Download presentation

Presentation is loading. Please wait.

Published bySylvia Tacey Modified about 1 year ago

1
Micromodels of Software Formal Methods in Verification of Computer Systems Jeremy Johnson

2
Outline

3
1.Combination Set of models (bounded size) Negative answer provides counter example Positive answer gives confidence 2.Small scope hypothesis Negative answers tend to occur in small models 3.Alloy (alloy.mit.edu)

4
Models Let F be a set of functions and P a set of predicates. A model M for (F,P) consists of A non-empty set A [universe] of concrete values For each nullary f F an element of A = f M For each n-ary f F a function f M : A n A For each n-ary P P a subset P M A n

5
Satisfaction

6

7
Semantic Entailment

8
Example 1 F = {i} and P = {R,F} i a constant function, R binary and F unary predicates Model – A set of states, initial state i, state transitions R, final states F A = {a,b,c} i M = a R M = {(a,a),(a,b),(a,c),(b,c), (c,c)} F M = {b,c}

9
Example 1 y R(i,y) F(i) x y z (R(x,y) R(x,z) y = z ) x y R(x,y)

10
Software Micromodels Want description M of all compliant implementations M i of some software system. Given a property Assertion checking: does hold in all implementations M i M Consistency checking: does hold in some implementations M i M

11
Alloy (alloy.mit.edu) “Alloy is a language for describing structures and a tool for exploring them. It has been used in a wide range of applications from finding holes in security mechanisms to designing telephone switching networks.” Declarative (language based on logic) Bounded queries Implemented using SAT solver Illustrate by describing concrete models of state machines (example 1) and checking assertion that “final states are not initial states) and consistency there are state machines that contain a non-final state that is deadlocked

12
Alloy Implementation module AboutStateMachines sig State {} -- simple states sig StateMachine { -- composite state machines A : set State, -- set of states of a state machine i : A, -- initial state of a state machine F : set A, -- set of final states of a state machine R : A -> A -- transition relation of a state machine }

13
Alloy Implementation -- E.G. assertion checking -- Claim that final states are never initial: false. assert FinalNotInitial { all M : StateMachine | no M.i & M.F } check FinalNotInitial for 3 but 1 StateMachine S0 S1 (F) S2 (I,F) R

14
Alloy Implementation -- E.G. consistency checking -- Is there a three-state machine with a non-final deadlock? True. pred AGuidedSimulation(M : StateMachine, s : M.A) { no s.(M.R) not s in M.F # M.A = 3 } run AGuidedSimulation for 3 but 1 StateMachine S0 S1 (F) S2 (I) R R

15
Example 2 F = {alma} and P = {loves} P is a binary predicates, alma constant function Model – A set of states, A = {a,b,c} alma M = a loves M = {(a,a),(b,a),(c,a)}

16
Example 2 alma M = a loves M = {(a,a),(b,a),(c,a)} loves M’ = {(b,a),(c,b)} Does the model satisfy None of Alma’s lovers’ lovers love her x y (loves(x,alma) loves(y,x) loves(y,alma)

17
Alloy Implementation module AboutAlma sig Person {} sig SoapOpera { cast : set Person, alma : cast, loves : cast -> cast } assert OfLovers { all S : SoapOpera | all x, y : S.cast | S.alma in x.(S.loves) && x in y.(S.loves) => not S.alma in y.(S.loves) } check OfLovers for 2 but 1 SoapOpera Person0 Alma R Person1

18
Underspecified System Add the following constaint Fact NoSelfLove { all S : SoapOpera, p : S.cast | not p in p.(S.loves) } No there are no counter examples Increase the number of persons to 3 provides the smallest counter example check OfLovers for 3 but 1 SoapOpera

19
Exercise Install alloy Go through the tutorial (file system example) Study package dependency example from section 2.7 of the text Look under ancillary materials Note that code is for an older version of alloy and some changes are necessary

Similar presentations

© 2016 SlidePlayer.com Inc.

All rights reserved.

Ads by Google