1. 1 Verification Options & Beyond Reachability or how to make UPPAAL perform better and more Kim Guldstrand Larsen BRICS@Aalborg

2. SV 2001 Kim G. Larsen UCb 2 Verification Options Diagnostic Trace Breadth-First Depth-First Local Reduction Early Termination Global Reduction Active-Clock Reduction Re-Use State-Space Over-Approximation Under-Approximation Distributed Impl. Diagnostic Trace Breadth-First Depth-First Local Reduction Early Termination Global Reduction Active-Clock Reduction Re-Use State-Space Over-Approximation Under-Approximation Distributed Impl.

3. SV 2001 Kim G. Larsen UCb 3 Forward Rechability Passed Waiting Final Init INITIAL Passed := Ø; Waiting := {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some Z’ Z (n,Z’) in Passed then STOP - else /explore/ add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTIL Waiting = Ø or Final is in Waiting n,Z’ m,U n,Z Init -> Final ? location zone

4. SV 2001 Kim G. Larsen UCb 4 Forward Rechability Passed Waiting Final Init INITIAL Passed := Ø; Waiting := {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some Z’ Z (n,Z’) in Passed then STOP - else /explore/ add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTIL Waiting = Ø or Final is in Waiting n,Z’ m,U n,Z Init -> Final ? location zone Questions: 1. Order for exploration Waiting ? 2. How to store symbolic state in Passed ? 3. When to store in Passed ?

5. SV 2001 Kim G. Larsen UCb 5 Order of Exploration Depth-First vs Breadth-First Passed Waiting Final Init n,Z’ m,U n,Z Depth-First Waiting repr. as stack Breadth-First Waiting repr as queue Depth-First Waiting repr. as stack Breadth-First Waiting repr as queue In most cases BF to be preferred. Allows for generation of “shortest” traces. DF useful in situations when reachability may be concluded without generating full state-space. Easy calculation of traces.

6. SV 2001 Kim G. Larsen UCb 6 Representation of symbolic states Zones x1-x2<=4 x2-x1<=10 x3-x1<=2 x2-x3<=2 x0-x1<=3 x3-x0<=5 x1-x2<=4 x2-x1<=10 x3-x1<=2 x2-x3<=2 x0-x1<=3 x3-x0<=5 x1x2 x3x0 -4 10 2 2 5 3 x1x2 x3x0 -4 4 2 2 5 33 -2 1 Shortest Path Closure O(n^3) Z Allows for easy exploration and subset-checking

7. SV 2001 Kim G. Larsen UCb 7 Representation of symbolic states Local Reduction x1-x2<=4 x2-x1<=10 x3-x1<=2 x2-x3<=2 x0-x1<=3 x3-x0<=5 x1-x2<=4 x2-x1<=10 x3-x1<=2 x2-x3<=2 x0-x1<=3 x3-x0<=5 x1x2 x3x0 -4 10 2 2 5 3 x1x2 x3x0 -4 4 2 2 5 3 x1x2 x3x0 -4 2 2 3 3 -2 1 Shortest Path Closure O(n^3) Shortest Path Reduction O(n^3) 3 Canonical wrt = Space worst O(n^2) practice O(n) Z

8. SV 2001 Kim G. Larsen UCb 8

9. SV 2001 Kim G. Larsen UCb 9

10. SV 2001 Kim G. Larsen UCb 10 Earlier Termination Passed Waiting Final Init INITIAL Passed := Ø; Waiting := {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some Z’ Z (n,Z’) in Passed then STOP - else /explore/ add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTIL Waiting = Ø or Final is in Waiting n,Z’ m,U n,Z Init -> Final ?

11. SV 2001 Kim G. Larsen UCb 11 Earlier Termination Passed Waiting Final Init INITIAL Passed := Ø; Waiting := {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some Z’ Z (n,Z’) in Passed then STOP - else /explore/ add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTIL Waiting = Ø or Final is in Waiting n,Z’ m,U n,Z Init -> Final ?

12. SV 2001 Kim G. Larsen UCb 12 INITIAL Passed := Ø; Waiting := {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some (n,Z’) in Passed then STOP - else /explore/ add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTIL Waiting = Ø or Final is in Waiting Earlier Termination Passed Waiting Final Init n,Z k m,U n,Z Init -> Final ? n,Z 1 n,Z 2

13. SV 2001 Kim G. Larsen UCb 13 Clock Difference Diagrams = Binary Decision Diagrams + Difference Bounded Matrices CDD-representations CAV99 zNodes labeled with differences z Maximal sharing of substructures (also across different CDDs) zMaximal intervals zLinear-time algorithms for set-theoretic operations. zNDD’s Maler et. al zDDD’s Møller, Lichtenberg

14. SV 2001 Kim G. Larsen UCb 14

15. SV 2001 Kim G. Larsen UCb 15

16. SV 2001 Kim G. Larsen UCb 16 Representation of symbolic states (In)Active Clock Reduction x is only active in location S1 x>3 x<5 x:=0 S x is inactive at S if on all path from S, x is always reset before being tested. Definition x<7

17. SV 2001 Kim G. Larsen UCb 17 Representation of symbolic states Active Clock Reduction x>3 x<5 S x is inactive at S if on all path from S, x is always reset before being tested. Definition g1 gk g2 r1 r2rk S1 S2Sk Only save constraints on active clocks

18. SV 2001 Kim G. Larsen UCb 18 When to store symbolic state Global Reduction No Cycles: Passed list not needed for termination However, Passed list useful for efficiency

19. SV 2001 Kim G. Larsen UCb 19 When to store symbolic state Global Reduction Cycles: Only symbolic states involving loop-entry points need to be saved on Passed list

20. SV 2001 Kim G. Larsen UCb 20 Reuse State Space Passed Waiting prop1 A[] prop1 A[] prop2 A[] prop3 A[] prop4 A[] prop5. A[] propn Search in existing Passed list before continuing search Which order to search? prop2

21. SV 2001 Kim G. Larsen UCb 21 Reuse State Space Passed Waiting prop1 A[] prop1 A[] prop2 A[] prop3 A[] prop4 A[] prop5. A[] propn Search in existing Passed list before continuing search Which order to search? Hashtable prop2

22. SV 2001 Kim G. Larsen UCb 22 Over-approximation Convex Hull x y Convex Hull 135 1 3 5

23. SV 2001 Kim G. Larsen UCb 23 Under-approximation Bitstate Hashing Passed Waiting Final Init n,Z’ m,U n,Z

24. SV 2001 Kim G. Larsen UCb 24 Under-approximation Bitstate Hashing Passed Waiting Final Init n,Z’ m,U n,Z Passed= Bitarray 1 0 1 0 0 1 UPPAAL 8 Mbits Hashfunction F

25. SV 2001 Kim G. Larsen UCb 25 Bitstate Hashing INITIAL Passed := Ø; Waiting := {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some Z’ Z then STOP (n,Z’) in Passed then STOP - else /explore/ add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTIL Waiting = Ø or Final is in Waiting INITIAL Passed := Ø; Waiting := {(n0,Z0)} REPEAT - pick (n,Z) in Waiting - if for some Z’ Z then STOP (n,Z’) in Passed then STOP - else /explore/ add { (m,U) : (n,Z) => (m,U) } to Waiting; Add (n,Z) to Passed UNTIL Waiting = Ø or Final is in Waiting Passed(F(n,Z)) = 1 Passed(F(n,Z)) := 1

26. SV 2001 Kim G. Larsen UCb 26 UPPAAL Distributing UPPAAL P W Gerd Behrmann, Thomas Hune, Frits Vandraager CAV2k

27. SV 2001 Kim G. Larsen UCb 27 UPPAAL Distributing UPPAAL P W Gerd Behrmann, Thomas Hune, Frits Vandraager CAV2k P1 W1 P2 W2 P4 W4 P3 W3 Passed structure distributed Passed structure distributed

28. SV 2001 Kim G. Larsen UCb 28 UPPAAL Distributing UPPAAL Gerd Behrmann, Thomas Hune, Frits Vandraager CAV2k P1 W1 P2 W2 P4 W4 P3 W3 Passed structure distributed Passed structure distributed Check in local Passed list. If not present save, explore and distribute... Check in local Passed list. If not present save, explore and distribute... ? MPI

29. SV 2001 Kim G. Larsen UCb 29 UPPAAL Distributing UPPAAL Gerd Behrmann, Thomas Hune, Frits Vandraager CAV2k P1 W1 P2 W2 P4 W4 P3 W3 Passed structure distributed Passed structure distributed ? Implemented using MPI on SUN Interprise 10000 Beowulf cluster Implemented using MPI on SUN Interprise 10000 Beowulf cluster Check in local Passed list. If not present save, explore and distribute... Check in local Passed list. If not present save, explore and distribute...

30. SV 2001 Kim G. Larsen UCb 30 Performance Full State Space Generation Full State Space Generation Super-linear Speed-up SUN Interprise 10000 Shared Memory 12GB Ram 24 333Mhz CPU’s

31. 31 Beyond Reachability - (Bi)Simulation - Compositional Verification

32. SV 2001 Kim G. Larsen UCb 32 Timed Bisimulation Wang’91

33. SV 2001 Kim G. Larsen UCb 33 Timed Simulation

34. SV 2001 Kim G. Larsen UCb 34 Examples

35. SV 2001 Kim G. Larsen UCb 35 Abstraction & Compositionality dealing w stateexplosion a cb a cb a cb a cb a cb a cb a cb a cb 1 2 43 1 2 43 Concrete Abstract simulation

36. SV 2001 Kim G. Larsen UCb 36 Abstraction Example a1a2a3a4a5 a b

37. SV 2001 Kim G. Larsen UCb 37 Example Continued abstracted by

38. SV 2001 Kim G. Larsen UCb 38 Proving abstractions using reachability A[] not TestAbstPoP1.BAD Recognizes all the BAD computations of PoP1