TEMPORAL TABLEAUX. United Kingdom. ABSTRACT

Transcription

1 A BLACKBOARD APPROACH TO PARALLEL TEMPORAL TABLEAUX ROBERT JOHNSON Department of Computing Manchester Metropolitan University Manchester, M1 5GD United Kingdom tel: (+44) fax: (+44) ABSTRACT Before we can contemplate specifying, verifying and animating reactive systems using temporal logics the computational eectiveness of the reasoning process must be vastly improved. While parallel processing will not decrease the total amount of processing required to solve a problem, (in fact it usually increases it) it has the potential to solve the problem faster than sequential systems by distributing the load for for concurrent computation. We illustrate a mechanism by which we are able to harness the available potential of the tableau method for temporal logic, and give an account of an implementation that will permit us to selectively tailor the amount of parallelism for a particular physical architecture. Our approach builds a single, regulated, shared data structure with many concurrent processes acting on it. 1. Introduction In order to port an existing algorithm to a parallel architecture a number of points must be addressed. Firstly, maximal parallelism must be identied in the algorithm, then a suitable process grain size must be determined, principally to suit the characteristics of the target architecture. The overheads involved with incorporating the parallelism must be deemed not to outweigh the potential benets to be accrued. Finally, an ecient mapping between algorithmic processes and the target architecture must be constructed. Temporal logics are used in order to facilitate reasoning about properties that change with time. Temporal logic formulas used in the modelling of large systems are correspondingly large, and require extensive computation for proof derivation. Thus, This research has been supported by SERC grant GR/J48979

2 a large amount of temporal information must be stored and manipulated during the proof process. Nevertheless, temporal logics have been used for modelling dynamic systems and reasoning about their domains. This reasoning inevitably requires proof procedures. The improved eciency and eectiveness of these is our goal. We are concerned with porting a variety of automated theorem proving techniques to novel parallel and distributed processing architectures. Here we shall restrict our discussion to the tableau method for linear, discrete propositional temporal logic. 4 We will not concern ourselves with possible topologies since the proposed approach is independent of any particular structure, however our design is based on a general message-passing architecture. It is currently being implemented using Strand88. Here we discuss our approach to the design and implementation of a parallel theorem prover for temporal logic. We give a semi-formal description of the original sequential algorithm, then suggest possible parallelisations. Some of these parallelisations maintain the structure of the original algorithm, others require a considerable restructuring of the approach. We then give specic algorithms that describe the function and interactions of a number of concurrent agents that collectively carry out the theorem proving operation. Finally we briey consider the problem of load balancing across a network of processors Notation For Algorithm Specication The notation we employ for the specication of algorithms seeks to present the fundamental processes of the algorithm in a semi-formal structure. Thus a specication may be used both for discussion and coding purposes, it being neither too rigorous for the former, nor too simplistic for the latter. Each statement is presented in the form: <statement number>.<description> Q 1 ; : : : ; Q p : R 1 ; : : : ; R q :: O 1 ; : : : ; O r ; where Q i ; 1 i p represent quantications, R j ; 1 j q represent restrictions on the quantications, and O k ; 1 k r represents the operations to be carried out. This is a coarse derivation of the schema employed in. 3 The restrictions component may have additional nested quantications and further restrictions on them as required. The description and restriction components may however not always be required. Control of statement execution is provided by conventional loop and IF: : :THEN: : :ELSE type constructs. Simplied algorithms may dispense with much of the mathematical nomenclature, relying on the description to convey the function of each statement. Variables that are not temporal logic formulas (or sets of formulas) may in most cases alternatively be viewed as sets of formulas, or as pipes/channels/streams between processes, along which messages ow. It should be stressed that the notation is intended to be exible and is designed as a vehicle for conveying the general semantics of an algorithm rather than for providing a full formal denition. Statements may be nested to describe more complex algorithmic functions. The statement numbers have no semantic relevance and are presented purely for reference purposes. Strand88 is a trademark of Strand Software Technologies Limited. 2

3 2. Wolper's Sequential Algorithm For Temporal Tableau The method described here is a non-analytic extension of the tableau method (described in 4 ). The approach is essentially two-phased. Firstly, it involves constructing a digraph by applying tableau rules to the formulas stored at each node. Then the graph is reduced by the application of reduction rules that enable nodes of the graph to be discarded. If the root node is removed then the supplied formula may be deemed unsatisable. In the sequential case the graph reduction phase commences immediately the graph is fully constructed. The tableau expansion rules are given in. 4 Graph Construction 1. Create node N := (ff g; ;) where F is the formula to be tested G := fn i g; WHILE 9g 2 L i ; g is an unmarked, non-elementary formula, N i 2 G; N i = (L i ; ;) DO 2. Apply tableau rule to f f ) fs i g; 3. Build successor nodes (N si ) to N i ; and mark f as used 8S i :: N si := (S i [ (L i? ffg) [ ff g; ;) where f is f marked as used, N 0 i := (L i; C i [ fs i g) (where s i are the names of the successors), G := (G? N i ) [ fn 0 i ; N sig; 4. If some N j is a state then build prestate N 0 j 8N j : N j = (L j ; ;); 6 9f 2 L j such that f is unmarked and non-elementary :: N sj := (ffj h f 2 L j g; ;); N 0 j := (L j ; fn sj g) (where N sj is a name), G := (G? N j ) [ fn 0 j ; N sjg; END WHILE Graph Reduction REPEAT 5. Set ag to indicate that no graph reduction has occurred so far in this pass reducing := f alse; 6. Delete contradictory nodes 8N i : N i 2 G; N i = (L i ; c i ); f; :f 2 L i :: 8N j : N j 2 G; N j = (L j ; c j ); N i 2 c j :: N 0 j := (L j; c j? fn i g) (where N i is a name in the last two instances); G := (G? (fn j g [ fn i g)) [ fn 0 j g; reducing := true;

4 7. Delete nodes without successors 8N i : N i 2 G; N i = (L i ; ;) :: 8N j : N j 2 G; N j = (L j ; c j ); N i 2 c j :: N 0 j := (L j ; c j? fn i g) (where N i is a name in the last two instances); G := (G? (fn j g [ fn i g)) [ fn 0 jg; reducing := true; 8. Delete nodes in cycles where the prestate eventuality is unsatised 8cycle : cycle = fn i ; N i + 1; : : : ; N j g; cycle G; N j = (L j ; c j ); N i 2 c j (where N i is a name); 9N p : N p 2 cycle; N p is a prestate, i p j; N p = (L p ; c p );}f 2 L p ; 6 9N q : N q 2 cycle; N q = (L q ; c q ); f 2 L q :: G := G? N p ; reducing := true; 6 9. Delete nodes in cycles where the prestate until( U ) eventuality is unsatised 8cycle : cycle = fn i ; N i + 1; : : : ; N j g; cycle G; N j = (L j ; c j ); N i 2 c j (where N i is a name); 9N p : N p 2 cycle; N p is a prestate, i p j; N p = (L p ; c p ); f 1 U f 2 2 L p ; 9N q : N q 2 cycle; N q = (L q ; c q ); f 2 2 L q :: G := G? N p ; reducing := true; UNTIL reducing = false 10. IF G = ; then F is unsatisable ELSE formula F is satisable. If the graph G is successfully reduced to nothing (i.e. we are able to remove the root node) then the supplied formula is unsatisable. Otherwise there exists an interpretation that will satisfy it. 3. Exploiting Control Parallelism Given the above algorithms we are able to identify the opportunities for control parallelism in the algorithm as follows: 1. Partitioning during graph construction following -rule application; 2. concurrently checking for duplicate state generation during graph construction; 3. deleting contradictory states; 4. deleting states without successors; 5. deleting states containing unsatisable eventualities, and within this: (a) concurrently searching graph for unsatisable eventualities, (b) concurrently applying graph deletion;

5 6. pipelining the entire procedure; 7. partitioning following -rule application. Note that contradictory nodes may be detected and deleted during the construction phase, thus avoiding redundant graph construction. 4. A Framework For Parallel Temporal Tableaux Our design is implemented as a framework so that parallel options may be enforced or retracted enabling a range of congurations from maximal parallelism to sequential execution to be produced. This allows us to experiment with the process granularity and to tailor the system to suit the characteristics of a particular architecture. Our implementation incorporates all of the parallel options given in with the exception of -partitioning (option 7) which has not been implemented at present since the requisite level of preprocessing analysis suggests that the overheads associated with such an approach are relatively high. The system is constructed using six communicating process agents: the director, process supplier, preprocessor, constructor, checker, and searcher. The agents cooperate to build (and reduce) a digraph that is stored, under the control of the director, as a shared data structure, eectively a blackboard structure. Each dierent type of agent incorporates facilities for internal parallel computation to a lesser or greater degree. Additionally there exists scope for parallelism between the agents using partitioning and pipelining strategies. For reasons of space the algorithms for each agent are presented in an abridged format (unabridged versions are also available). Given the shared blackboard data structure G some processes attempt to extend G through the application of tableau expansion rules; others try to clarify the graph structure, e.g. by detecting duplicate nodes; yet others attempt to prune the structure, e.g. by deleting contradictory nodes, deleting nodes with no successor, and deleting nodes with unsatisable eventualities. All these processes may proceed concurrently to exploit maximal parallelism. To a certain extent the model may be viewed as representing competition between the dierent processes where some are aiming at expansion, others at conciseness, and others still at the reduction of G. During graph construction, all agents may be concurrently active. However, once the graph is completed, only the director and searcher will operate. Each agent may be allocated any number of processes on demand, as ultimately determined by the process supplier. The process supplier agent assesses the relative loadings of each processor and the level of activity of each agent with respect to the state of G before allocating a process The Director The director agent is primarily responsible for the regulation of the graph G (the blackboard), and, through its subordinate agent, the process supplier, for the allocation and

6 mapping of processes to agents at the algorithmic level, and processes to processors at the physical level. During graph construction the director is ultimately responsible for adding nodes and edges to G. Similarly, during reduction, it acts upon the advice of the searcher as it systematically reduces G. In this algorithm we leave the process supplier to operate independent of directorial control. However, since both the incoming process request stream and the outgoing process address stream pass through the director agent, control may easily be enforced if required. The abridged version of the director's algorithm is as follows. 1. state := construction; 2. Build initial balance set (the set of relative processor loadings); 3. Spawn supplier sub-process to handle processor address requests for process distribution and pass to it both balance set and the process request stream; 4. Pass initial node to constructor; WHILE 9N 2 G : N is active DO 5. Poll constructor for returned `used' nodes N 0 ; 6. Pass N 0 to checker; 7. Terminate any constructor process that a checker identies as having derived a duplicate node; 8. Update G with checker reports. (a) either G := G [ N 0 (b) or update parent edge on existing n 2 G if a duplicate label; 9. IF N is a pre-state THEN pass it to a search process; 10. IF any searcher has a prestate P to delete THEN G := G? fp g; END WHILE 11. state := reduction REPEAT 12. IF G 6= ; THEN formula is valid ELSE 13. Poll search channels; 14. Delete any cycles from searchers - if dependent node then delete node - otherwise delete relevant edges; 15. IF any node has no successors THEN delete node; 16. Inform searchers of deletions ENDIF UNTIL no more deletions are possible 17. Formula is invalid.

7 4.2. The Process Supplier This agent receives a stream of process requests and operations information from the constructor via the director. It returns a stream of processor addresses while maintaining the relative processing loadings of balance set so that the processor with the lightest load can be determined on each request. WHILE StreamIn (the process request stream) not terminated DO IF head item of StreamIn is a process request THEN 1. Place address of processor with lightest load on StreamOut ELSE 2. Update process count to account for an expired process ENDIF ENDWHILE The Preprocessor The preprocessor deals with the initial parsing of the supplied formula. It is responsible for inserting meta-information into the formulas and for applying a few syntactic manipulations such as the removal of double negations prior to commencing graph building. The preprocessor receives input from the user and returns it to the director. While the preprocessing operation may be pipelined so that processed formulas are passed to the director and on to the constructor in a piecemeal fashion, it should be noted that the complexity of the preprocessing phase is linear on the size of the formula, and is generally a relatively low cost procedure. 1. Restructure formula; 2. Insert meta-information into sub-formulas The Constructor The constructor applies tableaux expansion rules to the formulas in a node to derive new successor nodes. It receives a node from another constructor as determined by the director then repeatedly returns derived nodes to the director (via the checker) until either a contradictory node is derived, no further rule applications may be made to the formulas in a node, or the constructor is instructed to terminate. The latter may occur if the formula has been identied as having derived a duplicate node and hence is pursuing a redundant computation. The constructor solicits the director for new processes when more than one successor node is derived. One successor is kept for expansion by the current processor while the other is expanded by the processor determined by the director. The granularity of each process is dictated by the frequency with which the constructor demands new processes. WHILE not-terminated AND 9active? nodes DO 1. Apply rule to active node N to derive new active? node set S = fs1; :::; sng; 2. Mark N as used (N 0 );

8 3. IF any s 2 S is contradictory THEN S := S? fsg, update child edge in N 0 ; 4. Place N 0 on G channel to director; 5. Spawn constructor process for some s 2 S; S := S? fsg; 6. IF s 6= ; THEN 8s 2 S spawn a new constructor process on the node dictated by Director process address channel; END WHILE The Checker This agent receives generated nodes from the constructor and searches the graph to determine whether or not they contain labels that are duplicated elsewhere. The checker may employ multiple subprocesses, each searching a subgraph to improve the eciency of this operation. The eciency of subgraph searching is of great importance since it is a relatively high cost operation in terms of processor time. WHILE state=construction DO 1. IF search? space is too large THEN partition it and spawn sub-processes to search partitions; 2. Poll director channel for incoming nodes N; 3. Pass N to all sub-checker processes (if they exist); 4. Check search? space for duplicate label L; 5. IF any checker or sub-process nds a match THEN report `found' on channel to director ELSE report unique; END WHILE 6. Terminate process and all sub-processes The Searcher The searcher agent is responsible for detecting unsatisable eventualities in any prestates that may occur in G. It does this by analysing G for strongly-connected components (cycles). Given that }f occurs in a prestate N p there must be a state N i reachable from N p that contains f, otherwise }f is unsatisable and the director may be instructed to delete N p from G. Similarly if f 2 does not appear in the cycle (which is detectable as a strongly-connected component of the graph) then formula f 1 U f 2 (where U is the `until' temporal operator) is unsatisable with the same operations resulting. WHILE state=construction DO 1. Poll incoming channel for node N; IF N is contradictory THEN 2. place its name on Gdel channel (nodes to be deleted) and delete its local instance; ELSE

9 3. Add N to each cycle that reaches it; ENDIF 4. IF N satises eventuality e from pre-state P, and P reaches N THEN tag the cycle for e with a reference to N; 5. IF N is a prestate THEN for every eventuality E 2 N create a new cycle and add them to the set of cycles EV ; 6. IF any cycle is subsumed by another THEN discard the subsumed cycle; 7. IF any cycle for e is strongly connected and e is unsatisable THEN delete the cycle for e, and IF the prestate P e references no other cycles THEN place P e on Gdel; END WHILE REPEAT 8. IF any cycle does not satisfy its respective e THEN delete the local instance of prestate P e, place the name of P e on Gdel, and remove cycles for any e in P e from EV ; 9. IF d 2 DN (nodes deleted by the director for having no successors) and d is tagged as satisfying e in a cycle THEN remove the tag; UNTIL EV = ; Incorporating Lemmata Since we are dealing with a blackboard architecture incorporating lemmata is a straightforward task. The checker agent deals with the identication of duplicate labels in the graph which constitute cycles. Theorem 1. (from Ben-Ari 1 ) The structure created from a semantic tableau is a Hintikka structure. Proof. Immediate by construction. Theorem 2. Given subgraphs H 1 and H 2 generated respectively from nodes N 1 and N 2 which are labelled by the same set of formulas F, then H 1 and H 2 are Hintikka structures and H 1 H 2. Proof. A corollary of the tableau soundness proof. Assuming theorem 2 it follows that deriving any new node, N 2, that has an identical label to one (N 1 ) already existing in the G permits us to discard the new node (since the graph formed from the formulas in the label of a node represents a proof of the formulas and so constitutes a lemma), and simply redirect the parent of N 2 to inherit N 1 as successor node instead. Since it is necessary for us to search G for duplicates for the purpose of cycle identication anyway we incur no additional computational costs by incorporating lemmata. Additionally we benet from reduced storage costs and the elimination of redundant duplicate computation.

10 5. The Problem Of Load Balancing A distributed network of processors is likely to be less tolerant of high inter-process communication (IPC) levels than a physically localised network of message-passing nodes such as the KSR y. Therefore a schema based on a single distribution model and process grain size is probably inappropriate. An eective balance of parallelism may be determined by analysing the relative amounts of processing and IPC produced during test running. This will enable a suitable process grain-size to be predicted. Furthermore, proling tools permit us to analyse the balance of process loadings across a network of nodes so that the most eective loading may be applied through the allocation of processors to pools available to particular agents, and the utilisation of the pools by each agent, under the control of the director. We shall consider a variety of load balancing techniques in future. 6. Conclusion We have provided a semi-formal description of Wolper's algorithm 4 for temporal tableaux and have described the potential opportunities for parallelism exhibited by the general method. Moreover, we have described a system suitable for implementation on a parallel or distributed architecture. An important feature of the system is the incorporation of lemmata as an integral part of the approach. The implementation of this design will enable us to insert and retract parallel options in order to tailor the system to best exploit particular physical architectures through the analysis of typical relative processor loads and IPC levels. References 1. M. Ben-Ari. Mathematical Logic For Computer Science. Prentice Hall I. Foster, S. Taylor. Strand: New Concepts In Parallel Programming. Prentice Hall F. Kurfe Parallelism In Logic. Vieweg P. Wolper. The Tableau Method For Temporal Logic: An Overview. Logique et Analyse vols June-Sept y Kendal Square Research machine.