Verification Using Temporal Logic

Transcription

1 CMSC 630 February 25, Verification Using Temporal Logic Sources: E.M. Clarke, O. Grumberg and D. Peled. Model Checking. MIT Press, Cambridge, E.A. Emerson. Temporal and Modal Logic. Chapter 16 in Volume B of J. van Leeuwen, editor, Handbook of Theoretical Computer Science. MIT Press, Cambridge, D. Peled. Software Reliability Methods. Springer-Verlag, Berlin, C. Baier and J.-P. Katoen. Principles of Model Checking. MIT Press, Cambridge, 2008.

2 CMSC 630 February 25, Temporal Logic a language for describing time-varying properties of systems.... originally developed as a branch of philosophical logic.... is a modal logic (logic of possibility and necessity).... brought to attention of computer scientists by A. Pnueli in 1977.

3 CMSC 630 February 25, Temporal Logic Verification Framework How is the verification question S sat R formulated in the temporal-logic setting? Temporal logic used to define requirements Spec. Sys? sat?

4 CMSC 630 February 25, Kripke Structures Kripke structures used as system models in temporal logic. {} { incs1} { incs2}

5 CMSC 630 February 25, Defining Kripke Structures Mathematically, a Kripke structure has form S,A,R,l,s I, where: S is a set of states; A is a set of atomic propositions; R S S is the transition relation; l : S 2 A is the labeling; and s I S is the initial state.

6 CMSC 630 February 25, Another Kripke Structure Example

7 CMSC 630 February 25, Where Do Kripke Structures Come From? Kripke structures are usually not specified directly by users; they are compiled from higher-level specifications using (small-step) operational semantics of programming / modeling notation. States: assignments of variables to values Labeling function given as relation on states / atomic propositions Transitions: execution steps defined by semantics

8 CMSC 630 February 25, Example: UNITY A modeling notation for concurrent systems See K.M. Chandy and J. Misra, Parallel Program Design, Addison Wesley, Reading MA, 1988 Emblematic of notations used by model-checking tools

9 CMSC 630 February 25, Example UNITY Model program mutex declare in: array [0..1] of int lock: int initially in[0] = in[1] = lock = 0 assign end P0enter: lock = 0 lock, in[0] = 1, 1 P1enter: lock = 0 lock, in[1] = 1, 1 P0exit: in[0] = 1 lock, in[0] = 0,0 P1exit: in[1] = 1 lock, in[0] = 0,0 lock = 0,in[0] = 0,in[1] = 0 lock = 1,in[0] = 1,in[1] = 0 lock = 1,in[0] = 0,in[1] = 1

10 CMSC 630 February 25, UNITY in Detail Programs consist of declare, initially, assign sections (among others) declare section defines variables initially section initializes variables assign section contains guarded commands Guarded command has formg S G is boolean condition,s is Hoare program Intended semantics: at each step, command with true guard is selected, executed atomically. Program terminates when all guards are false.

11 CMSC 630 February 25, Defining Temporal Logic Now that we know what systems (Sys) are, what about requirements (Spec)? Idea Formulas of temporal logic constitute Spec. but there are a number of variants of temporal logic. An important categorization: linear time vs. branching time. The difference: how time is modeled! (More on this later.) We ll start with linear-time.

12 CMSC 630 February 25, Linear-Time Temporal Logic (LTL) Used to specify properties of sequences. Given: set(a, b )A of atomic propositions. Formulas generated as follows. φ ::= a φ φ φ Xφ next φ U φ until Φ LTL is the set of all LTL formulas.

13 CMSC 630 February 25, LTL Semantics Formal semantics given as = (2 A ) ω Φ LTL. A: set of atomic propositions 2 A : set of all subsets ofa. (2 A ) ω : set of infinite sequences of2 A. That is, formulas interpreted with respect to sequences of sets of atomic propositions. π = φ: sequenceπhas propertyφ

14 CMSC 630 February 25, Notation Ifπ = A 0 A 1... (2 A ) ω then π[i] = A i 2 A π[i..] = A i A i+1... (2 A ) ω

15 CMSC 630 February 25, LTL Semantics (cont.) π = a ifa π[0]. π = φ ifπ = φ. π = φ 1 φ 2 ifπ = φ 1 orπ = φ 2. π = Xφ ifπ[1..] = φ. π = φ 1 U φ 2 if i 0. π[i..] = φ 2 and j < i. π[j..] = φ 1

16 CMSC 630 February 25, Derived Operators tt ff = a a true = tt false φ 1 φ 2 = (( φ1 ) ( φ 2 )) conjunction φ 1 φ 2 = ( φ1 ) φ 2 implication

17 CMSC 630 February 25, More Derived Operators Eventually Fφ tt U φ Always Gφ F φ

18 CMSC 630 February 25, Still More Derived Operators Release φ 1 R φ 2 (( φ 1 ) U ( φ 2 )) Weak Until φ 1 W φ 2 φ 2 R (φ 1 φ 2 ) What does (( φ 2 ) U ( φ 1 φ 2 )) mean?

19 CMSC 630 February 25, Writing Requirements in LTL LTL can be used to specify different properties of execution sequences. Safety Nothing bad ever happens. G bad Liveness Something good eventually happens. F good

20 CMSC 630 February 25, More Kinds of Properties Responsiveness Every request is eventually serviced. G(req F serviced) Reactivity (GF enabled) (GF executed) Partition φ 1 U (φ 2 U φ 3 )

21 CMSC 630 February 25, Example: Specifying Mutual Exclusion A = {in i, out i, trying i },i = 1,2. Mutual Exclusion G (in 1 in 2 ) Starvation-Freedom for Process 1 G(trying 1 F in 1 ) 1-Bounded Overtaking for Process 1 G(trying 1 (trying 2 U in 2 U in 1 ))

22 CMSC 630 February 25, But What About System Properties? So far we have used LTL to define properties of executions. How do we use it to define properties/requirements of systems? Idea Define a system to satisfy a formula if all its executions do. How to make this precise?

23 CMSC 630 February 25, Formalizing sat LetM = S,A,R,l,s I be a Kripke structure. π = s 0 s 1... S ω is an execution ofm if: s 0 = s I For alli 0, s i,s i+1 R or for alls S, s i,s R ands i+1 = s i. E(M): set of all executions ofm. l(s 0 s 1...) = l(s 0 )l(s 1 )... M satφ if for allπ E(M),l(π) = φ.

24 CMSC 630 February 25, What We Have a verification framework based on LTL! Systems: Requirements: sat: Kripke structures LTL formulas sat What s next? 1. Other temporal logics. 2. How to showm satφ.

25 CMSC 630 February 25, Branching-Time Temporal Logic Recall: Two kinds of temporal logic: linear-time and branching-time Linear-time: models are sequences Branching-time: models are trees (alternatively, states in Kripke structures) How do we define a branching-time temporal logic?

26 CMSC 630 February 25, CTL = LTL+Path Quantifiers The CTL approach: add path quantifiers to LTL! Eφ: satisfied by a state if there exists a path from the state and satisfyingφ. E is a path quantifier.

27 CMSC 630 February 25, Syntax of CTL Defines state formulas... σ ::= a σ σ σ Eφ Σ CTL : set of all CTL (state) formulas.

28 CMSC 630 February 25, Syntax of CTL (cont.)... and path formulas. φ ::= σ φ φ φ Xφ φ U φ Φ CTL : set of all CTL path formulas.

29 CMSC 630 February 25, Defining Semantics of CTL... given with respect to Kripke structurem = S,A,R,l,s I as relation = M (S Σ CTL ) (S ω Φ CTL )... i.e. states related to state formulas and paths to path formulas. FixM in what follows. Notation E(M,s) S ω : execution paths emanating froms. π E(M,s) if: π[0] = s For alli 0, π[i],π[i+1] R or for alls S, π[i],s R andπ[i+1] = π[i].

30 CMSC 630 February 25, Semantics of State Formulas s = M a ifa l(s). s = M σ ifs = M σ. s = M σ 1 σ 2 ifs = M σ 1 ors = M σ 2. s = M Eφ if there existsπ E(M,s) such thatπ = M φ.

31 CMSC 630 February 25, Semantics of Path Formulas π = M σ ifπ[0] = M σ. π = M φ ifπ = M φ. π = M φ 1 φ 2 ifπ = M φ 1 orπ = M φ 2. π = M Xφ ifπ[1..] = M φ. π = M φ 1 Uφ 2 if i 0. σ[i..] = M φ 2 and j < i. σ[j..] = M φ 1 Note:,, X, U as in LTL! Derived operators: usual LTL derived operators, A E.

32 CMSC 630 February 25, CTL Verification Framework Sys: Kripke structuresm = S,A,R,l,s I Spec: CTL state formulasσ Σ CTL sat: M satσ ifs I = M σ.

33 CMSC 630 February 25, Expressing Properties in CTL Possibility Any message can be lost. AG(sent EF lost) LTL Any LTL system specificationφcan be rendered as a CTL state formula Aφ. So CTL is at least as expressive a system specification notation as LTL. In fact, it is more so (LTL can t express E).

34 CMSC 630 February 25, CTL a sublogic of CTL... development preceded that of CTL... stands for Computation Tree Logic... first temporal logic used in model checking CTL formulas: state formulas in CTL in which every path modality (U, X, G, etc.) is immediately preceded by a path quantifier. CTL AG(sent AF received) Not CTL AG(sent F received)

35 CMSC 630 February 25, Formal CTL Syntax Note All CTL formulas are state formulas. σ ::= a σ σ σ EXσ E(σ Uσ) E(σ Rσ) Σ CTL : set of all CTL formulas. Recall that R is dual of U. Derived operators: AX, AU, AR, EG, EF, AG, AF, etc.

36 CMSC 630 February 25, Expressiveness of CTL System Specifications No more expressive than CTL, sinceσ CTL Σ CTL. Incomparable to LTL: CTL can express possibility properties. LTL can express fairness properties. AFGa expressible in LTL, not in CTL. Consequently, strictly less expressive than CTL! (Why?)