Branching Processes of High-Level Petri Nets and Model Checking of Mobile Systems Maciej Koutny School of Computing Science Newcastle University with: R.Devillers, V.Khomenko, H.Klaudel, A.Niaouris UFO'07, Siedlce, Poland 2007

2 Outline Motivation Coloured Petri nets Expansion and unfolding Relationship diagram Experimental results Application: mobile systems π-calculus to Petri nets Implementation issues Experimental results Further work

3 Motivation Low-level PNs: Can be efficiently verified Not convenient for modelling High-level descriptions: Convenient for modelling Verification is hard Gap Coloured PNs: a good intermediate formalism

4 Coloured PNs 1 2 w<u+v vu w {1,2} {1..4}

5 Expansion 1 2 w<u+v v u w {1,2} {1..4} The expansion faithfully models the original net Blow up in size

6 Unfolding 1 2 w<u+v v u w {1,2} {1..4} 1 2 u=1 v=2 w=1 1 u=1 v=2 w=2 2

7 Example: computing GCD u=3, v=2 u=2, v=1 u=1 v0v0 m n v u%v u v 0 u u {0..100}

8 Relationship diagram Coloured PNs unfolding Low-level prefix Coloured prefix unfolding Low-level PNs expansion ?

9 ~ Relationship diagram Coloured PNs unfolding Low-level prefix Coloured prefix unfolding Low-level PNs expansion

10 Relationship diagram 1 2 w<u+v v u w {1,2} {1..4} 1 2 u=1 v=2 w=1 12 u=1 v=2 w=2

11 Relationship diagram Coloured PNs unfolding Prefix unfolding Low-level PNs expansion

12 Benefits Avoiding an exponential blow up when building the expansion Definitions are similar to those for LL unfoldings, no new proofs All results and verification techniques for LL unfoldings are still applicable  Model checking algorithms  Canonicity, completeness, finiteness

13 Benefits Existing unfolding algorithms for LL PNs can easily be adapted  Usability of the total adequate order proposed in  All the heuristics improving the efficiency can be employed (e.g. concurrency relation and preset trees)  Parallel unfolding algorithm

14 Extensions: infinite place types v0v0 m n v u%v u v 0 u u {0..100}

15 Extensions: infinite place types v0v0 m n v u%v u v 0 u u N N N u=3, v=2 u=2, v=1 u=1

16 Extensions: infinite place types v0v0 m n v u%v u v 0 u u u=3, v=2 u=2, v=1 u=1 {0..2} {1..3} {1}

17 Refined expansion Coloured PNs unfolding Prefix unfolding Low-level PNs expansion

18 Experimental results Tremendous improvements for colour-intensive PNs (e.g. GCD) Negligible slow-down (<0.5%) for control- intensive PNs (e.g. Lamport’s mutual exclusion algorithm)

19 Application: mobility One of the main features of many crucial modern distributed computing systems Formal analysis and verification using process algebras like π-calculus Our aim: to alleviate the state space explosion problem during reachability analysis of mobile systems Using/adapting model checking algorithms based on unfoldings

20 Syntax (finite) Basic elements are channel (names) like a, b, c,... abinput prefix aboutput prefix τ internal prefix pref.Pfirst execute pref then P P+Qexecute P or Q P | Q execute P and Q in parallel ( ν c) Prestrict c within P A ├ PA is the set of all “known” channels _

21 Operational semantics Operational semantics defined using SOS rules such as: ¬ b є A ______________________________________ A ├ ac.P A {b} ├ {b/c} P One can then consider LTSs generated by π-terms, the associated behavioural properties, etc. ∩ ab

22 p-nets High level Petri nets where tokens can, e.g., be channels τ u vv a b transition is enabled if there is a suitable binding for u and v read arcs (non-directed) only for testing

23 p-nets High level nets where tokens can be, e.g., channels τ u vv a b transition is enabled if there is a suitable binding for u and v for instance u=a v=b

24 p-nets High level nets where tokens can be, e.g., channels τ u vv a b transition is enabled if there is a suitable binding for u and v for instance u=a v=b which leads to b

25 Holder places and read arcs τ u u u vvvv a b snd rcv Blue part (holder places) is related to channels Black part is related to control flow

26 Tag-place Used to maintain information about Known, New and Restricted channels Δ u v a UV _ V.v. K U.u. K v. R V. N e. N a.a. K Δ.RΔ.R

27 Tag-place Used to maintain information about Known, New and Restricted channels Δ u v a UV _ V.v. K U.u. K v. R V. N e. N a.a. K Δ.RΔ.R suitable binding u=U=a v=Δ V=e

28 Tag-place Used to maintain information about Known, New and Restricted channels Δ u v a UV _ V.v. K U.u. K v. R V. N e.Δ. K a.a. K suitable binding u=U=a v=Δ V=e generates ae and then LTS can be defined _

29 p-nets p-nets can be composed to mirror the operators in the process algebra: prefixing parallel composition choice communication

30 Model checking π-calculus Pi-calculus expression Safe High-level PN (p-nets) Automatic translation

31 Example 1 d u v UV V.v. K U.u. K v.v. K v. N e. N b.b. K v v uu U.u. K V.v. K U.u. K d.d. K b Uv {b,d} ├ ba.ad Uv UV _ _

32 Example 1 d u v UV V.v. K U.u. K v.v. K v. N e. N b.b. K v v uu U.u. K V.v. K U.u. K d.d. K b Uv UV _ binding u=U=b v=e

33 Example 1 d u v UV V.v. K U.u. K v.v. K v. N e.e. K b.b. K v v uu U.u. K V.v. K U.u. K d.d. K b Uv UV _ binding u=U=b v=e generates be e

34 Example 1 d u v UV V.v. K U.u. K v.v. K v. N e.e. K b.b. K v v uu U.u. K V.v. K U.u. K d.d. K b Uv UV _ e

35 Example 1 d u v UV V.v. K U.u. K v.v. K v. N e.e. K b.b. K v v uu U.u. K V.v. K U.u. K d.d. K b Uv UV _ binding u=U=e v=V=d e

36 Example 1 d u v UV V.v. K U.u. K v.v. K v. N e.e. K b.b. K v v uu U.u. K V.v. K U.u. K d.d. K b Uv UV _ binding u=U=e v=V=d generates ed e _

37 Example 2 b u v f. N b.b. K v Δ Δ.RΔ.R a.a. K UV a _ _ u V. N v. R U.u. K V.v. K {a,b} ├ (νc)ac.cb __ V.v. K U.u. K

38 Example 2 b u v f. N b.b. K v Δ Δ.RΔ.R a.a. K UV a _ _ u V. N v. R U.u. K V.v. K U.u. K binding u=U=a V=f v= Δ

39 Example 2 b u v b.b. K v Δ f.Δ. K a.a. K UV a _ _ u V. N v. R U.u. K V.v. K U.u. K binding u=U=a V=f v= Δ generates af _

40 Example 2 b u v b.b. K v Δ f.Δ. K a.a. K UV a _ _ u V. N v. R U.u. K V.v. K U.u. K

41 Example 2 b u v b.b. K v Δ f.Δ. K a.a. K UV a _ _ u V. N v. R U.u. K V.v. K U.u. K binding U=f u=Δ V=v=b

42 Example 2 b u v b.b. K v Δ f.Δ. K a.a. K UV a _ _ u V. N v. R U.u. K V.v. K U.u. K binding U=f u=Δ V=v=b generates fb _

43 Example 3 v f. N e.e. K v Δ.RΔ.R a.a. K a u d e Δ d.d. K UV τ v v u u U.u. K v. R V. N V.v. K U.u. K _ _ {a,e,d} ├ (νc)(ac.ec | ab.bd) ___

44 Example 3 v f. N e.e. K v Δ.RΔ.R a.a. K a u d e Δ d.d. K UV τ v v u u U.u. K v. R V. N V.v. K U.u. K _ _

45 Example 3 v f. N e.e. K v Δ.RΔ.R a.a. K a u d e Δ d.d. K UV τ v v u u U.u. K v. R V. N V.v. K U.u. K _ _ Δ

46 Example 3 v f. N e.e. K v Δ.RΔ.R a.a. K a u d e Δ d.d. K UV τ v v u u U.u. K v. R V. N V.v. K U.u. K _ _ Δ

47 Example 3 v e.e. K v f.Δ. K a.a. K a u d e Δ d.d. K UV τ v v u u U.u. K v. R V. N V.v. K U.u. K _ _ Δ

48 Example 3 v e.e. K v f.Δ. K a.a. K a u d e Δ d.d. K UV τ v v u u U.u. K v. R V. N V.v. K U.u. K _ _ Δ

49 Example 3 v e.e. K v f.Δ. K a.a. K a u d e Δ d.d. K UV τ v v u u U.u. K v. R V. N V.v. K U.u. K _ _ Δ

50 Model checking π-calculus pi-calculus expression Safe High-level PN (p-nets) PN unfolding Property Checking PUNF MPSat

51 Implementation issues Infinity of new channels Read arcs Non-safeness Partial-transition expansion Reducing the number of holder places

52 Example T ness NESS a h1 h2 h3 h4 a?ness

53 Example T ness NESS a h1 h2 h3 h4 h1!ness | h2!ness | h3!ness | h4!ness ness

54 Example T ness NESS a h1 h2 h3 h4 h1?addr1 | h2?addr2 | h3?addr3 | h4?addr4 ness

55 Example T ness NESS a h1 h2 h3 h4

56 Example T NESS a h1 h2 h3 h4 h h h!h1. h1!done. STOP + h?another1.addr1!h1. addr1!another1. h1!done.STOP ness

57 Experiments Problem Net Prefix |B| |E| Time Punf MPSat Time MWB |P| |T| Ness(2) <1 Ness(3) <1 Ness(4) <1 7 Ness(5) <1 - Ness(6) Ness(7)

58 Further work We need efficient extensions of the unfolding approach for read arcs Introduce a restricted form of recursion still allowing one to use model-checking Deal with the state space explosion caused by aspects other than high level of concurrency Further performance comparisons of this model with other model checkers

59 Thank you!