An SMT-Based Approach to Coverability Analysis Javier Esparza 1 , - - PowerPoint PPT Presentation

▶
an smt based approach to coverability analysis
SMART_READER_LITE
LIVE PREVIEW

An SMT-Based Approach to Coverability Analysis Javier Esparza 1 , - - PowerPoint PPT Presentation

Dec 30, 2023 47 likes •529 views

An SMT-Based Approach to Coverability Analysis Javier Esparza 1 , Rusln Ledesma-Garza 1 , Rupak Majumdar 2 , Philipp Meyer 1 , Filip Niksic 2 1 Technische Universitt Mnchen 2 MPI-SWS Petri net coverability is important, but difficult

slide-1
SLIDE 1

An SMT-Based Approach to Coverability Analysis

Javier Esparza1, Ruslán Ledesma-Garza1, Rupak Majumdar2, Philipp Meyer1, Filip Niksic2

1 Technische Universität München 2 MPI-SWS

slide-2
SLIDE 2

Petri net coverability is important, but difficult

  • Many verification problems reduce to Petri net

coverability problem

  • Petri net coverability is EXPSPACE-complete
  • Sophisticated tools and algorithms:

MIST — Expand-enlarge-check [GRB ’06] BFC — Minimal uncoverability proof [KKW ’12] IIC — Incremental, inductive coverability [KMNP ’13]

slide-3
SLIDE 3

MIST, BFC and IIC don’t scale well

Examples proved safe

23 46 69 92 115 MIST BFC IIC Together

64 51 61 33

slide-4
SLIDE 4

Reducing coverability to feasibility of linear constraints

Method LinCon:

  • Based on marking equation [Murata ’77]

Incomplete

  • Strengthened with traps [EM ’00]

Traps — essentially Boolean constraints Still incomplete

slide-5
SLIDE 5

Use SMT for linear and Boolean constraints. But LinCon is incomplete.

Does it make sense to use it?

slide-6
SLIDE 6

Yes! For the right class of examples, LinCon is “quite complete”

Examples proved safe

23 46 69 92 115 MIST BFC IIC Together LinCon

96 64 51 61 33

slide-7
SLIDE 7

Yes! For the right class of examples, LinCon is “quite complete”

Examples proved safe

23 46 69 92 115 MIST BFC IIC Together LinCon

96 64 51 61 33

All but one example in under 100 s

slide-8
SLIDE 8

Contributions

Main contribution:

  • Extensive experimental evaluation showing that

LinCon works well Also:

  • Using duality of linear programming to derive

succinct inductive invariants

slide-9
SLIDE 9

Contributions

Main contribution:

  • Extensive experimental evaluation showing that

LinCon works well Also:

  • Using duality of linear programming to derive

succinct inductive invariants

slide-10
SLIDE 10

In this talk

Petri nets and LinCon Experiments

slide-11
SLIDE 11

In this talk

Petri nets and LinCon Experiments

slide-12
SLIDE 12

Petri nets are state transition systems

x y z s t r

slide-13
SLIDE 13

Petri nets are state transition systems

x y z s t r

transitions places token

slide-14
SLIDE 14

Petri nets are state transition systems

x y z s t r

transitions places token

(0, 1, 0) initial marking

slide-15
SLIDE 15

Petri nets are state transition systems

x y z s t r

transitions places token

(0, 1, 0) initial marking

slide-16
SLIDE 16

Petri nets are state transition systems

x y z s t r

transitions places token

(0, 1, 0) (1, 1, 0) initial marking +(1, 0, 0)

slide-17
SLIDE 17

Petri nets are state transition systems

x y z s t r

transitions places token

(0, 1, 0) (1, 1, 0) initial marking +(1, 0, 0)

slide-18
SLIDE 18

Petri nets are state transition systems

x y z s t r

transitions places token

(0, 1, 0) (1, 1, 0) (0, 1, 1) initial marking +(1, 0, 0) +(-1, 0, 1)

slide-19
SLIDE 19

Petri nets are state transition systems

x y z s t r

transitions places token

(0, 1, 0) (1, 1, 0) (0, 1, 1) initial marking reachable markings +(1, 0, 0) +(-1, 0, 1)

slide-20
SLIDE 20

Reachable markings satisfy marking equation

x y z s t r   x y z   =   1   +   1 −1 1 −1     s t r   Ignore the order of transitions:

  • marking equation [Murata ’77]
slide-21
SLIDE 21

Reachable markings satisfy marking equation

x y z s t r Ignore the order of transitions:

  • marking equation [Murata ’77]

transition vector incidence matrix initial marking marking vector

M = m0 + CX

slide-22
SLIDE 22

Coverability problem

Given a Petri net with:

  • initial marking m0
  • target marking mt

Is there a reachable marking mr that covers mt?

m0 mt mr

slide-23
SLIDE 23

Coverability problem

Given a Petri net with:

  • initial marking m0
  • target marking mt

Is there a reachable marking mr that covers mt?

m0 mt mr

If mt is not coverable, Petri net is safe.

slide-24
SLIDE 24

Adding coverability constraint to marking equation yields basic LinCon

If the constraints are not feasible, the Petri net is safe.

M = m0 + CX M ≥ mt X ≥ 0

slide-25
SLIDE 25

Strengthening LinCon using traps [EM ’00]

Trap — set of places such that every transition that consumes tokens from it also puts tokens into it. x y z

slide-26
SLIDE 26

Strengthening LinCon using traps [EM ’00]

Trap — set of places such that every transition that consumes tokens from it also puts tokens into it. x y z

slide-27
SLIDE 27

Strengthening LinCon using traps [EM ’00]

Trap — set of places such that every transition that consumes tokens from it also puts tokens into it. If a trap is marked, it stays marked. x y z

slide-28
SLIDE 28

Strengthening LinCon using traps [EM ’00]

Trap — set of places such that every transition that consumes tokens from it also puts tokens into it. If a trap is marked, it stays marked. x y z x + y ≥ 1

slide-29
SLIDE 29

LinCon with traps [EM ’00]

M = m0 + CX M ≥ mt X ≥ 0

slide-30
SLIDE 30

LinCon with traps [EM ’00]

M = m0 + CX M ≥ mt X ≥ 0

no solution safe

slide-31
SLIDE 31

LinCon with traps [EM ’00]

M = m0 + CX M ≥ mt X ≥ 0

no solution safe

M = mr X = xr

slide-32
SLIDE 32

LinCon with traps [EM ’00]

M = m0 + CX M ≥ mt X ≥ 0

no solution safe

M = mr X = xr

Is there a trap

  • initially marked
  • empty at mr
slide-33
SLIDE 33

LinCon with traps [EM ’00]

M = m0 + CX M ≥ mt X ≥ 0

no solution safe

M = mr X = xr

Is there a trap

  • initially marked
  • empty at mr

SAT query:

slide-34
SLIDE 34

LinCon with traps [EM ’00]

M = m0 + CX M ≥ mt X ≥ 0

no solution safe

M = mr X = xr

Is there a trap

  • initially marked
  • empty at mr

no solution inconclusive SAT query:

slide-35
SLIDE 35

LinCon with traps [EM ’00]

M = m0 + CX M ≥ mt X ≥ 0

no solution safe

M = mr X = xr

Is there a trap

  • initially marked
  • empty at mr

no solution inconclusive SAT query:

Tp = ( 1, p in trap 0,

  • therwise
slide-36
SLIDE 36

LinCon with traps [EM ’00]

no solution safe

M = mr X = xr

Is there a trap

  • initially marked
  • empty at mr

no solution inconclusive SAT query:

Tp = ( 1, p in trap 0,

  • therwise

M = m0 + CX M ≥ mt X ≥ 0 T τM ≥ 1

slide-37
SLIDE 37

In this talk

Experiments Petri nets and LinCon

slide-38
SLIDE 38

In this talk

Experiments Petri nets and LinCon

slide-39
SLIDE 39

The origin of examples

  • MIST — https://github.com/pierreganty/mist

Examples from the literature

  • BFC — http://www.cprover.org/bfc/

Examples from verification of concurrent C programs

  • Provenance verification for message-passing

programs [MMW ’13]

Examples modeling a medical system and a bug-tracking system

  • SOTER — http://mjolnir.cs.ox.ac.uk/soter/ [DKO ’13]

Examples from verification of Erlang programs Contains a Petri net with 66,950 places and 213,625 transitions

slide-40
SLIDE 40

Main point here: LinCon works well even without traps

slide-41
SLIDE 41

LinCon without traps is fast

BFC (time in sec)

0,01 0,1 1 10 100 1000 10000 100000

LinCon (time in sec)

0,01 0,1 1 10 100 1000 10000 100000

slide-42
SLIDE 42

LinCon without traps is fast

BFC (time in sec)

0,01 0,1 1 10 100 1000 10000 100000

LinCon (time in sec)

0,01 0,1 1 10 100 1000 10000 100000

30 min

slide-43
SLIDE 43

LinCon without traps is fast

BFC (time in sec)

0,01 0,1 1 10 100 1000 10000 100000

LinCon (time in sec)

0,01 0,1 1 10 100 1000 10000 100000

30 min 25 s

slide-44
SLIDE 44

LinCon without traps is fast

BFC (time in sec)

0,01 0,1 1 10 100 1000 10000 100000

LinCon (time in sec)

0,01 0,1 1 10 100 1000 10000 100000

30 min 25 s 2 h

slide-45
SLIDE 45

LinCon is “quite complete”

Examples proved safe

23 46 69 92 115 MIST BFC IIC Together LinCon

96 64 51 61 33

slide-46
SLIDE 46

Examples proved safe

23 46 69 92 115 MIST BFC IIC Together LinCon

96 64 51 61 33

Examples proved safe

23 46 69 92 115 MIST BFC IIC Together LinCon

84 64 51 61 33

LinCon without traps is “quite complete”

slide-47
SLIDE 47

If LinCon were combined with other tools

Examples proved safe

23 46 69 92 115 BFC BFC+LinCon Together Together+LinCon

107 105 64 61

slide-48
SLIDE 48

Summary

  • We’ve revisited a linear constraint approach to

Petri net coverability

  • LinCon is incomplete, but useful

… on its own … as a cheap preprocessing step in other tools