Topics in Verification AZADEH FARZAN FALL 2017

Transcription

1 Topics in Verification AZADEH FARZAN FALL 2017

2 Last time

3 LTL Syntax ϕ ::= true a ϕ 1 ϕ 2 ϕ ϕ ϕ 1 U ϕ 2 a AP. ϕ def = trueu ϕ ϕ def = ϕ g intuitive meaning of and is obt

4 Limitations of LTL pay pay τ τ soda τ select τ beer select 1 soda beer select 2 These two transition systems satisfy the same set of LTL formulas. But they function in different ways. They are trace equivalent.

5 Computational Tree Logic (CTL)

6 Computational Tree Logic (CTL) (s 0, 0) (s 1, 1) s 0 s 1 { x 0} { x =0} (s 2, 2) (s 3, 2) (s 3, 3) (s 2, 3) (s 3, 3) s 3 s 2 { x =0} { x =1,x 0} (a) (s 2, 4) (s 3, 4) (s 3, 4)(s 2, 4) (s 3, 4) (b)

7 Computational Tree Logic (CTL) Aspect Linear time Branching time behavior path-based: state-based: in a state s trace(s) computation tree of s temporal LTL: path formulae ϕ CTL: state formulae logic s = ϕ iff existential path quantification ϕ π Paths(s). π = ϕ universal path quantification: ϕ

8 CTL Syntax State Formula Path Formula Φ ::= true ϕ ::= Φ a Φ 1 Φ 2 Φ Φ 1 U Φ 2 ϕ ϕ Examples: (x =1) (x =1) But not: (x =1 (x 3)) (true U (x =1))

9 Eventually and Always eventually: Φ = (true U Φ) Φ = (true U Φ) always: Φ = Φ Φ = Φ

10 More Examples black black black black (gray U black) (gray U black)

11 TS TS TS TS s 0 s 1 s 3 s 1 s 0 s s 3 { a } { a, b } { a } { a } a, a, { a, b } { a } s 2 s s 2 2 { b } { } { b b } (a) (a) (a) a a a a a a a a a a a ( a) (a b) ( a) ( ( a) a) (a (a (a U b) U b) b) b) (a ( ( b))) (a U (a U ( a ( a b))) ((a U a ( a ( ( a U b))) a U b))) Figure 6.4: Interpretation of several CTL formulae. Figure 6.4: Interpretation of several CTL formulae.

12 CTL Semantics s = a iff a L(s) s = Φ iff not s = Φ s = Φ Ψ iff (s = Φ) and(s = Ψ) s = ϕ iff π = ϕ for some π Paths(s) s = ϕ iff π = ϕ for all π Paths(s) π = Φ iff π[1] = Φ π = Φ U Ψ iff j 0. (π[j] = Ψ ( 0 k<j.π[k] = Φ))

13 Writing CTL Properties mutual exclusion: ( crit 1 crit 2 ) Each red light phase is preceded by a yellow light phase. (yellow red ) In every reachable state of the system, it is possible to return to a start state of the system. start Each process has access to the critical section infinitely often. ( crit 1 ) ( crit 2 )

14 Remember duality laws for paththis? quantifiers Definition. two LTL formulas are equivalent iff: 8 : = 1 () = 2 Φ Φ Φ Φ Φ Φ Φ Φ (Φ U Ψ) ( Ψ U ( Φ Ψ)) Ψ ((Φ Ψ) U ( Φ Ψ)) (Φ Ψ) ((Φ Ψ) W ( Φ Ψ)) expansion laws Definition. two CTL formulas are equivalent iff: (Φ U Ψ) Ψ (Φ (Φ U Ψ)) Φ Φ Φ Φ Φ Φ 8 TS : TS = 1 () TS = 2 (Φ U Ψ) Ψ (Φ (Φ U Ψ)) Φ Φ Φ Φ Φ Φ CTL equivalence is defined distributive over transition laws systems while LTL equivalence is defined over paths. (Φ Ψ) Φ Ψ (Φ Ψ) Φ Ψ

15 Step 3: model checking against an LTL/CTL property

16 LTL model checking is automata-theoretic

17 You would have needed to learn a new notion of automata on infinite words

18 CTL Model Checking Algorithms

19 Existential Normal Form Definition. A CTL formula is in existential normal form (ENF) if it is in the fragment defined by: Φ ::= true a Φ 1 Φ 2 Φ Φ (Φ 1 U Φ 2 ) Φ. Theorem. For every CTL formula, there exists an equivalent CTL formula in ENF. Φ (Φ U Ψ) Φ, ( Ψ U ( Φ Ψ)) Ψ.

20 CTL Model Checking Definition. An algorithm that takes a transition system and a CTL formula and checks whether: TS = for all i Φ do for all Ψ Sub(Φ) with Ψ = i do compute Sat(Ψ) fromsat(ψ ) od (* for maximal genuine Ψ Sub(Ψ) *) od return I Sat(Φ) Sat(Φ) = { s S s = Φ }

21 Example{ } Φ = a }{{} }{{} Ψ (bu c) }{{} }{{} }{{} Ψ } {{ } Ψ ubformulaofψ. ThesyntaxtreeforΦ is of the fol Sat(Φ) Sat(Ψ) U Sat(Ψ ) a b Sat(Ψ ) c

22 Facts about Sat sets Let TS =(S, Act,,I,AP,L) be a transition system without terminal states. For all CTL formulae Φ, Ψ over AP it holds that (a) Sat(true) =S, (b) Sat(a) = { s S a L(s) }, foranya AP, (c) Sat(Φ Ψ) = Sat(Φ) Sat(Ψ), (d) Sat( Φ) = S \ Sat(Φ), (e) Sat( Φ) = { s S Post(s) Sat(Φ) }, (f) Sat( (Φ U Ψ)) is the smallest subset T of S, suchthat (1) Sat(Ψ) T and (2) s Sat(Φ) and Post(s) T implies s T, (g) Sat( Φ) is the largest subset T of S, suchthat (3) T Sat(Φ) and (4) s T implies Post(s) T.

23 Remember Expansion Laws? ϕ U ψ ψ (ϕ (ϕ U ψ)) ψ ψ ψ ψ ψ ψ Lemma. Until is the least solution to the expansion law. The following equation has many solutions: X = _ ( ^ X) Until is the smallest set that satisfies this equation. Note that we are using the notions of sets (of paths) and formulas interchangeably, by referring to the set of paths that satisfy a given formula.

24 Facts about Sat sets Let TS =(S, Act,,I,AP,L) be a transition system without terminal states. For all CTL formulae Φ, Ψ over AP it holds that (a) Sat(true) =S, (b) Sat(a) = { s S a L(s) }, foranya AP, (c) Sat(Φ Ψ) = Sat(Φ) Sat(Ψ), (d) Sat( Φ) = S \ Sat(Φ), (e) Sat( Φ) = { s S Post(s) Sat(Φ) }, (f) Sat( (Φ U Ψ)) is the smallest subset T of S, suchthat (1) Sat(Ψ) T and (2) s Sat(Φ) and Post(s) T implies s T, (g) Sat( Φ) is the largest subset T of S, suchthat Smallest X such that: (3) T Sat(Φ) and (4) s T implies Post(s) T. X = _ ( ^ X) Smallest X such that: Sat(Ψ) { s Sat(Φ) Post(s) T X } = X T. ^ T { s Sat(Φ) Post(s) T }. X

25 How does one make an algorithm out of this?

26 switch(φ): end switch true : return S; a : return { s S a L(s) }; Φ 1 Φ 2 : return Sat(Φ 1 ) Sat(Φ 2 ); Ψ : return S \ Sat(Ψ); Ψ : return { s S Post(s) Sat(Ψ) }; (Φ 1 U Φ 2 ) : T := Sat(Φ 2 ); (* compute the smallest fixed point *) while { s Sat(Φ 1 ) \ T Post(s) T } do let s { s Sat(Φ 1 ) \ T Post(s) T }; T := T { s }; od; return T ; Φ : T := Sat(Φ); (* compute the greatest fixed point *) while { s T Post(s) T = } do let s { s T Post(s) T = }; T := T \{s }; od; return T ;

27 Example Φ { c } s 6 s 7 oke Al Φ =((a = c) (a b)) hm 14 (see page 348). Th { a, b, c } s 0 { b } s 3 { a } s 4 s 5 { a, c } (a) (b) { b, c } s 2 s 1 { a, b } (d) (b) (a) (c)

28 Enumerative Backward Search for Until E := Sat(Ψ); (* E administers the states s with s = (Φ U Ψ) *) T := E; (* T contains the already visited states s with s = (Φ U Ψ) *) while E do let s E; E := E \{s }; for all s Pre(s ) do if s Sat(Φ) \ T then E := E { s }; T := T { s } fi od od return T

29 Example: b. { c } s 6 s 7 { a, b, c } s 0 s 3 { a } { b } s 4 s 5 { a, c } { b, c } s 2 s 1 { a, b } (b) Non-trivial SCCs: Anything that reaches a non-trivial SCC:

30 Enumerative Backward Search for Always E := S \ Sat(Φ); (* E contains any not visited s with s = Φ *) T := Sat(Φ); (* T contains any s for which s = Φ has not yet been disproven *) for all s Sat(Φ) do count[s] := Post(s) ; od (* initialize array count *) while E do (* loop invariant: count[s] = Post(s) (T E) *) let s E; (* s = Φ *) E := E \{s }; (* s has been considered *) for all s Pre(s ) do (* update counters count[s] forallpredecessorss of s *) if s T then count[s] :=count[s] 1; if count[s] =0then T := T \{s}; (* s does not have any successor in T *) E := E { s }; fi fi od od return T

31 Time and Space Complexity Theorem. Let transition system TS have N states and K transitions. Then the complexity of model checking is: O((N+K) Φ ) Theorem. Time complexity of LTL model checking is linear on the transition system size, but exponential on the formula size.