Verification with LoLA: 5 Case Studies

5. Case Studies
Niels Lohmann

Exploring biochemical
The ErbB Network
(CARTOON FORM)
reaction chains

Reaction chains

• Domain: symbolic system biology
• “Symbolic systems biology is the
qualitative and quantitative study of
biological processes as integrated
systems rather than as isolated parts.”
• Property: reachability

Mcf2-act Rhob-GDP Ngef-reloc Trio-act

221-2 798-2 807-2

Cit Prkcl1 Rhob-GTP Diaph1 Rock1 Ktn1

591-2 581-2 680-2 679-4 700-2

f1-act Crkl-reloc Erk2 Prkcl1-act Diaph1-act Diaph1-act Limk1 Myl9 Rock1-act PP1 Ktn1-

03 672 238 671 697

Actin-mono Pfn1 Arp23-act Srf Limk1-act Myl9-phos PP1-inhib

11 732 58

Pxn Vasp Actinin Tns1 Tln-act Integrins-clustered Actin-poly Srf-act Vcl Zyx Ilk:

165 764 713 601 813 1076 1075

Pxn Vasp Src-act Actinin Ptk2-act Tns1 Vcl Zyx Ilk:Lims1:Parva

434

Reaction chains

• “For reachability queries on our nets,
answering a reachability query that would
have taken hours using a general purpose
model-checking tool takes on the order of
a second in LoLA — fast enough to permit
interactive use.”

Finding Hazards in
GALS Circuits

GALS circuits

• Domain: asynchronous/
synchronous hardware design
• prototype for IEEE-802.11 chip
• asynchronous hardware is not
clocked - order/timing of events
makes a difference
• problem: glitch

Glitch
P(a) = 1
a AND P(c) = 0
c
b Gate
P(b) = 0

1
P(a): 0 1
P(c): 0
P(b): 1
0

ΔT
9

Glitch
P(a) = 1
0
a AND P(c) = 0
c
b Gate
P(b) = 0

1
P(a): 0 1
P(c): 0
P(b): 1
0

ΔT
9

Glitch
P(a) = 1 0
0
a AND P(c) = 0 0
c
b Gate
P(b) = 0

1
P(a): 0 1
P(c): 0
P(b): 1
0

ΔT
9

Glitch
P(a) = 1 0
0
a AND P(c) = 0 0
1 c
b Gate
P(b) = 0

1
P(a): 0 1
P(c): 0
P(b): 1
0

ΔT
9

Glitch
P(a) = 1 0
0
a AND P(c) = 0 0 0
1 c
b Gate
P(b) = 0 1

1
P(a): 0 1
P(c): 0
P(b): 1
0

ΔT
9

Glitch
P(a) = 1
a AND P(c) = 0
c
b Gate
P(b) = 0

1
P(a): 0 1
P(c): 0
P(b): 1
0

ΔT
10

Glitch
P(a) = 1
a AND P(c) = 0
1 c
b Gate
P(b) = 0

1
P(a): 0 1
P(c): 0
P(b): 1
0

ΔT
10

Glitch
P(a) = 1
a AND P(c) = 0 1
1 c
b Gate
P(b) = 0 1

1
P(a): 0 1
P(c): 0
P(b): 1
0

ΔT
10

Glitch
P(a) = 1
0
a AND P(c) = 0 1
1 c
b Gate
P(b) = 0 1

1
P(a): 0 1
P(c): 0
P(b): 1
0

ΔT
10

Glitch
P(a) = 1 0
0
a AND P(c) = 0 1 0
1 c
b Gate
P(b) = 0 1

1
P(a): 0 1
P(c): 0
P(b): 1
0

ΔT
10

Glitch
P(a) = 1 0
0
a AND P(c) = 0 1 0
1 c
b Gate
P(b) = 0 1 Hazard

1
P(a): 0 1
P(c): 0
P(b): 1
0

ΔT
10

Petri Net Model of AND

a

• Events c
• Level
• Logics
b

Petri Net Model of AND
(P(a),P(b))

a 01

• Events 11
c
• Level
• Logics
00
b

10

GALS circuits
• Property: reachability
• Problem:
• partial order reduction not effective
enough in isolation
• sweep line helped
• initial model: 204 places/368 transitions;
manual abstractions necessary
• found 8 hazards,
2 were actual problems
gals

Verifying Service
Choreographies

Service Choreography

• Domain: service-oriented
architectures
• Original model: BPEL4Chor
• translation: compiler
BPEL2oWFN
• Design ﬂaw in chorgrography
model.
• Property: deadlock freedom

• ein Reisenderer, ein Reisebüro, mehrere
Fluglinien


bpel4chor

• Komposition kann verklemmen!

bpel4chor

Case Study
airline instances

Analyzing BPEL4Chor - Veriﬁcation and Partner Synthesis
1 5 10 100 1000
places 20 63 113 1013 10013
transitions 10 41 76 706 7006
states ! 14 3483 9806583 % %
states " 14 561 378096 % %
states # 11 86 261 18061 1752867
states $ 11 30 50 410 4010
 complete
complete/unreduced
!  symmetries
"  stubbornreduction
symmetry sets
#  symmetriesreduction
partial order and stubborn sets
$  overflow reduction and partial order reduction
symmetry (>2 GB)

Case Study
airline instances

1 5 10 100 1000
places 20 63 113 1013 10013
transitions 10 41 76 706 7006
states ! 14 3483 9806583 %exponential
%
states " 14 561 378096 % growth 
%
states # 11 86 261 18061 1752867
states $ 11 30 50 410 4010
 complete
complete/unreduced
!  symmetries
symmetry sets
symmetry (>2 GB)

Case Study
airline instances

1 5 10 100 1000
places 20 63 113 1013 10013
transitions 10 41 76 706 7006
states ! 14 3483 9806583 %exponential
%
states " 14 561 378096 % growth 
%
states # 11 86 261 18061 1752867
states $ 11 30 50 410 4010
 complete linear
complete/unreduced
!  symmetries
symmetry sets growth 
symmetry (>2 GB)

Soundness of
Business Processes
M2
M1
J1
F1

Soundness

• 735 real-world business processes
from IBM customers
• original formalism: UML dialect
from the IBM Websphere Business
Modeler
• translation: compiler UML2oWFN
• original question: can soundness
be veriﬁed using model checking
techniques

Soundness
• “IBM Soundness” = absence of
• lack of synchronization (= unsafe marking)
• deadlock (= deadlock)
• + certain assumptions on the structure
• for LoLA: two checks
• Is the ﬁnal marking life?
• Is the net safe?

Soundness
for each SESE fragment

matches
"
structural heuristics?
!/
A

B SESE "
translation C decomposition sound counterexample
business process
model workflow graph SESE fragments soundness check analysis result
(plain state space)

choice depends on SESE fragment
IBM WebSphere Business Modeler / SESE approach

liveness check

!/
(reduced state space)
translation "
sound counterexample

Petri net safeness check analysis result
(reduced state space)
always perform both checks
LoLA

trivial workflow net? !
sound

extension to structural analysis result
workflow net reduction
workflow net reduced workflow net soundness check
(structure and
state space)
!/
sound
"
structural information

analysis result
Compiler Woflan choice depends on net structure

Soundness
• execution scheduled and optimized using
Makeﬁles
• max. 50 ms per check
• “analysis on demand”

• observed effect: structural reduction
techniques do not pay off when using
stubborn sets

soundness

Veriﬁcation of
Concurrent Programs

Concurrent Programs
• concurrent processes
• shared and global variables
• goal: ﬁnd Aa. small-model roening, and T . Wahl
650 K aiser, D . K
property
to make a statement on the correctness of
an arbitrary number of instances
|R n |
|R| |R|
(a) (b)

n
m c

Concurrent Programs
• problem can be solved by checking for
reachable states in a coverability graph
• challenge: number of places = number of
states of a process
• concurrency only through tokens
• it took a while to beat LoLA

concurrent

AI Planning
• setting: smart conference room
• several projectors, canvases, documents,
and lamps
• AI planning problem: Conﬁgure the room to
display document A on that canvas.
• original formalism: proprietary
planning language; manually translated

AI Planning
• straightforward translation to state predicate
Goals: FORMULA
( LightOn 1 Lamp1 ); LightOn.<Lamp1|TRUE> = 1 AND
( LightOn 1 Lamp2 ); LightOn.<Lamp2|TRUE> = 1 AND
( DocShown 1 Doc1 LW3 ); DocShown.<Doc1|LW3|TRUE> = 1 AND
( DocShown 1 Doc2 LW1 ); DocShown.<Doc2|LW1|TRUE> = 1 AND
( CanvasDown 1 VD1 ); CanvasDown.<VD1|TRUE> = 1

• system is extremely concurrent
• depth-ﬁrst search actually ﬁnds shortest path
planner

Verification with LoLA: 5 Case Studies

Recommended

Recommended

More Related Content

Viewers also liked

Viewers also liked (7)

Similar to Verification with LoLA: 5 Case Studies

Similar to Verification with LoLA: 5 Case Studies (10)

More from Universität Rostock

More from Universität Rostock (20)

Recently uploaded

Recently uploaded (20)

Verification with LoLA: 5 Case Studies

Editor's Notes