Models. Lecture 25: Model Checking. Example. Semantics. Meanings with respect to model and path through future...

Transcription

1 Models Lecture 25: Model Checking CSCI 81 Spring, 2012 Kim Bruce Meanings with respect to model and path through future... M = (S,, L) is a transition system if S is a set of states is a transition relation (a binary relation on S), such that every s S has some s# S with s s#, and L: S P(Atoms) is a labeling function. Understand L(s) to be set of basic propositions (atoms) true at s. Example L(s 0 ) = {p,q}, L(s 1 ) = {q,r},... q, r A path π in a model M = (S,, L) is an infinite sequence of states s 1,s 2,s 3,... in S such that, for each i 1, s i s i+1. Path π = s 1 s 2 s 3... represents a possible future s 1 p, q s 0 r s 2 Let M = (S,,L)be a model, π = s1... be a path in M. Define: π, π π p iff p L(s 1) π φ iff π φ π φ 1 φ 2 iff π φ 1 andπ φ 2, etc for, π Xφ iff π 2 φ -- next π Gφ iff for all i 1, π i φ -- globa"y π Fφ iff there is some i 1 such that π i φ -- future Let π i be suffix of π starting at s i

2 Binary operators: π φ U ψ iff i 1, π i ψ and j=1,...,i 1, π j φ -- until π φ W ψ iff either i 1, π i ψ and j=1,...,i 1, π j φ or k 1, π k φ -- weak until π φ R ψ iff either i 1, π i φ and j=1,...,i, π j ψ, or k 1, π k ψ -- release Big Picture Examine (possibly) infinite computations on FSM s Determine properties of paths emanating from particular state. Particularly useful for modeling interleaving concurrency. Model checking should: Use expressive language Be practical and efficient (& hence decidable) Should be sound & complete Duality More Laws Like demorgan rules: G φ F φ F φ G φ X φ X φ (φ U ψ) φ R ψ (φ R ψ) φ U ψ F like, while G like F (φ ψ) F φ F ψ G (φ ψ) G φ G ψ. F φ U φ G φ R φ

3 Simple Example Critical Sections s 0 n 1 n 2 Critical sections for two processes: n i means process i not in critical section s 2 s 1 t 1 n 2 s 3 c 1 n 2 t1 t 2 s 5 n 1 t 2 s 6 n 1 c 2 c i means process i is in critical section s 4 s 7 t i means process i requests (tries) to be in critical section c 1 t 2 t 1 c 2 What happens to size of graph if add another process? Critical Section Examples Properties: Safety: Only one process is in its critical section at a given time. G( c 1 c 2) Liveness: Whenever a process requests to enter its critical section, it will eventually be permitted to do so. G(t i F c i) (but not true in s 1 if take 0,1,3,7,1,3,7,...) Non-blocking: A process can always request to enter its critical section. Can t express -- must quantify over paths. If try to enter critical region, must try until succeed. G(t i t i U c i) More examples No strict sequencing: Processes need not enter their critical section in strict sequence. I.e., we can have process i enter its critical section twice without the other one entering its critical section in between. There is a path s.t... can t be expressed Look at G( c 1 c 1 W ( c 1 c 1 W c 2)) - must alternate on every path If it true of all paths then no strict sequencing fails

4 Computation Tree Logic Propositional connectives as before Handles branching time Add modal operators A, E for on all paths, there exists a path φ ::= p ( φ) (φ φ) (φ φ) (φ φ) AXφ EXφ AF φ EF φ AG φ EG φ A[φ U φ] E[φ U φ] A,E always paired with F,G,X,U M,s AX φ iff s 1 such that s s 1 we have M,s 1 φ. M,s EX φ iff s 1 such that s s 1 & M,s1 φ. M,s 1 AG φ holds iff paths s 1 s 2 s 3..., and s i along the path, M, s i φ. M,s 1 EG φ holds iff there is a path s 1 s 2 s 3..., and s i along the path, M, s i φ. EF Aliens M,s 1 AF φ holds iff paths s 1 s 2..., s i such that M, s i φ. M,s 1 EF φ holds iff s 1 s 2 s 3..., and s i along the path, M, s i φ. M,s 1 A[φ 1 U φ 2 ] holds iff paths s 1 s 2 s 3..., s i along path, M, s i φ 2, and, j < i, M, s j φ 1. M,s 1 E[φ 1 U φ 2 ] holds iff path s 1 s 2 s 3..., and that path satisfies φ1 U φ2 as specified above.

5 "' Aliens AF Aliens &( Aliens "( Aliens AG Aliens EG Aliens EF (AG Aliens) &'("( Aliens)

6 AG (EF Aliens) More Examples What is AG (AF Aliens)? infinitely o'en AF(AG Aliens)? From critical sections: AG(n 1 EX t 1) can always enter critical section EF (c 1 E[c 1 U ( c 1 E[ c 2 U c 1 ])]) no strict sequencing Equivalences AFφ EG φ EF φ AG φ AXφ EX φ. EG ψ ψ EX EG ψ E(ψ 1 U ψ 2 ) ψ 2 (ψ 1 EX E(ψ 1 U ψ 2 )) Last two provide basis for model-checking algorithm!