Finite-State Verification or Model Checking. Finite State Verification (FSV) or Model Checking

Transcription

1 Finite-State Verification or Model Checking Finite State Verification (FSV) or Model Checking Holds the romise of roviding a cost effective way of verifying imortant roerties about a system Not all faults are created equal Invest effort into most imortant roerties Several romising rototyes Reachability Based SPIN Symbolic Model Checking (SMV) LTSA Flow Equations Integer Necessary Conditions (INCA) Data Flow Analysis FLAVERS

2 High-Level Architecture of FSV Systems Proerty Proerty Translator Proerty Reresentation System System Translator System Model Reasoning Engine Proerty Verified Counter Examles for Model Conservative Analysis If roerty verified, roerty holds for all ossible executions of the system If roerty not verified: An error found (in the system or in the roerty) OR A surious result System model abstracts information to be tractable Conservative abstractions usually overaroximate behavior If inconsistency relies uon overaroximations, then a surious result e.g. every counterexamle corresonds to an infeasible ath

3 System Model Deends on roerty being verified Eliminate information that does not imact the roof To kee the model as small as ossible Abstraction techniques allow states in the model to be reduced/collased Only kee track of the variables that are imortant to the roerty Use slicing Abstract values whenever ossible x<0, x=0, x>0 Alhabet Refinement: Model reduction based on relevant events foo foo foo bar Can remove a node from the grah if it does not have an event associated with it, AND does not affect the flow of events through the grah foo bar

4 Some Proerties of Proerties State-based versus event-based Once temerature is greater than 100 degrees, lock is true Elevator door s before elevator moves Single locations versus (sub)aths Deadlock, race conditions, some mutual exclusion Sequences of states or events Safety versus Liveness Finitely refutable Not finitely refutable Look for cycles that violate the roerty or the absence of cycles that satisfy the roerty A quick look at three aroaches to FSV Reachability-based Model Checking Flow Equations Data Flow Analysis

5 Reachability-based Model Checking: some history Originally roosed for hardware Early 80 s: E. Clarke and Emerson; Quielle and Sifakis Late 80 s: Imroved algorithms and roerty notations (E. Clarke, Emerson, Sistla) 90 s: Symbolic Model Checking (SMV) and other otimizations (Burch, E. Clarke, Dill, Long, and McMillan) Current: Hybrid aroaches that combine model checking with Theorem roving techniques Symbolic execution Otimization techniques (e.g., oints to analysis) Model Checking: Overview Proerties usually exressed in a temoral logic System reresented as a (ossibly abstracted ) reachability grah State based=>show the values of all the relevant variables Reasoning engine roagates valid subformulas through the grah

6 High-Level Architecture of Model Checking Temoral Logic Proerty Proerty Translator System System Translator State-based Reachability Grah Subformula roagation Proerty Reresentation Proerty Verified Counter Examles for Model Reresenting Proerties in CTL Temoral oerators G - globally F - future X - next U - until R - release Examles: Path quantifiers A - for all aths E - for some ath AG means that for all aths from this state, is true and will remain true EF means that for some ath from this state, will eventually be true

7 Assigning roositions to nodes Mark nodes with roositions that are true at that node Each tye of exression has a rule for how to roagate that exression through the grah E.g., Mark a node with AX (EX) if for all (some) of its successors is true Proagating Proositions: AX and EX X - in the next state, is true Consider AX Consider EX EX AX EX Only need to look at the successors of the node of interest

8 Proagating Proositions: AF F - at some time in the future, is true AF AF AF AF To roagate AF : Mark nodes where is true with AF If all of a node s successors are marked with AF, mark that node Reeat Ste 2 until a fixed oint is reached Proagating Proositions: EF F - at some time in the future, is true EF EF EF EF EF EF To roagate EF : Mark nodes where is true with EF If at least one of a node s successors are marked with EF, mark that node Reeat Ste 2 until a fixed oint is reached

9 Proagating Proositions G - globally in the future, is true Globally in the future talks about aths of infinite length Need to identify strongly connected comonents (SCCs) in the grah A subset of the grah in which every node is reachable from every other node in the subset Can be comuted in time linear to the size of the grah [Tarjan 1972] Proagating Proositions G - globally in the future, is true AG AG AG To roagate AG : Identify SCCs If is true on every node in a SCC, mark every node in that SCC with AG If is true on a node and all of its successors are marked with AG, mark that node Reeat Ste 3 until a fixed oint is reached AG AG AG

10 Proagating Proositions G - globally in the future, is true EG EG EG EG To roagate EG : Mark every node in a cycle where is true on every node in that cycle with EG If is true on a node and at least one of its successors are marked with EG, mark that node Reeat Ste 2 until a fixed oint is reached EG EG EG Proagation rules Different rule for each formula tye A roerty is true for a grah if it holds in the initial node(s) Need a reachability grah that shows the states (i.e., the values) of the relevant variables Examle: rocess 1 can be null, trying to obtain the lock, or in its critical region (n1, t1, c1) rocess 2 can be null, trying to obtain the lock, or in its critical region (n2, t2, c2) turn is a variable that indicates which rocess can obtain the lock (0,1,2)

11 Examle: mutual exclusion rotocol [McMillan] (rocess1 = n1,t1,c1 rocess2 = n2,t2,c2 turn = 0,1,2) n1,n2,0 t1,n2,1 n1,t2,2 c1,n2,1 t1,t2,1 t1,t2,2 n1,c2,2 c1,t2,1 t1,c2,2 Examle Proerty AG(t1 AF c1) If rocess1 gets the lock (t1) then eventually it gets into its critical region (c1) Subformulas AF c1 t1 AF c1 AG(t1 AF c1) Note, would like to rove this for all rocesses but FSV aroaches usually must instantiate a fixed configuration of the system (and roerty)

12 Examle: roagation AG(t1 AF c1) AF c1 n1,n2,0 AF c1 t1,n2,1 AF c1 n1,t2,2 AF c1 AF c1 c1,n2,1 AF c1 t1,t2,1 t1,t2,2 AF c1 n1,c2,2 AF c1 c1,t2,1 t1,c2,2 AF c1 (rocess1, rocess2, turn) Need to continue roagating AG(t1 AF c1) (t1 AF c1) equivalent to ( t1 v AF c1)

13 Examle: roagation AG(t1 AF c1) = AG( t1 v AF c1) t1 AF c1 c1 n1,n2,0 t1 AF c1 c1 t1,n2,1 t1 AF c1 t1 AF c1 c1,n2,1 AF c1 t1,t2,1 t1 AF c1 c1 n1,t2,2 t1 AF c1 t1 AF c1 c1 t1,t2,2 AF c1 n1,c2,2 t1 AF c1 c1,t2,1 t1,c2,2 t1 AF c1 c1 (rocess1, rocess2, turn) Examle: roagation AG(t1 AF c1) AG(t1 AF c1 c1) n1,n2,0 AG(t1 AF c1) t1,n2,1 AG(t1 AF c1) AG(t1 AF c1) c1,n2,1 t1,t2,1 AG(t1 AF c1 c1) n1,t2,2 AG(t1 AF AF c1) AG(t1 AF c1 c1) t1,t2,2 n1,c2,2 t1 AF AG(t1 c1 AF c1) c1,t2,1 t1,c2,2 AG(t1 t1 AF c1 AF c1) (rocess1, rocess2, turn)

14 Examle: roagation Proerty holds in the initial node, therefore it holds for the model n1,n2,0 AG(t1 AF c1) AG(t1 AF c1) c1,n2,1 AG(t1 AF c1) t1,n2,1 AG(t1 AF c1) t1,t2,1 t1,t2,2 AG(t1 AF c1) n1,t2,2 AG(t1 AF c1) AG(t1 AF c1) n1,c2,2 AG(t1 AF c1) c1,t2,1 t1,c2,2 AG(t1 AF c1) (rocess1, rocess2, turn) Formula Proagation Proagate until no change roagate from smaller to larger subformulas Actually kee all the formulas associated with a node AF c1, t1 AF c1, AG(t1 AF c1) n1,t2,2 smart algorithm: linear in the size of model and size of the formula But, model is exonential Many otimization techniques Symbolic model checking

15 Some observations: Model Checking Worst case bound linear in size of the model Model exonential Symbolic model checking encodes Boolean exressions and usually reduces the size of the model Exerimentally often very effective! Used to verify hardware and designs Trying to develo aroriate abstractions to make it alicable to software systems A quick look at three aroaches to FSV Model Checking Flow Equations Data Flow Analysis

16 Flow Equations: some history Originally roosed for designs Early 80 s: Initial develoment (Avrunin, Dillon, and Wileden) 90 s: Otimized and extended to real-time (Avrunin, Buy, Corbett, Dillon, and Wileden) Current: INCA rototye (Avrunin, Corbett, and Siegel) Flow Equations Model system as a set of finite state automata Use extended network flow inequalities to cature legal flow through a concurrent system Reresent comlement of the roerty and see if it is consistent with the set of system inequalities

17 Flow Equations Determine if combined system of inequalities is consistent Use integer linear rogramming If consistent, there is at least one set of flows through automata that violate the roerty Provides trace through the model (but may not be executable) High-Level Architecture of INCA Integer Necessary Condition Analyzer Proerty Secification Proerty Translator System System Translator Linear Inequalities Integer Linear Programming Solver Linear Inequalities Proerty Verified Assignment to Variables

18 Examle: Task Flow Equations x3 x0 x1 a x2 x4 x1 = x0 + x3 x2 = x1 x2 = x3 + x4 x0 = 1 x4 = 1 x7 x5 a x6 b x8 x6 = x5 + x7 x6 = x7 + x8 x5 = 1 x8 = 1 x12 x9 x10 b x11 x13 x10 = x9 + x12 x11 = x10 x11 = x12 + x13 x9 = 1 x13=1 Flow in to a node = Flow out of a node Flow in and out of a task is 1 Examle: Inter-task Flow Equations x3 x0 x1 a x2 x4 x7 x5 a x6 b x8 x12 x9 x10 b x11 x13 x2 = x6 x11 = x7 + x8 Rendezvous are always matched: # calls = # accets

19 Examle: Require Non-Negative Flow x3 x0 x1 a x2 x4 x7 x5 a x6 b x8 x12 x9 x10 b x11 x13 j: 0 xj Flow over edges is non-negative Examle: Proerty x3 x0 x1 a x2 x4 x7 x5 a x6 b x8 x12 x9 x10 b x11 x13 Are there more occurrences of event a then event b? Proerty: For all aths, event a occurs more than event b Proerty Equation: x2 > x11 Proerty Comlement: x2 x11

20 Solving for a roerty x1 = 1 + x3 x2 = x1 x2 = x3 + 1 x6 = 1 + x7 x6 = x7 + 1 x10 = 1 + x12 x11 = x10 x11 = x x2 = x6 x11 = x7 + 1 j: 0 xj x2 x11 Task Flow Equations Inter-Task Flow Equations Non-Negative Flow Proerty Comlement Does this set of inequalities have a solution? Solving for a roerty x1 = 1 + x3 x2 = x1 x2 = x3 + 1 x6 = 1 + x7 x6 = x7 + 1 x10 = 1 + x12 x11 = x10 x11 = x x2 = x6 x11 = x7 + x8 j: 0 xj x2 x11 Solution exists e.g., x3, x7, x12=0, all other xi=1 => roerty does not hold

21 Examle: Proerty x3 x0 x1 a x2 x4 x7 x5 a x6 b x8 x12 x9 x10 b x11 x13 Are there more occurrences of event a then event b? Proerty: For all aths, event a occurs more than event b Counter Examle: x3, x7, x12=0, all other xi=1 Some limitations Integer Linear Programming has an exonential worst case bound Interrocess order information is not reserved only checks whether event counts are consistent Like most static techniques, may roduce surious results

22 Benefits of the aroach Does not enumerate the state sace! ILP is often very efficient Emirical evidence: linear inequality systems usually grow linearly and take sub-exonential times to solve In ractice, INCA is often an effective technique A quick look at three aroaches to FSV Reachability-based Model Checking Flow Equations Data Flow Analysis FLAVERS

23 High-Level Architecture of FSV Systems Proerty Proerty Translator Proerty Reresentation System System Translator System Model Reasoning Engine Proerty Verified Counter Examles for Model Data Flow Based Verification: some history Mid-70 s: Originally roosed for def-ref anomalies in FORTRAN (Osterweil and Fosdick) Early 80 s: Extended to general roerties (Olender and Osterweil) & concurrency (Taylor and Osterweil) 90 s: Deadlock detection (Masticola and Ryder); Efficient reresentation of concurrency & incremental recision imrovement (Dwyer and Clarke) Recent: Otimizations, Java (Avrunin, Clarke, Cobleigh, Naumovich, and Osterweil)

24 Data Flow Analysis: FLAVERS FLow Analysis for VERification of Systems Reresents roerty as a finite-state automaton Reasoning engine based on data-flow analysis Relatively efficient because of the system model collection of annotated control flow grahs intertask communication and interleavings are reresented with additional nodes & edges does not enumerate all reachable states over-aroximates relevant executable behaviors Uses constraints to selectively imrove recision of the model TFG Construction task body t1 is begin u; t2.synch; v; w; end t1; task t2 body is begin x; accet synch; y; z; end t2; u t2.synch ` v synch x accet synch ` y w z

25 Two Event-Based Models b,b u,b u,x b,x u x s,s synch w,s v,s v,y s,y s,z v y w,y v,z w z w,z e,e TFG model Conservative Reresents all the sequences of events that occur in the rogram Imrecise May include some sequences of events that can not occur in the rogram Resulting analysis is conservative, but may reort surious roblems (false ositives)

26 High-Level Architecture of FLAVERS Proerty Secification Proerty Translator System System Translator Trace Flow Grah (TFG) State Proagation Proerty FSA Proerty Verified Counter Examle Trace through TFG FLAVERS Forward Flow, Any Path Problem IN and OUT are sets of FSA states IN(n) = OUT(m) m in red(n) OUT(n) = δ(s, n) s in IN(n) δ is the FSA transition function Result: Let f be the final node of the TFG All roerty: Want OUT(f) Accet(P) None roerty: Want OUT(f) Accet(P) = Accet(P) is the set of acceting states of a roerty, P Similar to Cesar, but state roagation being alied to a Trace Flow Grah

27 State Proagation Worklist: : 2, 3, 4, 5 {1} {2} 2: oen 1: if {1} {1} 1 oen move 3: if {1,2} {1,2} 2 oen {1,2} {1} 4: 5: move {1,2} {1,3} 3 move move oen State Proagation {2} 2: oen 1: if {1} 1 oen move 3: if {1,2} 2 oen {1} 4: 5: move {1,3} 3 move move oen

28 State Proagation 2: oen 4: 1: if 3: if 5: move 1: if (stoed) then 2: oen; end if; 3: if (stoed) then 4: ; end if; 5: move; Incrementally Imroving Precision Proerty Secification Proerty Translator Constraints... Proerty FSA System Trace Flow Grah System Translator State Proagation Proerty Verified Counter Examle Trace through TFG

29 Boolean Variable Constraint S=t u S=f S=f S=t t f S=f S=t v S=t S=f == is a redicate = is assignment Boolean Variable Constraint S=t u S=f S=f S=t t f S=f S=t v S=t S=f == is a redicate = is assignment

30 Constraints Are reresented as FSAs Describe conditions necessary for feasible execution Have a secial violation state that is entered when an infeasible ath is detected Violation is a tra state; once it is entered, never leave that state How do constraints affect the data flow equations IN and OUT are now sets of tules of FSA states Merge is still union Transfer function now has to look at each FSA state in the in-tule when comuting the out-tule Result looks at aths that are feasible with resect to the constraints The roerty state is the same as before Every constraint must be in an acceting state

31 Elevator Revisited 1,2,4: if (stoed) then 3: oen; end if; 5,6,8: if (stoed) then 7: ; end if; 9: move; 2: 3: oen 1: if 5: if 4: 6: 8: 7: 9: move State Proagation Worklist: : 2, 4, 3,, 5,, 6, 8 <1,t> <1,t> <2,t> <2,t>,<1,f> <2,t>,<1,v> 2: 3: oen 1: if 5: if 9: move 4: 6: 8: 7: <2,t>,<1,f> <2,t>,<1,f> <1,f> t 1 2 oen move oen move 3 move oen u v f

32 State Proagation Worklist: : 2, 4, 3,, 5,, 6, 8 <1,t> <1,t> <2,t> <2,t>,<1,f> <2,t>,<1,v> <1,v> 2: 3: oen 1: if 5: if 9: move 4: 6: 8: 7: <2,t>,<1,f> <2,t>,<1,f> <1,f> t 1 2 oen move oen move 3 move oen u v f State Proagation 1 Worklist: : 2, 4, 3,, 5, 6, 8, 7, 9 1: if <1,t> <1,t> <2,t> <2,t>,<1,f> <2,t>,<1,v> <2,t> <1,t> 2: 3: oen 5: if 9: move 4: 6: 8: 7: <2,t>,<1,f> <2,t>,<1,f> <1,f> <2,v>,<1,f> <1,t>,<1,f> <1,t>,<1,f> <2,t>,<1,f> t 2 oen move oen move 3 move oen u v f

33 State Proagation 1 Worklist: : 2, 4, 3,, 5,, 6, 8, 7, 9 1: if <1,t> <1,t> <2,t> <2,t>,<1,f> <2,t>,<1,v> <2,t> <1,t> 2: 3: oen 5: if 9: move 4: 6: 8: 7: <2,t>,<1,f> <2,t>,<1,f> <1,f> <2,v>,<1,f> <1,t>,<1,f> <1,t>,<1,f> <2,t>,<1,f> t 2 oen move oen move 3 move oen u v f State Proagation 1 Worklist: : 2, 4, 3,, 5,, 6, 8, 7, 9 1: if <1,t> <1,t> <2,t> <2,t>,<1,f> <2,t>,<1,v> <2,t> <1,t> 2: 3: oen 5: if 9: move 4: 6: 8: 7: <2,t>,<1,f> <2,t>,<1,f> <1,f> <2,v>,<1,f> <1,t>,<1,f> <1,t>,<1,f> <2,t>,<1,f> t 2 oen move oen move 3 move oen u v f

34 Some Observations: Data Flow Analysis Overall comlexity is O(N 2 S) N is the # nodes in the model S is the number of states: roerty x constraints More recisely O(N G 2 S P S C1 S Cn ) In our exerience, many imortant roerties can be roven with a small number of constraints Exerimentally: erformance sub-cubic Usually requires several iterations to determine needed constraints Constraints Many automatically generated on request Imroving Precision Use constraints to imrove recision Given a CFG G, a roerty P, and constraints C 1,,C n Alhabet refine G wrt (Σ P Σ C1 Σ Cn ) Want (L(G) L(C 1 ) L(C n )) L(P)

35 07 Comarison (Original) Time (s) INCA Sin SMV NuSMV Native Sin FLAVERS Events 07 Comarison (Decomosed) Time (s) INCA Sin SMV NuSMV Native Sin FLAVERS Events

36 FLAVERS Times Time (s) Events FSV Summary A number of techniques for otimizing the model Abstraction of values Bounded analysis Partial order Will always have some limitations on size The growth of distributed systems and the difficulty of testing such systems has increased attention on FSV Microsoft, NASA, Motorola, Intel, Ford, Verify some of the roerties of a system