1. Parallel and Distributed Computing in Model Checking Diana DUBU (UVT) Dana PETCU (IeAT, UVT) {ddubu,petcu}@info.uvt.ro

2. Subject: + = ? Model (?!) checkingParallel (?!) computing

3. Model Checking 1) Modeling: convert a design into a formalism accepted by a model checking tool. 2) Specification: state the properties that the design must satisfy. 3) Verification: ideally completely automatic.

4. Model Checking Results  Design/Implementation/Testing  2. Modeling/Property Specification Finite-state model extraction Simplifications Restrictions  3. Verification Abstractions Divide-and-conquer techniques

5. Model Checking Problems The state explosion problem Model checkers today can routinely handle systems with between 100 and 300 state variables. Systems with 10^120 reachable states have been checked The model construction problem. The requirement specification problem. The output interpretation problem.

6. Two aspects Parallel and distributed algorithms for model checking Model checking on parallel and distributed codes

7. Why to parallize? gain memory: in state exploration gain time: discovering a bug after 1 day is better than 4! State of art: Parallel and Distributed Model Checking, PDMC, August 19, 2002 -- Brno, Czech Republic, Satellite Workshop to CONCUR 2002. In Electronic Notes in Theoretical Computer Science vol. 68 (4), October 2002

8. Parallel and distributed algorithms were developed for Explicit state methods - reachability and model construction - LTL model checking - model checking for alternation-free  -calculus BDD-based methods - reachability and generation of counter example - model checking for full  -calculus

9. Problems in designing parallel/distributed algs. Partitioning the work among the processes Dynamic or static load balance to maintain balanced use of memory Maintaining a good proportion between computation at each process and communication Distributed or centralized termination detection

10. Reachability in distributed state space The state space is partitioned into slices Each slice is owned by one process Each process runs a check on its slice When non-owned states are discovered they are sent to the process that owns them

11. Load Balance The initial slicing distributes the memory requirements equally among the processes. As more states are discovered, the memory requirements might become unbalanced. Therefore, at the end of each step in the computation of the reachable states a load balance procedure is applied.

12. Solutions for load balancing Stern, Dill [1997]: Random load balancing Lerda, Sisto [1999]: Partition to minimise cross transitions Garavel et al. [2001]: Partition independent of state structure Lafuente [2002]: Partition to localise cycles

13. Static slicing Martin, Huddart [2000]: Graph pruning algorithm Barnat, et al. [2001]: Extra data structures to keep track of 2 nd searches Brim, et al. [2001]: Negative cycle detection Bollig, et al. [2002]: Algorithm without cycle detection

14. Parallel and distributed codes Hard to test Poor coverage Programmers have less intuition Parallel and distributed programs force us to encounter all possible interleavings – generates large models One of the common heuristics to reduce the model is partial-order reductions

15. Formal Methods for Parallel Programming: Theory and Applications FMPPTA'2001: April 27, 2001, San Francisco FMPPTA'2002 : April 19, 2002, Fort Lauderdale FMPPTA'2003: April 22-26, 2003, Nice

16. Parallel oriented model checker VeriSoft from Lucent: mainly useful for explicit model checking Spin from Bell Labs: is the most widely distributed software package that supports the formal verification of distributed systems SPIN2003, May 3-10, 2003, in Portland

17. What we intend to do Create own software for distributed state space construction algorithm Use PC Myrinet cluster. Implement a known parallel algorithm (Garavel). Use message passing interface MPI. Port the code on Grids, using Globus technologies. Verify various properties of the tested software. At start, small Java programs for which we can manually generate a model.