SPIN Search Optimization from THE SPIN MODEL CHECKER

SPIN Search Optimization from “THE SPIN MODEL CHECKER” by G. Holzmann Presented by Hong, Shin 23 th Nov 2007 2021 -03 -04 SPIN Search Optimization Hong, Shin @ PSWLAB 1 / 31

Introduction (1/1) • In explicit model checking, verification problem is reduced to the reachability problem in a graph. • The hard problem in explicit model checking to solve is finding effective ways to scale reachability checking algorithm to handle large to very large graph. Approaches (1) Reduce the number of reachable states to check - Partial order reduction, Statement merging (2) Reduce the amount of memory that is needed to store visited states. - Loseless compression : Collapse compression, Minimized automaton - Lossy compression : Bitstate hashing, Hash compact 2021 -03 -04 SPIN Search Optimization Hong, Shin @ PSWLAB 2 / 31

Partial Order Reduction (1/9) byte g = 0 ; active proctype T 1() { byte x ; x = 1 ; g = g + 2 ; } T 1: L 0 T 2: L’ 0 x=1 y=1 L 1 L’ 1 g=g+2 L 2 g=g*2 L’ 2 active proctype T 2() { byte y ; y = 1 ; g = g * 2 ; } 2021 -03 -04 SPIN Search Optimization Hong, Shin @ PSWLAB 3 / 31

Partial Order Reduction x, y, g L, L’ x=1 g=g+2 1, 0, 0 L 1, L’ 0 1, 0, 2 L 2, L’ 0 L 0, L’ 0 1, 1, 0 L 1, L’ 1 1, 1, 2 L 2, L’ 1 g=g*2 1, 1, 4 L 2, L’ 2 2021 -03 -04 y=1 x=1 y=1 g=g+2 y=1 0, 0, 0 SPIN Search Optimization (2/9) 0, 1, 0 L 0, L’ 1 g=g*2 0, 1, 0 L 0, L’ 2 g=g*2 1, 1, 0 L 1, L’ 2 x=1 g=g+2 1, 1, 2 L 2, L’ 2 Hong, Shin @ PSWLAB 4 / 31

Partial Order Reduction (3/9) • For two statements a and b, if two interleavings of these statements from any state result different states or two interleavings are impossible, then a and b are dependent to each other. - Dependent statements pairs g=g*2 and g=g+2 because both touch same data object. x=1 and g=g+2 the order of statements are fixed. y=1 and g=g*2 the order of statements are fixed. - Independent statements pairs x=1 and y=1 x=1 and g=g*2 y=1 and g=g+2 2021 -03 -04 SPIN Search Optimization Hong, Shin @ PSWLAB 5 / 31

Partial Order Reduction ¾ 1 ¾ 2 ¾ 3 ¾ 4 ¾ 5 ¾ 6 (4/9) ={(0, 0, 0, L’ 0) , (1, 0, 0, L 1, L’ 0), (1, 0, 2, L’ 0), (1, 1, 2, L’ 1), (1, 1, 4, L 2, L’ 2)} ={(0, 0, 0, L’ 0) , (1, 0, 0, L 1, L’ 0), (1, 1, 0, L 1, L’ 1), (1, 1, 0, L 1, L’ 2), (1, 1, 2, L’ 2)} ={(0, 0, 0, L’ 0) , (0, 1, 0, L’ 1), (0, 1, 0, L’ 2), (1, 1, 0, L 1, L’ 2), (1, 1, 2, L’ 2)} ={(0, 0, 0, L’ 0) , (0, 1, 0, L’ 1), (1, 1, 0, L 1, L’ 1), (1, 1, 2, L’ 1), (1, 1, 4, L 2, L’ 2)} These runs can be classified into two groups according to the end state. {¾ 1, ¾ 2, ¾ 6} , {¾ 3, ¾ 4, ¾ 5} 2021 -03 -04 SPIN Search Optimization Hong, Shin @ PSWLAB 6 / 31

Partial Order Reduction ¼ 1 = { x=1 ; g=g+2 ; y=1 ; g=g*2; } ¼ 2 = { x=1 ; y=1 ; g=g+2 ; g=g*2; } ¼ 6 = { y=1 ; x=1 ; g=g+2 ; g=g*2; } (5/9) Independent statements pairs x=1 and y=1 x=1 and g=g*2 y=1 and g=g+2 ¼ 3 = { x=1 ; y=1 ; g=g*2 ; g=g+2; } ¼ 5 = { y=1 ; x=1 ; g=g*2 ; g=g+2; } ¼ 4 = { y=1 ; g=g*2 ; x=1 ; g=g+2; } • Within each class, each run can be obtained from the other runs by one or more permutations of adjacent independent transitions. • The eventual outcome of a computation remains unchanged under such permutations. • For verification, it therefore would suffice to consider just one run from each class. 2021 -03 -04 SPIN Search Optimization Hong, Shin @ PSWLAB 7 / 31

Partial Order Reduction x, y, g L, L’ x=1 g=g+2 1, 0, 0 L 1, L’ 0 1, 0, 2 L 2, L’ 0 L 0, L’ 0 1, 1, 0 L 1, L’ 1 1, 1, 2 L 2, L’ 1 g=g*2 1, 1, 4 L 2, L’ 2 2021 -03 -04 y=1 x=1 y=1 g=g+2 y=1 0, 0, 0 SPIN Search Optimization (6/9) 0, 1, 0 L 0, L’ 1 g=g*2 0, 1, 0 L 0, L’ 2 g=g*2 1, 1, 0 L 1, L’ 2 x=1 g=g+2 1, 1, 2 L 2, L’ 2 Hong, Shin @ PSWLAB 8 / 31

Partial Order Reduction (7/9) • For previous example, it would be suffice to consider only runs ¾ 2 and ¾ 3. to accurately prove LTL formulae such as – Always(g = 0) – Eventually(2 · g) 2021 -03 -04 SPIN Search Optimization Hong, Shin @ PSWLAB 9 / 31

Partial Order Reduction (8/9) • What if “Always(y · x)” ? → The formula secretly introduces dependency between x=1 and y=1. ¼ 1 = { x=1 ; g=g+2 ; y=1 ; g=g*2; } ¼ 2 = { x=1 ; y=1 ; g=g+2 ; g=g*2; } ¼ 6 = { y=1 ; x=1 ; g=g+2 ; g=g*2; } Independent statements pairs x=1 and g=g*2 y=1 and g=g+2 ¼ 3 = { x=1 ; y=1 ; g=g*2 ; g=g+2; } ¼ 5 = { y=1 ; x=1 ; g=g*2 ; g=g+2; } ¼ 4 = { y=1 ; g=g*2 ; x=1 ; g=g+2; } 2021 -03 -04 SPIN Search Optimization Hong, Shin @ PSWLAB 10 / 31

Partial Order Reduction (9/9) • SPIN constructs global reachability graph on the fly. • SPIN uses a static reduction method for partial order reduction. – The dependency relations are computed offline. • Pre-evaluated dependency relations are used to decide which successors to search at each state exploration in SPIN. 2021 -03 -04 SPIN Search Optimization Hong, Shin @ PSWLAB 11 / 31

Statement Merging (1/5) • Merge sequences of transitions within a process into a single step to avoid the creation of unnecessary intermediate system states. • Automatically add d_step constructs into a specification whenever a sequence of statements meets merging condition. 2021 -03 -04 SPIN Search Optimization Hong, Shin @ PSWLAB 12 / 31

Statement Merging (2/5) • Merging can be safely done if a sequence of statements in a process (1) accesses only local data. (2) does not have any guarded condition (if or do statements). • Statement merging is enabled in default. And this can be disabled by –o 3 option. 2021 -03 -04 SPIN Search Optimization Hong, Shin @ PSWLAB 13 / 31

Statement Merging active proctype merging() { byte c ; if : : c = 0 ; : : c = 1 ; : : c = 2 ; fi ; do : : c < 2 -> c++ ; : : c > 0 -> c-- ; od ; } 2021 -03 -04 SPIN Search Optimization (3/5) L 0 c=2 c=1 c=0 L 1 c++ [c<2] c-[c>0] L 2 L 3 Hong, Shin @ PSWLAB 14 / 31

Statement Merging (4/5) c, L 0 c=0 c=1 0, L 1 [c<2] 1, L 1 [c>0] c-1, L 3 2021 -03 -04 2, L 1 c++ [c>0] 0, L 2 c=2 SPIN Search Optimization [c<2] c-c++ 2, L 3 1, L 2 Hong, Shin @ PSWLAB 15 / 31

Statement Merging active proctype merging() { byte c ; if : : c = 0 ; : : c = 1 ; : : c = 2 ; fi ; do : : d_step {c < 2 -> c++ ; } : : d_step {c > 0 -> c-- ; } od ; } (5/5) L 0 c=0 [c<2] c++ [c>0] c-- 0, L 0 c=0 [c<2] c++ [c>0] c-- SPIN Search Optimization c=1 L 1 0, L 1 2021 -03 -04 c=2 c=1 1, L 1 c=2 [c<2] c++ 2, L 1 [c>0] c-Hong, Shin @ PSWLAB 16 / 31

Collapse Compression (1/3) • Replicating a complete description of all local component of the system state in each global state that is stored is wasteful technique. • Collapse compression mode tries to store smaller state components separately while assigning small unique index numbers to each one. 2021 -03 -04 SPIN Search Optimization Hong, Shin @ PSWLAB 17 / 31

Collapse Compression (2/3) • Def. System State (gvars, procs, chans, exclusive, handshake, timeout, else, stutter) gvars: a finite set of variables with global scope procs: a finite set of processes chans: a finite set of message channels exclusive, handshake are integers timeout, else, stutter are booleans • Def. Process (pid, lvars, lstates, initial, curstate, trans) lvars: a finite set of local variables lstates: a finite set of integer initial: an element of lstates trans: a finite set of transitions on lstates. * PROMELA Semantics Hong, Shin @ PSWLAB 18 / 31

Collapse Compression (3/3) • Break down a global state into separate components – first component: the set of all global data objects such as global variables and all message channels. – one component for each active process: its control state and local states of the process. 2021 -03 -04 SPIN Search Optimization Hong, Shin @ PSWLAB 19 / 31

Minimized Automaton (1/4) • Use a minimized deterministic automaton for storage of statespace instead of conventional lookup table. • If a state descriptor is accepted by the minimized deterministic automaton, then that state was visited. • Lookup and update operation has a time complexity of O(S) where S is the maximum length of a state descriptor. – Both minimized automaton and lookup table have same order time complexity for the operations, minimized automaton takes much more time for the operations. • The user should provide an initial estimate of the maximum depth of the graph that is constructed for the minimized automaton representation using –DMA option for pan. 2021 -03 -04 SPIN Search Optimization Hong, Shin @ PSWLAB 20 / 31

Minimized Automaton (2/4) 1 0 Automaton Structure After Storing {000, 001, 101} 2021 -03 -04 SPIN Search Optimization Hong, Shin @ PSWLAB 21 / 31

Minimized Automaton (3/4) 1 0 Automaton Structure After Storing {000, 001, 100} 2021 -03 -04 SPIN Search Optimization Hong, Shin @ PSWLAB 22 / 31

Minimized Automaton (4/4) In verification of SM_Read. Sector() model where SECT_PER_U is 4, NUM_LS_USED is 6, and MAX_VUN is 5. • SPIN result with –DSAFETY –DCOLLAPSE options - memory: 138. 302 total actual memory usage - time: 0 m 17. 509 s • SPIN result with –DSAFETY –DCOLLAPSE –DMA option - memory: 87. 779 total actual memory usage - time: 13 m 55. 321 s 2021 -03 -04 SPIN Search Optimization Hong, Shin @ PSWLAB 23 / 31

Bitstate Hashing (1/4) • SPIN uses standard hash table as statespace storage. - Each slot in hash table has a sorted linked list of states of the same hash value. 2021 -03 -04 SPIN Search Optimization Hong, Shin @ PSWLAB 24 / 31

Bitstate Hashing (2/4) • R : the number of states stored in hash table • H : the number of slots in hash table. • when R > H, - The hash function computes the same value for different states(hash collision). - The average number of comparisons for a lookup or update operation is R/2 H. • when H >> R, - Each state can be stored in a different slot. - The lists stored in each slot will either be empty or contains one single states. 2021 -03 -04 SPIN Search Optimization Hong, Shin @ PSWLAB 25 / 31

Bitstate Hashing • • R M S H (3/4) : the number of reachable states : the memory size that hash table can use : the memory size that each state holds : the number of slots in hash table In standard hash table, H = M/S and If R*S >> M, only (M/S*R) of system state can be covered. If M >> R, assume that hash table has M slots. → Then we can assume that there is either no state or one state in each slot. → Therefore only one bit is enough to represent each slot. 2021 -03 -04 SPIN Search Optimization Hong, Shin @ PSWLAB 26 / 31

Bitstate Hashing (4/4) • In bitstate hashing, it is possible to cover at most M states where M is the memory size for statespace in bits. • Using a hash function hash(state s) that maps a state descriptor to a value in range of 0. . M-1. • For a state s, if slot(hash(s)) is true then state s was visited during the searching. • But this method can not guarantee exhaustive search. For a state s where k=hash(s), if slots(k) = true , it is impossible to distinguish whether s was visited or some other state s’ where hash(s’)=k was visited. But this method does not report false error. 2021 -03 -04 SPIN Search Optimization Hong, Shin @ PSWLAB 27 / 31

Hash Compact (1/2) • If M · R*S, then we can assign b. M/Rc bits for each reachable state. • In hash compact, the hash function hash(state s) returns values in range of 0. . 2 b. M/Rc -1 • SPIN stores these hash values instead of state descriptor. • The hash compact method can be enabled by compiling a verifier with –DHC 4. For example, M=109 and R=107 In bitstate hashing, R/M=1/102 In hash compact, R/2 M/R = 107/2100 ~ 1/1013 2021 -03 -04 SPIN Search Optimization Hong, Shin @ PSWLAB 28 / 31

Hash Compact (2/2) Measured Coverage of Double Bitstate Hashing(k=2) compared with Hash. Compact(hc), and Exhaustive Search Problem size: 427567 reachable states, state descriptor size 1376 bits 2021 -03 -04 SPIN Search Optimization Hong, Shin @ PSWLAB 29 / 31

Further Study • Partial Order Reduction – Static reduction technique used in SPIN. 2021 -03 -04 SPIN Search Optimization Hong, Shin @ PSWLAB 30 / 31

References [1]“THE SPIN MODEL CHECKER” by G. J. Holzmann. [2]The Engineering of a Model Checker: the Gnu i-Protocol Case Study Revisited, G. J. Holzmann. [3]An Improvement in Formal Verification, G. J. Holzmann and Doron Peled. 2021 -03 -04 SPIN Search Optimization Hong, Shin @ PSWLAB 31 / 31