Download presentation
Presentation is loading. Please wait.
Published byAbner Wade Modified over 9 years ago
1
Yang Liu, Jun Sun and Jin Song Dong School of Computing National University of Singapore
2
Outline General Introduction to PAT http://pat.comp.nus.edu.sg Motivation: Parallel Model Checking Model Checking with Fairness Experiment Results Conclusion 2
3
Model Checking Determining whether a model satisfies a property by the means of exhaustive searching. 3 Model Model Checker Property Counterexample!
4
Model Checking Works! Three researchers won Turing Award 2007 for their pioneer work on model checking! Intel Core i7 processor is verified by symbolic model checking completely without executing a single test case! The Slam project from Microsoft successfully detected many bugs in many driver software! 4
5
PAT: Motivation We aim to develop a self-contained framework for formal specification and verification of compositional systems which involves, concurrency, real-time, complex data structures and operations, complicated control flows, and etc. 5
6
PAT: Architecture 6
7
Motivation Model checking is limited by state space explosion. We do have multiple cores nowadays! 7
8
Safety “Something bad never happens” Reachability analysis Depth-first search Breadth-first search 8
9
Liveness “Something good eventually happens” Liveness checking = bad loop searching Nested depth-first- search SCC-based algorithms 9
10
Fairness Liveness often requires fairness! Process level weak/strong fairness Event level weak/strong fairness Strong global fairness
11
Verification under Fairness Automata-based LTL model checking weak fairness: SCC search strong fairness: strongly connected sub-graph search strong global fairness = terminal SCC search
12
Verification under Fairness A lasso is counterexample if and only if the loop is fair and it fails the liveness property. It is (process-level) weak fair iff there is NO process which is always enabled during the loop and never made any progress. It is (process-level) strong fair iff there is NO process which is enabled during the loop and never made any progress. It is strong global fairness iff …
13
Sequential Algorithm 13 A: Find SCC-0 B: Check if SCC-0 is fair Is Not Fair C: Generate Counterexample True Is Fair
14
Parallel Algorithm 14 Thread 1 Thread 2 Thread 4 Thread 3 A0 B0 A1 B1 A2 B2
15
Parallel Algorithm 15 Thread 1 Thread 2 Thread 4 Thread 3 A0 B0 A1 B1 A2 B2
16
Effectiveness Overhead – negligible Based on shared-memory architecture. Depends on how expensive checking whether a SCC satisfies the fairness constraint Weak fairness: linear in the number of transitions Strong fairness: bounded by #states * #transitions Global fairness: linear in the number of transitions 16
17
Experiment A 17
18
Experiment B 18
19
Experiment (cont’d) 19
20
Conclusion 20 A simple way of making use of multi-cores for model checking with fairness. The technique is available in PAT. http://pat.comp.nus.edu.sg Related work Spin’s liveness checking algorithm for dual-core systems Barnat et al. multi-core LTL model checking MAP, OWCTY, NEGC, OBF
Similar presentations
© 2025 SlidePlayer.com. Inc.
All rights reserved.