Download presentation

Presentation is loading. Please wait.

1
**Micromodels of Software**

Formal Methods in Verification of Computer Systems Jeremy Johnson

2
**Outline Semantic Entailment Model checking**

Given a set of formulas , is ⊨ valid encodes requirements and as a property that all valid implementations should have Undecidable Model checking Given a formula and a matching model M determine whether M ⊨l holds Requirements encoded in model Fixes too many implementation choices

3
**Outline Combination Small scope hypothesis Alloy (alloy.mit.edu)**

Set of models (bounded size) Negative answer provides counter example Positive answer gives confidence Small scope hypothesis Negative answers tend to occur in small models Alloy (alloy.mit.edu)

4
Models Let F be a set of functions and P a set of predicates. A model M for (F,P) consists of A non-empty set A [universe] of concrete values For each nullary f F an element of A = fM For each n-ary f F a function fM : An A For each n-ary P P a subset PM An

5
Satisfaction Given a model M for (F,P) and given an environment l : var A the satisfaction relation M ⊨l P(t1,…,tn) (a1,…,an) and M ⊨l iff (a1,…,an) RM M ⊨l x iff M ⊨l [x a] holds for all a A M ⊨l x iff M ⊨l [x a] holds for some a A

6
Satisfaction Given a model M for (F,P) and given an environment l : var A the satisfaction relation M ⊨l M ⊨l iff M ⊨l does not hold M ⊨l 1 2 iff M ⊨l 1 and M ⊨l 2 holds M ⊨l 1 2 iff M ⊨l 1 or M ⊨l 2 holds M ⊨l 1 2 iff M ⊨l 2 holds whenever M ⊨l 1 holds

7
Semantic Entailment Let be a set of formulas (possibly infinite) and be a formula from predicate calculus ⊨ holds iff for all models M and lookup tables l, whenever M ⊨l holds for all then M ⊨l holds as well is satisfiable iff there is some model M and lookup table l such that M ⊨l holds is valid iff M ⊨l holds for all models M and lookup tables l

8
**Example 1 F = {i} and P = {R,F}**

i a constant function, R binary and F unary predicates Model – A set of states, initial state i, state transitions R, final states F A = {a,b,c} iM = a RM = {(a,a),(a,b),(a,c),(b,c), (c,c)} FM = {b,c}

9
**Example 1 y R(i,y) F(i) x y z (R(x,y) R(x,z) y = z )**

x y R(x,y)

10
Software Micromodels Want description M of all compliant implementations Mi of some software system. Given a property Assertion checking: does hold in all implementations Mi M Consistency checking: does hold in some implementations Mi M

11
Alloy (alloy.mit.edu) “Alloy is a language for describing structures and a tool for exploring them. It has been used in a wide range of applications from finding holes in security mechanisms to designing telephone switching networks.” Declarative (language based on logic) Bounded queries Implemented using SAT solver Illustrate by describing concrete models of state machines (example 1) and checking assertion that “final states are not initial states) and consistency there are state machines that contain a non-final state that is deadlocked

12
Alloy Implementation module AboutStateMachines sig State {} -- simple states sig StateMachine { -- composite state machines A : set State, -- set of states of a state machine i : A, -- initial state of a state machine F : set A, -- set of final states of a state machine R : A -> A -- transition relation of a state machine }

13
Alloy Implementation -- E.G. assertion checking -- Claim that final states are never initial: false. assert FinalNotInitial { all M : StateMachine | no M.i & M.F } check FinalNotInitial for 3 but 1 StateMachine S0 S1 (F) S2 (I,F) R

14
Alloy Implementation -- E.G. consistency checking -- Is there a three-state machine with a non-final deadlock? True. pred AGuidedSimulation(M : StateMachine, s : M.A) { no s.(M.R) not s in M.F # M.A = 3 } run AGuidedSimulation for 3 but 1 StateMachine S0 S1 (F) R R S2 (I)

15
**Example 2 F = {alma} and P = {loves}**

P is a binary predicates, alma constant function Model – A set of states, A = {a,b,c} almaM = a lovesM = {(a,a),(b,a),(c,a)}

16
**Example 2 almaM = a lovesM = {(a,a),(b,a),(c,a)}**

lovesM’ = {(b,a),(c,b)} Does the model satisfy None of Alma’s lovers’ lovers love her xy (loves(x,alma) loves(y,x) loves(y,alma)

17
**Alloy Implementation R**

module AboutAlma sig Person {} sig SoapOpera { cast : set Person, alma : cast, loves : cast -> cast } assert OfLovers { all S : SoapOpera | all x, y : S.cast | S.alma in x.(S.loves) && x in y.(S.loves) => not S.alma in y.(S.loves) check OfLovers for 2 but 1 SoapOpera Person0 Alma Person1 R

18
**Underspecified System**

Add the following constaint Fact NoSelfLove { all S : SoapOpera, p : S.cast | not p in p.(S.loves) } No there are no counter examples Increase the number of persons to 3 provides the smallest counter example check OfLovers for 3 but 1 SoapOpera

19
**Exercise Install alloy Go through the tutorial (file system example)**

Study package dependency example from section 2.7 of the text Look under ancillary materials Note that code is for an older version of alloy and some changes are necessary

Similar presentations

© 2017 SlidePlayer.com Inc.

All rights reserved.

Ads by Google