Formal Verification Techniques. Riccardo Sisto, Politecnico di Torino

Transcription

1 Formal Verification Techniques Riccardo Sisto, Politecnico di Torino

2 State exploration State Exploration and Theorem Proving Exhaustive exploration => result is certain (correctness or noncorrectness proof) Partial exploration => bug detection Exhaustive exploration possible only if model finite Theorem proving No restrictions on the model, but proof search may not terminate If proof is found, result is certain (correctness or noncorrectness proof) Otherwise, nothing can be concluded 2

3 Model Checking Given a model (Kripke Structure K) and a property (TL formula f), find if K ² f K f Model Checker (K ² f?) TRUE FALSE + counter example A counter example is a run p of K that does not fulfill f (i.e. such that p ² f ) 3

4 Model Checking Techniques Explicit Model Checking Uses an explicit model representation (states, transitions, etc. ) Symbolic Model Checking Uses a symbolic model representation Transition relation => boolean function State set => boolean function Boolean functions represented by BDDs Bounded Model Checking Bounds the model to a finite run length Represents the model checking problem as a satisfiability problem (is a particular logic formula satisfiable?) Uses SAT or SMT for solving the satisfiability problem No technique is always better than the others 4

5 Explicit Model Checking of safety properties ([]P) Can be done by reachability analysis: Explore all reachable states and verify that in each of them P is fulfilled (look for a state where P is not fulfilled) If a state s where P is not fulfilled is found P is flase A counter example proving P is false is the run leading to s This analysis can be done on-the-fly 5

6 Reachability Analysis K []P Generate all reachable states s I(s,P)=T? path that leads to s NO End of exploration K ²[]P Counter example If exploration ends without finding counter examples, we can conclude K ² []P 6

7 Possible implementation States can be generated by a depth-first visit of the TS graph Þ Already visited states must be stored Þ At each time in the visit, the stack contains a path that leads to the current state When a state is found where P is not true The counter example is simply given by the stack contents Complexity: time and space are linear in the number of states (which is exponential in the number of concurrent processes) 7

8 Automata-theoretic model checking Is an explicit model checking technique Can be used to verify any LTL formula Is based on automata and formal language theories References: M. Y. Vardi, and P. Wolper, An automata-theoretic approach to automatic program verification, 1st IEEE Symp on Logic in Computer Science,

9 Finite State Automata (FSA) An FSA is an LTS with a set of final states F: (S, init, L, r, F) A finite sequence of labels l 0, l 1,, l n is accepted by the FSA if there exists a path p = s 0, s 1, s n such that "i Î [0,..,n-1] r(s i,l i,s i+1 ) holds s n Î F The language accepted by the FSA is the set of all the accepted sequences A language accepted by an FSA is said regular and is made of finite sequences 9

10 FSA Sample a abbbc F c b OK! abbac F a c b NOK! 10

11 Büchi Automata Are a variant of the FSA model, defined for dealing with infinite-length sequences An infinite sequence of labels l 0, l 1, is accepted by a Buchi automaton if there exists a path p = s 0, s 1, such that "i ³0 r(s i,l i,s i+1 ) holds There is at least one final state that occurs infinitely many times in p. 11

12 Büchi Automaton Example a a(cde)* F d c e b OK! a acde(b)* F d c e b NOK! 12

13 The Automaton of an LTL formula The Büchi automaton of a formula is such that its labels are predicates representing sets of states of an LTS (e. g. P Ú Q represents all states where P is true or Q is true) accepts all and only the sequences that fulfill the formula Examples: Automaton of []P F P P T Automaton of à[]p T P F P 13

14 Büchi Automaton as a Monitor The Büchi Automaton A f of formula f can be considered as a monitoring process that can decide if K ² f : K A f K sends each visited state to the automaton The automaton accepts the received run of K if it fulfills f 14

15 Automata-theoretic model checking Build the Buchi Automaton A f Explore the TS that results from coupling K with A f If in this TS it is possible to reach a loop where A f transits in at least one final state Þ There exists a run p of K such that p ² f Þ The statement K ² f is false and p is a counter example Verifying f reduces to an exhaustive search for these loops 15

16 Automata-theoretic model checking K A f Exhaustive search for reachable loops No loop found loop found K ² f K ² f f Generation of A f path that leads to loop Counter example 16

17 Possible implementation Nested-depth-first-search algorithm: Explore the TS as in reachability analysis When a global state s is found where the automaton is in a final state, Complexity: start another nested search in order to discover if s can be reached starting from itself Time complexity is O(nm) where n is the number of states in K and m the number of states in the Buchi automaton of f 17

18 extern int flag[2]; extern int turn; void user(int i) { Example: Peterson Algorithm while(1) { flag[i] = 1; /* signal will to enter */ turn = i; while (flag[(i+1)%2]!=0 && turn==i) /* wait (the other process has arrived first) */ ; /* in critical region */ } } flag[i]=0; /* exit critical region */ 18

19 1 1 0 (0,0,0,0,0) flag[0]=1 turn=0 flag[1]!=0 && turn==0 2 3 flag[1]==0 4 (turn!=0) flag[0]=0 Critical region (2,0,1,0,0) (1,0,0,0,0) flag[1]=1 turn=1 flag[0]!=0 && turn==1 2 3 flag[0]==0 4 (turn!=1) flag[1]=0 Critical region flag[0]= flag[1]= turn=

20 Property Examples Let us denote s[0] and s[1] the (control) states of the two processes The two processes are never both in the critical region [] (! ((s[0]==4) && (s[1]==4)) ) If a process requests to enter the critical region, it eventually gets permission to [] ( (flag[0]==1) => <> (flag[0]==0) ) 20

21 Fairness The second property is false in the developed model We need fairness criteria (modelling process scheduling fairness) in order to get more accurate models model checking tools for concurrent processes normally incorporate such criteria Further criteria can be added by writing the formula as: fairness_requirement Þ property where fairness_requirement is a formula that represents the fairness criterion. Example: []<> enabled Þ []<> executed 21

22 Complexity Reduction On-the-fly algorithms Memory occupancy reduction Data compression (lossless) Data compression with losses (means non-exhaustive exploration) Limit the number of runs/states to be explored partial order reduction (lossless) Symmetry reduction (lossless) 22

23 Theorem Proving for property verification Given a theory that is at least sound with respect to a model (Kripke structure K) and a property (TL formula f), find if f is a theorem Necessary if theory is not decidable K Theory f Human assistance Theorem Prover ( ` f?) YES + proof Proof not found (?) If the theory is sound and complete with respect to K, we have that ` f Û K ² f 23

24 Theorem Proving Techniques Traditional theorem provers Implement a number of proof tactics, i.e. algorithms for proof search SMT-based theorem provers Reduce proof search to a satisfiability problem Exploit the high efficiency of SAT solvers 24