Verification Based on Unfoldings of Petri Nets with Read Arcs C - - PowerPoint PPT Presentation

▶

Feb 01, 2023 228 likes •1.31k views

Verification Based on Unfoldings of Petri Nets with Read Arcs C esar Rodr guez PhD Thesis defense Ecole Normale Sup erieure de Cachan LSV EDSP December 12, 2013 Concurrent and Distributed Systems System are today increasingly

SLIDE 1

Verification Based on Unfoldings of Petri Nets with Read Arcs

C´ esar Rodr´ ıguez

PhD Thesis defense Ecole Normale Sup´ erieure de Cachan LSV · EDSP

December 12, 2013

SLIDE 2

Concurrent and Distributed Systems

System are today increasingly complex and distributed Concurrent systems are difficult to reason about Avionics Traffic control systems Multithreading software Communication systems . . .

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 2 / 38

SLIDE 3

Concurrent and Distributed Systems

System are today increasingly complex and distributed Concurrent systems are difficult to reason about Avionics Traffic control systems Multithreading software Communication systems . . . Ensuring Reliability Formal verification: model checking, theorem proving Dynamic methods: fault tolerance, runtime verification, fault diagnosis

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 2 / 38

SLIDE 4

Model Checking

Check whether K | = φ

Specification φ Kripke structure K

Formalization

System model

State-space exploration Modelling

System Counterexample / Correct Property to verify

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 3 / 38

SLIDE 5

State-space Explosion

Interleaving of concurrent actions increase size of state-space But many interleavings are uninteresting for target property x := 1 if (x) y := 0 assert (x) y := 1 if (y) x := 0

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 4 / 38

SLIDE 6

State-space Explosion

Interleaving of concurrent actions increase size of state-space But many interleavings are uninteresting for target property x := 1 if (x) y := 0 assert (x) y := 1 if (y) x := 0 y := 1 x := 1 if (x) y := 0 if (y) assert (x) ✓

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 4 / 38

SLIDE 7

State-space Explosion

Interleaving of concurrent actions increase size of state-space But many interleavings are uninteresting for target property x := 1 if (x) y := 0 assert (x) y := 1 if (y) x := 0 x := 1 y := 1 if (x) y := 0 if (y) assert (x) ✓

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 4 / 38

SLIDE 8

State-space Explosion

Interleaving of concurrent actions increase size of state-space But many interleavings are uninteresting for target property x := 1 if (x) y := 0 assert (x) y := 1 if (y) x := 0 x := 1 y := 1 if (y) x := 0 if (x) assert (x) ✗

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 4 / 38

SLIDE 9

Verification Based on Partial Orders

Concurrent system Sequential semantics Partial-order semantics Unfolding semantics of Petri nets Compact in presence of concurrency But suffer from other sources of explosion such as: Concurrent read access Sequences of choices

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 5 / 38

SLIDE 10

Verification Based on Partial Orders

Concurrent system Sequential semantics Partial-order semantics Unfolding semantics of Petri nets Compact in presence of concurrency But suffer from other sources of explosion such as: Concurrent read access Sequences of choices In this thesis Study unfoldings of Petri nets with read arcs Use them in model checking Improve conventional unfoldings for fault diagnosis

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 5 / 38

SLIDE 11

Petri Nets — Sequential Semantics

t1 p3 p2 t3 t2 p4 p7 t6 p6 t5 t4 p5 p1

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 6 / 38

SLIDE 12

Petri Nets — Sequential Semantics

t1 p3 p2 t3 t2 p4 p7 t6 p6 t5 t4 p5 p1

Preset •x and postset x• Presets and Postsets The preset and postset of a transition x (similarly for places) are: Preset •x of x: x Postset x• of x: x

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 6 / 38

SLIDE 13

Petri Nets — Sequential Semantics

t1 p3 p2 t3 t2 p4 p7 t6 p6 t5 t4 p5 p1

Preset •x and postset x• Firing sequence or run t1t2t3 . . . ∈ T ∗ ∪ T ω Run A run, or firing sequence is any sequence of transitions t1t2t3 . . . ∈ T ∗ ∪ T ω such that {p1, p4, p5}

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 6 / 38

SLIDE 14

Petri Nets — Sequential Semantics

t1 p3 p2 t3 t2 p4 p7 t6 p6 t5 t4 p5 p1

Preset •x and postset x• Firing sequence or run t1t2t3 . . . ∈ T ∗ ∪ T ω Run A run, or firing sequence is any sequence of transitions t1t2t3 . . . ∈ T ∗ ∪ T ω such that {p1, p4, p5}

− →

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 6 / 38

SLIDE 15

Petri Nets — Sequential Semantics

t1 p3 p2 t3 t2 p4 p7 t6 p6 t5 t4 p5 p1

Preset •x and postset x• Firing sequence or run t1t2t3 . . . ∈ T ∗ ∪ T ω Run A run, or firing sequence is any sequence of transitions t1t2t3 . . . ∈ T ∗ ∪ T ω such that {p1, p4, p5}

− → {p2, p4, p5}

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 6 / 38

SLIDE 16

Petri Nets — Sequential Semantics

t1 p3 p2 t3 t2 p4 p7 t6 p6 t5 t4 p5 p1

Preset •x and postset x• Firing sequence or run t1t2t3 . . . ∈ T ∗ ∪ T ω Run A run, or firing sequence is any sequence of transitions t1t2t3 . . . ∈ T ∗ ∪ T ω such that {p1, p4, p5}

− → {p2, p4, p5}

− →

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 6 / 38

SLIDE 17

Petri Nets — Sequential Semantics

t1 p3 p2 t3 t2 p4 p7 t6 p6 t5 t4 p5 p1

Preset •x and postset x• Firing sequence or run t1t2t3 . . . ∈ T ∗ ∪ T ω Run A run, or firing sequence is any sequence of transitions t1t2t3 . . . ∈ T ∗ ∪ T ω such that {p1, p4, p5}

− → {p2, p4, p5}

− → {p3, p5}

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 6 / 38

SLIDE 18

Petri Nets — Sequential Semantics

t1 p3 p2 t3 t2 p4 p7 t6 p6 t5 t4 p5 p1

Preset •x and postset x• Firing sequence or run t1t2t3 . . . ∈ T ∗ ∪ T ω Run A run, or firing sequence is any sequence of transitions t1t2t3 . . . ∈ T ∗ ∪ T ω such that {p1, p4, p5}

− → {p2, p4, p5}

− → {p3, p5}

− → . . .

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 6 / 38

SLIDE 19

Petri Nets — Sequential Semantics

t1 p3 p2 t3 t2 p4 p7 t6 p6 t5 t4 p5 p1

Preset •x and postset x• Firing sequence or run t1t2t3 . . . ∈ T ∗ ∪ T ω Reachability graph

{p3p6} {p1p4p5} {p2p4p5} {p1p4p6} {p1p7} {p3p5} {p2p4p6} {p2p7} t1 t4 t1 t4 t2 t5 t3 t5 t2 t4 t1 t6 t6 t3

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 6 / 38

SLIDE 20

Petri Net — Unfolding Semantics

N t1 p3 p2 t3 t2 p4 p7 t6 p6 t5 t4 p5 p1 Unfolding semantics of N is another net UN UN is acyclic and labelled Transitions are events and places conditions Labelling is a homomorphism UN t5 p5 t6 p7 t5 p6 t4 p5 t4 p6 . . . . . . . . . . . . p4 p7 p3 p1 t3 p3 t2 p2 t1 p1 t1 p2 p4 p4 t2

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 7 / 38

SLIDE 21

Petri Net — Unfolding Semantics

N t1 p3 p2 t3 t2 p4 p7 t6 p6 t5 t4 p5 p1 Copy initial marking Repeat:

Find transition t and conditions X s.t.:

X is coverable h(X) = •t

Add copy of t, with preset X, and copy of t•

Until no such t and X can be found UN t5 p5 t6 p7 t5 p6 t4 p5 t4 p6 . . . . . . . . . . . . p4 p7 p3 p1 t3 p3 t2 p2 t1 p1 t1 p2 p4 p4 t2

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 7 / 38

SLIDE 22

Petri Net — Unfolding Semantics

N t1 p3 p2 t3 t2 p4 p7 t6 p6 t5 t4 p5 p1 Copy initial marking Repeat:

Find transition t and conditions X s.t.:

X is coverable h(X) = •t

Add copy of t, with preset X, and copy of t•

Until no such t and X can be found UN p5 p4 p1

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 7 / 38

SLIDE 23

Petri Net — Unfolding Semantics

N t1 p3 p2 t3 t2 p4 p7 t6 p6 t5 t4 p5 p1 Copy initial marking Repeat:

Find transition t and conditions X s.t.:

X is coverable h(X) = •t

Add copy of t, with preset X, and copy of t•

Until no such t and X can be found UN p5 p4 t1 p1

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 7 / 38

SLIDE 24

Petri Net — Unfolding Semantics

N t1 p3 p2 t3 t2 p4 p7 t6 p6 t5 t4 p5 p1 Copy initial marking Repeat:

Find transition t and conditions X s.t.:

X is coverable h(X) = •t

Add copy of t, with preset X, and copy of t•

Until no such t and X can be found UN p5 p4 p2 t1 p1

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 7 / 38

SLIDE 25

Petri Net — Unfolding Semantics

N t1 p3 p2 t3 t2 p4 p7 t6 p6 t5 t4 p5 p1 Copy initial marking Repeat:

Find transition t and conditions X s.t.:

X is coverable h(X) = •t

Add copy of t, with preset X, and copy of t•

Until no such t and X can be found UN p5 p4 p2 t1 p1 t4

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 7 / 38

SLIDE 26

Petri Net — Unfolding Semantics

N t1 p3 p2 t3 t2 p4 p7 t6 p6 t5 t4 p5 p1 Copy initial marking Repeat:

Find transition t and conditions X s.t.:

X is coverable h(X) = •t

Add copy of t, with preset X, and copy of t•

Until no such t and X can be found UN p5 p4 p2 t1 p1 p6 t4

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 7 / 38

SLIDE 27

Petri Net — Unfolding Semantics

N t1 p3 p2 t3 t2 p4 p7 t6 p6 t5 t4 p5 p1 Copy initial marking Repeat:

Find transition t and conditions X s.t.:

X is coverable h(X) = •t

Add copy of t, with preset X, and copy of t•

Until no such t and X can be found UN p5 p4 t2 p2 t1 p1 p6 t4

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 7 / 38

SLIDE 28

Petri Net — Unfolding Semantics

N t1 p3 p2 t3 t2 p4 p7 t6 p6 t5 t4 p5 p1 Copy initial marking Repeat:

Find transition t and conditions X s.t.:

X is coverable h(X) = •t

Add copy of t, with preset X, and copy of t•

Until no such t and X can be found UN p5 p4 p3 t2 p2 t1 p1 p6 t4

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 7 / 38

SLIDE 29

Petri Net — Unfolding Semantics

N t1 p3 p2 t3 t2 p4 p7 t6 p6 t5 t4 p5 p1 Copy initial marking Repeat:

Find transition t and conditions X s.t.:

X is coverable h(X) = •t

Add copy of t, with preset X, and copy of t•

Until no such t and X can be found UN p5 p4 p3 t2 p2 t1 p1 p7 t5 p6 t4

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 7 / 38

SLIDE 30

Petri Net — Unfolding Semantics

N t1 p3 p2 t3 t2 p4 p7 t6 p6 t5 t4 p5 p1 Copy initial marking Repeat:

Find transition t and conditions X s.t.:

X is coverable h(X) = •t

Add copy of t, with preset X, and copy of t•

Until no such t and X can be found UN p5 p4 p1 t3 p3 t2 p2 t1 p1 p4 p7 t5 p6 t4

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 7 / 38

SLIDE 31

Petri Net — Unfolding Semantics

N t1 p3 p2 t3 t2 p4 p7 t6 p6 t5 t4 p5 p1 Copy initial marking Repeat:

Find transition t and conditions X s.t.:

X is coverable h(X) = •t

Add copy of t, with preset X, and copy of t•

Until no such t and X can be found UN p5 p4 p7 p1 t3 p3 t2 p2 t1 p1 p4 t5 p7 t5 p6 t4

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 7 / 38

SLIDE 32

Petri Net — Unfolding Semantics

N t1 p3 p2 t3 t2 p4 p7 t6 p6 t5 t4 p5 p1 Copy initial marking Repeat:

Find transition t and conditions X s.t.:

X is coverable h(X) = •t

Add copy of t, with preset X, and copy of t•

Until no such t and X can be found UN

. . .

p4 p1 t3 p3 t2 p2 t1 p1 p4 t5 p7 t5 p6 t4 p5 p7

. . . . . .

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 7 / 38

SLIDE 33

Verification with Unfoldings: Finite, Complete Prefixes

UN is the result of unfolding ‘as much as possible’ Finite unfolding prefix PN results if you stop construction

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 8 / 38

SLIDE 34

Verification with Unfoldings: Finite, Complete Prefixes

UN is the result of unfolding ‘as much as possible’ Finite unfolding prefix PN results if you stop construction If N has finitely many reachable markings. . .

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 8 / 38

SLIDE 35

Verification with Unfoldings: Finite, Complete Prefixes

UN is the result of unfolding ‘as much as possible’ Finite unfolding prefix PN results if you stop construction Definition Prefix PN is marking-complete if: for all marking m reachable in N, there is marking ˜ m reachable in PN such that h( ˜ m) = m. If N has finitely many reachable markings. . .

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 8 / 38

SLIDE 36

Verification with Unfoldings: Finite, Complete Prefixes

UN is the result of unfolding ‘as much as possible’ Finite unfolding prefix PN results if you stop construction Definition Prefix PN is marking-complete if: for all marking m reachable in N, there is marking ˜ m reachable in PN such that h( ˜ m) = m. If N has finitely many reachable markings. . . Some finite and marking-complete PN exists PN: symbolic representation of reachability graph Reachability of N is:

PSPACE-complete in N NP-complete in PN Linear in reachability graph

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 8 / 38

SLIDE 37

Unfoldings Cope with Concurrency

t3 p5 p6 t6 t5 p1 p2 t2 t1 p3 p4 t4

23 reachable markings

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 9 / 38

SLIDE 38

Unfoldings Cope with Concurrency

t3 p5 p6 t6 t5 p1 p2 t2 t1 p3 p4 t4

23 reachable markings And 2n if n processes

t5, t6 {p1, p3, p5} {p2, p3, p5} {p1, p3, p6} {p2, p3, p6} {p1, p4, p5} {p2, p4, p5} {p1, p4, p6} {p2, p4, p6} t3, t4 t3, t4 t3, t4 t3, t4 t1, t2 t1, t2 t1, t2 t1, t2 t5, t6 t5, t6 t5, t6

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 9 / 38

SLIDE 39

Unfoldings Cope with Concurrency

t3 p5 p6 t6 t5 p1 p2 t2 t1 p3 p4 t4 c1/p1 c4/p4 e2/t3 c3/p3 c6/p6 e2/t5 c5/p5 c2/p2 e1/t1

23 reachable markings And 2n if n processes Unfolding is of linear size

t5, t6 {p1, p3, p5} {p2, p3, p5} {p1, p3, p6} {p2, p3, p6} {p1, p4, p5} {p2, p4, p5} {p1, p4, p6} {p2, p4, p6} t3, t4 t3, t4 t3, t4 t3, t4 t1, t2 t1, t2 t1, t2 t1, t2 t5, t6 t5, t6 t5, t6

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 9 / 38

SLIDE 40

Check whether K | = φ

Specification φ Kripke structure K

Formalization

System model

State-space exploration Modelling

System Counterexample / Correct Property to verify

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 10 / 38

SLIDE 41

Model Checking with Net Unfoldings

Unfolding analysis

Property to verify

Formalization Modelling

Counterexample / Correct Complete prefix Petri Net Concurrent system

Unfolding construction

Reachability / LTL

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 10 / 38

SLIDE 42

Model Checking with Net Unfoldings

Unfolding construction Initially proposed by Ken McMillan

[McMillan 92]

Size of the prefix reduced

[Esparza, R¨

mer, Vogler 96]

Canonical prefixes

[Khomenko, Koutny, Vogler 02]

Comprehensive account

[Esparza, Heljanko 08]

Unfolding analysis Reachability and deadlock

[McMillan 92], [Melzer, R¨

mer 97], [Heljanko 99],

[Khomenko,Koutny 00]

LTL-X

[Esparza, Heljanko 01]

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 10 / 38

SLIDE 43

Improving Unfolding-based Verification: Outline

Concurrent read access

Unfolding construction for nets with read arcs SAT-based reachability analysis Reduction of size: adequate orders Experimental evaluation

Sequences of choices

Integration with merged processes SAT-based reachability analysis Characterization of mp-configurations Experimental evaluation

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 11 / 38

SLIDE 44

Improving Unfolding-based Verification: Outline

Concurrent read access

Unfolding construction for nets with read arcs SAT-based reachability analysis Reduction of size: adequate orders Experimental evaluation

Sequences of choices

Integration with merged processes SAT-based reachability analysis Characterization of mp-configurations Experimental evaluation

Fault diagnosis

(for conventional Petri nets) Generalization to partially-ordered observations Integration of fairness assumptions

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 11 / 38

SLIDE 45

Improving Unfolding-based Verification: Outline

Concurrent read access

Unfolding construction for nets with read arcs SAT-based reachability analysis Reduction of size: adequate orders Experimental evaluation

Sequences of choices

Integration with merged processes SAT-based reachability analysis Characterization of mp-configurations Experimental evaluation

Fault diagnosis

(for conventional Petri nets) Generalization to partially-ordered observations Integration of fairness assumptions

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 11 / 38

SLIDE 46

Concurrent Read Access and Unfoldings

Thread 1 Thread 2 l1: while (a) l2: work; l3: while (a) l4: work;

s′ l2 l1 l3 l4 a w s w ′

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 12 / 38

SLIDE 47

Concurrent Read Access and Unfoldings

Thread 1 Thread 2 l1: while (a) l2: work; l3: while (a) l4: work;

s′ l2 l1 l3 l4 a w s w ′

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 12 / 38

SLIDE 48

Concurrent Read Access and Unfoldings

Thread 1 Thread 2 l1: while (a) l2: work; l3: while (a) l4: work;

l3 l1 l3 a l2 l2 l4 l4 a a a a w s w s w ′ s′ s′ w ′ l1 l1 l3

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 12 / 38

SLIDE 49

Concurrent Read Access and Unfoldings

Thread 1 Thread 2 l1: while (a) l2: work; l3: while (a) l4: work;

s′ l2 l1 l3 l4 a w s w ′

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 12 / 38

SLIDE 50

Concurrent Read Access and Unfoldings

Thread 1 Thread 2 l1: while (a) l2: work; l3: while (a) l4: work;

l2 l1 l3 l4 a w s w ′ s′

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 12 / 38

SLIDE 51

Concurrent Read Access and Unfoldings

Thread 1 Thread 2 l1: while (a) l2: work; l3: while (a) l4: work;

l2 l3 l4 l1 a l1 l3 w s w ′ s′

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 12 / 38

SLIDE 52

Contextual Nets (c-nets)

Contextual nets: Petri nets + read arcs t1 t p t2 t2 t1 t p Transitions (and places) have context: t1 = {p}, p = {t1, t2} Assumptions: interleaving semantics and finite-state contextual net

[Montanari, Rossi 95]

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 13 / 38

SLIDE 53

Contextual Unfoldings

Contextual unfoldings can be more compact but have richer structure t4 t3 t2 t5 t6 t1

. . .

t3 t4 t1 t6 t2 t5

. . . . . .

Causality: e < e′ iff e′ occurs ⇒ e occurs before

[Baldan, Corradini, Montanari 98] [Vogler, Semenov, Yakovlev 98]

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 14 / 38

SLIDE 54

Contextual Unfoldings

Contextual unfoldings can be more compact but have richer structure t4 t3 t2 t5 t6 t1

. . .

t3 t4 t1 t6 t2 t5

. . . . . .

Causality: e < e′ iff e′ occurs ⇒ e occurs before Asymmetric conflict: e ր e′ iff e and e′ occur ⇒ e occurs before Configuration: set of events, causally-closed and ր-acyclic

[Baldan, Corradini, Montanari 98] [Vogler, Semenov, Yakovlev 98]

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 14 / 38

SLIDE 55

Constructing Ordinary Unfoldings

N t1 p3 p2 t3 t2 p4 p7 t6 p6 t5 t4 p5 p1 Copy initial marking Repeat:

Find transition t and conditions X s.t.:

X is coverable h(X) = •t

Add copy of t, with preset X, and copy of t•

Until no such t and X can be found UN t5 p5 t6 p7 t5 p6 t4 p5 t4 p6 . . . . . . . . . . . . p4 p7 p3 p1 t3 p3 t2 p2 t1 p1 t1 p2 p4 p4 t2

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 15 / 38

SLIDE 56

Constructing Ordinary Unfoldings

For ordinary Petri nets, Definition Conditions c, c′ are concurrent, c c′, iff some run marks them both. Proposition Conditions c1, . . . , cn are coverable iff ci cj holds for all i, j ∈ {1, . . . , n} Conventional unfolders: Compute and store relation as the unfolding construction progresses Use it to decide coverability of multiple conditions

[Esparza, R¨

mer 99]

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 15 / 38

SLIDE 57

However, for contextual unfoldings. . .

. . . the same approach does not work:

e2 c5 c2 e3 c6 c3 e1 c4 c1

c4 c5 and c4 c6 and c5 c6 but {c4, c5, c6} is not coverable Cycle e1 ր e2 ր e3 ր e1 of asymmetric conflict

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 16 / 38

SLIDE 58

Annotating Conditions with Histories

[R., Schwoon, Baldan 11]

In short, the solution proposed: Keeps track of conditions enriched with histories Defines on these enriched conditions, instead of plain conditions Constructs as unfolding progresses thanks to a characterization of

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 17 / 38

SLIDE 59

Annotating Conditions with Histories

[R., Schwoon, Baldan 11]

Definition Any configuration H is a history of e if:

e ∈ H

Any run of the events of H fires e last

e2 e1 e6 e5 c1 e3 e4 c5 c6 c7 c4 c8 c3 c2

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 17 / 38

SLIDE 60

Annotating Conditions with Histories

[R., Schwoon, Baldan 11]

Definition Any configuration H is a history of e if:

e ∈ H

Any run of the events of H fires e last {e3, e4} ✓

e2 e1 e6 e5 c1 e3 e4 c5 c6 c7 c4 c8 c3 c2

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 17 / 38

SLIDE 61

Annotating Conditions with Histories

[R., Schwoon, Baldan 11]

Definition Any configuration H is a history of e if:

e ∈ H

Any run of the events of H fires e last {e3, e4} ✓ {e1, e3, e4} ✗ (run e3e4e1)

e2 e1 e6 e5 c1 e3 e4 c5 c6 c7 c4 c8 c3 c2

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 17 / 38

SLIDE 62

Annotating Conditions with Histories

[R., Schwoon, Baldan 11]

Definition Any configuration H is a history of e if:

e ∈ H

Any run of the events of H fires e last {e3, e4} ✓ {e1, e3, e4} ✗ (run e3e4e1) {e1, e6, e3, e4} ✓ (e6 ր e3)

e2 e1 e6 e5 c1 e3 e4 c5 c6 c7 c4 c8 c3 c2

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 17 / 38

SLIDE 63

Annotating Conditions with Histories

[R., Schwoon, Baldan 11]

Definition Any configuration H is a history of e if:

e ∈ H

Any run of the events of H fires e last {e3, e4} ✓ {e1, e3, e4} ✗ (run e3e4e1) {e1, e6, e3, e4} ✓ (e6 ր e3)

e2 e1 e6 e5 c1 e3 e4 c5 {e1} {e1, e6} {e1, e6, e5} {e3} {e3, e1, e6} c6 c7 c4 {e3, e4} {e3, e4, e1, e2} {e3, e1, e6, e4} c8 c3 c2

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 17 / 38

SLIDE 64

Annotating Conditions with Histories

[R., Schwoon, Baldan 11]

Definition Any configuration H is a history of e if:

e ∈ H

Any run of the events of H fires e last Enriched prefix: label condition c with histories of •c and c

e2 e1 e6 e5 c1 e3 e4 c5 {e1} {e1, e6} {e1, e6, e5} {e3} {e3, e1, e6} c6 c7 c4 {e3, e4} {e3, e4, e1, e2} {e3, e1, e6, e4} c8 c3 c2

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 17 / 38

SLIDE 65

Annotating Conditions with Histories

[R., Schwoon, Baldan 11]

Definition Any configuration H is a history of e if:

e ∈ H

Any run of the events of H fires e last Enriched prefix: label condition c with histories of •c and c Enriched conditions: pairs c, H

e2 e1 e6 e5 c1 e3 e4 c5 {e1} {e1, e6} {e1, e6, e5} {e3} {e3, e1, e6} c6 c7 c4 {e3, e4} {e3, e4, e1, e2} {e3, e1, e6, e4} c8 c3 c2

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 17 / 38

SLIDE 66

Annotating Conditions with Histories

[R., Schwoon, Baldan 11]

Definition Any configuration H is a history of e if:

e ∈ H

Any run of the events of H fires e last Enriched prefix: label condition c with histories of •c and c Enriched conditions: pairs c, H

e2 e1 e6 e5 c1 e3 e4 c5 {e1} {e1, e6} {e1, e6, e5} {e3} {e3, e1, e6} c6 c7 c4 {e3, e4} {e3, e4, e1, e2} {e3, e1, e6, e4} c8 c3 c2 {} {e1, e6} {} {e1} {e1, e6} {e1, e6, e5} {e3} {e3, e1, e6} {e3, e1, e2} {e3, e4} {e3, e4, e1, e2} {e3, e1, e6, e4} {e1, e3, e2}

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 17 / 38

SLIDE 67

A Concurrency Relation for c-nets

[R., Schwoon, Baldan 11]

Definition Two enriched conditions ρ = c, H and ρ′ = c′, H′ are concurrent, written ρ ρ′, iff: H not in conflict with H′ and c, c′ ∈ (H ∪ H′)•

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 18 / 38

SLIDE 68

A Concurrency Relation for c-nets

[R., Schwoon, Baldan 11]

Definition Two enriched conditions ρ = c, H and ρ′ = c′, H′ are concurrent, written ρ ρ′, iff: H not in conflict with H′ and c, c′ ∈ (H ∪ H′)• Proposition Conditions c1, . . . , cn coverable iff there are histories H1, . . . , Hn verifying ci, Hi cj, Hj for all i, j ∈ {1, . . . , n}.

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 18 / 38

SLIDE 69

A Concurrency Relation for c-nets

[R., Schwoon, Baldan 11]

Definition Two enriched conditions ρ = c, H and ρ′ = c′, H′ are concurrent, written ρ ρ′, iff: H not in conflict with H′ and c, c′ ∈ (H ∪ H′)• Proposition Conditions c1, . . . , cn coverable iff there are histories H1, . . . , Hn verifying ci, Hi cj, Hj for all i, j ∈ {1, . . . , n}. Proposition Let ρ = c, H and e be the last enriched condition and event appended to the prefix, let ρ′ = c′, H′ be an arbitrary enriched condition. Then,

ρ ρ′ ⇐ ⇒ (c′ ∈ e• ∧ H = H′) ∨

c′ /

∈ •e ∧

(ρi ρ′) ∧

e ∩ H′ ⊆ H
C´

esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 18 / 38

SLIDE 70

Challenges and The Cunf Tool

[R., Schwoon 13]

Contextual unfoldings can be more compact, but Extra bookkeeping work for histories Prefix + histories: asymptotically same size as PR-unfolding Driving questions Is contextual unfolding as efficient? For realistic cases, more compact? How do the various unfolding approaches compare? The unfolder Cunf Asymmetric concurrency + dozen optimizations Robust tool, 7KLOC of C Integrated in Cosyverif environment (soon: TAPAAL and CPROVER)

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 19 / 38

SLIDE 71

Experimental Results: Unfolding Construction

Contextual Ordinary Ratios Net Events tC Events tP tC/tP tC/tR bds 1.sync 1866 0.14 12900 0.51 0.27 0.54 byzagr4 1b 8044 2.90 14724 3.40 0.85 0.55 ftp 1.sync 50928 34.21 83889 76.74 0.45 0.30 furnace 4 95335 18.34 146606 40.39 0.45 0.42 key 4.fsa 4754 6.33 67954 2.21 2.86 1.47 rw 1w3r 14490 0.45 15401 0.38 1.18 0.65 q 1.sync 10722 1.13 10722 1.21 0.93 0.52 dpd 7.sync 10457 0.91 10457 0.88 1.03 0.92 elevator 4 16856 1.26 16856 2.01 0.63 >0.01 rw 12.sync 98361 3.10 98361 3.95 0.78 0.41 rw 2w1r 9241 0.40 9241 0.30 1.33 0.04

C-net unfolding smaller or equal ordinary unfoldings In general faster than plain encoding Consistently faster than place-replication (tR)

[R., Schwoon, Baldan 11] [R., Schwoon 13]

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 20 / 38

SLIDE 72

Model Checking with Net Unfoldings

Unfolding analysis

Property to verify

Formalization Modelling

Counterexample / Correct Net unfolding Petri Net Concurrent system

Unfolding construction

Reachability/deadlock

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 21 / 38

SLIDE 73

Reachability Analysis with c-net Unfoldings

[R., Schwoon 12]

Recall For marking-complete prefix PN, deciding reachability of N is NP-complete Reduction to SAT Encodes existence of a configuration Acyclicity constraint for ր is problematic Results Three optimizations to mitigate effects of acyclicity constraint Structural optimizations + logical simplification Tool Cna Experimental evaluation: method is practical and beats established approach on standard benchmark

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 22 / 38

SLIDE 74

Improving Unfolding-based Verification: Outline

Concurrent read access

Unfolding construction for nets with read arcs SAT-based reachability analysis Reduction of size: adequate orders Experimental evaluation

Sequences of choices

Integration with merged processes SAT-based reachability analysis Characterization of mp-configurations Experimental evaluation

Fault diagnosis

(for conventional Petri nets) Generalization to partially-ordered observations Integration of fairness assumptions

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 23 / 38

SLIDE 75

Improving Unfolding-based Verification: Outline

Concurrent read access

Unfolding construction for nets with read arcs SAT-based reachability analysis Reduction of size: adequate orders Experimental evaluation

Sequences of choices

Integration with merged processes SAT-based reachability analysis Characterization of mp-configurations Experimental evaluation

Fault diagnosis

(for conventional Petri nets) Generalization to partially-ordered observations Integration of fairness assumptions

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 23 / 38

SLIDE 76

Unfoldings Suffer from Conflicting Choices

t1 u1 t2 q2 q3 p2 p3 p1 u2 . . . pn tn un pn+1 qn+1 p1 q2 t1 u1 t2 p2 t2 u2 p3 u2 q3 q3 q3 p3 p3 p3 p2 . . . . . . . . . . . . . . . . . . . . . . . .

2n copies of place pn+1 All events reach different markings, no event is a cutoff The prefix is exponential

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 24 / 38

SLIDE 77

Combining Two Methods

We integrate two partial-order representations: Contextual unfoldings: address concurrent read access Merged Processes: address sequences of conflicts

[Khomenko et al. 05]

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 25 / 38

SLIDE 78

Combining Two Methods

We integrate two partial-order representations: Contextual unfoldings: address concurrent read access Merged Processes: address sequences of conflicts

[Khomenko et al. 05]

These methods address orthogonal sources of state explosion:

t1 u1 t2 q2 q3 p2 p3 p1 u2 . . . pn tn un pn+1 qn+1 p1 q2 t1 u1 t2 p2 t2 u2 p3 u2 q3 q3 q3 p3 p3 p3 p2 . . . . . . . . . . . . . . . . . . . . . . . .

Net = Merged Process (Contextual) Unfolding

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 25 / 38

SLIDE 79

Combining Two Methods

We integrate two partial-order representations: Contextual unfoldings: address concurrent read access Merged Processes: address sequences of conflicts

[Khomenko et al. 05]

These methods address orthogonal sources of state explosion:

pn . . . tn t1 t p1 t t1 . . . p1 pn tn p1 pn t t t

C-net = Contextual unfolding Merged Process

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 25 / 38

SLIDE 80

Combining Two Methods

We integrate two partial-order representations: Contextual unfoldings: address concurrent read access Merged Processes: address sequences of conflicts

[Khomenko et al. 05]

Resulting method: Contextual Merged Processes (CMPs)

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 25 / 38

SLIDE 81

Contextual Merged Processes: Main Idea

Definition

[R., Schwoon, Khomenko 13]

The Contextual Merged Process (CMP) of the unfolding prefix PN is the labelled c-net MN resulting from

Merging all conditions with same occurrence depth and label

Eliminating duplicated events

t2 t1 t p 3 2 1 1 1 1 1 3 2 1 1 1 1 1 1 1 1 1 3 1 2 1

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 26 / 38

SLIDE 82

CMPs are in General not Acyclic

N

p5 t1 t2 p3 p2 p4 t3 t4 p1

PN

1 1 1 1 2 1 2 1 1

MN

1 1 1 2 2 1 1

Problem: CMPs have loops, transitions may fire more than once Prevents direct application of SAT-based analysis methods

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 27 / 38

SLIDE 83

CMPs are in General not Acyclic

N PN MN Problem: CMPs have loops, transitions may fire more than once Prevents direct application of SAT-based analysis methods

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 27 / 38

SLIDE 84

Acyclic Runs in CMPs

[R., Schwoon, Khomenko 13]

Proposition If PN is marking-complete then, N’s state-space is represented by MN’s ր-acyclic runs Corollary: reachability of N is NP-complete on PN

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 28 / 38

SLIDE 85

Acyclic Runs in CMPs

[R., Schwoon, Khomenko 13]

Proposition If PN is marking-complete then, N’s state-space is represented by MN’s ր-acyclic runs Corollary: reachability of N is NP-complete on PN Acyclicity of ր prevents both Contextual cycles involving read arcs (from c-net unfoldings) Cycles of causality (from merging)

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 28 / 38

SLIDE 86

Acyclic Runs in CMPs

[R., Schwoon, Khomenko 13]

Proposition If PN is marking-complete then, N’s state-space is represented by MN’s ր-acyclic runs Corollary: reachability of N is NP-complete on PN Acyclicity of ր prevents both Contextual cycles involving read arcs (from c-net unfoldings) Cycles of causality (from merging) Additional results Reduction to SAT of reachability queries on N Encoding of mp-configurations into SAT (for direct construction)

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 28 / 38

SLIDE 87

Experiments with CMPs: Corbett Benchmarks

Benchmark Unfolding Merged Process Name |T| Plain Contextual Plain Contextual Bds 59 21.73 5.73 1.14 44 Brujin 165 3.22 1.64 1.44 127 Byz 409 46.11 25.57 1.03 303 Ftp 529 85.74 82.51 1.05 455 Knuth 137 2.88 1.59 1.31 112 Dme(8) 392 10.64 10.64 1.04 360 Dme(10) 490 15.53 15.53 1.04 450 Elev(3) 783 6.48 6.48 1.00 346 Elev(4) 1939 11.38 11.38 1.00 841 Key(2) 92 3.92 1.82 2.50 105 Key(3) 133 19.93 4.33 4.13 186 Key(4) 174 113.82 12.54 5.26 290 Mmgt(3) 172 4.01 4.01 1.00 355 Mmgt(4) 232 11.68 11.68 1.00 638 [R., Schwoon, Khomenko 13]

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 29 / 38

SLIDE 88

CMPs of Dijkstra’s Mutual Exclusion Algorithm

b[0] = false; b[1] = false; while (k != 0) { while (k != 1) { if (b[k]) k = 0; if (b[k]) k = 1; } } ... ... /* critical section / / critical section */ ... ... [R., Schwoon, Khomenko 13]

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 30 / 38

SLIDE 89

CMPs of Dijkstra’s Mutual Exclusion Algorithm

b[0] = false; b[1] = false; while (k != 0) { while (k != 1) { if (b[k]) k = 0; if (b[k]) k = 1; } } ... ... /* critical section / / critical section */ ... ...

k=1 b0=t b1=t k = 0 c1 = f ? c1=f l1,0 l4,0 l2,0 b0 := f k = 0? c0 := f l5,0 l6,0 c0=t c0=f c0 := t l3,0 k = 1? k := 0 k = 1, bk = t? c1=t b0=f l0,0 ∀j = 0, cj = t? b0 := t; c0 := t

[R., Schwoon, Khomenko 13]

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 30 / 38

SLIDE 90

CMPs of Dijkstra’s Mutual Exclusion Algorithm

Net Unfoldings Merged Processes n |T| Petri Net C-net Petri Net C-net 2 18 54 35 42 31 3 36 371 131 113 64 4 60 2080 406 220 105 5 90 10463 1139 375 155 6 126 49331 3000 589 214 m ∝ 5m ∝ 3m ∝ m1.5 ∝ m

k=1 b0=t b1=t k = 0 c1 = f ? c1=f l1,0 l4,0 l2,0 b0 := f k = 0? c0 := f l5,0 l6,0 c0=t c0=f c0 := t l3,0 k = 1? k := 0 k = 1, bk = t? c1=t b0=f l0,0 ∀j = 0, cj = t? b0 := t; c0 := t

[R., Schwoon, Khomenko 13]

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 30 / 38

SLIDE 91

Improving Unfolding-based Verification: Outline

Concurrent read access

Unfolding construction for nets with read arcs SAT-based reachability analysis Reduction of size: adequate orders Experimental evaluation

Sequences of choices

Integration with merged processes SAT-based reachability analysis Characterization of mp-configurations Experimental evaluation

Fault diagnosis

(for conventional Petri nets) Generalization to partially-ordered observations Integration of fairness assumptions

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 31 / 38

SLIDE 92

Improving Unfolding-based Verification: Outline

Concurrent read access

Unfolding construction for nets with read arcs SAT-based reachability analysis Reduction of size: adequate orders Experimental evaluation

Sequences of choices

Integration with merged processes SAT-based reachability analysis Characterization of mp-configurations Experimental evaluation

Fault diagnosis

(for conventional Petri nets) Generalization to partially-ordered observations Integration of fairness assumptions

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 31 / 38

SLIDE 93

Diagnosis — Classical Approach

Partially-observable system S

[Sampath, Sengupata, Lafortune, Sinnamohideen, Teneketzis 95]

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 32 / 38

SLIDE 94

Diagnosis — Classical Approach

Partially-observable system S Observation a b g

[Sampath, Sengupata, Lafortune, Sinnamohideen, Teneketzis 95]

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 32 / 38

SLIDE 95

Diagnosis — Classical Approach

Partially-observable system S

a 7 1 11 12 a b g 7 1 8 9 10 a f b g 2 1 3 4 5 f b g

Explanations expl(abg) Observation a b g

[Sampath, Sengupata, Lafortune, Sinnamohideen, Teneketzis 95]

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 32 / 38

SLIDE 96

Diagnosis — Classical Approach

Partially-observable system S

a 7 1 11 12 a b g 7 1 8 9 10 a f b g 2 1 3 4 5 f b g

Explanations expl(abg) Observation a b g Diagnosis problems: Any/some run that explains the observation contains a fault?

[Sampath, Sengupata, Lafortune, Sinnamohideen, Teneketzis 95]

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 32 / 38

SLIDE 97

Diagnosis — Classical Approach

Partially-observable system S

a 7 1 11 12 a b g 7 1 8 9 10 a f b g 2 1 3 4 5 f b g

Explanations expl(abg) Diagnoser Sd Observation a b g Diagnosis problems: Any/some run that explains the observation contains a fault?

[Sampath, Sengupata, Lafortune, Sinnamohideen, Teneketzis 95]

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 32 / 38

SLIDE 98

Diagnosis — Unfolding-based Approach

t4 t2 t3 t5 t6 t1

Partially-observable system S

t1 t3 t3 t3 t6 t1 t6

Explanations Diagnoser Sd Observation: sequential or partially-ordered

[Benveniste, Fabre, Haar, Jard 03]

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 33 / 38

SLIDE 99

Contribution

[SSLST95] [BFHJ03] Interleaving explosion ✗ ✓ Partial-order observations ✗ ✓ Unobservable loops ✗ ✗

[SSLST95]: Sampath, Sengupata, Lafortune, Sinnamohideen, Teneketzis 95 [BFHJ03]: Benveniste, Fabre, Haar, Jard 03

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 34 / 38

SLIDE 100

Contribution

[SSLST95] [BFHJ03] [EK12] Interleaving explosion ✗ ✓ ✓ Partial-order observations ✗ ✓ ✗ Unobservable loops ✗ ✗ ✓

[SSLST95]: Sampath, Sengupata, Lafortune, Sinnamohideen, Teneketzis 95 [BFHJ03]: Benveniste, Fabre, Haar, Jard 03 [EK12]: Esparza, Kern 12

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 34 / 38

SLIDE 101

Contribution

[SSLST95] [BFHJ03] [EK12] This thesis Interleaving explosion ✗ ✓ ✓ ✓ Partial-order observations ✗ ✓ ✗ ✓ Unobservable loops ✗ ✗ ✓ ✓

[SSLST95]: Sampath, Sengupata, Lafortune, Sinnamohideen, Teneketzis 95 [BFHJ03]: Benveniste, Fabre, Haar, Jard 03 [EK12]: Esparza, Kern 12 This thesis: Haar, R., Schwoon 13

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 34 / 38

SLIDE 102

Contribution

[SSLST95] [BFHJ03] [EK12] This thesis Interleaving explosion ✗ ✓ ✓ ✓ Partial-order observations ✗ ✓ ✗ ✓ Unobservable loops ✗ ✗ ✓ ✓ Fairness ✗ ✗ ✗ ✓

[SSLST95]: Sampath, Sengupata, Lafortune, Sinnamohideen, Teneketzis 95 [BFHJ03]: Benveniste, Fabre, Haar, Jard 03 [EK12]: Esparza, Kern 12 This thesis: Haar, R., Schwoon 13

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 34 / 38

SLIDE 103

Diagnosis with Unobservable Loops

[Haar, R., Schwoon 13]

Diagnosis Problem Given observation α, decide whether all explanations in expl(α) contain a fault Main challenge expl(α) may be infinite due to unobservable loops Define class of succinct explanations expl(α) contains only finitely many ones So they fit in a finite unfolding prefix Pα! Results Cutoff criteria for constructing Pα SAT-based decision procedure Generalize [EK12] to partially-ordered observations

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 35 / 38

SLIDE 104

Weak Diagnosis: Diagnosis + Fairness

[Haar, R., Schwoon 13]

Weak fairness: if some transition gets enabled, eventually it is disabled Weak Diagnosis Problem Given observation α, decide whether any fair execution that contains an explanation in expl(α), also contains a fault Main challenge Need finite representation of maximal configurations of the unfolding that permits for checking set inclusion Maximal configurations repeat spoiling paths that can be cut off Results Cutoff criteria for building the representative prefixes SAT-based decision procedure

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 36 / 38

SLIDE 105

Conclusions

Concurrent read access

Unfolding construction for nets with read arcs SAT-based reachability analysis Reduction of size: adequate orders Experimental evaluation

Sequences of choices

Integration with merged processes SAT-based reachability analysis Characterization of mp-configurations Experimental evaluation

Fault diagnosis

(for conventional Petri nets) Generalization to partially-ordered observations Integration of fairness assumptions

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 37 / 38

SLIDE 106

Perspectives

Unfoldings for other higher-level formalisms

Such as software

Unfoldings vs. partial-order reductions

How can each profit from the strengths of the other?

How much is worth to remember?

Contextual Merged Processes: direct construction

Unfoldings and abstract interpretation

Unfoldings are exact abstractions of concurrency

C´ esar Rodr´ ıguez (ENS Cachan) Verification Based on Contextual Unfoldings December 12, 2013 38 / 38