72 Views

Download Presentation
## Temporal Logic and Model Checking

- - - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - - -

**Reactive Systems**• We often classify systems into two types: • Transformational: functions from inputs available at the start of the computation to outputs provided on termination • Reactive: behaviour is in general infinite: a process in a reactive system is usually non terminating continuously responding to stimuli from its environment • Implication – these different systems need different techniques for reasoning about system correctness**Reasoning about Correctness**• A system state is a snapshot of the system’s variables at some point in time • System changes state in response to stimuli • A pair of states, one before action, one after is called a transition • The computation of a reactive system is a possibly infinite sequence of states, each obtained from the previous state via a transition • Clarke slides • http://www-2.cs.cmu.edu/~emc/15-820A/reading/lecture_0.pdf**Start**Close Heat Error Start Close Heat Error Start Close Heat Error Start Close Heat Error Start Close Heat Error Start Close Heat Error Start Close Heat Error start oven close door open door open door cook done start cooking open door close door reset start oven warmup Example: Microwave Oven**CTL Specification**• We would like the microwave to have the following properties (among others): • No heat while door is open • AG( Heat→Close): • If oven starts, it will eventually start cooking • AG (Start→ AFHeat) • It must be possible to correct errors • AG( Error→AF ¬ Error): • Does it? How do we prove it?**Model Checking Problem**• Given a Kripke structure M = (S,R,L) that represents a finite-state transition graph and a temporal logic formula f • Find all states in S that satisfy f: • {s S | M,s ╞ f } • and check that initial states are among these.**CTL Model Checking Algorithm**• Iterate over subformulas of f from smallest to largest • For each s S, if subformula is true in s, add it to labels(s) • When algorithm terminates • M,s ╞ f iff f labels(s)**Checking Subformulas**• Any CTL formula can be expressed in terms of: ¬, , EX, EU, and EG, • Therefore must consider 6 cases: • Atomic proposition • if ap L(s), add to labels(s) • ¬f1 • if f1labels(s), add ¬f1to labels(s) • f1 f2 • if f1labels(s) or f1labels(s), add f1 f2 tolabels(s) • EX f1 • add EX f1 to labels(s) if successor of s, s', has f1labels(s')**Checking Subformulas**• E[f1 U f2] • Find all states s for which f2 labels(s) • Follow paths backwards from s finding all states that can reach s on a path in which every state is labeled with f1 • Label each of these states with E[f1 U f2]**Checking Subformulas**• EGf1 • Basic idea – look for one infinite path on which f1 holds. • Decompose M into nontrivial strongly connected components • A strongly connected component (SCC) C is • a maximal subgraph such that every node in C is reachable by every other node in C on a directed path that contained entirely within C. • C is nontrivial iff either • it has more than one node or • it contains one node with a self loop • Create M' = (S’,R’,L’) from M by removing all states s S in which f1labels(s) and updating S, R, and L accordingly**Checking Subformulas**• Lemma M,s ╞ EGf1 iff • s S' • There exists a path in M' that leads from s to some node t in a nontrivial strongly connected component of the graph (S', R'). • Proof left as exercise, but basic idea is • Can’t have an infinite path over finite states without cycles • So if we find a path from s to a cycle and f1 holds in every state (by construction) • Then we’ve found an infinite path over which f1 holds**Checking EF f1**procedure CheckEG(f1) S' = {s |f1labels(s)}; SCC = {C| C is a nontrivial SCC of S'}; T = C SCC{s | s C}; for all s Tdolabels(s) = labels(s) {EG f1}; while T ≠ do choose s T; T = T \ {s}; for all tsuch that t S' and R(t,s) do if EG f1 labels(t) then labels(t) = labels(t) {EG f1}; T = T {t}; end if; end for all; end while; end procedure;**Checking a Property**• Checking AG(Start → AF Heat) • Rewrite as ¬EF(Start EG ¬Heat) • Rewrite as ¬ E[ true U (Start EG ¬Heat)] • Compute labels for smallest subformulas • Start, Heat • ¬ Heat**Checking a Property**• Compute labels for EG ¬Heat • S’ = {1,2,3,5,6} • SCC = {{1,2,3,5}} • T = {1,2,3,5} • No other state in S’ can reach a state in T along a path in S’. • Computation terminates. States 1,2,3, and 5 labelled with EG ¬Heat**Checking a Property**• Compute labels for Start EG¬Heat**Checking a Property**• E[true U(Start EG¬Heat)] • Start with set of states in which Start EG¬Heat holds i.e., {2,5} • Work backwards marking every state in whichtrue holds**Checking a Property**• Check ¬ E[true U(Start EG ¬Heat)] • Leaves us with the empty set, so safety property doesn’t hold over microwave oven