UCb Kim Guldstrand Larsen Symbolic Model Checking …and Verification Options How UPPAAL really works & How to make UPPAAL really work

UCb IDA foredrag THE UPPAAL ENGINE Symbolic Reachability Checking

TOV 2002, Lektion 3.Kim G. Larsen UCb 3 Zones From infinite to finite State (n, x=3.2, y=2.5 ) x y x y Symbolic state (set ) (n, ) Zone: conjunction of x-y n

TOV 2002, Lektion 3.Kim G. Larsen UCb 4 Symbolic Transitions n m x>3 y:=0 delays to conjuncts to projects to x y 1<=x<=4 1<=y<=3 x y 1<=x, 1<=y -2<=x-y<=3 x y 3<x, 1<=y -2<=x-y<=3 3<x, y=0 x y Thus (n,1 (m,3<x, y=0) a

TOV 2002, Lektion 3.Kim G. Larsen UCb 5 A1 B1 CS1 V:=1V=1 A2 B2 CS2 V:=2V=2 Init V=1 2 ´´ V Criticial Section Fischer’s Protocol analysis using zones Y<10 X:=0 Y:=0 X>10 Y>10 X<10

TOV 2002, Lektion 3.Kim G. Larsen UCb 6 Fischers cont. B1 CS1 V:=1V=1 A2 B2 CS2 V:=2V=2 Y<10 X:=0 Y:=0 X>10 Y>10 X<10 A1,A2,v=1A1,B2,v=2A1,CS2,v=2B1,CS2,v=1CS1,CS2,v=1 Untimed case A1

TOV 2002, Lektion 3.Kim G. Larsen UCb 7 Fischers cont. B1 CS1 V:=1V=1 A2 B2 CS2 V:=2V=2 Y<10 X:=0 Y:=0 X>10 Y>10 X<10 A1,A2,v=1A1,B2,v=2A1,CS2,v=2B1,CS2,v=1CS1,CS2,v=1 Untimed case Taking time into account X Y A1

TOV 2002, Lektion 3.Kim G. Larsen UCb 8 Fischers cont. B1 CS1 V:=1V=1 A2 B2 CS2 V:=2V=2 Y<10 X:=0 Y:=0 X>10 Y>10 X<10 A1,A2,v=1A1,B2,v=2A1,CS2,v=2B1,CS2,v=1CS1,CS2,v=1 Untimed case Taking time into account X Y A1 10 X Y

TOV 2002, Lektion 3.Kim G. Larsen UCb 9 Fischers cont. B1 CS1 V:=1V=1 A2 B2 CS2 V:=2V=2 Y<10 X:=0 Y:=0 X>10 Y>10 X<10 A1,A2,v=1A1,B2,v=2A1,CS2,v=2B1,CS2,v=1CS1,CS2,v=1 Untimed case Taking time into account A1 10 X Y X Y

TOV 2002, Lektion 3.Kim G. Larsen UCb 10 Fischers cont. B1 CS1 V:=1V=1 A2 B2 CS2 V:=2V=2 Y<10 X:=0 Y:=0 X>10 Y>10 X<10 A1,A2,v=1A1,B2,v=2A1,CS2,v=2B1,CS2,v=1CS1,CS2,v=1 Untimed case Taking time into account A1 10 X Y X Y X Y

TOV 2002, Lektion 3.Kim G. Larsen UCb 11 Fischers cont. B1 CS1 V:=1V=1 A2 B2 CS2 V:=2V=2 Y<10 X:=0 Y:=0 X>10 Y>10 X<10 A1,A2,v=1A1,B2,v=2A1,CS2,v=2B1,CS2,v=1CS1,CS2,v=1 Untimed case Taking time into account A1 10 X Y X Y X Y

TOV 2002, Lektion 3.Kim G. Larsen UCb 12 Forward Rechability Passed Waiting Final Init INITIAL Passed := Ø; Waiting := {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some Z’ Z (n,Z’) in Passed then STOP - else (explore) add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTIL Waiting = Ø or Final is in Waiting Init -> Final ?

TOV 2002, Lektion 3.Kim G. Larsen UCb 13 Forward Rechability Passed Waiting Final Init n,Z INITIAL Passed := Ø; Waiting := {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some Z’ Z (n,Z’) in Passed then STOP - else (explore) add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTIL Waiting = Ø or Final is in Waiting n,Z’ Init -> Final ?

TOV 2002, Lektion 3.Kim G. Larsen UCb 14 Forward Rechability Passed Waiting Final Init n,Z INITIAL Passed := Ø; Waiting := {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some Z’ Z (n,Z’) in Passed then STOP - else /explore/ add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTIL Waiting = Ø or Final is in Waiting n,Z’ m,U Init -> Final ?

TOV 2002, Lektion 3.Kim G. Larsen UCb 15 Forward Rechability Passed Waiting Final Init INITIAL Passed := Ø; Waiting := {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some Z’ Z (n,Z’) in Passed then STOP - else /explore/ add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTIL Waiting = Ø or Final is in Waiting n,Z’ m,U n,Z Init -> Final ?

TOV 2002, Lektion 3.Kim G. Larsen UCb 16 Canonical Dastructures for Zones Difference Bounded Matrices Bellman 1958, Dill 1989 x<=1 y-x<=2 z-y<=2 z<=9 x<=1 y-x<=2 z-y<=2 z<=9 x<=2 y-x<=3 y<=3 z-y<=3 z<=7 x<=2 y-x<=3 y<=3 z-y<=3 z<=7 D1 D2 Inclusion 0 x y z x y z ? ? Graph

TOV 2002, Lektion 3.Kim G. Larsen UCb 17 Bellman 1958, Dill 1989 x<=1 y-x<=2 z-y<=2 z<=9 x<=1 y-x<=2 z-y<=2 z<=9 x<=2 y-x<=3 y<=3 z-y<=3 z<=7 x<=2 y-x<=3 y<=3 z-y<=3 z<=7 D1 D2 Inclusion 0 x y z Shortest Path Closure Shortest Path Closure 0 x y z x y z x y z Graph ? ? Canonical Dastructures for Zones Difference Bounded Matrices Canonical Form

TOV 2002, Lektion 3.Kim G. Larsen UCb 18 Bellman 1958, Dill 1989 x<=1 y>=5 y-x<=3 x<=1 y>=5 y-x<=3 D Emptyness 0 y x Negative Cycle iff empty solution set Graph Canonical Dastructures for Zones Difference Bounded Matrices

TOV 2002, Lektion 3.Kim G. Larsen UCb 19 1<= x <=4 1<= y <=3 1<= x <=4 1<= y <=3 D Future x y x y Future D 0 y x 4 3 Shortest Path Closure Remove upper bounds on clocks 1<=x, 1<=y -2<=x-y<=3 1<=x, 1<=y -2<=x-y<=3 y x y x Canonical Dastructures for Zones Difference Bounded Matrices

TOV 2002, Lektion 3.Kim G. Larsen UCb 20 Canonical Dastructures for Zones Difference Bounded Matrices x y D 1<=x, 1<=y -2<=x-y<=3 1<=x, 1<=y -2<=x-y<=3 y x Remove all bounds involving y and set y to 0 x y {y}D y=0, 1<=x Reset y x 0 0 0

TOV 2002, Lektion 3.Kim G. Larsen UCb 21 Improved Datastructures Compact Datastructure for Zones x1-x2<=4 x2-x1<=10 x3-x1<=2 x2-x3<=2 x0-x1<=3 x3-x0<=5 x1-x2<=4 x2-x1<=10 x3-x1<=2 x2-x3<=2 x0-x1<=3 x3-x0<=5 x1x2 x3x x1x2 x3x x1x2 x3x Shortest Path Closure O(n^3) Shortest Path Reduction O(n^3) 3 Canonical wrt = Space worst O(n^2) practice O(n) RTSS’97

TOV 2002, Lektion 3.Kim G. Larsen UCb 22

TOV 2002, Lektion 3.Kim G. Larsen UCb 23

TOV 2002, Lektion 3.Kim G. Larsen UCb 24 v and w are both redundant Removal of one depends on presence of other. v and w are both redundant Removal of one depends on presence of other. Shortest Path Reduction 1st attempt Idea Problem w <=w An edge is REDUNDANT if there exists an alternative path of no greater weight THUS Remove all redundant edges! An edge is REDUNDANT if there exists an alternative path of no greater weight THUS Remove all redundant edges! w v Observation: If no zero- or negative cycles then SAFE to remove all redundancies. Observation: If no zero- or negative cycles then SAFE to remove all redundancies.

TOV 2002, Lektion 3.Kim G. Larsen UCb 25 Shortest Path Reduction Solution G: weighted graph

TOV 2002, Lektion 3.Kim G. Larsen UCb 26 Shortest Path Reduction Solution G: weighted graph 1. Equivalence classes based on 0-cycles.

TOV 2002, Lektion 3.Kim G. Larsen UCb 27 Shortest Path Reduction Solution G: weighted graph 1. Equivalence classes based on 0-cycles. 2. Graph based on representatives. Safe to remove redundant edges

TOV 2002, Lektion 3.Kim G. Larsen UCb 28 Shortest Path Reduction Solution G: weighted graph 1. Equivalence classes based on 0-cycles. 2. Graph based on representatives. Safe to remove redundant edges 3. Shortest Path Reduction = One cycle pr. class + Removal of redundant edges between classes Canonical given order of clocks

TOV 2002, Lektion 3.Kim G. Larsen UCb 29 Earlier Termination Passed Waiting Final Init INITIAL Passed := Ø; Waiting := {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some Z’ Z (n,Z’) in Passed then STOP - else /explore/ add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTIL Waiting = Ø or Final is in Waiting n,Z’ m,U n,Z Init -> Final ?

TOV 2002, Lektion 3.Kim G. Larsen UCb 30 Earlier Termination Passed Waiting Final Init INITIAL Passed := Ø; Waiting := {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some Z’ Z (n,Z’) in Passed then STOP - else /explore/ add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTIL Waiting = Ø or Final is in Waiting n,Z’ m,U n,Z Init -> Final ?

TOV 2002, Lektion 3.Kim G. Larsen UCb 31 INITIAL Passed := Ø; Waiting := {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some (n,Z’) in Passed then STOP - else /explore/ add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTIL Waiting = Ø or Final is in Waiting Earlier Termination Passed Waiting Final Init n,Z k m,U n,Z Init -> Final ? n,Z 1 n,Z 2

TOV 2002, Lektion 3.Kim G. Larsen UCb 32 Clock Difference Diagrams = Binary Decision Diagrams + Difference Bounded Matrices CDD-representations CAV99 zNodes labeled with differences zMaximal sharing of substructures (also across different CDDs) zMaximal intervals zLinear-time algorithms for set-theoretic operations. zNDD’s Maler et. al zDDD’s Møller, Lichtenberg

TOV 2002, Lektion 3.Kim G. Larsen UCb 33

TOV 2002, Lektion 3.Kim G. Larsen UCb 34

TOV 2002, Lektion 3.Kim G. Larsen UCb 35 Verification Options Breadth-First Depth-First Clock Reduction State Space Reduction State Space Repr. DBM Compact Over-approximation Under-approx Reuse State Space Diagnostic Trace Breadth-First Depth-First Clock Reduction State Space Reduction State Space Repr. DBM Compact Over-approximation Under-approx Reuse State Space Diagnostic Trace Case Studies

TOV 2002, Lektion 3.Kim G. Larsen UCb 36 Representation of symbolic states (In)Active Clock Reduction x is only active in location S1 x>3 x<5 x:=0 S x is inactive at S if on all path from S, x is always reset before being tested. Definition x<7

TOV 2002, Lektion 3.Kim G. Larsen UCb 37 Representation of symbolic states Active Clock Reduction x>3 x<5 S x is inactive at S if on all path from S, x is always reset before being tested. Definition g1 gk g2 r1 r2rk S1 S2Sk Only save constraints on active clocks

TOV 2002, Lektion 3.Kim G. Larsen UCb 38 When to store symbolic state State Space Reduction No Cycles: Passed list not needed for termination However, Passed list useful for efficiency

TOV 2002, Lektion 3.Kim G. Larsen UCb 39 When to store symbolic state State Space Reduction Cycles: Only symbolic states involving loop-entry points need to be saved on Passed list

TOV 2002, Lektion 3.Kim G. Larsen UCb 40 Reuse State Space Passed Waiting prop1 A[] prop1 A[] prop2 A[] prop3 A[] prop4 A[] prop5. A[] propn Search in existing Passed list before continuing search Which order to search? prop2

TOV 2002, Lektion 3.Kim G. Larsen UCb 41 Reuse State Space Passed Waiting prop1 A[] prop1 A[] prop2 A[] prop3 A[] prop4 A[] prop5. A[] propn Search in existing Passed list before continuing search Which order to search? Hashtable prop2

TOV 2002, Lektion 3.Kim G. Larsen UCb 42 Over-approximation Convex Hull x y Convex Hull

TOV 2002, Lektion 3.Kim G. Larsen UCb 43 Under-approximation Bitstate Hashing Passed Waiting Final Init n,Z’ m,U n,Z

TOV 2002, Lektion 3.Kim G. Larsen UCb 44 Under-approximation Bitstate Hashing Passed Waiting Final Init n,Z’ m,U n,Z Passed= Bitarray UPPAAL 8 Mbits Hashfunction F

TOV 2002, Lektion 3.Kim G. Larsen UCb 45 Bitstate Hashing INITIAL Passed := Ø; Waiting := {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some Z’ Z then STOP (n,Z’) in Passed then STOP - else /explore/ add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTIL Waiting = Ø or Final is in Waiting INITIAL Passed := Ø; Waiting := {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some Z’ Z then STOP (n,Z’) in Passed then STOP - else /explore/ add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTIL Waiting = Ø or Final is in Waiting Passed(F(n,Z)) = 1 Passed(F(n,Z)) := 1

TOV 2002, Lektion 3.Kim G. Larsen UCb 46 Best Options for Fischer

TOV 2002, Lektion 3.Kim G. Larsen UCb 47 Best Options for Fischer

TOV 2002, Lektion 3.Kim G. Larsen UCb 48 Overview zTimed Automata (review) zUPPAAL 3.2 zSymbolic Reachability & Datastructures yDBMs yCompact Datastructure yCDDs zVerification Options zBeyond Model Checking

TOV 2002, Lektion 3.Kim G. Larsen UCb 49 The State Explosion Problem a cb a cb a cb a cb a cb a cb a cb a cb Model-checking is either EXPTIME-complete or PSPACE-complete (for TA’s this is true even for a single TA) Model-checking is either EXPTIME-complete or PSPACE-complete (for TA’s this is true even for a single TA) Sys

TOV 2002, Lektion 3.Kim G. Larsen UCb 50 Abstraction a cb a cb a cb a cb a cb a cb a cb a cb Sys Abs REDUCE TO Preserving safety properties

TOV 2002, Lektion 3.Kim G. Larsen UCb 51 Compositionality Sys Sys 1 Sys 2 a cb a cb a cb a cb a cb a cb a cb a cb Abs 1 Abs 2

TOV 2002, Lektion 3.Kim G. Larsen UCb 52 Timed Simulation UPPAAL

TOV 2002, Lektion 3.Kim G. Larsen UCb 53 Timed Simulation UPPAAL Applied to IEEE 1394a Root contention protocol (Simons, Stoelinga) B&O Power Down Protocol (Ejersbo, Larsen, Skou, FTRTFT2k) Modifications identified when urgency and shared integers

UCb IDA foredrag THE END (almost)almost

TOV 2002, Lektion 3.Kim G. Larsen UCb 55

TOV 2002, Lektion 3.Kim G. Larsen UCb 56

TOV 2002, Lektion 3.Kim G. Larsen UCb 57

TOV 2002, Lektion 3.Kim G. Larsen UCb 58

TOV 2002, Lektion 3.Kim G. Larsen UCb 59