CSE 555 Protocol Engineering Dr. Mohammed H. Sqalli Computer Engineering Department King Fahd University of Petroleum & Minerals Credits: Dr. Abdul Waheed (KFUPM) Spring 2004 (Term 032)

Correctness Requirements (Cont.)

CSE555-SqalliTerm How To Check A Model  The model can be represented as a graph  Various graph theoretic algorithms are applicable to search for violations of correctness criteria:  Invariants  Should hold in all states  Deadlocks  A state is reachable where program is blocked  Unreachable states  There are states that are never executed  Search through the state space  Use a search algorithm: depth-first-search, breadth-first search, etc.  Search entire state space or optimize  Report result  Conformance; or  Counter example: at least one state where criteria are not met

CSE555-SqalliTerm Credit: Theo Ruys (University of Twente)

CSE555-SqalliTerm Formal Correctness Condition  We want to find a correctness condition for a model to satisfy a specification:  Language of a model: L(Model)  Language of a specification: L(Spec)  We need: L(Model)  L(Spec)  In order to prove correctness:  Show that L(Model)  L(Spec)  Equivalently: ______ Show that L(Model)  L(Spec) = Ø.  Also: can obtain L(Spec) by translating from LTL! All sequences Sequences satisfying Spec Program executions

CSE555-SqalliTerm Reference: Lecture Notes - Caltech - January-March 2004http://spinroot.com/spin/Doc/course/index.html

CSE555-SqalliTerm Reference: Lecture Notes - Caltech - January-March 2004http://spinroot.com/spin/Doc/course/index.html

CSE555-SqalliTerm Credit: Theo Ruys (University of Twente)

CSE555-SqalliTerm Credit: Theo Ruys (University of Twente)

CSE555-SqalliTerm Reference: Lecture Notes - Caltech - January-March 2004http://spinroot.com/spin/Doc/course/index.html

CSE555-SqalliTerm Reference: Lecture Notes - Caltech - January-March 2004http://spinroot.com/spin/Doc/course/index.html

CSE555-SqalliTerm Credit: Theo Ruys (University of Twente)

CSE555-SqalliTerm Reference: Lecture Notes - Caltech - January-March 2004http://spinroot.com/spin/Doc/course/index.html

CSE555-SqalliTerm Reference: Lecture Notes - Caltech - January-March 2004http://spinroot.com/spin/Doc/course/index.html

CSE555-SqalliTerm Spin Verification  Spin accepts correctness properties using Linear Temporal Logic (LTL)  It uses a depth-first search algorithm  Exhaustive search  State space compression  Space complexity is the biggest problem with verification tools

CSE555-SqalliTerm LTL Syntax  LTL formulae are used to specify liveness properties  LTL = propositional logic + temporal operators  Temporal logic unary (boolean/temporal) operators:  []Always (e.g., []p - always p)  <>Eventually (e.g., <>p - eventually p)  XNext  !Logical negation  Binary operators  UStrong until (e.g., p U q - p is true until q becomes true)  &&Logical and  ||Logical or  ->Logical implication  (p -> q) is shorthand for: (!p || q)  Logical equivalence (iff)  (p q) is shorthand for: (p -> q) && (q -> p)

CSE555-SqalliTerm Reference: Lecture Notes - Caltech - January-March 2004http://spinroot.com/spin/Doc/course/index.html

CSE555-SqalliTerm LTL Examples  Examples about LTL syntax:  [] p “p is invariantly true”  <>p “p eventually becomes true”  p U q “p is true until q becomes true”  Examples of LTL combinations:  <>[] p “p eventually becomes invariantly true” “p will happen from some point forever”  []<>p “p will happen infinitely often”  []<>!p “p always eventually becomes false at least once more”  [] (p -> !q) “p always implies ¬q”  [] (p -> <> q) “p always implies eventually q”  ([]<>p) --> ([]<>q) “If p happens infinitely often, then q also happens infinitely often”

CSE555-SqalliTerm Semantics   X   U        

CSE555-SqalliTerm Reference: Lecture Notes - Caltech - January-March 2004http://spinroot.com/spin/Doc/course/index.html

CSE555-SqalliTerm Credit: Theo Ruys (University of Twente)

CSE555-SqalliTerm Reference: Lecture Notes - Caltech - January-March 2004http://spinroot.com/spin/Doc/course/index.html

CSE555-SqalliTerm Reference: Lecture Notes - Caltech - January-March 2004http://spinroot.com/spin/Doc/course/index.html

CSE555-SqalliTerm Reference: Lecture Notes - Caltech - January-March 2004http://spinroot.com/spin/Doc/course/index.html

CSE555-SqalliTerm LTL Formulae to Buchi Automata  Spin converts LTL formulae into Buchi automata  An initial state  An accepting state  Example:  LTL formula:  [] (pUq)  “It is always guaranteed that p remains true at least until q becomes true”  Buchi automata for LTL  PROMELA syntax:

CSE555-SqalliTerm Another Example  LTL formula:  [] (<>p)  “At any point in an execution, it is guaranteed that eventually p will become true at least once more”  Buchi automata:  PROMELA specifications:

CSE555-SqalliTerm Reference: Lecture Notes - Caltech - January-March 2004http://spinroot.com/spin/Doc/course/index.html

CSE555-SqalliTerm Reference: Lecture Notes - Caltech - January-March 2004http://spinroot.com/spin/Doc/course/index.html

CSE555-SqalliTerm Reference: Lecture Notes - Caltech - January-March 2004http://spinroot.com/spin/Doc/course/index.html

CSE555-SqalliTerm Reference: Lecture Notes - Caltech - January-March 2004http://spinroot.com/spin/Doc/course/index.html