GRIP: Generic Representatives in PRISM

Abstract

We give an overview of GRIP, a symmetry reduction tool for the probabilistic model checker PRISM, together with experimental results for a selection of example specifications. An Overview of GRIPGRIP (generic representatives in PRISM), introduced in [1], is a symmetry reduction tool for the PRISM model checker [6]. GRIP is based on the generic representatives approach of [2], which aims to overcome the inherent problem of combining symmetry reduction with symbolic state-space representation. We present an overview of GRIP version 2.0 (referred to henceforth as GRIP), an improved version of the original tool, and compare GRIP to PRISM-symm, an alternative symmetry reduction tool for PRISM [5]. GRIP, together with the PRISM examples used for experiments in Section 3 can be downloaded from our website [4].The top panel of Figure 1 shows a simple leader election protocol in PRISM, adapted from [1]. The underlying model here is a Markov decision process (MDP). GRIP works by translating this specification into a reduced form, as shown in the bottom-left panel of the figure. The reduced specification abstracts away from specific modules, instead using a single generic module comprised of variables which count the number of modules in each potential local state. Symmetric temporal properties can also be translated into reduced form. PRISM can then be used, unchanged, to check reduced properties of a reduced specification. New Features of GRIPThe original version of GRIP required specifications to consist of multiple instantiations of a single symmetric module type, specified using a single local state variable. This model of computation is in keeping with the presentation of the generic representatives approach for non-probabilistic model checking [2]. While a wide class of symmetric systems can, in theory, be specified in this way, accurately modelling complex protocols via a single state variable quickly becomes impractical. GRIP now supports: multiple local state variables; a wide range of arithmetic and boolean expressions over these variables; communication via shared global variables, and multiple asymmetric modules in parallel with a single family of symmetric modules. In addition, GRIP handles models with continuous time Markov chain (CTMC) semantics.Multiple local variables can result in a large number of local states, which translates to many counters in the specification output by GRIP. This in turn can lead to large MTBDDs (the symbolic data structure used by PRISM). To combat this, we have implemented an optimisation suggested in [3]: we use PRISM for local reachability analysis during the translation process, to reduce the number of counters in the output specification. In addition, since the sum of counter variables should always equal N (the number of symmetric modules), the last counter variable can be eliminated and replaced with the formulaThis second optimisation offers a modest reduction in MTBDD size. The bottom-right panel of Figure 1 shows the effect of these optimisations: local reachabi...

Replication and Abstraction: Symmetry in Automated Formal Verification

“…The idea of counter abstraction is readily extended to achieve symmetry reduction in probabilistic model checking [77]. The GRIP tool (Generic Representatives in PRISM) [78,79] translates symmetric PRISM programs into a counter-abstract form for analysis by the probabilistic model checker PRISM. GRIP provides an alternative to PRISM-SYMM, the method of exploiting symmetry built into PRISM (see Section 5.6).…”

“…The rule is illegal: the guard breaks symmetry by comparing scalarset variables using < and ≥. The idea of tailoring an input language so that symmetry information can be automatically inferred is the basis for several purpose-built symmetry reduction tools, including SMC [38] (see Section 4.4), SVISS [58] (see Section 5.6) and GRIP [78] (see Section 6). These approaches all share the limitation that they can only handle full symmetry between components of the same type.…”

Quantitative Verification Techniques for Biological Processes

“…One example is the statistical based model-checker Ymer [37], which performs approximate CSL model checking of CTMCs expressed as PRISM models, using discrete-event simulation and sequential acceptance sampling (for a detailed comparison of the merits of this approach and the probabilistic model checking techniques used by PRISM, see [38]). Another example is the tool GRIP (Generic Representatives In PRISM) [7], which performs language-level symmetry reduction of PRISM models based on the generic representatives approach of [8]. Further support for symmetry reduction is provided by PRISM-symm [19], a prototype extension of PRISM which uses an efficient symbolic (MTBDD-based) implementation.…”

Language-Level Symmetry Reduction for Probabilistic Model Checking

“…The approach was extended to probabilistic model checking [7] via the definition of Symmetric PRISM, a precursor to SPSL. A tool paper describing a preliminary version of the GRIP tool appeared as [8].…”

“…This is particularly beneficial in the context of probabilistic model checking since, for many state-of-the-art implementations (including the PRISM tool, to which we apply our techniques), both model size (number of states) and the size of a symbolic representation are critical. Initial results applying symmetry reduction by generic representatives to probabilistic model checking indicate that this is indeed the case [7], [8].…”