SLIDE 1
Uppsala University, Sweden
Paul Gastin
LSV, ENS Cachan, France
Chennai Mathematical Institute, India Joint work with ACTS! 09/02/2015, Chennai
COMMUNICATING RECURSIVE PROGRAMS: CONTROL AND SPLIT
INFORMEL
Indo-French Formal Methods Lab
SLIDE 2 VERIFICATION
Model Checking S ⊨ φ? ✗ ✓ System S! Specification φ Refine S ! (Fix bugs)
SLIDE 3 Model Checking S ⊨ φ? ✗ ✓ System S! Specification φ Refine S ! (Fix bugs) Undecidable in many cases
VERIFICATION
SLIDE 4
UNDER-APPROXIMATE VERIFICATION
SLIDE 5
UNDER-APPROXIMATE VERIFICATION
SLIDE 6 UNDER-APPROXIMATE VERIFICATION
Parametrised
SLIDE 7 UNDER-APPROXIMATE VERIFICATION
Parametrised
SLIDE 8 UNDER-APPROXIMATE VERIFICATION
Parametrised
SLIDE 9 UNDER-APPROXIMATE VERIFICATION
… Parametrised
SLIDE 10 UNDER-APPROXIMATE VERIFICATION
… Parametrised Exhaustive
SLIDE 11 UNDER-APPROXIMATE VERIFICATION
… Parametrised Exhaustive
SLIDE 12 UNDER-APPROXIMATE VERIFICATION
Model Checking S ⊨ φ? ✗ ✓ System S! Specification φ Refine S ! (Fix bugs)
k
Decidable
SLIDE 13 UNDER-APPROXIMATE VERIFICATION
Model Checking S ⊨ φ? ✗ ✓ System S! Specification φ Refine S ! (Fix bugs)
k
Decidable
SLIDE 14 UNDER-APPROXIMATE VERIFICATION
Model Checking S ⊨ φ? ✗ ✓ System S! Specification φ Refine S ! (Fix bugs)
k
Decidable
SLIDE 15 UNDER-APPROXIMATE VERIFICATION
Model Checking S ⊨ φ? ✗ ✓ System S! Specification φ Refine S ! (Fix bugs)
k
Decidable
SLIDE 16 UNDER-APPROXIMATE VERIFICATION
Model Checking S ⊨ φ? ✗ ✓ System S! Specification φ Refine S ! (Fix bugs)
k
Decidable
SLIDE 17 COMMUNICATING RECURSIVE PROGRAMS: CONTROL AND SPLIT
SLIDE 18 COMMUNICATING DISTRIBUTED SYSTEMS
Process 1 Process 2 Process 3 Process 4 Network
SLIDE 19 BEHAVIOURS :! MESSAGE SEQUENCE CHARTS
time Proc 1 Proc 2 Proc 3
SLIDE 20 Emptiness or Reachability! Inclusion or Universality! Satisfiability φ! Model Checking: S ⊨ φ! Temporal logics! Propositional dynamic logics! Monadic second order logic
VERIFICATION PROBLEMS
SLIDE 21 COMMUNICATING RECURSIVE PROGRAMS:
- Turing powerful: verification undecidable!
- Under-upproximations!
- Decidable!
- Controllable
SLIDE 22
- Turing powerful: verification undecidable!
- Under-upproximations!
- Decidable!
- Controllable
COMMUNICATING RECURSIVE PROGRAMS: CONTROL AND SPLIT
SLIDE 23
CONTROLLERS FOR VERIFICATION OF COMMUNICATING SYSTEMS
SLIDE 24 Process 2 Process 3 Network Process 1
From To
COMMUNICATING DISTRIBUTED SYSTEMS
SLIDE 25 CONTROLLERS FOR DISTRIBUTED SYSTEMS
Process 2 Process 3 Network Process 1
From To
Controller 1 Controller 2 Controller 3
SLIDE 26 Process 2 Process 3 Network Process 1
From To
Controller 1 Controller 2 Controller 3
From To
Heavy Fragile
CONTROLLERS FOR DISTRIBUTED SYSTEMS
SLIDE 27 Process 2 Process 3 Process 1 Controller 1 Controller 2 Controller 3 Network
SLIDE 28 Process 2 Process 3 Process 1 Controller 1 Controller 2 Controller 3 Network
SLIDE 29 CONTROLLERS FOR DISTRIBUTED SYSTEMS
Collection of local controllers! Communication via piggy-backing! Privacy: Do NOT read states/messages
SLIDE 30 UNDER-APPROXIMATION: BOUNDED (K) PHASE
LET’S DESIGN A CONTROLLER
SLIDE 31 time Proc 1 Proc 2 Proc 3 Receive from one process, send to all processes PHASE
SLIDE 32 time Proc 1 Proc 2 Proc 3 Receive from one process, send to all processes PHASE
SLIDE 33 time Proc 1 Proc 2 Proc 3 Receive from one process, send to all processes PHASE
SLIDE 34 time Proc 1 Proc 2 Proc 3 Receive from one process, send to all processes PHASE
SLIDE 35 time Proc 1 Proc 2 Proc 3 Receive from one process, send to all processes PHASE
SLIDE 36 time Proc 1 Proc 2 Proc 3 Receive from one process, send to all processes PHASE
SLIDE 37 time Proc 1 Proc 2 Proc 3 Receive from one process, send to all processes PHASE
SLIDE 38 time Proc 1 Proc 2 Proc 3 Receive from one process, send to all processes PHASE
- 1. At most k phases on each process!
- 2. No cycles
k-BOUNDED PHASE
SLIDE 39 time Proc 1 Proc 2 Proc 3 Receive from one process, send to all processes PHASE
- 1. At most k phases on each process!
- 2. No cycles
k-BOUNDED PHASE
SLIDE 40 time Proc 1 Proc 2 Proc 3 Receive from one process, send to all processes PHASE
- 1. At most k phases on each process!
- 2. No cycles
k-BOUNDED PHASE
SLIDE 41 time Proc 1 Proc 2 Proc 3 Receive from one process, send to all processes PHASE
- 1. At most k phases on each process!
- 2. No cycles
k-BOUNDED PHASE
SLIDE 42 DISTRIBUTED CONTROLLER FOR K-BOUNDED PHASE U-A
A local controller for each process Has a Phase Counter Remembers current sender Different sender? Detect Cycle? Increment counter, Update sender State Transitions
SLIDE 43 Detect Cycle? Phase Vectors best info about phase number of other processes Sends: tag with phase vector Receives: update phase vector by taking MAX
DISTRIBUTED CONTROLLER FOR K-BOUNDED PHASE U-A
SLIDE 44 CONTROLLERS FOR BOUNDED PHASE DISTRIBUTED SYSTEMS
Collection of local controllers! Communication via piggy-backing! Privacy: Do NOT read states/messages System independent! Generic! Deterministic! Finite state
SLIDE 45
DECIDABILITY OF K BOUNDED PHASE
SLIDE 46 Polynomial SPLIT-WIDTH PSPACE PDL Temporal Logics Reachability Decidable MSO
SLIDE 47 Polynomial SPLIT-WIDTH Refine phases to tree-like bound split-width
SLIDE 48 ACYCLIC PHASE DECOMPOSITION
time Proc2 Proc1 Proc3
SLIDE 49
INDUCED GRAPH ON PHASE
SLIDE 50
INDUCED GRAPH ON PHASE
SLIDE 51 PHASE DECOMPOSITION
time Proc2 Proc1 Proc3
SLIDE 52 PHASE DECOMPOSITION
time Proc2 Proc1 Proc3 Tree-like
SLIDE 53 Polynomial SPLIT-WIDTH
SLIDE 54
Split-width
a a b c d b a c d c
SLIDE 55 Split-width
a a b c d b a c d c
BUDGET
SLIDE 56
b c d a a a b c d c a a b c d b a c d c
SLIDE 57
b c d a a a b c d c
SLIDE 58
b c d a a a b c d c
SLIDE 59
b c d a a a b c d c
SLIDE 60
b c d a
SLIDE 61
b c d a b d c a
SLIDE 62
b d c a
SLIDE 63
b d c a
SLIDE 64
b c d a a a b c d c
SLIDE 65
a a b c d c
SLIDE 66
a b c d a c a a b c d c
SLIDE 67
a b c d a c
SLIDE 68
a b c d a c
SLIDE 69
a b c d a c
SLIDE 70
a b c d
SLIDE 71
b d a c a b c d
SLIDE 72
b d a c
SLIDE 73
b d a c
SLIDE 74 M p q a a b c d b a c d c M′ p q a a b c d b a c d c M1 p q a a b c d c M′
1
p q a a b c d c M3 a b c d M′
3
a b c d a c b d a c M2 b c d a M′
2
b c d a c a b d
(n) split-! (m, mm) div-Û Û
SPLIT TREE ! OF THE FULL DECOMPOSITION
Split-width
SLIDE 75 M p q a a b c d b a c d c M′ p q a a b c d b a c d c M1 p q a a b c d c M′
1
p q a a b c d c M3 a b c d M′
3
a b c d a c b d a c M2 b c d a M′
2
b c d a c a b d
(n) split-! (m, mm) div-Û Û
TREE INTERPRETATION
SLIDE 76 M p q a a b c d b a c d c M′ p q a a b c d b a c d c M1 p q a a b c d c M′
1
p q a a b c d c M3 a b c d M′
3
a b c d a c b d a c M2 b c d a M′
2
b c d a c a b d
(n) split-! (m, mm) div-Û Û
TREE INTERPRETATION
SLIDE 77 b d b d a c a c a c
M p q a a b c d b a c d c M′ p q a a b c d b a c d c M1 p q a a b c d c M′
1
p q a a b c d c M3 a b c d M′
3
a b c d a c b d a c M2 b c d a M′
2
b c d a c a b d
(n) split-! (m, mm) div-Û Û
TREE INTERPRETATION
SLIDE 78 b d b d a c a c a c
M p q a a b c d b a c d c M′ p q a a b c d b a c d c M1 p q a a b c d c M′
1
p q a a b c d c M3 a b c d M′
3
a b c d a c b d a c M2 b c d a M′
2
b c d a c a b d
(n) split-! (m, mm) div-Û Û
TREE INTERPRETATION
SLIDE 79 b d b d a c a c a c
M p q a a b c d b a c d c M′ p q a a b c d b a c d c M1 p q a a b c d c M′
1
p q a a b c d c M3 a b c d M′
3
a b c d a c b d a c M2 b c d a M′
2
b c d a c a b d
(n) split-! (m, mm) div-Û Û
Vertices TREE INTERPRETATION
SLIDE 80 b d b d a c a c a c
M p q a a b c d b a c d c M′ p q a a b c d b a c d c M1 p q a a b c d c M′
1
p q a a b c d c M3 a b c d M′
3
a b c d a c b d a c M2 b c d a M′
2
b c d a c a b d
(n) split-! (m, mm) div-Û Û
Vertices TREE INTERPRETATION
SLIDE 81 b d b d a c a c a c
M p q a a b c d b a c d c M′ p q a a b c d b a c d c M1 p q a a b c d c M′
1
p q a a b c d c M3 a b c d M′
3
a b c d a c b d a c M2 b c d a M′
2
b c d a c a b d
(n) split-! (m, mm) div-Û Û
Vertices TREE INTERPRETATION
SLIDE 82 b d b d a c a c a c
M p q a a b c d b a c d c M′ p q a a b c d b a c d c M1 p q a a b c d c M′
1
p q a a b c d c M3 a b c d M′
3
a b c d a c b d a c M2 b c d a M′
2
b c d a c a b d
(n) split-! (m, mm) div-Û Û
Vertices TREE INTERPRETATION
SLIDE 83 b d b d a c a c a c
M p q a a b c d b a c d c M′ p q a a b c d b a c d c M1 p q a a b c d c M′
1
p q a a b c d c M3 a b c d M′
3
a b c d a c b d a c M2 b c d a M′
2
b c d a c a b d
(n) split-! (m, mm) div-Û Û
Vertices TREE INTERPRETATION
SLIDE 84 b d b d a c a c a c
M p q a a b c d b a c d c M′ p q a a b c d b a c d c M1 p q a a b c d c M′
1
p q a a b c d c M3 a b c d M′
3
a b c d a c b d a c M2 b c d a M′
2
b c d a c a b d
(n) split-! (m, mm) div-Û Û
TREE INTERPRETATION
SLIDE 85 b d b d a c a c a c
M p q a a b c d b a c d c M′ p q a a b c d b a c d c M1 p q a a b c d c M′
1
p q a a b c d c M3 a b c d M′
3
a b c d a c b d a c M2 b c d a M′
2
b c d a c a b d
(n) split-! (m, mm) div-Û Û
Data edges TREE INTERPRETATION
SLIDE 86 b d b d a c a c a c
M p q a a b c d b a c d c M′ p q a a b c d b a c d c M1 p q a a b c d c M′
1
p q a a b c d c M3 a b c d M′
3
a b c d a c b d a c M2 b c d a M′
2
b c d a c a b d
(n) split-! (m, mm) div-Û Û
Data edges TREE INTERPRETATION
SLIDE 87 b d b d a c a c a c
M p q a a b c d b a c d c M′ p q a a b c d b a c d c M1 p q a a b c d c M′
1
p q a a b c d c M3 a b c d M′
3
a b c d a c b d a c M2 b c d a M′
2
b c d a c a b d
(n) split-! (m, mm) div-Û Û
1
Data edges TREE INTERPRETATION
SLIDE 88 b d b d a c a c a c
M p q a a b c d b a c d c M′ p q a a b c d b a c d c M1 p q a a b c d c M′
1
p q a a b c d c M3 a b c d M′
3
a b c d a c b d a c M2 b c d a M′
2
b c d a c a b d
(n) split-! (m, mm) div-Û Û
TREE INTERPRETATION
SLIDE 89 b d b d a c a c a c
M p q a a b c d b a c d c M′ p q a a b c d b a c d c M1 p q a a b c d c M′
1
p q a a b c d c M3 a b c d M′
3
a b c d a c b d a c M2 b c d a M′
2
b c d a c a b d
(n) split-! (m, mm) div-Û Û
Process edges TREE INTERPRETATION
SLIDE 90 b d b d a c a c a c
M p q a a b c d b a c d c M′ p q a a b c d b a c d c M1 p q a a b c d c M′
1
p q a a b c d c M3 a b c d M′
3
a b c d a c b d a c M2 b c d a M′
2
b c d a c a b d
(n) split-! (m, mm) div-Û Û
Process edges TREE INTERPRETATION
SLIDE 91 b d b d a c a c a c
M p q a a b c d b a c d c M′ p q a a b c d b a c d c M1 p q a a b c d c M′
1
p q a a b c d c M3 a b c d M′
3
a b c d a c b d a c M2 b c d a M′
2
b c d a c a b d
(n) split-! (m, mm) div-Û Û
Process edges TREE INTERPRETATION
SLIDE 92 b d b d a c a c a c
M p q a a b c d b a c d c M′ p q a a b c d b a c d c M1 p q a a b c d c M′
1
p q a a b c d c M3 a b c d M′
3
a b c d a c b d a c M2 b c d a M′
2
b c d a c a b d
(n) split-! (m, mm) div-Û Û
Process edges TREE INTERPRETATION
SLIDE 93 b d b d a c a c a c
M p q a a b c d b a c d c M′ p q a a b c d b a c d c M1 p q a a b c d c M′
1
p q a a b c d c M3 a b c d M′
3
a b c d a c b d a c M2 b c d a M′
2
b c d a c a b d
(n) split-! (m, mm) div-Û Û
Process edges TREE INTERPRETATION
SLIDE 94 b d b d a c a c a c
M p q a a b c d b a c d c M′ p q a a b c d b a c d c M1 p q a a b c d c M′
1
p q a a b c d c M3 a b c d M′
3
a b c d a c b d a c M2 b c d a M′
2
b c d a c a b d
(n) split-! (m, mm) div-Û Û
Process edges TREE INTERPRETATION
SLIDE 95 b d b d a c a c a c
M p q a a b c d b a c d c M′ p q a a b c d b a c d c M1 p q a a b c d c M′
1
p q a a b c d c M3 a b c d M′
3
a b c d a c b d a c M2 b c d a M′
2
b c d a c a b d
(n) split-! (m, mm) div-Û Û
Process edges TREE INTERPRETATION
SLIDE 96 Split-width
Problem Complexity bound on split-width part of the input (in unary) bound on split-width fixed CPDS emptiness ExpTime-Complete PTime-Complete CPDS inclusion or universality 2ExpTime ExpTime-Complete LTL / CPDL satisfiability or model checking ExpTime-Complete ICPDL satisfiability or model checking 2ExpTime -Complete MSO satisfiability or model checking Non-elementary Table 2 Summary of the complexities for bounded split-width verification.
SLIDE 97 SPLIT-WIDTH
Proc2 Proc1 Proc3
SLIDE 98 SPLIT-WIDTH
Proc2 Proc1 Proc3
SLIDE 99 SPLIT-WIDTH 3
Proc2 Proc1 Proc3
SLIDE 100 SPLIT-WIDTH 3
Proc2 Proc1 Proc3
SLIDE 101 SPLIT-WIDTH 3
Proc2 Proc1 Proc3
SLIDE 102 SPLIT-WIDTH 3
Proc2 Proc1 Proc3
SLIDE 103 SPLIT-WIDTH 3
Proc2 Proc1 Proc3
SLIDE 104 SPLIT-WIDTH 3
Proc2 Proc1 Proc3
SLIDE 105 SPLIT-WIDTH 3
Proc2 Proc1 Proc3
SLIDE 106 SPLIT-WIDTH 3
Proc2 Proc1 Proc3
SLIDE 107 SPLIT-WIDTH 3
Proc2 Proc1 Proc3
SLIDE 108 SPLIT-WIDTH 3
Proc2 Proc1 Proc3
SLIDE 109 SPLIT-WIDTH 3
Proc2 Proc1 Proc3
SLIDE 110 SPLIT-WIDTH 3
Proc2 Proc1 Proc3
SLIDE 111 Polynomial SPLIT-WIDTH PSPACE PDL Temporal Logics Reachability Decidable MSO
SLIDE 112 UNDER-APPROXIMATE VERIFICATION
Model Checking S ⊨ φ? ✗ ✓ System S! Specification φ Refine S ! (Fix bugs)
k
Decidable
SLIDE 113 OTHER UNDER-APPROXIMATIONS
Bounded channel size! Existentially bounded [Genest et al.]! Acyclic Architectures [La Torre et al., Heußner et al. Clemente et al.]! Bounded context switching [Qadeer, Rehof], [LaTorre et al.], …! Bounded phase [LaTorre et al.]! Bounded scope [LaTorre et al.]! Priority ordering [Atig et al., Saivasan et al.]
SLIDE 114 OTHER UNDER-APPROXIMATIONS
Bounded channel size! Existentially bounded [Genest et al.]! Acyclic Architectures [La Torre et al., Heußner et al. Clemente et al.]! Bounded context switching [Qadeer, Rehof], [LaTorre et al.], …! Bounded phase [LaTorre et al.]! Bounded scope [LaTorre et al.]! Priority ordering [Atig et al., Saivasan et al.]
Tree-width
SLIDE 115 OTHER UNDER-APPROXIMATIONS
Bounded channel size! Existentially bounded [Genest et al.]! Acyclic Architectures [La Torre et al., Heußner et al. Clemente et al.]! Bounded context switching [Qadeer, Rehof], [LaTorre et al.], …! Bounded phase [LaTorre et al.]! Bounded scope [LaTorre et al.]! Priority ordering [Atig et al., Saivasan et al.]
Tree-width
Many of the above classes have bounded tree-width [Parlato, Madhusudhan]
SLIDE 116 Split-width
!
Acyclic Architectures Bounded channel size Existentially bounded Bounded context switching Bounded scope Bounded phase Priority ordering Bounded Tree-width Constant Bound + 2 2Bound Linear
OTHER UNDER-APPROXIMATIONS
SLIDE 117 Width: split vs tree vs clique
Let C be a class of bounded degree MSO definable graphs.! TFAE!
- 1. C has a decidable MSO theory!
- 2. C can be interpreted in binary trees!
- 3. C has bounded tree-width!
- 4. C has bounded clique-width!
- 5. C has bounded split-width (for concurrent recursive behaviors)
Split-Width k T ree-Width t Clique-Width c
SLIDE 118 Width: split vs tree vs clique
Split-Width k T ree-Width t Clique-Width c
t ≤ 2(k + |Procs|) - 1 c ≤ 2(k + |Procs|) + 1
Let C be a class of bounded degree MSO definable graphs.! TFAE!
- 1. C has a decidable MSO theory!
- 2. C can be interpreted in binary trees!
- 3. C has bounded tree-width!
- 4. C has bounded clique-width!
- 5. C has bounded split-width (for concurrent recursive behaviors)
SLIDE 119 Split-Width k T ree-Width t Clique-Width c
k ≤ 120(t + 1) k ≤ 2c - 3
Width: split vs tree vs clique
Let C be a class of bounded degree MSO definable graphs.! TFAE!
- 1. C has a decidable MSO theory!
- 2. C can be interpreted in binary trees!
- 3. C has bounded tree-width!
- 4. C has bounded clique-width!
- 5. C has bounded split-width (for concurrent recursive behaviors)
SLIDE 120 COMMUNICATING RECURSIVE PROGRAMS: CONTROL AND SPLIT
SLIDE 121 AUTONOMOUS COMPUTATIONS
- Recursive computations which does not read from
- ther stacks/queues.!
- A stretch of computation in which all incoming
edges are on a single stack
SLIDE 122 AUTONOMOUS COMPUTATIONS
- Recursive computations which does not read from
- ther stacks/queues.!
- A stretch of computation in which all incoming
edges are on a single stack
SLIDE 123
PHASE
SLIDE 124 PHASE
- A stretch of computation which reads from at
most one stack/queue
SLIDE 125 PHASE
- A stretch of computation which reads from at
most one stack/queue
- free (unlimited) autonomous computations
SLIDE 126 PHASE
- A stretch of computation which reads from at
most one stack/queue
- free (unlimited) autonomous computations
- no loops
SLIDE 127
K-BOUNDED PHASE
SLIDE 128 K-BOUNDED PHASE
Phase 1 Phase 2
Phase 3
SLIDE 129 IDENTIFYING AUTONOMOUS POPS
- Possible by tagging the values on stacks!
- Deterministic controller for each stack !
- The phase controller simulates one such
automaton for each stack.
1 s?0 s?1 ¯ s? else s?0 s!0 else s!1 s?1 ¯ s?
SLIDE 130
- C. A., Paul Gastin, and K. Narayan Kumar. Controllers for the verification
- f communicating multi-pushdown systems. In CONCUR 2014.
- A. C. Verification of Communicating Recursive Programs via Split-width.
PhD thesis, ENS Cachan, 2014.
- C. A., Paul Gastin, and K. Narayan Kumar. Verifying communicating multi
pushdown systems via Split-width. In ATVA 2014.
- A. C., Paul Gastin, and K. Narayan Kumar. MSO decidability of multi-
pushdown systems via Split-width. In CONCUR 2012.
COMMUNICATING RECURSIVE PROGRAMS: CONTROL AND SPLIT
SLIDE 131