Principles. Model (System Requirements) Answer: Model Checker. Specification (System Property) Yes, if the model satisfies the specification

Transcription

1 Model Checking

2 Princiles Model (System Requirements) Secification (System Proerty) Model Checker Answer: Yes, if the model satisfies the secification Counterexamle, otherwise

3 Krike Model Krike Structure + Labeling Function Let AP be a non-emty set of atomic roositions. Krike Model: M = (S, s 0, R, L) S s 0 S R S S finite set of states initial state transition relation L: S 2 AP labeling function

4 Secification Often exressed in temoral logic Proositional logic with temoral asect Describes ordering of events without exlicitly using the concet of time Several variants: LTL, CTL, CTL* 4

5 Why Use Temoral Logic? Requirements of concurrent, distributed, and reactive systems are often hrased as constraints on sequences of events or states or constraints on execution aths. Temoral logic rovides a formal, exressive, and comact notation for realizing such requirements. The temoral logics we consider are also strongly tied to various comutational frameworks (e.g., automata theory) which rovides a foundation for building verification tools.

6 Temoral Logics Exress roerties of event orderings in time Linear Time Every moment has a unique successor Infinite sequences (words) Linear Temoral Logic (LTL) Branching Time Every moment has several successors Infinite tree Comutation Tree Logic (CTL)

7 Comutational Tree Logic (CTL) Syntax F ::= P rimitive roositions!f F && F F F F -> F roositional connectives AG F EG F AF F EF F temoral oerators AX F EX F A[F U F] E[F U F] Semantic Intuition AG along All aths holds Globally ath quantifier temoral oerator EG AF EF there Exists a ath where holds Globally along All aths holds at some state in the Future there Exists a ath where holds at some state in the Future

8 Comutational Tree Logic (CTL) Syntax F ::= P rimitive roositions!f F && F F F F -> F roositional connectives AG F EG F AF F EF F temoral oerators AX F EX F A[F U F] E[F U F] Semantic Intuition AX EX along All aths, holds in the next state there Exists a ath where holds in the next state A[ U q] E[ U q] along All aths, holds Until q holds there Exists a ath where holds Until q holds

9 Comutation Tree Logic AG

10 Comutation Tree Logic EG

11 Comutation Tree Logic AF

12 Comutation Tree Logic EF

13 Comutation Tree Logic AX

14 Comutation Tree Logic EX

15 Comutation Tree Logic A[ U q] q q q q q

16 Comutation Tree Logic E[ U q] q q q q q

17 Examle CTL Secifications For any state, a request (e.g., for some resource) will eventually be acknowledged AG(requested -> AF acknowledged) From any state, it is ossible to get to a restart state AG(EF restart) An uwards travelling elevator at the second floor does not changes its direction when it has assengers waiting to go to the fifth floor AG((floor=2 && direction=u && button5ressed) -> A[direction=u U floor=5])

18 CTL Examle

19 CTL Semantics M, s = M, s = M, s = q M, s = q if L(s) if not M, s = if M, s = and M, s = q if M, s = or M, s = q M, s = A M, s = E if (s): M, = if (s): M, =

20 CTL Semantics M, = X M, = F M, = G M, = Uq if M, 1 = if i 0: M, i = if i 0: M, i = if i 0: M, i = q and j< i: M, j = M = if M, s 0 =

21 CTL Satisfiability If a CTL formula is satisfiable, then the formula is satisfiable by a finite Krike model. CTL Model Checking: O( ( S + R ))

22 Examle: traffic light controller S E Guarantee no collisions Guarantee eventual service N

23 Secifications Safety (no collisions) Liveness AG (E_Go (N_Go S_Go)); AG ( N_Go N_Sense AF N_Go); AG ( S_Go S_Sense AF S_Go); AG ( E_Go E_Sense AF E_Go); Fairness constraints AF (N_Go N_Sense); AF (S_Go S_Sense); AF (E_Go E_Sense);

24 Equivalence EX EG E(Uq) AX EX AF EG AG EF A(Uq) E( R q) EF E(true U )

25 CTL Model Checking Six Cases: is an atomic roosition = q = q r = EXq = EGq = E(qUr)

26 Examle: Microwave Oven 1 Start Close Heat Error Start Close Heat Error start oven close door Start Close Heat Error oen door oen door done Start Close Heat Error cook close door oen door reset start oven start cooking Start Close Heat Error 5 6 Start Close Heat Error warmu 7 Start Close Heat Error

27 CTL Secification We would like the microwave to have the following roerties (among others): No heat while door is oen AG( Heat Close): If oven starts, it will eventually start cooking AG (Start AF Heat) It must be ossible to correct errors AG( Error AF Error): Does it? How do we rove it?

28 CTL Model Checking Algorithm Iterate over subformulas of f from smallest to largest For each s S, if subformula is true in s, add it to labels(s) When algorithm terminates M,s f iff f labels(s)

29 Checking Subformulas Any CTL formula can be exressed in terms of:,, EX, EU, and EG, therefore must consider 6 cases: Atomic roosition if a L(s), add to labels(s) f 1 if f 1 labels(s), add f 1 to labels(s) f 1 f 2 if f 1 labels(s) or f 1 labels(s), add f 1 f 2 to labels(s) EX f 1 add EX f 1 to labels(s) if successor of s, s', has f 1 labels(s')

30 Checking Subformulas E[f 1 U f 2 ] Find all states s for which f 2 labels(s) Follow aths backwards from s finding all states that can reach s on a ath in which every state is labeled with f 1 Label each of these states with E[f 1 U f 2 ]

31 Checking Subformulas EG f 1 Basic idea look for one infinite ath on which f1 holds. Decomose M into nontrivial strongly connected comonents A strongly connected comonent (SCC) C is a maximal subgrah such that every node in C is reachable by every other node in C on a directed ath that contained entirely within C. C is nontrivial iff either it has more than one node or it contains one node with a self loo Create M' = (S,R,L ) from M by removing all states s S in which f 1 labels(s) and udating S, R, and L accordingly

32 Checking Subformulas Lemma M,s EG f 1 iff 1. s S' 2. There exists a ath in M' that leads from s to some node t in a nontrivial strongly connected comonent of the grah (S', R', L'). Proof left as exercise, but basic idea is Can t have an infinite ath over finite states without cycles So if we find a ath from s to a cycle and f 1 holds in every state (by construction), then we ve found an infinite ath over which f 1 holds

33 Checking EG f 1 rocedure CheckEG(f 1 ) S' = {s f 1 labels(s)}; SCC = {C C is a nontrivial SCC of S'}; T = C SCC {s s C}; for all s T do labels(s) = labels(s) {EG f 1 }; while T do choose s T; T = T \ {s}; for all t such that t S' and R(t,s) do if EG f 1 labels(t) then labels(t) = labels(t) {EG f 1 }; T = T {t}; end if; end for all; end while; end rocedure;

34 Checking a Proerty Checking AG(Start AF Heat) Rewrite as EF(Start EG Heat) Rewrite as E[ true U (Start EG Heat)] Comute labels for smallest subformulas Start, Heat Heat Formulas/States Start x x x x Heat x x Heat x x x x x EG Heat Start EG Heat E[true U(Start EG Heat)] E[true U(Start EG Heat)]

35 Checking a Proerty Comute labels for EG Heat S = {1,2,3,5,6} SCC = {{1,2,3,5}} T = {1,2,3,5} No other state in S can reach a state in T along a ath in S. Comutation terminates. States 1,2,3, and 5 labelled with EG Heat Formulas/States Start x x x x Heat x x Heat x x x x x EG Heat x x x x Start EG Heat E[true U(Start EG Heat)] E[true U(Start EG Heat)]

36 Checking a Proerty Comute labels for Start EG Heat Formulas/States Start x x x x Heat x x Heat x x x x x EG Heat x x x x Start EG Heat x x E[true U(Start EG Heat)] E[true U(Start EG Heat)]

37 Checking a Proerty E[true U(Start EG Heat)] Start with set of states in which Start EG Heat holds i.e., {2,5} Work backwards marking every state in which true holds Formulas/States Start x x x x Heat x x Heat x x x x x EG Heat x x x x Start EG Heat x x E[true U(Start EG Heat)] x x x x x x x E[true U(Start EG Heat)]

38 Checking a Proerty Check E[true U(Start EG Heat)] Leaves us with the emty set, so this roerty doesn t hold over our microwave oven Formulas/States Start x x x x Heat x x Heat x x x x x EG Heat x x x x Start EG Heat x x E[true U(Start EG Heat)] x x x x x x x E[true U(Start EG Heat)]

39 Genealogy Floyd/Hoare late 60s Aristotle 300 s BCE Krike 59 Büchi, 60 w-automata S1S Logics of Programs Pnueli late 70 s Clarke/Emerson Early 80 s Temoral/ Modal Logics Tarski Park, 60 s 50 s Kurshan mid 80 s Vardi/Woler m-calculus ATV LTL Model Checking CTL Model Checking Bryant, mid 80 s QBF BDD Symbolic Model Checking late 80 s 39

40 Turing Awards in Verification 1. Amir Pnueli (1996) Temoral logics for secifying system behavior 2. Edmund Clarke, Allen Emerson, and Joseh Sifakis (2007) Develoment of model checking