. For these experiments, we used INCA version 3.4, Hrlequin Lispworks 4..0, nd CPLEX version 6.5. on Sun Enterprise 3500 with two proessors nd 2 GB of memory, running Solris 2.6. The upper bound B representing the mximum number of times n edge my betrversed in violting ex- 96

7 eution ws tken to be 0; 000. We used the defult options on CPLEX, exept for the following hnges: mip strtegy nodeselet ws set to 2, mip strtegy brnh ws set to, nd mip limits solutions ws set to. (The first two ffet hoies mde in the brnh-nd-bound lgorithm nd the third stops the serh ssoonsninteger solution is found.) For eh ILP problem, we rncplex five times nd took the verge time. The times reported here were olleted using the time ommnd, nd inlude both user nd system time. time (seonds) Conlusive result with yle elimintion Spurious solution without yle elimintion 4. A Slble Version of the Exmple from Setion 2 For the first experiment, we reted slble version of the simple exmple desribed in Setion 2.. Given n integer n, we modified the Ad progrm in Figure to hve n opies of tsk t2 nd to hve n + lterntives in the outer selet sttement. Eh of the new opies of tsk t2 lls the sme entries in t. (In detil, we repled tsk t2 with n opies of itself, lling these t, :::,tn. In the body of t, we repled the first ept line with n opies of itself nd repled the body of text beginning with the first ept nd ending with the lst or with n opies of itself.) As before, we wishtoverify tht rendezvous t entry n never preede rendezvous t entry b. INCA onstruts n FSA for t in whih there re 2n+4 nodes nd 4n 2 +3 edges. (The piture is slightly different from wht one might expet beuse we hve dded strt vertex nd n end vertex, nd INCA performs some trimming of the FSA.) There re 2 n + n distint subsets of the vertex set for t whih form yles. For eh n, INCA finds spurious solution involving disonneted yle in t. Applying the lgorithm in Setion 3.2 to the portion of the flowgrph oming from the FSA for tsk t, however, yields n ILP problem tht CPLEX reports hs no integer solutions, thus verifying tht n n never preede b. For n 3, the number of vribles in the INCA-generted ILP system is 4n 2 +2n, nd the number of onstrints (equtions nd inequlities) is 5n +. The number of vribles in the new system is (4n 2 +2n)+(4n 2 +2n +7)=8n 2 +4n +7; nd the number of onstrints is (5n +)+(8n 2 +2n +9)=8n 2 +7n +0: The time tht it tkes CPLEX to find spurious solution to the originl system nd the time it tkes to determine the inonsisteny of the ugmented system re shown in Figure 5. These times re very modest, ll under 0 seonds, nd re in ft dwrfed by the time it tkes INCA to generte its internl representtions of the problem nd the originl ILP system. (For n = 30, this ws bout 30 minutes.) It seems, however, tht for lrge n, the substntil inrese in the number of onstrints in the ugmented system, due to the lrge number of edges in the FSA for t, does begin to hve signifint impt on the time to solve the ILP problem n Figure 5: CPLEX times for sled simple exmple 4.2 Spurious Cyles in Chiron The seond experiment involves the Chiron user interfe system [9]. A Chiron lient omprises some bstrt dt types to be depited, rtists tht mintin mppings between these ADTs nd the visul objets ppering on the sreen, nd runtime omponents tht provide oordintion. In prtiulr, ertin events inditing hnges in the stte of the ADTs re defined, nd n ADT Wrpper tsk notifies Dispther tsk whenever n event ours. The Dispther mintins n rry for eh event tht reords whih rtists re interested in being notified of tht event. (Artists register nd unregister for n event to indite their urrent interest in being notified.) After reeiving the event from the ADT Wrpper, the Dispther then loops through the rtists in the pproprite rry nd lls n entry in eh rtist to notify it of the event. The Chiron rhiteture is highly onurrent nd even toy Chiron interfe represents bout 000 lines of Ad ode. In [2], we ompred the performne of severl finite-stte verifition tools (FLAVERS, INCA, SMV, nd SPIN) in heking number of properties of Chiron interfe with two rtists nd n different kinds of events, for n rnging from 2 to 70. One of the properties we wishtoverify bout this system, lled Property 4 in [2], is tht the Dispther notifies the rtists of the right event. For exmple, if the Dispther reeives event e from the ADT Wrpper, we wish to show tht it does not notify ny rtist of event e2 until it hs notified the pproprite rtists of e. To formulte this property s n INCA query tkes 2 segments. We wereinftbletoverify this property using INCA, but only in systems where the number of kinds of events, n, is t most 5. (FLAVERS nd SPIN were ble to verify this property up to t lest n = 40 nd n = 36, respetively.) To sle the problem further with INCA, we needed to deompose the Dispther tsk into subsystem. This entils reting new tsk Dispth ei, for i = ;::: ;n, whih mintins the rry for event ei. The Dispther tsk itself is left s n interfe whih just psses register, unregister, nd notifition requests on to the pproprite Dispth ei in wy suh tht no dditionl onurreny is introdued. 97

8 (If the internl ommunitions of the Dispther subsystem re hidden, the new system is observtionlly equivlent to the originl one.) This deomposed system hs the dvntge tht s n inreses, the size of eh Dispth ei FSA remins onstnt, lthough the number of these tsks inreses. While in generl this deomposition gretly improves the performne of INCA, for this property INCA yields n inonlusive result. The problem is disonneted yle in the tsk Dispth e in the seond segment. time (seonds) Conlusive result with yle elimintion Spurious solution without yle elimintion To get round this problem, we reformulted the property using different events to represent the high-level property. This depended on the prior verifition of other properties relting the events used in the originl nd new formultions nd ws umbersome nd time-onsuming. (One the property ws reformulted, however, the performne of INCA on this deomposed system ws onsiderbly better thn tht of the other tools. By n = 30, the INCA time ws lredy roughly n order of mgnitude better thn the times for the other tools nd INCA ould verify the property for muh lrger vlues of n. The differenes in performne of the tools on this property, for the two versions of the Chiron system, re typil of wht we observed on other properties. The implitions of this re disussed in [2].) Using the yle elimintion lgorithm desribed here, we were ble to verify the originl property diretly, for 2» n» 70. In this se there re 23 nodes nd 63 edges in the problemti tsk/segment for ll n. Hene for eh n our lgorithm dds 86 vribles nd 48 onstrints to the ILP system. For n 3, the number of vribles in the originl system is 82n + (n); where (n) is 58, 8, or 84, ording s n is ongruent modulo 3 to 0,, or 2, respetively. (This reflets the wy we hose to hve rtists register for events s we sled up the number of events.) The number of onstrints in the ugmented system is (33n +»(n))=3; where similrly the vlue of»(n) is 95, 28, or 235. In this se, eliminting spurious yles dds onstnt number of vribles nd onstrints s n inreses. The CPLEX times for eh n, for the originl system for whih CPLEX found spurious solution nd the result of the nlysis ws inonlusive, nd for the ugmented system for whih the property ws onlusively verified, re given in Figure 6. Agin, the times re ll under 5 seonds nd represent very smll portion of the totl nlysis time. (For n = 70, this ws bout 2.5 minutes.) The spike t n = 55 in the CPLEX time for the ugmented system seems to be due to the ourrene of ertin numeril problems for this prtiulr system. 4.3 The Cost of Unneessrily Preventing Spurious Cyles We lso tried dding the yle elimintion vribles nd onstrints to system whih lredy yielded onlusive result. This might yield insight into the mrginl ost of hving INCA dd yle elimintion by defult for ny problem. For this experiment, we used nother property from [2]. In events Figure 6: CPLEX times for Chiron Property 4 this se, we used Property b, whih sys tht n rtist never unregisters for n event unless it is lredy registered for tht event. As in [2], we restrited ourselves to heking this for single rtist nd event. The resulting property requires 2 segments for its formultion s n INCA query. Using the deomposed dispther version of the lient ode, INCA verified this property without ny need for yle elimintion, for n» 70. The number of vribles in the INCAgenerted ILP system (for n 3) is 00n + ff(n); where ff(n) is 77, 46, or 07 ording s n is ongruent modulo 3 to 0,, or 2, respetively. The number of onstrints is 5n + fi(n); where similrly fi(n) is 69,96,or 8. We then pplied the yle-elimintion lgorithm to ll of the n + 6 FSAs (rell tht there is seprte Dispth ei for eh of the n event types) nd both segments. (In the experiment disussed in the previous setion, we only pplied the lgorithm to one FSA nd one segment.) This entiled dding (457n + μ(n))=3 new vribles to the system, where μ(n) is 552, 833, or 682, nd dding (790n + ν(n))=3 new onstrints, where ν(n) is 897, 39, or 23. The times required by CPLEX to find the onlusive result in eh se re grphed in Figure 7. Although the ILP systems in the ugmented se re quite lrge (8,087 vribles nd 22,563 onstrints for n = 70) for the lrger n, it still ppers tht CPLEX n determine the inonsisteny of the system in very short time (less thn 4 seonds). If this exmple is typil, the rel ost in introduing yle elimintion in INCA might lie in generting the new ILP system, not in solving it. 98

9 4 3 Conlusive result with yle elimintion Conlusive result without yle elimintion would be fr too lrge to solve. The numbers of new vribles nd inequlities introdued by the method presented in this pper re liner in the number of sttes nd trnsitions in the FSAs representing the proesses of the onurrent system being nlyzed. time (seonds) events We hve reported here the results of some preliminry experiments imed t ssessing the ost, in inresed time to solve the systems of equtions nd inequlities, of pplying our method. These experiments suggest tht the ost is reltively smll, espeilly when the effort of the humn nlysts is tken into ount. We pln to rry out dditionl experiments of the sme type, nd to integrte our tehnique into the INCA toolset so tht we n lso evlute the time needed to generte the dditionl vribles nd inequlities. Figure 7: CPLEX times for Chiron Property b 5. CONCLUSIONS AND FUTURE WORK Some finite-stte verifition tools lwys provide onlusive result on ny problem they n nlyze. A tool tht wlks grph of the rehble sttes of onurrent system will never report tht the system might dedlok when in ft the system is dedlok-free (ssuming, of ourse, tht the grph orretly represents the rehble stte spe of the system). But suh tool must be ble to store the full set of rehble sttes, nd is unble to report ny results for system whose rehble stte spe exeeds the storge vilble. Other tools, suh s INCA, delibertely overestimte the olletion of possible exeutions of the system, nd thus ept the possibility of inonlusive results (or spurious reports of the possible fults), in order to inrese the rnge of systems to whih they n be pplied. For INCA, there re two min soures of impreision in the representtion of exeutions of the system. The first of these is the ft tht semnti restritions on the order of ourrene of events in different onurrent proesses re generlly not represented in the equtions nd inequlities used by INCA. The seond soure of impreision is the ft tht the equtions nd inequlities llow solutions in whih the flow in the FSA representing onurrent proess my hve yles not onneted to the initil stte. In this pper, we hve shown how impreision used by this seond soure my be eliminted. Speifi ses of inonlusive results n often be ddressed by reful reformultion of the property being heked, lthough this my require the verifition of dditionl properties to justify the reformultion. This proess n require very substntil mounts of effort on the prt of the humn nlysts, s well s onsiderble osts to rry out the neessry verifitions. We hve lso sometimes ddressed inonlusive results by mnully inserting speil inequlities to prevent disonneted flow on smll number of speifi yles. The problem with generlizing this pproh is tht the number of yles my well be exponentil in the size of the onurrent system, nd eh of the yles requires seprte inequlity. Even if it were fesible to utomte the genertion of these inequlities, the resulting ILP problems We re lso investigting pprohes to eliminting some of the impreision used by not representing restritions on the order of events in different proesses. Fully representing the restritions imposed by the semntis of the progrmming lnguge or design nottion my not be prtil nd might limit the pplibility of INCA in the sme wy tht hving to store the full set of rehble sttes limits the pplibility of tools bsed on exploring the grph of rehble sttes. We re therefore exploring methods tht llow the nlyst to ontrol the degree to whih restritions on order re represented. For exmple, one pproh tht we re onsidering is to formulte some of the flow ndommunition equtions in suh wy tht they hold t every stge of n exeution, not just the end. These reformulted flow nd ommunition equtions therefore enfore some of the restritions on the order of events in different proesses. They lso determine region in n-dimensionl Euliden spe, where n is the number of vribles in the system of equtions nd inequlities. We then look for point stisfying the full system of equtions nd inequlities tht n be rehed by tking ertin integer-sized steps through this region. Suessfully reduing this kind of impreision will be importnt in pplying the INCA pproh to mny systems where interproess ommunition is only through ess to shred dt. 6. REFERENCES [] G. S. Avrunin, J. C. Corbett, L. K. Dillon, nd J. C. Wileden. Automted derivtion of time bounds in uniproessor onurrent systems. IEEE Trns. Softw. Eng., 20(9):708 79, Sept [2] G. S. Avrunin, J. C. Corbett, M. B. Dwyer, C. S. P s renu, nd S. F. Siegel. Compring finite-stte verifition tehniques for onurrent softwre. Tehnil Report UM-CS , Deprtment of Computer Siene, University of Msshusetts Amherst, Nov URL: edu/~vrunin/reent_pubs/ompring.ps. [3] A. T. Chmillrd, L. A. Clrke, nd G. S. Avrunin. An empiril omprison of stti onurreny nlysis tehniques. Tehnil Report 96-84, Deprtment of Computer Siene, University of Msshusetts, 996. Revised My 997. [4] J. C. Corbett. An empiril evlution of three 99

10 methods for dedlok nlysis of Ad tsking progrms. In T. Ostrnd, editor, Proeedings of the 994 Interntionl Symposium on Softwre Testing nd Anlysis (ISSTA), pges , Settle, WA, Aug ACM Press (Proeedings ppered s speil issue of Softwre Engineering Notes). [5] J. C. Corbett. Evluting dedlok detetion methods for onurrent softwre. IEEE Trns. Softw. Eng., 22(3):6 79, Mr [6] J. C. Corbett nd G. S. Avrunin. A prtil method for bounding the time between events in onurrent rel-time systems. In T. Ostrnd nd E. Weyuker, editors, Proeedings of the 993 Interntionl Symposium on Softwre Testing nd Anlysis (ISSTA), pges 0 6, Cmbridge, MA, June 993. ACM Press (Proeedings ppered in Softwre Engineering Notes, 8(3)). An updted version is vilble t isst_updte.ps. [7] J. C. Corbett nd G. S. Avrunin. Towrds slble ompositionl nlysis. In D. Wile, editor, Proeedings of the Seond ACM SIGSOFT Symposium on Foundtions of Softwre Engineering, pges 53 6, New Orlens, De ACM Press (Proeedings ppered in Softwre Engineering Notes, 9(5)). [8] J. C. Corbett nd G. S. Avrunin. Using integer progrmming to verify generl sfety nd liveness properties. Forml Methods in System Design, 6:97 23, Jnury 995. [9] K. Forester, C. MFrlne, M. Cmeron, nd G. Boler. Chiron- user mnul. Ardi Doument UCI-93-07, University of Cliforni, Irvine, Sept