Parallel symbolic state-space exploration is difficult, but what is the alternative?

State-space exploration is an essential step in many modeling and analysis problems. Its goal is to find the states reachable from the initial state of a discrete-state model described. The state space can used to answer important questions, e.g., "Is there a dead state?" and "Can N become negative?", or as a starting point for sophisticated investigations expressed in temporal logic. Unfortunately, the state space is often so large that ordinary explicit data structures and sequential algorithms cannot cope, prompting the exploration of (1) parallel approaches using multiple processors, from simple workstation networks to shared-memory supercomputers, to satisfy large memory and runtime requirements and (2) symbolic approaches using decision diagrams to encode the large structured sets and relations manipulated during state-space generation. Both approaches have merits and limitations. Parallel explicit state-space generation is challenging, but almost linear speedup can be achieved; however, the analysis is ultimately limited by the memory and processors available. Symbolic methods are a heuristic that can efficiently encode many, but not all, functions over a structured and exponentially large domain; here the pitfalls are subtler: their performance varies widely depending on the class of decision diagram chosen, the state variable order, and obscure algorithmic parameters. As symbolic approaches are often much more efficient than explicit ones for many practical models, we argue for the need to parallelize symbolic state-space generation algorithms, so that we can realize the advantage of both approaches. This is a challenging endeavor, as the most efficient symbolic algorithm, Saturation, is inherently sequential. We conclude by discussing challenges, efforts, and promising directions toward this goal

Hierarchical Set Decision Diagrams and Regular Models

This paper presents algorithms and data structures that exploit a compositional and hierarchical specification to enable more efficient symbolic model-checking. We encode the state space and transition relation using hierarchical Set Decision Diagrams (SDD) [9]. In SDD, arcs of the structure are labeled with sets, themselves stored as SDD. To exploit the hierarchy of SDD, a structured model representation is needed. We thus introduce a formalism integrating a simple notion of type and instance. Complex composite behaviors are obtained using a synchronization mechanism borrowed from process calculi. Using this relatively general framework, we investigate how to capture similarities in regular and concurrent models. Experimental results are presented, showing that this approach can outperform in time and memory previous work in this area

Formal Verification of the Runway Safety Monitor

The Runway Safety Monitor (RSM) designed by Lockheed Martin is part of NASA's effort to reduce runway accidents. We developed a Petri net model of the RSM protocol and used the model checking functions of our tool SMART to investigate a number of safety properties in RSM. To mitigate the impact of state-space explosion, we built a highly discretized model of the system, obtained by partitioning the monitored runway zone into a grid of smaller volumes and by considering scenarios involving only two aircraft. The model also assumes that there are no communication failures, such as bad input from radar or lack of incoming data, thus it relies on a consistent view of reality by all participants. In spite of these simplifications, we were able to expose potential problems in the RSM conceptual design. Our findings were forwarded to the design engineers, who undertook corrective action. Additionally, the results stress the efficiency attained by the new model checking algorithms implemented in SMART, and demonstrate their applicability to real-world systems

Incremental, Inductive Coverability

We give an incremental, inductive (IC3) procedure to check coverability of well-structured transition systems. Our procedure generalizes the IC3 procedure for safety verification that has been successfully applied in finite-state hardware verification to infinite-state well-structured transition systems. We show that our procedure is sound, complete, and terminating for downward-finite well-structured transition systems---where each state has a finite number of states below it---a class that contains extensions of Petri nets, broadcast protocols, and lossy channel systems. We have implemented our algorithm for checking coverability of Petri nets. We describe how the algorithm can be efficiently implemented without the use of SMT solvers. Our experiments on standard Petri net benchmarks show that IC3 is competitive with state-of-the-art implementations for coverability based on symbolic backward analysis or expand-enlarge-and-check algorithms both in time taken and space usage.Comment: Non-reviewed version, original version submitted to CAV 2013; this is a revised version, containing more experimental results and some correction

Exposure to Endocrine Disruptors and Nuclear Receptors Gene Expression in Infertile and Fertile Men from Italian Areas with Different Environmental Features

Internal levels of selected endocrine disruptors (EDs) (i.e., perfluorooctane sulfonate (PFOS), perfluorooctanoic acid (PFOA), di-2-ethylhexyl-phthalate (DEHP), mono-(2-ethylhexyl)-phthalate (MEHP), and bisphenol A (BPA)) were analyzed in blood/serum of infertile and fertile men from metropolitan, urban and rural Italian areas. PFOS and PFOA levels were also evaluated in seminal plasma. In peripheral blood mononuclear cells (PBMCs) of same subjects, gene expression levels of a panel of nuclear receptors (NRs), namely estrogen receptor α (ERα) estrogen receptor β (ERβ), androgen receptor (AR), aryl hydrocarbon receptor (AhR), peroxisome proliferator-activated receptor γ (PPARγ) and pregnane X receptor (PXR) were also assessed. Infertile men from the metropolitan area had significantly higher levels of BPA and gene expression of all NRs, except PPARγ, compared to subjects from other areas. Subjects from urban areas had significantly higher levels of MEHP, whereas subjects from rural area had higher levels of PFOA in both blood and seminal plasma. Interestingly, ERα, ERβ, AR, PXR and AhR expression is directly correlated with BPA and inversely correlated with PFOA serum levels. Our study indicates the relevance of the living environment when investigating the exposure to specific EDs. Moreover, the NRs panel in PBMCs demonstrated to be a potential biomarker of effect to assess the EDs impact on reproductive health

Distributed Saturation

The Saturation algorithm for symbolic state-space generation, has been a recent break-through in the exhaustive veri cation of complex systems, in particular globally-asyn- chronous/locally-synchronous systems. The algorithm uses a very compact Multiway Decision Diagram (MDD) encoding for states and the fastest symbolic exploration algo- rithm to date. The distributed version of Saturation uses the overall memory available on a network of workstations (NOW) to efficiently spread the memory load during the highly irregular exploration. A crucial factor in limiting the memory consumption during the symbolic state-space generation is the ability to perform garbage collection to free up the memory occupied by dead nodes. However, garbage collection over a NOW requires a nontrivial communication overhead. In addition, operation cache policies become critical while analyzing large-scale systems using the symbolic approach. In this technical report, we develop a garbage collection scheme and several operation cache policies to help on solving extremely complex systems. Experiments show that our schemes improve the performance of the original distributed implementation, SmArTNow, in terms of time and memory efficiency

Pseudoxanthoma elasticum and reflectance confocal microscopy: report of two affected young sisters

Pseudoxanthoma elasticum (PXE) is a rare inherited multisystem disorder that mainly affects skin, eyes and cardiovascular system. The associated clinical signs are due to progressive calcification of elastic fibres and blood vessels, despite normal levels of calcium and phosphorus in blood and urine. The first clinical description of the disease was done in 1881 by Rigal, and in 1896 it was named PXE by Darier. Transmission of the disease is autosomal recessive. PXE is caused by homozygous or compound heterozygous mutations in the ATP-binding cassette subfamily C member 6 (ABCC6) gene, which encodes a transmembrane transport ADP-dependent protein (MRP6). The gene is expressed predominantly in the liver and kidney, and found in low level in the tissue involved by PXE. The clinical expression of PXE is heterogeneous with considerable variation in age of onset, progression and severity of the disease, even in individuals of the same family with identical mutations. We present the case of two young sisters affected by PXE and the correlation between the histopathology and the reflectance confocal microscopy (RCM). Parents and brother carry one copy of the mutated gene, without showing signs and symptoms of the disorder. We report the main clinical aspects of PXE and we highlight the importance of early diagnosis of the disease for adequate therapeutical management of associated complications

Congenital Glioblastoma multiforme and eruptive disseminated Spitz nevi

Background: Glioblastoma multiforme (GBM) is the deadliest malignant primary brain tumor in adults. GBM develops primarily in the cerebral hemispheres but can develop in other parts of the central nervous system. Its congenital variant is a very rare disease with few cases described in literature. Case presentation: We describe the case of a patient with congenital GBM who developed eruptive disseminated Spitz nevi (EDSN) after chemotherapy. Few cases of EDSN have been described in literature and this rare clinical variant, which occurs predominantly in adults, is characterized by multiple Spitz nevi in the trunk, buttocks, elbows and knees. There is no satisfactory treatment for EDSN and the best therapeutic choice is considered the clinical observation of melanocytic lesions. Conclusion: We recommend a close follow-up of these patients with clinical observation, dermoscopy and reflectance confocal microscopy (RCM). However, we suggest a surgical excision of the lesions suspected of being malignant