Tagungsband 300001828X, 9783000018282

Citation preview

L e c tu re N o te s in C o m p u te r S c ie n c e E d ite d b y G . G o o s , J . H a rtm a n is a n d J . v a n L e e u w e n

1 5 7 9

3 B e r lin H e id e lb e rg N e w Y o rk B a rc e lo n a H o n g K o n g L o n d o n M ila n P a r is S in g a p o re T o k y o

W . R a n c e C le a v e la n d ( E d .)

T o o ls a n d A lg o rith m s fo r th e C o n s tru c tio n a n d A n a ly s is o f S y s te m s 5 th In te rn a tio n a l C H e ld a s P a rt o f th e o n T h e o ry a n d P ra A m s te rd a m , T h e N P ro c e e d in g s

13

o n fe J o in c tic e e th e

re n c e , T A C A S t E u ro p e a n C o o f S o ftw a re , E rla n d s , M a rc h

’9 9 n fe re n c e s T A P S ’9 9 2 2 -2 8 , 1 9 9 9

S e rie s E d ito rs G e r h a r d G o o s , K a r ls r u h e U n iv e r s ity , G e r m a n y J u r is H a r tm a n is , C o rn e ll U n iv e r s ity , N Y , U S A J a n v a n L e e u w e n , U tr e c h t U n iv e r s ity , T h e N e th e r la n d s

V o lu m e E d ito r W . R a n c e C le S ta te U n iv e rs D e p a rtm e n t o S to n y B ro o k , E -m a il: ra n c e

a v e la n d ity o f N e w f C o m p u te N Y 1 1 7 4 3 @ c s .s u n y s

Y o rk a t S to n y B ro o k r S c ie n c e -4 4 0 0 , U S A b .e d u

C a ta lo g in g -in -P u b lic a tio n d a ta a p p lie d fo r D ie D e u ts c h e B ib lio th e k - C IP -E in h e its a u fn a h m e T in E T

o o ls te rn u ro p h e N H e id e S in g a (L e IS B

a n d a lg o r ith m s a tio n a l c o n fe re n c e a n C o n fe re n c e s e th e rla n d s , M a rc lb e rg ; N e w Y o rk p o re ; T o k y o : S p c tu re n o te s in c o m N 3 -5 4 0 -6 5 7 0 3 -7

fo r th e c o n s tr u c tio n e ; p ro c e e d in g s / T A C o n T h e o ry a n d P ra c tic h 2 2 - 2 8 , 1 9 9 9 . W . R ; B a rc e lo n a ; H o n g K rin g e r, 1 9 9 9 p u te r s c ie n c e ; V o l. 1

o f a n a ly s is o f s y s te m A S ’9 9 , h e ld a s p a rt o e o f S o ftw a re , E T A P S a n c e C le a v e la n d (e d .) o n g ; L o n d o n ; M ila n

s : 5 th f th e J o in t ’9 9 , A m s te rd a m , . - B e rlin ; ; P a ris ;

5 7 9 )

C R S u b je c t C la s s ifi c a tio n ( 1 9 9 8 ) : F .3 , D .2 .4 , D .2 .2 , C .2 .4 IS S N 0 3 0 2 -9 7 4 3 IS B N 3 -5 4 0 -6 5 7 0 3 -7 S p rin g e r-V e rla g B e rlin H e id e lb e rg N e w Y o rk T h is w o rk is s u b je c c o n c e rn e d , s p e c ifi c a re p ro d u c tio n o n m ic o r p a rts th e re o f is p e in its c u rre n t v e rs io n lia b le fo r p ro s e c u tio

t to c o p y rig h t. A ll rig h ts a re re s e rv e d , w h e th e r th e w h o le o r p a rt o f th e m a te ria l is lly th e rig h ts o f tra n s la tio n , re p rin tin g , re -u s e o f illu s tra tio n s , re c ita tio n , b ro a d c a s tin g , ro fi lm s o r in a n y o th e r w a y , a n d s to ra g e in d a ta b a n k s . D u p lic a tio n o f th is p u b lic a tio n rm itte d o n ly u n d e r th e p ro v is io n s o f th e G e rm a n C o p y rig h t L a w o f S e p te m b e r 9 , 1 9 6 5 , , a n d p e r m is s io n f o r u s e m u s t a lw a y s b e o b ta in e d f r o m S p r in g e r- V e r la g . V io la tio n s a r e n u n d e r th e G e rm a n C o p y rig h t L a w .

c S p rin g e r-V e rla g B e rlin H e id e lb e rg 1 9 9 9  P rin te d in G e rm a n y T y p e s e ttin g : C a m e ra -re a d y b y a u th o r S P IN 1 0 7 0 3 1 1 3 0 6 /3 1 4 2 – 5 4 3 2 1 0

P rin te d o n a c id -fre e p a p e r

Foreword

ETAPS’99 is the second instance of the European Joint Conferences on Theory and Practice of Software. ETAPS is an annual federated conference that was established in 1998 by combining a number of existing and new conferences. This year it comprises five conferences (FOSSACS, FASE, ESOP, CC, TACAS), four satellite workshops (CMCS, AS, WAGA, CoFI), seven invited lectures, two invited tutorials, and six contributed tutorials. The events that comprise ETAPS address various aspects of the system development process, including specification, design, implementation, analysis and improvement. The languages, methodologies and tools which support these activities are all well within its scope. Different blends of theory and practice are represented, with an inclination towards theory with a practical motivation on one hand and soundly-based practice on the other. Many of the issues involved in software design apply to systems in general, including hardware systems, and the emphasis on software is not intended to be exclusive. ETAPS is a loose confederation in which each event retains its own identity, with a separate programme committee and independent proceedings. Its format is open-ended, allowing it to grow and evolve as time goes by. Contributed talks and system demonstrations are in synchronized parallel sessions, with invited lectures in plenary sessions. Two of the invited lectures are reserved for “unifying” talks on topics of interest to the whole range of ETAPS attendees. As an experiment, ETAPS’99 also includes two invited tutorials on topics of special interest. The aim of cramming all this activity into a single one-week meeting is to create a strong magnet for academic and industrial researchers working on topics within its scope, giving them the opportunity to learn about research in related areas, and thereby to foster new and existing links between work in areas that have hitherto been addressed in separate meetings. ETAPS’99 has been organized by Jan Bergstra of CWI and the University of Amsterdam together with Frans Snijders of CWI. Overall planning for ETAPS’99 was the responsibility of the ETAPS Steering Committee, whose current membership is: Andr´e Arnold (Bordeaux), Egidio Astesiano (Genoa), Jan Bergstra (Amsterdam), Ed Brinksma (Enschede), Rance Cleaveland (Stony Brook), Pierpaolo Degano (Pisa), Hartmut Ehrig (Berlin), Jos´e Fiadeiro (Lisbon), Jean-Pierre Finance (Nancy), Marie-Claude Gaudel (Paris), Susanne Graf (Grenoble), Stefan J¨ ahnichen (Berlin), Paul Klint (Amsterdam), Kai Koskimies (Tampere), Tom Maibaum (London), Ugo Montanari (Pisa), Hanne Riis Nielson (Aarhus), Fernando Orejas (Barcelona), Don Sannella (Edinburgh), Gert Smolka (Saarbr¨ ucken), Doaitse Swierstra (Utrecht), Wolfgang Thomas (Aachen), Jerzy Tiuryn (Warsaw), David Watt (Glasgow)

VI

ETAPS’98 has received generous sponsorship from: – – – – – – –

KPN Research Philips Research The EU programme “Training and Mobility of Researchers” CWI The University of Amsterdam The European Association for Programming Languages and Systems The European Association for Theoretical Computer Science

I would like to express my sincere gratitude to all of these people and organizations, the programme committee members of the ETAPS conferences, the organizers of the satellite events, the speakers themselves, and finally SpringerVerlag for agreeing to publish the ETAPS proceedings. Edinburgh, January 1999

Donald Sannella ETAPS Steering Committee Chairman

VII

Preface This volume contains the proceedings of the fifth international meeting on Tools and Algorithms for the Construction and Analysis of Systems (TACAS’99). TACAS’99 took place on 22–25 March 1999 in Amsterdam as a constituent conference of the European Joint Conferences on Theory and Practice of Software (ETAPS). More information about it may be found in the foreword. Previous TACAS meetings occurred in 1998 (Lisbon), 1997 (Twente), 1996 (Passau), and 1995 (Aarhus). Like TACAS’98, TACAS’99 was a conference, while the meetings before 1998 were workshops. All previous TACAS proceedings have been published as volumes in Springer’s Lecture Notes in Computer Science series. TACAS’s mission is to provide a forum for researchers, developers and users interested in rigorously based tools for the construction and analysis of systems. The conference aims to bridge the gaps between different communities — including but not limited to those devoted to formal methods, real-time, software engineering, communications protocols, hardware, theorem proving, and programming languages — that have traditionally had little interaction but share common interests in and techniques for tool development. In particular, by providing a venue for the discussion of common problems, heuristics, algorithms, data structures and methodologies, TACAS hopes to support researchers in their quest to improve the utility, reliability, flexibility and efficiency of tools for building systems. These proceedings contain an invited paper, 28 refereed contributions, a position statement, and the text of an ETAPS tool demonstration that was reviewed independently of the TACAS program committee. The 28 regular papers were selected from 82 submissions, which represents the largest number of submissions TACAS has had to date. The accepted papers cover a wide range of topics, as the table of contents indicates, although all have relevance to the development and deployment of tools. As Program Committee Chairman for TACAS, I would like to acknowledge the efforts of the Program Committee and paper reviewers. The obvious strength of the conference program is a testament to their thoughtful analyses of the submitted papers and to the seriousness with which they approached the selection process. I would also like to thank the other members of the TACAS Steering Committee for their guidance and advice in organizing the conference. Stony Brook, January 1999

W. Rance Cleaveland II Program Committee Chairman TACAS’99

TACAS Steering Committee Ed Brinksma (NL) Rance Cleaveland (USA)

Kim G. Larsen (DK) Bernhard Steffen (D)

VIII

TACAS’99 Program Committee Chairman: Rance Cleaveland (SUNY at Stony Brook, USA) Rajeev Alur (U. Pennsylvania, USA) Ed Brinksma (U. Twente, NL) Hubert Garavel (INRIA R.-A., F) Fausto Giunchiglia (U. Trento, I) Mike Gordon (Cambridge U., UK) Roberto Gorrieri (U. Bologna, I) Jan Friso Groote (CWI, NL)

Nicolas Halbwachs (V´erimag, F) Gerard Holzmann (Bell Labs, USA) Kurt Jensen (U. Aarhus, DK) Kim G. Larsen (Aalborg U., DK) Tiziana Margaria (U. Dortmund, D) David Notkin (U. Washington, USA) Gregor Snelting (U. Braunschweig, D)

Reviewers Roberto Amadio Pedro R. D’Argenio Eugene Asarin Twan Basten Marco Bernardo G´erard Berry Roland Bol Volker Braun Mario Bravetti Olaf Burkart Paul Caspi Soren Christensen S. Cimato Susanna Donatelli Kousha Etessami Amy Felty Riccardo Focardi Mauro Gaspari Alain Girault Susanne Graf Radu Grosu Lex Heerink Nevin Heintze Tom Henzinger Holger Hermanns Leszek Holenderski Doug Howe Ole H. Jensen

Peter K. Jensen Burghard von Karger Joost-Pieter Katoen Josva Kleist Jens Knoop Dirk Kosch¨ utzki Lars M. Kristensen Hee-Hwan Kwak Cosimo Laneve Rom Langerak Izak van Langevelde Fran cois Laroussinie Naiel Lieuwen Bas Luttik Ken McMillan Oded Maler Radu Mateescu Michael Merritt Kees Middelburg Fran cois Monin Kjeld H. Mortensen Laurent Mounier Markus M¨ uller-Olm Uwe Nestmann Brian Nielsen Oliver Niese Thomas Noll Albert Nymeyer

Doron Peled Paul Pettersson G. Michele Pinna Marco Pistore Jaco van de Pol L. Pomello Anders P. Ravn Michel Reniers Arend Rensink M. Roccetti Judi Romijn Karen Rudie Vlad Rusu Oliver R¨ uthing Theo C. Ruys Ph. Schnoebelen Mary Sheeran Mihaela Sighireanu Bernhard Steffen Jan Tretmans Stavros Tripakis Rene de Vries Jos van Wamel Carsten Weise Tim Willemse Sergio Yovine Gianluigi Zavattaro Job Zwiers

Table of Contents

Invited Contribution Modeling for Mere Mortals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 J. Kramer, J. Magee Real-Time Scheduling System Verification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 P.-A. Hsiung, F. Wang, Y.-S. Kuo A Period Assignment Algorithm for Real-Time System Design . . . . . . . . . . . . . 34 M. Ryu, S. Hong Analyzing Stochastic Fixed-Priority Real-Time Systems . . . . . . . . . . . . . . . . . . . 44 M. Gardner, J. Liu Timed Diagnostics for Reachability Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 S. Tripakis Case Studies Fighting Livelock in the i-Protocol: A Comparative Study of Verification Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 Y. Dong, X. Du, Y. Ramakrishna, C. Ramakrishnan, I. Ramakrishnan, S. Smolka, O. Sokolsky, E. Stark, D. Warren Proving the Soundness of a Java Bytecode Verifier Specification in Isabelle/HOL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 C. Pusch Automated Fast-Track Reconfiguration of Group Communication Systems 104 C. Kreitz Specifications and Proofs for Ensemble Layers . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 J. Hickey, N. Lynch, R. van Renesse Compositionality and Abstraction An Automated Analysis of Ping-Pong Interactions in E-Mail Services . . . . 134 A. Bergeron, J.-C. Manzoni Automatic Verification of Cryptographic Protocols through Compositional Analysis Techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 D. Marchignoli, F. Martinelli Verification of Hierarchical State/Event Systems Using Reusability and Compositionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163 G. Behrmann, K. Larsen, H. Andersen, H. Hulgaard, J. Lind-Nielsen

X

Table of Contents

On Proving Safety Properties by Integrating Static Analysis, Theorem Proving and Abstraction . . . . . . . . . . . . . . . . . . . . . . . 178 V. Rusu, E. Singerman Symbolic Analysis Symbolic Model Checking without BDDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193 A. Biere, A. Cimatti, E. Clarke, Y. Zhu Symbolic Verification of Lossy Channel Systems: Application to the Bounded Retransmission Protocol . . . . . . . . . . . . . . . . . . . . . 208 P. Abdulla, A. Annichini, A. Bouajjani Model Checking in CLP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223 G. Delzanno, A. Podelski Using Logic Programs with Stable Model Semantics to Solve Deadlock and Reachability Problems for 1-Safe Petri Nets . . . . . . . . . . . . . . . . 240 K. Heljanko Process Algebra Finite State Verification for the Asynchronous Pi-Calculus . . . . . . . . . . . . . . . 255 U. Montanari, M. Pistore Process Algebra in PVS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270 T. Basten, J. Hooman On the Benefits of Using the Up To Techniques for Bisimulation Verification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285 D. Hirschkoff Computing Strong/Weak Bisimulation Equivalences and Observation Congruence for Value-Passing Processes . . . . . . . . . . . . . . . . . . . . . 300 Z. Li, H. Chen Frameworks for System Construction and Analysis Hardware Testing Using a Communication Protocol Conformance Testing Tool . . . . . . . . . . . . . . . . . . . . . . 315 H. Kahlouche, C. Viho, M. Zendri A Light-Weight Framework for Hardware Verification . . . . . . . . . . . . . . . . . . . . 330 C. Kern, T. Ono-Tesfaye, M. Greenstreet An Easily Extensible Toolset for Tabular Mathematical Expressions . . . . . . 345 D. Peters, D.L. Parnas From DFA-Frameworks to DFA-Generators: A Unifying Multiparadigm Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 360 J. Knoop

Table of Contents

XI

Tool Descriptions A Theorem Prover-Based Analysis Tool for Object-Oriented Databases . . . 375 D. Spelt, S. Even DYANA: An Environment for Embedded System Design and Analysis . . . . 390 A. Bakhmurov, A. Kapitonova, R. Smeliansky Path Exploration Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 405 E. Gunter, D. Peled Modular State Level Analysis of Distributed Systems Techniques and Tool Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 420 P. Buchholz, P. Kemper Position Paper Some Issues in the Software Engineering of Verification Tools . . . . . . . . . . . . 435 P. Stevens ETAPS Tool Demonstation The ETI Online Service in Action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 439 V. Braun, J. Kreileder, T. Margaria, B. Steffen Author Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 445

Integrating Printed and Online Information Thomas Friese1 , Tiziana Margaria2, and Thomas Rakow3 1

2

NeoMedia Technologies, Vienna (A), www.neom.com MetaFrame Technologies, Dortmund (D), www.metaframe.de 3 Springer Verlag, Heidelberg (D), www.springer.de

This LNCS volume concretizes a pilot project between NeoMedia Technologies, MetaFrame Technologies, and the Springer Verlag aimed at flexibly combining the strengths of printed and online documents. In a typical scenario, a combination of technologies enables researchers and students who normally frequent a library for taking copies to order their own high-quality print-outs of selected literature by scanning bar codes identifying the relevant papers as well as an authorization code (e.g. from a membership card). This automatically directs the print-outs to the most appropriate printer, e.g., at the member’s institute or directly at the library. Costs are deduced from the member’s or institution’s account. Using light-weight bar code readers, this avoids the typical drawbacks of traditional copying, like physically carrying the volumes to the queue at the copier, lengthy operations, which also deteriorates the books, and the often bad quality of the copies. Technically, our solution combines – a Digital Object Identifier (DOI), a unique and persistent identification code identical for printed and electronic versions of a document, 1 – an IDOCsTM enabled bar code on the printed documents corresponding to the DOI, and – an internet service managing the overall workflow. The Springer Verlag is among the publishers supporting the introduction of the DOI global identification system for intellectual property in the digital environment. Additionally, in our prototype comfortable and intelligent access to electronic documents is realized by linking light-weight string code technology with the power of modern internet. Via the bar code or the numeric code below it, IDOCs (NeoMedia Technologies’s Intelligent Document Solutions) guides the interested party over internet directly to a specific, customizable online service offered by MetaFrame Technologies which manages the subsequent workflow. In particular, it is possible to direct the request to further detailed information on a web page (here, the online version of the paper), and to add extra functionality (printing and billing) without modifying the underlying web presence. This combination of technologies guarantees not only the shortest distance to the required information but also enables additional, flexible support. Common goals of the present project are to provide a framework for managing intellectual content, link customers with publishers, facilitate electronic commerce, and enable automated copyright management. The technology is in fact easily applicable to many more scenarios where the currently lacking consequent coherence between printed and online information would dramatically simplify the workflow for library users, librarians and publishers. 1

IDOCs is a registered trademark of NeoMedia Technologies.

M o d e llin g fo r m e r e M o r ta ls Je ff K ra m e r a n d Je ff M a g e e D e p a rtm e n t Im p e ria l C o lle g e o f S c ie n c e , L o n d o n S W { jk ,jn m } @

o f T e 7 d o

C o m p u tin g c h n o lo g y a n d M e d ic in e , 2 B Z , U K . c .ic .a c .u k

A b s tr a c t. In th e p a s t, a tte m p ts to c o n v in c e p ra c tis in g s o ftw a re e n g in e e rs to a d o p t fo rm a l m e th o d s o f s o ftw a re d e v e lo p m e n t w e re g e n e ra lly u n s u c c e s s fu l. T h e m e th o d s w e re to o d iffic u lt to le a rn a n d u s e , p ro v id e d in a d e q u a te to o l s u p p o rt a n d d id n o t in te g ra te w e ll in to th e s o ftw a re d e v e lo p m e n t p ro c e s s . In s h o rt, th e y c o u ld o n ly b e u s e d e ffe c tiv e ly b y th e g o d s w h o c re a te d th e m ! A re w e in a b e tte r p o s itio n to d a y ? R e c e n t a d v a n c e s in a n d e x p e rie n c e w ith s p e c ific a tio n te c h n iq u e s a n d a u to m a te d m o d e l c h e c k in g h a v e d e m o n s tra te d th e u tility o f th e s e te c h n iq u e s . In th is p a p e r w e o u tlin e o n e s u c h e ffo rt w h ic h is s p e c ific a lly in te n d e d to fa c ilita te m o d e llin g a s p a rt o f th e s o ftw a re p ro c e s s , a n d to try to m a k e m o d e l s p e c ific a tio n a n d m o d e l c h e c k in g a c c e s s ib le to m e re m o rta ls .

1

I n tr o d u c tio n th

T h e A C M 5 0 A n n iv e rs a ry e d itio n o f C o m p u tin g S u rv e y s c o n ta in s tw o e x c e lle n t p a p e rs d e s c rib in g th e s ta te o f th e a rt a n d re s e a rc h d ire c tio n s in F o rm a l M e th o d s [1 ] a n d C o n c u rre n c y [2 ]. T h e fo rm e r p a p e r d e s c rib e s th e fa ilu re o f p a s t fo rm a l m e th o d s to m a k e a re a l im p a c t o n p ra c tis in g s o ftw a re e n g in e e rs , in d ic a tin g th a t th e y w e re ju s t to o d iffic u lt to le a rn a n d u s e , p ro v id e d in a d e q u a te to o l s u p p o rt a n d d id n o t in te g ra te w e ll in to th e s o ftw a re d e v e lo p m e n t p ro c e s s . T h e p a p e r d e s c rib e s h o w re c e n t a d v a n c e s in fu n d a m e n ta l re s e a rc h a n d im p ro v e d te c h n o lo g y h a s e n a b le d a n u m b e r o f s p e c ific a tio n a n d v e rific a tio n te c h n iq u e s to b e u s e d in p ra c tic e o n m a jo r in d u s tria l c a s e s tu d ie s . H o w e v e r, if w e a re to m a k e a s ig n ific a n t im p a c t o n p ra c tic e , w e m u s t s till s e e k to m a k e o u r m e th o d s a n d to o ls m o re a ttra c tiv e a n d a c c e s s ib le to p ra c tio n e rs . In a d d itio n , w e n e e d to p ro v id e th e a s s o c ia te d e d u c a tio n a n d te c h n o lo g y tra n s fe r. T h e la tte r p a p e r [2 ] p ro v id e s a n e x c e lle n t o v e rv ie w o f th e is s u e s a n d c u rre n t re s e a rc h in th e fie ld o f c o n c u rre n c y . A g a in , th e n e e d fo r e d u c a tio n , te c h n o lo g y tra n s fe r a n d im p ro v e d in te g ra tio n w ith th e s o ftw a re life c y c le is id e n tifie d . F u rth e rm o re , th e p a p e r s ta te s : ” T ra d itio n a lly , s o ftw a re e n g in e e rin g d e v o te s m u c h a tte n tio n to o rg a n iz a tio n a l a n d p ro c e d u ra l is s u e s in s o ftw a re d e v e lo p m e n t a n d re la tiv e ly little to m e th o d s fo r s y s te m a n a ly s is ; in th is re s p e c t it re s e m b le s a m a n a g e m e n t d is c ip lin e ra th e r th a n a n e n g in e e rin g o n e . T o o ls b a s e d o n c o n c u rre n c y th e o ry o ffe r a p a rtic u la rly a p p ro p ria te s ta r tin g p o in t fo r p u ttin g th e e n g in e e r in g in to s o f tw a r e e n g in e e r in g .”

W . R . C l e a v e l a n d ( E d . ) : T A C A S / E T A P S '9 9 , L N C S 1 5 7 9 , p p . 1 - 1 8 , 1 9 9 9 . © S p rin g e r-V e rla g B e rlin H e id e lb e rg 1 9 9 9

2

Je ff K ra m e r a n d Je ff M a g e e

O n e o f th e m a in a im s o f o u r re s e a rc h is to p ro v id e s o u n d a n fo r m o d e llin g a n d m o d e l v e rific a tio n a s s o c ia te d w ith th e d e v a n d d is trib u te d s y s te m s . W e a re a c u te ly a w a re o f th e p p o w e rfu l b u t e ru d ite a p p ro a c h e s u s a b le b y o n ly th e d e v e lo p e th e re fo re s o u g h t to a d o p t a n d a d a p t c o n c e p ts a n d te c h n iq u e s w o f w id e s c a le u s e b y o rd in a ry , c o m p e te n t e n g in e e rs . W e re c o g o r to o l w ill s u ffic e fo r a ll p u rp o s e s , a n d b e lie v e th a t it is b fo c u s s e d u s a b le a p p ro a c h th a n o n e w h ic h is m o re g e n e ra l b u fo c u s o u r w o rk o n th e m o d e llin g o f o n ly a p a rtic u la r a s p e c t o b e h a v io u r.

d a c c e s s ib le te c h n iq u e s e lo p m e n t o f c o n c u rre n t ro b le m s o f a d v o c a tin g rs th e m s e lv e s . W e h a v e h ic h o ffe r th e b e s t h o p e n is e th a t n o o n e m e th o d e tte r to p ro v id e a w e llt le s s u s a b le . H e n c e w e f a s y s te m – c o n c u rre n t

I n te g r a tio n w ith th e s o ftw a r e d e v e lo p m e n t p r o c e s s O u r a p p ro a c h e x p lo its th e s o ftw a re a rc h ite c tu re a s th e u n d e rly in g d e s ig n s tru c tu re o f a s y s te m , c o m m o n to th e v a rio u s p h a s e s o f s y s te m d e v e lo p m e n t. In p a rtic u la r, w e u s e th e D a r w in a r c h ite c tu r e d e s c r ip tio n la n g u a g e [ 3 ,4 ] w h ic h h a s b e e n d e s ig n e d to b e s u ffic ie n tly a b s tra c t to s u p p o rt m u ltip le v ie w s (F ig u re 1 ). E a c h v ie w is a n e la b o ra tio n o f th e b a s ic s tru c tu ra l v ie w : th e s k e le to n u p o n w h ic h w e h a n g th e fle s h o f b e h a v io u r s p e c ific a tio n o r s e rv ic e im p le m e n ta tio n [5 ]. T h e s e rv ic e v ie w d e s c rib e s th e s y s te m a s a h ie ra rc h ic a l c o m p o s itio n o f c o m p o n e n ts , e a c h o f w h ic h p ro v id e s a n d re q u ire s s e rv ic e s a t its in te rfa c e , w ith im p le m e n ta tio n e la b o ra tio n s fo r th e p rim itiv e c o m p o n e n ts . T h e b e h a v io u ra l v ie w m o d e ls th e s y s te m a s a h ie ra rc h ic a l, p a ra lle l c o m p o s itio n o f c o m p o n e n t p ro c e s s e s , e a c h o f w h ic h in te ra c ts w ith o th e r p ro c e s s e s v ia s h a re d a c tio n s a t its in te rfa c e , w ith b e h a v io u r e la b o ra tio n s fo r th e p rim itiv e c o m p o n e n t p ro c e s s e s . In e s s e n c e , th e a rc h ite c tu re d riv e s th e p ro c e s s o f p u ttin g to g e th e r in d iv id u a l c o m p o n e n t s p e c ific a tio n s o r im p le m e n ta tio n s in o rd e r to o b ta in a s y s te m w ith d e s ira b le c h a ra c te ris tic s . W h e n p e rfo rm in g a n a ly s is , th e s e c h a ra c te ris tic s a re fo rm a lly d e s c rib e d in te rm s o f p ro p e rtie s a g a in s t w h ic h th e s p e c ifie d s y s te m is c h e c k e d .

S tr u c tu r a l V ie w

B e h a v io u r a l V ie w

A n a ly s is

S e r v ic e V ie w

C o n s tr u c tio n / im p le m e n ta tio n

F ig . 1 . C o m m o n S tru c tu ra l V ie w , w ith S e rv ic e a n d B e h a v io u ra l V ie w s

M o d e llin g fo r m e re M o rta ls

3

S p e c ific a tio n a n d A n a ly s is S ta te m a c h in e s a re a p o p u la r m o d e llin g te c h n iq u e w h ic h is w id e ly ta u g h t a n d u s e d . F o r th is re a s o n , w e w e re a ttra c te d to th e u s e o f L a b e lle d T ra n s itio n s y s te m s (L T S ) a s th e u n d e rly in g fo rm a lis m fo r o u r w o rk . F o r th e v e rific a tio n o f fin ite m o d e ls , m o d e l c h e c k in g o ffe rs a fa s t, a u to m a tic te c h n iq u e w ith th e b e n e fit o f p ro v id in g c o u n te re x a m p le s a s fe e d b a c k w h e n p ro p e rty v io la tio n s a re d e te c te d . T h is s a tis fie s o u r b e lie f th a t a u to m a te d to o ls a re e s s e n tia l to a id v e rific a tio n . F u rth e rm o re , L T S s u p p o rts th e a p p ro p ria te c o m p o s itio n a lity (u s in g C o m p o s itio n a l R e a c h a b ility A n a ly s is C R A ) w ith th e c o m p o n e n ts s p e c ifie d s im p ly a s fin ite s ta te p ro c e s s e s (F S P ) [6 ]. C o m p o s itio n a l m e th o d s a re d e s ira b le in th e w a y th a t th e y c a n re fle c t th e s tru c tu re o f th e s y s te m . In a d d itio n , w e h a v e te c h n iq u e s fo r a m e lio ra tin g th e p ro b le m o f e x p o n e n tia l s ta te e x p lo s io n in s o m e c irc u m s ta n c e s [7 ] a n d fo r a n a ly s in g fo r b o th s a fe ty [8 ] a n d liv e n e s s [9 ] p ro p e rtie s . O u r p ro p e rty c h e c k in g m e c h a n is m s h a v e b e e n s p e c ific a lly d e s ig n e d fo r o u r m o d e ls th a t fo c u s o n a c tio n s ra th e r th a n s ta te s a n d a ls o a d d re s s is s u e s re la te d to C R A te c h n iq u e s . A s liv e n e s s p ro p e rty c h e c k s c a n b e e x p e n s iv e , w e h a v e a ls o id e n tifie d a s u b c la s s o f s u c h p ro p e rtie s th a t o c c u r fre q u e n tly in p ra c tic e , a n d w h ic h c a n b e c h e c k e d d ire c tly o n th e g ra p h o f th e s y s te m , w ith o u t th e u s e o f B ü c h i a u to m a ta [1 0 ]. T h is c la s s h a s b e e n n a m e d p ro g re s s . F in a lly , o u r m e th o d s a ls o s u p p o rt a c tio n p rio rity , w h ic h a llo w s u s e rs to c o n c e n tra te o n s p e c ific p a rts o f s y s te m b e h a v io u r, to im p o s e a d v e rs e c o n d itio n s , o r p e rfo rm a p a rtia l s e a rc h w h e n a n e x h a u s tiv e s e a rc h c a n n o t b e a c h ie v e d . A ll th is is s u p p o rte d b y th e L T S A n a ly s e r (L T S A ) w h ic h p ro v id e s fo r a u to m a tic c o m p o s itio n , a n a ly s is , m in im is a tio n , a n im a tio n a n d g r a p h ic a l d is p la y [ 5 ,1 1 ,1 2 ] . P a p e r o u tlin e R a th e r th a n d e s c rib e th e u n d e rly in g th e o ry o r d e ta ils o f th e a n a ly s is te c h n iq u e s , w e u s e a n e x a m p le to illu s tra te o u r g e n e ra l a p p ro a c h a n d to o l s u p p o rt. In p a rtic u la r, w e u s e a S u p e rv is o r-W o rk e r/T u p le S p a c e e x a m p le o f a c o n c u rre n t a rc h ite c tu re to illu s tra te th e u s e o f F S P /L T S a n d th e L T S A to o ls fo r s p e c ific a tio n a n d re a s o n in g . F o r th e s a k e o f b re v ity , w e m a k e v e ry little a tte m p t to c o m p a re o u r w o rk w ith th a t o f o th e r s . T h e F o rm a l M e th o d s a n d C o n c u r r e n c y p a p e r s [ 1 ,2 ] p ro v id e a n e x c e lle n t s u rv e y o f th e fie ld a n d o f re la te d w o rk . In s te a d w e m e re ly try to in d ic a te th e re a s o n s fo r s o m e o f o u r c h o ic e s . W e in tro d u c e o n ly a s m u c h o f th e n o ta tio n a n d a n a ly s is te c h n iq u e s a s n e c e s s a ry fo r th e e x a m p le . F u ll d e ta ils c a n b e fo u n d in [1 3 ] a n d a t th e w e b s ite : h ttp ://w w w - d s e .d o c .ic .a c .u k /c o n c u r r e n c y /.

4

Je ff K ra m e r a n d Je ff M a g e e

2 . A r c h ite c tu r a l D e s ig n a n d A n a ly s is : a n E x a m p le

2 .1 S u p e r v is o r - W S u p e rv is o r-W e x e c u tio n o m u ltip le p ro s p lit u p in to a re re fe rre d W o rk e r p ro g

o r k e r D e s c r ip tio n

o rk e r is a f so m e c o m c e sso rs. T h e a n u m b e r o f to a s ta s k s ra m is d e p ic

c o n c u rre n t a p u ta tio n a l p a rc h ite c tu re in d e p e n d e n t in th e fo llo w te d in F ig u re

W

rc h ite c tu re th a t c a n b e u s e d to ro b le m s b y e x p lo itin g p a ra lle l a p p lie s w h e n a c o m p u ta tio n a l p r s u b -p ro b le m s . T h e s e in d e p e n d e n t in g . T h e p ro c e s s a rc h ite c tu re o f 2 .

O R K E R

W

O R K E R

W

sp e x o b su a

e e d e c u le m b -p S u p

u p tio n c a n ro b le e rv is

th e o n b e m s o r-

O R K E R

“ B A G ”

S U P E R V IS O R

S u p e r v is o r -W o r k e r F ig . 2 . S u p e rv is o r-W o rk e r p ro c e s s a rc h ite c tu re

S u p e rv is o r m o m e n t, a s o f ta s k s a n d th e b a g a n d ta k e s a ta s k b a g . T h is p fin is h e d . W a rc h ite c tu re th e b a g c o n

a n a p d fr ro e

d w o rk e r p ro c e s s e s in te ra c t b y a c o n n e c to r th a t w e re fe r to , fo r th e “ b a g ” . T h e s u p e rv is o r p ro c e s s is re s p o n s ib le fo r g e n e ra tin g a n in itia l s e t la c in g th e m in th e b a g . A d d itio n a lly , th e s u p e rv is o r c o lle c ts re s u lts fro m e te rm in e s w h e n th e c o m p u ta tio n h a s fin is h e d . E a c h w o rk e r re p e titiv e ly o m th e b a g , c o m p u te s th e re s u lt fo r th a t ta s k , a n d p la c e s th e re s u lt in th e c e s s is re p e a te d u n til th e s u p e rv is o r s ig n a ls th a t th e c o m p u ta tio n h a s c a n u s e a n y n u m b e r o f w o rk e r p ro c e s s e s in th e S u p e rv is o r-W o rk e r . F irs t, w e e x a m in e a n in te ra c tio n m e c h a n is m s u ita b le fo r im p le m e n tin g n e c to r.

M o d e llin g fo r m e re M o rta ls

2 .2

5

L in d a T u p le S p a c e

L in d a is th p rim itiv e o p is a s h a re d a tu p le s . E a c h ( “ t a g ” ,

e c e ra sso d a

o lle c tiv e n a tio n s u s e d to c ia tiv e m e m ta tu p le in a

m e a c o ry tu p

v a l u e 1, … ,

g iv c e ss c o n le s p

e n b y a d a ta s is tin g a c e h a

v a l u e

C a rrie s tru c tu o f a c o s th e fo

ro re lle rm

a n d G e le rn te r [1 4 ] fo r a s e t o f c a lle d a tu p le s p a c e . A tu p le s p a c e c tio n o f ta g g e d d a ta re c o rd s c a lle d :

) n

T h e ta g is a lite ra l s trin g u s e d to d is tin g u is h b e tw e e n tu p le s re p re s e n tin g d iffe re n t c la s s e s o f d a ta . v a lu e ia re z e ro o r m o re d a ta v a lu e s – in te g e rs , flo a ts a n d s o o n . T h e re a re th re e b a s ic L in d a o p e ra tio n s fo r m a n ip u la tin g d a ta tu p le s : o u t, in a n d r d . A p ro c e s s d e p o s its a tu p le in a tu p le s p a c e u s in g : o u t ( “ t a g ” ,

e x p r 1, … ,

e x p r

) n

E x e c u tio n o f o u t c o m p le te s w h e n th e e x p re s s io n s h a v e b e e n e v a lu a te d a n d th e re s u ltin g tu p le h a s b e e n d e p o s ite d in th e tu p le s p a c e . A p ro c e s s re m o v e s a tu p le fro m tu p le s p a c e b y e x e c u tin g : i n ( “ t a g ” ,

f i e l d 1, … ,

f i e l d n

)

E a c h fie ld iis e ith e r a n e x p re s s io n o r a fo rm a l p a ra m e te r o f th e fo rm ? v a r w h e re v a r is a lo c a l v a ria b le in th e e x e c u tin g p ro c e s s . T h e a rg u m e n ts to in a re c a lle d a te m p la te ; th e p ro c e s s e x e c u tin g in b lo c k s u n til th e tu p le s p a c e c o n ta in s a tu p le th a t m a tc h e s th e te m p la te a n d th e n re m o v e s it. A te m p la te m a tc h e s a d a ta tu p le in th e fo llo w in g c irc u m s ta n c e s : if th e ta g s a re id e n tic a l, th e te m p la te a n d tu p le h a v e th e s a m e n u m b e r o f fie ld s , th e e x p re s s io n s in th e te m p la te a re e q u a l to th e c o rre s p o n d in g v a lu e s in th e tu p le , a n d th e v a ria b le s in th e te m p la te h a v e th e s a m e ty p e a s th e c o rre s p o n d in g v a lu e s in th e tu p le . W h e n th e m a tc h in g tu p le is re m o v e d fro m th e tu p le s p a c e , th e fo rm a l p a ra m e te rs in th e te m p la te a re a s s ig n e d th e c o rre s p o n d in g v a lu e s fro m th e tu p le . T h e th a t o p e r a ls o if a c a lle e x a m

th ird th e a tio n p ro v m a tc d e v p le .

b a tu p is id e h in a l

s ic o p e ra tio n is r d , w h le m a tc h in g th e te m p u s e d to e x a m in e th e c o s n o n -b lo c k in g v e rs io n g tu p le is fo u n d a n d r th a t c re a te s a n a c tiv e

F S P N o ta tio n T h e b e h a v io u ra l s p ro c e s s a lg e b ra -b a d e s c rib in g th e L a p u rp o s e s . It is a n o rig in a l in te n tio n H o w e v e r, it s o o n b

p e c ific a tio n s e d n o ta tio n b e lle d T ra n s “ A S C II” n o w a s to p ro e c a m e c le a r

ic h fu n la te is n te n ts s o f in e tu rn f o r p ro

c tio n s in e x a c tly th e s a m e n o t re m o v e d fro m th e o f a tu p le s p a c e w ith o u t m a n d r d c a lle d in p a n d r d p a ls e o th e rw is e . L in d a h a s c e s s tu p le . It is n o t u s e d

fo r th e tu p le [ 5 ,1 1 ,1 2 ,1 3 ] . itio n S y s te m ta tio n to s im v id e a g ra p th a t th is w a s

sp a c T h is (L T p lify h ic a l c lu m

w a y a s in e x c e p t tu p le s p a c e . T h e o d ify in g it. L in d a w h ic h re tu rn tru e a s ix th o p e ra tio n in th e fo llo w in g

e in v o lv e s d e s c rib in g it in th e F S P n o ta tio n is u s e d a s a c o n c is e w a y o f S ) o f th e tu p le s p a c e fo r a n a ly s is p a rs in g b y th e a n a ly s is to o ls . T h e to o l fo r d ra w in g L T S d ia g ra m s . s y a n d in a p p ro p ria te fo r a ll b u t th e

6

Je ff K ra m e r a n d Je ff M a g e e

s im p le s t o f m o d e ls . H e n c e w e ra th e r p ro v id e a m e a n s fo r tra n s la tin g a n d d is p la y in g F S P s p e c ific a tio n s a s L T S d ia g ra m s a s fe e d b a c k to th e d e s ig n e rs . P rim itiv e c o m p o n e n ts a re d e fin e d " - > " , c h o ic e " | " , a n d re c u rs io n . d e s c rib e s a p ro c e s s th a t in itia lly e d e s c rib e d b y P . If x a n d y a re w h ic h in itia lly e n g a g e s in e ith e r o is d e s c rib e d b y P o r Q , re s p e c tiv a c tio n .

a s fin ite s ta te p ro c e If x is a n a c tio n a n g a g e s in th e a c tio n a c tio n s th e n ( x - > f th e a c tio n s x o r y e ly . G u a rd s c a n b e

s s e s in F S P n d P a p ro x a n d th e n P | y - > Q ) , a n d th e s u u s e d to c o

P ro c e sse in te ra c t a c tio n s . fa c ilita te s a tis fie s

th ir d c e r

s itio n w ith C S P h e c k

s c a n b y s W e h s th e d e s ir

b e c o m p o s e d u s in g y n c h ro n is in g o n th e a v e a d o p te d th e b ro a c o m p o s itio n o f p ro p e d p ro p e rtie s .

T u p le S p a c e M O u r m o d e lin g a w e m u st m o d e l s p a c e c a n c o n ta o f c o p ie s o f e a c a n d th e a llo w e d

o d e l p p ro a c h re q u a tu p le s p a c e in m o re th a n h v a lu e th a t v a lu e s to b e

c o n s t N = … s e t T u p l e s = T h tu p ta g th e

e p le .v a n m

re c is e d e sp a c e m l1… v a ln. o d e lle d

fin o d W b y

itio n e l. E e d e f th e p

ir w o a r th

F a l s e T r u e B o o l

T U P L E ( T U P L E [ = ( o | w | w | w | w | r ) .

T = i : u t h e h e h e h e d p

' a 0 . [ T n

=

fin ite s ta te le v a lu e s . In m e v a lu e , w e th is n u m b

m o d a d d e m e r to

r “ | | ” . P ro c e ss v in g o f a ll o th in te ra c tio n a s th c o m p o s e d s y s te

e ls . itio u st b e

C n , fix th

u p v a ss p o

l e s lu e to m s itio

d is a n n

e p m a g o f

e n d s o n th o d e lle d b e e a c h tu p th e s e p ro c y

o n se s in c th e e c o

q u e n e a tu n u m n s ta n

e s e r is m

tly , p le b e r t N

e c o n te x t in w h ic h w e u s e th e a n F S P la b e l o f th e fo rm le v a lu e a n d th e tu p le s p a c e is e sse s:

F a l s e . . T r u e

| | T U P L E S P A C E

=

n

n s tru c t t o f tu p th e s a e d e fin

ra to rle a fo r th e

1 =

> 0 > 0 = = > 0 ] [

[

c o se ith W s.

o p e in te [1 5 ] th a t

0 =

n y . N ] ( i ( i ( i ( i i > 0

n

th a t w e a fin ite tu p le w llo w e d . e t T u p le

p o s, o f c

{ … }

o f N a n d T a c h tu p le in e a p ro c e a ra lle l c o m

c o n s t c o n s t r a n g e

n

e s ith n e e a e s

e p a ra lle l c o m s h a re d a c tio n a s t s e m a n tic s ty a u to m a ta to

u s in g a c tio n p re fix c e s s th e n ( x - > P ) b e h a v e s e x a c tly a s d e s c rib e s a p ro c e s s b s e q u e n t b e h a v io u r n tro l th e c h o ic e o f

)

=

T U P L E [ 0 ] ,

] )

i n ) i n 0 ) i n ) r d T ]

[ T p [ p [ [ T

] T r u e ] [ T ] F a l s e ] [ T ] ]

f o r a l l

- > - > - > - > - > - >

[ t : T u p l e s ]

T U T U T U T U T U T U

P L P L P L P L P L P L

E [ E [ E [ E [ E [ E [

i + 1 ] i - 1 ] i - 1 ] i ] i ] i ]

T U P L E ( t ) .

M o d e llin g fo r m e re M o rta ls

T h e L T S fo r T U P L E v a lu e a n y w n o t s p e c ifie d a g u a rd fo r th e p e rfo rm in g m o re th a n tw o o u t o th e E R R O R s ta te – 1 in fig u re 3 . T in d ic a te s th a t th a t e rro r is p o s s ib le L T S A c o m p ile r a u to m a tic a lly m a A s s h o w n la te r, th e E R R O R s ta te v io la tio n o f s a fe ty p ro p e rtie s .

ith N = 2 is d e p ic te d in fig u re 3 . N o u t a c tio n . H e n c e , e x c e e d in g p e ra tio n s le a d s to a n E R R O R . T h h is is a fo rm o f tra p s ta te [8 ] w h in th e s y s te m . T o a id th e s p e c ific p s s u c h u n d e fin e d tra n s itio n s to is a ls o u s e d in p ro p e rty a u to m a ta

7

o te th a t w e h a v e th e c a p a c ity b y is is in d ic a te d b y ic h , if re a c h a b le , a tio n p ro c e s s , th e th e E R R O R s ta te . to c h e c k fo r th e

A tu p le s p a c e is th e n d e fin e d a s th e p a ra lle l c o m p o s itio n o f tu p le s , fo r a ll ty p e s o f tu p le in th e T u p l e s s e t. o u t.a n y

-1

0

in p .0 .a n y rd p .0 .a n y

o u t.a n y

1

in .a n y in p .1 .a n y

rd .a n y rd p .1 .a n y

2

rd .a n y rd p .1 .a n y

in .a n y in p .1 .a n y

o u t.a n y

F ig . 3 . T U P L E L T S A n e x a m p le o f a c o n d itio n a l o p e ra tio n o n th e tu p le s p a c e w o u ld b e : i n p [ b : B o o l ] [ t : T u p l e s ] T h e v a lu e o f th e lo c a l v a ria b le t is o n ly v a lid w h e n b is tru e . E a c h T U P L E p ro c e s s h a s in its a lp h a b e t th e o p e ra tio n s o n o n e s p e c ific tu p le v a lu e . T h e a lp h a b e t o f T U P L E S P A C E is d e fin e d b y th e s e t T u p l e A l p h a : s e t =

T u p l e A l p h a { { i n , o u t , r d , r d p [ B o o l ] , i n p [ B o o l ] } . T u p l e s }

A p ro c e s s th a t s h a re s a c c e s s to th e tu p le s p a c e m u s t in c lu d e a ll th e a c tio n s o f th is s e t in its a lp h a b e t.

8

Je ff K ra m e r a n d Je ff M a g e e

A n im a tio n It is o fte n th e c a s e th a t th e L T S o f a s p e c ifie d p ro c e s s is to o c o m p le x to re ly m e re ly o n in s p e c tio n to c o n v in c e o n e s e lf th a t it m o d e ls th e re q u ire d b e h a v io u r. A n im a tio n c a n b e u s e d to te s t a s p e c ific a tio n . F o r in s ta n c e , fo r th e s in g le tu p le d e fin e d b y th e s e t, s e t

T u p l e s

=

{ a n y }

L T S A p e rm its a d e s ig n e r to s te p th ro u g h th e s c e n a rio g iv e n in fig u re 4 . T h e a c tio n s e lig ib le a t a n y tim e a re in d ic a te d b y a tic k , a n d th e tra c e o f a c tio n s is g iv e n o n th e le ft. H o w e v e r, fo r e x h a u s tiv e p ro p e rty c h e c k in g , w e u s e p ro p e rty a u to m a ta .

F ig . 4 . A n im a tio n o f th e T U P L E S P A C E fo r tu p le a n y

P r o p e r ty C h e c k s c th e s e p ro fo llo w in g m a tc h in g

A u to m a ta a n b e m a d e th a t th e m o d e l s a tis fie s c e rta in s a fe ty p ro p e rtie s b y s p e c ify in g p e rtie s a s a u to m a ta a n d c o m p o s in g th e m w ith th e s y s te m . F o r e x a m p le , th e p ro p e rty a s s e rts th a t a n i n a c tio n m u s t a lw a y s h a v e b e e n p re c e d e d b y a o u t a c tio n . p r o p e r C H E C K [ = ( w | w ) .

t y C H i : 0 . . h e n ( h e n (

E C K ( T = ' a n y ) N ] i < N ) o u t [ T ] i > 0 ) i n [ T ] =

C H E C K [ 0 ] , - > - >

C H E C K [ i + 1 ] C H E C K [ i - 1 ]

T h is g e n e ra te s th e im a g e a u to m a ta w ith th e L T S s h o w n in fig u re 5 . A s illu s tra te d , p ro p e rty a u to m a ta a re a u to m a tic a lly m a d e c o m p le te b y re p la c in g a n y u n d e fin e d

M o d e llin g fo r m e re M o rta ls

9

tra n s itio n w ith a tra n s itio n to th e E R R O R s ta te . In th e fin a l s y s te m , s a fe ty p ro p e rty v io la tio n s a re id e n tifie d b y th e re a c h a b ility o f th e E R R O R s ta te . o u t.a n y

-1

o u t.a n y

0

1

in .a n y

in .a n y

2 in .a n y

o u t.a n y F ig . 5 . P ro p e rty C H E C K

T h is c a n b e c o m p o s e d w ith T U P L E S P A C E a s fo llo w s u s in g th e p a ra lle l c o m p o s itio n o p e ra to r. | | T U P L E S P A C E = f o r a l l [ t : T u p l e s ] ( T U P L E ( t ) | | C H E C K ( t ) ) . T h e L T S A a n a ly s is to o l d e te c ts th e fo llo w in g v io la tio n o f p ro p e rty C H E C K fo r tu p le s a n y , a s w e ll a s th e v io la tio n s p e c ifie d in th e T U P L E its e lf. C o m p r p r S t a T r a

p o o p o p t e c e

s i e r e r s t o o o

n g t y t y C o o u t u t u t

m p . . .

C H T U p o r o a n a n a n

E C P L s e p e

K ( a n y E ( a n y d : 6 r t y v

)

v i v i T r a n i o l a )

o l o l s i t i

a t i o a t i o t i o n o n i

n . n . s : 2 4 i n 0 m s n T U P L E ( a n y ) :

y y y

H e n c e , a s e x p e c te d , th e v io la tio n in w h ic h a n i n a c tio n is e x e c u te d b e fo re a n o u t a c tio n is n o t p e rm itte d b y th e T U P L E S P A C E .

2 .3

S u p e r v is o r -W

W e m o d e l a a s e t o f ta s k s a ta s k a n d c p ro c e ss a re s

s im to o m k e

o r k e r M o d e l

p le s u p e r th e tu p le p u te s th e tc h e d b e lo

v is o r-w o rk e r s y s te m in w h ic h th e s u p e rv is o r in itia lly o u tp u ts s p a c e a n d th e n c o lle c ts re s u lts . E a c h w o rk e r re p e titiv e ly g e ts re s u lt. T h e a lg o rith m s fo r th e s u p e rv is o r a n d e a c h w o rk e r w :

S u p e r v is o r :: fo r a ll ta s k s :- o u t ( “ ta s k ” ,… )

1 0

Je ff K ra m e r a n d Je ff M a g e e

fo r a ll r e s u lts : in ( “ r e s u lt” ,… o u t(“ s to p ” )

)

W o r k e r :: w h ile n o t r d p ( in (“ ta c o m p o u t(“

“ s to p ” ) d o s k ” ,… ) u te re s u lt r e s u lt” ,… )

T o te rm in a te th e p ro g ra m , th e s u p e rv is o r o u tp u ts a tu p le w ith th e ta g “ s to p ” w h e n it h a s c o lle c te d a ll th e re s u lts it re q u ire s . W o rk e rs ru n u n til th e y re a d th is tu p le . T h e s e t o f tu p le v a lu e s a n d th e m a x im u m n u m b e r o f c o p ie s o f e a c h v a lu e a re d e fin e d fo r th e m o d e l a s: c o n s t s e t

N T u p l e s =

2 =

{ t a s k , r e s u l t , s t o p }

T h e s u p e rv is o r o u tp u ts N ta s k s to th e tu p le s p a c e , c o lle c ts N re s u lts a n d th e n o u tp u ts th e “ s to p ” tu p le a n d te rm in a te s . S U P E R V T A S K [ i ( o u t i R E S U L T ( i n . i F I N I S H ( o u t

I S O R : 1 . . . t a s f i < [ i : 1 r e s u f i < = . s t o

= N ] k

p

N

T A S K [ 1 ] , =

- > t h e n . . N ] = l t - > N t h e n - >

T A S K [ i + 1 ]

e l s e

e l s e

R E S U L T [ i + 1 ] e n d

- >

A s illu s tra te d , F S P s u p p o rts th e d e fin itio n e l s e . T h e S T O P p ro c e s s is o n e w h ic h e n g th e a lp h a b e t fo r a p ro c e s s is d e fin e d im p lic g e n e ra lly m o re c o n v e n ie n t th a n e x p lic it d e n o fre e a c tio n s c a n o c c u r in th e tu p le s p a lp h a b e t o f th e s u p e rv is o r to in c lu d e a ll th e

S T O P )

R E S U L T [ 1 ] ) ,

+

F I N I S H ) ,

T u p l e A l p h a .

o f c o n d itio n a l p ro c e s s e s u s in g i f a g e s in n o fu rth e r a c tio n s . F o r e a s e itly b y th e a c tio n s in its d e fin itio n . fin itio n . H o w e v e r, in o rd e r to e n s u a c e , w e u s e “ + ” to e x p lic itly e x te a c tio n s in th e s h a re d tu p le s p a c e .

t h e n o f u se , T h is is re th a t n d th e

T h e w o rk e r c h e c k s fo r th e “ s to p ” tu p le b e fo re g e ttin g a ta s k a n d o u tp u ttin g th e re s u lt. T h e w o rk e r te rm in a te s w h e n it re a d s “ s to p ” s u c c e s s fu lly . W O R K E R = ( r d p [ b i f ( ( i e l s e ( e ) + T u p l

: B o o l ] . s t o p - > ! b ) t h e n n . t a s k - > o u t . r e s u l t n d - > S T O P ) e A l p h a .

- >

W O R K E R )

M o d e llin g fo r m e re M o rta ls

T h e L T S fo r b o th S U P E R V I S O R o u t.ta s k

S U P E R V IS O R

0

a n d

1

w ith N = 2 is d e p ic te d in fig u re 6 .

W O R K E R

o u t.ta s k

in .r e s u lt

2

1 1

3

in .r e s u lt

o u t.s to p

4

e n d

5

6

rd p .1 .s to p rd p .0 .s to p

in .ta s k

e n d

W O R K E R

0

1

2

3

4

o u t.r e s u lt F ig . 6 . S U P E R V I S O R a n d W O R K E R L T S

In o rd e r p ro c e ss a n E N D e n d o c c

to a v o id d e te c tin g a d e a d lo c k in th e c a s e o f c o rre c t te rm in a tio n , w e p ro v id e a th a t c a n s till e n g a g e in a c tio n s a fte r th e e n d a c tio n h a s o c c u rre d . W e d e fin e p ro c e s s th a t e n g a g e s in th e a c tio n e n d e d a fte r th e c o rre c t te rm in a tio n a c tio n u rs. E N D E N D E D

= =

( e n d - > E N D E D ) , ( e n d e d - > E N D E D ) .

A s u p e rv is o r w o rk e r m o d e l w ith tw o w o rk e rs c a lle d r e d W o r k a n d b l u e W o r k , w h ic h c o n fo rm s to th e a rc h ite c tu re o f F ig u re 2 , c a n n o w b e d e fin e d a s fo llo w s : | | S U P E R V I S O R = ( s u p | | { r e | | { s u | | E N D ) / { e n d W e u se th e a lp h s u p p o rts a n d b l u to b e c a n o ta tio n p re fix e d F in a lly , a c tio n to

_ W e r d W p e

O R v i o r r v

K E s o k , i s

R r : S U P E R V I S O R b l u e W o r k } : W O R K E R o r , r e d W o r k , b l u e W o r k } : : T U P L E S P A C E

/ { s u p e r v i s o r , r e d W o r k , b l u e W o r k } . e n d } .

“ : ” to d e fin e a n a m e d p ro c e s s in s ta a b e t o f th e p ro c e s s b y th e in s ta n th e d e fin itio n o f m u ltip le n a m e d p e W o r k . F o r sh a re d re so u rc e s, su c h p a b le o f b e in g s h a re d w ith a n y o f “ : : ” in d ic a te s th a t e v e ry a c tio n b y e a c h o f th e u s e r p ro c e s s e s : s u p re la b e llin g “ / ” is u s e d to e n s u re th g e th e r.

n c e . T h e e ffe c t is to p re fix e a c h la b e l in c e n a m e e g . s u p e r v i s o r . T h is a ls o ro c e s s in s ta n c e s e g . w o rk e rs r e d W o r k , a s th e tu p le s p a c e , e v e ry tra n s itio n n e e d s th e s u p e rv is o r o r w o rk e r p ro c e s s e s . T h e in th e tu p le s p a c e b e c o m e s a c h o ic e , e r v i s o r , r e d W o r k , a n d b l u e W o r k . a t a ll p ro c e s s e s e n g a g e in th e s a m e e n d

1 2

Je ff K ra m e r a n d Je ff M a g e e

A n a ly s is S a fe ty a n a ly s is o f th is m o d e l u s in g L T S A re v e a ls n o E R R O R v io la tio n s . H o w e v e r, it d o e s d e te c t th e fo llo w in g p o te n tia l d e a d lo c k : T r a c e

t o s u s u r e r e r e s u r e r e r e s u r e s u b l

p e p e d W d W d W p e d W d W d W p e d W p e u e

D E r r o o o r o o o r o r W

A D v i v i r k r k r k v i r k r k r k v i r k v i o r

L O s o s o . r . i . o s o . r . i . o s o . r s o k .

T h is tra c e is fo r a n e x e c u tio n in ta s k s p u t in to tu p le s p a c e b y th re a l s y s te m s in c e w o rk e rs c a n tim e to s ta rt. T h e d e a d lo c k o c tu p le a fte r th e re d w o rk e r a tte m “ s to p ” tu p le h a s n o t y e t b e e n p d o e s n o t te rm in a te b u t b lo c k s fin is h e d , n o m o re tu p le s w ill b e w ill n e v e r te rm in a te .

C K r . r . d p n . u t r . d p n . u t r . d p r . r d

: o u o u . 0 t a . r i n . 0 t a . r i n . 0 o u p .

t . t . . s s k e s . r . s s k e s . r . s t . 1 .

t a s k t a s k t o p

- -

r d p re tu rn s fa ls e

u l t e s u l t t o p

- -

r d p re tu rn s fa ls e

- -

r d p re tu rn s fa ls e

- -

r d p re tu rn s tru e

u l e s t o s t s t

t u l t p o p o p

w h ic h th e re d w o rk e r e s u p e rv is o r. T h is is ru n a t d iffe re n t s p e e d c u rs b e c a u s e th e s u p p ts to re a d it. W h e n u t in to th e tu p le s p a c w a itin g fo r a n o th e r p u t in to th e tu p le s p a

c o m p u te s th q u ite le g itim s a n d ta k e d e rv is o r o n ly th e re d w o rk e , a n d c o n se ta s k . S in c e c e a n d c o n se

e re s u lts fo r th e tw o a te b e h a v io u r fo r a iffe re n t a m o u n ts o f o u tp u ts th e “ s to p ” e r trie s to re a d , th e q u e n tly , th e w o rk e r th e s u p e rv is o r h a s q u e n tly , th e w o rk e r

T h is d e a d lo c k , w h ic h c a n b e re p e a te d fo r d iffe re n t n u m b e rs o f ta s k s a n d w o rk e rs , in d ic a te s th a t th e te rm in a tio n s c h e m e w e h a v e a d o p te d is in c o rre c t. A lth o u g h th e s u p e rv is o r c o m p le te s th e c o m p u ta tio n , w o rk e rs m a y n o t te rm in a te . It re lie s o n a w o rk e r b e in g a b le to in p u t tu p le s u n til it re a d s th e “ s to p ” tu p le . A s th e m o d e l d e m o n s tra te s , th is m a y n o t h a p p e n . T h is w o u ld b e a d iffic u lt e rro r to o b s e rv e in a n im p le m e n ta tio n s in c e th e p ro g ra m w o u ld p ro d u c e th e c o rre c t c o m p u ta tio n a l re s u lt. H o w e v e r, a fte r a n e x e c u tio n , w o rk e r p ro c e s s e s w o u ld b e b lo c k e d a n d c o n s e q u e n tly re ta in e x e c u tio n re s o u rc e s s u c h a s m e m o ry a n d s y s te m re s o u rc e s s u c h a s c o n tro l b lo c k s . O n ly a fte r a n u m b e r o f e x e c u tio n s m ig h t th e u s e r o b s e rv e a s y s te m c ra s h d u e to m a n y h u n g p ro c e s s e s . N e v e rth e le s s , th is te c h n iq u e o f u s in g a “ s to p ” tu p le a p p e a rs in a n e x a m p le L in d a p ro g ra m in a s ta n d a rd te x tb o o k o n c o n c u rre n t p ro g ra m m in g ! A p o s s ib le s o lu tio n v a lu e . W h e n a w o B e c a u se a w o rk e r e v e n tu a lly in p u t it p u b lis h e d b y th e d e w o rk e r a re s k e tc h e d

is fo r th e s rk e r in p u ts o u tp u ts th a n d te rm in a s ig n e rs o f L b e lo w :

u p th e te in

e rv is o r to is v a lu e , s to p ta s k . T h is te rm d a [1 6 ]. T

o u tp u t a “ ta s k ” it o u tp u ts it a g b e fo re te rm in in a tio n te c h n iq h e re v is e d a lg o

tu p a in a tin u e rith

le w a n d g , e a p p e m s f

ith a s p e c ia l s to p th e n te rm in a te s . a c h w o rk e r w ill a rs in a lg o rith m s o r s u p e rv is o r a n d

M o d e llin g fo r m e re M o rta ls

1 3

S u p e r v is o r :: fo r a ll ta s k s :- o u t ( “ ta s k ” ,… ) f o r a ll r e s u lts :- in ( “ r e s u lt” ,… ) o u t ( “ ta s k ” ,s to p ) W o r k e r :: w h ile tr u e in if c o

d o (“ ta s k ” ,… ) v a lu e is s to p th e n o u t ( “ ta s k ” ,s to p ) ; e x it o m p u te re s u lt u t ( “ r e s u lt” ,… )

T h e tu p le d e fin itio n s a n d m o d e ls fo r s u p e rv is o r a n d w o rk e r n o w b e c o m e s : s e t

T u p l e s

S U P E R V I T A S K [ i : ( o u t . i f R E S U L T [ ( i n . r i f F I N I S H ( o u t . + T u p W O R K ( i | i )

E R n . t n . t + T

S O R 1 . . t a s i < i : 1 e s u i
e n =

T A S K [ i + 1 ]

e n

R E S U L T [ i + 1 ]

e l s e

R E S U L T [ 1 ] ) ,

> e l s e

F I N I S H ) ,

= t a s k . s t o p l e A l p h a .

- >

e n d

- >

S T O P )

= a s k - > o u t . r e s u l t - > W O R K E R a s k . s t o p - > o u t . t a s k . s t o p - > u p l e A l p h a .

e n d

- > S T O P

T h e re v is e d m o d e l d o e s n o t d e a d lo c k a n d d o e s n o t v io la te a n y s a fe ty p ro p e rty . P r o g r e ss W e h a v e fo u n d a c h e c k fo r a k in d o f liv e n e s s p ro p e rtie s w h ic h w e te rm p r o g r e s s to p ro v id e s u ffic ie n t in fo rm a tio n o n liv e n e s s in m a n y e x a m p le s [1 0 ]. P ro g re s s a s s e rts th a t in a n y in fin ite e x e c u tio n o f th e s y s te m b e in g m o d e lle d , a ll a c tio n s c a n o c c u r in fin ite ly o fte n . In p e rfo rm in g th e p ro g re s s c h e c k , w e a s s u m e s tro n g ly fa ir c h o ic e , a c c o rd in g to w h ic h if a c h o ic e is e x e c u te d in fin ite ly o fte n , a ll tra n s itio n s e n a b le d a re s e le c te d in fin ite ly o fte n . F o r in s ta n c e , w e c a n u s e th e fo llo w in g p ro g re s s p ro p e rty to c h e c k th a t o u r s u p e rv is o r-w o rk e r m o d e l d o e s in d e e d p ro g re s s to a c tio n e n d e d . p r o g r e s s L T S A re p o rts : N o

E N D

=

p r o g r e s s

{ e n d e d } v i o l a t i o n s

d e t e c t e d .

1 4

Je ff K ra m e r a n d Je ff M a g e e

F ig . 7 . T ra c e o f S u p e rv is o r-W o rk e r m o d e l

O n th e o th e r h a n d , w e c a n a s k if, s a y , th e w o rk e rs c a n a lw a y s a c c e p t a tu p le fro m tu p le s p a c e , i.e . p r o g r e s s

T A S K

=

{ { r e d W o r k , b l u e W o r k } . i n }

A s e x p e c te d , w e th e n g e t th e fo llo w in g v io la tio n : P r o g r e s T r a c e t s s r r s r r s s r r b b e A c t i o n s { e n d e d }

s o u p u p e d e d u p e d e d u p u p e d e d l u l u n d

v i t e e r e r W o W o e r W o W o e r e r W o W o e W e W i n

o l r m v i v i r k r k v i r k r k v i v i r k r k o r o r

a t i n s o s o . i . o s o . i . o s o s o . i . o k . k .

i o a l r . r . n . u t r . n . u t r . r . n . u t i n o u

n : o o t . i t . i o t . . t

s e u t u t a s r e n . a s r e n . u t a s t a t a . t

t e r m i n a l

T A t . t . t k s u r e k s u r e . t k . s k s k a s

S K o f s t a t e s : a s k a s k l t s u l t l t s u a s s t . s . s k .

s e t :

l t k . o p t o t o s t

s t o p p p o p

th e

M o d e llin g fo r m e re M o rta ls

T h is in d ic a c c e p t tu p s a m p le tra g e n e ra te d

a te le s c e b y

s th a t , a n d a g a in a n im a

a fte r th a t h a s tio n

re c e o n ly th e r a s sh

iv in th e e d w o w n

g th e t a c tio n o rk e r in F ig

1 5

k . s t o p tu p le , th e w o rk e rs c a n n o lo n g e r d e d is a v a ila b le in th e te rm in a l s e t. T h e p u tin g b o th ta s k s . T h is tra c e c a n a ls o b e 7 .

a s e n c o m u re

M in im is a tio n T h e re is a ls o a h id in g o p e ra to r @ w h ic h c a p tu re s th e n o tio n o f e x te r n a c o m p o n e n ts , a n d is u s e d in th e s p e c ific a tio n o f b o th p rim itiv e a c o m p o n e n ts . O p e ra to r @ s p e c ifie s th e s e t o f a c tio n la b e ls (a lp h a b e t) w h a t th e in te rfa c e o f th e c o m p o n e n t a n d th u s m a y b e s h a re d w ith o th e r c re s tric ts th e a lp h a b e t o f th e L T S to th e a c tio n s p re fix e d b y th e s e la b a c tio n s a re “ h id d e n ” a n d w ill a p p e a r a s “ s ile n t” o r “ τ ” a c tio n s d u rin g a d o n o t d is a p p e a r d u rin g m in im is a tio n (m in im is a tio n is p e rfo rm e d w o b s e rv a tio n a l e q u iv a le n c e a s d e fin e d b y M iln e r [1 7 ]).

l in te r fa c e s o f n d c o m p o s ite ic h a re v is ib le o m p o n e n ts . It e ls . A ll o th e r n a ly s is if th e y ith re s p e c t to

F o r in s ta n c e , w e c a n a b s tra c t fro m m a n y o f th e a c tio n s o f th e s u p e rv is o r-w o rk e r m o d e l to e x a m in e o n ly th o s e in a c tio n s o f th e w o rk e rs . T h is c a n b e s p e c ife d a s fo llo w s : | | M I N I M I S E =

S U P E R V I S O R _ W O R K E R @ { { r e d W o r k , b l u e W o r k } . i n . t a s k , e n d } .

M in im is a tio n p ro d u c e s a s y s te m w ith o n ly s e v e n s ta te s . T h e L T S is s h o w n in fig u re 8 . T h is c le a rly illu s tra te s th e a c tio n s o f th e w o rk e rs in a c c e p tin g ta s k s a n d fin a lly in d e a lin g w ith th e s to p ta s k . C o S t M I M i

m p a t N I n i

o s i n g e s C o m p o s e d : 2 7 T r a n s i t i o n s : M I Z E m i n i m i s i n g . . . . m i s e d S t a t e s : 7 i n 6 0 m s

4 1

i n

0 m s

r e d W o r k .in .ta s k .s to p

0

b lu e W o r k .in .ta s k r e d W o r k .in .ta s k

1

b lu e W o r k .in .ta s k r e d W o r k .in .ta s k

2

b lu e W o r k .in .ta s k .s to p

3

r e d W o r k .in .ta s k .s to p

4

e n d

5

b lu e W o r k .in .ta s k .s to p

F ig . 8 . M in im is e d L T S fo r th e S u p e rv is o r-W o rk e r m o d e l w ith h id in g

6

1 6

Je ff K ra m e r a n d Je ff M a g e e

3 . C o n c lu s io n s In th is p a p e r to a s p e c ific p ro v id e a g e fra m e w o rk o d e s ig n p ro c e

, w e h a v e m o d e lle a p p lic a tio n . W e w n e ra l s o lu tio n th a t f th e a rc h ite c tu re . s s , a t a fa irly h ig h

D e ta ile d a s p e th a t a lw a y s s c a la b ility . W p e rfo rm a n c e , 5 6 6 ,8 2 0 r e a c h c o n s tru c t a n d e ffe c t o f u s in c a n b e se e n fr

p ro a c h l o n e , ] h a s b O T O S

S u p e rv is o r-W o rk e r a rc h ite c b le to d is c o v e r a p ro b le m w e u s e d in a n y a p p lic a tio n im m o d e llin g h a s b e e n u s e d a s o f d e s ig n a b s tra c tio n .

c ts o f a s y s te m c a n a ls o b e m o d e lle a ris e s w h e n c o n s id e rin g e x h a u s tiv e h a v e u s e d th e c u rre n t to o ls e t, w h to a n a ly s e a n A c tiv e B a d g e S y s te m a b le s ta te s a n d 2 ,4 2 8 ,4 8 8 p o s s ib le tr c h e c k o n a 2 0 0 M H z P e n tiu m P ro g c o m p o s itio n a l re a c h a b ility to re d u o m th e ta b le b e lo w :

W e b e lie v e th p ro c e e d h a n d b e e n c a re fu lly d e v e lo p m e n t o a t a n y le v e l o a n d d e b u g g e d e a s ily re la te d a n a ly s is to o l a p p lic a tio n o r T h e a p g e n e ra [ 1 5 ,1 8 b o th L

d th e e re a c a n b T h u s le v e l

(B a d g e ,

R e a c h a b le

L o c a t io n )

S t a te s

d a n d a e s ta te ic h h a s [1 1 ] in a n s itio n a n d re q c e th e

T r a n s it io n s

tu re w ith te p le m a n in

ith o u rm in a e n te d te g ra l

t re fe re n c e tio n a n d to w ith in th e p a rt o f th e

n a ly s e d . H o w e v e r, a n is s u e s p a c e s e a rc h m e th o d s is n o t y e t b e e n o p tim is e d fo r w h ic h th e fin a l m o d e l h a s s . T h is to o k 4 0 0 s e c o n d s to u ire d 1 7 0 M b o f s to re . T h e s ta te s p a c e in th is e x a m p le

M e m o ry

T im e s

(M b )

( s e c s )

( 2 ,3 )

1 2 ,2 1 3

5 2 ,7 5 8

3

6

m in im is e d

3 ,9 2 4

1 9 ,2 6 0

< 1

1 2

( 2 ,4 )

5 8 ,3 8 4

2 5 2 ,5 7 6

1 3

3 8

m in im is e d

1 3 ,7 7 6

6 9 ,6 1 6

4

7 4

( 2 ,5 )

2 0 2 ,2 7 5

8 7 1 ,3 5 0

5 2

1 8 0

m in im is e d

3 9 ,6 0 0

2 0 1 ,6 5 0

2 2

3 3 7

( 2 ,6 )

5 6 6 ,8 2 0

2 ,4 2 8 ,4 8 8

1 7 3

4 0 0

m in im is e d

9 8 ,3 1 6

4 9 8 ,6 0 0

6 8

1 ,2 7 3

a t a n a ly s is a n d d e s ig n a re c lo s e ly in te r-lin k e d a c tiv itie s w h ic h s h o u ld in h a n d . T h e n o ta tio n F S P a n d its a s s o c ia te d a n a ly s is to o l L T S A h a v e e n g in e e re d to fa c ilita te a n in c re m e n ta l a n d in te ra c tiv e a p p ro a c h to th e f c o m p o n e n t-b a s e d s y s te m s . A n a ly s is a n d a n im a tio n c a n b e c a rrie d o u t f th e a rc h ite c tu re . C o n s e q u e n tly , c o m p o n e n t m o d e ls c a n b e d e s ig n e d b e fo re c o m p o s in g th e m in to la rg e r s y s te m s . T h e a n a ly s is re s u lts a re to th e a rc h ite c tu ra l m o d e l o f in te rc o n n e c te d c o m p o n e n ts . T h e L T S A d e s c rib e d in th is p a p e r is w ritte n in J a v a ™ a n d c a n b e ru n a s a n a p p le t. I t is a v a ila b le a t h ttp ://w w w - d s e .d o c .ic .a c .u k /c o n c u r r e n c y .

w e h w h ic h e e n u /C A D

a v e is se d P [

d e s c rib e d in n o t re s tric te d w ith th e a rc 2 0 ] a n d P ro m

th is p to a h ite c e la /S

a p e r to a n a ly z in g s o ftw p a rtic u la r to o l-s e t. F o tu ra l d e s c rip tio n la n g u P IN [2 1 ] h a v e b e e n u

a re r e x a g e se d

a r a m W in

c h ite c tu p le , C S rig h t [1 th e c o n

re s P /F 9 ] te x

is a D R a n d t o f

M o d e llin g fo r m e re M o rta ls

1 7

a n a ly s in g s o ftw a re a rc h ite c tu re s . O u r a p p ro a c h is d is tin g u is h e d b y th e d ire c t u s e o f th e a rc h ite c tu re d e s c rip tio n in a n a ly s is , th e u s e o f c o m p o s itio n a l re a c h a b ility a s a w a y o f m a n a g in g th e s ta te s p a c e a n d , h o p e fu lly , b y th e e a s e o f u s e o f th e to o ls e t. F in a lly , w e h a v e u n d e rg ra d u a te s tu E n g in e e rin g a n d g ra d u a te s tu d e n ts th e u tility o f th e e d u c a tio n a n d te c a n d to o ls e t c a n b e

e x p e rie n c e o f te a c h in g th e a p p ro a c h to a v a rie ty o f s tu d e n ts [1 3 ]: d e n ts in th e s e c o n d y e a r o f th re e a n d fo u r y e a r C o m p u tin g , S o ftw a re c o m b in e d C o m p u tin g /E le c tric a l E n g in e e rin g d e g re e c o u rs e s ; a n d ta k in g c o n v e rs io n c o u rs e s in C o m p u tin g . W e a re a ls o in v e s tig a tin g a p p ro a c h in in d u s try . T h e s e e ffo rts c o n s titu te o u r c o n trib u tio n to h n o lo g y tra n s fe r, a n d h e lp to c o n firm o u r b e lie f th a t th e a p p ro a c h le a rn t a n d u s e d to g o o d e ffe c t w ith in th e life tim e o f m e re m o rta ls .

A c k n o w le d g e m e n ts T h e a u th o rs w o u ld lik e to a c k n o w D is trib u te d S o ftw a re E n g in e e rin g G p a rtic u la r w e w o u ld lik e to th a n k D W e g ra te fu lly a c k n o w le d g e th e E P S E S P R IT p ro je c t 2 4 9 6 2 ) fo r th e ir fin a

le d g e d is c u s s io n s w ith ro u p d u rin g th e fo rm u la im itra G ia n n a k o p o u lo u R C (B E A D S G R /M 2 4 4 n c ia l s u p p o rt.

o u r tio n a n d 9 3 )

c o lle o f th S h in g a n d th

a g u e se C h e E

e s id i C U

in e a h e (C

th e s. In u n g . 3 D S

R e fe r e n c e s 1 ] C la r k e , E .M ., W in g , J .M ., e t a l. F o r m a l M e th o d s : S ta te o f th e A r t a n d F u tu r e D ir e c tio n s . A C M C o m p u tin g S u rv e y s , V o l. 2 8 N o . 4 (1 9 9 6 ), 6 2 6 -6 4 3 . [ 2 ] C le a v e la n d , R ., S m o lk a , S .A ., e t a l. S tr a te g ic D ir e c tio n s in C o n c u r r e n c y R e s e a r c h . A C M C o m p u tin g S u rv e y s , V o l. 2 8 N o . 4 (1 9 9 6 ), 6 0 7 -6 2 5 . [ 3 ] M a g e e J ., D u la y N ., E is e n b a c h S ., K r a m e r J ., S p e c ify in g D is tr ib u te d S o ftw a r e A r c h ite c tu r e s , P ro c . o f 5 th E u ro p e a n S o ftw a re E n g in e e rin g C o n fe re n c e (E S E C ‘9 5 ), L N C S 9 8 9 , S p rin g e r-V e rla g (1 9 9 5 ), 1 3 7 -1 5 3 . [ 4 ] M a g e e J ., D u la y N . a n d K r a m e r J ., R e g is : A C o n s tr u c tiv e D e v e lo p m e n t E n v ir o n m e n t fo r D is tr ib u te d P r o g r a m s , D is trib u te d S y s te m s E n g in e e rin g J o u rn a l, V o l. 1 N o . 5 , S p e c ia l Is s u e o n C o n fig u ra b le D is trib u te d S y s te m s , (1 9 9 4 ), 3 0 4 -3 1 2 . n d [5 ] K ra m e r, J . a n d M a g e e , J . E x p o s in g th e S k e le to n in th e C o o r d in a tio n C lo s e t. P ro c . o f 2 In te rn a tio n a l C o n f. o n C o o rd in a tio n M o d e ls a n d L a n g u a g e s (C O O R D IN A T IO N ’9 7 ), L N C S 1 2 8 2 , S p r in g e r - V e r la g ( 1 9 9 7 ) ,1 8 - 3 1 . [ 6 ] G ia n n a k o p o u lo u , D ., K r a m e r , J ., a n d C h e u n g , S .C . A n a ly s in g th e B e h a v io u r o f D is tr ib u te d S y s te m s u s in g T r a c ta . J o u rn a l o f A u to m a te d S o ftw a re E n g in e e rin g , S p e c ia l Is s u e o n A u to m a te d A n a ly s is o f S o f tw a r e ( e d . C le a v e la n d R . a n d J a c k s o n D .), V o l. 6 N o . 1 , (1 9 9 9 ) . [ 7 ] C h e u n g S .C . a n d K r a m e r J ., C o n te x t C o n s tr a in ts fo r C o m p o s itio n a l R e a c h a b ility A n a ly s is , A C M T r a n s a c tio n s o n S o f tw a r e E n g in e e r in g a n d M e th o d o lo g y T O S E M , V o l. 5 N o .4 , (1 9 9 6 ), 3 3 4 -3 7 7 . [ 8 ] C h e u n g , S .C . a n d K r a m e r , J . C h e c k in g S a fe ty P r o p e r tie s u s in g C o m p o s itio n a l R e a c h a b ility A n a ly s is . A C M T ra n s a c tio n s o n S o ftw a re E n g in e e rin g a n d M e th o d o lo g y T O S E M , to a p p e a r, (1 9 9 9 ). [ 9 ] C h e u n g , S .C ., G ia n n a k o p o u lo u , D ., a n d K r a m e r , J . V e r ific a tio n o f L iv e n e s s P r o p e r tie s u s in g C o m p o s itio n a l R e a c h a b ility A n a ly s is . P ro c . o f jo in t 6 th E u ro p e a n S o ftw a re E n g in e e rin g C o n fe re n c e (E S E C ’9 7 ), 5 th A C M S IG S O F T S y m p o s iu m o n th e F o u n d a tio n s

1 8

[1 0 [1 1 [1 2 [1 3 [1 4 [1 5 [1 6 [1 7 [1 8 [1 9 [2 0

[2 1

Je ff K ra m e r a n d Je ff M a g e e o f S o ftw a re E n g in e e rin g (F S E ’9 7 ), Z u ric h , S w itz e rla n d . M . J a z a y e ri a n d H . S c h a u e r E d s , L N C S 1 3 0 1 , S p rin g e r V e rla g (1 9 9 7 ), 2 2 7 -2 4 3 . ] G ia n n a k o p o u lo u , D ., M a g e e , J ., a n d K r a m e r , J . C h e c k in g P r o g r e s s in C o n c u r r e n t S y s te m s , Im p e ria l C o lle g e , L o n d o n , T e c h n ic a l R e p o rt D o C 9 8 , (1 9 9 8 ). ] M a g e e , J ., K r a m e r , J ., a n d G ia n n a k o p o u lo u , D . A n a ly s in g th e B e h a v io u r o f D is tr ib u te d S o ftw a r e A r c h ite c tu r e s : a C a s e S tu d y . 5 th IE E E W o rk s h o p o n F u tu re T re n d s o f D is trib u te d C o m p u tin g S y s te m s , T u n is ia (1 9 9 7 ), 2 4 0 -2 4 7 . ] M a g e e , J ., K r a m e r , J ., a n d G ia n n a k o p o u lo u , D . S o ftw a r e A r c h ite c tu r e D ir e c te d B e h a v io u r A n a ly s is . N in th IE E E In te rn a tio n a l W o rk s h o p o n S o ftw a re S p e c ific a tio n a n d D e s ig n (IW S S D -9 ), Is e -s h im a , J a p a n , (1 9 9 8 ). ] M a g e e , J . a n d K r a m e r , J ., C o n c u r r e n c y – S ta te M o d e ls a n d J a v a P r o g r a m s . J o h n W ile y & S o n s (1 9 9 9 ). ] C a rrie ro , N . a n d G e le rn te r, D . L in d a in C o n te x t. C o m m u n ic a tio n s o f th e A C M V o l. 3 2 N o . 4 (1 9 8 9 ), 4 4 4 -4 5 8 . ] H o a r e , C .A .R ., C o m m u n ic a tin g S e q u e n tia l P r o c e s s e s , P r e n tic e - H a ll, E n g le w o o d C lif f s , N .J ., ( 1 9 8 5 ) . ] C a rrie ro , N . a n d G e le rn te r, D . H o w to w r ite p a r a lle l p r o g r a m s : a g u id e fo r th e p e r p le x e d . A C M C o m p u tin g S u rv e y s V o l. 2 1 N o . 3 (1 9 8 9 ), 3 2 3 -3 5 8 . ] M iln e r , R ., C o m m u n ic a tio n a n d C o n c u r r e n c y . P r e n tic e - H a ll ( 1 9 8 9 ). ] F o r m a l S y s te m s , F a ilu r e s D iv e r g e n c e R e fin e m e n t: F D R 2 .0 U s e r M a n u a l, e d . F o rm a l S y s te m s ( E u r o p e ) , O x fo rd , U .K , ( 1 9 9 6 ). ] A lle n , R . a n d G a rla n , D . A F o r m a l B a s is fo r A r c h ite c tu r a l C o n n e c tio n . A C M T ra n s a c tio n s o n S o f tw a r e E n g in e e r in g a n d M e th o d o lo g y T O S E M , V o l. 6 N o .3 , ( 1 9 9 7 ) , 2 1 3 - 2 4 9 . ] J e a n -P ie rre K rim m a n d L a u re n t M o u n ie r. C o m p o s itio n a l s ta te s p a c e g e n e r a tio n fr o m L O T O S p r o g r a m s . I n E d B r i n k s m a , e d i t o r , P r o c e e d i n g s o f T A C A S '9 7 ( T o o l s a n d A lg o rith m s fo r th e C o n s tru c tio n a n d A n a ly s is o f S y s te m s ), E n s c h e d e , T h e N e th e rla n d s , L N C S 1 2 1 7 , S p rin g e r-V e rla g (1 9 9 7 ), 2 3 9 -2 5 8 ] H o lz m a n n , G .J ., T h e M o d e l C h e c k e r S P I N . I E E E T r a n s a c tio n s o n S o f tw a r e E n g in e e r in g , V o l. 2 3 N o . 5 (1 9 9 7 ), 2 7 9 -2 9 5 .

1 0 .1 0 0 7 /b 1 0 7 0 3 1 1 3 0 0 0 1

S c h e d u lin g S y s te m

V e r ifi c a tio n

P a o -A n n H s iu n g , F a rn W a n g , a n d Y u e -S u n K u o In s titu te o f In fo rm a tio n S c ie n c e , A c a d e m ia S in ic a , T a ip e i, T a iw a n , R O C {e r i c , f a r n , y s k u o }@ i i s . s i n i c a . e d u . t w

A b s tr a c t. A fo rm a l fra m e w o rk is p ro p o tim e s y s te m s , m o d e le d a s c lie n t-s e rv e r m o d e l-c h e c k in g a p p ro a c h . M o d e l-c h e c k s p a c e o f c o m p le x re a l-tim e s y s te m s . T h e b e ta k e n a d v a n ta g e o f fo r m o d e l-c h e c k in c o rro b o ra te th e fe a s ib ility o f s u c h a n a s ta te -s p a c e re d u c tio n , a n d s e v e ra l s c h e d u fe a tu re s in o u r th e o ry a n d im p le m e n ta tio

1

s e d fo r th e v e rifi c a tio n o f c o m p le x re a ls c h e d u lin g s y s te m s , u s in g th e p o p u la r in g is o fte n re s tric te d b y th e la rg e s ta te s c h e d u lin g o f ta s k s in s u c h s y s te m s c a n g . O u r im p le m e n ta tio n a n d e x p e rim e n ts p p ro a c h . W id e -a p p lic a b ility , s ig n ifi c a n t lin g s e m a n tic s a re s o m e o f th e im p o rta n t n .

I n tr o d u c tio n

M o d e l-c h e c k in g h a s th e p ro m is e o f a fo rm a l, fu ll, a n d a u to m a tic v e rifi c a tio n o f c o m p le x in d u s tria l im p le m e n ta tio n s in th e fu tu re . In s p ite o f th e re c e n t s u c c e s s in th e fo rm a l v e rifi c a tio n o f re a l-tim e s y s te m s , it is s till q u ite in fe a s ib le to fo rm a lly v e rify la rg e s c a le re a l-w o rld s y s te m s d u e to th e ir h ig h d e g re e o f c o m p le x ity . O n th e o th e r h a n d , e n g in e e rs h a v e d e v e lo p e d v a rio u s p a ra d ig m s to h e lp b u ild a n d v e rify s a fe r s y s te m s . O n e s u c h p a ra d ig m is th e s c h e d u lin g p a ra d ig m w h ic h g re a tly s im p lifi e s th e in te ra c tio n a m o n g m a n y p ro c e s s e s to p e rio d ic a l a n d a p e rio d ic a l c o m p u ta tio n tim e c o n te n tio n . B u t s till, s c h e d u lin g p a ra d ig m re p re s e n ts a to o m u c h s im p lifi e d p a ra d ig m fo r m a n y c o m p le x s y s t e m s , s u c h a s p r o t o c o l d e s i g n , c l i e n t - s e r v e r s y s t e m s , c o m m u n i c a t i o n s y s t e m s , . . .. In th is p a p e r, w e c o n s tru c t a th e o re tic a l fra m e w o rk w h ic h c o m b in e s th e a d v a n ta g e s o f m o d e l-c h e c k in g a n d s c h e d u lin g p a ra d ig m w ith s e v e ra l c o n c u rre n t s c h e d u lin g s e rv e rs e m p lo y in g d iffe re n t s c h e d u lin g p o lic ie s . O u r im p le m e n ta tio n a n d e x p e rim e n ts s h o w its b e n e fi t a n d f e a s ib ility b y c o m p a r in g w ith a n a iv e v e r ifi c a tio n e ff o r t, th a t is , p u r e m o d e lc h e c k in g a p p ro a c h . E x p e rim e n t d a ta s h o w s th a t e x p o n e n tia l re d u c tio n in s ta te -s p a c e s iz e c a n b e re a c h e d . In o u r fra m e w o rk , a s c h e d u lin g c lie n t-s e r v e r s y s te m c o n s is ts o f a s e t o f s e r v e r s , w ith s c h e d u lin g p o lic ie s s p e c ifi e d , a n d a s e t o f s c h e d u lin g c lie n t a u to m a ta w h ic h a re b a s ic a lly re a l-tim e a u to m a ta e x te n d e d w ith s c h e d u lin g ta s k s s p e c ifi e d a t d iffe re n t m o d e s . O n e m a jo r is s u e in s u c h s y s te m s is th e d iffi c u lty o f c o m p ro m is in g b e tw e e n tw o tim e s c a l e s : t h e j o b - c o m p u t a t i o n t i m e u n i t ΔJ a n d t h e s c h e d u l a b i l i t y - c h e c k t i m e u n i t ΔS . U s u a l l y ΔJ i s s e v e r a l o r d e r s o f m a g n i t u d e l a r g e r t h a n ΔS . I n r e a l - t i m e s y s t e m s m o d e l c h e c k in g , v e ry o fte n th e tim e a n d s p a c e c o m p le x itie s a re p ro p o rtio n a l to th e tim in g c o n s t a n t s u s e d i n t h e s y s t e m d e s c r i p t i o n . W i t h s u c h a b i g d i s p a r i t y b e t w e e n ΔJ a n d ΔS , t h e c o m p le x ity o f s c h e d u lin g s y s te m m o d e l-c h e c k in g c a n e a s ily g ro w b e y o n d m a n a g e a b le . In th is w o rk , w e a d o p te d th e fo llo w in g te c h n iq u e . T h e s y s te m s w ill s till b e p re s e n te d w i t h t i m e u n i t ΔJ . B u t , w h e n w e a r e i n a m o d e t o c h e c k t h e s c h e d u l a b i l i t y , w e s h a l l W .R . C le a v e la n d (E d .): T A C A S /E T A P S ’9 9 , L N C S 1 5 7 9 , p p . 1 9 – 3 3 , 1 9 9 9 . c S p rin g e r-V e rla g B e rlin H e id e lb e rg 1 9 9 9 

2 0

P a o -A n n H s iu n g , F a rn W a n g , a n d Y u e -S u n K u o

d e r iv e f o r m u la s , w ith r e s p e c t t i o n t i m e γS f o r t h e s c h e d u l a b γ i s s e t t o b e  ΔS J  i n t h e t i m e u te n tia l c o m b in a to ria l c o m p le x A n o th e r m a jo r is s u e is : w ta s k s in a m o d e b e p e rfo rm e d a n in -c o m in g tra n s itio n o f th e tio n o f th e m o d e is ta k e n . S e v c h e c k in g a re p o s s ib le . T h e s e o f a v id e o s y s te m .

to d iffe re n t s c h e d u lin g p o lic ie s , to c a lc u la te th e c o m p u ta ility -c h e c k . T h e n th e d u ra tio n o f th e s c h e d u la b ility -c h e c k n i t o f ΔJ . W i t h t h i s t e c h n i q u e , w e c a n c i r c u m v e n t t h e p o itie s c a u s e d b y th e d is p a rity b e tw e e n th e tw o tim e -s c a le s . h e n e x a c tly s h o u ld th e c h e c k in g fo r s c h e d u la b ility o f th e . T w o a lte r n a tiv e s a r is e h e r e , n a m e ly , ( 1 ) c h e c k in g b e f o r e m o d e is ta k e n , o r (2 ) c h e c k in g a fte r a n in -c o m in g tra n s ie ra l d iffe re n t k in d s o f s e m a n tic s re la te d to s c h e d u la b ility a r e d is c u s s e d in s u b s e c tio n 3 .1 . F o llo w in g is a n e x a m p le

E x a m p le 1 . : V id e o S y s te m H e re , w e h a v e tw o s e rv e rs a n d tw o c lie n ts in a V id e o -o n -D e m a n d s y s te m illu s tra te d in F ig . 1 . T h e tw o c lie n ts is s u e ta s k s e rv ic e re q u e s ts to b o th th e s e rv e rs c o n c u rre n tly . T h e tw o s e rv e rs c h e c k if re q u e s ts a re s c h e d u la b le a n d th e n e ith e r a c k n o w le d g e o r re je c t th e re q u e s ts . T h e s e rv e r fo r m o v ie s s c h e d u le s w ith th e r a te -m o n o to n ic (R M ) s c h e d u lin g p o lic y w h ile th e o th e r d o e s w ith th e e a r lie s t d e a d lin e fi r s t (E D F ) s c h e d u lin g p o lic y . T h e e x p la n a tio n o f s o m e p o p u la r s c h e d u lin g p o lic ie s c a n b e fo u n d in s e c tio n 2 . T h e M o v ie S e r v e r s to re s a s e t o f m o v ie fi le s re a d y fo r a c c e s s b y c lie n ts u n d e r th e ra te -m o n o to n ic s c h e d u lin g p o lic y . T h e C o m m e rc ia ls S e r v e r s to re s a s e t o f c o m m e rc ia l fi le s a n d w o rk w ith th e e a rlie s t-d e a d lin e fi rs t s c h e d u lin g p o lic y . A s s h o w n in F ig . 1 , th e c lie n ts a re m o d e le d b y fi n ite -s ta te a u to m a ta th a t a re e n h a n c e d w ith c lo c k s a n d s c h e d u lin g ta s k s . In th e fi g u re , b o x e s re p re s e n t d iffe re n t o p e ra tio n a l m o d e s o f th e c lie n ts a n d th e a rro w s re p re s e n t tra n s itio n s b e tw e e n m o d e s . x a n d y a re th e tw o c lo c k s u s e d to c o n t r o l t h e o p e r a t i o n t i m e s i n t h e c l i e n t a u t o m a t a . F o r e x a m p l e , t h e a s s i g n m e n t x := 0 b e s id e a n a r r o w m e a n s th a t th e c lo c k xis r e s e t to z e r o d u r in g th e tr a n s itio n . T h e p r e d ic a t e x = 35 o n a n o u t - g o i n g t r a n s i t i o n i n C l i e n t A m e a n s t h a t t h e t r a n s m i s s i o n o f m o v i e “ P r e t t y W o m a n ,” s h o u l d e n d a t 3 5 t i m e u n i t s . W i t h i n e a c h b o x , w e s p e c i f y t a s k s b y a t u p l e (α, c, p, d, f ) w h e r e α i s t h e s e r v e r id e n tifi c a tio n , cis th e c o m p u ta tio n tim e o f th e ta s k w ith in e a c h p e rio d , pis th e p e rio d f o r th e ta s k , dis th e d e a d lin e f o r e a c h in s ta n c e o f a ta s k , a n d f s p e c ifi e s if fi x e d p r io r ity ( f = 1) o r d y n a m i c p r i o r i t y ( f = 0) i s t o b e u s e d . I t i s i m p o r t a n t t h a t a t a n y i n s t a n t o f  th e c o m p u ta tio n , th e ta s k s s e t a d m itte d to e a c h s e rv e r re m a in s s c h e d u la b le . T h e o u tlin e o f th is p a p e r is a s f o llo w s . S e c tio n 2 g iv e s a b r ie f s u r v e y o f th e p r io r ity s c h e d u lin g p o lic ie s u s e d in o u r s y s te m . S e c tio n 3 p re s e n ts th e fo rm a l s y s te m m o d e l a n d d e s c rib e s h o w m o d e l-c h e c k in g is u s e d to v e rify th e s y s te m . S e c tio n 4 d e s c rib e s o u r im p le m e n ta tio n o f th e m o d e l-c h e c k in g a p p ro a c h u s in g th e p o p u la r H y T e c h to o l a n d s h o w s th e b e n e fi t o f o u r a p p ro a c h u s in g s o m e a p p lic a tio n e x a m p le s . S e c tio n 5 c o n c lu d e s th e p a p e r. I n t h e f o l l o w i n g , w e u s e N a n d R+ t o d e n o t e t h e s e t o f n o n - n e g a t i v e i n t e g e r s a n d th e s e t o f n o n - n e g a tiv e r e a l n u m b e r s .

R e v ie w o f s c h e d u lin g r e s e a r c h A

2

re a l-tim e s y s te m g e n e ra lly n e e d s to p ro c e s s v a rio u s c o n c u rre n t ta s k s . A ta s k is a fi n ite s e q u e n c e o f c o m p u ta tio n s te p s th a t c o lle c tiv e ly p e r f o r m s o m e r e q u ir e d a c tio n

S c h e d u lin g S y s te m

S

S

1

M o v ie S e rv e r

.... ....

C o m m e rc ia l S e rv e r E a rlie s t D e a d lin e F irs t

C lie n t B := 0

.... ....

C o m m e rc ia ls

S   

.. ... .. .. ...

x x

x



2

25 .... .....

:= 0

........... .

5 9 9 0

= 38

x

x

:= 0

30

y y

= 22

y

:= 0

P re tty W o m a n

B a tm a n II 

S   

2 5 5 1

y

S    y 2

1 2 2 0

S    1

:= 0

C o m m e rc ia ls



.. .... .... .... = 10 .... .... . . . .... := 0 .........



1

2 5 5 1

...........

.... .... .... .... .... .... ..... ..........

y y



S    1

1 6 6 1







= 35

.... .....

:= 0

S    y y 2

1 9 9 0 = 12

.... .....

P e e w e e H e rm a n

T e rm in a to r I 

S    1

2 3 3 1

S    1

1 4 4 1

S    y y 2

3 8 8 0 15

.... .....

:= 0



:= 0

T o y ’s S to ry 

S    1

1 3 3 1

C o m m e rc ia ls

C o m m e rc ia ls

C o m m e rc ia ls







S    2

1 8 8 0

S    2

3 7 7 0

:= 0

L io n K in g

C o m m e rc ia ls

2 7 7 0

= 25

:= 0

C o m m e rc ia ls

S    x x

y y

10

C o m m e rc ia ls 2

2 1

2

R a te -M o n o to n ic

C lie n t A

V e rifi c a tio n

S    2

2 7 7 0

F ig . 1 . A v id e o -o n -d e m a n d s y s te m

o f a re a l-tim e s y s te m a n d m a y b e c h a ra c te riz e d b y its e x e c u tio n tim e , d e a d lin e , e tc . P e r io d ic ta s k s a re ta s k s th a t a re re p e a te d ly e x e c u te d o n c e p e r p e rio d o f tim e . E a c h e x e c u tio n in s ta n c e o f a p e rio d ic ta s k is c a lle d a jo b o f th a t ta s k . In a p ro c e s s o r-c o n tro lle d s y s te m , w h e n a p ro c e s s o r is s h a re d b e tw e e n tim e -c ritic a l ta s k s a n d n o n -tim e -c ritic a l o n e s , e ffi c ie n t u s e o f th e p ro c e s s o r c a n o n ly b e a c h ie v e d b y c a re fu l s c h e d u lin g o f th e ta s k s . H e r e , tim e - c r itic a l ta s k s a r e a s s u m e d to b e p r e e m p tiv e , in d e p e n d e n t, p e r io d ic , a n d h a v in g c o n s ta n t e x e c u tio n tim e s w ith h a rd , c ritic a l d e a d lin e s . S c h e d u lin g m a y b e tim e - d r iv e n o r p r io r ity - d r iv e n . A tim e - d r iv e n s c h e d u lin g a lg o r ith m d e te r m in e s th e e x a c t e x e c u tio n tim e o f a ll ta s k s . A p r io r ity - d r iv e n s c h e d u lin g a lg o r ith m a s s ig n s p r io r itie s to ta s k s th a t d e te rm in e s w h ic h ta s k is to b e e x e c u te d a t a p a rtic u la r m o m e n t. W e m a in ly c o n s id e r tim e -c ritic a l p e rio d ic ta s k s w ith th e a b o v e a s s u m p tio n s a n d s c h e d u le d u s in g p r io r ity - d r iv e n s c h e d u lin g a lg o r ith m s . D e p e n d in g o n th e ty p e o f p rio rity a s s ig n m e n ts , th e re a re th re e c la s s e s o f s c h e d u lin g a lg o rith m s : fi x e d p r io r ity , d y n a m ic p r io r ity , a n d m ix e d p r io r ity s c h e d u lin g a lg o rith m s . W h e n th e p rio ritie s a s s ig n e d to ta s k s a re fi x e d a n d d o n o t c h a n g e b e tw e e n jo b e x e c u tio n s , th e a lg o rith m is c a lle d fi x e d p rio rity s c h e d u lin g a lg o rith m . W h e n p rio ritie s

2 2

P a o -A n n H s iu n g , F a rn W a n g , a n d Y u e -S u n K u o

c h a n g e d y n a m ic a lly b e tw e e n jo b e x e c u tio n s , it is c a lle d d y n a m ic p rio rity s c h e d u lin g . W h e n a s u b s e t o f ta s k s is s c h e d u le d u s in g fi x e d p rio rity a s s ig n m e n t a n d th e re s t u s in g d y n a m ic p rio rity a s s ig n m e n t, it is c a lle d m ix e d p rio rity s c h e d u lin g . B e fo re g o in g in to th e d e ta ils o f s c h e d u lin g a lg o rith m s , w e d e fi n e th e ta s k s e t to b e s c h e d u l e d a s a s e t o f n t a s k s {φ1 , φ2 , . . . , φn } w i t h c o m p u t a t i o n t i m e s c1 , c2 , . . . , cn , r e q u e s t p e r i o d s p1 , p2 , . . . , pn , a n d p h a s i n g s h1 , h2 , . . . , hn . A t a s k φi i s t o b e p e r i o d i c a l l y e x e c u t e d f o r ci t i m e u n i t s o n c e e v e r y pi t i m e u n i t s . T h e fi r s t j o b o f t a s k φi s t a r t s e x e c u t i o n a t a t i m e hi . T h e w o r s t - c a s e p h a s i n g c a l l e d a c r i t i c a l i n s t a n t o c c u r s w h e n a l l hi = 0, f o r a l l i, 1 ≤ i ≤ n. L iu a n d L a y la n d [L L 7 3 ] p ro p o s e d a n o p tim a l fi x e d p rio rity s c h e d u lin g a lg o rith m c a lle d th e r a te -m o n o to n ic (R M ) s c h e d u lin g a lg o rith m a n d a n o p tim a l d y n a m ic p rio rity s c h e d u lin g a lg o rith m c a lle d e a r lie s t-d e a d lin e fi r s t (E D F ) s c h e d u lin g . T h e R M s c h e d u lin g a lg o rith m a s s ig n s h ig h e r p rio ritie s to ta s k s w ith h ig h e r re q u e s t ra te s , th a t is , s m a lle r re q u e s t p e rio d s . L iu a n d L a y la n d p ro v e d th a t th e w o rs t c a s e u tiliz a tio n b o u n d o f R M w a s n(21/n − 1) f o r a s e t o f n t a s k s . T h i s b o u n d d e c r e a s e s m o n o t o n i c a l l y f r o m 0 . 8 3 w h e n n = 2 t o loge 2 = 0.693 a s n → ∞. T h i s r e s u l t s h o w s t h a t a n y p e r i o d i c t a s k s e t o f a n y s iz e w ill b e a b le to m e e t a ll d e a d lin e s a ll o f th e tim e if R M s c h e d u lin g a lg o rith m is u s e d a n d th e to ta l u tiliz a tio n is n o t g r e a te r th a n 0 .6 9 3 . T h e e x a c t c h a r a c te r iz a tio n f o r R M w a s g iv e n b y L e h o c z k y , S h a , a n d D in g [ L S D 8 9 ] , t h e y p r o v e d t h a t g i v e n p e r i o d i c t a s k s φ1 , φ2 , . . . , φn w i t h r e q u e s t p e r i o d s p1 ≤ p2 ≤ . . . ≤ pn c o m p u t a t i o n r e q u i r e m e n t s c1 , c2 , . . . , cn , a n d p h a s i n g s h1 , h2 , . . . , hn , φi i s s c h e d u la b le u s in g R M iff M in

{t∈Gi } Wi (t)/t

≤1

(1 )

i w h e r e Wi (t) = j=1 cj t/pj , t h e c u m u l a t i v e d e m a n d s o n t h e p r o c e s s o r b y t a s k s o v e r [0, t], 0 i s a c r i t i c a l i n s t a n t ( i . e . , hi = 0 f o r a l l i) , a n d Gi = {k · pj | j = 1, . . . , i, k = 1, . . . , pi /pj }. L iu a n d L a y la n d d is c u s s e d th e c a s e w h e n ta s k d e a d lin e s c o in c id e w ith re q u e s t p e rio d s , w h e re a s L e h o c z k y [L 9 0 ] c o n s id e re d th e fi x e d p rio rity s c h e d u lin g o f p e rio d ic ta s k s w ith a r b itr a r y d e a d lin e s a n d g a v e a fe a s ib ility c h a ra c te riz a tio n o f R M in th is c a s e : g i v e n a t a s k s e t w i t h a r b i t r a r y d e a d l i n e s d1 ≤ d2 ≤ . . . ≤ dn , φi i s R M s c h e d u l a b l e i f f M a x k≤Ni Wi (k, (k − 1)pi + di ) ≤ 1 w h e r e Wi (k, x) = m i n t≤x (( i−1 j=1 cj t/pj  + kci )/t) a n d Ni = m i n {k | Wi (k, kpi ) ≤ 1}. T h e w o r s t c a s e u tiliz a tio n b o u n d o f R M w ith a r b itr a r y d e a d lin e s w a s a ls o d e r iv e d i n [ L 9 0 ] . T h i s b o u n d ( U∞ ) d e p e n d s o n t h e c o m m o n d e a d l i n e p o s t p o n e m e n t f a c t o r Δ, i . e . , di = Δpi , 1 ≤ i ≤ n.  U∞ (Δ) = Δl o g

e

Δ+1 Δ

 , Δ = 1, 2, . . .

(2 )

F o r Δ = 2, t h e w o r s t c a s e u t i l i z a t i o n i n c r e a s e s f r o m 0 . 6 9 3 t o 0 . 8 1 1 a n d f o r Δ = 3 it is 0 .8 6 3 . R e c e n tly , th e tim in g a n a ly s is fo r a m o re g e n e ra l h a rd re a l-tim e p e rio d ic ta s k s e t o n a u n i p r o c e s s o r u s i n g fi x e d - p r i o r i t y m e t h o d s w a s p r o p o s e d b y H a¨ r b o u r e t a l [ H K L 9 4 ] .

S c h e d u lin g S y s te m

V e rifi c a tio n

2 3

C o n s id e rin g th e e a rlie s t d e a d lin e fi rs t d y n a m ic p rio rity s c h e d u lin g , L iu a n d L a y la n d [ L L 7 3 ] p r o v e d th a t g iv e n a ta s k s e t, it is E D F s c h e d u la b le iff n  ci ≤1 p i=1 i

(3 )

a n d s h o w e d th a t th e p ro c e s s o r u tiliz a tio n c a n b e a s h ig h a s 1 0 0 % . L iu a n d L a y la n d a ls o d is c u s s e d th e c a s e o f M ix e d P r io r ity (M P ) s c h e d g i v e n a t a s k s e t φ1 , φ2 , . . . , φn , t h e fi r s t k t a s k s φ1 , . . . , φk , k < n, a u s i n g fi x e d p r i o r i t y a s s i g n m e n t s a n d t h e r e s t n − k t a s k s φk+1 , . . . , φn a u s in g d y n a m ic p rio rity a s s ig n m e n ts . It w a s s h o w n th a t c o n s id e rin g th e p r o c e s s o r t i m e f r o m 0 t o t a v a i l a b l e t o t h e t a s k s e t (ak (t)), t h e t a s k s e t i s m s c h e d u la b le iff n−k  t  ck+i ≤ ak (t) pk+i i=1

u lin g , w h e re re s c h e d u le d re s c h e d u le d a c c u m u la te d ix e d p rio rity (4 )

f o r a l l t w h i c h a r e m u l t i p l e s o f pk+1 o r . . . o r pn . H e r e , ak (t) c a n b e c o m p u t e d a s fo llo w s .  k  t cj ak (t) = t − pj j=1 A lth o u g h th e E D F d y n a m ic p rio rity s c h e d u lin g h a s a h ig h p ro c e s s o r u tiliz a tio n , r e c e n t y e a r s fi x e d p r io r ity s c h e d u lin g h a s r e c e iv e d g r e a t in te r e s ts f r o m b o th a c a d e m a n d in d u s try [L S D 8 9 , L 9 0 , S G 9 0 , H K L 9 1 , S K G 9 1 , T B W 9 2 , K A S 9 3 , H K L 9 4 ]. S u m m a riz in g th e a b o v e s c h e d u lin g a lg o rith m s , w e h a v e fi v e d iffe re n t c a s e s o f s c h e la b ility c o n s id e ra tio n s : • R M -s a fe : a ll ta s k s e ts a re s c h e d u la b le a s lo n g a s th e s e rv e r u tiliz a tio n is b e lo loge 2 = 0.693, • R M -e x a c t: a ll ta s k s e ts s a tis fy in g E q u a tio n (1 ) a re s c h e d u la b le , • R M -a rb itra ry : a ll ta s k s e ts a re s c h e d u la b le a s lo n g a s th e s e rv e r u tiliz a tio n is b e lo Δl o g e ((Δ + 1)/Δ) ( E q u a t i o n ( 2 ) ) , • E D F : a ll ta s k s e ts s a tis fy in g E q u a tio n (3 ) a re s c h e d u la b le , • M P : a ll ta s k s e ts s a tis fy in g E q u a tio n (4 ) a re s c h e d u la b le ,

3

C lie n t-S e r v e r S c h e d u lin g S y s te m M o d e lin g v e rifi c a tio c o n s ta n t n in g p o lic y d iffe re n t s s e t o f ta s k

a re a l-tim e s y s te m n c o n s is ts o f a c o n u m b e r no f c lie n ts . E a c h c lie n t is m o c h e d u lin g re q u e s ts s , a s e rv e r d e c id e s

in y d u w

w

M o d e l

a s a c lie n t-s e rv e r s c h s ta n t n u m b e r mo f s e th a t is s u e s c h e d u lin g d e le d w ith a c lie n t a in v a rio u s m o d e s . O n w h e th e r th e ta s k s a re

e d u lin g s y s te m , o u r ta rg e t s y s te m o f r v e r s th a t p e rfo rm s c h e d u lin g a n d a re q u e s ts . A s e rv e r a d o p ts a s c h e d u lu to m a to n s u c h th a t th e c lie n t is s u e s r e c e iv in g a r e q u e s t f o r s c h e d u lin g a c u rre n tly s c h e d u la b le o r n o t.

D e fi n itio n 1 . : A P e r io d ic T a s k A p e r i o d i c t a s k i s a t u p l e φ = (α, c, p, d, f ), w h e r e α i s t h e i d e n t i fi c a t i o n o f t h e s e r v e r o n w h ic h th e ta s k is to b e p r o c e s s e d , cis th e c o n s ta n t c o m p u ta tio n tim e o f a jo b , pis th e

2 4

P a o -A n n H s iu n g , F a rn W a n g , a n d Y u e -S u n K u o

re q u e s t p e rio d o f a jo b , dis th e d e a d lin e w ith in w h ic h a jo b m u s t b e c o m p le te d b e fo re th e n e x t jo b re q u e s t o c c u rs , a n d f s p e c ifi e s if th e ta s k m u s t b e s c h e d u le d u s in g fi x e d p rio rity o r d y n a m ic p rio rity , th a t is , f = 1fo r fi x e d p rio rity a n d f = 0fo r d y n a m ic p r i o r i t y , c ≤ p, c ≤ d, a n d c, p, d ∈ N , t h e s e t o f n o n n e g a t i v e i n t e g e r s .  N o t a t i o n a l l y , w e l e t TH b e t h e u n i v e r s a l s e t c o n t a i n i n g a l l p o s s i b l e t a s k s i n a s y s t e m H. W e m o d e l t h e b e h a v i o r o f c l i e n t s w i t h t i m e d a u t o m a t a w h i c h a r e a u t o m a t a e n h a n c e d w ith c lo c k s . It is a s s u m e d th a t th e c u rre n t m o d e o f e a c h c lie n t is b ro a d c a s t to a ll th e c lie n ts in th e s a m e s y s te m . T h e b e h a v io r o f a c lie n t in e a c h m o d e c a n b e e x p re s s e d th ro u g h a s ta te p re d ic a te , w h ic h is a c o m b in a tio n o f p ro p o s itio n s a n d tim in g i n e q u a l i t i e s o n c l o c k r e a d i n g s . G i v e n a s e t o f p r o p o s i t i o n s P a n d a s e t o f c l o c k s X, a s ta te p re d ic a te ηo f P a n d Xh a s th e fo llo w in g s y n ta x . η ::= f a l s e | r | x ∼ a | x + a1 ∼ y + a2 | η1 ∧ η2 w h e r e r ∈ P , x, y ∈ X, a, a1 , a n d a2 a r e r a t i o n a l n u m b e r s , ∼ ∈ {≤, }, a n d η1 , η2 a r e s t a t e p r e d i c a t e s . L e t B(P, X) b e t h e s e t o f a l l s t a t e p r e d i c a t e s o n P a n d X. G i v e n a s e t o f p r o p o s i t i o n s P a n d a s e t o f c l o c k s X, a c l i e n t i s m o d e l e d a s f o l l o w s . n itio n 2 . : C lie n t A u to m a to n (C A ) l i e n t A u t o m a t o n ( C A ) i s a t u p l e C = (M, m0 , P, X, χ, μ, E, ρ, τ ) w i t h re s tric tio n s . M is a fi n ite s e t o f m o d e s . m0 ∈ M i s t h e i n i t i a l m o d e . P is a s e t o f a to m ic p ro p o s itio n s . Xis a s e t o f c lo c k s . χ : M → B(P, X) i s a f u n c t i o n t h a t l a b e l s e a c h m o d e w i t h a c o n d i t i o n m o d e . • μ : M → 2TH m a p s e a c h m o d e t o a fi n i t e s u b s e t o f t a s k s i n TH . • E ⊆M ×M is th e s e t o f tr a n s itio n s . • ρ : E → 2X m a p s a t r a n s i t i o n t o a s e t o f c l o c k s t h a t a r e r e s e t o n t h a t t r a • τ : E → B(P, X) m a p s e a c h t r a n s i t i o n t o a t r i g g e r i n g c o n d i t i o n . T h e C A C s t a r t s e x e c u t i o n a t i t s m o d e m0 . W e s h a l l a s s u m e t h a t i n i t i a l l y re a d z e ro . In b e tw e e n tra n s itio n s , a ll c lo c k s in c re m e n t a t a u n ifo rm ra te . T h e o f th e C A m a y b e fi re d w h e n th e trig g e rin g c o n d itio n is s a tis fi e d .

D e fi A C in g • • • • •

D e fi n itio n 3 . : S e r v e r s A s e r v e r i s a t u p l e α, φ w h s c h e d u lin g p o lic y o f th e s e rv N o w w ith a s e t o f s e rv s c h e d u la b ility -c h e c k tim e u n w h a t is a s c h e d u lin g s y s te m . D e fi n itio n 4 . : S A s c h e d u lin g s y P, X, Γ ), w h e r e c lie n t a u to m a ta , o f c lo c k s u s e d in jo b c o m p u ta tio n

th e fo llo w -

tru e in th a t

n s itio n .  , a ll c lo c k s tra n s itio n s

e r e αis th e u n iq u e id e n tifi c a tio n f o r th e s e r v e r a n d φis th e e r.  e rs , a s e t o f c lie n t a u to m a ta , a n d th e ra tio b e tw e e n th e it a n d th e jo b -c o m p u ta tio n tim e u n it, w e a re re a d y to d e fi n e

c h e d u lin g s y s te m s s te m H is d e fi n e d a s a tu p le {S1 , S2 , . . . , Sm } i s a s e t o f P, a n d X a r e r e s p e c t i v e l y t h e C1 , . . . , Cn , a n d Γ i s a r a t i o o tim e u n it.

({S1 , S2 , . . . , Sm }, {C1 , C2 , . . . , Cn }, s e r v e r s , {C1 , C2 , . . . , Cn } i s a s e t o f s e t o f a to m ic p ro p o s itio n s a n d th e s e t f a s c h e d u la b ility -c h e c k tim e u n it to a 

S c h e d u lin g S y s te m

V e rifi c a tio n

2 5

D e fi n itio n 5 . : S ta te s a n d th e ir a d m is s ib ility G i v e n a s y s t e m H = ({S1 , . . . , Sm }, {C1 , . . . , Cn }, P, X, Γ ) w i t h Ci = (Mi , m0i , P, X,

χi , μi , Ei , ρi , τi ), a s t a t e s o f +H i s d e fi n e d a s a m a p p i n g f r o m {1, ..., n} ∪ P ∪ X t o 1≤i≤n Mi ∪ {t r u e , f a l s e } ∪ R s u c h t h a t • ∀i ∈ {1, ..., n}, s(i) ∈ Mi i s t h e m o d e o f Ci i n s; • ∀r ∈ P , s(r) ∈ {t r u e , f a l s e } i s t h e t r u t h v a l u e o f r i n s; a n d • ∀x ∈ X, s(x) ∈ R+ i s t h e r e a d i n g o f c l o c k x i n s. F u r th e r, a s ta te sis s a id to b e a d m is s ib le w h e n :  • s |= 1≤i≤n χi (s(i)), a n d  • t h e t a s k s e t ∪1≤i≤m μi (s(i)) ⊆ TH a t s i s s c h e d u l a b l e b y t h e s e r v e r s . D e fi n itio n 6 . : S a tis fa c tio n o f s ta te p r e d ic a te b y a s ta te S t a t e p r e d i c a t e η i s s a t i s fi e d b y a s t a t e s, w r i t t e n a s s |= η i f f • s |= f a l s e ; • ∀r ∈ P, s |= r i f f s(r) = t r u e ; • ∀x ∈ X, s |= x ∼ a i f f s(x) ∼ a; • ∀x, y ∈ X, s |= x + a1 ∼ y + a2 i f f s(x) + a1 ∼ s(y) + a2 ; a n d • s |= η1 ∧ η2 i f f s |= η1 a n d s |= η2



D e fi n itio n 7 . : M o d e T r a n s itio n G i v e n a s y s t e m H = ({S1 , . . . , Sm }, {C1 , . . . , Cn }, P, X, Γ ) w i t h Ci = (Mi , m0i , P, X, χi , μi , Ei , ρi , τi ), a n d t w o s t a t e s s a n d s , t h e r e i s a m o d e t r a n s i t i o n f r o m s t o s i n H, i n s y m b o l s s → s , i f f • b o t h s a n d s a r e a d m i s s i b l e s t a t e s , • th e r e is a n 1≤i≤ns u c h th a t - (s(i), s (i)) ∈ Ei ; - s(i) |= τi (s(i), s (i)); - f o r a l l 1 ≤ j ≤ n a n d j = i, s(j) = s (j); - ∀x ∈ X ((x ∈ ρi (s(i), s (i)) ⇒ s (x) = 0)∧(x ∈ ρi (s(i), s (i)) ⇒ s (x) = s(x))).  + G iv e n a s ta te sa n d a δ ∈ R , w e le t s+δ b e th e s ta te th a t a g r e e s w ith sin e v e r y a s p e c t e x c e p t f o r a l l x ∈ X, s(x) + δ = (s + δ)(x). 3 .1

S e m a n tic s o f S c h e d u la b ility C h e c k in g

T h e a d m is s ib ility o f a n e w s ta te , th a t is , th e s c h e d u la b ility c h e c k , c a n b e im p le m e n te d in e ith e r o n e o f tw o w a y s : (1 ) c h e c k in g b e fo re tra n s itio n , a n d (2 ) c h e c k in g a fte r tra n s itio n . In th e fo rm e r c a s e , w h e n a c lie n t is in a p a rtic u la r m o d e (m a y b e e x e c u tin g s o m e ta s k s ) a n d a n o u t-g o in g tra n s itio n is e n a b le d , it m u s t fi rs t c h e c k w ith th e s e rv e rs b y s e n d in g s c h e d u lin g re q u e s ts b e fo re th e o u t-g o in g tra n s itio n is ta k e n . In th e la tte r c a s e , w h e n a c lie n t is in a p a rtic u la r m o d e a n d a n o u t-g o in g tra n s itio n is e n a b le d , th e c lie n t m a y ta k e th e tra n s itio n a n d th e n c h e c k if th e ta s k s in th e n e w m o d e a re s c h e d u la b le . (a ) S c h e d u lin g -C h e c k B e fo re T r a n s itio n (S C B T ): T h e s e m a n tic s h e re d iffe r m a in ly in th e d u ra tio n tim e th a t a c lie n t a u to m a ta c a n s ta y in a m o d e . H e re , w e p ro p o s e th re e p o s s ib ilitie s .

2 6

(b sp m in lo

P a o -A n n H s iu n g , F a rn W a n g , a n d Y u e -S u n K u o

• (S P R ) S a tu r a te d P a r a lle l R e q u e s t: If m o re th a n o n e o u t-g o in g tra n s itio n s o f th e c u rre n tly e x e c u tin g m o d e a re c o n c u rre n tly e n a b le d , th e n th e c lie n t k e e p s o n is s u in g s c h e d u lin g re q u e s ts to a ll s e rv e rs a c c o rd in g to its n e x t-s ta te s ta s k s e ts . O n c e a p o s itiv e r e s p o n s e is b a c k f o r a n y o n e n e x t- s ta te , th e c lie n t c a n m a k e th e c o r r e s p o n d in g tr a n s itio n . I f m o r e th a n o n e p o s itiv e r e s p o n s e s a r e r e c e iv e d , th e c lie n t m a k e s a ll c o rre s p o n d in g tra n s itio n s in p a ra lle l (p a ra lle lis m is im p le m e n te d a s in te rle a v in g o f tra n s itio n s e q u e n c e s ). In th is s e m a n tic s , th e d u ra tio n tim e o f a m o d e m u s t b e g re a te r th a n th e s c h e d u la b ility -c h e c k c o m p u ta tio n tim e fo r th e c o rre s p o n d in g n e x t s ta te . T h is s e m a n tic s n e e d s m in im a l m o d ifi c a tio n to tra n s la te to H y T e c h in p u t fo rm . • (S Q R ) S e q u e n tia l R e q u e s t: T h e c lie n t n o n d e te rm in is tic a lly c h o o s e s a n e x t s ta te a n d p o s ts re q u e s ts to th e s e rv e rs s p e c ifi e d in th e ta s k s e t o f th e n e x t s ta te . N o re q u e s t to a n y s e rv e r w ill b e is s u e d u n til th e la s t re q u e s t is re p lie d . In th is s e m a n tic s , th e c lie n t n o n d e te rm in is tic a lly c h o o s e s a n e x t-s ta te a n d p o lls th e s e rv e rs fo r s c h e d u la b ility -c h e c k . O n ly a fte r re s p o n s e is b a c k , th e c lie n t m a y te s t fo r a n o th e r n e x t-s ta te . T h u s th e d u ra tio n tim e a c lie n t c a n s ta y in a m o d e m u s t b e th e s u m o f a s e q u e n c e o f s c h e d u la b ility -c h e c k c o m p u ta tio n tim e s . • (N P R ) N o n -s a tu r a te d P a r a lle l R e q u e s t: T h e c lie n t p o lls a ll th e s e rv e rs fo r a ll its n e x t-s ta te s . O n c e a re p ly is b a c k , th e c lie n t c h o o s e b e tw e e n ta k in g th e c o rre s p o n d in g tra n s itio n o r n o t. If it d o e s n o t tra n s it a t th e m o m e n t, th e n it is s u e s a n o th e r s c h e d u la b ility re q u e s t fo r th e s a m e n e x t-s ta te . In th is s e m a n tic s , th e d u ra tio n tim e m u s t b e a t le a s t a m u ltip le o f th e s c h e d u la b ility -c h e c k c o m p u ta tio n tim e fo r a p a rtic u la r n e x t-s ta te . ) S c h e d u lin g C h e c k A fte r T r a n s itio n (S C A T ): In th is c a s e , m o d u la rity o f th e s y s te m e c ifi c a tio n s is p re s e rv e d a n d tra n s itio n s o c c u r a c c o rd in g to th e tim e d a u to m a ta s e a n tic s . S c h e d u lin g s y s te m s im p le m e n te d u s in g th is s c h e m e o f s c h e d u la b ility c h e c k g h a v e tw o s e m a n tic s re la te d to s c h e d u lin g , th a t is s tr ic t s c h e d u lin g s e m a n tic s a n d o s e s c h e d u lin g s e m a n tic s . • (S S S ) S tr ic t S c h e d u lin g S e m a n tic s : In a p a rtic u la r m o d e , it m a y h a p p e n th a t th e s p e c ifi e d ta s k s e t c a n n o t b e s c h e d u le d b e fo re a n o u t-g o in g tra n s itio n is e n a b le d . In th is s itu a tio n , w h e n w e d o n o t a llo w th e c lie n t to m a k e th e e n a b le d tra n s itio n fro m th e n o n -s c h e d u le d m o d e , w e c a ll it s tric t s c h e d u lin g s e m a n tic s . • (L S S ) L o o s e S c h e d u lin g S e m a n tic s : In a s p e c ifi c m o d e , w h e n th e s p e c ifi e d ta s k s a r e n o t s c h e d u le d ( i.e ., s c h e d u la b ility - c h e c k r e tu r n s n e g a tiv e r e s p o n s e ) b e f o r e a n o u t-g o in g tra n s itio n is e n a b le d , th e c lie n t m a y c h o o s e to e ith e r k e e p o n is s u in g s c h e d u lin g re q u e s ts fo r n o n -s c h e d u le d ta s k s s e t o r tra n s it to th e n e x t m o d e b y m a k in g th e e n a b le d tra n s itio n . T h is is c a lle d lo o s e s c h e d u lin g s e m a n tic s a n d re s u lts in a la rg e r g lo b a l s ta te s p a c e a s s h o w n b y e x a m p le s in S e c tio n 4 . T h e c o m p u ta tio n o f o u r s c h e d u lin g s y s te m is d e fi n e d in th e fo llo w in g .

D e fi n i t i o n 8 . : s- r u n G i v e n a s y s t e m H a n d a s t a t e s o f H, a c o m p u t a t i o n o f H s t a r t i n g a t s, c a l l e d a n s- r u n , i s a s e q u e n c e ((s1 , t1 ), (s2 , t2 ), . . . . . .) o f p a i r s s u c h t h a t • s = s1 ; a n d • f o r e a c h t ∈ R+ , ∃j ∈ N s u c h t h a t tj ≥ t; a n d

S c h e d u lin g S y s te m

• f o r e a c h i n t e g e r j ≥ 1, sj + δ |= χi (sj (i)); a n d • f o r e a c h j ≥ 1, H g o e s f - m o d e tr a n s itio n , i.e . - t i m e p a s s a g e , i . e . tj • T h e d u ra tio n tim e a c lie n

4

V e rifi c a tio n

2 7

f o r e a c h r e a l 0 ≤ δ ≤ tj+1 − tj , sj i s a d m i s s i b l e a n d r o m sj t o sj+1 b e c a u s e o f tj = tj+1 ∧ sj → sj+1 ; o r < tj+1 ∧ sj + tj+1 − tj = sj+1 . t c a n s ta y in a m o d e m u s t s a tis fy th e c h o s e n s e m a n tic s .



I m p le m e n ta tio n T h e th e o re tic a l fra m e w o rk o f a C lie n t S e rv e r S c h e d u lin g S y s te m M o d e l a s p re s e n te d in S e c tio n 3 h a s b e e n im p le m e n te d in to a p ra c tic a l to o l fo r v e rify in g s c h e d u lin g s y s te m s . T h e im p le m e n ta tio n m a in ly c o n s titu te s tw o p a rts : s c h e d u lin g c h e c k tim e c o m p u ta tio n a n d tra n s la tin g a s c h e d u lin g s y s te m d e s c rip tio n in to a p u re tim e d a u to m a ta s p e c ifi c a tio n . T h e re s u ltin g tim e d a u to m a ta s p e c ifi c a tio n c a n b e s e e n a s a s p e c ia l c a s e o f lin e a r h y b rid a u to m a ta , h e n c e th e p o p u la r to o l c a lle d H y T e c h is u s e d fo r v e rify in g o u r re s u lta n t s y s te m d e s c rip tio n s . T h e tw o s e m a n tic s o f s c h e d u lin g c h e c k b e fo re a n d a fte r tra n s itio n h a v e b o th b e e n im p le m e n te d in to o u r tra n s la to r to o l. E x p e rim e n ts h a v e b e e n c o n d u c te d w ith s e v e ra l a p p lic a tio n e x a m p le s fro m b o th h a rd w a re a n d s o ftw a re . T h o u g h th e d e g re e o f a d v a n ta g e in u s in g o u r p ro p o s e d a p p ro a c h fo r v e rify in g s c h e d u lin g s y s te m s v a ry , y e t a ll o f th e e x a m p le s s h o w a n a p p re c ia b le a m o u n t o f d e c re a s e in th e s iz e o f th e re a c h a b le s ta te s p a c e re q u ire d fo r v e rifi c a tio n . 4 .1

S c h e d u lin g C h e c k T im e C o m p u ta tio n

B e f o r e e n t e r i n g a s t a t e s, a s y s t e m m u s t c h e c k w i t h t h e s e r v e r s i f i t i s a n a d m i s s i b l e s t a t e , t h a t i s , i f a l l t h e t a s k s ( ∪vi=1 μi (s(i))) i n t h a t s t a t e a r e s c h e d u l a b l e b y t h e s e r v e r s . T h is c o m p u ta tio n f o r s c h e d u la b ility c h e c k is d o n e e x c lu s iv e ly b y e a c h c lie n t b y lo c k in g th e s e rv e rs a n d re q u ire s a s m a ll p e rio d o f tim e w h ic h d e p e n d s o n th e s c h e d u lin g a lg o rith m s u s e d b y th e s e rv e rs . U s u a lly th e c o m p u ta tio n fo r s c h e d u la b ility c h e c k is a v e ry s m a ll o n e c o m p a re d to th e s c h e d u le d jo b c o m p u ta tio n tim e . H o w e v e r, a s th e n u m b e r o f c o n te n d in g p ro c e s s e s in c re a s e s , s o m e s c h e d u lin g p o lic ie s m a y c o n s u m e a n a m o u n t o f tim e th a t c a n n o t b e c o n s id e re d n e g lig ib le . F o r e x a m p le , fo r a 2 0 0 M H z C P U , th e p ro c e s s o r c y c l e t i m e i s a r o u n d 5 × 10−8 s e c o n d s , a n d c o n s i d e r i n g a s i n g l e i n s t r u c t i o n t o b e 2 c y c l e s , t h e C P U r e q u i r e s o n l y 10−7 s e c o n d s f o r o n e p r o c e s s o r o p e r a t i o n . A t t h e s a m e tim e , o n e tic k o f s c h e d u le d jo b c o m p u ta tio n tim e in a re a l-tim e s y s te m is u s u a lly in th e o rd e r o f a m illis e c o n d (m s ). H e n c e , th e ra tio o f a s e rv e r c y c le tim e to a jo b c o m p u ta tio n t i m e u n i t i s 10−4 . N o r m a l l y , a t a s k s e t s i z e i n a r e a l - t i m e s y s t e m i s i n t h e o r d e r o f 1 0 t o 1 0 0 . A s c h e d u la b ility -c h e c k tim e lin e a r in th e s iz e o f th e ta s k s e t w o u ld b e n e g lig ib le c o m p a re d to th e c o m p u ta tio n tim e o f th e ta s k s e t, b u t if it is q u a d ra tic , it w o u ld b e in th e o rd e r o f o n e jo b tim e u n it. F o r a n a ly z in g th e a m o u n t o f tim e re q u ire d fo r s c h e d u la b ility -c h e c k , w e d e fi n e th e s e t o f t a s k s i n s o m e s t a t e s, w h i c h a r e t o b e s c h e d u l e d o n s o m e p a r t i c u l a r s e r v e r Sk u s i n g s o m e s c h e d u l i n g a l g o r i t h m Rk , 1 ≤ k ≤ m. νs (Rk ) = {φ | φ = (Sk , c, p, d, f ), φ ∈ μi (s(i)), 1 ≤ i ≤ n}

(5 )

2 8

P a o -A n n H s iu n g , F a rn W a n g , a n d Y u e -S u n K u o 4

3 .5 o th e rs : R M _ s a fe , R M _ a rb , E D

s c h e d u la b ility c h e c k tim e ( s )

3

2 .5 R M _ e x a c t 2

1 .5 M P 1

0 .5 o th e rs 0 1 0

-6

-5

-4

-3

1 0 1 0 1 0 p r o c e s s o r o p e r a tio n tim e to c o m p u ta tio n tim e u n it r a tio ( lo g )

1 0

-2

F ig . 2 . S c h e d u la b ility C h e c k T im e T h e s c h e d u la b ility c h e c k tim e re q u ire d fo r e a c h o f th e fi v e v a ria tio n s o f p rio rity s c h e d u lin g d e s c rib e d in s e c tio n 2 u s in g d iffe re n t ra tio s o f s e rv e r o p e ra tio n tim e to c o m p u ta tio n tim e u n it is illu s tra te d in F ig . 2 . W e o b s e rv e th a t th e s c h e d u la b ility c h e c k tim e i s n e g l i g i b l e w h e n t h e r a t i o i s o f t h e o r d e r o f (10−4 ). W e m a k e t h e f o l l o w i n g a s s u m p tio n s : • T h e e x e c u tio n o f a ll jo b s o f e a c h ta s k s ta rt a t in te g e r-v a lu e d tim e in s ta n ts . • A s c h e d u la b ility c h e c k is a s s u m e d to ta k e 1 c o m p u ta tio n tim e u n it w h e n it is n o t g re a te r th a n 1 u n it a n d it is ta k e n a s 2 tim e u n its w h e n it is b e tw e e n 1 a n d 2 , th a t is , th e s c h e d u la b ility c h e c k tim e is ta k e n a s th e n e x t la rg e r in te g e r if it is n o t a lre a d y a n in te g e r. A s fa r a s R M -s a fe , R M -a rb itra ry , a n d E D F p rio rity s c h e d u lin g a re c o n c e rn e d , th e s c h e d u l a b i l i t y c h e c k t i m e o n l y d e p e n d s o n t h e t o t a l u t i l i z a t i o n o f a s e r v e r . A s l o n g a s , a n d 1 0 0 % , t h e u t i l i z a t i o n i s b e l o w t h e r e s p e c t i v e b o u n d s o f n(21/n − 1), Δl o g e Δ+1 Δ a ll ta s k s o f a ll p h a s in g s , re q u e s t p e rio d s , a n d d e a d lin e s c a n b e s c h e d u le d . T h is c h e c k r e q u i r e s t i m e l i n e a r i n |νs (R)|, w h e r e R i s R M - s a f e , R M - a r b i t r a r y , a n d E D F , r e s p e c tiv e ly . H e n c e , a s s u m in g th e r a tio o f a p r o c e s s o r o p e r a tio n tim e to a jo b c o m p u ta tio n t i m e u n i t t o b e top , f o r e x a m p l e , top i s i n t h e o r d e r o f 10−4 f o r a 2 0 0 M H z C P U a n d a 1 m s tic k c o m p u ta tio n tim e , th e tim e s p e n t fo r c h e c k in g s c h e d u la b ility o f R M -s a fe , R M -a rb itra ry , a n d E D F b y a p a rtic u la r s e rv e r a re a s fo llo w s . γs (RMsaf e ) = |νs (RMsaf e )| × top

(6 )

γs (RMarb ) = |νs (RMarb )| × top

(7 )

γs (EDF ) = |νs (EDF )| × top

(8 )

F o r R M -e x a c t (E q u a tio n 1 ) s c h e d u lin g , th e s c h e d u la b ility c h e c k tim e is a s fo llo w s . γs (RMexact ) = |νs (RMexact )|2 × p|νs (RMexact )| × top

(9 )

S c h e d u lin g S y s te m

V e rifi c a tio n

2 9

w h e r e p|νs (RMexact )| i s t h e l a r g e s t p e r i o d i n νs (RMexact ). A s f o r m i x e d p r i o r i t y s c h e d u l in g , th e s c h e d u la b ility c h e c k tim e is a s fo llo w s . γs (M P ) = |νs (M P )| × L C M {pk | φ = (S, c, pk , d, 1)} × top w h e re L C M is th e le a s t c o is to b e s c h e d u le d u s in g d H e n c e , th e to ta l tim e a s ta te s in a s y s te m H P, X, TH , top ) i s a s f o l l o w

m m y n a sp = s.

o n m u l t i p l e a n d φ(S, c, pk , d, 1) i s a t a s k i n s t a t e s, w h i c h m ic p rio rity . e n t o n s c h e d u la b ility c h e c k d u rin g a s ta te tra n s itio n to (S1 , S2 , . . . , Sm , R1 , R2 , . . . , Rm , C1 , C2 , . . . , Cn ,

γs = M a x

1≤k≤m γs (Rk )

w h e r e Rk ∈ {RMsaf e , RMexact , RMarb , EDF, M P }. T h e d iffi c u lty in im p le m e n tin g s c h e d u lin g c h e c k tim e t h a t f o r RMexact a n d M P s c h e d u l i n g p o l i c i e s , t h e p e r i o d s ta s k s m u s t b e k n o w n (re fe r to E q u a tio n s (1 0 ) a n d (1 1 )), p o s s ib le p e rm u ta tio n s o f th e c lie n t m o d e s fo r a c o m p le te c a ls o im p lie s th a t th e m o d e s ta tu s o f e a c h c lie n t m u s t b e b ro in th e s c h e d u lin g s y s te m . T h is b ro a d c a s t h a s b e e n im p le m 4 .2

(1 0 )

(1 1 ) c o m p u ta tio n lie s in th e fa c t o f a ll th e c u rre n tly e x e c u tin g h e n c e w e m u s t c o n s id e r a ll h e c k tim e c o m p u ta tio n . T h is a d c a s t to a ll th e o th e r c lie n ts e n te d in o u r tra n s la to r.

T r a n s la to r

W e d e v e lo p e d a tra n s la to r fo r tra n s la tin g th e c lie n t-s e rv e r s c h e d u lin g s y s te m s p e c ifi c a tio n (in o u r o w n in p u t la n g u a g e ) to th e H y T e c h s p e c ifi c a tio n . A lth o u g h a s c h e d u lin g s y s te m c a n b e s p e c ifi e d u s in g th e H y T e c h in p u t la n g u a g e , y e t th e s p e c ifi c a tio n w o u ld b e v e ry le n g th y , te d io u s , a n d e rro r-p ro n e . U s in g o u r in p u t la n g u a g e , th e s p e c ifi c a tio n is s h o rt a n d c o m p a c t a n d th e tra n s la tio n is d o n e s y s te m a tic a lly , th u s a v o id in g a n y h u m a n e rro rs . F o r e x a m p le , in th e re a l-tim e o p e r a tin g s y s te m e x a m p le (d e s c rib e d in s u b s e c tio n 4 .3 ) , u s in g o u r in p u t la n g u a g e th e s p e c ifi c a tio n c o n s is te d o f o n ly 1 2 m o d e s a n d 1 7 tra n s itio n s , w h e re a s th e re s u ltin g tra n s la tio n in to H y T e c h in p u t la n g u a g e c o n s is te d o f 5 8 m o d e s a n d 4 1 6 tra n s itio n s . T h u s , th e tra n s la to r is a n e c e s s ity fo r v e rify in g s c h e d u lin g s y s te m s . H y T e c h [H H W T 9 5 ] is a p o p u la r v e rifi c a tio n to o l fo r v e rify in g s y s te m s m o d e le d a s lin e a r h y b rid a u to m a ta . H y T e c h h a s b e e n u s e d to v e rify v a rio u s d iffe re n t s y s te m s s u c h a s g a s b u rn e r, ra ilro a d c ro s s in g c o n tro lle r, C o rb e tt’s d is trib u te d c o n tro lle r, a n d p ro to c o ls s u c h a s F is c h e r’s m u tu a l e x c lu s io n p ro to c o l. E a c h c lie n t a u to m a to n is im p le m e n te d a s a lin e a r h y b rid a u to m a to n in H y T e c h a n d th e a n a ly s is to o l is u s e d to v e rify o u r s y s te m . A c c o rd in g to th e d iffe re n t s c h e d u lin g s e m a n tic s , w e h a v e d iffe re n t ty p e s o f im p le m e n ta tio n s c h e m e s . F o r th e s c h e d u lin g c h e c k b e fo re tra n s itio n (S C B T ) s e m a n tic s , w e h a v e a tra n s itio n -o rie n te d im p le m e n ta tio n a n d fo r th e s c h e d u lin g c h e c k a fte r tra n s itio n (S C A T ), w e h a v e a m o d e -o rie n te d im p le m e n ta tio n . S C B T I m p le m e n ta tio n A s illu s tra te d in F ig . 3 , e a c h m o d e in th e s c h e d u lin g s y s te m d e s c rip tio n is im p le m e n te d a s a s im p le jo b e x e c u tio n lo c a tio n c a lle d R u n J o b s , b u t e a c h m o d e tra n s itio n is im p le m e n te d a s a s e t o f th re e in te rc o n n e c te d lo c a tio n s c a lle d L o c k ,

3 0

P a o -A n n H s iu n g , F a rn W a n g , a n d Y u e -S u n K u o

M1

................................. ...... .... ... .. .. ..... .. .... ... ..... ..................................

R u n J o b s

M1

.............................................. ........... ...... ...... .... ... ..... .. ... .... ... .... ... ..... .... . . ........ . . . ................ ..... ...................................

tr ig g e r a s s ig n m e n ts pp p pp pp pp pp pp ppp pp pp pp pp pp p ppppp ppp p

M2

............................................... ........... ...... .... ...... ... .... .. ... . .... .. .... .. ..... .... . . ....... ...... . .............. . . . . . . . . . ...............................

tr ig g e r pp p pp pp pp pp pp ppp pp p pp p pp ppp ppp pppp p

ppppppppppp ppppppppppp ppppppppppp ppppppppppp p pppppppppp ppppppppppp ppppppppppp pppppppppp

.................................. .... ..... ... .. .... .. .... .. ..... .... ............................... . . . . . . . . .. ...... .................. . . . . . ....... ..... ....... ...... ....... ...... ....... ...... ....... .......... ........ ............ ....... .................................. . . .. . . .... ................................ .... . . ...... .... . ... ................. ... .. .... . ..... ... . .. ...... . . . . . .. . .... ..................p........... .... ...... ppp ppp ................................ ppp

l=0 l := i

l=i l := 0

l=i

n o t s c h e d u la b le

S c h e d C h e c k

s c h e d u la b le

L o c k

l := 0

E rro r

ppp ppp ppp ppp ppp ppp ppp ppp ppp ppp ppp ppp ppp ppp ppp ppp ppp ppp ppp pppp pppp ppp ppp ppp ppp pppp pp pppp pp pppp pppppp pppp pppp ppp pp ppppp ppp p pppppppppp ppppppppppp ppppppppp pp

M2

a s s ig n m e n ts

......................... ......... ..... .... ... ... .. ... R u n J o b s .. .... ...... .... .................................

F ig . 3 . S c h e d u lin g -C h e c k B e fo r e T r a n s itio n I m p le m e n ta tio n

S c h e d C h e c k , a n d E r r o r . T h e p u r p o s e o f th e s e lo c a tio n s a r e , r e s p e c tiv e ly , th e lo c k in g o f th e s e rv e rs , th e c h e c k in g fo r s c h e d u la b ility o f th e ta s k s in th e n e x t m o d e (th e d e s tin a tio n m o d e o f th e tra n s itio n u n d e r c o n s id e ra tio n ), a n d th e re s e ttin g o f in te rn a l v a ria b le s w h e n a n e g a tiv e r e s p o n s e is r e c e iv e d in S c h e d C h e c k . T h e r e is a lo c a tio n tr a n s itio n f r o m R u n jo b to L o c k a n d o n e f r o m S c h e d C h e c k ( o n a p o s itiv e r e s p o n s e f r o m th e s e r v e r s ) to th e R u n J o b s lo c a tio n o f th e d e s tin a tio n m o d e . T h e trig g e rin g c o n d itio n a n d th e a s s ig n m e n t s ta te m e n ts o f th e tra n s itio n u n d e r c o n s id e ra tio n a re a tta c h e d to th e lo c a tio n tra n s itio n fro m R u n J o b s to L o c k a n d to th e lo c a tio n tra n s itio n fro m S c h e d C h e c k to n e x t m o d e R u n J o b s lo c a tio n , r e s p e c tiv e ly . T h e lo c k in g m e c h a n is m is s im ila r to th a t f o r S C A T a n d is d e s c rib e d in th e S C A T im p le m e n ta tio n . S a tu ra te d p a ra lle l re q u e s t (S P R ) o f S C B T re q u ire s th e le a s t m o d ifi c a tio n w ith re s p e c t to H y T e c h , s o o n ly S P R w a s im p le m e n te d . S C A T I m p le m e n ta tio n E a c h m o d e o f a c lie n t a u to m a to n is im p le m e n te d b y fo u r lo c a tio n s , n a m e ly , L o c k , S c h e d C h e c k , R u n J o b s , a n d E r ro r . A c lie n t m u s t c h e c k th e a d m is s ib ility o f a m o d e b e f o r e e n te r in g it, a n d th is c h e c k m u s t b e d o n e e x c lu s iv e ly b y a c lie n t b e c a u s e o th e rw is e th e s c h e d u la b ility c h e c k p e rfo rm e d w ill n o t b e c o n s is te n t. T o e n s u re e x c lu s iv e n e s s o f s c h e d u la b ility c h e c k , w e e m p lo y a s im p le r v e r s io n o f th e F is c h e r ’s m u t u a l e x c l u s i o n p r o t o c o l [ L 8 7 ] a n d a l o c k ( l) s e m a p h o r e v a r i a b l e . B e f o r e p e r f o r m i n g s c h e d u la b ility -c h e c k , a c lie n t o b ta in s o w n e rs h ip o f l b y s e ttin g l to its id e n tifi c a tio n n u m b e r s o th a t it c a n e x c lu s iv e ly d o th e c h e c k in g . A c lie n t w a its in lo c a tio n L o c k f o r l t o b e f r e e ( i . e . , l = 0) a n d w h e n f r e e , i t s e t s l t o i t s i d e n t i fi c a t i o n n u m b e r . S c h e d u l a b i l i t y c h e c k is d o n e in th e lo c a tio n S c h e d C h e c k if lis s till s e t to its o w n id e n tifi c a tio n n u m b e r, o th e rw is e th e c lie n t re tu rn s to th e lo c a tio n L o c k . A fte r s c h e d u la b ility c h e c k , th e c lie n t

S c h e d u lin g S y s te m

....................... .......... ..... ................................................. .... ...... .................. ... ...... .. .... .... .. .... .... .... .... ...... . . .... . ............................ ... ... .. .. ... ... .. .. .. . . . . . . . . . . . . . . . . . . . . . . . . ...... .... .. .... ..... . . . .. . . . .. . .... . .. .. .... . . .. . ...... .................................. ... . ... . .. ... ... .... .... .......................... .... ........................... . . . . . . . . . . . . . . . . . . ..... .... .. .. ... ... ... .... .... ..... .. ... . ....... .... . . .. ................. ... ..... ... ... ..... ........ ..... ..... .......... .......................... ....................... .... .... .... .... .... .... .... .... .... .... .... ..... ............ . ............................... . . . . . . .... .......................................................... .. ........... ...... .... . .. ..... .... .... .. .... .... .... ....... . .... . . ............................ .... ... .. .. .. ... ... .. . . . . . . . . . . . . . . . ......... .. ......... ..... . . . . . ... .. . . .. . ..... .. .. ... . .. . ..... .. .. . ........... ................ . . ......... .. . ... .. ... ... .... .... ....................... ....................... . . . . . . . . . . . . . . . . . ..... ..... ... .... .... ... ... ..... .... .... ... ...... .. . .... .... . . ............ ... ....... .... .... ..... .... ...... ............ ............... ................................ .........

F ig . 4 . S C A T : S S S I m p le m e n ta tio n

M1

V e rifi c a tio n

L o c k

l=i l := 0

s c h e d u la b le

l=0 l := i S c h e d C h e c k l=i n o t s c h e d u la b le l := 0 E rro r

R u n J o b s

m o d e tra n s itio n

M2

L o c k

l=i l := 0

s c h e d u la b le

l=0 l := i S c h e d C h e c k l=i n o t s c h e d u la b le l := 0

R u n J o b s

E rro r

F ig . 5 . S C A T : L S S I m p le m e n ta tio n

c h a n g e s m o d e in lo c a tio n S c h e d C h e c k a n d if s c h e d u la b le th e jo b s o f th e s c h e d u a re e x e c u te d in lo c a tio n R u n J o b s , o th e rw is e th e lo c a tio n E r ro r is e n te re d . A s illu s tra te d in F ig . 4 , in th e c a s e o f s tric t s c h e d u lin g s e m a n tic s (S S S ), tio n E r ro r h a s o n ly o n e o u t-g o in g tra n s itio n to lo c a tio n L o c k s in c e th e ta s k s s c h e d u le d a n d e x e c u te d in th e m o d e b e fo re a n y m o d e tra n s itio n o c c u rs . T h e tra n s itio n fro m R u n J o b s to L o c k im p le m e n ts a m o d e tra n s itio n in th e c lie n t a u A s illu s tra te d in F ig . 5 , in th e c a s e o f lo o s e s c h e d u lin g s e m a n tic s (L S S ), th e lo c ro r h a s tw o o u t-g o in g tra n s itio n s : o n e to th e lo c a tio n L o c k o f th e c u rre n t m o d in th e c a s e o f s tric t s c h e d u lin g s e m a n tic s ) a n d o n e to th e lo c a tio n L o c k o f th e n e T h e tw o lo c a tio n tra n s itio n s fro m lo c a tio n E r ro r to th e tw o L o c k lo c a tio n s im p m o d e tra n s itio n . 4 .3

3 1

le d ta s k s th e lo c a m u st b e lo c a tio n to m a to n . a tio n E r e (ju s t a s x t m o d e . le m e n t a

A p p lic a tio n E x a m p le s

T o illu s tra te th e g e n e ra lity o f o u r a p p ro a c h , w e d e m fe re n t ty p e s o f s y s te m s : a h a rd w a re s y s te m s u c h a s a a s o ftw a re s y s te m s u c h a s a re a l-tim e o p e ra tin g s y s s u c h a s a p a c k a g e d e liv e r y s y s te m ( P D S ) . T h e re a re tw o s e rv e rs in th e v id e o e x a m p le s (ju s c h e d u le s ta s k s w ith th e ra te -m o n o to n ic (s a fe ) p o lic y s o w ith th e e a rlie s t-d e a d lin e fi rs t p o lic y . F o r th e re a s e rv e rs : O S k e rn e l, d is p la y , m e m o ry , a n d p rin te r,

o n s tra te th e b e n e fi ts o f th re e d ifv id e o -o n -d e m a n d (V O D ) s y s te m , te m (R T O S ), a n d a n a g e n t s y s te m s t a s in F ig , w h ile th e c l-tim e O S e w h ic h u s e

. 1 ) o m x a m ra te

. T h m e r p le -m o

e m o v ie c ia l s e rv , th e re a n o to n ic

se rv e r e r d o e s re fo u r (sa fe ),

3 2

P a o -A n n H s iu n g , F a rn W a n g , a n d Y u e -S u n K u o

T a b le 1 . C o m p a r is o n o f P u r e M o d e l C h e c k in g a n d O u r A p p r o a c h S p e c ifi c a tio n s

N u m b S C B T E x a m p le |S| |C| | ∪ Mi | | ∪ Ei | S P R PM C SM C V O D (F ig . 1 ) 2 2 8 9 1 3 9 9 0 V O D 1 2 3 6 7 3 4 4 2 3 1 V O D 2 2 3 9 1 1 1 1 4 4 6 R T O S 1 4 3 1 1 1 4 2 9 6 2 2 2 4 7 R T O S 2 4 3 1 2 1 6 8 3 0 3 0 6 P D S 1 3 4 6 6 4 7 1 7 3 7 0 8 P D S 2 3 4 6 6 3 3 0 6 1 5 5 4

e r o f r e g io n s (c o n v e S S S S % PM C SM C % 6 4 .7 1 1 0 6 8 6 1 6 7 .2 1 4 1 9 2 6 5 4 0 .3 8 0 3 4 4 2 7 5 .9 1 9 8 0 1 4 8 6 7 5 3 6 .9 6 8 4 2 5 6 3 7 7 8 .6 2 1 1 4 1 6 1 0 7 6 4 7 .0 1 1 9 3 5 3 6 4 4

x p r e d ic a te s ) C A T L S S PM C SM C .8 1 2 0 7 8 .2 1 4 7 9 8 .5 1 0 7 6 1 .0 2 0 5 4 1 5 6 0 .4 7 2 8 3 0 0 .1 2 1 4 0 1 6 3 6 .9 1 2 0 4 5 4 7

% 6 5 .0 6 6 .7 5 7 .0 7 5 .9 4 1 .2 7 6 .5 4 5 .4

S: s e t o f s e r v e r s , C: s e t o f c l i e n t s , | ∪ Mi |: t o t a l # m o d e s , | ∪ Ei |: t o t a l # t r a n s i t i o n s PM C : P u r e M o d e l C h e c k i n g , SM C : S c h e d u l i n g S y s t e m M o d e l C h e c k i n g , % : SM C / PM C

e a rlie s t-d e a d lin e fi rs t, ra te -m o n o to n ic (a rb ), ra te -m o n o to n ic (e x a c t) p o lic ie s , re s p e c tiv e ly , f o r s c h e d u lin g th e ta s k s . F o r th e d e liv e r y s y s te m e x a m p le , it is a s s u m e d th a t th e r e a r e th r e e d e liv e r y a g e n ts a n d f o u r c lie n ts . T h e d e liv e r y a g e n ts m u s t d e liv e r p a c k a g e s to th e c lie n ts a c c o rd in g to s c h e d u lin g p o lic ie s : ra te -m o n o to n ic (e x a c t), e a rlie s t-d e a d lin e fi rs t, a n d m ix e d s c h e d u lin g . T w o v e r s io n s a r e g iv e n f o r e a c h o f th e th r e e k in d s o f s y s te m s . A ll th e s ix e x a m p le s w e re s p e c ifi e d in o u r in p u t la n g u a g e w h ic h w a s th e n a u to m a tic a lly tra n s la te d b y o u r tra n s la to r in to th e H y T e c h in p u t la n g u a g e . T h e re s u lts , a s ta b u la te d in T a b le 1 , s h o w th a t o u r a p p ro a c h in d e e d re d u c e s th e to ta l s iz e o f th e s y s te m s ta te s p a c e fo r v e rifi c a tio n a s c o m p a re d to th e p u re m o d e l c h e c k in g a p p ro a c h . H e re , p u re m o d e l c h e c k in g m e a n s th a t w e d o n o t ta k e a d v a n ta g e o f th e s c h e d u lin g a lg o rith m s a n d d ire c tly v e rify th e s y s te m s w h ic h m ig h t c o n ta in a lo t o f u n s c h e d u la b le s ta te s . D ra s tic re d u c tio n s c a n b e a c h ie v e d in s y s te m s th a t h a v e a h e a v y w o rk lo a d . W ith e a c h ty p e o f e x a m p le , e ith e r V O D o r R T O S , it is o b s e r v e d th a t w ith a h ig h c o m p le x ity in th e c lie n t a u to m a ta ( i.e ., th e n u m b e r o f m o d e s a n d tr a n s itio n s ) th e S C B T im p le m e n ta tio n s h o w s a la r g e r b e n e fi t ( i.e ., a s m a lle r s ta te s p a c e s iz e ) c o m p a re d to a ll th e s e m a n tic s o f th e S C A T im p le m e n ta tio n . T h is is d u e to th e s tro n g e r s e m a n tic s o f a tra n s itio n n o t o c c u rin g b e fo re th e ta s k s s c h e d u la b ility o f its d e s tin a tio n m o d e is c h e c k e d . C o m p a rin g th e tw o s e m a n tic s o f S C A T : S S S a n d L S S , in a ll th e e x a m p le s it is o b s e rv e d th a t s tric t s e m a n tic s s h o w s a la rg e r b e n e fi t w ith o u r a p p ro a c h . T h is is d u e to th e s tro n g e r re s tric tio n in S S S o f ta s k s re q u ire d to b e s c h e d u le d b e fo re th e c lie n t c a n p ro g re s s o n . T h u s , w e c a n c o n c lu d e th a t b o th th e o re tic a lly a n d e x p e rim e n ta lly w e h a v e s h o w n th a t S C B T h a s th e s tro n g e s t n o tio n o f s c h e d u la b ility a n d L S S o f S C A T h a s th e w e a k e s t n o tio n w ith S S S o f S C A T in -b e tw e e n S C B T a n d L S S .

5

C o n c lu s io n M o d e l-c h e c k in g , th o u g h a p o p u la r v e rifi c a tio n m e th o d , h a s y e t to b e m a d e m o re e ffi c ie n t fo r v e rify in g th e c u rre n t h ig h ly c o m p le x s y s te m s . W e h a v e s h o w n h o w c o m p le x

S c h e d u lin g S y s te m

V e rifi c a tio n

3 3

re a l-tim e s y s te m s c a n b e e a s ily v e rifi e d u s in g th e p o p u la r m o d e l-c h e c k in g a p p ro a c h if w e m o d e l th e c o m p le x s y s te m a s a c lie n t-s e rv e r s c h e d u lin g s y s te m a n d th e n v e rify it. T h is a p p ro a c h is m e a n in g fu l w h e n w e o b s e rv e th a t a lm o s t a ll c o m p le x s y s te m s n e e d s o m e s o rt o f s c h e d u lin g s o th a t th e ta s k s c a n b e e x e c u te d c o n s is te n tly a n d e ffi c ie n tly . O u r p re lim in a ry e ffo rt h a s b e e n s h o w n fe a s ib le th ro u g h th e im p le m e n ta tio n u s in g o u r tra n s la to r a n d th e H y T e c h v e rifi c a tio n to o l. D iffe re n t s e m a n tic s h a v e b e e n im p le m e n te d a n d c o m p a re d u s in g s e v e ra l e x a m p le s . O u r fu tu re w o rk w ill in c lu d e th e d e v e lo p m e n t o f a to o l d e v o te d to th e v e rifi c a tio n o f s u c h s y s te m s u s in g s y m b o lic m o d e l c h e c k in g .

R e fe r e n c e s [A C D 9 0 ]

R . A l u r , C . C o u r c o u b e t i s , a n d D . L . D i l l , “ M o d e l c h e c k i n g f o r r e a l - t i m e s y s t e m s ,” 5 th IE E E L IC S , 1 9 9 0 . [C E S 8 1 ] E .M . C la r k e , E .A . E m e r s o n , a n d A .P . S is tla , “ A u to m a tic v e r ifi c a tio n o f fi n ite s ta te c o n c u r r e n t s y s t e m u s i n g t e m p o r a l l o g i c ,” P r o c s . W o r k s h o p o n L o g i c s o f P r o g r a m s , L e c tu re N o te s in C o m p u te r S c ie n c e , v o l. 1 3 1 , p p . 5 2 – 7 1 , 1 9 8 1 . [E 9 0 ] E . A . E m e r s o n , “ T e m p o r a l a n d M o d a l L o g i c ,” i n H a n d b o o k o f T h e o r e t i c a l C o m p u t e r S c ie n c e , E d . J . v a n L e e u w e n , E ls e v ie r S c ie n c e P u b lis h e r s B .V ., 1 9 9 0 . [ H H W T 9 5 ] T . A . H e n z i n g e r , P . - H . H o , a n d H . W o n g - T o i , “ H y T e c h : t h e n e x t g e n e r a t i o n ,” P r o c s . IE E E R e a l-T im e S y s te m s S y m p o s iu m , p p . 5 6 – 6 5 , 1 9 9 5 . [H K L 9 1 ] M .G . H a r b o u r, M .H . K le in , J .P . L e h o c z k y , “ F ix e d p r io r ity s c h e d u lin g o f p e r io d ic t a s k s w i t h v a r y i n g e x e c u t i o n p r i o r i t y ,” P r o c s . I E E E R e a l - T i m e S y s t e m S y m p o s i u m , p p . 1 1 6 – 1 2 8 , 1 9 9 1 . [H K L 9 4 ] M .G . H a r b o u r, M .H . K le in , J .P . L e h o c z k y , “ T im in g a n a ly s is f o r fi x e d - p r io r ity s c h e d u l i n g o f h a r d r e a l - t i m e s y s t e m s ,” I E E E T r a n s . S o f t w a r e E n g i n e e r i n g , v o l . 2 0 , n o . 1 , Ja n . 1 9 9 4 . [K A S 9 3 ] D .I . K a tc h e r, H . A r a k a w a , a n d J .K . S tr o s n id e r, “ E n g in e e r in g a n d a n a ly s is o f fi x e d p r i o r i t y s c h e d u l e r s ,” I E E E T r a n s . S o f t w a r e E n g i n e e r i n g , v o l . 1 9 , p p . 9 2 0 – 9 3 4 , S e p t. 1 9 9 3 . [L 8 7 ] L . L a m p o r t , “ A F a s t M u t u a l E x c l u s i o n A l g o r i t h m ,” A C M T r a n s . o n C o m p u t e r S y s te m s , v o l. 5 , n o . 1 , p p . 1 – 1 1 , F e b . 1 9 8 7 . [L 9 0 ] J .P . L e h o c z k y , “ F ix e d p r io r ity s c h e d u lin g o f p e r io d ic ta s k s e ts w ith a r b itr a r y d e a d l i n e s ,” P r o c s . I E E E R e a l - T i m e S y s t e m s S y m p o s i u m , p p . 2 0 1 – 2 0 9 , 1 9 9 0 . [L L 7 3 ] C .L . L iu a n d J .W . L a y la n d , “ S c h e d u lin g a lg o r ith m s f o r m u ltip r o g r a m m in g in a h a r d - r e a l - t i m e e n v i r o n m e n t ,” J o u r n a l o f t h e A s s o c i a t i o n f o r C o m p u t i n g M a c h i n e r y , v o l. 2 0 , n o . 1 , p p . 4 6 – 6 1 , J a n . 1 9 7 3 . [L S D 8 9 ] J .P . L e h o c z k y , L . S h a , a n d Y . D in g , “ T h e r a te m o n o to n ic s c h e d u lin g a lg o r ith m : e x a c t c h a r a c t e r i z a t i o n a n d a v e r a g e c a s e b e h a v i o r ,” P r o c s . I E E E R e a l - T i m e S y s t e m s S y m p o s iu m , p p . 1 6 6 -1 7 1 , 1 9 8 9 . [S G 9 0 ] L . S h a a n d J . B . G o o d e n o u g h , “ R e a l - t i m e s c h e d u l i n g t h e o r y a n d A d a ,” I E E E C o m p u te r , v o l. 2 3 , p p . 5 3 – 6 2 , A p r. 1 9 9 0 . [S K G 9 1 ] L . S h a , M .H . K le in , a n d J .B . G o o d e n o u g h , “ R a te m o n o to n ic a n a ly s is f o r r e a l- tim e s y s t e m s ,” F o u n d a t i o n s o f R e a l - T i m e C o m p u t i n g : S c h e d u l i n g a n d R e s o u r c e M a n a g e m e n t, A . v a n T ilb o rg a n d G .M . K o o b , E d s . N e w Y o r k : K lu w e r, p p . 1 2 9 – 1 5 5 , 1 9 9 1 . [T B W 9 2 ] K .W . T in d e ll, A . B u r n s , a n d A .J . W e llin g s , “ M o d e c h a n g e s in p r io r ity p r e - e m p tiv e ly s c h e d u l e d s y s t e m s ,” P r o c s . I E E E R e a l - T i m e S y s t e m s S y m p o s i u m , p p . 1 0 0 – 1 0 9 , 1 9 9 2 .

1 0 .1 0 0 7 /b 1 0 7 0 3 1 1 3 0 0 0 2

A Period Assignment Algorithm for Real-Time System Design Minsoo Ryu and Seongsoo Hong School of Electrical Engineering and ERC-ACI, Seoul National University, Seoul 151-742, Korea. {msryu,sshong}@redwood.snu.ac.kr http://redwood.snu.ac.kr

Abstract. Digital controllers found in many industrial real-time systems consist of a number of interacting periodic tasks. To sustain the required control quality, these tasks possess the maximum activation periods as performance constraints. An essential step in developing a realtime system is thus to assign each of these tasks a constant period such that the maximum activation requirements are met while the system utilization is minimized [3]. Given a task graph design allowing producer/consumer relationships among tasks [4], resource demands of tasks, and range constraints on periods, the period assignment problem falls into a class of nonlinear optimization problems. This paper proposes a polynomial time approximation algorithm which produces a solution whose utilization does not exceed twice the optimal utilization. Our experimental analysis shows that the proposed algorithm finds solutions which are very close to the optimal ones in most cases of practical interest.

1

Introduction

Real-time systems often consist of a number of interacting tasks. Most of these tasks execute periodically at fixed rates reading data from producer tasks and writing data to consumer tasks. A typical example is a feedback control system. A control task periodically samples input data, computes control laws, and generates output for actuators, and all these activities should be done periodically. In order to sustain the required quality of control, each real-time task possesses as its timing constraint the maximum activation period that is derived from a given performance specification. An essential step in developing a realtime system is thus to assign each task a constant period such that the maximum activation requirements are met while the system utilization is minimized. Where intermediate tasks are shared by several others that run with different rate constraints, the problem falls into a class of nonlinear optimization problems. 

The work reported in this paper was supported in part by Engineering Research Center for Advanced Control and Instrumentation (ERC-ACI) under Grant 96K30707-02-06-3 and by KOSEF under Grants 97-0102-05-01-3 and 981-0924-127-2.

W.R. Cleaveland (Ed.): TACAS/ETAPS’99, LNCS 1579, pp. 34–43, 1999. c Springer-Verlag Berlin Heidelberg 1999 

A Period Assignment Algorithm for Real-Time System Design

35

In [3] Gerber et al. addressed this problem as part of the real-time system design problem and formulated it into a nonlinear optimization problem in their design methodology. They proposed a set of heuristics which can be used to reduce the search space of the problem. Unfortunately, these heuristics possess only limited utility, since they may still leave a inhibitively large search space even for a problem with a modest size. To the best of our knowledge, no polynomial time approximation algorithm with a known performance bound has been proposed to address this period assignment problem. A similar problem was addressed by Seto et al. [9] for the design of real-time control systems. Given that the control performance requirement and the schedulability constraint determine the ranges of sampling periods, their proposed algorithm derives schedulable sampling periods that optimize the performance index of the control system. However, the application model in [9] is rather simple: in [9], all tasks in a system run independently, while the task graph in [3] allows producer/consumer relationships and data sharing between tasks. In this paper, we propose a polynomial time period assignment algorithm for the real-time design problem formulated in [3]. Our algorithm makes use of two effective heuristics, namely (1) optimal GCD assignment; and (2) harmonic period assignment among tail tasks. In the first heuristic, a producer task is assigned as its period the greatest common divisor of the periods of its consumers. In the second, tasks with no consumers (tail tasks) are assigned harmonic periods. We formally prove via the worst case analysis that the proposed algorithm with these heuristics yields a solution whose utilization does not exceed twice the optimal utilization. In reality, our experimental analysis shows that the algorithm produces solutions which are very close to the optimal ones in most cases of practical interest. This paper is organized as follows. In section 2, we give a formal specification of the period assignment problem by defining a task graph design of a real-time system, along with the constraints and the objective function of the problem. In section 3, we propose two heuristics and present the approximation algorithm. In section 4, we make a formal analysis of the proposed algorithm and prove its worst case performance bound. In section 5, we experimentally evaluate the algorithm by comparing it with an optimal algorithm using exhaustive search. Section 6 concludes the paper.

2

Problem Formulation

A real-time system in our problem is represented by a directed acyclic graph G(V, E) where V is a set of tasks {p1 , p2 , . . . pn } and E is a set of directed edges between two tasks. Each task has a bounded execution time ei which can be estimated in various ways [7]. An edge pi → pj denotes a producer/consumer relationship in that pi produces data that pj consumes [4]. Let Ti be the period of pi . Each producer/consumer pair pi , pj  is constrained to have harmonic periods such that Tj is an integer multiple of Ti , which is denoted “Ti |Tj ”. Figure 1 shows an example task graph with their

36

Minsoo Ryu and Seongsoo Hong

assigned harmonic periods. If these tasks ran with arbitrary periods, task executions would get out of phase resulting in large latencies in communication. The harmonicity constraint ensures that the two tasks stay “in-phase,” thus reducing communication latencies [3]. It also guarantees predictable data flow from a common producer to multiple consumers. For example, in Figure 1, it is guaranteed that p4 receives every data item p3 generates while p5 gets every third item of what p3 produces. In the remainder of the paper, we use the following additional notations. notation Ptail i Ptail i Psucc

description A set of tasks having no outgoing edges. A set of tail tasks pj which are reachable from pi . A set of tasks having an incoming edge from pi .

Every output task pi ∈ Ptail possesses a range constraint on Ti such that 1 ≤ Ti ≤ Tiu where Tiu is the maximum period constraint which is derived from the performance requirement. Due to harmonicity constraints, each non-tail task pj is also subject to a period constraint such that 1 ≤ Ti ≤ Tiu where Tiu is the smallest maximum period of all consumer tasks. Therefore, Tiu of non-tail task i i pi is determined such that Tiu = min{Tju | pj ∈ Psucc } = min{Tju | pj ∈ Ptail }. The objective function of this period assignment problem is to maximize the chance of the system being schedulable. Asin [3], we adopt, as the objective n ei function, minimization of utilization U = i=1 Ti . There have been a number of vastly different measures of schedulability depending on real-time scheduling algorithms such as nonpreemptive, calendar-based scheduling [11], and preemptive, static and dynamic priority scheduling [6]. In this paper, we assume a preemptive priority scheduling strategy. Note that in preemptive priority scheduling such as RMS and EDF, utilization is proven to be a sufficient measure of the schedulability of real-time systems [6,5]. Finally, the problem at hand is stated as follows. “Given a task graph and the range constraints on task periods, assign each task a harmonic period such that the range constraints n ei are met and the system utilization U is minimized where U = i=1 Ti .”

3

Period Assignment Algorithm

Due to the harmonicity constraints and the objective function, the problem is nonlinear optimization problem. To find solutions in a reasonable amount of time, we propose an approximation algorithm which consists of two heuristic steps to minimize the utilization.

A Period Assignment Algorithm for Real-Time System Design

g a g

h

37

b

c d

e g h

f i

Fig. 1. Task graph. 3.1

Optimal GCD assignment

Our first heuristic is the optimal GCD (greatest common divisor) assignment. It is a backward period assignment method in that a non-tail task pi gets period Ti i such that Ti = GCD{Tj | pj ∈ Psucc }. Such period assignment starts from those non-tail tasks that are the immediate predecessors of tail tasks, and is iteratively applied to their predecessors until all non-tail tasks are assigned their periods. As a result of the optimal GCD assignment, a producer task always gets the largest possible period which is harmonic to the periods of its consumer tasks. Theorem 1 proves that the optimal GCD assignment is a necessary step to obtain the optimal period assignment of a whole system. Theorem 1. If all tail tasks are given the optimal periods, the GCD assignment always finds the optimal period assignment for the whole tasks. Proof. We prove the theorem by contradiction. Suppose that the optimal solution has an intermediate task pi which has a non-GCD period Ti . Let TiGCD = i GCD{Tj | pj ∈ Psucc }. Due to the harmonicity constraint, Ti is a common divii sor of the periods of tasks in Psucc , and thus Ti |TiGCD . Hence, Ti can be replaced GCD by Ti without affecting the periods of other tasks, and this yields a lower utilization. This contradicts the assumption. Therefore, the optimal solution is obtained by the GCD assignment method.   Theorem 1 helps significantly reduce the problem size, since it allows us to focus only on tail tasks for the optimal period assignment. 3.2

Harmonic Period Assignment for Tail Tasks

Our second heuristic is the harmonic period assignment for tail tasks. In order to minimize the utilization, it is desirable to assign tail tasks the largest possible harmonic periods so that large GCD values are assigned to non-tail tasks. To do so, the algorithm introduces additional harmonicity constraints among the tail tasks. It then assigns tail tasks harmonic periods to satisfy this extra constraints.

38

Minsoo Ryu and Seongsoo Hong

This heuristic step works as follows. First, tail tasks are sorted in nondecreasing order of Tiu . Second, a harmonicity constraint is established on each of the two adjacent tasks in the list. We can represent this additional harmonicity constraint by slightly modifying a given task graph. Figure 2 shows a modified task graph of Figure 1 after it is extended with extra harmonicity constraints.

g a g

h

b

c d

e g h

f i

Fig. 2. Modified task graph with harmonicity constraints between tail tasks.

Due to the harmonicity constraints between tail tasks, the original problem is reduced into the problem of assigning a period to only the tail task with the smallest T u . The entire algorithm is presented below. In Step (1), it sorts tail tasks in the nondecreasing order of their maximum period constraints. In Step (2), the algorithm chooses a period value for the tail task with the smallest maximum period constraint. In order to bound the worst case performance of the algorithm, it is required to choose T1 between T1u /2 and T1u . This requirement will be proved shortly in the subsequent section. In Step (3), the algorithm assigns the largest harmonic periods to other tail tasks according to the extra harmonic constraints imposed on them. Finally, in Step (4), it performs GCD period assignment for non-tail tasks. Period Assignment Algorithm { (1) Let p1 , p2 , . . . , pm  be a sorted list of Ptail u such that T1u ≤ T2u ≤ . . . ≤ Tm . u (2) Choose any T1 such that T1 /2 ≤ T1 ≤ T1u . Tiu (3) Ti =  Ti−1 · Ti−1 for 2 ≤ i ≤ m. (4) Perform GCD assignment for non-tail tasks. }

A Period Assignment Algorithm for Real-Time System Design

4

39

Algorithm Analysis

In this section we make the worst case analysis of the proposed algorithm and summarize it in Theorem 2. It states that the algorithm, even in the worst case, yields a solution whose utilization does not exceed twice the optimal utilization. Theorem 2. Let Ualg be utilization computed by the algorithm, and Uopt the optimal utilization. Ualg is always less than 2Uopt . Proof. Let p1 , p2 , . . . , pm  be a sorted list of Ptail . Suppose that (T1 , . . . , Tm ) is a period assignment for tail tasks. Due to Theorem 1, the period of non-tail task in V can be represented with some combination of {T1 , . . . , Tm }. Thus, utilization U can be generally written as follows. U=

eˆ2 eˆm eˆm+1 eˆ1 + + + ...+ + T1 T2 Tm GCD(T1 , T2 ) eˆm+2 + ...+ GCD(T2 , T3 ) eˆ2m −1 GCD(T1 , T2 , . . . , Tm )

(1)

 where eˆi = pj ∈Qi ej and Qi is the set of tasks pj which has a path to every tail task appearing in the ith denominator, but to no other. Clearly, if Qi is empty, eˆi is zero. For the analysis of the algorithm, the lower bound Ulow of U is derived from Eq.( 1) by replacing its denominators with maximum possible periods, as follows. Ulow =

eˆ1 eˆ2 eˆm + u + ...+ u + u T1 T2 Tm eˆm+2 eˆ2m −1 eˆm+1 + + ...+ u u T1 T2 T1u

(2)

Since the proposed algorithm imposes the harmonicity constraints on Ptail , GCD(Ti , . . . , Tj ) = Ti for 1 ≤ i < j ≤ m. Thus, utilization Ualg computed by the algorithm can be derived from Eq.(1), as follows. Ualg =

i

th

eˆ1 eˆ2 eˆm eˆm+1 + + ...+ + + T1 T2 Tm T1 eˆ2m −1 eˆm+2 + ...+ T2 T1

(3)

Now Eq.(2) and Eq.(3) are compared term by term. Let ualg and ulow be the i i terms in Ualg and Ulow , respectively.

u ≤ 2ulow (a) For i = 1: ualg i , since T1 is assigned a period no less than T1 /2 in i the proposed algorithm.

40

Minsoo Ryu and Seongsoo Hong

(b) For 2 ≤ i ≤ 2m − 1 and ulow = 0: i Tju ualg i = Tju /Tj−1 · Tj−1 ulow i for some 1 < j ≤ m. Since

x x

< 2 for x ≥ 1, ualg < 2ulow i . i

The above comparison leads to Ualg < 2Ulow . Let Uopt be the optimal utilization, then it is obvious that Ulow ≤ Uopt . Combining these, we have Ualg < 2Uopt . This proves the theorem.

 

For a task graph with n sorted tasks (tail tasks are sorted in nondecreasing order of Tju and non-tail tasks are topologically sorted), O(n) period assignment steps are required for the proposed algorithm. Note that the GCD assignment step in the algorithm is simplified through mathematical manipulation shown in Eq.( 3). For a GCD assignment, GCD(Ti , . . . , Tj ) = Ti can be used.

5

Empirical Performance

From the previous discussion, we know that the performance ratio of the proposed algorithm to the optimal one is less than 2.0. However, this result is derived via an analysis made for the worst case. In this section, we perform an empirical study to show that the performance of the algorithm is very close to the optimal one in most cases of practical interest. To do so, we have implemented both the proposed algorithm and an optimal, exhaustive search algorithm. Then, we have generated artificial workloads using five types of representative task graphs that are commonly encountered in algorithmic structures of control applications. The task graph structures considered here are in-tree, out-tree, fork-join, Laplace equation solver [10], and FFT (fast Fourier transform) [2] types. Figure 5 pictorially shows these task graph types. For each of them, we generated three distinct task graphs by varying the number of tasks and their maximum period constraints. For the in-tree, fork-join, and Laplace equation solver task graphs that possess only one tail task, we have added two or more tail tasks to the task graphs to prevent the algorithms from generating trivial period assignments. Due to the inherent time complexity of the exhaustive search algorithm, the experiments were carried out with small-sized problems possessing 10 to 20 tasks. To generate the workloads, we varied task execution times and maximum period constraints for each task graph type. For the maximum period constraints Tju for tail tasks, we used the normal probability distributions N (μ, σ2 ) with mean μ and standard deviation σ. For each task graph type, three distinct test cases were generated using N (600, 3002), N (500, 2502) and N (400, 2002). Task execution times ei were generated using N (10, 52 ) in all test cases.

A Period Assignment Algorithm for Real-Time System Design

(A)

(B)

(D)

41

(C)

(E)

Fig. 3. Task graph types: (A) in-tree, (B) out-tree, (C) fork-join, (D) Laplace equation solver, and (E) FFT.

Figure 4 summarizes the results of our experiments. As is clear from Figure 4, the proposed algorithm yields solutions which are very close to the optimal U ones in all cases. On the average, the performance ratio Ualg is 1.0330 in our opt experiments.

6

Conclusion

We have presented a period assignment algorithm which requires O(n) period assignment steps and is capable of finding solutions close to the optimal ones. We have formally proved that the proposed algorithm has a performance ratio Ualg Uopt ≤ 2 and experimentally showed that it yields almost optimal solutions in U

practice. During the experiments, the performance ratio was Ualg = 1.0330 on opt the average. The proposed algorithm can be used as an essential component of the realtime system design methodology formulated in [3]. Since the methodology is currently applicable to a real-time system design built on top of a distributed platform, we are currently extending our algorithm for this purpose.

42

Minsoo Ryu and Seongsoo Hong











 









 
 



















































      


      

(A)


(B)









 
 













 


 













































 


 






      















      

(C)

(D)




 
 
































      

(E)

Fig. 4. Performance comparisons: (A) in-tree, (B) out-tree, (C) fork-join, (D) Laplace equation solver, and (E) FFT.

A Period Assignment Algorithm for Real-Time System Design

43

References 1. T. F. Abdelzaher, E. M. Atkins, and K. G. Shin. QoS negotiation in real-time systems and its application to automated flight control. In Proceedings of IEEE Real-Time Technology and Applications, pages 228–238, December 1997. 2. V. A. F. Almeida, I. M. Vasconcelos, J. N. C. Arabe, and D. A. Menasce. Using random task graphs to investigate the potential benefits of heterogeneity in parallel systems. In Proceedings of Supercomputing, pages 683–691, 1992. 3. R. Gerber, S. Hong, and M. Saksena. Guaranteeing real-time requirements with resource-based calibration of periodic processes. IEEE Transactions on Software Engineering, 21(7):579–592, July 1995. 4. K. Jeffay. The real-time producer/consumer paradigm: A paradigm for the construction of efficient, predictable real-time systems. In ACM/SIGAPP Symposium on Applied Computing, pages 796–804. ACM Press, February 1993. 5. J. Lehoczky, L. Sha and Y. Ding. The rate monotonic scheduling algorithm: Exact characterization and average case behavior. In Proceedings of IEEE Real-Time Systems Symposium, pages 166–171, December 1989. 6. C. Liu and J. Layland. Scheduling algorithms for multiprogramming in a hard real-time environment. Journal of the ACM, 20(1):46–61, January 1973. 7. C. Park and A. Shaw. Experimenting with a program timing tool based on sourcelevel timing schema. In Proceedings of IEEE Real-Time Systems Symposium, pages 72–81, December 1990. 8. R. Rajkumar, C. Lee, J. Lehoczky, and D. Siewiorek. A resource allocation model for QoS management. In Proceedings of IEEE Real-Time Systems Symposium, pages 298–307, December 1997. 9. D. Seto, J. P. Lehoczky, L. Sha, and K. G. Shin. On task schedulability in realtime control systems. In Proceedings of IEEE Real-Time Systems Symposium, pages 13–21, December 1996. 10. M. Y. Wu and D. D. Gajski. Hypertool: A programming aid for message-passing systems. IEEE Transactions on Parallel and Distributed Systems, 1(3):330–343, July 1990. 11. J. Xu and D. Parnas. Scheduling processes with release times, deadlines, precedence and exclusion relations. IEEE Transactions on Software Engineering, 16(3):360–369, March 1990.

10.1007/b107031130003

Analyzing Stochastic Fixed-Priority Real-Time Systems Mark K. Gardner and Jane W.S. Liu Department of Computer Science University of Illinois at Urbana-Champaign Urbana, IL 61801, USA {mkgardne,janeliu}@cs.uiuc.edu

Abstract. Traditionally, real-time systems require that the deadlines of all jobs be met. For many applications, however, this is an overly stringent requirement. An occasional missed deadline may cause decreased performance but is nevertheless acceptable. We present an analysis technique by which a lower bound on the percentage of deadlines that a periodic task meets is determined and compare the lower bound with simulation results for an example system. We have implemented the technique in the PERTS real-time system prototyping environment [6, 7].

1

Introduction

A distinguishing characteristic of real-time computer systems is the requirement that the system meet its temporal constraints. While there are many different types of constraints, the most common form is expressed in terms of deadlines: a job completes its execution by its deadline. In a hard real-time system, all jobs must meet their deadlines and a missed deadline is treated as a fatal fault. Hence hard real-time systems are designed to ensure that there are no missed deadlines, often at the expense of resource utilization and average performance. Hard realtime systems are most often found in safety or mission critical applications. The last few years have seen the proliferation of applications known as soft real-time systems. Examples include telecommunications and signal processing systems. For these systems, missed deadlines result in performance degradation. However, provided that the frequency of missed deadlines is below some threshold, the real-time performance of such a system is nevertheless acceptable. While many techniques for designing and validating hard real-time systems exist, there are few such techniques for soft real-time systems. In this paper, we present a schedulability analysis technique for fixed-priority systems to determine lower bounds on the frequency of missed deadlines and compare the lower bound with simulation results for an example system. We begin, in the next section, with a brief review of schedulability analysis techniques for validating hard real-time systems, motivate the need for better techniques to analyze soft-real time systems and describe closely related work. In Section 3, we present the Stochastic Time Demand Analysis technique and W.R. Cleaveland (Ed.): TACAS/ETAPS’99, LNCS 1579, pp. 44–58, 1999. c Springer-Verlag Berlin Heidelberg 1999 

Analyzing Stochastic Fixed-Priority Real-Time Systems

45

show how it allows a designer greater freedom in trading the certainty with which deadlines are met for other design goals. We compute a lower bound on the probability that deadlines are met by jobs in a simple system and compare the bounds with the percentage of deadlines met obtained by simulation. Section 4 briefly discusses issues which we discovered while implementing STDA in the PERTS real-time system prototyping environment and Section 5 discusses possible directions of future research.

2

Background and Related Work

The periodic task model [5] has proven useful in describing the characteristics of real-time systems. It is the foundation of state-of-the-art techniques for analyzing the behavior of hard real-time systems. According to this model, a real-time system consists of a set of tasks, each of which consists of a (possibly) infinite stream of computations or communications, called jobs. We denote the ith task of the system by Ti and the jth job of the task (or the jth job since some time instant) by Ji,j . The execution time of a job is the amount of time the job takes to complete if it executes alone. All the jobs in a task have a common minimum (maximum) execution time denoted Ei− (Ei+ ). Moreover, the jobs are released for execution, (i.e., arrive), with a common minimum inter-release time. The minimum inter-release time (or inter-arrival time) is called the period of the task. The period of each task Ti is larger than zero and is denoted by Pi . A job Ji,j becomes ready for execution at its release time, ri,j . It must complete execution by its absolute deadline, di,j , or it is said to have missed its deadline. Figure 1 shows these quantities in the context of a time-line. The length of time between the release time and absolute deadline of every job in each task Ti is constant. This length is called the relative deadline of the task and is denoted Di = di,j − ri,j . The completion time of Ji,j is denoted ci,j and the response time is ρi,j = ci,j − ri,j . In this paper, we will have occasion to refer to the actual execution time of Ji,j which we denote ei,j . The maximum utilization of the task is the ratio of the maximum execution time to the minimum inter-arrival time (period) and is denoted by Ui = Ei+ /Pi . Finally, the release time of the first job in a task is called the phase of the task. We say that tasks are in-phase when they have identical phases.

T

J i

r

i,j

i,j

111 00 000 11 c i,j

d

i,j

Fig. 1. Time-line for Task Ti

r

i,j+ 1

46

Mark K. Gardner and Jane W.S. Liu

In modern real-time systems, tasks are scheduled in a priority driven manner. At any point in time, the ready job with the highest priority executes. If at time t, a job of a higher priority becomes ready, the executing job is preempted and the higher priority job executes. Most priority assignments are fixed priority. According to a fixed-priority scheduling policy, all jobs in a task have the same priority. We denote the priority of task Ti and hence the priority of jobs Ji,1 , Ji,2 , . . . by φi . For convenience and without loss of generality, we assume that priorities are distinct and arrange the tasks in order of decreasing priority Ti  Ti+1 such that T1 has a higher priority than T2 , etc. 2.1

Deterministic Schedulability Analysis Methods

A task in a system is said to be schedulable if all jobs in the task meet their deadlines. A system of real-time tasks is schedulable if all tasks in the system are schedulable. One of the most commonly used fixed-priority assignments is Rate Monotonic (RM). According to this policy, the shorter the period Pi of a task, the higher its priority. It is shown in [5] that a system of n tasks scheduled on a RM basis is schedulable if the sum of the maximum utilizations of the 1 tasks, denoted U , satisfies the inequality U ≤ n(2 n − 1). The expression on the right hand side of the inequality is often called the Liu and Layland bound. The Liu and Layland bound gives a sufficient and hence conservative condition. A system may be schedulable rate monotonically even though its maximum utilization exceeds the Liu and Layland bound. The Time Demand Analysis (TDA) method [4] provides a more accurate and general characterization of the ability of arbitrary fixed-priority systems to meet all deadlines. It is based upon the observation that the worst-case response time of a job occurs when it is released at a critical instant. For a system of independent preemptive periodic tasks scheduled on a fixed-priority basis, a critical instant of a task occurs when a job in each task is released along with a job from all tasks of equal or higher priority [5]. Therefore, to bound the worst case response time of all the jobs in a task Ti , it suffices for us to look at a job that is released at a critical instant. We call this job Ji,1 . The time demand function of Ti , denoted wi (t), is the total maximum time demanded by Ji,1 , as well as all the jobs that complete before Ji,1 , as a function of time t since the release of Ji,1 . It is a function which increases by the maximum execution time Ek+ every time a higher priority job Jk,l is released. If there is a t ≤ Di such that wi (t) ≤ t is satisfied, then no job in Ti will miss its deadline. Figure 2 shows the time demand function for each of the tasks in Example #1. The parameters of the tasks are listed in Table 1.1 There is sufficient time for tasks T1 , T2 and T3 by 100, 200 and 600 respectively. A schedule of the system with the initial job in each task released at a critical instant is shown in Fig. 3. Even though the processor is idle from 1100–1200, it is clear that increasing the maximum execution time of any task will result in J3,1 missing its deadline at 600. 1

We note that the maximum total utilization of the tasks is 0.92, greater than the Liu and Layland bound, which is 0.78. However, the system is schedulable.

Analyzing Stochastic Fixed-Priority Real-Time Systems

Table 1. Parameters of the Tasks in Example #1. Ti T1 T2 T3 Total

φi 1 2 3

Pi 300 400 600

Ei+ 100 100 200

T im e D e m a n d

T

Di 300 400 600

Ui 0.333 0.250 0.333 0.917

3

T 2

T 1

5 0 0

0 0

5 0 0

T im e S u p p ly Fig. 2. Time Demand Analysis of the Example System

T

00 00 11 11 00 11 00 11 11 00 00 11 00 11 11 00 00 11 00 11 00 11 1

T 2

T 3

0

5 0 0

1 0 0 0

Fig. 3. Schedule of the Example System

47

48

Mark K. Gardner and Jane W.S. Liu

The version of TDA given above works only when all jobs will complete by the release of the next job in the task, which is the case for the example. To determine whether all jobs in Ti meet their deadlines when some job Jk,l+1 may be released before the previous job Jk,l in a higher priority task Tk completes, we must compute the worst case bound on response times of all jobs in Ti executed in a level-i busy interval that begins at an instant when a job Ji,1 in Ti is released at the same time with a job in every higher priority task.2 (A level-i busy interval is an interval of time which begins when a job in Ti or a higher priority task is released and immediately prior to the instant no job in those tasks is ready for execution. It ends at the first time instant t at which all jobs in Ti and higher priority tasks released before t have completed.) We call such a busy interval an in-phase level-φi busy interval. Analogous to the critical instant analysis in [5], it has been shown in [3] that it suffices for us to consider only an in-phase level-φi busy interval. The reasons are 1. if a job in Ti is ever released at the same time as a job in every higher priority task, that instant is the beginning of an in-phase busy interval (i.e., the system has no backlog at that instant), 2. the length of an in-phase level-φi busy interval is longer than a level-φi busy interval that is not in-phase (and hence more jobs in Ti are released in the in-phase busy interval), and 3. the response time of every job in a level-φi busy interval that is not in phase is no greater than the response time of the corresponding job in an in-phase level-φi busy interval. For these reasons, if all jobs in an in-phase level-i busy interval meet their deadlines, the task is schedulable [3]. Stochastic Time Demand Analysis described in Section 3 uses this generalization of TDA. We know from the above analysis that the system of tasks in Table 1 is schedulable. However, suppose that a significantly less expensive processor is available which is half as fast. The profitability of the product would be greatly enhanced if the slower processor could be used. Using the slower processor, the execution time doubles but the periods do not change because they are determined by the environment. Thus the system utilization is doubled. The hard real-time analysis techniques discussed earlier tell us whether or not a deadline will be missed, but not how often. Although we may be willing to trade occasional missed deadlines for the use of the slower processor, we are unable to do so based on available hard real-time techniques. A different approach is needed. 2.2

Probabilistic Approaches

We are aware of only two other techniques that exploit information about the statistical behavior of periodic tasks to facilitate better design of soft real-time 2

This instant is still called a critical instant in the literature but it is not the original definition of a critical instant since Ji,1 no longer has the longest response time among all jobs in Ti .

Analyzing Stochastic Fixed-Priority Real-Time Systems

49

systems: Probabilistic Time Demand Analysis (PTDA) [10] and Statistical Rate Monotonic Scheduling (SRMS) [1]. Like the proposed method, PTDA attempts to provide a lower bound on the probability that jobs in a task will complete in time. It is a straight forward extension to TDA in which the time demand is computed by convolving the probability density functions of the execution times instead of summing the maximum execution times as in TDA. PTDA assumes that the relative deadline of all tasks are less than or equal to their periods. It computes a lower bound on the probability that jobs in a task complete in time by determining the probability that the time supply equals or exceeds the time demand at the deadline of the first job in the task. This assumption is not valid, especially when the average utilization of the system approaches one. SRMS is an extension to classical Rate Monotonic Scheduling (RMS). Its primary goal is to schedule tasks with highly variable execution times in such a way that the portion of the processor time allocated to each task is met on the average. Variable execution times are “smoothed” by aggregating the executions of several jobs in a task and allocating an execution time budget for the aggregate (which may be proportional to the original). A job is released only if its task contains sufficient budget to complete in time and if higher priority jobs will not prevent its timely completion. All other jobs are dropped. The analysis given in [1] can only be used to compute the percentage of jobs in each task that will be released for execution (and hence complete in time). Moreover, it is applicable only when the periods of the tasks are related in a harmonic way, i.e., each larger period Pj is an integer multiple of every smaller period Pi . The method presented here seeks to provide a lower bound on the percentage of jobs which meet their deadlines when all jobs are released. It is not restricted to harmonic systems and the RM scheduling policy.

3

Stochastic Time Demand Analysis

In this section we describe an algorithm, called Stochastic Time-Demand Analysis (STDA), which computes a lower bound on the probability that jobs in each task will meet their deadlines. We also compare the bound with the average behavior of a system as determined by simulation. Consider the execution of a task Ti . Let Ji,j be the jth job in Ti released in a level-φi busy interval. To simplify the discussion and without loss of generality, we take as the time origin the beginning of this interval. The response time ρi,j of job Ji,j is a function of the execution times of all jobs which can execute in the interval [ri,j , ci,j ). As in the deterministic analysis, we use the minimum interrelease time in our analysis. However, the execution times of tasks are random variables, hence the response time of each job in a task is a random variable. Our analysis assumes that the execution time Ei of a job in Ti is statistically independent of that of other jobs in Ti and jobs in other tasks. Again, because a job may not complete by the release of the subsequent job in the same task, we must consider all jobs in a level-φi busy interval, and note that the length of a

50

Mark K. Gardner and Jane W.S. Liu

level-φi busy interval is also a random variable. Bounding the length of a level-φi busy interval is key to STDA. First we show how to compute the response time distribution of jobs in task Ti . Let wi,j (t) denote the time demand of all jobs that execute in the interval [ri,j , t). Job Ji,j completes when there is sufficient time to meet the demand wi,j (t) = t. Let Wi,j (t) = P[wi,j (t) ≤ t] denote the probability that the time demand up to t is met at t, given that the busy interval has not ended. We note that Wi,j (t) is also the probability that the response time of Ji,j is less than or equal to t. The probability that Ji,j meets its deadline is therefore at least Wi,j (Di ). We now turn our attention to computing Wi,j (t). Consider a task Ti from the system. The response time distribution Wi,j (t) is computed by conditioning on whether or not a backlog of work from equal or higher priority tasks exists when Ji,j is released. If no backlog exists, a level-φi busy interval starts at the release of Ji,j (which we relabel Ji,1 ) and Wi,1 (t) = P[wi,1 (t) ≤ t] .

(1)

Otherwise, the response time distributions for the remaining jobs of Ti in the busy interval are computed in order of their release by Wi,j (t) = P[wi,j (t) ≤ t | wi,j−1 (ri,j ) > ri,j ] .

(2)

For the highest priority task, the response time distribution of the first job in a busy interval is the same as its execution time distribution. The response time distribution of the subsequent job in the busy interval is computed by convolving the execution time distribution of the task with the distribution of the backlog obtained by conditioning. This process continues until the end of the busy interval. Equations 1 and 2 are also used to compute the response time distributions of the remaining tasks in the system. We now compute Wi,j (t) for j > 1. Clearly jobs with a priority higher than φi can execute in the interval [ri,j , ci,j ). Jobs among Ji,1 , Ji,2 , . . . , Ji,j−1 that complete after ri,j also execute in this interval. Their effect is taken into account in the conditioning process. To compute Wi,j (t), we must still take into account the time demand of jobs of higher priority tasks released in the interval [ri,j , ci,j ). This is done by dividing [ri,j , ci,j ) into sub-intervals separated by releases of higher priority jobs and conditioning on whether a backlog of work exists at the start of each sub-interval. For example, suppose that only one higher priority job Jk,l is released in the interval [ri,j , ci,j ) dividing the interval into two subintervals, [ri,j , rk,l ) and [rk,l , ci,j ). The probability that Ji,j will complete by time t before rk,l is Wi,j (t) = P[wi,j (t) ≤ t | wi,j−1 (ri,j ) > ri,j ] ,

(3)

i.e., for t in the first sub-interval [ri,j , rk,l ), and is Wi,j (t) = P[wi,j (t) ≤ t | wi,j−1 (ri,j ) > ri,j , wi,j (rk,l ) > rk,l ] P[wi,j (rk,l ) > rk,l ] ,

(4)

Analyzing Stochastic Fixed-Priority Real-Time Systems

51

for t in the second sub-interval [rk,l , ri,j+1 ). The probability that a job will complete by its deadline is determined by computing Wi,j (Di ). Alternatively, the sub-interval distributions can be combined before Wi,j (Di ) is computed. Equations 1 and 2 allow the response time distributions of jobs in a levelφi busy interval to be computed for any combination of initial release times {ri,1 | 1 ≤ i < n}. In order to compute a lower bound on the probability that jobs complete by their deadlines, the worst-case combination of release times needs to be identified. As discussed previously, an upper bound on the response time of jobs from Ti according to the deterministic TDA is obtained by computing the response times of jobs executed in an in-phase level-φi busy interval. Sadly, we note that it is not longer sufficient for us to consider an in-phase busy interval. The proof that no backlog exists at the instant a job is released simultaneously with the release of jobs of higher priority tasks requires that the maximum total utilization of the system is no greater than one, which is the assumption of deterministic TDA. STDA requires only that the average total utilization of the system is less than one hence some systems may not meet the condition. It is not clear what relationship between the release times of the first jobs in a level-φi busy interval causes some job in Ti to have the maximum possible response time and hence the smallest probability of completing in time. For now, we assume that the first jobs in all tasks are released in-phase and discuss the rationale for this assumption later. We now turn our attention to the matter of determining when a busy interval ends. We note that since there is a single task per priority level, a level-φi busy interval ends if some job Ji,j in Ti completes before the next job Ji,j+1 is released. Thus we know that the busy interval has surely ended if, for some j, P[wi,j (ri,j+1 ) ≤ ri,j+1 ] = 1.0.3 As an example, we now use STDA to analyze the behavior of a system of two tasks shown in Table 2. The execution time of each task is uniformly distributed (with parameters chosen to accentuate the potential for missed deadlines). The worst-case utilization of the system is 1.41 and the mean utilization of the system is 0.71. Consequently, we would expect that some jobs will miss their deadlines. To determine the probability of jobs in each of the tasks missing their deadlines, we apply the procedure outlined above. Because its maximum utilization is less than 1.0, we know that T1 will not miss any deadlines. Therefore we begin the analysis with T2 . It is apparent that the maximum time demand of T2 in the interval [0, 400) exceeds the time supply because the sum of the maximum utilizations of the two tasks exceeds one. Because J2,1 may not have complete by the time J2,2 is released, the response time of J2,2 may be greater than that of J2,1 . At the very least we need to compute the response time distributions for J2,1 and J2,2 . To compute the probability that J2,1 completes by its deadline, the interval 3

When multiple tasks have the same priority, jobs from the same priority level must have their response time distributions computed in order of increasing release times. The busy interval will have ended if all jobs with equal or higher priority released before time t have completed by t with probability 1.0.

52

Mark K. Gardner and Jane W.S. Liu

Table 2. Parameters of the Tasks in Example #2. Ti

Pi

T1 T2

300 300 400 400

Ei−

Di

¯i E

1 1

Ui−

Ei+

100 199 150 299

¯i U

Ui+

0.0033 0.333 0.663 0.0025 0.375 0.748

Total

0.0058 0.708 1.411

0 .0 1 0

1 .0

0 .0 0 8

0 .8

0 .0 0 6

0 .6

P ro b a b ility

P ro b a b ility

[0, 400) is divided into sub-intervals [0, 300) and [300, 400) due to the release of J1,2 at 300. In the first interval, the time demand includes only the execution times of J1,1 and J2,1 . The time demand of the second interval includes the execution time of J1,2 , as well as the work remaining from the first interval. The probability that a particular time demand occurs is conditioned on whether or not J2,1 completes before J1,2 is released. We first consider the interval [0, 300). The probability that J2,1 will finish by 300 is P[w2,1 (300) ≤ 300] , where w2,1 (t) for 0 ≤ t ≤ 300 is computed via the sum E1 + E2 and has the density function and distribution shown in Fig. 4. The probability that J2,1 completes by 300 is 0.668.

0 .0 0 4

0 .0 0 2

0 .4

0 .2

0 .0 0 0

0 .0 0

5 0

1 0 0

1 5 0

2 0 0 2 5 0 3 0 0 T im e D e m a n d

(a) Density

3 5 0

4 0 0

4 5 0

5 0 0

0

5 0

1 0 0

1 5 0

2 0 0 2 5 0 3 0 0 T im e D e m a n d

3 5 0

4 0 0

4 5 0

5 0 0

(b) Distribution

Fig. 4. Time demand of J2,1 over interval [0, 300).

We now compute P[w2,1 (400) ≤ 400 | w2,1(300) > 300] for t in the interval [300, 400). Because J2,1 may not have completed by time 300, there are between 0 and 198 time units of work remaining when J1,2 is released. The density function for the backlog is the density function of Fig. 4(a) in the range 300–498, normalized to 1.0 as is implied by statistical conditioning. The random variable for the backlog is then added to the execution time of J1,2 . The resulting density and distribution are given in Fig. 5. The probability that J2,1 completes by 400, given that it did not complete by 300, is 0.209 as shown in Fig. 5(b).

0 .0 1 0

1 .0

0 .0 0 8

0 .8

0 .0 0 6

0 .6

P ro b a b ility

P ro b a b ility

Analyzing Stochastic Fixed-Priority Real-Time Systems

0 .0 0 4

0 .0 0 2

53

0 .4

0 .2

0 .0 0 0

0 .0 3 0 0

3 5 0

4 0 0

4 5 0 5 0 0 5 5 0 T im e D e m a n d

(a) Density

6 0 0

6 5 0

7 0 0

3 0 0

3 5 0

4 0 0

4 5 0 5 0 0 5 5 0 T im e D e m a n d

6 0 0

6 5 0

7 0 0

(b) Distribution

Fig. 5. Time demand of J2,1 over interval [300, 400).

Combining the results of analyzing the two sub-intervals gives us the distribution of the response time of J2,1 and thus the probability that J2,1 completes by 400 and meets its deadline P[w2,1 (400) ≤ 400] = (0.668) + (0.209)(0.332) = 0.738 .

(5)

The complete density and distribution functions of the response time of J2,1 over the interval [0, 400) are given in Fig. 6. We note that the probability that J2,1 will not complete before r2,2 is 0.262 so it is also necessary to compute the probability that J2,2 completes by its deadline. The analysis proceeds following the same pattern until the busy interval ends. The probability that J2,2 completes by its deadline at 800 is 0.994. The probability that J2,3 completes by its deadline at 1200 is 1.000. Thus a lower bound on the probability that jobs in T2 meet their deadlines is 0.738. We now return to the choice of initial phases for tasks. While we do not know what phasing causes a critical instance to occur, we hypothesize that the event occurs so infrequently that the average completion rate is not significantly affected. To test this hypothesis, we performed a series of simulation experiments on a number of systems. For each system, we determine the behavior of the system when each task Ti has a randomly distributed phase in the range (−Pi , Pi ) and when all tasks have equal phases, i.e., are released at time 0. (We call a unique combination of phases and actual execution times of the tasks a run.) A large number of jobs in each task are released in each run. For each run, a histogram of the response time of the jobs in each task is computed. The histograms of all the runs are averaged, bin by bin, to obtain a histogram representing the average behavior of the tasks of the system. The histograms for in-phase and random-phase releases are then compared. For the tasks in Example 2, we performed 1000 runs for both in-phase and random-phase releases, each run containing the release of at least 1000 jobs in each task. The width of the 95% confidence interval on the profile of the

Mark K. Gardner and Jane W.S. Liu

0 .0 1 0

1 .0

0 .0 0 8

0 .8

0 .0 0 6

0 .6

P ro b a b ility

P ro b a b ility

54

0 .0 0 4

0 .0 0 2

0 .4

0 .2

0 .0 0 0

0 .0 0

1 0 0

2 0 0

3 0 0 4 0 0 T im e D e m a n d

5 0 0

6 0 0

7 0 0

0

(a) Density

1 0 0

2 0 0

3 0 0 4 0 0 T im e D e m a n d

5 0 0

6 0 0

7 0 0

(b) Distribution

Fig. 6. Time demand of J2,1 over interval [0, 400). histogram was ±5% or less except in the tail of the density function where the probability was small to begin with. Figure 7 shows the histograms for task T2 from our example.

0 .0 0 3 0

1 .0

0 .0 0 2 5

0 .8

R a n d o m -p h a se P ro b a b ility

0 .0 0 2 0 P ro b a b ility

In -p h a se R a n d o m -p h a se

In -p h a se

0 .0 0 1 5

0 .6

0 .4

0 .0 0 1 0 0 .2

0 .0 0 0 5 0 .0 0 0 0

0 .0 0

2 0 0

4 0 0 6 0 0 R e s p o n s e T im e

(a) Density

8 0 0

1 0 0 0

0

2 0 0

4 0 0 6 0 0 R e s p o n s e T im e

8 0 0

1 0 0 0

(b) Distribution

Fig. 7. Average response times of T2 .

As Fig. 7(b) shows, the average response time distribution for in-phase releases bounds the distribution for random-phase releases from below. The average response time density function, Figure 7(a), exhibits a curious saw-tooth behavior for in-phase releases. The behavior is caused by the fixed relationship between the release times of T1 and T2 . This relationship causes the completion of jobs in T2 to be delay by jobs in T1 in a periodic manner. The linearly rising shape of each tooth is due to the uniform distribution of the execution time of T1 while the general shape of the curve results from combined effect

Analyzing Stochastic Fixed-Priority Real-Time Systems

55

of the execution time distributions of both T1 and T2 . Figure 8 compares the histograms for tasks with the same parameters as our example but with exponential distribution times. Once again, the distribution with in-phase release bounds the distribution with random-phase release from below. Also, the inphase release curve exhibits a similar saw-tooth shape. However, each tooth has a more rounded shape due to the exponential distribution of T1 . Finally, the asymptotically decreasing shape of the density curves indicates the combined effect of the execution time distributions of both tasks.

0 .0 0 3 0 0 .0 0 2 5

1 .0

0 .8

R a n d o m -p h a se P ro b a b ility

0 .0 0 2 0 P ro b a b ility

In -p h a se R a n d o m -p h a se

In -p h a se

0 .0 0 1 5

0 .6

0 .4

0 .0 0 1 0 0 .2

0 .0 0 0 5 0 .0 0 0 0

0 .0 0

5 0 0

1 0 0 0 R e s p o n s e T im e

(a) Density

1 5 0 0

2 0 0 0

0

5 0 0

1 0 0 0 R e s p o n s e T im e

1 5 0 0

2 0 0 0

(b) Distribution

Fig. 8. Average response times of T2 (Exponential).

Despite the large number of systems simulated, we have not observed a case where tasks that are released with arbitrary phases have a lower average completion rate than the same tasks that are released in-phase. We therefore use in-phase busy intervals in computing a lower bound on the average completion rate using STDA. We now compare the lower bound on the probability of meeting deadlines obtained via STDA with the percentage of deadlines met for each task in Table 2. The percentage of the jobs in each task meeting their deadlines was obtained by simulating the behavior of the system for 1000 runs. Each run released and executed 1333 jobs of T1 and 1000 jobs of T2 to produce a response time distribution (in the form of a histogram) for the tasks of the system. Once again, the response time distributions of the runs were averaged, bin by bin, to obtain average response time distributions for the tasks, as well as to assess statistical significance. The behavior of the system was observed when both tasks have identical phases, as well as when the phase of each task Ti is uniformly distributed in the range (−Pi , Pi ). As previously observed, the average completion rate for systems in which the tasks are in-phase was lower than the average completion rate for systems in which the tasks have random phases by a small but statistically significant amount at a 95% confidence level. (The simulation results shown below are for the case where the tasks are released in-phase.)

56

Mark K. Gardner and Jane W.S. Liu

Table 3. A comparison of STDA bound with simulation results. Ti

STDA

T1 T2

100.0 73.8

Simulation In-phase Random-phase 100.0 ± 0.0 80.8 ± 0.1

100.0 ± 0.0 81.2 ± 0.1

Ratio 1.000 0.913

According to Table 3 the probability that jobs complete by their deadlines, as computed by STDA, bounds the percentage of deadlines met from below. The bound differs from the simulation results for T2 by only 8.7%. The difference occurs because STDA computes the worst-case probability that jobs in the first busy interval meet their deadlines rather than the percentage of all jobs in the task that meet their deadlines. In this simple example, simulating the behavior of the two tasks is reasonable. However, for realistic systems with many tasks, simulation requires significantly greater effort than STDA. Hence STDA provides a faster way to determine if the probability of a missed deadline is acceptable.

4

Implementing STDA

In this section, we discuss an implementation of STDA in the PERTS real-time prototyping environment [6, 7]. PERTS is a tool which facilitates the design and analysis of real-time systems by applying theoretical results, where possible, or by simulating the system to determine its behavior. The issues we discuss are not particular to PERTS and must be addressed by any implementation of STDA. One of the main operations in STDA is the summing of random variables representing execution times. It is well known that the probability density function of the sum of two statistically independent random variables can be obtained by convolution f (t) = g(t)⊗h(t).The direct way to perform convolution on a digital computer is to discretize the integral using a constant spacing between samples N −1 fi = j=0 gi hi−j . Computing f by direct convolution is an O(N 2 ) operation, where N is the number of points in the discrete representations of g and h. It has long been known that the asymptotic cost of convolution can be reduced by applying the Convolution Theorem g(t) ⊗ h(t) ⇐⇒ G(f )H(f ), where G(f ) and H(f ) are the Fourier transforms of g(t) and h(t) respectively. The result is an O(N log2 N ) algorithm for convolution. There are many descriptions and implementations of the FFT readily available (e.g., [2, 8, 9]). Three issues need to be considered when using FFT to perform convolution. First, the discrete representations of the probability density functions being convolved must have the same sampling rate and consist of the same number of points. In our application, the vectors containing the discretized probability density functions will almost always have different sample rates and numbers of points as a result of the conditioning process. Thus new vectors must be created by interpolation before every convolution. Since interpolation can be performed in O(N log2 N ) time, the asymptotic complexity of convolution is not increased.

Analyzing Stochastic Fixed-Priority Real-Time Systems

57

Second, sufficient “zero padding” is required to ensure that aliasing does not occur [9]. The length of the vectors are also required to be a power of two. As a result, the vectors are likely to be large and sparsely populated in our application. Our experience indicates that the vectors are often only 50–75% filled with non-zero data. The final issue concerns the number of points used to represent the probability density functions for sufficient accuracy. Figure 9(a) shows the error between the computed and exact distributions of response time corresponding to Fig. 4(b) as a function of the number of points in the discrete representation. Figure 9(b) shows the computation time as a function of the number of points. In order to maintain acceptable interactive response, we have chosen a default of 1024 points in the PERTS implementation of STDA, which yields a maximum absolute error of slightly over 0.005 for this example.

5 .0

0 .0 1 5

2 5 6 5 1 2 1 0 2 4 2 0 4 8 4 0 9 6

4 .0 C o m p u ta tio n T im e (s e c )

A b s o lu te E rro r in P ro b a b ility

0 .0 2 0

0 .0 1 0

0 .0 0 5

3 .0

2 .0

1 .0

0 .0 0 0

0 .0 0

5 0

1 0 0

1 5 0

2 0 0 2 5 0 3 0 0 R e s p o n s e T im e

3 5 0

4 0 0

4 5 0

5 0 0

(a) Accuracy

0

1 0 0 0

2 0 0 0 3 0 0 0 V e c to r L e n g th

4 0 0 0

5 0 0 0

(b) Time

Fig. 9. Convolution via FFT versus number of points.

5

Conclusions and Future Work

Using hard real-time analysis techniques to design soft real-time system can lead to low resource utilization, increased cost, and poor average performance. In this paper, we have presented the Stochastic Time Demand Analysis method for computing a lower bound on the percentage of jobs in a task that meet their deadlines under a fixed priority scheduling policy. The method enables missed deadlines to be balanced against other design goals such as processor utilization or cost. In addition to describing the STDA method, we have also performed a simulation study to check the tightness of the bound. For the system used as an example, the bound has less than 10% error. While simulation of the example system of two tasks may not be much more complicated and time consuming than

58

Mark K. Gardner and Jane W.S. Liu

STDA, the effort to bound the probability of missed deadlines is significantly less than required to simulate systems with many tasks. Hence STDA gives a faster way to determine whether the probability of missed deadlines is acceptable. We have implemented the STDA method in the PERTS environment. While STDA improves our ability to predict the behavior of soft real-time systems, it is restricted to fixed priority assignments. Similar techniques need to be developed for systems with dynamic priority assignments, such as those scheduled Earliest-Deadline-First. The probability that consecutive jobs will miss their deadlines also needs to be computed, as many soft real-time applications cannot afford to miss more than a certain number of deadlines in a row. Finally, the behavior of systems in which execution times are dependent, periods of jobs vary, jobs share resources, or jobs have precedence constraints between them needs to be considered.

References [1] A. K. Atlas and A. Bestavros. Statistical rate monotonic scheduling. Technical Report BUCS-TR-98-010, Boston University, 1998. [2] T. H. Cormen, C. E. Leiserson, and R. L. Rivest. Introduction to Algorithms. MIT Press, 1990. [3] J. Lehoczky. Fixed priority scheduling of periodic task sets with arbitrary deadlines. In Proceedings of the 11th Real-Time System Symposium, December 1990. [4] J. Lehoczky, L. Sha, and Y. Ding. The rate monotonic scheduling algorithm: Exact characterization and average case behavior. In Proceedings of the 10th Real-Time System Symposium, pages 166–171, December 1989. [5] C. L. Liu and J. W. Layland. Scheduling algorithms for multiprogramming in a hard-real-time environment. Journal of the Association for Computing Machinery, 20(1):46–61, January 1973. [6] J. W. S. Liu, C. L. Liu, Z. Deng, T. S. Tia, J. Sun, M. Storch, D. Hull, J. L. Redondo, R. Bettati, and A. Silberman. PERTS: A prototyping environment for real-time systems. International Journal of Software Engineering and Knowledge Engineering, 6(2):161–177, 1996. [7] J. W. S. Liu, J. L. Redondo, Z. Deng, T. S. Tia, R. Bettati, A. Silberman, M. Storch, R. Ha, and W. K. Shih. PERTS: A prototyping environment for realtime systems. In Proceedings of the 14th IEEE Real-Time Systems Symposium, pages 184–188, Raleigh-Durham, North Carolina, December 1993. [8] H. J. Nussbaumer. Fast Fourier Transform and Convolution Algorithms. SpringerVerlag, second edition, 1982. [9] W. H. Press, S. A. Teukolsky, W. T. Vetterling, and B. P. Flannery. Numerical Recipes in C. Cambridge University Press, second edition, 1992. [10] T.-S. Tia, Z. Deng, M. Shankar, M. Storch, J. Sun, L.-C. Wu, and J. W.-S. Liu. Probabilistic performance guarantee for real-time tasks with varying computation times. In Proceedings of the Real-Time Technology and Applications Symposium, pages 164–173, Chicago, Illinois, May 1995. IEEE.

10.1007/b107031130004

Timed Diagnostics for Reachability Properties Stavros Tripakis Verimag ´ Centre Equation, 2, rue de Vignate, 38610, Gi`eres, France E-mail: [email protected]

Abstract. We consider the problem of computing concrete diagnostics for timed automata and reachability properties. Concrete means containing information both about the discrete state changes and the exact amount of time passing at each state. Our algorithm solves the problem in O(l · n2 ) time, where l is the length of the diagnostic run and n the number of clocks. A prototype implementation in the tool Kronos has been used to produce a counter-example in the claimed-to-be-correct version of the collision detection protocol of [HSLL97].

1

Introduction

When checking a system against a property, a simple yes/no answer is often not satisfactory. The term diagnostics is used for any kind of supplementary information (for instance, states, executions or sets of these) which helps the user understand why verification fails or succeeds. Diagnostics are important for the following reasons: – Without them no confidence in the system’s model can be gained. For instance, in case the property is not satisfied by the model, it might be that it is not the system which is wrong, but the modeling. – Even if the model is correct, the fault of the system cannot be easily located without any guidance. In the particular case of timed systems modeled as dense-time automata (TA) [ACD93,HNSY94], there is a need for timed diagnostics, that is, concrete runs in the TA semantics. These runs contain information both about the discrete state changes of the system, as well as the exact time delay between two discrete transitions. These delays can be essential to the understanding of a sample behavior of the system. Since TA model-checking is based on abstract models rather than the concrete (i.e., semantic) one [DT98,BTY97], timed diagnostics cannot be generated directly. Until now, TA verification tools like Kronos [DOTY96,BTY97] and Uppaal [HSLL97] have been able to produce only abstract diagnostics, that is, sequences of the form S1 → · · · → Sk , where S1 , ..., Sk are sets of states and → is some abstract transition relation between these sets (usually corresponding to discrete steps). Then, all that is known is that some concrete execution exists which corresponds to the abstract one. In particular, all information about delays between discrete steps is lost. W.R. Cleaveland (Ed.): TACAS/ETAPS’99, LNCS 1579, pp. 59–73, 1999. c Springer-Verlag Berlin Heidelberg 1999 

60

Stavros Tripakis

In this paper we show how to compute timed diagnostics for TA with respect to reachability properties. Our technique is based on, first, finding an abstract execution sequence like the one above, and then extracting from it the concrete states and time delays. The complexity of our algorithm is O(l · n2 ), where l is the length of the abstract sequence and n is the number of clocks of the TA. We have implemented our algorithm in the tool Kronos and used it to verify the case study presented in [HSLL97], The case study concerns an industrial protocol by Bang&Olufsen, aimed to ensure collision detection in a distributed audio/video environment. [HSLL97] present two versions of the protocol: the first one contains an error, claimed to be corrected in the second version. Surprisingly, we have found an error even in the “corrected” version of the protocol. Using our algorithm, we have obtained a timed counter-example showing how a collision can pass undetected.

2 2.1

Background Clocks, bounds and polyhedra

Let R be the set of non-negative reals and X = {x1 , ..., xn } be a set of variables in R, called clocks. An X -valuation is a function v : X → R. For some X ⊆ X , v[X := 0] is the valuation v , such that ∀x ∈ X . v (x) = 0 and ∀x ∈ X . v (x) = v(x). For every δ ∈ R, v + δ (resp. v − δ) is a valuation such that for all x ∈ X , (v + δ)(x) = v(x) + δ (resp. (v − δ)(x) = v(x) − δ). Two valuations v and v are called c-equivalent, for c ∈ N, if for any clock x, either v(x) = v (x) or v(x) > c and v (x) > c. A bound [Dil89] over X is a constraint of the form of the form xi ∼ c or xi − xj ∼ c, where 1 ≤ i = j ≤ n, ∼∈ {} and c ∈ N ∪ {∞}. If we introduce a “dummy” clock variable x0 , taken to represent 0, then bounds can be uniformly written as xi − xj ≺ c, where 0 ≤ i = j ≤ n, ≺∈ { 3 can be written as x0 − x1 < −3. A bound xi − xj ≺ c is stricter than xi − xj ≺ c iff either c < c or c = c and ≺= 0, and s → s is a discrete transition and s → s is a timed transition. Lemma 2. Let A be a TA, c ≥ cmax (A) and s1 , s2 be two c-equivalent states of A. Then, s1 + δ and s2 + δ are c-equivalent for any δ ∈ R. Moreover, for any e e edge e, if s1 → s1 is a discrete transition, then s2 → s2 is a discrete transition such that s1 and s2 are c-equivalent. Intuitively, the above lemma says that two states of A have essentially the same executions, if they agree on their clock values, except perhaps for those clocks which have grown greater than cmax (A) 2 . The result will be used in section 3.1 for proving correctness of the reachability algorithm. Runs. A run of A starting from state s1 and reaching state sk is a sequence δk e1  δ1 e2 ρ = s1 → s1 → s2 → ··· → sk , such that s1 = s and for all i = 1, ..., k, si is the ei -successor of si and si+1 is the δi -successor of si . We say that sk is reachable from s1 . Reachability problem and diagnostic runs. The reachability problem for A is, given a set of initial states S1 and a set of target states S, find whether there exists a run starting from some state s1 ∈ S1 and reaching some state s ∈ S. To provide timed diagnostics means to exhibit such a run. 2

In fact, c-equivalence is a bisimulation.

Timed Diagnostics for Reachability Properties

3

63

Reachability with diagnostics

Consider a TA A, and two sets S1 and S, of initial and target states, respectively. We check whether S1 can reach S and, if so, provide timed diagnostics. Our method of consists in two steps: – First, we apply the reachability algorithm of [DT98] to check whether there exists some run from S1 to S. If reachability succeeds, the algorithm generek e1 ates an abstract path, that is, a sequence π = S1 → ··· → S, where Si are sets of states, and ei are edges of A, for i = 1, ..., k. ek δk e1 δ1 – Then, we extract a run ρ = s1 → → s2 · · · → → s, such that ρ is inscribed in π, that is: (1) s1 ∈ S1 , (2) s − δk , s ∈ S, and (3) for each 1 ≤ i < k, si+1 − δi , si+1 ∈ Si+1 . 3.1

Checking reachability

A zone of A is a set of states {(q, v) | v ∈ ζ}, where ζ is an X -polyhedron. For simplicity, we denote such a zone by (q, ζ). Given a zone (q, ζ), an edge e = (q, ζ  , X, q  ) and a natural constant c, we define 

 def post(q, ζ, e, c) = q  , close( (ζ ∩ ζ  )[X := 0] , c) Notice that the result of post() is a zone, since polyhedra are closed with respect to the operations of intersection, clock reset, projection and c-closure. Also observe that the operator is monotonic, that is, ζ1 ⊆ ζ2 implies post(q, ζ1 , e, c) ⊆ post(q, ζ2 , e, c). The essential properties of post() are stated in the following lemma. Lemma 3. If (q  , ζ  ) = post(q, ζ, e, c), then: e δ

1. For each v ∈ ζ and each δ ∈ R, if (q, v) →→ (q  , v ), then v ∈ ζ  . e δ 2. For each v ∈ ζ  , there exist δ ∈ R, v ∈ ζ and v ∈ ζ  , such that (q, v) →→ (q  , v ) and v , v are c-equivalent. Intuitively, post(q, ζ, e, c) contains all successor states of (q, ζ), by a discrete etransition and then a timed transition. Since the final result is closed under c-equivalence, some states might be added which are not direct successors, however, they are c-equivalent to some direct successor. Based on the above lemma, we develop the algorithm of figure 2. The algorithm uses a depth-first search (DFS) to explore all successor zones of the initial zone (q1 , ζ1 ). The search stops when either a zone is found which intersects the target zone (q, ζ) (line 1) or no more zones are left to be explored. Visit is the set of zones already visited, initially empty. Each new successor zone is inserted in Visit when the DFS procedure is called recursively (line 2). For each out-going edge of the current zone (q1 , ζ1 ), DFS generates its successor (line 3). Empty successors are ignored (line 4). The same is true with any

64

Stavros Tripakis /* Precondition: c ≥ max(cmax (A), cmax (ζ)) */ DFS ((q1 , ζ1 ), (q, ζ)) { if (q1 = q ∧ ζ1 ∩ ζ = ∅) then return “Yes” ; Visit := Visit ∪ {(q1 , ζ1 )} ; for each (e ∈ out(q1 )) do (q  , ζ  ) := post(q1 , ζ1 , e, c) ; if (ζ  = ∅) then continue ; else if (∃(q  , ζ  ) ∈ Visit . ζ  ⊆ ζ  ) then continue else DFS ((q  , ζ  ), (q, ζ)) ; end for each }

(1) (2) (3) (4) ; (5)

Fig. 2. A DFS for Yes/No reachability. successor (q  , ζ  ) which is contained in an already visited zone (q  , ζ  ) (line 5): since post() is monotonic, all successors of (q  , ζ  ) are contained in (q  , ζ  ), thus, (q  , ζ  ) does not have to be further explored. The algorithm generates pairs (q, ζ), where q is a discrete state and ζ is a c-closed polyhedron. By definition there is a finite number of discrete states and by lemma 1 there is a finite number of c-closed polyhedra, thus, the algorithm terminates. Correctness follows from lemmas 2 and 3. As presented, the algorithm of figure 2 only gives a yes/no answer to the reachability problem. It is easy to see how the abstract path reaching (q, ζ) can also be returned: a DFS is usually implemented using a stack to keep the current sequence of zones and edges explored. This sequence corresponds exactly to the abstract path. In what follows, we show how to obtain more, namely, how to extract a run from the abstract path. 3.2

Extracting runs from abstract paths e

e

1 Let π = (q1 , ζ1 ) → · · · →l (ql+1 , ζl+1 ) be the abstract path returned by the DFS of figure 2, where for each i = 1, ..., l, (qi+1 , ζi+1 ) = post(qi , ζi , ei , c) and Sl+1 = (q, ζl+1 ), with ζl+1 ∩ ζ = ∅. For simplicity, we assume that ζl+1 ⊆ ζ (otherwise, we can just replace ζl+1 by ζl+1 ∩ ζ). We show how to build a run inscribed in π. The run is built in two passes, first backwards and then forwards:

– Backward pass: initially we choose sl+1 ∈ (ql+1 , ζl+1 ) and then successively e δ

compute δi ∈ R, si ∈ (qi , ζi ), for i = l, ..., 1, such that si →i →i si+1 , for some si+1 which is c-equivalent to si+1 . – Forward pass: starting from s1 ∈ (q1 , ζ1 ), we compute si , for i = 2, ..., l + 1, e δ

e δ

1 1 → s2 · · · →l →l sl+1 . based on δi , ei . The final run is s1 →

Intuitively, the backward pass generates an invalid run which might contain some “jumps” among c-equivalent states. The forward pass corrects the run by “adjusting” the clocks which have grown greater than cmax (A).

Timed Diagnostics for Reachability Properties

65

Before describing the two passes in detail, we show how choosing a state in a zone (q, ζ) can be done effectively. In fact, this comes down to extracting a valuation v ∈ ζ. In the sequel, we assume that the set of clocks is X = {x1 , ..., xn }. Extracting valuations from polyhedra. An k-incomplete valuation is a valuation v on {x1 , ..., xk }. We say that v can be completed in ζ if there exists an X valuation v ∈ ζ, such that v (xj ) = v(xj ), for all j ≤ k. Completing v in ζ means finding such a v . Notice that we permit k = 0, so that completing a 0-incomplete valuation in ζ means extracting a valuation from ζ. Lemma 4. Let ζ be an X -polyhedron and v be an k-incomplete valuation. It takes O(n2 ) time to complete v in ζ, or find that this is not possible.  Proof. Let ζ = 0≤i =j≤n xi − xj ≺i,j ci,j . For i = 0, ..., k, we define:  δi =

0, if i = 0 v(xi ), if 1 ≤ i ≤ k

Then, for i = k + 1, ..., n, we choose δi such that: ∀0 ≤ j < i . −cj,i ≺j,i δi ≺i,j ci,j If such a δi cannot be chosen for some i, then v cannot be completed. Otherwise, we let v (xi ) = δi , for i = 1, ..., n. It is easy to see that v ∈ ζ. Regarding complexity, in the worst case we have i = 0, meaning that we have to perform n · (n − 1) + n comparisons and additions of bounds. Backward pass. It suffices to show how the computation is done for a single step, e say, (q1 , ζ1 ) → (q2 , ζ2 ). That is, given v2 ∈ ζ2 , we shall show how to compute e δ

δ ∈ R and v1 ∈ ζ1 such that (q1 , v1 ) →→ (q2 , v2 ), and v2 , v2 are c-equivalent. Finding δ can be done by “pulling v2 backward in time”, until some clock reset in e reaches 0. More precisely, if reset(e) = ∅ then we let δ = 0, otherwise we let δ = v2 (x), for some x ∈ reset(e). δ

Now, let v3 = v2 − δ. By definition, we have v3 ∈ ζ2 and (q2 , v3 ) → (q2 , v2 ). e It remains to find v1 ∈ ζ1 such that (q1 , v1 ) → (q2 , v4 ) and v4 and v3 are c-equivalent, which implies that v4 + δ and v2 are also c-equivalent. Without loss of generality, we assume that there exists 0 ≤ k ≤ n such that the clocks x1 , ..., xk are not reset in e and for each j = 1, ..., k, v2 (xj ) ≤ c. First, v1 should satisfy guard(e). Moreover, since clocks x1 , ..., xk are not reset in e, they should have the same value in v1 and v3 . Then, we let v be a k-incomplete valuation, such that v(xi ) = v3 (xi ), for i = 1, ..., k. Using lemma 4, we can complete v in ζ1 ∩ guard(e). This is always possible, by the second part of lemma 3. Therefore, we define v1 to be the completed valuation. If we let v4 = v1 [reset(e) := 0], we have:

66

Stavros Tripakis

– for i = 1, ..., k, v4 (xi ) = v3 (xi ); – for i = k + 1, ..., n, • if xi ∈ reset(e), then v4 (xi ) = v3 (xi ) = 0, • otherwise, v4 (xi ) > c and v3 (xi ) > c. That is, v4 and v3 are c-equivalent. Regarding the complexity of the backward pass, observe that for each step, it takes O(n) time to find the delay δ and O(n2 ) time to complete the valuation 3 . Therefore, the whole pass can be performed in time O(l · n2 ). Forward pass. This pass is easy. We start from s1 = (q1 , v1 ), as computed in the backward pass. Then, for i = 1, ..., l + 1, we compute vi by “adjusting” vi as follows. – v1 = v1 ;  [reset(ei ) := 0]) + δi . – for i = 2, ..., l + 1, vi = (vi−1 Using lemma 2 and induction on l, it is easy to prove that the resulting run is e δ  valid, that is, (qi , vi ) →i →i (qi+1 , vi+1 ), for all i = 1, ..., l. The complexity of the forward pass is O(l · n). Therefore, the complexity of computing the whole run is O(l · n2 ). Example. Consider the simple TA shown in figure 3. We are interested in reachability of the target zone (q3 , true) from the initial zone (q1 , x = y). Let e1 be the edge from q1 to q2 and e2 the edge from q2 to q3 . The algorithm of figure 2 suce1 e2 (q2 , y = x+2) → (q3 , y > x+2). ceeds, returning the abstract path (q1 , x = y) → Notice that for this example c = 2 and before applying close(), the polyhedron associated to q3 is y = x + 4. For the backward pass, we start by choosing v3 ∈ y > x + 2, say, v3 = (x = 0, y = 3). This gives δ3 = 0. Then, we must complete a 0-incomplete valuation in y = x + 2 ∧ x = 2, which gives us v2 = (x = 2, y = 4). Since x is reset in e1 , we get δ2 = 2. Finally, we have to complete a 0-incomplete valuation in y = x ∧ x = 2, which gives us v1 = (x = 2, y = 2). At the end of the backward e1 2 pass, we have the sequence (q1 , x = 2, y = 2) → (q2 , x = 0, y = 2) → (q2 , x = e2 2, y = 4) → (q3 , x = 0, y = 3). This is not a valid run, since there is a “jump” of clock y on the e2 -transition. The forward pass adjusts v3 to v3 = (x = 0, y = 4), yielding the final (valid) e1 e2 2 run: (q1 , x = 2, y = 2) → (q2 , x = 0, y = 2) → (q2 , x = 2, y = 4) → (q3 , x = 0 0, y = 4) → (q3 , x = 0, y = 4). 3

Completing a valuation in the intersection of more than one polyhedra, say, ζ1 ∩ · · · ∩ ζm , multiplies the complexity of the operation by only a constant factor m.

Timed Diagnostics for Reachability Properties

q1 x

x=2 x := 0

q2

x

x=y

2

x=2 x := 0

q3

y =x+2

2 2

y

the zone at q1

67

x

y >x+2

2 2

y

the zone at q2

2

y

the zone at q3

Fig. 3. A simple example.

4

Case study: Bang&Olufsen’s Collision-Detection Protocol

We have implemented the technique presented in the previous section in the real-time verification tool Kronos, which can now provide timed diagnostics when reachability analysis succeeds 4 . We have used Kronos to verify the industrial Bang&Olufsen protocol, treated with Uppaal in [HSLL97]. The TA models of Kronos and Uppaal are essentially the same, so that translating the specification of [HSLL97] to Kronos format was almost straightforward. The protocol is only briefly presented here; the reader is referred to the above paper for more details. Brief description and modeling. The role of the protocol is to ensure collision detection in a distributed environment of components exchanging messages through a common multiple-access bus. The system modeled has two transmission components A and B (identical up to renaming) and the bus. Since we are interested only in the collision-detection protocol, the reception components are not modeled. A and B consist each of 3 sub-components, namely, the sender, the detector and the frame generator. The sender handles transmission of messages, which are grouped in frames. The latter are generated by the frame generator. The detector is responsible for collision detection. The components along with their communication channels are shown in figure 4. Each component is modeled as an automaton. The two senders are modeled 4

The implementation is actually compatible with the new features of Kronos, including discrete variables (of type boolean, bounded integer or enumerative), message passing, and a variable-dimension DBM library which exploits the activity of clocks [DT98] to reduce the size of the state space.

68

Stavros Tripakis

Observer observe

Detector A Acheck Sender A ANewPn

Areset

zero one Aframe

Frame generator A

Bus

Detector B zero one

BNewPn

Bcheck Sender B Breset

Bframe

Frame generator B

Fig. 4. Bang&Olufsen’s protocol: general architecture.

by timed automata whereas the rest of the automata are untimed 5 . Figure 5 shows the TA for sender A. The figure is merely intended to give an impression of the complexity of the case study and the modeling issues involved. In particular, Uppaal uses so-called “committed locations”, which are not a standard feature of Kronos. However, they can be easily modeled as described in appendix A. The most interesting feature of the protocol is its timing constraints, which concern the frequency of senders’ polling on the bus, the encoding of messages and the waiting delay required before retransmitting after a collision. For instance, a sender samples the value of the bus (1 for high voltage, 0 for low voltage) twice every 781 micro-seconds. Also, there are 5 different types of messages and the i-th message is encoded by the presence of a 1 on the bus, for 2 · 1562 · i micro-seconds. Finally, the jamming signal, after a collision, is a continuous 1 on the bus for 25 milli-seconds 6 . Verification. The protocol must ensure collision detection, that is, if a frame sent by a sender is destroyed by the other sender (collision), then both senders shall detect this. According to [HSLL97], collision happens when the boolean expression def

φcol = ¬(A Pf ⇔ A S 1 ∧ A Pn ⇔ A S 2 ) 5

6

The observer automaton shown in the figure is not part of the system itself, but is added to monitor the system for possible errors, as we explain below. Notice that duration constants vary from 40 micro-seconds to 0.5 seconds and have no common divisor (look at figure 5). This implies a very small time quantum, namely, one micro-sec, which results in very large constants in guards and invariants. Consequently, enumerative approaches based on discretization are not well-suited for this case study, since time units have to be counted one-by-one, leading to state explosion.

Timed Diagnostics for Reachability Properties

x := 0 x = 781

1

x := 0

¬B start

2

B start x := 0

x = 50000 x := 0

3

x := 0

9

x = 2343 zero ? one ? x = 2343 x := 0

¬B start x = 3124

4

Done !

15 A Pn := A Pf 8

Aframe ! A err := 0 ¬A eof zero ? A S 1 := false

¬A eof one ? A S 1 := true

6

B start x = 3124

A eof x := 0

x = 781 A Pf := true A diff := false

7 x ≤ 781

A err = 0

ANewPn ! x = 40

11 x = 40 A err > 0 A Pn := true A stop

14 x = 781 A res = 1 Areset ! A Pn := false x := 0

¬A stop

Acheck !

13

x = 781 zero ? A S 2 := false observe !

x = 781 one ? A S 2 := true

12

x := 0 x = 781 A res = 2 Areset ! A Pn := true x := 0

18

zero ? x = 781

x = 781 one ?

10 A res = 0

5

16

one ? x = 781 x := 0

17

x = 28116 A res := 0

zero ? x = 781 x := 0

x ≤ 25000 A Pn := true x := 0

A start := false A res := 0

Fig. 5. Bang&Olufsen’s example: the TA for sender A.

69

70

Stavros Tripakis

evaluates to false at the moment A S 2 is assigned (transition from control state 11 to 12 in figure 5). A collision is detected when the result of the detector automaton (called by signal “Acheck !”) is A res = 1 or A res = 2, whereupon the sender emits an “Areset !” signal. Now we can model the requirement in terms or reachability of the “error” state of the observer automaton shown in figure 6. The observer starts at its leftmost state and moves to its middle state when a collision happens. If the collision is detected before the the sender finishes transmitting (modeled by signal “Done !”) then the observer returns to its initial state, otherwise it goes to the error state. Observe ? ¬φcol

Observe ? Observe ? φcol Areset ?

Done ? error

Done ? Fig. 6. Bang&Olufsen’s example: the observer automaton.

Results and performance. [HSLL97] present two versions of the protocol: the initial version contains an error (Uppaal provides an abstract counter-example); then, the frame-generator automaton is slightly modified and the authors of [HSLL97] claim this version to be correct. However, we have found a counterexample in both versions. The counter-example of the “corrected” version is generated by Kronos in 25 seconds on a Sparc 20 7 . The complete diagnostic run is 1951 discrete/timed steps long. Here, we show only its head and its tail, as produced by the tool 8 : - 0 - - - 40 - - - 741 - - - 40 - - - 0 - - - 2303 - 7

8

y:=0 "b_go" --> x:=0 "a_go" --> y:=0 "b_start_frame" --> "a_silent" --> x:=0 "a_start_frame" --> -- "b_silent" -->

As in [HSLL97], in order to obtain a fast answer, we have used a simplified model where not the whole variety of messages could be generated. There are too many discrete variables, thus, only the clock valuation is shown for each state. Clocks x and y correspond to senders A and B, respectively. The initial valuation is trivial since no clocks are initially active. In the second valuation, only y is active.

Timed Diagnostics for Reachability Properties

71

- 0 - -- y:=0 "b_one" --> - 40 - -- x:=0 "a_one" --> - 741 - -- y:=0 "b_one" --> - 40 - -- x:=0 "a_one" --> - 741 - -- y:=0 "b_frame" --> ... - 40 - -- "b_observe_ok" --> - 0 - -- "b_stopped" --> - 0 - -- x:=0 "a_zero" --> - 741 - -- "a_diff_pf_s1" --> - 0 - -- "a_stopped" --> - 0 - -- y:=0 "b_nocol" --> - 40 - -- "b_pf0" --> - 0 - -- "b_zero" --> - 0 - -- "b_new_pn" --> - 0 - -- x:=0 "a_nocol" --> - 40 - -- "a_pf0" --> - 0 - -- "a_zero" --> - 0 - -- "a_new_pn" --> Intuitively, the error seems to be due to the following reasons: 1. The two senders start transmitting with a difference of exactly 40 μ-seconds. Due to this fact and the way the sampling of the bus is performed, collision remains undetected until the last message of the frame is sent. 2. In the last message of the frame (a message signaling end-of-frame) the collision detection procedure is disarmed. This can be seen in the tail of the diagnostic run above: instead of the action a check calling the collision detection procedure, we see the action a stopped, which means that boolean variable A stop is set. Therefore, collision is not detected by A. The situation is the same for sender B.

5

Conclusions

We have shown how to compute exact diagnostics for timed systems with respect to reachability properties. Our technique has enhanced the verification tool Kronos with a useful feature, which makes debugging of the model and discovery of real system flaws much easier. Related work. Timed diagnostics have been considered independently in [LPY95]. However, only the existence of a run inscribed in a symbolic path is stated and no method is given on how to actually extract the run. Moreover, the symbolic reachability of [LPY95] does not contain the c-closure operation. This makes the extraction of runs simpler, but without c-closure termination is not generally ensured.

72

Stavros Tripakis

Recently, [AKV98] have developed an algorithm which, given a sequence of edges, produces a corresponding run, if one exists. This algorithm has complexity O(l · n2 ) as ours, and can also be used to extract a timed diagnostic from a symbolic path. Acknowledgments. This work would not have been possible without the help of Marius Bozga for extending Kronos without discrete variables. I would like also to thank him for his help in understanding the counter-example trace in Bang&Olufsens protocol.

References ACD93.

R. Alur, C. Courcoubetis, and D.L. Dill. Model checking in dense real time. Information and Computation, 104(1):2–34, 1993. AKV98. R. Alur, R.P. Kurshan, and M. Viswanathan. Membership questions for timed and hybrid automata. In RTSS’98, 1998. BTY97. A. Bouajjani, S. Tripakis, and S. Yovine. On-the-fly symbolic model checking for real-time systems. In Proc. of the 18th IEEE Real-Time Systems Symposium, San Francisco, CA, pages 232–243. IEEE, December 1997. Dil89. D.L. Dill. Timing assumptions and verification of finite-state concurrent systems. In J. Sifakis, editor, Automatic Verification Methods for Finite State Systems, Lecture Notes in Computer Science 407, pages 197–212. Springer– Verlag, 1989. DOTY96. C. Daws, A. Olivero, S. Tripakis, and S. Yovine. The tool KRONOS. In Hybrid Systems III, Verification and Control, volume 1066 of LNCS, pages 208–219. Springer-Verlag, 1996. DT98. C. Daws and S. Tripakis. Model checking of real-time reachability properties using abstractions. In Tools and Algorithms for the Construction and Analysis of Systems ’98, Lisbon, Portugal, volume 1384 of LNCS. SpringerVerlag, 1998. HNSY94. T.A. Henzinger, X. Nicollin, J. Sifakis, and S. Yovine. Symbolic model checking for real-time systems. Information and Computation, 111(2):193– 244, 1994. HSLL97. K. Havelund, A. Skou, K. Larsen, and K. Lund. Formal modelling and analysis of an audio/video protocol: An industrial case study using Uppaal. In Proceedings of the 18th IEEE Real-Time Systems Symposium San Francisco, CA, pages 2–13, December 1997. LPY95. K. Larsen, P. Pettersson, and W. Yi. Diagnostic model-checking for realtime systems. In 4th DIMACS Workshop on Verification and Control of Hybrid Systems, 1995. Yov93. S. Yovine. M´ethodes et outils pour la v´erification symbolique de syst`emes temporis´ es. PhD thesis, Institut National Polytechnique de Grenoble, 1993. In french.

A

Modeling “committed locations”

Committed locations are simply discrete states modeling atomic execution. Informally, the semantics are as follows, for a network of TA. When an automaton

Timed Diagnostics for Reachability Properties

73

A enters a committed location, it has to exit immediately, and no other automaton takes a discrete step meanwhile. To model committed locations, we introduce a global boolean variable atom and a global clock z (a single boolean variable and a single clock suffice, no matter how many the committed locations are). The invariant that must hold during execution is that atom is set iff some automaton is in a committed location and that the time spend in committed locations is zero. For each TA A in the global system, if e = (q, ζ, X, q  ) is an edge of A, then: – If q is not committed, then we add the boolean guard ¬atom to e. – If q is committed, then we add the clock guard z = 0 to e. – If q  is committed, then we add the assignment atom := true and the clock reset z := 0 to e. – If q  is not committed, then we add the assignment atom := false to e. The construction is illustrated in figure 7.

¬atom z := 0 committed:



z=0 atom := false



¬atom

Fig. 7. Modeling committed locations with an auxiliary boolean variable and clock.

10.1007/b107031130005

Fighting Livelock in the i-Protocol A Comparative Study of Verification Tools Yifei Dong, Xiaoqun Du, Y.S. Ramakrishna, C.R. Ramakrishnan, I.V. Ramakrishnan, Scott A. Smolka, Oleg Sokolsky   , Eugene W. Stark, and David S. Warren Department of Computer Science, SUNY at Stony Brook Stony Brook, NY 11794–4400, USA

Abstract. The i-protocol, an optimized sliding-window protocol for GNU UUCP, came to our attention two years ago when we used the Concurrency Factory’s local model checker to detect, locate, and correct a non-trivial livelock in version 1.04 of the protocol. Since then, we have repeated this verification effort with five widely used model checkers, namely, COSPAN, Murϕ, SMV, Spin, and XMC. It is our contention that the i-protocol makes for a particularly compelling case study in protocol verification and for a formidable benchmark of verification-tool performance, for the following reasons: 1) The i-protocol can be used to gauge a tool’s ability to detect and diagnose livelock errors. 2) The size of the i-protocol’s state space grows exponentially in the window size, and the entirety of this state space must be searched to verify that the protocol, with the livelock error eliminated, is deadlock- or livelock-free. 3) The i-protocol is an asynchronous, low-level software system equipped with a number of optimizations aimed at minimizing control-message and retransmission overhead. It lacks the regular structure that is often present in hardware designs. In this sense, it provides any verification tool with a vigorous test of its analysis capabilities.

1

Introduction

Model checking [CGP99] is a verification technique aimed at determining whether a system specification possesses a property expressed as a temporal logic formula. Model checking has enjoyed wide success in verifying, or finding design errors in real-life systems. An interesting account of a number of these success stories can be found in [CW96]. In this paper, we report on our experience in using model checking—as provided by six widely used verification tools—to detect and correct a nontrivial livelock in a bidirectional sliding-window protocol. The tools in question are the Concurrency Factory [CLSS96], COSPAN [HHK96], Murϕ [Dil96],   

Research supported in part by NSF Grants CCR-9505562 and CCR-9705998, and AFOSR grants F49620-95-1-0508 and F49620-96-1-0087. Currently at: Sun Microsystems, Mountain View, CA 94043, USA. Currently at: Department of Computer and Information Sciences, University of Pennsylvania, Philadelphia, PA 19104, USA.

W.R. Cleaveland (Ed.): TACAS/ETAPS’99, LNCS 1579, pp. 74–88, 1999. c Springer-Verlag Berlin Heidelberg 1999 

Fighting Livelock in the i-Protocol: A Comparative Study

75

SMV [CMCHG96], Spin [HP96], and XMC [RRR+ 97], each of which supports some variety of model checking. The protocol that we investigate, the i-protocol, is part of the GNU UUCP package, available from the Free Software Foundation, and is used for file transfers over serial lines. The i-protocol is part of a protocol stack; its purpose is to ensure ordered reliable duplex communication between two sites. At its lower interface, the i-protocol assumes unreliable (lossy) packet-based FIFO connectivity. To its upper interface, it provides reliable packet-based FIFO service. A distinguishing feature of the i-protocol is the rather sophisticated manner in which it attempts to minimize control-message and retransmission overhead. The GNU UUCP package also contains the g- and j-protocols, which are variants of the i-protocol. A problem with the i-protocol, GNU UUCP version 1.04, was first noticed by Stark, while trying to transfer large files from a remote computer to his home PC over a modem line. In particular, it appeared that, under certain message-loss conditions, the protocol would enter a “confused” state and eventually drop the connection. In order to diagnose this problem, we extracted an abstract version of the i-protocol from its source code, consisting of approximately 1500 lines of C code. We formalized this abstraction of the protocol in VPL (Value Passing Language), the input language of the Concurrency Factory specification and verification toolset. The VPL source of the i-protocol was then subjected to a series of model checking experiments using the Concurrency Factory’s local model checker for the modal mu-calculus [RS97]. This led us to the root of the problem: a livelock that occurs when a particular series of message losses drives the protocol into a state where the communicating parties enter into a cycle of fruitless message exchanges without any packets being delivered to the upper layer entities. Seeing no progress, the two sides close the connection, which must then be reestablished. If the communication line is sufficiently noisy, or if one of the sides is slow in emptying communication buffers, say due to disk waits, leading to buffer overflows, the chances of this scenario recurring are high, and can result in extremely poor performance. Using the Concurrency Factory’s diagnostic facility, we were able to pinpoint and subsequently “patch” the bug in the VPL code. The fix to the protocol consists of a simple change in the way negative acknowledgments are handled. The livelock error was fixed independently by Ian Taylor, the i-protocol’s original developer, in GNU UUCP version 1.05. We repeated our model-checking-based verification of the i-protocol with the COSPAN, Murϕ, Spin, SMV, and XMC verification tools, so that we could draw some comparisons between these tools on a real-life protocol. The i-protocol is particularly compelling as a case study in protocol verification and as a verification-tool performance benchmark for several reasons. First, the version we originally model checked has a bug, i.e. the livelock error, and hence the protocol can be used to gauge a tool’s ability to uncover errors of this nature. In this case, we are more interested in debugging or refutation than in verification.

76

Yifei Dong et al.

Secondly, the size of the i-protocol’s state space grows exponentially in the window size, and the entirety of this state space will need to be searched to verify that the protocol, with the livelock error eliminated, is deadlock- or livelock-free. Finally, the i-protocol is an asynchronous, low-level software system equipped with a number of optimizations aimed at minimizing control-message and retransmission overhead. It lacks the regular structure that is often present in hardware designs. In this sense, it provides any verification tool with a vigorous test of its analysis capabilities. Our experimental results show that the special-purpose cycle-detection algorithms of Spin and COSPAN can be used to significant advantage to check for livelocks in complex systems like the i-protocol. SMV exhibited excellent memory-usage performance on all runs of window size 1, but failed to complete in a reasonable amount of time on any run of window size 2. This can most likely be attributed to exponential blowup in the BDD representation for window sizes greater than 1. Murϕ and XMC performed the best on the i-protocol. In the case of Murϕ this is due to the low-level nature of its specification language (guarded commands) and the succinct manner in which system states are encoded. XMC’s strong performance is a consequence of the efficiency of the underlying tabled logic programming system, XSB [XSB97], and our use of partial evaluation to specialize the logical formula capturing livelock to the i-protocol’s behavior. Our model-checking results are described more fully in Section 5 (see Table 1). In related work, [CCA96,Cor96] benchmark the performance of a variety of model checkers (including SMV and Spin) on Ada tasking programs. The major differences between our study and theirs is in the application domain (a real-life communication protocol vs. a suite of concurrency analysis benchmark programs) and in the type of properties considered (livelock vs. reachability). The remainder of the paper is organized as follows. Section 2 describes the salient features of the tools used in this case study. Section 3 gives a detailed account of the i-protocol, with an emphasis on how we modeled the protocol for verification purposes. Section 4 describes the livelock that we discovered, and shows how a small change to the protocol effectively eliminates this form of livelock. Section 5 summarizes the results of our model-checking experiments, and offers a comparison of the tools’ performance. Section 6 contains our concluding remarks. We have constructed a web site (http://www.cs.sunysb.edu/~lmc/iproto/) to serve as a central repository for our results. The site contains the source code of version 1.04 of the i-protocol, the patch to the C code to fix the livelock error, the encoding of the protocol in each of the input languages of the six tools, and various performance statistics generated by our benchmarking activity. For each tool, these include the number of states explored, number of transitions traversed, CPU time usage, and memory usage (see Table 1).

Fighting Livelock in the i-Protocol: A Comparative Study

2

77

The Verification Tools

In this section, we describe the most salient features of the tools we used in our analysis of the i-protocol. 2.1

The Concurrency Factory

In the context of our case study, the main features of the Concurrency Factory [CLSS96] are its textual specification language, VPL, and its local model checker for the modal mu-calculus [RS97]. VPL-supported data structures include integers of limited size and arrays and records composed of such integers. A system specification in VPL is a tree-like hierarchy of subsystems. A subsystem is either a network or a process. A network consists of a collection of subsystems running in parallel and communicating with each other through typed channels. Simple statements of VPL are assignments of arithmetic or boolean expressions to variables, and input/output operations on channels. Complex statements include sequential composition, if-then-else, while-do, and nondeterministic choice in the form of the select statement. LMC, the Factory’s local model checker, computes in an on-the-fly fashion the product of a graph representation of the formula to be checked with the labeled transition system (guaranteed to be finite-state) underlying the VPL program. The number of nodes of the product graph explored by LMC is further minimized through the use of partial-order reduction. This technique eliminates from consideration those portions of the state space resulting from redundant interleavings of independent events. LMC is also equipped with diagnostic facilities that allows the user to request that the contents of the depth-first search stack be displayed whenever a certain “significant event” occurs (e.g. when the search first encounters a state at which a logical variable is determined to be either true or false) and to play interactive games for the full modal mu-calculus. 2.2

COSPAN

COSPAN [HHK96] is a model checker for synchronous systems based on the theory of ω-automata. The system to be verified is specified as an ω-automaton P , the task the system is intended to perform is specified as an ω-automaton T , and verification consists of the automata language containment test L(P ) ⊂ L(T ). P is typically given as the synchronous parallel composition of component processes, specified as ω-automata. Asynchronous composition can be modeled through nondeterministic delay in the components. Language containment can be checked in COSPAN using either a symbolic (BDD-based) algorithm or an explicit state-enumeration algorithm. Both algorithms are “on-the-fly.” COSPAN also supports a notion of “recur edge” and can check whether in every execution of the system the recur edge occurs infinitely often. We used this facility to detect livelock in the i-protocol. Systems can be specified in COSPAN using the S/R language, which supports nondeterministic, conditional (i.e., if-then-else) variable assignments;

78

Yifei Dong et al.

variables of type bounded integer, enumerated, boolean, and pointer; arrays and records; and integer and bit-vector arithmetic. Modular hierarchy, scoping, parallel and sequential execution, homomorphism declaration and general ω-automaton fairness are also available. COSPAN also provides an error tracing facility that allows the user to back-reference from the error track to the S/R source. 2.3

Murϕ

The Murϕ verification system consists of the Murϕ compiler and the Murϕ description language. The Murϕ compiler generates a special-purpose verifier from a Murϕ description. The Murϕ description language uses a set of iterated guarded commands, like Chandy and Misra’s Unity language [CM88]. A Murϕ description consists of constant and type declarations, variable declarations, procedure declarations, rule definitions, a description of the start state, and a collection of invariants. Each rule is a guarded command consisting of a condition and an action. The condition is a boolean expression and the action is a sequence of statements. An invariant is a boolean expression that is desired to be true in every state. When an invariant is violated, an error message and error trace are generated. Murϕ is able to verify liveness specifications written in a subset of Linear Time Temporal Logic (LTL). Liveness specifications are expressed using keywords ALWAYS, EVENTUALLY, and UNTIL, and are checked under the assumption that every rule is weak-fair (unless declared otherwise). We used this facility of Murϕ to encode and check for livelock in the i-protocol. 2.4

SMV

SMV [CMCHG96] is an automatic tool for model checking CTL formulas. CTL can also be used to specify simple fairness constraints. The transition relation of the system to be verified is represented implicitly by boolean formulas, and implemented by BDDs. This allows SMV to verify models having more than 1020 states. SMV also has a diagnostic facility that produces a counterexample when a formula is not true. An SMV program can be viewed as a system of simultaneous equations whose solution determines the next state. Asynchronous systems, such as the i-protocol, are modeled by defining a set of parallel processes whose actions are interleaved arbitrarily in the execution of the program. As in Murϕ liveness specifications, such as absence of livelock, are given in a form of temporal logic (CTL). 2.5

Spin

Spin [HP96] is a model checker for asynchronous systems specified in the language Promela. Safety and liveness properties are formulated using LTL. Model checking is performed on-the-fly and with partial-order reduction, if specified by

Fighting Livelock in the i-Protocol: A Comparative Study

79

the user. Moreover, model checking can be done in a conventional exhaustive manner, or, when this proves to be impossible due to state explosion, with an efficient approximation method based on bitstate hashing. With a careful choice of hashing functions, the probability of an exhaustive proof remains very high. Besides being able to specify correctness properties in LTL, the Promela specification language includes two types of labels that can be used to define two complementary types of liveness properties: acceptance and progress. We used Spin’s ability to check for this latter type of formula to detect livelock in the i-protocol. Promela is a nondeterministic guarded-command language with influences from Hoare’s CSP and the language C. Promela includes support for data structures, interrupts, bracketing of code sections for atomic execution, the dynamic creation of concurrent processes, and a variety of synchronous and asynchronous message passing primitives. Message passing is via channels with arbitrary numbers of message parameters. 2.6

XMC

XMC [RRR+ 97] is a model checker for a value-passing process calculus and the modal mu-calculus. It is written in under 200 lines of XSB tabled Prolog code. XSB [XSB97] is a logic programming system developed at SUNY Stony Brook that extends Prolog-style SLD resolution with tabled resolution. The principal merits of this extension are that XSB terminates on programs having finite models, avoids redundant subcomputations, and computes the well-founded model of normal logic programs. Systems to be verified in XMC are encoded in the XL language, a valuepassing language similar in many ways to Milner’s CCS. A distinguishing feature of XL is its support for a generalized process prefix operator, which allows arbitrary Prolog terms to appear as prefixes. This construct allows the XL programmer to take advantage of XSB’s substantial data-structuring facilities to describe sequential computation on values. Properties such as the possibility of livelock are expressed as modal mucalculus formulas. The encoding of the semantics of the mu-calculus in XMC can be specialized [JGS93] with respect to a given formula. For the livelock formula used in the verification of the i-protocol, specialization yields a logic program that implements an efficient cycle-detection algorithm, and leads to improved performance.

3

Modeling the i-Protocol

In this section we introduce the i-protocol, and describe how we modeled it for verification purposes. The i-protocol is a sliding window protocol, but with some optimizations, to be described later, aimed at reducing the acknowledgment and retransmission traffic. The window size, among other “steady-state” protocol parameters,

80

Yifei Dong et al.

such as data packet size, line quality and error handling parameters, timeout values, acknowledgment high watermarks, and data and message buffer sizes, is decided at the parameter negotiation stage during connection set-up. Since we are concerned with the data transfer properties of the protocol, we do not model the stages involved in connection set-up, parameter negotiation, error and linequality monitoring, and connection shutdown. In particular, the window size for our model is a parameter that is fixed at “compile time.” The protocol is intended to provide reliable, full duplex, FIFO service to its upper interface, given a full duplex, unreliable, FIFO packet-based communication service by its lower interface. It is convenient to imagine each side as consisting of two halves — a sender half that sends data packets to, and receives acknowledgments from, the receiver half on the other side, and a receiver half that receives data packets from, and sends acknowledgments to, the sender half on the other side. To allow for communication latency, the sender can send several packets without waiting for acknowledgments. If the window size is W , then the sender can have up to W contiguous packets unacknowledged at any time. These packets are stamped with sequence numbers when received from the upper layer; sequence numbers range from 0 to SEQ − 1. The i-protocol, as implemented in GNU UUCP, uses a fixed value of SEQ = 32, and is intended for window sizes up to, but not exceeding, 16. As discussed below, however, this bound is not essential, and using a sequence space of SEQ, a window size of up to SEQ/2 can be supported. To cut down on the acknowledgment traffic, the receiver can piggyback its acknowledgments on top of normal data, or other control traffic. When both sides are exchanging data packets, this is often sufficient to keep the connection going without the need for explicit acknowledgments. However, when a side is only receiving data, it needs to send explicit acks. In this case, as an optimization, acks are sent only at half-window boundaries, i.e., one for every W/2 packets received. Below we give a more detailed account of the i-protocol. The interested reader may also refer to the (VPL-style) pseudo-codes on the web site. The “sender half” uses the following main state variables, each of which ranges over SEQ. A variable sendseq is used to stamp the next user-level message from the upper layer. Its value gives the upper edge (exclusive) of the sender’s “active window.” The variable rack is used to keep track of acknowledgments from the remote, and its value gives the lower edge (exclusive) of the sender’s active window. At our level of abstraction, the data contents of a packet are not modeled, and so the sender does not explicitly buffer unsent messages1 . The main data structures used by the receiver half are as follows. A variable recseq is used to record the sequence number up to, and including which, all packets have been successfully received from the remote, and delivered to the upper layer. The variable lack records the sequence number up to which an acknowledgment, either explicit (via an ack) or implicit (via a piggybacked acknowledgment in a data or nak packet), has been most recently sent to the 1

This is a data independence abstraction [Wol86].

Fighting Livelock in the i-Protocol: A Comparative Study

81

remote. The receiver’s active window consists of the sequence numbers from lack + 1 through lack + W (modulo SEQ).2 A boolean array recbuf of size SEQ indicates the sequence numbers in this window that have been received (out of order) and are being buffered for returning to the upper layer. This buffering is required in order to deliver packets in the correct order to the upper layer. Another boolean array nakd is used to remember the sequence numbers that have recently been negatively acknowledged. As in the case of the sender, the receiver does not explicitly buffer packets, recording only whether a message has been received from the remote, but not yet delivered to the upper layer. The protocol initialization code sets lack, rack and recseq to 0, sendseq to 1, and all entries in the arrays nakd and recbuf to false. The protocol’s main loop consists of busy waiting for one of the following events to occur, and taking appropriate actions as described: (E1): a packet arrival over the communication link (lower layer interface): the packet is first checked for header checksum errors, and silently discarded if it has a header error. Otherwise, if the piggybacked acknowledgment is for a sequence number in the sender’s active window, this is used to update rack. This subsumes the handling of explicit ack packets. If the received packet is a nak for a sequence number in the sender’s active window, the requested data packet is resent. If the received packet is a data packet, its data checksum is first verified. If the data is found corrupted, and the packet’s sequence number is in the receiver’s active window, it has not been previously received, and has not been negatively acknowledged since the previous timeout, then a nak is sent for that sequence number. If, on the other hand, the data is valid, and the packet number is the first in its active window (bears the sequence number recseq + 1), then the newly arrived packet is delivered to the upper layer. Furthermore, any later packets that have been buffered, and all of whose “predecessors” have been delivered to the upper layer, are also returned, in order, to the upper layer. At each point, recseq is appropriately incremented, thus shifting up the active window. If it is subsequently found that W/2 or more packets have been received since the last ack (implicit or explicit) was sent, an explicit ack is generated for recseq, and lack appropriately updated. If, however, the sequence number of the newly arrived data packet is not equal to recseq + 1, meaning that there are some missing sequence numbers in between, the newly arrived packet is buffered (in recbuf ), if not already received, and naks generated for all “earlier” missing packets, for which a nak has not been sent since the last timeout. (E2): a user request to send a new message (upper layer interface): The sender first checks if there is an opening in its active window (i.e., that the active window size is less than W ). If there is an opening, the new message is transmitted, after being assigned the next new sequence number (sendseq), and the sender’s active window’s “upper edge” suitably adjusted. If, however, the sender’s window is full, it must wait for an opening (created by the receipt of an ack, see above), before it can send the new message. In this case, it busy-waits in a loop, waiting for 2

Henceforth, unless explicitly specified otherwise, we shall assume that all arithmetic is modulo SEQ.

82

Yifei Dong et al.

the arrival of a new packet (see (E1) above), or for the occurrence of a timeout (see (E3) below). (E3): a timeout: The nakd buffer is first cleared, signaling that fresh naks may need to be sent out. If there is no packet in the receive buffer (from the lower interface), then the receiver sends a nak for the “earliest” missing sequence number (recseq + 1) in its active window. Further, the sender resends the “oldest” message (if one exists in its active window), for which it has not received an acknowledgment from the remote. If, on the other hand, there is a packet available from the lower interface, we follow (E1) above. Our model of the i-protocol was derived from the C-code of the implementation, and involved a number of abstractions aimed at reducing the protocol’s state space. One such abstraction reduces the message sequence space from a fixed value of SEQ = 32 (a defined constant in the GNU implementation) to the value 2W when using a window size of W . Indeed, with a sequence space of SEQ = 32, a system consisting of just the receiver half of the protocol on one side and the sender half of the protocol on the other, connected by a single-buffer communication medium in either direction, would have an estimated state space of about 2.7 × 1014 , even with a window size of 1. In actuality, though, many of these configurations are observationally equivalent [Mil89] to one another, and by using a sequence space of 2W , this number can be reduced. For instance, for the case W = 1, the estimated state space shrinks dramatically to about 1.6×107 , a reduction by almost a factor of 107 . Figure 1 shows how the i-protocol is modeled, namely as an asynchronous system of four processes, a sender, a receiver, and two medium units SR and RS. The medium units are modeled, in the usual manner, as lossy FIFO buffers. The packets sent over the medium can be data, ack or nak packets. Each packet has a data and header checksum field, which are nondeterministically reset by the medium to model corruption of the data or header.

S e n d e r

R e c e iv e r S R

m e d -o u t

in

o u t

u sr-se n d

m e d -in

m e d -in u se r-re c v

in

o u t R S

Fig. 1: The system verified.

m e d -o u t

Fighting Livelock in the i-Protocol: A Comparative Study

83

The sender and receiver processes contain local variables corresponding to the data structures described above for the sender and receiver halves. These processes, as modeled in the Concurrency Factory and Spin, can be regarded as direct translations of the pseudo-code discussed above. This is possible since the Factory and Spin are designed to work for asynchronous systems, and their input languages provide data structures, complex control statements and typed communication channels. Murϕ and XMC are also designed for verifying asynchronous systems, but modeling the i-protocol in these tools requires more effort: in Murϕ the entire transition system of the i-protocol has to be encoded, while in XMC it has to be encoded as a set of CCS-like expressions. The modeling of the i-protocol in COSPAN and SMV requires yet the most effort, as the input to these tools are similar to finite state machines. Also, they are designed for the verification of synchronous systems, with extensions for asynchronous systems. Once the i-protocol has been modeled in each tool, various properties of the protocol can be checked, including deadlock-freedom, eventual message delivery, and livelock-freedom. In this paper, however, we will only present data relevant to livelock detection.

4

Livelock Error

The livelock error detected first using the Concurrency Factory, and subsequently using COSPAN, Murϕ, SMV, Spin and XMC, is illustrated in Figure 2 for the case of W = 2, medium buffer capacity 1, and assuming that one side acts as sender and the other as receiver. Initially, data1 sent by the sender is successfully received by the receiver, which responds with ack1. This ack is dropped by the medium. The sender then sends data2, which is also lost. The sender then enters its timeout procedure, and sends nak1 and resends data1. These (and all subsequent packets) are correctly delivered by the medium. Meanwhile, the receiver also times out, but finding the messages, nak1, data1, in its receive buffer, processes them. However, it silently ignores nak1, since it has never sent a data packet with sequence number 1. It also ignores data1, since 1 is not in its current receive window. This cycle can now repeat forever, with the sender sending messages to the receiver, which the receiver ignores, resulting in no messages being accepted from, or delivered to, the upper layer in spite of the medium behaving perfectly from this point onwards. The livelock error arises because there is no flow of information from the receiver to the sender regarding the sequence numbers up to which the receiver has received all messages. A simple fix for this problem consists of sending an up-to-date ack, on the receipt of a nak for sequence number sendseq, provided that the active send window is empty. With this fix the model checker was unable to find any livelocks in the protocol.

84

Yifei Dong et al. S e n d e r

R e c e iv e r

S e n d D A T A 1

R e c e iv e D A T A 1 ; G e n e ra te A C K 1 p a c k e t d ro p p e d b y m e d iu m

S e n d D A T A 2 p a c k e t d ro p p e d T im e o u t :

T im e o u t : S e n d N A K 1 ;

R e c e iv e N A K 1 ; Ig n o re s in c e n o t in a c tiv e s e n d w in d o w

R e se n d D A T A 1

R e c e iv e D A T A 1 ; Ig n o re s in c e n o t in a c tiv e re c e iv e w in d o w

repeat portion between dotted lines

Fig. 2: An error scenario illustrating a livelock in the original version of the i-protocol.

5

Model-Checking Results

As discussed in the Introduction, the i-protocol makes for a formidable case study for verification tools, and forms the basis for an interesting comparative study. Table 1 contains the performance data obtained by applying COSPAN (version 8.15), Murϕ (version 3.0), SMV (version 2.4), Spin (version 2.9.7), and XMC to the i-protocol. Results are given for W = 1 and W = 2, with the livelock error present (~fixed) and not present (fixed), and with a medium that can only drop messages (mini) versus one that can also corrupt messages (full). All results were obtained on an SGI IP25 Challenge machine with 16 MIPS R10000 processors and 3GB of main memory. Each individual execution of a verification tool, however, was carried out on a single processor with 1.9GB of available main memory. A few comments about Table 1 are in order. On some runs, memory was exhausted before the verification effort could complete. This is indicated in the “Completed?” column. The timing figures given in the table are “wall-clock” time rather than cpu time. This makes a difference in exactly one instance, W = 2/full/fixed for XMC, where 4.7GBytes of virtual memory are used. In this case, the wall-clock time is perceptively higher than the cpu time. Some table entries are left blank. This is because the corresponding data was unavailable because the tool does not provide it (e.g., the number of transitions, in the case of SMV) or because the tool failed to terminate on the run in question. The number of states reported by SMV is the total number of reachable states. The other tools give the number of explored states. Finally, the results for the Concurrency Factory are not included in the table. Although the Factory was the tool we used to first detect and diagnose livelock

Fighting Livelock in the i-Protocol: A Comparative Study

85

Version Tool Completed? States Transitions Memory(MB) Time(min:sec) W=1 mini ~fixed COSPAN Yes 63K 204K 4.9 0:41 Murϕ Yes 3K 8K 0.1 0:01 SMV Yes 24.5M 4.0 41:52 Spin Yes 425 768 749 0:10 XMC Yes 341 571 5 0:01 W=1 mini fixed COSPAN Yes 1.5M 5.9M 116 24:21 Murϕ Yes 7K 19K 0.3 0:06 SMV Yes 27.7M 5.3 74:43 Spin Yes 322K 1M 774 0:31 XMC Yes 3K 12K 78 0:17 W=2 mini ~fixed COSPAN Yes 154K 486K 13 1:45 Murϕ Yes 45K 122K 2 0:21 SMV No Spin Yes 35K 71K 751 0:12 XMC Yes 1034 1839 11 0:02 W=2 mini fixed COSPAN Yes 11.3M 42.7M 906 619:49 Murϕ Yes 91K 240K 4 1:37 SMV No Spin Yes 1.9M 6M 905 2:28 XMC Yes 20K 74K 475 1:49 W=1 full ~fixed COSPAN Yes 116K 345K 9.1 17:03 Murϕ Yes 54K 205K 2 0:25 SMV Yes 425.3M 6.0 201:04 Spin Yes 5.2K 10.1K 749 0:11 XMC Yes 961 1521 9 0:01 W=1 full fixed COSPAN No Murϕ Yes 124K 458K 6 1:57 SMV Yes 583.3M 9.8 224:20 Spin Yes 12.6M 44.9M 1713 17:50 XMC Yes 36K 155K 1051 3:36 W=2 full ~fixed COSPAN Yes 194K 562K 15.9 29:40 Murϕ Yes 1.1M 4M 20 9:43 SMV No Spin Yes 17K 22K 750 0:17 XMC Yes 4K 7K 35 0:05 W=2 full fixed COSPAN No Murϕ Yes 2.1M 7.7M 89 41:55 SMV No Spin No XMC Yes 315K 1.33M 4708 47:15 Table 1: Model-checking results.

86

Yifei Dong et al.

in the i-protocol, and it was able to do this for both window sizes 1 and 2, its CPU time usage was in general significantly higher in comparison with the other model checkers3. This situtation should improve with the new release of the Factory, planned for June 1999. As can be gleaned from the results of Table 1, the special-purpose cycledetection algorithms of Spin and COSPAN served them well. In particular, these tools were able to complete analysis of several complex versions of the i-protocol, including W = 2/mini/~fixed, W = 2/mini/fixed, and W = 2/full/~fixed. The ability to specify atomically executed code sections in Spin also proved effective, enabling Spin to complete analysis of the W = 1/full/fixed version. Spin, however, ran out of memory for W = 2/full/fixed, despite the use of partial-order reduction and bitstate hashing (with 98% state-space coverage). SMV exhibited excellent memory-usage performance on all runs of window size 1, but failed to complete in a reasonable amount of time on any run of window size 2. This is most likely due to an exponential blowup in the BDD representation for window sizes larger than 1. The dynamic variable reordering option of SMV was used on all runs reported in Table 1. Several static variable orderings were also tried, including a “sequential” ordering in which the variables of the sender precede the variables of the sender-to-receiver medium, which precede the variables of the receiver, etc. An “interleaved” ordering, in which the components’ variables were strictly interleaved, was also attempted. In all cases, the dynamic reordering significantly outperformed the static ones. Murϕ and XMC performed the best on the i-protocol, completing on all cases of interest. Murϕ uniformly exhibited superior memory-usage behavior (over all the other tools), due in part to the low-level nature of its specification language (guarded commands) and the succinct manner it encodes system states. Murϕ was also fast. XMC, however, was faster than Murϕ for all cases in which the livelock error was present. This is because of the local, top-down nature of XMC’s model-checking algorithm (Murϕ is a global model checker). Prior experience [RRR+ 97] indicates that the space requirements of XMC can be reduced through source-level transformations aimed at optimizing the representation of process terms. Finally, the number of states/transitions explored by XMC is appreciably lower in comparison with the other systems. This is primarily due to XMC’s use of lazily evaluated logical variables to represent variables and data structures in the specification, and the fact that XMC treats sequences of pure computation steps as atomic.

6

Conclusions

We have shown how an actual bug in a real-life communications protocol can be detected and eliminated through the use of automatic verification tools supporting model checking. We have also tried to demonstrate the i-protocol’s ef3

For the W = 1, mini, not fixed version of i-protocol, the Factory took 70 minutes and 41MB memory to detect the livelock. For W = 2, mini, not fixed, the Factory required 349 minutes and 118MB.

Fighting Livelock in the i-Protocol: A Comparative Study

87

fectiveness as a verification-tool benchmark by conducting a comparative study of the performance of six widely used verification tools in analyzing the original and livelock-free versions of the protocol. Pertinent future work includes recruiting the actual developers of the model checkers used in this study to encode and analyze the i-protocol. We expect that the performance of each tool will increase under these conditions and it would be interesting to learn what “tricks” the developers employ to attain this improvement. For completeness, other properties of the i-protocol should be checked besides the absence of livelock, such as deadlock-freedom and eventual message delivery. It would be particularly interesting to apply a tool with deductive reasoning capabilities, such as PVS [ORR+ 96], to the i-protocol, so that a parameterized version of the protocol (window size, buffer size, etc.) could be analyzed. Finally, we invite developers of verification tools besides those considered in this case study to try their hand at the i-protocol and report the results to us for posting on the i-protocol web site. This will assist protocol developers and other software engineers interested in pursuing automated verification to make an educated decision about which tool is right for the task at hand.

References AH96.

R. Alur and T. A. Henzinger, editors. Computer Aided Verification (CAV ’96), volume 1102 of Lecture Notes in Computer Science, New Brunswick, New Jersey, July 1996. Springer-Verlag. CCA96. A. T. Chamillard, L. A. Clarke, and G. S. Avrunin. Experimental design for comparing static concurrency analysis techniques. Technical Report 96-084, Computer Science Department, University of Massachusetts at Amherst, 1996. CGP99. E. M. Clarke, O. Grumberg, and D. Peled. Model Checking. MIT Press, 1999. To appear. CLSS96. R. Cleaveland, P. M. Lewis, S. A. Smolka, and O. Sokolsky. The Concurrency Factory: A development environment for concurrent systems. In Alur and Henzinger [AH96], pages 398–401. CM88. K. M. Chandy and J. Misra. Parallel Program Design — A Foundation. Addison-Wesley, 1988. CMCHG96. E. M. Clarke, K. McMillan, S. Campos, and V. Hartonas-GarmHausen. Symbolic model checking. In Alur and Henzinger [AH96], pages 419–422. Cor96. J. C. Corbett. Evaluating deadlock detection methods for concurrent software. IEEE Transactions on Software Engineering, 22(3):161–180, March 1996. CW96. E. M. Clarke and J. M. Wing. Formal methods: State of the art and future directions. ACM Computing Surveys, 28(4es), December 1996. Dil96. D. L. Dill. The Murϕ verification system. In Alur and Henzinger [AH96], pages 390–393. HHK96. R. H. Hardin, Z. Har’El, and R. P. Kurshan. COSPAN. In Alur and Henzinger [AH96], pages 423–427. HP96. G. J. Holzmann and D. Peled. The state of SPIN. In Alur and Henzinger [AH96], pages 385–389.

88

Yifei Dong et al.

JGS93. Mil89. ORR+ 96.

RRR+ 97.

RS97.

Wol86.

XSB97.

N. D. Jones, C. K. Gomard, and P. Sestoft. Partial Evaluation and Automatic Program Generation. Prentice Hall, 1993. R. Milner. Communication and Concurrency. International Series in Computer Science. Prentice Hall, 1989. S. Owre, S. Rajan, J. M. Rushby, N. Shankar, and M. Srivas. PVS: Combining specification, proof checking, and model checking. In Alur and Henzinger [AH96], pages 411–414. Y. S. Ramakrishna, C. R. Ramakrishnan, I. V. Ramakrishnan, S. A. Smolka, T. W. Swift, and D. S. Warren. Efficient model checking using tabled resolution. In Proceedings of the 9th International Conference on Computer-Aided Verification (CAV ’97), volume 1254 of Lecture Notes in Computer Science, pages 143–154, Haifa, Israel, July 1997. SpringerVerlag. Y. S. Ramakrishna and S. A. Smolka. Partial-order reduction in the weak modal mu-calculus. In A. Mazurkiewicz and J. Winkowski, editors, Proceedings of the Eighth International Conference on Concurrency Theory (CONCUR ’97), volume 1243 of Lecture Notes in Computer Science, pages 5–24, Warsaw, Poland, July 1997. Springer-Verlag. P. Wolper. Expressing interesting properties of programs in propositional temporal logic. In Proc. 13th ACM Symp. on Principles of Programming Languages, pages 184–192, St. Petersburgh, January 1986. XSB. The XSB logic programming system v1.7, 1997. Available by anonymous ftp from ftp.cs.sunysb.edu.

10.1007/b107031130006

Proving the Soundness of a Java Bytecode Verifier Specification in Isabelle/HOL

Cornelia Pusch Institut f¨ ur Informatik, Technische Universit¨ at M¨ unchen

80290 M¨ unchen, Germany http://www.in.tum.de/~pusch/

Abstract. Compiled Java programs may be downloaded from the World Wide Web and be executed on any host platform that implements the Java Virtual Machine (JVM). However, in general it is impossible to check the origin of the code and trust in its correctness. Therefore standard implementations of the JVM contain a bytecode verifier that statically checks several security constraints before execution of the code. We have formalized large parts of the JVM, covering the central parts of object orientation, within the theorem prover Isabelle/HOL. We have then formalized a specification for a Java bytecode verifier and formally proved its soundness. While a similar proof done with paper and pencil turned out to be incomplete, using a theorem prover like Isabelle/HOL guarantees a maximum amount of reliability.

1

Introduction

The Java Virtual Machine (JVM) is an abstract machine consisting of a memory architecture and an instruction set. It is part of the Java language design developed by Sun Microsystems and serves as a basis for Java implementations. However, it also can be used as intermediate platform for other programming languages, since the JVM works independently of Java. The corresponding compiler then generates architecture-independent JVM code instead of machine code for a specific host platform. This approach allows execution of compiled JVM code on any host platform that implements the JVM. However, this advantage does not come without risks. One can download any JVM code from the World Wide Web, and in general it is impossible to check the origin of the code and trust in its correctness. The Java Virtual Machine Specification (short JVMS) [LY96] describes a set of static and structural constraints that must hold for the code to assure safe execution, and requires that the JVM itself verifies that these constraints hold. However, this is not a formal specification, and it is in the nature of informal descriptions to contain ambiguities or even inconsistencies. Our goal is to give a fully formal specification of the JVM and a bytecode verifier that overcomes 

Research supported by DFG project Bali.

W.R. Cleaveland (Ed.): TACAS/ETAPS’99, LNCS 1579, pp. 89–103, 1999. c Springer-Verlag Berlin Heidelberg 1999 

90

Cornelia Pusch

this problem. We think that this work can be useful in several aspects: on the one hand it allows the formal investigation of central concepts of the JVM, such as the correctness of the bytecode verifier and compiler verification; on the other hand it may serve as reference specification that is more accurate than the informal description. Formalizing a real life programming language is a very complex task and it is likely that an approach done with paper and pencil also will be susceptible to more or less grave errors. Therefore, tool assistance is required to reach a maximum amount of reliability. A theorem prover like Isabelle/HOL [Pau94, Isa] offers valuable support in developing consistent specifications and correct proofs. To avoid the execution of incorrect JVM code, several verification strategies for JVM code may be used, for example: - Cohen [Coh97] has implemented a so called defensive JVM using the theorem prover ACL2. In this approach runtime checks are performed to guarantee a type-safe execution of the code. - The JVMS [LY96] describes Sun’s implementation of a bytecode verifier, where most of the type-checking is done statically but several parts are delayed until runtime. - Qian [Qia98] has developed a specification for an extended bytecode verifier, where all type-checking is done statically. The specification of a bytecode verifier in Isabelle/HOL presented in this paper follows Qian’s work. However, our formalization of the operational semantics [Pus98] has been done independently of Qian’s approach. Therefore we had to deviate from Qian’s work in several points to make it fit to our approach. There are several other approaches to formalize (parts of) the JVM (see [Ber97, FM98, Gol97, HBL98, SA98]). As far as we know, our work is the first to formally prove the soundness of a bytecode verifier using a theorem prover. The rest of the paper is organized as follows: section 2 briefly introduces Isabelle/HOL. Section 3 describes our formalization of the JVM, in particular the representation of runtime data and the definition of an operational semantics for the JVM instructions. In section 4 we introduce the notion of static welltypedness and give a formal specification for a bytecode verifier. Section 5 defines the notion of soundness for a bytecode verifier and sketches the corresponding soundness proof. In section 6 we discuss two extensions we have added to the specification, and section 7 summarizes our results and outlines future work.

2

Isabelle/HOL

Isabelle [Pau94, Isa] is a generic theorem prover that can be instantiated with different object logics. The formalization and proofs described in this paper are based on the instantiation for Higher Order Logic, called Isabelle/HOL. Subsequently we give an overview over the basic types and functions used in this paper.

Proving the Soundness of a Java Bytecode Verifier Specification

91

Isabelle’s type system is very similar to that of ML, with slight syntactic differences: function types are denoted by τ 1 ⇒ τ 2 , where τ 1 ⇒ τ 2 ⇒ . . . ⇒ τ n may be abbreviated as [τ 1 ,τ 2 ,. . .] ⇒ τ n . Product types are written as α × β × γ . Functions are preferably defined in a curried style (i.e. f a b c). Occasionally we have to define uncurried functions f (a, b, c); this is due to restrictions of Isabelle’s package for well-founded recursive functions. The basic types bool, nat and int are predefined. Isabelle/HOL also offers the polymorphic types α set (with the usual set operators) and α list. The list constructors are [] (‘nil’) and x#xs (‘cons’). The functions hd xs and tl xs return the head and tail of a list. The i-th list element is written xs ! i, length xs computes the length of a list, and set xs converts a list into a (finite) set. We also have map f xs to apply a function to all elements of a list, and zip xs ys takes two lists and returns a list of pairs. Inductive datatypes can be defined by enumerating their constructors together with their argument types. For example, the predefined datatype for optional values looks as follows: α option = None | Some α

In Isabelle/HOL, all functions are total. Partiality can be modeled using the predefined ‘map’ type which is defined as follows: α

β = (α ⇒ β option)

We use the infix operator !! of type [α β,α] ⇒ β for ‘partial’ function application. Whenever f x = Some y then f !! x = y. In the case of None the result will be an unknown value arbitrary, defined as εx. False (where ε is Hilbert’s description operator). Throughout this paper, we write logical constants in sans serif, whereas variables and types appear in italic.

3

The Java Virtual Machine

JVM code is stored in so called classfiles. If the code is produced by compilation of a Java program, each Java class is translated into a separate classfile. Similar to Java classes, a JVM classfile contains information about inheritance and implementation relations, as well as field and method definitions. Method code consists of a sequence of JVM instructions (bytecode). The machine model of the JVM has different memory areas for runtime data: a heap stores runtime objects and a frame stack contains state information for each active method invocation. Each method frame has its own operand stack and local variables array. Similar to Java, the JVM has an exception mechanism to treat error conditions. In our formalization, we consider a set of predefined exceptions, but do not yet treat exception handling. We have formalized large parts of the JVM, including the classfile structure and the operational semantics for a subset of JVM instructions covering the central parts of object orientation. Due to lack of space, we cannot present the entire formalization that can be found in [Pus98, NOP]. However, we introduce the main ideas of our approach.

92

3.1

Cornelia Pusch

JVM classfiles

The first component of a classfile consists of the constant pool, a kind of symbol table containing name and type information. This is followed by a flag indicating whether the classfile describes an interface or a class, several pointers to constant pool entries returning the names of the current class, its superclass and direct superinterfaces, and finally the field and method definitions: α classfile = cpool × iflag × idx × idx × idx list × fields × α methods

The type for methods is parameterized over the type of the method code, which may be instantiated later. This allows us to formalize the JVM instruction set and its operational semantics in a modular way. A predicate wf classfiles checks the well-formedness of classfiles, e.g. the superclass and superinterface relations must be acyclic and method overriding must obey certain type restrictions. Example: Consider a set of classfiles (see figure 1) consisting of class Object, as well as the classes C0, C1, C2, and Q. C0 and Q are direct subclasses of Object; C1 and C2 are both extensions of C0. Class C0 contains an integer field f0, class Q contains a method m.

 PPPP PP     HHH    H  Object

C0 : f

C1

Q:m



C2

Fig. 1. Example class hierarchy

Figure 2 shows the contents of classfile Q. The interface flag is set to False, cpool index 1 points to the name of class Q. This information extends over two entries: the keyword Class indicates the entry type, index 9 points then to another entry containing the string Q (with keyword Utf8). The superclass index points in the same way to class name Object. The description of method m contains again two pointers. The first one returns name m, the second one points to a type descriptor. In our case, method m gets two arguments of type C1 and C2 and returns an integer. The code section m code will be shown later. 3.2

JVM Runtime Data

The JVM operates on two different types of values, primitive values and reference values. We consider only primitive values, of type integer. The reference values are pointers to objects, the null pointer is expressed by a special null reference. The realization of object references is kept abstract: we model them by an opaque type loc that is not further specified. We define a datatype for JVM values as follows:

Proving the Soundness of a Java Bytecode Verifier Specification

cpool iflag idxclass idxsuper idxinter fields methods

cpool False 1 2 [] [] (7, 10, m code)

1 2 .. . 7 8 9 10 .. .

93

cpool Class 9 Class 8 .. . Utf8 Utf8 Utf8 Utf8

m Object Q ([L C1,L C2],I)

.. .

Fig. 2. Classfile for Q

val = Intg int | Addr loc | Null

You may have noticed that in contrast to our formalization, the JVMS [LY96] does not require values to be tagged with their runtime types. However, our approach does not impose any restrictions on possible implementations, because the type information is not used to determine the operational semantics of (correct) JVM code. We use the type tags only to state and prove the correctness of the bytecode verifier, where the runtime types are checked against the static type information.

3.3

Operational Semantics of JVM Instructions

The JVMS [LY96] describes the operational semantics for each instruction in the context of a JVM state where several constraints hold, e.g. there must be an appropriate number of arguments on the operand stack, or the operands must be of a certain type. If the constraints are not satisfied, the behaviour of the JVM is undefined. In our approach, we formalize the behaviour of JVM instructions with total functions. If a state does not satisfy the constraints of the current instruction, e.g. if an element should be popped from an empty operand stack, the result will be the unknown value arbitrary. We have structured the instructions into several groups of related instructions, describing each by its own execution function. This makes the operational semantics easier to understand, since every function only works on the parameters that are needed for the corresponding group of instructions: instr = LAS load and store | CO create object | MO manipulate object | MA manipulate array | CH check object | MI meth inv | MR meth ret | OS op stack | CB cond branch | UB uncond branch

94

Cornelia Pusch

Now, we can instantiate the type parameter for the code section of a classfile and introduce the following type abbreviation, describing a partial mapping from class names to classfiles:1 classfiles = ident

(instr list) classfile

Example: The code of method m is shown in figure 3. Aload i loads the content of local variable i onto the operand stack. Ifnull 3 compares the top operand stack element against Null and performs a conditional jump to pc = pc +3. Goto 2 performs an unconditional jump to pc = pc +2. Getfield 4 loads a field described at cpool entry 4 onto the operand stack (which is in our example integer field f0). Finally, Ireturn closes the current method invocation and returns the integer result to the calling method. pc 0 1 2 3 4 5 6

instr Aload 1 Ifnull 3 Aload 1 Goto 2 Aload 2 Getfield 4 Ireturn

Fig. 3. Code of method m Execution of a JVM instruction transforms the machine state. The machine state is formalized as a triple consisting of an exception flag, an object heap, and a frame stack. For each active method invocation, there exists a frame containing its own operand stack, a list of local variables, the name of the current class, a reference to the current method, and the program counter: frame jvm state

= opstack × locvars × ident × method loc × pc = xcpt option × heap × frame list

If an exception has been raised or the frame stack is empty, execution terminates.2 If the machine has not yet reached a final state, the function exec performs a single execution step: it calls an appropriate execution function (e.g. exec mo) and incorporates the result in the new machine state. If execution has reached a final state, exec does not return a new state. This is modeled by embedding the result state in an option type: exec :: classfiles × jvm state ⇒ jvm state option exec (CFS, (Some xp, hp, frs)) = None exec (CFS, (None, hp, [])) = None exec (CFS, (None, hp, (stk,loc,cn,ml,pc)#frs)) = case (get code CFS cn ml) ! pc of MO ins ⇒ Some ( . . . exec mo . . .) | . . . 1

2

We have abstracted from the size of instructions and regard the code section as a list of instructions. We do not yet treat exception handling.

Proving the Soundness of a Java Bytecode Verifier Specification

95

For example, the operational semantics of the Getfield instruction for object field access looks like this: exec mo :: [manipulate object,classfiles,cpool,heap,opstack,pc] ⇒ (xcpt option × heap × opstack × pc) exec mo (Getfield idx) CFS cp hp stk pc = let oref = hd stk; (cn,od) = get Obj (hp !! (get Addr oref)); (fc,fn,fd) = extract Fieldref cp idx; xp’ = if oref=Null then Some NullPointer else None in (xp’ , hp , (od !! (fc,fn))#(tl stk) , pc +1) CFS denotes a set of JVM classfiles. The operand stack stk is supposed to contain a reference to a class instance stored on the heap hp. In case of a null reference an exception is thrown. Otherwise, the referenced object contains class name cn and object data od. Index idx should point to a Fieldref entry in the constant pool cp, containing a class name fc, a field name fn and a field descriptor fd. The tuple (fc,fn) determines the field whose value is stored on the operand stack. Finally, the program counter pc is incremented. Execution of the entire code then consists of repeated application of exec as long as the result is not None. The relation CFS σ −→∗ σ’ maps a given set of classfiles CFS and a JVM state σ to a new state σ’, where the pair (σ,σ’) is in the reflexive transitive closure of successful execution steps:

−→∗

:: [classfiles,jvm state,jvm state] ⇒ bool def ∗ CFS σ −→ σ’ = (σ,σ’) ∈ {(s,t). exec (CFS,s) = Some t}∗

4

A Specification for a Bytecode Verifier

Standard implementations of the JVM contain a bytecode verifier that statically checks several security constraints before execution of the code. One main aspect of the bytecode verifier is to statically derive the types of possible runtime data and check that all instructions will get arguments of the correct type. 4.1

Static types

As Qian has pointed out in his work [Qia98], the attempt to statically type-check JVM code requires the introduction of reference type sets instead of single types. This is due to the fact that, as a result of a branching instruction, a program point may have multiple preceeding program points. These predecessor points are allowed to contain values of different types.3 In this case, the types of the 3

Surprisingly, the typing rule for the similar working conditional expression of the Java source language turns out to be more restricted (see [GJS96] and the discussion at [Typ]): it requires that the two branches yield two types where the first is a supertype of the second or vice versa.

96

Cornelia Pusch

two branches have to be merged to the first common supertype. However, the JVM allows multiple inheritance of interfaces, and therefore this supertype is not necessarily unique. Qian defines a static type system including types representing adresses of subroutine calls and uninitialized objects. We do not yet consider these aspects of the JVM, but have added array types. Static types are represented as values of datatype tys. Among the primitive types, we only consider type Integer. A reference type is either the type of the null reference (NT), or an interface or class name (IT id or CT id), or an array type (AT ts, where ts contains the type of the components of the array). A static type consists then either of a primitive type or a list of reference types.4 During bytecode verification, type information of different execution paths has to be merged. In case of incompatible types, the result becomes unusable. This is expressed by a value of type any, which is either a static type or Unusable. The return type of methods is denoted by a value of type tyOrVoid, which is either a static type or Void: prim ref tys any tyOrVoid

= Integer = NT | IT ident | CT ident | AT tys = PTS prim | RTS (ref list) = Unusable | US tys = Void | TY tys

We abbreviate US (PTS p) and US (RTS r) by Prim p and Refs r. If two types are merged, the resulting supertype must cover both types. A type a covers a type a’ (written CFS a  a’), if any instruction that is applicable to all values of type a is also applicable to all values of type a’. The predicate holds in the following cases:

 :: [classfiles,any,any] ⇒ bool CFS Unusable  a’ CFS Prim Integer  Prim Integer CFS Refs rs  Refs rs’ = (∀r’∈set rs’. ∃r∈set rs. widenConv CFS r’ r)

Qian gives a more restrictive definition identifying the covering of reference types with the superset relation. In our definition, an element of the subtype needs not be contained in the supertype, it just must be convertible to one of its elements. A state type contains type information for all local variables and the operand stack of the current invocation frame at a certain program point. The local variables may contain unusable values (as a result of merging two incompatible types), whereas only usable values may be stored on the operand stack. We extend the predicate  in two steps to state types: state type = tys list × any list



:: [classfiles,any list,any list] ⇒ bool def

CFS as  as’ = length as = length as’ ∧ ∀(a,a’)∈ set (zip as as’). CFS a  a’ 4

Due to restrictions to the construction of inductive datatypes, we model reference type sets as lists.

Proving the Soundness of a Java Bytecode Verifier Specification



97

:: [classfiles,state type,state type] ⇒ bool def

CFS (ST,LT)  (ST’,LT’) = CFS map US ST  map US ST’ ∧ CFS LT  LT’

Type information for the entire code of a method is collected in a value of method type. A value of class type maps a method reference to a value of method type, and a value of program type maps a class name to a value of class type: method type = state type list class type = method loc ⇒ method type prog type = ident ⇒ class type

4.2

Static Well-typedness

A bytecode verifier has to infer type information for each instruction and then check if the method code is well-typed. In our specification, well-typedness is checked with respect to a given type. A correct implementation of that specification must then compute a type that is well-typed according to the specification. We define a type checking predicate that checks whether an instruction at a certain program point is well-typed with respect to a given method type. Additionally, it checks several other constraints, e.g. an index to local variables must not be greater than the number of local variables and the program counter must remain within the current method. These constraints are indispensable to carry out the soundness proof for the bytecode verifier. The type-checking predicate makes a case distinction over the instruction to be executed at the current program point. In case of Getfield, the instruction is well-typed if the following predicate holds: wt MO :: [manipulate object,classfiles,cpool,method type,pc,pc] ⇒ bool wt MO (Getfield idx) CFS cp Δ maxpc pc = let (ST,LT) = Δ ! pc; (fc,fn,fd) = extract Fieldref cp idx in pc +1 < maxpc ∧ is class CFS fc ∧ get fields (CFS !! fc) (fc,fn) = Some fd ∧ ∃rs ST’. ST = (RTS rs) # ST’ ∧ widenConv CFS rs [CT fc] ∧ CFS Δ ! (pc +1)  (fd # ST’ , LT)

All well-typedness predicates contain a line of the form CFS Δ ! (pc +1)  type, which means that the next instruction expects a type according to type. Since that next instruction has possibly other predecessors, its type information is not necessarily equal to new type, but rather must cover it. The above predicate enforces that the incremented program counter pc +1 does not exceed the code length maxpc . The class fc must be defined and must contain a field with name fn according to the constant pool entry. The stack must not be empty and the top stack element must contain a reference type convertible to the type of fc. Finally, the next instruction must expect a type according to the field descriptor fd on top of the operand stack.

98

Cornelia Pusch

Similarly to the execution function exec, we define a predicate wt instr that selects the appropriate well-typedness predicate for each group of instructions. We extend the notion of well-typedness to methods, classes, and programs: at the beginning of a method body, the operand stack must be empty, and the local variables must contain values according to the type of the current class cn and the parameter descriptor pd of the current method: wt start :: [classfiles,ident,param desc,method type] ⇒ bool def

wt start CFS cn pd Δ = CFS Δ ! 0  ([],(Refs [CT cn])#(map (fd2any CFS) pd))

The code array of a method must not be empty, i.e. its length must be greater than zero. A method is well-typed with respect to a method type Δ, if it is well-typed at the beginning of the method body, and if for every program point in the method body the instruction is well-typed: wt method :: [classfiles,ident,param desc,return desc,instr list,method type] ⇒ bool def

wt method CFS cn pd rd ins Δ = let cp = get cpool (CFS !! cn); maxpc = length ins in 0 < maxpc ∧ wt start CFS cn pd Δ ∧ ∀ pc. pc ...... | (ECast, Unrel) . -> ...... . . | ) (s bottom, Fqueue.empty)

where ‘......’ indicates that details of the code are temporarily hidden from the display. We now call UseHyp 1, which leads to an evaluation of the first case of the case expression and eliminates all the other cases from the code.  if s bottom.all alive or (not (s bottom.failed.(getPeer ev))) then (s bottom, Fqueue.add UpM(ev, hdr) Fqueue.empty) else free name ev

Next, we use the assumption s bottom.failed.(getPeer ev) = false and evaluate of the first case of the conditional by calling UseHyps 2. This results in  (s bottom, Fqueue.add UpM(ev,hdr) Fqueue.empty)

110

Christoph Kreitz

No further reductions are meaningful, as the resulting state s bottom and the queue of outgoing events, a queue containing the single event UpM(ev,hdr), are explicitly stated. Under the the given assumptions we know now hdlrb (s bottom, UpM(ev, Full(NoHdr,hdr)))

=

(s bottom,[:UpM(ev,hdr):])

where hdlrb denotes the event handler of the bottom layer and [:UpM(ev,hdr):] abbreviates Fqueue.add UpM(ev,hdr) Fqueue.empty. This means that the state of the layer remains unchanged while the original message is passed to the next layer after the header NoHdr has been stripped off.

Verifying a reconfiguration. A fast-track reconfiguration in NuPRL is more than just a syntactical transformation of program code. Since it is based entirely on substitution, evaluation, and verified laws, we know that under the given assumptions a reconfigured program is equivalent to the original one. But in order to guarantee the reliability of a reconfigured communication system we must provide a formal proof of this equivalence. Formally, we have to prove let (sinit ,hdlr) = convert Functional l args (ls, vs) in = (sl , [:out-events:])

hdlr(sl , event)

where the left equand is the starting point of a reconfiguration and the right equand its final result, consisting of a modified state sl and a queue of outgoing events [:out-events:]. Again we introduce a formal abbreviation: RECONFIGURE LAYER l FOR EVENT event AND STATE sl ASSUMING assumptions YIELDS EVENTS [:out-events:] AND STATE sl

Fortunately, there is a close correspondence between our reconfiguration mechanisms and the logical inference rules of the NuPRL proof development system. It is easy to write proof tactics that perform exactly the same steps on the left hand side of an equation as our reconfiguration tactics Red, UseHyps, and RedLayerStructure did on the code of the protocol layer. We can therefore consider the trace of a reconfiguration as plan for the equivalence proof and transform each reconfiguration step into the corresponding proof step. This makes it possible to prove the equivalence theorem completely automatically – even in cases where the reconfiguration required considerable user interaction. We have written a tactic CreateReconfVerify, which states the equivalence theorem and proves it to be correct by replaying the derivation of the reconfigured code. Since the tactic is guaranteed to succeed, it runs as a background process after a reconfiguration has been finished.

4

Theorem-based Protocol Stack Reconfiguration

In contrast to individual layers, protocol stacks have no a priori implementation but are defined according to the demands of the application system. As there are thousands of possible configurations, a designer of an application system who uses a group communication toolkit must also be given a tool that creates a fast-track reconfiguration of the application system automatically. It is easy to see that tactic-based rewrite techniques are not appropriate for this purpose, as they require interaction and expertise about the code of the layers and of the mechanism for composing layers. Furthermore they do not scale

Automated Fast-Track Reconfiguration of Group Communication Systems

111

R e c o n fig u r a tio n T h e o r e m s

C O D E U p /S e n d

U p /C a s t

D n /S e n d

D n /C a s t

R e c o n fig u re C o m m o n C a se

V e rify S im p le C o m p o s itio n s C o m p o se fu n c tio n T o p L a y e r L a y e r L a y e r L a y e r L a y e r L a y e r B o tto m

L a y e r

A p p lic a tio n S ta c k

Fig. 3. Reconfiguration methodology: composing reconfiguration theorems up very well: since messages may create additional events on their path through a protocol stack the reconfiguration tactics would have to deal with the entire code of the stack at once, which means that each rewrite step must operate on extremely large terms (representing more that 10000 lines of code). On the other hand, a fast-path through a protocol stack is characterized by the fact that events pass through the stack without generating more than one or two additional events. Thus it is possible to derive the result of passing a common event through a protocol stack from already known reconfiguration results for the individual protocol layers: instead of having to symbolically evaluate the complete code from scratch we compose the individual reconfiguration results according to our knowledge about the code for layer composition. Technically, we do this by composing formal theorems, as illustrated in Figure 3. – For each protocol layer we prove reconfiguration theorems about the result of reconfiguring its code for the most common types of events, i.e. up- and down-going send- and broadcast messages. Since these theorems only depend on the implementation of the protocol layers but not on the particular application system, they can be proven once and for all and be included in the distribution of the communication toolkit. For Ensemble we use the equivalence theorems that are generated automatically after finishing the reconfiguration of a layer, as discussed in section 3 – For composing fast-paths through individual layers into a fast-path through a protocol stack we prove composition theorems about common combinations of fast-paths, such as linear traces (where an event passes through a layer), bouncing events, and messages that cause several events to be emitted from a

112

Christoph Kreitz THM ComposeDnLinear RECONFIGURING LAYER Upper FOR EVENT DnM(ev, hdr) AND YIELDS EVENTS [:DnM(ev, hdr1):] AND ∧ RECONFIGURING LAYER Lower FOR EVENT DnM(ev, hdr1) AND YIELDS EVENTS [:DnM(ev, hdr2):] AND ⇒ RECONFIGURING LAYER Upper ||| Lower FOR EVENT DnM(ev, hdr) YIELDS EVENTS [:DnM(ev, hdr2):]

STATE s up STATE s1 up STATE s low STATE s1 low AND STATE (s up, s low) AND STATE (s1 up, s1 low)

Fig. 4. Reconfiguration theorem for linear down traces layer (splitting) – both for up- and down-going events. While the statements of these theorems often appear trivial, their proofs are rather complex as we have to reason about the actual code of layer composition and to perform all steps that would usually occur during a reconfiguration. By proving the composition theorems we express the logical laws of layer composition as derived inference rules and remove a significant deductive burden from the reconfiguration process: reconfiguring composed protocol layers can now be done by theorem application in a single inference step where a tactic-based reconfiguration would have to execute hundreds of elementary steps. Figure 4 presents a reconfiguration theorem for composing down-going linear traces in Ensemble. Assuming that a down-going event through the layers Upper and Lower yields a queue consisting of a single down-event and possibly modifies the state of these layers, we prove that sending the event through the composed stack Upper ||| Lower (where ||| is Ensemble’s composition function) does the obvious: states will be updated independently while the event is first modified by the upper layer and then by the lower layer. – Using the above theorems we can generate and prove reconfiguration theorems for a given protocol stack . To create the statement of such a theorem we consult the theorems about layer reconfigurations for the corresponding events and compose them as described by the composition theorems. Starting with the top of the stack we match incoming and outgoing events of the theorems for adjacent layers to determine the structure of the event that must enter the stack and the result of passing it through the stack. The states of the layers will be composed into tuples of states and the assumptions will be accumulated by conjunctions. To prove the stack reconfiguration theorem we use the information that we had gained while stating it. We instantiate the reconfiguration theorems of the layers in the stack with the actual event that will enter them. We then apply step by step the appropriate composition theorems to compose the fast-paths through the stack until the result is identical to the original statement of the theorem. Both proof steps are very easy to implement as they only require us to apply instantiated versions of already proven theorems. For Ensemble we have developed a tactic CreateReconfiguredStack that, given a list of layer names, generates the reconfiguration theorem, proves it correct, and stores it under a unique name. Since all of these steps are completely automated the tactic does not require any user interaction but can instead integrated into Ensemble’s configurator. – From the logical reconfiguration theorems we finally generate Ocaml code for a modified protocol stack that can be used to replace the original stack.

Automated Fast-Track Reconfiguration of Group Communication Systems

113

We will discuss code generation in Section 6 after describing how to optimize a reconfigured stack by header compression (see Section 5). Theorem-based layer composition leads not only to fully automated reconfiguration techniques but also to a much clearer style of reasoning as we raise the abstraction level of program transformations from programming language expressions to reasoning about modules. It also improves the performance of the reconfiguration process, which requires only a few steps for each protocol layer passed by an event and thus scales up very well. Finally system updates can be handled much easier: the modification of a layer’s code only requires reproving the reconfiguration theorems for this particular layer while the reconfiguration of the protocol stack will remain unaffected or is re-executed automatically. Example 2. To reconfigure the stack Pt2pt ||| Mnak ||| Bottom for outgoing send-messages, CreateReconfiguredStack consults the following reconfiguration theorems. THM Pt2ptReconfDnMESend verif RECONFIGURING LAYER Pt2pt FOR EVENT DnM(ev, hdr) AND STATE s pt2pt ASSUMING getType ev = ESend ∧ getPeer ev = ls.rank YIELDS EVENTS [:DnM(ev, Full(Data(Iq.hi s pt2pt.sends.(getPeer ev)), hdr)):] AND STATE s pt2pt[.sends.(getPeer ev) ← Iq.add s pt2pt.sends.(getPeer ev) (getIov ev) hdr] THM MnakReconfDnMESend verif RECONFIGURING LAYER Mnak FOR EVENT DnM(ev, hdr) ASSUMING getType ev = ESend YIELDS EVENTS [:DnM(ev, Full(NoHdr, hdr)):] AND STATE s mnak

AND STATE

THM BottomReconfDnMESend verif RECONFIGURING LAYER Bottom FOR EVENT DnM(ev, hdr) AND STATE ASSUMING getType ev = ESend ∧ s bottom.enabled YIELDS EVENTS [:DnM(ev, Full(NoHdr, hdr)):] AND STATE s bottom

s mnak

s bottom

Since all three layers show a linear behavior, they have to be composed in a way that makes the theorem ComposeDnLinear applicable. The incoming event of theorem Pt2ptReconfDnMESend verif describes the event that enter the three-layer stack. The outgoing event of Pt2pt is matched against the incoming event of Mnak and the variable hdr in theorem MnakReconfDnMESend verif is instantiated accordingly. Similarly, the outgoing event of Mnak will be matched against the incoming event of Bottom. The instantiated outgoing event of theorem BottomReconfDnMESend verif describes the event queue emitted by the stack Pt2pt ||| Mnak ||| Bottom. The initial and resulting states of the three (instantiated) theorems are composed into triples and the assumptions are composed by conjunction. As a result CreateReconfiguredStack creates and proves the following reconfiguration theorem. RECONFIGURING FOR EVENT AND STATE ASSUMING YIELDS EVENTS AND STATE

5

LAYER Pt2pt ||| Mnak ||| Bottom DnM(ev, hdr) (s pt2pt, s mnak, s bottom) getType ev = ESend ∧ getPeer ev = ls.rank ∧ s bottom.enabled [:DnM(ev, Full(NoHdr, Full(NoHdr, Full(Data(Iq.hi s pt2pt.sends.(getPeer ev)), hdr)):] ( s pt2pt[.sends.(getPeer ev) ← Iq.add s pt2pt.sends.(getPeer ev) (getIov ev) hdr] , s mnak , s bottom )

Header Compression

After reconfiguring a protocol stack we know exactly which headers are added to a typical data message by the sender’s stack and how the receiver’s stack processes these headers in the respective layers. A message that goes through the

114

Christoph Kreitz

THM Compress RECONFIGURING LAYER L

FOR EVENT DnM(ev, hdr) AND STATE s YIELDS EVENTS [:DnM(ev, hdr1):] AND STATE s1 ⇒ RECONFIGURING LAYER L WRAPPED WITH COMPRESSION FOR EVENT DnM(ev, hdr) AND STATE s YIELDS EVENTS [:DnM(ev, compress hdr1):] AND STATE s1 THM Expand RECONFIGURING LAYER L FOR EVENT UpM(ev, expand hdr) AND STATE s YIELDS EVENTS [:UpM(ev, hdr1):] AND STATE s1 ⇒ RECONFIGURING LAYER L WRAPPED WITH COMPRESSION FOR EVENT UpM(ev, hdr) AND STATE s YIELDS EVENTS [:UpM(ev, hdr1):] AND STATE s1

Fig. 5. Compression and expansion theorems for down/up-traces fast-path obviously does not activate many protocol layers. Consequently, most of the added headers indicate that the layer has not been active. Such information does not have to be transmitted over the net if we encode the fact that the message has gone through the fast-path. Transmitting only the relevant headers will reduce the net load and improve the overall efficiency of communication. A straightforward method for eliminating irrelevant headers from a transmitted message is to generate code for compressing and expanding headers and to insert it between the protocol stack and the net. Compression removes all the constants from a header and leaves only the information that may vary. In the stack Pt2pt ||| Mnak ||| Bottom from example 2, for instance, an outgoing send-message receives the header Full(NoHdr, Full(NoHdr, Full(Data(Iq.hi s pt2pt.sends.(getPeer ev)), hdr)))

This header contains keyword constants like Full, NoHdr, and Data that do not carry essential information. Without loss of information it can be compressed to OptSend(Iq.hi s pt2pt.sends.(getPeer ev), hdr):]

To create the code for compression and expansion, we consult the reconfiguration theorems for received common messages and look at the structure of the headers of incoming events. Compression matches a header against this pattern and generates a new header only from the free variables in the pattern while removing all the constants. Headers that do not match such a pattern will not be changed. Header expansion simply inverts compression. Both programs can be generated automatically after a reconfiguration. For the stack Pt2pt ||| Mnak ||| Bottom, for instance, we get the following two programs. let compress hdr = match hdr with Full(NoHdr, Full(NoHdr, Full(Data(seqno), hdr))) -> OptSend(seqno, hdr) | Full(NoHdr, Full(Data(seqno), Full(NoHdr, hdr))) -> OptCast(seqno, hdr) | hdr -> Normal(hdr) let expand hdr = match hdr with OptSend(seqno, hdr) -> Full(NoHdr, Full(NoHdr, Full(Data(seqno), hdr))) | OptCast(seqno, hdr) -> Full(NoHdr, Full(Data(seqno), Full(NoHdr, hdr))) | Normal(hdr) -> hdr

Header compression can easily be integrated into the reconfiguration process. For this purpose we reconfigure the code of a protocol stack after wrapping it with compression. By doing so we generate an optimized stack that directly operates on compressed messages. Again we propose a theorem-based approach: since we already know how to reconfigure a regular protocol stack we prove generic compression and expansion theorems that describe the outcome of reconfiguring a wrapped stack in terms of the results of reconfiguring the regular stack. Figure 5 presents the compression and expansion theorems for Ensemble. They describe the obvious effect of applying Ensemble’s function wrap hdr to

Automated Fast-Track Reconfiguration of Group Communication Systems

115

a stack L and functions compress and expand, which we formally abbreviate by L WRAPPED WITH COMPRESSION. Proving the theorems removes another burden from the reconfiguration process: we can now make the transition from a reconfigured ordinary stack to its wrapped version in a single inference step. Based on compression and expansion theorems a reconfiguration of wrapped protocol stacks follows the same methodology as before. To generate the statement of the reconfiguration theorem, we compose the reconfiguration theorems for its layers and then compose the result with the compression and expansion theorems. To prove it, we first insert the result of a regular fast-track reconfiguration. For outgoing messages we then transform emitted headers into the form ‘compress hdr’ and apply the theorem Compress. For received messages we transform incoming headers into ‘expand hdr’ and apply the theorem Expand. For Ensemble we have developed a tactic CreateCompressedStack that performs all these steps automatically. For outgoing send-messages through the stack Pt2pt ||| Mnak ||| Bottom (c.f. example 2) wrapped with compression, for instance, it creates and proves the following reconfiguration theorem. RECONFIGURING FOR EVENT AND STATE ASSUMING YIELDS EVENTS AND STATE

6

LAYER Pt2pt ||| Mnak ||| Bottom WRAPPED WITH COMPRESSION DnM(ev, hdr) (s pt2pt, s mnak, s bottom) getType ev = ESend ∧ getPeer ev = ls.rank ∧ s bottom.enabled [:DnM(ev,OptSend(Iq.hi s pt2pt.sends.(getPeer ev), hdr)):] ( s pt2pt[.sends.(getPeer ev) ← Iq.add s pt2pt.sends.(getPeer ev) (getIov ev) hdr] , s mnak , s bottom )

Code Generation

The reconfiguration theorems for protocol stacks describe how to handle common events in a much more efficient way. In order to use these results in a running application system we have to convert the theorems into Ocaml-code that deals with all possible cases. For this purpose we introduce a “switch” that identifies the common case and sends fast-path messages to the reconfigured code while passing all other messages to the code of the original protocol stack. To convert a reconfiguration theorem into pieces of code we transform the reconfiguration results described by them, i.e. the modified states of the protocol stack and the queue of events to be emitted, into the code that creates these results. Modified states of the form s[.f ←e] are converted into an assignment s.f if getPeer ev ls.rank & s bottom.enabled then Iq.add s pt2pt.sends.(getPeer ev) (getIov ev) hdr ; dn ev (OptSend(Iq.hi s pt2pt.sends.(getPeer ev), hdr)) else hdlr ((s pt2pt,s mnak,s bottom),event) | (DnM(ev, hdr), ECast) -> ... | (UpM(ev, OptSend(seqno, hdr)), ESend) -> ... | (UpM(ev, OptCast(seqno, hdr)), ECast) -> ... -> hdlr ((s pt2pt,s mnak,s bottom),event) | in (s,opt hdlr)

After the code for the optimized stack has been generated as a NuPRL object we prove it to be equivalent to the original stack. We then export the code into the Ocaml environment source file and compile it into executable code.

7

The Application Interface

The protocol stacking architecture depicted in figure 1, which places the application on top of the stack, is a simplified model of the real architecture of efficient communication systems. As reliable group communication has to deal with many aspects that are not related to the application, application messages should not have to pass through the complete protocol stack but only through the protocols that are necessary for handling data. Therefore Ensemble connects the application to a designated layer partial appl within the stack (see left hand side of figure 6). Protocols that deal with the management of the group, e.g. with stability, merging, leaving, changing groups, virtual synchrony, etc. reside on top of this layer and are not used by application messages. While this refined architecture improves the efficiency of Ensemble it complicates a fully formal reconfiguration of its protocol stacks, because the interaction between the partial appl layer and the application does not rely on events anymore. Instead, application messages are processed by two functions recv send and recv cast, which in turn provide a list of actions that are converted into events. From the viewpoint of communication, the application is just a part of partial appl and we have reason about the effects of recv send and recv cast to create a fast-path through partial appl. These two functions link up- and down-going events and may also initiate many new events at once.

Automated Fast-Track Reconfiguration of Group Communication Systems

117

T o p

A P P L IC A T IO N

S w itc h , M ig r a te , L e a v e , M e r g e E le c t, S u s p e c t, S ta b le , V s y n c ..

G r o u p C o m m u n ic a tio n M a n a g e m e n t P a r tia l_ a p p l

S ta n d a rd M e s s a g e C o n d itio n s

A P P L IC A T IO N

T o p S w itc h , M ig r a te , L e a v e , M e r g e E le c t, S u s p e c t, S ta b le , V s y n c ..

G r o u p C o m m u n ic a tio n M a n a g e m e n t ? S ta n d a rd N o rm a l

P a r tia l_ a p p l ? n o

y e s

M e s s a g e H a n d lin g T o ta l, C o lle c t, F r a g M flo w , P t2 P t. M n a k ......

M e s s a g e H a n d lin g

R e c o n fig u r e d C o d e

T o ta l, C o lle c t, F r a g

B o tto m

M flo w , P t2 P t. M n a k ......

B o tto m

N E T

N o rm a l S ta c k C o n d itio n s

y e s

n o ?

S ta n d a rd N o rm a l ?

N E T

Fig. 6. Stack reconfiguration including the partial appl layer Since the number of emitted events is not fixed, we cannot create theorems about the results of reconfiguring partial appl. Instead, we must directly create a reconfigured version of the code of partial appl, and apply specialized tactics to compose the resulting code with the already optimized code for the remaining stack. This leads to a transformed application stack as illustrated in figure 6: the reconfigured protocol interacts directly with the application and is very efficient. While it is comparably easy to generate the complete code of the reconfigured stack, proving it to be equivalent to the original one is more difficult. We cannot use the composition theorems from section 4 for describing the effects of composing partial appl with the rest of the stack but have to use tactics that deal specifically with this situation. This makes a verification of the reconfigured stack more time consuming than a purely theorem-based approach but does not affect the reconfiguration process itself.

8

Conclusion

We have presented a variety of formal techniques for improving the performance of modular communication systems and applied them to networked systems built with the Ensemble group communication toolkit. They provide both interactive tools for a system developer, who uses expertise about the code to improve individual protocol layers, and fully automated reconfiguration mechanisms for a user of the communication toolkit, who designs application systems. We have implemented our techniques as tactics of the NuPRL proof development system, which are based on an embedding of Ensemble’s code into NuPRL’s logical language. This guarantees the correctness of all optimizations with respect to the formal semantics of the code and enables us to use theorembased rewriting, which raises the abstraction level of program transformations from expressions of the programming language to system modules. This leads

118

Christoph Kreitz

to a much clearer style of reasoning and makes our reconfiguration techniques scale up very well. To our knowledge there is no other rigorously formal system that can reason about the complete code of realistic applications. We have used our techniques to reconfigure the 22-layer protocol stack of a running application system, which resulted in significant improvements of the stack’s performance. In the future we intend to refine our techniques and to integrate them into the distribution of the Ensemble group communication toolkit. We also plan to add further reasoning capabilities to the logical programming environment in order to verify the code of Ensemble’s protocol layers [9] and protocol stacks. For this purpose we will integrate general deductive tools – such as extended type-analysis [4], first-order theorem proving [13], and inductive proof methods [15] – and develop proof tactics that are specifically tailored to Ensemble’s code. By combining all these techniques into a single environment we expect to create a software development infrastructure for the construction of efficient and reliable group communication systems.

References 1. K. Birman. Building Secure and Reliable Network Applications. Manning Publishing Company and Prentice Hall, 1997. 2. K. Birman & R. van Renesse. Reliable Distributed Computing with the Isis Toolkit. IEEE Computer Society Press, 1994. 3. R. Constable, et. al., Implementing Mathematics with the NuPRL proof development system. Prentice Hall, 1986. 4. O. Hafızo˜ gulları & C. Kreitz. A Type-based Framework for Automatic Debugging. Technical Report, Cornell University, 1998. 5. M. Hayden. Distributed communication in ML. Technical Report TR97-1652, Cornell University, 1997. 6. The Ensemble distributed communication system. System distribution and documentation. http://www.cs.cornell.edu/Info/Projects/Ensemble 7. M. Hayden. The Ensemble System. PhD thesis, Cornell University, 1998. 8. M. Hayden & R. van Renesse. Optimizing layered communication protocols. Technical Report TR 96-1613, Cornell University, 1996. 9. J. Hickey, N. Lynch, R. van Renesse. Specifications and Proofs for Ensemble Layers. TACAS’99 . This volume 10. C. Kreitz, M. Hayden, J. Hickey. A proof environment for the development of group communication systems. CADE-15, LNAI 1421, pp. 317–332, Springer, 1998. 11. C. Kreitz. Formal reasoning about communication systems I: Embedding ML into type theory. Technical Report TR97-1637, Cornell University, 1997. 12. C. Kreitz. Formal reasoning about communication systems II: Automated FastTrack Reconfiguration. Technical Report TR98-1707, Cornell University, 1998. 13. C. Kreitz, J. Otten, S. Schmitt. Guiding Program Development Systems by a Connection Based Proof Strategy. LoPSTR-5 , LNCS 1048, pp. 137–151. Springer, 1996. 14. X. Leroy. The Objective Caml system release 1.07. Institut National de Recherche en Informatique et en Automatique, 1998. 15. B. Pientka & C. Kreitz. Instantiation of existentially quantified variables in inductive specification proofs. AISC’98, LNAI 1476, pp. 247–258, Springer, 1998. 16. R. van Renesse, K. Birman, & S. Maffeis. Horus: A flexible group communication system. Communications of the ACM, 39(4):76–83, 1996.

10.1007/b107031130008

Specifications and Proofs for Ensemble Layers Jason Hickey1 , Nancy Lynch2 , Robbert van Renesse1 2

1 Dept. of Computer Science, Cornell University    Laboratory for Computer Science, Massachusetts Institute of Technology

Abstract. Ensemble is a widely used group communication system that supports distributed programming by providing precise guarantees for synchronization, message ordering, and message delivery. Ensemble eases the task of distributed-application programming, but as a result, ensuring the correctness of Ensemble itself is a difficult problem. In this paper we use I/O automata for formalizing, specifying, and verifying the Ensemble implementation. We focus specifically on message total ordering, a property that is commonly used to guarantee consistency within a process group. The systematic verification of this protocol led to the discovery of an error in the implementation.

1

Introduction

Ensemble [8,16] is a working system for supporting group communication. In the group communication model, processes join together to form views that vary over time, but at any time a process belongs to exactly one view. Ensemble provides precise semantics for message delivery and ordering both within a view, and as views change. The Ensemble implementation is modular; applications acquire services by constructing layered protocol stacks. Ensemble currently provides about 50 protocol layers, and the number of useful protocols that can be constructed by composing the layers into protocol stacks numbers in the thousands. Ensemble eases the task of distributed-application programming by supporting properties like failure detection and recovery, process migration, message ordering, and conflict resolution, through a common application interface. From one perspective, Ensemble provides a model for establishing confidence: the critical algorithms are cleanly isolated and modularized. From another perspective, the task of verifying thousands of protocols is seemingly impossible! Any verification model that we use must capture the modularity of Ensemble, and it must be able to provide automated assistance for module composition. In this paper we present our experience applying I/O automata [13,14] to Ensemble. The I/O automaton model provides a good framework for 

Support for this research was provided by DARPA contract F30602-95-1-0047 (Cornell), and DARPA contract F19628-95-C-0118, AFOSR contract F49620-97-1-0337, and NSF grants CCR-9804665 and CCR-9225124 (MIT).

W.R. Cleaveland (Ed.): TACAS/ETAPS’99, LNCS 1579, pp. 119–134, 1999. c Springer-Verlag Berlin Heidelberg 1999 

120

Jason Hickey, Nancy Lynch, Robbert van Renesse

modeling Ensemble because: (a) Ensemble layers can be described formally as automata, and composition of layers corresponds to composition of automata, (b) the I/O automaton model language supports a range of specification, from abstract specifications that characterize services to operational specifications that characterize program behavior, and (c) the automata can be interpreted formally, as part of a mechanical verification we are performing with the Nuprl system [5]. We demonstrate our experience through a case study of the Ensemble total-order protocol, which specifies an ordering property for message delivery. It is built incrementally from virtual synchrony, a basic Ensemble service. We present the following contributions: – EVS, a specification for the safety properties guaranteed by the Ensemble virtual synchrony layer. – ETO, for the Ensemble totally ordered virtual synchrony layer. – evstoetop , for the local program at node p, used in Ensemble in the implementation of eto using evs. The original program was written in OCaml by Mark Hayden [16,8], based on C code developed by Robbert van Renesse for the Horus system [17]. – a simulation relation showing that the composition of evs and all the evstoetop , for all p, implements eto. This document gives the specifications and summarizes the proofs for the total order case study. The full proofs are given in detail in [9], which provides the formal arguments used in the mechanical verification using the Nuprl proof development system. At the time of writing, the mechanical verification is partially complete. While we do not discuss proof automation specifically, the specifications we present were developed through a process of reverse-engineering, by hand-translating Ensemble code into a Nuprl specification, and the proofs were developed in concert with the Nuprl formalism. The outline for the rest of the paper is as follows. In Section 2, we give a brief description of the I/O automata formalism, and in Section 3, we use it to specify the abstract Ensemble client. We specify the eto and evs services in Sections 4 and 5; we develop the layer specification and its verification in Section 6; and we finish with a discussion of the specific ordering properties that led to the discovery of an error in Ensemble and Horus in Section 7.

2

Notation and mathematical foundations

Sets, functions, sequences. Given a set S not containing ⊥, the notation S⊥ refers to the set S ∪ {⊥}. We write  for the empty sequence.

Specifications and Proofs for Ensemble Layers

121

If a is a sequence, |a| denotes the length of a. We also use the notation |a|x to denote the number of elements in a that are equal to x. If a is a sequence and 1 ≤ i ≤ j ≤ |a| then a(i) denotes the ith element of a and a(i..j) denotes the subsequence a(i), . . . , a(j). We say that sequence s is a prefix of sequence t, written as s ≤ t iff there exists i such that s = t(1 . . . i). Views. P denotes the universe of all processes. G is a totally ordered set of identifiers used to distinguish views. Within G, we distinguish view identifiers gp , p ∈ P, one per process p. We assume that these special view identifiers come before all other view identifiers in the given total ordering of G. A view v = g, P  consists of a view identifier g, g ∈ G and a nonempty set P , P ∈ 2P , of processors called “members” of the view. V = G × 2P is the set of all views. Given a view v = g, P , the notation v.id refers to the view identifier g of view v and the notation v.set refers to the view membership set P of view v. We distinguish special initial views vp = gp , {p} for all p ∈ P. In specifications that associate at most one view with each identifier g ∈ G, we will sometimes refer to the “view” g, meaning the view with identifier g. Messages. We denote by M the universe of all possible messages. When messages are placed in queues, they are often paired with processors M× P. Given a message-processor pair x = m, p, the notation x.msg refers to the message m, and x.proc refers to the processor p. I/O automata. I/O automata provide a reactive model for programs that react with their environment in an ongoing manner, as described by Lynch [14]. An automaton consists of a set of actions, classified as input, output, or internal, a (possibly inifinite) set of states, and a set of transitions, which are (state, action, state) triples. A valid execution is a state-action sequence s1 a1 . . . si ai si+1 . . . where each triple si ai si+1 is a transition of the automaton. The I/O automata pseudocode we use in this paper describes the automaton in three parts: (1) the possible actions are described in the signature, (2) the state is expressed as a collection of variables and their domains, (3) the transitions are described with precondition/effect clauses for each action.

3

The client automaton C

The specification of the Ensemble client is shown in Figure 1. The client automaton is used to formalize restrictions on the environment in which Ensemble services exist. There is one client Cp per process p ∈ P; each client represents a single process in an Ensemble application. The group membership changes over time in three distinct phases, represented by three modes.

122

Jason Hickey, Nancy Lynch, Robbert van Renesse

Cp Signature: Input: eto-blockp , p ∈ P Output: eto-block-ok p , p ∈ P eto-newview(v)p , v ∈ V, p ∈ v.set eto-gpsnd(m)p , m ∈ M, p ∈ P eto-gprcv(m)p,q , m ∈ M, p, q ∈ P State: mode ∈ {“normal”, “preparing”, “blocked”}, initially “normal” Transitions: input eto-newview(v)p Eff: mode := normal input eto-blockp Eff: mode := preparing output eto-block-okp Pre: mode = preparing Eff: mode := blocked

output eto-gpsnd(m)p Pre: mode = blocked Eff: none input eto-gprcv(m)p,q Eff: none

Fig. 1. The Cp specification The client is initialized in the “normal” mode, and it can communicate with other processes in the view by sending and receiving messages. When a new view is to be installed, Ensemble notifies the client by sending it a block message. The block message puts the client in the “preparing” mode; the client may continue to send and receive messages in the “preparing” mode. The client may respond to the block request with a block-ok message, which makes the client “blocked.” The client is not allowed to send messages in the blocked mode. The transition from the “blocked” to the “normal” mode occurs when Ensemble delivers the newview message, which installs a new view in the client with a potentially new list of view members.

4

Ensemble virtual synchrony (EVS)

Virtual Synchrony provides the semantics of group communication. The view guarantees provided by Ensemble can be summarized with the following informal properties. EVS-self : if process p installs view v, then p ∈ v.set . EVS-view-order : views are installed in ascending order of view id. EVS-non-overlap : for any two processes p and q that both install view v, the previous views of p and q must either be the same or be disjoint. Failures may prevent messages from being delivered, and virtual synchrony provides the following delivery guarantees. EVS-msg-view : all delivered messages are delivered in the view in which they were sent. EVS-fifo : messages between any two processes in a view are delivered in FIFO order. EVS-sync : any two processes that install a view v2 , both with preceding view v1 , deliver the same messages in view v1 .

Specifications and Proofs for Ensemble Layers

123

evs Signature: In: evs-gpsnd(m)p , m ∈ M, p ∈ P evs-block-ok p , p ∈ P Internal: evs-createview(v), v ∈ V

Out: evs-gprcv(m)p,q , m ∈ M, p, q ∈ P evs-blockp . p ∈ P evs-newview(v)p , v ∈ V, p ∈ v.set

State: created ⊆ V, initially {vp : p ∈ P} for each p ∈ P: mode[p] ∈ {“normal”, “preparing”, “blocked”}, initially “normal” all-viewids[p] ⊆ G, initially {gp } for each p ∈ P, g ∈ G: pending[p, g] ∈ seqof (M), initially  for each p, q ∈ P, g ∈ G: next[p, q, g] ∈ N+ , initially 1 Derived variables: for each p ∈ P: all-views[p] ⊆ V, given by {v ∈ created : v.id ∈ all-viewids[p]} current-viewid[p] ∈ G, given by max (all-viewids[p]) current-view[p] ∈ G, a default view v ∈ created such that v.id = current-viewid[p] for each g ∈ G, p ∈ P: pred-viewid[g, p] ∈ G⊥ , the largest viewid strictly smaller than g in all-viewids[p], if g ∈ all-viewids[p] and any such viewid exists, else ⊥ for each v ∈ V, p ∈ P: pred-view[v, p] ∈ V, a default view w ∈ all-views[p] such that w.id = pred-viewid[v.id , p], if v ∈ all-views[p] and any such w exists, else ⊥ Transitions: output evs-blockp internal evs-createview(v) Pre: ∀w ∈ created : v.id > w.id Pre: mode[p] = normal Eff: created := created ∪{v} Eff: mode[p] := preparing input evs-gpsnd(m)p input evs-block-okp Eff: mode[p] := blocked Eff: append m to pending[p, current-viewid[p]] output evs-gprcv(m)q,p , choose g output evs-newview(v)p choose v1 Pre: g = current-viewid [p] Pre: mode[p] = blocked pending [q, g] =  v1 = current-view [p] pending [q, g](next[q, p, g]) = m v ∈ created Eff: next[q, p, g] := next[q, p, g] +1 v.id > v1.id ∀q ∈ v.set : if pred-view [v, q] = ⊥ then pred-view [v, q] = v1 ∨ pred-view [v, q].set ∩ v1.set = {} if pred-view [v, q] = v1 then ∀r ∈ v1.set : next [r, p, v1.id] = next [r, q, v1.id] Eff: mode := normal all-viewids[p] := all-viewids[p] ∪ {v.id }

Fig. 2. evs specification

124

Jason Hickey, Nancy Lynch, Robbert van Renesse

The automaton for evs is shown in Figure 2. This automaton contains a state shared by all processes, and the external events in the signature are indexed by processes p ∈ P. There is one event to match each of the client events. In addition there is a new internal action evs-createview(v) that creates new views that may eventually be installed. In the state, we keep a history for each process. The variable mode[p] represents the mode of client Cp . The sequence all-viewids[p] is the history of all views that have been delivered to process p. The sequence pending [p, g] is the sequence of messages sent by process p in view g. The index next[q, p, g] indicates the next message to be delivered to process p from process q in view g (so pending [q, g](next [q, p, g]) is the next message to be delivered). The view current-view [p] is the last view that was delivered to the client, and pred-view [g, p] is the view delivered just before view g to process p. The transitions for evs-block and evs-block-ok represent state changes in the client. The transition for evs-gpsnd(m)p places the message m in the current sequence of pending messages for process p, and the transition for evs-gprcv(m)q,p takes a message from the pending queue for process q and delivers it to process p. The evs-newview(v)p transition requires several properties before a new view can be delivered to the client Cp . The precondition v.id > v1.id requires that the new view be larger than the current view (which ensures EVS-view-order). For each process q ∈ P, the precondition pred-view [v, q] = v1 ∨ pred-view [v, q].set ∩ v1.set = {} provides the EVS-non-overlap property for processes that have already installed view v (pred-view [v, q] = ⊥). The precondition next[r, p, v1.id ] = next[r, q, v1.id ] provides the EVS-sync property: the messages delivered from process r must be the same for all processes that have installed view v from view v1. These properties, together with the EVS-fifo property that follows from the ordering of messages in the pending queues, yield the informal properties claimed by the designers.

5

Ensemble total order (ETO)

The eto service guarantees all of the properties of evs, and also the following ordering guarantees on message delivery. ETO-total : Any two messages m1 and m2 delivered to more than one process are delivered in the same order. ETO-causal : Messages are causally ordered: if process p2 receives a message m from process p1 , then it must have received all messages received by p1 before m was sent. The automaton for eto is derived from evs, with the differences shown in Figure 3: 1) the evs-· · · actions of evs are renamed with the

Specifications and Proofs for Ensemble Layers

125

eto: changes from evs Signature: In: eto-gpsnd(m)p , m ∈ M, p ∈ P Out: eto-gprcv(m)p,q , m ∈ M, p, q ∈ P eto-block-ok p , p ∈ P eto-blockp . p ∈ P eto-newview(v)p , v ∈ V, p ∈ v.set Internal: eto-createview(v), v ∈ V eto-order(mf , i, j)p , mf ∈ M × (P → N+ ), i, j ∈ N+ , p ∈ P State: for each g ∈ G: queue[g] ∈ seqof (P), initially  for each p ∈ P, g ∈ G: pending[p, g] ∈ seqof (M × (P → N+ )), initially  Derived variables: enabled [p, q, g] ∈ bool , indicates when a totally ordered message can be delivered from process p to process q in view g: ∃i. queue[g](i) = p ∧ |queue[g](1 . . . i)|p = next [p, q, g] ∧∀p ∈ P.p = p ⇒ ∃j < i: |queue[g](1 . . . j)|p = next [p , q, g] − 1 Transitions: input eto-gpsnd(m)p Eff: choose g = current-viewid[p] choose f = λr.next [r, p, g] append (m, f ) to pending[p, g] internal eto-order(mf , i, j)p , choose g Pre: |queue[g](1 . . . i)|p = j − 1 |queue[g]|p = j − 1 pending [p, g](j) = mf Eff: insert p into queue[g] at i

output eto-gprcv(m)q,p , choose g, f Pre: g = current-viewid[q] pending[q, g](next[q, p, g]) = (m, f ) ∀r ∈ P.next [r, p, g] ≥ f (r) enabled [q, p, g] Eff: next [q, p, g] := next [q, p, g] + 1

Fig. 3. The specification modifications for eto eto-· · · prefix, 2) the transitions for eto-gpsnd(m)p and eto-gprcv(m)q,p replace the corresponding transitions of evs, 3) eto-order(m, i, j)p is a new action, and 4) the eto state adds the state variables queue[g] and pending [p, g] to the state of evs. The total order for each view g ∈ G is represented by the queue[g] process sequence, where message mi in the total order is from process queue[g](i). The queue[g] entries are inserted by the internal action eto-order(m, i, j)p , which inserts process p into the total order queue[g] at location i after all other occurrences of process p in the total order. The message delivery ordering at process p is determined by the precondition for the evs-gprcv(m)q,p . The precondition ∀r ∈ P.next(r, q, g) ≥ f (r) provides causal ordering: the eto-gpsnd(m)p transition saves a causal “snapshot” of the delivery state when the message was sent, and the ∀r ∈ P: next [r, q, g] ≥ f (r) is the causality requirement. Total ordering is determined by the enabled predicate: if enabled [p, q, g] then there is some index i into the total order queue[g] where the number of deliv-

126

Jason Hickey, Nancy Lynch, Robbert van Renesse

ered messages from each process p ∈ P is no more than the number of occurrences of p in queue[g](1 . . . i). This condition for ordering allows message deliveries that contain gaps. For example, consider the ordering queue[g] = p1 p2 p1 p2 p1 p3 p2 p3 p2 , where the underlined process identifiers represent messages that have been delivered to process p. Two messages have been delivered from processes p1 and p2 . Message deliveries from p1 and p3 are no longer enabled—they would violate the total order. The only possible future delivery is from process p2 .

6

The implementation algorithm (evstoeto)

Ensemble implements services using separate protocol stacks for each process. The layer that implements total-order uses a two-phase token-based algorithm. When a view is first installed with the evs-newview(v)p action a token is generated by the group leader (the process with the smallest process identifier). Each message sent during the first phase, called the ordered phase, must be associated with a token. When a process has a message to send, it is required to obtain a token. If it obtains a token ti , it sends the message with the token, and generates new token ti+1 . During this phase, the sent messages (m1 , t1 ), (m2 , t2 ), . . . can be totally ordered by their tokens. When messages are received by the layer from evs in the ordered phase, they are saved in a queue, called the ordered queue, in the order determined by their tokens. The evstoetop layer delivers message mi to the client Cp only if messages m1 , m2 , . . . , mi−1 have been successfully received by the layer (with the evs-gprcv(m)q,p action) and delivered to the client (with the eto-gprcv(m)p,q action). The second phase of the protocol, called the unordered phase, can be entered by the layer at any time. During the unordered phase, outgoing messages are sent without waiting for the token, and they are designated as “unordered.” Layers that receive unordered messages place them on a queue called the unordered queue. Delivery of an unordered message to the client is delayed until the installation of the next view, upon which the layer sorts the contents of the unordered queue by process-identifier, and delivers the queued messages to the client before delivering the new view. The specification for the evstoeto layer is shown in Figures 4 and 51 . In this specification, tokens for messages in the ordered mode are represented by their number. The layer for evstoeto uses four message types to communicate information about messages and their ordering: 1

This version fixes the original error in Ensemble and Horus, which differed in the implementation of the precondition for eto-gprcv(m)q,p , as discussed in Section 7.

Specifications and Proofs for Ensemble Layers

127

evstoetop Signature:

define MT ≡ | | |

Ordered (t, m), t ∈ N, m ∈ M Unordered (m), m ∈ M TokenReq TokenSend (t, r), t ∈ N, r ∈ P

Input: evs-gprcv(m)q,p , m ∈ MT , p, q ∈ P evs-blockp , p ∈ P evs-newview(v)p , v ∈ V, p ∈ P eto-block-ok p , p ∈ P eto-gpsnd(m)p , m ∈ M, p ∈ P Internal: evs-unorderedp , p ∈ P State: blocked ∈ bool , initially false have-block ∈ bool , initially false have-block-ok ∈ bool , initially false have-newview ∈ bool , initially false holds-token ∈ bool , initially true token ∈ N, initially 1 use-token ∈ bool , initially true view ∈ V, initially vp Transitions: input evs-gprcv(Ordered (t, m))q,p Eff: ordered [t] := m, q input evs-gprcv(Unordered (m))q,p Eff: append m, q to unordered input evs-gprcv(TokenReq )q,p Eff: request := request ∪ {q} input evs-gprcv(TokenSend (t, r))q,p Eff: if r = p ∧ use-token then holds-token := true token := t input eto-gpsnd(m)p Eff: append m to pending

Output: evs-gpsnd(t, m)p , t ∈ N, m ∈ MT , p ∈ P evs-block-okp , p ∈ P eto-blockp , p ∈ P eto-newview(v)p , v ∈ V, p ∈ v.set eto-gprcv(m)q,p , m ∈ M, p, q ∈ P

request ∈ 2P , initially {} requested ∈ bool , initially false pending ∈ seqof (M), initially  next ∈ N+ , initially 1 order ∈ N, initially 1 for each t ∈ N: ordered [t] ∈ (M × P)⊥ , initially ⊥ unordered ∈ seqof (M × P), initially  input Eff: input Eff:

evs-blockp have-block := true evs-newview(v)p have-newview := true view := v input eto-block-okp Eff: have-block-ok := true blocked := true internal eto-unorderedp Pre: true Eff: holds-token := false use-token := false

Fig. 4. State, input, and internal transitions for evstoeto Ordered (t, m) pairs token t with message m, Unordered (m) designates an unordered message, TokenReq is used to request a token from another process, and TokenSend (t, p) is used to deliver token t to process p. The signature for the evstoeto layer includes both actions for communicating with evs (the evs-· · · events), and with the client (the eto-· · · events). In the specification, a process p is allowed to initiate unordered mode at any time with the internal event evs-unorderedp . The state has three parts. The view part maintains information about the view state and pending views. The blocked flag is true iff the client is considered to be blocked. The have-block , have-block-ok , and have-new-view flags keep track of queued block events as they are passed between evs and the client; for

128

Jason Hickey, Nancy Lynch, Robbert van Renesse

Output transitions output eto-gprcv(m)q,p choose i, j output eto-blockp Pre: ordered [order ] = m, q Pre: have-block ∨ (have-newview ¬have-newview ∧ i ≥ order ∧ j = 0 Eff: have-block := false ∧ ordered [i] = m, q output evs-block-okp ∧ q ∈ view .set Pre: have-block-ok ∧ ∀j ∈ [order . . . i − 1]: ordered [j] = ⊥ next = |pending | + 1 ⇒ ordered [j].proc ∈ / view .set ) Eff: have-block-ok := false ∨ (have-newview output evs-gpsnd(Ordered (t, m))p ∧ ∀k ≥ order : ordered [k] = ⊥ Pre: pending (next ) = m ⇒ ordered [k].proc ∈ / view .set holds-token ∧ unordered (j) = m, q ∧ i = 0 token = t Eff: next := next + 1 ∧ ∀k < j.∀p = unordered [k].proc: token := t + 1 p ∈ / view .set ∨ p >P q output evs-gpsnd(Unordered (m))p ∧ ∀k > j.∀p = unordered [k].proc: Pre: ¬use-token p ∈ / view .set ∨ p ≥P q) pending (next ) = m Eff: if ordered [order ] = m, p then Eff: next := next + 1 order := order + 1 output eto-newview(v)p else if j = 0 then Pre: have-newview ordered [i] := ⊥ v = view else ordered [order ] = ⊥ remove element j from unordered ∀i: unordered (i).proc ∈ / view .set output evs-gpsnd(TokenReq )p Eff: have-newview := false Pre: next ≤ |pending| token := 1 use-token order := 1 ¬holds-token next := 1 ¬requested pending :=  Eff: requested := true for each t ∈ N output evs-gpsnd(TokenSend (t, r)p ) ordered [t] := ⊥ Pre: next = |pending| + 1 holds-token = ¬∃q ∈ v.set .q

0 → x := x − 1

2.2

Theorem Proving

We use PVS [ORS+95] for invariant strengthening [GS96, HS96]. Given a transition system T and a state predicate I, we say that I is inductive if I ⊃ pre(I).  Obviously, if I is inductive and holds at the initial state of T , then I is an invariant of T . When I is not inductive, we can strengthen it by taking I ∧ pre(I)  and

On Proving Safety Properties by Integrating Static Analysis

181

check if the latter is inductive, that is, whether I ∧ pre(I)  ⊃ pre(I  ∧ pre(I));  or 2 equivalently, whether I ∧ pre(I)  ⊃ pre  (I). In general, this procedure terminates if there exists an n such that n

 I ∧ pre(I)  ∧ . . . ∧ pre  (I) ⊃ pre

n+1

(I).

(1)

n

In this case, it follows that I ∧ pre(I)  ∧ . . . ∧ pre  (I) is inductive: in particular, I is an invariant. This technique can be implemented in PVS as follows. We use a simple invariance rule stating that I is an invariant if it is true initially and is preserved by all transitions. If I is inductive then applying the rule once would complete the proof. Otherwise, the prover presents a number of pending (unproved) subgoals: each subgoal results from the fact that I is not preserved by some transition. We then apply the invariance rule to the predicate obtained by taking the conjunction of I and all the unproved subgoals: this amounts to attempting to prove that I ∧ pre(I)  is inductive. If there exists an n such that (1) holds, then repeating this process n times would eliminate all the subgoals and complete the proof. This leads to a fully automatic procedure (that is not guaranteed to halt). 2.3

Abstraction

We use the abstraction technique described in [GS97]. The abstraction of a concrete transition system T relative to a finite set of state predicates B = {B1 , . . . , Bk } called boolean abstract variables, is a transition system denoted T /B. The states of the abstract system T /B are called abstract states; every abstract state is labeled with a valuation of the control variables of T and of the abstract variables. Let us now briefly describe how T /B is constructed. The initial abstract state is labeled with the initial control configuration of T and with the truth values of the abstract variables at the initial concrete state. Assume now that sA is an abstract state, the abstract transitions going out of sA are then generated. Every concrete transition τ , originating from a concrete state with the same control configuration as sA , can give rise to several abstract transitions. Each of these transitions will have the same label as τ and lead to an abstract state obtained by computing (with Pvs) the effect of τ (starting from sA ) on the control and abstract variables. Consider, for example, the concrete system illustrated below. An abstraction relative to B1 : (x = 0) and B2 : (x = 1) generates the abstract system (a); while an abstraction only relative to B2 yields the abstract system (b), of which only the initial portion is shown. Note that in the latter, simulating the concrete transition inc gives rise to two successors. This is because starting at the initial abstract state, where ¬(x = 1) holds, the transition inc performing x := x + 1 can either lead to a state in which (x = 1) is true, or to a state in which the latter is false. Note also that in the abstract system (a), the only state labeled pc = 2 is also labeled (x = 1); we say this abstraction “shows” the property (pc = 2 ⊃ (x = 1)). On the other hand, the abstraction (b) does not show this property, since there exists an abstract state labeled pc = 2 and ¬(x = 1).

2

182

Vlad Rusu and Eli Singerman inc: true → x := x + 1 x=0 pc = 2

pc = 1

dec: true → x := x − 1 inc (x = 0)

¬(x = 0)

¬(x = 1)

(x = 1)

inc

(x = 1) pc = 2 . . .

inc

¬(x = 1) pc = 2

¬(x = 1) pc = 1

pc = 2

pc = 1 dec

...

(b)

(a)

To define the notion of “abstraction showing a property” we interpret the labelling of each abstract state sA as a predicate π(sA ) on the concrete variables; for instance, the predicate associated with the initial state of system (b) above is (pc = 1) ∧ ¬(x = 1). Let T /B be the abstraction of a concrete system T relative to the set of abstract variables B = {B1 , . . . , Bk }, and ϕ be a state predicate. We say that an abstract state sA shows ϕ if π(sA ) implies ϕ. We say that T /B ϕ, denoted T /B |=ABS ϕ, if all abstract states show ϕ. The crucial shows feature of these boolean abstractions, which is true by construction, is that for every computation a a1 ... s0 →0 s1 →,

2

2

of the concrete system T , there exists an abstract trace a

a

0 A 1 sA 0 → s1 →, . . .

such that for i = 0, 1, . . . , the labels of the abstract and concrete transitions coincide, and the boolean values of the abstract variables in sA i and in si coincide. Consequently, boolean abstractions are useful for proving invariants, since T /B |=ABS

2

ϕ

⇒

T |=

2

ϕ.

In general, an abstraction relative to a larger set of abstract variables can “show” more properties, because the prover has more information at its disposal when new abstract states are generated, therefore it can eliminate some of them, yielding a finer abstraction. Also, constructing an abstraction with some known invariants of the concrete system can assist in eliminating irrelevant abstract states.

3

The Integration

We introduce our approach for integrating the previously discussed static analysis, theorem proving and abstraction techniques. The general scheme is presented in Fig. 1.

On Proving Safety Properties by Integrating Static Analysis

183

p ro g ra m

p ro p e rty in v a r ia n ts

p e n d in g s u b g o a ls

I n v a r ia n t g e n e r a to r

in v a r ia n ts

n e w ly p r o v e d c o n je c tu r e T h e o r e m p r o v e r

A b s tr a c tio n g e n e r a to r

a b s tr a c t v a r ia b le s

a b s tr a c t s y s te m

w is h e s

P ro o f!

n e w a b s tr a c t v a r ia b le s

T r a c e a n a ly z e r

n e w in v a r ia n t: w is h e s g r a n te d

a b s tr a c t tr a c e N o

n e w w is h e s

v io la tin g tra c e ? Y e s

n e w c o n je c tu r e

T r a c e s im u la to r

Y e s

m a tc h e s c o n c re te tra c e ?

C o u n te r e x a m p le !

N o

Figure 1: Integration

We demonstrate the method on a simple mutual exclusion problem for three identical processes (illustrated below), in which the semaphore S is a shared variable. The property to be proved is that it is never the case that all three I processes are in their critical sections simultaneously; this is expressed as with

2

I : ¬((pc1 = cs) ∧ (pc2 = cs) ∧ (pc3 = cs)).

184

Vlad Rusu and Eli Singerman

S=2

requesti : S > 0 → S := S − 1 pci = nc

pci = cs

true

true releasei : true → S := S + 1

2

The first step is to employ the Invariant generator. This yields the global in(S ≥ 0), which is fed to the Theorem prover and to the Abstraction variant: generator, since it contains relevant information that may be useful in the sequel. The next step is to apply theorem proving in trying to prove that I is inductive. In our case, I is not inductive, and therefore the proof is not completed. Rather, we are presented with three (symmetric) pending subgoals, resulting from transitions that do not preserve I. For example, the following subgoal is related to transition request3 when the third process attempts to enter the critical section while the other two processes are already there: Assuming: – pc1 = cs – pc2 = cs – S>0 Prove:  – ¬(pc3 = cs) Obviously, the only way to prove this implication is to show that the assumption is contradictory; but I alone is too weak to prove it. The user now has two alternatives: either to remain in the prover and try to strengthen I, or to try to prove the pending subgoals using an abstraction. User-dependent decisions are represented in the diagram of Fig. 1 by dashed lines. Here, we choose the latter alternative. From the pending subgoals we identify the predicate (S > 0) as a potentially relevant abstract variable and use the Abstraction generator to build the abstract system T /{(S > 0)}. The generated abstract system is then passed to the Trace analyzer together with a user-defined wish. A wish is a transition-related state property to be checked on the abstract system which, if shown correct, would enable to eliminate an unproved subgoal. The transition to which a wish refers is that who gave rise to the corresponding subgoal. Formulating a wish is straightforward. For example, a wish corresponding to the subgoal above is: “for every abstract transition labeled request3 , if the origin abstract state is labeled pc1 = cs and pc2 = cs then it is also labeled ¬(S > 0)”. The role of the Trace analyzer is to find an abstract state that violates the wish. If there is no violating state, then the wish is granted and this information is passed back to the prover, allowing to complete the corresponding subgoal. In our example, however, there exists a violating abstract state and the Trace

On Proving Safety Properties by Integrating Static Analysis

185

analyzer returns the following abstract trace (starting from the initial abstract state) leading to it:

pc1 = nc pc2 = nc pc3 = nc S>0

request1

pc1 = cs pc2 = nc pc3 = nc S>0

request2

pc1 = cs pc2 = cs pc3 = nc S>0

request3

This means that either mutual exclusion is not guaranteed by the program, or that the abstraction is too coarse. To decide between these two we must check whether this violating trace can be matched by a concrete computation. This task is performed by the Trace simulator, by simulating the transitions of the violating trace on the concrete system. It checks whether after every transition the valuation of the abstract variables in the concrete and abstract systems coincide. If this is the case, then we have a counterexample. Here, it is not the case, since a miss-match is detected in the third abstract state: according to the concrete computation, S = 0 should hold, but in the abstract system, S > 0 holds. Thus, the abstraction is too coarse. In this situation, the simulator outputs a warning message indicating what “went wrong” in the abstraction; this information is obtained by computing the pre-images  of the abstract variables on the violating trace. In our example, the message suggests that the abstraction “believes” that initially S > 2 holds. The user has now two options to pursue. The first is to do another abstraction relative to a larger set of abstract variables (obtained by adding the new ones suggested by the trace simulator as “responsible” for the miss-matches). For example, S > 2 is a new relevant abstract variable. The second option is to formulate a conjecture and try to prove it in the theorem prover. A conjecture is an auxiliary invariant that would assist in generating a finer abstraction. In our (S ≤ 2). If it was proved, then taking it into case, an obvious conjecture is account when the next abstraction is computed would eliminate some abstract traces (e.g., the previous violating trace).

2

2

(S ≤ 2) does not succeed We pursue the latter alternative. The proof of in one invariant strengthening step. From the new unproved subgoals we extract two new abstract variables: (S ≤ 2) and (S ≤ 1). We compute the abstract system T /{(S > 0), (S ≤ 2)(S ≤ 1)}, which is fine enough to grant our original wishes. Armed with this information the prover eliminates the (original) unproved subgoals and completes the proof of mutual exclusion. As another example, we consider a version of the alternating bit protocol taken from [GS97] (see Fig. 2 below).

186

Vlad Rusu and Eli Singerman

S E N D E R : s e n t = n u ll b = fa ls e

R e c e iv e _ a c k : m e ssa g e _ p re se n t a n d a c k _ c h a n n e l= b ->

R e c e n o t m m e ss a c k _ a c k _

iv e _ o ld m e ssa g e _ p a g e _ c h a n c h a n n e l:= p r e s e n t:=

e ssa g e : re se n t o r n o t n e l.b it = c - > c , tr u e

R E C E IV E R : r e c e iv e d = n u ll c = fa ls e

N e w _ m e ssa g e : tr u e -> b := n o t(b ), s e n t: = a d d ( g e t_ n e w _ m e s s a g e ( ) ,s e n t) S e n d _ a c k : tr u e -> c := n o t(c ), a c k _ c h a n n e l:= c , S e n d _ m e ssa g e tr u e - > m e s s a g e _ c h a n n e l: = ( h e a d ( s e n t) ,b ) , m e s s a g e _ p r e s e n t:= tr u e

R e c e iv m e ssa g e m e ssa g e r e c e iv e d a d d (m e s r e c e iv e

e _ _ p _ c := sa d )

m e ssa g e : re se n t a n d h a n n e l.b it = c - > g e _ c h a n n e l.m e s s a g e ,

R e se n d _ m e ssa g e : n o t(m e s s a g e _ p r e s e n t a n d a c k _ c h a n n e l= b ) -> m e s s a g e _ c h a n n e l: = ( h e a d ( s e n t) ,b ) , m e s s a g e _ p r e s e n t:= tr u e

E N V IR O N M E N T : m e s s a g e _ p r e s e n t= fa ls e a c k _ p r e s e n t= fa ls e

L o se _ a c k : a c k _ p r e s e n t:= fa ls e

L o se _ m e ssa g e : m e s s a g e _ p r e s e n t= fa ls e

Figure 2: An Alternating bit Protocol.

There are three processes: sender, receiver and environment. The sender generates messages, records them in the sent list, then sends them to the receiver over the communication medium message channel. The latter is modeled as a oneplace buffer that can hold a message and a bit. The receiver records successfully received messages in the received list and sends an acknowledgment through the one-place buffer ack channel. The environment can lose messages and acknowledgements by setting the boolean flags message present and ack present to F alse. This causes the sender/receiver respectively to retransmit. The safety property to be proved, is that the (unbounded) lists sent and received always (sent = received ∨ sent = tail(received)). differ by at most one message:

2

The first step, static analysis, yields two invariants that are fed to the prover and to the abstraction generator. The next step is theorem proving, and since the property is not inductive, the proof is not completed. There are three pending

On Proving Safety Properties by Integrating Static Analysis

187

subgoals, all of which are related to transitions that update the sent/received lists. For example, we have to prove that at the origin of transition receive message: sent = tail(received). We take this predicate as an abstract variable, and formulate the above as a wish. (We also used two other similar abstract variables and corresponding wishes which are omitted here.) After the abstraction has been computed, the trace analyzer returns a violating trace in which a receive message transition is taken from the initial abstract state. From the trace simulator we get a warning message indicating that the problem occurred because the transition receive message should not have been enabled initially, and that the predicate “responsible” for this is the conjunct message channel.bit = c in the guard of the transition. The obvious choice now is to take this predicate as a new abstract variable and to redo an abstraction. Still, the second abstraction does not grant our wishes; a new violating trace is detected and another abstract variable is suggested by the same mechanism described above. The third abstraction grants all original wishes, and then the prover completes the proof. In [GS97] the same protocol is analyzed by an abstraction relative to a set of sub-formulas of the guards, and human inspection of the generated abstract system is necessary to conclude that the protocol is indeed correct. Our approach is different: the abstract variables are suggested to the user by the failures of previous proof attempts and abstractions; the analysis of the abstract system is automatic and it issues information to the user; and in the end we obtain a complete rigorous proof. Our method can be automated in significant proportion. Indeed, all the components in the diagram (Fig. 1) perform automatic tasks, and user intervention is basically limited to choosing between abstraction and theorem proving. In both cases, the user is assisted in providing the relevant abstract variables, wishes and conjectures by the pending subgoals in the prover and by the warning messages issued by the trace simulator. The method is incremental: progress is made in each step, as every relevant abstract variable and conjecture reduces the search space; and the user gains insight of the problem while progressing towards a proof or a counterexample. Finally, we show in the next section that by integrating the components it is possible to prove more properties than by automatic invariant strengthening or automatic abstraction as stand-alones.

4

Integration is More Powerful

We now define the class of safety properties that can be proved to be invariant by the automatic invariant strengthening technique described in Section 2.2. For a transition system T and n = 0, 1, . . . consider the set IN Vn (T ) = {

2

n

I | I ∧ pre(I)  ∧ . . . ∧ pre  (I) ⊃ pre 

n+1

(I)}

(2)

188

Vlad Rusu and Eli Singerman

Definition 1. The class IN 

V (T ) of safety properties that can be proven by preinvariant strengthening is n≥0 IN Vn (T ). Next, we define a particular class of properties that can be shown by the abstraction mechanism described in Section 2.3. Given a state predicate I, we consider the set of predicates n

AV (I) = {I, pre(I),  . . . , pre  (I), . . . , }

22

Definition 2. The class ABS(T ) of safety properties that can be shown by pre I for which there exists a finite subset abstraction is the class of properties I. B ⊂ AV (I) such that T /B |=ABS It should be stressed that choosing the abstract variables from I, pre(I),  ... , pre  n (I) is not arbitrary: the guards of transitions, which in many cases allow to generate useful control abstractions [GS97] are just sub-formulas of these predicates. Note that both pre-invariant  strengthening and pre-abstraction  are fully automatic techniques. Under the assumption that the same “reasoning power” is used for both pre-invariant  strengthening and pre-abstraction  (for example, both use the same theorem prover), the following result holds. Theorem 1. A safety property can be proved by pre-invariant  strengthening iff it can be shown by pre-abstraction.  Proof (sketch). First, for every n = 0, 1, . . . , define the finite set of predicates AVn (I) as n

 . . . , pre  (I)}. AVn (I) = {I, pre(I), Then, the set ABSn (T ) of safety properties that can be shown by abstraction relative to a subset of AVn (I) is ABSn (T ) = {

2

2

I | ∃n ≥ 0, B ⊆ AVn (I) s.t. T /B |=ABS I}.

Thus, by Definition 2, ABSn (T ) = n≥0 ABSn (T ). Next, recall that by Definition  strengthening

1, the class of properties that can be proved by pre-invariant is n≥0 IN Vn (T ). Finally, it is not difficult to prove that ABSn (T ) ⊆ IN Vn (T ) ⊆ ABSn+1 (T ) and the result follows.

2

2

In our method, when trying to prove a safety property I, the abstract variables and conjectures are also variants of sub-formulas of AV (I). As is shown in the following example, however, our method is strictly more powerful than the fully automatic techniques of pre-invariant  strengthening and of pre-abstractions.  The example is a mutual-exclusion algorithm taken from [BGP97], and is based on the same principle as the well-known Bakery Algorithm: using “tickets” to control access to the critical section. The program is illustrated in Fig. 3: two global variables t1 and t2 are used for keeping record of ticket values, and two local variables a and b control the entry to the critical sections.

On Proving Safety Properties by Integrating Static Analysis

189

t 1 = t2

init

init

assign-b: true → b := t2 , t2 := t2 + 1

assign-a: true → a := t2 , t2 := t2 + 1 nc

nc out-a: true → t1 := t1 + 1

in-a: a ≤ t1

in-b: b ≤ t1

out-b: true → t1 := t1 + 1

cs

cs Figure 3: The Ticket Protocol. The mutual-exclusion property is formulated as

2

I where

I : ¬(pc1 = cs ∧ pc2 = cs).

(3)

We employ our method to prove this property. Static analysis generates the local invariants pc1 = cs ⊃ a ≤ t1 and pc2 = cs ⊃ b ≤ t1 , which are then passed to the theorem prover and to the abstraction generator. Theorem proving yields two unproved subgoals, from which we identify the predicates (a ≤ t1 ) and (b ≤ t1 ) as relevant abstract variables (note that these predicates are simply the guards). The wish associated with the transition in-a is: “any abstract state labeled pc1 = nc, pc2 = cs is also labeled ¬(a ≤ t1 ) ”. That is, the guard (a ≤ t1 ) should prevent the first process from entering its critical section while the second is already there. A similar wish is associated with the transition in-b. The first abstraction does not grant these wishes. A violating trace is produced by the trace analyzer and fed to the trace simulator, which identifies it as not corresponding to a concrete computation; thus, the abstraction is too coarse. By computing pre-images  of the abstract variable (a ≤ t1 ), the system outputs a warning message indicating that the error occurred since the abstraction “believes” that initially: t1 ≤ t2 − 1. The user now has two options. The first is to add t1 ≤ t2 − 1 as a new abstract variable and do another abstraction. The second is to formulate a conjecture and try to prove it. Choosing the former alternative is reasonable since it would undoubtedly result in a finer abstraction. When it is not too difficult to come up with a conjecture, however, the latter is preferred. This is because a proved (stronger) conjecture usually eliminates more violating traces in further abstractions, and therefore significantly reduces the number of iterations. In our example this is the case, since it is easy to see that whenever both processes are at their init location, the stronger relation t1 = t2 (rather than t1 ≤ t2 − 1) should hold (this is true initially, and any loop that goes back to the

190

Vlad Rusu and Eli Singerman

init locations increases both t1 and t2 by one). So, we formulate the conjecture

2

(pc1 = init ∧ pc2 = init ⊃ t1 = t2 ).

(4)

In the prover, (4) is proved by three iterations of invariant strengthening. We then use it in a second abstraction (also relative to (a ≤ t1 ) and (b ≤ t1 )). This time, the wishes are granted, and the prover can discharge the unproved subgoals and complete the proof. An interesting conclusion can be drawn from this simple example. While the conjecture (4) can be proved by invariant strengthening, this is not the case I itself. As shown in [BGP97], backwards for the mutual-exclusion property analysis for this property does not converge, and hence (3) cannot be proved by pre-invariant  strengthening. Therefore, by Theorem 1, mutual exclusion cannot be shown by pre-abstraction,  either. Moreover, it is not difficult to prove that even an abstraction relative to any finite set of sub-formulas of pre-images  of I (such as the guards of the transitions) cannot show (3). The reason for this is that to prove (3) it is important to  of I express only weaker relations know when t1 = t2 holds, but the pre-images between t1 and t2 . (In the example we have obtained this information by proving (pc1 = init ∧ pc2 = init ⊃ ¬(t1 ≤ t2 − 1)) as the conjecture (4) instead of suggested by the system.) This demonstrates a typical use of the methodology, in which the detailed feedback from the system together with moderate amount of user ingenuity yields the relevant auxiliary invariant. This is in contrast to an ordinary theorem proving process, in which the user usually has to invest much more effort to come up with suitable auxiliary invariants.

2

2

5

Conclusion and Future Work

As an attempt to address the problem of the significant user ingenuity that is required to come up with appropriate auxiliary invariants or with suitable abstraction mappings, we have presented a new methodology for integrating static analysis, theorem proving and abstractions. The key features of our approach are – It is incremental: each step is based on information obtained from failures of previous steps. When the iterative process terminates, it yields a proof or a counterexample. – It is goal-directed: abstractions are guided by a subgoals in a failed proof attempt. – It is partially automatic: each component performs an automatic task, the user chooses which component to invoke at each step and how to apply it. – User input is highly guided by information provided by the system. – It is general, in principle, and not dependent on a particular implementation of the components.

On Proving Safety Properties by Integrating Static Analysis

191

For the experiments described in the paper we have used Pvs [ORS+95] for theorem proving and the Invariant Checker [GS97] for static analysis and abstraction. We are currently building a tool that would incorporate Smv [BCM+92] for trace analysis and simulation, and would also offer a connection to other static analysis tools [HPR97] as well as more general abstraction techniques [BLO98]. Acknowledgments. We wish to thank John Rushby and Natarajan Shankar for valuable comments, Sam Owre for lending us help with Pvs, and Hassen Saidi for assisting us with the Invariant Checker.

References [BCM+92]

[BGP97]

[BL] [BLO98]

[CC77]

[CCF+97]

[CU98]

[DGG97]

[GM95] [GS96]

[GS97]

[H91]

J.R. Burch, E.M. Clarke, K.L. McMillan, D.L. Dill and J. Hwang. Symbolic model checking: 1020 states and beyond. Information and Computation, 98(2):142-170, 1992. T. Bultan, R. Greber, and W. Pugh. Symbolic model checking of infinite state systems using Presburger arithmetic. In Proc. of the 9th Conference on Computer-Aided Verification, CAV ’97, LNCS 1254, pages 400–411. S. Bensalem and Y. Lakhnech. Automatic generation of invariants. To appear in Formal Methods in System Design. S. Bensalem, Y. Lakhnech, and S. Owre. Constructing abstractions of infinite state systems compositionally and automatically. In Proc. of the 10th Conference on Computer-Aided Verification, CAV ’98, LNCS 1427, pages 319–331. P. Cousot and R. Cousot. Abstract interpretation: a unified lattice model for static analysis of programs by construction or approximation of fixpoints. In Proc. of the 4th ACM Symposium on Principles of Programming Languages, POPL ’77, pages 238–252. C. Cornes, J. Courant, J.-C. Filliˆatre, G. Huet, P. Manoury, C. PaulinMohring, C. Mu˜ noz, C. Murthy, C. Parent, A. Sa¨ıbi, and B. Werner. The Coq Proof Assistant Reference Manual Version 6.1. Technical Report RT-0203, INRIA, July 1997. M.E. Col` on and T.E. Uribe. Generating finite-state abstractions of reactive systems using decision procedures. In Proc. of the 10th Conference on Computer-Aided Verification, CAV ’98, LNCS 1427, pages 293–304. D. Dams, R. Gerth and O. Gr¨ umberg. Abstract interpretation of reactive systems. ACM Transactions in Programming Languages and Systems, 19(2):253-291, 1997. M. Gordon and T.F. Melham. Introduction to the HOL system. Cambridge University press, 1994. S. Graf and H. Saidi. Verifying invariants using theorem proving. In Proc. of the 8th Conference on Computer-Aided Verification, CAV ’96, LNCS 1102, pages 196–207. S. Graf and H. Saidi. Construction of abstract state graphs with PVS. In Proc. of the 9th Conference on Computer-Aided Verification, CAV ’97, LNCS 1254, pages 72–83. G.J. Holzmann. Design and validation of communication protocols. Prentice Hall, 1991.

192

Vlad Rusu and Eli Singerman

[HPR97]

[HS96]

[LPY97]

[ORS+95]

[SUM96]

N. Halbwachs, Y.E. Proy, and P. Roumanoff. Verification of real-time systems using linear relation analysis. Formal Methods in System Design, 11(2):157–185, 1997. K. Havelund and N. Shankar. Experiments in theorem proving and model checking for protocol verification. In Formal Methods Europe, FME ’96, LNCS 1051, pages 662–681. K. G. Larsen, P. Petersson, and W. Yi. Uppaal: Status & Developments. In Proc. of the 9th Conference on Computer-Aided Verification, CAV ’97, LNCS 1254, pages 456–459. S. Owre, J. Rushby, N. Shankar, and F. von Henke. Formal verification for fault-tolerant architectures: Prolegomena to the design of PVS. IEEE Transactions on Software Engineering, 21(2):107-125, 1995. H.B. Sipma, T.E. Uribe, and Z. Manna. Deductive model checking. In Proc. of the 8th Conference on Computer-Aided Verification, CAV ’96, LNCS 1102, pages 208–219.

10.1007/b107031130013

S y m b o lic M o d e l C h e c k in g w ith o u t B D D s



A rm in B ie re 1 , A le s s a n d ro C im a tti2 , E d m u n d C la rk e 1 , a n d Y u n s h a n Z h u 1

C o m p u te r 5 0 0 0 F {A r m i n . B i e r e , 2 I s titu to v ia

S c ie n c e D e p o rb e s A v e n u E d m u n d . C l p e r la R ic e rc S o m m a r iv e c i m a t t

a rtm e n t, C a rn e g ie e , P itts b u rg h , P A 1 a r k e , Y u n s h a n a S c ie n tifi c a e T e c 1 8 , 3 8 0 5 5 P o v o (T i @ i r s t . i t c . i

M e llo n U 5 2 1 3 , U .S . Z h u }@ c n o lo g ic a ( N ), Ita ly t

1

n iv e r s ity .A s . c m u . e d u IR S T )

A b s tr a c t. S y m b o lic M o d e l C h e c k in g [3 , 1 4 ] h a s p ro v e n to b e a p o w e rfu l te c h n iq u e f o r th e v e r ifi c a tio n o f r e a c tiv e s y s te m s . B D D s [ 2 ] h a v e tr a d itio n a lly b e e n u s e d a s a s y m b o lic re p re s e n ta tio n o f th e s y s te m . In th is p a p e r w e s h o w h o w b o o l e a n d e c i s i o n p r o c e d u r e s , l i k e S t a˚ l m a r c k ’ s M e t h o d [ 1 6 ] o r t h e D a v i s & P u t n a m P ro c e d u re [7 ], c a n re p la c e B D D s . T h is n e w te c h n iq u e a v o id s th e s p a c e b lo w u p o f B D D s , g e n e ra te s c o u n te re x a m p le s m u c h fa s te r, a n d s o m e tim e s s p e e d s u p th e v e rifi c a tio n . In a d d itio n , it p ro d u c e s c o u n te re x a m p le s o f m in im a l le n g th . W e in tro d u c e a b o u n d e d m o d e l c h e c k in g p ro c e d u re fo r L T L w h ic h re d u c e s m o d e l c h e c k in g to p ro p o s itio n a l s a tis fi a b ility . W e s h o w th a t b o u n d e d L T L m o d e l c h e c k in g c a n b e d o n e w ith o u t a ta b le a u c o n s tru c tio n . W e h a v e im p le m e n te d a m o d e l c h e c k e r B M C , b a s e d o n b o u n d e d m o d e l c h e c k in g , a n d p re lim in a ry re s u lts a re p re s e n te d .

1

I n tr o d u c tio n

M o d e l c h e c k in g [ 4 ] is a p o w e r f u l te c h n iq u e f o r v e r if y in g r e a c tiv e s y s te m s . A b le to fi n d s u b tle e rro rs in re a l c o m m e rc ia l d e s ig n s , it is g a in in g w id e in d u s tria l a c c e p ta n c e . C o m p a r e d to o th e r f o r m a l v e r ifi c a tio n te c h n iq u e s ( e .g . th e o r e m p r o v in g ) m o d e l c h e c k in g is la rg e ly a u to m a tic . In m o d e l c h e c k in g , th e s p e c ifi c a tio n is e x p re s s e d in te m p o ra l lo g ic a n d th e s y s te m is m o d e le d a s a fi n ite s ta te m a c h in e . F o r re a lis tic d e s ig n s , th e n u m b e r o f s ta te s o f th e s y s te m c a n b e v e ry la rg e a n d th e e x p lic it tra v e rs a l o f th e s ta te s p a c e b e c o m e s in fe a s ib le . S y m b o lic m o d e l c h e c k in g [3 , 1 4 ], w ith b o o le a n e n c o d in g o f th e fi n ite s ta te m a c h in e , c a n h a n d le m o re th a n 1 0 2 0 s ta te s . B D D s [2 ], a c a n o n ic a l fo rm fo r b o o le a n e x p re s s io n s , h a v e tra d itio n a lly b e e n u s e d a s th e u n d e rly in g re p re s e n ta tio n fo r s y m b o lic m o d e l c h e c k e rs [1 4 ]. M o d e l c h e c k e rs b a s e d o n B D D s a re u s u a lly a b le to h a n d le s y s te m s w ith h u n d re d s o f s ta te v a ria b le s . H o w e v e r, fo r la rg e r s y s te m s th e B D D s g e n e ra te d d u rin g m o d e l c h e c k in g b e c o m e to o la rg e fo r c u rre n tly a v a ila b le c o m p u te rs . In a d d itio n , 

T h N o A n th o G o

is re s e a rc h is s p o n s o r . 9 7 -D J -2 9 4 a n d th e y o p in io n s , fi n d in g s s e o f th e a u th o rs a n d v e rn m e n t.

e d N a a n d o

b y th e tio n a l d c o n c n o t n e

S e m ic o n d u S c ie n c e F o lu s io n s o r c e s s a rily re

c to r R e s e a r u n d a tio n (N re c o m m e n d fl e c t th e v ie

c h C o rp o ra tio n (S S F ) u n d e r G ra n t a tio n s e x p re s s e d w s o f S R C , N S F ,

W .R . C le a v e la n d (E d .): T A C A S /E T A P S ’9 9 , L N C S 1 5 7 9 , p p . 1 9 3 – 2 0 7 , 1 9 9 9 . c S p rin g e r-V e rla g B e rlin H e id e lb e rg 1 9 9 9 

R C N o in o r

) u n . C C th is th e U

d e R m n

r C o n -9 5 0 5 a te ria ite d S

tra c t 4 7 2 . l a re ta te s

1 9 4

A rm in B ie re , A le s s a n d ro C im a tti, E d m u n d C la rk e , a n d Y u n s h a n Z h u

s e le c tin g th e rig h t o rd e rin g o f B D D v a ria b le s is v e ry im p o rta n t. T h e g e n e ra tio n o f a v a ria b le o rd e rin g th a t re s u lts in s m a ll B D D s is o fte n tim e c o n s u m in g o r n e e d s m a n u a l in te rv e n tio n . F o r m a n y e x a m p le s n o s p a c e e ffi c ie n t v a ria b le o rd e rin g e x is ts . P ro p o s itio n a l d e c is io n p ro c e d u re s (S A T ) [7 ] a ls o o p e ra te o n b o o le a n e x p re s s io n s b u t d o n o t u s e c a n o n ic a l fo rm s . T h e y d o n o t s u ffe r fro m th e p o te n tia l s p a c e e x p lo s io n o f B D D s a n d c a n h a n d le p ro p o s itio n a l s a tis fi a b ility p ro b le m s w ith th o u s a n d s o f v a ria b le s . S A T b a s e d te c h n iq u e s h a v e b e e n s u c c e s s fu lly a p p lie d in v a rio u s d o m a in s , s u c h a s h a rd w a re v e rifi c a tio n [1 7 ], m o d a l lo g ic s [9 ], fo rm a l v e rifi c a tio n o f ra ilw a y c o n tro l s y s te m s [1 ], a n d A I p la n n in g s y s te m s [1 1 ]. A n u m b e r o f e ffi c ie n t im p le m e n ta tio n s a re a v a i l a b l e . S o m e n o t a b l e e x a m p l e s a r e t h e P R O V E t o o l [ 1 ] b a s e d o n S t a˚ l m a r c k ’ s M e t h o d [1 6 ], a n d S A T O [1 8 ] b a s e d o n th e D a v is & P u tn a m P ro c e d u re [7 ]. In th is p a p e r w e p re s e n t a s y m b o lic m o d e l c h e c k in g te c h n iq u e b a s e d o n S A T p ro c e d u re s . T h e b a s ic id e a is to c o n s id e r c o u n te re x a m p le s o f a p a rtic u la r le n g th k a n d g e n e ra te a p ro p o s itio n a l fo rm u la th a t is s a tis fi a b le iff s u c h a c o u n te re x a m p le e x is ts . In p a rtic u la r, w e in tro d u c e th e n o tio n o f b o u n d e d m o d e l c h e c k in g , w h e re th e b o u n d is th e m a x im a l le n g th o f a c o u n te re x a m p le . W e s h o w th a t b o u n d e d m o d e l c h e c k in g fo r lin e a r te m p o ra l lo g ic (L T L ) c a n b e re d u c e d to p ro p o s itio n a l s a tis fi a b ility in p o ly n o m ia l tim e . T o p ro v e th e c o rre c tn e s s a n d c o m p le te n e s s o f o u r te c h n iq u e , w e e s ta b lis h a c o rre s p o n d e n c e b e tw e e n b o u n d e d m o d e l c h e c k in g a n d m o d e l c h e c k in g in g e n e ra l. U n lik e p re v io u s a p p ro a c h e s to L T L m o d e l c h e c k in g , o u r m e th o d d o e s n o t re q u ire a ta b le a u o r a u to m a to n c o n s tru c tio n . T h e m a in a d v a n ta g e s o f o u r te c h n iq u e a re th e fo llo w in g . F irs t, b o u n d e d m o d e l c h e c k in g fi n d s c o u n te re x a m p le s v e ry fa s t. T h is is d u e to th e d e p th fi rs t n a tu re o f S A T s e a rc h p ro c e d u re s . F in d in g c o u n te re x a m p le s is a rg u a b ly th e m o s t im p o rta n t fe a tu re o f m o d e l c h e c k in g . S e c o n d , it fi n d s c o u n te re x a m p le s o f m in im a l le n g th . T h is fe a tu re h e lp s th e u s e r to u n d e rs ta n d a c o u n te re x a m p le m o re e a s ily . T h ird , b o u n d e d m o d e l c h e c k in g u s e s m u c h le s s s p a c e th a n B D D b a s e d a p p ro a c h e s . F in a lly , u n lik e B D D b a s e d a p p ro a c h e s , b o u n d e d m o d e l c h e c k in g d o e s n o t n e e d a m a n u a lly s e le c te d v a ria b le o rd e r o r tim e c o n s u m in g d y n a m ic re o rd e rin g . D e fa u lt s p littin g h e u ris tic s a re u s u a lly s u ffi c ie n t. T o e v a lu a te o u r id e a s w e h a v e im p le m e n te d a to o l B M C b a s e d o n b o u n d e d m o d e l c h e c k in g . W e g iv e e x a m p le s in w h ic h S A T b a s e d m o d e l c h e c k in g s ig n ifi c a n tly o u tp e rfo rm s B D D b a s e d m o d e l c h e c k in g . In s o m e c a s e s b o u n d e d m o d e l c h e c k in g d e te c ts e rro rs in s ta n tly , w h ile th e B D D s fo r th e in itia l s ta te c a n n o t b e b u ilt. T h e p a p e r is o rg a n iz e d a s fo llo w s . In th e fo llo w in g s e c tio n w e e x p la in th e b a s ic id e a o f b o u n d e d m o d e l c h e c k in g w ith a n e x a m p le . I n S e c tio n 3 w e g iv e th e s e m a n tic s fo r b o u n d e d m o d e l c h e c k in g . S e c tio n 4 e x p la in s th e tra n s la tio n o f a b o u n d e d m o d e l c h e c k in g p ro b le m in to a p ro p o s itio n a l s a tis fi a b ility p ro b le m . In S e c tio n 5 w e d is c u s s b o u n d s o n th e le n g th o f c o u n te re x a m p le s . In S e c tio n 6 o u r e x p e rim e n ta l re s u lts a re p re s e n te d , a n d S e c tio n 7 d e s c rib e s s o m e d ire c tio n s fo r fu tu re re s e a rc h .

2

E x a m p le

C o n s id e r th e fo llo w in g s im p le s ta te m a c h in e M th a t c o n s is ts o f a th re e b it s h ift re g is te r x w i t h t h e i n d i v i d u a l b i t s d e n o t e d b y x [0 ], x [1 ], a n d x [2 ]. T h e p r e d i c a t e T (x , x + ) d e n o t e s th e tra n s itio n re la tio n b e tw e e n c u rre n t s ta te v a lu e s x a n d n e x t s ta te v a lu e s x + a n d is

S y m b o lic M o d e l C h e c k in g w ith o u t B D D s

e q u iv a le n t to :

1 9 5

(x + [0 ] = x [1 ]) ∧ (x + [1 ] = x [2 ]) ∧ (x + [2 ] = 1 )

I n t h e i n i t i a l s t a t e t h e c o n t e n t o f t h e r e g i s t e r x c a n b e a r b i t r a r y . T h e p r e d i c a t e I (x ) t h a t d e n o t e s t h e s e t o f i n i t i a l s t a t e s i s true. T h is s h ift re g is te r is m e a n t to b e e m p ty (a ll b its s e t to z e ro ) a fte r th re e c o n s e c u tiv e s h if ts . B u t w e in tr o d u c e d a n e r r o r in th e tr a n s itio n r e la tio n f o r th e n e x t s ta te v a lu e o f x [2 ], w h e r e a n i n c o r r e c t v a l u e 1 i s u s e d i n s t e a d o f 0 . T h e r e f o r e , t h e p r o p e r t y , t h a t e v e n t u a l l y t h e r e g i s t e r w i l l b e e m p t y ( w r i t t e n a s x =0 ) a f t e r a s u f fi c i e n t l y l a r g e n u m b e r o f s t e p s i s n o t v a l i d . T h i s p r o p e r t y c a n b e f o r m u l a t e d a s t h e L T L f o r m u l a F (x = 0 ). W e t r a n s l a t e t h e “ u n i v e r s a l ” m o d e l c h e c k i n g p r o b l e m A F (x = 0 ) i n t o t h e “ e x i s t e n t i a l ” m o d e l c h e c k i n g p r o b l e m E G (x = 0 ) b y n e g a t i n g t h e f o r m u l a . T h e n , w e c h e c k i f t h e r e i s a n e x e c u t i o n s e q u e n c e t h a t f u l fi l l s G (x = 0 ). I n s t e a d o f s e a r c h i n g f o r a n a r b i t r a r y p a t h , w e r e s t r i c t o u r s e l v e s t o p a t h s t h a t h a v e a t m o s t k +1 s t a t e s , f o r i n s t a n c e w e c h o o s e k =2 . C a l l t h e fi r s t t h r e e s t a t e s o f t h i s p a t h x 0 , x 1 a n d x 2 a n d l e t x 0 b e t h e i n i t i a l s t a t e ( s e e F ig u re 1 ). S in c e th e in itia l c o n te n t o f x c a n b e a rb itra ry , w e d o n o t h a v e a n y re s tric tio n

L 0 x [0 ] 0 x [1 ] 0

x [0 ] 1 x [1 ] 1

x [2 ] 0

x [2 ] 1

x

x 0

1

L 1

x [0 ] 2 x [1 ] 2

L 2

x [2 ] 2 x 2

F ig . 1 . U n ro llin g th e tra n s itio n re la tio n tw ic e a n d a d d in g a b a c k lo o p . o n x 0 . W e u n r o ll th e tr a n s itio n r e la tio n tw ic e a n d d e r iv e th e p r o p o s itio n a l f o r m u la fm d e fi n e d a s I (x 0 ) ∧ T (x 0 , x 1 ) ∧ T (x 1 , x 2 ). W e e x p a n d t h e d e fi n i t i o n o f T a n d I , a n d g e t t h e fo llo w in g fo rm u la .

A n w e o r w h

y p a th w re q u ire to its e lf ic h is e q

(x 1 [0 ] = x 0 [1 ]) ∧ (x 1 [1 ] = x 0 [2 ]) ∧ (x 1 [2 ] = 1 ) ∧

1 s t s te p

(x 2 [0 ] = x 1 [1 ]) ∧ (x 2 [1 ] = x 1 [2 ]) ∧ (x 2 [2 ] = 1 )

2 n d s te p

ith th a (se u iv

th re e s ta te s th a t is a t th e re is a tra n s itio n e a ls o F ig u re 1 ). W e a le n t to th e fo llo w in g

“ w fro re fo m

i t n e s s ” f o r G (x = 0 ) m u s t c o n t a i n a l o o p . T h u s , x 2 b a c k to th e in itia l s ta te , to th e s e c o n d s ta te , p r e s e n t t h i s t r a n s i t i o n a s L i d e fi n e d a s T (x 2 , x i ) rm u la .

(x i [0 ] = x 2 [1 ]) ∧ (x i [1 ] = x 2 [2 ]) ∧ (x i [2 ] = 1 ) F in a lly , w e h a v e to m a k e s u re th a t th is p a th w ill fu lfi ll th e c o n s tra in ts im p o s e d b y th e f o r m u l a G (x = 0 ). I n t h i s c a s e t h e p r o p e r t y S i d e fi n e d a s x i = 0 h a s t o h o l d a t e a c h s t a t e . S i is e q u iv a le n t to th e f o llo w in g f o r m u la . (x i [0 ] = 1 ) ∨ (x i [1 ] = 1 ) ∨ (x i [2 ] = 1 )

1 9 6

A rm in B ie re , A le s s a n d ro C im a tti, E d m u n d C la rk e , a n d Y u n s h a n Z h u

P u ttin g th is a ll to g e th e r w e d e r iv e th e f o llo w in g p r o p o s itio n a l f o r m u la . 2

f M

∧ i =0

S 2

L i∧

(1 ) i

i =0

T h is fo rm u la is s a tis fi a b le iff th e re is a c o u n te re x a m p le o f le n g th 2 fo r th e o rig in a l f o r m u l a F (x = 0 ). I n o u r e x a m p l e w e fi n d a s a t i s f y i n g a s s i g n m e n t f o r (1 ) b y s e t t i n g x i [ j ] : = 1 f o r a l l i , j = 0 ,1 ,2 .

3

S e m a n tic s A C T L * is d e fi n e d a s th e s u b s e t o f fo rm u la s o f C T L * [8 ] th a t a re in n e g a tio n n o rm a l f o r m a n d c o n ta in o n ly u n iv e r s a l p a th q u a n tifi e r s . A f o r m u la is in n e g a tio n n o r m a l fo r m (N N F ) if n e g a tio n s o n ly o c c u r in fro n t o f a to m ic p ro p o s itio n s . E C T L * is d e fi n e d in th e s a m e w a y , b u t o n ly e x is te n tia l p a th q u a n tifi e rs a re a llo w e d . W e c o n s id e r th e n e x t tim e o p e ra to r ‘X ’, th e e v e n tu a lity o p e ra to r ‘F ’, th e g lo b a lly o p e ra to r ‘G ’, a n d th e u n til o p e ra to r ‘U ’. W e a s s u m e th a t fo rm u la s a re in N N F . W e c a n a lw a y s tra n s fo rm a fo rm u la in N N F w ith o u t in c re a s in g its s iz e b y in c lu d in g th e re le a s e o p e ra to r ‘R ’ ( f R g i f f ¬(¬ f U ¬g )) . I n a n L T L f o r m u l a n o p a t h q u a n t i fi e r s ( E o r A ) a r e a l l o w e d . I n th is p a p e r w e c o n c e n tra te o n L T L m o d e l c h e c k in g . O u r te c h n iq u e c a n b e e x te n d e d to h a n d le fu ll A C T L * (re s p . E C T L * ).

D e fi n i t i o n 1 . A K r i p k e s t r u c t u r e i s a t u p l e M = (S , I , T , ) w i t h a fi n i t e s e t o f s t a t e s S , t h e s e t o f i n i t i a l s t a t e s I ⊆ S , a t r a n s i t i o n r e l a t i o n b e t w e e n s t a t e s T ⊆ S ×S , a n d t h e l a b e l i n g o f t h e s t a t e s : S → P (A ) w i t h a t o m i c p r o p o s i t i o n s A . W e u s e K r ip k e s tr u c tu r e s a s m o d e ls in o r d e r to g iv e th e s e m a n tic s o f th e lo g ic . F o r th e re s t o f th e p a p e r w e c o n s id e r o n ly K rip k e s tru c tu re s fo r w h ic h w e h a v e a b o o le a n e n c o d i n g . W e r e q u i r e t h a t S = {0 , 1 }n , a n d t h a t e a c h s t a t e c a n b e r e p r e s e n t e d b y a v e c t o r o f s t a t e v a r i a b l e s s = (s (1 ), . . . , s (n )) w h e r e s (i ) f o r i = 1 , . . . , n a r e p r o p o s i t i o n a l v a r i a b l e s . W e d e fi n e p r o p o s i t i o n a l f o r m u l a s f I (s ), f T (s ,t ) a n d f p (s ) a s : f I (s ) i f f s ∈ I , f T (s ,t ) i f f (s ,t ) ∈ T , a n d f p (s ) i f f p ∈ (s ). F o r t h e r e s t o f t h e p a p e r w e s i m p l y u s e T (s ,t ) i n s t e a d o f f T (s ,t ) e t c . I n a d d i t i o n , w e r e q u i r e t h a t e v e r y s t a t e h a s a s u c c e s s o r s t a t e . T h a t i s , f o r a l l s ∈ S t h e r e i s a t ∈ S w i t h (s ,t ) ∈ T . F o r (s ,t ) ∈ T w e a l s o w r i t e s → t . F o r a n i n fi n i t e s e q u e n c e o f s t a t e s π = (s 0 , s 1 , . . .) w e d e fi n e π (i ) = s i a n d π i = (s i , s i +1 , . . .) f o r i ∈ I N . A n i n fi n i t e s e q u e n c e o f s t a t e s π i s a p a t h i f π (i ) → π (i + 1 ) f o r a l l i ∈ I N . D e fi n itio n 2 (S e m a n tic s ). L e t M b e a K r ip k e s tr u c tu re , π b e a p a th in M L T L f o r m u l a . T h e n π |= f ( f i s v a l i d a l o n g π ) i s d e fi n e d a s f o l l o w s .

a n d f b e a n

π |= p

iff

p ∈ (π (0 ))

π |= ¬p

iff

p ∈ (π (0 ))

π |= f ∧ g

iff

π |= f a n d π |= g

π |= f ∨ g

iff

π |= f o r π |= g

iff

∀i . π

π |= F f

iff

∃i . π

π |= X f

iff

π

π |= f U g

iff

∃i [ π i

|= g

iff

∀i [ π i

|= g

π |= G f

π |= f R g

1

|= f i

|= f a n d

∀j , j < i . π j

|= f ]

o r

∃j , j < i . π j

|= f ]

i

|= f

S y m b o lic M o d e l C h e c k in g w ith o u t B D D s

D e fi n itio n 3 (V a lid ity ). ( i n s y m b o l s M |= A f ) i f f e x is te n tia lly v a lid in a K π i n M w i t h π |= f a n d π

1 9 7

A n L T L fo r m u la f is u n iv e r s a lly v a lid in a K r ip k e s tr u c tu r e M π |= f f o r a l l p a t h s π i n M w i t h π (0 ) ∈ I . A n L T L f o r m u l a f i s r i p k e s t r u c t u r e M ( i n s y m b o l s M |= E f ) i f f t h e r e e x i s t s a p a t h (0 ) ∈ I .

D e te r m in in g w h e th e r a n L T L f o r m u la f is e x is te n tia lly ( r e s p . u n iv e r s a lly ) v a lid in a g iv e n K r ip k e s tr u c tu r e is c a lle d a n e x is te n tia l ( r e s p . u n iv e r s a l) m o d e l c h e c k in g p r o b le m . In c o n fo rm a n c e to th e s e m a n tic s o f C T L * [8 ], it is c le a r th a t a n L T L fo rm u la f is u n i v e r s a l l y v a l i d i n a K r i p k e s t r u c t u r e M i f f ¬f i s n o t e x i s t e n t i a l l y v a l i d . I n o r d e r t o s o lv e th e u n iv e r s a l m o d e l c h e c k in g p r o b le m , w e n e g a te th e f o r m u la a n d s h o w th a t th e e x is te n tia l m o d e l c h e c k in g p r o b le m f o r th e n e g a te d f o r m u la h a s n o s o lu tio n . I n tu itiv e ly , w e a re try in g to fi n d a c o u n te re x a m p le , a n d if w e d o n o t s u c c e e d th e n th e fo rm u la is u n iv e r s a lly v a lid . T h e r e f o r e , in th e th e o r y p a r t o f th e p a p e r w e o n ly c o n s id e r th e e x is te n tia l m o d e l c h e c k in g p ro b le m . T h e b a s ic id e a o f b o u n d e d m o d e l c h e c k in g is to c o n s id e r o n ly a fi n ite p re fi x o f a p a th th a t m a y b e a s o lu tio n to a n e x is te n tia l m o d e l c h e c k in g p ro b le m . W e re s tric t th e le n g th o f th e p r e fi x b y a c e r ta in b o u n d k . I n p r a c tic e w e p r o g r e s s iv e ly in c r e a s e th e b o u n d , lo o k in g fo r lo n g e r a n d lo n g e r p o s s ib le c o u n te re x a m p le s . A c ru c ia l o b s e rv a tio n is th a t, th o u g h th e p re fi x o f a p a th is fi n ite , it s till m ig h t re p re s e n t a n in fi n ite p a th if th e re is a b a c k lo o p fro m th e la s t s ta te o f th e p re fi x to a n y o f th e p re v io u s s ta te s (s e e F ig u re 2 (b )). If th e re is n o s u c h b a c k lo o p (s e e F ig u re 2 (a )), th e n th e p re fi x d o e s n o t s a y a n y th in g a b o u t th e in fi n ite b e h a v io r o f th e p a th . F o r in s ta n c e , o n ly a p re fi x w ith a b a c k lo o p c a n re p re s e n t a w itn e s s fo r G p . E v e n if p h o ld s a lo n g a ll th e s ta te s fro m s 0 to s k , b u t th e re is n o b a c k lo o p fro m s k to a p re v io u s s ta te , th e n w e c a n n o t c o n c l u d e t h a t w e h a v e f o u n d a w i t n e s s f o r G p , s i n c e p m i g h t n o t h o l d a t s k +1 .

S

(a )

S i

n o lo o p

k

S l

(b )

S i

S k

(k , l )- l o o p

F ig . 2 . T h e tw o c a s e s fo r a b o u n d e d p a th .

D e fi n i t i o n 4 . F o r l ≤ k w e c a l l a p a t h π a (k , l )- l o o p i f π (k ) → π (l ) a n d π = u · v ω w i t h u = (π (0 ), . . . , π (l − 1 )) a n d v = (π (l ), . . . , π (k )). W e c a l l π s i m p l y a k - l o o p i f t h e r e i s a n l ∈ I N w i t h l ≤ k f o r w h i c h π i s a (k , l )- l o o p . W e g iv e o f D e fi n itio n n e x t s e c tio n s a tis fi a b ility In th e b o w e o n ly u s e

a b o u n d e d 2 . It a llo w w e w ill g p ro b le m . u n d e d se m th e fi rs t k

s e m a n tic s th a t is a n a p p ro x im a tio n to th e u n b o u n d e d s e m a n tic s s u s to d e fi n e th e b o u n d e d m o d e l c h e c k in g p ro b le m a n d in th e iv e a tr a n s la tio n o f a b o u n d e d m o d e l c h e c k in g p r o b le m in to a a n tic s w e o n ly c o n s id e r a fi n ite p re fi x o f a p a th . In p a rtic u la r, + 1 s t a t e s ( s 0 ,...,s k ) o f a p a t h t o d e t e r m i n e t h e v a l i d i t y o f a

1 9 8

A rm in B ie re , A le s s a n d ro C im a tti, E d m u n d C la rk e , a n d Y u n s h a n Z h u

fo rm u la a lo n g th a t p a th . If a p a th is a k -lo o p th e n w e s im p ly m a in ta in th e o rig in a l L T L s e m a n tic s , s in c e a ll th e in fo rm a tio n a b o u t th is (in fi n ite ) p a th is c o n ta in e d in th e p re fi x o f le n g th k . D e fi n i t i o n 5 ( B o u n d e d S e m a n t i c s f o r a L o o p ) . L e t k ∈IN a n d π b e a k - l o o p . T h e n a n L T L f o r m u l a f i s v a l i d a l o n g t h e p a t h π w i t h b o u n d k ( i n s y m b o l s π |=k f ) i f f π |= f . u n b π i o T h e π . W se m o f π

A s s u m e th o u n d e d se m f π . In th e re fo re , w e e k e e p th e a n tic s a n d . In L e m m

a t π is n o t a k -lo o p . T h a n tic s if w e c a n fi n d a n b o u n d e d s e m a n tic s th e c a n n o t d e fi n e th e b o u n d o rig in a l π in s te a d b u t a u s e t h e n o t a t i o n |=ik . T h a 7 w e w ill s h o w th a t π

e n in (k e d d d e p |=ik

th e fo rm u la f :=F p is v a lid a lo n g π in th d e x i ∈IN s u c h t h a t p i s v a l i d a l o n g t h e s u f fi + 1 )- t h s t a t e π (k ) d o e s n o t h a v e a s u c c e s s o s e m a n tic s r e c u r s iv e ly o v e r s u ffi x e s ( e .g . π i) o a p a ra m e te r i in th e d e fi n itio n o f th e b o u n d e a ra m e te r i is th e c u rre n t p o s itio n in th e p re fi f i m p l i e s π i |= f .

e x r. f d x

D e fi n it io n 6 ( B o u n d e d S e m a n t ic s w it h o u t a L o o p ) . L e t k ∈IN , a n d le t π b e a p a th th a t is n o t a k -lo o p . T h e n a n L T L fo r m u la f is v a lid a lo n g π w ith b o u n d k (in s y m b o ls π |=k f ) i f f π |=0k f w h e r e π |=ik p π

|=i k

p ∈ (π (i ))

iff f ∧g

iff

π

|=i k

f a n d π

|=i k

π |=ik ¬p

iff

p ∈ (π (i ))

|=i

iff

π |=ik f o r π |=ik g

iff

∃ j , i ≤ j ≤ k . π |=k f

π g

k

f ∨g

π |=ik F f

j

π |=ik G f

is a lw a y s fa ls e

π |=ik X f

iff

i < k a n d π |=ik +1 f

π |=ik f U g

iff

∃ j , i ≤ j ≤ k [ π |=k g

a n d

∀n , i ≤ n < j . π |=nk f ]

π |=ik f R g

iff

∃ j , i ≤ j ≤ k [ π |=k j f

a n d

∀n , i ≤ n ≤ j . π |=nk g ]

j

N o te th a t if π is n o t a k -lo o p , th e n w e s a y th a t G f is n o t v a lid a lo n g π in th e b o u n d e d s e m a n t i c s w i t h b o u n d k s i n c e f m i g h t n o t h o l d a l o n g π k +1 . S i m i l a r l y , t h e c a s e f o r f R g w h e re g a lw a y s h o ld s a n d f is n e v e r fu lfi lle d h a s to b e e x c lu d e d . T h e s e c o n s tra in ts i m p l y t h a t f o r t h e b o u n d e d s e m a n t i c s t h e d u a l i t y o f G a n d F ( ¬F f ≡ G ¬ f ) a n d t h e d u a l i t y o f R a n d U ( ¬( f U g ) ≡ (¬ f ) R (¬g )) n o l o n g e r h o l d . T h e e x is te n tia l a n d u n iv e r s a l b o u n d e d m o d e l c h e c k in g p r o b le m s a r e d e fi n e d in th e s a m e m a n n e r a s in D e fi n itio n 3 . N o w w e d e s c rib e h o w th e e x is te n tia l m o d e l c h e c k in g p r o b l e m ( M |= E f ) c a n b e r e d u c e d t o a b o u n d e d e x i s t e n t i a l m o d e l c h e c k i n g p r o b l e m ( M |=k E f ) . L e m m a 7 . L e t h b e a n L T L f o r m u l a a n d π a p a t h , t h e n π |=k h ⇒ π |= h P ro o f. If π is a s s u m e th a t π i ≤k th e s tr o n c a se h =f R g

a k -lo o p th e n th e c o n c lu s io n fo llo w s b y d e fi n itio n . In th e o th e r c a s e w e is n o t a lo o p . T h e n w e p ro v e b y in d u c tio n o v e r th e s tru c tu re o f f a n d g e r p r o p e r t y π |=ik h ⇒ π i |= h . W e o n l y c o n s i d e r t h e m o s t c o m p l i c a t e d .

π |=ik f R g

⇔ ∃ j , i ≤ j ≤ k [ π |=k j f a n d ∀n , i ≤ n ≤ j . π |=nk g ] ⇒ ∃j , i ≤ j ≤ k [ π ⇒ ∃j , i ≤ j [ π j

j

|= f a n d ∀n , i ≤ n ≤ j . π

|= f a n d ∀n , i ≤ n ≤ j . π n

n

|= g ]

|= g ]

S y m b o lic M o d e l C h e c k in g w ith o u t B D D s

1 9 9

L e t j + = j −i a n d n + = n −i ⇒ ∃j + [ π

i +j +

|= f a n d ∀n + , n + ≤ j + . π

⇒ ∃ j [ (π i

)j

|= f a n d ∀n , n ≤ j . (π

i )n

|= g

⇒ ∀n [ (π ⇒ π i

o r ∃ j , j < n . (π i

i +n +

i )n

)j

|= g ]

|= g ]

|= f ]

|= f R g

In th e n e x t-to -la s t s te p w e u s e d th e fo llo w in g fa c t: ∃m [ π m

|= f a n d ∀l , l ≤ m . π

A s s u m e th a t m is th In th e fi rs t c a s e w e t h a t π j |= f ( c h o o s e h a v e π n |= g f o r a l l rig h t h a n d s id e is fu

l

|= g ]

e s m a lle s t n u m b e r c o n s id e r n >m . B j =m ) . T h e s e c o n n ≤m . T h u s , f o r lfi lle d .

su c h a se d d c a a ll n

⇒

∀n [ π n

|= g o r ∃ j , j < n . π

t h a t π m |= f a n d π l |= g o n th e a s s u m p tio n , th e s e i s n ≤m . B e c a u s e π l w e h a v e p ro v e n th a t th

L e m m a 8 . L e t f b e a n L T L fo r m u la f a n d M e x i s t s k ∈ I N w i t h M |=k E f

fo r a ll l re e x is ts |= g f o r a e d is ju n c

a K r ip k e s tr u c tu re . If M

j

|= f ]

w i t h l ≤m j 1 7 h

S M V 2 se c M B 2 5 7 9 2 5 7 9 2 6 8 0 2 7 8 2 3 3 9 2 6 7 1 0 2 2 5 8 1 7 2 1 7 4 1 4 9 2 >1 G B

7 1 9 2 3

2 2 0 2

S A T O -g 5 se c M B 0 0 0 0 0 0 0 0 2 0 1 2 0 5 5 0 2 0 9 0 4 7 3 0 8 5 6 1 1 8 3 7 1 2 3 6 7 1 3 8 3 0 1 5 1 2 8 1 4 7 5 2 1 4 4 4 9 1 2 3 9 7 0

S A T O -g 5 0 se c M B 0 1 0 1 0 2 0 3 3 4 3 6 7 2 0 8 1 0 6 4 2 1 3 1 1 9 8 1 6 2 4 1 3 2 0 2 0 5 5 2 0 1 6 6 7 1 9 9 7 6 1 7 4 3 6 3 2 5 2 1 7 0 2 3 6 8 4 7 3 1 2 2 5 7 8

P R O V E se c M B 0 1 0 1 0 1 1 2 1 2 1 2 2 2 7 3 2 9 3 5 8 3 9 1 3 1 2 5 3 1 5 6 4 1 8 6 4 2 2 6 4 1 8 3 5 1 0 6 6

T a b le 1 . 1 6 x 1 6 b it s e q u e n tia l s h ift a n d a d d m u ltip lie r w ith o v e rfl o w fl a g a n d 1 6 o u tp u t b its (s e c = s e c o n d s , M B = M e g a B y te ).

S y m b o lic M o d e l C h e c k in g w ith o u t B D D s

2 0 5

In th e c o lu m n S M V 1 o f T a b le 1 th e o ffi c ia l v e rs io n o f th e C M U m o d e l c h e c k e r S M V w a s u s e d . S M V 2 is a v e rs io n b y B w o le n Y a n g fro m C M U w ith im p ro v e d s u p p o rt f o r c o n ju n c tiv e p a r titio n in g . W e u s e d a m a n u a lly c h o s e n v a r ia b le o r d e r in g w h e r e th e b its o f re g is te rs a re in te rle a v e d . D y n a m ic re o rd e rin g fa ile d to fi n d a c o n s id e ra b ly b e tte r o rd e rin g in a re a s o n a b le a m o u n t o f tim e . W e u s e d a b a rre l s h ifte r a s a n o th e r e x a m p le . It ro ta te s th e c o n te n ts o f a re g is te r fi le b w ith e a c h s te p b y o n e p o s itio n . T h e m o d e l a ls o c o n ta in s a n o th e r re g is te r fi le r th a t is re la te d to b in th e fo llo w in g w a y . If a re g is te r in r a n d o n e in b h a v e th e s a m e c o n te n ts th e n th e ir n e ig h b o rs a ls o h a v e th e s a m e c o n te n ts . T h is p ro p e rty h o ld s in th e in itia l s ta te o f th e m o d e l, a n d w e p ro v e d th a t it is v a lid in a ll s u c c e s s o r s ta te s . T h e re s u lts o f th is e x p e r i m e n t c a n b e f o u n d i n T a b l e 2 . T h e w i d t h o f t h e r e g i s t e r s i s c h o s e n t o b e l o g 2 |r | w h e r e |r | i s t h e n u m b e r o f r e g i s t e r s i n t h e r e g i s t e r fi l e r . I n t h i s c a s e w e w e r e a l s o a b l e t o p r o v e t h e r e c u r r e n c e d i a m e t e r ( s e e D e fi n i t i o n 2 2 ) t o b e |r |. T h i s t o o k o n l y v e r y l i t t l e tim e c o m p a re d to th e to ta l v e rifi c a tio n tim e a n d is s h o w n in th e c o lu m n “ d ia m e te r” . In [1 3 ] a n a s y n c h ro n o u s c irc u it fo r d is trib u te d m u tu a l e x c lu s io n is d e s c rib e d . It c o n s is ts o f n c e lls f o r n u s e r s th a t w a n t to h a v e e x c lu s iv e a c c e s s to a s h a r e d r e s o u r c e . W e p r o v e d th e liv e n e s s p r o p e r ty th a t a r e q u e s t f o r u s in g th e r e s o u r c e w ill e v e n tu a lly b e a c k n o w le d g e d . T h is liv e n e s s p r o p e r ty is o n ly tr u e if e a c h a s y n c h r o n o u s g a te d o e s n o t d e la y e x e c u tio n in d e fi n ite ly . W e m o d e l th is a s s u m p tio n b y a fa irn e s s c o n s tra in t fo r e a c h i n d i v i d u a l g a t e . E a c h c e l l h a s e x a c t l y 1 8 g a t e s a n d t h e r e f o r e t h e m o d e l h a s n ·1 8 f a i r n e s s c o n s tra in ts w h e re n is th e n u m b e r o f c e lls . S in c e w e d o n o t h a v e a b o u n d fo r th e m a x im a l le n g th o f a c o u n te re x a m p le fo r th e v e rifi c a tio n o f th is c irc u it w e c o u ld n o t v e rify th e liv e n e s s p r o p e r ty c o m p le te ly . W e o n ly s h o w e d th a t th e r e a r e n o c o u n te r e x a m p le s o f p a rtic u la r le n g th k . T o illu s tra te th e p e rfo rm a n c e o f b o u n d e d m o d e l c h e c k in g w e h a v e c h o s e n k = 5 ,1 0 . T h e r e s u l t s c a n b e f o u n d i n T a b l e 3 . W e r e p e a te d th e e x p e r im e n t w ith a b u g g y d e s ig n . F o r th e liv e n e s s p r o p e r ty w e s im p ly re m o v e d s e v e ra l fa irn e s s c o n s tra in ts . B o th P R O V E a n d S A T O g e n e ra te a c o u n te re x a m p le (a 2 -lo o p ) in s ta n tly (s e e T a b le 4 ).

7

C o n c lu s io n T h is w o rk is th e fi rs t s te p in a p p ly in g W e b e lie v e th a t o u r te c h n iq u e h a s th e w h a t is c u rre n tly p o s s ib le . T o w a rd s th is o f re s e a rc h . W e w o u ld lik e to in v e s tig a s e a rc h in S A T p ro c e d u re s . N e w te c h n iq s y s te m . In p a rtic u la r, it w o u ld b e in te re Q B F . C o m b in in g b o u n d e d m o d e l c h e c k p re s e n ts a n o th e r in te re s tin g p ro b le m .

S A T p ro c e d u re s to s y m b o lic m p o te n tia l to h a n d le m u c h la rg g o a l, w e p ro p o s e s e v e ra l p ro m te h o w to u s e d o m a in k n o w le d u e s a re n e e d e d to d e te rm in e th s tin g to s tu d y e ffi c ie n t d e c is io n in g w ith o th e r s ta te s p a c e re d u c

o d e l c h e c k in g . e r d e s ig n s th a n is in g d ire c tio n s g e to g u id e th e e d ia m e te r o f a p ro c e d u re s fo r tio n te c h n iq u e s

2 0 6

A rm in B ie re , A le s s a n d ro C im a tti, E d m u n d C la rk e , a n d Y u n s h a n Z h u S M V 2

|r | s e c M B 3 1 4 9 1 4 9 4 1 3 8 3 5 6 5 0 9 4 4 7 >1 G B 7 8 9 1 0

S A T O d ia m se c 0 0 0 1 3 5 2 5 4 2

-g 1 0 0 e te r M B 1 1 2 4 6 8 1 4 1 9

S A T O -g 2 0 se c 0 0 6 0 3 6 4 1 2 5 2 2 1 6 0 >2 1 h

M B 0 1 2 4 6 9

P R O V E P R O V E d ia m e te r se c M B se c M B 0 1 0 1 0 1 0 1 0 1 1 2 0 1 2 3 0 2 2 4 0 2 7 5 0 3 1 6 9 1 4 5 5 1 1

T a b l e 2 . B a r r e l s h i f t e r ( |r | = n u m b e r o f r e g i s t e r s , s e c = s e c o n d s , M B = M e g a B y t e s ) . S M V 1

se c M B c e lls 4 8 4 6 1 1 2 1 6 6 1 5 5 6 4 8 5 7 1 8 9 9 8 5 2 4 7 1 9 5 9 5 3 1 8 9 >1 0 h 1 0 1 1 1 2 1 3 1 4 1 5

S M V se c 1 5 9 5 3 0 1 7 6 2 6 5 6 3

2

M B 2 1 7 7 0 3 7 0 3 8 3 3 >1 G B

S A T O k =5 se c M B 0 3 0 4 0 4 0 5 1 6 1 6 1 7 1 8 1 9 1 9 1 1 0 1 1 1

P R O V E k =5 se c M B 1 3 2 3 3 3 4 4 6 5 9 5 1 0 5 1 3 6 1 6 6 1 9 8 2 2 8 2 7 8

S A T O k =1 0 se c M B 3 6 9 8 7 9 1 5 1 0 1 6 1 2 2 4 1 3 3 6 1 5 3 8 1 6 4 0 1 8 1 0 7 1 9 7 0 2 1 1 6 8 2 2

P R O V E k =1 0 se c M B 5 4 5 9 5 5 1 4 9 6 2 2 4 8 3 2 3 8 4 4 4 9 6 1 4 1 0 8 2 0 1 1 1 0 4 4 1 1 1 3 1 7 1 2 1 6 3 4 1 4 1 9 9 2 1 5

T a b le 3 . L iv e n e s s f o r o n e u s e r in th e D M E ( s e c = s e c o n d s , M B = M e g a B y te s ) .

c e lls 4 5 6 7 8 9 1 0 1 1 1 2 1 3 1 4 1 5

S M se c 7 9 9 1 6 6 1 3 1 5 5 5 6 2 2 9 4 4 9 se g m e fa

V 1

M B 1 1 1 4 2 1 3 8 7 3 n ta tio n u lt

S M se c 1 4 2 4 4 0 7 4 1 1 8 1 7 2 2 4 4 4 1 3 7 1 9 8 4 3 1 0 6 0 1 4 2 9

V 2

M B 4 4 5 7 7 6 1 3 7 2 1 7 2 2 0 7 0 2 7 0 2 7 0 2 7 0 2 7 0 2 7 0 2

S A T O se c M B 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 2 0 2 0 2 0 2

P R O V E se c M B 0 2 0 2 0 2 0 2 0 2 1 2 0 3 0 3 1 3 1 3 1 3 1 3

T a b le 4 . C o u n te r e x a m p le f o r liv e n e s s in a b u g g y D M E ( s e c = s e c o n d s , M B = M e g a B y te s ).

S y m b o lic M o d e l C h e c k in g w ith o u t B D D s

2 0 7

R e fe r e n c e s

[

[ [

[

[ [ [

[

[

[ 1 ] A r n e B o r a¨ l v . T h e i n d u s t r i a l s u c c e s s o f v e r i fi c a t i o n t o o l s b a s e d o n S t a˚ l m a r c k ’ s M e t h o d . In O rn a G ru m b e rg , e d ito r, In te r n a tio n a l C o n fe re n c e o n C o m p u te r -A id e d V e r ifi c a tio n (C A V ’9 7 ), n u m b e r 1 2 5 4 in L N C S . S p rin g e r-V e rla g , 1 9 9 7 . [2 ] R . E . B ry a n t. G ra p h -b a s e d a lg o rith m s fo r b o o le a n fu n c tio n m a n ip u la tio n . IE E E T r a n s a c tio n s o n C o m p u te r s , 3 5 (8 ):6 7 7 – 6 9 1 , 1 9 8 6 . [3 ] J . R . B u rc h , E . M . C la rk e , a n d K . L . M c M illa n . S y m b o lic m o d e l c h e c k in g : 1 0 2 0 s ta te s a n d b e y o n d . In fo r m a tio n a n d C o m p u ta tio n , 9 8 :1 4 2 – 1 7 0 , 1 9 9 2 . [4 ] E . C la rk e a n d E . A . E m e rs o n . D e s ig n a n d s y n th e s is o f s y n c h ro n iz a tio n s k e le to n s u s in g b ra n c h in g tim e te m p o ra l lo g ic . In P ro c e e d in g s o f th e IB M W o r k s h o p o n L o g ic s o f P ro g r a m s , v o lu m e 1 3 1 o f L N C S , p a g e s 5 2 – 7 1 . S p rin g e r-V e rla g , 1 9 8 1 . [5 ] E . C la rk e , O . G ru m b e rg , a n d K . H a m a g u c h i. A n o th e r lo o k a t L T L m o d e l c h e c k in g . In D a v id L . D ill, e d ito r, C o m p u te r A id e d V e r ifi c a tio n , 6 th In te r n a tio n a l C o n fe re n c e (C A V ’9 4 ), v o lu m e 8 1 8 o f L N C S , p a g e s 4 1 5 – 4 2 7 . S p rin g e r-V e rla g , J u n e 1 9 9 4 . [6 ] E d m u n d M . C la rk e , O rn a G ru m b e rg , a n d D a v id E . L o n g . M o d e l c h e c k in g a n d a b s tra c tio n . A C M T r a n s a c tio n s o n P ro g r a m m in g L a n g u a g e s a n d S y s te m s , 1 6 (5 ):1 5 1 2 – 1 5 4 2 , 1 9 9 4 . [7 ] M . D a v is a n d H . P u tn a m . A c o m p u tin g p ro c e d u re fo r q u a n tifi c a tio n th e o ry . J o u r n a l o f th e A s s o c ia tio n fo r C o m p u tin g M a c h in e r y , 7 :2 0 1 – 2 1 5 , 1 9 6 0 . [ 8 ] E . A . E m e r s o n a n d C .- L . L e i. M o d a litie s f o r m o d e l c h e c k in g : B r a n c h in g tim e s tr ik e s b a c k . S c ie n c e o f C o m p u te r P ro g r a m m in g , 8 :2 7 5 – 3 0 6 , 1 9 8 6 . [9 ] F . G iu n c h ig lia a n d R . S e b a s tia n i. B u ild in g d e c is io n p ro c e d u re s fo r m o d a l lo g ic s fro m p ro p o s itio n a l d e c is io n p ro c e d u re s - th e c a s e s tu d y o f m o d a l K . In P ro c . o f th e 1 3 th C o n fe re n c e o n A u to m a te d D e d u c tio n , L e c tu re N o te s in A rtifi c ia l In te llig e n c e . S p rin g e r-V e rla g , 1 9 9 6 . 1 0 ] D . S . J o h n s o n a n d M . A . T ric k , e d ito rs . T h e s e c o n d D IM A C S im p le m e n ta tio n c h a lle n g e , D IM A C S S e rie s in D is c re te M a th e m a tic s a n d T h e o re tic a l C o m p u te r S c ie n c e , 1 9 9 3 . (s e e h t t p : / / d i m a c s . r u t g e r s . e d u / C h a l l e n g e s / ). 1 1 ] H . K a u tz a n d B . S e lm a n . P u s h in g th e e n v e lo p e : p la n n in g , p ro p o s itio n a l lo g ic , a n d s to c h a s tic s e a rc h . In P ro c . A A A I’9 6 , P o rtla n d , O R , 1 9 9 6 . 1 2 ] O . L ic h te n s te in a n d A . P n u e li. C h e c k in g th a t fi n ite s ta te c o n c u rre n t p ro g ra m s s a tis fy th e ir lin e a r s p e c ifi c a tio n . In P o c e e d in g s o f th e T w e lfth A n n u a l A C M S y m p o s iu m o n P r in c ip le s o f P ro g r a m m in g L a n g u a g e s , p a g e s 9 7 – 1 0 7 , 1 9 8 5 . 1 3 ] A . J . M a rtin . T h e d e s ig n o f a s e lf-tim e d c irc u it fo r d is trib u te d m u tu a l e x c lu s io n . In H . F u c h s , e d ito r, P ro c e e d in g s o f th e 1 9 8 5 C h a p e l H ill C o n fe re n c e o n V e r y L a rg e S c a le In te g r a tio n , 1 9 8 5 . 1 4 ] K . L . M c M illa n . S y m b o lic M o d e l C h e c k in g : A n A p p ro a c h to th e S ta te E x p lo s io n P ro b le m . K lu w e r A c a d e m ic P u b lis h e rs , 1 9 9 3 . 1 5 ] A . P . S is tla a n d E . M . C la rk e . T h e c o m p le x ity o f p ro p o s itio n a l lin e a r te m p o ra l lo g ic s . J o u r n a l o f A s s o c . C o m p u t. M a c h ., 3 2 ( 3 ) :7 3 3 – 7 4 9 , 1 9 8 5 . 1 6 ] G . S t a˚ l m a r c k a n d M . S a¨ fl u n d . M o d e l i n g a n d v e r i f y i n g s y s t e m s a n d s o f t w a r e i n p r o p o s itio n a l lo g ic . In B . K . D a n ie ls , e d ito r, S a fe ty o f C o m p u te r C o n tro l S y s te m s (S A F E C O M P ’9 0 ), p a g e s 3 1 – 3 6 . P e rg a m o n P re ss, 1 9 9 0 . 1 7 ] P . R . S te p h a n , R . K . B ra y to n , a n d A . L . S a n g io v a n n i-V in c e n te lli. C o m b in a tio n a l te s t g e n e ra tio n u s in g s a tis fi a b ility . T e c h n ic a l R e p o rt M 9 2 /1 1 2 , D e p a rte m e n t o f E le c tric a l E n g in e e rin g a n d C o m p u te r S c ie n c e , U n iv e r s ity o f C a lif o r n ia a t B e r k le y , O c to b e r 1 9 9 2 . 1 8 ] H . Z h a n g . S A T O : A n e ffi c ie n t p ro p o s itio n a l p ro v e r. In In te r n a tio n a l C o n fe re n c e o n A u to m a te d D e d u c tio n (C A D E ’9 7 ), n u m b e r 1 2 4 9 in L N A I, p a g e s 2 7 2 – 2 7 5 . S p rin g e r-V e rla g , 1 9 9 7 .

1 0 .1 0 0 7 /b 1 0 7 0 3 1 1 3 0 0 1 4

Symbolic Verification of Lossy Channel Systems: Application to the Bounded Retransmission Protocol Parosh Abdulla1 1

Aurore Annichini2

Ahmed Bouajjani2

Dept. of Computer Systems, P.O. Box 325, S-75105 Uppsala, Sweden. [email protected] 2 Verimag, Centre Equation, 2 av. de Vignate, 38610 Gi`eres, France. [email protected], [email protected]

Abstract. We consider the problem of verifying automatically infinitestate systems that are systems of finite machines that communicate by exchanging messages through unbounded lossy fifo channels. In a previous work [1], we proposed an algorithmic approach based on constructing a symbolic representation of the set of reachable configurations of a system by means of a class of regular expressions (SREs). The construction of such a representation consists of an iterative computation with an acceleration technique which enhances the chance of convergence. This technique is based on the analysis of the effect of iterating control loops. In the work we present here, we experiment our approach and show how it can be effectively applied. For that, we developed a tool prototype based on the results in [1]. Using this tool, we provide an automatic verification of (the parameterized version of) the Bounded Retransmission Protocol.

1

Introduction

Communication protocols are naturally modeled as an asynchronous parallel composition of finite-state machines that exchange messages through unbounded fifo channels. Moreover, in a large class of communication protocols, e.g., link protocols, channels are assumed to be lossy in the sense that they can at any time lose messages. Then, an important issue is to develop automatic analysis techniques for lossy channel systems. Many verification problems, e.g., verification of safety properties, reduce to computing the set of reachable configurations. However, since lossy channel systems are infinite-state systems, this set cannot be constructed by enumerative search procedures, and naturally a symbolic approach must be adopted allowing finite representations of infinite sets of configurations. Moreover, it has been shown that there is no algorithm for computing reachability sets of lossy channel systems [8]. Then, the approach we adopt is to develop semi-algorithms based on a forward iterative computation with a mechanism allowing to enhance the chances of convergence. This mechanism is based on accelerating the calculation [18,9] by considering meta-transitions [6] corresponding to an arbitrary number of executions of control loops: in one step of the iterative computation, we W.R. Cleaveland (Ed.): TACAS/ETAPS’99, LNCS 1579, pp. 208–222, 1999. c Springer-Verlag Berlin Heidelberg 1999 

Symbolic Verification of Lossy Channel Systems

209

add successors by the transitions of the system as well as all the reachable configurations by iterating control loops. So, to realize this approach, we need a good symbolic representation which should be expressive, and allow efficient performance of certain operations that are used in the computation of reachability sets, e.g., inclusion testing, computing successors by transitions of the system, as well as the effect of iterating control loops. In [1], we proposed a new symbolic representation formalism based on a class of regular expressions called SREs (simple regular expressions) for use in the reachability analysis of lossy channel systems. We showed in that work that SREs are good symbolic respresentations: we showed that SREs can define the reachability set of any lossy channel system (but not effectively in general), and that all the needed operations on SREs are rather simple and can be carried out in polynomial time. The aim of this paper is to show the power of the approach we adopt and how our results in [1] can be effectively applied. Based on these results, we developed a tool prototype, called Lcs. Given a lossy channel system, this tool generates automatically its set of reachable configurations by means of SREs, and produces a symbolic graph which constitutes a finite-state abstract model of the system. Furthermore, the tool allows on-the-fly verification of safety properties given by finite-state labelled transition systems. The Lcs tool is connected to the Cadp toolbox [11] which provides a variety of procedures on finite-states labelled transition systems, e.g., comparison and minimization w.r.t. behavioural equivalences, model-checking for temporal logics. For instance, it is possible to generate automatically a finite abstract model of a system using the Lcs tool, and then apply standard finite-state verification techniques on this abstract model. We show an interesting experimentation we have done with our tool, which consists of an automatic verification of the Bounded Retransmission Protocol (BRP) of Philips. The BRP is a data link protocol which can be seen as an extended version of the well known alternating bit protocol. It consists of a sender and a receiver that communicate through two lossy channels. The service the protocol delivers is the transmission of large files seen as sequences of data of arbitrary length. In addition, both the sender and receiver must indicate to their clients whether the whole file has been delivered successfully or not. The sender reads a sequence of data and transmit successively each datum in a separate frame following an alternating bit protocol-like procedure. However, the sender can resend a non-acknowledged frame up to a fixed number of retransmission MAX, which is a parameter of the protocol. Our modeling of the BRP assumes that the sizes of the transmitted sequences and the value MAX can be arbitrary positive integers. The assumption concerning MAX leads to a model with unbounded channels which represents the whole family of BRPs with any value of MAX. This shows an example where the model of unbounded channels allows a parametric reasoning about a family of systems. We use our Lcs tool to generate automatically the set of reachable configurations of the BRP and the corresponding finite symbolic graph (0.56 seconds on UltraSparc). After projecting this graph on the set of external actions of the protocol and minimization w.r.t. observational trace equivalence, we get an ab-

210

Parosh Abdulla, Aurore Annichini, and Ahmed Bouajjani

stract model with 5 states and 10 transitions which corresponds exactly to the expected external behaviour of the protocol. Related Work: There are several works on symbolic verification of perfect fifochannel systems [20,12,4,5,7]. Pachl proposed to represent the set of reachable configurations of a protocol as a recognizable set (carthesian product of regular sets), but he gave no procedures for computing such a representation. Finkel and Marc´e proposed a symbolic analysis procedure using a class of regular expressions (not comparable with SREs), and which is based on an analysis of the unbounded iterability of a control loop [12]. The set of configurations computed by this procedure is, however, an upper approximation of the reachability set. Boigelot et al. use finite automata (under the name of QDDs) to represent recognizable sets of configurations [4,5]. However, QDDs cannot characterize the effect of any control loop of a perfect fifo-channel system (restrictions on the type of loops are considered in order to preserve recognizability). To compute and represent the effect of any control loop, stuctures called CQDDs combining finite automata with linear arithmetical constraints must be used [7]. Our work ([1] and this paper) takes advantage from the fact that we are analysing specifically lossy channel systems. For these systems, we propose a symbolic representation (SREs) which captures exactly the class of reachability sets of such systems. Then, while the operations on QDDs and CQDDs are of exponential complexity and are performed by quite non-trivial algorithms, all needed operations on SREs can be performed by much simpler algorithms and in polynomial time. Moreover, although QDDs and CQDDs are more expressive than SREs, the algorithms in [4,5,7] cannot simulate the ones we use on SREs. The reason is that lossy transitions are implict in our model, whereas all transitions are explicitly represented in the algorithms in [4,5,7]. Thus to simulate in [4,5,7] the effect of iteration of a loop in the lossy channel model, we have to add transitions explicitly to model the losses. These transitions add in general new loops to the system, implying that a loop in the lossy channel system is simulated by a nested loop in the perfect channel system. However analysis of nested loops is not feasible in the approaches of [4,5,7]. Several works addressed the specification and verification of the BRP. To tackle the problem of unboundedness of the size of the transmitted files and the parameter MAX, these works propose proof-based approaches using theorem provers, combined with abstraction techniques and model checking. In [14] the system and its external specification are described in μCRL and are proved to be (branching) bisimilar. The proof is carried out by hand and checked using Coq. An approach based on proving trace inclusion (instead of bisimulation) on I/O automata is developed in [17]. In [16] the theorem prover PVS is used to prove that the verification of the BRP can be reduced by means of abstraction to a finite-state problem that can be solved by model checking. In [13,3] a more automated approach is applied based on constructing automatically a finite abstract model using PVS, for an explicitely given abstraction function. It is possible to see the unbounded lossy channel system we use to model the BRP as an abstraction of the whole family of the BRPs for all possible values

Symbolic Verification of Lossy Channel Systems

211

of its parameters. But this model is infinite-state: the unboundedness of the parameters is in some sense transformed into an unboundedness of the channels. Then, starting from this infinite-state system, our verification technique is fully automatic. It is based on an automatic generation of a finite abstract model, without giving explicitly the abstraction relation. So, our work provides a fully automatic, and efficient, verification of the (untimed) parameterized version of the BRP. Finally, we mention two works where the BRP has been verified automatically but only for some fixed instances of its parameters: In [19], an untimed version of the BRP is verified using both a bisimulation-based approach and a model checking approach using Cadp. In [10] a timed version of the BRP is verified using the tools Spin and Uppaal. These two works avoid the issue of parameter unboundedness and use standard finite-state techniques. However, the work in [10] consider timing aspects that we have abstracted since our model is untimed. Outline: In Section 2 we define the model of lossy channel systems. In Section 3 we present the verification approach we adopt. In Section 3.3 we present the class of SREs and we overview our results concerning this symbolic representation. In Section 4 we describe our tool prototype. In Section 5 we present our modeling and verification of the BRP. Concluding remarks are given in Section 6.

2

Lossy Channel Systems

We consider system models consiting of asynchronous parallel compositions of finite-state machines that communicate through sending and receiving messages via a finite set of unbounded lossy fifo channels (in the sense that they can nondeterministically lose messages). A Lossy Channel System (LCS) L is a tuple (S, sinit , C, M, Σ, δ), where – S is a finite set of (control) states, The control states of a system with n finite-state machines is formed as the Cartesian product S = S1 × · · · × Sn of the control states of each finite-state machine. – sinit ∈ S is an initial state, The initial state of a system with n finite-state machines is a tuple sinit1 , . . . , sinitn  of initial states of the components. – C is a finite set of channels, – M is a finite set of messages, – Σ is a finite set of transition (or action) labels, – δ is a finite set of transitions, each of which is of the form (s1 , , O p, s2 ), where s1 and s2 are states,  ∈ Σ, and O p is a mapping from C to (channel) operations. An operation is either a send operation !a, a receive operation ?a, or an empty operation nop, where a ∈ M . A configuration γ of L is a pair s, w where s ∈ S is a control state, and w is a mapping from C to M ∗ giving the contents of each channel. The initial configuration γinit of L is the pair sinit ,  where  denotes the mapping where each channel is assigned the empty sequence . We define a labelled transition relation on configurations in the following  manner:s1 , w1  −→ s2 , w2 if and only if there exists a transition(s1 , , O p, s2 ) ∈ δ

212

Parosh Abdulla, Aurore Annichini, and Ahmed Bouajjani

such that, for each c ∈ C, we have: if O p(c) =!a, then w2 (c) = w1 (c) · a, and if O p(c) =?a, then a · w2 (c) = w1 (c), and if O p(c) = nop, then w2 (c) = w1 (c). Let  denote the subsequence relation on M ∗ . For two mappings w and w from C to M ∗ , we use w  w to denote that w(c)  w (c) for each c ∈ C. Then, we introduce a weak transition relation on configurations in the following manner:  s1 , w1  =⇒ s2 , w2  if and only if there are w1 and w2 such that w1  w1 , 



w2  w2 , and s1 , w1  −→ s2 , w2 . Intuitively, s1 , w1  =⇒ s2 , w2  means that s2 , w2  can be reached from s1 , w1  by first losing messages from the channels 

and reaching s1 , w1 , then performing the transition s1 , w1  −→ s2 , w2 , and thereafter losing messages from channels. Given a configuration γ, we let post(γ)  denote the set of immediate successors of γ, i.e., post(γ) = {γ  : ∃ ∈ Σ. γ =⇒ γ  }. The function post is generalized to sets of configurations in the obvious manner. Then, we let post∗ denote the reflexive transitive closure of post, i.e., given a set of configurations Γ , post∗ (Γ ) is the set of all reachable configurations starting from Γ . Let Reach(L) be the set post∗ (γinit ). For every control location s ∈ S, we define R(s) = {w : s, w ∈ Reach(L)}. A run of L starting from a configuration γ is a finite or infinite sequence i γi+1 . The trace of the ρ = γ0 0 γ1 1 γ2 . . . such that γ0 = γ and ∀i ≥ 0. γi =⇒ run ρ is the sequence of action labels τ = 0 1 2 . . .. We denote by T races(L) (resp. T racesf (L)) the set of all traces (resp. finite traces) of L starting from the initial configuration γinit . We introduce two extensions of the basic model given above: the first one consists in introducing channel emptiness testing: we use enabling conditions on transitions involving a predicate empty on channels telling whether a channel is empty. The second extension consists in allowing the components of a system to test and set boolean shared variables (remember that we consider here asynchronous parallel composition following the interleaving semantics). The formal semantics of the extended model is an obvious adaptation of the one given above.

3

Symbolic Reachability Analysis

We adopt an algorithmic verification approach based on the computation of the set of reachable configurations. We explain hereafter the general principle we consider in order to compute reachability sets, and how it can be applied to solve verification problems. 3.1

Computing reachability sets

The basic question is how to construct the set Reach(L) for any given system L, or more generally, how to construct the set post∗ (Γ ) for any given set of configurations Γ of the system. Clearly, post∗ (Γ ) is the least solution of the equation X = Γ ∪ post(X), and thus, it is the limit of the increasing sequence of sets (Xi )i≥0 where X0 = Γ and Xi+1 = Xi ∪ post(Xi ). From this fact, one can derive an iterative procedure computing the set post∗ (Γ ) which consists in computing the elements of the sequence of the Xi ’s until the inclusion Xi+1 ⊆ Xi holds for some index i, which means that the limit is reached. However, since the

Symbolic Verification of Lossy Channel Systems

213

systems we are interested in have an infinite number of reachable configurations, this naive procedure does not terminate in general. Moreover, in the case of lossy channel systems, it has been shown that the set Reach(L) cannot be effectively constructed although it is recognizable (finite-state automata definable) [8]. Hence, since an algorithm to construct the reachability sets does not exist in general, we adopt the approach of using semi-algorithms with a mechanism allowing to enhance their chance to terminate. This mechanism is based on the idea of accelerating fixpoint computations [18,9]. For instance, consider a control loop of a lossy channel system that sends a symbol a on a channel, initially empty (we mean by control loop a circuit in the graph (S, δ)). The set of all reachable contents of the channel by iterating this loop is the regular language a∗ . However, the naive procedure given above will compute successively: X0 = {}, X1 = {, a}, X2 = {, a, a2 }, . . ., and never reach the limit. This example shows that if we are able to compute the effect of a loop on a set of configurations, we can use it to jump to the limit in one step, and help the fixpoint computation to converge: Given a control loop θ and a set of configurations Γ , let post∗θ (Γ ) be the set of reachable configurations by iterating θ an arbitrary number of times starting from Γ . Then, if the post∗θ image of any set of configurations is effectively constructible, we can consider the loop θ as a meta-transition of the system [6]. This means that at each step of the iterative computation of the reachability set, we add immediate successors by original transitions of the system as well as successors by meta-transitions. To realize this procedure, we need representation structures of sets of configurations. A good representation structure must allow a finite representation of the infinite sets of configurations we are interested in, it should be at least effectively closed under union and post, and it must have a decidable inclusion problem. Furthermore, this representation structure must allow the computation of the effects of control loops. Finally, any reasonable representation structure should be “normalizable”, i.e., for every representable set, there is a unique normal (or canonical) representation which can be derived from any alternative representation (there is a normalization procedure). Indeed, all operations (e.g., entailement testing) are often easier to perform on normal forms. Furthermore, in many cases normality (canonicity) corresponds to a notion of minimality (e.g. for deterministic automata), which is crucial for practical reachability analysis procedures. 3.2

Use in verification

Verification of invariance properties It consists in checking whether starting from the initial configuration of the system, a state property ϕ is always satisfied. Clearly, this statement holds if Reach(L) ⊆ [[ϕ]], where [[ϕ]] is the set of configurations satisfying ϕ. Thus, if Reach(L) can be computed using a class C of good representation structures, and if [[ϕ]] is also effectively representable in C, then our problem is solvable (inclusion is decidable for good representations).

214

Parosh Abdulla, Aurore Annichini, and Ahmed Bouajjani

Automata-based verification of safety properties A regular safety property is a set of finite traces over Σ. Then, the system L satisfies a property Π iff T racesf (L) ⊆ Π

(1)

Naturally, a regular safety property Π is represented by a deterministic finitestate labelled transition system AΠ . This system is completed by adding a special state bad to the set of states Q, and adding transitions (q, , bad) for every q ∈ Q and  ∈ Σ such that there is no transitions in AΠ starting from q which are bad labelled by . Let Abad Π be the so obtained transition system and let L × AΠ bad bad be the synchronous product of L and AΠ . The system L × AΠ is a lossy channel system (with the n channels of L) whose control states are elements of S × (Q ∪{bad}). Then, the problem (1) reduces to checking if Reach(L× Abad Π )⊆ S × Q × (M ∗ )n (i.e., bad configurations are never reached). It is convenient to consider a safety property Π as a set of traces over a set of observable actions Ω ⊆ Σ. Then its verification problem consists in checking if T racesf (L)|Ω ⊆ Π, where |Ω denotes projection on Ω (i.e., hiding all symbols except those in Ω). Given Abad Π defined as previousely, this problem is equivalent ) ⊆ S × Q × (M ∗ )n , where ×Ω is the product of labelled to Reach(L ×Ω Abad Π transition systems with synchronisation on actions in Ω. Generation of finite abstractions A C-indexed language W over M is a ∗ mapping from C to 2M representing a set of C-indexed sequences such that w ∈ W iff ∀c ∈ C. w(c) ∈ W (c). A symbolic state of L is a pair φ = s, W  where s ∈ S is a control state and W is a C-indexed language over M . The symbolic state φ represents the set of configurations [[φ]] = {s, w : w ∈ W }. Let Φ be a finite set of symbolic states. Then, the symbolic graph associated with Φ is the finite-state labelled transition system GΦ such that its set of states   is Φ and, ∀φ1 , φ2 ∈ Φ. ∀ ∈ Σ. φ1 −→ φ2 iff ∃γ1 ∈ φ1 , γ2 ∈ φ2 . γ1 −→ γ2 . We consider as initial state in GΦ any configuration which contains the initial configuration γinit . In particular, we consider the partition of Reach(L) according to the control states, i.e., ΦL = {s, W  : s ∈ S and [[W ]] = R(s)}. The labelled transition system GΦL is called the canonical symbolic graph of L.

Lemma 1. For every finite set of symbolic states Φ, if Reach(L) ⊆ φ∈Φ [[φ]], then GΦ simulates L. Indeed, it is easy to see that the membership relation, i.e., the relation R such that γRφ iff γ ∈ [[φ]], is a simulation relation (using the fact that every reachable configuration of L belongs to at least one symbolic state in Φ). Clearly, Lemma 1 holds for the canonical symbolic graph of L. This means that if Reach(L) can be constructed, we obtain directly a finite-state abstraction of the system L. This abstract model can be used to check linear-time properties and, if the result is positive, to deduce that the same result holds for the concrete

Symbolic Verification of Lossy Channel Systems

215

system L1 . More precisely, given an ∞-regular linear-time property Π, i.e., a set of finite or infinite traces over Σ, a system L satisfies Π if T races(L) ⊆ Π. By Lemma 1, we have T races(L) ⊆ T races(GΦL ). Hence, for every ∞-regular property Π, if GΦL satisfies Π, then L satisfies Π too. Notice that if GΦL does not satisfy Π, this could be due to the fact that the abstraction corresponding to the partition of Reach(L) according to control state is too coarse. Then, one could try to check Π on refinements of this partition. 3.3 Computing Reachability Sets of LCSs We introduced in [1] a new symbolic representation formalism, based on a class of regular expressions called SREs (simple regular expressions), for use in the calculation of reachability sets of lossy channel systems. We showed in that previous work that SREs are “good” representation structures in the sense introduced in Section 3.1. We give hereafter the definition of SREs and a brief overview of the results of [1] concerning these representations. Definition 2 (SREs). An atomic simple expression over M is a regular expression of one of two following forms: (a + ), where a ∈ M , or (a1 + · · · + am )∗ , where a1 , . . . , am ∈ M . A simple product p over M is either  (denoting the language {}) or a concatenation e1 · e2 · · · en of atomic simple expressions over M . A simple regular expression (SRE) r over M is either ∅ (denoting the empty language) or a sum p1 + · · · + pn of simple products over M . Given an SRE r, we denote by [[r]] the language it defines. A language is said to be simply regular if it is definable by an SRE. A C-indexed SRE R over M is a mapping from C to the set of SREs. The expression R defines the C-indexed language L (denoted [[R]]) such that, for every c ∈ C, L(c) = [[R(c)]]. A C-indexed language is said to be simply recognizable if it is a finite union of languages definable by C-indexed SREs.

Any set of configurations Γ is a union of the form s∈S {s} × Ws where the Ws ’s are C-indexed languages over M . We say that Γ is SRE definable if Ws is simply recognizable for each s ∈ S. For a lossy channel system L, the set Reach(L) is SRE definable (the set R(s) is simply recognizable for each control state s) [1]. This means that SREs are expressive enough to represent the reachability set of any lossy channel system. However, as we mentionned before, there is, in general, no algorithm for computing a representation of Reach(L) for a lossy channel system L [8]. An entailment relation can be defined on SREs: For SREs r1 and r2 , we say that r1 entails r2 (we write r1 - r2 ), if [[r1 ]] ⊆ [[r2 ]]. This relation is extended to indexed SREs in the obvious manner. It can be shown that entailment among indexed SREs can be checked in quadratic time [1]. Definition 3 (Normal form). A simple product e1 · · · en is said to be normal if ∀i ∈ {1, . . . , n}. ei · ei+1 - ei+1 and ei · ei+1 - ei . An SRE r = p1 + · · · + pn 1

This approach can also be applied for branching-time properties expressed in universal positive fragments of temporal logics or μ-calculi like ∀CTL∗ [15] or 2Lμ [2].

216

Parosh Abdulla, Aurore Annichini, and Ahmed Bouajjani

is said to be normal if ∀i ∈ {1, . . . , n}. pi is normal, and ∀i, j ∈ {1, . . . , n}. i = j. pi - pj . It can be shown that for each SRE r, there is a unique (up to commutativity of products) normal SRE, denoted r, such that [[r]] = [[r]], and which can be derived from r in quadratic time [1]. Finally, we can show that, for a lossy channel system L and an SRE representable set of configurations Γ , the set post(Γ ) is SRE definable and effectively constuctible in linear time, and that for any control loop θ in L, the set post∗θ (Γ ) is also SRE definable and effectively constuctible in quadratic time [1].

4

Implementation

We implemented our techniques in a tool prototype called Lcs. The input of the Lcs is a finite set of communicating automata, given seperately. Then, the tool allows the following options: Generation of the reachability set: The tool allows calling a procedure which computes a representation of the reachability set of the system by means of (normal) SREs. The computation is done according to a depth-first-search strategy, and uses the acceleration principle (see Sections 3 and 3.3): Starting from the initial configuration, the procedure explores a graph where nodes are symbolic states. When visiting a node, the procedure computes its immediate successors using the post function. Whenever a control loop is detected, i.e., the current symbolic state has an ancestor with the same control state, the effect of iterating this loop is computed, leading to a new symbolic state. Notice that the loops used for acceleration are found on-the-fly and are not explicitly given by the user. The set of reachable configurations is memorized progressively. If a visited node (symbolic state) is included in the set of reachable configurations computed so far, the successors of the node are not generated. Otherwise, its set of configurations is added to the current set of reachable configurations, and the search continues. Generation of the canonical symbolic graph: During the computation the reachability set, the Lcs tool can construct the corresponding canonical symbolic graph (transitions between symbolic states). The symbolic graph is produced in the input format of the Cadp toolbox (Caesar/Aldebaran Development Package) [11] which contains several tools on finite-state labelled transition systems, e.g., graphical visualisation, comparison with respect to various behavioural equivalences and preorders like observational bisimulation and simulation, minimization, on-the-fly automata-based verification, model-checking for an ACTL-like temporal logic (action-based variant of CTL) and the alternation-free modal μ-calculus. On-the-fly checking of safety properties: Given a safety property described as a deterministic labelled transition system over a set observable actions Ω ⊆ Σ, the tool checks whether the projection of the system on Ω satisfies Π. This verification (based on a reachability set generation, see Section 3.2) is done onthe-fly: the procedure stops as soon as a bad configuration is encountered.

Symbolic Verification of Lossy Channel Systems

5

217

The Bounded Retransmission Protocol

5.1 Specification of the service The Bounded Retransmission Protocol (BRP for short) is a data link protocol. The service it delivers is to transmit large files (sequences of data of arbitrary lengths) from one client to another one. Each datum is transferred in a separate frame. Both clients, the sender and the receiver, obtain an indication whether the whole file has been delivered successfully or not. More precisely, at the sender side, the protocol requests a sequence of data s = d1 , . . . , dn (action REQ) and communicates a confirmation which can be SOK, SNOK, or SDNK. The confirmation SOK means that the file has been transferred successfully, SNOK means that the file has not been transferred completely, and SDNK means that the file may not have been transferred completely. This occurs when the last datum dn is sent but not acknowledged. Now, at the receiver side, the protocol delivers each correctly received datum with an indication which can be RFST, RINC, or ROK. The indication RFST means that the delivered datum is the first one and more data will follow, RINC means that the datum is an intermediate one, and ROK means that this was the last datum and the file is completed. However, when the connection with the sender is broken, an indication RNOK is delivered (without datum). Properties the service must satisfy are: 1. a request REQ must be followed by a confirmation (SOK, SNOK, or SDNK) before the next request, 2. a RFST indication (delivery of the first datum) must be followed by one of the two indications ROK or RNOK before the beginning of a new transmission (next request of the sender), 3. a SOK confirmation must be preceded by a ROK indication, 4. a ROK indication can be followed by either a SOK or a SDNK confirmation, but never by a SNOK (before next request), 5. a RNOK indication must be preceded by SNOK or SDNK (abortion), 6. if the first datum has been received (with the RFST indication), then a SNOK confirmation is followed by a RNOK indication before the next request. 5.2 Description of the protocol The BRP consists of two processes, the sender S and the receiver R, that communicate through two lossy fifo channels K and L: messages can either be lost or arrive in the same order in which they are sent. The BRP can be seen as an extended version of the alternating bit protocol. Messages sent from the sender S to the receiver R through the channel K are frames of the form (f irst, last, toggle, datum) where a datum is accompanied by three bits: f irst and last indicate whether the datum is the first or the last one of the considered file, toggle is the alternating bit allowing to detect duplications of intermediate frames. As for the acknowledgments (sent from R to S through L), they are frames of the form (f irst, last, toggle). Notice that in the description we consider of the BRP, the value of toggle is relevant only for intermediary frames.

218

Parosh Abdulla, Aurore Annichini, and Ahmed Bouajjani

Indeed, the first and last frames can be distinguished from the intermediary ones using the booleans f irst and last. The behaviours of S and R are the following: The sender S starts by reading (action REQ) a sequence s = d1 , . . . , dn . We consider here that n ≥ 2, the case n = 1 does not introduce any difficulty. Then, S sends to R through K the first data frame (1, 0, 0, d1 ), and waits for the acknowledgement. Let us consider first the ideal case where frames are never lost. When R receives the frame from K, it delivers to its client the datum d1 with the indication RFST, and sends to S an acknowledgement frame (1, 0, 0) through the channel L. When S receives this acknowledgement, it transmits to R the second frame (0, 0, 0, d2 ) (toggle is still equal to 0 since its value is relevant for intermediate frames). Then, after reception, R delivers d2 with the indication RINC and sends the acknowledgement (0, 0, 0) to S. Then, the next frame sent by S is (0, 0, 1, d3) (now toggle has flipped), and the same procedure is repeated until the last frame (0, 1, −, dn ) is sent (here again, like in the case of the first frame, the value of toggle is not relevant). When R receives the last frame, it delivers dn with the indication ROK, and acknowledges receipt. Then, the sender S communicates to its client the confirmation SOK meaning that the whole sequence s has been successfully transmitted. Now, let us consider the case where frames are lost. When S send a data and realizes that it may be lost (a timer Ts expires and it did not receive a corresponding acknowledgement from R), it retransmits the same frame and waits again for the acknowledgement. However, it can try only up to a fixed maximal number of retransmissions MAX which is a parameter of the protocol. So, the sender maintains a counter of retransmissions CR, and when CR reaches the value MAX, it gives up and concludes that the connection with the receiver is broken. Then, it informs its client that a failure occured by communicating one of the two confirmations: SNOK if the frame in consideration is not the last frame of the sequence, or SDNK if it is the last one (the sender cannot know if the frame was lost or if its acknowledgement was lost). On the other side, the receiver R uses also a timer Tr to measure the time elapsed between the arrival of two different frames. When R receives a new frame, it resets Tr and, it delivers the transmitted datum with the corresponding indication, otherwise it resends the last acknowledgement. If the timer expires, it concludes that the connection with the sender is broken and delivers an indication RNOK meaning that the transmission failed. Notice that if the first frame is continuously lost, the receiver has no way to detect that the sender is trying to start a new file transmission. In addition, two assumptions are made on the behaviour of S and R: A1 R must not conclude prematurely that the connection with S is broken. A2 In case of abortion, S cannot start transmitting frames of another file until R has reacted to abortion and informed its client. Assumption A1 means that Tr must be large enough to allow MAX retransmissions of a frame. Assumption A2 can be implemented for instance by imposing to S to wait enough time after abortion to be sure that Tr has expired.

Symbolic Verification of Lossy Channel Systems

5.3

219

Modeling the BRP as a Lossy Channel System

We model the BRP as a lossy channel system which consists of two communicating finite-state machines, the sender S and the receiver R represented in Figures 1 and 2 (with obvious notational conventions). For that, we proceed as follows: SNOK:Op2

K!last

L?last

K!last

K!1

7

K!1

6

5

L?1 K!last

L?1

SOK L?last

SDNK: Op2

L?0 L?0

L?last

8

3

K!0

4 K!0

Op1

L?fst K!fst

0

REQ

1

K!fst

Op1 9

2 L?fst

SNOK:Op2 SNOK:Op2

Op1 = ¬rtrans ∧ empty(K) ∧ empty(L) → abort := false Op2 = empty(L) → abort := true

Fig. 1. The sender S

Frames: Since the control of the BRP does not depend on the transmitted data, we hide their values and consider only the informations (f irst, last, toggle). The set of relevant informations of such form corresponds to a finite alphabet M = {fst, last, 0, 1}, where fst (resp. last) represents the first (resp. last) frame, and 0 and 1 represents the intermediate frames since only toggle is relevant in this case. The number of transmitted frames: Only is relevant whether a frame is the first one, the last one, or an intermediate one, we abstract from the actual value n corresponding to the size of the transmitted sequence of frames, and consider that it can be any positive integer, chosen nondeterministically (by the sender).

220

Parosh Abdulla, Aurore Annichini, and Ahmed Bouajjani

RNOK: abort ∧ empty(K) → rtrans := false

K?0, L!0

K?fst, L!fst

RNOK: abort ∧ empty(K) → rtrans := false

1

RINC: ¬abort

RINC: ¬abort K?0, L!0

2

K?0, L!0

RFST: ¬abort, K?fst L!fst → rtrans := true

0

RINC: ¬abort K?1, L!1

ROK: ¬abort K?last, L!last

empty(K) → rtrans := false

3 ROK: ¬abort K?last, L!last

K?1, L!1

4 K?last, L!last

RNOK: abort ∧ empty(K) → rtrans := false

Fig. 2. The receiver R

Time-outs: Since our model is untimed, we cannot express time-outs explicitly. Then, we consider that the sender and the receiver decide nondeterministically when time-outs occur, provided that their corresponding input channels are empty (we use channel emptiness testing). The counter CR and the value MAX: Only is relevant whether CR < MAX or CR ≥ MAX. Then, we consider that the sender can resend frames an arbitrary number of times before considering that MAX is reached and deciding the abortion of the transmission. This makes the size of the channels K and L unbounded. Our model is an abstraction of the whole family of BRPs for arbitrary values of MAX. Assumptions A1 and A2: Again, since our model is untimed, we cannot impose real-time constraints to implement the assumptions A1 and A2. Then, we use boolean shared variables to synchronise the sender and the receiver. We consider the two following variables: abort which tells whether the sender has decided abortion, and rtrans which tells whether the receiver considers that the transmission of a sequence of frames has started and is not finished yet, i.e., from the moment it receives the first frame until it informs its client that the transmission is terminated, either successfully or not.

Symbolic Verification of Lossy Channel Systems

5.4

221

Verifying the Bounded Retransmission Protocol

To verify the BRP, we follow the following steps: First, we use our Lcs tool to generate automatically the set of reachable configurations of the BRP and the corresponding canonical symbolic graph. The obtained graph has 24 symbolic states and 61 transitions. The execution time is 0.56 seconds (UltraSparc). Then, we use the tool Aldebaran to minimize this graph according to the observational trace equivalence where the set of observable actions is {REQ, SOK, SNOK, SDNK, RFST, RINC, ROK, RNOK}. We obtain the finite-state labelled transition system with 5 states and 10 transitions given in Figure 3. Properties RINC ROK

SDNK

SDNK

RFST SOK SNOK

SNOK

REQ RNOK

Fig. 3. The minimized symbolic graph of the BRP

such as those given in Section 5.1 are expressible in ACTL (the action-based variant of CTL) and can be automatically model checked on the obtained finitestate abstract model of the BRP.

6

Conclusion

We have presented a symbolic approach for verifying automatically a class of infinite-state systems: the class of unbounded lossy channel systems. This approach is based on a procedure of constructing the set of reachable configurations of the system by means of a symbolic representation (SREs), and acceleration techniques based on the analysis of the effect of control loops. In addition to the generation of the reachability set of a system, we showed that this approach allows the automatic generation of a finite abstract model of the system which can be used for checking various properties by means of standard finite-state verification methods. We applied this approach to the non-trivial example of the BRP. We showed that considering unbounded channels allows parametric reasoning: unboundedness of the channels models the fact that the number of retransmissions can be any arbitrary positive integer. Our experimentation with the Lcs tool show that the algorithmic approach we adopt is quite effective. For a first prototype, we obtained quite satisfactory performances.

222

Parosh Abdulla, Aurore Annichini, and Ahmed Bouajjani

References 1. P. Abdulla, A. Bouajjani, and B. Jonsson. On-the-fly Analysis of Systems with Unbounded, Lossy Fifo Channels. In CAV’98. LNCS 1427, 1998. 2. S. Bensalem, A. Bouajjani, C. Loiseaux, and J. Sifakis. Property-preserving simulations. In CAV’92. LNCS 663, 1992. 3. S. Bensalem, Y. Lakhnech, and S. Owre. Computing Abstractions of Infinite State Systems Compositionally and Automatically. In CAV’98. LNCS 1427, 1998. 4. B. Boigelot and P. Godefroid. Symbolic Verification of Communication Protocols with Infinite State Spaces using QDDs. In CAV’96. LNCS 1102, 1996. 5. B. Boigelot, P. Godefroid, B. Willems, and P. Wolper. The power of QDDs. In SAS’97. LNCS 1302, 1997. 6. B. Boigelot and P. Wolper. Symbolic Verification with Periodic Sets. In CAV’94. LNCS 818, 1994. 7. A. Bouajjani and P. Habermehl. Symbolic Reachability Analysis of FIFO-Channel Systems with Nonregular Sets of Configurations. In ICALP’97. LNCS 1256, 1997. 8. G´erard C´ec´e, Alain Finkel, and S. Purushothaman Iyer. Unreliable Channels Are Easier to Verify Than Perfect Channels. Inf. and Comp., 124(1):20–31, 1996. 9. P. Cousot and R. Cousot. Static Determination of Dynamic Properties of Recursive Procedures. In IFIP Conf. on Formal Desc. of Prog. Concepts. NH Pub., 1977. 10. P. D’Argenio, J-P. Katoen, T. Ruys, and G.J. Tretmans. The Bounded Retransmission Protocol must be on Time. In TACAS’97. LNCS 1217, 1997. 11. J-C. Fernandez, H. Garavel, A. Kerbrat, R. Mateescu, L. Mounier, and M. Sighireanu. CADP: A Protocol Validation and Verification Toolbox. In CAV’96. LNCS 1102, 1996. 12. A. Finkel and O. Marc´e. Verification of Infinite Regular Communicating Automata. Technical report, LIFAC, ENS de Cachan, 1996. 13. S. Graf and H. Saidi. Construction of Abstract State Graphs with PVS. In CAV’97, volume 1254 of LNCS, 1997. 14. J-F. Groote and J. Van de Pol. A Bounded Retransmission Protocol for Large Data Packets. In AMAST’96. LNCS 1101, 1996. 15. O. Grumberg and D. Long. Model Checking and Modular Verification. ACM TOPLAS, 16:843–871, 1994. 16. K. Havelund and N. Shankar. Experiments in Theorem Proving and Model Checking for Protocol Verification. In FME’96. LNCS 1051, 1996. 17. L. Helmink, M.P.A. Sellink, and F. Vaandrager. Proof checking a Data Link Protocol. In Types for Proofs and Programs. LNCS 806, 1994. 18. R.M. Karp and R.E. Miller. Parallel Program Schemata: A Mathematical Model for Parallel Computation. In 8th ann. Switch. and Aut. Theo. Symp. IEEE, 1967. 19. R. Mateescu. Formal Description and Analysis of a Bounded Retransmission Protocol. Technical report no. 2965, INRIA, 1996. 20. J.K. Pachl. Protocol Description and Analysis Based on a State Transition Model with Channel Expressions. In Protocol Specification, Testing, and Verification VII, 1987.

10.1007/b107031130015

Model Checking in CLP Giorgio Delzanno and Andreas Podelski Max-Planck-Institut f¨ ur Informatik Im Stadtwald, 66123 Saarbr¨ ucken, Germany {delzanno|podelski}@mpi-sb.mpg.de

Abstract. We show that Constraint Logic Programming (CLP) can serve as a conceptual basis and as a practical implementation platform for the model checking of infinite-state systems. Our contributions are: (1) a semantics-preserving translation of concurrent systems into CLP programs, (2) a method for verifying safety and liveness properties on the CLP programs produced by the translation. We have implemented the method in a CLP system and verified well-known examples of infinitestate programs over integers, using here linear constraints as opposed to Presburger arithmetic as in previous solutions.

1

Introduction

Automated verification methods can today be applied to practical systems [McM93]. One reason for this success is that implicit representations of finite sets of states through Boolean formulas can be handled efficiently via BDD’s [BCM+ 90]. The finiteness is an inherent restriction here. Many systems, however, operate on data values from an infinite domain and are intrinsically infinite-state; i.e., one cannot produce a finite-state model without abstracting away crucial properties. There has been much recent effort in verifying such sysˇ tems (see e.g. [ACJT96,BW98,BGP97,CJ98,HHWT97,HPR97,LPY97,SKR98]). One important research goal is to find appropriate data structures for implicit representations of infinite sets of states, and design model checking algorithms that perform well on practical examples. It is obvious that the metaphor of constraints is useful, if not unavoidable for the implicit representation of sets of states (simply because constraints represent a relation and states are tuples of values). The question is whether and how the concepts and the systems for programming over constraints as first-class data structures (see e.g. [Pod94,Wal96]) can be used for the verification of infinitestate systems. The work reported in this paper investigates Constraint Logic Programming (see [JM94]) as a conceptual basis and as a practical implementation platform for model checking. We present a translation from concurrent systems with infinite state spaces to CLP programs that preserves the semantics in terms of transition sequences. The formalism of ‘concurrent systems’ is a widely-used guarded-command specification language with shared variables promoted by Shankar [Sha93]. Using this translation, we exhibit the connection between states and ground atoms, between W.R. Cleaveland (Ed.): TACAS/ETAPS’99, LNCS 1579, pp. 223–239, 1999. c Springer-Verlag Berlin Heidelberg 1999 

224

Giorgio Delzanno and Andreas Podelski

sets of states and constrained facts, between the pre-condition operator and the logical consequence operator of CLP programs, and, finally, between CTL properties (safety, liveness) and model-theoretic or denotational program semantics. This connection suggests a natural approach to model checking for infinite-state systems using CLP. We explore the potential of this approach practically by using one of the existing CLP systems with different constraint domains as an implementation platform. We have implemented an algorithm to compute fixpoints for CLP programs using constraint solvers over reals and Booleans. The implementation amounts to a simple and direct form of meta-programming: the input is itself a CLP program; constraints are syntactic objects that are passed to and from the built-in constraint solver; the fixpoint iteration is a source-tosource transformation for CLP programs. We have obtained experimental results for several examples of infinite-state programs; these examples are quickly becoming benchmarks in the community (see e.g. [BGP97,BGP98,SKR98,SUM96,LS97]). Our experiments allow us to see that a CLP-based tool can solve the considered verification problems at acceptable time cost. Moreover, as CLP combines mathematical and logical reasoning, the CLP-based setting helps to find optimizations that are natural, directly implementable and provably correct. This is important since verification is a hard problem (undecidable in the general infinite-state case) and often requires a fine-tuning of the method. Finally, the experiments show that, perhaps surprisingly, the powerful (tripleexponential time) decision procedure for Presburger Arithmetic used in other approaches [BGP98,SKR98,BW94] for the same verification problems is not needed; instead, the (polynomial-time) consistency and entailment tests for linear arithmetic constraints (without disjunction) that are provided by CLP systems are sufficient.

2

Translating Concurrent Systems into CLP

We take the bakery algorithm (see [BGP97]) as an example of a concurrent program, using the notation of [MP95]: begin turn1 := 0; turn2 := 0; P1 || P2 end where P1 || P2 is the parallel execution of the subprograms P1 and P2 , and P1 is defined by: repeat think : turn1 := turn2 + 1; wait : when  turn1 < turn2 or turn2 = 0 do critical section; use : turn1 := 0 forever and P2 is defined symmetrically. The algorithm ensures the mutual exclusion property (at most one of two processes is in the critical section at every point

Model Checking in CLP

225

of time). The integer values of the two variables t urn1 and t urn2 in reachable states are unbounded; note that a process can enter w ait before the other one has reset its counter to 0. The concurrent program above can be directly encoded as the concurrent system S in Figure 1 following the scheme in [Sha93]. Each process is associated with a control variable ranging over the control locations (i.e. program labels). The data variables correspond to the program variables. The states of S are tuples of control and data values, e.g. think, think, 0, 3. The primed version of a variable in an action stands for its successor value. We omit conjuncts like p2 = p2 expressing that the value remains unchanged. Control variables p1 , p2 : {think, wait, use} Data variables turn1 , turn2 : int. Intial condition p1 = think ∧ p2 = think ∧ turn1 = turn2 = 0 Events cond p1 = think cond p1 = wait ∧ turn1 < turn2 cond p1 = wait ∧ turn2 = 0 cond p1 = use . . . symmetrically for Process 2

action action action action

p1 p1 p1 p1

= wait ∧ turn1 =turn2 +1 = use = use = think ∧ turn1 = 0

Fig. 1. Concurrent system S specifying the bakery algorithm Following the scheme proposed in this paper, we translate the concurrent system for the bakery algorithm into the CLP program shown in Figure 2 (here, p is a dummy predicate symbol, t hink, wait, and use are constants, and variables are capitalized; note that we often separate conjuncts by commas instead of using “∧”). init ← T urn1 = 0, T urn2 = 0, p(think, think, T urn1 , T urn2 ) p(think, P2 , T urn1 , T urn2 ) p(wait, P2 , T urn1 , T urn2 ) p(wait, P2 , T urn1 , T urn2 ) p(use, P2 , T urn1 , T urn2 )

← ← ← ←

T urn1 =T urn2 +1, T urn1 < T urn2 , T urn2 = 0, T urn1 = 0,

p(wait, P2 , T urn1 , T urn2 ) p(use, P2 , T urn1 , T urn2 ) p(use, P2 , T urn1 , T urn2 ) p(think, P2 , T urn1 , T urn2 )

. . . symmetrically for Process 2

Fig. 2. CLP program PS for the concurrent system S in Figure 1. If the reader is not familiar with CLP, the following is all one needs to know for this paper.1 A CLP program is a logical formula, namely a universally quantified 1

If the reader is familiar with CLP, note that we are proposing a paradigm shift: instead of looking at the synthesis of operational behavior from programs viewed as executable specifications, we are interested in the analysis of operational behavior through CLP programs obtained by a translation. The classical correspondence be-

226

Giorgio Delzanno and Andreas Podelski

conjunction of implications (as in Figure 2; it is common to call the implications clauses and to write their conjunction as a set). Its first reading is the usual first-order logic semantics. We give it a second reading as a non-deterministic sequential program. The program states are atoms, i.e., applications of the predicate p to values such as p(think, think, 0, 3). The successor state of a state s is any atom s such that the atom s is a direct logical consequence of the atom s under the program formula. This again is the case if and only if the implication s ← s is an instance of one of the implications. For example, the state p(think, think, 0, 3) has as a possible successor the state p(wait, think, 4, 3), since p(think, think, 0, 3) ← p(wait, think, 4, 3) is an instance of the first implication for p (instantiate the variables with P2 = think, T urn1 = 0, T urn1 = 4 and T urn2 = 3). A sequence of atoms such that each atom is a direct logical consequence of its successor in the sequence (i.e., a transition sequence of program states) is called a ground derivation of the CLP program. In the following, we will always implicitly identify a state of a concurrent system S with the corresponding atom of the CLP program PS ; for example, think, think, 0, 3 with p(think, think, 0, 3). We observe that the transition sequences of the concurrent system S in Figure 1 are exactly the ground derivations of the CLP program PS in Figure 2. Moreover, the set of all predecessor states of a set of states in S is the set of its direct logical consequences under the CLP program PS . We will show that these facts are generally true and use them to characterize CTL properties in terms of the denotational (fixpoint) semantics associated with CLP programs. We will now formalize the connection between concurrent systems and CLP programs. We assume that for each variable x there exists another variable x , the primed version of x. We write x for the tuple of variables x1 , . . . , xn  and d for the tuple of values d1 , . . . , dn . We denote validity of a first-order formula ψ wrt. to a structure D and an assignment α by D, α |= ψ. As usual, α[x → d] denotes an assignment in which the variables in x are mapped to the values in d. In the examples of Section 5 formulas will be interpreted over the domains of integers and reals. Note however that the following presentation is given for any structure D. A concurrent system (in the sense of [Sha93]) is a triple V, Θ, E such that – V is the tuple x of control and data variables, – Θ is a formula over V called the initial condition, – E is a set of pairs ψ, φ called events, where the enabling condition ψ is a formula over V and the action φ is a formula of the form x1 = e1 ∧ . . . xn = en with expressions e1 , . . . , en over V . The primed variable x appearing in an action is used to represent the value of x after the execution of an event. In the examples, we use the notation cond ψ action φ for the event ψ, φ (omitting conjuncts of the form x = x). tween denotational semantics and operational semantics (for ground derivations) is central again.

Model Checking in CLP

227

The semantics of the concurrent system S is defined as a transition system whose states are tuples d of values in D and the transition relation τ is defined by τ = {d, d¼  | D, α[x → d] |= ψ, D, α[x → d, x¼ → d¼ ] |= φ, ψ, φ ∈ E}. The pre-condition operator preS of the concurrent system S is defined through the transition relation: preS (S) = {d | exists d ∈ S such that d, d  ∈ τ }. For the translation to CLP programs, we view the formulas for the enabling condition and the action as constraints over the structure D (see [JM94]). We introduce p for a dummy predicate symbol with arity n, and init for a predicate with arity 0. 2 Definition 1 (Translation of concurrent systems to CLP programs) The concurrent program S is encoded as the CLP program PS given below, if S = V, Θ, E and V is the tuple of variables x. PS = {p(x) ← ψ ∧ φ ∧ p(x ) | ψ, φ ∈ E} ∪ {init ← Θ ∧ p(x)} The direct consequence operator TP associated with a CLP program P (see [JM94]) is a function defined as follows: applied to a set S of atoms, it yields the set of all atoms that are direct logical consequences of atoms in S under the formula P . Formally, TP (S) = {p(d) | p(d) ← p(d ) is an instance of a clause in P, p(d ) ∈ S}. We obtain a (ground) instance by replacing all variables with values. In the next statement we make implicit use of our convention of identifying states d and atoms p(d). Theorem 1 (Adequacy of the translation S → PS ) (i) The state sequences of the transition system defined by the concurrent system S are exactly the ground derivations of the CLP program PS . (ii) The pre-condition operator of S is the logical consequence operator associated with PS , formally: preS = TPS .

Proof. The clause p(x) ← ψ ∧ φ ∧ p(x ) of PS corresponds to the event ψ, φ. Its instances are of the form p(d) ← p(d ) where D, α[x → d, x → d ] |= ψ ∧ φ. Thus, they correspond directly to the pairs d, d¼  of the transition relation τ restricted to the event ψ, φ. This fact can be used to show (i) by induction on the length of a sequence of transitions or derivations and (ii) directly by ¾ definition. 2

Note that e.g. p(think, P2 , T urn1 , T urn2 ) ← . . . in the notation used in examples is equivalent to p(P1 , P2 , T urn1 , T urn2 ) ← P1 = think ∧ . . . in the notation used in formal statements.

228

Giorgio Delzanno and Andreas Podelski

As an aside, if we translate S into the CLP program PSpost where PSpost = {p(x) ∧ ψ ∧ φ → p(x ) | ψ, φ ∈ E} ∪ {Θ → p(x)} then the post-condition operator is the logical consequence operator associated with PS , formally: post S = TP post We thus obtain the characterization of the set S of reachable states as the least fixpoint of TP post . S

3

Expressing CTL Properties in CLP

We will use the temporal connectives: EF (exists finally), EG (exists globally), AF (always finally), AG (always globally) of CTL (Computation Tree Logic) to express safety and liveness properties of transition systems. Following [Eme90], we identify a temporal property with the set of states satisfying it. In the following, the notion of constrained facts will be important. A constrained fact is a clause p(x) ← c whose body contains only a constraint c. Note that an instance of a constrained fact is (equivalent to) a clause of the form p(d) ← t rue which is the same as the atom p(d), i.e. it is a state. Given a set of constrained facts F , we write [F ]D for the set of instances of clauses in F (also called the ‘meaning of F ’ or the ‘set of states represented by F ’). For example, the meaning of Fmut = {p(P1 , P2 , T urn1 , T urn2 ) ← P1 = use, P2 = use} is the set of states [Fmut ]D = {p(use, use, 0, 0), p(use, use, 1, 0), . . .}. The application of a CTL operator on a set of constrained facts F is defined in terms of the meaning of F . For example, EF (F ) is the set of all states from which a state in [F ]D is reachable. In our examples, we will use a more intuitive notation and write e.g. E F (p1 = p2 = use) instead of E F (Fmut ). As an example of a safety property, consider mutual exclusion for the concurrent system S in Figure 1 (“the two processes are never in the critical section at the same time”), expressed by AG(¬ (p1 = p2 = use)). Its complement is the set of states E F (p1 = p2 = use). As we can prove, this set is equal to the least fixpoint for the program PS ⊕ Fmut that we obtain from the union of the CLP Program PS in Figure 2 and the singleton set of constrained facts Fmut . We can compute this fixpoint and show that it does not contain the initial state (i.e. the atom init). As an example of a liveness property, starvation freedom for Process 1 (“each time Process 1 waits, it will finally enter the critical section”) is expressed by AG(p1 = wait → AF (p1 = use)). Its complement is the set of states E F (p1 = wait ∧ EG(¬ p1 = use)). The set of states E G(¬ p1 = use) is equal to the greatest fixpoint for the CLP program PS / Fstarv in Figure 3. We obtain PS / Fstarv from the CLP Program PS by a transformation wrt. to the following set of two constrained facts: Fstarv = { p(P1 , P2 , T urn1 , T urn2 ) ← P1 = think, p(P1 , P2 , T urn1 , T urn2 ) ← P1 = wait }.

Model Checking in CLP

229

init ← T urn1 = 0, T urn2 = 0, p(think, think, T urn1 , T urn2 ) p(think, P2 , T urn1 , T urn2 ) p(wait, P2 , T urn1 , T urn2 ) p(wait, P2 , T urn1 , T urn2 ) p(wait, think, T urn1 , T urn2 ) p(wait, wait, T urn1 , T urn2 ) p(wait, wait, T urn1 , T urn2 ) p(wait, use, T urn1 , T urn2 ) p(think, think, T urn1 , T urn2 ) p(think, wait, T urn1 , T urn2 ) p(think, wait, T urn1 , T urn2 ) p(think, use, T urn1 , T urn2 )

← ← ← ← ← ← ← ← ← ← ←

T urn1 =T urn2 +1, T urn1 < T urn2 , T urn2 = 0, T urn2 =T urn1 +1, T urn2 < T urn1 , T urn1 = 0, T urn2 = 0, T urn2 =T urn1 +1, T urn2 < T urn1 , T urn1 = 0, T urn2 = 0,

p(wait, P2 , T urn1 , T urn2 ) p(use, P2 , T urn1 , T urn2 ) p(use, P2 , T urn1 , T urn2 ) p(wait, wait, T urn1 , T urn2 ) p(wait, use, T urn1 , T urn2 ) p(wait, use, T urn1 , T urn2 ) p(wait, think, T urn1 , T urn2 ) p(think, wait, T urn1 , T urn2 ) p(think, use, T urn1 , T urn2 ) p(think, use, T urn1 , T urn2 ) p(think, think, T urn1 , T urn2 )

Fig. 3. The CLP program PS / Fstarv for the concurrent system S in Figure 1. The transformation amounts to ‘constrain’ all clauses p(label1 , , , ) ← . . . in PS such that l abel1 is either w ait or t hink (i.e., clauses of the form p(use, , , ) ← . . . are removed). To give an idea about the model checking method that we will describe in the next section: in an intermediate step, the method computes a set F  of constrained facts such that the set of states [F  ]D is equal to the greatest fixpoint for the CLP program PS / F . The method uses the set F  to form a third CLP program PS ⊕ F  . The least fixpoint for that program is equal to E F (p1 = wait ∧ EG(¬ p1 = use)). For more details, see Corollary 21 below. We will now formalize the general setting. Definition 2 Given a CLP program P and a set of constrained facts F , we define the CLP programs P ⊕ F and P / F as follows. P ⊕F = P ∪F P / F = { p(x) ← c1 ∧ c2 ∧ p(x ) | p(x) ← c1 ∧ p(x ) ∈ P, p(x) ← c2 ∈ F } Theorem 2 (CTL properties and CLP program semantics) Given a concurrent system S and its translation to the CLP program PS , the following properties hold for all sets of constrained facts F . EF (F ) = l f p(TP ⊕F ) EG(F ) = gf p(TP F ) Proof. Follows from the fixpoint characterizations of CTL properties (see [Eme90]) and Theorem 1. ¾ By duality, we have that AF (¬ F ) is the complement of gf p(TP F ) and AG(¬ F ) is the complement of l f p(TP ⊕F ). We next single out two important CTL properties that we have used in the examples in order to express mutual exclusion and absence of individual starvation, respectively.

230

Giorgio Delzanno and Andreas Podelski

Corollary 21 (Safety and Liveness) (i) The concurrent system S satisfies the safety property AG(¬ F ) if and only if the atom ‘init’ is not in the least fixpoint for the CLP program PS ⊕ F . (ii) S satisfies the liveness property AG(F1 → AF (¬ F2 )) if and only ‘init’ is not in the least fixpoint for the CLP program PS ⊕ (F1 ∧ F  ), where F  is a set of constrained facts denoting the greatest fixpoint for the CLP program PS / F2 . For the constraints considered in the examples, the sets of constrained facts are effectively closed under negation (denoting complement). Conjunction (denoting intersection) can always be implemented as F ∧ F  = {p(x) ← c1 ∧ c2 | p(x) ← c1 ∈ F, p(x) ← c2 ∈ F  , c1 ∧ c2 is satisfiable in D}.

4

Defining a Model Checking Method

It is important to note that temporal properties are undecidable for the general class of concurrent systems that we consider. Thus, the best we can hope for are ‘good’ semi-algorithms, in the sense of Wolper in [BW98]: “the determining factor will be how often they succeed on the instances for which verification is indeed needed” (which is, in fact, similar to the situation for most decidable verification problems [BW98]). A set F of constrained facts is an implicit representation of the (possibly infinite) set of states S if S = [F ]D . From now on, we always assume that F itself is finite. We will replace the operator TP over sets of atoms (i.e. states) by the operator SP over sets of constrained facts, whose application SP (F ) is effectively computable. If the CLP programs P is an encoding of a concurrent system, we can define SP as follows (note that F is closed under renaming of variables since clauses are implicitly universally quantified; i.e., if p(x1 , . . . , xn ) ← c ∈ F then also p(x1 , . . . , xn ) ← c[x1 /x1 , . . . , xn /xn ] ∈ F ). SP (F ) = {p(x) ← c1 ∧ c2 | p(x) ← c1 ∧ p(x ) ∈ P, p(x ) ← c2 ∈ F, c1 ∧ c2 is satisfiable in D} If P contains also constrained facts p(x) ← c, then these are always contained in SP (F ). The SP operator has been introduced to study the non-ground semantics of CLP programs in [GDL95], where also its connection to the ground semantics is investigated: the set of ground instances of a fixpoint of the SP operator is the corresponding fixpoint of the TP operator, formally lf p(TP ) = [lf p(SP )]D and gf p(TP ) = [gf p(SP )]D . Thus, Theorem 2 leads to the characterization of CTL properties through the SP operator via: EF (F ) = [lf p(SP ⊕F )]D , EG(F ) = [gf p(SP F )]D .

Model Checking in CLP

231

Now, a (possibly non-terminating) model checker can be defined in a straightforward way. It consists of the manipulation of constrained facts as implicit representations of (in general, infinite) sets of states. It is based on standard fixpoint iteration of SP operators for the specific programs P according to the fixpoint definition of the CTL properties to be computed (see e.g. Corollary 21). An iteration starts either with F = ∅ representing the empty set of states, or with F = {p(x) ← true} representing the set of all states. The computation of the application of the SP operator on a set of constrained facts F consists in scanning all pairs of clauses in P and constrained facts in F and checking the satisfiability of constraints; it produces a new (finite) set of constrained facts. The iteration yields a (possibly infinite) sequence F0 , F1 , F2 , . . . of sets of constrained facts. The iteration stops at i if the sets of states represented by Fi and Fi+1 are equal, formally [Fi ]D = [Fi+1 ]D . The fixpoint of the SP operator is taken wrt. the subsumption ordering between sets of constrained facts. We say that F is subsumed by F  if the set of states represented by F is contained in the set of states represented by F  , formally [F ]D ⊆ [F  ]D . Testing subsumption amounts to testing entailment of disjunctions of constraints by constraints. We interleave the least fixpoint iteration with the test of membership of the state init in the intermediate results; this yields a semi-algorithm for safety properties. We next describe some optimizations that have shown to be useful in our experiments (described in the next section). Our point here is to demonstrate that the CLP setting, with its combination of mathematical and logical reasoning, allows one to find these optimizations naturally. Local subsumption. For practical reasons, one may consider replacing subsumption by local subsumption as the fixpoint test. We say that F is locally subsumed by F  if every constrained fact in F is subsumed by some constrained fact in F  . Testing local subsumption amounts to testing entailment between quadratically many combinations of constraints. Generally, the fixpoint test may become strictly weaker but is more efficient, practically (an optimized entailment test for constraints is available in all modern CLP systems) and theoretically. For linear arithmetic constraints, for example, subsumption is prohibitively hard (co-NP [Sri93]) and local subsumption is polynomial [Sri93]. An abstract study of the complexity of local vs. full subsumption based on CLP techniques can be found in [Mah95]; he shows that (full) subsumption is co-NP-hard unless it is equivalent to local subsumption. Elimination of redundant facts. We call a set of constrained facts F irredundant if no element subsumes another one. We keep all sets of constrained facts F1 , F2 , . . . during the least fixpoint iteration irredundant by checking whether a new constrained fact in Fi+1 that is not locally subsumed by Fi itself subsumes (and thus makes redundant) a constrained fact in Fi . This technique is standard in CLP fixpoint computations [MR89]. Strategies. We obtain different fixpoint evaluation strategies (essentially, mixed forms of backward and forward analysis) by applying transformations

232

Giorgio Delzanno and Andreas Podelski

such as the magic-sets templates algorithm [RSS92] to the CLP programs PS ⊕F . Such transformations are natural in the context of CLP programs which may also be viewed as constraint data bases (see [RSS92,Rev93]). The application of a kind of magic-set transformation on the CLP program P = PS ⊕ F , where the clauses have a restricted form (one or no predicate in the  body), yields the following CLP program P (with new predicates p and init).  = {p(x) ← body, p(x ) | p(x) ← body ∈ P } ∪ P { p(x ) ← c, p(x) | p(x) ← c, p(x ) ∈ P } ∪  ← true} {init We obtain the soundness of this transformation wrt. the verification of safety properties by standard results [RSS92] which say that init ∈ lf p(TP ) if and only if init ∈ lf p(TP ) (which is, init ∈ lf p(SP )). The soundness continues to hold if we replace the constraints c in the clauses p(x ) ← c, p(x) in P by constraints c# that are entailed by c. We thus obtain a whole spectrum of transformations through the different possibilities to weaken constraints. In our example, if we weaken the arithmetical constraints by t rue, then the first iterations amount to eliminating constrained facts p(label1 , label2 , , ) ← . . . whose locations label1 , label2 are “definitely” not reachable from the initial state. Abstraction. We define an approximation SP# of the SP operator in the style of the abstract interpretation framework, whose results guarantee that we obtain conservative approximations of the fixpoints and, hence, of the CTL properties. This approximation turns our method into a (possibly non-terminating) semitest for AF and AG properties, in the following direction: only a positive answer is a definite answer. We introduce a new widening operator ⇑ (in the style of [CH78], but without a termination guarantee) and then define SP# (F ) = F ⇑SP (F ) (so that [SP (F )]D ⊆ [SP# (F )]D ). The operator ⇑ is defined in terms of constrained facts. For example, if F = {p(X, Y ) ← X ≥ 0, Y ≥ 0, X ≤ Y } F  = {p(X, Y ) ← X ≥ 0, Y ≥ 0, X ≤ Y + 1} then F ⇑F  = {p(X, Y ) ← X ≥ 0, Y ≥ 0}. Formally, F ⇑F  contains each constrained fact that is obtained from some constrained fact p(x) ← c1 ∧ . . . ∧ cn in F  by removing all conjuncts ci that are strictly entailed by some conjunct dj of some ‘compatible’ constrained atom p(x) ← d1 ∧ . . . ∧ dm in F , where ‘compatible’ means that the conjunction c1 ∧ . . . ∧ cn ∧ d1 ∧ . . . ∧ dm is satisfiable. This condition restricts the applications of the widening operator e.g to facts with the same values for the control locations. In contrast with the ‘standard’ widening operators in [CH78] and the refined versions in [HPR97,BGP98], the operator ⇑ can be directly implemented using the entailment test between constraints; furthermore, it is applied fact-by-fact, i.e., without requiring a preliminary computation of the convex hull of union of

Model Checking in CLP

233

polyhedra. Besides being computationally expensive, the convex hull approximation may be an important factor wrt. loss of precision. Let us consider e.g. the two sets of constrained atoms F = {p(, X) ← X ≥ 2} F  = {p(, X) ← X ≥ 2, p(, X) ← X ≤ 0}. When applied to F and F  , each of the widening operators in [BGP98,CH78,HPR97] returns the (polyhedra denoted by the) fact p(, X) ← true. In contrast, our widening is precise here, i.e., it returns F  . Note that the use of constrained facts automatically induces a partitioning over the state space wrt. the set of control locations; such a partitioning has shown to be useful to increase the precision of the widening operator (essentially, by reducing its applicability; see e.g. [HPR97,BGP98]).

5

Experimentation in CLP

We have implemented the model checking procedure described above in SICStus Prolog 3.7.1 using the CLP(Q,R) library [Hol95] and the Boolean constraint solvers (which are implemented with BDDs). We made extensive use of the runtime database facilities for storing and retrieving constrained facts, and of the meta-programming facilities (e.g., the interchangeability between uninterpreted and interpreted constraints expressions). We have applied the implementation to several infinite-state verification problems that are becoming benchmarks in the community (see e.g. [BGP97,BGP98,SKR98,SUM96,LS97]). This allowed us to evaluate the performance of our implementation, to experiment with evaluation strategies and abstractions through widenings, and to compare our solution with previous solutions. We implement the solving of constraints over integers, which is needed for model checking integer-valued concurrent systems, through a constraint solver over reals. We thus trade the theoretical and practical gain in efficiency with an extra abstraction. This abstraction yields yields a conservative approximation of CTL properties (by standard fixpoint theory). In our experiments, we did not incur a loss of precision. It would be interesting to generally characterize the integer-valued concurrent systems for which the abstraction of integer constraints to the reals is always precise. We will now briefly comment on the experimental results listed in Fig. 4. All the verification problems have been tested on a Sun Sparc Station 4, OS 5.5.1. Mutual exclusion and starvation freedom for the bakery algorithm (see Sect. 2 and Sect. 3) can be verified without the use of widening (execution time for starvation freedom: 0.9s). In versions of the bakery algorithm for 3 and 4 processes (not treated in [BGP97]), a maximum operator (used in assignments of priorities such as Turn1 = max (Turn2 , Turn3 ) + 1) is encoded case-by-case in the constraint representation. This makes the program size grow exponentially

234

Giorgio Delzanno and Andreas Podelski

Programs bakery bakery3 bakery4 ticket mut-ast network bbuffer (1) bbuffer (2) ubuffer

C 8 21 53 6 20 16 4 4 6

ET 0.1 6.3 335.4 ↑ 0.0 ↑ 0.2 0.0 ↑

EN 18 157 1698 ↑ 20 ↑ 2 2 ↑

ERT 0.1 6.1 253.2 ↑ 0.0 ↑ 0.2 0.0 ↑

ERN AT AN ART ARN 16 109 963 ↑ 1.0 15 1.1 13 20 ↑ 0.7 3 0.6 3 2 2 ↑ 3.0 16 1.7 6

Fig. 4. Benchmarks for the verification of safety properties; C: number of clauses, E: exact, A: approximation with widening, R: elimination of redundant facts, T: execution time (in seconds), N: number of produced facts, −: not needed, ↑: non-termination.

in the number of processes. Although here the time cost seems still reasonable, more experiments are needed to truly check scalability. The ticket algorithm (see [BGP97]) is based on similar ideas as the bakery algorithm. Here, priorities are maintained through two global variables and two local variables. As in [BGP97], we needed to apply widening to prove safety. In a second experiment we applied the magic set transformation instead and obtained a proof in 0.6s. We proved starvation freedom in 3.0s applying widening for the outer least fixpoint (the inner one for the greatest fixpoint terminates without abstraction). The algorithm mut-ast (see [LS97]) is also designed to ensure mutual exclusion. We have translated the description of a network of an arbitrary, non-fixed number of mut-ast-processes in [LS97] into a CLP-program and proved safety using abstraction (network). The other examples are producer-consumer algorithms. The algorithm bbuffer (see [BGP98]) coordinates a system of two producers and two consumers connected by a buffer of bounded size. We proved two invariants: the difference between produced and consumed items is always equal to the number of items currently present in the buffer (bbuffer(1)), and the number of free slots always ranges between zero and the maximum size of the buffer (bbuffer(2)). The algorithm ubuffer (see [BGP98]) coordinates a system with one producer and one consumer connected by two unbounded buffers. We have proved the invariant that the number of consumed items is always less than that of produced ones. A prototypical version of our model checker (SICStus source code, together with the code of the verification problems considered in this section and the outcomes of the fixpoint computations) is available at the URL address www.mpi-sb.mpg.de/delzanno/clp.html.

Model Checking in CLP

6

235

Related Work

There have been other attempts to connect logic programming and verification, none of which has our generality with respect to the applicable concurrent systems and temporal properties. In [FR96], Fribourg and Richardson use CLP programs over gap-order integer constraints [Rev93] in order to compute the set of reachable states for a ‘decidable’ class of infinite-state systems. Constraints of the form x = y + 1 (as needed in our examples) are not gap-order constraints. In [FO97], Fribourg and Olsen study reachability for system with integer counters. These approaches are restricted to safety properties. In [Rau94], Rauzy describes a CLP-style extension of the propositional μcalculus to finite-domain constraints, which can be used for model checking for finite-state systems. In [Urb96], Urbina singles out a class of CLP (R) programs that he baptizes ‘hybrid systems’ without, however, investigating their formal connection with hybrid system specifications; note that liveness properties of timed or hybrid automata can not be directly expressed through fixpoints of the SP operator (because the clauses translating time transitions may loop). In [GP97], Gupta and Pontelli describe runs of timed automata using the topdown operational semantics of CLP-programs (and not the fixpoint semantics). In [CP98], Charatonik and Podelski show that set-based program analysis can be used as an always terminating algorithm for the approximation of CTL properties for (traditional) logic programs specifying extensions of pushdown processes. In [RRR+ 97], a logic programming language based on tabling called XSB is used to implement an efficient local model checker for finite-state systems specified in a CCS-like value-passing language. The integration of tabling with constraints is possible in principle and has a promising potential. As described in [LLPY97], constraints as symbolic representations of states are used in uppaal, a verification tool for timed systems [LPY97]. It seems that, for reasons of syntax, it is not possible to verify safety for our examples in the current version of uppaal (but possibly in an extension). Note that uppaal can check bounded liveness properties only, which excludes e.g. starvation freedom. We will next discuss work on other verification procedures for integer-valued systems. In [BGP97,BGP98], Bultan, Gerber and Pugh use the Omega library for Presburger arithmetic as their implementation platform. Their work directly stimulated ours; we took over their examples of verification problems. The execution times (ours are about an order of magnitude shorter than theirs) should probably not be compared since we manipulate formulas over reals instead of integers; we thus add an extra abstraction for which in general a loss of precision is possible. In [BGL98], their method is extended to a composite approach (using BDDs), whose adaptation to the CLP setting may be an interesting task. In [CABN97], Chan, Anderson, Beame and Notkin incorporate an efficient representation of arithmetic constraints (linear and non-linear) into the BDDs of SMV [McM93]. This method uses an external constraint solver to prune states with unsatisfiable constraints. The combination of Boolean and arithmetic constraints for handling the interplay of control and data variables is a promising

236

Giorgio Delzanno and Andreas Podelski

idea that fits ideally with the CLP paradigm and systems (where BBD-based Boolean constraint solvers are available).

7

Conclusion and Future Work

We have explored a connection between the two fields of verification and programming languages, more specifically between model checking and CLP. We have given a reformulation of safety and liveness properties in terms of the wellstudied CLP semantics, based on a novel translation of concurrent systems to CLP programs. We could define a model checking procedure in a setting where a fixpoint of an operator on infinite sets of states and a fixpoint of the corresponding operator on their implicit representations can be formally related via well-established results on program semantics. We have turned the theoretical insights into a practical tool. Our implementation in a CLP system is direct and natural. One reason for this is that the two key operations used during the fixpoint iteration are testing entailment and conjoining constraints together with a satisfiability test. These operations are central to the CLP paradigm [JM94]; roughly, they take over the role of read and write operations for constraints as first-class data-structures. We have obtained experimental results for several example infinite-state systems over integers. Our tool, though prototypical, has shown a reasonable performance in these examples, which gives rise to the hope that it is useful also in further experiments. Its edge on other tools may be the fact that its CLPbased setting makes some optimizations for specific examples more direct and transparent, and hence experimentation more flexible. In a sense, it provides a programming environment for model checking. We note that CLP systems such as SICStus already provide high-level support for building and integrating new constraint solvers (on any domain). As for future work, we believe that more experience with practical examples is needed in order to estimate the effect of different fixpoint evaluation strategies and different forms of constraint weakening for conservative approximations. We believe that after such experimentation it may be useful to look into more specialized implementations. Acknowledgements. The authors would like to thank Stephan Melzer for pointing out the paper [BGP97], Christian Holzbaur for his help with the OFAI-CLP(R) library [Hol95], and Tevfik Bultan, Richard Gerber, Supratik Mukhophadyay and C.R. Ramakrishnan for fruitful discussions and encouragements.

References ˇ ACJT96.

ˇ ans, B. Jonsson, and Y.-K. Tsay. General Decidability P. A. Abdulla, K. Cer¯ Theorems for Infinite-state Systems. In Proceedings of the Eleventh Annual Symposium on Logic in Computer Science (LICS’96), pages 313–321. IEEE Computer Society Press, 1996.

Model Checking in CLP

237

BCM+ 90. J. R. Burch, E. M. Clarke, K. L. McMillan, D. L. Dill, and L. J. Hwang. Symbolic Model Checking: 1020 States and Beyond. In John C. Mitchell, editor, Proceedings of the Fifth Annual Symposium on Logic in Computer Science (LICS’90), pages 428–439. IEEE Society Press, 1990. BGL98. T. Bultan, R. Gerber, and C. League. Verifying Systems with Integer Constraints and Boolean Predicates: a Composite Approach. In Proceedings of the 1998 ACM/SIGSOFT International Symposium on Software Testing and Analysis (ISSTA’98), pages 113–123. ACM Press, 1998. BGP97. T. Bultan, R. Gerber, and W. Pugh. Symbolic Model Checking of Infinitestate Systems using Presburger Arithmetics. In Orna Grumberg, editor, Proceedings of the Ninth Conference on Computer Aided Verification (CAV’97), volume 1254 of LNCS, pages 400–411. Springer-Verlag, 1997. BGP98. T. Bultan, R. Gerber, and W. Pugh. Model Checking Concurrent Systems with Unbounded Integer Variables: Symbolic Representations, Approximations and Experimental Results. Technical Report CS-TR-3870, UMIACSTR-98-07, Department of Computer Science, University of Maryland, College Park, 1998. BW94. B. Boigelot and P. Wolper. Symbolic Verification with Periodic Sets. In David Dill, editor, Proceedings of the Sixth International Conference on Computer Aided Verification (CAV’94), volume 818 of LNCS, pages 55–67. Springer-Verlag, 1994. BW98. B. Boigelot and P. Wolper. Verifying Systems with Infinite but Regular State Space. In Alan J. Hu and Moshe Y. Vardi, editors, Proceedings of the Tenth Conference on Computer Aided Verification (CAV’98), volume 1427 of LNCS, pages 88–97. Springer-Verlag, 1998. CABN97. W. Chan, R. Anderson, P. Beame, and D. Notkin. Combining Constraint Solving and Symbolic Model Checking for a Class of Systems with Nonlinear Constraints. In Orna Grumberg, editor, Proceedings of the Ninth Conference on Computer Aided Verification (CAV’97), volume 1254 of LNCS, pages 316–327. Springer-Verlag, 1997. CH78. P. Cousot and N. Halbwachs. Automatic Discovery of Linear Restraints among Variables of a Program. In Proceedings of the Fifth Annual Symposium on Principles of Programming Languages (POPL’78), pages 84–96. ACM Press, 1978. CJ98. H. Comon and Y. Jurski. Multiple Counters Automata, Safety Analysis, and Presburger Arithmetics. In Alan J. Hu and M. Y. Vardi, editors, Proceedings of the Tenth Conference on Computer Aided Verification (CAV’98), volume 1427 of LNCS, pages 268–279. Springer-Verlag, 1998. CP98. W. Charatonik and A. Podelski. Set-based Analysis of Reactive Infinitestate Systems. In Bernhard Steffen, editor, Proceedings of of the First International Conference on Tools and Algorithms for the Construction and Analysis of Systems (TACAS’98), volume 1384 of LNCS, pages 358–375. Springer-Verlag, 1998. Eme90. E. A. Emerson. Temporal and Modal Logic. In Jan van Leeuwen, editor, Handbook of Theoretical Computer Science, volume B, pages 995–1072. Elsevier Science, 1990. FO97. L. Fribourg and H. Olsen. A Decompositional Approach for Computing Least Fixed Point of Datalog Programs with Z-counters. Journal of Constraints, 2(3-4):305–336, 1997.

238 FR96.

Giorgio Delzanno and Andreas Podelski

L. Fribourg and J. Richardson. Symbolic Verification with Gap-order Constraints. Technical Report LIENS-93-3, Laboratoire d’Informatique, Ecole Normale Superieure, Paris, 1996. GDL95. M. Gabbrielli, M. G. Dore, and G. Levi. Observable Semantics for Constraint Logic Programs. Journal of Logic and Computation, 2(5):133–171, 1995. GP97. G. Gupta and E. Pontelli. A Constraint Based Approach for Specification and Verification of Real-time Systems. In Proceedings of the 18th IEEE Real Time Systems Symposium (RTSS’97). IEEE Computer Society, 1997. HHWT97. T. A. Henzinger, P.-H. Ho, and H. Wong-Toi. HyTech: a Model Checker for Hybrid Systems. In Orna Grumberg, editor, Proceedings of the Ninth Conference on Computer Aided Verification (CAV’97), volume 1254 of LNCS, pages 460–463. Springer-Verlag, 1997. Hol95. C. Holzbaur. OFAI CLP(Q,R), Manual, Edition 1.3.3. Technical Report TR-95-09, Austrian Research Institute for Artificial Intelligence, Vienna, 1995. HPR97. N. Halbwachs, Y-E. Proy, and P. Roumanoff. Verification of Real-time Systems using Linear Relation Analysis. Formal Methods in System Design, 11(2):157–185, 1997. JM94. J. Jaffar and M. J. Maher. Constraint Logic Programming: A Survey. Journal of Logic Programming, 19-20:503–582, 1994. LLPY97. K. G. Larsen, F. Larsson, P. Pettersson, and W. Yi. Efficient Verification of Real-time Systems: Compact Data Structure and State-space Reduction. In Proceedings of the 18th IEEE Real Time Systems Symposium (RTSS’97), pages 14–24. IEEE Computer Society, 1997. LPY97. K. G. Larsen, P. Pettersson, and W. Yi. uppaal in a Nutshell. International Journal on Software Tools for Technology Transfer, 1(1-2):134–152, 1997. LS97. D. Lesens and H. Saidi. Automatic Verification of Parameterized Networks of Processes by Abstraction. In Proceedings of the International Workshop on Verification Infinite State Systems (INFINITY’97), available at the URL http://sunshine.cs.uni-dortmund.de/organization/pastE.html, 1997. Mah95. M. J. Maher. Constrained dependencies. In Ugo Montanari, editor, Proceedings of the First International Conference on Principles and Practice of Constraint Programming (CP’95), Lecture Notes in Computer Science, pages 170–185, Cassis, France, 19–22 September 1995. Springer-Verlag. McM93. K. L. McMillan. Symbolic Model Checking: An Approach to the State Explosion Problem. Kluwer Academic, 1993. MP95. Z. Manna and A. Pnueli. Temporal Verification of Reactive Systems: Safety. Springer-Verlag, 1995. MR89. M. J. Maher and R. Ramakrishnan. D´ej` a Vu in Fixpoints of Logic Programs. In Ross A. Lusk and Ewing L. Overbeek, editors, Proceedings of the North American Conference on Logic Programming (NACLP’89), pages 963–980. MIT Press, 1989. Pod94. A. Podelski, editor. Constraint Programming: Basics and Trends, volume 910 of LNCS. Springer-Verlag, 1994. Rau94. A. Rauzy. Toupie: A Constraint Language for Model Checking. In Podelski [Pod94], pages 193–208. Rev93. P. Z. Revesz. A Closed-form Evaluation for Datalog Queries with Integer (Gap)-order Constraints. Theoretical Computer Science, 116(1):117–149, 1993.

Model Checking in CLP

239

RRR+ 97. Y. S. Ramakrishnan, C. R. Ramakrishnan, I. V. Ramakrishnan, S. A. Smolka, T. Swift, and D. S. Warren. Efficient Model Checking using Tabled Resolution. In Orna Grumberg, editor, Proceedings of the Ninth Conference on Computer Aided Verification (CAV’97), volume 1254 of LNCS, pages 143–154. Springer-Verlag, 1997. RSS92. R. Ramakrishnan, D. Srivastava, and S. Sudarshan. Efficient Bottom-up Evaluation of Logic Programs. In P. De Wilde and J. Vandewalle, editors, Computer Systems and Software Engineering: State-of-the-Art, chapter 11. Kluwer Academic, 1992. Sha93. U. A. Shankar. An Introduction to Assertional Reasoning for Concurrent Systems. ACM Computing Surveys, 25(3):225–262, 1993. SKR98. T. R. Shiple, J. H. Kukula, and R. K. Ranjan. A Comparison of Presburger Engines for EFSM Reachability. In Alan J. Hu and Moshe Y. Vardi, editors, Proceedings of the Tenth Conference on Computer Aided Verification (CAV’98), volume 1427 of LNCS, pages 280–292. Springer-Verlag, 1998. Sri93. D. Srivastava. Subsumption and Indexing in Constraint Query Languages with Linear Arithmetic Constraints. Annals of Mathematics and Artificial Intelligence, 8(3-4):315–343, 1993. SUM96. H. B. Sipma, T. E. Uribe, and Z. Manna. Deductive Model Checking. In R. Alur and T. Henzinger, editors, Proceedings of the Eighth Conference on Computer Aided Verification (CAV’96), volume 1102 of LNCS, pages 208–219. Springer-Verlag, 1996. Urb96. L. Urbina. Analysis of Hybrid Systems in CLP(R). In Eugene C. Freuder, editor, Proceedings of Principles and Practice of Constraint Programming (CP’96), volume 1118 of LNCS, pages 451–467. Springer-Verlag, 1996. Wal96. M. Wallace. Practical Applications of Constraint Programming. Constraints, 1(1-2):139–168, 1996.

10.1007/b107031130016

Using Logic Programs with Stable Model Semantics to Solve Deadlock and Reachability Problems for 1-Safe Petri Nets Keijo Heljanko Helsinki University of Technology, Laboratory for Theoretical Computer Science P.O.Box 5400, FIN-02015 HUT, Finland Keijo.Heljanko@hut.fi

Abstract. McMillan has presented a deadlock detection method for Petri nets based on finite complete prefixes (i.e. net unfoldings). The basic idea is to transform the PSPACE-complete deadlock detection problem for a 1-safe Petri net into a potentially exponentially larger NP-complete problem of deadlock detection for a finite complete prefix. McMillan suggested a branch-and-bound algorithm for deadlock detection in prefixes. Recently, Melzer and Rmer have presented another approach, which is based on solving mixed integer programming problems. In this work it is shown that instead of using mixed integer programming, a constraint-based logic programming framework can be employed, and a linear-size translation from deadlock detection in prefixes into the problem of finding a stable model of a logic program is presented. As a side result also such a translation for solving the reachability problem is devised. Experimental results are given from an implementation combining the prefix generator of the PEP-tool, the translation, and an implementation of a constraint-based logic programming framework, the smodels system. The experiments show the proposed approach to be quite competitive, when compared to the approaches of McMillan and Melzer/Rmer.

1

Introduction

Petri nets are a widely used model for analyzing concurrent and distributed systems. Often such a system must exhibit reactive, non-terminating behavior, and one of the key analysis problems is that of deadlock-freedom: Do all reachable global states of the system (markings of the net) enable some action (net transition)? In this work we study this problem for a subclass of Petri nets, the 1-safe Petri nets, which are capable of modelling finite state systems. For 1-safe Petri nets the deadlock detection problem is PSPACE-complete in the size of the net [4], however, restricted subclasses of 1-safe Petri nets exist for which this problem is NP-complete [10, 11]. McMillan has presented a deadlock detection method W.R. Cleaveland (Ed.): TACAS/ETAPS’99, LNCS 1579, pp. 240–254, 1999. c Springer-Verlag Berlin Heidelberg 1999 

Using Logic Programs with Stable Model Semantics

241

for Petri nets based on finite complete prefixes (i.e. net unfoldings) [10, 11]. The basic idea is to transform the PSPACE-complete deadlock detection problem for a 1-safe Petri net into a potentially exponentially larger NP-complete problem. This translation creates a finite complete prefix, which is an acyclic 1-safe Petri net of a restricted form. Experimental results show that the blowup of the transformation can in many cases be avoided [5, 10, 11, 12]. In this work we address the NP-complete deadlock detection problem for finite complete prefixes. McMillan originally suggested a branch-and-bound algorithm for solving this problem. Recently, Melzer and Rmer have presented another algorithm which is based on solving mixed integer programming problems generated from prefixes [12]. Their approach seems to be faster than McMillan’s on examples in which a large percentage of the events of the prefix are so called cut-off events. However, if this assumption does not hold, the run times are generally slower than those of the McMillan’s algorithm [12]. In this work we study an approach that is similar to that of Melzer and Rmer in the way of being capable of handling cases with a large percentage of cut-off events but with more competitive performance. Instead of mixed integer programming our approach is based on a constraint-based logic programming framework [13, 14, 15]. We translate the deadlock detection problem into the problem of finding a stable model of a logic program. As a side result we also obtain such a translation for checking the reachability problem, which is also NP-complete in the size of the prefix [4]. For the deadlock detection problem we present experimental results, and find our approach competitive with the two previous approaches. The rest of the paper is divided as follows. First we present Petri net notations used in the paper. In Sect. 3 we will introduce the rule-based constraint programming framework. Section 4 contains the main results of this work, linear-size translations from deadlock and reachability property checking into the problem of finding a stable model of a logic program. In Sect. 5 we present experimental results from our implementation. In Sect. 6 we conclude and discuss directions for future research.

2

Petri Net Definitions

First we define basic Petri net notations. Next we introduce occurrence nets, which are Petri nets of a restricted form. Then branching processes are given as a way of describing partial order semantics for Petri nets. Last but not least we define finite complete prefixes as a way of giving a finite representation of this partial order behavior. We follow mainly the notation of [5, 12]. 2.1

Petri Nets

A triple S, T, F  is a net if S ∩ T = ∅ and F ⊆ (S × T ) ∪ (T × S). The elements of S are called places, and the elements of T transitions. Places and transitions are also called nodes. We identify F with its characteristic function

242

Keijo Heljanko

on the set (S × T ) ∪ (T × S). The preset of a node x, denoted by • x, is the set {y ∈ S ∪ T | F (y, x) = 1}. The postset of a node x, denoted by x• , is the set {y ∈ S ∪ T | F (x,

y) = 1}. Their generalizations on sets of nodes X ⊆ S ∪ T are

defined as • X = x∈X • x, and X • = x∈X x• respectively. A marking of a net S, T, F  is a mapping S → IN. A marking M is identified with the multi-set which contains M (s) copies of s for every s ∈ S. A 4-tuple Σ = S, T, F, M0  is a net system if S, T, F  is a net and M0 is a marking of S, T, F . A marking M enables a transition t if ∀s ∈ S : F (s, t) ≤ M (s). If t is enabled, it t can occur leading to a new marking (denoted M → M  ), where M  is defined by ∀s ∈ S : M  (s) = M (s) − F (s, t) + F (t, s). A marking M is a deadlock marking iff no transition t is enabled by M . A marking Mn is reachable in Σ iff there exist a sequence of transitions t1 , t2 , . . . , tn and markings M1 , M2 , . . . , Mn−1 t1 t2 tn such that: M0 → M1 → . . . Mn−1 → Mn . A reachable marking is 1-safe if ∀s ∈ S : M (s) ≤ 1. A net system Σ is 1-safe if all its reachable markings are 1-safe. In this work we will restrict ourselves to the set of net systems which are 1-safe, have a finite number of places and transitions, and also in which each transition t ∈ T has both nonempty pre- and postsets. 2.2

Occurrence Nets

We use ≤F to denote the reflexive transitive closure of F . Let S, T, F  be a net and let x1 , x2 ∈ S ∪ T . The nodes x1 and x2 are in conflict, denoted by x1 #x2 , if there exist t1 , t2 ∈ T such that t1 = t2 , • t1 ∩ • t2 = ∅, t1 ≤F x1 , and t2 ≤F x2 . An occurrence net is a net N = B, E, F  such that: – ∀b ∈ B : |• b| ≤ 1, – F is acyclic, i.e. the irreflexive transitive closure of F is a partial order, – N is finitely preceded, i.e. for any node x of the net, the set of nodes y such that y ≤F x is finite, and – ∀x ∈ S ∪ T : ¬(x#x). The elements of B and E are called conditions and events, respectively. The set M in(N ) denotes the set of minimal elements of the transitive closure of F . A configuration C of an occurrence net is a set of events satisfying: – If e ∈ C then ∀e ∈ E : e ≤F e implies e ∈ C (C is causally closed), – ∀e, e ∈ C : ¬(e#e ) (C is conflict-free). 2.3

Branching Processes

Branching processes are “unfoldings” of net systems and were introduced by Engelfriet [3]. Let N1 = S1 , T1 , F1  and N2 = S2 , T2 , F2  be two nets. A homomorphism is a mapping S1 ∪ T1 → S2 ∪ T2 such that: h(S1 ) ⊆ S2 ∧ h(T1 ) ⊆ T2 , and for all t ∈ T1 , the restriction of h to • t is a bijection between • t and • h(t), and similarly for t• and h(t)• . A branching process of a net system Σ is a tuple β = N  , h, where N  is a occurrence net, and h is a homomorphism from

Using Logic Programs with Stable Model Semantics

243

N  to S, T, F  such that: the restriction of h to M in(N  ) is a bijection between M in(N  ) and M0 , and ∀e1 , e2 ∈ E, if • e1 = • e2 ∧ h(e1 ) = h(e2 ) then e1 = e2 . The set of places associated with a configuration C of β is denoted by M ark(C) = h((M in(N ) ∪ C • ) \ • C). A configuration C is a deadlock configuration iff the set (M in(N ) ∪ C • ) \ • C does not enable any event e ∈ E. 2.4

Finite Complete Prefixes

A finite branching process β is a finite complete prefix of a net system Σ iff for each reachable marking M of Σ there exists a configuration C of β such that: – M ark(C) = M , and – for every transition t enabled in M there exists a configuration C ∪ {e} such that e ∈ C and h(e) = t. Algorithms to obtain a finite complete prefix β given a 1-safe net system Σ are presented in e.g. [5, 10, 11]. The algorithms will mark some events of the prefix β as special cut-off events, which we denote by the set CutOffs(β) ⊆ E. The intuition behind cutoff events is that for each cut-off event e there already exists another event e in the prefix. The markings reachable after executing e can also be reached after executing e , and thus the markings after e need not to be considered any further. Due to space limitations we direct the reader interested in the approach to [5, 10, 11, 12].

3

Rule-Based Constraint Programming

We will use normal logic programs with stable model semantics [6] as the underlying formalism into which the deadlock and reachability problems for 1-safe Petri nets are translated. This section is to a large extent based on [15]. The stable model semantics is one of the main declarative semantics for normal logic programs. However, here we use logic programming in a way that is different from the typical PROLOG style paradigm, which is based on the idea of evaluating a given query. Instead, we employ logic programs as a constraint programming framework [13], where stable models are the solutions of the program rules seen as constraints. We consider normal logic programs that consist of rules of the form h ← a1 , . . . , an , not (b1 ), . . . , not (bm )

(1)

where a1 , . . . , an , b1 , . . . , bm and h are propositional atoms. Such a rule can be seen as a constraint saying that if atoms a1 , . . . , an are in a model and atoms b1 , . . . , bm are not in a model, then the atom h is in a model. The stable model semantics also enforces minimality and groundedness of models. This makes many combinatorial problems easily and succinctly describable using logic programming with stable model semantics. We will demonstrate the basic behavior of the semantics using programs P1-P4:

244

Keijo Heljanko

P1: a ← not (b)

P2: a ← a

b ← not (a)

P3: a ← not (a)

P4: a ← not (b), c b ← not (a)

Program P1 has two stable models: {a} and {b}. The property of this program is that we may freely make negative assumptions as long as we do not bump into any contradictions. For example, we may assume not (b) in order to deduce the stable model {a}. Program P2 has the empty set as its unique stable model. This exposes the fact that we can’t use positive assumptions to deduce what is to be included in a model. Program P3 is an example of a program which has no stable models. If we assume not (a), then we will deduce a, which will contradict with our assumption not (a). Program P4 has one stable model {b}. If we assume not (a) then we will deduce b. If we assume not (b) then we can’t deduce a, because c can’t be deduced from our assumptions. The stable model semantics for a normal logic program P is defined as follows [6]. The reduct P A of P with respect to the set of atoms A is obtained (i) by deleting each rule in P that has a not-atom not (x) in its body such that x ∈ A and (ii) by deleting all not-atoms in the remaining rules. A set of atoms A is a stable model of P if and only if A is the deductive closure of P A when the rules in P A are seen as inference rules. A non-deterministic way of constructing stable models is to guess which assumptions (not-atoms of the program) to use, and then check using the deductive closure (in linear time) whether the resulting model agrees with the assumptions. The problem of determining the existence of a stable model is in fact NP-complete [9]. 3.1

The tool smodels

There is a tool, the smodels system [14, 15], which provides an implementation of logic programs as a rule-based constraint programming framework. It finds (some or all) stable models of a logic program. It can also tell when the program has no stable models. It contains strong pruning techniques to make the problem tractable for a large class of programs. The smodels implementation needs space linear in the size of the input program [15]. The stable model semantics is defined using rules of the form (1). The smodels 2 handles extended rule types, which can be seen as succinct encodings of sets of basic rules. One of the rule types is a rule of the form: h ← 2{a1 , . . . , an }. The semantics of this rule is that if two or more atoms from the set a1 , . . . , an belong to the model, then also the atom h will be in the 2 model. It is easy to see that this rule can be encoded by using N 2−N basic rules of the form: h ← ai , aj . Using an extended rule instead of the corresponding basic rule encoding was necessary to achieve a linear-size translation of the two problems at hand. We also use the so called integrity rules in the programs. They are rules with no head, i.e. of the form: ← a1 , . . . , an , not (b1 ), . . . , not (bm ). The semantics is

Using Logic Programs with Stable Model Semantics

245

the following: A new atom f is introduced to the program, and the integrity rule is replaced by: f ← a1 , . . . , an , not (b1 ), . . . , not (bm ), not (f). It is easy to see that any set of atoms, such that a1 , . . . , an are in a model and atoms b1 , . . . , bm are not in a model, is not a stable model. It is also easy to see that the rule doesn’t add any new stable models. The last extended rule we use is of the form: {h} ← a1 , . . . , an . The semantics is the following: A new atom h is introduced to the program, and the rule is replaced by two rules: h ← a1 , . . . , an , not (h ), and h ← not (h). The atom h is removed from any stable models it appears in, and the rest of the model gives the semantics for the extended rule.

4

Translating Deadlock and Reachability Property Checking into Logic Programs

In this section we present the translations of deadlock and reachability properties into logic programs with stable model semantics. For the deadlock property the main result can be seen as a rephrasing of the Theorem 4 of [12], where mixed integer programming has been replaced by the rule-based constraint programming framework. For the reachability property we give another translation. In this work we assume that the set of events of a finite complete prefix is non-empty. If it is empty, the corresponding net system would have no events enabled in the initial state, and then the deadlock and reachability properties can be trivially solved by looking at the initial state only. Now we are ready to define our translation from the finite complete prefixes into logic programs with stable model semantics. The basic part of our translation is given next. It translates the notion of a configuration of a finite complete prefix into the problem of finding a stable model of a logic program. The definitions will be followed by an example translation given in Fig. 1. First we define some additional notation. We assume a unique numbering of the events (and conditions) of the finite complete prefix. We use the notation ei (bi ) to refer to the event (condition) number i. In the logic programs ei , (bi ) is an atom of the logic program corresponding to the event ei (condition bi ). Definition 1. Let β = N, h with N = B, E, F  be a finite complete prefix of a given 1-safe net system Σ. Let PB (β) be a logic program containing the following rules: 1. For all ei ∈ E \ CutOffs(β) a rule: ei ← ep1 , . . . , epn , not (bei ), such that {ep1 , . . . , epn } = • (• ei ). 2. For all ei ∈ E \ CutOffs(β) a rule: bei ← not (ei ). 3. For all bi ∈ B such that |bi • \ CutOffs(β)| ≥ 2 a rule: ← 2{ep1 , . . . , epn }, such that {ep1 , . . . , epn } = bi • \ CutOffs(β).

246

Keijo Heljanko

In the logic program definitions of this paper we use the convention that a part of a rule will be omitted, if the corresponding set evaluates to the empty set. For example rule 1 for an event ei , such that • (• ei ) = ∅, would become: ei ← not (bei ). The translation above could be trivially extended to also include the cut-off events, but they are not needed by the applications in this work. We define a mapping from a set of events of the prefix to a set of atoms of a logic program and vice versa. Definition 2. The set of atoms of a logic program P corresponding to a set of events C ⊆ E \ Cutoffs(β) of a finite complete prefix β is Model (C) = {ei | ei ∈ C} ∪ {bej | ej ∈ E \ {C ∪ Cutoffs(β)}}. Definition 3. The set of events corresponding to a stable model Δ of a logic program P is Events(Δ) = {ei ∈ E | ei ∈ Δ}. Now we are ready to state the correspondence between the finite complete prefix and the core part of our translation. Proofs of the theorems are omitted. Theorem 1. Let β be a finite complete prefix of a 1-safe net system Σ, let PB (β) be the logic program translation by Def. 1, and let C be a configuration of β, such that C ∩ Cutoffs(β) = ∅. Then the set of atoms Δ = Model (C) is a stable model of PB (β). Additionally, the mapping Events(Δ) is a bijective mapping from the stable models of PB (β) to the configurations of β which contain no cut-off events. Next we move to the deadlock translation. We add a set of rules to the program which place additional constraints on the stable models of the program PB (β). We add integrity rules to the program, which remove all stable models of the basic program which are not deadlocks. To do this we model the the enabling of each event (cut-off or not) of the prefix in the logic program. Definition 4. Let β be a finite complete prefix of a given 1-safe net system Σ. Let PD (β) be a logic program containing all the rules of the program PB (β) of Def. 1, and also the following rules: 1. For all bi ∈ {bj ∈ B | bj • = ∅} a rule: bi ← el , not (ep1 ), . . . , not (epn ), such that {el } = • bi , and {ep1 , . . . , epn } = bi • \ CutOffs(β). 2. For all ei ∈ E a rule: ← b p1 , . . . , b pn , such that {bp1 , . . . , bpn } = • ei . Theorem 2. Let β be a finite complete prefix of a 1-safe net system Σ, and let PD (β) be the logic program translation by Def. 4. There exists a stable model of PD (β) iff Σ has a reachable deadlock marking M . Additionally, for any stable model Δ of PD (β), the set of events C = Events(Δ) is a deadlock configuration of β, such that Mark (C) is a reachable deadlock marking of Σ.

Using Logic Programs with Stable Model Semantics

N 1 :

s1

t1

s2

t2

e 1 (t2 )

b 3 (s3 ) e 4 (t1 )

b 1 1 (s1 )

t4

t5

s4 b 1 (s1 )

N 2 :

PD (N 2) :

t3

s3

e 5 (t4 )

s5

b 2 (s2 ) e 3 (t5 )

e 2 (t3 )

b 4 (s4 ) e 6 (t4 )

b 7 (s2 ) b 1 0 (s2 )

e 7 (t3 )

e 8 (t5 )

b 9 (s4 )

b 8 (s5 )

247

b 5 (s4 ) b 6 (s5 )

e1 ← not (be1 ) be1 ← not (e1 ) e2 ← not (be2 ) be2 ← not (e2 ) e3 ← not (be3 ) be3 ← not (e3 ) e5 ← e1 , not (be5 ) be5 ← not (e5 ) e8 ← e5 , not (be8 ) be8 ← not (e8 ) ← 2{e1 , e2 , e3 } b1 ← not (e1 ) b2 ← not (e1 ), not (e2 ), not (e3 ) b3 ← e1 b4 ← e1 , not (e5 ) b5 ← e2 b7 ← e5 , not (e8 ) ← b1 , b2 ← b2 ← b3 ← b4 ← b5 ← b7

Fig. 1. Deadlock translation example.

In Fig. 1 an example of the deadlock translation is given. The prefix N 2 is a finite complete prefix of the 1-safe nets system N 1. The cut-off events of N 2 are marked with crosses. The translated program PD (N 2) has only one stable model Δ = {be1, be2 , e3 , be5 , be8 , b1 }, and the set Events(Δ) = {e3 } is a deadlock configuration of N 2. Next we will preset a way of translating reachability problems. First we need a way of making statements about an individual marking M . Definition 5. An assertion on a marking of a 1-safe net system Σ = S, T, F, M0  is a tuple S + , S − , where S + , S − ⊆ S, and S + ∩S − = ∅. The assertion S + , S −  agrees with a marking M of Σ iff: S + ⊆ {s ∈ S | M (s) = 1} ∧ S − ⊆ {s ∈ S | M (s) = 0}. With assertions we can easily formulate both the reachability and submarking reachability problems. The idea is again to add some integrity rules to the program which remove all stable models of PB (β) which do not agree with the

248

Keijo Heljanko

assertion. The basic structure is the same as for deadlocks, however we also need a set of atoms which represent the marking of the original net. Definition 6. Let β be a finite complete prefix of a given 1-safe net system Σ = S, T, F, M0 , and let φ = S + , S −  be an assertion on the places of Σ. Let PR (β, φ) be a logic program containing all the rules of the program PB (β) of Def. 1, and also the following rules: 1. For all bi ∈ {bj ∈ B | h(bj ) ∈ S + ∪ S − ∧ • bj ∈ E \ Cutoffs(β)} a rule: bi ← el , not (ep1 ), . . . , not (epn ), such that {el } = • bi , and {ep1 , . . . , epn } = bi • \ CutOffs(β). 2. For all bi ∈ {bj ∈ B | h(bj ) ∈ S + ∪ S − ∧ • bj ∈ E \ Cutoffs(β)} a rule: si ← bi , such that si = h(bi ). 3. For all si ∈ S + a rule: ← not (si ). 4. For all si ∈ S − a rule: ← si . Note that in the definition above only conditions of the prefix β and places of Σ which can affect the assertion φ are translated. Also cut-off postset conditions are not translated, because cut-offs will not be fired by the translation. Theorem 3. Let β be a finite complete prefix of a 1-safe net system Σ, and let PR (β, φ) be a logic program translation by Def. 6. The logic program PR (β, φ) has a stable model iff there exists a reachable marking of Σ which agrees with φ. Additionally, for any stable model Δ of PR (β, φ), the configuration C = Events(Δ) is a configuration of β, such that Mark (C) is a reachable marking of Σ which agrees with φ. It is easy to see that the sizes of all the translations are linear in the size of the prefix β, i.e. O(|B| + |E| + |F |). Because the rule-based constraint programming system we use needs linear space in the size of the input program, deadlock and reachability property checking exploiting these translations can be made using linear space in the size of the prefix. The translations are also local, which makes them straightforward to implement using linear time in the size of the prefix.

5

Deadlock Property Checking Implementation

We have implemented the deadlock property checking translation using C++, and we plan on implementing the reachability translation in the near future. The translation reads a binary file containing the description of a finite complete prefix generated by the PEP-tool [7]. It generates a logic program using

Using Logic Programs with Stable Model Semantics

249

the deadlock translation, which is then through an internal interface given to the smodels stable model generator. The translation performs the following optimizations: 1. Not generating the program iff the number of cut-off events is zero. 2. Removal of blocking of “stubborn” transitions: If we find an event ei such that (• ei )• \ Cutoffs(β) = {ei }, the corresponding rule of type 1 of the program PB (β) is replaced by a rule of the form: ei ← ep1 , . . . , epn , and the rule 2 of the form: bei ← not (ei ) is not created. Also the corresponding liveness rule of type 2 of the program PD (β) of the form: ← bp1 , . . . , bpn does not need to be created as far as the event ei is concerned. 3. Removal of redundant condition rules: The rule of type 1 of the program PD (β) corresponding to condition bi is removed if the atom bi is does not appear elsewhere in the program. 4. Removal of redundant atoms: If a rule of the form: a1 ← a2 would be generated, and this is the only rule in which a1 appears as a head, then all instances of a1 are replaced by a2 , and the rule is discarded. 5. Duplicate rule removal: Only one copy of each rule is generated. For the optimization 1 it is easy to see that the net system Σ will deadlock, because the finite complete prefix is finite and does not contain any cut-offs. Thus the net system Σ can fire only a finite number of transitions. It also is straightforward to prove that the optimizations 3-5 do not alter the number of stable models the program has. The optimization 2 is motivated by stubborn sets [16]. The intuition is that whenever ei is enabled, it must be disabled in order to reach a deadlock. However the only way of disabling ei is to fire it. Therefore we can discard all configurations in which ei is enabled as not being deadlock configurations. We argue that optimization 2 is correct, i.e. the stable models of the program PD (β) are not affected by it (modulo the possible removal of the atom bei from the set of atoms of the optimized program). Consider the original program, and an optimized one in which an event ei has been optimized using optimization 2. If we look only at the two programs without the deadlock detection parts added by Def. 4, their only difference is that in the original program it is possible to leave the event ei enabled but not fired, while this is not possible in the optimized program. Thus clearly the set of stable models of the optimized program is a subset of the stable models of the original one. If we have any configuration in which the event ei is enabled but is not fired, then the set of atoms corresponding to this configuration is not a stable model of the original program. This is the case because the integrity rule of type 2 of Def. 4 corresponding to the event ei eliminates such a potential stable model. Therefore the optimized program will have the same number of stable models as the original one. We do quite an extensive set of optimizations. The optimizations 1 and 2 are deadlock detection specific. The optimizations 3-5 can be seen as general logic program optimizations based on static analysis, and could in principle be done in the stable model generator after the translation. The optimizations 1-4 are

250

Keijo Heljanko

implemented using linear time and space in the size of the prefix. The duplicate rule removal is implemented with hashing. We use succinct rule encodings with extended rules when possible. The two rules ei ← ep1 , . . . , epn , not (bei ), and bei ← not (ei ) can be more succinctly encoded by an extended rule of the form: {ei } ← ep1 , . . . , epn . Also ← 2{a1 , a2 } is replaced by: ← a1 , a2 . We also sort the rules after the translation. In our experiments the sorting seems to have only a minimal effect on the total running time, but produces nicer looking logic program (debugging) output. After the translation has been created, the smodels computational engine is used to check whether a stable model of the program exists. If one exists, the deadlock checker outputs an example deadlock configuration using the found stable model. Otherwise the program tells that the net is deadlock free. 5.1

Experimental Results

We have made experiments with our approach using examples by Corbett [2], McMillan [10, 11], and Melzer and Rmer [12]. They were previously used by Melzer and Rmer in [12] and by Best and Rmer in [1], where additional information can be found. We compare our approach with two other finite complete prefix based deadlock checking methods. The first method is the branch-andbound deadlock detection algorithm by McMillan [10, 11, 12], and the other is the mixed integer programming approach by Melzer and Rmer [12]. The Figures 2-4 present the running times in seconds for the various algorithms used in this work, and for the mixed integer programming approach those presented in [12]. The running times have been measured using a Pentium 166MHz, 64MB RAM, 128MB swap, Linux 2.0.29, g++ 2.7.2.1, smodels pre2.0.30, McMillan’s algorithm version 2.1.0 by Stefan Rmer, and PEP 1.6g. The experiments with the mixed integer programming approach by Melzer and Rmer used a commercial MIP-solver CPLEX, and were conducted on a Sparcstation 20/712, 96MB RAM. The rows of the tables correspond to different problems. The columns represent: sum of user and system times measured by /usr/bin/time command, or times reported in [12], depending on the column: – – – –

Unf = time for unfolding (creation of the finite complete prefix) (PEP). DCMIP = time for Mixed integer programming approach in [12]. DCMcM = time for McMillan’s algorithm, average of 4 runs. DCsmo = time for smodels based deadlock checker, average of 4 runs.

The marking vm(n) notes that the program ran out of virtual memory after n seconds. The other fields of the figures are as follows: |B|: number of conditions, |E|: number of events, #c: number of cut-off events, DL: Y - the net system has a deadlock, CP: choice points i.e. the number of nondeterministic guesses smodels did during the run. The DCsmo column also includes the logic program translation time, which was always under 10 seconds for the examples.

Using Logic Programs with Stable Model Semantics Problem(size) DPD(5) DPD(6) DPD(7) DPH(5) DPH(6) DPH(7) ELEVATOR(2) ELEVATOR(3) ELEVATOR(4) FURNACE(1) FURNACE(2) FURNACE(3) RING(5) RING(7) RING(9) RW(6) RW(9) RW(12)

|B| 1582 3786 8630 2712 14474 81358 1562 7398 32354 535 5139 34505 339 813 1599 806 9272 98378

|E| 790 1892 4314 1351 7231 40672 827 3895 16935 326 3111 20770 167 403 795 397 4627 49177

#c 211 499 1129 547 3377 21427 331 1629 7337 189 1990 13837 37 79 137 327 4106 45069

DL CP N 0 N 0 N 0 N 0 N 0 N 0 Y 2 Y 3 Y 4 N 0 N 0 N 0 N 0 N 0 N 0 N 0 N 0 N 0

Unf1 0.6 3.2 17.4 1.3 33.7 929.3 0.6 10.3 186.1 0.1 3.2 134.7 0.1 0.2 0.7 0.1 2.0 137.5

251

DC2MIP DC1McM DC1smo 17.3 1.6 1.0 82.8 12.3 6.1 652.6 128.9 31.4 42.9 6.5 1.8 1472.8 1063.7 32.9 - vm(1690.2) 760.6 2.3 0.5 0.7 14.5 10.1 15.0 387.8 268.8 231.7 0.3 0.2 0.0 18.1 11.1 0.6 1112.5 vm(392.5) 7.1 1.3 0.1 0.1 17.1 0.2 0.4 71.2 0.7 2.2 0.7 0.3 0.0 58.5 68.2 0.4 24599.9 vm(3050.5) 4.2

Fig. 2. Measured running times in seconds: 1 = Pentium 166MHz, 64MB RAM, Linux 2.0.29. 2 = Sparcstation 20/712, 96MB RAM [12].

The logic programming approach using the smodels system was able to produce an answer for all the examples presented here, while the McMillan’s algorithm implementation ran out of virtual memory on some of the larger examples. Our approach was sometimes much faster, see e.g. FURNACE(3), RW(12), SYNC(3), BDS(1), GASQ(4), and Q(1). The McMillan’s algorithm was faster than our approach on the following problem classes: RING, HART, SENT and SPD. These problems are quite easy for both methods, running times for the first three were a few seconds, and for the fourth still well under 30 seconds. On the DME and KEY examples our approach is scaling better as the problem sizes increase. McMillan’s algorithm is most competitive when the number of cut-off events is relatively small. We do not have access to the MIP-solver used in [12], and also our experiments in [8] seem to indicate that the computer we made our experiments on is faster than theirs. This makes it difficult to comment on the absolute running times between different machines. However our approach is scaling better on most examples, see e.g. RW, DME, and SYNC examples. An observation that should be made is that the number of choice points for smodels in these examples is very low, with a maximum of 9 choice points in the example SPD(1). This means that on this example set the search space pruning techniques were very effective in minimizing the number of nondeterministic choices that were needed to solve the examples.

252

Keijo Heljanko Problem(size) DME(2) DME(3) DME(4) DME(5) DME(6) DME(7) DME(8) DME(9) DME(10) DME(11) SYNC(2) SYNC(3)

|B| 487 1210 2381 4096 6451 9542 13465 18316 24191 31186 4007 29132

|E| 122 321 652 1145 1830 2737 3896 5337 7090 9185 2162 15974

#c 4 9 16 25 36 49 64 81 100 121 490 5381

DL CP Unf1 DC2MIP DC1McM DC1smo N 0 0.1 1.9 0.1 0.1 N 0 0.3 64.6 0.3 0.8 N 0 1.1 216.1 1.4 3.9 N 0 3.2 1968.3 5.5 13.7 N 0 8.5 13678.3 20.1 38.0 N 0 18.1 66.1 86.7 N 0 37.0 196.0 182.3 N 0 70.0 542.2 366.6 N 0 124.0 - 1268.4 646.1 N 0 207.0 - 3070.9 1134.8 N 0 4.6 171.6 37.0 1.8 N 0 218.6 11985.0 14073.3 66.5

Fig. 3. Measured running times in seconds: 1 = Pentium 166MHz, 64MB RAM, Linux 2.0.29. 2 = Sparcstation 20/712, 96MB RAM [12].

The example nets and C++ source code for our translation including smodels are available from: http://saturn.hut.fi/~kepa/experiments/tacas99/

6

Conclusions

Our main contribution is a method to transform the deadlock and reachability problems for 1-safe Petri nets into the problem of finding a stable model of a logic program. We do this translation in two steps: (i) Existing methods and tools are used to generate a finite complete prefix of the 1-safe Petri net [5, 7, 10, 11]. (ii) The deadlock and reachability problems for the finite complete prefix are translated into the problem of finding a stable model of a logic program. This step uses the two new translations presented in this work, both of which are linear in the size of the prefix. We present experimental results to support the feasibility of this approach for the deadlock detection problem. We use an existing constraint-based logic programming framework, the smodels system, for solving the problem of finding a stable model of a logic program. Our experiments show that the approach seems to be quite robust and competitive on the examples available to us. More experiments are needed to evaluate the feasibility of the approach on the reachability problem. There are interesting topics for future research. It seems possible to extend the translations to allow for a larger class of Petri nets to be translated, while still keeping the problem NP-complete. McMillan’s algorithm can be seen to be more goal directed algorithm than our approach, and an alternative translation using the basic ideas of McMillan’s algorithm could be created. The smodels system is quite a general purpose constraint propagation based search engine. Creating

Using Logic Programs with Stable Model Semantics Problem(size) BDS(1) FTP(1) GASN(3) GASN(4) GASN(5) GASQ(3) GASQ(4) OVER(4) OVER(5) HART(50) HART(75) HART(100) KEY(2) KEY(3) KEY(4) MMGT(3) MMGT(4) Q(1) SENT(75) SENT(100) SPD(1)

|B| 12310 178077 2409 15928 100527 2593 19864 1561 7388 354 529 704 1304 13885 135556 11575 92940 16090 533 608 5317

|E| 6330 89042 1205 7965 50265 1297 9933 797 3761 202 302 402 650 6940 67775 5841 46902 8402 266 291 3138

#c 3701 35247 401 2876 18751 490 4060 240 1251 1 1 1 201 2921 32081 2529 20957 1173 40 40 1311

253

DL CP Unf1 DC1McM DC1smo N 0 18.3 171.9 4.1 N 0 6470.5 vm(5413.1) 2080.0 N 0 1.2 13.2 2.4 N 0 49.3 2630.4 105.5 N 0 1972.7 vm(3393.7) 3958.4 N 0 1.3 10.1 2.4 N 0 72.9 4170.3 127.5 N 0 0.6 0.9 0.1 N 0 11.9 38.1 0.9 Y 5 0.1 0.0 0.2 Y 6 0.3 0.1 0.4 Y 6 0.4 0.1 0.8 Y 5 0.5 0.3 0.7 Y 5 41.0 38.8 68.4 Y 8 3457.8 vm(3930.9) 4418.7 Y 0 22.6 592.4 20.0 Y 0 1466.2 vm(3068.0) 1375.2 Y 5 89.5 71.2 4.7 Y 6 0.2 0.1 0.3 Y 6 0.3 0.1 0.4 Y 9 6.1 8.4 21.8

Fig. 4. Measured running times in seconds: 1 = Pentium 166MHz, 64MB RAM, Linux 2.0.29.

specialized algorithms for the two problems at hand could further improve the competitiveness of our approach. The subject of applying our approach to some form of model checking is a very interesting area for future research.

7

Acknowledgements

The author would like to thank Ilkka Niemel for introducing him into the rulebased constraint programming framework, and for many constructive ideas for this paper. The tool smodels was programmed by Patrik Simons, who gave valuable support for its usage. Stephan Melzer and Stefan Rmer provided the example nets, and also Linux binaries for McMillan’s algorithm, which both were invaluable. Thanks to Burkhard Graves and Bernd Grahlmann for supplying C source code to read PEP prefix files. The financial support of Helsinki Graduate School on Computer Science and Engineering (HeCSE), and the Academy of Finland are gratefully acknowledged.

254

Keijo Heljanko

References [1] E. Best. Partial order verification with PEP. In G. Holzmann, D. Peled, and V. Pratt, editors, Proceedings of POMIV’96, Workshop on Partial Order Methods in Verification. American Mathematical Society, July 1996. [2] J. C. Corbett. Evaluating deadlock detection methods for concurrent software. Technical report, Department of Information and Computer Science, University of Hawaii at Manoa, 1995. [3] J. Engelfriet. Branching processes of Petri nets. In Acta Informatica 28, pages 575–591, 1991. [4] J. Esparza and M. Nielsen. Decidability issues for Petri Nets - a survey. Journal of Information Processing and Cybernetics 30(3), pages 143–160, 1994. [5] J. Esparza, S. R¨ omer, and W. Vogler. An improvement of McMillan’s unfolding algorithm. In Proceedings of Second International Workshop on Tools and Algorithms for the Construction and Analysis of Systems (TACAS’96), pages 87–106, Passau, Germany, Mar 1996. Springer-Verlag. LNCS 1055. [6] M. Gelfond and V. Lifschitz. The stable model semantics for logic programming. In Proceedings of the 5th International Conference on Logic Programming, pages 1070–1080, Seattle, USA, August 1988. The MIT Press. [7] B. Grahlmann. The PEP Tool. In Proceedings of CAV’97 (Computer Aided Verification), pages 440–443. Springer-Verlag, June 1997. LNCS 1254. [8] K. Heljanko. Deadlock checking for complete finite prefixes using logic programs with stable model semantics (extended abstract). In Proceedings of the Workshop Concurrency, Specification & Programming 1998. HumboldtUniversity, Berlin, September 1998. Accepted for publication. Available at http:// saturn.hut.fi/˜kepa/publications/KH csp98.ps.gz. [9] W. Marek and M. Truszczy´ nski. Autoepistemic logic. Journal of the ACM, 38:588– 619, 1991. [10] K. L. McMillan. Using unfoldings to avoid the state space explosion problem in the verification of asynchronous circuits. In Proceeding of 4th Workshop on Computer Aided Verification (CAV’92), pages 164–174, 1992. LNCS 663. [11] K. L. McMillan. A technique of a state space search based on unfolding. In Formal Methods is System Design 6(1), pages 45–65, 1995. [12] S. Melzer and S. R¨ omer. Deadlock checking using net unfoldings. In Proceeding of 9th International Conference on Computer Aided Verification (CAV’97), pages 352–363, Haifa, Israel, Jun 1997. Springer-Verlag. LNCS 1254. [13] I. Niemel¨ a. Logic programs with stable model semantics as a constraint programming paradigm. In Proceedings of the Workshop on Computational Aspects of Nonmonotonic Reasoning, pages 72–79, Trento, Italy, May 1998. Helsinki University of Technology, Digital Systems Laboratory, Research Report A52. [14] I. Niemel¨ a and P. Simons. Smodels – an implementation of the stable model and well-founded semantics for normal logic programs. In Proceedings of the 4th International Conference on Logic Programming and Non-Monotonic Reasoning, pages 420–429, Dagstuhl, Germany, July 1997. Springer-Verlag. [15] P. Simons. Towards constraint satisfaction through logic programs and the stable model semantics. Research Report A47, Helsinki University of Technology, Espoo, Finland, August 1997. Licenciate’s thesis, Available at http:// saturn.hut.fi/pub/reports/A47.ps.gz. [16] A. Valmari. A stubborn attack on state explosion. Formal Methods in System Design, 1 (1992):297–322.

10.1007/b107031130017

Finite State Verification for the Asynchronous π-Calculus Ugo Montanari and Marco Pistore Computer Science Department, University of Pisa Corso Italia 40, 56100 Pisa, Italy {ugo,pistore}@di.unipi.it

Abstract. The π-calculus is a development of CCS that has the ability of communicating channel names. The asynchronous π-calculus is a variant of the π-calculus where message emission is non-blocking. Finite state verification is problematic in this context, since even very simple asynchronous π-processes give rise to infinite-state behaviors. This is due to phenomena that are typical of calculi with name passing and to phenomena that are peculiar of asynchronous calculi. We present a finite-state characterization of a family of finitary asynchronous π-processes by exploiting History Dependent transition systems with Negative transitions (HDN), an extension of labelled transition systems particularly suited for dealing with concurrent calculi with name passing. We also propose an algorithm based on HDN to verify asynchronous bisimulation for finitary π-processes.

1

Introduction

A growing interest has been recently devoted to calculi and languages for distributed systems, and in particular to the new phenomena they evidence. One of these phenomena is mobility: in large distributed systems, like the internet, there is mobility of hardware (when a computer is moved to a different node) and mobility of code and data (when applets are downloaded from the network and executed locally, or when remote programs are executed on local data). The π-calculus [7,6] is a foundational calculus with mobility. In the π-calculus, processes can handle channel names as messages, thus modeling changes in their neighborhood. Furthermore, name passing is enough to simulate higher order and object oriented concurrent calculi, thus also mobility of code and of data can be expressed in the π-calculus. In the original papers on π-calculus [7,6], communications are synchronous, i.e., the emission and the reception of a message are assumed to happen in the same instant. More recently, an asynchronous version of the π-calculus has been defined [5,2]. Here it is assumed that messages take time to move from the sender to the receiver, and that the sender is not blocked until the message is received. 

Research partially supported by CNR Integrated Project “Metodi e Strumenti per la Progettazione e la Verifica di Sistemi Eterogenei Connessi mediante Reti di Comunicazione”, and Esprit WG CONFER2.

W.R. Cleaveland (Ed.): TACAS/ETAPS’99, LNCS 1579, pp. 255–270, 1999. c Springer-Verlag Berlin Heidelberg 1999 

256

Ugo Montanari and Marco Pistore

While more expressive and more suitable to describe distributed systems, the calculi with name passing give rise to new problems, that cannot be solved by exploiting existing techniques for CCS-like process calculi. Here we focus on the problem of extending to (classes of) π-processes the techniques of finite state verification. Finite state verification is successful in the case of concurrent systems, since interesting problems can be expressed by means of finite state systems. This is the case for instance of protocols, where the control part is often independent from the data part and can be verified with finite-state techniques. In this paper we face the problem of finite state verification for the asynchronous π-calculus. This is not a trivial problem, since naive approaches lead to infinite state systems also for very simple asynchronous π-processes. Different techniques have to be exploited to obtain finite state representations for interesting classes of processes. Now we are going to describe these techniques. As a first step, we give a new definition of bisimilarity for the asynchronous π-calculus. In the classical asynchronous bisimulations proposed in [5,1], a lazy approach is used for output messages: since an arbitrary amount of time can be required for a message to be delivered, messages are never forced to be emitted from the system. In this way, however, infinite state systems are obtained practically for all recursive processes: in fact, if new messages are produced but never delivered, the size of the system can grow unboundedly. We propose a different definition of bisimulation, that we have called hotpotato bisimulation, where messages are emitted as soon as they are ready (a similar approach is proposed in [12] for asynchronous systems without mobility). In this way, the system cannot grow unboundedly due to messages that are ready to be emitted, but that are still undelivered. The classical, eager asynchronous bisimulation and the new hot-potato bisimulation coincide. Another cause of infiniteness is the generation of fresh names. This is a general phenomenon for the π-calculus: processes have the ability of creating dynamically new channels with the environment, and fresh names have to be associated to the new channels. Standard transition systems are not very convenient for dealing with allocation and deallocation of names: name creation is handled via the exposure of an internal name, that is subject to alpha conversion, and this results in an infinite branching; moreover, if names are never removed, new states are produced at every cycle which includes a name generation. In [8] we propose an enhanced version of labelled transition systems, that we called History Dependent (HD) transition systems, and a corresponding HD-bisimulation; names appear explicitly in states and labels of HD, so that name creation and deallocation can be explicitly represented. While HD and HD-bisimilarity are adequate to describe the π-calculus with synchronous communications, a more general model is needed for the asynchronous π-calculus. In this paper we define History Dependent transition systems with Negative transitions (HDN) and HDN-bisimulation. We show that the asynchronous π-calculus can be represented by means of HDN and that finite state HDN are obtained for an important family of π-processes. In our opinion, HDN

Finite State Verification for the Asynchronous π-Calculus

257

are a rather general model for mobile calculi; for instance, in [10] they are applied also to the early/late [7] and to the open [13,11] semantics of π-calculus. We also believe that they can be applied to other calculi with mobility, like the join calculus [4]. Finally, we define an iterative method to calculate HDN-bisimilarity for a certain class of finite state HDN. This method resembles the partitioning approach for ordinary labelled transition systems [9], where a partition of the states is built and incrementally refined until all the states in the same block are equivalent. In general HDN-bisimilarity is not guaranteed to be transitive: thus it is not possible to build a partition of equivalent states. Therefore, our partitioning approach applies only to a class of redundancy-consistent HDN. Fortunately enough, the HDN corresponding to asynchronous π-calculus is redundancy-consistent. Hence the partitioning method applies to verify equivalence of finitary asynchronous π-processes.

2

The asynchronous π-calculus

Asynchronous processes are a subset of ordinary π-calculus processes. More precisely, output prefixes ab.P are not allowed in the asynchronous context: in ab.P , in fact, process P is blocked until message ab is emitted, while in the asynchronous context message emission is required to be non-blocking. Output prefixes are replaced by output particles ab, that represent an output communication of name b on channel a that is ready to be delivered. For the same reasons, outputs cannot appear in a choice point, so sums are restricted to τ and input prefixes. Let be an infinite, countable set of names, ranged over by a, . . . , z. Asynchronous processes are defined by the syntax:     P, Q ::= ab  G  P |P  (νν a) P  A(a1 , . . . , an ) (processes)       (guards) G, H ::= 0 a(b).P τ.P G+G



def

where we assume that a definition A(b1 , . . . , bn ) = GA corresponds to each process identifier A. All the occurrences of b in (νν b) P and a(b).P are bound; free and bound names of process P are then defined as usual and we denote them with fn(P ) and bn(P ) respectively. We define a structural congruence ≡ that identifies all those processes that differ only for inessential details in the syntax of the programs. Formally, we define ≡ as the smallest congruence that satisfies the following rules: P ≡ Q if P and Q are alpha equivalent G+0 ≡ G G+G ≡ G +G G+(G +G ) ≡ (G+G )+G P |0 ≡ P P |P  ≡ P  |P P |(P  |P  ) ≡ (P |P  )|P  (νν a) 0 ≡ 0 (νν a) (νν b) P ≡ (νν b) (νν a) P (νν a) (P |Q) ≡ P |(νν a) Q if a ∈ fn(P ) The structural congruence is useful to obtain finite state representations for classes of processes. In fact, it can be used to garbage-collect terminated processes and unused restrictions.

258

Ugo Montanari and Marco Pistore a(b)

τ

[tau] τ.P −→ P

ab

α

[sum]

G −→ G α G+H −→ G

ab

[in] a(b).P −→ P [comm]

a(c)

P −→ P  Q −→ Q τ P |Q −→ P  |Q {b/c}

ab

[out] ab −→ 0 a(b)

[close]

a(b)

P −→ P  Q −→ Q τ P |Q −→ (νν b) (P  |Q )

α

P −→ P  P −→ P  if a = b [par] if bn(α) ∩ fn(Q) = ∅ α a(b) P |Q −→ P  |Q (νν b) P −→ P    α α Q Q ≡ Q P −→ P  n(α) [cong] P ≡ P P −→ [res] α α  if a ∈ (νν a) P −→ (νν a) P P −→ Q α a a def G { 1/b1 · · · n/bn } −→ P [ide] A if A(b1 , . . . , bn ) = GA α A(a1 , . . . , an ) −→ P [open]

 

If σ : → , we denote with P σ the process P whose free names have been replaced according to substitution σ (possibly with changes in the bound names to avoid name clashing); we denote with {y1/x1 · · · yn/xn } the substitution that maps xi into yi for i = 1, . . . , n and which is the identity on the other names. With some abuse of notation, we can see substitution σ in P σ as a function on fn(P ) rather than on . The actions that the processes can perform, are the following:    α ::= τ  a(c)  ab  a(c)



and are called respectively synchronization, input, free output and bound output actions; a and b are free names of α (fn(α)), whereas c is a bound name (bn(α)); moreover n(α) = fn(α) ∪ bn(α). The operational semantics of the asynchronous π-calculus is defined by means of a labelled transition systems. The transitions for the ground operational semantics are defined by the axiom schemata and the inference rules of the table on the top of this page. We recall that in the ground semantics no name instantiation occurs in the input transitions. In [1] it is shown that ground semantics coincides with early and late semantics in the case of asynchronous π-calculus without matching. 2.1

Asynchronous bisimulation

In this section we introduce asynchronous bisimulation. As we will see, while the management of τ and output transitions in the bisimulation game is standard, a special clause is needed for the input transitions; different characterizations of asynchronous bisimulation are proposed in [1]: they differ just in the way input transitions are dealt with. Following [1], we first define oτ -bisimulation, that just considers output and τ transitions; then we consider different notions of bisimulations that extend oτ -bisimulation with a clause for input transitions. Definition 1 (oτ -bisimulation [1]). A symmetric relation R on π-processes α is a oτ -bisimulation if P R Q and P −→ P  , where α is not an input transition, α and bn(α) ∩ fn(P |Q) = ∅, imply Q −→ Q and P  R Q .

Finite State Verification for the Asynchronous π-Calculus

259

Notice that clause “bn(α) ∩ fn(P |Q) = ∅” in the definition above assures that, when a channel name is extruded in a bound output transition, a fresh name (i.e., a name that is not used in P or Q) is used to denote that channel. In an asynchronous context, messages can be received by a process in any moment, even if the process is not ready to consume them: in [5] this intuition is modeled by allowing every process to accept every input message, i.e., according a(b)

to the semantics of [5], P −→ P |ab is a valid transition for every process P . This approach has some drawbacks; the most important for our purposes is that an infinite number of transitions can be performed by every process — even by process 0 — so finite state verification is not possible. a(b)

In this paper we follow instead the approach of [1]: an input transition P −→ P  corresponds to the consumption of a message, i.e., to the execution of an input prefix. However, in the definition of asynchronous bisimulation, we cannot require a(b)

that, given two bisimilar processes P and Q, each input transition P −→ P  is a(b)

matched by a transition Q −→ Q : process Q can receive the message ab without consuming it, and be still equivalent to P . In asynchronous bisimulation [1], a(b)

a(b)

hence, a transition P −→ P  can be matched either by a transition Q −→ Q , and P  and Q should be still bisimilar; or by a fictitious input transition of Q, that receives the message but does not consume it: this is modeled by requiring τ that Q −→ Q (i.e., Q performs some internal work), and that P  is bisimilar to Q |ab (process Q |ab has received the message but has not yet consumed it). Definition 2 (ground asynchronous bisimulation [1]). A symmetric relation R on π-processes is an (ground) asynchronous bisimulation if it is a a(b)

oτ -bisimulation such that P R Q and P −→ P  with b ∈ fn(P |Q) imply a(b)

• either Q −→ Q and P  R Q

τ

• or Q −→ Q and P  R (Q |ab).

Two processes P and Q are asynchronous bisimilar, written P ∼a Q, if P R Q for some asynchronous bisimulation R. In [1] some alternative characterizations of asynchronous bisimulation are proposed. One of them, namely 3-bisimulation, shows that it is possible to disa(b)

cover by only considering the behavior of P whether the input P −→ P  is “redundant”, and to require that only the “non-redundant” input transitions of P are matched in Q. The intuition is that an input transition is “redundant” if it is immediately followed by the emission of the received message. Here we define a variant of 3-bisimulation, that we call 4-bisimulation. Aca(b)

cording to it, if process P performs an input P −→ P  , but it also can perform τ a τ transition P −→ P  such that P  and P  |ab are bisimilar, then the input transition is redundant, and should not be matched by an equivalent process Q. Definition 3 (4-bisimulation). A symmetric relation R on π-processes is a a(b)

4-bisimulation if it is a oτ -bisimulation such that P R Q and P −→ P  with b ∈ fn(P |Q) imply

260

Ugo Montanari and Marco Pistore a(b)

• either Q −→ Q and P  R Q

τ

• or P −→ P  and P  R (P  |ab).

Two processes P and Q are 4-bisimilar, written P ∼4 Q, if there is some 4bisimulation R such that P R Q. In our opinion 4-bisimulation is particularly interesting: each process can discover privately if a transition is redundant, and in when two transitions of different processes are matched, it is required that the labels are exactly the same. Proposition 1. Relations ∼a and ∼4 coincide.

3

“Hot-potato” bisimulation

Asynchronous bisimulation and its alternative characterizations discussed in the previous section are not amenable for finite state verification. In fact, infinite state systems are obtained for essentially all the interesting processes that can perform infinite computations. This happens since the messages generated during a computation are not forced to be emitted, even if their channels are not restricted; rather, they are simply put in parallel to the process. So, every process that continues to generate output messages, gives rise to an infinite state system. We define now “hot-potato” bisimulation, that avoids this source of infiniteness. The key idea is to force the output particles to be emitted as soon as possible: consider process P = (νν c) (νν e) (ac|bc|cd|ef |G). Output particles ac and bc can be emitted directly. Particle cd can be emitted only after name c has been extruded by the emission of ac or of bc. Particle ef , finally, cannot be fired, since name e is restricted and there are no output particles that extrude it. In what follows, whenever we need to identify the firable output particles of a process P we use the notation P ≡ F P  , where F contains the firable output particles and the restrictions that are extruded by them, while P  contains the blocked output particles and the control part. So, for instance, process P can be decomposed as follows: P ≡ (νν c) (ac|bc|cd)  (νν e) (ef |G). Up to structural congruence ≡, the decomposition of P into F and P  is unique. In hot-potato bisimulation the emission of a message takes precedence on input and synchronization transitions; that is, process P cannot perform any input or synchronization transition until messages ac, bc and cd have been emitted. Moreover, rather than performing the emission of the output particles in a sequential way, the whole firable output F of F  P is emitted in one step. Definition 4 (hp-bisimulation). A symmetric relation R on π-processes is a hot-potato bisimulation (or hp-bisimulation) if P R Q and P ≡ F  P  with bn(F ) ∩ fn(P |Q) = ∅ then Q ≡ F  Q and

Finite State Verification for the Asynchronous π-Calculus τ

261

τ

– if P  −→ P  then Q −→ Q and P  R Q ;  a(b)

– if P −→ P  and b ∈ fn(P  |Q ) then: a(b)

• either Q −→ Q and P  R Q

τ

• or P  −→ P  and P  R (P  |ab).

Two processes P and Q are hp-bisimilar, written P ∼hp Q, if there is some hp-bisimulation R such that P R Q. Theorem 1. Relations ∼a and ∼hp coincide.

4

History dependent transition systems

In this section we introduce a new operational model, the History Dependent transition systems with Negative transitions, HDN in brief; they are, in our opinion, more adequate than classical labelled transition systems for dealing with process calculi with name passing, like the asynchronous π-calculus. As we have explained in the Introduction, classical labelled transition systems have difficulties in modelling the creation of fresh names: for instance, in the ordinary operational semantics of π-calculus, infinite bunches of transitions are necessary. This problem is addressed by HDN, where states and labels are enriched with sets of names, that are now an explicit component of the model. Moreover each state of a HDN is used to denote a whole family of π-processes that differ for injective renamings, and a single transition is sufficient to model the creation of a fresh name. This is obtained by representing explicitly the correspondence between the names of source, label and target of each transition; in the ordinary labelled transition system, the correspondence between these names is the syntactical identity, and this requires to distinguish states and transitions that differ for the syntactical identity of the names. All these features are also present in HD [8]. The original element of HDN is the presence of negative transitions: these are used to determine whether a transition is redundant or not. The intuition is that a transition is redundant if there is a negative transition from the same state, with the same label, and such that the two target states are bisimilar. That is, a negative transition from a state cancels the “equivalent” positive transitions from that state. Definition 5 (HDN). A History Dependent transition system with Negative /, /o /o /) where: transitions, or HDN, is a tuple = (Q, L, μ ,  – – –

Q is a set of states and L is a set of labels; we assume that Q ∩ L = ∅; μ : L ∪ Q → Pfin ( ) associates to each state and label a finite set of names;  / is the (positive) transition relation and /o /o / is the negative transition  relation; if Q λ / σ Q (resp. Q /o λ /o / σ Q ) then:  • Q, Q ∈ Q are the source and target states, • λ ∈ L is the label, • σ : μ (Q ) ! → μ (Q) ∪ μ (λ) is an injective embedding of the names of the target state into the names of the source state and of the label.



262

Ugo Montanari and Marco Pistore

We assume that the set of labels is closed for injective renamings, i.e., for each label λ ∈ L and each injective renaming ρ : μ (λ) ! → , we assume that a label λρ ∈ L is defined. The following properties of renamings on labels must be μ (λ)), (λρ)ρ = λ(ρ; ρ ), and λρ = λ if ρ = idμ (λ) . satisfied: μ (λρ) = ρ(μ



4.1

A HDN for the asynchronous π-calculus

In this section we define the HDN Π corresponding to the asynchronous πcalculus; the “hot potato” semantics is exploited to this purpose. In this case, the states QΠ have two forms: they are (0, P ) and (1, P ); in a state of the form (0, P ) the emission of the output message has still to be performed, while in a state (1, P ) it has already happened and process P can perform input and synchronization transitions. In both cases, the names associated to the state are fn(P ). In Π all the π-processes that differ only for an injective renaming are collapsed into a single state. To this purpose, we assume to have canonical representatives for each class of processes that differ for injective renamings, and a function norm that, given a process P , returns a pair norm(P ) = (Q, σ), where Q is the canonical representative of the class of processes that differ from P for an injective renaming, and σ : fn(Q) ! → fn(P ) is the injective renaming such that P = Qσ. The transitions in Π from a state (1, P ) correspond to the synchronization and input actions of process P . While all the τ transitions of P have to be represented in Π, it is not necessary to take all the input transitions; rather, it is sufficient to take just one canonical representative for each bunch of input transitions. In this case, a policy for allocating the fresh names has to be chosen. Since is countable, we can take the first name that does not already appear in process P whenever a transition from P requires the generation of a fresh name.



a(b)

 \ fn(P )).

So, we say that transition P −→ P  is canonical if b = min(

a(b)

Whenever a process P can perform both an input transition P −→ P  and a τ τ transition P −→ P  , we have to take into account that the input transition is  redundant if P and P  |ab are bisimilar. To this purpose, a negative transition with label a(b) is added to Π. In Π there is exactly one transition from state (0, P ), that corresponds to the emission of the firable messages. If P ≡ F  P  , then F is observed as the label of the transition. Since component F of a process P is unique only up to structural congruence, we assume to have canonical representatives for these composed output messages, and we call P ≡ F  P  a canonical decomposition if F is a canonical representative. Notice that the names μ (F ) that correspond to label F are not only the free names of F , but also its restricted ones. So, if the injective substitution ρ is applied to F , not only the free names are changed according to ρ, but also the restricted ones.

Finite State Verification for the Asynchronous π-Calculus

263

Definition 6 (HDN for the asynchronous π-calculus). The HDN Π for the “hot potato” asynchronous π-calculus is defined as follows: ∪ {(1, P ) | P is a canonical – QΠ = {(0, P ) | P is a canonical π-process} π-process without firable messages} and μ (0, P ) = μ (1, P ) = fn(P ); – LΠ = {τ } ∪ {a(b) | a, b ∈ } ∪ {F | F is canonical} and μ (τ ) = ∅, μ (a(b)) = {a, b}, μ (F ) = fn(F ) ∪ bn(F ); – if (0, Q) ∈ QΠ , Q ≡ F  Q is a canonical decomposition, and norm(Q ) =  (Q , σ), then (0, Q) F / σΠ (1, Q ); τ – if (1, Q) ∈ QΠ , Q −→ Q is a transition, and norm(Q ) = (Q , σ), then (1, Q)  τ / σΠ (0, Q );



a(b)

– if (1, Q) ∈ QΠ , Q −→ Q is a canonical transition, and norm(Q ) = (Q , σ),  a(b) / σ  then (1, Q) Π (0, Q ); a(b)

τ

– if (1, Q) ∈ QΠ , Q −→ Q is a canonical transition, Q −→ Q is a transition, a(b) and norm(Q |ab) = (Q , σ), then (1, Q) /o /o / σ (0, Q ). Π

Definition 7 (finitary processes). Let P be an asynchronous π-process and let norm(P ) = (Q, σ). Process P is finitary if and only if a finite number of states in Π are reachable from (0, Q). 4.2

HDN-bisimulation

In this section we define bisimulation on HDN. In this case, bisimulations cannot simply be relations on the states; they must also deal with name correspondences: a HDN-bisimulation is a set of triples of the form Q1 , δ, Q2  where Q1 and Q2 are states of the HDN and δ is a partial bijection between the names of the states. The bijection is partial since bisimilar states of a HDN can have a different number of names (in fact, bisimilar π-processes can have different sets of free names). Notation 1. We represent with f : A ! " B a partial bijection from set A to set B and with f : A ← → B a total bijection from set A to set B. We denote with f ; g the concatenation of f and g and with f −1 the inverse of f . Suppose that we want to check if states Q1 and Q2 are bisimilar via the partial bijection δ : μ (Q1 ) ! " μ (Q2 ) and suppose that Q1 can perform a transition Q1  λ1 / σ1 Q1 . There are two alternatives:  – State Q2 matches the transition of Q1 with a transition Q2 λ2 / σ2 Q2 such that labels λ1 and λ2 coincide up to a bijective renaming ρ, and states Q1 and Q2 are still bisimilar via a partial bijection δ  . Clearly, name correspondences δ, ρ and δ  have to be related. More precisely, ρ has to coincide with δ on the names that appear both in the label and in the source state (in fact, ρ is used to extend δ to the fresh names that are introduced in the transition) and all the pairs of names that appear in δ  must appear, via the embeddings σ1 and σ2 , either in δ or in ρ.

264

Ugo Montanari and Marco Pistore

– Transition Q1  λ1 / σ1 Q1 is redundant, i.e., there is some negative transition  λ Q1 /o 1/o / σ1 Q1 such that labels λ1 and λ1 coincide up to a bijective renaming ρ, and states Q1 and Q1 are bisimilar via a partial bijection δ  . Also in this case, name correspondences idμ (Q1 ) , ρ and δ  are related. Definition 8 (redundant transitions). Let R be a symmetric set of triples on HDN . Transition Q1  λ1 / σ1 Q1 is redundant for R, written Q1  λ1 / σ1  λ Q1 ∈ red[R], if there exists some negative transition Q1 /o 1/o / σ1 Q1 and some ρ : μ (λ1 ) ← → μ (λ1 ) such that μ (λ1 ) × μ (λ1 )); μ (Q1 ) × μ (Q1 )) = idμ (Q1 ) ∩(μ – ρ ∩ (μ  – λ1 = λ1 ρ; −1 – Q1 , δ  , Q1  ∈ R for some δ  ⊆ σ1 ; (idμ (Q1 ) ∪ρ); σ1 .  If transition Q1 λ1 / σ1 Q1 is not redundant for R, then we say that it is nonredundant for R and we write Q1  λ1 / σ1 Q1 ∈ red[R]. Definition 9 (HDN-bisimulation). A symmetric set of triples R on HDN is a HDN-bisimulation if Q1 , δ, Q2  ∈ R implies that for each transition Q1  λ1 / σ1 Q1 ∈ red[R] there exists some transition Q2  λ2 / σ2 Q2 and some → μ (λ2 ) such that ρ : μ (λ1 ) ← μ (λ1 ) × μ (λ2 )); μ (Q1 ) × μ (Q2 )) = δ ∩ (μ – ρ ∩ (μ – λ2 = λ1 ρ; – Q1 , δ  , Q2  ∈ R for some δ  ⊆ σ1 ; (δ ∪ ρ); σ2−1 . Proposition 2. If Ri with i ∈ I are HDN-bisimulations for some HDN then

also i∈I Ri is a HDN-bisimulation. This proposition guarantees the existence of the largest bisimulation for a HDN . We denote with ∼ this largest HDN-bisimulation. Moreover, if Q1 , δ, Q2  ∈ ∼ then we say that states Q1 and Q2 are HDN-bisimilar according to δ. The following theorem shows that HDN-bisimulation on Π captures exactly asynchronous bisimulation. Theorem 2. Let P1 and P2 be two π-processes and let norm(P1 ) = (Q1 , σ1 ) and norm(P2 ) = (Q2 , σ2 ). Then P1 ∼a P2 if and only if (0, Q1 ) and (0, Q2 ) are HDN-bisimilar in Π according to σ1 ; σ2−1 . 4.3

Iterative characterization of HDN-bisimulation

In this section we show that, for a class of finite state HDN, the largest bisimulation can be effectively built with an iterative algorithm that resembles the partition refinement techniques of classical labelled transition systems [9]. As a first step, we characterize HDN-bisimulations on HDN as the pre-fixed points of a monotone functor Φ .

Finite State Verification for the Asynchronous π-Calculus

265

Definition 10 (functor Φ ). Functor Φ on symmetric set of triples R on is defined as follows: Q1 , δ, Q2  ∈ Φ (R) if and only if for each HDN   Q1 λ1 / σ1 Q1 ∈ red[R] there exists some transition Q2 λ2 / σ2 Q2 and some ρ : μ (λ1 ) ← → μ (λ2 ) such that μ (λ1 ) × μ (λ2 )); μ (Q1 ) × μ (Q2 )) = δ ∩ (μ – ρ ∩ (μ – λ2 = λ1 ρ; – Q1 , δ  , Q2  ∈ R where δ  ⊆ σ1 ; (δ ∪ ρ); σ2−1 . Fact 1. Set of triples R is a HDN-bisimulation for pre-fixed point of functor Φ .

if and only if it is a

Lemma 1. Functor Φ is monotone. Moreover, if the HDN ing, functor Φ is continuous.

is finite branch-

The fact that functor Φ is continuous for finite branching HDN (and hence in particular for finite state HDN), guarantees that the largest bisimulation ∼ can be obtained by the iterated application of Φ starting from the universal set of triples U = {Q1 , δ, Q2  | Q1 , Q2 ∈ Q, δ : μ (Q1 ) ! " μ (Q2 )}.  Corollary 1. Let be a finite branching HDN. Then ∼ = n∈IN Φn (U ). This result can be exploited to obtain an algorithm that builds ∼ whenever is a finite state HDN. However, this approach is not very efficient, since it involves the manipulation of large sets of triples: even in the case ∼ is very small, the algorithm starts from a set of triples U that is very large. A similar situation also happens in the case of bisimulation for ordinary finite state transition systems: all the states are considered equivalent in the beginning, and this universal relation is refined by the repeated application of a functor. In that case, however, all the approximations built by the algorithm are equivalences and can be efficiently represented by partitions of the states in equivalence blocks. So, for instance, the initial relation is represented in a compact way by the singleton partition, where all the states are in the same block. To develop an efficient algorithm for HDN-bisimulation, it would be important to apply partitioning-like techniques also in this context. Unfortunately, in general the approximations Φn (U ), and in particular the largest HDNbisimulation ∼ , are not transitively closed. Consider if fact the following very simple HDN , where no names are associated to states and labels: P _ =

α

 P

IQ [ [ α α [ [   Q Q

R

It holds that P, ∅, Q ∈ ∼ (since P and Q have the same positive transitions) and that Q, ∅, R ∈ ∼ (since the only positive transition of Q is clearly redundant). It is not true, however, that P, ∅, R ∈ ∼ , since R is not able to match the positive transition of P .

266

Ugo Montanari and Marco Pistore

These problems occur since in the definition of Φ , as well as in the definition of HDN-bisimulation, it is not required that a non-redundant transition of Q1 is matched by a non-redundant transition of Q2 . Now we define functor Ψ where this correspondence between non-redundant transitions is forced. Therefore, the approximations obtained by iterating functor Ψ are transitively closed. However, this functor differs from Φ in general and, even worse, it is non-monotone (so there is no guarantee that the approximations will ever converge). Definition 11 (functor Ψ ). Functor Ψ on a symmetric set of triples R  is defined as follows: Q1 , δ, Q2  ∈ Ψ (R) if and only if for each Q1 λ1 / σ1  λ 2 / σ2 Q1 ∈ red[R] there exists some transition Q2 Q2 ∈ red[R] and some ρ : μ (λ1 ) ← → μ (λ2 ) such that μ (Q1 ) × μ (Q2 )) = δ ∩ (μ μ (λ1 ) × μ (λ2 )); – ρ ∩ (μ – λ2 = λ1 ρ; – Q1 , δ  , Q2  ∈ R where δ  ⊆ σ1 ; (δ ∪ ρ); σ2−1 . on the previous page and let R = {P  , ∅, Q } and S = Consider HDN     {P , ∅, Q , Q , ∅, Q }. Then clearly R ⊆ S. However, P, ∅, Q ∈ Ψ (R) but P, ∅, Q ∈ Ψ (S), so Ψ (R) ⊆ Ψ (S). In the case of HDN , therefore, functor Ψ is not monotone. While in general different, there are classes of finite branching HDN on which functors Φ and Ψ compute the same sequence of approximations. This situation is very convenient, since in this case the advantages of both functors hold; that is, the functor is continuous, so that the largest HDN-bisimulation is captured by iterating it; and the approximations are transitively closed, which implies that also the largest bisimulation is transitively closed. Fortunately enough, all the interesting HDN that we have considered are redundancy-consistent. In particular, this is the case of Π. Definition 12 (redundancy-consistent HDN). The finite branching HDN is redundancy-consistent if Φn (U ) = Ψ n (U ), for all n ∈ IN. Proposition 3. All the approximations R = Ψ n (U ) of a redundancy-consistent HDN are transitively closed, i.e., Q1 , δ12 , Q2  ∈ R and Q2 , δ23 , Q3  ∈ R imply Q1 , (δ12 ; δ23 ), Q3  ∈ R. Theorem 3. The HDN Π is redundancy-consistent. Each transitively closed set of triples R induces a partition of the states in equivalence classes. However, to characterize R it is still necessary to represent all the name correspondences between all the pairs of states in the same block. Now we show that these correspondences can be represented in a compact way by exploiting active names. At every step of the iteration of functor Ψ there are names of a state that have played no active roles in the game of matching transitions, since they are not appeared yet in the labels of the transitions considered for that state. Therefore, any correspondence can exist between the “inactive” names of equivalent states.

Finite State Verification for the Asynchronous π-Calculus

267

Definition 13 (active names). Let be a HDN. The family of functions ann : Q → Pfin ( ), with n ∈ IN, is defined as follows: an0 (Q) = ∅, and 

 μ (λ) ∪ σ ann (Q ) ∩ μ (Q). ann+1 (Q) = !  λ σ " / Q∈red[Ψ n (U )] Q



Notice that only the transitions that are non-redundant w.r.t. Ψ n (U ) are considered for computing the active names at the (n+1)-th step: only those transitions, in fact, are considered in the (n+1)-th application of functor Ψ . Also, the intersection − ∩ μ (Q) is necessary, since a transition can introduce new names that do not appear in the source state. The following proposition expresses the important properties of active names: any name correspondence between two equivalent states is a total correspondence between the active names of the two states; moreover, any correspondence is possible between the non-active names of two equivalent states. Proposition 4. Let

be a redundancy-consistent HDN. Then:

1. if P, δ, Q ∈ Ψ n (U ) then δ ∩ ann (P )×ann (Q) is a total bijection between ann (P ) and ann (Q);



2. if P, δ, Q ∈ Ψ n (U ) and δ ∩ ann (P ) × ann (Q) = δ  ∩ ann (P ) × ann (Q) then P, δ  , Q ∈ Ψ n (U ).

We can exploit the properties of active names to obtain a more compact representation of Ψ n (U ): only the correspondences of the active names are explicitly represented for each pair of states in the same equivalence class. There are cases in which the introduction of active names leads to a dramatic reduction of the correspondences that have to be represented explicitly. An extreme example is the universal relation U : while all the name correspondences between each pair of states appear in U , none of them has to be represented explicitly, since no name is active at this point. Also in the cases where a large number of correspondences exist between two equivalent states, a compact representation can be found for them. In fact, let Δn (P, Q) be the set of name correspondences that exist, according to Ψ n (U ), between the active names of P and the active names of Q: !

 " Δn (P, Q) = δ ∩ ann (P ) × ann (Q)  P, δ, Q ∈ Ψ n (U ) . The following proposition shows that Δn (Q, Q) is a permutation group on the active names of Q; it is hence sufficient to represent it by means of a set of generators. Moreover Δn (P, Q) can be recovered, starting from any of its elements δ, by composing δ with all the elements of Δn (Q, Q); it is hence sufficient to represent explicitly only one element of Δn (P, Q). Proposition 5. Let

be a redundancy-consistent HDN. Then:

1. if Δn (Q, Q) is a permutation group on ann (Q); 2. if δ ∈ Δn (P, Q) then Δn (P, Q) = {δ; δ  | δ  ∈ Δn (Q, Q)}.

268

Ugo Montanari and Marco Pistore 1 Normalize processes P1 and P2 . Let (Qi , σi ) = norm(Pi ) for i = 1, 2. 2 Generate the part of the HDN Π that is reachable from (0, Q1 ) and (0, Q2 ). 3 Initialization: 3.1 For each (reachable) state Q of Π, initialize an[Q] to the empty set. 3.2 Initialize part to the singleton partition on the (reachable) states of Π. 3.3 For each pair of (reachable) states Q and Q , initialize Delta[Q, Q ] to the empty set of name relations. 4 Repeat the following steps until partition part becomes stable: 4.1 Compute the non-redundant transitions according to part. 4.2 Update the sets of active names an[Q] for all the states Q. 4.3 Refine part according to functor ΨΠ . For each pair of states Q and Q that are still in the same block of part, put in Delta[Q, Q ] (a compact representation of) the valid relations between an[Q] and an[Q ]. 5 Check if Q1 and Q2 are in the same class and if σ1 ; σ2−1 is in Delta[Q1 , Q2 ].

We are currently working on the implementation of an algorithm that exploits these techniques to check bisimilarity of finitary asynchronous π-processes. In the table above we sketch the main steps that have to be performed to check whether processes P1 and P2 are equivalent. We plan to integrate it within HAL, a verification environment for calculi with name passing [3]. We conclude this section with some comments on the complexity of the algorithm. It is not possible, in general, to find an upper bound for the number of states and transitions of the HDN corresponding to a finitary π-process P in function of the syntactical length of P : in fact this problem is equivalent to find an upper bound to the length of the tape used by a given Turing machine, which is an undecidable problem. Once the HDN is built, the complexity in time for building the largest HDN-bisimulation is polynomial in the number s of states and t of transitions of the HDN, and exponential in the maximum number n of the names that appear in the states. The polynomial complexity in s and t is typical of the partitioning algorithms: each iteration of step 4 of the algorithm refines the partition of states, and at most s − 1 refinements are possible, after that all the states are in different blocks. However, the algorithm has to deal with correspondences between names, and there can be up to 2O(n·log n) of those correspondences between two states, hence the algorithm is exponential in n. Even if these correspondences are represented in a compact way by means of permutation groups, the exponential in the number of names cannot be avoided: some of the operations on permutation groups used in the algorithm are in fact exponential in the number n of elements.

5

Concluding remarks

In this paper we have presented the model of history dependent transition systems with negative transitions (HDN). They are an extended version of labelled transition systems and are adequate for asynchronous calculi with name passing.

Finite State Verification for the Asynchronous π-Calculus

269

We have also defined a finitary characterization of bisimilarity for the π-calculus; this characterization can be modeled by HDN and, as a consequence, finite state representations can be computed for a family of π-processes. In this paper we have considered only the asynchronous π-calculus without matching. In [10], however, HDN are applied also to the asynchronous π-calculus with matching, as well as to the early, late [7], and open [13,11] semantics of the π-calculus with synchronous communications. We are also working to extend the approach described in this paper to the weak asynchronous bisimulation. The alternative characterization given by 4bisimulation works also for the weak semantics: it is sufficient to replace the α α strong transitions −→ with weak transitions =⇒. Unfortunately, weak hotpotato bisimulation does not coincide with weak asynchronous bisimulation: it is not safe to force weak outputs to be emitted as soon as they are ready, since in this case the firing of an output can discard possible behaviors. For instance, in process τ.ab + a(c).0 the input transition is not performed at all if the output ab

transition τ.ab+a(c).0 =⇒ 0 has the precedence. To apply successfully the HDN also to the weak asynchronous π-calculus it is necessary to find conditions that allow a weak output transition to be fired without discarding behaviors.

References 1. R. Amadio, I. Castellani and D. Sangiorgi. On bisimulations for the asynchronous π-calculus. Theoretical Computer Science, 192(2):291–324, 1998. 2. G. Boudol. Asynchrony and the π-calculus. Research Report 1702, INRIA, SophiaAntipolis, 1991. 3. G. Ferrari, G. Ferro, S. Gnesi, U. Montanari, M. Pistore and G. Ristori. An automata-based verification environment for mobile processes. In Proc. TACAS’97, LNCS 1217. Springer Verlag, 1997. 4. C. Fournet, G. Gonthier, J.-J. L´evy, L. Maranget and D. R´emy. A calculus of mobile agents. In Proc. CONCUR’96, LNCS 1119. Springer Verlag, 1996. 5. K. Honda and M. Tokoro. An object calculus for asynchronous communication. In Proc. ECOOP’91, LNCS 612. Springer Verlag, 1991. 6. R. Milner. The polyadic π-calculus: a tutorial. In Logic and Algebra of Specification, NATO ASI Series F, Vol. 94. Springer Verlag, 1993. 7. R. Milner, J. Parrow and D. Walker. A calculus of mobile processes (parts I and II). Information and Computation, 100(1):1–77, 1992. 8. U. Montanari and M. Pistore. An introduction to history dependent automata. In Proc. HOOTS II, ENTCS 10. Elsevier, 1998. 9. R. Paige and R. E. Tarjan. Three partition refinement algorithms. SIAM Journal on Computing, 16(6):973–989, 1987. 10. M. Pistore. History Dependent Automata. PhD Thesis. Dipartimento di Informatica, Universit` a di Pisa, 1999. 11. M. Pistore and D. Sangiorgi. A partition refinement algorithm for the π-calculus. In Proc. CAV’96, LNCS 1102. Spinger Verlag, 1996. 12. J. Rathke. Resource based models for asynchrony. In Proc. FoSSaCS’98, LNCS 1378. Springer Verlag, 1998. 13. D. Sangiorgi. A theory of bisimulation for π-calculus. Acta Informatica, 33:69–97, 1996.

10.1007/b107031130018

P r o c e s s A lg e b r a in P V S T w a n B a s te n 1

D e p t. o f C o m p u tin g S c ie n tb a s te n @ w 2 C o m p u tin g S c ie n c e h o o m a n @ c

c e , E in in .tu e .n In s titu s .k u n .n

1

a n d Jo z e f H o o m a n

d h o v e l, h ttp te , U n l, h ttp

n U n iv e ://w w w iv e r s ity ://w w w

rs ity .w in o f N .c s .k

2

o f T e c h n o lo . t u e . n l / ∼t b a s ijm e g e n , T h u n . n l / ∼h o o m

g y , T h e N e th e rla n d s te n e N e th e rla n d s a n

1

A b s tr a c t. T h e a im o f th is w o rk is to in v e s tig a te m e c h a n ic a l s u p p o rt fo r p ro c e s s a lg e b ra , b o th fo r c o n c re te a p p lic a tio n s a n d th e o re tic a l p ro p e rtie s . T w o a p p ro a c h e s a re p re s e n te d u s in g th e v e rifi c a tio n s y s te m P V S . O n e a p p ro a c h d e c la re s p ro c e s s te rm s a s a n u n in te rp re te d ty p e a n d s p e c ifi e s e q u a lity o n te rm s b y a x io m s . T h is is c o n v e n ie n t fo r c o n c re te a p p lic a tio n s w h e re th e re w rite m e c h a n is m s o f P V S c a n b e e x p lo ite d . F o r th e v e rifi c a tio n o f th e o re tic a l re s u lts , o fte n in d u c tio n p rin c ip le s a re n e e d e d . T h e y a re p ro v id e d b y th e s e c o n d a p p ro a c h w h e re p ro c e s s te rm s a re d e fi n e d a s a n a b s tra c t d a ta ty p e w ith a s e p a ra te e q u iv a le n c e r e la tio n .

I n tr o d u c tio n W e in v e s tig a te th e p o s s ib ilitie s o f o b ta in in g m e c h a n ic a l s u p p o rt fo r e q u a tio n a l re a s o n in g in p r o c e s s a lg e b r a . I n p a r tic u la r, w e c o n s id e r A C P - s ty le p r o c e s s a lg e b r a s [ 2 ,3 ] , w h e re p ro c e s s e s a re re p re s e n te d b y te rm s c o n s tru c te d fro m a to m s (d e n o tin g a to m ic a c tio n s ) a n d o p e ra to rs s u c h a s c h o ic e (n o n -d e te rm in is m ), s e q u e n tia l c o m p o s itio n , a n d p a ra lle l c o m p o s itio n . A x io m s s p e c ify w h ic h p ro c e s s te rm s a re c o n s id e re d to b e e q u a l. T h e id e a is to a p p ly e q u a tio n a l re a s o n in g to p ro c e s s e s , s im ila r to n o rm a l a rith m e tic . T h is re a s o n in g is o fte n v e ry te d io u s a n d e rro r-p ro n e , a n d it is d iffi c u lt to c h e c k a ll d e ta ils m a n u a lly . E s p e c ia lly c o n c u rre n c y , w h ic h is u s u a lly u n fo ld e d in to a s e q u e n tia l te rm re p re s e n tin g a ll in te rle a v in g s , m ig h t g e n e ra te la rg e a n d c o m p le x te rm s . H e n c e , th e q u e s t fo r c o n v e n ie n t p ro o f s u p p o rt fo r p ro c e s s a lg e b ra . W e in v e s tig a te tw o a s p e c ts : – M e c h a n ic a l s u p p o rt fo r th e v e rifi c a tio n o f c o n c re te a p p lic a tio n s . T h e a im is u s u a lly to v e rify th a t a n im p le m e n ta tio n s a tis fi e s a s p e c ifi c a tio n . B o th a re e x p re s s e d in p ro c e s s a lg e b ra , w h e re th e im p le m e n ta tio n is m o re d e ta ile d w ith a d d itio n a l (in te rn a l) a c tio n s . T h e g o a l is to s h o w th a t th e s p e c ifi c a tio n e q u a ls th e im p le m e n ta tio n a fte r th e a b s tra c tio n fro m in te rn a l a c tio n s . T h e p ro o f p ro c e e d s b y re w ritin g th e im p le m e n ta tio n u s in g th e a x io m s u n til th e s p e c ifi c a tio n is o b ta in e d . – M e c h a n ic a l s u p p o rt fo r th e p ro o f o f th e o re tic a l p ro p e rtie s o f a p ro c e s s a lg e b ra . A c o m m o n p ro o f te c h n iq u e is b a s e d o n s o -c a lle d e lim in a tio n th e o re m s . S u c h a th e o r e m s ta te s th a t a n y c lo s e d p r o c e s s te r m in a g iv e n p r o c e s s a lg e b r a c a n b e r e w r itte n in to a b a s ic te r m , i.e . a te r m c o n s is tin g o f o n ly a to m s , c h o ic e s , a n d a to m - p r e fi x e s (re s tric te d s e q u e n tia l c o m p o s itio n ). T h u s a p ro p e rty fo r g e n e ra l p ro c e s s te rm s c a n b e re d u c e d in to o n e fo r b a s ic te rm s , w h ic h c a n th e n b e p ro v e d b y in d u c tio n o n th e s tru c tu re o r th e le n g th o f b a s ic te rm s . S in c e o u r g o a l is to r e a s o n a b o u t r e c u r s iv e , p o s s ib ly in fi n ite , p r o c e s s e s a n d to v e r if y n o t o n ly c o n c re te a p p lic a tio n s , b u t a ls o g e n e ra l th e o re tic a l re s u lts , w e d o n o t a im a t W .R . C le a v e la n d (E d .): T A C A S /E T A P S ’9 9 , L N C S 1 5 7 9 , p p . 2 7 0 – 2 8 4 , 1 9 9 9 . c S p rin g e r-V e rla g B e rlin H e id e lb e rg 1 9 9 9 

P ro c e s s A lg e b ra in P V S

2 7 1

c o m p le te ly a u to m a tic v e rifi c a tio n . In th is p a p e r, w e in v e s tig a te h o w p ro c e s s a lg e b ra c a n b e in c o rp o ra te d in th e fra m e w o rk o f th e to o l P V S (P ro to ty p e V e rifi c a tio n S y s te m ) [1 6 ]. P r o p e r tie s c a n b e p r o v e d in P V S b y m e a n s o f a n in te r a c tiv e p r o o f c h e c k e r. T h is m e a n s th a t th e u s e r a p p lie s p ro o f c o m m a n d s to s im p lify th e g o a l th a t m u s t b e p ro v e n , u n til it c a n b e p ro v e d a u to m a tic a lly b y th e p o w e rfu l d e c is io n p ro c e d u re s o f th e to o l. W e e x p e rim e n t w ith tw o d iffe re n t d e fi n itio n s o f p ro c e s s a lg e b ra in th e s p e c ifi c a tio n la n g u a g e o f P V S , a ty p e d h ig h e r-o rd e r lo g ic . O n e p o s s ib ility is to d e fi n e p ro c e s s te rm s b y m e a n s o f th e a b s tra c t-d a ta ty p e m e c h a n is m o f P V S w h ic h g e n e ra te s , a m o n g o th e rs , a u s e fu l in d u c tio n s c h e m e fo r th e d a ta ty p e , a llo w in g in d u c tio n o n th e s tru c tu re o f te rm s . A s a n a lte r n a tiv e , w e in v e s tig a te h o w th e r e w r itin g m e c h a n is m s o f P V S c a n b e e x p lo ite d fo r e q u a tio n a l re a s o n in g . S in c e p ro c e s s a lg e b ra , a s a m e th o d fo r s p e c ify in g a n d v e rify in g c o m p le x s y s te m s , is s till u n d e r d e v e lo p m e n t, m a n y d iffe re n t a lg e b ra s a lre a d y e x is t a n d o th e rs a re s till b e in g d e s ig n e d . T h e re fo re , th e g o a l is to c re a te a fl e x ib le fra m e w o rk in P V S th a t a llo w s e x p e rim e n ts w ith to o l s u p p o rt fo r c u s to m iz e d p ro c e s s a lg e b ra s . R e la te d W o r k . A lo t o f e ffo rt h a s b e e n d e v o te d to th e d e v e lo p m e n t o f d e d ic a te d to o ls fo r p ro c e s s a lg e b ra . F o r P S F [1 3 ], a n e x te n s io n o f A C P w ith a b s tra c t d a ta ty p e s , to o ls a re a v a ila b le th a t m a in ly s u p p o rt s p e c ifi c a tio n a n d s im u la tio n . P A M [1 2 ] is a re la te d to o l w h ic h p ro v id e s fl e x ib le la n g u a g e s u p p o rt. A n o th e r c la s s o f d e d ic a te d to o ls a im s a t a u to m a tic v e rifi c a tio n , in c lu d in g b is im u la tio n a n d m o d e l c h e c k e rs . A n e x a m p le is th e C o n c u rre n c y F a c to ry [8 ]. M o re re la te d to o u r w o rk is re s e a rc h o n th e u s e o f g e n e ra l p u rp o s e p ro o f c h e c k e r s . E .g ., to o l s u p p o r t f o r C C S a n d C S P h a s b e e n o b ta in e d u s in g H O L [ 6 ,7 ,1 5 ] . T h is th e o re m p ro v e r h a s a ls o b e e n u s e d to g e t m e c h a n iz e d s u p p o rt fo r re a s o n in g w ith th e π- c a l c u l u s [ 1 4 ] . F o r μC R L , a n A C P - l i k e l a n g u a g e w i t h d a t a s t r u c t u r e s , b o t h C o q [ 5 , 1 1 ] a n d P V S [1 0 ] h a v e b e e n in v e s tig a te d . In [5 ] p u re a lg e b ra ic re a s o n in g is u s e d , w h e re a s th e w o r k d e s c r ib e d in [ 1 0 ,1 1 ] c o m b in e s a lg e b r a ic a n d a s s e r tio n a l r e a s o n in g . M o s t o f th e re s e a rc h m e n tio n e d a b o v e a im s a t c o n c re te a p p lic a tio n s . T h e o n ly s u p p o rt fo r th e v e rifi c a tio n o f th e o re tic a l is s u e s c o n c e rn s th e s o u n d n e s s p ro o f o f a lg e b ra ic a x io m s , b a s e d o n a s p e c ifi c s e m a n tic m o d e l [ 6 ,1 4 ,1 5 ] . W h e r e a s th is o f te n c o n c e r n s th e o ry a b o u t th e u n d e rly in g m o d e l, w e a re m o re in te re s te d in th e v e rifi c a tio n o f th e o re tic a l re s u lts o n th e a x io m a tic le v e l, w ith o u t re ly in g o n a n y u n d e rly in g m o d e l. A ls o d iffe re n t is th a t w e e x p lic itly s tu d y th e c h o ic e s th a t c a n b e m a d e w h e n in c o rp o ra tin g p ro c e s s a lg e b ra in a g e n e ra l p u rp o s e p ro o f c h e c k e r. In th a t re s p e c t, o u r w o rk is p ro b a b ly m o s t re la te d to re s e a rc h o n to o l s u p p o rt fo r a C S P -lik e a lg e b ra b y m e a n s o f H O L [9 ]. In fa c t, th e y in v e s tig a te s im ila r a p p ro a c h e s a s w e d o , a lth o u g h th e y o n ly c o n s id e r s m a ll c o n c re te e x a m p le s . N e w in o u r p a p e r is , b e s id e s th e v e rifi c a tio n o f n o n - tr iv ia l e x a m p le s , th a t w e a d d itio n a lly s h o w h o w to o b ta in p r o o f s u p p o r t f o r th e d e v e lo p m e n t o f A C P -s ty le th e o ry o n th e a x io m a tic le v e l. O v e r v ie w . I n S e c tio n 2 , w e in v e s tig a te tw o a lte r n a tiv e s f o r th e m o d e lin g o f p r o c e s s a lg e b ra in P V S . A n a p p ro a c h w h e re p ro c e s s te rm s a re d e fi n e d a s a n a b s tra c t d a ta ty p e , w ith a s e p a r a te e q u iv a le n c e r e la tio n o n te r m s , is p r e s e n te d in S e c tio n 3 . I t is u s e d to p ro v e a n u m b e r o f th e o re tic a l re s u lts , u s in g in d u c tio n s c h e m e s p ro v id e d b y P V S . S e c tio n 4 d e s c r ib e s a n a lte r n a tiv e a p p r o a c h w h e r e p r o c e s s te r m s a r e d e fi n e d a s a n u n in te rp re te d ty p e , a llo w in g c o n v e n ie n t re w ritin g o f c o n c re te p ro c e s s te rm s . C o n c lu d in g re m a rk s c a n b e fo u n d in S e c tio n 5 .

2 7 2

2

T w a n B a s te n a n d J o z e f H o o m a n

M o d e lin g P r o c e s s A lg e b r a in P V S W e d is c u s s tw o a p p ro a c h e s b rie fl y in tro d u c e th e p ro c e s fo rw a rd fo rm u la tio n in P V S e c tio n 2 .2 . A n a p p r o a c h w in S e c tio n 2 .3 .

2 .1

to d e fi n in s -a lg e b ra S , u s in g h e re te rm

g p ro c ic fra m u n in te s a re

e s s a lg e w o rk rp re te d d e fi n e d

e b ra c o n ty p a s

in s id e s a n

P V e re p lu a b s

S . F d in s e q tra c

irs th u a t d

t, in is p a lity , a ta ty

S e p e is p e

c tio n r. A s p re se is d e

2 .1 , w e tra ig h tn te d in s c rib e d

P r o c e s s A lg e b r a

T o illu s tra te th e m a in c o n c e p ts , w e c o n s id e r th e o ry P A (P ro c e s s A lg e b ra ), a s d e fi n e d in [ 2 ,3 ] . T h is th e o r y is p r e s e n te d in T a b le 1 , w h e r e p a r a m e te r A r e p r e s e n ts th e s e t o f a to m s . T h e fi rs t e n try o f th is ta b le s p e c ifi e s th e s o rts ; P is th e s o rt o f a ll p ro c e s s te rm s . T h e s e c o n d e n t r y l i s t s t h e s t a n d a r d a l g e b r a i c o p e r a t o r s ; c h o i c e , d e n o t e d C, s e q u e n t i a l c o m p o s i t i o n , d e n o t e d · , p a r a l l e l c o m p o s i t i o n o r m e r g e , d e n o t e d , a n d a n a u x i l i a r y o p e r a t o r c a l l e d t h e l e f t m e r g e , d e n o t e d , w h i c h i s u s e d t o a x i o m a t i z e t h e m e r g e . I n t u itiv e ly , th e le f t m e rg e c o r r e s p o n d s to p a r a lle l e x e c u tio n , w ith th e r e s tr ic tio n th a t th e le f t p ro c e s s e x e c u te s th e fi rs t a c tio n . T h e t h i r d e n t r y o f T a b l e 1 c o n t a i n s t h e a x i o m s . F o r i n s t a n c e , A x i o m A4 s p e c i fi e s r ig h t- d is tr ib u tiv ity o f s e q u e n tia l c o m p o s itio n o v e r c h o ic e . T h e a b s e n c e o f le f t- d is tr ib u tiv ity im p lie s th a t p r o c e s s e s w ith d iff e r e n t m o m e n ts o f c h o ic e a r e d is tin g u is h e d . T h e a x io m s d e fi n e a n e q u iv a le n c e r e la tio n o n p r o c e s s e s . A m o d e l o f th e s e a x io m s , th e r e b y s h o w in g th e ir c o n s is te n c y , c o n s is ts o f e q u iv a le n c e c la s s e s o f c lo s e d te r m s ( i.e . te r m s w ith o u t v a r ia b le s ) a s p r o c e s s e s , w ith b is im u la tio n a s th e e q u iv a le n c e r e la tio n . N o te , h o w e v e r, th a t th is is o n ly o n e p o s s ib le m o d e l. A s tro n g p o in t o f a x io m a tic re a s o n in g is th a t it is m o d e l in d e p e n d e n t. S ta n d a rd fo r e q u a tio n a l s p e c ifi c a tio n s a re g e n e ra l s u b s titu tio n a n d c o n te x t ru le s w h ic h e x p r e s s th a t a p r o c e s s c a n b e r e p la c e d b y a n e q u iv a le n t te r m in a n y c o n te x t, i.e ., in s id e a n y te r m . P A A  P I A ⊆P C , · ,  ,  a : A I x, y, z : P I

: P ×P →P

xC y D yC x x C y C z D x C y C z xC x D x x C y · z D x · z C y · z x · y · z D x · y · z

A1 A2 A3 A4 A5

x  y D x  y C y  x a  x D a · x a · x  y D a · x  y x C y  z D x  z C y  z

M1 M2 M3 M4

T a b le 1 . T h e p ro c e s s a lg e b ra P A . 2 .2

U s in g U n in te r p r e te d T y p e s p lu s E q u a lity

I n P V S t h e o r y PArew, w e m o d e l p r o c e s s a l g e b r a P A w i t h t h e i n t e n t i o n t o e x p l o i t t h e r e w r i t i n g m e c h a n i s m s o f P V S . T h e o r y PArew i s p a r a m e t e r i z e d b y t h e t y p e Atoms. P r o c e s s te rm s a re ju s t d e fi n e d a s s o m e n o n -e m p ty u n in te rp re te d ty p e , a s s u m in g a fu n c tio n

P ro c e s s A lg e b ra in P V S

2 7 3

trm w h i c h m a p s a t o m s i n t o t e r m s . T h i s f u n c t i o n i s d e fi n e d a s a c o n v e r s i o n i n P V S , w h ic h m e a n s th a t it n e e d n o t b e m e n tio n e d e x p lic itly . PArew [Atoms: NONEMPTY_TYPE]: THEORY BEGIN Terms : NONEMPTY_TYPE trm : [Atoms -> Terms] CONVERSION trm

N e x t w ity o n in te rp r M o re o

e d e te rm e te d v e r,

fi n s, a s n o

e th e u s in g te rm te th a

o p e ra to th e b u s u s in g t ob in d

rs a s ilt-in c o n v s s tro

fu n c tio n s in th e la n g u a g e o e q u a lity o n u n in te rp re te d e r s i o n trm. E . g . , a o x i s n g e r t h a n // w h i c h b i n d s

f P V S ty p e s . in te rp s tro n g

a n d a x io m a tiz e e q u a lF re q u e n tly , a to m s a re r e t e d a s trm(a) o x. e r t h a n +.

+, o, //, lmrg : [Terms,Terms -> Terms] a : VAR Atoms x, y, z : VAR Terms A1 : AXIOM x + y = y + x A2 : AXIOM (x + y) + z = x + (y + z) A3 : AXIOM x + x = x A4 : AXIOM (x + y) o z = x o z + y o z A5 : AXIOM (x o y) o z = x o (y o z) M1 : AXIOM x // y = lmrg(x,y) + lmrg(y,x) M2 : AXIOM lmrg(a,x) = a o x M3 : AXIOM lmrg(a o x,y) = a o (x // y) M4 : AXIOM lmrg(x + y,z) = lmrg(x,z) + lmrg(y,z) END PArew

In in in fo a x m

g e n e ra l, o n e s h o u ld b e c a re fu l w ith a x io m s in P V S , b e c a u s e th e y m ig h t in tro d u c e c o n s is te n c ie s . H o w e v e r, a s m e n tio n e d in S e c tio n 2 .1 , th e r e a r e s e v e r a l m o d e ls s a tis f y g th e a b o v e a x io m s , s h o w in g th a t th e y a re c o n s is te n t. F o r th e tim e b e in g , w e d id n o t rm a liz e a m o d e l in P V S , s in c e o u r m a in in te re s t c o n c e rn s p ro o f s u p p o rt fo r A C P -s ty le io m a tic re a s o n in g . W h e n u s in g P V S fo r a c u s to m iz e d p ro c e s s a lg e b ra , its c o n s is te n c y u s t o f c o u rs e b e s h o w n b y p ro v id in g a m o d e l. A s a s i m p l e a p p l i c a t i o n o f t h i s t h e o r y , w e p r e s e n t t h e o r y PArewex w h i c h i m p o r t s PArew. T h e t h e o r e m c a l l e d expand s h o w s t h e e q u i v a l e n c e o f a p a r a l l e l p r o c e s s a n d a s e q u e n tia l te rm , re p re s e n tin g a ll in te rle a v in g s . T h is th e o re m c a n b e p ro v e d a u to m a tic a l l y i n P V S a f t e r i n s t a l l i n g a u t o m a t i c r e w r i t e s o n a l l a x i o m s e x c e p t A1. PArewex : THEORY BEGIN Atoms : TYPE = {a,b,c,d} IMPORTING PArew[Atoms] expand : THEOREM (a+b) o a o (a o (c + d) + b o (a o (c + d) + c o (a o (a + b) + d o (a o (a + b) + END PArewex

(a+b) // b o (c + b o (c + b o (a + b o (a +

(c+d) = d) + (c o (a + b) + d o (a + b))) + d) + (c o (a + b) + d o (a + b))) + b)) + b))

In S e c tio n 4 , w e illu s tra te th is a p p ro a c h b y a m o re c o m p le x p ro c e s s a lg e b ra a n d a n o n tr iv ia l e x a m p le . H o w e v e r, th is f r a m e w o r k is n o t s u ita b le f o r p r o v in g th e o r e tic a l r e s u lts , b a s e d o n in d u c tiv e p r o o f s .

2 7 4

2 .3

T w a n B a s te n a n d J o z e f H o o m a n

D e fi n in g P r o c e s s -A lg e b r a T e r m s a s a n A b s tr a c t D a ta ty p e

P ro o fs a b o u t p ro p e rtie s o f p ro c e s s a lg e b ra o fte n S in c e P V S g e n e ra te s s u c h in d u c tio n s c h e m e s fo r to m o d e l p ro c e s s te rm s a s a n a b s tra c t d a ta ty p e . H th e te rm s o f P A a re re p re s e n te d a s a n a b s tra c t d a T h e d a ta ty p e b e lo w c o n ta in s fi v e s o -c a lle d c o n s a n d f o u r o p e r a t o r s o, +, //, a n d lmrg f o r , r e s p . , a n d le ft m e rg e . PA_terms [Atoms: TYPE] : DATATYPE BEGIN atm(at: Atoms) o(sq1, sq2: PA_terms) +(ch1, ch2: PA_terms) //(mrg1, mrg2: PA_terms) lmrg(lmrg1, lmrg2: PA_terms) END PA_terms

: : : : :

u s e in d u c tio n o n th e s tru c tu re o f a b s tra c t d a ta ty p e s , it s e e m s c o n v e n c e w e p re s e n t a n a p p ro a c h in t a t y p e w i t h t y p e Atoms a s a p a r a t r u c t o r s : atm t o t u r n a t o m s i n t o s e q u e n tia l c o m p o s itio n , c h o ic e ,

te rm s . e n ie n t w h ic h m e te r. te rm s , m e rg e

atom? seq? choice? merge? lmerge?

W h e n ty p e c h e c k in g th is d a ta ty p e d e fi n itio n , th e P V S s y s te m g e n e ra te s a n e w fi le w h ic h c o n ta in s a la rg e n u m b e r o f u s e f u l d e fi n itio n s a n d p r o p e r tie s o f th e d a ta ty p e . E .g ., a s u b t e r m r e l a t i o n x out_q_behavior.vhd: L_Respout_Retry for Collision detected dbg_info= 000 at time 2240 NS RCC # 0 ---> out_q_entry.vhd: freeing OUT_Q # 02 dbg_info= 000 at time 2260 NS PROBE # 0 ---> BLINK SID=2 fm 0000 to part 0010 R_tag=05 R_Done at time 2300 NS PROBE # 0 ---> L_Bus 620 burst rwitm 80 Tag 00 addr=0000000000 Pos_Ack Resp_Retry at time 2320 NS

Hardware Testing

327

At the last analysis phase, a PASS verdict is detected by the ANALYSOR (see below). This verdict states that the behavior of the IUT is conform to the specification w.r.t the test purpose. It means that the FLUSH operation terminates correctly, passing all the check-points despite the colliding RWITM transaction. ------------------ANALYSER phase... TC traversed part... (9,"PACKET_TRANSFER !M0 !M1 !RESP_PACKET_TYPE !NIL_DATA !NETRESP_DONE !OUTQI0, (PASS)",1) =>IUT(0),TC(9): ***** PASS ... ********** End of Test Case *************

The main difference with the batch testing is that all this steps are chained up automatically using the clock cycles and as many times as possible until the end of the test case. This allows the execution of tests in which more than one stimulus are necessary and the next stimulus depends on the reactions of the system observed after the previous stimulus, as the case with tests generated by tgv. By the way, this approach also increases the test coverage.

5

Results of the experiment and analysis

Through the different steps of this experiment described in the following, we indicate how we have resolved the different problems encountered, how much does it cost, what are its significant results, etc. Formal specification The first work was to obtain a formal specification of the Bull’s cc numa architecture as suitable as possible for describing hardware and for test generation using tgv. The justifications of the choice of lotos language are given in section 3.1. In fact, good abstractions were also done in order to avoid needless complicated aspects of system in the specification (see section 3.1). As this specification is considered as a reference by tgv, it was important to guarantee that it is error-free. This work was done by Bull and took about 8 man×months to have the first version. Modifications were done until the end of the experiment. Starting from the formal specification used for verification it took 1 man×month to adapt it for test generation purpose. By the way, notice that some bugs have been detected during this formal specification. Improvements of TGV The first version of tgv (before this experimentation) accepts only specifications in SDL or Aldebaran language. Because lotos language have been chosen for the specification, we were obliged to make tgv taking into account specifications described in this language. Different problems and corresponding solutions developed are explained in section 3. Other improvements of tgv dedicated to refine the generated test cases were needed and implemented during the experiment such as: – the introduction of refusal states in the test purposes which reduce the part of the specification traversed,

328

Hakim Kahlouche, C´esar Viho, and Massimo Zendri

– the generation of loops in the test cases (this was not the case before this experiment) leading to fewer Inconclusive verdicts; this allows the test of more functionalities. These works were done by Inria-Rennes and costs about 8 man×months. The main benefit is that this experiment is the first one showing the interest of the on-the-fly generation available in tgv. In fact, it was impossible to obtain the state graph of the Bull’s cc numa specification. So, the only way to obtain tests is to work on-the-fly. Abstract test cases generation We have formally specified all the test purposes described in the Test Groups 3 and 4 (see section 2.2) including those requiring an interactive behavior of the system. This work costs about 15 man×days. For each test purpose, we have generated the corresponding abstract test case using tgv. He who can do more can do less, we have also generated test cases for some basic operations. A total of 75 tests have been generated and cost 1 man×month. The main problem here concerns with the time cost of the test generation with tgv: from less than 1 second for some test to about 12 hours for others. This is due to the complexity of the Bull’s CC NUMA architecture specification which required us sometimes to refine the test purposes in order to speed up the test generation with tgv. Developing the tester package The main difficulty in executing the test cases was in the fact that the format of the test cases is different from the probe output format. It costs about 5 man×months to Inria-Rennes to develop the tester package which brings solution to this problem. Since the applications which constitute this tester package are generic and automatically produced using classical compiler generators, they can be reused to test other systems without major effort. Using the tester package All the test cases generated by tgv have been executed in the testing SIM1 environment using the tester package. For each test case and the corresponding probe output file, no sensible overhead is charged to the simulation time due to the presence of the tester package. An estimation of maximal time spent to execute all the 75 tests is less than 20 hours (1 day full time basis) corresponding to 1000 cycles per test, 0.6 second per cycle, 5 minutes for environment loading. Results and analysis The main benefit in using the tgv approach is that we only have to formally specify the system to test and the test purposes, then all the testing activity would be completely automated. The time spent in specifying the Bull’s CC NUMA architecture, formalizing test purposes and generating the test cases with tgv is completely paid by the better correctness and the confidence to put in the implementation. This approach permitted to detect 5 bugs concerning principally the address collision, and problems of test coverage (some situations were not tested): the update of the Presence Cache and Remote Cache directory sometimes are not done in the same order as described in the specification.

Hardware Testing

6

329

Conclusion

In this paper, we have presented an end-to-end industrial experiment which demonstrates that the prototype tgv which was developed for conformance testing of communication protocols can also be efficiently used to test hardware architectures. In fact and this is the main result of this experiment, the approach have permitted to improve the quality of the tests and the test coverage: we have detected bugs which were not detected manually by experts of hardware testing, using interactive approach. It brings also some significant improvements in both of the conformance test generation with tgv at Inria-Rennes and off-line testing in hardware at Bull: this approach will be used for another architecture under construction at Bull. Now, we are on the way to improve again our test coverage using more general test purposes and living tgv to decide the actions to do on the system to cover a particular situation.

References 1. IEEE (Institute of Electrical and Electronic Engineers). Standard VHDL Language Reference Manual. IEEE Standard 1076-1993, 1993. 2. IEEE (Institute of Electrical and Electronic Engineers). Standard Verilog HDL Language Reference Manual. IEEE Draft Standard 1364, October 1995. 3. M. Faci and L. Logrippo. Specifying Hardware in LOTOS. In D. Agnew, L. Claesen, and R. Camposano, editors, In the 11th International Conference on Computer Hardware Description Languages and their Applications, pages 305–312, Ottawa, Ontario, Canada, April 1993. 4. G. Chehaibar, H. Garavel, L. Mounier, N. Tawbi, and F. Zulian. Specification and Verification of the PowerScaleT M Bus Arbitration Protocol : An Industrial Experiment with LOTOS. In R. Gotzhein and J. Bredereke, editors, Proceedings of FORTE/PSTV’96, Kaiserslautern, Germany, October 1996. 5. J.-C. Fernandez, C. Jard, T. J´eron, and C. Viho. Using on-the-fly verification techniques for the generation of test suites. In A. Alur and T. Henzinger, editors, Conference on Computer-Aided Verification (CAV ’96), New Brunswick, New Jersey, USA, LNCS 1102. Springer, July 1996. 6. J.-C. Fernandez, C. Jard, T. J´eron, and C. Viho. An experiment in automatic generation of test suites for protocols with verification technology. Journal of Science of Computer Programming - Special Issue on Industrial Relevant Applications of Formal Analysis Techniques, 29, p. 123-146, 1997. 7. M. Bozga, J.-C. Fernandez, L. Ghirvu, C. Jard, T. J´eron, A. Kerbrat, L. Mounier, and P. Morel. Verification and test generation for the SSCOP protocol. Journal of Science of Computer Programming - Special Issue on The Application of Formal Methods in Industrial Critical Systems, To appear, 1999. 8. H. Garavel. OPEN/CÆSAR: An Open Software Architecture for Verification, Simulation, and Testing. In B. Steffen, editor, Proceedings of the First International Conference on Tools and Algorithms for the Construction and Analysis of Systems (TACAS’98), LNCS vol. 1384, p. 68-84, March 1998. 9. H. Kahlouche, C. Viho, and M. Zendri. An industrial experiment in automatic generation of executable test suites for a cache coherency protocol. In A. Petrenko, and N. Yevtushenko, editors, IFIP TC6 11th International Workshop on Testing of Communicating Systems. Chapman & Hall, p. 211-226, September 1998.

10.1007/b107031130022

A Light-Weight Framework for Hardware Verification Christoph Kern, Tarik Ono-Tesfaye and Mark R. Greenstreet Dept. of Computer Science, University of British Columbia Vancouver, BC V6T 1Z4, Canada {ckern,tesfaye,mrg}@cs.ubc.ca

Abstract. We present a deductive verification framework that combines deductive reasoning, general purpose decision procedures, and domainspecific reasoning. We address the integration of formal as well as informal domain-specific reasoning, which is encapsulated in the form of user-defined inference rules. To demonstrate our approach, we describe the verification of a SRT divider where a transistor-level implementation with timing is shown to be a refinement of its high-level specification.

1

Introduction

Most formal verification of hardware designs is based on state-space exploration or theorem proving. State space exploration provides an automatic approach for verifying properties of designs described by relatively small models. In principle, theorem proving techniques can be applied to much larger and more detailed design descriptions. However, the large demands for the time of expert users prevents the wide-scale application of theorem proving techniques. The strengths and weaknesses of state-space exploration and theorem proving are in many ways complementary. This has motivated several recent efforts to combine the two techniques [5]. One approach is to embed state-space exploration algorithms as decision procedures in a general purpose theorem prover [20]. In this approach, the design and specification are represented by formulas in the logic of the prover, and decision procedures are oracles, introducing new theorems into the system. Alternatively, some researchers have augmented state-space exploration tools with simple theorem proving capability [12,1,18]. Viewing the verification task as one of maximizing the probability of producing a correct design subject to schedule and budget constraints, we generalize the latter approach. Using domain-specific and possibly informal decision procedures and inference rules in a deductive framework, we can verify critical properties of real designs that would not be practical to verify by theorem proving and/or model checking alone. Section 2 elaborates this claim. Section 3 describes our implementation of this framework, and section 4 presents our verification of a self-timed divider using this tool. 

This work was supported in part by NSERC research grant OGP-0138501, a NSERC graduate fellowship and a UBC graduate fellowship.

W.R. Cleaveland (Ed.): TACAS/ETAPS’99, LNCS 1579, pp. 330–344, 1999. c Springer-Verlag Berlin Heidelberg 1999 

A Light-Weight Framework for Hardware Verification

1.1

331

Running Example: Asynchronous Divider Verification

Our divider verification establishes refinement between progressively more detailed descriptions of the design written in the Synchronized Transitions language [25]. The highest level model is an abstract specification of radix-2 SRT division on rational numbers; we prove functional correctness of the algorithm at this level. The most detailed model formalizes the transistor-level structure along with its timing properties. Each level of the hierarchy inherits the safety properties of the higher levels: by showing that the top-level model divides correctly, we establish that all of the lower level models divide correctly as well1 . Although there have been many published verifications of dividers, we believe that our work is distinguished by spanning the complete design hierarchy. 1.2

Synchronized Transitions

A Synchronized Transitions (abbr. ST) [25] program is an initial state predicate and a collection of transitions. A transition is a guarded command. For example, y → x, y := y, x >> is a transition that is enabled to swap x and y when x is greater than y. Transitions may be combined using the asynchronous combinator, , for example t1 t2  . . . tn . Program execution consists of repeatedly selecting a transition, testing its guard, and, if the guard is satisfied, performing the multi-assignment. The order in which transitions are selected is unspecified: this non-determinism models arbitrary delays in a speed-independent model. ST provides other combinators and other language features which are not presented in this paper. 1.3

Semantics

We employ a wp semantics (see [8]) for ST. If P is a program and Q is a predicate, then wp(P, Q) is the weakest condition that must hold such that Q is guaranteed to hold after any single action allowed by P is performed. Consider a transition : the guard, G, denotes a function from program states to the Booleans; the multi-assignment, M , denotes a function from states to states. A wp semantics of ST includes wp(, Q) = G ⇒ Q ◦ M n  wp(t1 t2  . . . tn , Q) = wp(ti , Q) i=1

We make extensive use of invariants. A predicate I is an invariant if I holding in some state ensures that I will hold in all possible subsequent states of the program. In particular, I is an invariant of P iff I ⇒ wp(P, I). A predicate Q is 1

A detailed description of the refinement proofs between an intermediate and the transistor-level models can be found in [15].

332

Christoph Kern, Tarik Ono-Tesfaye and Mark R. Greenstreet

a safety property of P if Q holds in all states reachable in any execution of P . As shown in [13], Q is a safety property of P if and only if there is an invariant I such that Q0 ⇒ I and I ⇒ Q. Intuitively, program P  is a refinement of P if every reachable state transition that P  can make corresponds to a move of P . More formally, refinement is defined with respect to an abstraction mapping A that maps the states of P  to P [2]. P  is a refinement of P under abstraction mapping A iff for every reachable state s1 of P  and every state s2 that is reachable by performing a single transition of P  from s1 , either A(s1 ) = A(s2 ) (a stuttering action), or there is a transiton of P that effects a move from A(s1 ) to A(s2 ).

2

Verification Approach

Like many theorem provers, our verification tool presents a deductive style of verification. However, there are three ways in which our approach differs from traditional theorem proving: Integration of informal reasoning. Domain-specific decision procedures and inference rules can be used in our framework. Such procedures provide an algorithmic encapsulation of formal or informal domain expertise; this allows domain expertise to be introduced as a hypothesis of a proof. Syntactic embedding of the HDL. Our framework favours an embedding of the hardware description language (HDL) at a syntactic level. Inference rules operate directly on the HDL’s abstract syntax. Merging of inference rules and decision procedures. In traditional theorem provers, inference rules provide pattern-based rewriting of proof obligations, while decision procedures (if any) decide the validity of leaf obligations in a proof tree. In our framework, inference rules may perform non-trivial computations to decide the soundness of a proof step, or to derive the result of an inference step. 2.1

Informal reasoning in formal verification

At first, the suggestion of allowing informal reasoning to be introduced into a formal proof appears to be outrageous: if an informal inference rule is unsound, it can invalidate any proof in which the rule is used. However, informal rules provide a practical way to tailor our verification tool to specific domains and verify properties that would not be practical to address by strictly formal approaches. When errors are found in a design, the verification effort is worthwhile even if some steps are justified only informally. Informal reasoning is commonplace in many verification efforts. For example, model-checking is typically applied to an abstraction of the design that was produced informally by a verification expert [11,19]. Although the absence of errors in the abstraction does not guarantee the correctness of the actual design, errors found in the abstraction can reveal errors in the actual design. Many

A Light-Weight Framework for Hardware Verification

333

theorem-prover based verifications model functional units at the register transfer level; the gate- and transistor-levels of the design are validated only through simulation and informal reviews [24]. We make two uses of informal rules. First, an informal rule can provide an algorithmic encoding of domain knowledge where a formalization in logic would be unacceptably time-consuming. For example, the timing analysis procedure that we used derives a graph whose nodes correspond to the channel connected regions of the transistor-level circuit. The circuit topology is syntactically encoded in the text of the ST program, and the procedure derives timing bounds through graph traversal. The correspondence between the graph and the original circuit and the soundness of the graph traversal have only been shown informally. Second, we use several ‘semi-formal’ rules for reasoning about ST programs. For instance, the proof rules for reasoning about invariants, safety properties, and refinements are founded on theorems that were formally proven (although the proofs have not been mechanically checked). These theorems are based on a formal semantics of a core language only, and their extension to the full language with records, arrays, functions, and modules is informal. In our framework, informal inference rules and decision procedures can be seen as a generalization of the concept of using a hypothesis in a proof: Usually, a hypothesis is simply a formula that is assumed to be valid. An informal rule in contrast is an algorithm of which it is assumed that it permits only sound inferences (e.g. by generating a valid formula and introducing it as an assumption). 2.2

Syntactic embedding of the HDL

Formal verification requires a description of the design as a formula in the appropriate logic. If it is not practical to describe the design directly in logic [9], e.g. because of lack of tool support for simulation, synthesis etc, an embedding of the HDL in the logic has to be devised. Such embeddings are commonly divided into two classes [6]: In a deep embedding, both the (abstract) syntax of the HDL as well as its semantic interpretation are defined within the logic in terms of an abstract data type and a semantic function, respectively. This provides a very rigorous embedding and allows meta-reasoning about the HDL semantics. However, the effort for producing such an embedding can be substantial, although it may be possible to amortize this effort over many designs. In a shallow embedding in contrast, the semantic interpretation of the HDL occurs outside the logic. Shallow embeddings can be easier to implement than deep embeddings because the translation process is informal with a corresponding loss of rigour. Because program structures are not represented in the logic, theorems that refer to the syntactic structure of the HDL description can be neither stated nor proven [6]. We propose a third variant, a syntactic embedding: The syntax of the HDL becomes part of the syntax of the logic (see section 3.3 for the embedding of ST). As in a shallow embedding, the semantic interpretation is informal. However, the procedures that perform this interpretation are encapsulated as domain-specific inference rules. This provides a tighter integration with the prover than could

334

Christoph Kern, Tarik Ono-Tesfaye and Mark R. Greenstreet

be achieved with a shallow embedding. However, as with shallow embeddings, no meta-reasoning about the semantics of the specification language is possible. We have found that a syntactic embedding simplifies the implementation of semi-formal or informal inference rules. Such rules are often based on syntactic analysis of the underlying program. These rules are easier to implement, and hopefully less prone to implementation errors, because the abstract syntax of the program is immediately available in the syntactic embedding. 2.3

Merging of Decision Procedures and Inference Rules

Traditional mechanized theorem provers generally use only decision procedures in the classic sense of an algorithm that decides the validity of a formula. Such decision procedures are used to discharge proof obligations in a single automatic step, i.e. they operate on the leaves of a proof tree. Proof steps interior to the proof tree, however, are generally justified by matching them with an inference rule schema, and possibly checking side conditions or provisos. We remove the restriction of decision procedures to leaf obligations and allow inference rules to use arbitrary algorithms to decide the soundness of a proof step. Theoretically, lifting this restriction has no significance; such an “inference procedure” can be replaced by the corresponding leaf decision procedures, and inferences using propositional logic. However, there are significant practical advantages to our approach. In many cases, it is convenient to let the inference rule compute the derived obligations rather than requiring the user to provide them. Of course, one could perform two computations of the derived obligation: one outside of the trusted core to derive the result for the user, and the other in the core to verify the result. Such an approach has obvious disadvantages with respect to efficiency and software maintenance. These problems would be particularly severe in a framework such as ours where ease of adding and extending domain-specific inference rules and decision procedures is important. Our “inference procedures” provide a simple mechanism for avoiding these problems.

3

Prototype Implementation

We have implemented a proof-of-concept verification environment for our approach. It has three architectural components. A generic core provides proof state and theorem objects, as well as a tactic interface. The second component is a library of common decision procedures, while the third comprises the code that is specific to a particular object logic. The system has been implemented in Standard ML of New Jersey [4], which also forms the user-interface for the proof checker. 3.1

Generic Core

Similar to theorem proving environments such as HOL, PVS or Isabelle [10,16,17], a (backwards-style) proof in our proof checker is represented by a sequence of

A Light-Weight Framework for Hardware Verification

335

proof states. A proof state consists of the claim, the pending obligations, and some bookkeeping information. The claim and obligations are judgments which can be, for instance, a sequent (in a sequent calculus), or a formula (in a natural deduction style calculus). In the initial proof state of a proof, the list of pending obligations consists only of the claim. Rules of inference are implemented as functions from proof state to proof state, and are used to transform one or more pending obligations into zero or more (simpler) obligations. The available proof rules are registered with the claim state and cannot be modified afterwards; in a sense, they become hypotheses of the theorem. This permits user-defined domain-specific proof rules to be introduced without modification of the core. A proof state with no pending obligations corresponds to a proven claim, i.e. a theorem. To allow for theorems to be used in later proofs without having to check, and therefore execute, their proof before each use, we provide theorem objects, which associate a claim with a proof, i.e. a function that takes the claim proof state and returns a proof state with no pending obligations. Theorems can only be used in a proof if they were imported into the initial proof state. We provide facilities that analyze the dependency between theorems, ensure the absence of circularity, check all proofs that a theorem depends on, and generate reports. All of the above components are parameterized in the syntax of the logic and a well-formedness predicate for proof obligations. The parameterization is realized through SML functors. To facilitate the interactive development of proofs, we provide a simple goal package, which maintains a current proof-state to which rules can be applied, and allows proof steps to be undone. As indicated above, a proof in our system is a SML function from proof states to proof states. We provide a library of higher-order functions on proof rules (analogous to tacticals in e.g. HOL or Isabelle) which facilitate the construction of proofs from basic proof rules (which correspond to HOL tactics). 3.2

Library of Common Decision Procedures

This library comprises core routines of several commonly used decision procedures. The library is independent of a particular object logic; instantiating a decision procedure for a logic requires writing a small amount of interface code. To support Boolean tautology checking as well as symbolic model checking, the library provides an abstract data type for boolean expressions in a canonical representation. The underlying implementation of this data type is a state-of-the art BDD package [23] that was integrated into the SML/NJ runtime system. The interface provides full access to the control aspects of the BDD package, such as variable reordering strategies, cache sizes etc. Based on the BDD package, we have implemented a package for symbolic manipulation of bit-vectors and arithmetic operation thereon. Components for arithmetic decision procedures include a package for arbitrary precision integer and rational arithmetic, polynomials, and a decision procedure for linear arithmetic.

336

Christoph Kern, Tarik Ono-Tesfaye and Mark R. Greenstreet

Based on these procedures, we have implemented a decision procedure that discharges arbitrary tautologies composed of linear inequalities with boolean connectives. We have not implemented a decision procedure for combinations of theories (e.g. [14,22]) as our simple procedures were sufficient for the divider proof. All decision procedures include counter-example facilities for non-valid formulas.

3.3

Object Logic for Synchronized Transitions

We have instantiated the generic core with a logic suitable for reasoning about ST programs. The proof system is a sequent calculus for explicitly typed first-order logic that is extended with all types, constants and operators of ST, including transition-valued expressions. Assertions on ST programs, such as invariants, safety properties and refinement, are formulated in terms of predicates on transition-valued expressions. We provide proof rules, such as the wp-based rule for invariants, that allow such obligations to be reduced to obligations that are purely within quantifier-free logic with boolean connectives, arithmetic, If-expressions, and arrays and records under store and select. As an example, consider a proof state that includes the pending obligation: HasInvariant(>, 0 ≤ i ≤ N ) This obligation states that the two transitions maintain the given invariant. An application of the proof rule for HasInvariant rewrites this obligation as (0 ≤ i ≤ N ) ⇒ wp(>, 0 ≤ i ≤ N ) An application of the proof rule for wp, which implements the semantics given in section 1.3, yields: (0 ≤ i ≤ N ) ⇒ ( ((i > 0) ⇒ (0 ≤ i − 1 ≤ N )) ∧ ((i < N ) ⇒ (0 ≤ i + 1 ≤ N ))) This last obligation can be discharged using the decision procedure for linear inequalities with boolean connectives. Further proof rules include the usual rules for sequent manipulations, rewrites, simplification and lifting of If-expressions, quantifier manipulations, and arithmetic simplifications. Together with decision procedures for propositional calculus and linear arithmetic, these are frequently sufficient to discharge obligations arising from assertions about ST programs. More specialized proof rules will be explained briefly in the context of the divider verification presented in the remainder of the paper.

A Light-Weight Framework for Hardware Verification

4

337

Example: Proving a Self-Timed Divider Correct

We evaluated the proof checker by verifying Williams’ self-timed divider [27], which implements the radix-2 SRT algorithm [7]. We reconstructed the design from the descriptions in [27] and [28]. A variation of this design is incorporated in the HAL SPARC CPU. 4.1

Description of the Divider

As shown in figure 1, the divider consists of three identical stages, each of which performs p b ( 0 ) p b ( 1 ) p b ( 2 ) the computation of a single iterative step of s s s the SRT division algorithm, and which pass int t t q ( 0 ) q ( 1 ) a a a q ( 2 ) g g g termediate results around in a circular fashion. e e e r ( 2 ) Each stage computes a new partial remainder 0 1 2 r ( 0 ) r ( 1 ) (in carry-save representation) and quotient digit, based on the result of the previous iteration Fig. 1. Divider Architecture which it receives from the preceding stage. The design is self-timed [21], with signals encoded as dual-rail values [26], and implemented in precharged logic [28]. The precharge control block sequences the iterative computation. This block reads the stage completion signals and regulates the operation of the stages through the precharge control signals. In each iteration, three steps of the SRT algorithm are computed. Governed by the precharge control signals, each stage is in one of three states: precharge, evaluate, or hold. The “precharge bar” signal for stage i is pb(i). When pb(i) is low, stage i is precharging. Precharging leads to a state where every dual-rail signal produced by the stage has the “empty” value. Evaluation leads to a state where every signal has a “valid” value. A stage in the holding state leaves its outputs unchanged so that its successor can use them to compute the next partial remainder and quotient digit. A simple invariant that captures this sequencing is central in many of our proofs. Williams employed two optimizations to improve the performance of the divider. First, he assumed that a stage can precharge faster than its predecessor can evaluate. Second, he assumed that the quotient digit of a stage will be the last output to change during the evaluation phase. The first optimization allows stage i+1 to precharge in parallel with the evaluation phase of stage i. If no timing assumptions were made, these operations would have to be performed sequentially. The second optimization allows the computation of stage i+1 to start as soon as the quotient digit from stage i is output, without any extra hardware to check the completion status of the partial remainder. Due to these optimizations, verifying the functionality of the divider includes proof obligations that require timing analysis. This timing analysis establishes relative orderings of events in the operation of the divider and shows that the assumptions on which the optimizations are based are indeed correct. p re c h a rg e c o n tro l

338

4.2

Christoph Kern, Tarik Ono-Tesfaye and Mark R. Greenstreet

A Refinement Hierarchy for the Divider

The transistor-level model of the divider is too large to permit model checking, and too complicated to verify from first princire fin e m e n t ples using a theorem prover. Therefore it is desirable to prove safety properties on S y n c h ro n o u s W o rd L e v e l M o d e l a more abstract, higher-level model and (in te g e r) show that these properties hold in the more re fin e m e n t detailed models. We used a hierarchy of models as depicted in figure 2 to verify S y n c h ro n o u s W o rd L e v e l M o d e l the divider. Arrows indicate verification (b it-v e c to r) obligations: vertical arrows correspond to re fin e m e n t refinement proofs, horizontal arrows inS p e e d -In d e p e n d e n t dicate other properties that either estabsp e e d in d e p e n d e n c e W o rd L e v e l M o d e l lish correctness or assist in the refinement proofs. re fin e m e n t The first two refinement steps are data p r e c h a r g e T im e d fa s te r th a n refinements. Our top-level model has a sinW o rd L e v e l M o d e l e v a lu a te gle stage which computes a quotient digit re fin e m e n t and the next partial remainder in each su m T im e d T ra n s is to r step. The divisor, dividend, and remainfa s te r th a n L e v e l M o d e l q u o tie n t der have rational values. In the first refinement step, we replace the rational values Fig. 2. Verification Hierarchy with integer values, and the next refinement step replaces these integers with bit-vectors. The next two models elaborate upon the self-timed handshaking protocols used in the design. The speed-independent model has three divider stages and implements a handshaking protocol that does not depend on the timing delays of the components. In the timed, word-level model, bounds are given on the ratio of precharge time to evaluation time. The lowest-level model corresponds directly to our transistor-level implementation of the divider chip. Variables in this model are represented using dual-rail code. In the higher level models, the remainder word was computed as a single, atomic action. Here, each signal is set independently. In this transistor-level model, a stage’s completion status is determined solely by the quotient digit output. S y n c h ro n o u s W o rd L e v e l M o d e l (ra tio n a l)

4.3

d iv id e s c o rre c tly

Functional Correctness

Figure 3 depicts the ST code of our top-level, synchronous divider model. In radix-2 SRT division, each quotient digit can have the value -1, 0 or 1 (see [7]). If the current remainder Ri is greater or equal to 0, 1 is a valid quotient digit choice. If the remainder is negative, -1 is a valid choice for the next quotient digit. If 2|Ri | ≤ divisor, the quotient digit can also be 0. In our synchronous model of the divider this overlapping choice for the digit is represented by three

A Light-Weight Framework for Hardware Verification currRem : currRemF BEGIN! ONE| q = −1 ? q=0 ? q=1 ? END;

339

(* q: -1..1; R, D: RATIONAL *) = 2 ∗ R + D, 2 ∗ R, " 2∗R−D

SRTDivide : SRTDivideC (* q: -1..1; BEGIN  0 ≤ currRem(R, q, D)   −D ≤ 2 ∗ currRem(R, q, D) ≤ D   currRem(R, q, D) ≤ 0 END;

R, D: RATIONAL *) = → R, q := currRem(R, q, D), 1  → R, q := currRem(R, q, D), 0  → R, q := currRem(R, q, D), −1 

Fig. 3. Synchronous Word Level Model

transitions combined with the asynchronous combinator (see fig. 3). For example, if the current remainder is equal to −0.2 ∗ D, then either the first or the second transition may be chosen for the next step. By using non-determinism, we avoid cluttering this description with implementation details, and at the same time modularize and simplify the proofs. Deterministic quotient digit selection is introduced in the synchronous, bit-vector model. The following two properties are invariants of the synchronous divider model: (i) |Ri | ≤ D  −j q 2 = Ri 21−i , (ii) 2C − D i−1 j=0 j where Ri is the remainder determined in iteration i. From these two invariants and the initial condition that the divisor D and dividend C are normalized to satisfy 12 ≤ D < 1 and 0 < C < D, we proved that the computed quotient i−1 −j asymptotically approaches the true quotient C/D. j=0 qj 2 4.4

Refinement Proofs

This section gives short overviews of the refinement proofs and mentions key problems within each proof. It is this chain of refinement proofs which establishes that the functional correctness proven on the abstract, synchronous model also applies to the transistor-level model. The divider models will be referred to as rational divider, integer divider, bit-vector divider, speed-independent divider, timed divider and transistor-level divider. In our approach, refinement is a safety-property. To establish refinement, we must first show that initial states of the lower-level model correspond to legal, initial states of the higher-level model. Then, we must show that for each transition that can be performed by the lower-level model, there is a corresponding transition of the higher-level model, or that it is a stuttering move [2] of the

340

Christoph Kern, Tarik Ono-Tesfaye and Mark R. Greenstreet

higher-level model. These proof obligations are derived automatically by one of the proof rules that encodes the semantics of our logic for ST. Because refinement is a safety property, we can assume that if the state of the lower-level model before a transition is performed maps to a state of the higher-level model, it satisfies any safety properties that have been established for higher-level model. This allows us to use safety properties of the higher-level model in the proof of refinement. This is very helpful for our proofs: For example, arithmetic properties that are established for the top-level models can be used when verifying the other models. Likewise, invariants that are established on intermediate level models can be used when verifying lower-level models. Because of this, the verification of refinement is often simply a matter of tautology checking. Refinement between the Rational Divider and the Integer Divider. To convert the integer values in the integer divider to the rational valued variables in the rational divider one has to simply apply a division by 2N −1 . To prove that the integer-valued divider is a refinement of the rational-valued one, it needs to be shown that overflows do not happen. However, this is implied by the safety property |Ri | ∗ 2N1−1 ≤ D ∗ 2N1−1 which the integer divider model inherits from the rational divider. Refinement between the Integer Divider and the Bit-Vector Divider. In the bit-vector divider, carry-save representation is used for the remainder value. The abstraction mapping adds the carry and sum words to determine the remainder value at the integer level. Furthermore, the next quotient digit is computed deterministically in the bit-vector model based on the top four bits of the carry-save adder without resolving the carry of the bottom bits. Thus only the top four bits need to be resolved in a carry-propagate adder. Figure 4 shows the transitions of the quotient selection logic. Depending on the top four bits of cpaSum, the output of the four-bit carry-propagate adder, the next quotient is either 1, 0 or -1. For the refinement proof it needs to be shown that for each quotient digit choice of the bit-vector model, an equivalent choice can be made by the higher-level model.

QSL : QSLC = BEGIN  ¬cpaSum(2) ∧ ¬ (cpaSum(3) ∧ cpaSum(1) ∧ cpaSum(0)) → qi := 1   cpaSum(2) ∧ cpaSum(1) ∧ cpaSum(0) → qi := 0   (cpaSum(2) ∧ ¬(cpaSum(1) ∧ cpaSum(0))) ∨ (cpaSum(3) ∧ ¬cpaSum(2) ∧ cpaSum(1) ∧ cpaSum(0)) → qi := −1  END;

Fig. 4. Quotient Selection Logic in Bit-Vector Word Level Model

A Light-Weight Framework for Hardware Verification

341

Several safety properties of the higher-level models are used to bound the values of the divider and partial remainder at each iteration. Combined with properties of the abstraction mapping, refinement is straightforward to show. The proof obligations were discharged by the combination of a proof rule that reduces arithmetic operations on bit-vectors to BDDs, and the BDD-based tautology checker. Refinement between the Bit-Vector Divider and Speed-Independent Divider. The speed-independent model consists of three divider stages and all control is performed by explicit handshaking without any timing assumptions. For the abstraction mapping it is necessary to determine which stage’s output to map to the output of the synchronous model’s only stage. Intuitively, the precharge control ensures that at any time, there is a stage whose output value is the last partial remainder computed, and this stage can be identified by the state of the precharge control. We verified a hand-written invariant to show that the control logic operates as intended. We then defined an abstraction function that selected the appropriate output value for the partial remainder based on the state of the precharge control. Using this abstraction function, the refinement property was easily proven. Refinement between the Speed-Independent Divider and the Timed Divider. In the speed-independent model, the precharge control block performs an explicit check to ensure that stage i+1 is done precharging (i.e. its outputs are empty) before stage i starts evaluating. The timed model starts both operations in parallel, and timing bounds are used to ensure that precharging completes before evaluation. This corresponds to Williams’ first optimization in the design of the chip, as discussed in section 4.1. We use the approach of [3] to model time: a real-valued variable is added to the program to model the current time, transition guards are strengthened to express lower bounds on delays, and an action for advancing time is defined so as to observe upper bounds on delays (i.e. time may not progress beyond the maximum delay for a pending action). In this model, the clause of the guard for the evaluate action that asserted that the successor stage is done precharging is replaced by a clause that states that the successor stage started precharging sufficiently far in the past. We then verified an invariant that implies that whenever this timing condition is satisfied, the successor stage has finished precharging. With this invariant, refinement was easily verified (see [15] for details). Refinement between the Timed Divider and Transistor-Level Divider. To establish that the transistor-level model implements the timed divider, two major problems have to be addressed. First, the dual-rail encoded signals of the transistor-level model must be mapped to the bit-vectors of the timed divider. Second, in the transistor-level model only the quotient digit output is used to determine if a stage has finished evaluation. It therefore needs to be shown that

342

Christoph Kern, Tarik Ono-Tesfaye and Mark R. Greenstreet

the quotient digit of a stage becomes valid only after all other outputs of a stage are valid. This corresponds to Williams’ second optimization as mentioned in section 4.1. The first problem was addressed by defining an appropriate abstraction mapping. Solving the second problem requires an argument about the timing of events as data values propagate from a stage’s inputs through its logic elements after it enters evaluation mode. Our verification adapted a simple depth-first graph traversal algorithm for timing verification of combinational logic for use in the self-timed context. The timing analysis is encapsulated as an inference rule that introduces a theorem, which in turn states a transistor level safety property expressing timing bounds for a stage’s outputs. The timing analysis requires several side conditions to hold (expressed as assumptions of the above theorem), stating e.g. that the inputs to a stage (i.e. its predecessor’s outputs) remain stable while it is in evaluation mode. Intuitively, the computation in the divider ring proceeds as follows: A stage’s dual-rail signals are reset to “empty” during precharging. In evaluation mode, the signals are assigned “valid” values based on the output signals of the previous stage. The previous stage, which is in hold mode, keeps its outputs unchanged while this stage is evaluating. The side conditions are satisfied as long as the divider conforms to this sequence. To discharge the above side-conditions, one needs to formally show that the divider’s operation indeed follows the intuition. To this end, we introduced a side hierarchy of models that matched the handshaking of the original hierarchy with the details of the computation abstracted away. Corresponding safety properties were proven for the highest, speed-independent level of the side hierarchy, which were then inherited down (through refinement) to the transistor level and used to discharge the side conditions of the timing analysis. The introduction of the side hierarchy allowed us to discharge all proof obligations without ever having to prove an invariant or safety property directly at the transistor level. Due to the timed nature and the amount of detail present at this level, this would have been extremely difficult and time-consuming. See [15] for details on the timing analysis and the use of the side hierarchy.

5

Conclusions

We have demonstrated an approach to the verification of hardware designs that combines deductive reasoning with algorithmic decision procedures. Like theorem provers such as HOL, Isabelle or PVS, our tool employs the notion of proof states, to which a sequence of inference rules and decision procedures is applied to form a proof. The most important distinction between our tool and more traditional provers is that the set of available inference rules and decision procedures is not fixed, but may be extended with domain-specific rules. This permits reasoning that would be unacceptably costly to formalize rigorously in logic to be introduced into a correctness argument in a controlled manner. We have demonstrated the practical applicability of our approach by carrying out a top-to-bottom verification of a non-trivial hardware design, a self-timed

A Light-Weight Framework for Hardware Verification

343

implementation of SRT division. Our verification connects a high-level specification of the SRT division algorithm with a formalization of the transistor-level implementation through a series of refinement proofs. Safety-properties proven at the highest level, in particular correct division, are propagated down the chain of refinements and thus hold for the implementation. The proof obligations arising from the safety property and refinement proofs varied widely in nature, from arithmetic obligations at the algorithmic level to timing properties at the transistor level. Although there have been many published verifications of dividers, we believe that our work is distinguished by spanning the complete design hierarchy. Domain-specific proof rules such as the timing-verification procedure played a crucial role in achieving this. Acknowledgments We would like to thank Alan Hu for many helpful discussions on the divider verification. Our thanks to Ted Williams who explained many details of his design to one of the authors several years ago. Thanks to Andrew Appel and Lorenz Huelsbergen for answering our questions on integrating the CUDD package into SML. Finally, we would like to thank Michael Gordon for his comments on an earlier version of this paper.

References 1. Mark Aagaard and Carl-Johan H. Seger. The formal verification of a pipelined double-precision IEEE floating-point multiplier. In Int. Conf. on Computer-Aided Design, ICCAD ’95, pages 7–10, November 1995. 2. Mart´ın Abadi and Leslie Lamport. The existence of refinement mappings. Theor. Comput. Sci., 82(2):253–284, May 1991. 3. Mart´ın Abadi and Leslie Lamport. An old-fashioned recipe for real time. In J.W. de Bakker et al., editors, Proceedings of the REX Workshop, “Real-Time: Theory in Practice”. Springer, 1992. LNCS 600. 4. Andrew W. Appel and David B. MacQueen. Standard ML of New Jersey. In 3rd Int. Symp. on Prog. Lang. Implement. and Logic Program., number 528 in Lect. Notes Comput. Sci., pages 1–13. Springer-Verlag, August 1991. 5. N. Bjørner, A. Browne, E. Chang, M. Col´ on, A. Kapur, Z. Manna, H.B. Sipma, and T.E. Uribe. STeP: Deductive-algorithmic verification of reactive and real-time systems. In 8th Int. Conf. Computer-Aided Verification, CAV ’96, number 1102 in Lect. Notes Comput. Sci., pages 415–418. Springer-Verlag, August 1996. 6. Richard Boulton, Andrew Gordon, Mike Gordon, John Harrison, John Herbert, and John Van Tassel. Experience with embedding hardware description languages in HOL. In 1st Int. Conf. on Theorem Provers in Circuit Design, TPCD ’92, pages 129–156. North Holland, 1992. 7. Joseph J.F. Cavanagh. Digital computer arithmetic : design and implementation. McGraw-Hill, New York, 1984. 8. E.W. Dijkstra. A Discipline of Programming. Prentice-Hall, 1976. 9. Michael Gordon. Why higher-order logic is a good formalism for specifying and verifying hardware. In G. J. Milne and P. A. Subrahmanyam, editors, Formal Aspects of VLSI Design, pages 153–177. Elsevier Science Publishers, 1985.

344

Christoph Kern, Tarik Ono-Tesfaye and Mark R. Greenstreet

10. Michael J.C. Gordon. HOL: a proof generating system for higher-order logic. In Graham Birtwistle and P.A. Subrahmanyam, editors, VLSI Specification, Verification and Synthesis, pages 74–128. Kluwer Academic Publishers, 1988. 11. Cheryl Harkness and Elizabeth Wolf. Verifying the Summit bus converter protocols with symbolic model checking. Formal Meth. System Design, 4:83–97, 1994. 12. Scott Hazelhurst and Carl-Johan H. Seger. A simple theorem prover based on symbolic trajectory evaluation and BDDs. IEEE Trans. Comput. Aided Des. Integr. Circuits, 14(4):413–422, April 1995. 13. Leslie Lamport. win and sin: Predicate transformers for concurrency. ACM Trans. Program. Lang. Syst., 12(3):396–428, July 1990. 14. Greg Nelson and Derek C. Oppen. Simplification by cooperating decision procedures. ACM Trans. Program. Lang. Syst., 1(2):245–257, October 1979. 15. Tarik Ono-Tesfaye, Christoph Kern, and Mark R. Greenstreet. Verifying a selftimed divider. In Proc. International Symposium on Advanced Research in Asynchronous Circuits and Systems. IEEE Computer Society Press, April 1998. 16. S. Owre, J. M. Rushby, and N. Shankar. PVS: A prototype verification system. In 11th Int. Conf. Automated Deduction (CADE ’92), number 607 in Lect. Notes Comput. Sci., pages 748–752. Springer-Verlag, 1992. 17. Lawrence C. Paulson. Isabelle: A Generic Theorem Prover. Number 828 in Lect. Notes Comput. Sci. Springer-Verlag, Berlin, 1994. 18. Amir Pnueli and Elad Shahar. A platform for combining deductive with algorithmic verificication. In 8th Int. Conf. Computer-Aided Verification, CAV ’96, number 1102 in Lect. Notes Comput. Sci., pages 184–195. Springer-Verlag, August 1996. 19. F. Pong, A. Nowatzyk, G. Aybay, and M. Dubois. Verifying distributed directorybased cache coherence protocols: S3.mp, a case study. In Proc. EURO-Par ’95 Parallel Processing, number 966 in Lect. Notes Comput. Sci., pages 287–300. SpringerVerlag, August 1995. 20. S. Rajan, N. Shankar, and M.K. Srivas. An integration of model-checking with automated proof checking. In 7th Int. Conf. Computer-Aided Verification, CAV ’95, number 939 in Lect. Notes Comput. Sci., pages 84–97. Springer-Verlag, July 1995. 21. Charles L. Seitz. System timing. In Carver Mead and Lynn Conway, editors, Introduction to VLSI Systems, pages 218–262. Addison-Wesley, 1980. 22. Robert E. Shostak. Deciding combinations of theories. J. ACM, 31(1):1–12, January 1984. 23. Fabio Somenzi. CUDD: CU Decision Diagram Package. URL: http://bessie.colorado.edu/~fabio/CUDD/cuddIntro.html. 24. Mandayam K. Srivas and Steven P. Miller. Applying formal verification to the AAMP5 microprocessor: A case study in the industrial use of formal methods. Formal Meth. System Design, 8(2):153–188, March 1996. 25. Jørgen Staunstrup. A formal approach to hardware design. Kluwer Academic Publishers, Boston, 1994. 26. Tom Verhoeff. Delay-insensitive codes – an overview. Distributed Computing, 3:1– 8, 1988. 27. T. E. Williams, M. A. Horowitz, R. L. Alverson, and T. S . Yang. A self-timed chip for division. In Stanford Conference on Advanced Research in VLSI, pages 75–96, March 1987. 28. Ted E. Williams. Self-timed rings and their application to division. Technical Report CSL-TR-91-482, Computer Systems Lab, Dept. of EE, Stanford, May 1991.

10.1007/b107031130023

An Easily Extensible Toolset for Tabular Mathematical Expressions David Lorge Parnas1 and Dennis K. Peters1,2 1 Electrical and Computer Engineering Faculty of Engineering and Applied Science Memorial University of Newfoundland St. John’s, Newfoundland Canada A1B 3X5 [email protected] 2 Department of Computing and Software Faculty of Engineering McMaster University Hamilton Ontario Canada L8S 4K1

Abstract. We describe the design of an open ended set of tools for manipulating multi-dimensional tabular expressions. The heart of the toolset is a set of modules that makes it possible to add new tools to the toolset without having detailed knowledge of the other tools. This set of modules, the Tool Integration Framework, supports new and existing tools by providing abstract communication interfaces. The framework that we describe has proven to be a practical approach to building an extensible set of tools.

1

Introduction

The McMaster University Software Engineering Research Group (SERG) studies documentation methods for computer systems engineering that use mathematical functions and relations [18] to describe program behaviour. The mathematical expressions that describe the behaviour of real systems are often so complex that they are difficult to write and use. When expressions are written in a tabular form, they are much more easily formulated and interpreted [16]. While the value of tabular notation has often been demonstrated [4, 5, 3, 6, 11], we believe that well designed tools can reduce both the effort needed to write tabular expressions and the number of errors in the documentation. To demonstrate this, our research group is developing a suite of tools, collectively known as the Table Tool System (TTS), for creating, editing, printing, analysing and interpreting tabular documentation. This paper presents an overview of the design of the TTS. It is intended both to draw attention to the TTS and to provide an example of a system in which modularisation, abstraction, and other related design principles are applied consistently. W.R. Cleaveland (Ed.): TACAS/ETAPS’99, LNCS 1579, pp. 345–359, 1999. c Springer-Verlag Berlin Heidelberg 1999 

346

David Lorge Parnas and Dennis K. Peters

New components of the TTS are usually produced as Masters Theses by students who come, learn about software engineering, and then leave. It is normally extremely difficult to get such independently written components to work together in a useful way. The Tool Integration Framework that is described in this paper has changed that. Components can be developed independently, then easily integrated into our system by people who do not know the details of either the old or the new components. 1.1

Background

Much traditional engineering documentation is mathematically based and precise, rich in information content and consistently interpreted from user to user. Parnas and Madey [18] have shown how the essential properties of computer systems can be described by using mathematical relations. These relations can be characterised by first-order predicate logic (e.g., [17]]. By providing these relations, computer systems designers can document their designs systematically, and use that documentation to conduct thorough reviews and analysis. The expressions that characterise the relations that result from applying functional documentation techniques to real programs are usually complex because they must distinguish many cases. When represented in their customary form (i.e. as a one dimensional expression) they would be too difficult to read to be practical. In [16], Parnas defined a new notation, called tabular expressions, that grew from earlier work at the Naval Research Laboratory in Washington, DC [4]. Tabular expressions in this new form have the same theoretical expressive power as conventional notation but, by organising the expression as an array of much simpler expressions, they are much easier for human readers to interpret. The reader is referred to [16, 7, 6] for descriptions of table types and interpretations. The importance of readability in engineering documentation is clear when the role of documentation in the design process is considered. Documentation should capture the measurable objectives of the design effort. The actual results of the design effort can be compared with the objectives expressed in the documentation at several points during the design process. For example, documentation will be used as the basis for design reviews [13] and as the basis for testing procedures. The examples in Fig. 1 show three different formats for an expression representing the function f (x, y). The benefits of representing expressions in tabular form are shown even more clearly by longer, more realistic, expressions such as those in [1, 23]. Without support tools, a great deal of time is spent performing tasks that could be automated. Mathematical expressions can be checked mechanically and used for automated verification of the design specified by the documents. For example, manually comparing two tables to see if they represent the same function is a very important task that can be very time consuming and tedious; small errors can be difficult to detect. We need tools to help automate those jobs that can be automated, so that our time and energy can be devoted to the more interesting tasks of system design.

An Easily Extensible Toolset for Tabular Mathematical Expressions

⎧ 0 ⎪ ⎪ ⎪ ⎪ x ⎪ ⎨ 2

if if y if f (x, y) = 2 if −y ⎪ ⎪ ⎪ ⎪ x + y if ⎪ ⎩ x − y if

x≥0∧y x 10) → f (x, y) = y 2 ) ∧ ((x ≥ 0 ∧ y < 10) → f (x, y) = −y 2 )∧ ((x < 0 ∧ y > 10) → f (x, y) = x + y) ∧ ((x < 0 ∧ y < 10) → f (x, y) = x − y)



(b) f (x, y) described using classical predicate logic f (x, y) =

y = 10 y > 10 y < 10 x≥0 0 y2 −y 2 x ’b option. ’ I s a b e l l e / H O L f u n c t i o n t y p e s ( =>) a r e t o t a l ; p a r tia l fu n c tio n ty p e s c a n b e m o d e lle d u s in g o p tio n s . T h e o p tio n d a ta ty p e in c lu d e s th e c o n s t r u c t o r s None ( t o r e p r e s e n t u n d e fi n e d f u n c t i o n r e s u l t s ) a n d Some ( t o r e p r e s e n t d e fi n e d fu n c tio n re s u lts — th e a c tu a l v a lu e is s u p p lie d a s a n a rg u m e n t). T h e ty p e v a ria b le

3 8 0

D a v id S p e lt a n d S u s a n E v e n

CNode CNode::createCNodeIn(int p, int z, string s) { var n:CNode { n = new CNode(s, p, z); elements += set(n); cnodes += set(n) } returns (n) }; boolean CNode::removeNodeOrLink(Element n) { if (n != nil) and (n in elements) and (forall x in elements : not(x.isConnectedTo(n))) then { elements -= set(n) } returns (true) else { skip } returns (false) }; boolean Node::isConnectedTo(Element n) { (n in inLinks) or (n in outLinks) }; boolean Link::isConnectedTo(Element n) { (from == n) or (to == n) };

F ig . 2 . E x a m p le M e th o d D e fi n itio n s fo r th e S E P IA S c h e m a

β ( w r i t t e n ’b) i n t h e c o - d o m a i n t y p e o f ‘ oid => ’b a c o n c re te ty p e th a t d e s c rib e s th e s c h e m a -s p e c ifi c c la t y p e o f o b j e c t i d e n t i fi e r s ( oid) i s d e fi n e d a s a d a t a t y p O n th is a b s tra c t n o tio n o f d a ta b a s e s ta te , w e d e fi fo r d a ta b a s e re trie v a l a n d u p d a te . F ig u re 3 lis ts th e s e T h e s e fu n c tio n s a re m o d e lle d a s s c h e m a -in d e p e n d e n t

option’ w i l l b e i n s t a n t i a t e d w s s s tru c tu re s (s e e S e c tio n 5 ). T e , w h ic h w e o m it h e re . n e s e v e ra l h ig h e r-o rd e r fu n c tio o p e ra tio n s w ith th e ir s ig n a tu r o p e ra tio n s , w h ic h ta k e (fu n c tio

ith h e n s e s. n s

oids :: (oid ⇒ β option) ⇒ oid set eval :: [β option, β ⇒ bool] ⇒ bool get :: [β option, β ⇒ α] ⇒ α set :: [(oid ⇒ β option), oid, β ⇒ β] ⇒ (oid ⇒ β option) smash :: [(oid ⇒ β option), (oid ⇒ β option)] ⇒ (oid ⇒ β option) apply :: [α set, [α, oid] ⇒ β option] ⇒ (oid ⇒ β option) new :: [oid, β] ⇒ (oid ⇒ β option) skip :: (oid ⇒ β option)

F ig . 3 . G e n e ric O p e ra tio n s o n O b je c ts

a s ) p a ra m e te r to re trie v e in f tra n s la tio n o f th e s ta te ; th e y lo c a l c h a n g e s a ttrib u te a s s ig ( ‘ ;’ ) o f c o m m

s t o m a k e t h e m s p e c i fi c . T h e o p e r a t i o n s oids, get, a n d eval a r e u s e d o r m a t i o n f r o m t h e s t a t e . F o r e x a m p l e , t h e o p e r a t i o n get i s u s e d f o r t h e a ttrib u te s e le c tio n . T h e o th e r o p e ra tio n s in th e fi g u re a re u s e d to u p d a te re s u lt in a “ little ” o b je c t s to re (c a lle d a d e lta v a lu e [6 ]), w h ic h c o m p ris e s t o t h e s t a t e . F o r e x a m p l e , t h e o p e r a t i o n set i s u s e d f o r t h e t r a n s l a t i o n o f n m e n t . T h e smash o p e r a t i o n i s u s e d t o e n c o d e s e q u e n t i a l c o m p o s i t i o n s a n d s . It is d e fi n e d a s a fu n c tio n a l o v e rrid e , w h e re th e b in d in g s in th e

A T h e o re m

P ro v e r-B a s e d A n a ly s is T o o l fo r O b je c t-O rie n te d D a ta b a s e s

s e c o n d a r g u m e n t t a k e p r e c e d e n c e o v e r t h o s e i n t h e fi r s t . T h e smash o p e r a t i o n u s e d to a p p ly m e th o d c h a n g e s to th e o b je c t s to re . Is a b e lle c a n b e u s e d to p ro v e a b s tra c t p ro p e rtie s (th e o re m s ) a b o u t th e o p e ra F ig u re 3 , b a s e d o n th e ir d e fi n itio n s in H O L . A t p re s e n t, th e g e n e ric th e o ry o f in c lu d e s 4 9 th e o r e m s . F ir s t- o r d e r r u le s a r e d e r iv e d f o r th e a s s o c ia tiv ity a n d r e fl o f smash. S e c o n d - o r d e r r e w r i t e r u l e s ( w i t h f u n c t i o n s i n a r g u m e n t s ) a r e d e r i v e d p l i c a t i o n s o f eval a n d get t o m o d i fi e d o b j e c t s t o r e v a l u e s . B e l o w , w e g i v e a n e o f o n e o f t h e s e t h e o r e m s ( r u l e r1 ) :

3 8 1

is a ls o tio o b e x fo x a

n s in je c ts iv ity r a p m p le

get ((smash os1 (set os2 idb f)) ida) g = (if idb=ida & idb:oids os2 then get (os2 ida) (g ◦ f) else get (os1 ida) g)

T h i s r u l e i l l u s t r a t e s h o w a get o p e r a t i o n i s “ p u s h e d t h r o u g h ” a n u p d a t e d o b j e c t s t o r e . S u c h th e o re m s a re u s e d a s re w rite ru le s d u rin g p ro o fs , in a le ft-to -rig h t m a n n e r.

5

M o d e llin g d a ta b a s e -s p e c ifi c k n o w le d g e T h e O A S IS s c h e m a tra n s la to r s u p p le m e n ts th e g e n e ric th e o ry d is c u s s e d in th e p re v io u s s e c tio n w ith d a ta b a s e -s p e c ifi c in fo rm a tio n . F o r a n in p u t d a ta b a s e s c h e m a , th e s c h e m a t r a n s l a t o r g e n e r a t e s a n I s a b e l l e ‘ .thy’ fi l e t h a t c o n t a i n s t h e d a t a b a s e - s p e c i fi c H O L d e f in itio n s o f c la s s s tru c tu re s , m e th o d s , tra n s a c tio n s , a n d in te g rity c o n s tra in ts . In e ffe c t, th e s c h e m a tra n s la to r im p le m e n ts a s e m a n tic s m a p p in g , w h e re th e o u tp u t is H O L n o ta tio n . T h e s c h e m a tra n s la tio n h a s b e e n d e fi n e d a n d im p le m e n te d fo r a ll o f th e O A S IS c o n s t r u c t s w e s h o w i n t h i s p a p e r ( a s w e l l a s a f e w o t h e r s , s u c h a s foreach, w h i c h w e d o n o t d is c u s s h e re ). T h e p re v io u s s e c tio n in tro d u c e d a n a b s tra c t n o tio n o f d a ta b a s e s ta te a s a p a rtia l f u n c t i o n f r o m o i d s t o v a l u e s o f g e n e r i c t y p e ’b. F o r a s p e c i fi c d a t a b a s e s c h e m a , t h e t y p e v a r i a b l e ’b s h o u l d b e i n s t a n t i a t e d w i t h t y p e i n f o r m a t i o n t h a t r e fl e c t s t h e d a t a b a s e s p e c ifi c c la s s h ie ra rc h y . T h is is d o n e u s in g a d a ta ty p e d e fi n itio n : datatype object = ANode string int (oid set) (oid set) (string set) | CNode string int (oid set) (oid set) int (oid set) | Link string int oid oid

T h e a b o v e d a ta ty p e is a d is jo in t u n io n ty p e , w ith a c a s e fo r e a c h o f th e c o n c re te c la s s e s i n t h e s c h e m a ; t h e a b s t r a c t c l a s s e s Element a n d Node a r e n o t i n c l u d e d , b e c a u s e t h e y d o n o t h a v e c o n c r e te in s ta n tia tio n s . S tr u c tu r a l in f o r m a tio n o f o b je c ts ( i.e ., a ttr ib u te v a lu e s ) is s u p p lie d a s a n a rg u m e n t to th e d a ta ty p e c o n s tru c to rs . T h is in fo rm a tio n in c lu d e s a ll a ttrib u te s in h e rite d fro m s u p e rc la s s e s . C la s s re fe re n c e s in c o m p o u n d o b je c ts a p p e a r a s “ p o in te r” re fe re n c e s in th e fo rm o f o id -v a lu e s . T h is a c c o m m o d a te s o b je c t s h a rin g a n d h e te ro g e n e o u s s e ts : re p re s e n ta tio n s o f o b je c ts fro m d iffe re n t c la s s e s c a n b e g ro u p e d in o n e a n d t h e s a m e s e t , s i n c e t h e y a l l h a v e t h e s a m e I s a b e l l e t y p e oid. T h e c o n s t r u c t o r s o f t y p e object p r o v i d e f o r t h e r e q u i r e d r u n - t i m e t y p e i n f o r m a t i o n . In o b je c t-o rie n te d s y s te m s w ith in h e rita n c e , th is in fo rm a tio n is n e e d e d to m o d e l ru n tim e ty p e -b a s e d d e c is io n s , s u c h a s la te -b in d in g . U s in g o u r Is a b e lle re p re s e n ta tio n , th e s e

3 8 2

D a v id S p e lt a n d S u s a n E v e n

d e c i s i o n s c a n b e c o n v e n i e n t l y e n c o d e d u s i n g case- s p l i t s t o e x a m i n e t h e t y p e t a g . T h e fo llo w in g s e c tio n s s h o w h o w to e n c o d e O A S IS fe a tu re s in te rm s o f th e g e n e ric th e o ry o f o b je c ts , e n h a n c e d w ith s c h e m a -s p e c ifi c in fo rm a tio n . Q u e r ie s a n d c o n s tr a in ts . T h e s c h e m a tra n s la to r m a p s O A S IS q u e ry e x p re s s io n s to fu n c tio n s in Is a b e lle /H O L . T h e s e fu n c tio n s ta k e th e in p u t o b je c t s to re a s a n a rg u m e n t. T h e Is a b e lle p re d e fi n e d d a ta ty p e s s u p p o rt m o s t c o m m o n ly u s e d O Q L q u e ry la n g u a g e c o n s t r u c t s [ 5 ] . F o r e x a m p l e , s e t e x p r e s s i o n s i n O Q L ( e . g . , union, select-from-where, except, a n d intersect) a r e a v a i l a b l e i n t h e I s a b e l l e s y n t a x . T h e t r a n s l a t i o n o f m o s t O Q L e x p r e s s io n s is s tr a ig h tf o r w a r d . H o w e v e r, th e tr a n s la tio n o f o p e r a tio n s o n o b je c ts ( e .g ., a t t r i b u t e s e l e c t i o n a n d nil c o m p a r i s o n s ) i s c o m p l i c a t e d b y t h e i n t r o d u c t i o n o f o b j e c t id e n tifi e rs . F o r th e s e c o n s tru c ts , e x p lic it lo o k u p s o n th e o b je c t s to re a re n e e d e d . W e e n c o d e t h e s e u s i n g t h e g e n e r i c r e t r i e v a l o p e r a t i o n s get a n d eval o f t h e t h e o r y o f o b j e c t s . T o r e p r e s e n t nil c o m p a r i s o n s i n I s a b e l l e , w e m a k e u s e o f t h e f u n c t i o n eval. F o r e x a m p l e , t h e e x p r e s s i o n ‘ n!=nil’ , w h e r e n i s o f t y p e Node, a m o u n t s t o a c h e c k t h a t n i s in th e o b je c t s to re , w ith th e rig h t ty p e . T h e fo llo w in g Is a b e lle c o d e a c c o m p lis h e s th is : eval of | |

(os n) (%val. case val ANode name position inLinks outLinks content => True CNode name position inLinks outLinks size elements => True Link name from to => False)

T h e e x p r e s s i o n (os n) l o o k s u p t h e object- t y p e d v a s e c o n d a r g u m e n t t o eval i s a b o o l e a n - v a l u e d f u n c t i o n f o r λ- a b s t r a c t i o n ) . T h i s f u n c t i o n r e t u r n s True i f t h e t y p CNode; o t h e r w i s e , i f n d o e s n o t h a v e a b i n d i n g i n os, o r False i s r e t u r n e d . I n t h e e x a m p l e s , w e a b b r e v i a t e t h e c s u c h a s is N o d e fo r th e a b o v e . A t t r i b u t e s e l e c t i o n s a r e c o d e d u s i n g t h e get o p e r a e x p r e s s i o n ‘ n.elements’ , w h e r e n i s o f t y p e CNode, i s r e

lu e a s s o c (th e s y m e ta g o n is b o u n d a s e -s p lit

i a t e d w i t h o i d n. T h e b o l %is H O L s y n ta x t h e v a l u e i s ANode o r t o a Link v a l u e , t h e n fu n c tio n w ith a n a m e ,

tio n . F o r e x a m p le , th e O A S IS p re s e n te d a s fo llo w s :

get (os n) (%val. case val of ANode name position inLinks outLinks content => arbitrary | CNode name position inLinks outLinks size elements => elements | Link name from to => arbitrary)

O b se c o m m C s e n te

rv e o n o n s d in

th a t w a y tra in Isa b

a n arbitrary v a l u e i s r e t u r n e d f o r t h e w r o n g l y t y p e d c a s e s ; t h i s i s a o f d e a lin g w ith u n d e fi n e d fu n c tio n re s u lts in H O L [7 ]. t s a r e b o o l e a n - v a l u e d q u e r i e s . C o n s t r a i n t c4 o f t h e S e p i a s c h e m a i s r e p r e e lle a s fo llo w s :

c4 os cnodes links anodes == ! cn:cnodes. ! e:(get (os cn) elementsOf ). (eval (os e) isLink ) --> ((get (os e) fromOf ):(get (os cn) elementsOf )) & ((get (os e) toOf ):(get (os cn) elementsOf ))

I n I s a b e l l e s y n t a x , t h e forall q u a n t i fi e r i s w r i t t e n a s ‘ !’ . T h e t y p e c a s t i n t h e o r i g i n a l c o n s tra in t fa lls a w a y in th e tra n s la tio n to H O L .

A T h e o re m

P ro v e r-B a s e d A n a ly s is T o o l fo r O b je c t-O rie n te d D a ta b a s e s

U p d a te m e th o d s , la te b in d in g , a n d tr a n s a c tio n s n a m e d fu n c tio n s in H O L . S u c h fu n c tio n s m a p a n o i d this, a c t u a l p a r a m e t e r v a l u e s a n d a n y r e q u i r e d th e m o d ifi c a tio n s to th e o b je c t s to re , p e rs is te n t ro v a lu e o f th e m e th o d is g iv e n in th e la s t p o s itio n m e th o d o f c la s s C N o d e h a s th e fo llo w in g H O L r

. U p in p u n e w o ts , a o f th e p re s

d a te m e t o b je c t o id s to a n d m e th e tu p le . e n ta tio n

3 8 3

th o d s a re re p re s e n te d a s s to re , p e rs is te n t ro o ts , a n tu p le . T h e tu p le in c lu d e s o d p a ra m e te rs ; th e re tu r n T h e removeNodeOrLink :

CNode_removeNodeOrLink os cnodes links anodes this n == if (eval (os n) isElement ) & n:(get (os this) elementsOf ) & (! x:(get (os this) elementsOf ). ~ (if (eval (os x) isLink ) then Link_isConnectedTo os cnodes links anodes x n else Node_isConnectedTo os cnodes links anodes x n)) then (set os this f , True) else (skip, False)

T h e rig h t-h a n d s id e is a c o n d itio n a l e x p re s s io n th a t re fl e c ts th e s tru c tu re o f th e o rig in a l m e t h o d b o d y . W i t h i n t h e c o n d i t i o n a l , t h e a p p l i c a t i o n o f t h e isConnectedTo m e t h o d t o e l e m e n t o b j e c t ‘ x’ i n t h e if- c l a u s e i n v o l v e s l a t e b i n d i n g : b a s e d o n t h e a c t u a l r u n - t i m e t y p e o f ‘ x’ , t h e c o r r e c t i m p l e m e n t a t i o n o f t h e m e t h o d i s a p p l i e d . I n o u r f r a m e w o r k , s u c h a r u n - t i m e t y p e - b a s e d d e c i s i o n i s e a s i l y e x p r e s s e d u s i n g a n if-then-else c l a u s e , a n d t h e eval p r e d i c a t e . T h e i n n e r c o n d i t i o n a l e x p r e s s i o n y i e l d s a b o o l e a n v a l u e , w h i c h i s n e g a t e d w i t h t h e o p e r a t o r ‘ ~’ . I t i s i m p o r t a n t t o r e a l i s e t h a t n o t h i n g i s c o m p u t e d b y a c o n d i t i o n a l e x p r e s s i o n ; i t i s o n l y u s e d a s a n a s s u m p t i o n i n t h e then a n d else b r a n c h e s o f th e p ro o f. T h e fi r s t c o m p o n e n t o f t h e t u p l e r e t u r n e d b y t h e then b r a n c h i s a set e x p r e s s i o n , w h i c h d e s c r i b e s t h e e f f e c t s o f t h e a s s i g n m e n t t o t h e elements a t t r i b u t e o f t h e this o b j e c t , in a n a lg e b ra ic m a n n e r. T h e fu n c tio n f a b b re v ia te s a c a s e -s p lit fo r th e a c tu a l u p d a te : (%val. case val of ANode name position inLinks outLinks content => ANode name position inLinks outLinks content | CNode name position inLinks outLinks size elements => CNode name position inLinks outLinks size (elements - {n}) | Link name position from to => Link name position from to)

T h e se c o n d c o m v a lu e . W e o m it O u r sc h e m a in h e re n t in a u to fo rm , u s in g te rm A tra n s a c tio w h o se c h a n g e s tra n s a c tio n is fu tic s is p ro v id e d v a lu e th a t re p re tra n s a c tio n le v e

p o n e n t o f th e tu p le is th e re tu rn v a lu e o f th e m e th o d , w h ic h is a b o o le a n c h a n g e s to th e p e rs is te n t ro o ts a n d p a ra m e te rs in th e a b o v e e x a m p le . tra n s la to r g e n e ra te s le s s “ e ffi c ie n t” c o d e th a n th a t s h o w n a b o v e ; th is is m a tic c o d e g e n e ra tio n . H o w e v e r, w e e a s ily o b ta in th e a b o v e s im p lifi e d re w ritin g (s e e S e c tio n 6 ). n is n o t th e s a m e a s a m e th o d : a tra n s a c tio n is a s e q u e n c e o f u p d a te s , a re n o t p ro p a g a te d to th e d a ta b a s e u n til th e tra n s a c tio n c o m m its . A r th e r d is tin g u is h e d b y n o t h a v in g a r e c e iv e r o b je c t. T r a n s a c tio n s e m a n b y a p p l y i n g a n a d d i t i o n a l smash t o t h e i n p u t o b j e c t s t o r e a n d t h e d e l t a s e n ts th e tra n s a c tio n b o d y ’s u p d a te s . A m e th o d c a n b e “ lifte d ” to th e l b y p u ttin g c o d e to lo o k u p th e r e c e iv e r o b je c t in th e tr a n s a c tio n , a n d

3 8 4

D a v id S p e lt a n d S u s a n E v e n

th e n a p p ly in g th e m e th o d . T h e n e x t s e c tio n u s e s a n e x a m p le in w h ic h w e g iv e tr a n s a c t i o n s e m a n t i c s t o t h e removeNodeOrLink m e t h o d .

6

U s in g th e s y s te m T h e O A S IS to o l c u rre n tly p ro v id e s s u p p o rt fo r a u to m a te d tra n s a c tio n s a fe ty a n a ly s is . T h e to o l im p le m e n ts a n a u to m a te d p ro o f s tr a te g y , w h ic h is c o m p ris e d o f th e fo llo w in g f o u r s u c c e s s iv e s te p s : ( i) s p e c ifi c a tio n o f a n in itia l p r o o f g o a l; ( ii) n o r m a lis a tio n o f th e g o a l u s in g r e w r itin g ; ( iii) s a f e n a tu r a l d e d u c tio n in f e r e n c e s te p s ; a n d ( iv ) e x h a u s tiv e d e p th - fi r s t s e a r c h . T h is s tr a te g y c a n v e r if y m a n y n o n - tr iv ia l c o m b in a tio n s o f tr a n s a c tio n s a n d c o n s tra in ts , a lth o u g h th e s e a rc h is in h e re n tly in c o m p le te [2 ]. T h e a u to m a te d p ro o f p ro c e d u re re tu rn s a n y g o a ls th a t it c a n n o t s o lv e . W e n o w e x p la in in d e ta il e a c h o f th e s e s te p s .

S ta r tin g a Is a b e lle p fu n c tio n s a g iv e n m d e fi n e d in

tr a n s a c tio n s a fe ty ro o f g o a l s h o u ld fi start_proof a n d e th o d a n d c o n s tra in c la s s C N o d e , is s a

p ro o f. T o s ta rt a tra n s a c tio n (o r m e th o d ) s a fe ty p ro o f, a n rs t b e c o n s tru c te d . O u r s c h e m a tra n s la to r d e fi n e s th e M L method_safety_goal, w h i c h a u t o m a t e t h i s p r o c e s s f o r t . F o r e x a m p l e , t o v e r i f y t h a t m e t h o d removeNodeOrLink, f e w i t h r e s p e c t t o c o n s t r a i n t c4 , w e t y p e t h e f o l l o w i n g :

- start_proof(method_safety_goal("removeNodeOrLink","CNode","c4",["c1"]));

V e rifi c a tio n o f a m e th o d o r tra n s a c tio n w ith re m a y d e p e n d o n a d d itio n a l c o n s tra in ts o n th e n e c e s s a rily a s s u m e d , s in c e in o rd e r to e x tra o b j e c t , t h a t o b j e c t m u s t b e n o n - nil. A d d i t i o n a t h e start_proof c o m m a n d . I s a b e l l e n o w r g o a l:

sp e c t sc h e m c t th e l a ssu e sp o n

to a n in d iv id a . In th is e x elements a m p tio n s a re d s w ith th e

u a l c o n s tra in t p re a m p le , c o n s tra in ttrib u te fro m a C g iv e n a s p a r a m e fo llo w in g in itia l

d ic a te t c1 i s N o d e te rs to p ro o f

Level 0 ... (eval (os this) isCNode ) & c4 os cnodes links anodes & c1 os cnodes links anodes --> (let (delta,result) = CNode_removeNodeOrLink os cnodes links anodes this n in c4 (smash os delta) cnodes links anodes)

T h e g o a l is in th e fo rm o f a n im p lic a tio n , w h e re th e c o n s tra in ts a i n t h e i n i t i a l s t a t e os ( a s s e e n i n t h e p r e m i s e ) ; t h e c o n c l u s i o n i s i n e x p re s s io n , w h ic h s u b s titu te s th e m o d ifi c a tio n s re s u ltin g fro m th e in to th e c o n s tra in t e x p re s s io n . R e c a ll th a t o u r ru n n in g e x a m p le ig n o th e p e rs is te n t ro o ts . O b s e rv e th a t th e n e w d a ta b a s e s ta te in w h ic h th u a t e d t a k e s t h e f o r m (smash os delta). T h e smash “ i m p l e m e n l e v e l c o m m i t o f t h e c h a n g e s i n t h e l i t t l e o b j e c t s t o r e delta t o t h e i n a s m e n tio n e d in S e c tio n 5 .

re a s s u m e d to th e fo rm o f a m e th o d a p p lic re s m o d ifi c a tio e c o n s tra in t is ts ” th e tra n s a c p u t o b je c t s to r

h o ld let a tio n n s to e v a ltio n e os,

A T h e o re m

P ro v e r-B a s e d A n a ly s is T o o l fo r O b je c t-O rie n te d D a ta b a s e s

3 8 5

N o r m a lis a tio n o f th e p ro o f g o a l. T h e a c tu a l p ro o f s ta rts b y u n fo ld in g th e d a ta b a s e s p e c ifi c d e fi n itio n s (o f m e th o d s , c o n s tra in ts , a n d tra n s a c tio n s ) in th e in itia l g o a l. T h is is d o n e u s in g th e Is a b e lle S im p lifi e r . T h e S im p lifi e r p e rfo rm s te rm -re w ritin g w ith a s e t o f t h e o r e m s o f t h e f o l l o w i n g f o r m : [|H1 ; · · · ; Hn |] ==> LHS = RHS. S u c h th e o re m s a re re a d a s c o n d itio n a l re w rite ru le s : a te rm u n ify in g w ith th e e x p re s s io n o n t h e l e f t - h a n d s i d e o f t h e e q u a l i t y s i g n (LHS) i s r e w r i t t e n t o t h e t e r m t h a t a p p e a r s o n t h e r i g h t - h a n d s i d e (RHS), p r o v i d e d t h a t t h e h y p o t h e s e s (H1 , . . . , Hn ) h o l d . T h e d e f a u l t Is a b e lle S im p lifi e r in s ta lls a la rg e c o lle c tio n o f s ta n d a rd re d u c tio n ru le s fo r H O L ; n e w ru le s a re e a s ily a d d e d to c u s to m is e th e S im p lifi e r to p a rtic u la r ta s k s . W e h a v e e x te n d e d th e S im p lifi e r b y a d d in g a n u m b e r o f re w rite ru le s fo r s im p lify in g e x p re s s io n s in v o lv in g t h e c o n s t r u c t s o f t h e g e n e r i c t h e o r y o f o b j e c t s . I n a d d i t i o n t o t h e s e , t h e ‘ .ML’ fi l e t h a t is g e n e ra te d b y th e s c h e m a tra n s la to r a s s e rts a ll d a ta b a s e -s p e c ifi c d e fi n itio n s a s re w rite ru le s . T h u s d e fi n itio n s a re a u to m a tic a lly u n fo ld e d b y th e n o rm a lis a tio n s te p . U n fo ld in g th e d a ta b a s e -s p e c ifi c d e fi n itio n s re w rite s th e in itia l g o a l in to a m o re c o m p l e x f o r m , i n w h i c h e v e r y o c c u r r e n c e o f t h e i n p u t o b j e c t s t o r e os i n t h e g o a l ’ s c o n c l u s i o n i s r e p l a c e d b y a n e x p r e s s i o n t h a t r e fl e c t s t h e m o d i fi c a t i o n s t o os. D u r i n g n o r m a l i s a tio n , o n e o f th e s u b te rm s fo r th e e x a m p le is : (get ((smash os (set os this f )) e) fromOf ) : (get ((smash os (set os this f )) cn) elementsOf )

T h th e b e re w

is s u c o n re d u ritte

b te rm te x t o c e d u n (in

re p re se f th e u p s in g th e se v e ra l s

n ts d a te re w te p s

th e d o rite ) to

c o n d i t i o n ‘ e.from in cn.elements’ ( i n c o n s t r a i n t c4 ) , i n b je c t s to re . A t th is p o in t, p a tte rn s s u c h a s th e a b o v e c a n ru le s o f th e g e n e ric th e o ry o f o b je c ts . T h e a b o v e te rm is :

(get (os e) fromOf ):(if na=this then (get (os cn) elementsOf )-{n} else (get (os cn) elementsOf )

T h e re w ritin g “ p u s h e s ” th e a ttrib u te s e le c tio n th ro u g h th e a lg e b ra ic u p d a te o p e ra tio n s ( smash, set) . F o r e x a m p l e , t h e u p d a t e o f t h e elements a t t r i b u t e i s i r r e l e v a n t w i t h r e s p e c t t o t h e s e l e c t i o n o f t h e from fi e l d . T h i s i s i d e n t i fi e d b y t h e S i m p l i fi e r b y a p p l i c a t i o n o f r u l e r1 f r o m S e c t i o n 4 . O b s e r v e t h a t , i n t h e r e s u l t t e r m , a l l a t t r i b u t e s e l e c t i o n s a r e e x p re s s e d d ire c tly in te rm s o f th e in p u t o b je c t s to re . D u rin g th e n o rm a lis a tio n p h a s e , c o n s tra in ts th a t a re irre le v a n t w ith re s p e c t to a p a rt o f th e p ro o f g o a l c a n b e d e te c te d . (F o r e x a m p le , s tra ig h tfo rw a rd te rm re w ritin g c a n a l r e a d y p r o v e t h a t m e t h o d removeNodeOrLink d o e s n o t i n t e r a c t w i t h c o n s t r a i n t c2 . ) T h e e x a m p le p ro o f a b o v e re q u ire s m o re a n a ly s is , b e c a u s e u p d a te s a re a p p lie d to th e s a m e p a r t s o f t h e d a t a b a s e ( i . e . , t h e elements a t t r i b u t e ) . S a fe n a tu r a l d e d u c tio n in fe re n c e s te p s . In a d d itio n to te rm re w ritin g w ith th e S im p lifi e r, Is a b e lle a ls o u s e s n a tu ra l d e d u c tio n . Its C la s s ic a l R e a s o n e r u s e s a s e t o f in tro d u c tio n a n d e lim in a tio n r u le s ( i.e ., th e o r e m s ) f o r h ig h e r- o r d e r lo g ic to a u to m a te n a tu r a l d e d u c tio n in fe re n c e s . T h e d e fa u lt c o n fi g u ra tio n o f th e to o l in c lu d e s m a c h in e ry to re a s o n a b o u t s e ts , lis ts , tu p le s , b o o le a n s , e tc . T h e to o l im p le m e n ts a d e p th -fi rs t s e a rc h s tra te g y ; v a ria b le s in tro d u c e d b y th e u s e o f q u a n tifi e rs c a n b e a u to m a tic a lly in s ta n tia te d , a n d b a c k tr a c k in g is p e r f o r m e d b e tw e e n d iff e r e n t a lte r n a tiv e u n ifi e r s . T h e to o l r e q u ir e s

3 8 6

D a v id S p e lt a n d S u s a n E v e n

a d is tin c tio n to b e m a d e b e tw e e n s o -c a lle d s a fe a n d u n s a fe ru le s . S a fe ru le s c a n b e a p p lie d d e te rm in is tic a lly ; th e y d o n o t in tro d u c e o r in s ta n tia te v a ria b le s , s o th e re is n o n e e d to u n d o a n y o f th e s e s te p s a t la te r s ta g e s in th e p ro o f. F o r e x a m p le , in tro d u c tio n o f u n iv e r s a l q u a n tifi c a tio n is s a f e , w h e r e a s its e lim in a tio n is u n s a f e . S a f e s te p s g e t r id o f tr iv ia l c a s e s . T h e C la s s ic a l R e a s o n e r in te r le a v e s th e s e s te p s w ith f u r th e r s im p lifi c a tio n . A s w e d id fo r th e S im p lifi e r to o l, s o m e e x te n s io n s h a v e to b e m a d e to th e C la s s ic a l R e a s o n e r. T h e e x te n s io n s in c lu d e a d a ta b a s e -s p e c ifi c ru le fo r th e in tro d u c tio n (a n d its c o n v e r s e r u l e f o r e l i m i n a t i o n ) o f t h e p r e d i c a t e eval. T h e s e r u l e s ( a n d t h e i r p r o o f s c r i p t s ) a r e g e n e r a t e d a u t o m a t i c a l l y b y t h e O A S I S s c h e m a t r a n s l a t o r a n d r e s i d e i n t h e ‘ .ML’ fi l e ; t h e y p r o v i d e a m e c h a n i s m f o r c a s e - b a s e d r e a s o n i n g f o r t h e d a t a b a s e - s p e c i fi c object ty p e . F o r e x a m p le , fo r a n e x p re s s io n o f ty p e N o d e , c a s e s a re g e n e ra te d fo r ty p e s A N o d e a n d C N o d e ; s im p lifi c a tio n im m e d ia te ly d is c a rd s th e o th e r c a s e s , w h ic h a re irre le v a n t. A p p ly in g s a fe in fe re n c e s te p s to o u r e x a m p le g o a l g e n e ra te s a lis t o f 1 2 s u b g o a ls . T h e s e g o a ls re q u ire m o re in -d e p th a n a ly s is . E x h a u s tiv e d e p th -fi r s t s e a rc h . O n c e th e s a fe s te p s h a v e b e e n p e rfo rm e d , a n y re m a in in g g o a ls a r e s u b je c t to a n e x h a u s tiv e d e p th - fi r s t a n a ly s is [ 7 ] . S a f e in f e r e n c e s te p s a r e n o w in te rle a v e d w ith u n s a fe s te p s . T h is m a y in v o lv e b a c k tra c k in g , a n d u n d o in g o f u n ifi c a tio n s te p s . Is a b e lle a llo w s a lim it to b e im p o s e d o n th e s e a rc h d e p th . T h is g u a ra n te e s te rm in a tio n o f th e s e a rc h ta c tic s . In o u r p ra c tic a l e x p e rim e n ts , a d e p th o f 2 w a s s u ffi c ie n t fo r m o s t c a s e s . S te p s ( ii) to ( iv ) o f th e a u to m a te d p r o o f s tr a te g y a r e p a c k a g e d a s a s in g le I s a b e lle t a c t i c ( oasis_tac, w h i c h i s a c u s t o m i z a t i o n o f I s a b e l l e ’ s auto_tac) . A t a c t i c i s a p r o o f p r o c e d u r e ( i.e ., p r o o f in s tr u c tio n s f o r th e s y s te m ) th a t m a y im p le m e n t a h e u r is tic . T h e oasis_tac t a c t i c t a k e s a s a p a r a m e t e r a l i m i t o n t h e s e a r c h d e p t h . C a l l i n g t h i s ta c tic w ith a d e p th o f 2 o n th e e x a m p le ’s in itia l g o a l p ro d u c e s th e fo llo w in g o u tp u t: > by (oasis_tac (claset()) (simpset()) 2); Applying simplification steps... Applying safe inference steps... Now trying : 12...Done! Now trying : 11...Done! ... No subgoals!

T h e oasis_tac t a c t i c a u t o m a t i c a l l y fi n d s t h e r e q u i r e d p r o o f , u s i n g e x h a u s t i v e d e p t h fi rs t s e a rc h . Is a b e lle p rin ts th e ju s t-p ro v e d th e o re m (o m itte d fro m th e o u tp u t), a n d th e m e s s a g e “ No subgoals!”  P r a c tic a l re s u lts . T h e O A S IS s c h e m a tra n s la to r c o n s is ts o f M L c o d e . A t p re s e n t, th e g e n e ric O O th e o ry is 6 3 2 lin 4 9 th e o re m s . T h e in p u t S E P IA s c h e m a c u rre n tly in c lu d e s d e fi n itio n s , a n d 5 c o n s tr a in ts .1 T h e I s a b e lle /H O L th e o r y a s c h e m a c o m p ris e 1 6 2 lin e s o f c o d e . T a b le 1 s h o w s e x p e rim e n ta l re s u lts fo r v e rify in g th e s 1

O n ly p a rts o f th e S E P IA s c h e m a a re s h o w n in th is p a p e r.

o f a p p e s o f Is 6 c la s s n d M L

ro x a b e d e fi fi le

im a te ly lle /H O L n itio n s , s g e n e ra

2 0 2 9 lin e s c o d e , a n d 1 8 m e th o d te d fo r th is

a fe ty o f tw o m e th o d s o f c la s s

A T h e o re m

P ro v e r-B a s e d A n a ly s is T o o l fo r O b je c t-O rie n te d D a ta b a s e s

3 8 7

M E T H O D C O N S T R A IN T P R O O F T IM E CNode::removeNodeOrLink c1 3.35s . CNode::removeNodeOrLink c2 1.04s . CNode::removeNodeOrLink c3 1.06s . CNode::removeNodeOrLink c4 161.77s . CNode::removeNodeOrLink c5 109.63s . CNode::createCNodeIn c1 10.93s . CNode::createCNodeIn c2 2.89s . CNode::createCNodeIn c3 2.88s . CNode::createCNodeIn c4 222.46s . CNode::createCNodeIn c5 551.49s .

T a b le 1 . S o m e E x p e rim e n ta l R e s u lts fo r M e th o d S a fe ty

C N o d e , w ith re s p e c t to th e c o n s tra in ts in F ig u re 1 . A ll p ro o f tim e s a re in s e c o n d s , w ith I s a b e lle r u n n in g o n a S U N 2 9 6 M H z U ltr a - S P A R C - I I , u n d e r S o la r is . T h e tim e s g iv e n a re o n ly a ro u g h g u id e o f th e e ffi c ie n c y o f th e a u to m a te d m e th o d s a fe ty p ro o fs . T h e tim e s in d ic a te th a t th e tr iv ia l p r o o f s a r e im m e d ia te ly s o lv e d b y th e th e o r e m p r o v e r. F o r e x a m p l e , t h e c o m b i n a t i o n o f c o n s t r a i n t c2 a n d m e t h o d removeNodeOrLink o p e r a t e o n d iff e r e n t a ttr ib u te s . A s d is c u s s e d in th e p r e v io u s s e c tio n , th e p r o o f is tr iv ia l a n d is d o n e u s in g s tra ig h tfo rw a rd te rm re w ritin g , b y th e S im p lifi e r. T h e re a l p o w e r o f th e th e o re m p ro v e r re v e a ls its e lf in th e c a s e s w h e re th e c o n s tra in t a n d m e th o d o p e ra te o n th e s a m e a t t r i b u t e s a n d / o r p e r s i s t e n t r o o t s . F o r e x a m p l e , t h e c o m b i n a t i o n o f c o n s t r a i n t c4 a n d m e t h o d removeNodeOrLink ( i l l u s t r a t e d i n t h e p r e v i o u s s e c t i o n s ) t a k e s 161.77 s e c o n d s . In th is c a s e , th e p ro o f in v o lv e s m a n y te d io u s s te p s .

7

R e la te d w o r k T h e o re m p ro v e r te c h n iq u e s h a v e b e e n a p p lie d in th e c o n te x t o f re la tio n a l d a ta b a s e s u s in g fo rm a lis m s s u c h a s B o y e r-M o o re lo g ic [1 4 ] a n d H o a re lo g ic [1 1 ], fo r th e v e rifi c a tio n ( [ 1 4 ] ) a n d d e d u c tiv e s y n th e s is ( [ 1 1 ] ) o f tr a n s a c tio n s th a t r e s p e c t a n u m b e r o f s ta tic in te g rity c o n s tra in ts . O u r w o rk s h a re s s im ila ritie s w ith th e s e a p p ro a c h e s , b u t it is b a s e d o n a n o b je c t-o rie n te d fra m e w o rk a n d u s e s a m o d e rn th e o re m p ro v e r. A t th e tim e th e a b o v e a u th o rs p u b lis h e d th e ir w o rk , th e o re m p ro v e r te c h n o lo g y w a s s till in a n e a rly s ta g e o f d e v e lo p m e n t. F o r e x a m p le , in [1 4 ], h ig h e r-o rd e r e x te n s io n s a re m a d e to a fi rs t o rd e r th e o re m p ro v e r, a n d s ta n d a rd d a ta ty p e s s u c h a s n a tu ra l n u m b e rs a n d s e ts a re d e fi n e d fro m s c ra tc h . N o w a d a y s , th e s e m o d e llin g c a p a b ilitie s a re a v a ila b le “ o ff th e s h e l f ,” u s i n g a s t a n d a r d H O L t h e o r e m p r o v e r . W ith in a n o b je c t-o r ie n te d d a ta b a s e fra m e w o rk , B e n z a k e n e t a l [3 ] s tu d y th e p ro b le m o f m e th o d v e rifi c a tio n w ith re s p e c t to s ta tic in te g rity c o n s tra in ts , u s in g a b s tr a c t in te r p re ta tio n . A ta b le a u x re a s o n e r is u s e d to a n a ly s e s o m e p ro p e rtie s o f a p p lic a tio n c o d e u s in g fi rs t-o rd e r lo g ic . H o w e v e r, im p o rta n t is s u e s s u c h a s tra n s a c tio n s , ty p e in fo rm a tio n , a n d o b je c t s h a rin g a re n o t a d d re s s e d . T h e o re m p ro v e r te c h n iq u e s th a t u s e h ig h e r-o rd e r lo g ic a re a p p lie d in th e c o n te x t o f o b je c t- o r ie n te d p r o g r a m m in g in [ 1 3 ,8 ] . S a n te n [ 1 3 ] u s e s I s a b e lle /H O L to r e a s o n a b o u t

3 8 8

D a v id S p e lt a n d S u s a n E v e n

c la s s s p e c ifi c a tio n s in O b je c t-Z . A tra c e s e m a n tic s is e n c o d e d to s u p p o rt re a s o n in g a b o u t b e h a v io u ra l re la tio n s b e tw e e n c la s s e s . J a c o b s e t a l s tu d y th e v e rifi c a tio n o f J a v a c o d e , u s in g th e P V S th e o re m p ro v e r [8 ]. A to o l c a lle d L O O P (L o g ic o f O b je c t-O rie n te d P ro g ra m m in g ) tra n s la te s J a v a c la s s e s in to th e h ig h e r-o rd e r lo g ic o f th e P V S s y s te m . T h e s e m a n tic s o f th e ir a p p ro a c h is b a s e d o n c o a lg e b ra s , in p a rtic u la r to s u p p o rt p ro o fs a b o u t re fi n e m e n t re la tio n s . J a c o b s e t a l a d d re s s a n u m b e r o f is s u e s th a t w e d o n o t, s u c h a s e x c e p tio n s , te rm in a tio n , a n d re c u rs io n . In c o n tra s t to th e w o rk o n o b je c t-o rie n te d p ro g ra m m in g , w e s tu d y d a ta b a s e tra n s a c tio n s o n a p e rs is te n t o b je c t s to re , ra th e r th a n th e b e h a v io u r o f in d iv id u a l o b je c ts . T h e w o rk in th is p a p e r e x te n d s o u r p re v io u s w o rk ([1 5 ]) b y c o n s id e rin g a d d itio n a l to p ic s s u c h a s in h e rita n c e a n d h e te ro g e n e ity . H e re , e m p h a s is is p la c e d o n m o d e llin g a n o b je c t-o rie n te d d a ta b a s e s c h e m a in H O L , a n d o n th e e x te n s io n s to th e Is a b e lle s y s te m to p ro v id e a u to m a te d re a s o n in g fo r s u c h a d a ta b a s e s c h e m a . W e b u ild o n th e id e a s o f D o h e rty a n d H u ll [6 ] in w h ic h d a ta b a s e s ta te c h a n g e s a re e n c o d e d a s d e lta v a lu e s (a d iffe re n c e b e tw e e n d a ta b a s e s ta te s ). In th e ir w o rk , d e lta v a lu e s a re u s e d to d e s c rib e p r o p o s e d u p d a te s in th e c o n te x t o f c o o p e r a tiv e w o r k ; w h e r e a s in o u r w o r k , d e lta v a lu e s a re u s e d to c o p e w ith in tra -tra n s a c tio n p a ra lle lis m d u e to s e t-o rie n te d u p d a te s .

8

C o n c lu s io n s a n d fu tu r e w o r k

W e h a v e s h o w n h o w to re p re s e n t th e c o n s tru c ts o f a n o b je c t-o rie n te d d a ta b a s e s p e c ifi c a tio n la n g u a g e in th e h ig h e r-o rd e r lo g ic o f th e Is a b e lle th e o re m p ro v e r. T o a c h ie v e th is , w e d e fi n e d a n Is a b e lle th e o ry o f o b je c ts , w h ic h re s e m b le s th e ty p e -ta g g e d m e m o ry o f a p e rs is te n t o b je c t s to re . T h e c o n s tru c ts o f th e s p e c ifi c a tio n la n g u a g e a re d e fi n e d a s g e n e ric h ig h e r-o rd e r o p e ra tio n s in th is th e o ry . H ig h e r-o rd e r lo g ic a llo w s u s to a c h ie v e s c h e m a -in d e p e n d e n t re a s o n in g : w e h a v e p ro v e d th e o re m s a b o u t th e g e n e ric o p e ra tio n s th a t a re u s e d in re a s o n in g a b o u t s p e c ifi c d a ta b a s e o p e ra tio n s . W e p re s e n te d s o m e o f o u r e x p e rim e n ta l re s u lts o n th e s ta tic a n a ly s is o f d a ta b a s e in te g rity . T h e e x a m p le p ro o f s h o w n in S e c tio n 6 in v o lv e s a c o m b in a tio n o f ty p ic a l o b je c to rie n te d fe a tu re s (n a m e ly , h e te ro g e n e o u s c o lle c tio n s , a b s tra c t m e th o d s , d o w n -c a s tin g , la te b in d in g , a n d n il r e f e r e n c e s ) . T h is e x a m p le is r e p r e s e n ta tiv e o f th e in te r a c tio n o f la n g u a g e fe a tu re s e n c o u n te re d in m a n y o b je c t-o rie n te d a p p lic a tio n s . T h e e x a m p le s c h e m a w e a re w o rk in g w ith is b a s e d o n th e g e n e ric g ra p h e d itin g fu n c tio n a lity o f a re a l s y s te m (th e S E P IA s y s te m [1 6 ]). A ll 9 0 m e th o d s a fe ty re q u ire m e n ts in th e c a s e s tu d y c o u ld b e v e rifi e d a u to m a tic a lly , u s in g th e Is a b e lle to o l. It is w o rth m e n tio n in g th a t o u r in itia l s p e c ifi c a tio n c o n ta in e d a fe w b u g s , s u c h a s fo rg o tte n n il-c h e c k s . T h e s e k in d s o f e rro rs in th e s c h e m a a re e a s ily o v e rlo o k e d b y th e s p e c ifi e r, b u t im m e d ia te ly s p o tte d b y th e th e o re m p ro v e r. O u r to o l is n o t lim ite d to tra n s a c tio n s a fe ty a n a ly s is . B e c a u s e th e th e o ry u s e d b y th e to o l is b a s e d o n v e ry g e n e ra l s e m a n tic s p ro p e rtie s o f th e u p d a te la n g u a g e , w e e x p e c t o u r e x p e rim e n ta l re s u lts to b e e x te n d ib le to th e k in d s o f p ro o f re q u ire m e n ts e n c o u n te re d in o th e r a p p lic a tio n a re a s , w h e re re a s o n in g a b o u t th e s e m a n tic s o f d a ta b a s e o p e ra tio n s is n e e d e d . W e a re c u rre n tly lo o k in g a t a p p lic a tio n s o f th e O A S IS re a s o n in g to o l in th e a r e a s o f w o r k fl o w a n d c o o p e r a tiv e w o r k , f o r th e v e r ifi c a tio n o f e .g ., c o m p e n s a tio n re q u ire m e n ts (th a t is , p ro o fs th a t o n e m e th o d c o m p e n s a te s th e re s u lts o f a n o th e r).

A T h e o re m

P ro v e r-B a s e d A n a ly s is T o o l fo r O b je c t-O rie n te d D a ta b a s e s

3 8 9

R e fe r e n c e s

1 1 1

1

1 1

1

1

1 . F . B a n c ilh o n , C . D e lo b e l, a n d P . K a n e lla k is , e d ito rs . B u ild in g a n O b je c t-o r ie n te d D a ta b a s e S y s te m : T h e S to r y o f O 2 . M o rg a n K a u fm a n n , 1 9 9 2 . 2 . M . B e n e d ik t, T . G riffi n , a n d L . L ib k in . V e rifi a b le p ro p e rtie s o f d a ta b a s e tra n s a c tio n s . In P ro c e e d in g s o f P r in c ip le s o f D a ta b a s e S y s te m s (P O D S ), p a g e s 1 1 7 – 1 2 7 , 1 9 9 6 . 3 . V . B e n z a k e n a n d X . S c h a e fe r. S ta tic m a n a g e m e n t o f in te g rity in o b je c t-o rie n te d d a ta b a s e s : D e s ig n a n d im p le m e n ta tio n . In E x te n d in g D a ta b a s e T e c h n o lo g y (E D B T ), M a rc h 1 9 9 8 . 4 . A . J . B e r n s te in , D . S . G e r s tl, W .- H . L e u n g , a n d P . M . L e w is . D e s ig n a n d p e r f o r m a n c e o f a n a s s e rtio n a l c o n c u rre n c y c o n tro l s y s te m . In P ro c e e d in g s o f IC D E , p a g e s 4 3 6 – 4 4 5 , O rla n d o , F lo rid a , F e b ru a ry 1 9 9 8 . 5 . R . G . G . C a tte ll a n d D o u g la s K . B a r r y , e d ito r s . T h e O b je c t D a ta b a s e S ta n d a r d : O D M G 2 .0 . M o rg a n K a u fm a n n P u b lis h e rs , S a n F ra n c is c o , C a lifo rn ia , 1 9 9 7 . 6 . M . D o h e rty , R . H u ll, M . D e rr, a n d J . D u ra n d . O n d e te c tin g c o n fl ic t b e tw e e n p ro p o s e d u p d a te s . In In te r n a tio n a l W o r k s h o p o n D a ta b a s e P ro g r a m m in g L a n g u a g e s (D B P L ), G u b b io , Ita ly , S e p te m b e r 1 9 9 5 . 7 . I s a b e l l e . http://www.cl.cam.ac.uk/Research/HVG/isabelle.html. 8 . B . J a c o b s , J . v a n d e n B e rg , M . H u is m a n , M . v a n B e rk u m , U . H e n s e l, a n d H . T e w s . R e a s o n in g a b o u t J a v a C la s s e s (P re lim in a ry R e p o rt). In P ro c e e d in g s o f O O P S L A , 1 9 9 8 . T o a p p e a r. 9 . C ris P e d re g a l M a rtin a n d K rith i R a m a m rith a m . D e le g a tio n : E ffi c ie n tly re w ritin g h is to ry . In P r o c e e d in g s o f I C D E , p a g e s 2 6 6 – 2 7 5 , B ir m in g h a m , U .K ., A p r il 1 9 9 7 . 0 . L a w re n c e C . P a u ls o n . Is a b e lle : A G e n e r ic T h e o re m P ro v e r , v o lu m e 8 2 8 o f L N C S . S p rin g e rV e rla g , 1 9 9 4 . 1 . X ia o le i Q ia n . T h e d e d u c tiv e s y n th e s is o f d a ta b a s e tr a n s a c tio n s . A C M T r a n s a c tio n s o n D a ta b a s e S y s te m s , 1 8 (4 ):6 2 6 – 6 7 7 , D e c e m b e r 1 9 9 3 . 2 . M a r e k R u s i n k i e w i c z , W o l f g a n g K l a s , T h o m a s T e s c h , J u¨ r g e n W a¨ s c h , a n d P e t e r M u t h . T o w a r d s a c o o p e r a tiv e tr a n s a c tio n m o d e l— T h e C o o p e r a tiv e A c tiv ity M o d e l. I n P r o c e e d in g s o f th e 2 1 s t V L D B C o n fe re n c e , Z u ric h , S w itz e rla n d , S e p te m b e r 1 9 9 5 . 3 . T h o m a s S a n te n . A th e o ry o f s tru c tu re d m o d e l-b a s e d s p e c ifi c a tio n s in Is a b e lle /H O L . In P ro c . o f th e 1 9 9 7 In te r n a tio n a l C o n fe re n c e o n T h e o re m P ro v in g in H ig h e r O rd e r L o g ic s (T P H O L s 9 7 ), L e c tu re N o te s in C o m p u te r S c ie n c e . S p rin g e r-V e rla g , 1 9 9 7 . 4 . T im S h e a rd a n d D a v id S te m p le . A u to m a tic v e rifi c a tio n o f d a ta b a s e tra n s a c tio n s a fe ty . A C M T r a n s a c tio n s o n D a ta b a s e S y s te m s , 1 4 (3 ):3 2 2 – 3 6 8 , S e p te m b e r 1 9 8 9 . 5 . D a v id S p e lt a n d H e rm a n B a ls te rs . A u to m a tic v e rifi c a tio n o f tra n s a c tio n s o n o b je c t-o rie n te d d a ta b a s e s . In P ro c e e d in g s o f th e W o r k s h o p o n D a ta b a s e P ro g r a m m in g L a n g u a g e s (D B P L ), E s te s P a rk , C o lo ra d o , 1 9 9 7 . 6 . N . S tre itz , J . H a a k e , J . H a n n e m a n n , A . L e m k e , W . S c h u le r, H . S c h u e tt, a n d M . T h u e rin g . S E P I A : A c o o p e r a tiv e h y p e r m e d ia a u th o r in g e n v ir o n m e n t. I n A C M C o n fe r e n c e o n H y p e r te x t (E C H T ), p a g e s 1 1 – 2 2 , M ila n o , Ita ly , 1 9 9 2 . 7 . J u ¨ r g e n W a¨ s c h a n d W o l f g a n g K l a s . H i s t o r y m e r g i n g a s a m e c h a n i s m f o r c o n c u r r e n c y c o n t r o l in c o o p e r a tiv e e n v ir o n m e n ts . I n I E E E W o r k s h o p o n R e s e a r c h I s s u e s in D a ta E n g in e e r in g : In te ro p e r a b ility o f N o n tr a d itio n a l D a ta b a s e S y s te m s , p a g e s 7 6 – 8 5 , 1 9 9 6 .

1 0 .1 0 0 7 /b 1 0 7 0 3 1 1 3 0 0 2 6

DYANA: An Environment for Embedded System Design and Analysis  A.G. Bakhmurov, A.P. Kapitonova, R.L. Smeliansky Moscow State University Dept. of Computational Mathematics and Cybernetics, Vorobyevy Hills, Moscow 119899, Russia {bahmurov,alla,smel}@cs.msu.su

Abstract. The results presented here are based on the experience of development and application of DYANA – an environment for analysis of multiprocessor computer systems operation. The architecture and basic features of such an environments are discussed. Main problems of such the environment design are highlighted and possible solutions are shown. The key features of the DYANA environment are: the possibility of both quantitative and algorithmic analysis of system to be modeled; the time complexity estimation subsystem which helps to avoid the instructionlevel simulation of target computer system; support of program development through simulation.

1

Introduction

Usually, simulation is a significant stage of a product’s life cycle. More complex the product is, more substantial the simulation stage is in the life cycle. The suitability of simulation modelling from the viewpoint of software development manufacturability depends on answers on two questions: – to which extent the transition from the model to the product itself is simple and efficient? – how manufacturable the process of simulation model creation and investigation is? In other words, how the process of model creation and investigation ’fits’ into the process of product development? From the viewpoint of model-to-product transition, it’s perfect when we obtain the product as a result of simulation, or the transition is automated completely. In this article we’ll investigate the model-to-product transition with respect to such an objects as embedded multiprocessor systems. The state-of-the-art technology of developing such a systems is characterized by the following. In the area of hardware, there exist mature technologies for automated transition from hardware description to its implementation. As a rule, this hardware description 

This work is partially supported by the Russian Fund of Basic research, Grant No. 98-01-00151 and by the EEC INCO-Copernicus Grant No 977020

W.R. Cleaveland (Ed.): TACAS/ETAPS’99, LNCS 1579, pp. 390–404, 1999. c Springer-Verlag Berlin Heidelberg 1999 

DYANA: An Environment for Embedded System Design and Analysis

391

is a result of simulation. But, the transition mentioned above is developed for the chip level only and implemented in the CAD systems based on the VHDL and Verilog languages. Now the support for such a transition starting from the systems level is ’hottest’. There are many reasons for this, the main one is: the speed of hardware development now is far beyong the one of software development [7]. Authors do not know any design environment enabling the model-to-product transition starting from the systems level. In the area of software development, simulation is not used in practice. Various specification methods does not give the opportunity to estimate the properties of program under development with respect to the particular hardware environment. The manufacturability of simulation model development and investigation strongly depends on the concepts of simulation environment being used, on how this environment covers all development stages. Such an environment should include at least the following: a simulation modelling language, a programming language (if we wish to obtain a program as a product) or a hardware description language (if the product is a hardware component), a system behaviour specification language. Aproppriate graphical facilities, editors, compilers etc. are required as for model as for program development. For the last 30 years, more than 200 languages and environments were proposed [8], with various concepts and capabilities. But, none of them was directed to investigation and development of multiprocessor distributed computer systems. These environments use different languages on different steps (e.g. for model description, for specification etc.). So the problem of syntactical and semantical consistency arizes immediately. All these environments has different architecture. The absence of stable and unified architecture (which is clear and convenient for user and provides integration of all necessary tools) complicates the problem of portability and working with this environments in theclient-server network architecture. We’ll try to answer the questions mentioned above and show possible solutions on the case of the DYANA system applied to problems of development and analysis of operation of distributed multiprocessor computer systems.

2

Project goals

The DYANA system (DYnamic ANAlyzer) is the software system which is proposed to help analyze distributed computer environment operation. The design and development of the system were aimed at the following: – to develop the tool for describing as software behaviour as hardware behaviour of distributed systems on the systems level; – to develop the tool for systems performance estimation under the different tradeoffs between hardware and software on the project system level stage; – to enable the application of algorithmic and quantitative methods of analysis to the same model description [1];

392

A.G. Bakhmurov, A.P. Kapitonova, R.L. Smeliansky

– to have a possibility to vary the detail level of behaviour analysis depending on the detail devel of description; (this goal has a ’side effect’: to investigate the methodology of program development through simulation and stepwise refinement); – to experiment with a simulation models of software and hardware independently. The goals mentioned above imply the solution of the following problems: – how to describe such particularities of modeled object as indeterminism of program behavior, independence of program behavior from time, absence of unique time in a distributed system, shared resourses, existence of two types of parallelism - interleaving and real concurrency? – how to measure the ”computational work” of the program being analyzed and how to map the measure onto time for given hardware environment? – how to provide the technology for the development of a model to support the ”top-down” approach, to enable re-usage of model components? – how to integrate all tools involved in product development? In other words, the main goal of the project is to develop an instrumental environment which enables the user to describe the target software and hardware on the systems level and analyze the behaviour of the target system as a whole. Also, such an environment will allow for software development through simulation. Let we can describe the software with variable degree of detail and analyze its behaviour. Essentially, this description is a model since we make it for the purpose of investigation and analysis. Gradually refining this description, we yield a program — that is, an algorithm description created for application, not analysis. This program has to have all properties checked during analysis with assurance. Generally, the idea of software design through simulation is not a new one. Examples are: an industry-level systems for design in the SDL language (SDT from Telelogic, [10]), systems supporting the OMT and ROOM methodologies [6], the Ptolemy simulation environment [11]. An interesting environment SimOS [9] permits to emulate the hardware and estimate its performance on the ’realistic’ workload — up to industrial operating systems and applications. The main differences and advantages of our approach are as follows. At first, the developer is able to analyze namely dynamics (behaviour) of both the hardware and software. He is able to analyze the software behaviour with respect to the given target hardware environment. At second, it is possible to determine the program’s resource usage, e.g. execution time of a given code block for the target CPU architecture. Certain powerful environments such as ObjecTime [13] focus on software development and code generation for target real-time OS. At third, within our approach it is possible to estimate and to verify both quantitative approach of program behaviour (e.g. performance indices) and logical (algorithic) properties without any rewriting of model description.

DYANA: An Environment for Embedded System Design and Analysis

393

At fourth, the approach proposed enables the user to connect the statical program description (i.e. text) and its dynamics. Namely, DYANA lets to link the event of interest with correspondent code block. The theoretical issues of our approach along with description of first version of tools were given in [3]. The rest of this paper is organized in the following way. The next section briefly presents the computational model used in DYANA. The capabilities of software description and model detail up to executable program are shown in Sect. 4 by example. Sect. 5 describes the DYANA architecture.

3

The Computational Model. Language Features Overview

The DYANA model decription language named M 2 -SIM is based on the following model of computations. Processes and distributed programs. A program is a set of sequential processes communicating by means of the message passing. Every process has the set of input and output buffers. An attempt to read a message from an empty input buffer blocks the process until a message arrives. Messages are distinguished by types. In general, a message type is an equivalence class on the set of message data, but it can be detailed to a data value (as a single as a structured one). Research [4] has shown that this model of computations has certain noticeable properties, from the viewpoint of the algorithmic analysis. To capture the needs of the interprocess communication, two more features are added: the receive with timeout and the wait for a message arrival statements. To support modularity and stepwise refinement, a notion of distributed program (DP) is introduced. To form a DP, you need to declare the instances of processes and establish links between their input and output buffers. Since a DP may also have inputs and outputs, it’s possible to replace a process with a DP during the model refinement. As processes as DPs may be parameterized. During a DP construction, it’s possible to declare arrays of its subcomponents and to use C code blocks to manage the linking of buffers. (Note: the construction process is done prior to the model run, and the entire model structure remains unchanged during the run, leaving the possibility for algorithmic analysis, see Sect. 5.5). The machanism of the DP construction shown above enables to create reusable submodels. Executors. An important distinctive feature of the M 2 -SIM is the notion of an executor. An executor represents a hardware component of a system to be modeled and it maps the complexity of process’ internal actions onto modelling time. Please refer to Sect. 5.2 for details of mapping the computational complexity to time. The examples of executors application could be found in Sect. 4.2.

394

A.G. Bakhmurov, A.P. Kapitonova, R.L. Smeliansky

Binding. The process-to-executor binding description allows to describe different kinds of parallelism. Processes bound to the same executor run in the interleaved mode, and those ones bound to different executors run really in parallel. See examples in Sect. 4.2.

4

An Example of Model Construction in DYANA

The capabilities of model descriprion will be shown on en example of robotic control system for the manipulator (i.e. robot’s arm). The aim of manipulator’s work is to catch a moving oblect (a target). The manipulator consists of two chains and it has two degrees of freedom. To detect the target and to determine the target’s coordinates, a vision subsystem is provided, its particular principle of operation does not influence on this article’s subject and will not be considered. The idea of control algorithm is as follows. Having the target’s and manipulator’s coordinates a catch point is determined. Then, a trajectory of manipulator moving up to the catch point is computed. The next step is to move the manipulator along the trajectory. If the trajectory is passed and the target is not caught, new catch point is computed, and so on. To follow the trajectory, the feedback-by-error algorithm is used, which is implemented on the control computer. 4.1

Model Construction

The following components operating in parallel could be distinguished in our system to be modeled: the vision subsystem, the control sybsystem and the manipulator itself. The general model structure is shown on Fig. 1.

Vision subsystem Control subsystem

Vision

HiControl Manipulator

LoControl Manip

Fig. 1. Model structure

Vision Subsystem. Let’s suppose that the target detection algorithm should take not more T d time to execute, and it runs periodically with pause time T p. If a target is detected, the vision subsystem sends a message with target

DYANA: An Environment for Embedded System Design and Analysis

395

coordinates (and velocity) to the control subsystem. Here is the model text for the vision subsystem: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18

message Target {}; /*message to control subsystem */ process Vision() < output TargetData; /* output buffer to send a message */ > { msg TargetMark; /* message variable */ /* model parameters */ float Td = 1000; /*time for detection */ float Tp = 200; /* pause length */ while( 1 ){ delay( Td ); /* simulate target detection */ if( TargetDetected() ) { /* target is detected */ TargetMark = message Target; send( TargetMark, TargetData ); /* send message to control subsystem */ } delay( PauseTime ); /* do pause */ } } /* Vision */

Note that on the current level of detail the vision subsystem is treated just like the source of messages on targets (see the message type description in line 1, the message is sent in line 14). The target detection algorithm itself is presented by the delay in line 11, which specifies the execution time for this algorithm. There is no computations there. The possibilities of model detail will be considered later, in Sect. 4.3. Control Subsystem. Let’s partition the control algorithm on high level and low level of control. Each level is presented by a separate process. The algorithm operates by the following way. When the high control level process receives thetarget coordinates, it requests the coordinates of manipulator and checks the possibility to catch the target. If catching is possible, the manipulator’s trajectory is computed and sent to the low control level process. These actions are repeated for the next position of target. Model text is as follows: 1 2 3 4 5 6 7 8 9

process HiControl() < input TargetData(queue), Feedback(queue); output Control, ManipAcq; > { msg in, out, x; int CatchPossible; float ComputeCP = 100;/* time to compute catch point */ float ComputeTraj = 100; /* time to compute trajectory */

396

10 11 12 13 14 15 16 17 18 19 20 21 22 23

A.G. Bakhmurov, A.P. Kapitonova, R.L. Smeliansky

while( 1 ) { receive( in, TargetData ); /*get target parameters */ out = message CoordReq; send( out, ManipAcq ); /*request for manipulator’s coordinates */ receive( x, Feedback ); /* get manipulator’s coordinates */ /* test for possibility of catching and catch point computation */ delay( ComputeCP ); if( !CatchPossible ) continue; /* impossible to catch */ delay( ComputeTraj ); /* compute trajectory parameters */ out = message Traj; /* send trajectory to low control level */ send( out, Control ); } /* while */ } /* HiControl */

The low control level is responsible for following by computed trajectory, in presence of external physical infuences on the manipulator. Its implementation is omitted for brevity. Manipulator. In our model, the manipulator can perform two operations: to determine and send its coordinates; to do an (elementary) move by the control system’s command. The Manip process may receive messages of two types: move command (Move) and request for coordinates (CoordReq). Having received the former message, Manip makes a move and sends its coordinates to the low control level. Upon receiving the latter one, it replies with coordinates to the high control level. Note that the Manip process, essentially, isn’t a part of the computer system, it’s a component of an computer system’s outer environment. Under this term we mean the set of sensors, servomechanisms etc. interfacing a computer control system with controlled object. So, building a software model in the DYANA environment opens an opportunity to investigate the program behaviour together with its outer environment, which is crucial for the real-time programs development. 4.2

Taking Hardware Into Account

Besides the program description considered above, the complete model contains: – hardware description (a set of executors); – process to executor binding description. The sequential executor is an abstraction of a device performing only one action at a time. Let’s suppose that we use a dedicated signal processor for the vision subsystem and general-purpose Intel 80386-based computer — for the control subsystem. Then, the hardware description in M 2 -SIM may look like:

DYANA: An Environment for Embedded System Design and Analysis

397

sequex DSP() {} /*for vision subsystem */ sequex CPU() { /* for control subsystem */ architec Intel386; } sequex Manip() {} /*for manipulator */ Leaving some syntactical details, one of possible binding descriptions may look like: bind bind bind bind

Vision => DSP; HiControl => CPU; LowControl => CPU; Manip => Manip;

The HiControl and LowControl processes are bound to the same executor. They will run in thr interleaved fashion. The actions of vision and Manip (these processes are bound to distinct executors) could be executed in parallel (if waiting for message does not instruct otherwise). Please note that the notion of executor could represent not only a CPU, but any other hardware component (e.g., a bus, a memory module, a switch etc). In this case, the sequential executor should be accomplished by the appropriate process containing the operation algorithm of the device to be modeled. 4.3

Model Detail. Model-to-Program Transition

In order to move from a model to a program, you should refine the data structure in messages and actions in processes. For example the structure of message Target from process Vision below and the delay statement in line 17 of process HiControl (catch point calculation) could be detailed by the following way: message Target {float Xt, Yt, Zt, Vx, Vy, Vz }; complex { C1 = cos(theta1); S1 = sin(theta1); C2 = cos(theta2); S2 = sin(theta2); Xm = (l1+l2*C2)*C1; Ym = (l1+l2*C2)*S1; Zm = l2*S2; ... } The complete text of the catch point calculation is omitted due to the lack of space. Note the complex block above. If the architecture description of the target CPU is given in the model, the execution time of this block for given target CPU will be estimated during the model run. For details on time estimation, see Sect. 5.2. When the detail of M 2 -SIM program is finished, it may be converted into a C++ program for the target computer. For example, let’s see the part of the conversion result for HiControl process below.

398

A.G. Bakhmurov, A.P. Kapitonova, R.L. Smeliansky

#include "__mm.h" ... void __mm_process_HiControl::__mm_process_body() { ... __mm_message *in = new __mm_message; int CatchPossible; while(1){ __mm_receive(__mm_bf_TargetData,in,1,"HiControl.mm:12"); (&__mm_sample_message_CoordReq)->__mm_copy_message(out); __mm_send(__mm_bf_ManipAcq,out,2,HiControl.mm:14"); ... __mm_delay(ComputeCP,3,"HiControl.mm:17"); ... } } Of course, the details of the target operating system interface should be taken into account. But it’s not a subject of this paper. Here we want only to show the possibility of such a conversion. An important note: the DYANA environment is capable to reproduce the parallel program behaviour with respect to computer system architecture of interest and particular outer environment on any stage of model detail. So, meeting the specified deadlines in a real-time control systems could be checked on any stage of detail.

5

The DYANA Architecture

The architecture of the DYANA system is shown on the Fig. 2. The most interesting components of the DYANA system are described below. 5.1

The Runtime Subsystem

The runtime subsystem is responsible for the following: – reproduction of the system’s behaviour on the base of process-oriented discreteevent simulation methodology (before execution, the program description in M 2 -SIM is translated to the text in the C++ language, compiled and linked with the DYANA runtime library); – collection of the event trace for subsequent analysis. Also, the dynamic stage of the time estimation (see 5.2) is done by the runtime subsystem. Now, the design and development of distributed discrete-event simulation kernel for DYANA is in progress. Our approach to analysis and choozing the distributed model time synchronization algorithm is presented in [12].

DYANA: An Environment for Embedded System Design and Analysis

I

399

0RGHO GHVFULSWLRQ ODQJXDJH FRPSLOHU

n t e g r

SURJUDP EHKDYLRU ELQGLQJ

a

$UFKLWHFWXUH GHVFULSWLRQ VXEV\VWHP

t e d

KDUGZDUH GHVFULSWLRQ

D e

D a ta b a s e

7LPH FRPSOH[LW\ HVWLPDWLRQ VXEV\VWHP

v e l o p m e

9HUVLRQ FRQWURO

n t E n v i r

5XQWLPH VXEV\VWHP

o m e

9LVXDOL]DWLRQ VXEV\VWHP

3HUIRUPDQFH DQDOLV\V

6SHFLILFDWLRQ VXEV\VWHP

n t

5.2

Fig. 2. Architecture of the DYANA system

The Subsystem for Time Complexity Estimation

The aim of this subsystem is to to estimate an execution time of a text block in the C language in the complex statements for given target CPU architecture. The underlying theory and architecture of this subsystem were described in [2,4]. Briefly, the main idea is as follows. The combined static-and-dynamic approach is used for the time estimation purposes. During a compilation, the static analysis of the C code is being performed. For every linear code block in complex statement a prediction of execution time is being made. During a model run, when exact sequence of executed linear code blocks is known, the time estimate is being given on the base of static predictions. The mapping of computations to the target CPU architecture is implemented by the following way. A model of CPU architecture is being constructed which captures the essential features of a certain archtecture class, influencing on the execution time. For example, models of an von-Newmann sequential registerstack CPU and of a RISC CPU are supported now. For the register-stack CPU model. the algorithms of optimal code generation are implemented. The execution time estimate is based on the length of code generated [2]. During testing, the relative error of execution time prediction was in range of four to ten percents which is acceptable for practical use. The RISC CPU model enables you to determine statically the pipeline latencies due to data dependencies in instructions. Also, the instruction cache behaviour analysys could be done in the static phase. The architecture type of sequential executor can be specified by writing an identifier of the architecture, as follows: architec Intel286;

400

A.G. Bakhmurov, A.P. Kapitonova, R.L. Smeliansky

The architecture description itself (it can be rather awkward) is placed separately and specifies the clock rate, register structure and instruction set of an executor. For RISC processors this description contains also the pipelines structure, instruction processing scheme and cache configuration. Our time complexity estimation methodology was applied to the Motorola DSP96002 CPU. On the set of digital signal processing algorithms, a zero time prediction error was achieved, while the prediction time was 3 orders of magnitude less than emulation time (see [14]). 5.3

The Visualization Subsystem

This subsystem is intended to view the event trace collected during model run. Events are associated with interprocess communication and with the beginning and finishing of process internal actions. The collected trace could be viewed in the form of timing diagram (See Fig. 3). User is able to scroll and scale the diagram, to select the model components of interest for visualization, to get an additional information about event and state attributes by clicking on event (state). Also, an important feature is the capability to observe the logical links between events and to locate the corresponding piece of process’s text while browsing events. 5.4

The Performance Analysis Subsystem

This subsystem is useful when you need certain integrated performance indices (such as working time, idle time, processor utilization, message queue length etc). These indices can be computed and displayed as tables, graphs and histograms. The output data representation could be easily imported into third-party tools for advanced processing and report generation. 5.5

The Algorithmic Analysis Subsystem

This subsystem allows the user to specify the behaviour of software under development and to verify the software behaviour against specification. Under term ’behaviour’ we mean the partially ordered set of events (See [4] for details). For specification of properties of system being modeled, a special language was developed. The approach to specification and verification (with the previous version of this language) was described in [1]. This language named M 2 -SPEC permits: – to specify the actions of a process as relations between process states before and after an action; – to specify possible chains of actions using behavior expressions; – to specify the properties of a process and a whole system behavior as predicates on behavior expressions;

DYANA: An Environment for Embedded System Design and Analysis

401

An important feature of M 2 -SPEC is: its syntax is close to one of M 2 -SIM , but the semantics of M 2 -SPEC is equivalent to one of the branching time logic. For the following two problems algorithms are developed and prototyped now: checking the consistency of specification itself; verifying the specification against the model description on the M 2 -SIM . More detailed description of the M 2 -SPEC could be found in [5]. 5.6

The Integrated Development Environment

Notes on Technology of Model Development. As we have noted above, one of the goals of M 2 -SIM development is to support the top-down design. That is, to let the user to start from the large-grain model picking up only general structure of system to be simulated and ignoring small-grain details. Gradually, step-by-step small details are refined, more and more detailed models are developed. Such an stepwise detail should be performed in three directions. 1. Structure detail implies the detail of component’s internal structure. Such a feature is provided by independence of the distributed programs and the executors description on internal structure of subcomponents. Because of modularity, changes in any part of the model does not require changing (and even recompiling) of other parts. 2. Action detail (i.e. move from simple prototyping of a process interface to real data processing). This kind of detail is provided by two ways to time complexity specification — the delay statement (it sets the model time delay explicitly but specify no computations) and the complex statement (it specifies computations, and model time delay is estimated by the special subsystem). 3. Message type and structure detail (i.e., for example, going from checking message type only to analysis of message contents). To support such a detail, there exist two families of operators on msg-variables — the former use message type only, the latter group provide an access to message fields. Integrated Development Environment Features. For increasing of efficiency of model building a special object-oriented instrumental environment was developed. This object-oriented IDE relieves the user from necessity of working with files. All objects are stored in the repository (database). Every object has a visual representation on screen. All objects are arranged into the hierarchy. Models are at the top level of this hierarchy. By means of the Model List window, the user can operate on the model as a single object (e.g. compile, run it). Objects forming a model fall to one of the following groups: source descriptions, internal representations, results of model run. For every type of model component (process, executor, message etc.), the IDE handles (and gives the user to operate on) the components lists, see Fig. 4.

402

A.G. Bakhmurov, A.P. Kapitonova, R.L. Smeliansky

Fig. 3. The Timing Diagram window

Fig. 4. IDE: the Model Components window

DYANA: An Environment for Embedded System Design and Analysis

403

A model component could be viewed and edited in different forms by user wish. Now textual and structural (schematic) presentations are supported. The main advantages of environment described above are as follows: 1. The usage of database provides the correspondence of external representation (e.g. screen images) of the set of descriptions with their internal organization. 2. the semantical and time dependencies between source text components could be watched more accurately, which reduce the overheads during assembling compiled model. We should highlight an important feature of developed environment — the interface description of a component can be combined with more than one version of component implementation, the implementations may be either sequential or parallel. This feature lets: 1. to perform the stepwise detail, with possibility to get back to earlier stages of development at any time; 2. to experiment with different configurations of developed and debugged model (e.g. with different versions of components implementations), what is the final goal of the user of simulation system.

6

Conclusion

The DYANA environment described in this paper is directed to the following: – description of software and hardware (on the systems level) with variable degree of detail; – analysis of various aspects of computer system’s behaviour without hardware prototyping. The DYANA environment enables the user as to develop programs through simulation as to choose the proper hardware configuration. For our point of view, the most interesting features of the project are as follows: – the duality of analysis methods; – the time complexity estimation which helps to avoid the target architecture emulation. Now the prototype system is implemented in the Sun Solaris environment. The DYANA system was tested in the following areas: – performance analysis of local area networks; – software design and development for embedded systems.

404

A.G. Bakhmurov, A.P. Kapitonova, R.L. Smeliansky

The DYANA system is being used now in the EEC INCO-Copernicus Project DRTESY 1 which is aimed at evaluation (and mutual enhancement) of tools provided by project partners on a common realistic case study from the field of embedded avionics system design. Much attention will be paid to the time complexity reduction of our algorithmic analysis methods. The nearest goals of the future work are also: – to spread the database approach to trace storage and processing; – to develop the library of CPU models for those RISC processors which are used in embedded computer systems; – to build a library of reusable ’basic blocks’ suitable for modelling of networks and embedded hardware and software components.

References 1. R.L. Smeliansky, Yu.P. Kazakov, Yu.V. Bakalov, The combined approach to the distributed computer system simulation, in Proc Conference on Parallel Computing Technologies, Novosibirsk, Scientific Centre, Sept. 1991. 2. A.P. Kapitonova, I.A. Terehov, R.L. Smeliansky, The instrumental system for estimation of computational complexity in programs, MSU Press, Moscow 1991 (in Russian). 3. R.L. Smeliansky, Program behavior invariant as the basis for system performance estimation, in Proc Conference on Parallel Computing Technologies, Obninsk, Russia, Sept. 1993. 4. R.L. Smeliansky, Distributed computer system operation model, Moscow University Computational Mathematics and Cybernetics, 3(1990), p. 4-16. 5. Yu. Bakalov, R. Smeliansky, M 2 -SPEC : A Language for Distributed Program Behaviour Specification. Proc. of PARCELLA-96 Berlin, 1996. 6. B. Selic, G. Gullelson, J. McGee, and I. Engelberg, ”ROOM: An Object-Oriented Methodology for Developing Real-Time Systems”, in Proc. 5th International Workshop on CASE, Montreal, Canada, 1992. 7. T.Lewis, The next 10,0002 years. Computer, April, 1996, pp.64-71 8. O.Tanir, S.Sevinc, Defining Reguirements for a Standart Simulation Environment. Computer, February, 1994, pp.28-34. 9. M. Rosenblum et. al., Using the SimOS Machine Simulator to Study Complex Computer Systems. ACM Trans. on Modelling and Computer Simulation, V. 7, No. 1, January 1997, P.78-103 10. Telelogic home page http://www.telelogic.se/ 11. Ptolemy project home page http://ptolemy.eecs.berkeley.edu 12. Y. Kazakov, R. Smeliansky, Organization of synchronization algorithms in distributed simulation, in Proc. of 2nd Russian-Turkish seminar ’New High Information Technologies’, May 9-12, 1994, Gebre, Turkey. 13. ObjecTime Limited home page, http://www.objectime.com 14. V.V. Balashov, A.P. Kapitonova, V.A. Kostenko, R.L. Smeliansky, N.V. Youshchenko, Modelling of digital signal processors based on the staticdynamic approach, in Proc. of the 1st International Conference ”Digital Signal Processing and its Applications”, June, 30th – July, 3rd, 1998, Moscow.

10.1007/b107031130027 1

http://www.first.gmd.de/ drtesy/

Path Exploration Tool Elsa L. Gunter and Doron Peled Bell Laboratories 600 Mountain Ave. Murray Hill, NJ 07974, USA December 30, 1998 Abstract

While verication methods are becoming more frequently integrated into software development projects, software testing is still the main method used to search for programming errors. Software testing approaches focus on methods for covering dierent execution paths of a program, e.g., covering all the statements, or covering all the possible tests. Such coverage criteria are usually approximated using some add-hoc heuristics. We present a tool for testing execution paths in sequential and concurrent programs. The tool, path exploration tool Pet, visualizes concurrent code as ow graphs, and allows the user to interactively select an interleaved execution path. It then calculates and displays the condition to execute such a path, and allows the user to easily modify the selection in order to cover additional related paths. We describe the design and architecture of this tool and suggest various extensions.

1

Introduction

Software testing techniques 4 are frequently used for debugging programs. Unlike software verication techniques, software testing is usually less systematic and exhaustive. However, it is applicable even in cases where verication fails due to memory and time limitations. Many testing techniques are based on criteria for covering execution paths. Conditions are sought for executing the code from some point A to some point B , and the code is walked through or simulated. Di erent coverage criteria are given as a heuristic measure for the quality of testing. One criterion, for example, advocates trying to cover all the executable statements. Other criteria suggest covering all the logical tests, or all the ow of control from any setting of a variable to any of its possible uses 9. Statistics about the e ectiveness of di erent coverage approaches used are kept. W .R . C le a v e la n d ( E d .) : T A C A S /E T A P S ’ 9 9 , L N C S 1 5 7 9 , p p . 4 0 5 - 4 1 9 , 1 9 9 9 . © S p rin g e r-V e rla g B e rlin H e id e lb e rg 1 9 9 9

4 0 6

E ls a L . G u n te r a n d D o ro n P e le d

In this paper, we present a new testing approach and a corresponding testing tool. The focus of the analysis is an execution path in a sequential code, or on interleaved execution paths consisting of sequences of transitions from dierent concurrent processes. The system facilitates selecting such paths and calculating the conditions under which they can be executed. It also assists in generating variants of this path, such as allowing dierent interleavings of the path transitions. The code of the checked programs is compiled into a collection of interconnecting ow graphs. The system calculates the most general condition for executing the path and performs formula simplication. We present the tool's architecture and demonstrate its use. The system's architecture includes: An SML program that takes processes, written using Pascal-like syntax, and produces their corresponding ow graphs. A DOT program that is used to help obtain an optimal display of the ow graphs, representing the dierent processes. A TCL TK graphical interface that allows selecting and manipulating paths. An SML program that calculates path conditions and simplies them. An HOL decision procedure that is used to further simplify the path conditions by applying a Presburger arithmetic decision procedure.

2 System Architecture Research in formal methods focuses mainly on issues such as algorithms, logics, and proof systems. Such methods are often judged according to their expressiveness and complexity. However, experience shows that the main obstacles in practically applying such technology into practice are more mundane: it is often the case that new proof techniques or decision procedures are rejected because the potential users are reluctant to learn some new syntax, or perform the required modeling process. One approach to avoiding the need for modeling systems starts at the notation side. It provides design tools that are based on a simple notation such as graphs, automata theory e.g., 8, or message sequence charts 1. The system is then rened, starting with some simplistic basic design. Such tools usually provide several gadgets that allow the system designer to perform various automatic or human assisted checks. There is some support for checking or guaranteeing the correctness of some steps in the renement of systems. Some design tools even support automatic code generation. This approach prevents the need for modeling, by starting the design with some abstract model, and

P a th E x p lo ra tio n T o o l

4 0 7

begin y1:=x y2:=1 while y1=100 or y2= =1 do begin if y1=100 then begin y1:=y1+11 y2:=y2+1 end else begin y1:=y1-10 y2:=y2-1 end end z:=y1-10 end.

Figure 1: Floyd's 101 program rening it into a full system. Using standard notation, such as message sequence charts 3 , conforms with the usual start of the design. On the other hand, automatic code generation is still add hoc, and it is not expected that the code generated would be e cient or elegant although it is, by denition, well documented. Our approach for testing is quite the complement to the above. After the software or parts of it is designed and coded, one checks its behavior under various conditions, or in various environments. One of the motivations of the Pet tool is to avoid the need for modeling, and allow the testing to be performed using a notation that is natural for the user. The tool automatically translates the code of the program to be checked into one of the earliest and most useful notations for software, namely that of ow graphs. The program is written as one or more processes in a syntax similar to Pascal. Figure 1 includes the code for Floyd's 101 program, as accepted by our tool. We use the combination = = = as inequality. The graphical interface includes a window for each process, displaying the original text, and a compatible window displaying the corresponding ow graph. The ow graph is a directed graph, with some edges carrying labels. Each node in a graph is one of the following: begin, end, test, wait, assign. The begin and end nodes appear as ovals, the test and wait nodes appear as diamonds, labeled by the test condition, and the assign nodes appear as boxes labeled by

4 0 8

E ls a L . G u n te r a n d D o ro n P e le d

the assignment. There is no out edge from an end node, two out edges from a test node, and one out edge from all other nodes. The two out edges from a test node are labeled, one by yes" and one by no". The ow graph that is generated for the program in Figure 1 appears in Figure 2. The focus objects of the tool are the execution paths. Path information is displayed using two additional windows. One window displays the recently selected execution path, and the other displays the most general condition to execute the selected path. In order to maintain the connection between the code and the model the ow graph , the dierent windows are context sensitive: pointing at a node e.g., a test or an assignment box in a ow graph window would highlight the corresponding code in the process source window.1 . A selected path in the 101 program appears in Figure 3. Each transition appears within parentheses that correspond to its shape and color in the ow graph. Inside the parentheses there is a pair corresponding to the process name, and the number of the transition as appears in the ow graph . If several processes are involved, transitions of dierent processes appear with dierent amount of indentation from the left margin. If the coursor points at a transition listed in this window, the corresponding item in the ow graph and the corresponding text will be highlighted. 2.1 Path Operations Software testing is based on inspecting paths. Therefore, it is of great importance to allow convenient selection of execution paths. Dierent coverage techniques suggest criteria for the appropriate coverage of a program. Our tool leaves the choice of paths to the user. A future version, where various path selection criteria will be used to automatically suggest the tested paths, is under construction. Once the source code is compiled into a ow graph, or a collection of ow graphs, the user can choose the test path by clicking on the appropriate constructs on the ow graphs. The selected path appears also in a separate window, where each line lists the selected node, the process and the shape the lines are also indented according to the number of the process to which they belong . In order to make the connection between the code, the ow graph and the selected path clear, sensitive highlighting is used. For example, when the cursor points at some node in the path window, the corresponding node in the ow graph is highlighted, as is the corresponding text of the process. Once a path is xed, the condition to execute it is calculated. The tool allows altering the path by removing nodes from the end, in reverse order, or appending to it new nodes. This allows, for example, the selection of an alternative choice for a condition, after the nodes that were chosen past that condition are removed. 1 Our choice was, in the case of a test, to highlight the entire minimal programming construct that is associated with it, such as an if-then-else statement or a while loop.

P a th E x p lo ra tio n T o o l

Figure 2: A ow graph for the program in Figure 1

4 0 9

4 1 0

test6 test6 test6

test6

test6 test6 test6

test6 test6 test6

E ls a L . G u n te r a n d D o ro n P e le d

: : : : : : : : : :

0 1 2 8 7 5 6 8 9 10

Figure 3: A selected path in the 101 program Another way to alter a path is to use the same transitions but allow a dierent interleaving of them. When dealing with concurrent programs, the way the execution of transitions from dierent nodes are interleaved is perhaps the most important source of problems. The Pet tool allows the user to ip the order of adjacent transitions on the path, if they belong to dierent processes. It is easy to check that, by repeatedly ipping the order in this way, one can obtain any possible execution of the selected transitions. 2.2 Path Condition The most important information that is provided by Pet is the condition to execute a selected path. An important point to note is that an execution path in a set of ow graphs is really a sequences of edges, which when restricted to each of the processes involved, forms a contiguous sequence. However, when specifying an execution path, it seems most natural to give a selection of nodes to be executed. For most nodes, there is a one-to-one correspondence between the nodes in a ow graph and their out edges. The subtle case is when a test node is selected. Selecting such a node does not tell us how it executed, since the condition may be either true or false. The execution of a test is determined by whether its yes" or no" out edge was selected, which we can know by knowing the successor node to the test in the same process. Thus, if a test node is the last transition of some process in the selected path, it would not contribute to the path condition, as the information about how it is executed is not given. Let = s1 s2 : : : sn be a sequence of nodes. For each node si on the path, we dene: typesi  is the type of the transition in si . This can be one of the following: begin, end, test, wait, assign. procsi  is the process to which si belongs.

P a th E x p lo ra tio n T o o l

cond si 

4 1 1

is the condition on s , in case that s is either a test or a wait node. branch s  is the label on a node s which is a test if it has a successor in the path that belongs to the same process, and is undened" otherwise. expr s  is the expression assigned to some variable, in case that s is an assign statement. var s  is the variable assigned, in case s is an assign statement. pv=e is the predicate p where all the free occurrences of the variable v are replaced by the expression e. The following is the algorithm used to calculate the path condition. Notice that it is calculated from the tail of the path to the head. i

i

i

i

i

i

i

i

current pred := `true' for i := n to 1 step -1 do begin case type s  do test

i

case branch s  do `yes' current pred := current pred^cond s  `no' current pred := current pred ^:cond s  `undened' current pred := current pred end case i

i

i

wait

current pred := current pred^cond s 

assign

i

current pred := current pred  var s =expr s  end case simplify current pred end i

i

It is interesting to note that the meaning of the calculated path condition is dierent for sequential and concurrent programs. In a sequential program, consisting of one process, the condition expresses all the possible assignments that would ensure executing the selected path, starting from the rst selected node. When concurrency is allowed, the condition expresses the assignments that would make the execution of the selected path possible. Thus, when concurrency is present, the path condition does not guarantee that the selected path is executed, as there might be alternatives paths with the same variable assignments.

4 1 2

E ls a L . G u n te r a n d D o ro n P e le d

0 :s ta rt

0 :s ta rt

1 :a := 5

1 :a := 2

2 :e n d

2 :a = 5 !

3 :e n d

Figure 4: Two simple concurrent processes In Figure 4, an example of two simple processes that share the variable a is given. The pascal code for the processes is as follows: C1: begin a:=5 end

C2: begin a:=2 wait a=5 end

Consider the following path: C1 : C2

C2

C1 : C2 C2 C1 :

0 : 0 : 1 1 : 2 : 3 2

In this path, the `a := 5' of the rst assignment is executed after the `a := 2' and hence the wait condition can be passed, and the path can be completed. This does not depend on the value of any variable. Thus, the path condition is `true'. If we choose now to switch the third and the fourth lines, e.g., the two assignments to the variable a, the path cannot be passed, independent of any initial values of the variables. Thus, in this case the path condition is `false'.

P a th E x p lo ra tio n T o o l

4 1 3

Switching the order between a pair of adjacent transitions is done by moving the mouse to the rst transition in the pair and clicking a mouse button. The tool does not allow the unreasonable choice of permuting transitions that belong to the same process.

2.3 Formula Simplication

The primary information object that is provided by the Pet tool is that of a quantier free rst order formula, describing the condition under which a path is executed. In the prototype developed, we assume that the mathematical model is that of arithmetic over the integers. As shown in the previous subsection, these conditions are calculated symbolically, and can therefore be quite complicated to understand. In most cases, the automatically generated expression is equivalent to a much simpler expression. Simplifying expressions is a hard task. For one thing, it is not clear that there is a good measure in which one expression is simpler than the other. Another reason is that in general, deciding the satisability or the validity of rst order formulas is undecidable. However, such limitations should not discard heuristic attempts to simplify formulas, and for some smaller classes of formulas such decision procedures do exist. The approach for simplifying rst order formulas is to try rst applying several simple term-rewriting rules in order to perform some common-sense and general purpose simplications. In addition, it is checked whether the formula is of the special form of Presburger arithmetic, i.e., allowing addition, multiplication by a constant, and comparison. If this is the case, one can use some decision procedures to simplify the formula. The simplication that is performed includes the following rewriting: Boolean simplication, e.g., ' ^ true is converted into ', and ' ^ false is converted into false .  Eliminating constant comparison, e.g., replacing 1  2 by false.  Constant substitution. For example, in the formula x = 5 ^ ', every free occurrence of x in ' is replaced by 5.  Arithmetic cancellation. For example, the expression x + 2 , 3 is simplied into x , 1, and x  0 is replaced by 0. However, notice that x=2  2 is not simplied, as integer division is not the inverse of integer multiplication. In case the formula is in Presburger arithmetic, we can decide 7 if the formula ' is unsatisable, i.e., is constantly false, or if it is valid, i.e., constantly true. The rst case is done by deciding on :9x1 9x2 : : : 9xn ', and the second case is done by deciding on 8x1 8x2 : : : 8xn ', where x1 : : : xn are the variables that appear in '. If the formula is not of Presburger arithmetic, one can still

4 1 4

E ls a L . G u n te r a n d D o ro n P e le d

try to decide whether each maximal Presburger subformula of it is equivalent to true or false. Another way of using the decision procedure for Presburger arithmetic is to check whether there are variables that are not needed in the formula, and can hence be discarded. For example, consider a Presburger arithmetic formula 'x1  x2  : : : xn . We can check whether the formula depends on the variable xn by checking 8x1 8x2 : : : 8xn,1 8xn 8xn 0 'x1  x2  : : :  xn  $ 'x1  x2  : : :  xn 0  Then, if this formula is true, we can replace xn by 0 everywhere.

2.4 Implementation

The Pet system consists mainly of a graphical interface, and a program that is responsible for compilation and calculation, as described in Figure 5. The graphical interface is responsible for selection and update of execution paths. It was implemented in TCLTK. Compilation and calculations are done via an SML program. The language SML was selected since it allows simple and e cient symbolic manipulations such as subformula substitution. The SML program is running as a server process. It receives requests for processing from the graphical interface. One such request is of the form

le processname and results in the compilation of the process to a ow graph. Another type of request is of the form path processname:node : : : processname:node with a reversed selected path. The SML program calculates the weakest most general condition to execute the path, and returns it to the graphical interface for display. The SML program informs the graphical interface when compilation is done, and also prepares several les, which the graphical interface uses. These les are:  A DOT le, including the description of the ow graph that corresponds to the compiled process according to the DOT syntax see Unix manual, or 6. This allows using the DOT program in order to draw the graph.  An adjacency list, specifying for each node of the graph its immediate successor. This information allows the graphical interface to control path selection.  A list of pointers to the beginning and end of the text that corresponds to each graph item. This le allows connecting the ow graph with the text windows, so that the text corresponding to the currently selected node is highlighted.

P a th E x p lo ra tio n T o o l

c a lc u la tio n re q u e st G ra p h ic a l In te rfa c e T C L /T K G ra p h a llo c a tio n re q u e st G ra p h d ra w in g

c a lc u la te d re s u lts

4 1 5

C o m p ila tio n a n d s y m b o lic c a lc u la tio n S M L

In p u t file s G ra p h la y o u t

file s p re p a re d fo r in te rfa c e file s y s te m * .te x t, * .d o t * .a r r a y

d o t

Figure 5: General architechture of Pet system The graphical interface makes use of the DOT program to draw ow graphs. The SML code prepares a DOT le, which describes the nodes, arrows and text of the ow graph. The DOT program processes this le and produces a layout for a visual description of the graph. It produces another DOT le, where the graph objects are annotated with specic coordinates. The TCLTK graphical interface reads the latter le and uses it to draw the graph. The SML program is compiled under the HOL environment. This allows using the Presburger Arithmetic decision procedure that is included in HOL to be used for simplifying arithmetic expressions by our system.

3 Examples Consider the simple protocol in Figure 6, intended to obtain mutual exclusion. In this protocol, a process can enter the critical section if the value of a shared variable turn does not have the value of the other process. The code for the rst process is as follows:

4 1 6

E ls a L . G u n te r a n d D o ro n P e le d

0 :s ta rt

0 :s ta rt

5 :tru e ? y e s

n o

2 :tu rn = 1 ?

6 :e n d

1 :n o -o p

n o

2 :tu rn = 0 ?

n o

y e s

5 :tru e ? y e s

y e s 3 :c ritic a l

1 :n o -o p

4 :tu rn := 1

6 :e n d n o 3 :c ritic a l

4 :tu rn := 0

Figure 6: A mutual exclusion example begin while true do begin while turn=1 do begin * no-op * end * critical section * turn:=1 end end.

The second process is similar, with constant values 1 changed to 0. When we select the following path, which admits the second process mutex1, while the rst process mutex0 is busy waiting as follows: mutex0 : mutex1 mutex1 mutex0 : mutex1 mutex0 : mutex1 mutex0 :

0 : 0 : 5 5 : 2 2 : 3 1

we get the path condition turn = 1, namely that the second process will get rst into its critical section if initially the value of the variable turn is 1. When we check a path that gets immediately into both critical sections, namely: mutex0 : 0

P a th E x p lo ra tio n T o o l mutex1 mutex1 mutex0 : mutex0 : mutex1

mutex0 :

mutex1

4 1 7

: 0 : 5 5 2 : 2 3 : 3

= 1 ^ turn 6= 0. This condition suggests that we will not get a mutual exclusion if the initial value would be, say, 3. This indicates an error in the design of the protocol. The problem is that a process enters its critical section if turn is not set to the value of the other process. This can be xed by allowing a process to enter the critical section if turn is set to its own value.

we get a path condition turn

4

6

Extensions and Future Work

In this section, we describe work in progress, and planned extensions of the tool. The current implementation of the Pet tool provides a basic framework for testing sequential and interleaved execution paths. The implementation was designed to support adding many testing techniques and features. Software testing suggests various coverage criteria. For example, one might want to check paths that involve at least every executable statement, or paths from a statement where a variable is set to all or some of the statements where it is used 9 . Integrating such coverage techniques into our tool can be done by assisting the selection of a path according to such criteria. For example, when selecting an assignment node, the Pet tool can suggest all the possible nodes where the variable that is assigned is later used. These nodes are highlighted using a color dierent from the other nodes, and the user can select one of them. The Pet tool can then extend the current path with a shortest path from the current node to the node selected. Statistics about the quality of coverage can be collected. Another extension deals with testing of dierent interleavings that are formed from a given set of transitions. Interleaving concurrent transitions in dierent orders is a main pitfall in concurrent programming. Currently, support is given to interleave transitions of dierent processes in various ways by commuting between them. An extension is being developed in order to facilitate a more e cient and thorough inspection of dierent interleaved sequences. The main idea is that many permutations of concurrently executed transitions do not lead to dierent results. For example, consider two transitions that involve completely dierent variables. Instead of only allowing the user to select particular adjacent transitions that will be commuted, the tool will successively generate dierent permutations of the selected interleaved sequences.

4 1 8

E ls a L . G u n te r a n d D o ro n P e le d

Using the compiled knowledge about the variables assigned and used by the transitions, a dependency relation between the transitions can be calculated 2. The tool will calculate the next permutation that is not equivalent to the current one up to permuting adjacent independent transitions. If it is equivalent, the path condition is guaranteed to be the same. The new permutation will then be displayed and the new path condition will be calculated. Thus, the tool will help the user to cycle between di erent interleaved sequences that may give rise to di erent behaviors. One can formalize this feature as presenting to the user di erent representatives for Mazurkiewicz traces 5. This extension is also connected to the suggested path: if one uses the system's recommendation about how to continue a path from each given state, one does not have to worry about how to interleave these paths, as a systematic and exhaustive search of the interleavings can be performed. Of course, one has to be careful, as permuting interleaved sequences can lead to exponential number of possibilities. Another direction of future development is to expand the programming language in which we require the programs to be written to include arrays and other data types, and to include subroutines. For arrays, the diculty is calculating the precondition when array subscripts are given by complex arithmetic expressions. We are also exploring di erent ways of presenting information to the user. Although the path conditions are in many cases simple to understand, there are cases where the user may nd them dicult to use. Allowing the user to supply various nite ranges for the program variables enables the system to check whether there are values in the given range that satisfy the path conditions. Finally, program slicing 10 can be used to extract projections of the program statements that a ect a variable at a particular location. Such an analysis can also be calculated and displayed using our graphical interface.

References 1 R. Alur, G. Holzmann, D. Peled, An Analyzer for Message Sequence Charts, Software: Concepts and Tools, 17 1996, 7077. 2 S. Katz, D. Peled, Dening conditional independence using collapses, Theoretical Computer Science 101 1992, 337-359. 3 ITU-T Recommendation Z.120, Message Sequence Chart MSC, March 1993. 4 G.J. Myers, The Art of Software Testing, John Wiley and Sons, 1979. 5 A. Mazurkiewicz, Trace Theory, Advances in Petri Nets 1986, Bad Honnef, Germany, LNCS 255, Springer, 1987, 279324.

P a th E x p lo ra tio n T o o l

4 1 9

6 E. Koutsoous, S.C. North, Drawing Graphs with dot, available on research.att.com in distdrawdagdotguide.ps.Z. pn

7 D.C. Oppen, A 222 Upper Bound on the Complexity of Presburger Arithmetic, Journal of Computer and System Sciences 16, 1978, 323-332. 8 B. Selic, G. Gullekson, P.T. Ward, Real-Time Object-Oriented Modeling, Wiley, 1993. 9 S. Rapps, E.J. Weyuker, Selecting Software Test Data Using Data Flow Information, Transactions on Software Engineering 114: 367-375 1985. 10 M. Weiser, Program Slicing, IEEE Transactions on Software Engineering, 104, 1984, 352357.

10.1007b107031130028

Modular State Level Analysis of Distributed Systems Techniques and Tool Support Peter Buchholz, Peter Kemper Informatik IV, Universit¨ at Dortmund D-44221 Dortmund, Germany

Abstract. Techniques from different areas are combined to analyze parallel and distributed software within a common framework. They include bisimulation equivalences known from process algebras, Kronecker representations of labelled (stochastic) transitions systems known from performance analysis using Markov chains, and ordered natural decision diagrams (ONDDs) as a generalization of ordered binary decision diagrams famous in hardware verification as well as for the analysis of Boolean functions in general. The employed analysis tools are all part of a toolbox built on the abstract Petri net notation (APNN), a model interchange format using Petri nets. In this context we experience a cross fertilization of different research fields within a Petri net context. We exercise Lamport’s mutual exclusion algorithm to discuss the strengths and limitations of the presented approach. Keywords: Software analysis, Petri nets, Kronecker algebra, bisimulation, ordered natural decision diagrams, model checking

1

Introduction

Development of correct and efficient parallel and distributed software is by no means a trivial task. Many formalisms have been developed to obtain a clear distinction between sequential and parallel elements of a task. A popular point of view is to consider such systems as a set of communicating sequential processes, e.g. in modeling formalisms like CCS [20], CSP [14], automata networks [1], and superposed generalised stochastic Petri nets [12], but also for programming interfaces like MPI, PVM, or distributed C (EPOCA). Communication between processes is either asynchronous (by message passing) or synchronous (rendezvous), where the latter is more general, since every asynchronous communication operation can be easily described using synchronous communication primitives (see [20]), whereas the representation of synchronous communication using asynchronous primitives is much harder to realize. Thus synchronous communication is usually used in low level formalisms supporting functional analysis, whereas asynchronous communication is often part of high level paradigms for parallel or distributed programming. Since this paper focuses on model based analysis, we consider synchronous communication. Concurrent programs have a potential for speed up due to parallel execution but carry the crux of potential deadlock and other unexpected, undesired behavior. Consequently functional analysis of parallel programs is an important W.R. Cleaveland (Ed.): TACAS/ETAPS’99, LNCS 1579, pp. 420–434, 1999. c Springer-Verlag Berlin Heidelberg 1999 

Modular State Level Analysis of Distributed Systems Techniques

421

topic. A classical brute force approach is the enumeration of all possible cases, which results in a set of reachable states. Its general drawback is the state space explosion problem: even trivial examples can cause excessive dimensions in state spaces. Various techniques have been developed in different research areas to handle this problem at least for certain special, but still relevant cases and up to large dimensions of state spaces. Examples of such techniques are: ordered binary decision diagrams (OBDDs) for verification, Kronecker representations for performance analysis, also useful for model checking, reduction of components according to equivalences in Process algebras to mention only a few examples. We consider combinations of such concepts and demonstrate how they fit together for the analysis of concurrent software. We exercise Lamport’s mutual exclusion algorithm as a small example to indicate the strengths and limitations of our approach. The software tools we present belong to a much larger set of tools around a model interchange format named “abstract Petri net notation” (APNN) [4] and its toolbox [3]. The paper is organized as follows: Section 2 describes the combination of different methods to represent and analyze models of synchronously communicating components. These methods include directed acyclic graphs for state space representation, Kronecker operations to describe transition relations and equivalences to reduce components before composition. Afterwards, in Sect. 3, we introduce a toolbox which supports modular analysis approaches. In Sect. 4, the modular analysis of a non-trivial example is presented. The paper ends with the conclusion including an outline of further work.

2

Representation and Analysis of Synchronized Processes

A set of processes can be but need not be sequential, hence we allow for atomic operations, sequences of such operations, and fork and join inside a process. Communication takes place via synchronous interaction. This scenario can be formalized in various manners, e.g. as process algebras like CCS [20] (if elementary processes are sequential) or as Petri nets with superposition of transitions or as automata with synchronization. We initially consider Petri nets for modeling and visualization and mainly automata for subsequent analysis. The well known dining philosopher problem serves as a running example. A philosopher shows four activities: he or she thinks, gets two forks, eats, and puts two forks back. N philosophers sit around a table and share a total of N forks, i.e. philosopher i shares a fork to his left with i − 1 and to his right with i + 1 - the index is applied modulo N to match the cyclic setting of philosophers. We model this by a set of N processes, where each process relates to one philosopher and the fork to his left. The i-th process is synchronized with the i + 1-th and i − 1-th via access of forks. This example can be nicely visualized and formalized as a Petri net. Definition 1. Place/transition net A P/T-net is a 5 tuple (P, T, I − , I + , M0 ) where P and T are non-empty, finite, and disjoint sets, P ∩ T = ∅, I − , I + : P × T → IN0 are the incidence functions and M0 : P → IN0 is the initial marking, as a special case of a marking M : P → IN0 .

422

Peter Buchholz, Peter Kemper

p ro c e ss_ i

p _ th in k _ i

p _ th in k _ i+ 1

th in k _ i

th in k _ i+ 1

p _ g e t_ i

p _ g e t_ i+ 1 g e t_ i

g e t_ i-1 g e t_ i

fo rk _ i

n _ fo rk _ i

g e t_ i+ 1

p _ e a t_ i

p _ e a t_ i+ 1 fo rk _ i+ 1

n _ fo rk _ i+ 1 e a t_ i

e a t_ i+ 1

p _ p u t_ i

p _ p u t_ i+ 1

p u t_ i+ 1

p u t_ i p u t_ i-1

p u t_ i

Fig. 1. A dining philosopher with one of his forks An advantage of P/T-nets is their visual representation, where places are circles, transitions are boxes and incidence functions are directed, weighted arcs where arc weights of 1 are frequently omitted for readability. The initial marking is represented either as a number of dots (tokens) or numbers at the corresponding places. Let •t = {p ∈ P |I − (p, t) > 0} denote the preset of a transition t, and t• = {p ∈ P |I + (p, t) > 0} denote the postset. The left part of Fig. 1 indicates a philosopher process i of our example with his fork to his right and the right part of Fig. 1 indicates the neighboring process i + 1. The dynamic behavior of a P/T-net results from the enabling and firing of its transitions: a transition t is enabled at a marking M if M (p) ≥ I − (p, t) for all p ∈ •t, e.g. the initial marking in Fig. 1 enables transitions think i and think i + 1. An enabled transition t at marking M fires and yields successor marking M  (p) = M (p)+I + (p, t)−I − (p, t). Starting from the initial marking M0 , successive application of the firing rule for all enabled transitions yields the set of reachable markings and a reachability graph. The latter is a directed graph, where nodes are given by the set of reachable markings and arcs result from the firing of transitions. If arcs are labeled with the corresponding transition identifier, we obtain a labeled state transition system. The set of reachable markings of an isolated P/T-net of process i is given in the table to the right of Fig. 2, index i is omitted for readability and only places with a marking greater than 0 are denoted. We consider P/T-nets with synchronization: two P/T-nets are synchronized by fusion of those transitions which are selected for synchronization. This allows to describe processes with synchronization of rendez-vous type in a natural manner, e.g. Fig. 1 shows two philosopher i and i + 1 which are synchronized by merging transition get i and put i. A general concept of synchronization uses labels for transitions, i.e., each transition is labeled with some label from a finite set of labels. In a composition identically labeled transitions are fused. A similar form of synchronization is used

Modular State Level Analysis of Distributed Systems Techniques g e t_ i+ 1

g e t_ i+ 1

0

1

0

1

p u t_ i+ 1 th in k _ i

p u t_ i+ 1 th in k _ i

g e t_ i+ 1 2

g e t_ i+ 1 3

2

3

p u t_ i+ 1 p u t_ i

g e t_ i

p u t_ i+ 1 p u t_ i 4

g e t_ i

4 e a t_ i 5

423

index 0 1 2 3 4 5

marked places p think fork p think no fork p get fork p get no fork p eat p put

5

Fig. 2. Reachability graph of philosopher with one fork and its reachability set in process algebras [20] and different classes of Petri-Nets [5,6]. If the reachability set is finite, then the reachability graph of a P/T-net can be interpreted as a finite automaton. Transition labels in the automaton result from the corresponding transition labels in the P/T-net. We will not further consider P/T-nets, because all analysis steps we present in the sequel make use of the description of a system as a set of synchronized automata. Whether the automata result from the reachability graph of a Petri-net or the derivation graph of a process algebra specification is not relevant for the analysis. We have used a Petri-net formalism for specification since it has a nice visual representation. However, for other purposes process algebras might be more adequate to specify components. Definition 2. An automaton is a 4 tuple A = (S, δ, s0 , L) where S = {0, 1, . . . , n−1}1 is the set of states with cardinality n and initial state s0 ∈ S. δ ⊆ S×S×L is the state transition relation for a finite set of labels L, where a state transition from a state sx to a state sy carries a label l ∈ L, such that (sx , sy , l) ∈ δ. We consider non-deterministic automata, such that δ is a relation and not necessarily a function. An automaton can be represented as an node and arc labeled graph, e.g. by the reachability  graph of Petri net, or represented as a sum of boolean adjacency matrices l∈L Ql where Ql (x, y) = 1 if (sx , sy , l) ∈ δ and 0 otherwise. The reachability graph of a dining philosopher is shown on the left side of Fig. 2 and can be represented by 6 matrices including all together 9 nonzero elements. It is often not necessary to distinguish all labels at the automata level. Thus we adopt the hiding mechanism of process algebras and use the convention that transitions which need not be distinguished result in unlabeled arcs in the automaton. If we consider in the example only those transitions that are required for synchronization, then we obtain the graph shown at the right side of Fig. 2. This graph can be represented by 5 matrices with 9 non-zero elements. For synchronization between a set of N automata A1 , A2 , . . . , AN we use the index to characterize the different automata and define the synchronized N automaton A = A1 |A2 | . . . |AN = (×N i=1 Si , δ, (s1 , s2 , . . . , sn ), ∪i=1 Li ) and the set of synchronization labels LS = {l ∈ L|∃i = j : l ∈ Li ∧ l ∈ Lj }. The number of (N states in Si is denoted as ni , which implies that ×N i=1 Si includes i=1 ni states. 1

The state space of an automaton is isomorphic to a finite set of integers, depending on the context we use the notation x and sx for the x-th state in the set.

424

Peter Buchholz, Peter Kemper

Synchronization is of the rendez-vous type and refers to equal labels in Ai and Aj , i.e. neither Ai nor Aj is able to perform l ∈ LS independently of the other after synchronization.  If one represents δ as l∈L Ql , the synchronization of automata yields a matrix description of δ in the dimension of the cross-product of automata. δ has a space efficient compositional representation as a sum of Kronecker products, see [11,22] . Definition 3. Kronecker product, Kronecker sum Let Q1 , . . . , QN be square matrices of dimension (k i × k i ) then their Kro(N )N necker product Q = i=1 Qi is defined by Q(x, y) = i=1 Qi (xi , y i ) where x = N i N i 1, gi = k i−1 gi−1 (for i > 1). The i=1 x gi and y = i=1 y gi with weights g1 = * * N ) i) N N i Kronecker sum B = i=1 Qi is then given by Q Iri i=1 Q = i=1 Ili where Ili , Iri are identity matrices of dimension li × li ,resp. ri × ri where ri = (i−1 j i (N j j=1 k , l = j=i+1 k and I(a, b) = 1 iff a = b and 0 otherwise. Kronecker operations do not only apply for real valued matrices but also for Boolean matrices if addition is defined as Boolean or and multiplication as Boolean and. We focus on Boolean matrices. A Kronecker product formalizes the operation of multiplying every matrix element of one matrix with all matrix elements of the other matrices; these products of matrix elements are arranged in lexicographical order in the resulting matrix, for more details see, e.g., [11]. The key observation is that the fact “synchronization successfully takes place if all processes agree (join) to the rendez-vous” can be formally expressed by the nonzero result of a product, i.e., if all terms are nonzero (= all processes agree), the synchronization can take place. If an automaton Ai is not involved in a synchronization for label l, i.e. if l ∈ Li , then we define Qil = I i , where the identity matrix I i is a matrix of dimension ni × ni . For l ∈ Li , Qil is a ni ×ni matrix representing all l-labeled transitions in automaton i. Hence one can  )N represent δ by l∈L i=1 Qil . This is an extremely space efficient representation (N ( of δ since for a i=1 ni × N i=1 ni matrix we use only |L| times N matrices of dimension ni × ni (where in practice a lot of matrices will be identity matrices I, that need not be stored at all). Let R denote the set of reachable states which results from the reflexive, transitive closure of δ including the initial state s0 . Obviously the set of reachable states R of A = A1 | . . . |AN is a subset of ×N i=1 Si due to synchronization. The set ×N i=1 Si can be represented as a tree structure of N levels, where nodes at a level i have ni sons such that a path in this tree corresponds to a state (s1 , . . . , sn ). If one extracts all paths from this structure which refer to unreachable states, one trivially obtains a representation of R, where nodes at a level i provide the reachable fraction of Si . Let R(s1 , . . . , si ) = {x ∈ R|x1 = s1 ∧ . . . ∧ xi = si } denote the subset of states in R which match the given states of automata 1, . . . , i. Then R(s1 , . . . , si ) refers to a subtree with a root node at level i + 1. Let the root node of a subtree be denoted as Ri (s1 , . . . , si−1 ), which is the subset of reachable states in Si for the context of states s1 , . . . , si−1 . This notion reflects a sort of conditional reachability set. Consequently R() = R refers to the whole tree and R1 () refers to the root node.

Modular State Level Analysis of Distributed Systems Techniques a )

( 0 ,1 ,2 ,3 ,4 ,5 )

( 0 ,2 ,4 ,5 )

( 0 ,2 )

( 0 ,2 ) ( 0 ,2 ) ( 1 ,3 ) ( 1 ,3 )

( 0 ,2 ,4 ,5 )

( 4 ,5 ) ( 4 ,5 )

( 0 ,2 )

8

8

4

2 2 ( 0 ,2 )

4

( 1 ,3 )

( 0 ,1 ,2 ,3 ,4 ,5 )

4 0

( 0 ,2 ) 2

2

( 1 ,3 ) 2

( 4 ,5 )

2

( 1 ,3 )

( 0 ,2 ) ( 0 ,2 ) ( 0 ,2 ) ( 0 ,2 )

c ) 4

( 0 ,2 ,4 ,5 )

( 1 ,3 )

( 0 ,2 ) ( 0 ,2 ) ( 1 ,3 ) ( 1 ,3 ) ( 4 ,5 ) ( 4 ,5 )

( 0 ,1 ,2 ,3 ,4 ,5 )

b )

2

425

1 2

8

( 0 ,2 ,4 ,5 ) 2

0 ( 0 ,2 )

2

4

2 8

2 0 ( 0 ,2 )

2 4

6 ( 1 ,3 )

0 2 ( 4 ,5 )

0

( 1 ,3 )

2

Fig. 3. Tree a) and 2 DAG representations b),c) of the reachability set for N=3 Fig. 3 a) shows a tree representation of the philosopher model with 3 processes. This model contains |R| = 32 reachable states of 63 = 216 potential states. The tree consists of 23 nodes and 22 arcs. It contains 32 paths to encode the triples which describe a state within ×3i=1 Si . Employing binary search at each node, one needs O(log ni ) to search a certain path (state). Nodes at a level i belong to a single automaton Ai , but these nodes can vary in their cardinality according to the conditional reachability. Several nodes and subtrees are equal, which indicates redundancy. As for ordered binary decision diagrams (OBDDs) isomorphic subtrees do not require more than a single representation. Two trees R(s1 , . . . , si ) and R(s1 , . . . , si ) are equal iff Ri (s1 , . . . , si−1 ) = Ri (s1 , . . . , si−1 ) and all pairs of subtrees R(s1 , . . . , si , si+1 ), R(s1 , . . . , si , si+1 ) with si+1 = si+1 are equal. Clearly at the bottom level, this simplifies to equality of sets RN (s1 , . . . , sN −1 ) = RN (s1 , . . . , sN −1 ). If we apply a folding operation similar to OBDDs in a bottom up manner we obtain a unique directed acyclic graph (DAG), whose set of paths is equal to the set of paths in the tree. A DAG representation of R save space, but the effort to find a state/path remains the same as in the tree representation. The corresponding DAG for the tree in Fig. 3 b) uses only 7 nodes, 14 arcs to represent 32 paths (triples, states). For some analysis algorithms, e.g. in performance analysis based on CTMC analysis [16,9], it is important to be able to assign specific information to a single state during analysis. For such algorithms a unique, bijective mapping m : R → {0, 1, . . . , |R| − 1} has to be known. If one applies a lexicographical order on states in R, m simply assigns an index according to this total order on the elements of R. The mapping for lexicographical order can be integrated into the DAG structure if one recognizes that one basically has to count the number of leaves to the left of the path of a state s in the tree. The cardinality of leaves is obviously equal among isomorphic subtrees such that it remains invariant under the folding operation, e.g. as indicated by arc labels in Fig. 3 b) for such cardinalities. Consequently, by assigning corresponding weights on arcs of the DAG, one is able to evaluate m for a path s1 , . . . , sN in the DAG by summation of arc weights at each node which leave from the left positions of si in Ri (s1 , . . . , si−1 ) plus the position of the sN in RN (s1 , . . . , sN −1 ). Clearly an

426

Peter Buchholz, Peter Kemper

implementation will precompute such weights to avoid the local summation at a node si . Fig. 3 c) provides these values as arc labels for our example. Note that the position of state (3,2,5) results from the summation of arc labels 20 and 2 and the position of s3 = 5 inside the leave node, which is 1, such that we obtain m(2, 3, 5) = 23, which is correct since m(0, 0, 0) = 0. So far we considered ways for space efficient representations of reachability graphs by Kronecker algebra and representations of reachability sets by DAGs. With these representations it is possible to perform analysis of models with very large state spaces. From the  DAG representation of R, reachability of a specific state can be decided in O( log ni ). From the Kronecker representation of δ, all successors of a state can be computed in a time proportional to the number of successor states. Within reachability analysis, the Kronecker representation can be further exploited using two observations: 1) transitions with labels l ∈ / LS can occur locally and independently in the components. Thus it is possible to define some canonical ordering among those transitions instead of considering all interleavings when computing successor states of a state during reachability analysis. 2) the state ordering defined due to the Kronecker representation im(N plies a perfect hash function such that a bit vector of length i=1 ni is sufficient to decide in O(1) whether a state has been reached or not. For details about the algorithm and its performance see [17]. A well known, but orthogonal approach to reduce complexity is state aggregation based on equivalence relations. The goal is to reduce the number of states and transitions but to retain the possibility to compute the required results. A successfull application requires an equivalence relation has to exist which preserves the required results and an aggregation algorithm which performs faster than the analysis of the original system. The latter usually requires a congruence relation with respect to composition via synchronous transitions, such that aggregation can be applied for each subsystem at the automata level and the combination of aggregated subsystems gives an aggregated but still equivalent overall system. In this case, the Kronecker representation is convenient to combine aggregation and composition, because aggregates are computed at the level of automata matrices yielding a matrix description of the aggregated automaton which can be used instead of the original matrices in the Kronecker representations. We briefly outline the steps of equivalence computation in the context of Kronecker based analysis. A large number of equivalence relations has been proposed in the literature (see e.g., [24] for equivalences in the context of Petri nets), especially equivalences of the bisimulation type are popular. An equivalence relation Ri ⊆ Si × Si is a bisimulation if for all (sx , sy ) ∈ Ri and all l ∈ Li : 1. Qil (x, z) = 1 implies Qil (y, z  ) = 1 for some z  with (sz , sz ) ∈ Ri and 2. Qil (y, z) = 1 implies Qil (x, z  ) = 1 for some z  with (sz , sz ) ∈ Ri . The bisimulation relation with the least number of equivalence classes can be computed for finite state systems as the fixed point of the following partition refinement Rk+1 = {(sx , sy )|(sx , sy ) ∈ Rki and i Qil (x, z) = 1 implies ∃z  with (sz , sz ) ∈ Rki such that Qil (y, z  ) = 1 and Qil (y, z) = 1 implies ∃z  with (sz , sz ) ∈ Rki such that Qil (x, z  ) = 1 },

Modular State Level Analysis of Distributed Systems Techniques

427

where R0i is some initial relation. For a bisimulation, initial relation R0i = Si ×Si is sufficient. Efficient algorithms to compute the fixed point are known [21,15] and implemented in analysis tools [10]. According to a bisimulation relation Ri , an aggregated automaton can be built by substituting every equivalence class by a single state. Let n ˜ i be the number of equivalence classes and Ri [˜ sx ] be the x-equivalence class. Then the aggregated automata is defined by n ˜i × n ˜ i matrices ˜ i with Q ˜ i (˜ Q ˜) = 1 if sx ∈ Ri [˜ sx˜ ] and sy ∈ Ri [˜ sy˜] with Qil (x, y) = 1 exist. All l l x, y ˜ i can then be used instead of Qi in the remaining elements are 0. Matrices Q l l Kronecker representation reducing the state space of the composed model by a factor of n ˜ i /ni . Since bisimulation is a congruence, the composed models using the original and aggregated model are bisimulation equivalent. Bisimulation relations can also be defined for modified forms of automata. A popular modification yielding a less discriminating equivalence results in hiding of some labels. We define a label l to be local for automaton i if l ∈ Li and l ∈ / LS. Let Lloc be the set of local  labels for automaton i. Observe that Qjl = I j for i i i l ∈ Lloc i and i = j. Let Qli = l∈Li Ql . It is easy to show that in the Kronecker loc

representation of δ the terms involving Qil (l ∈ Lloc i ) can be substituted by a j i j single term involving Qli and matrices Qli = I for j = i. In contrast to the original system, labels from Lloc can no longer be distinguished. Define i ∞ different i k (Qili )∗ = (Q ) . A transitive and reflexive closure algorithm computes li k=0 (Qili )∗ within O(ni 3 ). A bisimulation equivalence for the automaton results from (Qil )∗ = (Qili )∗ Qil (Qili )∗ for all l ∈ Li \ Lloc i . This equivalence relation hides the details of transitions from Lloc and still preserves the external behavior visible i via labels l ∈ Li \ Liloc . Corresponding bisimulations are usually denoted as weak bisimulations. Labels which should not be observed in functional analysis and which are not required for synchronization can be collected in Lloc and hidden i in the aggregated automaton. So far, bisimulation equivalences do not preserve the reachability of states, i.e., if in the aggregated automaton state s˜x is reachable, at least one state sy ∈ Ri [˜ sx ] is reachable, but it is not clear whether all states or more than one state are reachable in the original automaton. The reason is that the equivalence relations consider only the future and not the past behavior. If results with respect to specific states should be computed, the equivalences have to be extended. To formalize the approach, states are characterized by labels and an equivalence relation is computed by refining R0i where (sx , sy ) ∈ R0i if sx and sy are identically labeled (see [10]). This approach works if the number of state labels is relatively small. However, in cases with a large number of state labels, the resulting number of equivalence classes will also be large. In particular, if the set or reachable states should be computed, the aggregation presented so far does not help because in the initial relation R0i each equivalence class contains a single state. For reachability analysis we have to consider the past instead of the future behavior, because reachability of a state implies the existence of a path from the initial state. An equivalence relation preserving reachability has been introduced in [7]. Let Ri ⊆ Si × Si be an equivalence relation such that (s0 , sx ) ∈ Ri implies (Qili )∗ (0, x) = 1 (i.e, all states which are in the same equivalence class as the initial state are reachable by internal transitions from the initial state) and for

428

Peter Buchholz, Peter Kemper a )

g e t_ i+ 1 ~ 0

( ~ 0 ,~ 1 ,~ 2 )

b ) ~ 1 2

1

1

p u t_ i+ 1 p u t_ i

g e t_ i ~ 2

( ~ 0 ,~ 2 ) 1 (~ 0 )

(~ 0 ) 1 (~ 1 )

1

(~ 1 ) 1

(~ 2 )

Fig. 4. Reachability graph of an aggregated philosopher a) and DAG representation of the aggregated reachability set b). all (sx , sy ) ∈ Ri and all l ∈ Li : 1. (Qil )∗ (z, x) = 1 implies (Qil )∗ (z  , y) = 1 for some z  with (sz , sz ) ∈ Ri and 2. (Qil )∗ (z, y) = 1 implies (Qil )∗ (z  , x) = 1 for some z  with (sz , sz ) ∈ Ri . The relation can be denoted as a weak inverse bisimulation since it considers incoming instead of outgoing transitions. The largest weak inverse bisimulation can be computed using a partition refinement algorithm with the transposed instead of the original matrices. As shown in [7] (sx , sy ) ∈ Ri for some weak inverse bisimulation Ri implies that if automaton i can be in state sx after a sequence of synchronized transitions, then it can as well be in state sy and vice versa. This behavior is exploited for an efficient reachability analysis. In a first step, aggregated automata with respect to weak inverse bisimulation are computed, then reachability analysis for the complete system is performed using the aggregated instead of the original automata. If in the aggregated system state (˜ s1 , . . . , s˜N ) is reachable, then all states from {R1 [˜ s1 ]×R2 [˜ s2 ]×. . .×RN [˜ sN ]} are reachable in the original system. If (˜ s1 , . . . , s˜N } is not reachable, then all states from {R1 [˜ s1 ] × R2 [˜ s2 ] × . . . × RN [˜ sN ]} are unreachable too. Exploitation of this results allows a very time efficient generation and space efficient representation of huge reachability sets, for details see [8]. If we compute equivalence relations for the philosophers in the example and declare all transitions which are not needed for synchronization as local, then the relation R with equivalence classes R[˜ 0] = (0, 2), R[˜1] = (1, 3) and R[˜2] = (4, 5) is a weak bisimulation in both directions, forward and backward. Thus the aggregated automaton (Fig 4a) with 3 states and 4 transitions can be used instead of the original one in subsequent composition and analysis. Because R is a weak forward bisimulation, model checking using the aggregated instead of the original system yields identical results and since R is a weak backward bisimulation, reachability analysis can be performed using the aggregated system. Thus, it is indeed possible to perform all analysis steps on the Kronecker and DAG representation of the aggregated system. Fig. 4b) shows the DAG of the aggregated reachability set which is more compact then the original DAG but contains the same information, e.g., reachability of aggregated state (˜0, ˜2, ˜1) implies that all 8 states from {(0, 2) × (4, 5) × (1, 3)} are reachable and also the other way, since state (˜0, ˜1, ˜2) is not reachable in the aggregated system, all 8 states from {(0, 2) × (1, 3) × (4, 5)} are unreachable in the original system.

Modular State Level Analysis of Distributed Systems Techniques

R e p o rt

G U I

A P N N + A n a ly s is s p e c ific P a ra m e te rs / D e s c rip tio n s

A n a ly w ith o S ta te E x p lo

G e n e ra to r

R e s u lts

o th e r P E T o o ls / M o d e llin g F o rm a lis m s

T ra n sfo rm e r

S ta te S p a c e E x p lo ra tio n :

s is u t S p a c e ra tio n

P a rse r + A u to m a to n G e n e ra to r

L e g e n d :

e .g . In v a ria n t A n a ly s is , S im u la tio n

429

P E T o o l M o d u le (T o o lb o x P a rt)

A u to m a to n in te rfa c e

F u n tio n a l A n a ly s e r

Q u a n tita tiv e A n a ly s e r

E q u iv a le n c e A n a ly s e r

Fig. 5. Structural overview of the toolbox

3

Tool support

Many software tools for analysis of finite state systems exist. They differ in modeling paradigms, analysis techniques and the kind of results they compute. Often they are standalone developments such that models cannot be interchanged. This implies that a fair comparison of different techniques is often hard, the combination of techniques from different tools is impossible and it also results in a lot of redundancy, because basic modules like state-space generators, graphical interfaces etc. are often reimplemented for a specific tool. Recent efforts aim for standardized interfaces to support the interchange of models and algorithms, e.g. the ISO standardization approach for Petri nets [13], the Petri net kernel of the Humboldt university [18] and the Electronic Tool Integration platform [25]. The presented analysis techniques are integrated in a toolbox, the APNN toolbox [3], which was developed with similar ideas in mind. The toolbox is based on two standardized file formats. First, the so-called abstract Petri net notation (APNN), an extendable file format (formal grammar) for a rather general class of Petri nets, including colored, hierarchical and stochastic nets [4]. The second format is for synchronized (stochastic) automata which matches the formalism introduced in Section 2. Figure 5 gives an overview of the APNN toolbox. Due to lack of space, we name only those parts which are relevant for the functional analysis of systems. We neglect components that deal with quantitative system analysis using techniques for Markov chain analysis or discrete event simulation. Currently two graphical interfaces are available to specify Petri Net models structured in synchronized components. Both interfaces generate an APNN decription of the model. The APNN description of a model is the input

430

Peter Buchholz, Peter Kemper

for analysis modules at the net level. Invariant analysis is often useful to obtain first results – especially upper bounds for token populations on the places of a Petri net, which are in turn helpful to limit the size of automata state spaces in composed nets [16]. The APNN description is read by the module for state space generation. It is possible to generate the state space and transition system for the complete net or for components only. The latter results in an automata network description of the model which contains all information necessary to generate the Kronecker representation of the complete system. Reachability graphs are stored as sparse matrices, one for each transition label. Automata description can also be obtained from other modeling formalism, e.g. from a process algebra specification consisting of the parallel composition of components at the highest level, the description as an automata network can be easily generated by computing the transition systems of the components. ˜ DAG nodes DAG Size in KByte non-zeros Time in sec. N |R| |R| 8 12,032 47 27 0.8 72 2 12 1,318,912 322 54 1.6 108 3 16 1.44638e+8 2,207 102 3.1 144 5 20 1.58618e+10 15,127 158 4.8 180 36

Table 1. Sizes and efforts to generate and represent the philosophers example. The automata description is the interface for different state based analysis modules, e.g. a module for equivalence computation and the generation of reduced automata, a module to generate the reachability set using DAGs, and a module to perform model checking for computational tree logic (CTL) formulas using DAGs and Kronecker representations. To present first results, we consider the analysis of the philosophers example using the modules of the toolbox. Tab. 1 includes results for configurations with up to 20 philosophers. The first column contains the number of philosophers, |R| ˜ are the number of markings in the reachability set and the aggregated and |R| reachability set, respectively. The size of the reachability set grows very rapidly with an increasing number of philosophers, whereas the aggregated reachability set is relatively small even for a larger number of philosophers. The following ˜ As shown two columns include information about the DAG to represent |R|. ˜ above, knowledge of R and the equivalence classes allows us to characterize R completely. For all configurations of the example, the number of nodes in the ˜ let alone compared to the size of R. DAG is very small compared to the size R, Memory requirements to store the DAG are shown in the fifth column. Apart from the DAG, the equivalence classes and the matrices have to be stored to represent the reachability set and graph. The number of non-zero elements in all matrices which are needed to represent the reachability graph is shown in column six. The last column includes the total time required to generate the compact representations of reachability set and graph starting with the APNN-description of the model. The time is measured as “wallclock time in seconds” on a Sun UltraSparc workstation with 167MHz CPU and 128 MByte of main memory. Since the different analysis steps are performed by single modules communicating

Modular State Level Analysis of Distributed Systems Techniques

431

via a file interface, time includes the effort to load programs and read and write files. However, even for the largest configuration with more than 15 billions reachable markings, the compact representation is generated in about half a minute and requires less than 10 KByte memory. The compact representation can afterwards be used in further analysis steps including model-checking or performance analysis. Observe that we did not exploit symmetries in the model or identities of different components. This would be an additional step to improve analysis. However, we obtained similar result for non-symmetric configurations where some of the philosophers pick up forks one after the other. With the approach even configurations with more than 20 philosophers can be handled. In this case it is preferable to group two or three philosophers to a single automaton which can be aggregated to a small automaton. The philosophers example includes some features, which are common in parallel or distributed systems and support our analysis approach. Components have some internal transitions such that corresponding automata can be substantially aggregated. Additionally, synchronization takes place between adjacent components and not globally. The following example is less favorable and demonstrates limitations of our approach.

4

Example

Lamport’s mutual exclusion algorithm [19] for shared-memory systems without test-and-set instructions, but with atomic read and write operations is, of course, an academic example, but it is complex and not easy to analyze. We analyze the algorithm for a system consisting of N processes cycling between local computing and access to shared memory. Figure 6 gives the pseudo code for process i. The basic idea is that in systems where contention to a shared resource is rare, it is not efficient to inspect the state of all other processes before accessing the shared resource. By a sophisticated use of variables x and y it is possible to assure exclusive access without first scanning all other processes. However, it is not straightforward to describe the meaning of x and y. It is worth mentioning that the algorithm in its original setting is not symmetric for processes. Since in the for-loop processes are scanned starting with process 1 and ending with N in the code of each process, processes are treated in a different way depending on their number. The difference in process behavior destroys symmetries such that methods reducing state spaces due to symmetries cannot be used for the example. Lamport’s algorithms is considered in [2], where colored stochastic Petri nets are applied for its analysis and in [23], where it is modeled as a network of stochastic automata. Our model is in some sense in between these approaches since we use superposed Petri nets which are mapped on automata. The algorithm is too complex to be described as a flat P/T net. We used a colored net with hierarchies as in [2]. The major difference is that we explicitly model the for loop. In contrast to [2] our net describes system with N components interacting via synchronized transitions. The net for component i contains the description of process i plus places for the variables b[i], x = i with complement place x = i, y = i with complement place y = i. The first automaton considers additionally the situation y = 0. Values of the variables are described in a

432

Peter Buchholz, Peter Kemper

1. compute locally ; 2. start: b[i] := true ; /* start access to shared memory */ 3. x := i ; 4. if y = 0 then 5. b[i] := f alse ; 6. await y = 0 ; 7. goto start fi ; 8. y := i ; 9. if x = i then 10. b[i] := f alse ; 11. for j := 1 to N do await not b[j] od ; 12. if y = i then 13. await y = 0 ; 14. goto start fi fi ; 15. critical section ; 16. y := 0 ; 17. b[i] := f alse ; /* end access to shared memory */

Fig. 6. Lamport’s algorithm code for process i. distributed way. Such a description is not obvious, however, the alternative, where components for the variables x and y are introduced, as in [23], results in a model where the state of the automata for the variables determine the state of the remaining automata and the modular analysis behaves similar to a conventional analysis of the complete net. For a model with N processes, the state space of the first automaton contains 40 + 4N states, the remaining state spaces for the automata 2, . . . N include 20 + 2N states each. The size of the automata state spaces depends on the number of processes due to the for-loop, where each other process is considered. Aggregation with respect to weak backwards bisimulation reduces the state space of the first automaton to 32 + 4N states and the remaining state spaces to 16 + 2N . For this example we obtain only a small reduction by a constant value with the aggregation approach. This shows the complexity of the processes. Nevertheless, the aggregated reachability set is significantly smaller than the original one, although the sizes of both reachability sets grow rapidly with an increasing number of processes. Results for the example with 3, 4 and 5 processes are shown in Tab. 2. The effort to generate reachability sets for this example is significantly higher than for the philosophers example. However, for the largest configuration (N = 5) with nearly 8 millions of states, it takes less than an hour to generate the reachability set and represent it in a very compact form requiring ˜ ≥ 1.1 · 108 states, but could still be about 26 KByte of memory. For N = 6, |R| represented in a compact form. Nevertheless generation times become extremely large. ˜ N |R| |R| DAG nodes DAG Size in KByte non-zeros Time in sec. 3 16,683 11,337 40 4.7 11,568 18 4 347,875 222,046 84 12.9 16,042 129 5 7,856,309 4,760,531 145 25.8 21,056 2,948

Table 2. Sizes and efforts to generate and represent the Lamport’s algorithm. The example shows also the limits of the approach, if processes are highly synchronized such that abstraction cannot be applied to reduce intermediate reachability sets. However, even for this example the approach outperforms conventional state space generation which fails completely for the model with N = 5 on the same hardware due to memory limitations.

Modular State Level Analysis of Distributed Systems Techniques

5

433

Conclusion

We propose a methodology to analyze distributed software systems at the state level in a modular way. Starting from a specification of the software system as a P/T-net consisting of components interacting via synchronized transitions, we generate a network of communicating automata. For the analysis of this automata network, we apply three different concepts to manage the inherent complexity of state level analysis. First, we avoid the explicit generation of the reachability graph by representing it as a sum of Kronecker products of small automata matrices. Second, we avoid the explicit enumeration of the state space (reachability set) by representing it as a directed acyclic graph. As a third step, we integrate state level aggregation due to equivalence relations to reduce automata state spaces a priori. Aggregation can be naturally integrated into the Kronecker description of the reachability graph and can therefore be performed in a very efficient way. All concepts together reduce drastically the memory requirements to represent large reachability sets and graphs. At least from the memory perspective, the state space explosion problem can be managed for most models which are described by synchronously communicating components. The situation is a little bit different if one considers the time requirements to build the data structures for really large systems with several hundred millions or some billions of states. As shown by the dining philosophers example it is sometimes possible to generate data structures for such large models in a few seconds. However, if interactions between components become more complex such that a priori aggregation has only small effects on the size of the reachability set, then the handling of huge state spaces is still a very time consuming task, as the results for the second example indicate. The usability of any analysis technique relies on the availability of appropriate software tools incorporating the technique. The modular state level analysis is part of a general toolbox based on two standardized file formats to describe general classes of Petri-nets at a higher level and synchronized automata at a lower level. The toolbox includes, apart from modules for functional system analysis, also modules for performance or reliability analysis based on Markov chain technique. These techniques follow similar ideas as proposed here for the functional case. Future work will consider the exploitation of symmetries during the reachability set generation and the compositional computation of equivalence relations. We plan to implement analysis steps in a distributed way on a workstation cluster and to further enhance the toolbox interconnection with other tools.

References 1. A. Arnold. Finite Transition systems. Prentice Hall, 1994. 2. G. Balbo, S. C. Bruell, P. Chen, and G. Chiola. An example of modelling and evaluation of a concurrent program using coloured stochastic Petri nets: Lamport’s fast mutual exclusion algorithm. IEEE Trans. on Parallel and Distributed Systems, 3(2):221–240, 1992.

434

Peter Buchholz, Peter Kemper

3. F. Bause, P. Buchholz, and P. Kemper. A toolbox for functional and quantitative analysis of DEDS. In R. Pujanger, N. N. Savino, and B. Serra, editors, Quant. Eval. of Comp. and Comm. Sys., pp. 356–359. Springer LNCS 1469, 1998. 4. F. Bause, P. Kemper, and P. Kritzinger. Abstract Petri nets notation. Petri Net Newsletter, (49):9–27, 1995. 5. E. Best, W. Fraczak, R. P. Hopkins, H. Klaudel, and E. Pelz. M-nets: An algebra of high-level Petri nets, with an application to the semantics of concurrent programming languages. Acta Informatica, 35(10):813–857, 1998. 6. P. Buchholz. A notion of equivalence for stochastic Petri nets. In G. De Michelis and M. Diaz, editors, ATPN’95, pp. 161–180. Springer LNCS 935, 1995. 7. P. Buchholz. Hierarchical structuring of superposed GSPNs. In Proc. PNPM’97 pp. 81–90. IEEE CS-Press, 1997. 8. P. Buchholz and P. Kemper. Efficient computation and representation of large reachability sets for composed automata. Technical report, in preparation. 9. G. Ciardo and A. S. Miner. Storage alternatives for large structured state spaces. In R. Marie and B. Plateau, editors, Proc. 9th Int. Conf. on Mod. Techn. and Tools for Comp. Perf. Eval., pp. 44–57. Springer LNCS 1245, 1997. 10. R. Cleaveland, J. Parrow, and B. Steffen. The concurrency workbench: a semantics based tool for the verification of concurrent systems. ACM Trans. on Programming Languages and Systems, 15(1):36–72, 1993. 11. M. Davio. Kronecker products and shuffle algebra. IEEE Trans. on Computer, 30:116–125, 1981. 12. S. Donatelli. Superposed generalized stochastic Petri nets: definition and efficient solution. In R. Valette, editor, APTN’94, pp. 258–277. Springer LNCS 815, 1994. 13. J. Billington (ed.). Petri net standard. Committee draft, ISO/IEC JTC1/SC7/WG11, 1992. 14. C. Hoare. Communicating sequential processes. Prentice Hall, 1985. 15. P. C. Kanellakis and S. A. Smolka. CCS expressions, finite state processes and three problems of equivalence. Information and Computation, 86:43–68, 1990. 16. P. Kemper. Numerical analysis of superposed GSPNs. IEEE Trans. on Software Engineering, 22(9):615–628, 1996. 17. P. Kemper. Reachability analysis based on structured representations. In J. Billington and W. Reisig, editors, ATPN’96, pp. 269–288. Springer LNCS 1091, 1996. 18. E. Kindler and J. Desel. Der Traum von einem universellen Petrinetz-Werkzeug – der Petrinetz-Kern (in German). In Proc. 3rd Workhop on Algorithmen und Werkzeuge f¨ ur Petrinetze, 1996. 19. L. Lamport. A fast mutual exclusion algorithm. ACM Trans. on Computer Systems, 5(1):1–11, 1987. 20. R. Milner. Communication and concurrency. Prentice Hall, 1989. 21. R. Paige and R. E. Tarjan. Three partitopn refinement algorithms. SIAM Journ. on Computing, 16(6):973–989, 1987. 22. B. Plateau. On the stochastic structure of parallelism and synchronisation models for distributed algorithms. Performance Evaluation Review, 13:142–154, 1985. 23. B. Plateau and K. Atif. Stochastic automata networks for modeling parallel systems. IEEE Trans. on Software Engineering, 17(10):1093–1108, 1991. 24. L. Pomello, G. Rozenberg, and C. Simone. A survey of equivalence relations for net based systems. In G. Rozenberg, editor, Adv. in Petri Nets 1992, pages 410–472. Springer LNCS 609, 1992. 25. B. Steffen, T. Margaria, and V. Braun. The electronic tool integration platform: concepts and design. Int. Journ. on Softw. Tools for Technology Transfer, 1(1/2):9– 30, 1997.

10.1007/b107031130029

Some Issues in the Software Engineering of Verification Tools Perdita Stevens



Division of Informatics, University of Edinburgh JCMB, King’s Buildings Mayfield Road Edinburgh EH9 3JZ

Abstract. The Edinburgh Concurrency Workbench has been the author’s responsibility for the past four years, having been under development for eight years before that. Over its lifetime, we have learnt many lessons and encountered many questions about verification tool development, both from bitter experience and from discussion with other tool developers and users. This note raises some of them for wider discussion.

1

Introduction

It is common to hear it said that an important factor in the practical uptake of theoretical work in computer science is the availability of tools that incorporate the theory; and the spread of finite-automata-based verification tools through the US hardware verification industry is indeed one of the more widely visible signs of recent progress in theoretical computer science. Although there are now some cases of verification tools being taken over, or developed in house, by commercial organisations, it is more usual that they are developed in universities, at least partly by people whose jobs also involve research and teaching. The nature and range of software engineering problems encountered by developers naturally vary with the kind of product being developed and with the nature of the developing organisation. This note draw on a longer paper “A Verification Tool Developer’s Vade Mecum” (available from www.dcs.ed.ac.uk/home/pxs) which attempted to bring out the special features of the development of verification tool development in universities. In this note we raise some of the questions, commenting on a few as space permits: the aim is to promote constructive sharing of experience and views.

2

“Business case” level issues

To begin with one of the earliest and thorniest of questions: Who does the development? And more difficult, who does the maintenance and support? 

[email protected], supported by EPSRC GR/K68547. Tel: +44 131 650 5195, Fax: +44 131 667 7209

W.R. Cleaveland (Ed.): TACAS/ETAPS’99, LNCS 1579, pp. 435–438, 1999. c Springer-Verlag Berlin Heidelberg 1999 

436

Perdita Stevens

– Professional researchers who are expert in the underlying theory? – Students, with limited experience in both theory and software engineering? They may receive direction, but this normally comes from someone more expert in theory than engineering. – Professional software developers, employed for the purpose, under direction from researchers, who supply the detailed theoretical understanding? Will they have to be so minutely directed, in order to ensure that the theory is correctly implemented, that the skilled work of system design is, in effect, again done by the researchers, with the programmers doing routine programming work only? – Professional software developers who are in the process of becoming professional researchers? The possibility is probably unusual, but I was brought into the Edinburgh Concurrency Workbench project after some years as an industrial software engineer, but with only undergraduate level knowledge of the underlying theory, with the intention that I should acquire whatever knowledge was necessary. My ignorance of the underlying theory posed formidable problems in the beginning – but perhaps it is easier in a university environment to acquire theoretical understanding than engineering understanding? How do you find the time to spend on tool work? In varying degrees, all of the options for tool development require a serious commitment of time and energy. For someone pursuing an academic career, there is a tension between producing papers and producing tools. Although increasingly universities seem to recognise the importance of producing tools (to gain the advantages cited below), it is very difficult – especially, but not only, for someone who is not engaged in tool development and maintenance – to appreciate the amount of time that is required. To some extent, it may be possible to combine the goals of producing papers and producing tools: there are fora, including TACAS, for presenting papers about new tools or major new features in tools. However, much of the effort required to maintain a tool, especially one which has many users, is the routine (though skilled) work of updating interfaces to changing external systems, writing documentation, answering email, developing tests, etc. This work is not research. Do you want to develop a tool at all? We have begun to mention the disadvantages: it’s time-consuming, and difficult in ways which often have little to do with research, and it may be difficult to find the resource to do it well. Other options to consider may include: – Developing a component of another tool set, rather than a whole new tool. The practicality of this will depend on the intended functionality of the tool and the qualities of the tool set. – Getting someone else to develop the tool. If your intended user group is industrial verifiers, can you build the tool as a collaborative venture with an industrial partner?

Some Issues in the Software Engineering of Verification Tools

437

Do you want your tool to have users? Or is it better to build a purely experimental system, with lower support needs? Who are the intended users of your tool? Students and their teachers? Researchers? Industrial verifiers? With what needs and experience? What do you want to achieve? For example: – Technology transfer: you may want to improve visibility of some well-established piece of theory (among industrial practitioners, students or both). – Theory experimentation: you may want to deepen your understanding of some theory by experimenting with different implementations. – Image manipulation: you may want yourself or your organisation to be seen as doing “practical” work.

3

Architectural issues

What high level structure is appropriate? (This is influenced, for example, by whether you want other people to be able to extend the tool, and if so, in what ways.) Specifically, Which decisions must be encapsulated so that they can easily be changed? What programming language is best for the purpose? Considerations will include, for example, support for encapsulation, the type system, the availability of compilers on the relevant platforms. What user interface is best? For example, do you want a graphical user interface or not, and if so, on what toolkit should it be based, considering maintenance and portability? Much depends on who the users are.

4

Issues concerning the development process and QA

A quality assurance process suitable for academic development of verification tools needs to be extremely streamlined. A meta-question is What documentation of the process is useful? This depends on, for example, the group of people involved, their distribution and turnover. Let us consider a couple of important areas. Version control This is important for all systems, but particularly important for verification tools, where correctness is paramount. I find it helpful to versioncontrol everything – code, build files, documentation, tests, “correct” answers to tests, etc. In order to make this feasible given resource constraints, the version control system has to be very easy to use, so that one can check something in and keep working on it without interrupting a chain of thought.

438

Perdita Stevens

Testing It goes without saying that a verification tool needs to be thoroughly tested; but the effort required to do this is often underestimated. In mainstream software engineering, the usual estimate of how much of a software development project’s budget is spent on testing is 30 - 50%; verification tools can be expected to be towards the upper end of this spectrum. It is extremely tempting to cut corners here, and so it is crucial that all time that is spent on testing is used as effectively as possible. Some automated support for regression testing is probably essential – the CWB’s system testing software is written in Perl, a language which is well adapted to this kind of task. This simple program enables the CWB developer to run tests and spot newly introduced problems with minimal effort. It is simple-minded; for example semantically insignificant changes to CWB output – printing nominally unordered output items in a different order, for example – are reported as errors: but it has not yet seemed efficient to implement anything more sophisticated, bringing us on to the next question: What is it efficient to automate? It seems worth remarking that there is a danger of losing time by automating things, too. For example, after making two minor errors in releasing versions of the CWB, I developed a script to automate the release process, when in fact I would have been better off with a checklist of things to do when releasing the CWB: this would have solved the original problem more robustly with less effort. Other issues in the development process that may need to be considered include What coding practices are required? What kind of documentation is needed? Writing and maintaining documentation is one of the most time-consuming aspects of tool development, so this needs particularly careful consideration.

5

Dissemination issues

are relevant if you are developing a tool which is to have external users. What kind of distribution policy is appropriate? What kind of support will you offer? In conclusion, What does your own experience suggest as answers to any of these questions? And what other questions are crucial? What is the single most important piece of advice to give to tool developers?

10.1007/b107031130030

The ETI Online Service in Action Volker Braun, J¨ urgen Kreileder, Tiziana Margaria and Bernhard Steffen Universit¨ at Dortmund, Fachbereich Informatik, D-44221 Dortmund, Germany {vbraun,kreilede,tiziana,steffen}@sunshine.cs.uni-dortmund.de

1

ETI’s Goals

The Electronic Tool Integration platform (ETI) associated to the Intern. Journal on Software Tools for Technology Transfer (STTT) [7] is designed for the interactive experimentation with and coordination of heterogeneous tools1 . ETI users are assisted by an advanced, personalized Online Service guiding experimentation, coordination and simple browsing of the available tool repository according to their degree of experience. In particular, this allows even newcomers to orient themselves in the wealth of existing tools and to identify the most appropriate collection of tools to solve their own application-specific tasks. Typical users of the ETI platform are tool builders and members of software projects looking for adequate tool support in their project area, but also researchers and scientists interested in tools as a research aid. The effectiveness of the ETI approach depends on the richness of the ETI repositories, which steadily grow with the integration of new tools, transformations and benchmarks. A more detailed exposition, including background and related work can be found in [5].

2

The ETI Online Service

ETI contains and manages a heterogeneous wealth of information, functionalities and data. From the ETI Service homepage, http://eti.cs.uni-dortmund.de, it is possible to 1. access online information on the tools via hyperlinks to each tool’s home site. These may provide information (documentation, literature, user manuals, prominent case studies) or, depending on the tool providers’ choice even the tool’s code (executable or source). 2. access online a stand-alone version of each tool, centrally located at the ETI service sites and executing (running) there. 3. access the ETI repository of integrated tools. The platform’s repository contains a collection of functionalities offered by each integrated tool, classified for ease of retrieval according to behavioural and interfacing criteria. 4. experiment at ease with the integrated tools, by 1

The ETI platform is realized on top of the MetaFrame environment [6,4].

W.R. Cleaveland (Ed.): TACAS/ETAPS’99, LNCS 1579, pp. 439–443, 1999. c Springer-Verlag Berlin Heidelberg 1999 

440

Volker Braun, J¨ urgen Kreileder, Tiziana Margaria and Bernhard Steffen

(a) running the (stand-alone or integrated) tools on libraries of examples, case studies, and benchmarks made available on the ETI platform, (b) testing and running single tool functionalities, capturing specific features offered by the integrated tools, on the same examples, from within a uniform graphical user interface provided by ETI, (c) constructing own application-specific heterogenous tools through combination of single functionalities available in the ETI platform. This way users can prototypically solve problems which require the cooperation of several integrated tools, and experience the interplay of the integrated functionalities, (d) loosely specifying coodination tasks, which can be then automatically completed by means of ETI’s coordination support. This, in particular, takes care of any type (data format) incompatibilities, as detailed in [3]. 5. experiment with own sets of data, to be deployed in user-specific, protected home areas. The tool demonstration focusses on ETI’s unique support for high-level tool coordination, while illustrating the steadily improving features of personalization, statistic analysis and automatic evaluation.

3

Experimentation by Loose Coordination

Tool coordination is freed from any programming and technicalities, so that little or no specific knowledge is prerequisite to the use of ETI as a coordination environment. In particular, ETI provides high-level task specification languages, graphical support for specifications and user interaction, as well as automatic coordination support by means of automatic synthesis and prototype animation [3]. This eases the access and use of the functionalities offered by different tools, implemented in different languages of different programming paradigms (functional, imperative, object-oriented) and running on different platforms. The perhaps most prominent application example for loose coordination is the type-based completion of type-incorrect tool combinations. In a heterogeneous collection of tools, with all its advanced input and output formats, exact/correct tool coordination is extremely difficult. ETI provides convenient coordination interfaces even for newcomers, whose attention is kept free from typing constraints in order to concentrate on the desired functionalities. The formal backbone of loose coordination is model synthesis/construction for Linear Time Temporal Formulas[5]. Users of the ETI service need not know this logic. Rather, they may choose between several specification formats, like e.g. the above mentioned type-incomplete coordination sequences, graphical formats or (application-specifically) derived logics. All these specification formats can be handled automatically by our synthesis mechanism, which, in particular, transforms type-incorrect coordination sequences into directly executable ones[3]. ETI can be operated without any previous knowledge about the content of the current tool repository. In fact, besides incompleteness (looseness) in the

The ETI Online Service in Action

Fig. 1. ETI in Use: Taxonomies and Coordination

441

442

Volker Braun, J¨ urgen Kreileder, Tiziana Margaria and Bernhard Steffen

above-described fashion (along a coordination execution), looseness in the specification of single functionalities allows newcomers to specify tools just by selecting desired properties. The system will then return the set of all corresponding (satisfying) functionalities, which can be investigated online using a hypertext documentation system. Figure 1 shows a screenshot summarizing the essential features and components offered by the ETI Online Service via the standard browsers in a platform independent fashion.2 A browser (left upper corner), serves as the documentation facility (white frame), the console (upper frame), and the entry point for the other service functionalities (menu in the left frame). The core functionalities are invoked via the tool bar: – the type and activity taxonomy browsers, – the synthesis editor, – the graph editors. The screenshot additonally displays a synthesized coordination graph (upper right corner) and an example graph, reachable via the graph editor (lower right corner). Experts may use the coordination system in an even more flexible manner: they may use the full power of the SLTL linear time temporal logic[5] and request e.g. the presentation of the set of all (minimal) coordination sequences as feedback. This way, they may investigate the full potential of the ETI repository by successively refining the logical specification. Thus people with different programming skills and professional profiles are able to profitably develop and test even complex tool coordination structures in a comfortable, intuitive manner.

4

Conclusions and Perspectives

The ETI Online Service plays a public service role, giving users the possibility of direct, hands-on, experience with a wealth of available tools and functionalities. This also includes features like the ETI Online Forum, where users may e.g., propose case studies, and report on their experiences [2]. The service is intended to develop into an independent tool presentation and evaluation site: potential customers (or project partners) are intended to use the service as a – directory for possible tools and algorithms satisfying totally or partially their needs, – (vendor- and producer-) independent test site for trying and comparing alternative products and solutions, which may be accessed without the overload of getting demo copies, demo licenses, making own installations, etc., 2

A typical user will not be confronted with all these windows at once, as they only appear on demand.

The ETI Online Service in Action

443

– quality assessment site for the published tools, which are refereed according to requirements like originality, usability, installability, stability, performance, design, etc., – independent benchmarking site for performance on a growing basis of problems and case studies. This should simplify the communication between tool builders and tool users as well as between academia and industrial practice, supporting the transfer of toolrelated technology. In fact, we are optimistic that the typical hesitation to try out new technologies can be overcome because serious hurdles, like installation of the tools, getting acquainted with new user interfaces, lack of direct comparability of the results and of performances, are eliminated. Moreover, the intended collaborative effort of the ETI user community to provide easily accessible information about fair, application-specific evaluations of various competing tools on the basis of predefined benchmarks, will be of inestimable help for everybody in need of tool support.

References 1. V. Braun, T. Margaria, B. Steffen: The ETI Online Service: Concepts and Design, Proc. 4. STJA, “Smalltalk und Java in Industrie und Ausbildung”, October 1998, Erfurt (D). 2. R. Cleaveland, T. Margaria, B. Steffen: Editorial, [7], pp.1-5. 3. T. Margaria, V. Braun, J. Kreileder: Interacting with ETI: A User Session, [7], pp.49-63. 4. T. Margaria, B. Steffen: Coarse-grain Component Based Software Development: The MetaFrame Approach, Proc. STJA’97, “Smalltalk und Java in Industrie und Ausbildung”10.-11. September 1997, Erfurt (D), ISBN 3-00-001828-X, pp.29-34. 5. B. Steffen, T. Margaria, V. Braun: The Electronic Tool Integration platform: concepts and design, [7], pp. 9-30. 6. B. Steffen, T. Margaria, A. Claßen, V. Braun: The MetaFrame’95 Environment, Proc. CAV’96, Int. Conf. on Computer-Aided Verification - Juli-Aug. 1996, New Brunswick, NJ, USA, LNCS 1102, pp.450-453, Springer Verlag. 7. Special section on the Electronic Tool Integration Platform, Int. Journal on Software Tools for Technology Transfer, Vol. 1, Springer Verlag, November 1997

10.1007/b107031130031

Author Index

Abdulla, P. 208 Andersen, H. 163 Annichini, A. 208 Bakhmurov, A. 390 Basten, T. 270 Behrmann, G. 163 Bergeron, A. 134 Biere, A. 193 Bouajjani, A. 208 Braun, V. 439 Buchholz, P. 420 Chen, H. 300 Cimatti, A. 193 Clarke, E. 193 Delzanno, G. 223 Dong, Y. 74 Du, X. 74 Even, S. 375 Gardner, M. 44 Greenstreet, M. 330 Gunter, E. 405 Heljanko, K. 240 Hickey, J. 119 Hirschkoff, D. 285 Hong, S. 34 Hooman, J. 270 Hsiung, P.-A. 19 Hulgaard, H. 163 Kahlouche, H. 315 Kapitonova, A. 390 Kemper, P. 420 Kern, C. 330 Knoop, J. 360 Kramer, J. 1 Kreileder, J. 439 Kreitz, C. 104 Kuo, Y.-S. 19 Larsen, K. 163

Li, Z. 300 Lind-Nielsen, J. 163 Liu, J. 44 Lynch, N. 119 Magee, J. 1 Manzoni, J.-C. 134 Marchignoli, D. 148 Margaria, T. 439 Martinelli, F. 148 Montanari, U. 255 Ono-Tesfaye, T. 330 Parnas, D.L. 345 Peled, D. 405 Peters, D. 345 Pistore, M. 255 Podelski, A. 223 Pusch, C. 89 Ramakrishna, Y. 74 Ramakrishnan, C. 74 Ramakrishnan, I. 74 van Renesse, R. 119 Rusu, V. 178 Ryu, M. 34 Singerman, E. 178 Smeliansky, R. 390 Smolka, S. 74 Sokolsky, O. 74 Spelt, D. 375 Stark, E. 74 Steffen, B. 439 Stevens, P. 435 Tripakis, S. 59 Viho, C. 315 Wang, F. 19 Warren, D. 74 Zendri , M. 315 Zhu, Y. 193