Data Decision Diagrams for ProMeLa Systems Analysis

Transcription

1 Softwre Tools for Tehnology Trnsfer mnusript No. (will e inserted y the editor) Dt Deision Digrms for ProMeL Systems Anlysis Vinent Beudenon, Emmnuelle Enrenz, Smi Tktk Lortoire d Informtique de Pris 6, University Pierre et Mrie Curie (Pris 6), CNRS UMR 7606, 2, rue Cuvier, Pris edex 05, Frne. E-Mil : {Vinent.Beudenon, Emmnuelle.Enrenz, Smi.Tktk}@lip6.fr Reeived: dte / Revised version: dte Astrt. In this pper, we show how to verify CTL properties, using symoli methods, on systems written in ProMeL. Symoli representtion is sed on Dt Deision Digrms (DDDs) whih re n-vlued DAGs designed to represent dynmi systems with integer domin vriles. We desrie prinipl omponents used for the verifition of ProMeL systems (DDD, representtion of ProMeL progrms with DDD, the trnsposition of the exeution of ProMeL instrutions into DDD). Then we ompre nd ontrst our method with the model heker SPIN or lssil BDD tehniques, to highlight wht system lsses whether SPIN or our tool is more relevnt for. Key words: SPIN, CTL, Symoli Verifition Methods, BDDs, DDDs. enumertive onstrution. Memory resoures needed re linked to the mount of sttes explored nd the informtion they hold. If we wnt to use exhustive methods on huge systems, we first hve to redue these prmeters. The strted model must e speified regrding the property tht will e heked, whih mens tht system s redution (onerning vriles domins nd omputtion strtion) must e refully expressed. We hose n strtion level whih is the input for high-level hrdwre synthesis [7] nd its industril pplitions []. The system to nlyse is modelled y finite set of onurrent synhronous proesses. Communitions re performed using uffered hnnels or shred vriles. These systems re desried in ProMe- L, the input lnguge of the SPIN model-heker [4] whih proposes verifition of sfety or liveness properties, expressed in liner temporl logi (LTL, [23]) or with Bühi utomt. Introdution. Context Model heking is set of tehniques intended to utomtilly deide if some property holds on finitestte system. If the system does not stisfy the property heked, ounter-exmple my e expeted to orret the system s (or the property s) speifition. To determine whether the system stisfies property, ll omputtion sequenes hve to e explored. This mens tht, t lest, ll rehle sttes hve to e stored to ensure the ending of omputtion. Unlike simultion methods tht n hndle huge systems (0 5 sttes or more), without giving ny forml onlusion, exhustive methods formly ensures vlidity of onlusions, ut nnot hndle more thn modest sized systems (up to 0 9 sttes) in se of expliit.2 Expliit stte-spe onstrution The model-heker SPIN hs proven its effiieny for ommunition protools or C progrms [4, 3]. It performs LTL properties vlidtion y finding eptne yles in the synhronous produt of the system s utomton nd Bühi utomton. This ltest reognizes ny infinite sequene vlidting the negtion of the property to e heked. The synhronous produt is lso Bühi utomton, its size grows exponentilly with the systems s size nd the omplexity of the heked property. The sttes re expliitly stored using n effiient ompression lgorithm [5] nd methods limiting the stte-spe explortion [6, 2]. Nevertheless, the SPIN model-heker nnot hndle systems whose size exeeds 0 7 sttes, nd knowledge out the tool ehviour is essentil to del with rel systems [].

2 2 Vinent Beudenon, Emmnuelle Enrenz, Smi Tktk: Dt Deision Digrms for ProMeL Systems Anlysis.3 Symoli Methods As stte-spe representtion is ruil ftor for these verifition methods, symoli methods emerged for representing systems with greter size (0 20 sttes) [5]. These methods del with set of sttes ontrry to expliit methods hndling sttes one-y-one. Symoli Methods usuly lend theirselves to Computtion Tree Logi [8] nd led to the implementtion of effiient vlidtion tools suh s VIS [2] or SMV [9]. Symoli representtion used y these tools is sed on Binry Deision Digrms [3] desried in setion.4. An experimentl omprison etween the enumertive method (performed y SPIN) nd the symoli one (performed y VIS) ws proposed on the ATM protool [22]. Unlike SPIN, VIS is symoli model-heker over networks of synhronous proesses using signl ommunitions. For etter omprison, the most dpted models were implemented for eh tool. It emerges tht SPIN is more relevnt for smll-sized system ut VIS n hndle huge systems. Other omprtive studies, suh s [25] exhiit the etter performne of exhustive methods over symolis ones in se of livelok nlysis of vrint of the sliding-window protool (the GNU i-protool). Our pproh onsists in using symoli methods on ProMeL systems, in order to verify sfety nd liveness properties of some systems tht nnot e hndled y SPIN. We hose Dt Deision Digrms (DDDs) [9] tht present the effiient properties of noniity nd ompity of BDDs nd re etter suited to represent dynmi systems nd non oolen vriles (ut hving finite domins). Systemti omprison of verifition of systems desried in ProMeL exhiits some hrteristis of systems tht re etter suited for SPIN nlysis, while others give the dvntge to symoli tehniques (BDD or DDD). Moreover, for systems presenting high prllelism where nturl ordering of vriles n e found, DDD outperforms BDD for ll (stti or dynmi) ordering strtegies of BDD. Orgnistion of the pper follows : the rest of this setion desries DAG-sed stte-spe representtions. setion 2 riefly rells preliminries out CTL, nd in setion 3 we desrie the Dt Deision Digrm struture nd the wy they re mnipulted. In setion 4 we exhiit the links etween ProMeL progrm nd the set of trnsformtions to e pplied to DDD. In setion 5 we ompre, on systems desried with the sme semntis (ProMeL) the performnes of expliit methods using SPIN nd symoli methods sed on DDDs nd BDDs, nd ring out some hrteristis of systems giving n dvntge to one verifition pproh or to the other one..4 DAG-sed stte-spe onstrution A Binry Deision Digrm (BDD [3]) represents oolen funtion on grph with eh nonterminl node lelled y inry vrile. Eh node hs two outgoing edges, orresponding to the ses where the vrile evlutes to or to 0. Terminl nodes re lelled with 0 or, orresponding to the possile funtions vlues. Binry Deision Digrms (BDDs [3] represent Boolen funtions in oth nonil nd (often) ompt form. Most logil opertion n e effiiently implemented using OBDDs nd onstnt ssignment n e performed in liner time (regrding the size of modified BDD). These digrms llow stte spe onstrution when onsidered s hrteristi funtion of set of sttes. The suess of OBDDs inspired reserhs to improve their effiieny. Min memers of the BDD fmily re shown on figure. Two prts of this figure re seprted with dshed line. The left side ontins deision digrms used to represent funtions over oolen vriles. Reder my find more detils in [4]. The right side of the figure shows reent improvements of DAGs mde for stte-spe representtion purpose. They ll del with vriles tht re not neessry oolen. Funtions over numeri vriles void it-to-it onstrution. They propose n esier wy to mnipulte trnsitions in se of stte genertion. Multi-vlued Deision Digrms (MDDs) where developped y [20] for set of sttes genertion nd storge. Additive Edge- Vlued MDD (EV+MDD [6]) where proposed to represent numeri vlued funtion over numeri vlues nd set genertion of shortest pths. At lest two topis in MDDs ught our ttention: First, voiding it-to-it onstrution is simple wy to del with high level design; There is no need, for instne, to uilt omplete (it-level) dder to perform n integer ddition; Seond, DAG sed representtion onserves shring properties, ut it needs knowledge out the rnge of eh vrile to e onstruted. And third, the use of event lolity tht elertes tretments during sttes genertion [7] gives exellents results on Petri nets nlysis. Event lolity onsists in rehing diretly seleted nodes in the middle of pths in DAGs rther thn trversing the DAGs vrile node y vrile node from root to lef. This is pplyle only if few nd lose lyers hve to e modified y prtiulrizing eh trnsition with eh enling preondition. Unfortuntely ProMeL systems do not hve this lolity property. Dt Deision Digrms (DDDs)[9] re very lose to MDDs, ut they hve signifint differenes: They use the sme priniple of multivlued vriles ut only rehed vlues hve orresponding outgoing edge. Any vrile n e instnited s often s neessry, whih llows representtion of dynmi systems. DDDs re endowed with formlism of indutive methods tht re

3 Vinent Beudenon, Emmnuelle Enrenz, Smi Tktk: Dt Deision Digrms for ProMeL Systems Anlysis 3 set of it vetors ZBDD Reed Muller OBDD OFDD OKFDD Hyrid Form Multi Terminl MTBDD Reed Muller Hyrid Form BMD HDD Weighted edges Non BoolenVriles Add Mult Add EFBDD FEVBDD *BMD Additive Weighted Edges MDD EV+MDD 0 Terminl set to defult Undefined vrile rnge Multiple ssignments Indutive trversl mehnisms DDD Set Vlued Edges SDD Creting Funtion: "Apply" proedure on two XDD nd inry opertor Event Lolity Indutive methods Fig.. Grph-sed funtion representtion prtiulrized trversl mehnisms expressing opertors nd trnsitions in nonil form. This lst differene led us to use DDDs (rther thn MDDs) to hndle ProMeL systems s we will see in setion 3. Set Deision Digrms (SDDs [27]) is the lst evolution of DDDs. Edges of SDD re lelled with set of vlues ( DDD, for instne), whih inreses the shring of su strutures. 2 The CTL Temporl Logi 2. Syntx nd Semntis Computtion Tree Logi (CTL) is propositionl, rnhing-time, temporl logi, whih ws proposed to speify temporl properties on finite onurrent systems [8]. It enlrges lssil propositionl logis with temporl opertors ssoited with pth quntifiers. The semnti of CTL formul is defined on Kripke struture. Definition (Kripke Struture). A Kripke struture M = (AP, S, L, R, S 0 ) is defined s follows: AP is finite set of tomi propositions. S is finite set of sttes. L : S 2 P is funtion lelling eh stte with set of tomi propositions. R S S is totl trnsition reltion: s S, s /(s, s ) R. S 0 is the set of initil sttes. A pth is n infinite sequene of sttes π = s 0, s, s 2... suh s i 0, (s i, s i+ ) R. We denote π i the suffix of π strting t s i. Definition 2 (CTL Properties [8]). CTL properties re uilt on tomi propositions. The syntx nd semntis of CTL properties re defined, given Kripke struture, s follows: Eh tomi property p AP is CTL formul. s = p p L(s) Let f nd g e to CTL formuls, then f, f g, EXf, EGf et EfUg re CTL formuls. s 0 = f s 0 / = f s 0 = f g s 0 = f nd s 0 = g s 0 = EXf there exists pth π suh s π = f s 0 = EGf there exists pth π suh s i 0, π i = f s 0 = EfUg there exists pth π 2.2 Verifying CTL properties suh s k 0 suh s π k = g nd 0 i < k, π i = f The use on n effiient strt dt type to represent nd operte on sets is key issue to perform symoli model heking. In most ses, for finite systems, hrteristi funtions of sets of sttes re onsidered nd enoded into BDD s introdued y [9] nd implemented into VIS nd SMV. But other representtions of sets might e onsidered, provided they re equipped with effiient set opertions omputtion, nd two set trnsformers post nd pre [26]. Some exmples of lterntive set representtions re predite strutures pplied to lgeri Petri Nets [24] or onvex union of (onvex) polyhedr, used in vrious verifition tools for hyrid systems [0] [2]. The post trnsformer omputes the set of sttes tht re rehle from sttes grouped into set X: post(x) = s /R(s, s ) s X

4 4 Vinent Beudenon, Emmnuelle Enrenz, Smi Tktk: Dt Deision Digrms for ProMeL Systems Anlysis The pre trnsformer omputes the set of predeessor sttes of sttes tht re grouped into set X. This orresponds to the omputtion of ll sttes tht verify the CTL formul s = EX(X). pre(x) = s X s /R(s, s) EG nd EU CTL opertors re omputed s fixpoints sed on the pre (or EX) opertor, due to their reurrent definition: Fig. 2. Two well-defined DDD M, s = EGf M, s = f EX(EGf) M, s = g M, s = EfUg M, s = (f EX(EfUg)) In setion 3 we desrie the strt dt type we use to represent set of sttes nd the ssoited formlism to onstrut post nd pre opertors. 3 Dt Deision Digrms 3. Presenttion Dt Deision Digrms (DDDs,[9]) re dt strutures for representing sets of sequenes of ssignments. DDDs re enoded s DAGs. Eh node is leled with vrile nd eh outgoing edge with n integer vlue. A pth leding from the root of the DDD to the terminl node represents n epted sequene of ssignments. All pths leding to the defult terminl node 0 re not represented nd undefined sequenes re represented on pths leding to the node. Eh vrile my our ny times long pth. Cnoniity is insured y imposing totl order on vriles. In the following, E denotes set of vriles, nd for ny e E, Dom(e) represents the domin of e. Definition 3 (DDD [9]). The set D of DDD is defined y d D if d {0,, } or d = (e, α) with : e E α : Dom(e) D, suh tht {x Dom(e) α(x) 0} is finite. We denote e d, the DDD (e, α) with α() = d nd x, α(x) = 0. A DDD is well-defined if ll pths strting from the root of the DAG led to the unique terminl node. Figure 2 shows the DDDs representing the following sets of sequenes of ssignments: { =, = 2}, { = 2, = }, { = 2, = 2, = 3} for the left-hnd side. { =, = 3}, { = 2, = 2} for the right-hnd side. Two well-defined DDDs re equls if d = d = or d = (e, α) 0 nd d = (e, α ) 0 nd x Dom(e), α(x) = α (x). Set opertors (union +, intersetion, set-differene \) re defined indutively on DDD [9]. They re otined y reursive evlution on DDDs representing the opernd sets. Contention opertor is lso defined: ( x ).( y ) = x y. 3.2 Homomorphisms Our purpose is to represent sttes of ProMeL system on DDDs nd use the properties of noniity nd ompity of this struture. Given n initil stte, we hve to onstrut set of opertors tht stisfies the system s trnsition rules. DDD llows the use of lss of opertors, lled homomorphisms, for oding trnsition rules [9]. Let Φ e n homomorphism nd two welldefined DDD d nd d, then Φ(d + d ) = Φ(d) + Φ(d ). We del with speil kind of homomorphisms lled indutive homomorphisms whih re lolly defined. Unlike for BDD, only epted sequenes re represented on the DAG thus, it is not neessry to explore the entire DDD. Definition 4 (Indutive Homomorphism [9]). Let e DDD nd φ(e, x) e E,x Dom(e) e n homomorphism fmily. 0 if d = 0 if d = Φ(d) = if d = φ(e, x)(α(x)) if d = (e, α) x Dom(e) is n homomorphism. This lst expression ( x Dom(e) φ(e, x)(α(x))) is only pplied on DDD nodes. In suh ses the homomorphism uses only lol informtion: The vrile e nd its possile vlues x Dom(e). For eh of these vlues, nd

5 Vinent Beudenon, Emmnuelle Enrenz, Smi Tktk: Dt Deision Digrms for ProMeL Systems Anlysis 5 its ssoited outgoing edge α(x), funtion φ(e, x) is pplied. Then union of otined DDD is performed. Evlution of set opertors in DDD nd omputtion of homomorphisms re stored in n opertion he Elementry homomorphisms to ompute post In our ontext, we onsider tht no homomorphism n e pplied on terminl node euse it mens tht the tretment my not e pplied orretly (it would refer to used ut undelred vrile): φ() =, homomorphism φ Thus, we just hve to del with homomorphism on nonterminl node, whih mens tht we only hve to define lol tretment for ouple (vrile, edge). elow: setexpr (vr, expr) (e, x) = if vr = e if e expr if expr {e:=x} = 0 e evl(expr {e:=x}) id else down (vr, expr {e:=x} ) else down (vr, expr {e:=x} ) else if e expr if expr {e:=x} = 0 e x setcst (vr, evl(expr {e:=x} ) else e x setexpr (vr, expr {e:=x} ) else e x this With: up (vr, vl) (e, x) = e x vr vl id Proposition (Constnt Assignments). Let d e well defined DDD, vr e vrile of E ppering in d, nd st Dom(vr). The homomorphism setcst (vr, st) tht performs the ssignement vr = st is defined s elow: And: down (vr, expr) (e, x) if e / expr up (e, x) down (vr, expr) setcst (vr, st) (e, x) = if vr = e e st id else e x this Term st e st mens tht ny enountered outgoing edge of nodes lelled with e reeives the unique lel st nd id reprodues the originl suffixes rehed y the edges. Term this mens tht the homomorphism propgtes itself long ny outgoing edge if the node is not lelled with vr. Proposition 2 (Expression Assignments). Let d e well defined DDD, vr e vrile of d, nd expr e n rithmeti expression suh s ny prmeter of expr is defined on d. The homomorphism setexpr (vr, expr) tht performs the ssignment vr = expr is defined s else = if expr {e:=x} > 0 up (e, x) down (vr, expr {e:=x} ) else vr evl(expr {e:=x} e x id The seond prt of the expression (if e vr) in setexpr () is immedite, the homomorphism propgtes itself with (if neessry) ompleted expression. Then if the expression is ssessle ( expr {e:=x} = 0 ) the propgted homomorphism eomes setcst (). The first prt of the expression dels with ses where the ssigned vrile vr is rehed efore the expression expr is ssessle. In suh ses the tretment hs to omplete the expression, store the result in temporry node tht will e repled t the vr level. The omposition of up () nd down () homomorphisms omputes these (omplete, store, nd reple) opertions in unique trversl. Exmple ( up () nd down () usge). We im t performing the ssignment = + + d on the DDD

6 6 Vinent Beudenon, Emmnuelle Enrenz, Smi Tktk: Dt Deision Digrms for ProMeL Systems Anlysis 2 3 d 4 e 5. setexpr (, + + d) ( 2 3 d 4 e 5 ) = setexpr (, + + d) ( 2 3 d 4 e 5 ) = down (, d) ( 3 d 4 e 5 ) = up (, 3) down (, 3 + d) (d 4 e 5 ) = up (, 3) ( 7 d 4 e 5 ) = 7 3 d 4 e Elementry homomorphisms to ompute pre The min diffiulty for evluting the pre opertor is the non-reversiility of some kinds of instrution suh s reding vrile in FIFO, or some ssignments: Wht n e, for given ontext, the vlue(s) tken y the ssigned vrile efore the ssignement (or FIFO s reding) oured? The set of sttes tht preeeds the vr = st instrution s exeution nnot e omputed without priori knowledge out vr s rnge, or etter, out knowledge of the effetive vlues tken in the exeution ontext of the instrution vr = st. For given onstnt ssignment, two sets of sttes re used to ompute the pre opertor. The set of sttes tht we wnt to know the set of predeessors sttes: T O, nd set of ndidtes sttes C, tht pproximtes the exeution ontext of the instrution vr = st. It is suset of rehle sttes. We use the following ssumptions: Initil vlue of ssigned vrile is ritrry. Only vr is modified. The solution is omposition of three tretments:. Seleting in T O sttes tht stisfies vr = st. As vr is the only modified vrile, we otin the exeution ontext of instrution vr = st. 2. Extending, in this lst DDD, the domin of vr to ll possile vlues given y ndidtes sttes C (we use C euse vr s rnge is unknown). 3. Interset the otined DDD with the set of ndidte sttes: It gives ll ndidtes respeting the exeution ontext y strting vr. The homomorphism sweet omputes these three tretments in unique trversl of C oupled with the trversl of T O. Its prmeters re vr, st nd sttes whom we wnt to ompute predeessors T O. It is pplied on ndidtes sttes C: presetcst (vr, st, C (T O) = sweet (vr, st, T O) (C) We detil lol tretment of the homomorphism sweet (v,, T o) on n ritrry node (e, x).. There is no predeessor (nor suessor) for the empty set: sweet (v,, T o) = () if T o =. 2. Before enountering vr, lol intersetion is mde: sweet (v,, T o) (e, x) = e x sweet (v,, T o x ) (2) if e v where T o x is the node rehed y outgoing edge of T o, lelled with x. 3. After rehing vr, its domin is extended to the vlues tken in ndidte sttes (the vlues of eh outgoing edges of urrent node, s sweet () works on ndidte sttes represented on C). After this n intersetion on remining vriles is otined with lssil produt of DDDs. sweet (v,, T o) (e, x) = e x ( id T o )i (3) A omputtion of sweet () opertor is given on figure 3. We re pplying the homomorphism sweet (, 3, T O) on the DDD C (see first nd seond shemes). The DDD T O does not ept = 2, thus pplition of sweet () on 2... leds to the empty set (ording to formul ), nd the homomorphism propgtes in C on the edge C fter restriting T O to the suffix of = (the outgoing edge of T O lelled y ording to the formul 2, see third sheme). By definition, eh vlue lelling outgoing edge of the node C is llowle. The set of sttes they hndle ( 2 C ) + ( 3 C 2 ) is interseted with sttes of T O tht represents the exeution ontext = 2 ( 2 d2) given lower lyers (ording to formul 3, see fourth sheme). The result is given in the fifth nd lst sheme. Predeessors of T O were seleted in C, respeting the exeution ontext of the instrution = 2. We found tht for ny non-reversile instrution, the pre opertor n e omputed using the evlution of onstnt ssignment s one. In se of expression ssignment, it is defined s elow: Proposition 3 (pre opertor for Expression Assignement). Let d e well defined DDD, vr e vrile of d, expr e n rithmeti expression suh s ny prmeter of expr is defined on d, nd C the ste of rehle sttes. The homomorphism setexpr (vr, expr) tht performs the pre opertor (ording to C) of ssignment vr = expr is defined s

7 Vinent Beudenon, Emmnuelle Enrenz, Smi Tktk: Dt Deision Digrms for ProMeL Systems Anlysis 7 TO d3 d0 d 3 2 d2 4 3,4 2 sweet(d0,,2) 2 C 2 4,5 C 2 3 2,3 sweet(null,,2) sweet(d,, 2) 2 2 =DDD(null) 2 4,5 2 3 C C 2 C C 2 2,3 4,5 3,4 2, =d2 x x Fig. 3. Computtion of the sweet () opertor elow: if presetexpr (vr, expr, C) (e, x) = vr = e seletcond (x = expr) presetcst (e, x, ) (e x id ) else if e expr if expr {e:=x} = 0 e x presetcst (vr, evl(expr {e:=x}, C x ) else e x presetexpr (vr, expr {e:=x} C x ) else e x presetexp (vr, expr, C x ) 3.3 Differenes with BDDs nd MDDs Sve the rnge of the vriles, there re ruil differenes etween BDDs nd DDDs: On BDD, eh pth leding to terminl ( or 0) is represented on the DAG ut some vrile my not our long pth leding from root to lef, in se it is not deision node. On DDD only pths leding to the terminl re represented, hene long eh pth from root to terminl, eh vrile ppers t lest one. On BDDs, It is possile to represent the trnsition of stti ProMeL system using the Apply proedure proposed y [3]. The Apply proedure reursively trverses the two BDD opernds from root to leves (either 0 or ). On the opposite, homomorphisms do not hve to trverse the whole DDD down to lef. On BDD, ssignment of vrile is performed while onsidering the vrile s nd the expression s itto-it deomposition. This deomposition supposes n priori knowledge of the domin of eh ProMeL vrile (oftenly given y the type of the vrile), nd some type-onversion or it-expension filities. For instne, onsidering three vriles x, y nd z of yte type, nd the ssignment x = y + z, eh it x i of x will e modified with the ith oolen funtion of n 8-its dder. The it-to-it ssignment is performed using i-implition (oolen funtion xnor). For exmple, the ssignment opertor = for set of sttes represented on the oolen funtion f is performed in three steps:. Astrting the ssigned vrile: f = f. 2. Construting the i-implition opertor etween nd : x = ā. 3. Construting the new funtion g = f x. A performnes omprison of BDDs nd DDDs on ProMeL systems is given in setion 5. On the other hnd, MDDs represent oolen (or eventuly rithmeti) funtion over integer vriles. Eh internl node represent n integer vrile, pointing out the nodes representing nother vrile. The rity of eh node is priori ounded (ontrry to DDD). Vriles hve to e ordered, nd MDD nodes representing given vrile re sid to elong to given lyer, tht n e rehed diretly (without trversing the MDD from its root to this lyer). This implementtion is wellsuited to perform lol modifitions of the MDD, without hving to trverse it (from root to leves s in BDD or from root to the onerned vrile s in DDD). In MDD, representing the firing of trnsitions is performed using event lolity [7]. In se of trnsitions using few vriles represented on lose lyerss on the DAG, [7] proposes to modify these only lyers, onsidering the independene of the others. First, eh trnsition is deomposed into n enumertive set of prtiulrized trnsitions regrding vriles domins. These trnsitions re represented on ouple of sttes: Enling sttes nd new sttes. These sttes re represented on MDDs orresponding to set of lyers ontining ll onerned vriles. A union is performed etween pths ontining enling sttes nd new sttes generted. An exmple is given on figure 4. The entrl MDD represents set of sttes mde of vriles (,,, d). Vriles domin is {0,, 2}, eh node is ssimilte to n rry of three edges impliitly lelled y one of these three vlues nd leding to node to the following lyer. For instne, in urrent stte spe, there is unique

8 8 Vinent Beudenon, Emmnuelle Enrenz, Smi Tktk: Dt Deision Digrms for ProMeL Systems Anlysis <0> <0> <2> Union <0> <> Union <3> <0> <> <2> <0> <> <3> <0> <2> <> d Event e enled y <0>: e (*,,, *) (*, 2,, *) <d0> <d> <d0> Event e enled y <>: (*,,, *) e (*, 2,, *) Current sttes spe New stte spe <d> d Fig. 4. Exmple of n MDD-modifition in response to firing n event node ( 0 ), lelled y the vrile, whith two outgoing edges orresponding to the first nd the lst vlue of the vriles domin: 0 nd 2. There is no stte tht stisfies =. Considering the ssignment = +, onerned vriles re nd nd modifitions only our on these two onseutive lyers. In the figure, the ssignement is performed if = = (other ses hve to e hndled). The orresponding enling set of sttes is (,,, ) (wih mens tht nd re set to, nd d don t mtter) nd the result fter trnsition is (, 2,, ). As vrile is not onerned, the prefixes 0 nd 2 re preserved the omputtion strts on lyer. Corresponding pthes re: 0 0 [ d0 ] nd [ d ]. The squre rkets denotes suffixes of the pthes tht re not modified y the tretment. We denote the event e: (,,, ) e (, 2,, ) they re respetively united with result pttern joint to she sme suffixes of enling ptterns [ d0 ] nd ( ) [ d ]. Enumertive prtiulriztion of trnsition T is neessry nd inreses the omputtion omplexity. However, this method prove its effiieny for representing huge stte-spe on Petri nets whith strong lolity, ontroled (nd smll) vriles domins (ples pity), nd n d-ho vrile ordering. Representing rehle stte spe for ProMeL systems on MDDs presents three mjor diffiulties. First, prtitioner my hve no ide out vriles rnge sve the C type used for its enoding, whih mens, for instne, reting nodes of 256 outgoing edges for vrile enoded on yte, even if its effetive set of vlues is muh smller. Seond, some vriles re shred etween mny proesses nd trnsitions my onern mny of them, thus the lolity ftor is not s preeminent s in Petri nets. Third, the enumertive prtiulriztion of trnsitions my eome the min ftor of omintoril explosion (notly when deling with rithmeti expressions), ll the more sine vriles domins re too gret. Dt Deision Digrms solve the first prolem: They hndle effetively only rehed vlues. Homomorphisms on DDDs solve the two lst prolems: Even if rehing onerned lyers is fster on MDDs (ut only pplile when lolity is present), representing trnsition does not depend on vrile ordering nd hs nonil form whtever the rehed vlues re. 4 ProMeL systems omponents We show how DDDs re used to represent stte of ProMeL system. Then we define homomorphisms orresponding to pre nd post opertors tht mth ProMeL semntis. 4. Ojet Model of ProMeL progrm Figure 5 shows our ojet onstrution of ProMeL progrm. The progrm lss possesses glol vriles, ommunition hnnels nd ProMeL progrm s proesses. Eh proess lss possesses lol vriles of proess nd its progrm ounter. There re two min instrution s type in ProMeL: Elementry instrutions (lelled, gurded) nd loks seprtors (selets, loops, et.). These ltests ontin speilised strutured sets of instrutions ut they re uilt on the sme homomorphisms s elementry instrutions re. 4.2 Stte representtion A ProMeL progrm desries dynmi olletion of proesses whih ommunite with hnnels or shred vriles. We onsider stti suset of ProMeL, no proess nor vrile n e dynmilly instnited.

9 Vinent Beudenon, Emmnuelle Enrenz, Smi Tktk: Dt Deision Digrms for ProMeL Systems Anlysis 9 Progrm Vrile..* Proess..*..* Instrution..* _nme _nme _nme _pindex _vriles 0..* _index _vriles _pvl _proesses _instrutions _npvl _timeouts 0..* 0.. _lels _proess..* _progrm 0..* 0.. Fig. 5. Ojet model of ProMeL progrm This ssumption llow us to represent stte-spe s olletion of vriles desried s follows. Eh integer vrile is represented y DDD : vrile vlue A proess is otined y the ontention of DDDs tht represent its lol vriles nd progrm ounter: progrm ounter p lol vr vl Eh stti strutured type is flttened without hnging the system s ehviour. For exmple, n n sized rry t is represented with n vriles: t[0] t[]... t[n ] There re two types of ommunition using hnnels: Rendez-vous tht re repled with gurded ssignments; nd FIFOs tht re represented on DDD y using the enoding proposed y [9]: We use the sme vrile for eh ple of the FIFO. All the nodes re represented suessively on the DDD frmed with two nodes lelled with the sme vrile: The first one indites the hnnel s size nd the lst one indites tht there is no other oupied ple in the FIFO. This lst one, hs unique outgoing edge lelled with vlue tht nnot e hold in the FIFO (#). Thus, FIFO re onstruted using the following wy: f size f st elt...f ith elt f # (4) The stte of ProMeL progrm is otined y the ontention of ll glol vriles, hnnels nd proesses. 4.3 Instrutions Eh elementry instrution is gurded y given progrm ounter vlue. Another ondition my e dded (like non-emptyness of FIFO, for instne). Eh instrution proeeds to the progrm ounter evolution nd modifitions desried in ProMeL. In stti ProMeL systems (no dynmi proess retion), eh instrution n e onstruted using these following elementry tretments:. Seletion of sttes stisfying given oolen formul. 2. Integer expression ssignment. 3. Expression s writing in FIFO. 4. Vrile s reding in FIFO. 5. Cthing informtion on FIFO (full, non-full, empty nd non-empty). Elementry instrutions nd orresponding homomorphisms re given in tle 4.3 the lst olumn gives dditionl homomorphisms tht my e lled when using the homomorphism in previous olumn. Given the promel ode = +;, whih ssigns the expression + to the vrile nd sets the progrm ounter p from n ritrry vlue m to nother ritrry vlue n, the tretment n e performed y pplying the following homomorphism: setcst (p, n) setexpr (, + ) seletcond (p = m) = seletandset (p, m, n) setexpr (, + ) More omplex homomorphims were uilt using these elementry ones to perform omplete instrution (inluding the evolution of the progrm ounter) on unique trversl. 5 Results 5. performnes In this setion we ompre the performnes of SPIN versus our tool using DDDs or BDDs onerning stti systems. As heking LTL properties using Bühi utomton is n dditionl soure of omplexity, we hose to ompre SPIN nd our tool only on the rehle

10 0 Vinent Beudenon, Emmnuelle Enrenz, Smi Tktk: Dt Deision Digrms for ProMeL Systems Anlysis Tle. Elementry homomorphisms for ProMeL instrutions Instrution ProMeL ode Min Homomorphism Su-Homomorphisms Jump goto lel; seletandset (p, pv l, npv l) Gurd (==); seletcond (Expression) Constnt Assignment x=2; setcst (vr, vl) Expression Assignment x=+; setexpr (vr, Expression) setcst () up () down () Fifo not Full f![ ]; notfull (fifo) heknotfull (n) (Compres the size of the Fifo nd the numer (n) of used ples. Fifo not Empty f?[ ]; notempty (fifo) Write Constnt in Fifo f!2; writecst (fifo, st) ddtilcst (st) ( Til mens enounter of ) Write Expression in Fifo f!(+); writeexpr (fifo, expression) writecst () up () downfifoexpr () Red vrile in Fifo f?v; redvr (fifo, vr) setcst () up () downvrfifo () stte-spe onstrution. Futhermore, rehle sttespe doesn t depend on the property to hek nd it n e omputed nd stored efore heking ll properties we wnt. As the properties heked my e not relevnt, it is useful to hek new properties without hving to restrt rehle stte-spe uild-up. The relevne of DDD is lso ompred to BDD implementtion. The experiment ompres the time nd memory needed to ompute the set of rehle sttes (sed on the post opertor) nd the verifition of CTL property (sed on the pre opertor). The BDD nd DDD-sed tools strts from the sme internl represention of the ProMeL progrm, nd re sed on the sme verifition lgorithms sve the lirry used : Our own DDD lirry or the Buddy pkge [8]. Buddy offers set of funtions to mnge finite sets nd finite integers, represented s BDD vetors, nd lso supports dynmi reordering (tht DDD does not hndle). Comprison results re given on tle 5., we used 3,2GHz Intel Pentium IV, lulus were utomtilly orted fter dy or GB of used memory. The olumns SPIN, BDD, DDD nd DDD-O ontins performnes of given tool. DDD-O is otined y foring nturl order on the tree inspired y the system s topology. For eh tool, olumn reh mens the user time needed to uild-up the rehle stte-spe; olumn hek gives the tuser time needed to ompute the set of sttes stisfying the CTL property; olumn mem indites the memory used to perform the omputtion of the rehle stte-spe (one the rehle stte-spe is uilt, no dditionl memory is needed to hek the CTL property). The systems we heked re: A mssively prllel system using very simple omponents on ring: The dining philosophers prolem. Systems with less (ut more omplex) omponents: The leder eletion on ring nd sliding window protool. Systems deling with omplex rithmeti expression without possiility to fore nturl order (Bkery s nd Peterson s Algorithms). Results on DDDs (with or without stti ordering) were otined without ny optimiztion (dynmi reorder, stte-spe ompression, prtil order redution, sturtion et.) sve the use of omputtion he. Results on BDDs were otined using the more relevnt optimiztion (prtiulry Sift or Win2ite reorder lgorithms). SPIN results were otined using posteriori suggested prmeters y the SPIN model heker, whih led us to reompute some lulus to otin the est performnes. The olumn S in tle 5. gives the numer of sttes generted. 5.2 Disussion 5.2. Symoli vs Enumertive We only onsider the omputtion of the rehle sttespe. For smll sized systems, nd systems whose ehviour is highly sequentil, SPIN presents etter performnes in oth time nd memory thn BDD nd DDD pprohes. As soon s the systems size grows, BDD nd DDD mnge etter the omintoril explosion thn SPIN. We n ring out this property y ompring dining philosophers, leder eletion nd sliding window systems. The topology of these exmples is the sme (

11 Vinent Beudenon, Emmnuelle Enrenz, Smi Tktk: Dt Deision Digrms for ProMeL Systems Anlysis Tle 2. Stts on SPIN, DDDs or BDDs SPIN BDD DDD DDD-O S reh mem reh hek mem. reh hek mem reh hek mem N (se.) MB (se.) (se.) MB (se.) (se.) MB (se.) (se.) MB Dining Philosophers AG(AF(eting philosopher)) < 2.3 < < 93 < < 4.3 < < e e e e e e > 24h e > 24h e9 * > GB * * * * * > GB e23 * > GB * * * * * > GB Leder Eletion AF(est ndidte eleted) 5 5.4e e e5 * > GB * * * e7 * > GB * * * 4533 * * 77 Sliding Window AG(AF(new messge sent)) 2 4.0e5 < e e e * * > GB * * * * * > GB * * > GB Peterson AF(query i stisfied) nd AG(query i AF(ritil i)) < 5.5 < 94 < < e4 < e * * > GB 4.7e5 > 24h 900 * * > GB Bkery AF(lient i stisfied) 4.8e5 < < 94 7 < e < e9 > 24h * * * * ring) ut the omplexity of the nodes differs. Figure 6 shows (on logrithmi sle) the numer of new sttes generted t eh itertion, y pplying the post opertor. The sliding-window protool does not produe more thn 5000 sttes t eh itertion, nd in this se the use of symoli methods is ounter-produtive. On the other hnd, for systems produing huge numer of new sttes t eh step, (s leders or philosophers, growing up to 0 8 sttes), symoli tehnis re relevnt, ut vriles ordering strtegies hve to e used to outperform signifintly enumertive stte-spe onstrution. new sttes generted e+2 e+0 e+08 e philo 3 leders 8 sliding 2 The sequenil spet of Sliding Window is not the only reson why symoli methods re outperformed y SPIN: It uses uffered hnnels ontining strutured dt tht hve een flttened to e represented on DDD. First, eh ssignement or reding/writing opertion needs to ompose s mny homomorphisms s there is fields in the onerned struture. Seond, this unexpeted growth of the tree s depth inreses the numer of nodes nd homomorphisms to store (nd the memory needed), nd slow down the omputtion he time (s) Fig. 6. New sttes generted y pplying post DDDs vs BDDs In the exmples, ll vriles domins n e priori defined, hene re representle either with DDD or with BDD (for BDD, ll the vlues of the type domin re enoded). DDDs shows more flexiility when using rithmeti expression using rrys (Bkery nd Peterson). In

12 2 Vinent Beudenon, Emmnuelle Enrenz, Smi Tktk: Dt Deision Digrms for ProMeL Systems Anlysis ft, expressions onerning rrys nnot e omputed with n orthogonl produt (t[n] = n i=0 t[i] (i = n)) on BDDs euse of the neessity two opernds of the sme domin to uild opertors (this is Buddy limittion). DDDs doesn t suffer this prtiulrity s they don t re out vriles s domins. Thus, without hnging glol ehvior of proesses, we hd to modify some instrution in the ProMeL ode to simultes the orthogonl produt to fit with Buddy s interfe. Hndling expression with mny opernds mde BDDs little more effiient thn DDDs when heking the Peterson s lgorithm (one step eyond). When ny stti ordering is imposed, DDDs show omprle performnes with BDDs using the est ordering onfigurtion. When using nturl order, DDDs overomes BDDs, ut pplying this good DDD-order on BDD does not improve BDD performne (it is just the opposite!). Considering speed, DDDs proove the effiieny of indutive methods s omputtion time gets lower for DDDs thn BDDs s the system s omplexity grows. Conerning CTL formuls nd omputing pre opertor, the struturl differenes inlined in fvour of DDDs. Even if strting vrile on BDD is more effiient thn using rehle sttes, the priniple of unique oupled trversl in DDD voids to ompute other tretments (seletion nd intersetion) on the whole BDD. The lolity evlution due to homomorphism is the min ftor explining the gin of DDD over BDD Future Works As stts shown on tle 5. were given without ny optimiztion on DDDs (sve ordering vriles mnuly in the lst olumn), DDDs formlism (Shred tree nd indutive methods) prove its effiieny for stte-spe onstrution, nd its ility to ontin stte-spe explosion. Without vriles ordering, DDDs present omprle performnes with expliit nd ompressed representtion in SPIN or with symoli representtion on ordered BDDs. Sve vrile s order tht improves shring qulity, two DDDs disfvourle prmeters were not minimized: vriles numer tht inreses the tree s depth nd sequenil proedures tht mkes too thin the new sttes frontier. The lst evolution of DDDs, the Set Deision Digrms (SDDs [27]) tht lels the edges of the tree with dt sets (DDDs or SDDs) llows est shring properties on hierrhil modelled systems nd dereses the depth of the tree on hierrhily modeled systems. Conerning sequenil spet of some kind of systems, sturtion lgorithm my help to produe more sttes y pplying the post opertor for unique proess until fixpoint is rehed. After sturting proess, some pttern re outlined nd the sturtion of other proesses will tke into ount more exeution ontexts. This method n e implemented on homomorphism tht lunhs the sturtion fter hving rehed vrile tht onerns the sturted proess. For instne, on DDDs with nturl order, sturting proesses in inresing then deresing order llow us to onstrut the stte-spe of 50 dining philosophers in seonds with only 7MB of memory. These first results enourge us to pursue our investigtion of DDDs nd the derived strutures to uild verifition tools. 6 Conlusion nd future works We developped CTL symoli model heker for stti ProMeL systems tht n verify sfety nd liveness properties when SPIN is inefiient. This tool is sed on Dt Deision Digrms tht reprodues shred nd tree sed nonil representtion of OBDDs. This struture, nd the ssoited formlism of homomorphisms, helps to hndle numeri vlues nd llows omplex trnsitions representtion. As with BDDs, vriles ordering is ritil. We indentify the min hrteristis tht mkes symolis methods more effiient thn expliits methods (SPIN gives est results only on strongly sequentil systems). Comprison with OBDDs prove the relevne to work with non oolen vriles for sttespe representtion nd indutive methods for sttespe onstrution (rther thn ll-bdd onstrution). Mins lks re linked to the depth of the tree, speilly when mny strutured types re flttened. As DDDs nd homomorphisms formlism prove their effiieny, our future works resides in uild Model-Cheker tht exploits hierrhil properties of the heked systems y the wy of Set Deision Digrms tht will overome vrile s multipliity prolem nd will limit needed mteril resoures y reduing the size of omputtion he. Referenes. Vinent Beudenon, Emmnuelle Enrenz, nd Jen- Lou Desrieux. Design vlidtion of zsp with spin. In Proeedings of the Third Interntionl Conferene on Applition of Conurreny to System Design (ACSD 03), pge 02. IEEE Computer Soiety, R. K. Bryton, G. D. Hhtel, A. Sngiovnni- Vinentelli, F. Somenzi, A. Aziz, S. T. Cheng, S. Edwrds, S. Khtri, Y. Kukimoto, A. Prdo, S. Qdeer, R. K. Rnjn, S. Srwry, T. R. Shiple, G. Swmy, nd T. Vill. VIS: system for verifition nd synthesis. In Rjeev Alur nd Thoms A. Henzinger, editors, Proeedings of the Eighth Interntionl Conferene on Computer Aided Verifition CAV, volume 02, pges , New Brunswik, NJ, USA, / 996. Springer Verlg. 3. Rndl E. Brynt. Grph-sed lgorithms for oolen funtion mnipultion. IEEE Trns. Comput., 35(8):677 69, 986.

13 Vinent Beudenon, Emmnuelle Enrenz, Smi Tktk: Dt Deision Digrms for ProMeL Systems Anlysis 3 4. Rndl E. Brynt. Binry deision digrms nd eyond: Enling tehnologies for forml verifition. In IEEE/ACM Interntionl Conferene on Computer Aided Design, ICCAD, Sn Jose/CA, pges IEEE CS Press, Los Almitos, J.R. Burh, E.M. Clrke, K.L. MMilln, D.L. Dill, nd L.J. Hwng. Symoli Model Cheking: 0 20 Sttes nd Beyond. In Proeedings of the Fifth Annul IEEE Symposium on Logi in Computer Siene, pges 33, Wshington, D.C., 990. IEEE Computer Soiety Press. 6. G. Cirdo nd R. Siminienu. Using edge-vlued deision digrms for symoli genertion of shortest pths, Ginfrno Cirdo, Gerld Luettgen, nd Rdu Siminienu. Effiient symoli stte-spe onstrution for synhronous systems. Tehnil report, E. M. Clrke, E. A. Emerson, nd A. P. Sistl. Automti verifition of finite-stte onurrent systems using temporl logi speifitions. ACM Trns. Progrm. Lng. Syst., 8(2): , Jen-Mihel Couvreur, Emmnuelle Enrenz, Emmnuel Pviot-Adet, Denis Poitrenud, nd Pierre- André Wrenier. Dt deision digrms for petri net nlysis. In Proeedings of the 23rd Interntionl Conferene on Applitions nd Theory of Petri Nets, pges Springer-Verlg, C. Dws, A. Olivero, S. Tripkis, nd S. Yovine. The tool kronos. In Proeedings of the DIMACS/SYCON workshop on Hyrid systems III : verifition nd ontrol, pges Springer-Verlg New-York, In., E. A. de Kok, W. J. M. Smits, P. vn der Wolf, J.- Y. Brunel, W. M. Kruijtzer, P. Lieverse, K. A. Vissers, nd G. Essink. Ypi: pplition modeling for signl proessing systems. In Proeedings of the 37th onferene on Design utomtion, pges ACM Press, T. Henzinger nd H. Wong-Toi P.-H. Ho. Hyteh: model-heker for hyrid systems. :0 22, G. J. Holzmnn. Design nd Vlidtion of Computer Protools. Prentie-Hll, Englewood Cliffs, New Jersey, G. J. Holzmnn. The Model Cheker Spin. IEEE Trns. on Softwre Engineering, 23(5): , My 997. Speil issue on Forml Methods in Softwre Prtie. 5. G.J. Holzmnn. Stte Compression in Spin. Twente University, The Netherlnds, April G.J. Holzmnn nd Doron Peled. An improvement in forml verifition. In Pro. Forml Desription Tehniques, FORTE94, pges 97 2, Berne, Switzerlnd, Otoer 994. Chpmn & Hll. 7. Denis Hommis, Frédéri Pétrot, nd Ivn Augé. A prtil tool ox for system level ommunition synthesis. In Proeedings of the ninth interntionl symposium on Hrdwre/softwre odesign, pges ACM Press, Jørn Lind-Nielsen nd Henrik Reif Andersen. Stepwise CTL model heking of stte/event systems. In CAV 99: Computer Aided Verifition. Leture Notes in Computer Siene, Kenneth L. MMilln. Symoli Model Cheking. Kluwer Ademi Pulishers, Andrew S. Miner nd Ginfrno Cirdo. Effiient rehility set genertion nd storge using deision digrms. In Dontelli, Susnn nd Kleijn, Jetty, editors, Leture Notes in Computer Siene: Applition nd Theory of Petri Nets 999, 20th Interntionl Conferene, ICATPN 99, Willimsurg, Virgini, USA, volume 630, pges Springer-Verlg, june D. Peled. Comining prtil order redutions with onthe-fly model-heking. In Pro. Sixth Int Conf. Computer Aided Verifition (CAV94), pges , Hong Peng, Sofiène Thr, nd Ferht Khendek. Comprison of SPIN nd VIS for protool verifition. Interntionl Journl on Softwre Tools for Tehnology Trnsfer (STTT), 4(2): , Ferury A. Pnueli. The Temporl Logi of Progrms. In 8th IEEE Symp. Foundtions of Computer Siene, pges 46 57, P. Rloz. Symoli proof of temporl properties for vrious kinds of Petri nets. PhD thesis, University of Genev, Switzerlnd, April Y.S. Rmkrishn, O. Sokolsky, Xioqun Du, S. Smolk, nd E. Strk. Fighting livelok in the i-protool: A omprtive study of verifition tools. In Pro. of the 5th interntionl onferene on Tools nd Algorithms for the Constrution nd Anlysis of Systems, TACAS 99, pges Springer-Verlg, J. Sifkis. A unified pproh for studying the properties of trnsition systems. Theoretil Computer Siene, 8(3): , June Ynn Thierry-Mieg. Tehniques pour le model-heking de spifition de Hut Niveu. PhD thesis, Universit Pierre et Mrie Curie (UPMC, Pris 6) - LIP6, 2004.