Proving Probabilistic Proving Probabilistic Properties of the I tai - PowerPoint PPT Presentation

Proving Probabilistic Proving Probabilistic Properties of the I tai I tai Rodeh Rodeh Properties of the leader election protocol for leader election protocol for any Number of Processes any Number of Processes Douglas Graham Douglas Graham Department of Computing Science Department of Computing Science University of Glasgow University of Glasgow

Overview Overview � Parameterised Parameterised model checking model checking � – Classical Classical parameterised parameterised model checking model checking – problem problem – Proof by induction: Proof by induction: Firewire Firewire example example – – Extending Extending Firewire Firewire & proof probabilistically & proof probabilistically – � Itai Itai Rodeh Rodeh leader election protocol leader election protocol � – Application of induction proof to Application of induction proof to Itai Itai Rodeh Rodeh – 30/06/2006 2 30/06/2006 2

Parameterised Model Model Parameterised Checking Checking � For system For system M(N)=p(1) || p(2) || M(N)=p(1) || p(2) || … … || || p(N p(N) ) � can only model check property P P for fixed for fixed can only model check property N N � What if we want to verify for any What if we want to verify for any N N ? ? � � Undecidable Undecidable in general but techniques in general but techniques � apply for subclasses of system apply for subclasses of system � E.g. proof by induction [Miller & Calder] E.g. proof by induction [Miller & Calder] � – Firewire Firewire leader election protocol leader election protocol – 30/06/2006 3 30/06/2006 3

Parameterised Model Model Parameterised Checking Checking 2 0 1 30/06/2006 4 30/06/2006 4

Parameterised Model Model Parameterised Checking Checking 2 0 P 1 30/06/2006 5 30/06/2006 5

Parameterised Model Model Parameterised Checking Checking 2 0 C P 1 30/06/2006 6 30/06/2006 6

Parameterised Model Model Parameterised Checking Checking 2 0 A P 1 30/06/2006 7 30/06/2006 7

Parameterised Model Model Parameterised Checking Checking 0 P 1 30/06/2006 8 30/06/2006 8

Parameterised Model Model Parameterised Checking Checking 0 C 1 30/06/2006 9 30/06/2006 9

Parameterised Model Model Parameterised Checking Checking 0 A 1 30/06/2006 10 30/06/2006 10

Parameterised Model Model Parameterised Checking Checking 0 30/06/2006 11 30/06/2006 11

Parameterised Model Model Parameterised Checking Checking � Notice that once child node has sent Notice that once child node has sent ack ack it it � no longer takes part no longer takes part � System is described as System is described as degenerative degenerative � � Can exploit this Can exploit this behaviour behaviour � � Prove by induction that certain types of Prove by induction that certain types of � property hold for any number of nodes property hold for any number of nodes [Miller & Calder] [Miller & Calder] 30/06/2006 12 30/06/2006 12

Parameterised Model Model Parameterised Checking Checking � Show property holds for `base Show property holds for `base’ ’ system system – – � star topology e.g. “ “leader will always be leader will always be star topology e.g. elected” ” elected � For any configuration and size of system For any configuration and size of system � every execution of model is related ( stutter stutter every execution of model is related ( equivalent) to execution in model of to execution in model of equivalent) smaller system smaller system 30/06/2006 13 30/06/2006 13

Probabilistic Parameterised Parameterised Probabilistic Model Checking Model Checking � Can we apply degenerative approach to Can we apply degenerative approach to � probabilistic systems? probabilistic systems? � Extend Extend Firewire Firewire probabilistically probabilistically � – Resolve Resolve “ “contention contention” ” situations with coin flip situations with coin flip – – Model as MDP in PRISM Model as MDP in PRISM – � Extend induction proof Extend induction proof � – “ “Executions Executions” ” are are DTMCs DTMCs not paths not paths – – Weak Weak bisimulation bisimulation instead of stutter instead of stutter – equivalence equivalence 30/06/2006 14 30/06/2006 14

Probabilistic Parameterised Parameterised Probabilistic Model Checking Model Checking � Can we apply induction approach to any Can we apply induction approach to any � other degenerative probabilistic systems? other degenerative probabilistic systems? � Itai Itai Rodeh Rodeh leader election protocol for leader election protocol for � rings? rings? 30/06/2006 15 30/06/2006 15

Probabilistic Parameterised Parameterised Probabilistic Model Checking Model Checking � Unidirectional ring of processes: Unidirectional ring of processes: � 30/06/2006 16 30/06/2006 16

Probabilistic Parameterised Parameterised Probabilistic Model Checking Model Checking � Each process flips coin and chooses 0 or 1 with Each process flips coin and chooses 0 or 1 with � equal probability equal probability 0 0 1 0 30/06/2006 17 30/06/2006 17

Probabilistic Parameterised Parameterised Probabilistic Model Checking Model Checking � Each process then passes choice to Each process then passes choice to neighbour neighbour; if ; if � chosen 0 and receive 1 become passive chosen 0 and receive 1 become passive A A A P 30/06/2006 18 30/06/2006 18

Probabilistic Parameterised Parameterised Probabilistic Model Checking Model Checking � Counter is then passed around ring by each Counter is then passed around ring by each � active process; counter is incremented by any active process; counter is incremented by any passive process passive process A 0 0 A A 0 P 30/06/2006 19 30/06/2006 19

Probabilistic Parameterised Parameterised Probabilistic Model Checking Model Checking � Counter is then passed around ring by each Counter is then passed around ring by each � active process; counter is incremented by any active process; counter is incremented by any passive process passive process A A A 1 P 30/06/2006 20 30/06/2006 20

Probabilistic Parameterised Parameterised Probabilistic Model Checking Model Checking � If any process receives counter of value N If any process receives counter of value N- -1 then 1 then � he becomes leader, else active processes choose he becomes leader, else active processes choose again again 1 0 1 P 30/06/2006 21 30/06/2006 21

Probabilistic Parameterised Parameterised Probabilistic Model Checking Model Checking � Itai Itai Rodeh Rodeh is partially degenerative is partially degenerative � – When process becomes passive it only passes on When process becomes passive it only passes on – messages… … messages – … …but it can increment counter, whose max value is but it can increment counter, whose max value is – dependent on N dependent on N � Modelled Modelled in PRISM as an MDP [ in PRISM as an MDP [Kwiatkowska Kwiatkowska et et � al., Fokkink Fokkink et al.] et al.] al., � Our model is variation of these using buffers of Our model is variation of these using buffers of � size N size N 30/06/2006 22 30/06/2006 22

Probabilistic Parameterised Parameterised Probabilistic Model Checking Model Checking � Apply same approach as for Apply same approach as for Firewire Firewire: : � – Base system is ring of size 3, say (could be Base system is ring of size 3, say (could be – anything that we can model check) anything that we can model check) 1 2 3 30/06/2006 23 30/06/2006 23

Probabilistic Parameterised Parameterised Probabilistic Model Checking Model Checking � For N>2 show that For N>2 show that M_N M_N ~ ~ M_N+1 M_N+1 where: where: � – ~ is some ~ is some relationship between executions of relationship between executions of MDPs MDPs – – M_N M_N is model of system of size N is model of system of size N – 1 1 ~ ~ N 2 N+1 2 30/06/2006 24 30/06/2006 24

Probabilistic Parameterised Parameterised Probabilistic Model Checking Model Checking � Introduce series of Introduce series of “ “intermediate intermediate” ” models models � � Define model Define model Mc_N Mc_N as for as for M_N M_N but with but with � buffer length N+1 buffer length N+1 � For system of size N, never more than N For system of size N, never more than N � messages in buffers [Fokkink Fokkink et al] et al] messages in buffers [ � Mc_N Mc_N isomorphic to isomorphic to M_N M_N � M_N = = Mc_N Mc_N M_N 30/06/2006 25 30/06/2006 25

Probabilistic Parameterised Parameterised Probabilistic Model Checking Model Checking � Define model Define model Mp_N Mp_N � � As for As for M_N+1 M_N+1 except initial except initial � nondeterministic choice over processes nondeterministic choice over processes with one selected as passive with one selected as passive � Passive process does not increment Passive process does not increment � counter counter 30/06/2006 26 30/06/2006 26

Probabilistic Parameterised Parameterised Probabilistic Model Checking Model Checking 30/06/2006 27 30/06/2006 27