Model checking dynamic states in GROOVE Arend Rensink Formal Methods and Tools University of Twente

IPA Spring Days, 7 May 2008 Model checking dynamic states in Groove2 Outline Context: Graph transformation – GROOVE tool for software model checking Integrated methods – On-the-fly model checking – Partial order reduction Method integration – Stochastic analysis – Aspect-oriented program analysis Interoperability – Syntactic: Model transformation – Semantic: Graph transformation approaches

IPA Spring Days, 7 May 2008 Model checking dynamic states in Groove3 States as graphs Objects & method frames as nodes Relations & variables as (labelled) edges BufferCell next last first Object val heap stack

IPA Spring Days, 7 May 2008 Model checking dynamic states in Groove4 Graph formalism Graphs in this presentation: – flat (i.e., not hierarchical), untyped – directed, edge-labelled, no parallel edges – self-edges depicted as node labels Formally: G = (L,N,E) with – L set of labels – N finite set of nodes – E  N  L  N finite set of labelled edges Partial morphisms – structure-preserving node mappings

IPA Spring Days, 7 May 2008 Model checking dynamic states in Groove5 Graphs as states BufferCell next first, last Object val BufferCell next last first Object val Object val BufferCell next last first Object val Object val Object val BufferCell next first last BufferCell next last first Object val

IPA Spring Days, 7 May 2008 Model checking dynamic states in Groove6 forbidden Graph Productions Production rule source graph matching Graph transition src(t)tgt(t) morph(t) target graph pushout NAC NACs (SPO = Single Pushout Approach) LHSRHS rule morphism (partial)

IPA Spring Days, 7 May 2008 Model checking dynamic states in Groove7 Example production rule Alternative single-graph representation: Buffer Cell Object next val last Object blue = eraser: LHS, not RHS; to be matched and deleted green = creator: RHS, not LHS; to be added black = reader: LHS and RHS; to be matched and preserved red = embargo: NAC, not LHS; forbidden

IPA Spring Days, 7 May 2008 Model checking dynamic states in Groove8 Aim: software model checking Construct graph procuction system from – UML diagrams / other specifications – Programs to be checked Generate state space – States=graphs, transitions=transformations Formulate properties – invariants/reachability (safety) – liveness – full temporal logic Check properties on the model

IPA Spring Days, 7 May 2008 Model checking dynamic states in Groove9 Envisaged tool chain Program (source) Program (graph) Compilation Semantics (rules) Generation State space (GTS) Properties Verification Conclusion Testing Tracing abstraction refinement Rule system per language Combine (on-the- fly checking)

IPA Spring Days, 7 May 2008 Model checking dynamic states in Groove10 Problem: Complexity of GT Traditional approach – Concurrent communicating automata – Model paradigm much closer to machine – Fast evaluation – 20 years research in Symbolic storage Symmetry & partial order reduction Abstractions & heuristics Graph Transformation – Graph matching & manipulation – Dynamic models: No a priori bounds – Many existing results do not apply Sometimes reflects a feature of the modelled system

IPA Spring Days, 7 May 2008 Model checking dynamic states in Groove11 Challenge: How to counter Transfer existing results to GT approach (integrated methods) – Model checking algorithms – Partial order reduction Make use of graph structure – Store states as graph deltas – Isomorphism for symmetry reduction – Graph-based abstractions – Nested rules

IPA Spring Days, 7 May 2008 Model checking dynamic states in Groove12 Outline Context: Graph transformation – GROOVE tool for software model checking Integrated methods – On-the-fly model checking – Partial order reduction Method integration – Stochastic analysis – Aspect-oriented program analysis Interoperability – Syntactic: Model transformation – Semantic: Graph transformation approaches

IPA Spring Days, 7 May 2008 Model checking dynamic states in Groove13 Integrated Methods On-the fly model checking – Principle: check while expanding state space; in particular, check for cycles – Problem: state space here infinite; hence cycle check easily fails to terminate – Solution: combination with bounded MC Partial order reduction – Principle: avoid concurrent interleavings – Problem: actions here a priori unknown – Solution: new POR algorithm

IPA Spring Days, 7 May 2008 Model checking dynamic states in Groove14 Example: On-the-fly model checking Existing algorithm [Schwoon, Ersparza 2005] Exhaustive DFS detect cycles in accepting states The exhaustive DFS will not terminat for infinite state spaces

IPA Spring Days, 7 May 2008 Model checking dynamic states in Groove15 Combination with bounded checking Approximate ! by sequence of ! i

IPA Spring Days, 7 May 2008 Model checking dynamic states in Groove16 Outline Context: Graph transformation – GROOVE tool for software model checking Integrated methods – On-the-fly model checking – Partial order reduction Method integration – Stochastic analysis – Aspect-oriented program analysis Interoperability – Syntactic: Model transformation – Semantic: Graph transformation approaches

IPA Spring Days, 7 May 2008 Model checking dynamic states in Groove17 Method Integration: Example 1 Stochastic graph transformation systems [Heckel, Lajios, Menge, 2006] – Application area: performance/reliability analysis of dynamic systems – Basic idea: Associate rates with graph transformation rules – Generate state space – Derive and solve continuous-time Markov chains – Tool chain: GROOVE -> PRISM/EMC 2 GROOVE [offers] state space generation [and] import/export functionality.

IPA Spring Days, 7 May 2008 Model checking dynamic states in Groove18 Example transformation rules move connect breakdownfail handover

IPA Spring Days, 7 May 2008 Model checking dynamic states in Groove19 Method Integration: Example 2 Aspect composition conflict detection [Havinga et al., 2007] – Application area: aspect-oriented programming – Analysis of run-time introduction of new methods in existing classes – Translate Java and AspectJ to graphs – Graph trafo rules to model introductions – Conflict detection through forbidden patterns

IPA Spring Days, 7 May 2008 Model checking dynamic states in Groove20 Example graphs and rules AspectJ program Abstract syntax graph Forbidden pattern Introduction rule

IPA Spring Days, 7 May 2008 Model checking dynamic states in Groove21 Outline Context: Graph transformation – GROOVE tool for software model checking Integrated methods – On-the-fly model checking – Partial order reduction Method integration – Stochastic analysis – Aspect-oriented program analysis Interoperability – Syntactic: Model transformation – Semantic: Graph transformation approaches

IPA Spring Days, 7 May 2008 Model checking dynamic states in Groove22 Syntactic Interoperability: Example Graph Transformation Semantics for QVT [Rensink, Nederpel 2006] – Context: model transformation – Approach: use graph transformation

IPA Spring Days, 7 May 2008 Model checking dynamic states in Groove23 Overall method Artefacts 1-3 given in different languages Steps 4-6 involve syntactic translations – There is no semantics to be preserved – Translation defines semantics

IPA Spring Days, 7 May 2008 Model checking dynamic states in Groove24 Semantic Interoperability: Example Simulating Multigraph Transformations Using Simple Graphs [Boneva et al. 2007] – Motivation: use GROOVE technology for other tools’ graph production systems – Different graph models (multigraphs have edge identities) – Different transformation approaches (Single Pushout versus Double Pushout) – Encoding: translate multigraph edges into simple graph nodes

IPA Spring Days, 7 May 2008 Model checking dynamic states in Groove25 Conclusion GROOVE technology used in different contexts – Built on well-researched formal methods – Usable GUI – XML-based graph I/O – Open Java source code Integrating methods necessary, but – Not seen as “cutting edge” research – Ratio effort/output not highest – We need more funding for this!!