SPIN
Seach Optimization
• Exhaustive search requires so much time and memory
• to perform verification realistically, must perform some shortcuts– reduce the number of reachable states– reduce the amount of memory required to
represent a state
Agenda
• Search Algorithm• Search Optimization
– Reduction of the number of reachable states– Reduction of the amount of memory
• lossless method– State Compression– Minimized automaton representation
• lossy method– Bit state hashing– Bloom Filter– Hash Compact
Partial Order Reduction
• 考えられる実行順序– 1 : x = 1;g = g+2;y = 1 ;g = g*2;– 2 : x = 1;y = 1 ;g = g+2 ;g = g*2;– 3 : x = 1;y = 1 ;g = g*2 ;g = g+2;– 4 : y = 1;g = g*2 ;x = 1 ;g = g+2; – 5 : y = 1;x = 1 ;g = g*2 ;g = g+2;– 6 : y = 1;x = 1 ;g = g+2;g = g*2;
P1 : x = 1; g = g+2;
P2 : y = 1 g = g*2
Partial Order Reduction
• x = 1 と y = 2 と (g = g + 2, g= g * 2) は独立
• 重要なのは g = g+2, g = g * 2 の順序のみ– 2 : x = 1;y = 1 ;g = g+2 ;g = g*2;– 3 : x = 1;y = 1 ;g = g*2 ;g = g+2;
の二つについてのみ探索を行えば十分
Statement Merging
• if permissible, merge adjacent statements (operations) into one
• if there is a possibility that a different process might interleave between statements, this is not possible– eg: when global variables are accessed conse
cutively
• It is a special case of Partial Order Reduction
adjacent: 隣接する
Agenda
• Search Algorithm• Search Optimization
– Reduction of the number of reachable states– Reduction of the amount of memory
• lossless method– State Compression– Minimized automaton representation
• lossy method– Bit state hashing– Bloom Filter– Hash Compact
State Compression
• 各プロセスの状態表現に P[bits] – プロセス数が n なら状態表現に nP[bits] 必要– しかし P[bits] で表現される全ての状態に到達
するわけではない。– よって P[bits] は情報量として冗長– 各プロセス毎に到達した状態に unique な番
号を割り振って、全状態としてはその番号の組み合わせを記憶する。
State Compression
• e.g.– P1 : integer x, y , z; P2 : integer a, b , c;– the size of memory to represent a state of each
process is 24bits.– the number of reachable states is 5,000– the number of reachable states of each process is
100 ( <= 256 = 2^8)• If states is represented straightforwardly, you
need …– (24 + 24)*5,000 = 240,000 [bits]
• If you use this method, you need only …– (100 + 100)*24 + 8 * 5,000 = 44,800 [bits]
Minimized automaton representation
• 状態が到達済みかどうかの判定を OBDDを利用して行う。
• OBDD– bit 列の入力に対して、真偽を判断するための
データ構造• 戦略
– 状態 S をビット列に変換– OBDD で到達済みか判断。– 到達済みでないなら、 OBDD を更新する。
OBDD
• BDD (Binary Decision Diagram)– bit 列 [b0,b1, …] に対して true, false を判定する
automaton– 各 vertex が b0,b1, … に対応 edges が bit の値に対応
• OBDD– BDD に以下の条件を加えたもの。– b0,b1,b2, … の順に処理– 同じ構造のツリーはまとめる。– 冗長な vertex は除去
OBDD Structure
b0 b1
b1
b2
F
T
0
1 0
1
1
00
1
(b0,b1,b2) { (0,0,0),(0,0,1),(1,0,1) } →∈ Trueotherwise → False
+ (1,0,0)
Agenda
• Search Algorithm• Search Optimization
– Reduction of the number of reachable states– Reduction of the amount of memory
• lossless method– State Compression– Minimized automaton representation
• lossy method– Bit state hashing– Bloom Filter– Hash Compact
Bit state hashing
• Depth-first search constructs a set of reachable states to conclude whether a state was reached.
• The set is normally implemented using hash table.
Standard implementation
• Standard implementation uses– 8×h + S×r [bits]
• h : the number of slots of a hash table
• S : the size of memory to represent a state
• r : the number of reachable states
• 8 : pointer• m : total size of memory
in the machine
Standard Implementation
• If parameters are ...– m = 10^9 bits ,S = 1000 , r = 10^7– (S ・ r)/m = 10 > 1– coverage of the problem size is only 10%
Bit state hashing
• If we configure the hash table as an array of m bits, using it as a hash table with h = m slots.....– h >> r and coverage close to 100%– when a hash collision happens, we will
conclude incorrectly that a state was visited before.
s0
s1
s2s3
s4
s5
hash collision!!
not reached
h(s0) = 0, h(s1) = 5, h(s2) = 3, h(s3) = 2,h(s4) = 5, h(s5) = 1
0 1 2 3 4 5
h(s0) h(s1)h(s2)h(s3) h(s4)
This state was reached !?
Bloom Filters
push (s) : existed = True hlist = hash(s,k) for h in hlist: if (hash_table[h] is False): existed = False hash_table[h] = True return existed
hash(s,k): return [h0(s),h1(s),...., h_k_1(s)]
Bloom Filters (k = 2)
h0(s0) = 0h1(s0) = 1
h0(s1) = 0h1(s1) = 3
h0(s2) = 3h1(s2) = 1
0 1 2 3 4
OK
OK OKCollision OK
OK
Collision Collision
False Collision
Bloom Filter• After r states is stored, probability that a
certain bit is still false is
• Probability that we incorrectly conclude that the (r + 1)th state was visited
• optimal k (that minimize probability) is
Hash Compact
• Normal Implementation な hash table に State ではなく、 State を hash 関数を使って、より小さい空間に写像したものを渡す。– 当然、写像に使う hash 関数は hashtable 内で利用さ
れているものとは異ならなければならない。• the number of reachable states << hash 値の空
間の大きさ << State 空間の大きさの時効果を発揮する。
• 前者の <<→ 衝突の確率が低い。• 後者の <<→ 保存データサイズの縮小• 要するに State 空間の表現が冗長だよってこと。