Verification. Lecture 9. Bernd Finkbeiner Peter Faymonville Michael Gerke

Transcription

1 Verification Lecture 9 Bernd Finkbeiner Peter Faymonville Michael Gerke

2 REVIEW: Overview of LTL model checking System Negation of property Model of system LTL-formula φ model checker GeneralisedBüchiautomatonG φ Transition system TS BüchiautomatonA φ Product transition system TS A φ TS A φ P pers(a φ) Yes No (counter-example)

3 REVIEW: The GNBA of LTL-formula φ ForLTL-formulaφ,letG φ =(Q,2 AP,δ,Q 0,F)where QisthesetofallelementarysetsofformulasB closure(φ) Q0 ={B Q φ B} F ={{B Q φ 1 Uφ 2 / Borφ 2 B} φ 1 Uφ 2 closure(φ)} Thetransitionrelationδ Q 2 AP 2 Q isgivenby: δ(b,b AP)isthesetofallelementarysetsofformulasB satisfying: (i) Forevery ψ closure(φ): ψ B ψ B,and (ii) Foreveryψ 1Uψ 2 closure(φ): ψ 1Uψ 2 B (ψ 2 B (ψ 1 B ψ 1Uψ 2 B ))

4 REVIEW: Main result [Vardi, Wolper& Sistla 1986] ForanyLTL-formulaφ(overAP)thereexistsa GNBAG φ over2 AP suchthat: (a) Words(φ)=L ω (G φ ) (b)g φ canbeconstructedintimeandspaceo(2 φ ) (c) #acceptingsetsofg φ isboundedabovebyo( φ ) every LTL-formula expresses an ω-regular property!

5 REVIEW: NBA are more expressive than LTL ThereisnoLTLformulaφwithWords(φ)=PfortheLT-property: P={A 0 A 1 A 2... (2 {a} ) ω a A 2i fori 0} ButthereexistsanNBAAwithL ω (A)=P there are ω-regular properties that cannot be expressed in LTL!

6 REVIEW: Complexity for LTL to NBA ForanyLTL-formulaφ(overAP)thereexistsanNBAA φ withwords(φ)=l ω (A φ )and whichcanbeconstructedintimeandspacein2 O( φ )

7 The LTL model-checking problem is co-np-hard The Hamiltonian path problem is polynomially reducible to the complement of the LTL model-checking problem In fact, the LTL model-checking problem is PSPACE-complete [Sistla& Clarke 1985]

8 Reduction to Hamiltonian Path Problem HamiltonianPathforagraph(V,E)passeseveryvertexexactly once. Stategraph:(V {b},e (V {b}) {b}, L(v)={v}forv V,L(b)= ) LTL property no path is Hamiltonian : ( v (v v)) v V

9 PSPACE-hardness Let M be a polynomial space-bounded Turing machine that acceptswordsofalanguagek (i.e.,k isapspace-language) WeconstructforeachwordwastategraphSandanLTL formulaφsuchthats φiffw K. Single-tapeTuringmachine(Q,q 0,F,Σ,δ) δ Q Σ Q Σ {L,R,N} L:left,R:right,N:nomove Space-bounded: there is a polynomial P(n) such that the computationoninputwordoflengthnvisitsatmostp(n)tape cells.

10 begin P(n) S={0,1,...,P(n)} {(q,a,i) q Q { },A Σ,0<i P(n)} Idea:q QidentifiescurrentstateofTuringmachineandcurrent position of cursor; everywhere else.

11 Configuration(TapecontentA 1,...,A P(n),currentstateq, cursor position i) is encoded as path fragment 0(,A 1,1)1(,A 2,2)2...i 1(q,A i,i)i(,a i+1,i+1)...p(n) Computation is encoded as a sequence of such fragments. Legal configurations: φ conf = (begin φ 1 conf φ2 conf ) φ 1 conf = 1 i P(n) 2i 1 Φ Q whereφ Q = (q,a,i) S,q Q (q,a,i) φ 2 conf = 1 i P(n)( 2i 1 Φ Q 1 j P(n),j i 2j 1 Φ Q )

12 Transition function forδ(q,a)=(p,b,l): φ q,a = 1 i P(n) ( 2i 1 (q,a,i) ψ(q,a,i,p,b,l)) where ψ(q,a,i,p,b,l)= 1 j P(n),i j,c Σ ( 2j 1 C 2j 1+2P(n)+1 C) contentofallcells iunchanged 2i 1+2P(n)+1 B overwriteabybincelli 2i 1+2P(n)+1 2 p movetostatepandcursortocelli 1 φ δ = φ q,a q,a [C shortfor r,j (r,c,j),pshortfor D,j (p,d,j)]

13 Starting configuration φ w start=begin q 0 1 i n 2i 1 A i n<i P(n) 2i 1 blank Accepting configuration φ accept = q F q Full encoding φ w = φ conf φ w start φ δ φ accept Modelcheck φ w.

14 PSPACE-completeness Claim: TheLTLmodelcheckingproblemcanbesolvedbya nondeterministic polynomial space-bounded algorithm Idea:Guess,nondeterministically,anacceptingruninS G φ : u 0 u 1...u n 1 (v 0 v 1...v m 1 ) ω wheren,m S 2 φ Guess n, m nondeterministically by guessing log( S 2 φ ) =O(log( S ) φ )bits. Guessthesequenceu 0 u 1...u n 1 u n...u n+m wheren i =(s i,b i ) such that si isasuccessorofs i 1 fori 1 Bi iselementary Bi AP=L(s i ) Bi δ(b i 1,L(s i 1 ))fori 1. Checkifu n =u n+m Checkthatwheneverφ 1 Uφ 2 B i forsomei {n,...n+m 1} then j {n,...,n+m 1}withφ 2 B j

15 Required space n+mcanbeexponential.however,weonlyneed: pairofstatesu i 1,u i ; flagwhichφ 1 Uφ 2 haveappearedinloop; flagwhichφ 2 haveappeared; u n polynomial space

16 LTL satisfiability and validity checking Satisfiability problem: Words(φ)/= for LTL-formula φ? doesthereexistatransitionsystemforwhichφholds? Solution:constructanNBAA φ andcheckforemptiness nesteddepth-firstsearchforcheckingpersistenceproperties Validityproblem:isφ true,i.e.,words(φ)=(2 AP ) ω? doesφholdforeverytransitionsystem? Solution:asforsatisfiability,asφisvalidiff φisnotsatisfiable runtime is exponential; a more efficient algorithm most probably does not exist!

17 LTL satisfiability and validity checking The satisfiability and validity problem for LTL are PSPACE-complete Idea: Reduce model checking problem of φ to satisfiability problem by encoding transition system as LTL formula: ψ=ψ I ψ S ψ AP ψ I = q I q ψ S = q S q q Post(q) q ψ AP = q S q a L(q) a a/ L(q) a Check satisfiability of ψ φ.

18 Summary of LTL model checking(1) LTL is a logic for formalizing path-based properties Expansion law allows for rewriting until into local conditions and next LTL-formulaφcanbetransformedalgorithmicallyintoNBAA φ thismaycauseanexponentialblowup algorithm:firstconstructagnbaforφ;thentransformitintoan equivalent NBA LTL-formulae describe ω-regular LT-properties butdonothavethesameexpressivityasω-regularlanguages

19 Summary of LTL model checking(2) TS φcanbesolvedbyanesteddepth-firstsearchints A φ timecomplexityoftheltlmodel-checkingalgorithmislinear intsandexponentialin φ Fairness assumptions can be described by LTL-formulae the model-checking problem for LTL with fairness is reducible to the standard LTL model-checking problem The LTL-model checking problem is PSPACE-complete Satisfiability and validity of LTL amounts to NBA emptiness-check The satisfiability and validitiy problems for LTL are PSPACE-complete

20 Linear and branching temporal logic Linear temporal logic: statements about(all) paths starting in a state s (x 20)iffforallpossiblepathsstartinginsalwaysx 20 Branching temporal logic: statements about all or some paths starting in a state s AG(x 20)iffforallpathsstartinginsalwaysx 20 s EG(x 20)iffforsomepathstartinginsalwaysx 20 nestingofpathquantifiersisallowed CheckingEφinLTLcanbedoneusingA φ...butthisdoesnotworkfornestedformulassuchasagefa

21 Linear versus branching temporal logic Semanticsisbasedonabranchingnotionoftime aninfinitetreeofstatesobtainedbyunfoldingtransitionsystem one timeinstant mayhaveseveralpossiblesuccessor time instants Incomparable expressiveness therearepropertiesthatcanbeexpressedinltl,butnotinctl therearepropertiesthatcanbeexpressedinctl,butnotinltl Distinct model checking algorithms, and their time complexities Distinct treatment of fairness assumptions Distinct equivalences(pre-orders) on transition systems thatcorrespondtologicalequivalenceinltlandbranching temporal logics

22 Transition systems and trees (s 0,0) s 0 s 1 {x=0} (s 1,1) {x 0} (s 2,2) (s 3,2) s 3 s 2 {x=0} (s 3,3) (s 2,3) (s 3,3) {x=1,x 0} (s 2,4) (s 3,4) (s 3,4) (s 2,4) (s 3,4)

23 behavior path-based: state-based: in a state s trace(s) computation tree of s temporal LTL: path formulas φ CTL: state formulas logic s φ iff existential path quantification φ π Paths(s). π φ universal path quantification: φ complexity of the PSPACE--complete PTIME model checking problems O( TS 2 φ ) O( TS Φ ) implementation- trace inclusion and the like simulation and bisimulation relation (proof is PSPACE-complete) (proof in polynomial time) fairness no special techniques special techniques needed

24 Branching temporal logics There are various branching temporal logics: Hennessy-Milner logic Computation Tree Logic(CTL) ExtendedComputationTreeLogic(CTL ) combinesltlandctlintoasingleframework Alternation-free modal µ-calculus Modal µ-calculus Propositional dynamic logic

25 Computation tree logic modal logic over infinite trees[clarke& Emerson 1981] Statements over states a AP atomicproposition ΦandΦ Ψ negationandconjunction Eφ thereexistsapathfulfillingφ Aφ allpathsfulfillφ Statements over paths XΦ thenextstatefulfillsφ ΦUΨ ΦholdsuntilaΨ-stateisreached notethatxand U alternatewitha ande AXXΦandAEX Φ/ CTL,butAXAX ΦandAXEX Φ CTL Alternativesyntax:E,A,X,G,F.

26 Derived operators potentiallyφ: EFΦ = E(trueUΦ) inevitablyφ: AFΦ = A(trueUΦ) potentiallyalwaysφ: EGΦ = AF Φ invariantlyφ: AGΦ = EF Φ weakuntil: E(ΦWΨ) = A((Φ Ψ)U( Φ Ψ)) A(ΦWΨ) = E((Φ Ψ)U( Φ Ψ)) the boolean connectives are derived as usual

27 Visualization of semantics EFred EGred E(yellowUred) AFred AGred A(yellowUred)

28 Semantics of CTL state-formulas Definedbyarelation suchthat s ΦifandonlyifformulaΦholdsinstates s a iff a L(s) s Φ iff (s Φ) s Φ Ψ iff (s Φ) (s Ψ) s Eφ iff π φforsomepathπthatstartsins s Aφ iff π φforallpathsπthatstartins

29 Semantics of CTL path-formulas Definedbyarelation suchthat π φifandonlyifpathπsatisfiesφ π XΦ iffπ[1] Φ π ΦUΨ iff( j 0.π[j] Ψ ( 0 k<j.π[k] Φ)) whereπ[i]denotesthestates i inthepathπ

30 Transition system semantics For CTL-state-formula Φ, the satisfaction set Sat(Φ) is defined by: Sat(Φ)={s S s Φ} TSsatisfiesCTL-formulaΦiffΦholdsinallitsinitialstates: TS Φ ifandonlyif s 0 I.s 0 Φ thisisequivalenttoi Sat(Φ) Pointofattention:TS/ ΦandTS/ Φispossible! becauseofseveralinitialstates,e.g.s0 EGΦands 0 / EGΦ

31 CTL equivalence CTL-formulasΦandΨ(overAP)areequivalent,denotedΦ Ψ ifandonlyifsat(φ)=sat(ψ)foralltransitionsystemstsoverap Φ Ψ iff (TS Φ ifandonlyif TS Ψ)

32 Duality laws AXΦ EX Φ EXΦ AX Φ AFΦ EG Φ EFΦ AG Φ A(ΦUΨ) E((Φ Ψ)W( Φ Ψ))

33 Expansion laws RecallinLTL:φUψ ψ (φ X(φUψ)) In CTL: A(ΦUΨ) Ψ (Φ AXA(ΦUΨ)) AFΦ Φ AXAFΦ AGΦ Φ AXAGΦ E(ΦUΨ) Ψ (Φ EXE(ΦUΨ)) EFΦ Φ EXEFΦ EGΦ Φ EXEGΦ

34 Distributive laws Recall in LTL: G(φ ψ) Gφ Gψ F(φ ψ) Fφ Fψ In CTL: AG(Φ Ψ) AGΦ AGΨ EF(Φ Ψ) EFΦ EFΨ notethateg(φ Ψ) / EGΦ EGΨandAF(Φ Ψ) / AFΦ AFΨ

35 Existential normal form(enf) ThesetofCTLformulasinexistentialnormalform(ENF)isgivenby: Φ = true a Φ 1 Φ 2 Φ EXΦ E(Φ 1 UΦ 2 ) EGΦ For each CTL formula, there exists an equivalent CTL formula in ENF AXΦ EX Φ A(ΦUΨ) E( ΨU( Φ Ψ)) EG Ψ

36 Model checking CTL HowtocheckwhetherstategraphTSsatisfiesCTLformula Φ? converttheformula ΦintotheequivalentΦinENF computerecursivelythesetsat(φ)={q S q Φ} TS ΦifandonlyifeachinitialstateofTSbelongstoSat(Φ) Recursive bottom-up computation of Sat(Φ): considertheparse-treeofφ starttocomputesat(ai ),forallleafsinthetree thengoonelevelupinthetreeanddeterminesat( )forthese nodes e.g.,: Sat(Ψ 1 Ψ 2 )=Sat( Ψ 1 nodeatleveli node at level i 1 ) Sat( Ψ 2 node at level i 1 thengoonelevelupanddeterminesat( )ofthesenodes andsoon...untiltherootistreated,i.e.,sat(φ)iscomputed )

37 Example Sat(Φ) Sat(Ψ) EX EU Sat(Ψ ) b EG Sat(Ψ ) a c Φ= EXa Ψ E(bU EG c) Ψ Ψ.

38 Basic algorithm Require: finite transition system TS with states S and initial states I, and CTLformulaΦ(bothoverAP) Ensure: TS Φ {computethesetssat(φ)={q S q Φ}} foralli Φ do forallψ Sub(Φ)with Ψ =ido computesat(ψ)fromsat(ψ ){formaximalproperψ Sub(Ψ)} end for end for returni Sat(Φ)

39 Characterization of Sat(1) ForallCTLformulasΦ,ΨoverAPitholds: Sat(true) = S Sat(a) = {q S a L(q)}, foranya AP Sat(Φ Ψ) = Sat(Φ) Sat(Ψ) Sat( Φ) = S Sat(Φ) Sat(EXΦ) = {q S Post(q) Sat(Φ)/= } for a given finite transition system with states S

40 Characterization of Sat(2) Sat(E(ΦUΨ))isthesmallestsubsetT ofs,suchthat: (1)Sat(Ψ) T and (2)(q Sat(Φ)andPost(q) T ) q T Sat(EGΦ)isthelargestsubsetT ofs,suchthat: (3)T Sat(Φ) and (4)q T impliespost(q) T/=

41 ComputingSat(E(ΦUΨ))(1) Sat(E(ΦUΨ))isthesmallestsetT Qsuchthat: (1)Sat(Ψ) T and (2)(q Sat(Φ)andPost(q) T ) q T ThissuggeststocomputeSat(E(ΦUΨ))iteratively: T 0 = Sat(Ψ) and T i+1 = T i {q Sat(Φ) Post(q) T i /= } T i =statesthatcanreachaψ-stateinatmostistepsviaa Φ-path Byinductiononjitfollows: T 0 T 1... T j T j+1... Sat(E(ΦUΨ))

42 ComputingSat(E(ΦUΨ))(2) TSisfinite,soforsomej 0wehave:T j = T j+1 = T j+2 =... Therefore:T j = T j {q Sat(Φ) Post(q) T j /= } Hence:{q Sat(Φ) Post(q) T j /= } T j hence,tj satisfies(2),i.e., (q Sat(Φ)andPost(q) T j ) q T j further,sat(ψ)=t0 T j so,t j satisfies(1),i.e.sat(ψ) T j AsSat(E(ΦUΨ))isthesmallestsetsatisfying(1)and(2): Sat(E(ΦUΨ)) Tj andthussat(e(φuψ))=t j Hence:T 0 T 1 T 2... T j =T j+1 =...=Sat(E(ΦUΨ))

43 ComputingSat(E(ΦUΨ))(3) Require: finite transition system with states S CTL-formula E(Φ U Ψ) Ensure: Sat(E(ΦUΨ))={q S q E(ΦUΨ)} V =Sat(Ψ);{V administersstatesqwithq E(ΦUΨ)} T =V;{T containsthealreadyvisitedstatesqwithq E(ΦUΨ)} whilev/= do let q V; V =V {q }; forallq Pre(q )do if q Sat(Φ) T thenv =V {q};t =T {q}; endif end for end while return T

44 Computing Sat(EG Φ) V = S Sat(Φ);{V containsanynotvisitedq withq / EGΦ} T = Sat(Φ);{T containsanyqforwhichq EGΦhasnotyetbeendisproven} forallq Sat(Φ)doc[q] = Post(q) ; od{initializearrayc} whilev do {loopinvariant:c[q]= Post(q) (T V) } letq V;{q / Φ} V = V {q };{q hasbeenconsidered} forallq Pre(q )do ifq T then c[q] = c[q] 1;{updatecounterc[q]forpredecessorqofq } ifc[q]=0then T = T {q};v = V {q};{qdoesnothaveanysuccessorint} endif endif end for end while return T

45 Alternative algorithm for Sat(EG Φ) 1. Consideronlystateqifq Φ,otherwiseeliminateq changestatestos =Sat(Φ), allremovedstateswillnotsatisfyegφ,andthuscanbesafely removed 2. Determine all non-trivial strongly connected components in TS[Φ] non-trivialscc=maximal,connectedsubgraphwithatleast one edge anystateinsuchsccsatisfiesegφ 3. q EGΦisequivalentto somesccisreachablefromq thissearchcanbedoneinabackwardmanner