![V = { x ∈ [0,5], y ∈ [0,7] }
C = { x + y = 7, x + 1 ≥ 2y }
y
(x ≤ 5) ∧ (x + 1 ≥ 2y)
Integer Bound Propagation
xz
=> y ≤ 3
(x ≤ 5) ∧ (x + y = 7)
=> y ≥ 2
(y ≤ 3) ∧ (x + y = 7)
=> x ≥ 4](https://image.slidesharecdn.com/sefm2015yorksept2015rclariso-slideshare-150915155904-lva1-app6892/85/Towards-Domain-Refinement-for-UML-OCL-Bounded-Verification-16-320.jpg)
![context Part inv UniqueSerials :
Part::allInstances()->isUnique(serial)
context Machine inv MachineAvailability :
Cutter::allInstances()->exists(c|c:idle) and
Grinder::allInstances()->exists(g|g:idle)
Refinement (4/4)
Domain bounds Initial Bound Inferred Bound
Machine
Cutter
Grinder
Part
Uses
Serial
[0, ∞)
[0, ∞)
[0, ∞)
[0, ∞)
[0, ∞)
[0, 10]
[2, 2]
[1, 1]
[1, 1]
[8, 8]
[8, 8]
[8, 8]](https://image.slidesharecdn.com/sefm2015yorksept2015rclariso-slideshare-150915155904-lva1-app6892/85/Towards-Domain-Refinement-for-UML-OCL-Bounded-Verification-26-320.jpg)
![context Part inv UniqueSerials :
Part::allInstances()->isUnique(serial)
context Machine inv MachineAvailability :
Cutter::allInstances()->exists(c|c:idle) and
Grinder::allInstances()->exists(g|g:idle)
Refinement (4/4)
Domain bounds Initial Bound Inferred Bound
Machine
Cutter
Grinder
Part
Uses
Serial
[0, ∞)
[0, ∞)
[0, ∞)
[0, ∞)
[0, ∞)
[0, 10]
[2, 2]
[1, 1]
[1, 1]
[8, 8]
[8, 8]
[8, 8]
One choice
is sufficient
to bind the
state space](https://image.slidesharecdn.com/sefm2015yorksept2015rclariso-slideshare-150915155904-lva1-app6892/85/Towards-Domain-Refinement-for-UML-OCL-Bounded-Verification-27-320.jpg)
![Designer
UML Model
A B
C
Domain Bounds
X = [1,20], Y = [2, 15], ...
Experimental set-up
KodKod Model Finder
Sat4j SAT Solver
UML-based Specification
Environment (USE)](https://image.slidesharecdn.com/sefm2015yorksept2015rclariso-slideshare-150915155904-lva1-app6892/85/Towards-Domain-Refinement-for-UML-OCL-Bounded-Verification-28-320.jpg)
![Designer
Domain Bounds
X = [1,20], Y = [2, 15], ...
UML Model
A B
C
Bound refinement
Experimental set-up
KodKod Model Finder
Sat4j SAT Solver
Bound refinement
UML-based Specification
Environment (USE)](https://image.slidesharecdn.com/sefm2015yorksept2015rclariso-slideshare-150915155904-lva1-app6892/85/Towards-Domain-Refinement-for-UML-OCL-Bounded-Verification-29-320.jpg)
Towards Domain Refinement for UML/OCL Bounded Verification
- 1. Towards Domain Refinement for UML/OCL Bounded Verification Robert Clarisó Universitat Oberta de Catalunya - Spain Carlos A. González AtlanMod team - Inria, Mines Nantes, LINA - France Jordi Cabot ICREA - Spain 13th Int. Conf on SW Enginerering and Formal Methods 8-11 September 2015, York, UK
- 2. Motivation Who? The reader What? Where? Find Wally Inside the page
- 3. Motivation Who? The reader What? Where? Find Wally Inside the page
- 4. Motivation Who? A solver What? Where? Find faults In a bounded state space
- 5. 1. Bounded verification 2. Related work Outline 2. Related work 3. Solution: refinement 4. Experimental results 5. Conclusions
- 6. Model M Model-Based Verification A B C Consistent No contradictions A 1 2 Property P UML Class diagram Non-redundant Lack of duplicities A B C context C inv: self.a-> excludes(self) OCL Invariants Does model M satisfy correctness property P?
- 7. VERIFICATION TOOL Model-based verification: overview ? Model A B C Correctness Formal Notation SAT / CP ?Correctness Property Finite Bounds Designer Feedback Example or ? Counterexample or ? Reasoning Engine
- 8. Bound selection Choose “suitable” verification bounds for the solver Goal CONFIDENCE EFFICIENCY BOUNDSSmall Large Fast Slow Less More
- 9. Bound selection: heuristics Small bounds are sufficient to detect most faults Small scope hypothesis Repeat analysis progressively increasing bounds Incremental scoping
- 10. Our approach: bound refinement VERIFICATION TOOL Model A B C Formal Notation SAT / CP Correctness Property Finite Bounds Reasoning Engine Feedback Example or ? Countexample or ?
- 11. Our approach: bound refinement VERIFICATION TOOL Model A B C Formal Notation SAT / CP Correctness Property Finite Bounds Reasoning Engine Tighter boundsBound refinement Feedback Example or ? Countexample or ?
- 12. Related work Abstract size-related info to reason about size properties Size abstraction Bound propagation Yu et al (FSE’2007) CP solvers e.g. Remove improductive values from verification bounds CP solvers e.g. Interval Constraint Solver in eCLiPSe This work: Size abstraction + Bound propagation Size properties CP solvers Arbitrary SAT
- 13. Running example: production facility context Part inv UniqueSerials : Part::allInstances()->isUnique(serial) context Machine inv MachineAvailability :context Machine inv MachineAvailability : Cutter::allInstances()->exists(c|c:idle) and Grinder::allInstances()->exists(g|g:idle) Property : Strong satisfiability “It should be possible to populate of each non-abstract class while satisfying all integrity constraints”
- 14. context Part inv UniqueSerials : Part::allInstances()->isUnique(serial) context Machine inv MachineAvailability : Running example: size abstraction context Machine inv MachineAvailability : Cutter::allInstances()->exists(c|c:idle) and Grinder::allInstances()->exists(g|g:idle) Multiplicities “4 Parts per Machine” Generalizations “All Cutters are Machines” Invariants “There is at least one Grinder ”
- 15. Size abstraction for OCL OCL Expression Abstract OCL Expression Refers to the values in an instance of the model Refers to the size of the model instance OCL expression Abstraction col->including( object ) Col <= Exp <= Col + 1 col->exists( var | cond ) (0 <= Exp <= 1) ∧ (Col = 0) -> (Exp = 0)
- 16. V = { x ∈ [0,5], y ∈ [0,7] } C = { x + y = 7, x + 1 ≥ 2y } y (x ≤ 5) ∧ (x + 1 ≥ 2y) Integer Bound Propagation xz => y ≤ 3 (x ≤ 5) ∧ (x + y = 7) => y ≥ 2 (y ≤ 3) ∧ (x + y = 7) => x ≥ 4
- 17. context Part inv UniqueSerials : Part::allInstances()->isUnique(serial) context Machine inv MachineAvailability : Cutter::allInstances()->exists(c|c:idle) and Grinder::allInstances()->exists(g|g:idle) Refinement (1/4) Domain bounds Source Machine Cutter Grinder Part Uses Serial Number of objects of type Machine Number of objects of type Cutter Number of objects of type Grinder Number of objects of type Part Number of links in association Uses Number of distinct values of attribute Serial
- 18. context Part inv UniqueSerials : Part::allInstances()->isUnique(serial) context Machine inv MachineAvailability : Cutter::allInstances()->exists(c|c:idle) and Grinder::allInstances()->exists(g|g:idle) Refinement (1/4) Domain bounds Source Machine Cutter Grinder Part Uses Serial Number of objects of type Machine Number of objects of type Cutter Number of objects of type Grinder Number of objects of type Part Number of links in association Uses Number of distinct values of attribute Serial
- 19. Constraint Source context Part inv UniqueSerials : Part::allInstances()->isUnique(serial) context Machine inv MachineAvailability : Cutter::allInstances()->exists(c|c:idle) and Grinder::allInstances()->exists(g|g:idle) Refinement (2/4) Constraint Source Machine = Cutter + Grinder Uses ≤ Part * Machine Uses = 4 * Machine Uses ≤ Part Part ≤ Serial Cutter ≥ 1 Grinder ≥ 1 Generalization + Abstract class Associaton Uses Association end pieces Association end device Invariant UniqueSerials Invariant MachineAvailability Invariant MachineAvailability
- 20. Constraint Source context Part inv UniqueSerials : Part::allInstances()->isUnique(serial) context Machine inv MachineAvailability : Cutter::allInstances()->exists(c|c:idle) and Grinder::allInstances()->exists(g|g:idle) Refinement (2/4) Constraint Source Machine = Cutter + Grinder Uses ≤ Part * Machine Uses = 4 * Machine Uses ≤ Part Part ≤ Serial Cutter ≥ 1 Grinder ≥ 1 Generalization + Abstract class Associaton Uses Association end pieces Association end device Invariant UniqueSerials Invariant MachineAvailability Invariant MachineAvailability
- 21. Constraint Source context Part inv UniqueSerials : Part::allInstances()->isUnique(serial) context Machine inv MachineAvailability : Cutter::allInstances()->exists(c|c:idle) and Grinder::allInstances()->exists(g|g:idle) Refinement (2/4) Constraint Source Machine = Cutter + Grinder Uses ≤ Part * Machine Uses = 4 * Machine Uses ≤ Part Part ≤ Serial Cutter ≥ 1 Grinder ≥ 1 Generalization + Abstract class Associaton Uses Association end pieces Association end device Invariant UniqueSerials Invariant MachineAvailability Invariant MachineAvailability
- 22. Constraint Source context Part inv UniqueSerials : Part::allInstances()->isUnique(serial) context Machine inv MachineAvailability : Cutter::allInstances()->exists(c|c:idle) and Grinder::allInstances()->exists(g|g:idle) Refinement (2/4) Constraint Source Machine = Cutter + Grinder Uses ≤ Part * Machine Uses = 4 * Machine Uses ≤ Part Part ≤ Serial Cutter ≥ 1 Grinder ≥ 1 Generalization + Abstract class Associaton Uses Association end pieces Association end device Invariant UniqueSerials Invariant MachineAvailability Invariant MachineAvailability
- 23. Constraint Source context Part inv UniqueSerials : Part::allInstances()->isUnique(serial) context Machine inv MachineAvailability : Cutter::allInstances()->exists(c|c:idle) and Grinder::allInstances()->exists(g|g:idle) Refinement (2/4) Constraint Source Machine = Cutter + Grinder Uses ≤ Part * Machine Uses = 4 * Machine Uses ≤ Part Part ≤ Serial Cutter ≥ 1 Grinder ≥ 1 Generalization + Abstract class Associaton Uses Association end pieces Association end device Invariant UniqueSerials Invariant MachineAvailability Invariant MachineAvailability
- 24. context Part inv UniqueSerials : Part::allInstances()->isUnique(serial) context Machine inv MachineAvailability : Cutter::allInstances()->exists(c|c:idle) and Grinder::allInstances()->exists(g|g:idle) Refinement (3/4) Domain bounds Initial Bound Inferred Bound Machine Cutter Grinder Part Uses Serial [0, ∞) [0, ∞) [0, ∞) [0, ∞) [0, ∞) [0, ∞)
- 25. context Part inv UniqueSerials : Part::allInstances()->isUnique(serial) context Machine inv MachineAvailability : Cutter::allInstances()->exists(c|c:idle) and Grinder::allInstances()->exists(g|g:idle) Refinement (3/4) Domain bounds Initial Bound Inferred Bound Machine Cutter Grinder Part Uses Serial [0, ∞) [0, ∞) [0, ∞) [0, ∞) [0, ∞) [0, ∞) [2, ∞) [1, ∞) [1, ∞) [8, ∞) [8, ∞) [8, ∞) Inferred bounds with no user input
- 26. context Part inv UniqueSerials : Part::allInstances()->isUnique(serial) context Machine inv MachineAvailability : Cutter::allInstances()->exists(c|c:idle) and Grinder::allInstances()->exists(g|g:idle) Refinement (4/4) Domain bounds Initial Bound Inferred Bound Machine Cutter Grinder Part Uses Serial [0, ∞) [0, ∞) [0, ∞) [0, ∞) [0, ∞) [0, 10] [2, 2] [1, 1] [1, 1] [8, 8] [8, 8] [8, 8]
- 27. context Part inv UniqueSerials : Part::allInstances()->isUnique(serial) context Machine inv MachineAvailability : Cutter::allInstances()->exists(c|c:idle) and Grinder::allInstances()->exists(g|g:idle) Refinement (4/4) Domain bounds Initial Bound Inferred Bound Machine Cutter Grinder Part Uses Serial [0, ∞) [0, ∞) [0, ∞) [0, ∞) [0, ∞) [0, 10] [2, 2] [1, 1] [1, 1] [8, 8] [8, 8] [8, 8] One choice is sufficient to bind the state space
- 28. Designer UML Model A B C Domain Bounds X = [1,20], Y = [2, 15], ... Experimental set-up KodKod Model Finder Sat4j SAT Solver UML-based Specification Environment (USE)
- 29. Designer Domain Bounds X = [1,20], Y = [2, 15], ... UML Model A B C Bound refinement Experimental set-up KodKod Model Finder Sat4j SAT Solver Bound refinement UML-based Specification Environment (USE)
- 30. Experimental results: Summary (1/2) Lightly constrained (“Easy”) Satisfiable Unsatisfiable – Seconds Seconds (“Easy”) Highly constrained (“Hard”) Difficulty +– + Minutes Hours
- 31. Experimental results: Summary (1/2) Lightly constrained (“Easy”) Satisfiable Unsatisfiable No improvement No improvement (“Easy”) Highly constrained (“Hard”) Speed-ups from 1,7x to 11x Speed-ups from 2x to 50x Overhead of bound tightening: <1 second
- 32. Conclusions… in 140 chars Quick preprocessing to make SAT-based verification faster and more usable Target: UML/OCL Up to 50x speed-up TODO: further experiments Tweet0
- 33. Thank you for your attention! Robert Clarisó rclariso@uoc.edu @robertclariso