Parallel LTL-X Model Checking of High- Level Petri Nets Based on Unfoldings Claus Schröter* and Victor Khomenko** *University of Stuttgart, Germany **University of Newcastle upon Tyne, UK UNIVERSITY OF STUTTGART

Basis for our work Esparza and Heljanko (ICALP 2000, SPIN 2001): A New Unfolding Approach to LTL Model-Checking  Net system is constructed as the product of the original net system and an Büchi automaton accepting   Model-checking problem is reduced to detection of illegal ω-traces and illegal livelocks by exploiting finite complete prefixes

Basis for our work Simplicity of this approach Partial order semantics of Petri nets Alleviates the state space explosion problem  Input are low level Petri nets  Low level Petri nets are not convenient for modelling

Low-level PNs: Can be efficiently verified  Not convenient for modelling High-level descriptions:  Verification is hard Convenient for modelling a good intermediate formalism Coloured PNsColoured PNs Gap

Coloured PNs 1 2 w<u+v vu w {1,2} {1..4}

Coloured PNs 1 2 w<u+v vu w {1,2} {1..4}

Coloured PNs w<u+v vu w {1,2} {1..4} 1

Coloured PNs w<u+v vu w {1,2} {1..4} 2

Expansion 1 2 w<u+v v u w {1,2} {1..4}

Expansion 1 2 w<u+v v u w {1,2} {1..4}

Expansion 1 2 w<u+v v u w {1,2} {1..4}

Expansion 1 2 w<u+v v u w {1,2} {1..4}

Expansion 1 2 w<u+v v u w {1,2} {1..4}

Expansion The expansion faithfully models the original net 1 2 w<u+v v u w {1,2} {1..4}  Blow up in size

Finite complete prefix  Introduced by McMillan in 1992  Relies on the partial order view of concurrent computation  Represents system states implicitly, using an acyclic net  Satisfies two key properties: Completeness: Each reachable marking of the original net is represented by at least one reachable marking in the prefix Finiteness: The prefix is finite and thus can be used as an input to model-checking algorithms

Relationship diagram Coloured PNs unfolding Low-level prefix Coloured prefix unfolding Low-level PNs expansion ?

Relationship diagram Coloured PNs unfolding Low-level prefix Coloured prefix unfolding Low-level PNs expansion ~ Khomenko and Koutny proved isomorphism (TACAS’03)

Relationship diagram 1 2 w<u+v v u w {1,2} {1..4} 1 2 u=1 v=2 w=1 12 u=1 v=2 w=2

Example: Buffer of capacity 2 01 t1t1 t2t2 t3t3 p 1 :{0,1}p 3 :{0,1} p 2 :{0,1}p 4 :{0,1} a aa a a a bb

Example: Buffer of capacity 2 01 t1t1 t2t2 t3t3 p 1 :{0,1}p 3 :{0,1} p 2 :{0,1}p 4 :{0,1} a aa a a a bb

Example: Buffer of capacity t1t1 t2t2 t3t3 p 1 :{0,1}p 3 :{0,1} p 2 :{0,1}p 4 :{0,1} a aa a a a bb

Example: Buffer of capacity t1t1 t2t2 t3t3 p 1 :{0,1}p 3 :{0,1} p 2 :{0,1}p 4 :{0,1} a aa a a a bb

Example: Buffer of capacity t1t1 t2t2 t3t3 p 1 :{0,1}p 3 :{0,1} p 2 :{0,1}p 4 :{0,1} a aa a a a bb

Example: Buffer of capacity t1t1 t2t2 t3t3 p 1 :{0,1}p 3 :{0,1} p 2 :{0,1}p 4 :{0,1} a aa a a a bb

Example: Buffer of capacity 2 01 t1t1 t2t2 t3t3 p 1 :{0,1}p 3 :{0,1} p 2 :{0,1}p 4 :{0,1} a aa a a a bb

Example: Buffer of capacity 2 01 t1t1 t2t2 t3t3 p 1 :{0,1}p 3 :{0,1} p 2 :{0,1}p 4 :{0,1} a aa a a a bb Property: φ = ◊□(p 2 ≠0) q0q0 q1q1  (p 2 ≠0) true u0u0 u1u1 I0I0  (p 2 ≠0) q 0 :{  } q 1 :{  } Büchi automaton A  φ

Synchronisation  Standard technique: Synchronisation on all transitions  Synchronisation sequentialises the system  Not suitable for unfolding based verification  Solution: Synchronisation just on those transitions which ‘touch’ the atomic propositions of the formula Concurrency can be exploited

Synchronisation 01 t1t1 t2t2 t3t3 p 1 :{0,1}p 3 :{0,1} p 2 :{0,1}p 4 :{0,1} a aa a a a bb u0u0 q 0 :{  } I0I0  (p 2 ≠0) q 1 :{  } u1u1

Synchronisation 01 t1t1 t2t2 t3t3 p 1 :{0,1}p 3 :{0,1} p 2 :{0,1}p 4 :{0,1} a aa a a a bb u0u0 q 0 :{  } I0I0  (p 2 ≠0) q 1 :{  } u1u1 p2p2 p2p2

Synchronisation 01 t1t1 t2t2 t3t3 p 1 :{0,1}p 3 :{0,1} p 2 :{0,1}p 4 :{0,1} a aa a a a bb u0u0 q 0 :{  } I0I0  (p 2 ≠0) q 1 :{  } u1u1 B:{  } S:{  } p2p2 p2p2

Synchronisation 01 t1t1 t2t2 t3t3 p 1 :{0,1}p 3 :{0,1} p 2 :{0,1}p 4 :{0,1} a aa a a a bb u0u0 q 0 :{  } I0I0  (p 2 ≠0) q 1 :{  } u1u1 B:{  } S:{  } p2p2 p2p2

Synchronisation 01 t1t1 t2t2 t3t3 p 1 :{0,1}p 3 :{0,1} p 2 :{0,1}p 4 :{0,1} a aa a a a bb u0u0 q 0 :{  } I0I0  (p 2 ≠0) q 1 :{  } u1u1 B:{  } S:{  } p2p2 p2p2

Synchronisation 01 t1t1 t2t2 t3t3 p 1 :{0,1}p 3 :{0,1} p 2 :{0,1}p 4 :{0,1} a aa a a a bb u0u0 q 0 :{  } I0I0  (p 2 ≠0) q 1 :{  } u1u1 B:{  } S:{  } p2p2 p2p2

Synchronisation 01 t1t1 t2t2 t3t3 p 1 :{0,1}p 3 :{0,1} p 2 :{0,1}p 4 :{0,1} a aa a a a bb u0u0 q 0 :{  } I0I0  (p 2 ≠0) q 1 :{  } u1u1 B:{  } S:{  } p2p2 p2p2

Synchronisation 01 t1t1 t2t2 t3t3 p 1 :{0,1}p 3 :{0,1} p 2 :{0,1}p 4 :{0,1} a aa a a a bb u0u0 q 0 :{  } I0I0  (p 2 ≠0) q 1 :{  } u1u1 B:{  } S:{  } p2p2 p2p2

Illegal ω-traces  Infinite transition sequence that touches q 1 infinitely often violates φ  To detect such runs we introduce a set I off all transitions putting a token into an accepting Büchi place  An infinite transition sequence of the synchronised net which is fireable from the initial marking and contains infinitely many occurrences of I-transitions violates φ (illegal ω-trace)

Synchronisation 01 t1t1 t2t2 t3t3 p 1 :{0,1}p 3 :{0,1} p 2 :{0,1}p 4 :{0,1} a aa a a a bb u0u0 q 0 :{  } I0I0  (p 2 ≠0) q 1 :{  } u1u1 B:{  } L0L0 S:{  } p2p2 p2p2

Synchronisation 01 t1t1 t2t2 t3t3 p 1 :{0,1}p 3 :{0,1} p 2 :{0,1}p 4 :{0,1} a aa a a a bb u0u0 q 0 :{  } I0I0  (p 2 ≠0) q 1 :{  } u1u1 B:{  } L0L0 L1L1 S:{  } p2p2 p2p2

Synchronisation 01 t1t1 t2t2 t3t3 p 1 :{0,1}p 3 :{0,1} p 2 :{0,1}p 4 :{0,1} a aa a a a bb u0u0 q 0 :{  } I0I0  (p 2 ≠0) q 1 :{  } u1u1 B:{  } L0L0 L1L1 L2L2 S:{  } p2p2 p2p2 p2p2  (p 2 ≠0)

Synchronisation 01 t1t1 t2t2 t3t3 p 1 :{0,1}p 3 :{0,1} p 2 :{0,1}p 4 :{0,1} a aa a a a bb u0u0 q 0 :{  } I0I0  (p 2 ≠0) q 1 :{  } u1u1 B:{  } L0L0 L1L1 L2L2 S:{  } p2p2 p2p2 p2p2  (p 2 ≠0)

q0q0 S p10p10 p31p31 p31p31 p10p10 S q0q0 q0q0 B u0u0 t3t3 p41p41 I0I0 Prefix

q0q0 S p10p10 p31p31 p31p31 p10p10 S q0q0 q0q0 B u0u0 t3t3 p41p41 I0I0

q0q0 S p10p10 p31p31 p31p31 p10p10 S q0q0 q0q0 B u0u0 t3t3 p41p41 I0I0

q0q0 S p10p10 p31p31 p31p31 p10p10 S q0q0 q0q0 B u0u0 t3t3 p41p41 I0I0

q0q0 S p10p10 p31p31 p31p31 p10p10 S q0q0 q0q0 B u0u0 t3t3 p41p41 I0I0

Experimental Results NetFormulaUnfSmdlSpinPunf Abp□(p→◊q) Bds□(p→◊q) Dpd(7) ◊□  (p  q  r) Furnace(3)◊□p GasNq(4)◊□p Rw(12)□(p→◊q) Ftp◊□p>

More Results NetFormulaUnfSmdlSpinPunf Over(5)◊□p Cyclic(12)□(p→◊q) Ring(9)◊□p Dp(12) ◊□  (p  q  r) Ph(12) ◊□  (p  q  r) Com(15,0) □(p→  ◊q) Par(5,10) □(p→  ◊q)

More Results NetSpinPunf Cyclic(15) Cyclic(16) Cyclic(17) Ring(12) Ring(13) Ring(14) Dp(13) Dp(14) NetSpinPunf Com(20,0) Com(21,0) Com(22,0) Ph(15) Ph(18) Ph(21) mem Par(6,10) Par(7,10) 161 mem

Results for Parallel Mode NetSpinPunf(1)Punf(2) Com(20,3) Com(22,3) Com(25,3) mem Par(20,100) Par(20,150) mem Buf(20) Buf(25)

Conclusions  Efficient parallel LTL-X model-checker for high level Petri nets  Based on partial order techniques (unfoldings)  Alleviates the state space explosion problem  Experimental results showed a good performance of our checker for several examples