Verification Options

1. Verification Options&Beyond Reachabilityor how to make UPPAAL perform better and moreKim Guldstrand Larsen BRICS@Aalborg

2. Verification Options • Diagnostic Trace • Breadth-First • Depth-First • Local Reduction • Early Termination • Global Reduction • Active-Clock Reduction • Re-Use State-Space • Over-Approximation • Under-Approximation • Distributed Impl.

3. Forward Rechability Init -> Final ? INITIALPassed:= Ø; Waiting:= {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some Z’ Z (n,Z’) in PassedthenSTOP - else /explore/ add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTILWaiting = Ø or Final is in Waiting Waiting Final m,U location zone n,Z n,Z’ Init Passed

4. Forward Rechability Init -> Final ? Questions: 1.Order for exploration Waiting ? 2. How to store symbolic state in Passed ? 3. When to store in Passed ? INITIALPassed:= Ø; Waiting:= {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some Z’ Z (n,Z’) in PassedthenSTOP - else /explore/ add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTILWaiting = Ø or Final is in Waiting Waiting Final m,U location zone n,Z n,Z’ Init Passed

5. Order of ExplorationDepth-First vs Breadth-First Depth-First Waitingrepr. as stack Breadth-First Waitingrepr as queue Waiting Final m,U n,Z In most cases BF to be preferred. Allows for generation of “shortest” traces. DF useful in situations when reachability may be concluded without generating full state-space. Easy calculation of traces. n,Z’ Init Passed

6. Representation of symbolic statesZones Z -4 -4 x1-x2<=4 x2-x1<=10 x3-x1<=2 x2-x3<=2 x0-x1<=3 x3-x0<=5 Shortest Path Closure O(n^3) x1 x2 x1 x2 4 10 3 3 2 3 2 -2 -2 2 2 x0 x3 x0 x3 1 5 5 Allows for easy exploration and subset-checking

7. Representation of symbolic states Local Reduction Z -4 -4 x1-x2<=4 x2-x1<=10 x3-x1<=2 x2-x3<=2 x0-x1<=3 x3-x0<=5 Shortest Path Closure O(n^3) x1 x2 x1 x2 4 10 3 3 2 3 2 -2 -2 2 2 x0 x3 x0 x3 1 5 5 -4 Shortest Path Reduction O(n^3) x1 x2 Canonical wrt = Space worst O(n^2) practice O(n) 3 3 2 2 x0 x3

10. Earlier Termination Init -> Final ? INITIALPassed:= Ø; Waiting:= {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some Z’ Z (n,Z’) in PassedthenSTOP - else /explore/ add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTILWaiting = Ø or Final is in Waiting Waiting Final m,U n,Z n,Z’ Init Passed

11. Earlier Termination Init -> Final ? INITIALPassed:= Ø; Waiting:= {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some Z’ Z (n,Z’) in PassedthenSTOP - else /explore/ add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTILWaiting = Ø or Final is in Waiting Waiting Final m,U n,Z n,Z’ Init Passed

12. Earlier Termination Init -> Final ? INITIALPassed:= Ø; Waiting:= {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some (n,Z’) in PassedthenSTOP - else /explore/ add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTILWaiting = Ø or Final is in Waiting Waiting Final m,U n,Z n,Z1 n,Z2 n,Zk Init Passed

13. Clock Difference Diagrams= Binary Decision Diagrams + Difference Bounded Matrices CAV99 CDD-representations • Nodes labeled with differences • Maximal sharing of substructures (also across different CDDs) • Maximal intervals • Linear-time algorithms for set-theoretic operations. • NDD’s Maler et. al • DDD’s Møller, Lichtenberg

16. Definition x is inactive at Sif on all path from S, x is always reset before being tested. S x:=0 x:=0 x>3 x<5 Representation of symbolic states(In)Active Clock Reduction x is only active in location S1 x<7

17. Representation of symbolic states Active Clock Reduction S Definition g1 x is inactive at Sif on all path from S, x is always reset before being tested. gk g2 r1 r2 rk S1 S2 Sk x>3 x<5 Only save constraints on active clocks

18. When to store symbolic stateGlobal Reduction However, Passedlist useful for efficiency No Cycles: Passed list not needed for termination

19. When to store symbolic stateGlobal Reduction Cycles: Only symbolic states involving loop-entry points need to be saved on Passed list

20. Reuse State Space Waiting prop2 A[] prop1 A[] prop2 A[] prop3 A[] prop4 A[] prop5 . . . A[] propn Search in existing Passed list before continuing search prop1 Passed Which order to search?

21. Reuse State Space Waiting prop2 A[] prop1 A[] prop2 A[] prop3 A[] prop4 A[] prop5 . . . A[] propn Search in existing Passed list before continuing search prop1 Passed Which order to search? Hashtable

22. Over-approximationConvex Hull y 5 3 1 x 1 3 5 Convex Hull

23. Under-approximationBitstate Hashing Waiting Final m,U n,Z n,Z’ Init Passed

24. Under-approximationBitstate Hashing 1 Passed= Bitarray Waiting Final m,U 0 1 n,Z 0 UPPAAL 8 Mbits Hashfunction F n,Z’ 0 Init Passed 1

25. Bitstate Hashing INITIALPassed:= Ø; Waiting:= {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some Z’ Z (n,Z’) in PassedthenSTOP - else /explore/ add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTILWaiting = Ø or Final is in Waiting Passed(F(n,Z)) = 1 Passed(F(n,Z)) := 1

26. W P Distributing UPPAAL Gerd Behrmann, Thomas Hune, Frits VandraagerCAV2k

27. W W2 W4 W3 P2 P4 P3 P Distributing UPPAAL Gerd Behrmann, Thomas Hune, Frits VandraagerCAV2k W1 P1 Passed structure distributed

28. W2 W4 W3 P2 P4 P3 Distributing UPPAAL Gerd Behrmann, Thomas Hune, Frits VandraagerCAV2k W1 ? MPI Check in local Passed list. If not present save, explore and distribute ... P1 Passed structure distributed

29. W2 W4 W3 P2 P4 P3 Distributing UPPAAL Gerd Behrmann, Thomas Hune, Frits VandraagerCAV2k W1 ? Check in local Passed list. If not present save, explore and distribute ... P1 Passed structure distributed Implemented using MPI on SUN Interprise 10000 Beowulf cluster

30. Performance SUN Interprise 10000 Shared Memory 12GB Ram 24 333Mhz CPU’s Super-linear Speed-up Full State Space Generation

31. Beyond Reachability- (Bi)Simulation - Compositional Verification

32. Timed Bisimulation Wang’91

33. Timed Simulation

34. Examples

35. a a a a a a a a 1 1 2 2 b b b b b b b b c c c c c c c c 3 3 4 4 Abstraction & Compositionalitydealing w stateexplosion simulation Concrete Abstract

36. Abstraction Example a1 a2 a3 a4 a5 a b

37. Example Continued abstracted by

38. Proving abstractions using reachability Recognizes all the BAD computations of PoP1 A[] not TestAbstPoP1.BAD