Forml Methods in Softwre Engineering Lecture 09 orgniztionl issues Prof. Dr. Joel Greenyer Decemer 9, 2014
Written Exm The written exm will tke plce on Mrch 4 th, 2015 The exm will tke 60 minutes nd strt t 13.30 CET More informtion out the exm will follow
Forml Methods in Softwre Engineering Lecture 09 LTL Model Checking Prof. Dr. Joel Greenyer Decemer 9, 2014
LTL Model Checking in the lst lecture... modify model (usully the error is here) Model flse + counter exmple (how the specifiction cn e violted) now: lgorithm for checking n LTL formul Model Checking true GF φ Specifiction or modify specifiction (my lso e wrong) LTL Formul 4
in the lst lecture... Automt-sed LTL Model Checking There re different techniques for checking LTL properties i.e. checking whether M φ One is sed on Büchi Automt (BA) utomt tht ccept infinite words Approch: (Be M Kripke structure over AP) M φ L(M) L(φ) L(M) ((2 AP ) ω \ L(φ)) = L(M) L( φ) = L(B M B φ ) = Wht we need: 1. Büchi Automt (BA) 2. Checking emptyness of the lnguge ccepted y BA 2. Product construction for BAs 3. Represent KS s BA 4. Represent LTL formul s BA 5
in the lst lecture... Agend 1. Introduce Büchi Automt ( ) 2. Checking emptyness of the lnguge ccepted y BA ( ) 3. Product construction for BAs 4. Represent KS s BA 5. Represent LTL formul s BA 6
in the lst lecture... Exmples of Büchi Automt Which lnguge is ccepted y this Büchi utomton?, c c,, c the lnguge of ll words of,, c where is never directly followed y Which Büchi utomton ccepts the lnguge of ll words of,, c where is lwys eventully followed y?, c, c 7
Find Accepting Runs Nested DFS in the lst lecture... procedure nested_dfs(ba ) forll q 0 I cll dfs_lue(q 0 ); procedure dfs_lue (Stte q) q.lue := true; forll q' post(q) do if q'.lue then cll dfs_lue(q'); if q F then seed := q; cll dfs_red(q); procedure dfs_red (Stte q) q.red := true; forll q' post(q) do if q'.red then cll dfs_red(q'); else if q' = seed then report cycle; 8
Agend 1. Introduce Büchi Automt ( ) 2. Checking emptyness of the lnguge ccepted y BA ( ) 3. Product construction for BAs 4. Represent KS s BA 5. Represent LTL formul s BA 9
Given two BA B 1 = (Q 1, Σ, T 1, I 1, F 1 ) nd B 2 = (Q 2, Σ, T 2, I 2, F 2 ) Build n utomton B 1 B 2 tht ccepts L(B 1 ) L(B 2 ) Let's pproch the prolem with exmple first: Let us consider two ω-regulr lnguges L 1 nd L 2. L 1 contins ll words over, with infinitely mny s L 2 contins ll words over, with infinitely mny s Then L 1 L 2 should contin ll words over, with infinitely mny s nd infinitely mny s B 1 B 2 q 1 q 2 10
We know product construction for finite-stte utomt Does this help? Assume B 1 nd B 2 were ctully finite-stte utomt how would the product utomton look like? B 1 Tht's B 1 B 2 if B 1 nd B 2 were finite-stte utomt B 2 q 1 q 2 So tht does not work... 11
How out the following ide: Tke the product utomton from efore Mke three copies of it B 1 B 2 q 1 q 2 12
How out the following ide: Tke the product utomton from efore Mke three copies of it If in the first utomton you rech stte tht is ccepting in B1, then jump to the second copy B 1 B 2 q 1 q 2 13
How out the following ide: Tke the product utomton from efore Mke three copies of it If in the first utomton you rech stte tht is ccepting in B1, then jump to the second copy B 1 B 2 q 1 q 2 14
How out the following ide: Tke the product utomton from efore Mke three copies of it If in the first utomton you rech stte tht is ccepting in B1, then jump to the second copy If in the second copy you rech stte tht is ccepting in B2, then jump to the third copy B 1 B 2 q 1 q 2 15
How out the following ide: Tke the product utomton from efore Mke three copies of it If in the first utomton you rech stte tht is ccepting in B1, then jump to the second copy If in the second copy you rech stte tht is ccepting in B2, then jump to the third copy B 1 B 2 q 1 q 2 16
How out the following ide: Tke the product utomton from efore Mke three copies of it If in the first utomton you rech stte tht is ccepting in B1, then jump to the second copy If in the second copy you rech stte tht is ccepting in B2, then jump to the third copy Mke ll sttes in third copy ccepting; ll trnsitions led to first copy B 1 B 2 q 1 q 2 17
How out the following ide: Tke the product utomton from efore Mke three copies of it If in the first utomton you rech stte tht is ccepting in B1, then jump to the second copy If in the second copy you rech stte tht is ccepting in B2, then jump to the third copy Mke ll sttes in third copy ccepting; ll trnsitions led to first copy B 1 B 2 q 1 q 2 18
How out the following ide: Tke the product utomton from efore Mke three copies of it If in the first utomton you rech stte tht is ccepting in B1, then jump to the second copy If in the second copy you rech stte tht is ccepting in B2, then jump to the third copy Mke ll sttes in third copy ccepting; ll trnsitions led to first copy B 1 B 2 q 1 q 2 let's do it for this stte only 19
How out the following ide: Tke the product utomton from efore Mke three copies of it If in the first utomton you rech stte tht is ccepting in B1, then jump to the second copy If in the second copy you rech stte tht is ccepting in B2, then jump to the third copy Mke ll sttes in third copy ccepting; ll trnsitions led to first copy B 1 B 2 q 1 q 2 these re not rechle 20
How out the following ide: Tke the product utomton from efore Mke three copies of it If in the first utomton you rech stte tht is ccepting in B1, then jump to the second copy If in the second copy you rech stte tht is ccepting in B2, then jump to the third copy Mke ll sttes in third copy ccepting; ll trnsitions led to first copy B 1 B 2 these re lso not rechle q 1 q 2 21
How out the following ide: Tke the product utomton from efore Mke three copies of it If in the first utomton you rech stte tht is ccepting in B1, then jump to the second copy If in the second copy you rech stte tht is ccepting in B2, then jump to the third copy Mke ll sttes in third copy ccepting; ll trnsitions led to first copy B 1 B 2 q 1 q 2 22
Does the BA ccept the lnguge? L 1 L 2 should contin ll words over, with infinitely mny s nd infinitely mny s looks good. B 1 B 2 q 1 q 2 23
more formlly Given two BA B 1 = (Q 1, Σ, T 1, I 1, F 1 ) nd B 2 = (Q 2, Σ, T 2, I 2, F 2 ) Building n utomton B 1 B 2 tht ccepts L(B 1 ) L(B 2 ): B 1 B 2 = (Q 1 Q 2 {0, 1, 2}, Σ, T, I 1 I 2 {0}, Q 1 Q 2 {2}) we hve ((r i, q j, x), σ, (r m, q n, y)) T iff (r i, σ, r j ) T 1 nd (q m, σ, q n ) T 2 x = 0 nd r m F 1, then y = 1 x = 1 nd q n F 2, then y = 2 x = 2 then y = 0 otherwise x = y visited ccepting stte of first BA visiting lso ccepting stte of second BA reset counter keep vlue of counter from E. Clrke, O. Grumerg, D. Peled: Model Checking. MIT Press, 2000. 24
more formlly Given two BA B 1 = (Q 1, Σ, T 1, I 1, F 1 ) nd B 2 = (Q 2, Σ, T 2, I 2, F 2 ) Building n utomton B 1 B 2 tht ccepts L(B 1 ) L(B 2 ): B 1 B 2 = (Q 1 Q 2 {0, 1, 2}, Σ, T, I 1 I 2 {0}, Q 1 Q 2 {2}) we hve ((r i, q j, x), σ, (r m, q n, y)) T iff (r i, σ, r j ) T 1 nd (q m, σ, q n ) T 2 x = 0 nd r m F 1, then y = 1,0 x = 1 nd q n F 2, then y = 2 x = 2 then y = 0 otherwise x = y B 1 B 2 q 1 q 2 25
Given two BA B 1 = (Q 1, Σ, T 1, I 1, F 1 ) nd B 2 = (Q 2, Σ, T 2, I 2, F 2 ) Building n utomton B 1 B 2 tht ccepts L(B 1 ) L(B 2 ): B 1 B 2 = (Q 1 Q 2 {0, 1, 2}, Σ, T, I 1 I 2 {0}, Q 1 Q 2 {2}) we hve ((r i, q j, x), σ, (r m, q n, y)) T iff (r i, σ, r j ) T 1 nd (q m, σ, q n ) T 2 x = 0 nd r m F 1, then y = 1 x = 1 nd q n F 2, then y = 2 x = 2 then y = 0 otherwise x = y,?,0 B 1 B 2 q 1 q 2 26
Given two BA B 1 = (Q 1, Σ, T 1, I 1, F 1 ) nd B 2 = (Q 2, Σ, T 2, I 2, F 2 ) Building n utomton B 1 B 2 tht ccepts L(B 1 ) L(B 2 ): B 1 B 2 = (Q 1 Q 2 {0, 1, 2}, Σ, T, I 1 I 2 {0}, Q 1 Q 2 {2}) we hve ((r i, q j, x), σ, (r m, q n, y)) T iff (r i, σ, r j ) T 1 nd (q m, σ, q n ) T 2 x = 0 nd r m F 1, then y = 1 x = 1 nd q n F 2, then y = 2 x = 2 then y = 0 otherwise x = y,1,0 B 1 B 2 q 1 q 2 27
Given two BA B 1 = (Q 1, Σ, T 1, I 1, F 1 ) nd B 2 = (Q 2, Σ, T 2, I 2, F 2 ) Building n utomton B 1 B 2 tht ccepts L(B 1 ) L(B 2 ): B 1 B 2 = (Q 1 Q 2 {0, 1, 2}, Σ, T, I 1 I 2 {0}, Q 1 Q 2 {2}) we hve ((r i, q j, x), σ, (r m, q n, y)) T iff (r i, σ, r j ) T 1 nd (q m, σ, q n ) T 2 x = 0 nd r m F 1, then y = 1,0 x = 1 nd q n F 2, then y = 2 x = 2 then y = 0,1 otherwise x = y B 1 B 2 q 1 q 2 28
Given two BA B 1 = (Q 1, Σ, T 1, I 1, F 1 ) nd B 2 = (Q 2, Σ, T 2, I 2, F 2 ) Building n utomton B 1 B 2 tht ccepts L(B 1 ) L(B 2 ): B 1 B 2 = (Q 1 Q 2 {0, 1, 2}, Σ, T, I 1 I 2 {0}, Q 1 Q 2 {2}) we hve ((r i, q j, x), σ, (r m, q n, y)) T iff (r i, σ, r j ) T 1 nd (q m, σ, q n ) T 2 x = 0 nd r m F 1, then y = 1,0 x = 1 nd q n F 2, then y = 2 x = 2 then y = 0,1 otherwise x = y B 1 B 2,2,? q 1 q 2 29
Given two BA B 1 = (Q 1, Σ, T 1, I 1, F 1 ) nd B 2 = (Q 2, Σ, T 2, I 2, F 2 ) Building n utomton B 1 B 2 tht ccepts L(B 1 ) L(B 2 ): B 1 B 2 = (Q 1 Q 2 {0, 1, 2}, Σ, T, I 1 I 2 {0}, Q 1 Q 2 {2}) we hve ((r i, q j, x), σ, (r m, q n, y)) T iff (r i, σ, r j ) T 1 nd (q m, σ, q n ) T 2 x = 0 nd r m F 1, then y = 1,0 x = 1 nd q n F 2, then y = 2 x = 2 then y = 0,1 otherwise x = y B 1 B 2,2 q 1 q 2 30
Given two BA B 1 = (Q 1, Σ, T 1, I 1, F 1 ) nd B 2 = (Q 2, Σ, T 2, I 2, F 2 ) Building n utomton B 1 B 2 tht ccepts L(B 1 ) L(B 2 ): B 1 B 2 = (Q 1 Q 2 {0, 1, 2}, Σ, T, I 1 I 2 {0}, Q 1 Q 2 {2}) we hve ((r i, q j, x), σ, (r m, q n, y)) T iff (r i, σ, r j ) T 1 nd (q m, σ, q n ) T 2 x = 0 nd r m F 1, then y = 1 x = 1 nd q n F 2, then y = 2 x = 2 then y = 0 otherwise x = y B 1 B 2 q 1 q 2,1,2,0 ll sttes with 2 s the third component re ccepting 31
Given two BA B 1 = (Q 1, Σ, T 1, I 1, F 1 ) nd B 2 = (Q 2, Σ, T 2, I 2, F 2 ) Building n utomton B 1 B 2 tht ccepts L(B 1 ) L(B 2 ): B 1 B 2 = (Q 1 Q 2 {0, 1, 2}, Σ, T, I 1 I 2 {0}, Q 1 Q 2 {2}) we hve ((r i, q j, x), σ, (r m, q n, y)) T iff (r i, σ, r j ) T 1 nd (q m, σ, q n ) T 2 x = 0 nd r m F 1, then y = 1,0 x = 1 nd q n F 2, then y = 2 x = 2 then y = 0,1,0 otherwise x = y B 1 B 2 q 1 q 2,2,0 32
Agend 1. Introduce Büchi Automt ( ) 2. Checking emptyness of the lnguge ccepted y BA ( ) 3. Product construction for BAs ( ) 4. Represent KS s BA 5. Represent LTL formul s BA 33
Represent Kripke Structure s Büchi Automton This is quite simple n exmple: Büchi Automton Kripke Structure {p} {p, q} {p} {p, q} {p} {p,q} {q} {q} {p,q} from E. Clrke, O. Grumerg, D. Peled: Model Checking. MIT Press, 2000. 34
Represent Kripke Structure s Büchi Automton This is quite simple n exmple: Büchi Automton {p, q} Kripke Structure {p} {p, q} {p} {p} {q} {p,q} {p,q} {q} A Kripke Structure M = (S, R, S 0, L) is trnsformed into Büchi utomton BA = (S {i}, Σ, T, {i}, S) where Σ = 2 AP (s, α, s') T for s, s' S iff (s, s') (i, α, s) T for s S iff s S 0 nd α = L(s) R nd α = L(s') from E. Clrke, O. Grumerg, D. Peled: Model Checking. MIT Press, 2000. 35
Specil Cse for BA Product Construction Product construction cn e simplified if ll sttes of one utomton re ccepting when the BA is constructed from KS Given two BA B 1 = (Q 1, Σ, T 1, I 1, F 1 ) nd B 2 = (Q 2, Σ, T 2, I 2, F 2 ) if F 1 = Q 1, then B 1 B 2 is defined s follows: B 1 B 2 = (Q 1 Q 2, Σ, T, I 1 I 2, Q 1 F 2 ) we hve ((r i, q j ), σ, (r m, q n )) T iff (r i, σ, r j ) T 1 nd (q m, σ, q n ) T 2 ccepting where second utomton is ccepting oth utomt gree on trnsition, s usul 36
Agend 1. Introduce Büchi Automt ( ) 2. Checking emptyness of the lnguge ccepted y BA ( ) 3. Product construction for BAs ( ) 4. Represent KS s BA ( ) 5. Represent LTL formul s BA 37
Represent LTL formuls s Büchi Automt We will not cover the detils here For more informtion, see Section 9.4 from E. Clrke, O. Grumerg, D. Peled: Model Checking. MIT Press, 2000. The online tool: http://www.lsv.ens-cchn.fr/~gstin/ltl2/index.php G (p -> F q) G (q U p) 38
Represent LTL formuls s Büchi Automt G (p -> F q) this is non-deterministic utomton. From init, we cn lwys go to stte 1, no mtter wht tomic propositions hold 39
Represent LTL formuls s Büchi Automt lwys when cee ws chosen, te will not e delivered until te is chosen G (cee_chosen -> (!te_delivered U te_chosen)) 40
Represent LTL formuls s Büchi Automt lwys if cee is chosen nd next money is inserted, cee will e delivered eventully G ((cee_chosen && X money_inserted) -> F cee_delivered) 41
Agend 1. Introduce Büchi Automt ( ) 2. Checking emptyness of the lnguge ccepted y BA ( ) 3. Product construction for BAs ( ) 4. Represent KS s BA ( ) 5. Represent LTL formul s BA ( ) 42
Summry: Automt-sed LTL Model Checking There re different techniques for checking LTL properties i.e. checking whether M φ One is sed on Büchi Automt (BA) utomt tht ccept infinite words Approch: (Be M Kripke structure over AP) M φ L(M) L(φ) L(M) ((2 AP ) ω \ L(φ)) = L(M) L( φ) = L(B M B φ ) = Wht we need: 1. Büchi Automt (BA) 2. Checking emptyness of the lnguge ccepted y BA 2. Product construction for BAs 3. Represent KS s BA 4. Represent LTL formul s BA 43
Complexity of LTL Model Checking Converting Kripke Structure to Büchi utomton complexity: liner in the size of the Kripke Structure Constructing BA from n LTL formul φ complexity: O(2 φ ) (size of B φ : O(2 φ )) Computing B M B φ complexity: O( B M B φ ) Checking emptyness of the lnguge ccepted y BA complexity: liner in size of BA Overll complexity for checking whether Kripke Structure KS stisfies n LTL formul φ: O( KS 2 φ ) 44
Summry: CTL nd LTL model checking We hve so fr lerned out CTL nd CTM model checking LTL nd LTL model checking Fundmentl modeling lnguges for rective systems LTSs Sttechrts GQ6 informl specifiction Next: Applictions Checking UML models Checking Progrm code Some dvnced forml methods trnsform specifiction for MC tool check []! ; []<> ; Model Checker (MC) chn ts2c =... trnsform Model for MC tool formlize ssert(...); modify design or specifiction detil design or generte code forml specifiction crete design design write/ generte code pulic void run(){...; } code 45