Finite State Model Checking

Finite State Model Checking

Finite State Model Checking Finite State Systems System Descrition A Requirement F CTL TOOL No! Debugging Information Yes, Prototyes Executable Code Test sequences Tools: visualstate, SPIN, Statemate, Verilog, Formalcheck,...

From Programs to Networks P1 P1 :: :: while True do do T1 T1 : wait(turn=1) C1 C1 : turn:=0 endwhile P2 P2 :: :: while True do do T2 T2 : wait(turn=0) C2 C2 : turn:=1 endwhile Mutual Exclusion Program

From Network Models to Krike Structures T1 I2 I1 I2 T1 T2 I1 T2 T1 C2 I1 C2 C1 I2 T1 I2 C1 T2 I1 I2 T1 T2 I1 T2

CTL Models = Krike Structures

Comutation Tree Logic, CTL Clarke & Emerson 1980 Syntax

Path s s 1 s 2 s 3... The set of ath starting in s

Formal Semantics ( )

ossible inevitable...... AF...... CTL, Derived Oerators EF............

otentially always always EG......... CTL, Derived Oerators AG...............

Theorem A All oerators are derivable from EX EX f f EG EG f f E[ E[ f f U g ] and boolean connectives [ f U g] E[ gu( f g) ] EG g

Examle 1 2 4,q q 3

Examle EX 1 2 4,q q 3

Examle EX 1 2 4,q q 3

Examle AX 1 2 4,q q 3

Examle AX 1 2 4,q q 3

Examle EG 1 2 4,q q 3

Examle EG 1 2 4,q q 3

Examle AG 1 2 4,q q 3

Examle AG 1 2 4,q q 3

Examle A[ U q ] 1 2 4,q q 3

Examle A[ U q ] 1 2 4,q q 3

Proerties of MUTEX examle? T1 I2 I1 I2 T1 T2 AG (C AG[ EG AG C I1 T2 T 1 C AF(C [ C1] [ A[ C U ( C A[ C U C ]) ] 1 1 I1 C2 2 ) 1 1 )] 1 C1 I2 1 T1 I2 2 HOW to DECIDE IN GENERAL I1 I2 T1 T2 I1 T2 T1 C2 C1 T2

CTL Model Checking Algorithms

Fixoint Characterizations EF EXEF or let A be the set of states satisfying A EX A in fact A is the smallest such set (the least fixoint) EF then

Examle 1 2,q q 3 EF q 4 A q EX A

Fixed oints of monotonic functions Let τ be a function 2 S 2 S Say τ is monotonic when Fixed oint of τ is y such that If τ monotonic, then it has x imlies least fixed oint μy. τ(y) greatest fixed oint νy. τ(y) y τ ( y ) = y τ ( x) τ ( y)

Iteratively comuting fixed oints Suose S is finite The least fixed oint μy. τ(y) is the limit of false τ (false) τ ( τ (false)) L The greatest fixed oint νy. τ(y) is the limit of true τ (true) τ ( τ (true)) L Note, since S is finite, convergence is finite

Examle: EF EF is characterized by EF = μy. ( EX y) Thus, it is the limit of the increasing series...... EX EX( EX )

Examle: EG EG is characterized by EG = ν y. ( EX y) Thus, it is the limit of the decreasing series...... EX( EX ) EX

Examle, continued EF q 1 2,q q 3 EF q = μy. ( q EX y) A A A A 0 1 2 3 = Ø 4 = {2,3} = {1,2,3} = {1,2,3}

Remaining oerators )) (.( ) ( )) (.( ) ( ).( ).( y AX q y U q A y EX q y U q E y AX y AG y AX y AF = = = = μ μ ν μ

Proerties of MUTEX examle? T1 I2 I1 I2 T1 T2 I1 T2 AG[ T1 AF(C AF(C )] I1 C2 1 1 C1 I2 )] T1 I2 I1 I2 T1 T2 I1 T2 T1 C2 C1 T2

({ s s '.( s, s ') R s ' Q } Sat ( φ ))

More Efficient Check EG SCC SCC SCC

Examle EG q,q q

Examle,q EG Reduced Model

Examle EG Non trivial Strongly Connected Comonent

Proerties of MUTEX examle? T1 I2 I1 I2 T1 T2 I1 T2 [ ] EG C 1 I1 C2 C1 I2 T1 I2 I1 I2 T1 T2 I1 T2 T1 C2 C1 T2

Proerties of MUTEX examle? T1 I2 I1 I2 T1 T2 I1 T2 [ ] EG C 1 I1 C2 T1 I2 I1 I2 T1 T2 I1 T2 T1 C2 Reduced Model which are the non-trivial SCC s?

Comlexity However SS sys may sys be beexponential in in number of ofarallel comonents! -- -- FIXPOINT COMPUTATIONS may be becarried out out using ROBDD s (Reduced Ordered Binary Decision Diagrams) Bryant, 86 86