Internals of SPIN Model Checker by Amin Alipour Software Design Lab malipour@mtu

1. Internals of SPIN Model Checker by Amin Alipour Software Design Lab malipour@mtu.edu

2. Outline • Introduction to SPIN • Reachability Analysis of SPIN • Assertions • Non-progress Cycles • Acceptance Cycles • SPIN Validator Internals

3. SPIN • Model chcking: • [Clarke & Emerson 1981]: “Model checking is an automated technique that, given a finite-state model of a system and a logical property, systematically checks whether this property holds for (a given initial state in) that model.” • It is a model checker. • It uses explicit state enumeration for model checking.

4. How SPIN enumerates the states DFS

5. How SPIN store the states • Exhaustive • Keeping whole states in memory • Supertrace • Using a big memory and a hash function to map each state to a bit in memory.

6. Reachability Analysis Algorithms • A reachability analysis algorithms given a model of a program and a property to verify, must verify the property in program. • Properties could be: • Assertions of states • Progress Property • Non-Progress Property

7. Verifying Assertions

8. Verifying Non-Progress • Consider that a state stands for Progress P. • It should be verified that every traces must include P. • The algorithm should ensure that there is no cycle without P.

9. Detecting Non-Progress Cycle in SPIN • If during state enumeration it reaches state in W, it is a cycle. • SPIN uses a demon process as follows: • When magic =1, all transitions from P is disabled.

10. Non-Progress Cycle Detection-Example

11. Non-Progress Cycle Detection-Example • The algorithm guarantees that if any non-progress cycle exists, at least one of them will be detected. • The algorithm incur twice memory and time requirement.

12. Acceptance Cycles • Here we want to verify that a state (or set of states) is not infinitely often enabled. It is called acceptance states. • We need to detect cycles include the acceptance states.

13. Detection of Acceptance Cycles • SPIN maintains another copy of A in C. • When an acceptance state S wants to move from W to A (all of its successors have been explored). C restarts the search and looks if there is any cycle that includes S. If yes, SPIN declares an failure.

14. Checking Temporal Claims • Right after generation of a new state , SPIN enforces the temporal claim transitions. If the transition cannot be made, it is a violation of temporal property and it finishes the search. Otherwise it adds new state(s) to the state space.

15. Validator Corresponding Files • pangen1.c • pangen1.h • pangen2.h • pangen2.c • pangen3.c • pangen3.h • pangen4.c • pangen5.c

16. SPIN Validator • Big Picture

17. Validation Kernel

18. A snippet of pan.m

19. Validator-Contd

20. A Snippet of pan.b

21. Transition Matrix

22. Transition Matrix-example

23. Reference • G J Holzmann Design and Validation of Computer Protocols. Prentice-Hall, 1991

24. Further Readings • Lee, D. and Yannakakis, M. Testing Finite-State Machines: State Identification and Verification. IEEE Trans. Computers. 43, 3 (Mar. 1994), 306-320. • Yannakakis, M. . Testing finite state machines. In Proceedings of the Twenty-Third Annual ACM Symposium on theory of Computing (New Orleans, Louisiana, United States, May 05 - 08, 1991). STOC '91. • M Yannakakis, D Lee. Testing Finite State Machines: Fault Detection. Journal of Computer and System Sciences, 1995. • GJ Holzmann, Design and validation of protocols: a tutorial, Computer Networks and ISDN Systems, 1993. • Lee, D.; Yannakakis, M. Principles and methods of testing finite state machines-a survey , Proceedings of the IEEE , vol.84, no.8, pp.1090-1123, Aug 1996.

25. Petrenko, A. “Fault Model-Driven Test Derivation from Finite State Models: Annotated Bibliography”. In Modeling and Verification of Parallel Processes, F. Cassez, C. Jard, B. Rozoy, and M. D. Ryan, Eds. Lecture Notes In Computer Science, vol. 2067. Springer-Verlag New York, New York, NY, 196-205. http://www.springerlink.com/content/fnpm8c6wt52q28kj/