Introduction to SMV

Introduction to SMV

Symbolic Model Verifier • Ken McMillan, Symbolic Model Checking: An Approach to the State Explosion Problem, 1993. • Finite-state Systems described in a specialized language • Specifications given as CTL formulas • Internal representation using OBDDs • Automatically verifies specification or produces a counterexample

Overview of SMV SMV Input Language Backend Finite State Kripke Structure OBDD based Symbolic Model Checking Yes Specification – CTL Formula No CounterExample

Language Characteristics • Allows description of completely synchronous to asynchronous systems, detailed to abstract systems • Modularized and hierarchical descriptions • Finite data types: Boolean and enumerated

Language Characteristics (cont..) • Parallel-assignment syntax • Non-determinism

A Sample SMV Program MODULE main VAR request: boolean; state: {ready, busy}; ASSIGN init(state) := ready; next(state) := case state=ready & request: busy; 1: {ready, busy}; esac; SPEC AG(request -> AF (state = busy))

The Case Expression Case_expr :: “case” expr_a1 “:” expr_b2 “;” … expr_an “:” expr_bn “;” “esac” • Guards are evaluated sequentially. • The first one that is true determines the resulting value • If none of the guards are true, result is numeric value 1

State Variables Decl :: “VAR” atom1 “:” type1 “;” atom2 “:” type2 “;” … • State is an assignment of values to a set of state variables • Type of a variable – boolean, scalar, user defined module, or array.

ASSIGN declaration Decl :: “ASSIGN” dest1 “:=“ expr1 “;” dest2 “:=“ expr2 “;” … Dest :: atom | “init” “(“ atom “)” | “next” “(“ atom “)”

Variable Assignments • Assignment to initial state: init(value) := 0; • Assignment to next state (transitionrelation)next(value) := value + carry_in mod 2; • Assignment to current state (invariant)carry_out := value & carry_in; • Either init-next or invar should be used, but not both • SMV is a parallel assignment language

Circular definitions • … are not allowed! • This is illegal: • a := next(b);next(b) := c;c := a; • This is o.k. • init(a) := 0;next(a) := !b;init(b) := 1;next(b) := !a;

Nondeterminism • Completely unassigned variable can model unconstrained input. • {val_1, …, val_n} is an expression taking on any of the given values nondeterministically. • Nondeterministic choice can be used to: • Model an implementation that has not been refined yet • Abstract behavior

ASSIGN and DEFINE • VARa: boolean;ASSIGNa := b | c; • declares a new state variable a • becomes part of invariant relation • DEFINEd:= b | c; • is effectively a macro definition, each occurrence of d is replaced by b | c • no extra BDD variable is generated for d • the BDD for b | c becomes part of each expression using d

Modules and Hierarchy • Modules can be instantiated many times, each instantiation creates a copy of the local variables • Each program has a module main • Scoping • Variables declared outside a module can be passed as parameters • Parameters are passed by reference.

Pass by reference DEFINE a := 0; VAR b : bar(a); … MODULE bar(x) DEFINE a := 1; y := x;

Pass by reference … VAR a : boolean; b : foo(a); … MODULE foo(x) ASSIGN x:=1;

MODULE main VARbit0 : counter_cell(1); bit1 : counter_cell(bit0.carry_out); bit2 : counter_cell(bit1.carry_out); SPEC AG AF bit2.carry_out MODULE counter_cell(carry_in) VARvalue : boolean; ASSIGN init(value) := 0; next(value) := value + carry_in mod 2; DEFINEcarry_out := value & carry_in;

Module Composition • Synchronous composition • All assignments are executed in parallel and synchronously. • A single step of the resulting model corresponds to a step in each of the components. • Asynchronous composition • A step of the composition is a step by exactly one process. • Variables, not assigned in that process, are left unchanged.

Asynchronous Composition MODULE main VARgate1: process inverter(gate3.output); gate2: process inverter(gate1.output); gate3: process inverter(gate2.output); SPEC (AG AFgate1.output) & (AG AF!gate1.output) MODULE inverter(input) VAR output: boolean; ASSIGN init(output) := 0; next(output) := !input;

Fairness • FAIRNESS ctl_formulae • Assumed to be true infinitely often • Model checker only explores paths satisfying fairness constraint • Each fairness constraint must be true infinitely often • If there are no fair paths • All existential formulas are false • All universal formulas are true • FAIRNESSrunning

With Fairness.. MODULE main VARgate1: process inverter(gate3.output); gate2: process inverter(gate1.output); gate3: process inverter(gate2.output); SPEC (AG AFgate1.output) & (AG AF!gate1.output) MODULE inverter(input) VAR output: boolean; ASSIGN init(output) := 0; next(output) := !input; FAIRNESS running

Counter revisited MODULE main VAR count_enable : boolean; bit0 : counter_cell(count_enable); bit1 : counter_cell(bit0.carr_out); bit2 : counter_cell(bit1.carry_out); SPEC AG AF bit2.carry_out FAIRNESS count_enable

Synchronous vs Asynchronous • In Asynchronous process, need not combine transition relation of each process • Complexity of representing set of states reachable in n steps higher in asynchronous processes occassionally due to higher number of interleavings

Implicit Modelling • TRANS - boolean valued expr restricting transition relation of system • INIT - boolean valued expression giving initial states • INVAR - boolean valued expression restricting set of all states of model

Implicit Modelling Example MODULE main VAR gate1 : inverter(gate3.output); gate2 : inverter(gate1.output); gate3 : inverter(gate2.output); SPEC (AG AF gate1.out) & (AG AF !gate1.out) MODULE inverter(input) VAR Output : boolean; INIT output = 0; TRANS next(output) = !input | next(output) = output

TRANS Advantages • Group assignments to different variables • Good for modelling guarded commands Disadvantages • Logical absurdities can lead to unimplementable descriptions

Shared Data Example Two Users assign pid to shared data in turn MODULE main VAR data : boolean; turn : boolean; user0 : user(0, data, turn); user1 : user(1, data, turn); ASSIGN next(turn) := !turn; SPEC AG (AF data & AF (!data))

Shared data example (cont..) Using ASSIGN and CASE statement won’t work(constraining sema all the time) MODULE user(pid, data, turn) ASSIGN next(data) := case turn: pid; 1 : data; esac; Line 3: multiple assignment: next(data)

Using TRANS TRANS useful for changing shared data in synchronous system between modules. MODULE user(pid, turn, data) TRANS turn -> next(data) = pid

Guarded Commands Guard1 : action1 Guard2 : action2 .. Otherwise nop TRANS (guard1 & action1)| (guard2 & action2)| … (!guard1 & !guard2 & … & “nop”)

TRANS Pitfall True -> next(b) = 0 & True -> next(b) = 1 & … Results in an empty transition relation

TRANS Guidelines • Try using ASSIGN instead • Write in a disjunction of conjunction format • Try covering all cases • Try make guards disjoint

SMV Steps • Read_Model : read model from input smv file • Flatten_hierarchy : instantiate modules and processes • Build_model : compile the model into BDDs (initial state, invar, transition relation) • Check_spec : checking specification bottom up

Run SMV • smv [options] inputfile • -c cache-size for BDD operations • -k key-table-size for BDD nodes • -v verbose • -int interactive mode • -r • prints out statistics about reachable state space

SMV Options • –f • computes set of reachable states first • Model checking algorithm traverses only the set of reachable states instead of complete state space. • useful if reachable state space is a small fraction of total state space

SMV Options: Reordering vars • Variable reordering is crucial for small BDD sizes and speed. • Generally, variables which are related need to be close in the ordering. • –i filename –o filename • Input, output BDD variable ordering to given file. • -reorder • Invokes automatic variable reordering

SMV Options: Transition relation smv -cp part_limit • Conjunctive Partitioning: Transition relation not evaluated as a whole, instead individual next() assignments are grouped into partitions that do not exceed part_limit • Uses less memory and benefits from early quantification

SMV options: -inc • Perform incremental evaluation of the transition relation • At each step in forward search, transition relation restriced to reached state set • Cuts down on size of transition relation with overhead of extra computation

Example: Client & Server MODULE client (ack) VAR state : {idle, requesting}; req : boolean; ASSIGN init(state) := idle; next(state) := case state=idle : {idle, requesting}; state=requesting & ack : {idle, requesting}; 1 : state; esac; req := (state=requesting);

MODULE server (req) VAR state : {idle, pending, acking}; ack : boolean; ASSIGN next(state) := case state=idle & req : pending; state=pending : {pending, acking}; state=acking & req : pending; state=acking & !req : idle; 1 : state; esac; ack := (state = acking);

Is the specification true? MODULE main VAR c : client(s.ack); s : server(c.req); SPEC AG (c.req -> AF s.ack) • Need fairness constraint: • Suggestion:FAIRNESS s.ack • Why is this bad? • Solution:FAIRNESS (c.req -> s.ack)

NuSMV • Specifications expressible in CTL, LTL and Real time CTL logics • Provides both BDD and SAT based model checking. • Uses a number of heuristics for achieving efficiency and control state explosion • Higher number of features in interactive mode

Cadence SMV • Provides “compositional techniques” to verify large complex systems by decomposition to smaller problems. • Provides a variety of techniques for refinement verification, symmetry reductions, uninterpreted functions, data type reductions.

Useful Links • SMV sources, binaries and manualshttp://www.cs.cmu.edu/~modelcheck/smv.html • SMV man page http://www.cs.cmu.edu/~dongw/smv.txt • SMV manualhttp://www.cs.cmu.edu/~modelcheck/smv/smvmanual.ps • Tutorial on verification techniques using Cadence SMVhttp://www-cad.eecs.berkeley.edu/~kenmcmil/tutorial.ps • SMV Input Language documentationhttp://www-cad.eecs.berkeley.edu/~kenmcmil/psdoc.html

Downloads • SMV www.cs.cmu.edu/~modelcheck/smv.html • NuSMV http://nusmv.irst.itc.it/ • Cadence SMV http://wwwcad.eecs.berkeley.edu/~kenmcmil/smv

Introduction to SMV