[PPT] - Multi-core model checking for biological applications Jaco van de PowerPoint Presentation

SLIDE 1

Multi-core model checking for biological applications UNIVERSITY OF TWENTE.

Formal Methods & Tools. Jaco van de Pol 22 November 2013

NWPT’13, Tallinn

SLIDE 2

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

High-performance Model Checking for the Masses

Goals

◮ Investigate high-performance model checking algorithms ◮ Application to complex man-made and natural systems ◮ Need access to/from multiple modeling languages

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 2 / 56

SLIDE 3

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

High-performance Model Checking for the Masses

Goals

◮ Investigate high-performance model checking algorithms ◮ Application to complex man-made and natural systems ◮ Need access to/from multiple modeling languages

Languages Symbolic Distributed Multi−core Tools Reachability mCRL2 Promela DVE UPPAAL Specification

PINS

Requirements on tool and interface (LTSmin / PINS)

◮ Generality: support LTS with arbitrary state/edge labels ◮ On-the-fly API: next-state function to pull implicit graph ◮ Efficiency: models expose locality in a dependency matrix

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 2 / 56

SLIDE 4

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

High-performance Model Checking for the Masses

Goals

◮ Investigate high-performance model checking algorithms ◮ Application to complex man-made and natural systems ◮ Need access to/from multiple modeling languages

Languages Symbolic Distributed Multi−core Tools Reachability mCRL2 Promela DVE UPPAAL Specification

PINS

x y z t1 r w – t2 – r w t3 w – rw

Requirements on tool and interface (LTSmin / PINS)

◮ Generality: support LTS with arbitrary state/edge labels ◮ On-the-fly API: next-state function to pull implicit graph ◮ Efficiency: models expose locality in a dependency matrix

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 2 / 56

SLIDE 5

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

LTSmin architecture and PINS interface

Blom, van de Pol, Weber [CAV’10], Laarman, van de Pol, Weber [NFM’11] http://fmt.cs.utwente.nl/tools/ltsmin/ Pins2pins mCRL2 Promela DVE UPPAAL Symbolic Specification

PINS PINS

Distributed Multi−core Languages Tools Reachability reduction Partial−order Variable reordering Transition grouping caching Transition Wrappers

And also: LLVM, parity games, Markov Automata, C-code Indirectly: GSPN, xUML, Signalling Networks in Biology

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 3 / 56

SLIDE 6

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

LTSmin architecture and PINS interface

Blom, van de Pol, Weber [CAV’10], Laarman, van de Pol, Weber [NFM’11] http://fmt.cs.utwente.nl/tools/ltsmin/ Pins2pins mCRL2 Promela DVE UPPAAL Symbolic Specification

PINS PINS

Distributed Multi−core Languages Tools Reachability reduction Partial−order Variable reordering Transition grouping caching Transition Wrappers

And also: LLVM, parity games, Markov Automata, C-code Indirectly: GSPN, xUML, Signalling Networks in Biology

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 3 / 56

LTSmin won the RERS challenge in 2012 (Crete) and 2013 (Palo Alto)

SLIDE 7

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

LTSmin architecture and PINS interface

Blom, van de Pol, Weber [CAV’10], Laarman, van de Pol, Weber [NFM’11] http://fmt.cs.utwente.nl/tools/ltsmin/

reduction / lumping mCRL2 Promela DVE UPPAAL Symbolic Specification

PINS PINS

Distributed Multi−core Languages Tools Reachability reduction Partial−order Variable reordering Transition grouping caching Transition Wrappers Pins2pins Analysis Algorithms LTL Bisimulation mu−calculus

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 3 / 56

SLIDE 8

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Signaling Pathways with Timed Automata

Stefano Schivo, Langerak, van de Pol etal. [BIBE’12] [GENE’13] [J-BHI’14]

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 4 / 56

SLIDE 9

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Which architecture suits Multi-core Model Checking?

Worker 1 Worker 2 Worker 3 Worker 4

Queue Queue Queue Queue

store store store store

Static partitioning

◮ Distributed memory solution ◮ Communication: W 2 queues ◮ (Relaxed) BFS only

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 7 / 56

SLIDE 12

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Which architecture suits Multi-core Model Checking?

Worker 1 Worker 2 Worker 3 Worker 4

Queue Queue Queue Queue

store store store store

Static partitioning

◮ Distributed memory solution ◮ Communication: W 2 queues ◮ (Relaxed) BFS only

Load balancer Store Worker 1 Worker 2 Worker 4 Worker 3

Queue Queue Queue Queue

Shared hash table

◮ (Pseudo) DFS & BFS ◮ Communication: shared hash table ◮ Load balancing

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 7 / 56

SLIDE 13

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Lockless Hash Table: Design

Alfons Laarman, van de Pol, Weber [fmcad10]

Main bottlenecks for scalable implementation

◮ State storage: requires concurrent access

(lock contention)

◮ Graph traversal: random memory access

(bandwidth)

◮ Computer architecture: shared L2 caches

(false sharing)

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 8 / 56

SLIDE 14

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Lockless Hash Table: Design

Alfons Laarman, van de Pol, Weber [fmcad10]

Main bottlenecks for scalable implementation

◮ State storage: requires concurrent access

(lock contention)

◮ Graph traversal: random memory access

(bandwidth)

◮ Computer architecture: shared L2 caches

(false sharing) Design: keep it simple

◮ Hash memoization: read less data ◮ On collision: Walking the Line ◮ In-situ locking (1 bit per bucket) ◮ Bucket operations require CAS ◮ Not strictly wait-free |state| data bucket |cache line|

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 8 / 56

SLIDE 15

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Scalability Experiments from 2010 (BEEM database)

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 9 / 56

SPIN 5.2.4 (NASA/JPL) DiVinE 2.2 (Brno,CZ)

SLIDE 16

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Scalability Experiments from 2010 (BEEM database)

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 9 / 56

SPIN 5.2.4 (NASA/JPL) DiVinE 2.2 (Brno,CZ) LTSmin (U Twente, NL)

SLIDE 17

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Recursive indexing (Tree Compression)

Blom, Lisser, van de Pol, Weber [PDMC’07, JLC’09]

1 8 1 1 1 1 1 6 8 5 6 6 8 5 8 4 3 3 4 3 4 3 3 4 3 5 4 5 5 4 5 4 5 5 4 4 4 4 4 4 4 4 4 4 4 5 5 5 6 6 6 3 3 3 3 3 5 6 1 2 3 3 5 5 4 1 3 3 5 6 2 1 2 1 2 5 2 4 1 1 3 1 1 2 1 2 2 1

HK (K − 1) × H2

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 11 / 56

SLIDE 19

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Recursive indexing (Tree Compression)

Blom, Lisser, van de Pol, Weber [PDMC’07, JLC’09]

1 8 1 1 1 1 1 6 8 5 6 6 8 5 8 4 3 3 4 3 4 3 3 4 3 5 4 5 5 4 5 4 5 5 4 4 4 4 4 4 4 4 4 4 4 5 5 5 6 6 6 3 3 3 3 3 5 6 1 2 3 3 5 5 4 1 3 3 5 6 2 1 2 1 2 5 2 4 1 1 3 1 1 2 1 2 2 1

HK (K − 1) × H2

Analysis

◮ Locality =

⇒ balanced tree (N + 2

√ N + 4 4

(N) · · · ≈ N)

Compresses states of lenght K to almost 2 (!)

◮ Hard to parallelize:

◮ Sequential operation on tree of tables ◮ Many small (variable size) hash tables UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 11 / 56

SLIDE 20

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Parallel Tree Compression

Laarman, van de Pol, Weber [spin11], Laarman, van der Vegt [memics’11]

Solution

◮ Reuse lockless hash table: merge tree of tables into one

3, 5, 5, 4, 1, 3

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 12 / 56

SLIDE 21

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Parallel Tree Compression

Laarman, van de Pol, Weber [spin11], Laarman, van der Vegt [memics’11]

Solution

◮ Reuse lockless hash table: merge tree of tables into one

3, 5, 5, 4, 1, 3 5 3 3 5 4 1 3, 5, 5 4, 1, 3 3, 5 4, 1

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 12 / 56

SLIDE 22

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Parallel Tree Compression

Laarman, van de Pol, Weber [spin11], Laarman, van der Vegt [memics’11]

Solution

◮ Reuse lockless hash table: merge tree of tables into one

4 1 3 5 3, 5, 5, 4, 1, 3 5 3 3 5 4 1 3, 5, 5 4, 1, 3 3, 5 4, 1

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 12 / 56

SLIDE 23

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Parallel Tree Compression

Laarman, van de Pol, Weber [spin11], Laarman, van der Vegt [memics’11]

Solution

◮ Reuse lockless hash table: merge tree of tables into one

4 1 6 5 1 3 3 5 3, 5, 5, 4, 1, 3 6 5 1 3 3 5 4 1 3, 5, 5 4, 1, 3 3, 5 4, 1

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 12 / 56

SLIDE 24

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Parallel Tree Compression

Laarman, van de Pol, Weber [spin11], Laarman, van der Vegt [memics’11]

Solution

◮ Reuse lockless hash table: merge tree of tables into one

4 1 6 5 1 3 3 5 2 5 3, 5, 5, 4, 1, 3 2 5 6 5 1 3 3 5 4 1 3, 5, 5 4, 1, 3 3, 5 4, 1

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 12 / 56

SLIDE 25

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Parallel Tree Compression

Laarman, van de Pol, Weber [spin11], Laarman, van der Vegt [memics’11]

Solution

◮ Reuse lockless hash table: merge tree of tables into one ◮ Incremental updates: use the Dependency Matrix

◮ (K − 1) → log2(K − 1) lookups

4 1 6 5 1 3 3 5 2 5 3, 5, 5, 4, 1, 3 3, 5, 9, 4, 1, 3 2 5 6 5 1 3 3 5 4 1 ? 5 6 9

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 12 / 56

SLIDE 26

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Parallel Tree Compression

Laarman, van de Pol, Weber [spin11], Laarman, van der Vegt [memics’11]

Solution

◮ Reuse lockless hash table: merge tree of tables into one ◮ Incremental updates: use the Dependency Matrix

◮ (K − 1) → log2(K − 1) lookups

◮ Further improvements:

◮ Zobrist incremental hashing (’69), Cleary hash compaction (’84)

4 1 6 5 1 3 3 5 2 5 3, 5, 5, 4, 1, 3 3, 5, 9, 4, 1, 3 2 5 6 5 1 3 3 5 4 1 ? 5 6 9

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 12 / 56

SLIDE 27

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Compression Experiments from 2011 [BEEM database]

Laarman, van de Pol, Weber [spin11]

◮ Tree compression is a recursive

variant of SPIN’s Collapse (’97)

◮ Exploit combinatorial structure:

◮ State vectors are highly similar ◮ Impressive compression ratios

◮ Extreme case: firewire tree

Uncompressed: 14 GB Tree Compression: 96 MB

◮ Compression comes for free

◮ Arithmetic intensity increases ◮ Less memory-bus traffic

!" #" $!" $#" %!" %#" !" #!" $!!" $#!" %!!" %#!" &!!" !"#$%&''(")*+,!-"%*./012** '-,-&*3&)4-5*.67-&2** '())"*+,-()../+0" 12.3"'245)" 6-7,25"8())"*+,-()../+0" 96::;<=>"+-7,25" 96::;<=>"*+,-()../+0"

1000 2000 3000 4000 5000 6000 1 2 4 6 8 10 12 14 16 time (sec) #cores LTSmin-mc Table LTSmin-mc Tree DiVinE 2.2 SPIN SPIN Collapse

ptimal (linear speedup)

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 13 / 56

SLIDE 28

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Symbolic Model Checking based on BDDs

Bryant [IEEE Trans. Comp.’86], Burch,Clarke, McMillan [LICS’90]

BDD data structures

◮ Unique Table (to store BDD nodes) ◮ Computed Cache (apply operations)

X Y Z 1

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 15 / 56

SLIDE 30

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Symbolic Model Checking based on BDDs

Bryant [IEEE Trans. Comp.’86], Burch,Clarke, McMillan [LICS’90]

BDD data structures

◮ Unique Table (to store BDD nodes) ◮ Computed Cache (apply operations)

Symbolic Reachability (chaining strategy) Require: I: initial state, R1, . . . , RN: subtransitions Ensure: Vnew: set of reachable states from I by Ri

1: Vold := 0 ; Vnew := I 2: while Vold = Vnew do 3:

Vold:=Vnew

4:

for i = 1 to N do

5:

Vnew := Vnew Or RelProd(Vnew, Ri) X Y Z 1

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 15 / 56

SLIDE 31

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Multi-core Binary Decision Diagrams

Tom van Dijk, Alfons Laarman, van de Pol [pdmc’12]

Multi-core BDDs

◮ Use shared hashtable for Unique Table, Operations Cache ◮ Parallelize computation tree of recursive operations (Apply)

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 16 / 56

SLIDE 32

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Multi-core Binary Decision Diagrams

Tom van Dijk, Alfons Laarman, van de Pol [pdmc’12]

Multi-core BDDs

◮ Use shared hashtable for Unique Table, Operations Cache ◮ Parallelize computation tree of recursive operations (Apply)

Complications for Parallelism

◮ BDD nodes can be removed ◮ Irregular task graph ◮ Fine-grained parallelism

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 16 / 56

SLIDE 33

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Multi-core Binary Decision Diagrams

Tom van Dijk, Alfons Laarman, van de Pol [pdmc’12]

Multi-core BDDs

◮ Use shared hashtable for Unique Table, Operations Cache ◮ Parallelize computation tree of recursive operations (Apply)

Complications for Parallelism

◮ BDD nodes can be removed ◮ Irregular task graph ◮ Fine-grained parallelism

Solutions

◮ Tombstones, garbage collect ◮ Work-stealing ◮ Use split deque

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 16 / 56

SLIDE 34

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Parallelizing the BDD Operations

Parallel BDD operations

◮ Organize recursive calls to RelProd and

Or in a task dependency graph

◮ Same task might be created several times:

store result in the shared Computed Table

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 17 / 56

SLIDE 35

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Parallelizing the BDD Operations

Parallel BDD operations

◮ Organize recursive calls to RelProd and

Or in a task dependency graph

◮ Same task might be created several times:

store result in the shared Computed Table

◮ Fine-grained task-parallelism:

◮ Parent spawns children for subtasks,

and waits upon their completion

◮ Load balancing by work-stealing; use e.g.

Cilk [Blumofe ’95] or Wool [Fax´ en ’08]

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 17 / 56

SLIDE 36

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Parallelizing the BDD Operations

Parallel BDD operations

◮ Organize recursive calls to RelProd and

Or in a task dependency graph

◮ Same task might be created several times:

store result in the shared Computed Table

◮ Fine-grained task-parallelism:

◮ Parent spawns children for subtasks,

and waits upon their completion

◮ Load balancing by work-stealing; use e.g.

Cilk [Blumofe ’95] or Wool [Fax´ en ’08]

Split double-ended queue in public and private part t s h

stolen

stealable worker-private

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 17 / 56

SLIDE 37

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Results: speedup of BDD operations for model checking

5 10 15 20 25 30 10 20 30 40

Workers Speedup

Model bakery.4 bakery.8 collision.5 iprotocol.7 lifts.4 lifts.7 schedule world.2 schedule world.3

Experiments

◮ BEEM benchmarks, again ◮ On 4 × 12 = 48 core NUMA ◮ Speedup up to 32 (=66.7%) ◮ Small models don’t scale

(time spent in work stealing)

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 18 / 56

SLIDE 38

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Results: speedup of BDD operations for model checking

5 10 15 20 25 30 10 20 30 40

Workers Speedup

Model bakery.4 bakery.8 collision.5 iprotocol.7 lifts.4 lifts.7 schedule world.2 schedule world.3

Experiments

◮ BEEM benchmarks, again ◮ On 4 × 12 = 48 core NUMA ◮ Speedup up to 32 (=66.7%) ◮ Small models don’t scale

(time spent in work stealing) Conclusion

◮ So far only speed up for the BDD-operations ◮ Even for large models, many small BDDs are involved ◮ Ongoing: parallelize Symbolic Reachability itself

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 18 / 56

SLIDE 39

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Model Checking by Accepting Cycles

LTL Model Checking

◮ A buggy run in a system can be viewed as an infinite word ◮ Absence of bugs: emptiness of some B¨

uchi automaton

◮ S ⊆ P iff S ∩ P = ∅ iff S × ¬P has no accepting cycle

1 2 3 4 5 6

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 20 / 56

SLIDE 41

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Model Checking by Accepting Cycles

LTL Model Checking

◮ A buggy run in a system can be viewed as an infinite word ◮ Absence of bugs: emptiness of some B¨

uchi automaton

◮ S ⊆ P iff S ∩ P = ∅ iff S × ¬P has no accepting cycle

◮ Graph problem: find a reachable accepting state on a cycle 1 2 3 4 5 6 1 2 5 6

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 20 / 56

SLIDE 42

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Model Checking by Accepting Cycles

LTL Model Checking

◮ A buggy run in a system can be viewed as an infinite word ◮ Absence of bugs: emptiness of some B¨

uchi automaton

◮ S ⊆ P iff S ∩ P = ∅ iff S × ¬P has no accepting cycle

◮ Graph problem: find a reachable accepting state on a cycle ◮ Basic algorithm: Nested Depth First Search (NDFS) 1 2 3 4 5 6 1 2 5 6

Properties of NDFS

◮ NDFS runs in linear time ◮ Inherently depends on post-order ◮ Post-order is P-complete [Reif’85] ◮ Not parallelizable (unless P=NC)

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 20 / 56

SLIDE 43

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Recall: Nested Depth First Search

[CVWY’92] [Holzmann’92]

◮ Blue search: explore graph in DFS order

◮ states on the blue search stack are cyan

Blue search

1: procedure dfsBlue(s) 2: add s to Cyan 8: move s from Cyan to Blue

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 21 / 56

SLIDE 44

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Recall: Nested Depth First Search

[CVWY’92] [Holzmann’92]

◮ Blue search: explore graph in DFS order

◮ states on the blue search stack are cyan

Blue search

1: procedure dfsBlue(s) 2: add s to Cyan 3: for all successors t of s do 4: if t ∈ Blue ∪ Cyan then 5: dfsBlue(t) 8: move s from Cyan to Blue

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 21 / 56

SLIDE 45

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Recall: Nested Depth First Search

[CVWY’92] [Holzmann’92]

◮ Blue search: explore graph in DFS order

◮ states on the blue search stack are cyan ◮ on backtracking from an accepting state:

Blue search

1: procedure dfsBlue(s) 2: add s to Cyan 3: for all successors t of s do 4: if t ∈ Blue ∪ Cyan then 5: dfsBlue(t) 6: if s is accepting then 7: dfsRed(s) 8: move s from Cyan to Blue

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 21 / 56

SLIDE 46

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Recall: Nested Depth First Search

[CVWY’92] [Holzmann’92]

◮ Blue search: explore graph in DFS order

◮ states on the blue search stack are cyan ◮ on backtracking from an accepting state:

◮ Red search: find an accepting cycle

Blue search

1: procedure dfsBlue(s) 2: add s to Cyan 3: for all successors t of s do 4: if t ∈ Blue ∪ Cyan then 5: dfsBlue(t) 6: if s is accepting then 7: dfsRed(s) 8: move s from Cyan to Blue

Red search

1: procedure dfsRed(s) 2: add s to Red 3: for all successors t of s do 6: if t ∈ Red then 7: dfsRed(t)

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 21 / 56

SLIDE 47

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Recall: Nested Depth First Search

[CVWY’92] [Holzmann’92]

◮ Blue search: explore graph in DFS order

◮ states on the blue search stack are cyan ◮ on backtracking from an accepting state:

◮ Red search: find an accepting cycle

◮ exit as soon as the cyan stack is reached

Blue search

1: procedure dfsBlue(s) 2: add s to Cyan 3: for all successors t of s do 4: if t ∈ Blue ∪ Cyan then 5: dfsBlue(t) 6: if s is accepting then 7: dfsRed(s) 8: move s from Cyan to Blue

Red search

1: procedure dfsRed(s) 2: add s to Red 3: for all successors t of s do 4: if t ∈ Cyan then 5: Exit: cycle detected 6: if t ∈ Red then 7: dfsRed(t)

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 21 / 56

SLIDE 48

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Recall: Nested Depth First Search

[CVWY’92] [Holzmann’92]

◮ Blue search: explore graph in DFS order

◮ states on the blue search stack are cyan ◮ on backtracking from an accepting state:

◮ Red search: find an accepting cycle

◮ exit as soon as the cyan stack is reached

◮ Linear time, depends on post-order

Blue search

1: procedure dfsBlue(s) 2: add s to Cyan 3: for all successors t of s do 4: if t ∈ Blue ∪ Cyan then 5: dfsBlue(t) 6: if s is accepting then 7: dfsRed(s) 8: move s from Cyan to Blue

Red search

1: procedure dfsRed(s) 2: add s to Red 3: for all successors t of s do 4: if t ∈ Cyan then 5: Exit: cycle detected 6: if t ∈ Red then 7: dfsRed(t)

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 21 / 56

SLIDE 49

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Simple idea: Swarmed Nested Depth First Search

Laarman, Langerak, van de Pol, Wijs [ATVA’11]

Multi-core Swarmed NDFS

◮ W workers perform independent random NDFS

◮ Visited states are stored in a shared hashtable ◮ All workers use their own set of colors

(2W bits per state)

◮ Speeds up bug hunting only

Blue search

1: procedure dfsBlue(s, i) 2: add s to Cyan[i] 3: for all successors t of s do 4: if t ∈ Blue[i] ∪ Cyan[i] then 5: dfsBlue(t, i) 6: if s is accepting then 7: dfsRed(s, i) 8: move s from Cyan[i] to Blue[i]

Red search

1: procedure dfsRed(s, i) 2: add s to Red[i] 3: for all successors t of s do 4: if t ∈ Cyan[i] then 5: Exit: cycle detected 6: if t ∈ Red[i] then 7: dfsRed(t, i)

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 23 / 56

SLIDE 51

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Multi-core Nested Depth First Search

Laarman, van de Pol,...[ATVA’11][PDMC’11]; Evangelista,L,vdP [ATVA’12]

Multi-core NDFS (several variations)

◮ Collaboration between NDFS workers

◮ Share red and/or blue globally ◮ Workers backtrack on parts finished by others ◮ Correctness: Complicated to restore post-order ◮ Performance: Reasonable scalability

Blue search

1: procedure dfsBlue(s, i) 2: add s to Cyan[i] 3: for all successors t of s do 4: if t ∈ Blue ∪ Cyan[i] then 5: dfsBlue(t, i) 6: if s is accepting then 7: dfsRed(s, i) 8: move s from Cyan[i] to Blue

Red search

1: procedure dfsRed(s, i) 2: add s to Red 3: for all successors t of s do 4: if t ∈ Cyan[i] then 5: Exit: cycle detected 6: if t ∈ Red then 7: dfsRed(t, i)

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 24 / 56

SLIDE 52

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

OWCTY (BFS) and Swarmed NDFS versus Parallel NDFS

Experiments from [ATVA’11] on BEEM benchmarks on 16 cores

!"#$%&' !"#$%!' !"#(%%' !"#(%!' !"#(%&' !"#(%)' !"#(%*' !"#$%&' !"#$%!' !"#(%%' !"#(%!' !"#(%&' !"#(%)' !"#(%*' !"#$%&'(()*+',-&#.' !/"#$%&'(()*+',-&#.' +,+-./' 01'+,+-./' ,'2'3' ,'2'!4'5'3'

Swarmed versus Sequential NDFS

Conclusions

◮ Swarmed NDFS speeds up bug hunting

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 25 / 56

SLIDE 53

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

OWCTY (BFS) and Swarmed NDFS versus Parallel NDFS

Experiments from [ATVA’11] on BEEM benchmarks on 16 cores

!"#$%&' !"#$%!' !"#(%%' !"#(%!' !"#(%&' !"#(%)' !"#(%*' !"#$%&' !"#$%!' !"#(%%' !"#(%!' !"#(%&' !"#(%)' !"#(%*' !"#$%&'(()*+',-&#.' !/"#$%&'(()*+',-&#.' +,+-./' 01'+,+-./' ,'2'3' ,'2'!4'5'3'

Swarmed versus Sequential NDFS

!"#$%&' !"#$%!' !"#(%%' !"#(%!' !"#(%&' !"#(%)' !"#(%*' !"#$%&' !"#$%!' !"#(%%' !"#(%!' !"#(%&' !"#(%)' !"#(%*' !"#$%&'())*+,(-.'$/( !"#$%&'(01#))*+,(-.'$/( +,+-./' 01'+,+-./' ,'2'3' ,'2'!%'4'3'

Swarmed versus Parallel NDFS

Conclusions

◮ Swarmed NDFS speeds up bug hunting ◮ Parallel NDFS also speeds up verification

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 25 / 56

SLIDE 54

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

OWCTY (BFS) and Swarmed NDFS versus Parallel NDFS

Experiments from [ATVA’11] on BEEM benchmarks on 16 cores

!"#$%&' !"#$%!' !"#(%%' !"#(%!' !"#(%&' !"#(%)' !"#(%*' !"#$%&' !"#$%!' !"#(%%' !"#(%!' !"#(%&' !"#(%)' !"#(%*' !"#$%&'(()*+',-&#.' !/"#$%&'(()*+',-&#.' +,+-./' 01'+,+-./' ,'2'3' ,'2'!4'5'3'

Swarmed versus Sequential NDFS

!"#$%&' !"#$%!' !"#(%%' !"#(%!' !"#(%&' !"#(%)' !"#(%*' !"#$%&' !"#$%!' !"#(%%' !"#(%!' !"#(%&' !"#(%)' !"#(%*' !"#$%&'())*+,(-.'$/( !"#$%&'(01#))*+,(-.'$/( +,+-./' 01'+,+-./' ,'2'3' ,'2'!%'4'3'

Swarmed versus Parallel NDFS

!"#$%&' !"#$%!' !"#(%%' !"#(%!' !"#(%&' !"#(%)' !"#$%&' !"#$%!' !"#(%%' !"#(%!' !"#(%&' !"#(%)' !"#(%* !"#$%&'()*+,)-.*/(01'$2( !"#$%&'(3.#445+6(01'$2( +,+-./' 01'+,+-./' 2'3',' 2'3'!%'4',' 2'3'!5!%'4','

OWCTY (BFS) versus Parallel NDFS

Conclusions

◮ Swarmed NDFS speeds up bug hunting ◮ Parallel NDFS also speeds up verification ◮ Parallel NDFS finds bugs faster than OWTCY (BFS)

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 25 / 56

SLIDE 55

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Experiments extended to 48 cores

From [PDMC’12]. See fmt.cs.utwente.nl/tools/ltsmin/performance/

Reachability

10 20 30 40

10

20 30 40 50

Threads Speedup

Legend

divine−table

ltsmin−cleary−tree ltsmin−table ltsmin−tree spin−hc spin−nohc

Promela: Bakery protocol LTL model checking

10 20 30 40

10

20 30 40 50

Threads Speedup

Legend

divine−owcty

ltsmin−cndfs spin−pb

Promela: Elevator controllor

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 26 / 56

SLIDE 56

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Interim Evaluation: what did we learn?

Reachability: Implementation matters, keep it simple

◮ Leave workers alone when possible; load balancing ◮ Rely on randomness to avoid “duplicate work” ◮ Careful design of concurrent data structures

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 27 / 56

SLIDE 57

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Interim Evaluation: what did we learn?

Reachability: Implementation matters, keep it simple

◮ Leave workers alone when possible; load balancing ◮ Rely on randomness to avoid “duplicate work” ◮ Careful design of concurrent data structures

LTL model checking

◮ Previous parallel algorithms (OWCTY) used BFS: O(N2) ◮ Now: linear, speedups . . . P = NC, or what did we do?

◮ W → ∞ versus W = 48 ◮ Worst case O(N · W ), no speedup UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 27 / 56

SLIDE 58

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Interim Evaluation: what did we learn?

Reachability: Implementation matters, keep it simple

◮ Leave workers alone when possible; load balancing ◮ Rely on randomness to avoid “duplicate work” ◮ Careful design of concurrent data structures

LTL model checking

◮ Previous parallel algorithms (OWCTY) used BFS: O(N2) ◮ Now: linear, speedups . . . P = NC, or what did we do?

◮ W → ∞ versus W = 48 ◮ Worst case O(N · W ), no speedup

Remaining theoretical questions

◮ Average (randomized) runtime/scalability analysis ◮ Why doesn’t this work for Strongly Connected Components?

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 27 / 56

SLIDE 59

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Practical Evaluation: Solved multi-core model checking?

Multi-core MC is compatible

◮ On-the-fly ◮ Partial-order reduction ◮ State compression ◮ Symbolic model checking

Quite general

◮ Arbitrary state/edge labels ◮ mCRL2, Promela, DVE, GSPN, ◮ LLVM, C, xUML, POOSL, ?? ◮ Domain Specific Languages?

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 28 / 56

SLIDE 60

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Practical Evaluation: Solved multi-core model checking?

Multi-core MC is compatible

◮ On-the-fly ◮ Partial-order reduction ◮ State compression ◮ Symbolic model checking

Quite general

◮ Arbitrary state/edge labels ◮ mCRL2, Promela, DVE, GSPN, ◮ LLVM, C, xUML, POOSL, ?? ◮ Domain Specific Languages?

Remaining Questions

◮ Even better speedup – especially for symbolic model checking ◮ Quite restricted to explicit state model checking ◮ Infinite state systems? data, recursion, time, . . .

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 28 / 56

SLIDE 61

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Model checking LTL for Timed Automata

Laarman, Olesen, Dalsgaard, Kim Larsen, vdPol [FORMATS’12] [CAV’13]

Handling Timed Automata

◮ Work with timed zones (DBM) for Timed B¨

uchi Automata

◮ Checking LTL properties for Uppaal timed automata

◮ Use subsumption to prune Nested DFS where possible ◮ Multi-core NDFS algorithm for Timed B¨

uchi Automata

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 29 / 56

SLIDE 62

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Model checking LTL for Timed Automata

Laarman, Olesen, Dalsgaard, Kim Larsen, vdPol [FORMATS’12] [CAV’13]

Handling Timed Automata

◮ Work with timed zones (DBM) for Timed B¨

uchi Automata

◮ Checking LTL properties for Uppaal timed automata

◮ Use subsumption to prune Nested DFS where possible ◮ Multi-core NDFS algorithm for Timed B¨

uchi Automata

Tool support

property DBM library result verification mc−NDFS LTSmin C++ code successor

paal

xml−file generator ltl2ba Uppaal LTL ◮ Open source through opaal and LTSmin

◮ opaal-modelchecker.com/ ◮ fmt.cs.utwente.nl/tools/ltsmin/ UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 29 / 56

SLIDE 63

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Timed B¨ uchi Automata

[Alur,Dill’94]

ℓ0 ℓ1 ℓ2 y ≤ 2 y ≤ 2 x := 0, y := 0 y := 0 [x > 2] x := 0, y := 0

Ingredients

◮ locations (ℓ0, ℓ1, ℓ2), can be initial or accepting ◮ transitions, governed by real-valued clocks (x, y) ◮ timed runs should respect clock guards, resets, invariants

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 31 / 56

SLIDE 65

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Timed B¨ uchi Automata

[Alur,Dill’94]

ℓ0 ℓ1 ℓ2 y ≤ 2 y ≤ 2 x := 0, y := 0 y := 0 [x > 2] x := 0, y := 0

Ingredients

◮ locations (ℓ0, ℓ1, ℓ2), can be initial or accepting ◮ transitions, governed by real-valued clocks (x, y) ◮ timed runs should respect clock guards, resets, invariants

ℓ0,

UNIVERSITY OF TWENTE.

Multi-core MC for Biology 22 November 2013 31 / 56

SLIDE 66

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Timed B¨ uchi Automata

[Alur,Dill’94]

ℓ0 ℓ1 ℓ2 y ≤ 2 y ≤ 2 x := 0, y := 0 y := 0 [x > 2] x := 0, y := 0

Ingredients

◮ locations (ℓ0, ℓ1, ℓ2), can be initial or accepting ◮ transitions, governed by real-valued clocks (x, y) ◮ timed runs should respect clock guards, resets, invariants

ℓ0,

2.7

− → ℓ0,

UNIVERSITY OF TWENTE.

Multi-core MC for Biology 22 November 2013 31 / 56

SLIDE 67

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Timed B¨ uchi Automata

[Alur,Dill’94]

ℓ0 ℓ1 ℓ2 y ≤ 2 y ≤ 2 x := 0, y := 0 y := 0 [x > 2] x := 0, y := 0

Ingredients

◮ locations (ℓ0, ℓ1, ℓ2), can be initial or accepting ◮ transitions, governed by real-valued clocks (x, y) ◮ timed runs should respect clock guards, resets, invariants

ℓ0,

2.7

− → ℓ0,

1.8

− → ℓ1, 1.8

UNIVERSITY OF TWENTE.

Multi-core MC for Biology 22 November 2013 31 / 56

SLIDE 68

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Timed B¨ uchi Automata

[Alur,Dill’94]

ℓ0 ℓ1 ℓ2 y ≤ 2 y ≤ 2 x := 0, y := 0 y := 0 [x > 2] x := 0, y := 0

Ingredients

◮ locations (ℓ0, ℓ1, ℓ2), can be initial or accepting ◮ transitions, governed by real-valued clocks (x, y) ◮ timed runs should respect clock guards, resets, invariants

ℓ0,

2.7

− → ℓ0,

1.8

− → ℓ1, 1.8

0.5

− → ℓ2,

UNIVERSITY OF TWENTE.

Multi-core MC for Biology 22 November 2013 31 / 56

SLIDE 69

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Timed B¨ uchi Automata

[Alur,Dill’94]

ℓ0 ℓ1 ℓ2 y ≤ 2 y ≤ 2 x := 0, y := 0 y := 0 [x > 2] x := 0, y := 0

Ingredients

◮ locations (ℓ0, ℓ1, ℓ2), can be initial or accepting ◮ transitions, governed by real-valued clocks (x, y) ◮ timed runs should respect clock guards, resets, invariants

ℓ0,

2.7

− → ℓ0,

1.8

− → ℓ1, 1.8

0.5

− → ℓ2,

2.0

− → ℓ1, 2.0 2.0

UNIVERSITY OF TWENTE.

Multi-core MC for Biology 22 November 2013 31 / 56

SLIDE 70

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Timed B¨ uchi Automata

[Alur,Dill’94]

ℓ0 ℓ1 ℓ2 y ≤ 2 y ≤ 2 x := 0, y := 0 y := 0 [x > 2] x := 0, y := 0

Ingredients

◮ locations (ℓ0, ℓ1, ℓ2), can be initial or accepting ◮ transitions, governed by real-valued clocks (x, y) ◮ timed runs should respect clock guards, resets, invariants

ℓ0,

2.7

− → ℓ0,

1.8

− → ℓ1, 1.8

0.5

− → ℓ2,

2.0

− → ℓ1, 2.0 2.0

→

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 31 / 56

SLIDE 71

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Timed B¨ uchi Automata

[Alur,Dill’94]

ℓ0 ℓ1 ℓ2 y ≤ 2 y ≤ 2 x := 0, y := 0 y := 0 [x > 2] x := 0, y := 0

Ingredients

◮ locations (ℓ0, ℓ1, ℓ2), can be initial or accepting ◮ transitions, governed by real-valued clocks (x, y) ◮ timed runs should respect clock guards, resets, invariants

ℓ0,

2.7

− → ℓ0,

1.8

− → ℓ1, 1.8

0.5

− → ℓ2,

2.0

− → ℓ1, 2.0 2.0

→

Question: is the B¨ uchi language empty? . . . . . . . no counterexample

Does a (non-zeno) timed run exist that visits an accepting state infinitely often?

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 31 / 56

SLIDE 72

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Finite representation: zone abstraction, extrapolation

ℓ0 ℓ1 ℓ2 y ≤ 2 y ≤ 2 y := 0 [x > 2] x := 0, y := 0 x := 0, y := 0

Finite representation by zones (DBM)

[Dill’89] [Daws,Tripakis’98]

◮ A zone is a set of constraints ◮ finite by taking into account the lower/upperbounds

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 32 / 56

SLIDE 73

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Finite representation: zone abstraction, extrapolation

ℓ0 ℓ1 ℓ2 y ≤ 2 y ≤ 2 y := 0 [x > 2] x := 0, y := 0 x := 0, y := 0

Finite representation by zones (DBM)

[Dill’89] [Daws,Tripakis’98]

◮ A zone is a set of constraints ◮ finite by taking into account the lower/upperbounds

ℓ0, Z0

Z0 := y = x

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 32 / 56

SLIDE 74

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Finite representation: zone abstraction, extrapolation

ℓ0 ℓ1 ℓ2 y ≤ 2 y ≤ 2 y := 0 [x > 2] x := 0, y := 0 x := 0, y := 0

Finite representation by zones (DBM)

[Dill’89] [Daws,Tripakis’98]

◮ A zone is a set of constraints ◮ finite by taking into account the lower/upperbounds

ℓ0, Z0 ℓ1, Z1

Z0 := y = x Z1 := y ≤ x ∧ y ≤ 2

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 32 / 56

SLIDE 75

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Finite representation: zone abstraction, extrapolation

ℓ0 ℓ1 ℓ2 y ≤ 2 y ≤ 2 y := 0 [x > 2] x := 0, y := 0 x := 0, y := 0

Finite representation by zones (DBM)

[Dill’89] [Daws,Tripakis’98]

◮ A zone is a set of constraints ◮ finite by taking into account the lower/upperbounds

ℓ0, Z0 ℓ1, Z1 ℓ2, Z2

Z0 := y = x Z1 := y ≤ x ∧ y ≤ 2 Z2 := y = x ∧ y ≤ 2

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 32 / 56

SLIDE 76

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Finite representation: zone abstraction, extrapolation

ℓ0 ℓ1 ℓ2 y ≤ 2 y ≤ 2 y := 0 [x > 2] x := 0, y := 0 x := 0, y := 0

Finite representation by zones (DBM)

[Dill’89] [Daws,Tripakis’98]

◮ A zone is a set of constraints ◮ finite by taking into account the lower/upperbounds

ℓ0, Z0 ℓ1, Z1 ℓ2, Z2 ℓ1, Z2

No accepting run! Z0 := y = x Z1 := y ≤ x ∧ y ≤ 2 Z2 := y = x ∧ y ≤ 2

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 32 / 56

SLIDE 77

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Finite representation: zone abstraction, extrapolation

ℓ0 ℓ1 ℓ2 y ≤ 2 y ≤ 2 y := 0 [x > 2] x := 0, y := 0 x := 0, y := 0

Finite representation by zones (DBM)

[Dill’89] [Daws,Tripakis’98]

◮ A zone is a set of constraints ◮ finite by taking into account the lower/upperbounds

ℓ0, Z0 ℓ1, Z1 ℓ2, Z2 ℓ1, Z2 ⊒

No accepting run! Z0 := y = x Z1 := y ≤ x ∧ y ≤ 2 Z2 := y = x ∧ y ≤ 2 Subsumption: Z2 ⊆ Z1, so (ℓ1, Z2) ⊑ (ℓ1, Z1)

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 32 / 56

SLIDE 78

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Subsumption, or inclusion abstraction

Why explore a state again, if it is subsumed by a previous state?

s0 s1 s2 s3 ⊒

Zone abstraction

s0 s2 s3 s1

s3 ⊑ s1

s0 s1 s2

subsumption

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 33 / 56

SLIDE 79

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Subsumption, or inclusion abstraction

Why explore a state again, if it is subsumed by a previous state?

s0 s1 s2 s3 ⊒

Zone abstraction

s0 s2 s3 s1

s3 ⊑ s1

s0 s1 s2

subsumption Known results

[Behrmann et al’04] [Tripakis’09] [Li’09]

◮ finite zone abstraction preserves reachability of locations ◮ finite zone abstraction also preserve B¨

uchi emptiness

◮ subsumption preserves reachability of locations as well

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 33 / 56

SLIDE 80

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Subsumption, or inclusion abstraction

Why explore a state again, if it is subsumed by a previous state?

s0 s1 s2 s3 ⊒

Zone abstraction

s0 s2 s3 s1

s3 ⊑ s1

s0 s1 s2

subsumption Known results

[Behrmann et al’04] [Tripakis’09] [Li’09]

◮ finite zone abstraction preserves reachability of locations ◮ finite zone abstraction also preserve B¨

uchi emptiness

◮ subsumption preserves reachability of locations as well

Open problem

posed in [Tripakis’09] Is emptiness of Timed B¨ uchi Automata preserved by subsumption?

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 33 / 56

SLIDE 81

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Subsumption, or inclusion abstraction

Why explore a state again, if it is subsumed by a previous state?

s0 s1 s2 s3 ⊒

Zone abstraction

s0 s2 s3 s1

s3 ⊑ s1

s0 s1 s2

subsumption Known results

[Behrmann et al’04] [Tripakis’09] [Li’09]

◮ finite zone abstraction preserves reachability of locations ◮ finite zone abstraction also preserve B¨

uchi emptiness

◮ subsumption preserves reachability of locations as well

Open problem

posed in [Tripakis’09] Is emptiness of Timed B¨ uchi Automata preserved by subsumption? NO

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 33 / 56

SLIDE 82

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Analysis of accepting spirals with subsumption

[CAV’13]

⊑ is a simulation relation: s′ s t ⊑ → t′ → ⊑ ⊑ is a finite abstraction

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 35 / 56

SLIDE 84

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Analysis of accepting spirals with subsumption

[CAV’13]

⊑ is a simulation relation: s′ s t ⊑ → t′ → ⊑ ⊑ is a finite abstraction

s’ s t

Lemma: If s has an accepting cycle then any s′ ⊒ s has it as well Preservation of accepting cycles Proof Sketch s′ s t t ⊑ →∗ →+

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 35 / 56

SLIDE 85

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Analysis of accepting spirals with subsumption

[CAV’13]

⊑ is a simulation relation: s′ s t ⊑ → t′ → ⊑ ⊑ is a finite abstraction

s’ t’ t’’ s t

Lemma: If s has an accepting cycle then any s′ ⊒ s has it as well Preservation of accepting cycles Proof Sketch s′ s t t ⊑ →∗ →+ t′ t′′ →∗ →+ ⊑ ⊑

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 35 / 56

SLIDE 86

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Analysis of accepting spirals with subsumption

[CAV’13]

⊑ is a simulation relation: s′ s t ⊑ → t′ → ⊑ ⊑ is a finite abstraction

s’ t’ t’’ s t t’’’

Lemma: If s has an accepting cycle then any s′ ⊒ s has it as well Preservation of accepting cycles Proof Sketch s′ s t t ⊑ →∗ →+ t′ t′′ →∗ →+ ⊑ ⊑ · · · · · · · · · · · · t′′′ t →+ →+ →+ →+ ⊑

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 35 / 56

SLIDE 87

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Analysis of accepting spirals with subsumption

[CAV’13]

⊑ is a simulation relation: s′ s t ⊑ → t′ → ⊑ ⊑ is a finite abstraction

s’ t’ t’’ s t t’’’

Lemma: If s has an accepting cycle then any s′ ⊒ s has it as well Preservation of accepting cycles Proof Sketch s′ s t t ⊑ →∗ →+ t′ t′′ →∗ →+ ⊑ ⊑ · · · x · · · · · · · · · t′′′ t →+ →+ →+ →+ ⊑ x t →+ →+ ⊑

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 35 / 56

SLIDE 88

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Subsumption in Nested Depth First Search

[CAV’13]

Blue search find accepting states in post order

1: procedure dfsBlue(s) 2: Cyan := Cyan ∪ {s} 3: for all successors t of s do 4: if t ∈ Blue ∪ Cyan then 5: dfsBlue(t) 6: if s is accepting then 7: dfsRed(s) 8: Blue, Cyan := Blue ∪ {s}, Cyan\{s}

Red search find cycles on accepting states

1: procedure dfsRed(s) Postcondition: no accepting spiral reachable 2: Red := Red ∪ {s} 3: for all successors t of s do 4: if t ∈ Cyan then 5: Exit: cycle detected 6: if t ∈ Red then 7: dfsRed(t)

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 36 / 56

SLIDE 89

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Subsumption in Nested Depth First Search

[CAV’13]

Blue search find accepting states in post order

1: procedure dfsBlue(s) 2: Cyan := Cyan ∪ {s} 3: for all successors t of s do 4: if t ∈ Blue ∪ Cyan then 5: dfsBlue(t) 6: if s is accepting then 7: dfsRed(s) 8: Blue, Cyan := Blue ∪ {s}, Cyan\{s}

Red search find cycles on accepting states

1: procedure dfsRed(s) Postcondition: no accepting spiral reachable 2: Red := Red ∪ {s} 3: for all successors t of s do 4: if t ⊒ Cyan then Accepting spiral found! 5: Exit: cycle detected 6: if t ∈ Red then 7: dfsRed(t)

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 36 / 56

SLIDE 90

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Subsumption in Nested Depth First Search

[CAV’13]

Blue search find accepting states in post order

1: procedure dfsBlue(s) 2: Cyan := Cyan ∪ {s} 3: for all successors t of s do 4: if t ∈ Blue ∪ Cyan then 5: dfsBlue(t) 6: if s is accepting then 7: dfsRed(s) 8: Blue, Cyan := Blue ∪ {s}, Cyan\{s}

Red search find cycles on accepting states

1: procedure dfsRed(s) Postcondition: no accepting spiral reachable 2: Red := Red ∪ {s} 3: for all successors t of s do 4: if t ⊒ Cyan then Accepting spiral found! 5: Exit: cycle detected 6: if t ⊑ Red then Spiral on t would give spiral from Red 7: dfsRed(t)

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 36 / 56

SLIDE 91

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Subsumption in Nested Depth First Search

[CAV’13]

Blue search find accepting states in post order

1: procedure dfsBlue(s) 2: Cyan := Cyan ∪ {s} 3: for all successors t of s do 4: if t ∈ Blue ∪ Cyan∧ t ⊑ Red then Prune the blue search 5: dfsBlue(t) 6: if s is accepting then 7: dfsRed(s) 8: Blue, Cyan := Blue ∪ {s}, Cyan\{s}

Red search find cycles on accepting states

1: procedure dfsRed(s) Postcondition: no accepting spiral reachable 2: Red := Red ∪ {s} 3: for all successors t of s do 4: if t ⊒ Cyan then Accepting spiral found! 5: Exit: cycle detected 6: if t ⊑ Red then Spiral on t would give spiral from Red 7: dfsRed(t)

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 36 / 56

SLIDE 92

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Experiments: speedup up to 48 cores

Reachability: [Formats’12]. LTL model checking: [CAV’13] BFS Reachability on Timed Automata

10 20 30 40

●
10

20 30 40 50

Threads Speedup

Model

fischer6

train−crossing−stdred−5 train−gate−N10 train−gate−N9 viking15 viking17

Checking LTL on Timed Automata

10 20 30 40 50

10

20 30 40 50

Threads Speedup

Model

csma

fddi fischer−1 fischer−2 train−gate

Experiments with opaal and LTSmin – open source hours − → minutes − → seconds

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 37 / 56

SLIDE 93

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Signaling Pathway in Cell Biology

Kinase pathways: spreading the Phosphor token

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 39 / 56

SLIDE 95

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Signaling Pathway in Cell Biology

Kinase pathways: spreading the Phosphor token

◮ Biochemical equilibrium reactions:

◮ E + S + ATP ⇋ ES + ATP → ESP + ADP ⇋ E + SP + ADP

◮ Simplify to one interaction (here activiation): E −

→ S

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 39 / 56

SLIDE 96

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Signaling Network in Cell Biology

Complex network dynamics

◮ Node interactions:

◮ activation ◮ inhibition

◮ Crosstalk and Feedback ◮ Ultimate questions:

◮ understand & control ◮ key to finding a cure UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 40 / 56

SLIDE 97

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

How to model signaling networks?

Mathematical models (ODE)

[Gillespie ’77]

dA dt = k1·B − k2·C − k3·A ◮ A, B, C are molecule concentrations ◮ k1, k2, k3 are kinetic parameters ◮ Precise, strong tools (simulation, stability) ◮ Difficult, too many parameters are unknown

Boolean networks

[Kauffman’69]

B ∧ ¬C = ⇒ A

◮ Easy to handle, biologically relevant ◮ No timing, no concentrations at all ◮ So how to execute this?

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 41 / 56

SLIDE 98

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Using Networks of Timed Automata

Modeling Assumptions

◮ Every reactant is a Timed Automaton ◮ It maintains a discrete activation level:

active

active+inactive

◮ Clocks trigger when the activation level goes up or down

◮ Activation/Inhibition: broadcast communication between automata

reacting[3]? reacting[0]! reacting[1]? reacting[2]? reacting[1]? stubborn update(), c:= 0 update(), c:= 0 reacting[2]? react(), c := 0 reacting[3]? update(), c:= 0 cant_react() c >= T c < T can_react() c >= T start updating not_reacting c > T waiting c <= T c <= T update() update() c := T

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 42 / 56

time T depends on activation levels: L[r1][r2] and U[r1][r2]

SLIDE 99

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

ANIMO: Analysis of Networks by Interactive Modeling

Schivo, Scholma, Karperien, Langerak, vdPol, Post, Urquidi, Vet, Wanders, (FMT, HMI, BioEng) [BIBE’12] [GENE’13] [J-BHI’14]

ANIMO is a Cytoscape plugin, running UPPAAL in the background

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 44 / 56

SLIDE 101

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

ANIMO workflow

Draw topology, initial conditions, and investigate the behaviour

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 45 / 56

SLIDE 102

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

ANIMO workflow

Draw topology, initial conditions, and investigate the behaviour Node colors/edges show activation level;

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 45 / 56

SLIDE 103

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

ANIMO workflow

Draw topology, initial conditions, and investigate the behaviour Node colors/edges show activation level; view as graphs,

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 45 / 56

SLIDE 104

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

ANIMO workflow

Draw topology, initial conditions, and investigate the behaviour Node colors/edges show activation level; view as graphs, heatmap.

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 45 / 56

SLIDE 105

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Validation by Wet-Lab Experiments

Phosphorylation of proteins in human chondrocytes: Time series under three experimental conditions.

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 46 / 56

SLIDE 106

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Validation by Wet-Lab Experiments

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 47 / 56

SLIDE 107

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Validation by Wet-Lab Experiments

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 47 / 56

SLIDE 108

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Osteoarthritis

◮ Mesenchymal stem cells can

differentiate to

◮ either Osteoblasts (bone) ◮ or Chondrocytes (cartilage)

◮ Osteoarthritis: articular cartilage

dries, wears out, forms bone

◮ Pain in “bone-to-bone” joints ◮ 60% of the population (> 65 years)

will show symptoms

◮ Characterized by transcription

factors: SOX9 or RUNX2

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 49 / 56

SLIDE 110

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

ECHO: the Executable Chondrocyte

Size

◮ 7 inputs ◮ 123 nodes ◮ 354 links ◮ Sox9, Runx2

as output Starting point: Boolean Network Kerkhofs et al (U Leuven), PLoS One 7(4), 2012

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 50 / 56

SLIDE 111

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Validation by simulating results from literature

Basic validation by simulation

◮ Exhaustive / Monte Carlo simulation with 37 input conditions ◮ Knock-out or overexpress individual nodes in the network

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 51 / 56

SLIDE 112

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Validation by simulating results from literature

Basic validation by simulation

◮ Exhaustive / Monte Carlo simulation with 37 input conditions ◮ Knock-out or overexpress individual nodes in the network ◮ There are only two stable

states (SOX9 and RUNX2)

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 51 / 56

SLIDE 113

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Validation by simulating results from literature

Basic validation by simulation

◮ Exhaustive / Monte Carlo simulation with 37 input conditions ◮ Knock-out or overexpress individual nodes in the network ◮ There are only two stable

states (SOX9 and RUNX2)

◮ WNT pushes SOX9

stable states to RUNX2

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 51 / 56

SLIDE 114

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Validation by simulating results from literature

Basic validation by simulation

◮ Exhaustive / Monte Carlo simulation with 37 input conditions ◮ Knock-out or overexpress individual nodes in the network ◮ There are only two stable

states (SOX9 and RUNX2)

◮ WNT pushes SOX9

stable states to RUNX2

◮ DKK, FRZB and GREM

stabilize healthy cartilage

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 51 / 56

SLIDE 115

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Multi-core Model Checking for Biological Applications?

Key questions (biological relevant answers)

◮ Which input combination/series causes a switch RUNX2 → SOX9 ◮ Which interactions should be inhibited to prevent SOX9 → RUNX2

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 52 / 56

SLIDE 116

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

The Empirical Research Cycle/Spiral

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 53 / 56

SLIDE 117

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Literature on LTSmin (reachability)

LTSmin toolset

◮ http://fmt.cs.utwente.nl/tools/ltsmin/ ◮ Stefan Blom, Jaco van de Pol, Michael Weber,

LTSmin: Distributed and Symbolic Reachability . . . . . . . . . . . . . (CAV 2010)

◮ Alfons Laarman, Jaco van de Pol, Michael Weber,

Multi-Core LTSmin: Marrying Modularity and Scalability. . . .(NFM 2011) Reachability

◮ Alfons Laarman, Jaco van de Pol and Michael Weber, . . . (FMCAD 2010)

Boosting Multi-Core Reachability Performance with Shared Hash Tables

◮ Alfons Laarman, Jaco van de Pol, Michael Weber,

Parallel Recursive State Compression for Free . . . . . . . . . . . . . . (SPIN 2011)

◮ Tom van Dijk, Alfons Laarman and Jaco van de Pol,

Multi-core BDD Operations for Symbolic Reachability . . . . (PDMC 2012)

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 54 / 56

SLIDE 118

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Literature on LTSmin (advanced)

LTL model checking

◮ Alfons Laarman, Rom Langerak, Jaco vd Pol, Michael Weber, A. Wijs,

Multi-Core Nested Depth-First Search. . . . . . . . . . . . . . . . . . . . (ATVA 2011)

◮ Alfons Laarman, Jaco van de Pol,

Variations on Multi-Core Nested Depth-First Search . . . . . . (PDMC 2011)

◮ Sami Evangelista, Alfons Laarman, Laure Petrucci and Jaco van de Pol,

Improved Multi-Core Nested Depth-First Search . . . . . . . . . . .(ATVA 2012) Timed Automata

◮ A. Dalsgaard, A.W. Laarman, K.G. Larsen, M. Olesen, J. van de Pol,

Multi-Core Reachability for Timed Automata . . . . . . . . . . . (FORMATS’12)

◮ Alfons Laarman, M. Olesen, A. Dalsgaard, K.G. Larsen, J. van de Pol,

Multi-core emptiness checking of timed B¨ uchi automata using inclusion abstraction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . (CAV’13)

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 55 / 56

SLIDE 119

... Multi-core Reachability Multi-core LTL model checking Timed Automata Signalling Networks ...

Literature on ANIMO

Signaling Networks in Biology

◮ http://fmt.cs.utwente.nl/tools/animo/ ◮ Stefano Schivo, Jetse Scholma, B. Wanders, R. Urquidi, P. van der Vet,

M. Karperien, R. Langerak, J. van de Pol, J.N. Post, (BIBE’12, J-BHI’14)

Modelling biological pathway dynamics with Timed Automata

◮ Jetse Scholma, Stefano Schivo, Ricardo Urquidi, Jaco van de Pol, Marcel

Karperien, Janine Post, . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .GENE 533 (2013) Biological networks 101: computational modeling for molecular biologists

UNIVERSITY OF TWENTE. Multi-core MC for Biology 22 November 2013 56 / 56

Multi-core model checking for biological applications UNIVERSITY OF TWENTE.

Formal Methods & Tools. Jaco van de Pol 22 November 2013

NWPT’13, Tallinn

High-performance Model Checking for the Masses

Goals

◮ Investigate high-performance model checking algorithms ◮ Application to complex man-made and natural systems ◮ Need access to/from multiple modeling languages

High-performance Model Checking for the Masses

Goals

◮ Investigate high-performance model checking algorithms ◮ Application to complex man-made and natural systems ◮ Need access to/from multiple modeling languages

PINS

Requirements on tool and interface (LTSmin / PINS)

◮ Generality: support LTS with arbitrary state/edge labels ◮ On-the-fly API: next-state function to pull implicit graph ◮ Efficiency: models expose locality in a dependency matrix

High-performance Model Checking for the Masses

Goals

◮ Investigate high-performance model checking algorithms ◮ Application to complex man-made and natural systems ◮ Need access to/from multiple modeling languages

PINS

x y z t1 r w – t2 – r w t3 w – rw

Requirements on tool and interface (LTSmin / PINS)

◮ Generality: support LTS with arbitrary state/edge labels ◮ On-the-fly API: next-state function to pull implicit graph ◮ Efficiency: models expose locality in a dependency matrix

LTSmin architecture and PINS interface

Blom, van de Pol, Weber [CAV’10], Laarman, van de Pol, Weber [NFM’11] http://fmt.cs.utwente.nl/tools/ltsmin/ Pins2pins mCRL2 Promela DVE UPPAAL Symbolic Specification

PINS PINS

Distributed Multi−core Languages Tools Reachability reduction Partial−order Variable reordering Transition grouping caching Transition Wrappers

And also: LLVM, parity games, Markov Automata, C-code Indirectly: GSPN, xUML, Signalling Networks in Biology

LTSmin architecture and PINS interface

Blom, van de Pol, Weber [CAV’10], Laarman, van de Pol, Weber [NFM’11] http://fmt.cs.utwente.nl/tools/ltsmin/ Pins2pins mCRL2 Promela DVE UPPAAL Symbolic Specification

PINS PINS

Distributed Multi−core Languages Tools Reachability reduction Partial−order Variable reordering Transition grouping caching Transition Wrappers

And also: LLVM, parity games, Markov Automata, C-code Indirectly: GSPN, xUML, Signalling Networks in Biology

LTSmin won the RERS challenge in 2012 (Crete) and 2013 (Palo Alto)

LTSmin architecture and PINS interface

Blom, van de Pol, Weber [CAV’10], Laarman, van de Pol, Weber [NFM’11] http://fmt.cs.utwente.nl/tools/ltsmin/

reduction / lumping mCRL2 Promela DVE UPPAAL Symbolic Specification

PINS PINS

Distributed Multi−core Languages Tools Reachability reduction Partial−order Variable reordering Transition grouping caching Transition Wrappers Pins2pins Analysis Algorithms LTL Bisimulation mu−calculus

Signaling Pathways with Timed Automata

Stefano Schivo, Langerak, van de Pol etal. [BIBE’12] [GENE’13] [J-BHI’14]

Table of Contents

1 Multi-core Reachability

Shared hash table Parallel state compression Multi-core BDDs

2 Multi-core LTL model checking

B¨ uchi automata for LTL model checking Parallel Nested Depth First Search

3 Timed Automata: subsumption of symbolic states

Timed B¨ uchi automata and subsumption LTL model checking with subsumption

4 ANIMO: Signalling Networks in Computational Biology

Modeling Signaling Networks in Cell Biology ANIMO: Interactive Modeling and Analysis Silicon Experiments: Osteoarthritis

Table of Contents

1 Multi-core Reachability

Shared hash table Parallel state compression Multi-core BDDs

2 Multi-core LTL model checking

B¨ uchi automata for LTL model checking Parallel Nested Depth First Search

3 Timed Automata: subsumption of symbolic states

Timed B¨ uchi automata and subsumption LTL model checking with subsumption

4 ANIMO: Signalling Networks in Computational Biology

Modeling Signaling Networks in Cell Biology ANIMO: Interactive Modeling and Analysis Silicon Experiments: Osteoarthritis

Which architecture suits Multi-core Model Checking?

Static partitioning

◮ Distributed memory solution ◮ Communication: W 2 queues ◮ (Relaxed) BFS only

Which architecture suits Multi-core Model Checking?

Static partitioning

◮ Distributed memory solution ◮ Communication: W 2 queues ◮ (Relaxed) BFS only

Shared hash table

◮ (Pseudo) DFS & BFS ◮ Communication: shared hash table ◮ Load balancing

Lockless Hash Table: Design

Alfons Laarman, van de Pol, Weber [fmcad10]

Main bottlenecks for scalable implementation

◮ State storage: requires concurrent access

(lock contention)

◮ Graph traversal: random memory access

(bandwidth)

◮ Computer architecture: shared L2 caches

(false sharing)

Lockless Hash Table: Design

Alfons Laarman, van de Pol, Weber [fmcad10]

Main bottlenecks for scalable implementation

◮ State storage: requires concurrent access

(lock contention)

◮ Graph traversal: random memory access

(bandwidth)

◮ Computer architecture: shared L2 caches