Lecture 4 Model Checking and Logic Synthesis

Transcription

1 Lecture 4 Model Checking and Logic Synthesis Nok Wongpiromsarn Richard M. Murray Ufuk Topcu EECI, 18 March 2013 Outline Model checking: what it is, how it works, how it is used Computational complexity of model checking Closed system synthesis Examples using SPIN model checker

2 The basic idea behind model checking Given: Transition system LTL formula TS TS Question: Does satisfy, i.e., TS =? Trace(TS) (all possible executions) executions that are possible and invalid Words( ) (all invalid executions) Answer (conceptual): TS = m Trace(TS) Words( ) m Trace(TS) \ Words( ) =; [TS satisfies ] [All executions of TS satisfy ] [No execution of TS violates ] How to determine whether Trace(TS) \ Words( ) =;? 2

3 Preliminaries: LTL Buchi automata Theorem. There exists an algorithm that takes an LTL formula and returns a Büchi automaton A such that Words( )=L! (A) = g = (g! h) = (f (guh)) A true g q0 g q1 A g h h q0 true true q1 A true q0 g f h g g f q2 q1 g h true A tool for constructing Buchi automata from LTL formulas: LTL2BA [ 3

4 Preliminaries: transition system Buchi automaton Transition system: TS =(S, Act,!,I,AP,L) Nondeterministic Buchi automaton: A =(Q, 2 AP,,Q 0,F) Define the product automaton: S 0 = S Q TS A =(S 0, Act,! 0,I 0, AP 0,L 0 ), where with and q L(t)! p, there exists I 0 L(s 0 ) = {hs 0,qi : s 0 2 I and 9q 0 2 Q 0 s.t. q 0! q} AP 0 = Q L 0 : S Q! 2 Q and L 0 (hs, qi) ={q} 8s, t 2 S, q, p 2 Q s! t hs, qi! 0 ht, pi ; {g} s0: red s1: green TS {q 0 } {q 1 } TS A s0, q0 s0, q1 true g q0 g q1 A s1, q0 {q 0 } s1, q1 {q 1 } 4

5 Preliminaries Transition system: TS =(S, Act,!,I,AP,L) Nondeterministic Buchi automaton: A =(Q, 2 AP,,Q 0,F) not in F Theorem: Trace(TS) L! (A) =, Proof idea ( ): Pick a path π in TS A s.t. 0 = eventually forever F, and let π be its projection to TS. Then, trace(π) Trace(TS) -- by definition of product trace(π) L! (A) -- by hypothesis and by definition of product (L ( s,q ) = {q}) TS A = eventually forever F ; {g} s0: red s1: green true g q0 g q1 TS A F = {q 1 } TS A = eventually forever F m There exists a state x in x is reachable L (x) F x is on a directed cycle TS A } graph search, e.g., (nested) depth-first search 5 L 0 (hs 0,q 0 i 6 F hs 0,q 1 i not on cycle {q 0 } {q 1 } s0, q0 s1, q0 {q 0 } L 0 (hs 1,q 0 i 6 F s0, q1 s1, q1 {q 1 } hs 1,q 1 i not reachable

6 Given: Transition system TS Putting together LTL formula NBA A accepting with the set F of accepting states TS = m Trace(TS) 6 Words( ) m Trace(TS) Words( ) = m Trace(TS) L! (A ) = m TS A = eventually forever F 6

7 The process flow of model checking Efficient model checking tools automate the process: SPIN, nusmv, TLC,... 7

8 Example 1: traffic lights (property verified) System TS: synchronous composition of two traffic lights and a controller q 1 s 1 c 2 c 1 q 2 {g 1 } s 2 {g 2 } = {g 1 } q 2,s 1,c 2 q 1,s 1,c 1 P 1 Specification : The light are never green simultaneously. traffic light 1 traffic light 2 c 3 controller q 1,s 2,c 3 {g 2 } SPIN code: System model (synchronous composition of the modules): A P1 Property verified: TS P 1 A P1 from LTL2BA: 8

9 Example 2: traffic lights (counterexample found property not verified) System TS: composition of two traffic lights and a controller q 1 q 2 {g 1 } traffic light 1 s 1 {g 2 } c 2 c 1 = s 2 traffic light 2 c 3 controller Property not verified: TS = P 2 Counterexample: (hq 1,s 1,c 1, 1ihq 1,s 2,c 3, 1i)! q 2,s 1,c 2 {g 1 } q 1,s 1,c 1 q 1,s 2,c 3 {g 2 } P 2 Specification : The first light is infinitely often green. Counterexample from SPIN output: A P2 q 2,s 1,c 2,init q 1,s 1,c 1,init q 1,s 1,c 1, 1 q 1,s 2,c 3,init q 1,s 2,c 3, 1 TS A P2 9

10 Example 3: traffic lights (counterexample used to modify the controller) System TS: composition of two traffic lights and a modified controller q 1 s 1 c 1 c 2! new controller: is not a valid control signal anymore P 2 Specification : The first light is infinitely often green. Property verified: A P2 q 2 {g 1 } s 2 {g 2 } c 4 c 3 TS P 2 = q 1,s 1,c 1 {g 1 } q 2,s 1,c 2 q 1,s 1,c 1,init q 2,s 1,c 2,init q 1,s 2,c 4 {g 2 } q 1,s 1,c 3 q 1,s 2,c 4,init q 1,s 1,c 3,init q 1,s 1,c 3, 1 q 1,s 1,c 1, 1 q 1,s 2,c 4, 1 10 TS A P2

11 Computational complexity of model checking Transition system: TS =(S, Act,!,I,AP,L). Specification: Problem size: # of reachable states in TS O( S ) Potential reductions: # of states in A O( ) 2 size of one state in bytes length of, e.g., # of operators in Restrict the ranges of variables Use abstraction, separation of concerns, generalization Use compressed representation of the state space (e.g. BDD) Used in symbolic model checkers, e.g., SMV, NuSMV Partial order reduction (avoid computing equivalent paths) Use separable properties, instead of large, combined ones Lossy compression, e.g., hashcompact and bitstate hashing May result in incompleteness Lossless compression and alternate state representation methods May increase time while reduce memory A On-the-fly construction of TS, and the product automaton (while searching the automaton) to avoid constructing the complete state space Time complexity of DFS: O(# of states + # of transitions in TS A ) 11

12 Closed system synthesis Closed system: behaviors are generated purely by the system itself without any external influence Given: A transition system P An LTL formula P: composition of two traffic lights 1 s1,s0 2 s0,s0 1 ; {g 1 } {g 2 } s1,s1 {g 1,g 2 } s0,s1 P = (g 1 ^ g 2 ) ^ g 1 ^ g Compute: A path = of P such that Sample paths of P: 1 = (hs 0 s 0 ihs 1 s 0 ihs 1 s 1 ihs 0 s 1 i)! 2 = (hs 0 s 0 ihs 0 s 1 i)! 3 = (hs 0 s 0 ihs 1 s 0 ihs 0 s 0 ihs 0 s 1 i)! 12

13 Closed system synthesis--a controls interpretation P C output y memory domain The controller C is a function C : M S! Act The controller keeps some history of states It picks the next action for P such that the resulting path satisfies the specification (i.e., C constrains the paths system can take. Let M be a sequence of length 1, i.e., the controller keeps only the previous state C(;, hs 0 s 0 i) = 1 1 s1,s0 s0,s0 1 ; P {g 1 } {g 2 } s0,s1 C(hs 0 s 1 i, hs 0 s 0 i) = 1 C(hs 1 s 0 i, hs 0 s 0 i) = 2 2 s1,s1 {g 1,g 2 } 1 C(hs 0 s 0 i, hs 1 s 0 i) = 1 C(hs 0 s 0 i, hs 0 s 1 i) = 2 = (hs 0 s 0 ihs 1 s 0 ihs 0 s 0 ihs 0 s 1 i)! 1 s0,s0 C 2 and = = (g 1 ^ g 2 ) ^ g 1 ^ g 2 s1,s0 s0,s s0,s0 2

14 A solution approach Closed system synthesis can be formulated as a non-emptiness of the specification or satisfiability problem 9y (y) For synthesis problems, interesting behaviors are good behaviors (as opposed to verification problems where interesting behaviors are bad behaviors) Trace(P) (all possible executions) executions that are possible and valid Words( ) (all valid executions) Construct a verification model and claim that Trace(P) \ Words( )=; A counterexample provided in case of negative result is a path of P that satisfies Positive result means Trace(P) \ Words( )=;, i.e., a path of P that satisfies does not exist 14

15 Example: traffic lights System model: P = Specification: ; TS 1 s0: red 1 1 k ; TS 2 s0: red 2 2 s1: green s1: green {g 1 } {g 2 } = (g 1 ^ g 2 ) ^ g 1 ^ g 2 L! (A) =Words( ) A q0 (g 1 ^ g 2 ) g 1 ^ g 2 (g 1 ^ g 2 ) g1 ^ g2 (g 1 ^ g 2 ) q1 q2 g 1 ^ g 2 15 SPIN code: System model (asynchronous composition): bool g1 = 0, g2 = 0; active proctype TL1() { do :: atomic{ g1 == 0 -> g1 = 1} :: atomic{ g1 == 1 -> g1 = 0 } od } active proctype TL2() { do :: atomic{ g2 == 0 -> g2 = 1} :: atomic{ g2 == 1 -> g2 = 0 } od } Automaton from LTL2BA: never { T0 init: if :: (!g1) (!g2) -> goto T0 init :: (g1 &&!g2) -> goto T1 S1 fi; T1 S1: if :: (!g1) (!g2) -> goto T1 S1 :: (!g1 && g2) -> goto accept S1 fi; accept S1: if :: (!g1) (!g2) -> goto T0 init :: (g1 &&!g2) -> goto T1 S1 fi; }

16 Solution to the traffic light problem System model: P = ; TS 1 s0: red 1 1 k s1: green {g 1 } ; TS 2 s0: red 2 2 s1: green {g 2 } Solution from SPIN output: Specification: = (g 1 ^ g 2 ) ^ g 1 ^ g 2 L! (A) =Words( ) q0 (g 1 ^ g 2 ) A =(hs 0 s 0 ihs 1 s 0 ihs 0 s 0 ihs 0 s 1 ihs 0 s 0 ihs 0 s 1 i)! g 1 ^ g 2 g1 ^ g2 (g 1 ^ g 2 ) s0,s0 s1,s0 s0,s0 (g 1 ^ g 2 ) q1 g 1 ^ g 2 q2 s0,s1 s0,s0 s0,s1 16

17 Example: the farmer puzzle A farmer wants to cross a river in a little boat with a wolf, a goat and a cabbage. Constraints: The boat is only big enough to carry the farmer plus one other animal or object. The wolf will eat the goat if the farmer is not present. The goat will eat the cabbage if the farmer is not present. How can the farmer get both animals and the cabbage safely across the river? P f1,w0 = (f = w = g = c = 1) ^ (w 6= g _ f = g) ^ (g 6= c _ f = g) f1,w0 f1,w0 L! (A) =Words( ) f1,w0 g1,c1 q0 (w 6= g ^ g 6= c) _ f = g (f = w = g = c = 1) ^ A p i, p = i p 2 {f,w,g,c}, i 2 {0, 1} g1,c1 g1,c1 g1,c1 17 q1 (w 6= g ^ g 6= c) _ f = g (w 6= g ^ g 6= c) _ f = g

18 Solving the farmer puzzle (using SPIN) A farmer wants to cross a river in a little boat with a wolf, a goat and a cabbage. Constraints: The boat is only big enough to carry the farmer plus one other animal or object. The wolf will eat the goat if the farmer is not present. The goat will eat the cabbage if the farmer is not present. System model in SPIN: bit f=0, w=0, g=0, c=0; active proctype P() { do :: f=1-f :: atomic{ f==g -> f=1-f; g=1-g } :: atomic{ f==w -> f=1-f; w=1-w } :: atomic{ f==c -> f=1-f; c=1-c } od } farmer crosses the river alone farmer and goat cross the river farmer and wolf cross the river farmer and cabbage cross the river never { Specification: T0 init: if :: (w!= g && g!= c) (f==g) -> goto T0 init :: (f && g && w && c) && ((w!= g && g!= c) f==g) -> goto = accept (f S2= w = g = c = 1) ^ fi; accept S2: (w 6= g _ f = g) ^ if :: (w!= g (g && g 6=!= c c) _ f (f==g) = g) -> goto accept S2 fi; } 18 A solution: g1,c1 f1,w0

19 Alternative solution A farmer wants to cross a river in a little boat with a wolf, a goat and a cabbage. Constraints: The boat is only big enough to carry the farmer plus one other animal or object. The wolf will eat the goat if the farmer is not present. The goat will eat the cabbage if the farmer is not present. How can the farmer get both animals and the cabbage safely across the river? P f1,w0 = (f = w = g = c = 1) L! (A) =Words( ) f1,w0 f1,w0 f1,w0 g1,c1 q0 true A f = w = g = c =1 q1 true p i, p = i g1,c1 p 2 {f,w,g,c}, i 2 {0, 1} g1,c1 g1,c1 19

20 Alternative solution A farmer wants to cross a river in a little boat with a wolf, a goat and a cabbage. Constraints: The boat is only big enough to carry the farmer plus one other animal or object. The wolf will eat the goat if the farmer is not present. The goat will eat the cabbage if the farmer is not present. System model in SPIN: bit f=0, w=0, g=0, c=0; active proctype P() { do :: atomic{ (g!=c && g!=w) -> f=1-f } :: atomic{ f==g -> f=1-f; g=1-g } :: atomic{ (f==w && g!=c) -> f=1-f; w=1-w } :: atomic{ (f==c && g!=w) -> f=1-f; c=1-c } od } farmer can cross only when goat and cabbage are not at the same place and goat and wolf are not farmer and goat can cross only when they are at the same place farmer and wolf can cross only when they are at the same place and goat and cabbage are not farmer and cabbage can cross only when they are at the same place and goat and wolf are not never { T0 init: if :: (1) -> goto T0 init :: (f = && (f g && w = && w c) = -> g goto = c accept = 1) all fi; accept all: skip } Specification: Another solution: g1,c1 f1,w0 20

21 Example: frog puzzle Find a way to send all the yellow frogs to the right hand side of the pond and send all the brown frogs to the left hand side. Constraints: Frogs can only jump in the direction they are facing. Frogs can either jump one rock forward if the next rock is empty or they can jump over a frog if the next rock has a frog on it and the rock after it is empty. 21

22 Solving the frog puzzle as logic synthesis Rock i is not occupied or occupied State of frog i: Transition system of frog i: Overall system model: s(f i ) {s 0,s 1...,s 6 } ri {0, 1} P = F 1 F 2 F 6 r 0 r 1 r 2 r 3 r 4 r 5 r 6 F i s 0 s 1 s 2 s 3 s 4 s 5 s 6 r 1 s0 r 1 ^ r 2 F 1 s1 r 2 s2 r 2 ^ r 3 r 3 ^ r 4 s3 r 4 s4 r 4 ^ r 5 r 5 ^ r 6 s5 r 6 s6 F 2 s1 r 2 s2 r 2 ^ r 3 r 3 ^ r 4 s3 r 4 s4 r 4 ^ r 5 r 5 ^ r 6 s5 r 6 s s2 r 2 ^ r 3 r 3 ^ r 4 F 3 s3 r 4 s4 r 4 ^ r 5 r 5 ^ r 6 s5 r 6 s6 = s(f 1 ),s(f 2 ),s(f 3 ) 2 {s 4,s 5,s 6 } ^ s(f 4 ),s(f 5 ),s(f 6 ) 2 {s 0,s 1,s 2 } true q0 p q1 true A p, s(f 1 ),s(f 2 ),s(f 3 ) 2 {s 4,s 5,s 6 } ^ s(f 4 ),s(f 5 ),s(f 6 ) 2 {s 0,s 1,s 2 } 22