An introduction to model checking

Transcription

1 An introduction to model checking Slide 1 University of Albert Edmonton July 3rd, 2002 Guy Trembly Dépt d informtique UQAM Outline Wht re forml specifiction nd verifiction methods? Slide 2 Wht is model checking? How cn the behvior of rective system be specified? How cn temporl properties be specified? How cn model checking be done? Why nd how cn model checking be done in prllel? 1

2 1 Wht re forml methods? [Forml methods re] mthemticlly bsed techniques used to describe the properties of computing systems They [re used to] specify, develop, nd verify systems in systemtic nd rigorous mnner [] [Wing90] Key elements of forml method: Slide 3 Forml lnguge for writing specifictions Rules to check the qulity of the specifictions Strtegies nd rules to refine nd verify the specifictions Foundtion on which everything rests = Forml specifictions Whtisformlspecifiction lnguge? Forml lnguge ) well-defined syntx nd semntics: Syntx = EBNF, syntx digrms, etc Semntics = lgebrs, utomts nd trnsition systems, reltions nd predictes, etc Slide 4 Specifiction lng ) describes the externl behvior of softwre component by describing its key properties in n bstrct wy (without unneeded implementtion detils) without sying how it is going to be implemented (non-lgorithmic) 2

3 Thus, progrmming lnguge is not specifiction lnguge becuse it is lgorithmic it is not bstrct (rrys, pointers, etc) A specifiction provides non-lgorithmic description ) Describes the wht? insted of the how? Slide 5 An exmple (in Spec): FUNCTION squre_root{ precision: rel SUCH THAT precision > 00 } MESSAGE root( x: rel SUCH THAT x >= 00 ) REPLY( r: rel ) WHERE r >= 00 & lmost_equl( rˆ2, x ) CONCEPT lmost_equl( r1 r2: rel ) VALUE( b: boolen ) WHERE b <=> bs(r1 - r2) <= precision END Wht re the mjor benefits of forml specifictions nd forml methods? Hving to better understnd the specificnd by compeling the nlyst to be bstrct yet precise bout the properties of the system cn be more rewrding thn hving the specifiction itself [Wing90] Specifictions re more explicit, precise, with less mbiguity Formliztion effort ) help identify errors, mbiguities, nd problems erly Slide 6 Provide better foundtion for implementtion work Allows for use of tools (mnipultion, nlysis, simultion) Bsis for developing tests Provide bsis for doing forml verifiction 3

4 Why re there mny specif lng nd methods? Mny different styles of specifictions: Abstrct modeling for mchines nd objects (VDM, Z, Spec, etc); Algebric specifiction for ADT (Lrch, ACT ONE, etc); Behviorl specifiction for rective systems (CCS, CSP, LOTOS, ACP, etc) Sfety nd liveness properties (modl nd temporl logics) Slide 7 Similr to progrmming lnguges: Diverse ppliction domins Vrious styles nd prdigms Vrying expressive power nd nlyzbility 2 Specifying rective nd concurrent systems A system is sid to be rective when it mintins constnt interction with its environment when its behvior is event-driven Slide 8 A system is sid to be concurrent when its behvior is determined by the interction of multiple tsks (processes) tht cooperte nd exchnge informtion 4

5 Modeling the behvior of rective systems The behvior of rective system cn be described by specifying the ctions tht it cn (nd cnnot) perform A computtion of rective system is generlly infinite ) use of lbeled trnsition systems (utomt) Slide 9 A smll exmple: Lotos specifiction nd its grphicl description process P[, b, c]: noexit := ; c; ; P[, b, c] P[, b, c] b [] b; ; c; P[, b, c] endproc c; ; P[, b, c] c ; P[, b, c] ; c; P[, b, c] c; P[, b, c] c Modeling concurrent systems Concurrent behvior cn be expressed by interleving semntics: Concurrent (unordered) ctions cn occur in ny order ) ny possible interleving is llowed Synchronized ctions = ctions performed synchronously by two (or more) gents ) only one ction visible Slide 10 ; b; d; STOP [b] d; b; c; STOP ; b; d; STOP d; b; c; STOP d b; d; STOP b; c; STOP b b d; STOP c; STOP d c STOP STOP Possible set of visible runs = fdbdc, dbcd, dbdc, dbcdg 5

6 Specifying properties of the behvior Automt = form of opertionl description describes how to generte the possible sequences of ctions But such description does not mke explicit the properties stisfied by the behvior Sfety properties: nothing bd will ever hppen Liveness: something good will eventully hppen Slide 11 Different pproches to the specifiction of properties: Modl logic: locl properties of current stte Temporl logic: properties of runs Liner-time logic Brnching-time logic Liner-time logic Liner-time property = property long single pth of execution ) A stte stisfies liner-time logic property if ll complete pths tht strt from this stte stisfy the property Exmple: M1 M2 Slide 12 muffin coin coin cookies muffin coin cookies These two mchines hve the sme set of (complete) pths: { coin;muffin, coin;cookies } ) they will stisfy the sme liner-time properties but do they relly hve the sme behvior? 6

7 Modl logic Modl logic = expresses (locl) properties of the current stte Possibility (my): hi =itispossibletodoction nd then rech stte tht stisfies Necessity (must): [] = whenever ction is done, the resulting stte stisfies Slide 13 Two typicl idioms: hitt =itispossibletodo []ff = cnnot be done Exmples on P = c; ; P[, b, c] c P[, b, c] b ; c; P[, b, c] c ; P[, b, c] c; P[, b, c] P j= hitt Slide 14 (Liveness) P cn do s its first move P j= [][b]ff (Sfety) In its strting stte, P cnnot do n followed by b P j= [,b]hcitt ^ [,]h; ditt (Liveness) If the 1st ction is not b, then the 2nd is c nd if the 1st is not n, the 2nd is n or d 7

8 Modl logic ) Mchines M1 nd M2 cn now be distinguished: M1 M2 coin coin coin muffin cookies muffin cookies Slide 15 M1 M2 j== [coin]hmuffinitt j= [coin]hmuffinitt Temporl (brnching-time) logic Temporl logic = Expresses properties of the runs (the pths) ) Describes qulittively the occurence of events in time CTL = Computtion Tree Logic: Slide 16 s j= AG = holds on ll possible sttes rechble from stte s = Alwys() s j= EF: = froms, there exists pth where eventully holds = Eventully() 8

9 AG p EF p Slide 17 EG p AF p Exmples on P = c; ; P[, b, c] c P[, b, c] b ; c; P[, b, c] c ; P[, b, c] c; P[, b, c] Slide 18 P j= AG([b][c]ff) (Sfety) For ny run, it is never possible to do b followed by c s j= AG(EF hitt) (Wek liveness) Along every pth strting from s, eventully, n ction will be possible 9

10 Mu-clculus Modl mu-clculus = A temporl logic with explicit fixpoint opertors Syntx: ::= tt j ff j X j 1 ^ 2 j 1 _ 2 j [L] jhli j X: j X: Slide 19 Alwys nd Eventully using fixpoint opertors: Alwys() = X: ^ [,]X Eventully() = X: _ h,ix 3 Model checking Model checking = A technique tht relies on building finite model of system nd checking tht desired property holds in tht model [ClrkeEtAl96] Model checking = An utomtic technique for verifying properties of finite stte systems Slide 20 Generl pproch: 1 Construct M = model (of the behvior of the system) 2 Specify = property expected of the system (expressed in modl/temporl logic) 3 Check tht M stisfies If not, produce counter-exmples 10

11 Implementtion requires explortion of the stte spce ) Importnt requirement for M = must be finite Slide 21 Advntges/disdvntges of model checking (+/-): + Verifiction is completely utomtic + Cn produce counter-exmples tht represent subtle errors - Stte explosion problem Primry pplictions (so fr) = hrdwre nd protocol verifiction: IEEE Futurebus+ cche coherence protocol [McMilln93] ( number of previously undetected errors were found) ISDN/ISUP telecommuniction protocol [Holzmnn92] (122 errors found) Slide 22 HDLC chnnel controller [DePlmGl96] (uncovered mjor bug) Active structurl control system in civil engineering [ElseidyEtAl96] (uncovered mjor bug tht could hve worsen effect of vibrtion) 11

12 4 Implementtion of model checking 41 Globl vs locl model checking Globl model checking: Given finite model, M, nd formul,, determine the set of sttes in M tht stisfy Locl model checking: Given finite model, M,formul,, nd stte s in M, determine whether s stisfies Slide 23 Chrcteristics of globl vs locl model checking: Solution to globl problem ) solution to locl one Solution to globl problem ) explortion of the whole stte spce Solution to locl ) demnd-driven explortion of stte spce 42 How to compute fixpoints Solving model checking problem ) need to find solutions to recursive equtions Let h,i nd [,] denote the uses of the modlities with rbitrry ctions Recll tht: Slide 24 AG = Alwys() EF = Eventully() Alwys nd Eventully cn be defined recursively: Alwys() = ^ [,]Alwys() Eventully() = _ h,ieventully() 12

13 Definition: x is fixpoint of f iff f (x) =x Fct: A solution to recursive eqution is lwys fixpoint of n pproprite function Exmple: x =2 x Associted function: (x) =2 x Slide 25 Solution: 0 is solution since (0) = 0 Exmple: x = x Associted function: (x) =x Solution: Any n is solution since (n) =n Exmple: recursive definition of list of integers Eqution: l =1: l Associted function: (l) =1: l Solution: Let ones =[1; 1; 1; 1; :::] be n infinite list of 1s Then (ones) =ones Slide

14 Fct: The lest solution of functionl cn be obtined s the limit of sequence of pproximtions (where? is the lest element of the domin): Exmple: Let (l) =1: l Let 0 (l) =? 1G n=0 n (?) Slide 27 Let i+1 (l) = ( i (l))=1 : i (l) 0 (?) =? 1 (?) = 1:? 2 (?) = 1: 1:? ::: i+1 (?) = 1: 1: ::: :? 43 Globl model-checking for mu-clculus = Determine set of sttes stisfying property Compute denottionl semntics (set of sttes) [tt ]V = P [ff ]V = fg Slide 28 [X ]V = V(X) [ 1 ^ 2 ]V = [ 1 ]V \ [ 2 ]V [ 1 _ 2 ]V = [ 1 ]V [ [ 2 ]V [[L] ]V = fp j8 2 L; p 0 2P:: p! p 0 ) p 0 2 [ ]Vg [hli ]V = fp j9 2 L; p 0 2P:: p! p 0 ^ p 0 2 [ ]Vg [X: ]V = fix ;V where ;V (x) =[ ]V[x7!X] 14

15 fix ;V = 1[ n=0 n ;V (fg) Where 0 (x) =x i+1 (x) = ( i (x)) Slide 29 Termintion property: Since the model (number of sttes) is finite, fixpoint will be reched fter finite number of itertions 44 Locl model-checking for mu-clculus = Determine whether stte stisfies property Compute xiomtic semntics (inference rules) = Set of (inductive) rules tht specify if process p stisfies formul Slide 30 p j= tt p j== ff p j= ^ iff p j= nd p j= p j= _ iff p j= or p j= p j= [L] iff 8 2 L; p 0 2P:: p! p 0 ) p 0 j= p j= hli iff 9 2 L; p 0 2P:: p! p 0 ^ p 0 j= p j= X: iff ::: 15

16 5 Prllel model checking 51 The stte explosion problem Modeling of concurrency by interleving ) Totl number of sttes my grow exponentilly with the number of concurrently executing components Exmple: Slide lines Lotos specifiction with 10 smll processes ) sttes trnsitions Globl model checking nd exhustive explortion of the stte spce ) keep stte spce in memory to void multiple explortion of sme stte ) lot of spce required to store the grph (LTS) Possible solutions to stte explosion problem Symbolic model checking Slide 32 Exploit vrious kinds of informtion to reduce the number of sttes/trnsitions (s long s the key properties re preserved) Use prllel mchine with multiple nodes to provide more memory 16

17 52 Trget mchine nd environment Trget prllel mchine = EARTH (CAPSL, Univ of Delwre, Newrk, DE) Fine-grin multi-threded prllelism = multiple levels of prllelism (threds vs fibers) Irregulr dynmic prllelism = dt flow style scheduling Slide 33 Off-the-shelf computer = EARTH-RTS (Pthreds nd sockets) Erthquke = 16-processors Beowulf cluster (University of Delwre) Progrmming lnguge = Threded-C CADP toolbox (INRIA, Grenoble, Frnce): Trnsltor from Lotos to LTS + numerous other tools: Simultion Equivlence checking Model checking for regulr lterntion-free mu-clculus Slide 34 LTS provides n implicit representtion of the grph (trnsition function) Gol = construct n explicit representtion (stte grph) 17

18 53 Distributing the grph Generl strtegy for distributing the grph Trverse the grph by evluting the trnsition function Use dispersion function h to distribute the sttes on the vrious processors Slide 35 Hndle trnsition t = (s1, e, s2) on processor h(s2) Never send trnsition more thn once by keeping trck of the sttes tht hve been visited Pseudo-code: // Initiliztion phse in process 0 s0 = strt_stte(); visited = {s0}; FOREACH trnsition t = (s0, e, s1) going out of s0 DO SEND t TO processor h(s1); END Slide 36 } // Processing phse (on ll processors) WHILE not terminted (?!) DO RECEIVE trnsition t0 = (s0, e0, s1) from rbitrry process; IF!(s1 IN visited) THEN visited = visited U {s1}; FOREACH trnsition t = (s1, e, s2) going out of s1 DO SEND t TO process h(s2); END END END 18

19 54 Detecting termintion Key problem = Detecting when ll trnsitions hve been processed Currently implemented solution = Distributed detection termintion bsed on the number of messges sent/received 55 Next step = perform model checking Slide 37 Currently: Only distribution of trnsitions hs been implemented (grdute course project) Still need to dd processing ssocited with model checking itself Globl model checking ) multiple explortion of the grph (fixpoint computtion) Locl model checking ) demnd-driven explortion 6 Conclusion Model checking is n interesting pproch to forml verifiction becuse it is utomtic Mjor difficulty = need to hndle lrge stte spce Slide 38 On-going nd future work: Short-term = see how prllel nd distributed execution cn help with stte explosion problem Long-term = pply model checking to -clculus ) hndle mobile processes (dynmic nd non-finite stte spce ;( 19