Unbounded, Fully Symbolic Model Checking of Timed Automata using Boolean Methods

Transcription

1 Unbounded, Fully Symbolic Model Checking of Timed Automata using Boolean Methods Sanjit A. Seshia and Randal E. Bryant Computer Science Department Carnegie Mellon University

2 Verifying Timed Embedded Systems Verifying Timed Embedded Systems Many embedded systems are real-time E.g., drive-by-wire systems in automobiles Confidence in system reliability is increased by verification of system models Model Checking has been successfully used for verifying finite-state models Model Property Model Checker Exhaustive state space exploration Yes, model satisfies property No, here s a counterexample However, the same level of success has eluded model checking of real-time models time models State space contains both continuous and discrete parts Hard to find a compact representation that combines both parts -2-

3 Timed Automata Timed Automata Alur, Courcobetis, & Dill, 90 A modeling formalism for timed systems Generalization of finite automaton with: Non-negative real-valued clock variables Constraints on clocks as guards on states and transitions s=true y 5 y 3 / y := 0 y 4 x 6 / x := 0 s=false y 10 x 8-3-

4 Timed Model Checking Taxonomy Timed Model Checking Taxonomy Unbounded Explores entire state space Uppaal, Kronos Red, DDD, TMV Bounded Only explores state space for bounded unfoldings of transition relation Symbolic Separate representations for continuous and discrete parts of state space MathSAT Fully Symbolic Single representation for both continuous and discrete parts -4-

5 Unbounded, Fully Symbolic Model Checking Set of states represented as a formula φ in separation logic (SL) Boolean Combinations (,, ) of Boolean variables: e i Separation Predicates: x i x j + c, x i > x j + c» Also called difference-bound or gap-order constraints 0 represented as special variable x 0 Properties are in Timed CTL * Two kinds of TCTL* formulas: Reachability properties: Safety and bounded liveness» E.g. AG (file requested AF Henzinger, Nicollin, Sifakis, Yovine 94 5 (file received)) Non-reachability properties: Unbounded liveness» E.g. EG. z:= 0. F (z = 1) [non-zenoness] -5-

6 Pre Operator for Model Checking Pre Operator for Model Checking Two ways to reach a set of states φ: Let time elapse Only clock variables change, discrete variables remain unchanged Make a discrete transition Some clock variables reset, all others unchanged Discrete state changes as per transition relation Pre Operator can be written as pre(φ) pre d (φ) pre t (φ) pre d (φ) is the same as in Boolean model checking pre t (φ) is expressed in Quantified Separation Logic (QSL) -6-

7 Timed Pre Operator in QSL Timed Pre Operator in QSL φ inv φ Computing pre t (φ) pre t (φ) δ { δ x 0 φ [δ / x 0 ] ε ( δ ε x 0 φ inv [ε / x 0 ] ) } φ inv is the conjunction of all state guards Need quantifier elimination procedure for QSL -7-

8 QSL Quantifier Elimination QSL Quantifier Elimination Start with QSL formula ω,, where ω x a. φ To handle x a. φ, start with x a. φ, and negate the result Quantifier elimination done in 3 phases: 1. Translate ω to another QSL formula ω where: ω has quantifiers only over Boolean variables ω is equivalent to ω 2. Encode ω as a QBL formula and eliminate Boolean quantifiers 3. Translate the result back to SL Benefit of this method Unlike other methods, avoids translation to DNF -8-

9 Quantifier Elimination Phase 1 Quantifier Elimination Phase 1 Input ω x 3. (x 1 x 3 x 3 x 1 +2) x 0 x 3-5 x 3 x 2 Transitivity constraints φ cons Boolean encoding φ bool (e,0 1,3 e,0 3,2 ) (x 1 x 2 ) (e,0 1,3 e,2 3,1 ) e0,3,-5 e,0 3,2 (e,2 3,1 e,-5 0,3 ) (x 0 x 1-3) (e,-5 0,3 e,0 3,2 ) (x 0 x 2-5) Generate QSL formula ω -9-. [φbool φ cons ],0. [,-5, e3,2 e,2, e0,3 e,0, e3,1 e e 1,3

10 Quantifier Elimination Phase 2 & 3 Quantifier Elimination Phase 2 & 3 Generate QBL formula ρ from ω e,0 1,3, e3,1 e,2, e0,3 e,-5, e3,2 e,0. [φ bool (e,0 1,3 e,0 3,2 e,0 1,2 ) (e,2 3,1 e,-5 0,3 e,-3 0,1 ) (e,-5 0,3 e,0 3,2 ) e0,2,-5 ] Eliminating quantifiers from ρ yields (e,0 1,2 e,-5 0,2 ) (e,-3 0,1 e,-5 0,2 ) Translating back to separation logic (x 1 x 2 x 0 x 2-5) (x 0 x 1-3 x 0 x 2-5) -10-

11 Special Class of QSL formulas Special Class of QSL formulas Consider QSL formulas of the form: ε. { ε x 0 φ [ε / x 0 ] } Recall that x 0 stands for 0 We can do quantifier elimination more efficiently, generating fewer quantified Boolean variables Can similarly handle ε. { ε x 0 φ [ε / x 0 ] } Half of all quantifier elimination operations Experimentally, leads to 10X-20X speedup -11-

12 Preliminary Results Preliminary Results Fischer s timed mutual exclusion protocol, for increasing numbers of processes Results for non-reachability formula (non-zenoness zenoness) Timed Model Verifier (TMV): Our model checker Uses a BDD package (CUDD) as a QBL solver Kronos & Red are the only other model checkers that can handle non-reachability properties Number of Processes Kronos Time (sec.) Red Time (sec.) TMV Time (sec.) (peak nodes) * *

13 Publications & Future Work Publications & Future Work Work will appear at CAV 2003 Details in technical report CMU-CS Ongoing & Future Work: Using a SAT-based QBL solver Improving current BDD-based implementation Applications to real-world benchmarks Investigating other applications Convergence checking for bounded model checking of timed automata Theorem proving Hybrid systems -13-