CS 267: Automted Verifiction Lecture 8: Automt Theoretic Model Checking Instructor: Tevfik Bultn
LTL Properties Büchi utomt [Vrdi nd Wolper LICS 86] Büchi utomt: Finite stte utomt tht ccept infinite strings The etter known vrint of finite stte utomt ccept finite strings (used in lexicl nlysis for exmple) A Büchi utomton ccepts string when the corresponding run visits n ccepting stte infinitely often Note tht n infinite run never ends, so we cnnot sy tht n ccepting run ends t n ccepting stte LTL properties cn e trnslted to Büchi utomt The utomton ccepts pth if nd only if the pth stisfies the corresponding LTL property
LTL Properties Büchi utomt G p p p true F p p p true G (F p) p p p p The size of the property utomton cn e exponentil in the size of the LTL formul (recll the complexity of LTL model checking)
Büchi Automt: Lnguge Emptiness Check Given Buchi utomton, one interesting question is: Is the lnguge ccepted y the utomton empty? i.e., does it ccept ny string? A Büchi utomton ccepts string when the corresponding run visits n ccepting stte infinitely often To check emptiness: Look for cycle which contins n ccepting stte nd is rechle from the initil stte Find strongly connected component tht contins n ccepting stte, nd is rechle from the initil stte If no such cycle cn e found the lnguge ccepted y the utomton is empty
LTL Model Checking Generte the property utomton from the negted LTL property Generte the product of the property utomton nd the trnsition system Show tht there is no ccepting cycle in the product utomton (check lnguge emptiness) i.e., show tht the intersection of the pths generted y the trnsition system nd the pths ccepted y the (negted) property utomton is empty If there is cycle, it corresponds to counterexmple ehvior tht demonstrtes the ug
LTL Model Checking Exmple Exmple trnsition system Property to e verified G q p,q 1 Negtion of the property G q F q q 2 Ech stte is leled with the propositions tht hold in tht stte 3 p Property utomton for the negted property q q Equivlently {q},, {p} 1 2 true,{p},{q},
Trnsition System to Buchi Automton Trnsltion Exmple trnsition system Corresponding Buchi utomton p,q 1 i 1 q 2 Ech stte is leled with the propositions tht hold in tht stte 3 p {q} {q} 2 3 {p}
Buchi utomton for the trnsition system (every stte is ccepting) Product utomton 1,1 1 2 {q} 2,1 {q} {q}, {q} 3 4 {p} Property Automton, {p} 1 2,{p},{q}, {p} 3,1 4,2 {q} {p} 3,2 Accepting cycle: (1,1), (2,1), (3,1), ((4,2), (3,2)) ω Corresponds to counter-exmple pth for the property G q
SPIN [Holzmnn 91, TSE 97] Explicit stte model checker Finite stte Temporl logic: LTL Input lnguge: PROMELA Asynchronous processes Shred vriles Messge pssing through (ounded) communiction chnnels Vriles: oolen, chr, integer (ounded), rrys (fixed size) Structured dt types
SPIN Verifiction in SPIN Uses the LTL model checking pproch Constructs the product utomton on-the-fly It is possile to find n ccepting cycle (i.e. counterexmple) without constructing the whole stte spce Uses nested depth-first serch lgorithm to look for n ccepting cycle Uses vrious heuristics to improve the efficiency of the nested depth first serch: prtil order reduction stte compression
Exmple Mutul Exclusion Protocol Two concurrently executing processes re trying to enter criticl section without violting mutul exclusion Process 1: while (true) { out: := true; turn := true; wit: wit ( = flse or turn = flse); cs: := flse; } Process 2: while (true) { out: := true; turn := flse; } wit: wit ( = flse or turn); cs: := flse;
Exmple Mutul Exclusion Protocol in Promel #define cs1 process1@cs #define cs2 process2@cs #define wit1 process1@wit #define wit2 process2@wit #define true 1 #define flse 0 ool ; ool ; ool turn; proctype process1() { out: = true; turn = true; wit: ( == flse turn == flse); cs: = flse; goto out; } proctype process2() { out: = true; turn = flse; wit: ( == flse turn == true); cs: = flse; goto out; } init { run process1(); run process2() }
Property utomton genertion % spin -f "! [] (! (cs1 && cs2)) never { /*! [] (! (cs1 && cs2)) */ T0_init: if :: ((cs1) && (cs2)) -> goto ccept_ll :: (1) -> goto T0_init fi; ccept_ll: skip } % spin -f "!([](wit1 -> <>(cs1))) Input formul [] mens G <> mens F spin f option genertes Buchi utomton for the input LTL formul never { /*!([](wit1 -> <>(cs1))) */ T0_init: if :: (!((cs1)) && (wit1) ) -> goto ccept_s4 :: (1) -> goto T0_init fi; ccept_s4: if :: (! ((cs1))) -> goto ccept_s4 fi; } Conctnte the generted never clims to the end of the specifiction file
SPIN spin mutex.spin genertes C progrm pn.c from the specifiction file This C progrm implements the on-the-fly nested-depth first serch lgorithm You compile pn.c nd run it to the model checking Spin genertes counter-exmple trce if it finds out tht property is violted
%mutex - wrning: for p.o. reduction to e vlid the never clim must e stutter-invrint (never clims generted from LTL formule re stutter-invrint) (Spin Version 4.2.6 -- 27 Octoer 2005) + Prtil Order Reduction Full sttespce serch for: never clim + ssertion violtions + (if within scope of clim) cceptnce cycles + (firness disled) invlid end sttes - (disled y never clim) Stte-vector 28 yte, depth reched 33, errors: 0 22 sttes, stored 15 sttes, mtched 37 trnsitions (= stored+mtched) 0 tomic steps hsh conflicts: 0 (resolved) 2.622 memory usge (Myte) unreched in proctype process1 line 18, stte 6, "-end-" (1 of 6 sttes) unreched in proctype process2 line 27, stte 6, "-end-" (1 of 6 sttes) unreched in proctype :init: (0 of 3 sttes)
Automt Theoretic LTL Model Checking Input: A trnsition system T nd n LTL property f Trnslte the trnsition system T to Buchi utomton A T Negte the LTL property nd trnslte the negted property f to Buchi utomton A f Check if the intersection of the lnguges ccepted y A T nd A f is empty Is L(A T ) L(A f ) =? If L(A T ) L(A f ), then the trnsition system T violtes the property f
Automt Theoretic LTL Model Checking Note tht L(A T ) L(A f ) = if nd only if L(A T ) L(A f ) By negting the property f we re converting lnguge susumption check to lnguge intersection followed y lnguge emptiness check Given the Buchi utomt A T nd A f we will construct product utomton A T A f such tht L(A T A f ) = L(A T ) L(A f ) So ll we hve to do is to check if the lnguge ccepted y the Buchi utomton A T A f is empty
Buchi Automt A Buchi utomton is tuple A = (Σ, Q, Δ, Q 0, F) where Σ is finite lphet Q is finite set of sttes Δ Q Σ Q is the trnsition reltion Q 0 Q is the set of initil sttes F Q is the set of ccepting sttes A Buchi utomton A recognizes lnguge which consists of infinite words over the lphet Σ L(A) Σ ω Σ ω denotes the set of infinite words over the lphet Σ
Buchi Automton Given n infinite word w Σ ω where w = 0, 1, 2, run r of the utomton A over w is n infinite sequence of utomton sttes r = q 0, q 1, q 2, where q 0 Q 0 nd for ll i 0, (q i, i,q i+1 ) Δ Given run r, let inf(r) Q e the set of utomt sttes tht pper in r infinitely mny times A run r is n ccepting run if nd only if inf(r) F i.e., run is n ccepting run if some ccepting sttes pper in r infinitely mny times
Trnsition System to Buchi Automton Trnsltion Given trnsition system T = (S, I, R) set of tomic propositions AP nd leling function L : S AP {true, flse} the corresponding Buchi utomton A T = (Σ T, Q T, Δ T, Q 0T, F T ) Σ T = 2 AP n lphet symol corresponds to set of tomic propositions Q T = S {i} i is new stte which is not in S Q ot = {i} i is the only initil stte F T = S {i} ll sttes of A T re ccepting sttes Δ T is defined s follows: (s,,s ) Δ iff either (s,s ) R nd p iff L(s,p) = true or s=i nd s I nd p iff L(s,p) = true
Trnsition System to Buchi Automton Trnsltion Exmple trnsition system Corresponding Buchi utomton p,q 1 i 1 q 2 Ech stte is leled with the propositions tht hold in tht stte 3 p {q} {q} 2 3 {p}
Generlized Buchi Automton A generlized Buchi utomton is tuple A = (Σ, Q, Δ, Q 0, F) where Σ is finite lphet Q is finite set of sttes Δ Q Σ Q is the trnsition reltion Q 0 Q is the set of initil sttes F 2 Q is sets of ccepting sttes i.e., F = {F 1, F 2,, F k } where F i Q for 1 i k This is different thn the stndrd definition Given generlized Buchi utomton A, run r is n ccepting run if nd only if for ll 1 i k, inf(r) F i
Buchi Automt Product Given A 1 = (Σ, Q 1, Δ 1, Q 01, F 1 ) nd A 2 = (Σ, Q 2, Δ 2, Q 02, F 2 ) the product utomton A 1 A 2 = (Σ, Q, Δ, Q 0, F) is defined s: Q = Q 1 Q 2 Q 0 = Q 01 Q 02 F = {F 1 Q 2, Q 1 F 2 } ( generlized Buchi utomton) Δ is defined s follows: ((q 1,q 2 ),,(q 1,q 2 )) Δ iff (q 1,,q 1 ) Δ 1 nd (q 2,,q 2 ) Δ 2 Bsed on the ove construction, we get L(A 1 A 2 ) = L(A 1 ) L(A 2 )
Exmple from the Lst Lecture is Specil Cse Buchi utomton 1 {q} 1 2 {q} {p} 3 4 Since ll the sttes in the utomton 1 is ccepting, only the ccepting sttes of utomton 2 decide the ccepting sttes of the product utomton Product utomton 1,1 2,1 {q} 3,1 Buchi utomton 2 {p} {q} {q},, {p} 1 2,{p},{q}, 4,2 {p} 3,2
Buchi Automt Product Exmple Automton R Automton Q r1 r2 q1 q2 L(R) = ( * ) ω L(Q) = ( * ) ω Automton R Q L(R Q) = L(R) L(Q) r1,q1 r2,q1 r1,q2 r2,q2 F = { {(r1,q1), (r1,q2)}, {(r1,q1), (r2,q1)} }
Generlized to Stndrd Buchi Automt Conversion Given generlized Buchi utomton A = (Σ, Q, Δ, Q 0, F) where F = {F 1, F 2,, F k } it is equivlent to stndrd Buchi utomton A = (Σ, Q, Δ, Q 0, F ) where Q = Q {1, 2,, k} Q 0 = Q 0 {1} F = F 1 {1} Δ is defined s follows: ((q 1, i),, (q 2, j)) Δ iff (q 1,,q 2 ) Δ nd j=i j=(i mod k) + 1 Keep counter. When the counter is i look only for the ccepting sttes in F i. When you see stte from F i, increment the counter (mod k). When the counter mkes one round, you hve seen n ccepting stte from ll F i s. if q 1 F i if q 1 F i Bsed on the ove construction we hve L(A ) = L(A)
Exmple (Cont d) A generlized Buchi utomton G A stndrd Buchi utomton S where L(S) = L(G) q1 q2 q1,1 q1,2 q3 q4 q2,1 q3,1 q2,2 q3,2 F = { {q1, q3}, {q1, q2} } q4,1 q4,2 F = { (q1,1), (q3,1)}