Methods for Software Verification. Andrea Corradini Gian Luigi Ferrari. Second Semester 6 CFU

Transcription

1 Methods for Software Verification Andrea Corradini Gian Luigi Ferrari Second Semester 6 CFU.

2 The importance of Software Correctness Increasing integration of ICT in different applications: Embedded systems Communication protocols Transportation systems Service-Oriented platforms,... Reliability increasingly depends on software: defects can be fatal and extremely costly Products subject to mass-production Safety-critical systems In this digital era, correct systems for information processing are more valuable than gold Henk Barendregt,

3 Telephone Networks or the potential effect of even very small program errors... a normal day in the life of a telephone system (wednesday april 5, 1995) ~133 million long distance calls are handled 3

4 The AT&T Telephone Network Outage: monday january 15, 1990 (MLK day) green - sw it c h is up w hit e - sw it c h is dow n red - sw it c h unreac hable 2 switches crash and reboot 1:23 pm 1:43 pm 4

5 AT&T Network (green: blocked long distance links) 50% of all calls were lost due to a software glitch (1 redundant break statement in the C code, that changed the algorithm). Costs: several 100 million US$ AT&T apologized by offering free calls the next Valentine s day: February 14, :45 pm 1:25 pm for (;;) { switch (x) { case A: ; break; case B: ; break; } } for (;;) { if (x == A) { ; } else { : ; break; } } 5

6 Ariane 5 Crash (1996) or the potential effect of a single error instance

7 Software Verification Techniques Empirical approaches: Peer reviewing Testing Approaches based on Formal Methods. To prove that property P holds: Deductive methods: Prove that P holds with a theorem prover/proof assistant Model Checking: systematic check on P in all states applicable if the system generates a (finite) behavioural model

8 Model Checking: how does it work? 8

9 What are models and properties? Models: Transition systems States labeled with basic propositions [Labeled] Transition relation between states Can model [multi-threaded] programs, communicating processes, hardware circuits... Example properties: Can the system reach a deadlock situation? Can two processes be simultaneously in a critical section? On termination, does a program provide the correct output? Properties as formulas Propositional logic Modal operators such as always and eventually Interpreted over state sequences (linear) Or over infinite trees of states (branching)

10 Model Checking: a language theoretic approach system: L(S) (the set of possible behaviors of S) property: L(p) (the set of valid/desirable behaviors) goal: prove that L(S) L(p) (everything possible is valid) method: to prove L(S) L(p) we can prove L(S) (Σ ω \ L(p)) = which is the same as L(S) L( (p)) = Emptiness of intersection of certain languages 10

11 Course Outline Introduction what makes designing distributed systems hard? the concept of a verification model modeling concurrency, expressing correctness properties the role of abstraction in building verification models Theoretical foundation automata and logic verification algorithms avoiding state space explosion partial order reduction, abstract interpretation Model checking in practice tools and tool design (Spin Model Checker) model building and model extraction challenges: software model checking (integrated IDE) 11

12 Textbooks Christel Baier, Joost Peter Katoen Principles of Model Checking MIT Press, 2008 Mordechai Ben-Ari Principles of the Spin Model Checker Springer,

13 Relevant Research Activities Model checking infinite state systems Software Model Checking for Services and Cloud Systems 13