Presentation is loading. Please wait.

Presentation is loading. Please wait.

BDD vs. Constraint Based Model Checking: An Experimental Evaluation for Asynchronous Concurrent Systems Tevfik Bultan Department of Computer Science University.

Similar presentations


Presentation on theme: "BDD vs. Constraint Based Model Checking: An Experimental Evaluation for Asynchronous Concurrent Systems Tevfik Bultan Department of Computer Science University."— Presentation transcript:

1 BDD vs. Constraint Based Model Checking: An Experimental Evaluation for Asynchronous Concurrent Systems Tevfik Bultan Department of Computer Science University of California, Santa Barbara bultan@cs.ucsb.edu http://www.cs.ucsb.edu/~bultan/

2 Outline Concurrency problems Symbolic model checking Functionality required for symbolic model checking BDD representation Constraint representation Experimental results Related work Conclusions

3 Program: Bakery Data Variables: a, b: positive integer Control Variables: pc1, pc2: {T, W, C} Initial Condition: a=b=0 & pc1=T1 & pc2=T2 Events: eT1: pc1=T & pc1’=W & a’=b+1 eW1: pc1=W & (a<b | b=0) & pc1’=C eC1: pc1=C & pc1’=T & a’=0 eT2: pc2=T & pc2’=W & b’=a+1 eW2: pc2=W & (b<a | a=0) & pc2’=C eC2: pc2=C & pc2’=T & b’=0 BAKERY: AG(!(pc1=c & pc2=C))

4 Program: Barber Data Variables: cinchair,cleave,bavail, bbusy,bdone: positive integer Control Variables: pc1,pc2,pc3: {1,2} Initial Condition: cinchair=cleave=bavail =bbusy=bdone=0 & pc1=pc2=pc3=1 Events: eHairCut1: pc1=1 & pc1’=2 & cinchair<bavail & cinchair’=cinchair+1 eHairCut2: pc1=2 & pc1’=1 & cleave<bdone & cleave’=cleave+1 eNext1: pc2=1 & pc2’=2 & bavail’=bavail+1 eNext2: pc2=2 & pc2’=1 & bbusy<cinchair & bbusy’=bbusy+1 eFinish1: pc3=1 & pc3’=2 & bdone<bbusy & bdone’=bdone+1 eFinish2: pc3=2 & pc3’=1 & bdone=cleave

5 BARBER: AG(cinchair >=cleave & bavail>=bbusy>=bdone & cinchair<=bavail & bbusy<=cinchair & cleave<=bdone) BARBER-1: AG(cinchair>=cleave & bavail>=bbusy>=bdone) BARBER-2: AG(cinchair<=bavail & bbusy<=cinchair) BARBER-3: AG(cleave<=bdone)

6 Program:Readers-Writers Data Variables: nr, nw: positive integer Initial Condition: nr=nw=0 Events: eReaderEnter: nw=0 & nr’=nr+1 eReaderExit: nr>0 & nr’=nr-1 eWriterEnter: nr=0 & nw= 0 & nw’=nw+1 eWriterExit: nw>0 & nw=nw-1 READERS-WRITERS: AG((nr=0 | nw=0) & nw<=1)

7 Program: Bounded-Buffer Parameterized Constant: size: positive integer Data Variables: available, produced, consumed: positive integer Initial Condition: produced=consumed=0 & available = size Events: eProduce: 0<available & produced’=produced+1 & available’=available-1 eConsume: available<size & consumed’=consumed+1 & available’=available+1

8 BOUNDED-BUFFER: AG(produced-consumed=size-available & 0<=available<=size) BOUNDED-BUFFER-1: AG(produced-consumed=size-available) BOUNDED-BUFFER-2: AG(0<=available<=size) BOUNDED-BUFFER-3: AG(0<=produced-consumed<=size)

9 Program: Circular-Queue Parameterized Constant: size: positive integer Data Variables: occupied,head,tail, produced, consumed : positive integer Initial Condition:occupied=head=tail =produced=consumed=0 Events: eProduce: occupied<size & occupied’=occupied+1 & produced’=produced+1 & (tail=size & tail’=0 | tail<size & tail’=tail+1) eConsume: occupied>0 & occupied’=occupied-1 & consumed’=consumed+1 & (head=size & head’=0 | head<size & head’=head+1)

10 CIRCULAR-QUEUE: AG(0<=produced-consumed<=size & produced-consumed=occupied) CIRCULAR-QUEUE-1: AG(0<=produced-consumed<=size) CIRCULAR-QUEUE-2: AG(produced-consumed=occupied)

11 Model Checking Given a program and a temporal property p: Either show that all the initial states satisfy the temporal property p –set of initial states  truth set of p Or find an initial state which does not satisfy the property p –a state  set of initial states  truth set of  p

12 Temporal Properties  Fixpoints EF p  p  (EX p)  EX (EX p)  … 1 3 2

13 Temporal Properties  Fixpoints Note that –AG p   EF(  p ) Other temporal operators can also be represented as fixpoints –AF p, EG p, p AU q, p EU q

14 Tools Required for Model Checking Basic set operations intersection, union, set difference –to handle    Equivalence Checking –to check if the fixpoint is reached Relational image computation –for precondition operation EX

15 Functionality of a Symbolic Representation Symbolic And(Symbolic,Symbolic) Symbolic Or(Symbolic,Symbolic) Symbolic Not(Symbolic) BooleanEquivalent(Symbolic,Symbolic) Symbolic EX(Symbolic)

16 BDDs Efficient representation for boolean functions Disjunction, conjunction complexity: at most quadratic Negation complexity: constant Equivalence checking complexity: constant or linear Image computation complexity: can be exponential

17 BDD encoding for Integer Variables Systems with bounded integer variables can be represented using BDDs Use a binary encoding –represent integer x as x 0 x 1 x 2... x k –where x 0, x 1, x 2,..., x k are binary variables You have to be careful about the variable ordering!

18 Integers in SMV SMV represents integers using a binary encoding In the BDD variable ordering current and next state bits of an integer variable are interleaved –good for x’ = x Bits of different variables are not interleaved –What happens when we have x’ = y ?

19 x2 x2’x1x1’x0x0’y2y2’y1y1’y0y0’x2 x2’x1x1’x0x0’y2y2’y1y1’y0y0’ We have to remember every x’ bit until this point for x’ = y

20 William Chan’s Ordering Using a preprocessor converts integer variables to boolean variables Interleaves bits of all integer variables in the BDD ordering Results with much better performance for systems with integer variables

21 Linear Arithmetic Constraints Constraints Constraint representation  a i x i = c 1  i  n  a i x i  c 1  i  n   constraint kl 1  k  h1  l  m

22 Linear Arithmetic Constraints Can be used to represent unbounded integers Disjunction complexity: linear Conjunction complexity: quadratic Negation complexity: can be exponential Equivalence checking complexity: can be exponential Image computation complexity: can be exponential

23 Image Computation in Omega Library Extension of Fourier-Motzkin variable elimination for real variables Eliminating one variable from a conjunction of constraints may double the number of constraints Integer variables complicate the problem even further

24 Fourier-Motzkin Variable Elimination Given two constraints   bz and az   we have a   abz  b  We can eliminate z as:  z. a   abz  b  if and only if a   b  Every upper and lower bound pair can generate a separate constraint, the number of constraints can double for each eliminated variable real shadow

25 Integers are More Complicated If z is integer  z. a   abz  b  if a  + (a - 1)(b - 1)  b  Remaining solutions can be characterized using periodicity constraints in the following form:  z.  + i = bz dark shadow

26  y. 0  3y – x  7  1  x – 2y  5 Consider the constraints: 2x  6y2x  6y We get the following bounds for y: 6y  2x + 14 6y  3x - 33x - 15  6y When we combine 2 lower bounds with 2 upper bounds we get four constraints: 0  14, 3  x, x  29, 0  12 Result is: 3  x  29

27 2y  x – 1 x – 5  2y 3y  x + 7 x  3y dark shadow real shadow 293 y x

28 Systems with Bounded Integer Variables BDDs and constraint representations are both applicable Which one is better?

29 Experiments Intel Pentium PC (500MHz, 128MByte main memory) Three approaches are compared –SMV –SMV with Chan’s interleaved variable ordering –Omega library model checker

30

31

32

33

34

35

36

37

38 BAKERY: AG(!(pc1=c & pc2=C)) BARBER: AG(cinchair >=cleave & bavail>=bbusy>=bdone & cinchair<=bavail & bbusy<=cinchair & cleave<=bdone) BARBER-1: AG(cinchair>=cleave & bavail>=bbusy>=bdone) BARBER-2: AG(cinchair<=bavail & bbusy<=cinchair) BARBER-3: AG(cleave<=bdone) READERS-WRITERS: AG((nr=0 | nw=0) & nw<=1) BOUNDED-BUFFER: AG(produced-consumed=size-available & 0<=available<=size) BOUNDED-BUFFER-1: AG(produced-consumed=size-available) BOUNDED-BUFFER-2: AG(0<=available<=size) BOUNDED-BUFFER-3: AG(0<=produced-consumed<=size) CIRCULAR-QUEUE: AG(0<=produced-consumed<=size & produced-consumed=occupied) CIRCULAR-QUEUE-1: AG(0<=produced-consumed<=size) CIRCULAR-QUEUE-2: AG(produced-consumed=occupied)

39 TimeMemoryTimeMemory Bakery 20.1215070.29655 Bakery 30.8222287.3212165 Bakery 419.159110  Barber0.4024250.551458 Barber-10.53249015.3723101 Barber-20.3522280.29926 Barber-30.3522280.29926 RW0.0312450.05295 SMV (interleaved)Omega Each integer variable is restricted to 0  i  1024

40 TimeMemoryTimeMemory BB0.2821630.04147 BB-10.2722280.05188 BB-20.2621630.04147 BB-3163.303080  CQ1.0834080.10377 CQ-11228.456357  CQ-21.0433420.07328 SMV (interleaved)Omega Each integer variable is restricted to 0  i  1024 Size of the buffer is restricted to 0  size  16

41 Constraint-Based Verification: Not a New Idea [Cooper 71]: used a decision procedure for Presburger arithmetic to verify sequential programs represented in a block form [Cousot and Halbwachs 78]: used real arithmetic constraints to discover invariants of sequential programs

42 Constraint-Based Verification: [Halbwachs 93]: constraint based delay analysis in synchronous programs [Halbwachs et al. 94]: verification of linear hybrid systems using constraint representations [Alur et al. 96]: HyTech, a model checker for hybrid systems

43 Constraint-Based Verification [Boigelot and Wolper 94]: symbolic verification with periodic sets [Bultan et al. 97, 99]: used Presburger arithmetic constraints for model checking concurrent systems [Delzanno and Podelski 99]: built a model checker using constraint logic programming framework

44 BDD-Based Verification [Bryant 86]: Reduced ordered BDDs [Coudert et al. 90]: BDD-based verification [Burch et al. 90]: Symbolic model checking [McMillan 93]: SMV

45 Combining BDDs and Constraints [Chan et al. 97]: combining BDD representation with a constraint solver (it can handle nonlinear constraints but the transition system is restricted) [Bultan et al. 98, 00]: combining different symbolic representations in one model checker (combined BDDs and linear arithmetic constraints in a disjunctive form)

46 Automata-Based Representations [Klarlund et al. 95]: MONA, an automata manipulation tool for verification [Wolper and Boigelot]: verification using automata as a symbolic representation [Kukula et al. 98]: application of automata based verification to hardware verification

47 Automata vs. Constraint Representation [Kukula et al. 98]: comparison of automata and constraint-based verification –comparison based on reachability analysis –no clear winner –on some cases automata based approach seems to show asymptotic advantage –this could be due to inefficient encoding of booleans in constraint representation

48 Conclusions Constraint-based representations can be more efficient for integer variables with large domains BDD-based model checking is more robust Constraint-based model checkers can handle infinite state systems Constraint-based model checking suffers from inefficient representation of variables with small domains I believe there is room for improvement for constraint- based model checking techniques


Download ppt "BDD vs. Constraint Based Model Checking: An Experimental Evaluation for Asynchronous Concurrent Systems Tevfik Bultan Department of Computer Science University."

Similar presentations


Ads by Google