In recent years CTL and LTL logics have been used with considerable industrial success.

Transcription

1 Modelchecking In recent years CTL and LTL logics have been used with considerable industrial success. For example microprocessors manufacturers (like Intel, Motorola) use programs which automatically can check if some features are correctly implemented on a chip. These programs are called modelcheckers. 1

2 Informally a modelchecker is a program that takes a KTS describing a system, a temporal logical formula and returns either a counterexample if the formula is false in that KTS or true if the formula is satisfied in that KTS KTS model of a system Yes, formula true Modelchecker Temporal logical formula No, counterexample 2

3 We are now going to see the Spin modelchecker at work. You can find material on spin at there are tutorials, manuals, and the program itself which is free to download. Most applications of modelchecking are highly technical (hardware veryification, concurrent protocols verification etc..). We will consider a simple non technical problem just to give a flavour how modelchecking works 3

4 We are going to proceed as follows: We take a problem (the ferryman problem) for which we want a solution We describe all possible behaviours of the system with a transition system We express the solution in terms of a LTL formula We ask the system to verify that the solution is impossible The modelchecker will tell us that it is not true that the solution is impossible by providing a counterexample The counterexample will constitute the solution. 4

5 The problem A ferryman has to transport a piece of cabbage, a goat and a wolf across a river. On each journey he can carry at most one item. However he cannot leave unattended on the same side the cabbage and the goat or the goat and wolf (because the goat would eat the cabbage or the wolf would eat the goat). How can he do it? 5

6 The first few states of the transition system representing the system are as follows (the two river banks are denoted by 0 and 1): F=G=C=W=0 F=W=1 F=C=1 F=G=1 F=1 G=C=0 G=W=0 W=C=0 G=W=C=0 Notice that the only transition the doesn t violate the rules is the one where the ferryman transports the goat across the river. 6

7 The transition system representing the system is described by the following process: In the initial state C,G,W,F are on the same river bank Given a state s in the system if F and X (X is any of C,G,W) are on the same side then there is also the transition s s where s is the state like s except for F and X which are now on the opposite side. Given a state s in the system there is also the transition s s where s is the state like s except for F which is now on the opposite side 7

8 Let s now formulate the solution in terms of LTL: We want F,G,W,C to end up on the opposite river bank from which they started. That is we want F=G=W=C=1 to be true. This is the liveness condition. Moreover following the rules we do not want to go across states where G=W F or C=G F. This is the same as saying (G=W C=G) G=F And constitutes our safety condition 8

9 The solution is then a path in the transition system where there is a state which satisfy liveness and all previous states satisfy safety, i.e. we want the following formula to be true: ((G=W C=G) G=F) U (F=G=W=C=1) However if we ask the modelchecker to verify this formula we won t get anything interesting, just yes it is true, so what we will do is ask the modelchecker to verify the negation of the formula, 9

10 Now if the formula is true its negation will be false so the modelchecker will provide a counterexample, i.e. a trace in the transition system which is a counterexample to (((G=W C=G) G=F) U (F=G=W=C=1)) Such a trace will hence satisfy ((G=W C=G) G=F) U (F=G=W=C=1) i.e. it will be a sequence of states where at some point F=G=W=C=1 and beforehand (G=W C=G) G=F that is a solution to our initial problem. 10

11 the ferryman problem in Promela (the spin language for describing systems): bit ferryman=0,goat=0,cabbage=0,wolf=0 ; proctype Ferryman() { do ::(ferryman == goat) -> atomic{ferryman=1-goat; goat=1-goat} ::(ferryman == wolf) -> atomic{ferryman=1-wolf; wolf=1-wolf } ::(ferryman == cabbage) -> atomic{ferryman=1-cabbage; cabbage= :: ferryman=1-ferryman ::((ferryman==wolf)&&(wolf==cabbage)&&(cabbage==goat) &&(wolf==1)) -> goto accept all od; accept all: skip } init{ run Ferryman() } 11

12 The solution in spin [(run Ferryman())] ((ferryman==goat)) ferryman = (1-goat) goat = (1-goat) ferryman = (1-ferryman) ((ferryman==wolf)) ferryman = (1-wolf) wolf = (1-wolf) ((ferryman==goat)) ferryman = (1-goat) goat = (1-goat) ((ferryman==cabbage)) 12

13 ferryman = (1-cabbage) cabbage = (1-cabbage) ferryman = (1-ferryman) ((ferryman==goat)) ferryman = (1-goat) goat = (1-goat) ((ferryman==goat))

14 As you can see Promela, the language to describe the transition system for the spin modelchecker is somehow similar to Java; you can declare variables, Processes play a similar role to java classes constructors, the process init is similar to the java main method. An important Promela feature is the structure channel. Channels are used by processes to communicate with each other by sending and receiving messages. Basic informations about Promela and channels are available in the first few pages of the spin slides. 13