Systems Verification. Alessandro Abate. Day 1 January 25, 2016

Transcription

1 Systems Verification Alessandro Abate Day 1 January 25, 2016

2 Outline Course setup Intro to formal verification Models - labelled transition systems Properties as specifications - modal logics Model checking algorithms

3 Instructors, TAs, times Alessandro Abate (day 1, 4) Marta Kwiatkovska (day 2, 3) Daniel Kroening (day 5) Maria Svorenova, Sadegh E.Z. Soudjani Lectures in the mornings Practicals in the afternoons (except for Friday)

4 Organisation of the module assessment: participation to lectures and practicals readings BK08 C. Baier and J.-P. Katoen, Principles of Model Checking. The MIT Press. Cambridge, MA, USA, CGP99 E.M. Clarke, O. Grumberg, and D.A. Peled, Model Checking, MIT Press. Cambridge, MA, USA, HR04 M. Huth and M, Ryan, Logic in Computer Science - modelling and reasoning about systems, Cambridge Univ. Press, T09 P. Tabuada, Verification and Control of Hybrid Systems, A symbolic approach, Springer, KS08 D. Kroening and O. Strichman, Decision procedures, Springer, tools SPIN/nuSMV, PRISM, FAUST2

5 Objectives of the course To familiarise with the main concepts in systems modelling and property specification To explain the fundamentals of explicit algorithms in qualitative and quantitative model checking To gain practical experience of verification tools and how they are applied through examples To give appreciation of relevant research directions in systems verification and synthesis

6 High-level overview of the course Formalise models of systems under verification Formally study properties (verify specifications) of models expressed in some logics Develop algorithms and data structures to check that the model of a system satisfies a given property Applications to hardware and software systems, extensions to more general systems (biology, autonomy, robotics)

7 List of topics to be covered in the course day 1 Basics of verification. Transition systems, quantitative requirements, temporal logics (LTL and CTL). Fundamentals of algorithmic verification (via model checking). day 2 Verification of Markov models, time and rewards, probabilistic temporal logics. Overview of algorithms, including statistical model checking. day 3 Verification for models with non-determinism/decisions: Markov decision processes, issues of time and rewards. Stochastic games. Main algorithms for verification and strategy/controller synthesis. day 4 Hybrid systems. From discrete to continuous models. The role of stochasticity. Formal abstractions for automated verification and symbolic controller synthesis. Software tools for verification and synthesis of complex control models. day 5 Propositional satisfiability (SAT) checking, SMT solving. Bounded model checking (BMC). Unbounded verification with SAT/SMT and inductive reasoning. Applications to software.

8 Outline Course setup Intro to formal verification Models - labelled transition systems Properties as specifications - modal logics Model checking algorithms

9 What is verification? Have you actually made what you were trying to make? verification vs validation 1 Does the hardware/software system satisfy all the properties characterising its specification? 2 Is the specification of the system correct? ( Have you made the right thing? ) 1 a-priori, provably correct-by-design 2 a-posteriori, tested to work correctly

10 Limitations of validation validation by testing manual inspection, very costly and error prone validation via simulation computer-based, but often lengthy and imprecise

11 Limitations of validation validation by testing manual inspection, very costly and error prone validation via simulation computer-based, but often lengthy and imprecise Testing/simulation shows the presence of errors, does not prove their absence [Edsger W. Dijkstra]

12 Bugs/errors are everywhere (particularly where they shouldn t be) Therac-25 patients receiving excessive radiation; Bank of New York corrupted database of bond market; FPU of Pentium errors; Ariane explosion; Knight Capital Group default, Denver Airport halt, Toyota Prius recall...

13 The practical need for formal verification Not only reasons of safety, it s also about the money... Bank of New York bug: $ 5 million Pentium bug: $ 475 million Ariane bug: $ 500 million Blackout bug: $ 6 billion Denver bug: $ 300 million Knight bug: $ 440 million The cost of software bugs to the U.S. economy is estimated at $ 60 billion per year. National Institute of Standards and Technology, 2002

14 When are bugs introduced and detected? System Verification 5 Analysis Conceptual Design Programming Unit Testing System Testing Operation 50% % 30% introduced errors (in %) detected errors (in %) cost of correction 10 per error (in 1,000 US $) % 5 10% 2.5 0% Time (non-linear) 0 Figure 1.3: Software lifecycle and error introduction, detection, and repair costs [275]. Christel Baier and Joost-Pieter Katoen. Principles of Model Checking. The MIT Press. Cambridge, MA, USA About 50% of all defects are introduced during programming, the phase in which actual coding takes place. Whereas just 15% of all errors are detected in the initial design stages, most errors are found during testing. At the start of unit testing, which is oriented to discovering defects in the individual software modules that make up the system, a defect density of about 20 defects per 1000 lines of (uncommented) code is typical. This has been reduced to about 6 defects per 1000 code lines at the start of system testing, where acollectionofsuchmodulesthatconstitutesarealproductistested. Onlaunchinganew software release, the typical accepted software defect density is about one defect per 1000

15 Why are bugs introduced? Hardware and software systems - particularly when embedded within physical components - are among the most complex artefacts ever produced by humans. transistors: 55 million area: 146 mm 2 clock rate: Hz Pentium 4 microprocessor

16 How does verification detect bugs? property checking: does system (model) S satisfy property P? equivalence checking: are systems (models) S 1 and S 2 equivalent? in this course, the focus will be on property checking

17 What is formal about formal verification? the system is formalised as some mathematical model the property is formalised within a temporal logic checking whether the system satisfies the property is formalised, that is formally proven

18 Why is formal verification computer-aided? a formal proof that a system satisfies a property may consist of millions of steps without the use of clever algorithms and data structures, proving that a system satisfies a property can be quite impractical automatic techniques are user- and industry-friendly formal verification can be performed via model checking

19 Model checking: a computer-aided, formal verification paradigm model M property p model checker: does M verify p? yes no: counterexample

20 The industrial impact of model checking verification of protocols, circuits, hardware, software

21 Outline Course setup Intro to formal verification Models - labelled transition systems Properties as specifications - modal logics Model checking algorithms

22 Model of a system given a system (e.g., a physical device, a hardware circuit, or software code), a model represents an abstraction of it all models are wrong, but some are useful [G.E.P. Box] many levels of abstraction are possible many models of a system can be made; abstraction/refinement (choice of right model) ought to be part of the modelling effort formal verification asserts properties of a model, not of the underlying system

23 (Labeled) transition system Definition A transition system is a tuple S,, I, AP, L consisting of a set S of states, a transition relation S S, a set I S of initial states, a set AP of atomic propositions (alphabet), and a labelling function L : S 2 AP. a TS is also known as Kripke structure [CGP99] internal non-determinism a TS can be as well action enabled [BK08] (next slide)

24 (Labeled) transition system with actions Definition A transition system is a tuple S, Act,, I, AP, L consisting of a set S of states, a set Act of actions, a transition relation S Act S, a set I S of initial states, a set AP of atomic propositions (alphabet), and a labelling function L : S 2 AP. action enabled TS are closely related to Moore machines actions: internal vs. external non-determinism henceforth, for simplicity we will work with the first definition

25 On LTS models can write s s instead of (s, s ) we consider exclusively transition relations such that each state has an outgoing transition, that is s S : s S : s s this is known as non-blocking condition, as absence of a terminal state here we consider finite TS, namely assume S has finite cardinality

26 Example: model of a traffic light System description: A traffic light can be red, green, amber or black (not working). The traffic light might stop working at any time. After it has been repaired, it turns red. Initially, the light is red. 1 red 2 amber and red 3 green 4 amber 5 black S = {1, 2, 3, 4, 5}

27 Example: model of a traffic light System description: A traffic light can be red, green, amber or black (not working). The traffic light might stop working at any time. After it has been repaired, it turns red. Initially, the light is red. S = {1, 2, 3, 4, 5} = {(1, 2), (2, 3), (3, 4), (4, 1), (1, 5), (2, 5), (3, 5), (4, 5), (5, 1)} I = {1} AP = {r, a, g} L = {1 {r}, 2 {r, a}, 3 {g}, 4 {a}, 5 }

28 Example: model of a traffic light System description: A traffic light can be red, green, amber or black (not working). The traffic light might stop working at any time. After it has been repaired, it turns red. Initially, the light is red

29 Direct predecessors and successors Definition For s S, the set Post(s) of direct successors of s is defined by Post(s) = { s S s s }. For s S, the set Pre(s) of direct predecessors of s is defined by Pre(s) = { s S s s }.

30 Post and Pre Definition The set Post (s) consists of the states reachable in the state graph from s. Let C S. The set Post (C) is defined by Post (C) = Post (s). s C The set Pre (s) consists of the states that can reach s in the state graph. Let C S. The set Pre (C) is defined by Pre (C) = Pre (s). s C Reach(TS) = Post (I ) is the reachability set of TS from I related to safety analysis (and used for CTL model checking)

31 Determinism of a transition system Definition A TS S,, I, AP, L is deterministic if I = 1, and if s S, (Post(s)) = 1, where ( ) denotes the cardinality of a set. Else the TS is non-deterministic. (above notion refers to internal non-determinism)

32 Path fragment, path, trace nomenclature: path, run, execution, trajectory are synonyms Definition Consider the transition system S,, I, AP, L. A finite path fragment is a finite state sequence s 0 s 1... s n for some n 0 such that s i Post(s i 1 ) for all 0 < i n. An infinite path fragment is an infinite state sequence s 0 s 1... such that s i Post(s i 1 ) for all i > 0. A path fragment is initial if s 0 I. A path is an initial infinite path fragment Paths(TS) A trace is the output of a path: L(s 0 )L(s 1 )...

33 Path Give an example of a finite initial path fragment: Give an example of an initial infinite path fragment (a path):

34 Path Give an example of a finite initial path fragment: Give an example of an initial infinite path fragment (a path): (15) ω

35 Some notational conventions let π = s 0 s 1... be an infinite path fragment (notions below apply to finite path as well) for j 0, the jth state of π, s j is denoted by π[j] (initial state is indexed by 0) for j 0, the jth prefix of π, s 0 s 1... s j is denoted by π[..j] π[..j] {}}{ s 0 s 1... s j 1 s j s j+1... for j 0, the jth suffix of π, s j s j+1... is denoted by π[j..] π[j..] {}}{ s 0 s 1... s j 1 s j s j+1... the set of infinite path fragments π with π[0] = s is denoted by Paths(s)

36 Some notational conventions (example) Let π = What is π[4]? What is π[..3]? What is π[5..]? 3

37 Some notational conventions (example) Let π = What is π[4]? 5 What is π[..3]? 1234 What is π[5..]? 12 3

38 Some notational conventions (example, cont d) What is Paths(5)? What is the set of paths of the transition system?

39 Some notational conventions (example, cont d) What is Paths(5)? {(51) ω, (51) 5 Paths(1)} What is the set of paths of the transition system? Paths(TS) = Paths(1) = {(1234) ω, (1234) {1, 12, 123}Paths(5)} = {((1234) (1{ɛ, 2, 23, 234}5) ) {1234, 1{ɛ, 2, 23, 234}5} ω }

40 Example 2: deterministic, finite transition system consider system with 2 variables (x, y), ranging over {0, 1} system starts in state (1, 1), and consists of transition x := (x + y)mod 2 TS can be built as S = {0, 1} {0, 1} I = {(1, 1)} = {((1, 1), (0, 1)), ((0, 1), (1, 1)), ((1, 0), (1, 0)), ((0, 0), (0, 0))} 2 AP = S, L is the identity map

41 Example 2: deterministic, finite transition system consider system with 2 variables (x, y), ranging over {0, 1} system starts in state (1, 1), and consists of transition x := (x + y)mod 2 TS can be built as S = {0, 1} {0, 1} I = {(1, 1)} = {((1, 1), (0, 1)), ((0, 1), (1, 1)), ((1, 0), (1, 0)), ((0, 0), (0, 0))} 2 AP = S, L is the identity map TS path, for the given I, is unique

42 Example 3: transition system for an ODE Ordinary difference equation (ODE) x(k + 1) = f (x(k)), x(0) = x 0, y(k) = Cx(k) e.g. f (x(k)) = Ax(k); k N, x R n

43 Example 3: transition system for an ODE Ordinary difference equation (ODE) x(k + 1) = f (x(k)), x(0) = x 0, y(k) = Cx(k) e.g. f (x(k)) = Ax(k); k N, x R n consider TS where S = R n x x x = f (x) = Ax I = x0 2 AP = R n, L is a linear function with scaling factor C TS is deterministic, but (uncountably) infinite (and with continuous labels set) more about this model on Thursday

44 Example 4: Timed automaton 2 c 10:reset(c) ċ = 1 1 c 2:reset(c) ċ = 1 ċ = 1 2 c 2:reset(c) ċ = 1 1 c 10:reset(c) (not covered in this course)

45 Example 5: Hybrid automaton g 12 (c):reset 12 (c) g 11 (c):reset 11 (c) ċ = f 1 (c) g 41 (c):reset 41 (c) ċ = f 2 (c) ċ = f 4 (c) g 23 (c):reset 23 (c) ċ = f 3 (c) g 34 (c):reset 34 (c) g 33 (c):reset 33 (c) variable c is a vector (covered in this course on day 4)

46 Example 6: Markov chain P = (covered in this course on day 2) Markov decision process: M. chains with actions (day 3)

47 Example x: Stochastic hybrid models g 12 (c):reset 12 (c),w.p.0.7 ċ = f 2 (c) g 11 (c):reset 11 (c) dc = f 1 (c)dt + σ 1 (c)dw g 12 (c):reset 12 (c),w.p.0.3 g 23 (c):reset 23 (c) dc = f 3 (c)dt + σ 3 (c)dw g 41 (c):reset 41 (c) g 34 (c):reset 34 (c) g 33 (c):reset 33 (c)w.p.0.4,reset 33 (c)w.p.0.6 ċ = f 4 (c) stochastic differential equations as special instances to be discussed on day 4

48 Outline Course setup Intro to formal verification Models - labelled transition systems Properties as specifications - modal logics Model checking algorithms

49 Modal logics based on propositional and predicate logic used to reason about objects with modalities (expressed via modal operators) in particular, modal operators qualify temporal expressions in this course we shall focus on two classes: LTL and CTL 1. LTL: linear temporal logic 2. CTL: computational tree logic allows encoding fine-grained, complex statements in natural language

50 Syntax of LTL ϕ ::= true a ϕ ϕ ϕ ϕ ϕ U ϕ, a AP alternative expression of more formulae ϕ 1 ϕ 2 = ( ϕ 1 ϕ 2 ) ϕ 1 ϕ 2 = ϕ 1 ϕ 2 and of two temporal modalities ϕ = true U ϕ ϕ = ϕ

51 Alternative syntax in the literature you may encounter the following notations: Xϕ : ϕ Fϕ : ϕ Gϕ : ϕ (notation on left-hand side from [CGP99], on right-hand side from [BK08])

52 Semantics of LTL TS = ϕ iff s I : s = ϕ where s = ϕ iff π Paths(s) : π = ϕ

53 Semantics of LTL where and where (cf. LTL syntax) TS = ϕ iff s I : s = ϕ s = ϕ iff π Paths(s) : π = ϕ π = true π = a iff a L(π[0]) π = ϕ ψ iff π = ϕ π = ψ π = ϕ iff π = ϕ π = ϕ iff π[1..] = ϕ π = ϕ U ψ iff i 0 : π[i..] = ψ 0 j < i : π[j..] = ϕ

54 Alternative semantics of LTL let ϕ be an LTL formula over AP, inducing the LT property Words(ϕ) = {σ (2 AP ) ω σ = ϕ} where (2 AP ) ω = 2 AP 2 AP..., and where σ = true σ = a a 2 AP... TS = ϕ iff Traces(TS) Words(ϕ)

55 LTL properties for the traffic light model how to express the property the light is infinitely often red by an LTL formula? red

56 LTL properties for the traffic light model how to express the property the light is infinitely often red by an LTL formula? red how to express the property once green, the light cannot become red immediately by an LTL formula? (green red)

57 Verification of LTL specs is over linear-time paths back to the traffic light model, consider the following path: π : question: π = red?

58 Verification of LTL specs is over linear-time paths back to the traffic light model, consider the following path: π : question: π = red? answer: yes

59 Verification of LTL specs is over linear-time paths back to the traffic light model, consider the following path: π : question: π = red?

60 Verification of LTL specs is over linear-time paths back to the traffic light model, consider the following path: π : question: π = red? answer: no

61 Verification of LTL specs is over linear-time paths back to the traffic light model, consider the following path: π : question: π = red U green?

62 Verification of LTL specs is over linear-time paths back to the traffic light model, consider the following path: π : question: π = red U green? answer: yes, because L(2) = {red, amber}

63 Verification of LTL specs is over linear-time paths back to the traffic light model, consider the following path: π : question: π = black?

64 Verification of LTL specs is over linear-time paths back to the traffic light model, consider the following path: π : question: π = black? answer: yes

65 Verification of LTL specs is over linear-time paths back to the traffic light model, consider the following path: π : question: π = red?

66 Verification of LTL specs is over linear-time paths back to the traffic light model, consider the following path: π : question: π = red? answer: no

67 Verification of LTL specs is over linear-time paths back to the traffic light model, consider the following path: π : question: π = ( black) U ( red)?

68 Verification of LTL specs is over linear-time paths back to the traffic light model, consider the following path: π : question: π = ( black) U ( red)? answer: yes

69 Classes of LTL specifications question: what class of LTL formulas capture invariants?

70 Classes of LTL specifications question: what class of LTL formulas capture invariants? answer: ϕ, where ϕ ::= true a ϕ ϕ ϕ

71 Classes of LTL specifications question: what class of LTL formulas capture invariants? answer: ϕ, where ϕ ::= true a ϕ ϕ ϕ example: red

72 Classes of LTL specifications question: how is the class of safety properties characterized?

73 Classes of LTL specifications question: how is the class of safety properties characterized? answer: nothing bad ever happens

74 Classes of LTL specifications question: how is the class of safety properties characterized? answer: nothing bad ever happens example: a red light is immediately preceded by amber question: how can we express this property in LTL?

75 Classes of LTL specifications question: how is the class of safety properties characterized? answer: nothing bad ever happens example: a red light is immediately preceded by amber question: how can we express this property in LTL? answer: red ( red amber)

76 Classes of LTL specifications question: how is the class of liveness properties characterized?

77 Classes of LTL specifications question: how is the class of liveness properties characterized? answer: something good eventually happens

78 Classes of LTL specifications question: how is the class of liveness properties characterized? answer: something good eventually happens example: the light is infinitely often red question: how can we express this property in LTL?

79 Classes of LTL specifications question: how is the class of liveness properties characterized? answer: something good eventually happens example: the light is infinitely often red question: how can we express this property in LTL? answer: red

80 Expressiveness of LTL are there temporal properties we cannot express in LTL? yes, example: always a state satisfying a can be reached

81 Expressiveness of LTL are there temporal properties we cannot express in LTL? yes, example: always a state satisfying a can be reached example 2: π Paths(TS) : m 0 : π Paths(π[m]) : n 0 : π [n] = a.

82 Expressiveness of LTL are there temporal properties we cannot express in LTL? yes, example: always a state satisfying a can be reached example 2: π Paths(TS) : m 0 : π Paths(π[m]) : n 0 : π [n] = a. a { }} { { a }} { π Paths(TS) : m 0 : π Paths(π[m]) : n 0 : π [n] = a }{{} } {{ a } a

83 Outline Course setup Intro to formal verification Models - labelled transition systems Properties as specifications - modal logics Model checking algorithms

84 Unfolding of a transition system the following transition system can be unfolded via its paths as follows... 3

85 LTL, a linear temporal logic

86 CTL, a branching temporal logic

87 Syntax of CTL state formulae are defined by Φ ::= true a Φ Φ Φ ϕ ϕ path formulae are defined by ϕ ::= Φ Φ U Φ

88 Syntax of CTL state formulae are defined by Φ ::= true a Φ Φ Φ ϕ ϕ path formulae are defined by ϕ ::= Φ Φ U Φ two temporal modalities are introduced as Φ = (true U Φ) Φ = (true U Φ) Φ = (true U Φ) Φ = (true U Φ)

89 CTL properties for the traffic light model question: how to express the property each red light is preceded by an amber light in CTL?

90 CTL properties for the traffic light model question: how to express the property each red light is preceded by an amber light in CTL? answer: red (amber red) (derive via implication rule)

91 CTL properties for the traffic light model question: how to express the property the light is infinitely often green in CTL?

92 CTL properties for the traffic light model question: how to express the property the light is infinitely often green in CTL? answer: green

93 Semantics of CTL where (cf. CTL syntax) and where TS = Φ iff s I : s = Φ s = true s = a iff a L(s) s = Φ Ψ iff s = Φ s = Ψ s = Φ iff s = Φ s = ϕ iff π Paths(s) : π = ϕ s = ϕ iff π Paths(s) : π = ϕ π = Φ iff π[1] = Φ π = Φ U Ψ iff i 0 : π[i] = Ψ 0 j < i : π[j] = Φ

94 Semantics of CTL where (cf. CTL syntax) and where TS = Φ iff s I : s = Φ s = true s = a iff a L(s) s = Φ Ψ iff s = Φ s = Ψ s = Φ iff s = Φ s = ϕ iff π Paths(s) : π = ϕ s = ϕ iff π Paths(s) : π = ϕ π = Φ iff π[1] = Φ π = Φ U Ψ iff i 0 : π[i] = Ψ 0 j < i : π[j] = Φ Satisfaction set Sat(Φ) is defined by Sat(Φ) = { s S s = Φ } Thus, TS = Φ iff I Sat(Φ)

95 On the semantics of CTL temporal modalities recall that Φ = (true U Φ) question: how is defined? s = Φ

96 On the semantics of CTL temporal modalities recall that Φ = (true U Φ) question: how is defined? s = Φ answer: π Paths(s) : i 0 : π[i] = Φ

97 On the semantics of CTL temporal modalities recall that Φ = (true U Φ) question: how is defined? s = Φ

98 On the semantics of CTL temporal modalities recall that Φ = (true U Φ) question: how is defined? s = Φ answer: π Paths(s) : i 0 : π[i] = Φ

99 On the semantics of CTL temporal modalities recall that Φ = (true U Φ) question: how is defined? s = Φ answer: π Paths(s) : i 0 : π[i] = Φ (likewise for the other two temporal modalities)

100 Example of CTL semantics via TS unfolding question: green? answer:

101 Example of CTL semantics via TS unfolding question: green? answer: yes

102 Example of CTL semantics via TS unfolding question: black? answer:

103 Example of CTL semantics via TS unfolding question: black? answer: no

104 Example of CTL semantics via TS unfolding question: black? answer:

105 Example of CTL semantics via TS unfolding question: black? answer: yes

106 Example of CTL semantics via TS unfolding question: black? answer:

107 Example of CTL semantics via TS unfolding question: black? answer: no

108 Example of CTL semantics via TS unfolding question: (( black) U black)? answer:

109 Example of CTL semantics via TS unfolding question: (( black) U black)? answer: yes

110 Expressiveness of LTL and CTL L 425 CTL LTL CTL (a a) a (a a) a a Figure 6.27: Relationship between LTL CTL and CTL. CTL is a modal logic encompassing both LTL and CTL of the consequences of this fact, is that as in LTL fairness assumptions can be ressed syntactically in CTL. For instance, for fairness assumption fair, formulaeof form (fair ϕ) or (fair ϕ)

111 Expressiveness of LTL and CTL L 425 CTL LTL CTL (a a) a (a a) a a Figure 6.27: Relationship between LTL CTL and CTL. CTL is a modal logic encompassing both LTL and CTL of the consequences other logics of this are also fact, used is that as (e.g., in ν-calculus, LTL fairness epistemic assumptions l.,... ) can be ressed syntactically in CTL. For instance, for fairness assumption fair, formulaeof form (fair ϕ) or (fair ϕ)

112 Outline Course setup Intro to formal verification Models - labelled transition systems Properties as specifications - modal logics Model checking algorithms

113 Model checking procedure formalised model of a system yes does model satisfy property? formalised property no, c-example

114 Model checking procedure over CTL formulae (labeled) transition system TS yes, I Sat(Φ) TS = Φ? CTL formula Φ no, I Sat(Φ) c-example

115 Model checking procedure over LTL formulae (labeled) transition system TS yes, Traces(TS) Words(Φ) TS = Φ? LTL formula Φ no, c-example

116 Model checking CTL: main idea recall that TS = Φ iff I Sat(Φ) basic idea: compute Sat(Φ) by recursion on the structure of Φ, then compare Sat(Φ) with I alternative view: label each state with the subformulae of Φ that it satisfies (i.e. with the subformulae that are satisfied on that state) until while formula is covered, then check whether the entire I is tagged by Φ

117 Model checking CTL consider CTL formula Φ = a (b U c) structure of of Φ is given by its syntax tree (parse tree) leaves have atomic propositions nodes have operators U a b c

118 Model checking CTL CTL formulae are defined by Φ ::= true a Φ Φ Φ Φ (Φ U Φ) Φ (Φ U Φ) Question What is Sat(a)?

119 Model checking CTL CTL formulae are defined by Φ ::= true a Φ Φ Φ Φ (Φ U Φ) Φ (Φ U Φ) Question What is Sat(a)? Answer Sat(a) = { s S a L(s) } S Alternative view Label each state s satisfying a L(s) with a

120 Model checking CTL CTL formulae are defined by Φ ::= true a Φ Φ Φ Φ (Φ U Φ) Φ (Φ U Φ) Question What is Sat(Φ Ψ)?

121 Model checking CTL CTL formulae are defined by Φ ::= true a Φ Φ Φ Φ (Φ U Φ) Φ (Φ U Φ) Question What is Sat(Φ Ψ)? Answer Sat(Φ Ψ) = Sat(Φ) Sat(Ψ) Alternative view Label states, that are labelled with both Φ and Ψ, also with Φ Ψ

122 Model checking CTL CTL formulae are defined by Φ ::= true a Φ Φ Φ Φ (Φ U Φ) Φ (Φ U Φ) Question What is Sat( Φ)?

123 Model checking CTL CTL formulae are defined by Φ ::= true a Φ Φ Φ Φ (Φ U Φ) Φ (Φ U Φ) Question What is Sat( Φ)? Answer Sat( Φ) = { s S Post(s) Sat(Φ) } Alternative view Labels those states that have a (not necessarily all) direct successor labelled with Φ, with Φ

124 Model checking CTL CTL formulae are defined by Φ ::= true a Φ Φ Φ Φ (Φ U Φ) Φ (Φ U Φ) Question What is Sat( (Φ U Ψ))?

125 Model checking CTL CTL formulae are defined by Φ ::= true a Φ Φ Φ Φ (Φ U Φ) Φ (Φ U Φ) Question What is Sat( (Φ U Ψ))? Proposition Sat( (Φ U Ψ)) is the smallest subset T of S such that (a) Sat(Ψ) T, and (b) if s Sat(Φ) and Post(s) T then s T Notice that: (Φ U Ψ) = Ψ (Φ (Φ U Ψ)); pick T = (Φ U Ψ), then T satisfies conditions above condition above can be implemented via reachability procedure

126 Computation of Sat( (Φ U Ψ)) condition above can be implemented via reachability procedure existence of least fixpoint via lattice theory (Tarski-Knaster s fixpoint theorem) over finite TS, procedure completes in finite time but valid also for more complicated (infinite-state) models

127 Model checking CTL comments in its explicit version, boils down to state-space reachability analysis, over the formula tree clearly, this wouldn t scale to models of high cardinality in its practice, CTL MC leverages a symbolic implementation plus a number of other techniques, such as BMC, SAT-based counterexample generation, induction, interpolations, abstractions/refinements nusmv is a CTL model checker widely used

128 Outline Course setup Intro to formal verification Models - labelled transition systems Properties as specifications - modal logics Model checking algorithms

129 Model checking LTL: main idea LTL model checking algorithm takes a model TS and a formula ϕ and returns yes if TS = ϕ no and a counter-example if TS = ϕ

130 Model checking LTL: main idea LTL model checking algorithm takes a model TS and a formula ϕ and returns yes if TS = ϕ no and a counter-example if TS = ϕ here we look into the automata-based approach (alternatively, tableau construction, and indeed, many more alternatives!)

131 Model checking LTL: essential steps consider model TS, LTL property ϕ qualitatively, TS = ϕ if for all the paths π of TS it holds that π = ϕ, namely if Trace(π) Words(ϕ) equivalently, TS admits no path π such that π = ϕ; if such a path π exists, it is a counterexample for TS over ϕ

132 Model checking LTL: essential steps consider model TS, LTL property ϕ qualitatively, TS = ϕ if for all the paths π of TS it holds that π = ϕ, namely if Trace(π) Words(ϕ) equivalently, TS admits no path π such that π = ϕ; if such a path π exists, it is a counterexample for TS over ϕ more formally, TS = ϕ Traces(TS) Words(ϕ) ( ) Traces(TS) (2 AP ) ω \ Words(ϕ) = Traces(TS) Words( ϕ) =

133 Model checking LTL: essential steps consider model TS, LTL property ϕ qualitatively, TS = ϕ if for all the paths π of TS it holds that π = ϕ, namely if Trace(π) Words(ϕ) equivalently, TS admits no path π such that π = ϕ; if such a path π exists, it is a counterexample for TS over ϕ more formally, TS = ϕ Traces(TS) Words(ϕ) ( ) Traces(TS) (2 AP ) ω \ Words(ϕ) = Traces(TS) Words( ϕ) = let s look into the entity Words( ϕ)

134 Expressing formulae via models let s look into the entity Words( ϕ)

135 Expressing formulae via models let s look into the entity Words( ϕ) first, we relate to an LTL formula ( ϕ) a model, namely an automaton A ϕ recall that Words( ϕ) (2 AP ) ω (is ω-regular) we need an non-terminating automaton with an alphabet Σ on 2 AP : as an option, use of NBA then, we look at the language associated to the automaton, L ω (A ϕ )

136 Expressing formulae via models let s look into the entity Words( ϕ) first, we relate to an LTL formula ( ϕ) a model, namely an automaton A ϕ recall that Words( ϕ) (2 AP ) ω (is ω-regular) we need an non-terminating automaton with an alphabet Σ on 2 AP : as an option, use of NBA then, we look at the language associated to the automaton, L ω (A ϕ ) finally, express check Traces(TS) Words( ϕ) = as Traces(TS) L ω (A ϕ ) =

137 GNBA - syntax Definition A generalised non-deterministic Büchi automaton G is a tuple (Q, Σ, δ, Q 0, F), where Q is a finite state space, Σ is an alphabet, δ : Q Σ 2 Q is a transition relation, Q 0 Q is a set of initial states, F 2 Q are the accepting states.

138 GNBA - accepting run NBA A is obtained as special case where F = F Q, that is a GNBA G is an NBA A whenever F is a singleton additional special cases: DBA (deterministic, less expressive) NFA (finite runs different semantics, equiv. to DFA)

139 GNBA - accepting run NBA A is obtained as special case where F = F Q, that is a GNBA G is an NBA A whenever F is a singleton additional special cases: DBA (deterministic, less expressive) NFA (finite runs different semantics, equiv. to DFA) for NBA, an accepting run for σ = A 0 A 1 A 2... Σ ω is a sequence q 0 q 1 q 2..., where q 0 Q 0, q i Q, and δ(q i, A i ) = q i+1 ; and q i F for infinitely many indices for GNBA, last condition becomes: for all F F, q i F for infinitely many indices

140 (G)NBA - examples ϕ = a A : q 0 a a a a q 1 ϕ = (a b) A : q 0 b a b a b b q 1 (double circles denote accepting states)

141 Model checking LTL: essential steps consider model TS, LTL property ϕ TS = ϕ Traces(TS) Words(ϕ) Traces(TS) (2 AP ) ω \ Words( ϕ) ( ) Traces(TS) (2 AP ) ω \ Words(ϕ) = Traces(TS) Words( ϕ) = Traces(TS) L ω (A ϕ ) = TS A ϕ = F TS A ϕ is a product automaton F is set of accepting states of A ϕ

142 Product Automaton - example model of pedestrian traffic light (green, red) TS ϕ = g, thus ϕ = g; build A ϕ TS : r g T A ϕ : q 0 g g q 1 T q g 2

143 Product Automaton - example model of pedestrian traffic light (green, red) TS ϕ = g, thus ϕ = g; build A ϕ TS : r g T A ϕ : q 0 g g q 1 T g q 2 TS A ϕ : r, q 0 ; q 0 r, q 1 ; q 1 r, q 2 ; q 2 g, q 0 ; q 0 g, q 1 ; q 1 g, q 2 ; q 2

144 Product Automaton - example model of pedestrian traffic light (green, red) TS ϕ = g, thus ϕ = g; build A ϕ TS : r g T A ϕ : q 0 g g q 1 T g q 2 TS A ϕ : r, q 0 ; q 0 r, q 1 ; q 1 r, q 2 ; q 2 g, q 0 ; q 0 g, q 1 ; q 1 g, q 2 ; q 2 P pers(a) = q 1 TS A ϕ = P pers(a) TS = ϕ

145 Comments on LTL model checking algorithm again LTL boils down to reachability analysis however in the practice... on-the-fly procedures symbolic procedures with BDD, SAT-based BMC, use of counter-examples, Craig interpolation and induction, abstractions and refinements compositional verification SPIN is an LTL model checker widely used

146 Outline Course setup Intro to formal verification Models - labelled transition systems Properties as specifications - modal logics Model checking algorithms

147 Support reading from [BK08] for this lecture ch 2 LTS models ch 4 LT properties ch 5 LTL - logic and model checking algorithms ch 6 CTL - logic and model checking algorithms ch 7 equivalences and abstractions