1. ASAP: An Extensible Platform for State Space Analysis Michael Westergaard (Aarhus, DK) Sami Evangelista (Aarhus, DK) Lars Michael Kristensen (Bergen, NO)

2. Outline Tool overview Specification of verification jobs The state space search engine Extending ASAP Benchmarks Conclusion

3. What is ASAP? Next generation of computer tool support for state space analysis of CPN models. Developed within the ASCoVeCo research project. Supported by the Danish Research Council for Technology and Production [09/2006 – 09/2009]. Project members ASCoVeCo Advanced State Space Methods and Computer Tools for Verification of Communication Protocols ASAPASCoVeCo State Space Analysis Platform Lars Michael KristensenSurayya Urazimbetova Michael WestergaardSami Evangelista

4. Aim and vision A state space analysis tool and development platform aimed at – Research – implementation of verification algorithms / state space reduction techniques (e.g., sweep line); experimental comparison of algorithms – Education – user- and implementation perspective – Industrial use – ease of use; stability; highly automatic; pragmatic methods; practical expressiveness of models. The challenge: support all this in a coherent manner with a suitable user interface. Implementation of ASAP started in summer 2007.

5. Software architecture Graphical User Interface State Space Exploration Engine JAVA Eclipse Rich Client Platform Eclipse Modelling Framework Graphical Modelling Framework CPN Model Representation CPN Model Loader CPN Model Instantiator Standard ML CPN Tools Simulator Explorations Storages Waiting sets Query Languages JoSEL Editor JoSEL Scheduler Reporting BIRT ASAP runs on Windows XP/Vista, Linux, and Mac OS X. JoSEL Representation Method- specific tasks

7. Outline Tool overview Specification of verification jobs The state space search engine Extending ASAP Benchmarks Conclusion

8. JoSEL overview - 1 Graphical language inspired by – Dataflow diagrams (input and output) – Coloured Petri nets (hierarchy concept, abstraction mechanism) A task is the atomic unit of computation Tasks have typed input and output ports. Task name Typically used to represent instantiation or execution of a component on the underlying state space exploration platform

9. JoSEL overview - 2 Output ports and input ports can be connected A verification job – is a collection of tasks and their connections – specifies a producer/consumer scenario

10. JoSEL overview - 3 A job can have exported ports. A job can be abstractly represented by a macro task. The use of macros enables – reuse of sub-jobs among different verification jobs – simplification of JoSEL specifications – different levels of abstraction

12. JoSEL example – Top-level of a job Macro task for report generation Macro task for checking a safety property Instantiate safety property to be checked Name of safety property Load file containing the property Load file containing CPN model Instantiation of CPN model simulator

13. JoSEL example – Safety checker

14. Outline Tool overview Specification of verification jobs The state space search engine Extending ASAP Benchmarks Conclusion

15. Written in SML Based on a few SML signatures (  JAVA interfaces) – STORAGE for data structures storing states – EXPLORATION for search algorithms – MODEL for specific model operations – WAITING_SET for data structures storing states waiting to be processed by an EXPLORATION The state space search engine

16. signature MODEL = sig eqtype state eqtype event val getInitialStates: unit -> (state * event list) list val nextStates: state * event -> (state * event list) list val executeSequence: state * event list -> (state * event list) list val stateToString: state -> string val eventToString: event -> string end The MODEL signature Get the initial state(s) with their enabled events Compute the successor(s) of a state by executing an event Execute a sequence of events and return the states on the path String representation of states and events

17. Current status of the engine Search algorithms: – DFS, BFS – Random walks – External memory algorithms Reduction techniques – Bit-state hashing, hash compaction – State caching – Sweep-line method – ComBack method Type of properties analyzed – Safety properties – Deadlock – Generic properties of CPNs (liveness, boundness, home markings, …)

19. Outline Tool overview Specification of verification jobs The state space search engine Extending ASAP Benchmarks Conclusion

20. Integration of a sweep-line plug-in - 1 Graphical User Interface State Space Exploration Engine JAVA Eclipse Rich Client Platform Eclipse Modelling Framework Graphical Modelling Framework CPN Model Representation CPN Model Loader CPN Model Instantiator Standard ML CPN Tools Simulator Explorations Storages Waiting sets Query Languages JoSEL Editor JoSEL Scheduler Reporting BIRT JoSEL Representation Method- specific tasks

21. SML implementation of the sweep-line algorithm functor SweepLineExploration ( structure Storage: STORAGE structure Model: MODEL structure Measure: PROGRESS_MEASURE): EXPLORATION = struct fun explore filterEvents transformState arcHook stateHook = … end Exploration algorithm using the sweep-line method. ≈100 lines of SML code Filter the executable events of a state, e.g., for partial-order reduction Transform a state, e.g., with a canonicalization function Functions called for each state and arcs of the reachability graph Data structure used to store reachable states Model of which we explore the graph Used to evaluate the progression of states

22. Integration of a sweep-line plug-in - 2 Graphical User Interface State Space Exploration Engine JAVA Eclipse Rich Client Platform Eclipse Modelling Framework Graphical Modelling Framework CPN Model Representation CPN Model Loader CPN Model Instantiator Standard ML CPN Tools Simulator Explorations Storages Waiting sets Query Languages JoSEL Editor JoSEL Scheduler Reporting BIRT JoSEL Representation Method- specific tasks

23. JAVA implementation of the sweep-line task functor SweepLineExploration ( structure Storage: STORAGE structure Model: MODEL structure Measure: PROGRESS_MEASURE): EXPLORATION = struct fun explore filterEvents transformState arcHook stateHook = … end

24. JAVA implementation of the sweep-line task class SweepLineExplorationTask implements FunctorTask { String getName () { return "Sweep Line Exploration"; } String getFunctor () { return "SweepLineExploration"; } Value getReturnType () { return new Value ("Traversal", Exploration.class); } Value[] getParameters () { return new Value[] { new Value ("Model", Model.class), new Value ("Storage", Storage.class), new Value ("Progress Measure", Measure.class) }; } Exploration exec (Model m, Storage s, Measure p) { … } } Name of the SML functor in the search engine Generates the SML code executed when the task is performed

25. Outline Tool overview Specification of verification jobs The state space search engine Extending ASAP Benchmarks Conclusion

26. Experimentation context ASAP can load – CPN models produced by CPN Tools – DVE models (language of the DiVinE model checker) Two types of inputs – CPN models from our own collection – DVE models from the BEEM database: http://anna.fi.muni.cz/models/ Performed an exhaustive state space exploration (with and without the ComBack method) and recorded execution time.

27. ASAP vs CPN Tools State space exploration time (sec.) ModelStatesCPN ToolsASAPSpeed-up Dining philosophers40 K6,61427245 Simple protocol204 K7,08433215 ERDP207 K19,351112173 DYMO114 K7,40330824 Average on 4 models164

28. ASAP vs DiVinE State space exploration time (sec.) ModelStatesDiVinEASAPSpeed-up brp2.65.7 M39172.29 firewire_tree.53.8 M2275250.43 plc.43.7 M55451.22 rether.49.5 M51341.52 Average on 50 models1.39

29. Outline Tool overview Specification of verification jobs The state space search engine Extending ASAP Benchmarks Conclusion

30. To sum up ASAP is a state space analysis tool. It is graphical, based on the eclipse platform Verification tasks are performed using the JoSEL graphical language. Intented to be easy to use by different types of users – Students – Researchers – Industrial users and to extend w.r.t. – verification algorithms – specification languages ASAP is free of charge.

31. What’s next Temporal logic verification (LTL, CTL) Drawing of state spaces Multi-threaded / distributed verification

32. Thank you for your attention! ASAP download page: http://www.cs.au.dk/~ascoveco/download.html Visit us during tools demonstration.