figure a

1 Introduction

Bigraphs were first introduced by Robin Milner as a universal mathematical model for representing the spatial configuration of physical or virtual objects, their interaction capabilities and temporal evolution. They were subsequently extended to stochastic bigraphs [11] and bigraphs with sharing [16], and have been applied in areas such as wireless protocols, home network management, mixed reality systems, cloud computing, security and as meta-models to encode process calculi (e.g. Mobile Ambients, CSS).

BigraphER is a modelling and reasoning environment for bigraphs consisting of an OCaml library and a command-line tool. The functionality includes:

  • native support for both bigraphs and bigraphs with sharing;

  • a rewrite engine with support for stochastic reaction rules, rules with instantiation maps, rule priorities (stochastic) simulation and exhaustive state space exploration;

  • predicate checking;

  • efficient matching engine based on SAT (used to implement rewriting and predicate checking);

  • support for parameterised controls and parameterised reaction rules;

  • export labelled transition systems to probabilistic model checker PRISM [12];

  • graphical output of bigraphs, reaction rules and transition systems (see Fig. 1 (right) for an example bigraph and graphical layout).

Fig. 1.
figure 1

Left: wireless network with a router and a machine; signal coverage is represented by coloured circles. Right: corresponding bigraphical representation automatically generated by BigraphER (\(\mathsf {S}\) = signal, \(\mathsf {R}\) = router, \(\mathsf {M}\) = machine). (Color figure online)

Full size image

Example Applications. While many early applications of bigraphs have been to meta-modelling, e.g. for encodings of the \(\pi \)-calculus, \(\lambda \)-calculus, and CCS (Calculus of Communicating Systems), applications in other domains are recently beginning to emerge. Some examples are: security for cyber-physical systems [18], quantitative analysis of biological processes [11], cloud computing [19], and a framework to control systems of networked mobile robotic systems [14]. BigraphER has been used to specify and analyse a wide range of case studies in many different application domains: wireless network protocols [6], wireless mesh networks [4], run-time policy management for domestic networks [5], and human-computer interaction in mixed-reality systems [2]. Example analysis has ranged from detecting basic “programming” errors (e.g. through type checking) in [2], to generation of example state spaces, and run-time checking of invariants (i.e. predicates), implemented on a router in [5].

Related Tools. BigMC [15] is an explicit-state model checking tool for BRSs based on the BPL matching engine [3]. Currently, it does not support stochastic bigraphs nor bigraphs with sharing and can only check reachability properties. Big Red [9] is a visual editor for bigraphs and bigraphical reaction rules implemented as an Eclipse plugin; it does not implement rewriting. DBtk [1] is an implementation of matching for directed bigraphs, a variant of bigraphs with a directed link structure; there is no support for rewriting and BRS execution.

2 Bigraphical Reactive Systems – Overview

A bigraph [13] is a pair of relations over the same set of nodes: a directed forest, called place graph, representing topological space in terms of node containment and a hypergraph, called link graph, representing the interactions and (non-spatial) relationships among nodes. There is both an algebraic and graphical form. The graphical representation of an example bigraph is in Fig. 1 (right); it models the simple network in Fig. 1 (left) with a router, a machine, and the range of their wireless signals.

Nodes are indicated by circles and ovals and are assigned a type called control indicated here by \(\mathsf {S}\) (for signals), \(\mathsf {M}\) (the machine), \(\mathsf {R}\) (the router), etc. The place graph is specified by black arrows. Bigraphs with sharing [16] extend the original theory by defining the place graph as a Directed Acyclic Graph (DAG), thus allowing a natural representation of overlapping or intersecting locations. For instance, the \(\mathsf{M}\)-node in the example is contained by both nodes of control \(\mathsf{S}\), meaning the machine is in a spatial location covered by both wireless signals. The link graph is represented by green edges called links. Links may be only partially specified, in which case they connect a name. Names are links (or potential links) to other bigraphs representing the external environment or context. By convention, names are drawn above the bigraph. In the example, names \(l\_in\) and \(l\_out\) are used to name incoming and outgoing (potential) links to remote resources. The number of links of a node, also called arity, depends on its control, i.e. entities with the same control have the same number of links. Dashed rectangles denote regions of adjacent parts of the system and sites are used to model parts of the model that have been abstracted away (see Fig. 3 (top)). A bigraph with node identifiers is said to be concrete. When all the identifiers are ignored, we obtain an abstract bigraph which can be interpreted as an equivalence class of bigraphs with the same structure.

A BRS consists of a set of reaction rules together with an initial bigraph on which the rules operate. In stochastic bigraphs [11], a rate is associated with each rule.

3 BigraphER Specification Language

The BigraphER specification language almost corresponds to the standard algebraic notation for bigraphical expressions [13, 16]. In the following, we highlight some of the distinctive features of the BigraphER language by presenting a simple model for wireless networks inspired by [5]. The model is specified by the code in Fig. 2. A valid BRS model consists of four separate blocks of definitions: a signature containing all the controls in the model, a set of bigraphs, a set of reaction rules and a reactive system specifying the initial state of the BRS, the priority hierarchy among reaction rules and a set of predicates.

Fig. 2.
figure 2

Specification of a BRS in the BigraphER language.

Full size image

Controls are defined in lines 1–2 by using keyword \(\mathtt {ctrl}\). The integer on the right-hand side of each definition indicates the arity of each control. The keyword \(\mathtt {atomic}\) specifies that a node may not contain other nodes. Bigraph definitions are in lines 4–8. Line 5 defines bigraph \(\mathtt {s0}\). Expression Mw,s denotes a node of control \(\mathtt {M}\) with names \(\mathtt {w}\) and \(\mathtt {s}\). Operators . and | denote nesting and merge product, respectively. Nesting is the operation allowing to place a bigraph inside another one; merge product is the operation placing two bigraphs side-by-side inside the same region. Closures like /s0 indicate that a link has no names (see link between \(\mathtt {M}\) and \(\mathtt {S}\)). Sharing is introduced by ternary operator share ... by ... in .... The first argument specifies the entities to be shared, e.g. machine \(\mathtt {M}\) and router \(\mathtt {R}\). The second argument specifies how they are shared: 0, 1 indicates that \(\mathtt {M}\) is shared by the first and the second signals (counting from left to right). The third argument specifies the entities containing the shared entities, e.g. signals \(\mathtt {S{s0}}\) and \(\mathtt {S{s1}}\). The graphical representation of \(\mathtt {s0}\), automatically generated by BigraphER is shown in Fig. 1 (right).

Fig. 3.
figure 3

Reaction rule \(\mathtt {block\_in}\) for blocking a machine’s incoming traffic.

Full size image

The code in lines 10–11 defines reaction rule \(\mathtt {block\_in}\). Operator –> is used to separate the left-hand side from the right-hand side of the rule. Expression \(\mathtt {id}\) indicates the identity bigraph, i.e. the bigraph with one site inside one region. This reaction rule models a firewall rule blocking a machine’s incoming traffic. The corresponding graphical representation is in Fig. 3. Reaction rule \(\mathtt {leave\_net}\) defined in lines 13–15 models a machine leaving the network.

Finally, lines 17–21 contain the reactive system definition. A BRS is defined by construct brs ... endbrs. Keyword \(\mathtt {init}\) specifies the initial state of the system. In the example, this is bigraph \(\mathtt {s0}\). Construct rules = [...] defines a list of priority classes in descending order of priority. A priority class is specified by construct {...} and may only contain reaction rules identifiers. Construct preds = ... defines a set of predicates. Predicate is_in_blocked (defined in line 8) can be used to tag states in which there are machines with blocked incoming traffic. In a more extensive model like in [5], this predicate can be used to verify network invariants after network policies are enforced by users.

This simple example highlights the main features; more complex examples including stochastic reaction rules, reducible priority classes and instantiation maps can be accessed at http://www.dcs.gla.ac.uk/~michele/bigrapher.html.

4 Components and Features

The BigraphER command-line tool is composed of three distinct modules: the compiler, the matching engine and the rewriting engine. All are coded in OCaml.

Compiler. The compiler translates an input source file in the BigraphER language into a run-time representation of the model. Each declaration specifies the binding of an identifier to a data type representing either a control, a bigraph or a (stochastic) reaction rule. Each bigraph is stored in memory as a pair of specialised data structures: a sparse boolean matrix encoding the DAG’s adjacency matrix of the place graph, and a set of hyperedges (i.e. multisets with nodes and names as elements) for the representation of the link graph. Although the BigraphER language only defines abstract bigraphs, the compiler operates on the corresponding concrete bigraphs by assigning arbitrary node labellings. This is required to allow the enumeration of all distinct occurrences of a reaction rule and thus to compute exit rates in stochastic BRSs. Additional features are: type-checking of parameterised definitions, combinatorial generation of parametric reaction rules, graphical representation of all the bigraph defined in the input model (useful for debugging).

Matching Engine. The bigraph matching problem determines whether a bigraph, called pattern, occurs in another bigraph, called target. The BigraphER matching engine implements the algorithm introduced in [16]: a SAT encoding of a specialisation of the sub-graph isomorphism problem. For each instance of the problem, the matching engine generates a set of constraints (formulas in Conjunctive Normal Form (CNF)) encoding the instance. Solutions are then obtained by passing all the constraints through the OCaml bindings for the MiniSat solver [7]. Solutions are expressed as total maps from the nodes of the pattern to sub-sets of the nodes of target. Because the matching problem is NP-complete, two techniques to optimise performance have been adopted in the implementation. The first is to reduce the size of the SAT instances by applying Tseitin transformation [17] to constraints. The second is to minimise instances by exploiting the symmetries in the structure of the pattern: when enumerating all the occurrences, the automorphisms of the pattern are used to generate all the symmetric solutions starting from a computed solution. The matching engine also implements specialised constraints to support bigraph equality and predicate checking.

Rewrite Engine. This component computes the dynamic evolution of the (stochastic) BRS specified in the input file by iteratively applying all the reaction rules to each bigraph (state) until either a fixpoint or a user-defined bound on the number of states is reached.Footnote 1 The transition system generated by a BRS is represented internally by BigraphER as a directed graph; the Continuous Time Markov Chain resulting from a stochastic BRS as a labelled directed graph. Rule application consists of two steps: first the matching engine is queried for occurrences of the left-hand side of a reaction rule, then, for each distinct occurrence, a new state is computed by replacing the occurrence with the right-hand side of the rule (see Fig. 3). BigraphER also supports reaction rules with instantiation maps Footnote 2 allowing to easily duplicate or discard parts of a bigraph when a reaction rule is applied. The rewriting engine incrementally builds the state space in a breadth-first search (BFS). Support for simulation is obtained by computing only one random path of the transition system. Simulation for stochastic BRSs implements Gillespie’s Stochastic Simulation Algorithm (SSA) [10]. Besides standard rule priorities, BigraphER admits reducible classes Footnote 3 i.e. priority classes in which rules are treated like rewriting within an equivalence class. This means that after applying all possible rules in an arbitrary order only a canonical form is stored. This feature allows, for instance, to reduce the number of intermediate states generated by the application of instantaneous stochastic reaction rules. Predicates expressed as matches are checked during the generation of the transition system: every time a new state is discovered, all the predicates specified in the input model are checked against it and the labelling function is updated. The rewriting engine can return either a textual or a graphical representation of the (labelled) transition system and its states. Graphical output is computed by the open-source graph layout generator Graphviz [8]. Textual output is compatible with the PRISM probabilistic model checker, thus enabling quantitative verification for BRSs.

OCaml Library. This component provides programming interfaces for the data structures used internally by the BigraphER command-line tool. For instance, it allows manipulation of bigraphs and their constituents by providing implementation for the following operations: composition, tensor product, parallel product, merge product and nesting. The library also provides APIs to check predicates, construct reaction rules and apply them to rewrite bigraphs. The full library documentation can be accessed at http://www.dcs.gla.ac.uk/~michele/docs/bigraph/index.html.

Technical Details and Availability. BigraphER is free and open source (BSD) and runs on all major operating systems. It is available for download from http://www.dcs.gla.ac.uk/~michele/bigrapher.html.