1. SPIN Verification System The Model Checker SPIN By Gerard J. Holzmann Comp 587 – 12/2/09 Eduardo Borjas – Omer Azmon ☐ ☐

2. Overview ProblemSolutionApplicationsStructureExample Live Demo Conclusion Q & A ☐ ☐

3. Problem ☐ ☐

4. Problem: Today’s Problem With Design “Whether we like it or not, we often design software either by trial and error or by duplicating and modifying a piece of code that does something similar to what we want. This works fine for small applications, but fails miserably for large design projects or for critical code.” -Gerard J. Holzmann ☐ ☐

5. Problem: Circular Blocking ☐ ☐

6. Problem: Deadly Embrace Get B Get A Rel A Rel B Rel A Get A Get B *Rel = Release ☐ ☐

7. Problem: Design Flaws DeadlockLivelockStarvationOverspecification Unused code Underspecification Not all states are expected Assumptions about Speed Logic vs. real world 

8. Problem: Distributed Process Software Testing ComplexityScaleImpractical Equipment availability Regression testing Time Timing in asynchronous processes Testing all instances Criticality ☐ ☐

9. Solution ☐ ☐

10. Solution: SPIN “SPIN is an efficient verification system for models of distributed software systems” SPIN Focuses on Process Interactions Focus on Proving Correctness The act of proving the correctness of an algorithm using formal methods of mathematics ☐ ☐

11. Solution: SPIN SPIN Aims To Provide the Following: 1)An intuitive, program-like notation for specifying design choices unambiguously, without implementation detail. 2)A powerful, concise notation for expressing general correctness requirements. 3)A methodology for establishing the logical consistency of the design choices from 1) and the matching correctness requirements from 2). ☐ ☐

12. Solution: SPIN Other Facts SPIN Was Awarded the System Software Award by the ACM (2002) Other award winners include UNIX, TeX, Smalltalk, TCP/IP, and Tcl/Tk Tools Can Transfer Java or C Programs Into SPIN Models Used By NASA, Bell Labs, and Lucent Currently Taught at Caltech (CS 118, 119a-b, and 116) ☐ ☐

13. Applications ☐ ☐

14. Applications Traditional Theoretical Studies Empirical Studies (Search and Storage) Practical Flood Control (Computer Management Group) Mission Critical Software (NASA) Telephone Exchange (Bell Labs & Lucent) Packet Switching Railway Safety (Ansaldo and IRST) Client Server Applications ☐ ☐

15. Applications Practical Process Scheduling Leader Election Flow Control Multithreaded Programs ☐ ☐

16. Structure ☐ ☐

17. Structure: SPIN SPIN is Broken Into Two Parts: Design Specification (PROMELA) Correctness Claims (Linear Temporal Logic) SPIN = Simple Promela INterpreter Counter-Examples ☐ ☐

18. Structure: PROMELA Specification Language (Design) PROtocol MEta Language One or More User-Defined Process Templates proctype definition Each template defines the behavior of a process A running process can instantiate another process ☐ ☐

19. Structure: PROMELA active proctype main() { printf("hello world\n") } active proctype main() { printf("hello world\n") } ☐ ☐

20. Structure: Linear Temporal Logic LTL Is An Extension of Propositional and Predicate Logic to Temporal Claims SPIN Verification Relies on LTL to Make Claims About Models Just like Symbolic Logic, LTL Can Be Isomophically Converted Into Finite State Diagrams Using Büchi Formulae 

21. Structure: LTL Formulae (Frequently Used) FormulaPronouncedType/Template ☐p☐p always pinvariance ♢p♢p eventually pguarantee p  ♢ q p implies eventually qresponse p  q U rp implies q until rprecedence ☐♢p☐♢p always eventually precurrence (progress) ♢☐p♢☐p eventually always pstability (non-progress) ♢ p  ♢ q eventually p implies eventually qcorrelation 

22. Example 

23. Example: Peterson’s Mutual Exclusion (Critical Section) Algorithm SoSo S5S5 S1S1 flag me = 1 S2S2 turn= me flag other == 0 || turn == other S3S3 flag other != 0 && turn == me flag me = 0 S4S4 Critical Section 

24. Example: Peterson’s Mutual Exclusion (Critical Section) Algorithm bool turn, flag[2]; active [2] proctype user() { again: flag[_pid] = 1; turn = _pid; (flag[1 - _pid] == 0 || turn == 1 -_pid); /* Critical Section */ flag[_pid] = 0; goto again; } bool turn, flag[2]; active [2] proctype user() { again: flag[_pid] = 1; turn = _pid; (flag[1 - _pid] == 0 || turn == 1 -_pid); /* Critical Section */ flag[_pid] = 0; goto again; } SoSo S5S5 S1S1 flag me = 1 S2S2 turn= me flag other == 0 || turn == other S3S3 flag other != 0 && turn == me flag me = 0 S4S4 Critical Section 

25. Live Demo 

26. Example: Peterson’s Mutual Exclusion (Critical Section) Algorithm bool turn, flag[2]; byte ncrit; active [2] proctype user() { assert(_pid == 0 || __pid == 1); again: flag[_pid] = 1; turn = _pid; (flag[1 - _pid] == 0 || turn == 1 - _pid); ncrit++; assert(ncrit == 1); /* critical section */ ncrit--; flag[_pid] = 0; goto again; } bool turn, flag[2]; byte ncrit; active [2] proctype user() { assert(_pid == 0 || __pid == 1); again: flag[_pid] = 1; turn = _pid; (flag[1 - _pid] == 0 || turn == 1 - _pid); ncrit++; assert(ncrit == 1); /* critical section */ ncrit--; flag[_pid] = 0; goto again; } 

27. Conclusion 

28. Conclusion Problem For complex problems, did the design actually cover all of our bases? How can I test distributed software process models efficiently and cost-effectively?Solution SPIN formally proves temporal models mathematically Easy to use 

29. Information Holzmann, G. J. (2009). Retrieved from Spin - Formal Verification: http://www.spinroot.com Holzmann, G. J. (1997). The Model Checker SPIN. IEEE TRANSACTIONS ON SOFTWARE ENGINEERING, 23 (5). Holzmann, G. J. (2006). The Spin Model Checker. Troy, NY: Addison Wesley. Cimatti, A., Giunchiglia, F., et al. Model Checking Safety Critical Software with SPIN: an Application to a Railway Interlocking System. ☐ ☐

30. Questions & Answers Comp 587 – 12/2/09 Eduardo Borjas – Omer Azmon Thank You! ☐ ☐