On-the-Fly Model Checking for Extended Action-Based Probabilistic Operators

Transcription

1 On-the-Fly Model Checking for Extended Action-Based Probabilistic Operators Radu Mateescu and José Ignacio Requeno Inria Grenoble and LIG / Convecs

2 SPIN Eindhoven, March Context Concurrent value-passing systems Action-based, branching-time setting Process calculi, bisimulations Objectives Handle actions, data, costs, discrete time, probabilities Provide on-the-fly quantitative analysis Integrate into the CADP toolbox ( SENSATION project FP

3 SPIN Eindhoven, March Probabilistic Transition Systems (value-passing)

4 SPIN Eindhoven, March Related Work Action-based probabilistic logics PML (probabilistic HML) on PTSs [Larsen-Skou-91] GPL (probabilistic Lμ 1 ) [Cleaveland-Iyer-Narasimba-05] On-the-fly verification PCTL [Latella-Loreti-Massink-14] Our contributions Extension of (action-based) Until PCTL operators Description of complex paths in the PTS Data handling (computation of costs over paths) On-the-fly verification on PTSs

5 SPIN Eindhoven, March Outline Glimpse of MCL (Model Checking Language) Regular probabilistic operator On-the-fly model checking Data-handling extensions Experiments and peak cost analysis Perspectives

6 SPIN Eindhoven, March MCL: Model Checking Language (dataless fragment) Action formulas α ::= false a α α 1 V α 2 Regular formulas (ACTL) boolean op. (PDL) β ::= α β 1.β 2 β 1 β 2 β* regular op. if ϕ then β 1 else β 2 end if conditional op. State formulas (PDL + L ) ϕ ::= false ϕ ϕ 1 V ϕ 2 boolean op. < β > ϕ [ β ] ϕ modal op. Y Y. ϕ νy. ϕ fixed point op.

7 SPIN Eindhoven, March Some Derived Operators Derived regular operators: β + = β. β* nil = false* if ϕ then β end if = if ϕ then β else nil end if transitive closure empty sequence if-then op. ϕ? = if not ϕ then false end if PDL testing op. CTL Until operator: E [ ϕ 1 U ϕ 2 ] = < (ϕ 1?. true)*. ϕ 2? > true

8 SPIN Eindhoven, March Probabilistic Regular Operator Syntax: { β } op p where op { <, <=, >, >=, = } Semantics: P op p (β) = μ (Cyl (β)) op p = β s 0 β s0 a 0 p 0 s 1 s k a k p k s k+1 = β (p 0 p k ) op p β Cyl (β)

9 SPIN Eindhoven, March Encoding Probabilistic Until Operators PCTL pure probabilistic Until [ϕ 1 U ϕ 2 ] >= p = { (ϕ 1?. true)*. ϕ 2? } >= p PACTL pure probabilistic Until [ϕ 1 α1 U ϕ 2 ] >= p = { (ϕ 1?. α 1 )*. ϕ 2? } >= p [ϕ 1 α1 U α2 ϕ 2 ] >= p = { (ϕ 1?. α 1 )*. ϕ 1?. α 2. ϕ 2? } >= p

10 SPIN Eindhoven, March Example { PUT 0. (not (PUT 0 or GET 0 ))*. GET 0 } >=

11 SPIN Eindhoven, March On-the-Fly Model Checking (syntactic steps) < PUT 0. (not (PUT 0 or GET 0 ))*. GET 0 > true MCL X 1 = < PUT 0. (not (PUT 0 or GET 0 ))*. GET 0 > X 2 X 2 = true PDLR elimination of regular operators X 1 = < PUT 0 > X 3 X 2 = true determinization HMLR [Larsen-88] X 3 = < GET 0 > X 2 or < not (PUT 0 or GET 0 ) > X 3

12 SPIN Eindhoven, March On-the-Fly Model Checking (semantic steps) X 1 = < PUT 0 > X 3 X 2 = true X 3 = < GET 0 > X 2 or < not (PUT 0 or GET 0 ) > X 3 synchronous products of HMLR and PTS BES for pruning unreachable suffixes HMLR Z 1,s = s PUT0 p s p Z 3,s Z 2,s = 1.0 Z 3,s = s GET0 p s p Z 2,s + s A p s p Z 3,s LES A PUT 0, GET 0 Y 1,s = V s PUT0 s Y 3,s Y 2,s = true Y 3,s = V s GET0 s Y 2,s or V s A s Y 3,s BES A PUT 0, GET 0

13 SPIN Eindhoven, March Local LES & BES 0.8 Resolution Z 1,0 = 0.5 Z 3,1 = Z 2,s = 1.0 Z 3,1 = Z 2,0 + Z 3,3 Z 3,3 = 0.8 Z 2,2 + Z 3,1 0.8 LES represented as Signal Flow Graph BES represented as Boolean Graph forward exploration of dependencies backward propagation / substitution

14 SPIN Eindhoven, March Data-Handling Extensions PTS for value-passing systems data-carrying actions Action predicates of MCL { c!e?x:t... where b } c v 1 v n p Data-handling probabilistic regular operator { β } op p where β Is built over action predicates Enables data capture and propagation

15 SPIN Eindhoven, March Counter-Based Regular Operators β ::= β { e } iteration e times β { e } iteration e times β { e 1 e 2 } iteration between e 1 and e 2 times for n:nat from e 1 to e 2 step e 3 stepwise iteration do β end for

16 SPIN Eindhoven, March Data-Handling Examples Probability of P i s first access to its critical section { { NCS?i:Nat }. (not { CS!ENTER })*. { CS!ENTER!i } } >= 0.5 PCTL full probabilistic Until data capture and propagation [ϕ 1 U <= t ϕ 2 ] >= p = { (ϕ 1?. true) { t }. ϕ 2? } >= p But: reasoning about weights (costs, energy,...) requires more expressive regular operators

17 SPIN Eindhoven, March Generalized Iteration Operators iteration parameter return parameter loop (x:t:=e 0 ) : (x :T ) in β end loop body of the loop continue (e) start next iteration and set x to e exit (e ) terminate the loop and set x to e

18 SPIN Eindhoven, March Encoding of Regular Operators β* = loop exit β. continue end loop β+ = loop β. (exit continue) end loop β { e 1 e 2 } = loop (c 1 :nat:=e 1, c 2 :nat:=e 2 e 1 ) in if c 1 > 0 then β. continue (c 1 1, c 2 ) elsif c 2 > 0 then exit β. continue (c 1, c 2 1) else exit end if end loop

19 SPIN Eindhoven, March On-the-Fly Verification Method (Evaluator 4.0) LNT specification translation MCL formula implicit LTS Caesar_Solve compilation parameterized HMLR encoding parameterized BES & LES optimisation On-the-fly activities Open/Caesar environment instantiation & resolution verdict & diagnostic

20 SPIN Eindhoven, March Case Study: Mutual Exclusion Protocols [Mateescu-Serwe-13] N concurrent processes competing for a shared resource Accesses to shared variables (read/write/tas/cas ) NUMA (caches/local/remote) various latencies Four sections executed cyclically Non critical section Entry section Critical section Exit section // do not use the resource // request access to the resource // access the resource // release the resource Five protocols (CLH, MCS, BL, TAS, TTAS) with N 4 PTS with equal probabilities for neighbour transitions

21 SPIN Eindhoven, March Overtaking Degree (for starvation-free protocols) Sequence with d overtakes of P i by P j : true*. NCS (i). (not MEM (i))*. MEM (i). ( for k:nat from 0 to N-1 do (not CS (i))*. MEM (k) end for. (not CS)*. CS (j) ) { d } Maximum value of d: overtaking degree

22 SPIN Eindhoven, March Overtaking Degree (BL protocol probability that Pj overtakes Pi d times) higher priority (lower index) processes have better overtaking chances Pj_Pi: Pj overtakes Pi d

23 SPIN Eindhoven, March Memory Latency until Critical Section Sequence with memory latency max for P i : (not NCS (i))*. NCS (i). loop (cost:nat := 0) in (not CS (i))*. if cost < max then { MEM?c:nat!i }. continue (cost + c) else exit end if end loop. CS (i)

24 Memory Latency (probability to access the CS with a memory latency max) max SPIN Eindhoven, March

25 SPIN Eindhoven, March Analysis of Peak Cost Sequences 1. specify the desired sequence as β (cost) 2. if sequences with peak cost are finite then 3. else Check < β (cost) > true using standard on-the-fly model checking Use dichotomic search to determine peak cost Check { β (peak) } op p to get the probability of peak cost sequence Check { β (cost) } op p for variable cost values

26 SPIN Eindhoven, March Perspectives Extend MCL and the model checker User-defined types and functions Connect to IPCs [Coste-Hermanns-et-al-10] Extend the approach to handle infinite sequences using the < β operator of MCL Enhance the back-end verification engine Distributed resolution of BESs Connection to the distributed MUMPS LES solver Further experiments Compare with (explicit-state) PRISM on PCTL formulas

27 SPIN Eindhoven, March Thank you Further information