Using Constraints to Verify Properties of Rule Programs

1. Using Constraints to Verify Properties of Rule Programs Bruno Berstel, University of Freiburg & IBM Michel Leconte, IBM CSTVA’10 – April 10th, 2010 ANR-07-SESUR-003

2. What are Business Rules?

3. What are business rules? Rule upgrade-to-platinum if the category of the customeris Gold and the value of the shopping cartis more than $1500 then changethe category of the customerto Platinum

4. Agenda • What are Business Rules? • Verification • rules as transition constraints • properties as constraint problems • Impact on CP Solver • slow propagation • how to cope with it • Conclusion

5. Verification Example rules Rule gold-discount when category = Gold & value ≥ 2000 then discount := discount + 10 Rule platinum-discount when category = Platinum & value ≥ 1000 then discount := discount + 15 Rule upgrade when category = Gold & age ≥ 60 then category := Platinum

6. cat = Gold age ≥ 60 value ≥ 1000 cat := Plat disc += 15 cat = Gold age ≥ 60 cat := Plat cat = Gold value ≥ 2000 disc += 10 cat = Plat value ≥ 1000 disc += 15 Verification Conflict (example) upgrade + platinum-discount cat = Gold age = 65 value = 2500 discount = 10 gold-discount cat = Platinum age = 65 value = 2500 discount = 25 cat = Gold age = 65 value = 2500 discount = 0 ≠ cat = Platinum age = 65 value = 2500 discount = 15 cat = Platinum age = 65 value = 2500 discount = 0 upgrade platinum-discount

7. Verification Conflict (general principle) execution #1 final state #1 initial state = ? final state #2 execution #2

8. Verification Conflict (general principle) • Compute the transition constraints for all executions • e.g. ρ(upgrade ∘ platinum-discount) isc =Gold ∧ a ≥60 ∧ v ≥1000 ∧ c’ =Plat ∧ d’ = d +15 ∧ a’ =a ∧ v’ =v • interested in maximal executions only • bound length of traces to cope with infinite executions • many unfeasible executions: ρ⊨⊥ • Look for conflicting executions • s⇝s’1s⇝s’2s’1≇s’2 • init ∧ ρ1 ∧ ρ2 ∧ ∨ξ’1 ≠ ξ’2 • Is one of these constraint problems satisfiable? • Yes: we found a witness! • No: there is no conflict in the rule program. • Don’t know ξ∈Var

9. Verification Conflict (example with constraints) c =Gold ∧ a ≥60 ∧ v≥2000 ∧ c’2=Plat ∧ d’2= d +25 ∧ a’2=a ∧ v’2=v gold-discount ∘ upgrade ∘ platinum-discount category ↦ c’2 age ↦ a’2 value ↦ v’2 discount ↦ d’2 v  ≥ 1000 v  ≥ 2000 category ↦ c age ↦ a value ↦ v discount ↦ d =? d’1 = d+ 15 d’2 = d+ 25 d’1≠d’2 category ↦ c’1 age ↦ a’1 value ↦ v’1 discount ↦ d’1 upgrade ∘ platinum-discount c =Gold ∧ a ≥60 ∧ v≥1000 ∧ c’1=Plat ∧ d’1= d +15 ∧ a’1=a ∧ v’1=v

10. Challenging the CP Solverwith the conjunction of • Large Domains • variables are ranging over machine-representable values • typically 232 or 264 values for integers • Slow Propagation • when the time of domain reduction is proportional to the size of the domain • e.g. d’ = d+ 15 d’ = d+ 25

11. d’ = d + 15 d’ = d + 25 d’ = d + 15 d’ = d + 25 d’ = d + 15 etc. Slow convergence of propagation d, d’∈ [-231, 231-1] d’ ∈ [-231 + 15, 231-1] d ∈ [-231, 231-1 - 25] d’ = d+ 15 d’ = d+ 25 d’ ∈ [-231 + 15, 231-1 - 10] d ∈ [-231, 231-1 - 35] d’ ∈ [-231 + 15,231-1 - 20] ✘ It takes approx. 859 000 000 steps to reduce the domains to the empty set.

12. Slow propagation ⇏ unsatisfiability x > ux x ∈ [-231, 231-1] u ∈ {0, 1} u = 1 x≥y + 1 x≥y + 1 y = ux x, y ∈ [-231, 231-1] u ∈ {0, 1} + 231 steps of interval reduction to empty domains y = ux x ∈ [1, 231-1] y ∈ [0, 231-1] u ∈ {0, 1} 231 steps of interval reduction

13. Slow propagation ⇏ unsatisfiability x > ux x ∈ [-231, 231-1] u ∈ {0, 1} x≥y + 1 x≥y + 1 y = ux x, y ∈ [-231, 231-1] u ∈ {0, 1} u = 0 y = ux x≥ 1 x ∈ [1, 231-1] y ∈ [0, 231-1] u ∈ {0, 1} 231 steps of interval reduction solution found in 231+1 steps (best case)

14. Fighting against slow propagation • From specialized procedures • linear normalization (x = x +1) • cycle detection (x < y ∧ y < x) • congruence domains (2x+2y = 1) • … • To pragmatic techniques • Let the user specify domains (age in [0, 100]) • Stop the propagation before fix point

15. Conclusion • Using constraints for rule program verification • to translate rules into transition constraints • to express properties • to find answers using a CP Solver • It scales because • problems are small in practice • techniques are put in place to fight against slow propagation