Download presentation

1
**Introduction to Model Checking**

Ken McMillan Cadence Berkeley Labs

2
**Outline Model checking Symbolic model checking Temporal logic**

Model checking algorithms Expressiveness and complexity Symbolic model checking The “state explosion” problem Binary Decision Diagrams Computing fixed points with BDD’s Application

3
**Propositional Linear Temporal Logic**

Express properties of “Reactive Systems” interactive, nonterminating For PLTL, a model is an infinite state sequence Temporal operators “Globally”: G p at t iff p for all t’ ³ t. p p p p p p p p p p p... G p...

4
**Temporal operators... p p p p p p F p... p p p p p p p p p q p U q...**

“Future”: F p at t iff p for some t’ ³ t. p p p p p p F p... “Until”: p U q at t iff q for some t’ ³ t and p in the range [ t, t’ ) p p p p p p p p p q p U q... “Next-time”: X p at t iff p at t+1

5
**Examples Liveness: “if input, then eventually output”**

G (input Þ F output) Strong fairness: “infinitely send implies infinitely recv.” GF send Þ GF recv Weak until: “no output before input” Øoutput W input atomic props infinitely often p W q º p U q Ú G p

6
**Safety v. Liveness Safety Liveness Refutable by finite run**

Refutable only by infinite run Every finite run extensible to satisfying run

7
**PLTL semantics Given an infinite sequence**

if f is true in state si of s. if f is true in state s0 of s. if f is valid. A formula is an atomic proposition, or... true, p Ú q, Øp, p U q, X p

8
PLTL semantics... Definition of satisfaction iff Derived operators...

9
**Model Checking (Clarke/Emerson, Queille/Sifakis)**

G(p -> F q) yes temporal formula MC algorithm no p p q q counterexample finite-state model Model must now represent all behaviors

10
**Kripke models A Kripke model (S,R,L) consists of**

set of states S set of transitions R Í S ´ S labeling L Í S ´ AP Kripke models from programs repeat p := true; p := false; end Øp p

11
**Mutual exclusion example**

N1,N2 turn=0 T1,N2 turn=1 T1,T2 C1,N2 C1,T2 N1,T2 turn=2 T1,T2 N1,C2 T1,C2 N = noncritical, T = trying, C = critical

12
**PLTL on Kripke models A path in model M = (S,R,L) is a sequence**

such that (si,si+1) Î R. p s0 s1 p s2 s3... F p p

13
**Branching time Model of time is a tree, not a sequence**

Path quantifiers p p AF p p

14
**Computation Tree Logic**

Every operator F, G, X, U preceded by A or E Universal modalities... AG p AF p p p p p p p p p p p . . . . . . . . . . . . . . . . . . . . . . . .

15
**CTL, cont... Existential modalities EG p EF p p p p p . . . . . .**

16
**CTL, cont Other modalities Some dualities...**

AX p, EX p, A(p U q), E(p U q) Some dualities... Examples: mutual exclusion specs... AG Ø (C1 Ù C2) mutual exclusion AG (T1 Þ AF C1) liveness AG (N1 Þ EX T1) non-blocking

17
**CTL model checking Model checking problem: Simple algorithm:**

Determine for given M, s0 and f, whether Simple algorithm: Inductive over structure of formula Backward propagation of formula labels O(f V(V + E))

18
**Example AG (T1 Þ AF C1) N1,N2 turn=0 T1,N2 turn=1 N1,T2 turn=2 C1,N2**

C1,T2 turn=1 T1,C2 turn=2

19
**CES algorithm Need only modalities EX, EU, EG. e.g.,**

Checking E(p U q) by backward BFS Checking EG p p BFS q p SCC EG p SCC SCC Complexity = O(f (V + E))

20
**CTL* Contains both CTL and LTL p in LTL ® A p in CTL***

path formulas p U q, G p, Fp, Xp, Øp, p Ù q state formulas A p, E p p in LTL ® A p in CTL* Framework for comparing expressiveness Existential properties not expressible in PLTL e.g., AG EF p Fairness assumptions not expressible in CTL e.g., A (GF p ® GF q)

21
**Model checking complexities**

CTL * = PLTL O(2f (V+E)) CTL O(f (V+E)) PSPACE COMPLETE Note: all are linear in model size

22
**Comparing CTL and LTL Think of CTL formulas as approximations to LTL**

AG EF p is weaker than G F p Good for finding bugs... p AF AG p is stronger than F G p Good for verifying... p p CTL formulas easier to verify So, use CTL when it applies... 8

23
**Symbolic model checking**

State explosion problem State graph exponential in program size Symbolic model checking approach Boolean formulas represent sets and relations Use fixed point characterizations of CTL operators Model checking without building state graph Sometimes can handle much larger sate space

24
**Binary Decision Diagrams (Bryant)**

Ordered decision tree for f = ab + cd a 1 b b 1 1 c c c c 1 1 1 1 d d d d d d d d 1 1 1 1

25
**OBDD reduction Reduced (OBDD) form:**

a 1 b 1 c 1 1 d 1 Key idea: combine equivalent sub-cases

26
**OBDD properties Canonical form (for fixed order)**

direct comparison Efficient apply algorithm build BDD’s for large circuits f fg g O(|f| |g|) Variable order strongly affects size

27
**Boolean quantification**

If v is a boolean variable, then $v.f = f |v =0 V f |v =1 Multivariate quantification $(w1,w2,…,wn). f Complexity on BDD representation worst case exponential heuristically efficient Example: $(b,c). (ab Ú cd) = a Ú d

28
**Characterizing sets Let M = (S,R,L) be a Kripke model**

Let S be the set of boolean vectors (v1,v2,…,vn) Î {0,1}n Represent any P Í S by its characteristic function cP P = {(v1,v2,…,vn) : cP} Set operations cÆ = false cS = true cP È Q = P V Q cP Ç Q = P Ù Q cS \ P = Ø P

29
**Characterizing relations**

Transition relation R is a set of state pairs… R = {((v1,v2,…,vn), (v’1,v’2,…,v’n)) : Î cR} Examples A synchronous sequential circuit v0 v1 cR = (v’0 = Ø v0) Ù (v’1 = v0 Å v1)

30
**Transition relations, cont...**

An asynchronous circuit s q q r Interleaving model Simultaneous model

31
**Forward and reverse image**

Forward image P Image(P,R) R

32
Images, cont... Reverse image Image-1(P,R) P R = EX P

33
**Symbolic CTL model checking**

Equate a formula f with the set of states satisfying it… Compute BDD’s for characteristic functions… Ø p, p Ú q, p Ù q (use BDD ops) EX p = Image-1(p,R) AX p = Ø EX Ø p Remaining operators have fixed-point characterization... In fact, this is the least fixed point...

34
**Fixed points of monotonic functions**

Let t be a function S ® S Say t is monotonic when Fixed point of t is y such that If t monotonic, then it has least fixed point my. t(y) greatest fixed point ny. t(y)

35
**Iteratively computing fixed points**

Suppose S is finite The least fixed point my. t(y) is the limit of The greatest fixed point ny. t(y) is the limit of Note, since S is finite, convergence is finite

36
**Example: EF p EF p is characterized by**

Thus, it is the limit of the increasing series... p Ú EX(p Ú EX p) p Ú EX p . . . p ...which we can compute entirely using BDD operations

37
**Example: EG p EG p is characterized by**

Thus, it is the limit of the decreasing series... p Ù EX(p Ù EX p) ... p Ù EX p p ...which we can compute entirely using BDD operations

38
**Remaining operators Allows CTL model checking with only BDD ops**

Avoid building state graph (Sometimes) avoid state explosion problem Now you can go home and build your own symbolic model checker...

39
**Example: “Gigamax” cache protocol**

global bus . . . UIC UIC UIC cluster bus . . . . . . . . . M P P M P P Bus snooping maintains local consistency Message passing protocol for global consistency

40
**Protocol example Cluster B read --> cluster A**

global bus . . . UIC A B C UIC UIC cluster bus . . . . . . . . . M P P M P P owned copy read miss Cluster B read --> cluster A Cluster A response --> B and main memory Clusters A and B end shared

41
**Protocol correctness issues**

Protocol issues deadlock unexpected messages liveness Coherence each address is sequentially consistent store ordering (system dependent) Abstraction is relative to properties specified

42
**One-address abstraction**

Cache replacement is nondeterministic Message queue latency is arbitrary IN OUT ? A ? ? ? output of A may or may not occur at any given time

43
**{ Specifications Absence of deadlock Coherence**

SPEC AG (EF p.readable & EF p.writable); Coherence SPEC AG((p.readable & bit -> ~EF(p.readable & ~bit)); Abstraction: { 0 if data < n 1 otherwise bit =

44
**Counterexample: deadlock in 13 steps**

global bus . . . UIC A B C UIC UIC cluster bus . . . . . . . . . M P P M P P owned copy from cluster A Cluster A read --> global (waits, takes lock) Cluster C read --> cluster B Cluster B response --> C and main memory Cluster C read --> cluster A (takes lock)

45
State space explosion State space growth is exponential

46
BDD performance BDD size growth is linear

47
BDD performance Run time growth is quadratic

48
Why does it work? . . . . . . . . . OBDD Many partial states equivalent... ...implies many subfunctions equivalent...

49
**When doesn’t it work? Protocols that pass pointers Linked lists**

Anytime one part of the system “knows” a large amount of information about another part

50
**Summary Model checking State explosion problem Applications**

Automatic verification (or falsification) of finite state systems Linear v. branching time logics State explosion problem Binary Decision Diagrams Heuristically efficient boolean operations Image calculations Fixed point characterization of CTL Model checking without building state graph Applications Find subtle errors in complex protocols

Similar presentations

OK

1 Introduction to SMV and Model Checking Mostly by: Ken McMillan Cadence Berkeley Labs Small parts by: Brandon Eames ISIS/Vanderbilt.

1 Introduction to SMV and Model Checking Mostly by: Ken McMillan Cadence Berkeley Labs Small parts by: Brandon Eames ISIS/Vanderbilt.

© 2018 SlidePlayer.com Inc.

All rights reserved.

To make this website work, we log user data and share it with processors. To use this website, you must agree to our Privacy Policy, including cookie policy.

Ads by Google