Reduced Ordered Binary Decision Diagrams

Size: px

Start display at page:

Download "Reduced Ordered Binary Decision Diagrams"

Morris Heath
6 years ago
Views:

1 Symbolic Model Checking : Decision Diagrams and Symmetries Yann Thierry-Mieg November 6 ICTAC 6 Tunis, Tunisia Reduced Ordered Binary Decision Diagrams (RO)BDD BDD for Model-checking BDD extensions Exploiting Symmetries

2 Binary Decision Diagrams Y. Thierry-Mieg November6 3 Most cited document in computer science according to citeseer :. Graph-Based Algorithms for Boolean Function Manipulation Bryant (986) In this paper we present a new data structure for representing Boolean functions and an associated set of... Introduces Reduced Ordered Binary Decision Diagrams (RO)BDD What is a (RO)BDD? A compact data structure to represent boolean functions BDD : an example : f = ( a b) c Y. Thierry-Mieg November6 4 An ordered (a<b<c) binary decision diagram for f :

3 BDD : an example : f = ( a b) c Y. Thierry-Mieg November6 5 Reduction : single occurrence of terminals BDD : an example : f = ( a b) c Y. Thierry-Mieg November6 6 Recursively from terminals : single occurrence of any node Uses a unicity table for nodes (hash table) Node hash key based on : node + hash key of sons 3

4 BDD : an example : f = ( a b) c Y. Thierry-Mieg November6 7 Remove useless nodes Criterion : variable value does not influence truth value of formula <=> both son arcs point to me node Properties of ROBDD Y. Thierry-Mieg November6 8 4

5 Properties of BDD : Choice of an order Y. Thierry-Mieg November6 9 Model checking and BDD (RO)BDD BDD for Model-checking BDD extensions Exploiting Symmetries 5

6 Representing a state-space using DD Y. Thierry-Mieg November6 Principle : A path in the structure represents a reachable state A state S is described by the value of its state variables Example : A mutual exclusion protocol for process p and p Example Y. Thierry-Mieg November6 6

7 Example Y. Thierry-Mieg November6 3 P Good representation for Globally Asynchronous Locally Synchronous (GALS) systems : Independence of local actions (t and t) is well captured P Variable Ordering issues Y. Thierry-Mieg November6 4 P P P P 7

8 Growth in node size w.r.t. order Y. Thierry-Mieg November6 5 Nb Proc 5 Nb States 44 Consecutive order 6 4 Interlaced order 6 Linear growth vs exponential growth for poor ordering clearly visible Linear growth of representation but exponential growth of state-space size with appropriate ordering!! e For some problems BDD based techniques allow to go much further than explicit representation techniques 3.486e+9 6 -out of ram- Efficiency of BDD Y. Thierry-Mieg November6 6 Computations on BDD use a cache to limit complexity Cache is of the form Key:<operation, operand_,..,operand_n >-> value:result Where operands and result are BDD nodes Example : Cache : contains <union, a, b > -> c if (a U b) = c 8

9 union of BDD Y. Thierry-Mieg November6 7 union (a,b) If (a= or b=) return b; If (a= or b=) return a; If (a=b) return a; If ( <union,a,b> -> r in cache ) return r; BDD r= createbdd( => union(a[],b[]), => union(a[],b[]) ) Cache.add( <union,a,b> -> r) Return r; Complexity of BDD operations Y. Thierry-Mieg November6 8 createbdd uses a unicity table based on node structure Hash on value of son nodes Operation cache => complexity proportional to #nodes(a) x #nodes(b) => number of nodes Without it complexity would be proportional to number of PATHS in the structure Intersection differs from union only in terminal cases If (a = or b = ) return b If (a = or b = ) return a 9

State space computation Y. Thierry-Mieg November6 9 Classic algorithm is based on Breadth-first exploration BFS Consider a system composed of k state variables (i.e. state space represented as a k-level BDD) Transition relation represented using k variables (i,j) = (i,j,.

10 State space computation Y. Thierry-Mieg November6 9 Classic algorithm is based on Breadth-first exploration BFS Consider a system composed of k state variables (i.e. state space represented as a k-level BDD) Transition relation represented using k variables (i,j) = (i,j,..ik,jk) System can go from i to j in one step A special synchronized product (relational product) operation is defined to apply such a transition to a system p New p Transition BDD for Next(t) p Paths to terminal not represented Useless variables removed New p Y. Thierry-Mieg November6 Slide by G. Ciardo

11 Combining transitions Y. Thierry-Mieg November6 BDD representing transitions can be combined using union Full transition relation NextAll = union ( Next(t)+..+Next(tn) ) Algorithm for BFS(s) S := S N := While (N!= S) N := S S := S U NextAll(S) Return S Symbolic Model Checking: States and Beyond (LICS 99) Burch, Clarke, McMillan, Dill, Hwang State space representation size Y. Thierry-Mieg November6 BFS performs better than the intuitive algorithm Size of representation is not directly linked to number of states manipulated Re-evaluating a transition on an already reached state is likely to ctose a cache-hit thus has experimentally low cost. Algorithm for newbfs(s) S := S N := S While (N!= ) N := NextAll(U) \ S S := S U N Return S Only computes NextAll on newly reached states

12 Decomposing the transition relation [Roig 95] Y. Thierry-Mieg November6 3 The idea is to cluster some transitions but keep an expression of the transition relation in parts Next(i) for I in..nbclusters = union ( Next(tj),..Next(tj+k)) Create one cluster for each process (requires structural information) Not quite BFS anymore as chainings may occur Solves problems experienced with the size of NextAll BDD Algorithm for chainbfs(s) S := S N := While (N!= S) N := S For (i in..nbclusters) S := S U Next(i) (S) Return S Compared performances Performances (Ciardo 5) using Smart New Slide by G. Ciardo New Y. Thierry-Mieg November6 New 4 New BFS BFS Chain Chain BFS BFS Chain Chain

13 Y. Thierry-Mieg November6 5 Using the state space representation Y. Thierry-Mieg November6 6 The state space representation allows to easily verify fety properties Can we reach a bad state Can A and B both be true simultaneously State space generation is the basis for more complex temporal logic properties such as CTL CTL properties can be expressed as nested fix points of the transition relation and its reverse Next - 3

14 Y. Thierry-Mieg November6 7 BDD based algorithm for EX(f) Y. Thierry-Mieg November6 8 Let F be the set of states tisfying f F can be built by selecting states from the full state space EX(F) S := Next - (F) Return S 4

15 Operator EU for E(f U g) Y. Thierry-Mieg November6 9 Let F and G be the set of states tisfying f and g EU(F,G) S := G N := While (N!= S) N := S S := S ( F Next - (S)) Return S Initialize with states that verify g Keep only predecessors that verify f Operator EG for EG (f) Y. Thierry-Mieg November6 3 Let F be the set of states tisfying f EG(F) S := F N := While (N!= S) N := S S := S Next - (S) Return S 5

16 Some BDD extensions (RO)BDD BDD for Model-checking BDD extensions Exploiting Symmetries Decision Diagrams : Widely accepted in verification tools Y. Thierry-Mieg November6 3 SMV (US): FSM/Kripke structure emblematic first symbolic enabled verification tool. Now uses (NuSMV -Italy) library Cudd. Uppaal (Den-Nor): Hybrid systems uses Difference Bounded Matrix diagrams to represent clocks Pri (UK) : Stochastic process algebra uses Matrix DD and Multi-terminal DD for stochastic verification Smart (US) : Stochastic Petri nets uses integer valued DD, both CTL and stochastic solution engine (+turation) Red (Taiwan) : Timed automata Specific solution for real time systems 6

17 Integer valued Decision Diagrams Some variants: Multi-way DD (Ciardo&Miner Icatpn 99) Data Decision Diagrams (Couvreur et al. Icatpn ) Variables may have an integer domain instead of boolean domain Usually zero-suppressed, to allow arbitrary variable domains provided the actual reachable set is finite Using BDD, one has to decode integer state variables into their log_(n) bit representation Problem : complexity also linked to nb arcs/node, not only number of nodes Data Decision Diagram No variable order (handled in the union operation to handle incompatibilities) Homomorphis to define the transition relation Y. Thierry-Mieg November a a b 4 c Multi terminal Decision Diagrams Y. Thierry-Mieg November6 34 Multi-terminal (MTDD [Fujita+ 97] or Algebraic DD [Bahar+ 93]): Instead of single terminal, use several terminals Allows to give a correspondence between a state and a characteristic it has Not just presence or absence of a state Example : integer terminal Terminal gives the distance (number of steps) from initial state of any state union handles me path with different terminals => keep the allest terminal Useful for finding shortest witness or counter-example traces Example : Real valued terminal Used in stochastic/probabilistic systems, gives the probability of being in a state union handles the approximation ( terminals x and y considered equal if x-y < epsilon) 7

18 Saturation vs BFS Y. Thierry-Mieg November6 35 Saturation algorithm introduced by Ciardo+ Tacas Tacas 3 Fire transitions from the leaves (terminals) up to root Go to ancestor of a node iff. The current node is turated : all events that only affect this variable and variables below it have been fired atil a fixpoint is reached Each time a node is affected by an event, returate it. Not BFS anymore, firing order of events follows data structure Huge reduction of time and space complexity Good tackling of intermediate peak size effect Saturation example Y. Thierry-Mieg November6 36 Suppose event = if (d <) d++; Iteration + h a b c 3 d a b c 3 d BFS style iterations Iteration + h a 3 b c d a 3 b c d 3 a b c d 8

19 Saturation effect Y. Thierry-Mieg November6 37 Nested transitive closure or fixpoint = turation allows: single traverl of the top of the tree => cost of + and h less intermediate nodes Iteration BFS style iterations Iteration a b c d h 3 a b c d 3 a b c d h 3 a b c d Useless intermediate nodes!! 3 a b c d Performance measures : effect of turation Y. Thierry-Mieg November6 38 Transitive closure allows more efficiency Saturation "à la Ciardo" (Tacas' and '3) Ornize events by highest variable affected 9

20 Set Decision Diagram (SDD) Y. Thierry-Mieg November6 39 Limits of pre-existing library (DDD) reached Need for structure Idea : hierarchy Label the arcs with a SET = Set Decision Diagram Increases sharing Memory in Time in cache traverls DDD SDD + DDD = referenced values Set Decision Diagrams : A compositional Model Y. Thierry-Mieg November6 4 SDD arcs may be labeled by DDD Hierarchical Structure Adapted to composition captures the similarity of repeated modules The similarity of behavior of the philosophers is captured : 8*( Philosopher)

21 4 Y. Thierry-Mieg November6 DDD sharing & SDD sharing Idle WaitLeft WaitLeft HasLeft HasLeft WaitRight HasRight HasRight Fork Idle WaitLeft WaitLeft HasLeft WaitRight HasRight HasRight Fork Idle WaitLeft WaitLeft HasLeft WaitRight HasRight HasRight Fork Idle3 WaitLeft3 WaitLeft3 HasLeft3 WaitRight3 HasRight3 Fork3 HasLeft3 WaitRight3 Fork Idle3 WaitLeft3 HasLeft3 HasLeft WaitRight Fork Idle WaitLeft HasLeft HasLeft WaitRight Fork Idle WaitLeft HasLeft WaitRight HasRight HasRight Fork Idle WaitLeft WaitLeft HasLeft WaitRight HasRight HasRight Fork Idle WaitLeft WaitLeft HasLeft WaitRight HasRight HasRight Fork Idle3 WaitLeft3 WaitLeft3 HasLeft3 WaitRight3 HasRight3 HasRight3 Fork3 HasLeft3 WaitRight3 Fork Idle3 WaitLeft3 HasLeft3 HasLeft WaitRight Fork Idle WaitLeft HasLeft HasLeft WaitRight Fork Idle WaitLeft HasLeft HasLeft WaitRight Mod_ State space, 4 philosophers (DDD) P // P // P3 // P4 With SDD, the state of a philosopher is referenced. mod mod Mod_ mod Mod_ mod Mod_ mod Mod_3 mod Mod_ mod Mod_ mod 3 Mod_3 mod 3 Mod_ one Mod_3 Mod_ Mod_ Mod_ mod Mod_3 mod Mod_ mod 3 Mod_3 mod 3 Mod_ Mod_ Mod_ Mod_ Mod_ Mod_ Mod_ Mod_3 Mod_ (P) // (P) // (P3) // (P4) (P) (P) (P3) (P4) Idle WaitLeft WaitLeft HasLeft WaitRight HasRight Fork HasLeft WaitRight Idle WaitLeft HasLeft WaitRight HasRight HasRight Fork Idle WaitLeft HasLeft Idle WaitLeft WaitLeft HasLeft HasLeft WaitRight Mod_ 6 Mod_ 6 Mod_3 6 Mod_ 6 Pi P P P3 P4 4 Y. Thierry-Mieg November6 C E E A A B B D D F F G G H C E E A A B B D D F F G G H C E E A A B D F F G G H C3 E3 A3 D3 F3 G3 H3 C4 E4 A4 B4 D4 F4 G4 H4 B D A B B D D F G H F G H C3 E3 E3 A3 D3 F3 G3 A3 D3 D3 F3 G3 H3 F3 G3 H3 C4 E4 E4 A4 B4 D4 F4 G4 A4 B4 B4 D4 F4 G4 H4 F F G G H C E E A B B D D F G F G A B B D D F G H F G H C3 E3 E3 A3 D3 D3 F3 G3 F3 G3 A3 D3 D3 F3 G3 H3 F3 G3 H3 C4 E4 A4 B4 B4 D4 F4 G4 D F F G G H B B D D D A B B D D F G H F G H C E E A B B D D F G F G A B B D D F G H F G H C3 E3 E3 A3 D3 D3 F3 G3 F3 G3 A3 D3 F3 G3 H3 F F G G H C E E A B B D D F G F G A B B D D F G H F G H C E E A B B D D F G F G A B B D D F G H F G H C3 E3 A3 D3 F3 G3 D F F G G H B B D D D A B B D D F G H F G H C E E A B B D D F G F G A B B D D F G H F G H C E E A B B D D F G F G A B B D F G H DDD to SDD Model "slotted ring", 5 participants, states mod mod Mod_ mod Mod_ mod Mod_ mod Mod_ mod Mod_ mod Mod_ mod 3 Mod_ mod 3 Mod_ mod 3 Mod_ mod 4 Mod_ mod 4 Mod_ mod 4 Mod_ one Mod_ Mod_ Mod_ Mod_ Mod_ Mod_ Mod_ Mod_ Mod_ Mod_ mod 3 Mod_ Mod_ Mod_ Mod_ mod Mod_ mod Mod_ Mod_ Mod_ mod 3 Mod_ Mod_ Mod_ Mod_ Mod_ Mod_ Mod_ C E E A A B D F F G G H B D A B B D F G H C E A B B D F G C E Mod_ Mod_ 3 Mod_ pure DDD 35 nodes Peak 93k nodes 6 secondes SDD... 8 nodes...+ddd 3 nodes Peak at nodes.4 secondes (turation dibled)

22 Kanban example, low parameter value (5) Y. Thierry-Mieg November6 43 SDD mod Mod_ Mod_ Mod_ Mod_3 Mod_ Mod_4 Mod_5 Mod_6 DDD Mod_ mod Mod_ Mod_3 Mod_4 Mod_5 Mod_6 P Pout P Pout P Pout P Pout P Pout P P Pout mod mod mod mod mod mod Mod_ Mod_ Mod_3 Mod_4 Mod_5 Mod_6 Pback Pback Pback Pback Pback Pback mod 3 Mod_ Pm Pm Pm Pm Pm Pm one Explosion of arcs per node as states per component increases Level 4 :(,56) Level 3 :(,56) Level 37:(9,56) 35:(46,44) 3:(,5) 8:(7,) 3:(,4) :(,) Level 7:(,56) MDD (Smart) Level 7 Conclusions on Decision Diagrams Y. Thierry-Mieg November6 44 Huge success in hardware verification Pasge to verification of software more difficult Variable length signature (creation/destruction of objects) Integer or real valued variables Expression of complex (code) transitions An active research topic New Extensions of DD (i.e. hierarchy ) Using DD to tackle new problems (i.e. real-valued clocks ) new transition relation strategies (turation ) DD are perfect for some systems, poor in other settings More research is needed to provide heuristics that autoconfigure DD libraries

23 Symmetry exploitation : another «symbolic» representation (RO)BDD BDD for Model-checking BDD extensions Exploiting Symmetries Factual observation : Existence of symmetries Y. Thierry-Mieg November6 46 In Distributed Systems: Repeated Instances : clients, process... Symmetric Domains : memory adresses, pid,... Discretition of variables with a continuous domain : sensors... Large domains but existence of few values critical to control : i < threshold, i... Exploiting symmetries Well Formed Petri Nets [CDFH'9] Murphi [IpDill'96] Extensions to partial symmetries [Capra',BHI'4] 3

24 Symbolic Reachability Graph : principle Y. Thierry-Mieg November6 47 CurAlt = subclass AltOK is [..9] subclass AltNOK is [3..,AltErr] CurAlt = CurAlt=<> CurAlt=<> CurAlt=<9> 9 states OK GetAlt(<x>) CurAlt=<> 77 states CurAlt=<3> CurAlt=<3> GetAlt(x in AltOK) CurAlt=<AltErr> CurAlt = Z Z = Z in AltOK OK GetAlt(x in AltNOK) CurAlt = Z Z = Z in AltNOK NOK [x in AltNOK] [x in AltOK] [x<3 and x!= AltErr] [x>=3 or x = AltErr] NOK Concrete RG Symbolic RG SRG properties Y. Thierry-Mieg November6 48 Symbolic reachability graph SRG Based on a notion of permutations that preserve behaviors Permutations described through a partition Symbolic state = equivalence class representative of behavior Equivalence Classes w.r.t. Transition relation permutations are allowed if they respect the partition Gain may be exponential Very few symbolic states Symbolic firing => few arcs The rougher the partition, the better the in Worst case SRG = RG, if partition distinguishes every element = no permutations allowed 4

25 Well-Formed Nets : A simple Client Server protocol Y. Thierry-Mieg November6 49 Concrete Marking Symbolic Marking <c>+<c> +<c3> <cli> Client t <cli,serv,m> <cli> Wait Req t <cli,serv,m> <cli,serv,m> Treat <serv> <s>+<s> Server Z C <cli> <cli> <cli,serv> <serv> Z S <cli> <cli> t3 t4 Z C =3 Resp Z S = Concrete State space (C=, S=, M=) Y. Thierry-Mieg November6 5 gr gr gr gr gr Dimensions 4 Nodes 54 Arcs C gr gr gr gr gr Cycles = Client to server call with mesge M No interlaced requests (i.e. other client remains idle) gr C gr gr gr gr gr 5

26 SRG () Clients are Permutable Y. Thierry-Mieg November6 5 gr 4 nodes, 54 arcs C C gr gr gr gr gr 4 nodes, 7 arcs C C C gr gr gr gr gr gr gr gr C gr gr gr gr gr Ci : «A» Client gr sends M gr gr gr gr A client sends M to server Two paths (C C) Same configuration, only single path (identity of clients may be permuted) Graphe Quotient () Les Mesges Sont Permutables Y. Thierry-Mieg November6 5 4 nodes, 7 arcs grc C gr gr nodes, 6 arcs C C et M M gr "A" client sends M "A" client sends M gr gr gr "a" client sends "a" mesge gr gr gr gr gr a client sends a mesge to server Two Paths (M M) Same configuration, a single path (identity of mesges permutable) 6

27 Conclusions on SRG Y. Thierry-Mieg November6 53 Symbolic firing rule not presented due to lack of space Sorry! SRG is compatible with many other techniques Partial order reductions Attempts at combining with DD SRG suffers from some drawbacks Requires full symmetry of the system New techniques allow to construct variants of SRG with support for partial symmetry in property or system Problem of defining symmetries left to user But automatic symmetry analysis/detection is possible Complexity of symbolic firing may be high Usual trade-off time vs. memory Makes it well adapted to grid computing (high CPU uge, low bandwidth) Well Formed nets currently being standardized by ISO under the appellation Symmetric Nets 7

Efficient reachability set generation and storage using decision diagrams

Efficient reachability set generation and storage using decision diagrams Andrew S. Miner Gianfranco Ciardo Department of Computer Science College of William and Mary Williamsburg, VA, 23185 {asminer,ciardo}@cs.wm.edu