Keeping a Crowd Safe On the Complexity of Parameterized Verification

1. Keeping a Crowd SafeOn theComplexityofParameterizedVerification Javier Esparza Technical University ofMunich

2. Wilfried Brauer (1937-2014) Book ofcondolence: http://kondolenz.informatik.tu-muenchen.de

4. „Whydon´tyougiveup?“ Theorem (Alan Turing, 1936) Programterminationisundecidable. Theorem (Henry G. Rice, 1961) Every non-trivial propertyofprogramsisundecidable. Theorem (Marvin Minsky, 1969) Every non-trivial propertyofwhile-programswithtwocounter variables isundecidable.

5. „Whydon´tyougiveup?“ Theorem (Alan Turing, 1936) Programterminationisundecidable. Theorem (Henry G. Rice, 1961) Every non-trivial propertyofprogramsisundecidable. Theorem (Marvin Minsky, 1969) Every non-trivial propertyofwhile-programswithtwocounter variables isundecidable.

6. „Whydon´tyougiveup?“ Theorem (Alan Turing, 1936) Programterminationisundecidable. Theorem (Henry G. Rice, 1961) Every non-trivial propertyofprogramsisundecidable. Theorem (Marvin Minsky, 1969) Every non-trivial propertyofwhile-programswithtwocounter variables isundecidable.

7. Because … • Undecidabilityrequiressomesourceof „infinity“: • Variables with an infinite range • Dynamic datastructures (lists, trees) • Unboundedrecursion • Concurrentsystems • aredifficulttogetright, and • oftenhave a finite statespace.

8. Dijkstra´s Mutual ExclusionAlgorithm CC CACM 8:9, 1965

9. Concurrentprogramsareoften finite-state CC

10. Concurrentprogramsareoften finite-state CC Onlytwoboolean variables per process!

11. Concurrentprogramsaredifficulttogetright CC CACM 9:1, 1966

12. Concurrentprogramsaredifficulttogetright CC

13. A Leader ElectionAlgorithm (90s)

14. A Cache-Coherence Protocol (00s) Murphi modelchecker (Dill et al.) Source: Wikipedia

15. A Model of a Bluetooth Driver (10s) KISS (Qadeerand Wu)

16. ParameterizedVerification • Model-checkingtoolscanonly check instancesofthesesystemsforparticularvaluesofthenumber N ofprocesses. Can weprovecorrectnessforevery N ? • Amountstochecking an infinite familyof finite-statesystems.

17. ParameterizedVerification • Model-checkingtoolscanonly check instancesofthesesystemsforparticularvaluesofthenumber N ofprocesses. Can weprovecorrectnessforevery N ? • Amountstochecking an infinite familyof finite-statesystems.

18. Keeping a Crowd Safe • The coverabilityproblem: • Given: a program templatewith finite-range variables, a „dangerous“ controlpointof. • Decide: Isthere a number such thatthecrowd canreach a global state in which at least oneofis at ?

19. ParameterizedVerification: Giveup? Theorem (folklore): The HaltingProblem canbereducedtotheparameterizedcoverabilityproblem. • Reduction: • The templatemodelsthebehaviourofonetapecell. • TM terminates • ituses a finite number N ofcells • N copiesofthetemplatereachthedangerousstate

20. ParameterizedVerification: Giveup? Theorem (folklore): The HaltingProblem canbereducedtotheparameterizedcoverabilityproblem.

21. ParameterizedVerification: Giveup? Theorem (folklore): The HaltingProblem canbereducedtotheparameterizedcoverabilityproblem. Parameterizedverificationisdoomed!

22. Identities • In thisreductionprocesses do not executeexactlythe same code • The codemakesuseoftheprocessidentity(theindex) toorganizeprocesses in an array. • But manysystems do not useidentities: • DKR Leader Electionusesidentities. • Dijkstra´salgorithm, MESI-protocol, and Bluetooth driverdo not. • In others, processesmustremainanonymous!

23. Anonymous Crowds • Weinvestigatethedecidabilityandcomplexityofthecoverabilityproblemforcrowdsin which • everyprocessexecutesexactlythe same code, (anonymouscrowds), and • thenumberofprocessesisunknowntotheprocesses.

24. Keeping an Anonymous Crowd Safe • The coverabilityproblemforanonymouscrowds (TCS version) : • Given: a finite automatonanda „dangerous“ stateof. • Decide: Isthere a number such thattheanonymouscrowd canreach a global state in which at least oneofthecopiesis at ?

25. Communication Mechanisms Reliablebroadcast • A processsends a message • All otherprocessesreceivethemessage (instantaneously) Rendez-vous • Synchronousexchangeof a messagebetweentwoprocesses

26. Communication Mechanisms Reliablebroadcast • A processsends a message • All otherprocessesreceivethemessage (instantaneously) Rendez-vous • Synchronousexchangeof a messagebetweentwoprocesses

27. Communication Mechanisms Sharedmemorywithlocking • Processescompetefor a lock • Processowningthe lock canperformreadsandwrites Sharedmemory, nolocking • Concurrentreadsandwritesallowed • Interleavingsemantics

28. Communication Mechanisms Sharedmemorywithlocking • Processescompetefor a lock • Processowningthe lock canperformreadsandwrites Sharedmemory, nolocking • Concurrentreadsandwritesallowed • Interleavingsemantics

29. High or Low Complexity? Verifierswantlowcomplexity

30. High or Low Complexity? „Crowddesigners“ (swarmintelligence, populationprotocols, crowdsourcing) want high complexity Verifierswantlowcomplexity

31. Reliablebroadcast • Theorem [E., Finkel, Mayr 99] The coverabilityproblemforbroadcastprotocolsisdecidable. • Informally: Anonymous crowdsare not Turing powerful • Straightforwardapplicationofthebackwardsreachabilityalgorithmby Abdulla et al., based on thetheoryof well-quasi-orders.

32. Reliablebroadcast A configurationofthesystemiscompletelydeterminedbythenumberofprocesses in eachstate. (Noidentities) Symbolic Backward Search /* angerous */ Iterateuntil ; return „unsafe“ or fixpoint; return „safe“

33. Reliablebroadcast A configurationofthesystemiscompletelydeterminedbythenumberofprocesses in eachstate. (Noidentities) Symbolic Backward Search /* angerous */ Iterateuntil ; return „unsafe“ or fixpoint; return „safe“ Problems: • contains infinite sets. Finite representation? • Termination?

34. Reliablebroadcast • Partial orderon configurations: ifhas at least asmanyprocessesasin eachstate • “ is a well-quasi-order : a well-founded partial orderwithno infinite antichains. • Consequence: always hasfinitelymany minimal elements. • Finite representation • Termination

35. Reliablebroadcast • Partial orderon configurations: ifhas at least asmanyprocessesasin eachstate • “ is a well-quasi-order : a well-founded partial orderwithno infinite antichains. • Consequence: always hasfinitelymany minimal elements. • Finite representation • Termination Love it!

36. Reliablebroadcast: Complexity Theorem (Schmitz andSchnoebelen 13) The coverabilityproblemforbroadcastprotocolshas non-primitive-recursivecomplexity.

37. Reliablebroadcast: Complexity Theorem (Schmitz andSchnoebelen2013) The coverabilityproblemforbroadcastprotocolshas non-primitive-recursivecomplexity.

38. Reliablebroadcast: Complexity Theorem (Schmitz andSchnoebelen 13) The coverabilityproblemforbroadcastprotocolshas non-primitive-recursivecomplexity. Putthat in yourpipeand smoke it, Sherlock!

39. Reliablebroadcast: Complexity Theorem (Schmitz andSchnoebelen 13) The coverabilityproblemforbroadcastprotocolshas non-primitive-recursivecomplexity. Don‘tdespair, Sherlock! Backwardsreachabilityisusefulforverification! I‘veusedittoprovepropertiesofa dozen cache-coherenceprotocols: theirtemplateshaveunder 10 states! G. Delzanno

40. Sharedmemorywithlocking • Two essential propertiesofreliablebroadcast: • Everybodyreceiveseverymessage • The crowdcanproduce a leader • Sharedmemorywithlocking • Can still produce a leader • Can onlyguaranteethatsomebodyreceives a message

41. Sharedmemorywithlocking Theorem: The coverabilityproblemforsystemscommunicatingthrough a global storewithlockingis EXSPACE-complete.

42. Sharedmemorywithlocking A templatewithstatescansimulate a countercountingupto. Lowerbound [Lipton 1976]

43. Sharedmemorywithlocking Upperbound [Rackoff 1978]: Lowerbound [Lipton 1976] If thegoalstateiscoverable, thenitiscoverable in an instancewith processes.

44. Sharedmemorywithlocking Upperbound [Rackoff 1978]: Unfortunately, forusverifiersthisupperboundisalgorithmicallyuseless …

45. Sharedmemorywithlocking Theorem [Bozzelli, Ganty 2012]: Symbolicbackwardsreachabilityruns in double exponential time for global storewithlocking.

46. Sharedmemorywithlocking Love it! But backwardsalgorithmsoftengeneratetoomanyunreachablestates! Cant´tyoucomeupwith a forwardexplorationalgorithm? Theorem [Bozzelli, Ganty 2012]: Symbolicbackwardsreachabilityruns in double exponential time for global storewithlocking.

47. Sharedmemorywithlocking The Karp-Miller coverabilitygraph (1969). • Configuration: • Generalizedconfiguration: wherestandsfor „arbitrarilymany“ • Initially: • Construct a „forwardreachabilitygraph“: Ifthen • Problem:termination

48. Sharedmemorywithlocking • „Accelerate“ theconstruction: Change to • Theorem:The Karp-Miller graphisalways finite.

49. Sharedmemorywithlocking • „Accelerate“ theconstruction: Change to • Theorem:The Karp-Miller graphisalways finite. • But: The Karp-Miller graphcanhave non-primitive recursivesize.

50. Sharedmemorywithlocking • „Accelerate“ theconstruction: Change to • Theorem:The Karp-Miller graphisalways finite. • But: The Karp-Miller graphcanhave non-primitive recursivesize. Don´tloveit!