1. Formal methods: Lecture 2 12.02.2009
Model Checking I:
transition systems

2. Model Checking Problem
Property  is a temporal property
M is a state-transition system that models the implementation
Model checking is an enumeration of the state space of M that determines if it satisfies the property .

3. Advantage of MC Fully automatic
Error trace (counter example) generated by checker helps to analyze the source of the problem
Good for bug-hunting: a “debugger” that does not require the execution of your program.

4. Modeling How to get M? By the process of abstraction:
Makes verification possible by retaining the part of the system that is relevant to modeling;
Should not discard too much so that the result is doubtable, or the verification is not feasible;
Usually done by human (novel automatic model extraction techniques are winning popularity).

5. Choice of models We focus on state-transition systems
Acceptable by model checkers
Mostly finite set of states and transitions
Also push-down systems possible
Even source programs can be used as models, e.g., Java Pathfinder

6. Notions of modeling State
We concern what is true of a particular state
A state is a “snapshot” of the system variables’ (possibly a set of) valuation(s)
Transition
Relation between states
Can be a C statement: x++;
Or can be a circuit
Or nothing but an arrow, the source and destination of which matter.

7. Atomicity of a transition
Represents abstraction level
too big step may miss intermediate states that are relevant;
too small step may blow up the model unnecessarily.
Must consider concurrency
make possible interleaving of transitions explicit.

8. Kripke Structure (KS)
4-tuple (S, S0, L, R) over a set of atomic propositions AP where
S is a set of (control) states
S0 is a set of initial states
L is a labelling function: S  2AP
R is the transition relation: S x S

9. Example of a KS S= {s0, s1} S0 = {s0} R = {(s0, s1), (s1, s0)}
Assume in s x=1 and y=1
S= {s0, s1}
S0 = {s0}
R = {(s0, s1), (s1, s0)}
L(s0) = {x=1, y=1}
L(s1) = {x=0, y=1}
x:= (x+y) mod 2 S0 S1
x:= (x+y) mod 2

10. Modeling Reactive System
Reactive systems:
do not terminate;
interact with their environment constantly;
KS is one way of modeling them.
Properties to verify:
race condition;
deadlock freedom;
no starvation, etc.
Consider KS as a simple modeling language.

11. Modeling Concurrent Programs with KS
Steps from program to KS (by Manna and Pnueli)
Model components of the concurrent program (i.e., sequential programs) as logic relations.
Compose the logic relations for the concurrent program.
Compute a Kripke structure from the logic relations.

12. Describing States We use first order predicate logic…
true, false, ¬, , , , , →
extended with equality “=” and interpreted predicate and function symbols:
x=y
even (x)
...

13. Chains of State Representation
y<z
Abstraction1
x=0;
y=1;
z=2;
Selective observation
y=1;
z=2;
z is prime
Abstraction2

14. Representing States Valuation of a state Set of states
A type-preserving mapping from observable state variables V to their values
Set of states
A first-order logic formula describing the set
We use S0 for the logic formula describing the set S0
Example: S0 == (x=1)  (y=1)

15. Representing a transition
Transition is a statement (circuit)
Distinguish two sets of variables (signals)
V and V’ for variables before and after transition, respectively
Transition is a relation
Relation is a set of tuples, e.g., pairs
represented as a logic formula on V, V’ with “=”,
Example:
x’ = x+1 for statement x:=x+1

16. From a Logic Relation to a Kripke Structure
Rules
S (statespace) is the set of all valuations for V;
S0 is the set of all valuations that satisfy S0
If s and s’ are two states, then (s,s’)  R(s,s’) is a transition in KS;
L is defined so that L(s) is the subset of all atomic propositions true in s.

17. Example (1,1) (0,1) x:= (x+y) mod 2 S0 == x = 1  y = 1
S= B x B, where B = {0,1}
S0 = {(1,1)}
R = {((1,1), (0,1)), ((0,1),(1,1))}
L((1,1)) = {x=1, y=1}
L((0,1)) = {x=0, y=1}
(1,1)
(0,1)
x:= (x+y) mod 2

18. Simple Programming Language
A parallel program contains processes
Synchr. primitives: wait, lock and unlock
Processes share variables
No assumption about the speed and execution order of these processes
Program is labeled by l1… ln
We use C(l1, P, l2) to denote the logic relation of the transition that represents program P.

19. How to Compute Transition Relation for sequential programs?
Base case: atomic statements:
skip
Assignment: x:=e
Let C describe valuations before and after executing P: x:=e
C(l1, x:=e, l2) ==
pc= l1  pc’=l2  x’= e  same(V \{x})
same(Y) means y’= y, for all y  Y.

20. How to Compute a Transition for Sequential Programs? (2)
Sequential composition
C(l0, P1; l: P2, l1) = C(l0, P1, l) ∨ C(l, P2, l1)
C(l, if b then l1 :P1 else l2 : P2 end if,l’) is the disjuction of:
pc = l  pc’= l1  b  same(V)
pc = l  pc’= l2  ¬ b  same(V)
C (l1, P1, l’)
C(l2, P2, l’)
Conditional part
Body part

21. Example identify variables, including program counters
L0: while (true) do
NC0: wait (turn =0);
CR0: turn := 1;
end while
L0’
L1: while (true) do
NC1: wait (turn =1);
CR1: turn := 0;
L1’
identify variables, including program counters
• compute set of states and set of initial states
• compute translations

22. Example (continued I) Identify variables, including program counters:
L0: while (true) do
NC0: wait (turn =0);
CR0: turn := 1;
end while
L0’
L1: while (true) do
NC1: wait (turn =1);
CR1: turn := 0;
L1’
Identify variables, including program counters:
• V = { pc_0, pc_1, turn}
• domain of pc_0 is L0, NC0, CR0, L0’
• domain of turn is {0,1}

23. Example (continued II)
L0: while (true) do
NC0: wait (turn =0);
CR0: turn := 1;
end while
L0’
L1: while (true) do
NC1: wait (turn =1);
CR1: turn := 0;
L1’
Compute set of states and set of initial states
S= {(L0, L1, 1), (L0,L1,0), (L0, NC1, 1)…}
S0 = {(L0,L1,0), (L0,L1,1)}

24. Example (continued III)
m: cobegin
Compute transition relation separately & then compose them together:
A global dom(pc) = {m, m’, }
 represents one of local pc is taking effect.
L1: while (true) do
NC1: wait (turn =1);
CR1: turn := 0;
end while
L1’
L0: while (true) do
NC0: wait (turn =0);
CR0: turn := 1;
end while
L0’
m’: coend

25. Example (continued IV)
m: cobegin
Transition relations of the composition:
C(L0, P0, L0’)  same(V\V0)  same(PC \PC0)
L0: while (true) do
NC0: wait (turn =0);
CR0: turn := 1;
end while
L0’
L1: while (true) do
NC1: wait (turn =1);
CR1: turn := 0;
end while
L1’
m’: coend

26. Summary Concept of MC (at very high level): State transition system:
An automatic procedure that verifies TL properties
Requires in input
a state transition system
a temporal property
State transition system:
Kripke structure is our (teaching) language
KS models an implementation
An example demonstrated how a concurrent program is translated to KS:
Concurrent programs to logic relations
Logic relations to KS.

27. Next lecture Temporal properties
CTL*, CTL and LTL
Their semantics
CTL model checking on a Kripke structure

28. Exercise
Write a meaningful program that can be modeled as the Kripke structure below.
Give your definition of APs p, q, r.
L(s0) = {¬ p, ¬ q, ¬ r}
L(s1) = {¬ p, ¬ q, r}
L(s2) = {¬ p, q, ¬ r}
L(s3) = {¬ p, q, r}
L(s4) = {p, ¬ q, ¬ r}
L(s5) = {p, ¬ q, r}
L(s6) = {p, q, ¬ r}
L(s7) = {p, q, r} s7 s0 s3 s1 s2 s5 s6 s4