An Unfoling Approh to Moel Cheking Jvier Esprz Lbortory for Fountions of Computer Siene University of Einburgh
Conurrent progrms Progrm: tuple P T 1 T n of finite lbelle trnsition systems T i A i S i i s 0i 1 i n where A i is n lphbet of tions, S i is finite set of (lol) sttes, i S i A i i is trnsition reltion, n s 0i S i is the initil stte
REQ0 b0:=f ENT0 REQ1 b1:=f ENT1 b0:=t t=1 b1=f b1:=t t=0 b0=f Exmple t:=0 b0=f t=0 t:=1 b1=f t:=0 b0:=t b0:=f t:=1 t:=0 b1:=t b1:=f t:=1 b0=t t=1 b1=t
Semntis The behviour of P is efine by the (rehble subset of) the globl trnsition system where T P A S s 0 A A 1 A n (A prtitione into visible n invisible tions), S S 1 S n (s i enotes the ith omponent of s S), s 0 s 01 s 0n, s s iff for every 1 i n A i s i s i i, n A i s i s i
Reuing the moel heking problem The moel heking problem for progrm P T 1 T n n be reue to (severl instnes of) the following problems: The forbien tre problem (FT) Given: Progrm P, tion To eie: Does T P exhibit forbien tre, ie, tre 0 1 2 n A suh tht n? The forbien infinite tre problem (FIT) Given: Progrm P, tion To eie: Does T P exhibit forbien infinite tre, ie, n infinite tre 0 1 2 A ω suh tht i for infinitely mny i 0? The livelok problem (L) Given: Progrm P, tion To eie: Does T P exhibit livelok, ie, n infinite tre 0 1 2 A ω suh tht i for some i, n j is invisible for every j i?
A first nlysis Complexity of FT, FIT n L: PSPACE-omplete Stnr solution: ompute the globl trnsition system TP, n use well-known grph lgorithms Time n spe omplexity O TP, but in prtie often O TP 2 Problem: exponentil in the size of P for very esy instnes, eg for ompletely inepenent proesses Our solution: work on the unfoling of the system Compt proof objets, exponentilly smller thn TP in fvourble ses Proof objets of size O TP for FT, n of size O TP 2 for FIT n L In this tlk: only FT n FIT (L more tehnil)
b Running exmple s0 r0 b s1 s2 r1 T1 T2
The unfoling s0 s0 s0 r0 r0 r0 s1 s1 s1 s2 s2 s2 r1 r1 r1 b b b b b
First tree s0 b s1 s2 b b s0 s0 b b s1 s2 s1 s2
Seon tree r0 r1 r0 r1 r0 r1
An exmple with n 1 In this se P T1 TP s0 s0 s1 s2 s1 s2 s1 s1 s2 s1 s2 s1 s1 s2 s1 s1 s2 s1 s2 s1 s2 s1 s1 s2 s1 s2
Solving FT for n 1 Proof tree: Prefix of the unfoling of P A noe n is terminl if (I) it is rehe by n event lbelle by, or (II) the proof tree onstrute so fr ontins noe n lbelle by the sme stte s n A tbleu is (miniml) proof tree suh tht ll leves re terminls A terminl n is suessful if it is of type I A proof tree is suessful if it hs t lest one suessful terminl Theorem: P exhibits forbien tre iff P hs suessful proof tree
Generliztion to n 1 First ttempt Problem: Terminls re lol sttes, but terminl s efinition must refer to globl sttes Ie [MMilln 92, 95]: Assoite to eh noe n of the unfoling globl stte GS n s follows: let Hist n be the history of n; let GS n be the result of exeuting Hist n New efinition of terminl: A noe n is terminl if (I) it is rehe by n event lbelle by, or (II) the proof tree onstrute so fr ontins noe n suh tht GS n GS n A terminl n is suessful if it is of type I
s0 s0 s0 r0 r0 r0 s1 s1 s1 s2 s2 s2 r1 r1 r1 b b b b b
p0 p1 p2 p3 p4 p5 p6 p7 p8 p9 p10 p11 The ttempt fils! p1 1 2 p1 p2 p3 p4 3 4 5 6 p5 p6 p7 p8 p5 p6 p7 p8 7 8 10 9 p9 p9 p10 p10
Aequte orers GS n GS n too wek for terminl An orer on histories is equte if it is well-foune, preserves uslity: if h prefix of h then h h, n is preserve by finite extensions: if h h h h h for ll h h, then We sy n n if Hist n Hist n New efinition of terminl: A noe n is terminl if (I) it is rehe by n -trnsition, or (II) the proof tree onstrute so fr ontins noe n n suh tht GS n GS n A terminl n is suessful if it is of type I Theorem: P hs forbien tre iff it hs suessful tbleu
Problem: n n is n itionl onition less ples re terminls proof trees n be bigger! In [MMilln 92]: h h if size of h smller thn size of h Tbleux n be exponentilly bigger thn T P In [E,Römer,Vogler 96, E, Römer 99]: Totl orers Theorem: Any tbleux in whih the events re e in -orer hs size O T P
A solution to FIT for n 1 A noe n is terminl if Hist n ontins noe n lbelle with the sme stte s n A terminl n is suessful if Hist n Hist n (the pth from n to n) ontins some -lbelle trnsition Theorem: P exhibits forbien infinite tre iff P hs suessful tbleu Problem: tbleux n be exponentilly lrger thn T P
s1 s2 s2 s2 s4 s1 s1 s2 s1 s2
A better solution for n 1 New efinition of terminl: A noe n is terminl if there is noe n lbelle with the sme stte s n suh tht n belongs to Hist n, or n oes not belong to Hist n, n Hist n ontins t lest s mny -lbelle trnsitions s Hist n A terminl n is suessful if n belongs to Hist n n Hist n Hist n ontins some -lbelle trnsition Theorem: P hs forbien infinite tre iff it hs suessful tbleu The size of ny tbleu in whih events re e in -orer is O T P 2
1 s0 s1 s2 2 3 s1 s2 s1 4 5 6 7 8 s1 s1 s2 9 10
Generliztion to n 1 Definition of terminl: A noe n is terminl if there is noe n suh tht GS n GS n, n n n belongs to Hist n, or n oes not belong to Hist n, n Hist n ontins t lest s mny -lbelle trnsitions s Hist n A terminl n is suessful if n belongs to Hist n n Hist n Hist n ontins some -lbelle trnsition Theorem: T P hs forbien infinite tre iff it hs suessful tbleu With the equte orers of [E,Römer,Vogler 96] n [E, Römer 99] the size of ny tbleu is t most O T P 2
A suessful tbleu s0 r0 s1 s2 r1 s0 r0 s1 s2 r1
System Struture Petri net Prefix BDD size (sle) Ples Trns Globl Sttes Ples Trns (Petrify) CY(12) 95 71 74264 232 104 DPD(7) 63 63 109965 86310 4314 SR(10) 100 100 81 10 12 119450 86180 EL(4) 736 1939 43440 32354 16935 PC 231 202 31 106 2164 1035 40188 CP 150 140 28 10 7 1671 780 210249 DME(64) 257 256 18 10 62 385 256 45460 RW(10) 86 66 16 10 6 29132 15974 7576
CY : Cyler (Milner) DPD: Philosophers with elok voine SR: Slotte ring protool EL: Elevtor PC: Proution ell CP: Conurrent Pushers (Heimer) DME: STG speifition of iruit for istribute mutul exlusion RW: Reers n writers (Hellwgner)
Unfolings vs BDDs Coneptul similrities n ifferenes: Both tehniques ompress the stte spe BDDs exploit regulrity Unfolings exploit onurreny Consequenes: Robustness: Unfolings less sensitive to hnges in the system Compression: Prefix smller for loosely ouple systems, BDDs smller for tightly ouple systems
100 rnom tbles with right-hne, left-hne, n mbiextrous philosophers BDD for the set of rehble sttes (Petrify) Nr of BDD size phil Averge Min Mx StDev Aver/StDev 4 178 94 355 52 030 6 583 248 1716 305 052 8 1553 390 8678 1437 092 10 3140 510 27516 4637 148 12 4855 632 47039 8538 176 14 33742 797 429903 85798 254
100 rnom tbles with right-hne, left-hne, n mbiextrous philosophers Noes of the omplete prefix (PEP) Nr of Prefix size phil Averge Min Mx StDev Aver/StDev 4 46 40 60 513 010 6 70 60 85 599 009 8 95 80 110 692 007 10 117 100 135 778 007 12 141 120 160 740 005 14 161 140 185 925 006
Cheking elok-freeom with BDDs 100 rnom tbles with right-hne, left-hne, n mbiextrous philosophers SMV on SUN Ultr 60, 2 proessors, 640 MB Nr of Time in seons phil Averge Min Mx StDev Aver/StDev 4 008 005 013 002 029 6 036 020 118 016 046 8 414 125 1460 245 059 10 5660 1580 38800 4690 083 12 159500 22800 1061600 161500 101
Cheking elok-freeom with unfolings 100 rnom tbles with right-hne, left-hne, n mbiextrous-philosophers PEP + stble moels on SUN Ultr 60, 2 proessors, 640 MB Nr of Time in seons phil Averge Min Mx St Dev Aver/St Dev 8 001 004 003 0007 024 10 001 006 003 0009 027 12 002 007 004 0012 028 14 002 005 004 0007 020 16 002 005 004 0007 017 18 003 005 004 0007 017
Unfolings vs stubborn sets Coneptul similrities n ifferenes: Both tehniques exploit onurreny Stubborn sets isr informtion Unfolings ompress informtion Stubborn sets re onservtive: smll overhe is gurntee, t the prie of suboptiml reution Unfolings tke risks : lrge overhe is possible, but optiml ompression Consequenes: No loss of informtion All rehbility properties hekble on the sme prefix Cuslity informtion vilble (ex lrm ptterns) Lrger overhes for tightly ouple systems
Cheking elok-freom with stubborn sets n unfolings 1 left-hne, 1 right-hne, n n 2 mbiextrous philosophers SUN Ultr 60, 2 proessors, 640 MB Nr of Time in seons phil PROD PEP + smoels 10 18 004 12 69 004 14 834 004 16 5003 004 18 29257 006
Tenttive rules of thumb BDDs more suitble for very regulr systems Stubborn sets n unfolings more suitble for irregulr but onurrent systems Stubborn sets more suitble for systems with little onurreny Unfolings more suitble for highly onurrent systems