Verification. Arijit Mondal. Dept. of Computer Science & Engineering Indian Institute of Technology Patna

Transcription

1 IIT Patna 1 Verification Arijit Mondal Dept. of Computer Science & Engineering Indian Institute of Technology Patna arijit@iitp.ac.in

2 Introduction The goal of verification To ensure 100% correct in functionality and timing Spend 50 70% of time to verify a design Functional verification Simulation Formal proof Timing verification Dynamic timing simulation (DTS) Static timing analysis (STA) IIT Patna 2

3 Verification vs Test Verification Verifies correctness of design i.e., check if the design meets the specifications. Simulation or formal methods. Performed once prior to manufacturing. Required for reliability of design. Test Checks correctness of manufactured hardware. Two-stage process: Test generation: CAD tools executed once during design for ATPG Test application: TPs tests applied to ALL hardware samples Test application performed on every manufactured device. Responsible for reliability of devices. IIT Patna 3

4 Simulation Need to drive the circuit with the stimulus Exhaustive simulation Drive the circuit with all possible stimulus Non-exhaustive simulations Drive the circuit with selected stimulus To find appropriate subset is a complex problem May not cover all cases Number of test cases may be exponential IIT Patna 4

5 Verification of Combinational Circuits IIT Patna 5 a a sel Y1 sel Y2 b b Are Y1 and Y2 equivalent? Y1 = (a sel) (b sel) Y2 = (a sel) (b sel) Canonical structure of Binary Decision Diagram can be exploited to compare Boolean functions like Y1 & Y2

6 Verification of Sequential Circuits r1 r2 RR Arbiter g1 g2 Properties span across cycle boundaries Example: Two way round robin arbiter If the request bit r1 is true in a cycle then the grant bit g1 has to be true within the next two clock cycles IIT Patna 6

7 Verification of Sequential Circuits r1 r2 RR Arbiter g1 g2 Properties span across cycle boundaries Example: Two way round robin arbiter If the request bit r1 is true in a cycle then the grant bit g1 has to be true within the next two clock cycles Need temporal logic to specify the behavior IIT Patna 6

8 Verification of Sequential Circuits IIT Patna 7 r1 r2 RR Arbiter g1 g2 r1(0) r2(0) g1(0) g2(0) T=0 r1(1) r2(1) g1(1) g2(1) T=1 r1(2) r2(2) g1(2) g2(2) If the request bit r1 is true in a cycle then the grant bit g1 has to be true within the next two clock cycles t[r1(t) g1(t + 1) g1(t + 2)] In propositional temporal logic time (t) is implicit always r1 (next g1) (next next g1) T=2

9 Temporal logic IIT Patna 8 The truth value of a temporal logic is defined with respect to a model. Temporal logic formula is not statically true or false in a model. The models of temporal logic contain several states and a formula can be true in some states and false in others. Example: I am always happy. I will eventually be happy. I will be happy until I do something wrong. I am happy.

10 Kripke Structure IIT Patna 9 p p,q r S0 S1 S S3 S q q,r M = (AP, S, S 0, T, L) AP Set of atomic proposition S Set of states S 0 Set of initial states T Total transition relation (T S S) L Labeling function (S 2 AP )

11 Path IIT Patna 10 A path π = s 0, s 1,... in a Kripke structure is a sequence of states such that i, (s i, s i+1 ) T Sample paths S0, S1, S2, S4, S1,... S0, S3, S4, S0,... p p,q r S0, S1, S4, S1,... π = s 0, s 1,..., s }{{ k, s } k+1... prefix of π k in π π = s 0, s 1,..., s k, s k+1... }{{} suffix of π k in π S0 S1 S S3 S q q,r

12 Temporal operators Two fundamental path operators Next operator Xp property p holds in the next state Until operator p U q property p holds in all states upto the state where property q holds Derived operators Eventual/Future operator Fp property p holds eventually (in some future states) Always/Globally operator Gp property p holds always (at all states) All these operators are interpreted over the paths in Kripke structure under consideration All Boolean operators are supported by the temporal logics IIT Patna 11

13 The next operator (X) Xp p holds p holds in the next state of the path Formally π = Xp iff π 1 = p IIT Patna 12

14 The until operator (U) puq p holds q holds q holds eventually and p holds until q holds Formally π = p U q iff k such that π k = q and j, 0 j < k we have π j = p IIT Patna 13

15 The eventual operator (F) Fp p holds p holds eventually (in future) Formally π = Fp iff k such that π k = p This can be written as true U p IIT Patna 14

16 The always operator (G) G p p holds p holds always (globally) Formally π = Gp iff k we have π k = p This can be written as (true U p) or F p IIT Patna 15

17 Branching Time Logic IIT Patna 16 Interpreted over computation tree a,b a,b b,c c b,c c a,b c c

18 Path Quantifier IIT Patna 17 A: For all paths... E: There exists a path...

19 Universal Path Quantification IIT Patna 18 AX p AG p p p p p p p p p p In all the next states p holds. Along all the paths p holds forever.

20 Universal Path Quantification IIT Patna 19 AF p A(pUq) p p p q p p q q Along all the paths p holds eventually. Along all the paths p holds until q holds.

21 Existential Path Quantification IIT Patna 20 EX p EG p p p p p There exists a next state where p holds. there exists a path along which p holds forever.

22 Existential Path Quantification IIT Patna 21 EF p E(pUq) p p p q There exists a path along which p holds eventually. There exists a path along which p holds until q holds.

23 Duality between Always & Eventual operators Gp = p (next p) (next next p) (next next next p)... = ( (p (next p) (next next p) (next next next p)...)) applying De Morgan s law = ( p (next p) (next next p) (next next next p)...) = (F p) Therefore we have Gp = F p Fp = G p IIT Patna 22

24 Computation Tree Logic (CTL) Syntax: Given a set of Atomic Propositions (AP): All Boolean formulas of over AP are CTL properties If f and g are CTL properties then so are f, AXf, A(f U g), EXf and E(f U g), Properties like AFp, AGp, EGp, EFp can be derived from the above Semantics: The property Af is true at a state s of the Kripke structure iff the path property f holds on all paths starting from s The property Ef is true at a state s of the Kripke structure iff the path property f holds on some path starting from s IIT Patna 23

25 Nested properties in CTL AX AGp From all the next state p holds forever along all paths EX EFp There exist a next state from where there exist a path to a state where p holds AG EFp From any state there exist a path to a state where p holds p p p p p p p AX AGp p EX EFp p p p p AG EFp IIT Patna 24

26 CTL example IIT Patna 25 S req req req req gr gr gr req gr gr gr gr From S the system always makes a request in future:

27 CTL example IIT Patna 25 S req req req req gr gr gr req gr gr gr gr From S the system always makes a request in future: AF req

28 CTL example IIT Patna 25 S req req req req gr gr gr req gr gr gr gr From S the system always makes a request in future: AF req All requests are eventually granted:

29 CTL example IIT Patna 25 S req req req req gr gr gr req gr gr gr gr From S the system always makes a request in future: AF req All requests are eventually granted: AG(req EF gr)

30 CTL example IIT Patna 25 S req req req req gr gr gr req gr gr gr gr From S the system always makes a request in future: AF req All requests are eventually granted: AG(req EF gr) Sometimes requests are immediately granted:

31 CTL example IIT Patna 25 S req req req req gr gr gr req gr gr gr gr From S the system always makes a request in future: AF req All requests are eventually granted: AG(req EF gr) Sometimes requests are immediately granted: EF (req EX gr)

32 CTL example IIT Patna 25 S req req req req gr gr gr req gr gr gr gr From S the system always makes a request in future: AF req All requests are eventually granted: AG(req EF gr) Sometimes requests are immediately granted: EF (req EX gr) Requests are held till grant is received:

33 CTL example IIT Patna 25 S req req req req gr gr gr req gr gr gr gr From S the system always makes a request in future: AF req All requests are eventually granted: AG(req EF gr) Sometimes requests are immediately granted: EF (req EX gr) Requests are held till grant is received: AG(req A(req U gr))

34 Real Time properties Real time systems Predictable response time are necessary for correct operation Safety critical systems like controller for aircraft, industrial machinery are a few examples It is difficult to express complex timing properties Simple: event p will happen in future Fp Complex: event p will happen within at most n time units p (Xp) (XXp)... ([XX... n times]p) IIT Patna 26

35 Bounded Temporal Operators Specify real-time constraints Over bounded traces Various bounded temporal operators G [m,n] p p always holds between m th and n th time step F [m,n] p p eventually holds between m th and n th time step X [m] p p holds at the m th time step p U [m,n] q q eventually holds between m th and n th time step and p holds until that point of time IIT Patna 27

36 Examples IIT Patna 28 G [2,4] p p holds p holds always between 2nd and 4th time step

37 Examples IIT Patna F [2,4] p p holds p holds eventually between 2nd and 4th time step

38 Examples IIT Patna 30 X p p holds p holds in the 3rd time step

39 Examples IIT Patna 31 pu [2,4] q p holds q holds q holds eventually between 2nd and 4th time step and p holds until q holds

40 Timing properties IIT Patna 32 Whenever request is recorded grant should take place within 4 time units AG(posedge(req) AF [0,4] posedge(gr)) The arbiter will provide exactly 64 time units to high priority user in each grant AG(posedge(hpusing) A( negedge(hpusing) U [64,64] negedge(hpusing)))

41 Formal Verification IIT Patna 33 State machine extraction Specification A(pUq) Model Checker Yes No

42 Formal Property Verification IIT Patna 34 The formal method is called Model Checking The algorithm has two inputs A finite state state machine (FSM) that represents the implementation A formal property that represent the specification The algorithm checks whether the FSM models the property This is an exhaustive search of the FSM to see whether it has any path / state that refutes the property

43 Example: Explicit State Model IIT Patna 35 a a,b a S0 S1 S3 S2 b

44 Example: EX IIT Patna 36 a a,b a S0 S1 S3 S2 b EXa

45 Example: EX IIT Patna 36 a a,b a S0 S1 S3 S2 b EXa

46 Example: EX IIT Patna 36 a a,b a S0 S1 S3 S2 b EXa

47 Example: EX IIT Patna 36 a a,b a S0 S1 S3 S2 b EXa

48 Example: EX IIT Patna 36 a a,b a S0 S1 S3 S2 b EXa

49 Example: AX IIT Patna 37 a a,b a S0 S1 S3 S2 b AXa

50 Example: AX IIT Patna 37 a a,b a S0 S1 S3 S2 b AXa

51 Example: AX IIT Patna 37 a a,b a S0 S1 S3 S2 b AXa

52 Example: AX IIT Patna 37 a a,b a S0 S1 S3 S2 b AXa

53 Example: EG IIT Patna 38 a a,b a S0 S1 S3 S2 b EGa

54 Example: EG IIT Patna 38 a a,b a S0 S1 S3 S2 b EGa

55 Example: EG IIT Patna 38 a a,b a S0 S1 S3 S2 b EGa

56 Example: EG IIT Patna 38 a a,b a S0 S1 S3 S2 b EGa

57 Example: AG IIT Patna 39 a a,b a S0 S1 S3 S2 b AGa

58 Example: AG IIT Patna 39 a a,b a S0 S1 S3 S2 b AGa

59 Example: AU IIT Patna 40 a a,b a S0 S1 S3 S2 b A(a U b)

60 Example: AU IIT Patna 40 a a,b a S0 S1 S3 S2 b A(a U b)

61 Example: AU IIT Patna 40 a a,b a S0 S1 S3 S2 b A(a U b)

62 Example: AU IIT Patna 40 a a,b a S0 S1 S3 S2 b A(a U b)

63 Symbolic Representation IIT Patna 41 Represents set of transition as function δ(old, new) Yields 1 if there is a transition from old to new Can be represented as Boolean function by encoding the states with Boolean variables

64 Symbolic Representation IIT Patna 41 Represents set of transition as function δ(old, new) Yields 1 if there is a transition from old to new Can be represented as Boolean function by encoding the states with Boolean variables

65 Symbolic Representation IIT Patna 41 Represents set of transition as function δ(old, new) Yields 1 if there is a transition from old to new Can be represented as Boolean function by encoding the states with Boolean variables o 1, o 2 Old state variables n 1, n 2 New state variables 11 10

66 Symbolic Representation IIT Patna 41 Represents set of transition as function δ(old, new) Yields 1 if there is a transition from old to new Can be represented as Boolean function by encoding the states with Boolean variables o 1, o 2 Old state variables n 1, n 2 New state variables δ = ō 1 ō 2 n 1 n 2 ō 1 ō 2 n 1 n 2 ō 1 o 2 n 1 n 2 o 1 ō 2 n 1 n 2 o 1 ō 2 n 1 n 2 o 1 o 2 n 1 n 2 o 1 o 2 n 1 n 2

67 Symbolic Representation IIT Patna 41 Represents set of transition as function δ(old, new) Yields 1 if there is a transition from old to new Can be represented as Boolean function by encoding the states with Boolean variables o 1, o 2 Old state variables n 1, n 2 New state variables δ = ō 1 ō 2 n 1 n 2 ō 1 ō 2 n 1 n 2 ō 1 o 2 n 1 n 2 o 1 ō 2 n 1 n 2 o 1 ō 2 n 1 n 2 o 1 o 2 n 1 n 2 o 1 o 2 n 1 n 2 New states = o 1 o 2 [S( o 1 o 2 ) δ( o 1 o 2, n 1 n 2 )]

68 Breadth First Reachability IIT Patna R i is the set of states that can be reached in i transitions Reaches fix point when R n = R n+1 Fix point always exists as it has finite number of states

69 Breadth First Reachability IIT Patna R i is the set of states that can be reached in i transitions Reaches fix point when R n = R n+1 Fix point always exists as it has finite number of states

70 Breadth First Reachability IIT Patna R R i is the set of states that can be reached in i transitions Reaches fix point when R n = R n+1 Fix point always exists as it has finite number of states

71 Breadth First Reachability IIT Patna R R i is the set of states that can be reached in i transitions Reaches fix point when R n = R n+1 Fix point always exists as it has finite number of states

72 Breadth First Reachability IIT Patna R 0 R R i is the set of states that can be reached in i transitions Reaches fix point when R n = R n+1 Fix point always exists as it has finite number of states

73 Breadth First Reachability IIT Patna R 0 R R i is the set of states that can be reached in i transitions Reaches fix point when R n = R n+1 Fix point always exists as it has finite number of states

74 Breadth First Reachability IIT Patna R 0 R 1 R R i is the set of states that can be reached in i transitions Reaches fix point when R n = R n+1 Fix point always exists as it has finite number of states

75 Breadth First Reachability IIT Patna R 0 R 1 R R i is the set of states that can be reached in i transitions Reaches fix point when R n = R n+1 Fix point always exists as it has finite number of states

76 CTL Model Checking It checks whether a given CTL formula f holds on a given Kripke structure M i.e., M = f Need to have modalities for EX, EU and EG Other modalities can be expressed using EX, EU and EG AF f EG f AG f EF f A(f U g) ( EG g) ( E[ g U ( f g)]) Basic procedure The set Sat(f) of all states satisfying f is computed recursively M = f if and only if S 0 Sat(f ) IIT Patna 43

77 CTL Model Checking: EXf IIT Patna 44 s Sat(f) Post(s) = {s S (s, s ) T} Sat(EXf) = {s S Post(s) Sat(f) }

78 CTL Model Checking: EXf IIT Patna 45 function CheckEX(f) 1. S f = {s S f L(s)} 2. while S f 3. Choose s S f 4. S f = S f {s} 5. for all t such that (t, s) T 6. if f L(t) 7. L(t) = L(t) {EXf} 8. endif 9. end for 10. end while

79 CTL Model Checking: EFp IIT Patna 46 f 0 = p

80 CTL Model Checking: EFp IIT Patna 46 f 0 = p

81 CTL Model Checking: EFp IIT Patna 46 f 1 = p EXf 0 f 0 = p

82 CTL Model Checking: EFp IIT Patna 46 f 1 = p EXf 0 f 0 = p

83 CTL Model Checking: EFp IIT Patna 46 f 2 = p EXf 1 f 1 = p EXf 0 f 0 = p

84 CTL Model Checking: EFp IIT Patna 46 f 2 = p EXf 1 f 1 = p EXf 0 f 0 = p

85 CTL Model Checking: EFp IIT Patna 46 f 3 = p EXf 2 f 2 = p EXf 1 f 1 = p EXf 0 f 0 = p

86 CTL Model Checking: EFp IIT Patna 46 f 3 = p EXf 2 f 2 = p EXf 1 f 1 = p EXf 0 f 0 = p

87 CTL Model Checking: EFp IIT Patna 46 f 3 = p EXf 2 f 2 = p EXf 1 f 1 = p EXf 0 f 0 = p Least Fix Point

88 CTL Model Checking: f = EF p IIT Patna 47 Given a model M = AP, S, S 0, T, L and S p the set of states satisfying p in M function CheckEF(S p ) Q φ; Q S p ; while Q Q do Q Q Q Q {s s [T (s, s ) Q(s )]} end while S f Q return S f

89 CTL Model Checking: EFp IIT Patna 48 function CheckEF(p) 1. S p = {s S p L(s)} 2. for all s S p do L(s) = L(s) {EFp} 3. while S p 4. Choose s S p 5. S p = S p {s} 6. for all t such that (t, s) T 7. if {EFp} L(t) 8. L(t) = L(t) {EFp} 9. S p = S p t 10. endif 11. end for 12. end while

90 IIT Patna 49 Example: g = EF ( ) (a c) (a b) c S6 S7 a,b,c S0 a S3 S4 b S5 a,c b,c S2 S1 a,b Let p = ((a c) (a b)) S p = {} {} = g

91 IIT Patna 49 Example: g = EF ( ) (a c) (a b) c S6 S7 a,b,c S0 a S3 g S4 b S5 a,c b,c S2 S1 a,b S4 = g. S p = {S4} {S4} = g

92 IIT Patna 49 Example: g = EF ( ) (a c) (a b) c S6 S7 a,b,c S0 a S3 g S4 g S5 a,c b b,c S2 S1 a,b S5 = g. S p = {S4, S5} {S4, S5} = g

93 IIT Patna 49 Example: g = EF ( ) (a c) (a b) c S6 S7 a,b,c S0 a S3 g S4 g S5 a,c b b,c S2 S1 a,b Choose S4. S p = {S5} {S4, S5} = g

94 IIT Patna 49 Example: g = EF ( ) (a c) (a b) g c S6 S7 a,b,c S0 a S3 g S4 g S5 a,c b b,c S2 S1 a,b S6 = g. S p = {S5} {S4, S5} = g

95 IIT Patna 49 Example: g = EF ( ) (a c) (a b) g c S6 S7 a,b,c S0 a S3 g S4 g S5 a,c b b,c S2 S1 a,b S p = {S5, S6} {S4, S5, S6} = g

96 IIT Patna 49 Example: g = EF ( ) (a c) (a b) g c S6 S7 a,b,c S0 a S3 g S4 g S5 a,c b b,c S2 S1 a,b Choose S5. S p = {S6} {S4, S5, S6} = g

97 IIT Patna 49 Example: g = EF ( ) (a c) (a b) g c S6 S7 a,b,c S0 a S3 g S4 g S5 a,c b b,c S2 S1 a,b No predecessor. S p = {S6} {S4, S5, S6} = g

98 IIT Patna 49 Example: g = EF ( ) (a c) (a b) g c S6 S7 a,b,c S0 a S3 g S4 g S5 a,c b b,c S2 S1 a,b Choose S6. S p = {} {S4, S5, S6} = g

99 IIT Patna 49 Example: g = EF ( ) (a c) (a b) g c S6 g S7 a,b,c S0 a S3 g S4 g S5 a,c b b,c S2 S1 a,b S7 = g. S p = {} {S4, S5, S6} = g

100 IIT Patna 49 Example: g = EF ( ) (a c) (a b) g c S6 g S7 a,b,c S0 a S3 g S4 g S5 a,c b b,c S2 S1 a,b S p = {S7} {S4, S5, S6, S7} = g

101 IIT Patna 49 Example: g = EF ( ) (a c) (a b) g c S6 g S7 a,b,c S0 a S3 g S4 g S5 a,c b b,c S2 S1 a,b Choose S7. S p = {} {S4, S5, S6, S7} = g

102 IIT Patna 49 Example: g = EF ( ) (a c) (a b) g c S6 g S7 a,b,c S0 a S3 g S4 g S5 a,c b b,c S2 Done. S1 a,b {S4, S5, S6, S7} = g

103 CTL Model Checking: EGp IIT Patna 50 f 0 = p

104 CTL Model Checking: EGp IIT Patna 50 f 0 = p f 1 = p EXf 0

105 CTL Model Checking: EGp IIT Patna 50 f 0 = p f 1 = p EXf 0 f 2 = p EXf 1

106 CTL Model Checking: EGp IIT Patna 50 f 0 = p f 1 = p EXf 0 f 2 = p EXf 1 f 3 = p EXf 2

107 CTL Model Checking: EGp IIT Patna 50 f 0 = p f 1 = p EXf 0 f 2 = p EXf 1 f 3 = p EXf 2

108 CTL Model Checking: EGp IIT Patna 50 f 0 = p f 1 = p EXf 0 f 2 = p EXf 1 f 3 = p EXf 2 Greatest Fix Point

109 CTL Model Checking: f = EG p IIT Patna 51 Given a model M = AP, S, S 0, T, L and S p the set of states satisfying p in M function CheckEG(S p ) Q φ; Q S p ; while Q Q do Q Q Q Q {s s [T (s, s ) Q(s )]} end while S f Q return S f

110 CTL Model Checking: EGp function CheckEG(p) 1. S p = {s S p L(s)} 2. SCC = {C C is nontrivial SCC of S p } 3. R = {s s C} C SCC 4. for all s R do L(s) = L(s) {EGp} 5. while R 6. Choose s R 7. R = R {s} 8. for all t such that (t, s) T and t S p 9. if {EGp} L(t) 10. L(t) = L(t) {EGp} 11. R = R {t} 12. endif 13. end for 14. end while IIT Patna 52

111 Example: g = EG b IIT Patna 53 c φ S6 S7 a,b,c S0 a S3 S4 b a,c S5 b,c S2 S1 a,b Let p = b

112 Example: g = EG b IIT Patna 53 c φ S6 S7 a,b,c S0 a S3 S4 b a,c S5 b,c S2 S1 a,b Find states Let p satisfying = b b.

113 Example: g = EG b IIT Patna 53 c φ S6 S7 a,b,c S0 a S3 S4 b a,c S5 b,c S2 S1 a,b Find states Let p satisfying = b b. S p = {S0}

114 Example: g = EG b IIT Patna 53 c φ S6 S7 a,b,c S0 a S3 S4 b a,c S5 b,c S2 S1 a,b Find states Let p satisfying = b b. S p S= p = {S0, {S0} S1}

115 Example: g = EG b IIT Patna 53 c φ S6 S7 a,b,c S0 a S3 S4 b a,c S5 b,c S2 S1 a,b Find states Let p satisfying = b b. S p S= p S= p {S0, = {S0, {S0} S1, S1} S2}

116 Example: g = EG b IIT Patna 53 c φ S6 S7 a,b,c S0 a S3 S4 b a,c S5 b,c S2 S1 a,b Find states Let p satisfying = b b. S p S= p S= p {S0, S= p {S0, = {S0, S1, {S0} S1, S1} S2, S2} S4}

117 Example: g = EG b IIT Patna 53 c φ S6 S7 a,b,c S0 a S3 S4 b a,c S5 b,c S2 S1 a,b Find Find states Let SCCp satisfying using = b S p. b. S p S = p S= p {S0, S= p {S0, = {S0, S1, {S0} S1, S2, S1} S2} S4}

118 Example: g = EG b IIT Patna 53 c φ S6 S7 a,b,c S0 a S3 S4 b a,c S5 b,c S2 S1 a,b Find Find states Let SCCp satisfying using = b S p. b. S p S = p S= p {S0, S= p {S0, = {S0, S1, {S0} S1, S2, S1} S2} S4}

119 Example: g = EG b IIT Patna 53 c φ S6 S7 a,b,c S0 a S3 S4 b a,c S5 b,c S2 S1 a,b Find Find states Let SCCp satisfying using = b S p. b. S p S = p SR = p {S0, S= p = {S0, S1, {S0} S1, S2} S2, S1} S2} S4}

120 Example: g = EG b IIT Patna 53 c φ S6 S7 a,b,c g S0 a S3 b,c g S2 S4 b S1 a,b a,c S5 Find Find states Let SCCp satisfying using = b S p. b. S p S = p SR = p {S0, S= p = {S0, S1, {S0} S1, S2} S2, S1} S2} S4} S g = {S0, S2}

121 Example: g = EG b IIT Patna 53 c φ S6 S7 a,b,c g S0 a S3 b,c g S2 S4 b S1 a,b a,c S5 Find Find states Choose Let SCCp satisfying using = S0. b S p. b. S p S = p SR = p {S0, SR = p = {S0, S1, {S2} {S0} S1, S2} S2, S1} S2} S4} S g = {S0, S2}

122 Example: g = EG b IIT Patna 53 c φ S6 S7 a,b,c g S0 a S3 g S4 a,c S5 g b b,c S2 S1 a,b Find Find states Choose Let SCC S4 p = satisfying using = g. S0. b S p. b. S p S = p SR = p {S0, S R = p = {S0, S1, {S2} {S0} S1, S2} S2, S1} S2} S4} S g = {S0, S2}

123 Example: g = EG b IIT Patna 53 c φ S6 S7 a,b,c g S0 a S3 g S4 a,c S5 g b b,c S2 S1 a,b Find Find states Choose Let SCC S4 p = satisfying using = g. S0. b S p. b. S p S = p S R = p {S0, S R = p = {S0, {S2, S1, {S2} {S0} S1, S2} S4} S2, S1} S2} S4} S g S= g = {S0, {S0, S2, S2} S4}

124 Example: g = EG b IIT Patna 53 c φ S6 S7 a,b,c g S0 a S3 g S4 a,c S5 g b b,c S2 S1 a,b Find Find states Choose Let SCC S4 p = satisfying using = g. S0. S2. b S p. b. S p S = p S R = p {S0, S R = p = {S0, {S2, S1, {S2} {S4} {S0} S1, S2} S4} S2, S1} S2} S4} S g S = g = {S0, {S0, S2, S2} S4}

125 Example: g = EG b IIT Patna 53 c φ S6 S7 a,b,c g S0 a S3 g S4 a,c S5 g b b,c S2 S1 a,b Find Find Nothing states Choose Let SCC S4 p to = satisfying using = explore. g. S0. S2. b S p. b. S p S = p S R = p {S0, S R = p = {S0, {S2, S1, {S2} {S4} {S0} S1, S2} S4} S2, S1} S2} S4} S g S = g = {S0, {S0, S2, S2} S4}

126 Example: g = EG b IIT Patna 53 c φ S6 S7 a,b,c g S0 a S3 g S4 a,c S5 g b b,c S2 S1 a,b Find Find Nothing states Choose Let SCC S4 p to = satisfying using = explore. g. S0. S2. S4. b S p. b. S p S = p S R = p {S0, S R = p R {S0, {S2, = S1, {S2} {S4} {S0} {} S1, S2} S4} S2, S1} S2} S4} S g S = g = {S0, {S0, S2, S2} S4}

127 Example: g = EG b IIT Patna 53 c φ S6 S7 a,b,c g S0 a S3 g S4 a,c S5 g b b,c S2 S1 a,b Find Find Nothing states Choose Let SCC S4 p to = satisfying using = explore. g. S0. S2. S4. b S p. b. S p S = p S R = p {S0, S R = p R {S0, {S2, = S1, {S2} {S4} {S0} {} S1, S2} S4} S2, S1} S2} S4} S g S = g = {S0, {S0, S2, S2} S4}

128 Example: g = EG b IIT Patna 53 c φ S6 S7 a,b,c g S0 a S3 g S4 a,c S5 g b b,c S2 S1 a,b Find Find Nothing states Choose Let SCC S4 Done. p to = satisfying using = explore. g. S0. S2. S4. b S p. b. S p S = g p S R = p {S0, S R = p R {S0, {S2, {S0, = S1, {S2} {S4} {S0} {} S1, S2, S2} S4} S2, S1} S2} S4} S4} S g S = g = {S0, {S0, S2, S2} S4}

129 CTL Model Checking: E(p U q) IIT Patna 54 f 0 = q

130 CTL Model Checking: E(p U q) IIT Patna 54 f 1 = q (p EXf 0 ) f 0 = q

131 CTL Model Checking: E(p U q) IIT Patna 54 f 2 = q (p EXf 1 ) f 1 = q (p EXf 0 ) f 0 = q

132 CTL Model Checking: E(p U q) IIT Patna 54 f 3 = q (p EXf 2 ) f 2 = q (p EXf 1 ) f 1 = q (p EXf 0 ) f 0 = q

133 CTL Model Checking: E(p U q) IIT Patna 54 f 3 = q (p EXf 2 ) f 2 = q (p EXf 1 ) f 1 = q (p EXf 0 ) f 0 = q Least Fix Point

134 CTL Model Checking: E(p U q) IIT Patna 55 function CheckEU(p,q) 1. S q = {s S q L(s)} 2. for all s S q do L(s) = L(s) {E(p U q)} 3. while S q 4. Choose s S q 5. S q = S q {s} 6. for all t such that (t, s) T 7. if {E(p U q)} L(t) and p L(t) 8. L(t) = L(t) {E(p U q)} 9. S q = S q {t} 10. endif 11. end for 12. end while

135 Nested CTL query IIT Patna 56 EF(p AG q)

136 Nested CTL query IIT Patna 56 EF(p AG q) EF p AG q

137 Nested CTL query IIT Patna 56 EF(p AG q) EF p AG q p

138 Nested CTL query IIT Patna 56 EF(p AG q) EF p AG q p

139 Nested CTL query IIT Patna 56 EF(p AG q) EF p AG q p AG q

140 Nested CTL query IIT Patna 56 EF(p AG q) EF p AG q p AG q AG q

141 Nested CTL query IIT Patna 56 EF(p AG q) EF p AG q p AG q AG q

142 Nested CTL query IIT Patna 56 EF(p AG q) EF p AG q p AG q AG q

143 Nested CTL query IIT Patna 56 EF(p AG q) EF p AG q p AG q AG q

144 Nested CTL query IIT Patna 56 EF(p AG q) EF p AG q p AG q AG q

145 Verification of RTCTL query IIT Patna 57 A(p U k q) q (p AX A(p U k 1 q)) if k > 1 E(p U k q) q (p EX E(p U k 1 q)) if k > 1 A(p U 0 q) q E(p U 0 q) Similar fix point characterization of CTL modalities can be used For qualative CTL queries k = S

146 RTCTL Model Checking: f = E(p U k q) function CheckEU(p,q,k) 1. N 0 f = {s S q L(s)} 2. for all s N 0 f do L(s) = L(s) {E(p U k q)} 3. j = 0; 4. while j < k 5. TEMP = N j f 6. while N j f 7. Choose s TEMP; TEMP = TEMP {s} 8. for all t such that (t, s) T 9. if {E(p U k q)} L(t) and p L(t) 10. L(t) = L(t) {E(p U k q)}; N j+1 f = N j+1 f 11. endif 12. end for 13. end while 14. j = j + 1; 15. end while {t} IIT Patna 58

147 Verification of RTCTL query IIT Patna 59 E(p U [a,b] q) p (EX E(p U [a 1,b 1] q)) if a > 0 and b > 0 E(p U [0,b] q) q (p EX E(p U [0,b 1] q)) if b > 0 E(p U [0,0] q) q

148 Verification of RTCTL query IIT Patna 59 E(p U [a,b] q) p (EX E(p U [a 1,b 1] q)) if a > 0 and b > 0 E(p U [0,b] q) q (p EX E(p U [0,b 1] q)) if b > 0 E(p U [0,0] q) q Steps: Compute set of states where p is true for a steps If fix point is reached before a steps, skip to the second case Compute set of states where E(p U q) is true for b steps If fix point is reached before (b-a) steps, skip to the third case

149 Complexity IIT Patna 60 Linear in the size of the model Linear in the size of the CTL formula Complexity is O( F M) Model size M Formula size F