Model Checking Graph Grammars Kaminski, Seidl et al. Muscholl Estonian Summer School on Computer and Systems Science Lecture 3 Arend Rensink, University of Twente

Model Checking Graph Grammars Seen last time Visual and textual operational semantics With and without parallelism Statements and expressions with data Type graph and instances Graph structure Program graph Frame graph Value graph Operational semantics One or two rules per syntax construct Completely modular ESSCASS Lecture 3, 28 August 2007 Model Checking Graph Grammars

Model Checking Graph Grammars Temporal logic So far: state properties Invariants Inconsistencies More difficult: evolutionary properties In the next state … After some time … Never … Again and again … Every time this, eventually that Predicates & temporal nature orthogonal! Today: propositional temporal logic Predicate logic Temporal logic ESSCASS Lecture 3, 28 August 2007 Model Checking Graph Grammars

Example properties: circular buffer In every next state, the buffer is nonempty Holds if current buffer size is not 1 “empty” is a proposition The empty buffer is always reachable Correct The buffer is always emptied again Does not hold After every get, eventually there is a put ESSCASS Lecture 3, 28 August 2007 Model Checking Graph Grammars

Not covered: temporal predicates Examples: Every value is eventually removed Values are added and removed in FIFO Require quantification outside temporal modalities ESSCASS Lecture 3, 28 August 2007 Model Checking Graph Grammars

Syntax of the logic (propositional) State properties  ::= p proposition p holds in this state | 1 Ç 2 disjunction | : negation | A   holds along All paths | E   holds along somE path Path properties  ::=   holds in the first state | 1 Ç 2 disjunction | : negation | X   holds in the neXt state | 1 U 2 1 holds Until 2 holds ESSCASS Lecture 3, 28 August 2007 Model Checking Graph Grammars

Useful auxiliary operators Eventually  holds (liveness) Abbreviation: F  (in the Future) Equivalent to true U   holds always (safety) Abbreviation: G  (Globally) Equivalent to :(F :) ESSCASS Lecture 3, 28 August 2007 Model Checking Graph Grammars

Model Checking Graph Grammars Example properties In the next state, the buffer is nonempty X :empty or AX :empty The empty buffer is always reachable AG EF empty The buffer is always emptied again AF empty After every get, eventually there is a put AG (get ) F put) Negation: EF (get Æ G :put) ESSCASS Lecture 3, 28 August 2007 Model Checking Graph Grammars

Semantics of temporal logic Interpreted over Kripke structures Quadruple <S, T, P, I> with S a set of states T a set of transitions: T µ S £ S P a proposition evaluation: P µ Prop £ S I a start state: I 2 S For graph transition systems Transitions are applications of changing rules LHS and RHS not isomorphic Rule labels disregarded Propositions are applications of testing rules Distinguished start node ESSCASS Lecture 3, 28 August 2007 Model Checking Graph Grammars

Model Checking Graph Grammars Auxiliary notions Paths: sequences s0 s1 s2 … such that Transitions everywhere: (si,si+1) 2 T for all i We need infinite paths What about final states? Allow stuttering: (si,si+1) 2 T or si = si+1 and @ s’: (si,s’) 2 T All (infinite) paths considered No notion of fairness or progress Extension: Büchi automata – not covered ESSCASS Lecture 3, 28 August 2007 Model Checking Graph Grammars

Interpretation of state formulae Satisfied by Kripke structure + state Satisfaction relation K, s ²  Defined inductively K, s ² p if (p,s) 2 P K, s ² 1Ç 2 if K,s ² 1 or K,s ² 2 K, s ² : if not K,s ²  K, s ² A  if K,s0s1... ²  for all paths with s0=s K, s ² E  if K,s0s1... ²  for some path with s0=s State component omitted if initial K ²  equivalent to K, I ²  ESSCASS Lecture 3, 28 August 2007 Model Checking Graph Grammars

Model Checking Graph Grammars Schematically For a tree-like Kripke structure Some path All paths For a cyclic Kripke structure there are infinitely many paths think of the unfolding (which is a tree) ... ... ... ... ... ... ESSCASS Lecture 3, 28 August 2007 Model Checking Graph Grammars

Interpretation of path formulae Satisfied by Kripke structure + path Satisfaction relation K,  ²  (with  = s0 s1 s2 ...) Defined inductively K,  ²  if K, s0 ²  K,  ² 1Ç 2 if K,  ² 1 or K,  ² 2 K,  ² : if not K,  ²  K,  ² X  if K, s1s2... ²  K,  ² 1 U 2 if K, sisi+1... ² 2 for some i and K, sjsj+1... ² 1 for all j<i Path component omitted if for all paths Starting from initial state ESSCASS Lecture 3, 28 August 2007 Model Checking Graph Grammars

Model Checking Graph Grammars Schematically p,q q p,q p,r q,r ... p X q pÇq U r F pÆr G qÇr ... ... ... ... ... ESSCASS Lecture 3, 28 August 2007 Model Checking Graph Grammars

Fragments of temporal logic Linear temporal logic (LTL) No quantification over paths Just X and U (hence F and G) Not included: e.g., AG EF empty Computation tree logic (CTL) Always quantification over paths Just EX, AX, EU and AU (hence EF, AF etc.) Not included: e.g., G (get ) F put) Complete logic (CTL*) quite expressive Model checking complex ESSCASS Lecture 3, 28 August 2007 Model Checking Graph Grammars

Model Checking Graph Grammars Can we answer the question K ²  For given (arbitrary) K and  This is called the model checking question For linear temporal logic (LTL): yes Based on nested depth-first search Complexity: linear in |K|, exponential in || Various optimizations: e.g., on-the-fly For computation tree logic (CTL): yes Based on breadth-first search Complexity: linear in |K|, linear in || More amenable to symbolic methods (BDDs) ESSCASS Lecture 3, 28 August 2007 Model Checking Graph Grammars

Model Checking Graph Grammars Syntax of CTL State properties only  ::= true always true | p proposition p holds in this state | 1 Ç 2 disjunction | : negation | AX   holds in All neXt states | EX   holds in somE neXt state | A(1 U 2) along All paths, 1 holds Until 2 | E(1 U 2) along somE path, 1 holds Until 2 dual not dual ESSCASS Lecture 3, 28 August 2007 Model Checking Graph Grammars

Useful auxiliary operators Eventually  holds (liveness) Abbreviation: AF  & EF  (in the Future) Equivalent to A(true U ) (resp. E)  holds always (safety) Abbreviation: AG  & EG  (Globally) Equivalent to :(EF :) (resp. A) ESSCASS Lecture 3, 28 August 2007 Model Checking Graph Grammars

Model Checking Graph Grammars Interpretation of CTL Satisfied by Kripke structure + state Satisfaction relation K, s ²  Defined inductively K, s ² p if (p,s) 2 P K, s ² 1 Ç 2 if K, s ² 1 or K, s ² 2 K, s ² : if not K, s ²  K, s ² AX  if K, s’ ²  for all (s,s’) 2 T K, s ² A(1 U 2) if for all paths  starting in s, there is a position k in  such that K, si ² 1 for all i<k and K, sk ² 2 K, s ² E(1 U 2) if there is a path  starting in s, and a position k in  such that K, si ² 1 for all i<k and K, sk ² 2 ESSCASS Lecture 3, 28 August 2007 Model Checking Graph Grammars

Model checking question: K,I ² ? Method: compositional (visitor pattern) Let S = { s j K,s ²  } (set of states satisfying ) Given sets Si for i (i=1,2), compute S for:  = :1  = 1 Ç 2  = AX 1 Problem: Until ( = A(1 U 2)) Due to quantification over paths: Requires “infinite” amount of knowledge Key observation: A(1 U 2) , 2 Ç (1 Æ AXA(1 U 2)) S is solution of X = S2 [ { s 2 S1 | 8(s,s’)2T: s’ 2 X } S is smallest solution of this equation S = S n S1 S = S1 [ S2 S = { s | 8 (s,s’) 2 T: s’ 2 S1} ESSCASS Lecture 3, 28 August 2007 Model Checking Graph Grammars

Model Checking Graph Grammars Fixpoint theory Let f be a function mapping sets to sets f is monotonic if X µ Y implies f(X) µ f(Y) X is a fixpoint of f if f(X) = X X is smallest if f(Y) = Y implies X µ Y Notation: f for smallest fixpoint of f Smallest fixpoints through iteration: let X0 = ; first approximant Xi+1 = f(Xi) next approximants Due to monotonicity, Xi µ Xi+1 If Xi = Xi+1 it is the smallest fixpoint of f If universe is finite, this always terminates ESSCASS Lecture 3, 28 August 2007 Model Checking Graph Grammars

Model Checking Graph Grammars Until as fixpoint Assume S1 and S2 are predefined sets Characteristic sets of 1 and 2 Let fAU be defined by fAU(X) = S2 [ { s 2 S1 | 8 (s,s’) 2 T: s’ 2 X } Then: fAU = S with  = A(1 U 2) fAU is monotonic and universe is finite So: f can be calculated through iteration What are fEU, fAF, fAG, fEF, fEG? In G cases: largest fixpoint, denoted fAG ESSCASS Lecture 3, 28 August 2007 Model Checking Graph Grammars

Model Checking Graph Grammars Example 1 Property: p U q X0 = ; X1 = {2} X2 = {2,3} X3 = {1,2,3} X4 = {1,2,3} Ready after 4th iteration! 2 1 4 p p q q p 3 p,r p,r fAU(X) = Sq [ { s 2 Sp | 8 (s,s’) 2 T: s’ 2 X } with Sp = {1,3,4} Sq = {2} ESSCASS Lecture 3, 28 August 2007 Model Checking Graph Grammars

Model Checking Graph Grammars Example Property: EG p X0 = {1,2,3,4} X1 = {1,3,4} X2 = {1,4} X3 = {4} X4 = {4} Ready after 4th iteration! 2 1 4 p p q q p p 3 p,r p,r fEG(X) = Sp Å { s | 9 (s,s’) 2 T: s’ 2 X } with Sp = {1,3,4} SEG p is largest fixpoint fEG! ESSCASS Lecture 3, 28 August 2007 Model Checking Graph Grammars

Model checking graph transformations 2-phase approach First generate entire state space, then model check Disadvantages: Does not work for infinite state spaces Too much work if error is found early On-the-fly Check during state space generation, stop at error Only works for LTL (depth-first-search) Fails to terminate if wrong branch is chosen and state space is infinite Bounded On-the-fly up to a certain depth Increase depth if no error is found ESSCASS Lecture 3, 28 August 2007 Model Checking Graph Grammars

Model Checking Graph Grammars Optimisations Symmetry reduction Automatic due to isomorphism check Partial order reduction Standard solutions rely on parallel processes Do not exist for graph transformation New: optimistic approach (CONCUR 2008) Implementation pending Abstraction Theory of shape analysis (Sagiv et al.) Similar (parts of) graphs are collapsed Partial implementation in GROOVE ESSCASS Lecture 3, 28 August 2007 Model Checking Graph Grammars

Model Checking Graph Grammars Seen today Temporal Logic Path and state formulae Semantics Example properties Useful fragments Linear temporal logic (LTL) Computation tree logic (CTL) Model checking CTL ESSCASS Lecture 3, 28 August 2007 Model Checking Graph Grammars