Model Checking. Temporal Logic. Fifth International Symposium in Programming, volume. of concurrent systems in CESAR. In Proceedings of the

Transcription

1 Sérgio Campos, Edmund Why? Advantages: No proofs Fast Counter-examples No problem with partial specifications can easily express many concurrency properties Main Disadvantage: State Explosion Problem Too many processes Data Paths Much progress has been made on this problem recently Tree Problem 1 / 34 Tree Problem 3 / 34 Specification Language: A propositional temporal logic called CTL. Verification Procedure: Exhaustive search of the state space of the concurrent system to determine if the specification is true or not. E. M. and E. A. Emerson. Synthesis of synchronization skeletons for branching time temporal logic. In Logic of programs: workshop Yorktown Heights NY May 1981, volume 131 of Lecture Notes in Computer Science. Springer-Verlag, J.P. Quielle and J. Sifakis. Specification and verification of concurrent systems in CESAR. In Proceedings of the Fifth International Symposium in Programming, volume 137 of Lecture Notes in Computer Science. Springer-Verlag, Finite-state systems are modeled by labeled state-transition graphs, called Kripke Structures. If some state is designated as the initial state, the structure can be unwound into an infinite tree with that state as the root. We will refer to the infinite tree obtained in this manner as the computation tree of the system. Paths in the tree represent possible computations or behaviors of the program. Tree Problem 2 / 34 Tree Problem 4 / 34

2 Cont.) State Transition Graph or Kripke Model b c c b c c c c Infinite Tree (Unwind State Graph to obtain Infinite Tree) Tree Temporal logics may differ according to how they handle branching in the underlying computation tree. In a linear temporal logic, operators are provided for describing events along a single computation path. In ranching-time logic the temporal operators quantify over the paths that are possible from a given state. Tree Problem 5 / 34 Tree Problem 7 / 34 Cont.) Formally, a Kripke structure is a triple M = S R L, where S is the set of states, R S S is the transition relation, and L : S (AP) gives the set of atomic propositions true in each state. We assume that R is total (i.e., for all states s S there exists a state s S such that (s s ) R). A path in M is an infinite sequence of states, π = s0 s1... such that for i 0, (s s1) R. We write π to denote the suffix of π starting at s. Unless otherwise stated, all of our results apply only to finite Kripke structures. The computation tree logic CTL combines both branching-time and linear-time operators. In this logic a path quantifier can prefix an assertion composed of arbitrary combinations of the usual linear-time operators. 1. Path quantifier: for every path E there exists a path 2. Linear-time operators: Xp p holds next time. Fp p holds sometime in the future Gp p holds globally in the future puq p holds until q holds Tree Problem 6 / 34 Tree Problem 8 / 34

3 Path Formulas and State Formulas The syntax of state formulas is given by the following rules: If p AP, then p is a state formula. If f and g are state formulas, then f and f g are state formulas. If f is a path formula, then E(f ) is a state formula. Two additional rules are needed to specify the syntax of path formulas: If f is a state formula, then f is also a path formula. If f and g are path formulas, then f, f g, X f, and U fg are path formulas. Path Formulas If f is a path formula, M π = f means that f holds along path π in Kripke structure M. Assume g1 and g2 are path formulas and f is a state formula. The relation M π = f is defined inductively as follows: 1. π = f s is the first state of π and s = f. 2. π = g1 π = g1. 3. π = g1 g2 π = g1 or π = g2. 4. π = X g1 π 1 = g1. 5. π = U g1g2 there exists a k 0 such that π k = g2 and for 0 j < k, π j = g1. Tree Problem 9 / 34 Tree Problem 11 / 34 State Formulas If f is a state formula, the notation M s = f means that f holds at state s in the Kripke structure M. Assume f1 and f2 are state formulas and g is a path formula. The relation M s = f is defined inductively as follows: 1. s = p p L(s). 2. s = f1 s = f1. 3. s = f1 f2 s = f1 or s = f2. 4. s = E(g) there exists a path π starting with s such that π = g. Standard Abbreviations The customary abbreviations will be used for the connectives of propositional logic. In addition, we will use the following abbreviations in writing temporal operators: (f ) E( f ) F f U truef G f F f Tree Problem 10 / 34 Tree Problem 12 / 34

4 CTL is a restricted subset of CTL that permits only branching-time operators each of the linear-time operators G, F, X, and U must be immediately preceded by a path quantifier. More precisely, CTL is the subset of CTL that is obtained if the following two rules are used to specify the syntax of path formulas. If f and g are state formulas, then X f and U fg are path formulas. If f is a path formula, then so is f. Example: G(EF p) Expressive Power It can be shown that the three logics discussed in this section have different expressive powers. For example, there is no CTL formula that is equivalent to the LTL formula (FG p). Likewise, there is no LTL formula that is equivalent to the CTL formula G(EF p). The disjunction (FG p) G(EF p) is a CTL formula that is not expressible in either CTL or LTL. Tree Problem 13 / 34 Tree Problem 15 / 34 Linear temporal logic (LTL), on the other hand, will consist of formulas that have the form f where f is a path formula in which the only state subformulas permitted are atomic propositions. More precisely, a path formula is either: If p AP, then p is a path formula. If f and g are path formulas, then f, f g, X f, and U fg are path formulas. Example: (FG p) There are eight basic CTL operators: X and EX, G and EG, F and EF, U and EU Each of these can be expressed in terms of EX, EG, and EU: X f = EX( f ) G f = EF( f ) F f = EG( f ) EF f = E[true U f ] [f U g] E[ g U f g] EG g Tree Problem 14 / 34 Tree Problem 16 / 34

5 Cont.) The four most widely used CTL operators are illustrated below. Each computation tree has the state s0 as its root. M s0 = EF g M s0 = F g M s0 = EG g M s0 = G g True or Counterexample Tree Problem 17 / 34 Tree Problem 19 / 34 The Problem Let M be the state transition graph obtained from the concurrent system. Let f be the specification expressed in temporal logic. Find all states s of M such that M s = f. There exist very efficient model checking algorithms for the logic CTL. E. M., E. A. Emerson, and A. P. Sistla. Automatic verification of finite-state concurrent systems using temporal logic specifications. ACM Trans. Programming Languages and Systems, 8(2):pages , Basic M s0 = EF p? Tree Problem 18 / 34 Tree Problem 20 / 34

6 Basic M s0 = EF p? U1 = p EX U0 Basic M s0 = EF p? U3 = p EX U2 Tree Problem 21 / 34 Tree Problem 23 / 34 Basic M s0 = EF p? U2 = p EX U1 Basic M s0 = EF p? U4 = p EX U3 Tree Problem 22 / 34 Tree Problem 24 / 34

7 Basic M s0 = EG a F b? M s0 = F a F b? ~ Basic M s0 = EG a F b? M s0 = F a F b? ~ AF ~a Tree Problem 25 / 34 Tree Problem 27 / 34 Basic M s0 = EG a F b? M s0 = F a F b? ~ AF ~a Basic M s0 = EG a F b? M s0 = F a F b? ~ AF ~a Tree Problem 26 / 34 Tree Problem 28 / 34

8 Basic M s0 = EG a F b? M s0 = F a F b? ~AF ~a ~ AF ~a ~AF ~a Mutual Exclusion Example ~AF ~a Tree Problem 29 / 34 Tree Problem 31 / 34 Mutual Exclusion Example n t c t c Mutual Exclusion Example t n t n Tree Problem 30 / 34 Tree Problem 32 / 34

9 Mutual Exclusion Example Tree Problem 33 / 34 The Kyoto University Verifier Vectorized version of EMC algorithm on Fujitsu FACOM VP400E using an explicit representation of the state transition graph. State Machine size: 131,072 states 67,108,864 transitions 512 transitions from each state on the average. CTL formula: 113 different subformulas. Time for model checking: 225 seconds Tree Problem 34 / 34