General Techniques for Symmetry Reduction in Model Checking Alastair Donaldson Alice Miller Department of Computing Science University of Glasgow

Model Checking System design or code Requirements Finite state model M Set of logical properties Model checker M |= φ ? for each property φ No Yes √ ? manual automatic

Model Written in High Level Language byte tok = 1; active [2] proctype user() { byte state = N; do :: (state == N) -> state = T :: (state == T) && (tok == _pid) -> state = C :: (state == C) -> state = N; if :: tok = 1 :: tok = 2 fi od }

Symmetry Reduction: Example N 1 N 2 tok=1 N 1 N 2 tok=2 N 1 T 2 tok=1 T 1 N 2 tok=2 T 1 N 2 tok=1 N 1 T 2 tok=2 T 1 T 2 tok=1 T 1 T 2 tok=2 C 1 N 2 tok=1 N 1 C 2 tok=2 C 1 T 2 tok=1 T 1 C 2 tok=2 N 1 N 2 tok=1 N 1 T 2 tok=1 T 1 N 2 tok=1 T 1 T 2 tok=1 C 1 N 2 tok=1 C 1 T 2 tok=1 State-graphReduced state-graph

Symmetry Reduction – Informally  Symmetry partitions state-space into equivalence classes  Knowledge of symmetry  search only 1 state per equivalence class  Need techniques for: Symmetry detection Efficient exploitation of symmetry  Ideally both should be fully automatic This talk

TopSPIN Promela source code G Symmetry group for state-space Symmetry reduction strategy for G, based on group structure Minimising set Enumerate Local search… pan.c sympan.c SymmExtractor Generate verifier using SPIN Use GAP to classify structure of G Adjust verifier to incorporate symmetry reduction strategy pan.exe M |= φ or counter example gcc execute sympan.exe gcc M G |= φ or counter example Based on approach used by SymmSpin (Bosnacki et. al 2002)

Model Checking With Symmetry  Suppose we have magic function, rep : S → S  Encounter state s Is rep(s) in reached? Yes: backtrack No: add rep(s) to reached & explore successors of rep(s) Standard approach: take rep(s) to be smallest state in equivalence class Represent state as tuple of local states, e.g. (A,A,B) Total ordering on states follows

Obvious Approach  Given s, consider σ(s) for all σ  G  Choose smallest σ(s) as rep(s)  If |G| = 10 this is fine  If |G| = 10! > 3,000,000 this is bad

The Orbit Problem  Constructive orbit problem (COP) – compute smallest state in equivalence class of s under G  NP-hard [Jha 1996]  However, for many classes of group, COP can be solved in polynomial time  The function rep can be approximate – representatives don’t have to be unique

Easy Groups: Small  N processes  |G| < N 2  Enumerate  Could use bound f(N) for some +ve valued polynomial f

Easy Groups: Fully Symmetric  Largest kind of groups  N processes, |S N |=N!  Compute representative by sorting state  Example: Local states A, B, C with A < B < C. 5 processes. s = (C,B,B,A,B) rep(s) = (A,B,B,B,C)  Sorting is easy! This can be generalised

Easy Groups: Disjoint Products  M+N processes  G = S {1,…,M}. S {M+1,…,M+N}  Sort both sections Suppose M = N = 5 s = (B,A,A,C,B|A,C,B,A,A) rep(s) = (A,A,B,B,C|A,A,A,B,C)  This generalises Based on Jha 1996

Easy Groups: Wreath Products  Example s = (A,B,A|B,C,B|C,A,A|A,A,A) (A,A,B|B,B,C|A,A,C|A,A,A) rep(s) = (A,A,A|A,A,B|A,A,C|B,B,C)  This generalises Based on Jha 1996

Classifying a Group G  Small groups / fully symmetric groups Easy to detect  Disjoint products: Construct equivalence relation on generators Factors of product generated by equivalence classes  Wreath products: Look at maximal block systems of G restricted to individual orbits  Classify G using a recursive algorithm

Local Search for Unclassifiable Groups orbit of s s G = t u          min  5d Hypercube |G|=3840 No reduction: 9.6 x 10 6 states, 2965 s Full reduction: 3907 states, 5241 s Local search: states, 946 s

Summary  Symmetry techniques aim to improve model checkers  Challenges: detecting & exploiting symmetries  Group structure can lead to efficient exploitation  Computational group theory can help find structure  Local search can be applied as an approximate strategy

References  A.F. Donaldson and A. Miller – Automatic Symmetry Detection for Model Checking Using Compuataional Group Theory (FM’05)  A.F. Donaldson and A. Miller – A Computational Group Theoretic Symmetry Reduction Package for the SPIN Model Checker (AMAST’06)  S. Jha – Symmetry and Induction in Model Checking (PhD Thesis 1996)