# BDD vs. Constraint Based Model Checking: An Experimental Evaluation for Asynchronous Concurrent Systems Tevfik Bultan Department of Computer Science University.

## Presentation on theme: "BDD vs. Constraint Based Model Checking: An Experimental Evaluation for Asynchronous Concurrent Systems Tevfik Bultan Department of Computer Science University."— Presentation transcript:

BDD vs. Constraint Based Model Checking: An Experimental Evaluation for Asynchronous Concurrent Systems Tevfik Bultan Department of Computer Science University of California, Santa Barbara bultan@cs.ucsb.edu http://www.cs.ucsb.edu/~bultan/

Outline Concurrency problems Symbolic model checking Functionality required for symbolic model checking BDD representation Constraint representation Experimental results Related work Conclusions

Program: Bakery Data Variables: a, b: positive integer Control Variables: pc1, pc2: {T, W, C} Initial Condition: a=b=0 & pc1=T1 & pc2=T2 Events: eT1: pc1=T & pc1’=W & a’=b+1 eW1: pc1=W & (a { "@context": "http://schema.org", "@type": "ImageObject", "contentUrl": "http://images.slideplayer.com/13/3893426/slides/slide_3.jpg", "name": "Program: Bakery Data Variables: a, b: positive integer Control Variables: pc1, pc2: {T, W, C} Initial Condition: a=b=0 & pc1=T1 & pc2=T2 Events: eT1: pc1=T & pc1’=W & a’=b+1 eW1: pc1=W & (a

Program: Barber Data Variables: cinchair,cleave,bavail, bbusy,bdone: positive integer Control Variables: pc1,pc2,pc3: {1,2} Initial Condition: cinchair=cleave=bavail =bbusy=bdone=0 & pc1=pc2=pc3=1 Events: eHairCut1: pc1=1 & pc1’=2 & cinchair { "@context": "http://schema.org", "@type": "ImageObject", "contentUrl": "http://images.slideplayer.com/13/3893426/slides/slide_4.jpg", "name": "Program: Barber Data Variables: cinchair,cleave,bavail, bbusy,bdone: positive integer Control Variables: pc1,pc2,pc3: {1,2} Initial Condition: cinchair=cleave=bavail =bbusy=bdone=0 & pc1=pc2=pc3=1 Events: eHairCut1: pc1=1 & pc1’=2 & cinchair

BARBER: AG(cinchair >=cleave & bavail>=bbusy>=bdone & cinchair<=bavail & bbusy<=cinchair & cleave<=bdone) BARBER-1: AG(cinchair>=cleave & bavail>=bbusy>=bdone) BARBER-2: AG(cinchair<=bavail & bbusy<=cinchair) BARBER-3: AG(cleave<=bdone)

Program:Readers-Writers Data Variables: nr, nw: positive integer Initial Condition: nr=nw=0 Events: eReaderEnter: nw=0 & nr’=nr+1 eReaderExit: nr>0 & nr’=nr-1 eWriterEnter: nr=0 & nw= 0 & nw’=nw+1 eWriterExit: nw>0 & nw=nw-1 READERS-WRITERS: AG((nr=0 | nw=0) & nw<=1)

Program: Bounded-Buffer Parameterized Constant: size: positive integer Data Variables: available, produced, consumed: positive integer Initial Condition: produced=consumed=0 & available = size Events: eProduce: 0 { "@context": "http://schema.org", "@type": "ImageObject", "contentUrl": "http://images.slideplayer.com/13/3893426/slides/slide_7.jpg", "name": "Program: Bounded-Buffer Parameterized Constant: size: positive integer Data Variables: available, produced, consumed: positive integer Initial Condition: produced=consumed=0 & available = size Events: eProduce: 0

BOUNDED-BUFFER: AG(produced-consumed=size-available & 0<=available<=size) BOUNDED-BUFFER-1: AG(produced-consumed=size-available) BOUNDED-BUFFER-2: AG(0<=available<=size) BOUNDED-BUFFER-3: AG(0<=produced-consumed<=size)

CIRCULAR-QUEUE: AG(0<=produced-consumed<=size & produced-consumed=occupied) CIRCULAR-QUEUE-1: AG(0<=produced-consumed<=size) CIRCULAR-QUEUE-2: AG(produced-consumed=occupied)

Model Checking Given a program and a temporal property p: Either show that all the initial states satisfy the temporal property p –set of initial states  truth set of p Or find an initial state which does not satisfy the property p –a state  set of initial states  truth set of  p

Temporal Properties  Fixpoints EF p  p  (EX p)  EX (EX p)  … 1 3 2

Temporal Properties  Fixpoints Note that –AG p   EF(  p ) Other temporal operators can also be represented as fixpoints –AF p, EG p, p AU q, p EU q

Tools Required for Model Checking Basic set operations intersection, union, set difference –to handle    Equivalence Checking –to check if the fixpoint is reached Relational image computation –for precondition operation EX

Functionality of a Symbolic Representation Symbolic And(Symbolic,Symbolic) Symbolic Or(Symbolic,Symbolic) Symbolic Not(Symbolic) BooleanEquivalent(Symbolic,Symbolic) Symbolic EX(Symbolic)

BDDs Efficient representation for boolean functions Disjunction, conjunction complexity: at most quadratic Negation complexity: constant Equivalence checking complexity: constant or linear Image computation complexity: can be exponential

BDD encoding for Integer Variables Systems with bounded integer variables can be represented using BDDs Use a binary encoding –represent integer x as x 0 x 1 x 2... x k –where x 0, x 1, x 2,..., x k are binary variables You have to be careful about the variable ordering!

Integers in SMV SMV represents integers using a binary encoding In the BDD variable ordering current and next state bits of an integer variable are interleaved –good for x’ = x Bits of different variables are not interleaved –What happens when we have x’ = y ?

x2 x2’x1x1’x0x0’y2y2’y1y1’y0y0’x2 x2’x1x1’x0x0’y2y2’y1y1’y0y0’ We have to remember every x’ bit until this point for x’ = y

William Chan’s Ordering Using a preprocessor converts integer variables to boolean variables Interleaves bits of all integer variables in the BDD ordering Results with much better performance for systems with integer variables

Linear Arithmetic Constraints Constraints Constraint representation  a i x i = c 1  i  n  a i x i  c 1  i  n   constraint kl 1  k  h1  l  m

Linear Arithmetic Constraints Can be used to represent unbounded integers Disjunction complexity: linear Conjunction complexity: quadratic Negation complexity: can be exponential Equivalence checking complexity: can be exponential Image computation complexity: can be exponential

Image Computation in Omega Library Extension of Fourier-Motzkin variable elimination for real variables Eliminating one variable from a conjunction of constraints may double the number of constraints Integer variables complicate the problem even further

Fourier-Motzkin Variable Elimination Given two constraints   bz and az   we have a   abz  b  We can eliminate z as:  z. a   abz  b  if and only if a   b  Every upper and lower bound pair can generate a separate constraint, the number of constraints can double for each eliminated variable real shadow

Integers are More Complicated If z is integer  z. a   abz  b  if a  + (a - 1)(b - 1)  b  Remaining solutions can be characterized using periodicity constraints in the following form:  z.  + i = bz dark shadow

 y. 0  3y – x  7  1  x – 2y  5 Consider the constraints: 2x  6y2x  6y We get the following bounds for y: 6y  2x + 14 6y  3x - 33x - 15  6y When we combine 2 lower bounds with 2 upper bounds we get four constraints: 0  14, 3  x, x  29, 0  12 Result is: 3  x  29

2y  x – 1 x – 5  2y 3y  x + 7 x  3y dark shadow real shadow 293 y x

Systems with Bounded Integer Variables BDDs and constraint representations are both applicable Which one is better?

Experiments Intel Pentium PC (500MHz, 128MByte main memory) Three approaches are compared –SMV –SMV with Chan’s interleaved variable ordering –Omega library model checker

BAKERY: AG(!(pc1=c & pc2=C)) BARBER: AG(cinchair >=cleave & bavail>=bbusy>=bdone & cinchair<=bavail & bbusy<=cinchair & cleave<=bdone) BARBER-1: AG(cinchair>=cleave & bavail>=bbusy>=bdone) BARBER-2: AG(cinchair<=bavail & bbusy<=cinchair) BARBER-3: AG(cleave<=bdone) READERS-WRITERS: AG((nr=0 | nw=0) & nw<=1) BOUNDED-BUFFER: AG(produced-consumed=size-available & 0<=available<=size) BOUNDED-BUFFER-1: AG(produced-consumed=size-available) BOUNDED-BUFFER-2: AG(0<=available<=size) BOUNDED-BUFFER-3: AG(0<=produced-consumed<=size) CIRCULAR-QUEUE: AG(0<=produced-consumed<=size & produced-consumed=occupied) CIRCULAR-QUEUE-1: AG(0<=produced-consumed<=size) CIRCULAR-QUEUE-2: AG(produced-consumed=occupied)

TimeMemoryTimeMemory Bakery 20.1215070.29655 Bakery 30.8222287.3212165 Bakery 419.159110  Barber0.4024250.551458 Barber-10.53249015.3723101 Barber-20.3522280.29926 Barber-30.3522280.29926 RW0.0312450.05295 SMV (interleaved)Omega Each integer variable is restricted to 0  i  1024

TimeMemoryTimeMemory BB0.2821630.04147 BB-10.2722280.05188 BB-20.2621630.04147 BB-3163.303080  CQ1.0834080.10377 CQ-11228.456357  CQ-21.0433420.07328 SMV (interleaved)Omega Each integer variable is restricted to 0  i  1024 Size of the buffer is restricted to 0  size  16

Constraint-Based Verification: Not a New Idea [Cooper 71]: used a decision procedure for Presburger arithmetic to verify sequential programs represented in a block form [Cousot and Halbwachs 78]: used real arithmetic constraints to discover invariants of sequential programs

Constraint-Based Verification: [Halbwachs 93]: constraint based delay analysis in synchronous programs [Halbwachs et al. 94]: verification of linear hybrid systems using constraint representations [Alur et al. 96]: HyTech, a model checker for hybrid systems

Constraint-Based Verification [Boigelot and Wolper 94]: symbolic verification with periodic sets [Bultan et al. 97, 99]: used Presburger arithmetic constraints for model checking concurrent systems [Delzanno and Podelski 99]: built a model checker using constraint logic programming framework

BDD-Based Verification [Bryant 86]: Reduced ordered BDDs [Coudert et al. 90]: BDD-based verification [Burch et al. 90]: Symbolic model checking [McMillan 93]: SMV

Combining BDDs and Constraints [Chan et al. 97]: combining BDD representation with a constraint solver (it can handle nonlinear constraints but the transition system is restricted) [Bultan et al. 98, 00]: combining different symbolic representations in one model checker (combined BDDs and linear arithmetic constraints in a disjunctive form)

Automata-Based Representations [Klarlund et al. 95]: MONA, an automata manipulation tool for verification [Wolper and Boigelot]: verification using automata as a symbolic representation [Kukula et al. 98]: application of automata based verification to hardware verification

Automata vs. Constraint Representation [Kukula et al. 98]: comparison of automata and constraint-based verification –comparison based on reachability analysis –no clear winner –on some cases automata based approach seems to show asymptotic advantage –this could be due to inefficient encoding of booleans in constraint representation

Conclusions Constraint-based representations can be more efficient for integer variables with large domains BDD-based model checking is more robust Constraint-based model checkers can handle infinite state systems Constraint-based model checking suffers from inefficient representation of variables with small domains I believe there is room for improvement for constraint- based model checking techniques

Download ppt "BDD vs. Constraint Based Model Checking: An Experimental Evaluation for Asynchronous Concurrent Systems Tevfik Bultan Department of Computer Science University."

Similar presentations