Crash course Verification of Finite Automata CTL model-checking Exercise session - 07.12.2016 Xiaoxi He 1
Reminders Big picture Objective Verify properties over DES models Formal method Absolute guarantee! Problem Combinatorial explosion Huge amount of states, computationally intractable Solution Work with sets of states Symbolic Model-Checking (O)BDDs 2
Reminders First exercise session Equivalence between sets and Boolean equations BBD representation of Boolean functions 3
Let see what you remember! 4
5
Today s menu 1. Reachability of states 2. Comparison of automata 3. Formulation and verification of CTL properties Can be formulated as reachability problems 6
Reachability of states Fairly simple 1. Start from the initial set of states, 2. Compute all states you can transition to in one hop (one transition), The successor states, 3. Join the two sets, 4. Iterate from 2. until you reach a fix point. 5. Done! Is this guarantee to terminate? 7
Reachability of states Fairly simple 1. Start from the initial set of states, 2. Compute all states you can transition to in one hop (one transition), The successor states, 3. Join the two sets, 4. Iterate from 2. until you reach a fix point. 5. Done! Is this guarantee to terminate? Only if you have a finite model!! How can we formalize this problem? 8
Formalization of reachable states δδ XX EE XXX EE qq qqq qq qq E XX δδ E XXX qqq qq XX qq XX, δδ qq, qq iiii dddddddddddddd ψψ δδ qq, qq = 1 qq XX qq XX, δδ qq, qq iiii dddddddddddddd qq XX, ψψ δδ qq, qq = 0 9
Formalization of reachable states δδ XX EE XXX EE qq qqq E XX qq E Q = Suc(Q,δδ) δδ What is Q? Q XXX qq QQ qq XX qq XX, ψψ δδ qq, qq = 1 satisfies qqq Not sufficient! We also need that qq belongs to QQ qq QQ or equivalently ψψ QQ qq = 1 10
Formalization of reachable states δδ XX EE XXX EE qq qqq E XX qq E Q = Suc(Q,δδ) δδ What is Q? Q qqq XXX qq QQ qq XX, ψψ QQ qq = 1 and ψψ δδ qq, qq = 1 qq XX, ψψ QQ qq ψψ δδ qq, qq = 1 QQ = SSSSSS QQ, δδ = qq qq XX, ψψ QQ qq ψψ δδ qq, qq = 1} 11
Formalization of reachable states δδ XX EE XXX EE qq qqq E XX qq E Q = Suc(Q,δδ) δδ Q qqq XXX QQ = SSSSSS QQ, δδ = qq qq XX, ψψ QQ qq ψψ δδ qq, qq = 1} ψψ QQQ = ψψ QQ ψψ δδ QQ RR : set of reachable states QQ RR = QQ 0 ii 0 SSSSSS(QQ ii, δδ) ψψ QQRR = ψψ QQ0 ii 0 ψψ QQii ψψ δδ 12 Again, finite union if finite model
Comparison of automata Two automata are equivalent Computation of the joint transition function, Same input produces same output Computation of the reachable states (method according to previous slides), Don t compare states! Get rid of the input Computation of the reachable output values, The automata are not equivalent if the following term is true, Compute QQ RR Deduce reachable outputs Test for equivalence 13
Formulation of CTL properties Based on atomic propositions (φφ) and quantifiers Aφφ «All φφ», φφ holds on all paths Eφφ «Exists φφ», φφ holds on at least one path Quantifiers over paths Xφφ «NeXt φφ», φφ holds on the next state Fφφ «Finally φφ», φφ holds at some state along the path Gφφ «Globally φφ», φφ holds on all states along the path φφ 1 Uφφ 2 «φφ 1 Until φφ 2», φφ 1 holds until φφ 2 holds Path-specific quantifiers 14
Formulation of CTL properties Proper CTL formula: {A,E} {X,F,G,U}φφ Missing Hypothesis Interpretation on CTL formula Quantifiers go by pairs, you need one of each. Transition functions are fully defined (i.e. every state has at least one successor) Automaton of interest Automaton to work with 15
Formulation of CTL properties EF φφ : There exists a path along which at some state φφ holds. s q φφ q EF φφ r? s? r 16
Formulation of CTL properties EF φφ : There exists a path along which at some state φφ holds. s q φφ q EF φφ r EF φφ s EF φφ r 17
Formulation of CTL properties AF φφ : On all paths, at some state φφ holds. s q φφ q AF φφ r? s? r 18
Formulation of CTL properties AF φφ : On all paths, at some state φφ holds. s q φφ q AF φφ r AF φφ s AF φφ r 19
Formulation of CTL properties AG φφ : On all paths, for all states φφ holds. q s r φφ q AG φφ r? s? 20
Formulation of CTL properties AG φφ : On all paths, for all states φφ holds. q s r φφ q AG φφ r AG φφ s AG φφ 21
Formulation of CTL properties EG φφ : There exists a path along which for all states φφ holds. q s r φφ q EG φφ r? s? 22
Formulation of CTL properties EG φφ : There exists a path along which for all states φφ holds. q s r φφ q EG φφ r EG φφ s EG φφ 23
Formulation of CTL properties φφeuψ : There exists a path along which φφ holds until Ψ holds. s Ψ φφ q q φφeuψ r? s? r 24
Formulation of CTL properties φφeuψ : There exists a path along which φφ holds until Ψ holds. s Ψ φφ q q φφeuψ r φφeuψ s φφeuψ r 25
Formulation of CTL properties φφauψ : On all paths, φφ holds until Ψ holds. s Ψ φφ q q φφauψ r? s? r 26
Formulation of CTL properties φφauψ : On all paths, φφ holds until Ψ holds. s Ψ φφ q q φφauψ r φφauψ s φφauψ r 27
Formulation of CTL properties AXφφ : On all paths, the next state satisfies φφ. EXφφ : There exists a path along which the next state satisfies φφ. s φφ q q EXφφ r? s? r 28
Formulation of CTL properties AXφφ : On all paths, the next state satisfies φφ. EXφφ : There exists a path along which the next state satisfies φφ. s φφ q q EXφφ r EXφφ s EXφφ r 29
Formulation of CTL properties AG EF φφ : On all paths and for all states, there exists a path along which at some state φφ holds. s φφ q q AG EFφφ r? s? r 30
Formulation of CTL properties AG EF φφ : On all paths and for all states, there exists a path along which at some state φφ holds. s φφ q q AG EFφφ r AG EFφφ s AG EFφφ r 31
Inverting properties is sometimes useful! AG φφ EF φφ AF φφ EG φφ EF φφ AG φφ EG φφ AF φφ On all paths, for all states φφ holds. There exists no path along which at some state φφ doesn t hold. Remark There exists other temporal logics LTL (Linear Tree Logic) CTL* = {CTL,LTL} 32
How to verify CTL properties? Convert the property verification into a reachability problem 1. Start from states in which the property holds; 2. Compute all predecessor states for which the property still holds true; (same as for computing successor, with the inverse the transition function) 3. If initial states set is a subset, the property is satisfied by the model. Computation specifics are described in the lecture slides. 33
So what is Model-Checking exactly? An algorithm Input A DES model, M Finite automata, Petri nets, Kripke machine, A logic property, φφ CTL, LTL, Output M φφ? A trace for which the property does not hold! 34
Crash course Verification of Finite Automata CTL model-checking Slides online on my webpage: http://people.ee.ethz.ch/~jacobr/ Your turn to work! 35
36
Comparison of Finite Automata a) Express the characteristic function of the transition relation for both automaton, ψψ rr (xx, xx, uu). 37
Comparison of Finite Automata b) Express the joint transition function, ψψ ff. 38
Comparison of Finite Automata c) Express the characteristic function of the reachable states, ψψ XX (xx AA, xx BB ). 39
Comparison of Finite Automata d) Express the characteristic function of the reachable output, ψψ YY (xx AA, xx BB ). and 40
Comparison of Finite Automata e) Are the automata equivalent? Hint: Evaluate, for example, ψψ YY (0,1). Or, in a more general way, and implies Automata are not equivalent. 41
Temporal Logic i. EF a ii. EG a 0 iii. EX AX a iv. EF ( a AND EX NOT(a) ) 3 1 2 42
Temporal Logic i. EF a ii. EG a 0 iii. EX AX a iv. EF ( a AND EX NOT(a) ) 3 1 2 43
Temporal Logic i. EF a ii. EG a 0 iii. EX AX a iv. EF ( a AND EX NOT(a) ) 3 1 2 44
Temporal Logic i. EF a ii. EG a 0 iii. EX AX a iv. EF ( a AND EX NOT(a) ) 3 1 2 45
Temporal Logic i. EF a ii. EG a 0 iii. EX AX a iv. EF ( a AND EX NOT(a) ) 3 1 2 46
Temporal Logic Trick AF Z not(eg not(z)) 47
Crash course Verification of Finite Automata CTL model-checking See you next week! 48