Configuring PRISM


Introduction

The operation of PRISM can be configured in a number of ways. From the GUI, select "Options" from the main menu to bring up the "Options" dialog. The settings are grouped under several tabs. Those which affect the basic model checking functionality of the tool are under the heading "PRISM". Separate settings are available for the simulator and various aspects of the GUI (the model editor, the property editor and the log).

From the command-line version, options are controlled by switches. A full list can be displayed by typing:

prism -help

In the following sections, we give a brief description of the most important configuration options available.

User options and settings are saved locally and reused. They are stored in the file .prism, which can be found in your home directory (~) under Unix, Linux or Mac OS X and in e.g. C:\Documents and Settings\username under Windows. The settings are used by both the command-line and GUI versions of PRISM. Currently the "Options" dialog in the GUI represents the easiest way to modify the settings, but the .prism file is in a simple textual format and can be edited by hand.

To restore the default options for PRISM, click "Load Defaults" and then "Save Options" from the "Options" dialog in the GUI. Alternatively, delete the .prism file and then run PRISM.


Computation Engines

Computation engines

An important feature of the tool is its engines. PRISM is a symbolic model checker: its basic underlying data structures are BDDs and MTBDDs. When performing numerical computation, however, the tool can use one of three engines. The first is implemented purely in MTBDDs (and BDDs); the second uses sparse matrices; and the third is a hybrid, using a combination of the other two.

The choice of engine ("MTBDD", "sparse" or "hybrid") will not affect the results of model checking - all engines perform the same calculations (although in a few cases, some types of computation can only be performed with certain engines). Performance (time and space), however, may vary significantly and if you are using too much time/memory with one engine, it may be worth experimenting. Below, we briefly summarise the key characteristics of each engine.

  • The hybrid engine is enabled by default in PRISM. It uses a combination of symbolic and explicit data structures (as used in the MTBDD and sparse engines, respectively). In general it provides the best compromise between time and memory usage: it (almost) always uses less memory than the sparse engine, but is typically slightly slower. The size of model which can be handled with this engine is quite predictable. The limiting factor in terms of memory usage comes from the storage of 2-4 (depending on the computation being performed) arrays of 8-byte values, one for each state in the model. So, a typical PC can handle models with between 107 and 108 states (one vector for 107 states uses approximately 75 MB).
  • The sparse engine can be a good option for smaller models where model checking takes a long time. For larger models, however, memory usage quickly becomes prohibitive. As a rule of thumb, the upper limit for this engine, in terms of model sizes which can be handled, is about a factor of 10 less than the hybrid engine.
  • The MTBDD engine is much more unpredictable in terms of performance but, when a model exhibits a lot of structure and regularity, can be very effective. This engine has been successfully applied to extremely large structured (but non-trivial) models, in cases where the other two engines cannot be applied. The MTBDD engine often performs poorly when the model (or solutions computed from it) contain lots of distinct probabilities/rates; it performs best when there are few such values. For this reason the engine is often successfully applied to MDP models, but much less frequently to CTMCs. When using the MTBDD engine, the variable ordering of your model is especially important. This topic is covered in the FAQ section.

When using the PRISM GUI, the engine to be used for model checking can be selected from the "Engine" option under the "PRISM" tab of the "Options" dialog. From the command-line, engines are activated using the -mtbdd, -sparse and -hybrid (or -m, -s and -h, respectively) switches, e.g.:

prism poll2.sm -tr 1000 -s

For further information and technical details about PRISM's implementation and engines, see: [Par02],[KNP04b].

Note also that precise details regarding the memory usage of the current engine are displayed during model checking (from the GUI, check the "Log" tab). This can provide valuable feedback when experimenting with different engines.


Iterative Numerical Methods

For performing the computation of probabilities and expected costs/rewards during verification, PRISM uses iterative numerical methods. The methods used vary depending on the type of verification being performed. In some cases, PRISM solves systems of linear equation systems (e.g. "until" properties for DTMCs and CTMCs, steady-state properties for CTMCs and "reachability reward" properties for DTMCs). For this, a range of methods are available (see below). For "until" and "reachability reward" properties of MDPs, PRISM uses a method called "value iteration". For computations involving transient probabilities of CTMCs (e.g. "bounded until" and "cumulative reward" properties), it uses a method called "uniformisation".

Convergence

Common to all of these methods is the way that PRISM checks convergence, i.e. decides when to terminate the iterative methods because the answers have converged sufficiently. This is done by checking when the maximum difference between elements in the solution vectors from successive iterations drops below a given threshold. The default value for this threshold is 10-6 but it can be altered with the "Termination epsilon" option (switch -epsilon <val>). The way that the maximum difference is computed can also be varied: either "relative" or "absolute" (the default is "relative"). This can be changed using the "Termination criteria" option (command-line switches -relative and -absolute, or -rel and -abs for short).

Also, the maximum number of iterations performed is given an upper limit in order to trap the cases when computation will not converge. The default limit is 10,000 but can be changed with the "Termination max. iterations" option (switch -maxiters <val>). Computations that reach this upper limit will trigger an error during model checking to alert the user to this fact.

For the specific case of "steady-state convergence checking" during uniformisation (which is an optimisation for uniformisation), convergence checking can be disabled with the "Use steady-state detection" option (command-line switch -nossdetect).

Linear equation systems

For instances where PRISM has to solve a linear equation system (see above), the numerical method used can be selected by the user. Below is a list of the alternatives available and the switches used to select them from the command-line. The corresponding GUI option is "Iterative method".

  • Power method: -power (or -pow, -pwr)
  • Jacobi method: -jacobi (or -jac)
  • Gauss-Seidel method: -gaussseidel (or -gs)
  • Backwards Gauss-Seidel method: -bgaussseidel (or -bgs)
  • JOR method (Jacobi with over-relaxation): -jor
  • SOR method: -sor
  • Backwards SOR method: -bsor

When using the MTBDD engine, Gauss-Seidel/SOR based methods are not available. When using the hybrid engine, pseudo variants of Gauss-Seidel/SOR based method can also be used [Par02] (type prism -help at the command-line for details of the corresponding switches). For methods which use over-relaxation (JOR/SOR), the over-relaxation parameter (between 0.0 and 2.0) can also be specified with option "Over-relaxation parameter" (switch -omega <val>).

More information

For more information about all the issues discussed in this section, see e.g. [Ste94].


Other Options

Output options

To increase the amount of information displayed by PRISM (in particular, to display lists of states and probability vectors), you can use the "Verbose output" option (activated with comand-line switch -verbose or -v). To display additional statistics about MTBDDs after model construction, use the "Extra MTBDD information" option (switch -extraddinfo) and, to view MTBDD sizes during the process of reachability, use option "Extra reachability information" (switch -extrareachinfo).

Fairness

Sometimes, model checking of properties for MDPs requires fairness constraints to be taken into account. See e.g. [BK98],[Bai98] for more information. To enable the use of fairness constraints (for P operator properties), use the -fair switch.

Probability/rate checks

By default, when constructing a model, PRISM checks that all probabilities and rates are within acceptable ranges (i.e. are between 0 and 1, or are non-negative, respectively). For DTMCs and MDPs, it also checks that the probabilities sum up to one for each command. These checks are often very useful for highlighting user modelling errors and it is strongly recommended that you keep them enabled, however if you need to disable them you can do so via option "do prob checks?" in the GUI or command-line switch -noprobchecks.

CUDD memory

CUDD, the underlying BDD and MTBDD library used in PRISM has an upper memory limit. By default, this limit is 204800 KB (200 MB). If you are working on a machine with significantly more memory this and PRISM runs out of memory when model checking, this may help. To set the limit (in KB) from the command-line, use the -cuddmaxmem val switch. You can also change this setting in the GUI, but you will need to close and restart the GUI (saving the settings as you do) for this option to take effect.

Java memory

The Java virtual machine (JVM) used to execute PRISM also has un upper memory limit. Sometimes (for example if you are trying to load a model for which the PRISM code is extremely lengthy), this limit will be exceeded and you will see an error of the form java.lang.OutOfMemory. The current default limit for the Sun JVM is 64MB. To resolve this problem, you can increase this memory limit. On Unix, Linux or Mac OS X platforms, this is done by setting the environment variable PRISM_JAVAMAXMEM, for example (under a tcsh shell):

setenv PRISM_JAVAMAXMEM 512m
prism big_model.pm

or (under a bash shell):

PRISM_JAVAMAXMEM=512m
export PRISM_JAVAMAXMEM
prism big_model.pm

The lower case m in 512m denotes MB. If you are running PRISM on Windows you will have to do this manually by modifying the prism.bat or xprism.bat scripts. To set the memory to 512MB for example, replace java at the start of the last line in the appropriate script with java -Xmx512m.

Precomputation

By default, PRISM's probabilistic model checking algorithms use an initial precomputation step which uses graph-based techniques to efficient detect trivial cases where probabilities are 0 or 1. Occasionally, you may want to disable this step for efficiency (e.g. if you know that there are no/few such states and the precomputation process is slow). This can be done with the -nopre switch. Please note that it is not always safe to disable precomputation: unless you are checking until properties on MDPs or on DTMCs using the Power method (which is not the default option), then you should only only disable precomputation if you know that it will not identify any states which (non-trivially) have probability 0 or 1.

PRISM Manual

Configuring PRISM

[ View all ]