Model checking an introduction overview
This presentation is the property of its rightful owner.
Sponsored Links
1 / 53

Model Checking: An introduction & overview PowerPoint PPT Presentation


  • 67 Views
  • Uploaded on
  • Presentation posted in: General

Model Checking: An introduction & overview. Gordon J. Pace. October 2005. History of Formal Methods. Automata model of computation: mathematical definition but intractable. Formal semantics: more abstract models but proofs difficult, tedious and error prone.

Download Presentation

Model Checking: An introduction & overview

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -

Presentation Transcript


Model checking an introduction overview

Model Checking:An introduction & overview

Gordon J. Pace

October 2005


History of formal methods

History of Formal Methods

  • Automata model of computation: mathematical definition but intractable.

  • Formal semantics: more abstract models but proofs difficult, tedious and error prone.

  • Theorem proving: proofs rigorously checked but suffers from ‘only PhDs need apply’ syndrome.


The 1990s

The 1990s

  • Radiation therapy machine overdoses patients,

  • Pentium FDIV bug,

  • Ariane-V crash.

Industry willing to invest in algorithmic based, push-button verification tools.


Model checking

Model-Checking

  • Identify an interesting computation model,

  • For which the verification question is decidable,

  • And tractable on interesting problems.

  • Write a program to answer verification questions.


Formal semantics

Formal Semantics

  • Operational Semantics:


Formal semantics1

Formal Semantics

  • Denotational Semantics of Timed Systems:

v

V’

0

def

[ delay (v’, v) ] =

v’(t+1)=v(t) /\ v’(0)=low

[

]


Transition systems

Transition Systems

  • Q= States

  • = Transition relation (Q x Q)

  • I= Initial states ( Q)

Q, , I 


Constructing tss via os

Constructing TSs via OS

(v:=1; w:=v) || (v:=¬v)

v,w=0,0

pc=0,0

v,w=1,0

pc=1,0

v,w=1,0

pc=0,1

v,w=1,0

pc=0,0

v,w=0,1

pc=0,1

v,w=0,1

pc=0,0

v,w=1,1

pc=1,0

v,w=1,1

pc=0,0


Constructing tss via tds

Constructing TSs via TDS

i

o

m

Q= Bool x Bool x Bool

I= {(i,m,o) | o = i /\ m }

= {((i,m,o),(i’,m’,o’)) | m’=o, o’=i’ /\ m’ }


Model checking an introduction overview

Note:

  • We will be ‘constructing’ TSs from a symbolic (textual/graphical) description of the system. This is a step which explodes exponentially (linear increase in description may imply exponential increase in state-space size).


Properties of tss

Properties of TSs

  • Safety properties: ‘Bad things never happen’.

    eg The green lights on a street will never be on at the same time as the green lights on an intersecting street.

  • Liveness properties: ‘Good things eventually happen’.

    eg A system will never request a service infinitely often without eventually getting it.


Safety property model

Safety Property Model

Are any of the red states

reachable?

etc


Safety property model1

Safety Property Model

Given a transition system M=Q,,I  and a set of ‘bad’ states B, are there any states in B which are reachable in M?


A reachability algorithm

A Reachability Algorithm

R0 = I

Rn+1= Rn (Rn)

where: (P) = { s’ | sP: s  s’ }

Reachable set is the fix-point of this sequence. Termination and correctness are easy to prove.


A reachability algorithm1

A Reachability Algorithm

R := I; Rprev := ;

while (R  Rprev) do

Rprev := R;

R := R  (R);

if (B  R  ) then BUG;

CORRECT;


State space representation

State Space Representation

  • Explicit representation

    • Keeping a list of traversed states.

    • State-explosion problem.

    • Looking at the recursion stack will give counter-example (if one is found).

    • Breath-first search guarantees a shortest counter-example.


Typical optimizations

Typical Optimizations

  • On-the-fly exploration: Explore only the ‘interesting’ part of the tree (wrt property and graph).

    Example: Construct graph only at verification time. Finding a bug would lead to only partial unfolding of the description into a transition system.


Typical optimizations1

Typical Optimizations

  • Partial order reduction: By identifying commuting actions (ones which do not disable each other), we can ignore parts of the model.

    Example: To check for deadlock in (a!; P  b!; Q), we may just fire actions a and b in this order rather than take all interleavings.


Typical optimizations2

Typical Optimizations

  • Compositional verification: Build TS bottom up, minimising the automata as one goes along.

    Example: To construct (P Q), construct P and minimise to get P’, construct Q and minimise to get Q’, and then calculate (P’ Q’).


Typical optimizations3

Typical Optimizations

  • Interface-Based Verification: Use information about future interfaces composands while constructing sub-components.

    Example: Constructing the full rhs of (10c;P + 5c;Q + …)  Huge  (5c;Tea) gives a lot of useless branches which the last process never uses.


State space representation1

State Space Representation

  • Symbolic state representation: Use a symbolic formula to represent the set of states.

R := I; Rprev := ;

while (R  Rprev) do

Rprev := R;

R := R  (R);

if (B  R  ) then BUG;

CORRECT;

Requires: representation of empty set, union, intersection, relation application, and set equality test.


Symbolic representation

Symbolic Representation

Use boolean formulae

Let v1 to vn be the boolean variables in the state space. A boolean formula f(v1,…,vn) represents the set of all states (assignments of the variables) which satisfy the formula.


Symbolic representation1

Symbolic Representation

Double the variables

To represent the transition relation, give a formula over variables v1,…,vn and v’1,…,v’n relating the values before and after the step.


Example

Example

v1

v3

Initial states:

I  (v2=true) /\ (v3=v1 /\ v2)

v2

1

Transition relation:

T  (v3=v1 /\ v2) /\ (v’3=v’1 /\ v’2) /\ v’2=v3


Set operators

Set Operators:

Empty set:  = false

Intersection:P  Q = P /\ Q

Union:P  Q = P \/ Q

Transition relation application:

(P) = (vars: P /\ T)[vars’/vars]

Testing set equality:

P=Q iff P  Q


The problem

The Problem

  • Calculating whether a boolean formula is a tautology is an NP-complete problem. 

  • In practice representations like Binary Decision Diagrams (BDDs) and algorithms used in SAT checkers perform quite well on typical problems.


Counter example generation

Counter-Example Generation

Bad

I=R0


Counter example generation1

Counter-Example Generation

R1

Bad

I


Counter example generation2

Counter-Example Generation

R2

R1

Bad

I


Counter example generation3

Counter-Example Generation

R2

R1

Bad

I


Counter example generation4

Counter-Example Generation

R2

R1

Bad

I


Counter example generation5

Counter-Example Generation

R2

R1

Bad

I


Counter example generation6

Counter-Example Generation

R2

R1

Bad

I

Set of all shortest counter-examples obtained


Abstract interpretation

Abstract Interpretation

  • Technique to reduce state space to explore, transition relation to use.

  • Collapse state space by approximating wrt property being verified.

  • Can be used to verify infinite state systems.


Abstract interpretation1

Abstract Interpretation

  • Example: Collapse states together by throwing away variables, or simplifying wrt formula.

etc


Abstract interpretation2

Abstract Interpretation

  • Example: Collapse states together by throwing away variables, or simplifying wrt formula.

etc


Abstract interpretation3

Abstract Interpretation

  • Example: Collapse states together by throwing away variables, or simplifying wrt formula.

etc


Abstract interpretation4

Abstract Interpretation

  • Concrete counter-example generation not always easy.

  • May yield ‘false negatives’.

etc


Other techniques

Other Techniques

  • Backward Analysis

    R0 = Bad

    Rn+1= Rn  -1(Rn)

    If R be the fix-point of this sequence, the system is correct iff R  I = .


Other techniques1

Other Techniques

  • Induction (depth 1): If …

  • The initial states are good, and

  • Any good state can only go to a good state, then

    The system is correct.


Other techniques2

Other Techniques

  • Induction (depth n): If …

  • Any chain of length n starting from an initial state yields only good states, and

  • Any chain of n good states can only be extended to reach a good state, then,

    The system is correct.


Other techniques3

Other Techniques

  • Induction

    By starting with n=1 and increasing, (plus adding some other constraints) we get a complete TS verification technique.


State of the art

State-of-the-art

  • Explicit state traversal: No more than 107 generated states. Works well for interleaving, asynchronous systems.

  • Symbolic state traversal: Can reach up to 10150 (overall) states. Works well for synchronous systems.

    • Sometimes may work with thousands of variables …

    • With abstraction, 101500 states and above have been reported!


State of the art1

State-of-the-art

  • Combined with other techniques, microprocessor producers are managing to ‘verify’ large chunks of their processors.

  • Application of model-checking techniques on real-life systems still requires expert users.


Tools

Tools

  • Various commercial and academic tools available.

  • Symbolic:

    • BDD based: SMV, NuSMV, VIS, Lustre tools.

    • Sat based: Prover tools, Chaff, Hugo, Bandera toolset.

  • Explicit state: CADP, Spin, CRL, Edinburgh Workbench, FDR.

  • Various high-level input languages: Verilog, VHDL, LOTOS, CSP, CCS, C, JAVA.


Stating properties

Stating Properties

  • Safety properties are easy to specify

    • Intuition: ‘no bad things happen’.

    • If you can express a new output variable ok which is false when something bad happens, then this your property is a safety property (observer based verification).

    • Not all properties are safety properties.


Observer verification

Observer Verification

inputs

outputs

Program

ok

Observer

Advantage: Program and property can be expressed in the same language.


Safety properties

mayday

Safety Properties

  • The system may only shutdown if the mayday signal has been on and unattended for 4 consecutive time units.

shutdown

ok


Non safety properties

Non-Safety Properties

  • Bisimulation based verification

  • Temporal logic based verification

    • Linear time logic (eg LTL)

      Globally (Finally bell)

    • Branching time logic (eg CTL)

      AG (ding EF dong)

      Globally (Globally req Finally ack)


Beyond finite systems

Beyond Finite Systems

  • Example: Induction on structure:

    From:

    Prog(in,out) satisfiesProp(in,out)

    Prog(in,m) /\ Prop(m,out) satisfies Prop(in,out)

    Conclude:

    Any chain of Prog’s satisfies Prop.


Philosophical issues

Philosophical Issues

  • So does this constitute a proof?

  • Can I now claim my product to be correct?

  • Would a proof that P=NP change verification as we now know it?


What i would have also liked to talk about

What I would have also liked to talk about …

  • Other techniques (STE, BMC,…),

  • More about infinite systems,

  • Testing and combining testing with verification,

  • Interaction between theorem-provers and model-checkers,

  • Model-checking other types of systems (hybrid systems, Petri-Nets, etc).


What now potential projects

What now? Potential projects …

  • Verification of Kevin & co’s synchronisation algorithms,

  • Use grammar induction to improve interface based verification,

  • SPeeDI and hybrid system verification,

  • Structural induction to model-check compiler properties.


  • Login