Supervisory Control (4CM30)

Transcription

1 Supervisory Control (4CM30) Verifiction in mcrl2 Michel Reniers

2 Verifiction in mcrl2 M CIF = φ CIF iff M mcrl2 = φ mcrl2 1. Adpt CIF model 2. Formulte property in modl µ-clculus 3. Trnslte CIF model into mcrl2 4. Verify property in mcrl2 Exmple: check supermrket model for property whether it is possible tht queue 1 contins three customers

3 Exmple: supermrket 1 controllble q1enter, q1leve, q2enter, q2leve ; 2 3 plnt queue1 : 4 disc int [0..5] count = 0; 5 loction l0: 6 initil ; 7 mrked ; 8 edge q1enter when count < 5 do count := count + 1; 9 edge q1leve when count > 0 do count := count - 1; 10 end plnt queue2 : 13 disc int [0..5] count = 0; 14 loction l0: 15 initil ; 16 mrked ; 17 edge q2enter when count < 5 do count := count + 1; 18 edge q2leve when count > 0 do count := count - 1; 19 end plnt customer : 22 loction l0: 23 initil ; 24 mrked ; 25 edge q1enter when queue1. count <= queue2. count ; 26 edge q2enter when queue2. count <= queue1. count ; 27 end requirement invrint queue1. count < 3; requirement q2enter needs queue2. count < 3;

4 Step 1: Adpt CIF model Explicitly introduce Boolen loction vribles (using elim-locs-in-exprs) Remove event conditions (using elim-stte-evt-excl-inv) Remove invrints mnully Add self-loop loction events (if needed for property) Add self-loop mrked stte events (if needed for property)

5 Exmple Remove event condition 1 requirement q2enter needs queue2. count < 3; is replced by 1 requirement utomton RequirementStteEvtExcls : 2 loction : 3 initil ; 4 mrked ; 5 edge q2enter when queue2. count < 3; 6 end Remove invrint mnully 1 requirement invrint queue1. count < 3; is replced by (dpted copy of involved plnt(s)) 1 requirement utomton RequirementInvrint : 2 loction l0: 3 initil ; 4 mrked ; 5 edge q1enter when queue1. count < 2; 6 edge q1leve when queue1. count < 4; 7 end

6 Step 2: Formulte property in modl µ-clculus use loction events nd mrked stte events use vrible vlue events to refer to vlues of vribles mcrl2 syntx for modl µ-clculus properties reference/muclc.html file with extension mcf

7 Exmple property of interest: is it possible tht queue 1 contins three customers true queue1.count=3 find right event representing the vrible: vlue count mcrl2 syntx true vlue count(3) true 1 <true *> < vlue_count (3) > true

8 Step 3: Trnslte CIF model to mcrl2 trnsltion in CIF tool hs irritting mistkes use tooldef with nme fix mcrl2 output.tooldef2 with nme of CIF file to be processed in line 3 1 from " lib : cif3 " import *; 2 3 string bse_ nme = " xxx "; 4 string cif_ file = bse_ nme + ". cif "; 5... results in file with nme xxx-fixed.mcrl2 to be used by mcrl2

9 Step 4: Verify property in mcrl2 1. pply mcrl22lps on the mcrl2 file with the option no-lph checked! 2. pply lps2pbes on the lps file nd the mcf file with the property. The result is file with extension pbes. 3. pply ps2bool on this pbes file.

10 Supervisory Control (4CM30) Modl µ-clculus & dt Michel Reniers

11 Even more expressivity... there re still properties we cnnot express ll behviour inevitbly reches stte where formul φ holds there is some behviour where the formul φ holds everywhere formulting properties using the modl µ-clculus requires experience. φ ::= true flse φ φ φ φ φ φ φ φ []φ µx.φ νx.φ X Hennessy-Milner logic is included ction formuls cn be trnslted (s HML is included) regulr formuls cn be trnslted (explined lter)

12 Fixed points in mthemtics in mthemtics: x is fixed point of function f if x = f(x) exmple: 3 is fixed point of function f with f(x) = x 2 2x function my hve multiple fixed points fixed point is solution of n eqution with unknow(s)/vrible(s): x = x 2 2x

13 Fixed points in modl µ-clculus Given trnsition system with stte spce S, modl µ-clculus formul φ represents subset of S for which it holds. Consider the eqution X = true. b

14 Fixed points in modl µ-clculus Given trnsition system with stte spce S, modl µ-clculus formul φ represents subset of S for which it holds. Consider the eqution X = true. true represents the set of sttes where it holds b

15 Fixed points in modl µ-clculus Given trnsition system with stte spce S, modl µ-clculus formul φ represents subset of S for which it holds. Consider the eqution X = true. true represents the set of sttes where it holds set of ll sttes from which n -lbelled trnsition strts is the solution b

16 Fixed points in modl µ-clculus Given trnsition system with stte spce S, modl µ-clculus formul φ represents subset of S for which it holds. Consider the eqution X = true. true represents the set of sttes where it holds set of ll sttes from which n -lbelled trnsition strts is the solution unique solution (independent of X) b

17 Consider the eqution X = X: s Wht is the solution?

18 Consider the eqution X = X: s Wht is the solution? There re only two cndidtes: X = or X = S = {s}

19 Consider the eqution X = X: s Wht is the solution? There re only two cndidtes: X = or X = S = {s} Wht is mening of X? It is the set of sttes tht cn execute nd end up in the set represented by X

20 Consider the eqution X = X: s Wht is the solution? There re only two cndidtes: X = or X = S = {s} Wht is mening of X? It is the set of sttes tht cn execute nd end up in the set represented by X So = nd S = S

21 Consider the eqution X = X: s Wht is the solution? There re only two cndidtes: X = or X = S = {s} Wht is mening of X? It is the set of sttes tht cn execute nd end up in the set represented by X So = nd S = S so both re solution to the eqution

22 Miniml nd mximl solutions Consider the eqution X = X: s µx.φ denotes the miniml solution for the eqution X = φ

23 Miniml nd mximl solutions Consider the eqution X = X: s µx.φ denotes the miniml solution for the eqution X = φ µx. X holds for no sttes since the miniml fixed point of the eqution X = X is

24 Miniml nd mximl solutions Consider the eqution X = X: s µx.φ denotes the miniml solution for the eqution X = φ µx. X holds for no sttes since the miniml fixed point of the eqution X = X is νx.φ denotes the mximl solution

25 Miniml nd mximl solutions Consider the eqution X = X: s µx.φ denotes the miniml solution for the eqution X = φ µx. X holds for no sttes since the miniml fixed point of the eqution X = X is νx.φ denotes the mximl solution µx. X holds for sttes since the mximl fixed point of the eqution X = X is {s}

26 Sfety properties Nothing bd my hppen Assume tht φ chrcterises good sttes µx.[true]φ expresses sfety [true ]φ lso expresses sfety

27 Liveness Something good cn hppen Assume tht phi chrcterises the good thing νx. true φ expresses liveness true φ lso expresses liveness

28 Regulr formuls trnslte to modl µ-clculus R φ = µx.( R X φ) [R ]φ = νx.([r]x φ)

29 Inevitbly φ only expressestht φ cn become vlid in some run of the system

30 Inevitbly φ only expressestht φ cn become vlid in some run of the system often desired: φ will eventully become vlid long every pth µx.([true]x φ)

31 Inevitbly φ only expressestht φ cn become vlid in some run of the system often desired: φ will eventully become vlid long every pth µx.([true]x φ) not expressible without fixed point opertor

32 Inevitbly φ only expressestht φ cn become vlid in some run of the system often desired: φ will eventully become vlid long every pth µx.([true]x φ) not expressible without fixed point opertor this formul will lso become true for pths ending in dedlock, becuse in such stte [true]x becomes vlid

33 Inevitbly φ only expressestht φ cn become vlid in some run of the system often desired: φ will eventully become vlid long every pth µx.([true]x φ) not expressible without fixed point opertor this formul will lso become true for pths ending in dedlock, becuse in such stte [true]x becomes vlid void this by dding bsence of dedlock explicitly: µx.(([true]x true true) φ)

34 Inevitbly φ only expressestht φ cn become vlid in some run of the system often desired: φ will eventully become vlid long every pth µx.([true]x φ) not expressible without fixed point opertor this formul will lso become true for pths ending in dedlock, becuse in such stte [true]x becomes vlid void this by dding bsence of dedlock explicitly: µx.(([true]x true true) φ) Exercise: Formulte the property tht n ction must inevitbly be done unless the system dedlocks µx.([true]x true) or µx.[]x

35 µx.([true]x true) versus µx.[]x b

36 µx.([true]x true) versus µx.[]x b µx.([true]x true) is vlid in the initil stte µx.[]x is not vlid in the initil stte

37 µx.([true]x true) versus µx.[]x b µx.([true]x true) is vlid in the initil stte µx.[]x is not vlid in the initil stte procedure for estblishing vlidity of formul w.r.t. given trnsition system is slightly more complicted only sketched for formuls with only one fixed point symbol

38 Vlidity of miniml fixed point formul µx.φ lbel with subformuls of φ, including X initilly no stte is lbeled with X lbel with ll other strict subformuls from φ when stte is lbeled with φ, it is lso lbeled with X repet from third item until nothing hs chnged w.r.t. previous lbeling µx.φ holds in stte iff it is lbeled with X

39 Exmple Consider the formul µx.( X b true) which expresses tht there is finite sequence of ctions fter which b is possible b true X b true b

40 Exmple Consider the formul µx.( X b true) which expresses tht there is finite sequence of ctions fter which b is possible X X b true b true X b true X, b true X b true b b

41 Exmple Consider the formul µx.( X b true) which expresses tht there is finite sequence of ctions fter which b is possible X, X X b true X, X X b true X X b true X, X X b true b true X b true X, b true X b true X, b true X b true b b b

42 Vlidity of mximl fixed point formul νx.φ similr, but now ll sttes re initilly lbeled with X X is removed from stte if φ does not hold when the lbeling process stbilizes when removing of lbels stbilizes gin, νx.φ is vlid in the sttes lbeled with X

43 Vlidity of mximl fixed point formul νx.φ similr, but now ll sttes re initilly lbeled with X X is removed from stte if φ does not hold when the lbeling process stbilizes when removing of lbels stbilizes gin, νx.φ is vlid in the sttes lbeled with X Exmple: Check νx.([]x true): lwys one more cn be done fter n rbitrry -sequence X, []X true, []X true X, []X true, []X true X, []X

44 Vlidity of mximl fixed point formul νx.φ similr, but now ll sttes re initilly lbeled with X X is removed from stte if φ does not hold when the lbeling process stbilizes when removing of lbels stbilizes gin, νx.φ is vlid in the sttes lbeled with X Exmple: Check νx.([]x true): lwys one more cn be done fter n rbitrry -sequence X, []X true, []X true true X, []X true, []X true X, []X true []X

45 Nested fixed point opertors Firness properties: some event must hppen provided it is unboundedly often enbled, or becuse some other ction hppens only bounded number of times Exmple: from the sttes on ech infinite b-tril, there re only finite number of sttes where -trnsitions re possible µx.νy.(( true [b]x) ( true [b]y ))

46 Modl formuls with dt Modl formuls re extended with dt: modl vribles cn hve rguments ctions cn crry dt rguments existentil nd universl quntifiction is possible f ::= t true flse (t 1,..., t n) f f f f f d : D.f d : D.f R ::= ε f R R R+R R R + φ ::= true flse t φ φ φ φ φ φ φ R φ [R]φ d : D.φ d : D.φ µx(d 1 : D 1 :=t 1,..., d n : D n:=t n).φ νx(d 1 : D 1 :=t 1,..., d n : D n:=t n).φ X(t 1,..., t n) Exmple: whenever n error with some number n is observed, shutdown is inevitble: [true n : IN.error(n)]µX.([shutdown]X true true)

47 mteril from Chpter 6 is tested in written exm modl µ-clculus formuls with nested fixed points re not tested modl µ-clculus formuls with dt re not tested You my use these for the ssignment!