1 Carnegie Mellon UniversitySPINFlavio Lerda SPIN An explicit state model checker

2 Carnegie Mellon UniversitySPINFlavio Lerda Explict State Model Checker Represents the system as an finite state machine Visits each reachable state (state space) explicitly Checks some property –Property is satisfied –Counterexample

3 Carnegie Mellon UniversitySPINFlavio Lerda DFS DFS visit of the state space procedure DFS(s) visited = visited  {s}; for each successor s’ of s if s’  visited then DFS(s’); end if end for end procedure

4 Carnegie Mellon UniversitySPINFlavio Lerda DFS How do we: –Represent the transition relation –Store the visited set Needs fast access (hash table) State space explosion –Check properties

5 Carnegie Mellon UniversitySPINFlavio Lerda Promela Process Algebra –An algebraic approach to the study of concurrent processes. Its tools are algebraical languages for the specification of processes and the formulation of statements about them, together with calculi for the verification of these statements. [Van Glabbeek, 1987]Van Glabbeek, 1987 Describes the system in a way similar to a programming language

6 Carnegie Mellon UniversitySPINFlavio Lerda Promela Asynchronous composition of independent processes Communication using channels and global variables Non-deterministic choices and interleavings

7 Carnegie Mellon UniversitySPINFlavio Lerda An Example mtype = { NONCRITICAL, TRYING, CRITICAL }; show mtype state[2]; proctype process(int id) { beginning: noncritical: state[id] = NONCRITICAL; if :: goto noncritical; :: true; fi; trying: state[id] = TRYING; if :: goto trying; :: true; fi; critical: state[id] = CRITICAL; if :: goto critical; :: true; fi; goto beginning;} init { run process(0); run process(1); } NC C T

8 Carnegie Mellon UniversitySPINFlavio Lerda An Example mtype = { NONCRITICAL, TRYING, CRITICAL }; show mtype state[2]; proctype process(int id) { beginning: noncritical: state[id] = NONCRITICAL; if :: goto noncritical; :: true; fi; trying: state[id] = TRYING; if :: goto trying; :: true; fi; critical: state[id] = CRITICAL; if :: goto critical; :: true; fi; goto beginning;} init { run process(0); run process(1); }

9 Carnegie Mellon UniversitySPINFlavio Lerda An Example mtype = { NONCRITICAL, TRYING, CRITICAL }; show mtype state[2]; proctype process(int id) { beginning: noncritical: state[id] = NONCRITICAL; if :: goto noncritical; :: true; fi; trying: state[id] = TRYING; if :: goto trying; :: true; fi; critical: state[id] = CRITICAL; if :: goto critical; :: true; fi; goto beginning;} init { run process(0); run process(1); }

10 Carnegie Mellon UniversitySPINFlavio Lerda An Example mtype = { NONCRITICAL, TRYING, CRITICAL }; show mtype state[2]; proctype process(int id) { beginning: noncritical: state[id] = NONCRITICAL; if :: goto noncritical; :: true; fi; trying: state[id] = TRYING; if :: goto trying; :: true; fi; critical: state[id] = CRITICAL; if :: goto critical; :: true; fi; goto beginning;} init { run process(0); run process(1); }

11 Carnegie Mellon UniversitySPINFlavio Lerda An Example mtype = { NONCRITICAL, TRYING, CRITICAL }; show mtype state[2]; proctype process(int id) { beginning: noncritical: state[id] = NONCRITICAL; if :: goto noncritical; :: true; fi; trying: state[id] = TRYING; if :: goto trying; :: true; fi; critical: state[id] = CRITICAL; if :: goto critical; :: true; fi; goto beginning;} init { run process(0); run process(1); }

12 Carnegie Mellon UniversitySPINFlavio Lerda An Example mtype = { NONCRITICAL, TRYING, CRITICAL }; show mtype state[2]; proctype process(int id) { beginning: noncritical: state[id] = NONCRITICAL; if :: goto noncritical; :: true; fi; trying: state[id] = TRYING; if :: goto trying; :: true; fi; critical: state[id] = CRITICAL; if :: goto critical; :: true; fi; goto beginning;} init { run process(0); run process(1); } NC C T

13 Carnegie Mellon UniversitySPINFlavio Lerda Enabled Statements A statement needs to be enabled for the process to be scheduled. bool a, b; proctype p1() { a = true; a & b; a = false; } proctype p2() { b = false; a & b; b = true; } init { a = false; b = false; run p1(); run p2(); }

14 Carnegie Mellon UniversitySPINFlavio Lerda Enabled Statements A statement needs to be enabled for the process to be scheduled. bool a, b; proctype p1() { a = true; a & b; a = false; } proctype p2() { b = false; a & b; b = true; } init { a = false; b = false; run p1(); run p2(); } These statements are enabled only if both a and b are true.

15 Carnegie Mellon UniversitySPINFlavio Lerda Enabled Statements A statement needs to be enabled for the process to be scheduled. bool a, b; proctype p1() { a = true; a & b; a = false; } proctype p2() { b = false; a & b; b = true; } init { a = false; b = false; run p1(); run p2(); } These statements are enabled only if both a and b are true. In this case b is always false and therefore there is a deadlock.

16 Carnegie Mellon UniversitySPINFlavio Lerda Other constructs Do loops do :: count = count + 1; :: count = count - 1; :: (count == 0) -> break od

17 Carnegie Mellon UniversitySPINFlavio Lerda Other constructs Do loops Communication over channels proctype sender(chan out) { int x; if ::x=0; ::x=1; fi out ! x; }

18 Carnegie Mellon UniversitySPINFlavio Lerda Other constructs Do loops Communication over channels Assertions proctype receiver(chan in) { int value; out ? value; assert(value == 0 || value == 1) }

19 Carnegie Mellon UniversitySPINFlavio Lerda Other constructs Do loops Communication over channels Assertions Atomic Steps int value; proctype increment() {atomic { x = value; x = x + 1; value = x; }

20 Carnegie Mellon UniversitySPINFlavio Lerda On-The-Fly System is the asynchronous composition of processes The global transition relation is never build For each state the successor states are enumerated using the transition relation of each process

21 Carnegie Mellon UniversitySPINFlavio Lerda On-The-Fly

22 Carnegie Mellon UniversitySPINFlavio Lerda On-The-Fly

23 Carnegie Mellon UniversitySPINFlavio Lerda On-The-Fly

24 Carnegie Mellon UniversitySPINFlavio Lerda On-The-Fly

25 Carnegie Mellon UniversitySPINFlavio Lerda On-The-Fly

26 Carnegie Mellon UniversitySPINFlavio Lerda On-The-Fly

27 Carnegie Mellon UniversitySPINFlavio Lerda On-The-Fly

28 Carnegie Mellon UniversitySPINFlavio Lerda On-The-Fly

29 Carnegie Mellon UniversitySPINFlavio Lerda On-The-Fly

30 Carnegie Mellon UniversitySPINFlavio Lerda On-The-Fly

31 Carnegie Mellon UniversitySPINFlavio Lerda On-The-Fly

32 Carnegie Mellon UniversitySPINFlavio Lerda On-The-Fly

33 Carnegie Mellon UniversitySPINFlavio Lerda On-The-Fly

34 Carnegie Mellon UniversitySPINFlavio Lerda Visited Set Represents all the states that have been reached so far Will eventually become the set of all reachable state (state space) Test of presence of a state in the set must be efficient –It is performed for each reached state procedure DFS(s) visited = visited  {s}; for each successor s’ of s if s’  visited then DFS(s’); end if end for end procedure

35 Carnegie Mellon UniversitySPINFlavio Lerda Visited Set Hash table –Efficient for testing even if the number of elements in it is very big (≥ 10 6 )

36 Carnegie Mellon UniversitySPINFlavio Lerda Visited Set Hash table –Efficient for testing even if the number of elements in it is very big (≥ 10 6 ) Reduce memory usage –Compress each state When a transition is executed only a limited part of the state is modified

37 Carnegie Mellon UniversitySPINFlavio Lerda Visited Set Hash table –Efficient for testing even if the number of elements in it is very big (≥ 10 6 ) Reduce memory usage –Compress each state Reduce the number of states –Partial Order Reduction

38 Carnegie Mellon UniversitySPINFlavio Lerda State Representation Global variables Processes and local variables Queues Global Variables Processes Queues

39 Carnegie Mellon UniversitySPINFlavio Lerda Compression Each transition changes only a small part of the state Assign a code to each element dynamically Encoded states + basic elements use considerably less spaces than the uncompressed states

40 Carnegie Mellon UniversitySPINFlavio Lerda Compression i=0 j=0 P0 x=0 P0 x=0 P0 x=1 Q0 {1} P1 y=0 i=0 j=0 P0 x=0 P0 x=1 Q0 {1} P1 y=

41 Carnegie Mellon UniversitySPINFlavio Lerda 00 P0 x=0 Q0 {1} Compression i=0 j=0 P0 x=0 P0 x=1 P0 x=1 Q0 {} P1 y=0 i=0 j=0 P0 x=0 P0 x=1 Q0 {1} P1 y= Q0 {} 11 q ? x

42 Carnegie Mellon UniversitySPINFlavio Lerda Hash Compaction Uses a hashing function to store each state using only 2 bits

43 Carnegie Mellon UniversitySPINFlavio Lerda Hash Compaction Uses a hashing function to store each state using only 2 bits There is an non-zero probability that two states are mapped into the same bits

44 Carnegie Mellon UniversitySPINFlavio Lerda Hash Compaction Uses a hashing function to store each state using only 2 bits There is an non-zero probability that two states are mapped into the same bits If the number of states is quite smaller than the number of bits available there is a pretty good chance of not having conflicts

45 Carnegie Mellon UniversitySPINFlavio Lerda Hash Compaction Uses a hashing function to store each state using only 2 bits There is an non-zero probability that two states are mapped into the same bits If the number of states is quite smaller than the number of bits available there is a pretty good chance of not having conflicts The result is not (always) 100% correct!

46 Carnegie Mellon UniversitySPINFlavio Lerda Minimized Automata Reduction Turns the state in a sequence of integers

47 Carnegie Mellon UniversitySPINFlavio Lerda Minimized Automata Reduction Turns the state in a sequence of integers Constructs an automata which accepts the states in the visited set

48 Carnegie Mellon UniversitySPINFlavio Lerda Minimized Automata Reduction Turns the state in a sequence of integers Constructs an automata which accepts the states in the visited set Works like a BDD but on non-binary variables (MDD)

49 Carnegie Mellon UniversitySPINFlavio Lerda Minimized Automata Reduction Turns the state in a sequence of integers Constructs an automata which accepts the states in the visited set Works like a BDD but on non-binary variables (MDD) –The variables are the components of the state

50 Carnegie Mellon UniversitySPINFlavio Lerda Minimized Automata Reduction Turns the state in a sequence of integers Constructs an automata which accepts the states in the visited set Works like a BDD but on non-binary variables (MDD) –The variables are the components of the state –The automata is the minimal automata

51 Carnegie Mellon UniversitySPINFlavio Lerda Minimized Automata Reduction Turns the state in a sequence of integers Constructs an automata which accepts the states in the visited set Works like a BDD but on non-binary variables (MDD) –The variables are the components of the state –The automata is the minimal automata –The automata is updated efficiently

52 Carnegie Mellon UniversitySPINFlavio Lerda Partial Order Reduction Some interleavings of processes are equivalent x=0 y=0 x=1 y=0 x=0 y=1 x=1 y=1 x++ y++ x++ x=1 y=0 x=1 y=0

53 Carnegie Mellon UniversitySPINFlavio Lerda Partial Order Reduction Some interleavings of processes are equivalent Computing such interleavings and storing the intermediate states is expensive

54 Carnegie Mellon UniversitySPINFlavio Lerda Partial Order Reduction Some interleavings of processes are equivalent Computing such interleavings and storing the intermediate states is expensive Partial order reduction defines a reduced system which is equivalent to the original system but contains less states and transitions Defines an equivalent relation between states and computes the quotient of the state transition graph to obtain a reduced state transition graph. Properties are true of the reduced state transition graph if and only if are true of the original graph.

55 Carnegie Mellon UniversitySPINFlavio Lerda Partial Order Reduction Optimal partial order reduction is as difficult as model checking!

56 Carnegie Mellon UniversitySPINFlavio Lerda Partial Order Reduction Optimal partial order reduction is as difficult as model checking! Compute an approximation based on syntactical information

57 Carnegie Mellon UniversitySPINFlavio Lerda Partial Order Reduction Optimal partial order reduction is as difficult as model checking! Compute an approximation based on syntactical information –Independent –Invisible –Check (at run-time) for actions postponed at infinitum Access to local variables Receive on exclusive receive-access queues Send on exclusive send-access queues Not mentioned in the property So called stack proviso

58 Carnegie Mellon UniversitySPINFlavio Lerda Properties Safety properties –Something bad never happens –Properties of states Liveness properties –Something good eventually happens –Properties of paths Reachability is sufficient We need something more complex to check liveness properties

59 Carnegie Mellon UniversitySPINFlavio Lerda LTL Model Checking Liveness properties are expressed in LTL –Subset of CTL* of the form: A f where f is a path formula with does not contain any quantifiers The quantifier A is usually omitted. G is substituted by   (always or box) F is substituted by  (eventually or diamond) X is substituted by  (next)

60 Carnegie Mellon UniversitySPINFlavio Lerda LTL Formulae Always eventually p:   p AGFp in CTL* AG(p  Fq) in CTL* Fairness: (   p )   AG(p  AFq) in CTL AG AF p in CTL (AGF p)   in CTL* Can’t express it in CTL Always after p there is eventually q:  ( p  (  q ) )

61 Carnegie Mellon UniversitySPINFlavio Lerda References Design and Validation of Computer Protocols by Gerard Holzmann The Spin Model Checker by Gerard Holzmann An automata-theoretic approach to automatic program verification, by Moshe Y. Vardi, and Pierre Wolper An analysis of bitstate hashing, by G.J. Holzmann An Improvement in Formal Verification, by G.J. Holzmann and D. Peled Simple on-the-fly automatic verification of linear temporal logic, by Rob Gerth, Doron Peled, Moshe Vardi, and Pierre Wolper A Minimized automaton representation of reachable states, by A. Puri and G.J. Holzmann