170 likes | 282 Views
Predictive Reachability Using a Sample-based Approach. D. Sahoo, Stanford J. Jain, Fujitsu S. Iyer, UT-Austin D. Dill, Stanford E. A. Emerson, UT-Austin. IWLS 2005. Outline. BDD-based Verification Reachability Techniques Predictive Reachability Results Conclusion and Future work.
E N D
Predictive Reachability Using a Sample-based Approach D. Sahoo, Stanford J. Jain, Fujitsu S. Iyer, UT-Austin D. Dill, Stanford E. A. Emerson, UT-Austin IWLS 2005
Outline • BDD-based Verification • Reachability Techniques • Predictive Reachability • Results • Conclusion and Future work
BDD-based Verification • BDD : • Binary Decision Diagram • Used to represent Boolean functions • Reachability Analysis • Finds bug • Finds a counter example for the invariant • Proves invariant • Efficient CTL model checking
Reachability using BDD [Burch et al. : 91] Partitioned Transition Relation Initial State I … … R1 Image computation Trn Tri Tr1 R2 Least Fixed Point Ri
Local Fixed Point 1 Local Fixed Point 2 Local Fixed Point 3 Local Fixed Point 4 Partitioned Reachability using POBDD POBDD - [Jain : 92] Reachability - [Narayan et al. : 97] I Initial States : I
Local Fixed Point 3 Local Fixed Point 4 Communicate from 1 -> 2 Communicate from 1 -> 4 Communicate from 1 -> 3 Partitioned Reachability using POBDD POBDD - [Jain : 92] Reachability - [Narayan et al. : 97] I Initial States : I Local Fixed Point 1 Local Fixed Point 2
Local Fixed Point 1 Local Fixed Point 2 Local Fixed Point 3 Local Fixed Point 4 Communicate from 2 -> 1 Communicate from 2 -> 3 Communicate from 2 -> 4 Partitioned Reachability using POBDD POBDD - [Jain : 92] Reachability - [Narayan et al. : 97] I Initial States : I Similarly repeat for other partitions
Local Fixed Point 1 Local Fixed Point 2 Local Fixed Point 3 Local Fixed Point 4 Partitioned Reachability using POBDD POBDD - [Jain : 92] Reachability - [Narayan et al. : 97] I Improvements: [Iyer et al. : 03] [Sahoo et al. : 04]
Forward Invariant Check • Monolithic Reachability • Starts with the initial states • Computes Fixed point of Image Computation • Checks if all the reachable states satisfy the invariants • Partitioned Reachability • Starts with the initial states • Creates Partitions • Computes Fixed point inside each partitions • Communicate results to other partitions • Finishes if there is no new state found • Checks if all the reachable states satisfy the invariants
Backward Invariant Check • Monolithic Reachability • Starts with error states • Computes Fixed point of Image Computation • Check if any of the initial state is reached • Partitioned Reachability • Starts with error states • Creates Partitions of the error states • Computes Fixed point inside each partitions • Communicate results to other partitions • Finishes if there is no new state found • Checks if any of the initial state is reached
Which method is better? • We don’t know a priori • Forward Monolithic Reachability • Backward Monolithic Reachability • Forward Partitioned Reachability • Backward Partitioned Reachability • How do we take advantage of the efficiency of each method? • Look at initial few steps of the Image Computation • A sample computation • Characterize the sample computations
Reachability – A sample-based Approach • Compute sample image computations for each method • Characterize the sample computations • Select a method that is more effective • Augment selected method with the states covered by the sample computations • Complete reachability steps for the selected method
Characterization of the Samples • Number of Image Computation performed • Until a predefined BDD size cutoff exceeded • Total number of states covered • Total time taken during the sample computation
Monolithic sample E’ I’ E I Partitioned sample Fixpt R I E Augmentation • Augment forward reachable states using both monolithic and partitioned reachability • Augment backward reachable states • Advantages: • The number of steps to reach fix-point can be reduced • Leads to fast verification • Intersection of forward and backward reachable states: • Leads to fast errors detection
Number of Timeouts Timeout of 1 day 0
Conclusion and Future Work • Sample-based approach • combines Forward and backward Reachability • combines Monolithic and Partitioned Reachability • Intersection of Forward and Backward frontiers • For fast error detection • Augmentation: • Reduced number of steps to reach a Fix-point • For fast verification • Future work: • Combine different efficient partitioning strategies • Combine different Transition Relation clustering