Lecture 4 Model Checking and Logic Synthesis
|
|
- Emil Grant
- 5 years ago
- Views:
Transcription
1 Lecture 4 Model Checking and Logic Synthesis Nok Wongpiromsarn Richard M. Murray Ufuk Topcu EECI, 18 March 2013 Outline Model checking: what it is, how it works, how it is used Computational complexity of model checking Closed system synthesis Examples using SPIN model checker
2 The basic idea behind model checking Given: Transition system LTL formula TS TS Question: Does satisfy, i.e., TS =? Trace(TS) (all possible executions) executions that are possible and invalid Words( ) (all invalid executions) Answer (conceptual): TS = m Trace(TS) Words( ) m Trace(TS) \ Words( ) =; [TS satisfies ] [All executions of TS satisfy ] [No execution of TS violates ] How to determine whether Trace(TS) \ Words( ) =;? 2
3 Preliminaries: LTL Buchi automata Theorem. There exists an algorithm that takes an LTL formula and returns a Büchi automaton A such that Words( )=L! (A) = g = (g! h) = (f (guh)) A true g q0 g q1 A g h h q0 true true q1 A true q0 g f h g g f q2 q1 g h true A tool for constructing Buchi automata from LTL formulas: LTL2BA [ 3
4 Preliminaries: transition system Buchi automaton Transition system: TS =(S, Act,!,I,AP,L) Nondeterministic Buchi automaton: A =(Q, 2 AP,,Q 0,F) Define the product automaton: S 0 = S Q TS A =(S 0, Act,! 0,I 0, AP 0,L 0 ), where with and q L(t)! p, there exists I 0 L(s 0 ) = {hs 0,qi : s 0 2 I and 9q 0 2 Q 0 s.t. q 0! q} AP 0 = Q L 0 : S Q! 2 Q and L 0 (hs, qi) ={q} 8s, t 2 S, q, p 2 Q s! t hs, qi! 0 ht, pi ; {g} s0: red s1: green TS {q 0 } {q 1 } TS A s0, q0 s0, q1 true g q0 g q1 A s1, q0 {q 0 } s1, q1 {q 1 } 4
5 Preliminaries Transition system: TS =(S, Act,!,I,AP,L) Nondeterministic Buchi automaton: A =(Q, 2 AP,,Q 0,F) not in F Theorem: Trace(TS) L! (A) =, Proof idea ( ): Pick a path π in TS A s.t. 0 = eventually forever F, and let π be its projection to TS. Then, trace(π) Trace(TS) -- by definition of product trace(π) L! (A) -- by hypothesis and by definition of product (L ( s,q ) = {q}) TS A = eventually forever F ; {g} s0: red s1: green true g q0 g q1 TS A F = {q 1 } TS A = eventually forever F m There exists a state x in x is reachable L (x) F x is on a directed cycle TS A } graph search, e.g., (nested) depth-first search 5 L 0 (hs 0,q 0 i 6 F hs 0,q 1 i not on cycle {q 0 } {q 1 } s0, q0 s1, q0 {q 0 } L 0 (hs 1,q 0 i 6 F s0, q1 s1, q1 {q 1 } hs 1,q 1 i not reachable
6 Given: Transition system TS Putting together LTL formula NBA A accepting with the set F of accepting states TS = m Trace(TS) 6 Words( ) m Trace(TS) Words( ) = m Trace(TS) L! (A ) = m TS A = eventually forever F 6
7 The process flow of model checking Efficient model checking tools automate the process: SPIN, nusmv, TLC,... 7
8 Example 1: traffic lights (property verified) System TS: synchronous composition of two traffic lights and a controller q 1 s 1 c 2 c 1 q 2 {g 1 } s 2 {g 2 } = {g 1 } q 2,s 1,c 2 q 1,s 1,c 1 P 1 Specification : The light are never green simultaneously. traffic light 1 traffic light 2 c 3 controller q 1,s 2,c 3 {g 2 } SPIN code: System model (synchronous composition of the modules): A P1 Property verified: TS P 1 A P1 from LTL2BA: 8
9 Example 2: traffic lights (counterexample found property not verified) System TS: composition of two traffic lights and a controller q 1 q 2 {g 1 } traffic light 1 s 1 {g 2 } c 2 c 1 = s 2 traffic light 2 c 3 controller Property not verified: TS = P 2 Counterexample: (hq 1,s 1,c 1, 1ihq 1,s 2,c 3, 1i)! q 2,s 1,c 2 {g 1 } q 1,s 1,c 1 q 1,s 2,c 3 {g 2 } P 2 Specification : The first light is infinitely often green. Counterexample from SPIN output: A P2 q 2,s 1,c 2,init q 1,s 1,c 1,init q 1,s 1,c 1, 1 q 1,s 2,c 3,init q 1,s 2,c 3, 1 TS A P2 9
10 Example 3: traffic lights (counterexample used to modify the controller) System TS: composition of two traffic lights and a modified controller q 1 s 1 c 1 c 2! new controller: is not a valid control signal anymore P 2 Specification : The first light is infinitely often green. Property verified: A P2 q 2 {g 1 } s 2 {g 2 } c 4 c 3 TS P 2 = q 1,s 1,c 1 {g 1 } q 2,s 1,c 2 q 1,s 1,c 1,init q 2,s 1,c 2,init q 1,s 2,c 4 {g 2 } q 1,s 1,c 3 q 1,s 2,c 4,init q 1,s 1,c 3,init q 1,s 1,c 3, 1 q 1,s 1,c 1, 1 q 1,s 2,c 4, 1 10 TS A P2
11 Computational complexity of model checking Transition system: TS =(S, Act,!,I,AP,L). Specification: Problem size: # of reachable states in TS O( S ) Potential reductions: # of states in A O( ) 2 size of one state in bytes length of, e.g., # of operators in Restrict the ranges of variables Use abstraction, separation of concerns, generalization Use compressed representation of the state space (e.g. BDD) Used in symbolic model checkers, e.g., SMV, NuSMV Partial order reduction (avoid computing equivalent paths) Use separable properties, instead of large, combined ones Lossy compression, e.g., hashcompact and bitstate hashing May result in incompleteness Lossless compression and alternate state representation methods May increase time while reduce memory A On-the-fly construction of TS, and the product automaton (while searching the automaton) to avoid constructing the complete state space Time complexity of DFS: O(# of states + # of transitions in TS A ) 11
12 Closed system synthesis Closed system: behaviors are generated purely by the system itself without any external influence Given: A transition system P An LTL formula P: composition of two traffic lights 1 s1,s0 2 s0,s0 1 ; {g 1 } {g 2 } s1,s1 {g 1,g 2 } s0,s1 P = (g 1 ^ g 2 ) ^ g 1 ^ g Compute: A path = of P such that Sample paths of P: 1 = (hs 0 s 0 ihs 1 s 0 ihs 1 s 1 ihs 0 s 1 i)! 2 = (hs 0 s 0 ihs 0 s 1 i)! 3 = (hs 0 s 0 ihs 1 s 0 ihs 0 s 0 ihs 0 s 1 i)! 12
13 Closed system synthesis--a controls interpretation P C output y memory domain The controller C is a function C : M S! Act The controller keeps some history of states It picks the next action for P such that the resulting path satisfies the specification (i.e., C constrains the paths system can take. Let M be a sequence of length 1, i.e., the controller keeps only the previous state C(;, hs 0 s 0 i) = 1 1 s1,s0 s0,s0 1 ; P {g 1 } {g 2 } s0,s1 C(hs 0 s 1 i, hs 0 s 0 i) = 1 C(hs 1 s 0 i, hs 0 s 0 i) = 2 2 s1,s1 {g 1,g 2 } 1 C(hs 0 s 0 i, hs 1 s 0 i) = 1 C(hs 0 s 0 i, hs 0 s 1 i) = 2 = (hs 0 s 0 ihs 1 s 0 ihs 0 s 0 ihs 0 s 1 i)! 1 s0,s0 C 2 and = = (g 1 ^ g 2 ) ^ g 1 ^ g 2 s1,s0 s0,s s0,s0 2
14 A solution approach Closed system synthesis can be formulated as a non-emptiness of the specification or satisfiability problem 9y (y) For synthesis problems, interesting behaviors are good behaviors (as opposed to verification problems where interesting behaviors are bad behaviors) Trace(P) (all possible executions) executions that are possible and valid Words( ) (all valid executions) Construct a verification model and claim that Trace(P) \ Words( )=; A counterexample provided in case of negative result is a path of P that satisfies Positive result means Trace(P) \ Words( )=;, i.e., a path of P that satisfies does not exist 14
15 Example: traffic lights System model: P = Specification: ; TS 1 s0: red 1 1 k ; TS 2 s0: red 2 2 s1: green s1: green {g 1 } {g 2 } = (g 1 ^ g 2 ) ^ g 1 ^ g 2 L! (A) =Words( ) A q0 (g 1 ^ g 2 ) g 1 ^ g 2 (g 1 ^ g 2 ) g1 ^ g2 (g 1 ^ g 2 ) q1 q2 g 1 ^ g 2 15 SPIN code: System model (asynchronous composition): bool g1 = 0, g2 = 0; active proctype TL1() { do :: atomic{ g1 == 0 -> g1 = 1} :: atomic{ g1 == 1 -> g1 = 0 } od } active proctype TL2() { do :: atomic{ g2 == 0 -> g2 = 1} :: atomic{ g2 == 1 -> g2 = 0 } od } Automaton from LTL2BA: never { T0 init: if :: (!g1) (!g2) -> goto T0 init :: (g1 &&!g2) -> goto T1 S1 fi; T1 S1: if :: (!g1) (!g2) -> goto T1 S1 :: (!g1 && g2) -> goto accept S1 fi; accept S1: if :: (!g1) (!g2) -> goto T0 init :: (g1 &&!g2) -> goto T1 S1 fi; }
16 Solution to the traffic light problem System model: P = ; TS 1 s0: red 1 1 k s1: green {g 1 } ; TS 2 s0: red 2 2 s1: green {g 2 } Solution from SPIN output: Specification: = (g 1 ^ g 2 ) ^ g 1 ^ g 2 L! (A) =Words( ) q0 (g 1 ^ g 2 ) A =(hs 0 s 0 ihs 1 s 0 ihs 0 s 0 ihs 0 s 1 ihs 0 s 0 ihs 0 s 1 i)! g 1 ^ g 2 g1 ^ g2 (g 1 ^ g 2 ) s0,s0 s1,s0 s0,s0 (g 1 ^ g 2 ) q1 g 1 ^ g 2 q2 s0,s1 s0,s0 s0,s1 16
17 Example: the farmer puzzle A farmer wants to cross a river in a little boat with a wolf, a goat and a cabbage. Constraints: The boat is only big enough to carry the farmer plus one other animal or object. The wolf will eat the goat if the farmer is not present. The goat will eat the cabbage if the farmer is not present. How can the farmer get both animals and the cabbage safely across the river? P f1,w0 = (f = w = g = c = 1) ^ (w 6= g _ f = g) ^ (g 6= c _ f = g) f1,w0 f1,w0 L! (A) =Words( ) f1,w0 g1,c1 q0 (w 6= g ^ g 6= c) _ f = g (f = w = g = c = 1) ^ A p i, p = i p 2 {f,w,g,c}, i 2 {0, 1} g1,c1 g1,c1 g1,c1 17 q1 (w 6= g ^ g 6= c) _ f = g (w 6= g ^ g 6= c) _ f = g
18 Solving the farmer puzzle (using SPIN) A farmer wants to cross a river in a little boat with a wolf, a goat and a cabbage. Constraints: The boat is only big enough to carry the farmer plus one other animal or object. The wolf will eat the goat if the farmer is not present. The goat will eat the cabbage if the farmer is not present. System model in SPIN: bit f=0, w=0, g=0, c=0; active proctype P() { do :: f=1-f :: atomic{ f==g -> f=1-f; g=1-g } :: atomic{ f==w -> f=1-f; w=1-w } :: atomic{ f==c -> f=1-f; c=1-c } od } farmer crosses the river alone farmer and goat cross the river farmer and wolf cross the river farmer and cabbage cross the river never { Specification: T0 init: if :: (w!= g && g!= c) (f==g) -> goto T0 init :: (f && g && w && c) && ((w!= g && g!= c) f==g) -> goto = accept (f S2= w = g = c = 1) ^ fi; accept S2: (w 6= g _ f = g) ^ if :: (w!= g (g && g 6=!= c c) _ f (f==g) = g) -> goto accept S2 fi; } 18 A solution: g1,c1 f1,w0
19 Alternative solution A farmer wants to cross a river in a little boat with a wolf, a goat and a cabbage. Constraints: The boat is only big enough to carry the farmer plus one other animal or object. The wolf will eat the goat if the farmer is not present. The goat will eat the cabbage if the farmer is not present. How can the farmer get both animals and the cabbage safely across the river? P f1,w0 = (f = w = g = c = 1) L! (A) =Words( ) f1,w0 f1,w0 f1,w0 g1,c1 q0 true A f = w = g = c =1 q1 true p i, p = i g1,c1 p 2 {f,w,g,c}, i 2 {0, 1} g1,c1 g1,c1 19
20 Alternative solution A farmer wants to cross a river in a little boat with a wolf, a goat and a cabbage. Constraints: The boat is only big enough to carry the farmer plus one other animal or object. The wolf will eat the goat if the farmer is not present. The goat will eat the cabbage if the farmer is not present. System model in SPIN: bit f=0, w=0, g=0, c=0; active proctype P() { do :: atomic{ (g!=c && g!=w) -> f=1-f } :: atomic{ f==g -> f=1-f; g=1-g } :: atomic{ (f==w && g!=c) -> f=1-f; w=1-w } :: atomic{ (f==c && g!=w) -> f=1-f; c=1-c } od } farmer can cross only when goat and cabbage are not at the same place and goat and wolf are not farmer and goat can cross only when they are at the same place farmer and wolf can cross only when they are at the same place and goat and cabbage are not farmer and cabbage can cross only when they are at the same place and goat and wolf are not never { T0 init: if :: (1) -> goto T0 init :: (f = && (f g && w = && w c) = -> g goto = c accept = 1) all fi; accept all: skip } Specification: Another solution: g1,c1 f1,w0 20
21 Example: frog puzzle Find a way to send all the yellow frogs to the right hand side of the pond and send all the brown frogs to the left hand side. Constraints: Frogs can only jump in the direction they are facing. Frogs can either jump one rock forward if the next rock is empty or they can jump over a frog if the next rock has a frog on it and the rock after it is empty. 21
22 Solving the frog puzzle as logic synthesis Rock i is not occupied or occupied State of frog i: Transition system of frog i: Overall system model: s(f i ) {s 0,s 1...,s 6 } ri {0, 1} P = F 1 F 2 F 6 r 0 r 1 r 2 r 3 r 4 r 5 r 6 F i s 0 s 1 s 2 s 3 s 4 s 5 s 6 r 1 s0 r 1 ^ r 2 F 1 s1 r 2 s2 r 2 ^ r 3 r 3 ^ r 4 s3 r 4 s4 r 4 ^ r 5 r 5 ^ r 6 s5 r 6 s6 F 2 s1 r 2 s2 r 2 ^ r 3 r 3 ^ r 4 s3 r 4 s4 r 4 ^ r 5 r 5 ^ r 6 s5 r 6 s s2 r 2 ^ r 3 r 3 ^ r 4 F 3 s3 r 4 s4 r 4 ^ r 5 r 5 ^ r 6 s5 r 6 s6 = s(f 1 ),s(f 2 ),s(f 3 ) 2 {s 4,s 5,s 6 } ^ s(f 4 ),s(f 5 ),s(f 6 ) 2 {s 0,s 1,s 2 } true q0 p q1 true A p, s(f 1 ),s(f 2 ),s(f 3 ) 2 {s 4,s 5,s 6 } ^ s(f 4 ),s(f 5 ),s(f 6 ) 2 {s 0,s 1,s 2 } 22
ENES 489p. Verification and Validation: Logic and Control Synthesis
11/18/14 1 ENES 489p Verification and Validation: Logic and Control Synthesis Mumu Xu mumu@umd.edu November 18, 2014 Institute for Systems Research Aerospace Engineering University of Maryland, College
More informationLecture 2 Automata Theory
Lecture 2 Automata Theory Ufuk Topcu Nok Wongpiromsarn Richard M. Murray EECI, 18 March 2013 Outline Modeling (discrete) concurrent systems: transition systems, concurrency and interleaving Linear-time
More informationSanjit A. Seshia EECS, UC Berkeley
EECS 219C: Computer-Aided Verification Explicit-State Model Checking: Additional Material Sanjit A. Seshia EECS, UC Berkeley Acknowledgments: G. Holzmann Checking if M satisfies : Steps 1. Compute Buchi
More informationLecture 2 Automata Theory
Lecture 2 Automata Theory Ufuk Topcu Nok Wongpiromsarn Richard M. Murray Outline: Transition systems Linear-time properties Regular propereties EECI, 14 May 2012 This short-course is on this picture applied
More informationIn recent years CTL and LTL logics have been used with considerable industrial success.
Modelchecking In recent years CTL and LTL logics have been used with considerable industrial success. For example microprocessors manufacturers (like Intel, Motorola) use programs which automatically can
More informationFormal Verification Techniques. Riccardo Sisto, Politecnico di Torino
Formal Verification Techniques Riccardo Sisto, Politecnico di Torino State exploration State Exploration and Theorem Proving Exhaustive exploration => result is certain (correctness or noncorrectness proof)
More informationLogic Model Checking
Logic Model Checking Lecture Notes 10:18 Caltech 101b.2 January-March 2004 Course Text: The Spin Model Checker: Primer and Reference Manual Addison-Wesley 2003, ISBN 0-321-22862-6, 608 pgs. the assignment
More informationTimo Latvala. March 7, 2004
Reactive Systems: Safety, Liveness, and Fairness Timo Latvala March 7, 2004 Reactive Systems: Safety, Liveness, and Fairness 14-1 Safety Safety properties are a very useful subclass of specifications.
More informationLecture 9 Synthesis of Reactive Control Protocols
Lecture 9 Synthesis of Reactive Control Protocols Nok Wongpiromsarn Singapore-MIT Alliance for Research and Technology Richard M. Murray and Ufuk Topcu California Institute of Technology EECI, 16 May 2012
More informationLecture 7 Synthesis of Reactive Control Protocols
Lecture 7 Synthesis of Reactive Control Protocols Richard M. Murray Nok Wongpiromsarn Ufuk Topcu California Institute of Technology AFRL, 25 April 2012 Outline Review: networked control systems and cooperative
More informationEfficient Model Checking of Safety Properties
Efficient Model Checking of Safety Properties Timo Latvala timo.latvala@hut.fi Laboratory for Theoretical Computer Science Helsinki University of Technology Finland Spin 2003 p.1/16 Introduction Safety
More informationCDS 270 (Fall 09) - Lecture Notes for Assignment 8.
CDS 270 (Fall 09) - Lecture Notes for Assignment 8. ecause this part of the course has no slides or textbook, we will provide lecture supplements that include, hopefully, enough discussion to complete
More informationChapter Two: Finite Automata
Chapter Two: Finite Automata In theoretical computer science, automata theory is the study of abstract machines (or more appropriately, abstract 'mathematical' machines or systems) and the computational
More informationLTL Model Checking. Wishnu Prasetya.
LTL Model Checking Wishnu Prasetya wishnu@cs.uu.nl www.cs.uu.nl/docs/vakken/pv Overview This pack : Abstract model of programs Temporal properties Verification (via model checking) algorithm Concurrency
More informationThe State Explosion Problem
The State Explosion Problem Martin Kot August 16, 2003 1 Introduction One from main approaches to checking correctness of a concurrent system are state space methods. They are suitable for automatic analysis
More informationAutomata-based Verification - III
COMP30172: Advanced Algorithms Automata-based Verification - III Howard Barringer Room KB2.20: email: howard.barringer@manchester.ac.uk March 2009 Third Topic Infinite Word Automata Motivation Büchi Automata
More informationLinear-time Temporal Logic
Linear-time Temporal Logic Pedro Cabalar Department of Computer Science University of Corunna, SPAIN cabalar@udc.es 2015/2016 P. Cabalar ( Department Linear oftemporal Computer Logic Science University
More informationAbstractions and Decision Procedures for Effective Software Model Checking
Abstractions and Decision Procedures for Effective Software Model Checking Prof. Natasha Sharygina The University of Lugano, Carnegie Mellon University Microsoft Summer School, Moscow, July 2011 Lecture
More informationTemporal Logic Model Checking
18 Feb, 2009 Thomas Wahl, Oxford University Temporal Logic Model Checking 1 Temporal Logic Model Checking Thomas Wahl Computing Laboratory, Oxford University 18 Feb, 2009 Thomas Wahl, Oxford University
More informationAlan Bundy. Automated Reasoning LTL Model Checking
Automated Reasoning LTL Model Checking Alan Bundy Lecture 9, page 1 Introduction So far we have looked at theorem proving Powerful, especially where good sets of rewrite rules or decision procedures have
More informationautomata-theoretic model checking
automata-theoretic model checking Kousha Etessami Bell Labs (starting next week, my affiliation will be U. of Edinburgh) overview The purpose of my lectures: to cover the fundamental algorithms used in
More informationIntroduction. Büchi Automata and Model Checking. Outline. Büchi Automata. The simplest computation model for infinite behaviors is the
Introduction Büchi Automata and Model Checking Yih-Kuen Tsay Department of Information Management National Taiwan University FLOLAC 2009 The simplest computation model for finite behaviors is the finite
More informationAutomata-Theoretic LTL Model-Checking
Automata-Theoretic LTL Model-Checking Arie Gurfinkel arie@cmu.edu SEI/CMU Automata-Theoretic LTL Model-Checking p.1 LTL - Linear Time Logic (Pn 77) Determines Patterns on Infinite Traces Atomic Propositions
More informationAutomata-based Verification - III
CS3172: Advanced Algorithms Automata-based Verification - III Howard Barringer Room KB2.20/22: email: howard.barringer@manchester.ac.uk March 2005 Third Topic Infinite Word Automata Motivation Büchi Automata
More informationLecture 8 Receding Horizon Temporal Logic Planning & Finite-State Abstraction
Lecture 8 Receding Horizon Temporal Logic Planning & Finite-State Abstraction Ufuk Topcu Nok Wongpiromsarn Richard M. Murray AFRL, 26 April 2012 Contents of the lecture: Intro: Incorporating continuous
More informationAutomatic Synthesis of Distributed Protocols
Automatic Synthesis of Distributed Protocols Rajeev Alur Stavros Tripakis 1 Introduction Protocols for coordination among concurrent processes are an essential component of modern multiprocessor and distributed
More informationSynthesis of Control Protocols for Autonomous Systems
Unmanned Systems, Vol. 0, No. 0 (2013) 1 19 c World Scientific Publishing Company Synthesis of Control Protocols for Autonomous Systems Tichakorn Wongpiromsarn a, Ufuk Topcu b, Richard M. Murray c a Ministry
More informationAutomata on Infinite words and LTL Model Checking
Automata on Infinite words and LTL Model Checking Rodica Condurache Lecture 4 Lecture 4 Automata on Infinite words and LTL Model Checking 1 / 35 Labeled Transition Systems Let AP be the (finite) set of
More informationModeling Concurrent Systems
Modeling Concurrent Systems Wolfgang Schreiner Wolfgang.Schreiner@risc.uni-linz.ac.at Research Institute for Symbolic Computation (RISC) Johannes Kepler University, Linz, Austria http://www.risc.uni-linz.ac.at
More informationLinear-Time Logic. Hao Zheng
Linear-Time Logic Hao Zheng Department of Computer Science and Engineering University of South Florida Tampa, FL 33620 Email: zheng@cse.usf.edu Phone: (813)974-4757 Fax: (813)974-5456 Hao Zheng (CSE, USF)
More informationComputer-Aided Program Design
Computer-Aided Program Design Spring 2015, Rice University Unit 3 Swarat Chaudhuri February 5, 2015 Temporal logic Propositional logic is a good language for describing properties of program states. However,
More informationBüchi Automata and Linear Temporal Logic
Büchi Automata and Linear Temporal Logic Joshua D. Guttman Worcester Polytechnic Institute 18 February 2010 Guttman ( WPI ) Büchi & LTL 18 Feb 10 1 / 10 Büchi Automata Definition A Büchi automaton is a
More informationOp#mal Control of Nonlinear Systems with Temporal Logic Specifica#ons
Op#mal Control of Nonlinear Systems with Temporal Logic Specifica#ons Eric M. Wolff 1 Ufuk Topcu 2 and Richard M. Murray 1 1 Caltech and 2 UPenn University of Michigan October 1, 2013 Autonomous Systems
More informationHelsinki University of Technology Laboratory for Theoretical Computer Science Research Reports 66
Helsinki University of Technology Laboratory for Theoretical Computer Science Research Reports 66 Teknillisen korkeakoulun tietojenkäsittelyteorian laboratorion tutkimusraportti 66 Espoo 2000 HUT-TCS-A66
More informationChapter 3: Linear temporal logic
INFOF412 Formal verification of computer systems Chapter 3: Linear temporal logic Mickael Randour Formal Methods and Verification group Computer Science Department, ULB March 2017 1 LTL: a specification
More informationTesting with model checkers: A survey
COMPETENCE NETWORK SOFTNET AUSTRIA Testing with model checkers: A survey SNA-TR-2007-P2-04 Gordon Fraser, Franz Wotawa, Paul E. Ammann SNA TECHNICAL REPORT NOVEMBER 2007 Competence Network Softnet Austria,
More informationFinite-State Model Checking
EECS 219C: Computer-Aided Verification Intro. to Model Checking: Models and Properties Sanjit A. Seshia EECS, UC Berkeley Finite-State Model Checking G(p X q) Temporal logic q p FSM Model Checker Yes,
More informationLinear Temporal Logic and Büchi Automata
Linear Temporal Logic and Büchi Automata Yih-Kuen Tsay Department of Information Management National Taiwan University FLOLAC 2009 Yih-Kuen Tsay (SVVRL @ IM.NTU) Linear Temporal Logic and Büchi Automata
More informationState-Space Exploration. Stavros Tripakis University of California, Berkeley
EE 144/244: Fundamental Algorithms for System Modeling, Analysis, and Optimization Fall 2014 State-Space Exploration Stavros Tripakis University of California, Berkeley Stavros Tripakis (UC Berkeley) EE
More informationSafety and Liveness Properties
Safety and Liveness Properties Lecture #6 of Model Checking Joost-Pieter Katoen Lehrstuhl 2: Software Modeling and Verification E-mail: katoen@cs.rwth-aachen.de November 5, 2008 c JPK Overview Lecture
More informationDouble Header. Model Checking. Model Checking. Overarching Plan. Take-Home Message. Spoiler Space. Topic: (Generic) Model Checking
Double Header Model Checking #1 Two Lectures Model Checking SoftwareModel Checking SLAM and BLAST Flying Boxes It is traditional to describe this stuff (especially SLAM and BLAST) with high-gloss animation
More informationCS 267: Automated Verification. Lecture 8: Automata Theoretic Model Checking. Instructor: Tevfik Bultan
CS 267: Automted Verifiction Lecture 8: Automt Theoretic Model Checking Instructor: Tevfik Bultn LTL Properties Büchi utomt [Vrdi nd Wolper LICS 86] Büchi utomt: Finite stte utomt tht ccept infinite strings
More informationLogic Programming. Prolog : 3
Logic Programming Prolog : 3 Review We don't write normal functions in Prolog. Instead we relate the input and the output e.g. factorial: factorial(0, 1). factorial(n, V) : N > 0, N1 is N 1, factorial(n1,
More informationTecniche di Specifica e di Verifica. Automata-based LTL Model-Checking
Tecniche di Specifica e di Verifica Automata-based LTL Model-Checking Finite state automata A finite state automaton is a tuple A = (S,S,S 0,R,F) S: set of input symbols S: set of states -- S 0 : set of
More informationRevisiting Synthesis of GR(1) Specifications
Revisiting Synthesis of GR(1) Specifications Uri Klein & Amir Pnueli Courant Institute of Mathematical Sciences, NYU Haifa Verification Conference, October 2010 What Is Synthesis? Rather than implement
More informationInfinite Games. Sumit Nain. 28 January Slides Credit: Barbara Jobstmann (CNRS/Verimag) Department of Computer Science Rice University
Infinite Games Sumit Nain Department of Computer Science Rice University 28 January 2013 Slides Credit: Barbara Jobstmann (CNRS/Verimag) Motivation Abstract games are of fundamental importance in mathematics
More informationScenario Graphs and Attack Graphs
Scenario Graphs and Attack Graphs Oleg Mikhail Sheyner CMU-CS-04-122 April 14, 2004 School of Computer Science Computer Science Department Carnegie Mellon University Pittsburgh, PA Thesis Committee: Jeannette
More informationBounded Model Checking with SAT/SMT. Edmund M. Clarke School of Computer Science Carnegie Mellon University 1/39
Bounded Model Checking with SAT/SMT Edmund M. Clarke School of Computer Science Carnegie Mellon University 1/39 Recap: Symbolic Model Checking with BDDs Method used by most industrial strength model checkers:
More informationTecniche di Specifica e di Verifica. Automata-based LTL Model-Checking
Tecniche di Specifica e di Verifica Automata-based LTL Model-Checking Finite state automata A finite state automaton is a tuple A = (Σ,S,S 0,R,F) Σ: set of input symbols S: set of states -- S 0 : set of
More informationDesign and Analysis of Distributed Interacting Systems
Design and Analysis of Distributed Interacting Systems Organization Prof. Dr. Joel Greenyer April 11, 2013 Organization Lecture: Thursdays, 10:15 11:45, F 128 Tutorial: Thursdays, 13:00 13:45, G 323 first
More informationModel Checking: An Introduction
Model Checking: An Introduction Meeting 3, CSCI 5535, Spring 2013 Announcements Homework 0 ( Preliminaries ) out, due Friday Saturday This Week Dive into research motivating CSCI 5535 Next Week Begin foundations
More informationLecture Notes on Emptiness Checking, LTL Büchi Automata
15-414: Bug Catching: Automated Program Verification Lecture Notes on Emptiness Checking, LTL Büchi Automata Matt Fredrikson André Platzer Carnegie Mellon University Lecture 18 1 Introduction We ve seen
More informationChapter 5: Linear Temporal Logic
Chapter 5: Linear Temporal Logic Prof. Ali Movaghar Verification of Reactive Systems Spring 91 Outline We introduce linear temporal logic (LTL), a logical formalism that is suited for specifying LT properties.
More informationAlgorithms for NLP
Regular Expressions Chris Dyer Algorithms for NLP 11-711 Adapted from materials from Alon Lavie Goals of Today s Lecture Understand the properties of NFAs with epsilon transitions Understand concepts and
More informationChap. 2 Finite Automata
Chap. 2 Finite Automata 2.1 An Informal Picture of Finite Automata (See 2nd Edition) A man with a wolf, goat, and cabbage is on the left bank of a river A boat carries one man and only one of the other
More informationInteger Linear Programming Based Property Checking for Asynchronous Reactive Systems
IEEE TRANSACTIONS ON SOFTWARE ENGINEERING 1 Integer Linear Programming Based Property Checking for Asynchronous Reactive Systems Stefan Leue Department of Computer and Information Science University of
More informationLecture 6 Verification of Hybrid Systems
Lecture 6 Verification of Hybrid Systems Ufuk Topcu Nok Wongpiromsarn Richard M. Murray AFRL, 25 April 2012 Outline: A hybrid system model Finite-state abstractions and use of model checking Deductive
More informationLecture 2: Symbolic Model Checking With SAT
Lecture 2: Symbolic Model Checking With SAT Edmund M. Clarke, Jr. School of Computer Science Carnegie Mellon University Pittsburgh, PA 15213 (Joint work over several years with: A. Biere, A. Cimatti, Y.
More informationMANY coordinated tasks performed by teams of mobile
1 Distributed Intermittent Connectivity Control of Mobile Robot Networks Yiannis Kantaros, Student Member, IEEE, and Michael M. Zavlanos, Member, IEEE Abstract In this paper we develop an intermittent
More informationSystems Verification. Alessandro Abate. Day 1 January 25, 2016
Systems Verification Alessandro Abate Day 1 January 25, 2016 Outline Course setup Intro to formal verification Models - labelled transition systems Properties as specifications - modal logics Model checking
More informationChap. 2 Finite Automata
Chap. 2 Finite Automata 2.1 An Informal Picture of Finite Automata (See 2nd Edition) A man with a wolf, goat, and cabbage is on the left bank of a river A boat carries one man and only one of the other
More informationA Symbolic Approach to Safety LTL Synthesis
A Symbolic Approach to Safety LTL Synthesis Shufang Zhu 1 Lucas M. Tabajara 2 Jianwen Li Geguang Pu 1 Moshe Y. Vardi 2 1 East China Normal University 2 Rice Lucas M. Tabajara (Rice University) 2 University
More informationOverview. Discrete Event Systems Verification of Finite Automata. What can finite automata be used for? What can finite automata be used for?
Computer Engineering and Networks Overview Discrete Event Systems Verification of Finite Automata Lothar Thiele Introduction Binary Decision Diagrams Representation of Boolean Functions Comparing two circuits
More informationComputation Tree Logic
Chapter 6 Computation Tree Logic Pnueli [88] has introduced linear temporal logic to the computer science community for the specification and verification of reactive systems. In Chapter 3 we have treated
More informationState := PC 2 (N 2 ) 5. I(p,q, x,y,v,r, a) : p = q = 1 x N 2 v = r = a = 0. S1(...) S2(...) S3(...) R1(...) R2(...).
Verifying Concurrent Systems Wolfgang Schreiner Wolfgang.Schreiner@risc.uni-linz.ac.at Research Institute for Symbolic Computation (RISC) Johannes Kepler University, Linz, Austria http://www.risc.uni-linz.ac.at
More informationSoftware Verification
Software Verification Grégoire Sutre LaBRI, University of Bordeaux, CNRS, France Summer School on Verification Technology, Systems & Applications September 2008 Grégoire Sutre Software Verification VTSA
More informationSemantic Equivalences and the. Verification of Infinite-State Systems 1 c 2004 Richard Mayr
Semantic Equivalences and the Verification of Infinite-State Systems Richard Mayr Department of Computer Science Albert-Ludwigs-University Freiburg Germany Verification of Infinite-State Systems 1 c 2004
More informationVerifying Concurrent Systems
Verifying Concurrent Systems Wolfgang Schreiner Wolfgang.Schreiner@risc.uni-linz.ac.at Research Institute for Symbolic Computation (RISC) Johannes Kepler University, Linz, Austria http://www.risc.uni-linz.ac.at
More informationOn the Synergy of Probabilistic Causality Computation and Causality Checking
Technical Report soft-13-01, Chair for Software Engineering, University of Konstanz, Copyright by the Authors 2013 On the Synergy of Probabilistic Causality Computation and Causality Checking Florian Leitner-Fischer
More informationOn Model Checking for Visibly Pushdown Automata
Japan Institute of Advanced Industrial Science and Technology Research Center for Specification and Verification LATA 2012 On Model Checking for Visibly Pushdown Automata Nguyen Van Tang and Hitoshi Ohsaki
More informationResponse property checking via distributed state space exploration
Response property checking via distributed state space exploration Brad Bingham and Mark Greenstreet {binghamb, mrg}@cs.ubc.ca Department of Computer Science University of British Columbia, Canada October
More informationFailure Diagnosis of Discrete Event Systems With Linear-Time Temporal Logic Specifications
Failure Diagnosis of Discrete Event Systems With Linear-Time Temporal Logic Specifications Shengbing Jiang and Ratnesh Kumar Abstract The paper studies failure diagnosis of discrete event systems with
More informationSymbolic Model Checking Property Specification Language*
Symbolic Model Checking Property Specification Language* Ji Wang National Laboratory for Parallel and Distributed Processing National University of Defense Technology *Joint Work with Wanwei Liu, Huowang
More informationBasics of Linear Temporal Proper2es
Basics of Linear Temporal Proper2es Robert B. France State vs ac2on view Ac2on view abstracts out states; focus only on ac2on labels State view: focus only on states and the proposi2ons that are true in
More informationModeling & Control of Hybrid Systems. Chapter 7 Model Checking and Timed Automata
Modeling & Control of Hybrid Systems Chapter 7 Model Checking and Timed Automata Overview 1. Introduction 2. Transition systems 3. Bisimulation 4. Timed automata hs check.1 1. Introduction Model checking
More informationTransition Systems and Linear-Time Properties
Transition Systems and Linear-Time Properties Lecture #1 of Principles of Model Checking Joost-Pieter Katoen Software Modeling and Verification Group affiliated to University of Twente, Formal Methods
More informationComputation Tree Logic (CTL) & Basic Model Checking Algorithms
Computation Tree Logic (CTL) & Basic Model Checking Algorithms Martin Fränzle Carl von Ossietzky Universität Dpt. of Computing Science Res. Grp. Hybride Systeme Oldenburg, Germany 02917: CTL & Model Checking
More informationLecture 3: Nondeterministic Finite Automata
Lecture 3: Nondeterministic Finite Automata September 5, 206 CS 00 Theory of Computation As a recap of last lecture, recall that a deterministic finite automaton (DFA) consists of (Q, Σ, δ, q 0, F ) where
More informationCTL Model checking. 1. finite number of processes, each having a finite number of finite-valued variables. Model-Checking
CTL Model checking Assumptions:. finite number of processes, each having a finite number of finite-valued variables.. finite length of CTL formula Problem:Determine whether formula f 0 is true in a finite
More informationLecture 23 : Nondeterministic Finite Automata DRAFT Connection between Regular Expressions and Finite Automata
CS/Math 24: Introduction to Discrete Mathematics 4/2/2 Lecture 23 : Nondeterministic Finite Automata Instructor: Dieter van Melkebeek Scribe: Dalibor Zelený DRAFT Last time we designed finite state automata
More informationCS477 Formal Software Dev Methods
CS477 Formal Software Dev Methods Elsa L Gunter 2112 SC, UIUC egunter@illinois.edu http://courses.engr.illinois.edu/cs477 Slides based in part on previous lectures by Mahesh Vishwanathan, and by Gul Agha
More informationComponent-wise Incremental LTL Model Checking
Component-wise Incremental LTL Model Checking Vince Molnár 1, András Vörös 1, Dániel Darvas 1, Tamás Bartha 2 and István Majzik 1 1 Department of Measurement and Information Systems, Budapest University
More informationChap. 2 Finite Automata
Chap. 2 Finite Automata 2.1 An Informal Picture of Finite Automata A man with a wolf, goat, and cabbage is on the left bank of a river A boat carries one man and only one of the other three. The wolf eats
More informationReactive Synthesis. Swen Jacobs VTSA 2013 Nancy, France u
Reactive Synthesis Nancy, France 24.09.2013 u www.iaik.tugraz.at 2 Property Synthesis (You Will Never Code Again) 3 Construct Correct Systems Automatically Don t do the same
More informationONR MURI AIRFOILS: Animal Inspired Robust Flight with Outer and Inner Loop Strategies. Calin Belta
ONR MURI AIRFOILS: Animal Inspired Robust Flight with Outer and Inner Loop Strategies Provable safety for animal inspired agile flight Calin Belta Hybrid and Networked Systems (HyNeSs) Lab Department of
More informationFrom Liveness to Promptness
From Liveness to Promptness Orna Kupferman Hebrew University Nir Piterman EPFL Moshe Y. Vardi Rice University Abstract Liveness temporal properties state that something good eventually happens, e.g., every
More informationProbabilistic Model Checking Michaelmas Term Dr. Dave Parker. Department of Computer Science University of Oxford
Probabilistic Model Checking Michaelmas Term 2011 Dr. Dave Parker Department of Computer Science University of Oxford Overview Temporal logic Non-probabilistic temporal logic CTL Probabilistic temporal
More informationAlgorithmic verification
Algorithmic verification Ahmed Rezine IDA, Linköpings Universitet Hösttermin 2018 Outline Overview Model checking Symbolic execution Outline Overview Model checking Symbolic execution Program verification
More informationTechniques to solve computationally hard problems in automata theory
Techniques to solve computationally hard problems in automata theory Richard Mayr University of Edinburgh, UK IST Vienna, 4. Nov. 2014 Resources: www.languageinclusion.org Mayr (Edinburgh) Hard Problems
More informationDirected Model Checking (not only) for Timed Automata
Directed Model Checking (not only) for Timed Automata Sebastian Kupferschmid March, 2010 Model Checking Motivation Embedded Systems Omnipresent Safety relevant systems Pentium bug Ariane 5 Errors can be
More informationMonitoring Distributed Controllers
Monitoring Distributed Controllers When an Efficient LTL Algorithm on Sequences is Needed to Model-Check Traces A. Genon T. Massart C. Meuter Université Libre de Bruxelles Département d Informatique August
More informationEECS 144/244: Fundamental Algorithms for System Modeling, Analysis, and Optimization
EECS 144/244: Fundamental Algorithms for System Modeling, Analysis, and Optimization Discrete Systems Lecture: Automata, State machines, Circuits Stavros Tripakis University of California, Berkeley Stavros
More informationIntegrating Induction and Deduction for Verification and Synthesis
Integrating Induction and Deduction for Verification and Synthesis Sanjit A. Seshia Associate Professor EECS Department UC Berkeley DATE 2013 Tutorial March 18, 2013 Bob s Vision: Exploit Synergies between
More informationOverview. overview / 357
Overview overview6.1 Introduction Modelling parallel systems Linear Time Properties Regular Properties Linear Temporal Logic (LTL) Computation Tree Logic syntax and semantics of CTL expressiveness of CTL
More informationMethods for the specification and verification of business processes MPB (6 cfu, 295AA)
Methods for the specification and verification of business processes MPB (6 cfu, 295AA) Roberto Bruni http://www.di.unipi.it/~bruni 20 - Workflow modules 1 Object We study Workflow modules to model interaction
More informationProbabilistic Model Checking and Strategy Synthesis for Robot Navigation
Probabilistic Model Checking and Strategy Synthesis for Robot Navigation Dave Parker University of Birmingham (joint work with Bruno Lacerda, Nick Hawes) AIMS CDT, Oxford, May 2015 Overview Probabilistic
More informationModels for Efficient Timed Verification
Models for Efficient Timed Verification François Laroussinie LSV / ENS de Cachan CNRS UMR 8643 Monterey Workshop - Composition of embedded systems Model checking System Properties Formalizing step? ϕ Model
More informationA new Abstraction-Refinement based Verifier for Modular Linear Hybrid Automata and its Implementation
A new Abstraction-Refinement based Verifier for Modular Linear Hybrid Automata and its Implementation Hao Ren 1 (ren@iastate.edu), Jing Huang 2 (freescaler@live.com), Shengbing Jiang 3 (shengbing.jiang@gm.com)
More informationMethods for the specification and verification of business processes MPB (6 cfu, 295AA)
Methods for the specification and verification of business processes MPB (6 cfu, 295AA) Roberto Bruni http://www.di.unipi.it/~bruni 20 - Workflow modules 1 Object We study Workflow modules to model interaction
More informationPlanning Under Uncertainty II
Planning Under Uncertainty II Intelligent Robotics 2014/15 Bruno Lacerda Announcement No class next Monday - 17/11/2014 2 Previous Lecture Approach to cope with uncertainty on outcome of actions Markov
More information