Lecture 3 SPIN and Promela
|
|
- Julie Dorsey
- 6 years ago
- Views:
Transcription
1 Lecture 3 SPIN and Promela 1
2 What is SPIN(Simple Promela INterpreter) A tool for analyzing mels of concurrent systems Mels described in Promela Language with concurrent processes Communication via shared variables and channels Analysis by Simulation Mel checking Several optimizations implemented most efficient tool for explicit-state mel checking 2
3 Material About SPIN SPIN Home page Contains manuals, reference material, and tutorial Books about SPIN and its use G.J. Holzmann SPIN MODEL CHECKER Primer and Reference Manual, G.J. Holzmann Design and Validation of Computer Protocols,, Prentice Hall 1991, older book, available on the Internet M. Ben-Ari Principles of Concurrent and Distributed Programming Tutorials, etc. linked from SPIN Home page 3
4 Elements of Promela Language for defining finite-state transition systems Data types with precisely defined finite mains Bits, integers, arrays, messages Processes, which can be dynamically created Communication via global variables or communication channels Simple control constructs 4
5 Transition System Semantics of Promela Each Promela mel defines a transition system State consists of Valuation of global variables and communication channels Local state of each created process Transitions defined by Statements in the bies of processes Each process denotes an action system or process automaton 5
6 Transition System Semantics: Illustration bool y1, y2; int t; active proctype P1() { l0: y1 = 1; l1: t = 2; l2: (y2 == 0 t == 1); l3: y1 = 0 ; goto l0 active proctype P2() { m0: y2 = 1; m1: t = 1; m2: (y1 == 0 t == 2); m3: y2 = 0 ; goto m0 6
7 Transition System Semantics: Illustration bool y1, y2; int t; active proctype P1() { l0: y1 = 1; l1: t = 2; l2: (y2 == 0 t == 1); l3: y1 = 0 ; goto l0 active proctype P2() { m0: y2 = 1; m1: t = 1; m2: (y1 == 0 t == 2); m3: y2 = 0 ; goto m0 P1: l0 y1 = 0 l3 y1 = 1 l1 t = 2 (y2==0 t==1) l2 7
8 Transition System Semantics: Illustration bool y1, y2; int t; active proctype P1() { l0: y1 = 1; l1: t = 2; l2: (y2 == 0 t == 1); l3: y1 = 0 ; goto l0 active proctype P2() { m0: y2 = 1; m1: t = 1; m2: (y1 == 0 t == 2); m3: y2 = 0 ; goto m0 P1: l0 y1 = 0 l3 P2: y2 = 0 m0 m3 y1 = 1 l1 t = 2 (y2==0 t==1) l2 y2 = 1 m1 t = 1 (y1==0 t==2) m2 8
9 Typical Structure of Promela Mel In its basic form, Promela mel consists of type declarations channel declarations variable declarations process declarations init process mtype = {msg, ack; chan tos =... chan tor =... bool flag; proctype Sender () {... proctype Receiver () {... init {... 9
10 Basic Variables and Types Basic types Array declaration Array access bit [0.. 1] bool [0.. 1] byte [ ] short [ ] int [ ] byte anarray[24]; anarray[v] = anarray[3]; Records type definition Record declaration Record access typedef Msg{ byte a[3], b; chan p Msg astruct astruct.a[1] Enumeration type f. messages mtype = {ack, nak, err, next 10
11 Expressions Operators + - * / % ^ > >= < <= ==!=! && & - >> << Conditional expression (v >= 0 -> v : -v) Operations on channel identifers len(qid) empty(qid) nempty(qid) full(qid) nfull(qid) 11
12 Basic Statements Expressions Assignments No-Op (y == false x > 9) y = 34 % 3 anarray[0] = anarray[3] * anarray[(v+2)/4] skip Goto Print (only in simulation) goto label printf All basic statements are either executable (enabled) or blocked (disabled) (of course, depending on values of variables, etc.) Expressions are also statements THIS IS IMPORTANT Blocked if evaluated to 0, otherwise executable In this way, expressions/statements can be used as guards 12
13 Compound Statements Sequential composition Selection test == 1 ; state = state + 1 test == 1 -> state = state + 1 if :: (a == b) -> state = state + 1 :: (a!= b) -> state = state 1 fi equivalent if :: (a == b) -> state = state + 1 :: else -> state = state 1 fi Selection can be nonderministic if :: input? offhook :: (a == b) -> b = 3 ; goto onhook :: output! wakeup :: b = 3 /*any statement can be guard*/ fi 13
14 Compound Statements (ctd.) Repetition :: (m > n) -> m = m - n :: (m < n) -> n = n m :: (m == n) -> break ; printf ( GCD = %d\n, m) Note ; (semicolon) is a statement separator (not a statement terminator as in C) E.g., no need to have ; after clauses in - statements (but es not harm either) 14
15 Processes and process types Name Local variable declarations proctype Sender(chan in; chan out) { bit sndb, rcvb; formal parameters :: out! data(sndb) -> in? ack(rcvb); if :: sndb == rcvb > sndb = 1-sndB :: else -> skip fi Process types defined by proctype definitions A process type may be instantiated (to a process) several times Each process has its local state (pc, local variables) Processes execute concurrently, by interleaving 15
16 Process instantiations Processes are created by run statement/expression run returns process id proctype Foo(byte x) {... Processes execute their first statement some time after creation init { int pid = run Foo(2); run Foo(27) Alternative mechanism: Processes can be statically created at initialization time (no formal parameters allowed) active[3] proctype Bar(){... 16
17 Communication Channels Channels used for passing messages Asynchronous (buffered, default is FIFO) Synchronous (rendez-vous) chan qid = [4] of {mtype, int, byte chan synch[3] = [0] of {mtype, int name capacity types of messages Sending Receiving qid! var1, const, var qid! err(const, var) qid? err(const, var) matched assigned Non-mifying receive qid? [err, const, var] Sorted send/receive (inserts lexicographically, receives any element) qid!! err(const, var) qid?? err(const, var) 17
18 Communication Channels (ctd.) Declaring synchronous (rendez-vous) channel w. capacity 0 chan synch[3] = [0] of {mtype, int 18
19 Peterson-Fischer Mutual Exclusion #define true 1 #define false 0 #define turn1 false #define turn2 true bool y1, y2, t; byte mutex = 0; proctype P2() { m1: y2 = true; m2: t = turn1; m3: (y1 == false t == turn2) ; m4: /* critical section */ y2 = false ; goto m1 proctype P1() { l1: y1 = true; l2: t = turn2; l3: (y2 == false t == turn1) ; l4: /* critical section */ y1 = false ; goto l1 init { atomic { run P1() ; run P2() 19
20 Peterson-Fischer Mutual Exclusion #define true 1 #define false 0 #define turn1 false #define turn2 true bool y1, y2, t; byte mutex = 0; proctype P1() { l1: y1 = true; l2: t = turn2; l3: (y2 == false t == turn1) ; mutex++ ; assert (mutex <= 1) ; l4: /* critical section */ mutex -- ; y1 = false ; goto l1 proctype P2() { m1: y2 = true; m2: t = turn1; m3: (y1 == false t == turn2) ; mutex++ ; assert (mutex <= 1) ; m4: /* critical section */ mutex-- ; y2 = false ; goto m1 init { atomic { run P1() ; run P2() 20
21 Checking by monitor #define true 1 #define false 0 #define turn1 false #define turn2 true bool y1, y2, t; byte mutex = 0; proctype P1() { l1: y1 = true; l2: t = turn2; l3: (y2 == false t == turn1) ; mutex++ ; l4: /* critical section */ mutex -- ; atomic{ y1 = false ; goto l1 proctype P2() { m1: y2 = true; m2: t = turn1; m3: (y1 == false t == turn2) ; mutex++ ; m4: /* critical section */ mutex-- ; atomic{ y2 = false ; goto m1 active proctype monitor() { assert (mutex <= 1) init { atomic { run P1() ; run P2() 21
22 Checking deadlocks #define true 1 #define false 0 #define turn1 false #define turn2 true bool y1, y2, t; byte mutex = 0; proctype P1() { l1: y1 = true; l2: skip ; l3: (y2 == false) ; mutex++ ; l4: /* critical section */ mutex -- ; y1 = false ; goto l1 proctype P2() { m1: y2 = true; m2: skip ; m3: (y1 == false) ; mutex++ ; m4: /* critical section */ mutex-- ; y2 = false ; goto m1 active proctype monitor() { assert (mutex <= 1) init { atomic { run P1() ; run P2() 22
23 Problem with Atomicity Only basic statements are atomic Q: What is the final value of state? byte state = 1; proctype A() { state == 1 -> state++ proctype B() { state == 1 -> state-- init { run A() ; run B() 23
24 Solution: atomic-construct A process whose control is inside atomic{ executes without being interrupted by other processes NOTE: Make sure that such a sequence cannot be blocked inside (after the first statement). In that case, Promela will suspend the process, and you get unintended semantics. byte state = 1; proctype A() { atomic { state == 1 -> state++ proctype B() { atomic { state == 1 -> state-- init { atomic {run A() ; run B() 24
25 Other use of atomic{ To group complex manipulation into single transition If the manipulation is deterministic and always exits at the end, d_step { is more efficient d_step denotes a single transition atomic denotes a sequence of transitions with interrupt disabled atomic { cnt = 0 ; :: (cnt < Max) -> z[cnt] = 3; cnt++ :: (cnt >= Max) -> break d_step { cnt = 0 ; :: (cnt < Max) -> z[cnt] = 3; cnt++ :: (cnt >= Max) -> break 25
26 Else and Timeout else is enabled if no other statement in the same process is enabled :: (m > n) -> m = m - n :: (m < n) -> n = n m :: else -> break ; printf ( GCD = %d\n, m) timeout is enabled if no other statement in the entire Promela mel is enabled skip is best to use if we want to be sure to analyze the effect of possibly premature timeout. :: input? offhook :: input? ringing :: timeout -> output! wakeup Od :: input? offhook :: input? ringing :: skip -> output! wakeup 26
27 Useful Macros IF without else branch #define IF if :: #define FI :: else fi Allows to write IF b -> x++ FI FOR loop #define FOR(i,l,h) i = l ; :: i < h -> #define ROF(i,l,h) ;i++ :: i >= h -> break Allows to write FOR(i,0,N) run proc(i) ROF(i,0,N) which means i = 0 ; :: i < N -> run proc(i) :: i >= N -> break 27
28 New Language Constructs (V6, 2010) For loops Several variants for (i : 1.. 9) { run proc(i) int a[10]; for (i in a) { printf( a[%d] = %d\n, i, a[i]) Selection (nondeterministic) int i; select (i : 1..10); printf( %d\n, i); Parser translates them to basic Promela 28
29 Message Transmission Protocol mtype = { m0, m1, ack proctype Sender{ Send0: :: skip -> /* timeout */ StoR!m0 :: RtoS?ack -> /* rec ack */ SoR!m1; goto Send1 ; Send1: :: skip -> /* timeout */ StoR!m1 :: RtoS?ack -> /* rec ack */ StoR!m0; goto Send0 proctype Receiver{ Rec0: :: StoR?any -> skip /* loss */ :: StoR?m0 -> RtoS!ack; goto Rec1 Rec1: :: StoR?any -> skip /* loss */ :: StoR?m1 -> RtoS!ack; goto Rec0 init { chan StoR = [1] of { mtype ; chan RtoS = [1] of { mtype ; atomic { StoR!m0; /* start */ run Sender; run Receiver 29
30 Alternating Bit Protocol (version 1) mtype = { msg, ack ; chan s_r = [2] of {mtype, byte, bit; chan r_s = [2] of {mtype, bit ; active proctype Sender() { byte data = 0; bit sbit, seqno = 0; :: s_r! msg(data, sbit) -> r_s? ack(seqno); if :: seqno == sbit -> sbit = 1 sbit; data++ :: else fi active proctype Receiver() { byte recd ; bit rbit, seqno = 0; :: s_r? msg (recd, seqno) -> r_s! ack(seqno); if :: seqno == rbit -> rbit = 1 rbit :: else fi 30
31 Alternating Bit Protocol (version 1 altern) mtype = { msg, ack ; chan s_r = [2] of {mtype, byte, bit; chan r_s = [2] of {mtype, bit ; proctype Sender() { byte data = 0; bit sbit, seqno = 0; :: s_r! msg(data, sbit) -> r_s? ack(seqno); if :: seqno == sbit -> sbit = 1 sbit; data++ :: else fi proctype Receiver() { byte recd ; bit rbit, seqno = 0; :: s_r? msg (recd, seqno) -> r_s! ack(seqno); if :: seqno == rbit -> rbit = 1 rbit :: else fi init { atomic { run Sender(); run Receiver() 31
32 AB Protocol (version 2, with losses ) mtype = { msg, ack ; chan s_r = [2] of {mtype, byte, bit; chan r_s = [2] of {mtype, bit ; active proctype Sender() { byte data = 0; bit sbit, seqno = 0; :: s_r! msg(data, sbit) -> r_s? ack(seqno); if :: seqno == sbit -> sbit = 1 - sbit ; data++ :: else fi :: (1) -> skip active proctype Receiver() { byte recd ; bit rbit, seqno = 0; :: s_r? msg (recd, seqno) -> if :: r_s! ack(seqno) :: skip fi; if :: seqno == rbit -> rbit = 1 - rbit :: else fi 32
33 AB Protocol (version 3, w. retransmission) mtype = { msg, ack ; chan s_r = [2] of {mtype, byte, bit; chan r_s = [2] of {mtype, bit ; active proctype Sender() { byte data = 0; bit sbit, seqno = 0; :: s_r! msg(data, sbit) :: (1) -> skip :: r_s? ack(seqno); if :: seqno == sbit -> sbit = 1 - sbit ; data++ :: else fi active proctype Receiver() { byte recd, expected = 0; bit rbit = 1, seqno; :: s_r? msg (recd, seqno) -> if :: seqno!= rbit -> rbit = 1 - rbit ; assert(recd == expected) ; expected++ :: else fi :: r_s! ack (rbit) :: (1) -> skip 33
34 AB Protocol (version 4, w. checks) mtype = { msg, ack ; chan s_r = [2] of {mtype, byte, bit; chan r_s = [2] of {mtype, bit ; active proctype Sender() { byte data = 0; bit sbit, seqno = 0; :: data < 10 -> s_r! msg(data, sbit) :: (1) -> skip :: r_s? ack(seqno); if :: seqno == sbit -> sbit = 1 - sbit ; data++ :: else fi active proctype Receiver() { byte recd, expected = 0; bit rbit = 1, seqno; :: s_r? msg (recd, seqno) -> if :: seqno!= rbit -> rbit = 1 - rbit ; assert(recd == expected); expected++ :: else fi :: r_s! ack (rbit) :: (1) -> skip 34
What is SPIN(Simple Promela Interpreter) Elements of Promela. Material About SPIN. Basic Variables and Types. Typical Structure of Promela Model
What is SPIN(Simple Promela Interpreter) Lecture XX SPIN and Promela A tool for analyzing mels of reactive systems Mels described in Promela Language with concurrent processes, Communication via channels,
More informationWhat is SPIN(Simple Promela Interpreter) Material About SPIN. Elements of Promela. Basic Variables and Types. Typical Structure of Promela Model
What is SPIN(Simple Promela Interpreter) Lecture 3 SPIN and Promela A tool for analyzing mels of reactive systems Mels described in Promela Language with concurrent processes, Communication via channels,
More informationCS477 Formal Software Development Methods / 39
CS477 Formal Software Development Methods 2112 SC, UIUC egunter@illinois.edu http://courses.engr.illinois.edu/cs477 SPIN Beginners Tutorial April 11, 2018 Hello World /* A "Hello World" Promela model for
More informationNetwork Protocol Design and Evaluation
Network Protocol Design and Evaluation 05 - Validation, Part I Stefan Rührup Summer 2009 Overview In the last lectures: Specification of protocols and data/message formats In this chapter: Building a validation
More informationCS477 Formal Software Development Methods / 32
CS477 Formal Software Development Methods 2112 SC, UIUC egunter@illinois.edu http://courses.engr.illinois.edu/cs477 SPIN Beginners Tutorial April 13, 2018 Assertion Violation: mutextwrong1.pml bit flag;
More informationComputer Aided Verification 2015 The SPIN model checker
Computer Aided Verification 2015 The SPIN model checker Grigory Fedyukovich Universita della Svizzera Italiana March 11, 2015 Material borrowed from Roberto Bruttomesso Outline 1 Introduction 2 PROcess
More informationA Tutorial on Model Checker SPIN
A Tutorial on Model Checker SPIN Instructor: Hao Zheng Department of Computer Science and Engineering University of South Florida Tampa, FL 33620 Email: haozheng@usf.edu Phone: (813)974-4757 Fax: (813)974-5456
More informationDesign of Internet Protocols:
CSCI 234 Design of Internet Protocols: George Blankenship George Blankenship 1 Outline Verication and Validation History and motivation Spin Promela language Promela model George Blankenship 2 Verication
More informationCopyright 2008 CS655 System Modeling and Analysis. Korea Advanced Institute of Science and Technology
The Spin Model Checker : Part I Copyright 2008 CS655 System Korea Advanced Institute of Science and Technology System Spec. In Promela Req. Spec. In LTL Overview of the Spin Architecture Spin Model pan.c
More informationThe SPIN Model Checker
The SPIN Model Checker Metodi di Verifica del Software Andrea Corradini GianLuigi Ferrari Lezione 3 2011 Slides per gentile concessione di Gerard J. Holzmann 2 the do-statement do :: guard 1 -> stmnt 1.1
More information4/6/2011. Model Checking. Encoding test specifications. Model Checking. Encoding test specifications. Model Checking CS 4271
Mel Checking LTL Property System Mel Mel Checking CS 4271 Mel Checking OR Abhik Roychoudhury http://www.comp.nus.edu.sg/~abhik Yes No, with Counter-example trace 2 Recap: Mel Checking for mel-based testing
More informationSoftware Engineering using Formal Methods
Software Engineering using Formal Methods Introduction to Promela Wolfgang Ahrendt 03 September 2015 SEFM: Promela /GU 150903 1 / 36 Towards Model Checking System Model Promela Program byte n = 0; active
More informationComputer Lab 1: Model Checking and Logic Synthesis using Spin (lab)
Computer Lab 1: Model Checking and Logic Synthesis using Spin (lab) Richard M. Murray Nok Wongpiromsarn Ufuk Topcu Calornia Institute of Technology AFRL, 25 April 2012 Outline Spin model checker: modeling
More informationFormal Specification and Verification
Formal Specification and Verification Introduction to Promela Bernhard Beckert Based on a lecture by Wolfgang Ahrendt and Reiner Hähnle at Chalmers University, Göteborg Formal Specification and Verification:
More informationHello World. Slides mostly a reproduction of Theo C. Ruys SPIN Beginners Tutorial April 23, Hello() print "Hello"
Hello World CS477 Formal Software Development Methods 11 SC, UIUC egunter@illinois.edu http://courses.engr.illinois.edu/cs477 inners April 3, 014 /* A "Hello World" Promela model for SPIN. */ active Hello()
More informationSpin: Overview of PROMELA
Spin: Overview of PROMELA Patrick Trentin patrick.trentin@unitn.it http://disi.unitn.it/trentin Formal Methods Lab Class, March 10, 2017 These slides are derived from those by Stefano Tonetta, Alberto
More informationSoftware Engineering using Formal Methods
Software Engineering using Formal Methods Introduction to Promela Wolfgang Ahrendt & Richard Bubel & Reiner Hähnle & Wojciech Mostowski 31 August 2011 SEFM: Promela /GU 110831 1 / 35 Towards Model Checking
More informationT Parallel and Distributed Systems (4 ECTS)
T 79.4301 Parallel and Distributed Systems (4 ECTS) T 79.4301 Rinnakkaiset ja hajautetut järjestelmät (4 op) Lecture 3 4th of February 2008 Keijo Heljanko Keijo.Heljanko@tkk.fi T 79.4301 Parallel and Distributed
More informationPromela and SPIN. Mads Dam Dept. Microelectronics and Information Technology Royal Institute of Technology, KTH. Promela and SPIN
Promela and SPIN Mads Dam Dept. Microelectronics and Information Technology Royal Institute of Technology, KTH Promela and SPIN Promela (Protocol Meta Language): Language for modelling discrete, event-driven
More informationTool demonstration: Spin
Tool demonstration: Spin 1 Spin Spin is a model checker which implements the LTL model-checking procedure described previously (and much more besides). Developed by Gerard Holzmann of Bell Labs Has won
More informationApplications of Formal Verification
Applications of Formal Verification Model Checking: Introduction to PROMELA Bernhard Beckert Mattias Ulbrich SS 2017 KIT INSTITUT FÜR THEORETISCHE INFORMATIK KIT University of the State of Baden-Württemberg
More informationApplications of Formal Verification
Applications of Formal Verification Model Checking: Introduction to PROMELA Prof. Dr. Bernhard Beckert Dr. Vladimir Klebanov SS 2012 KIT INSTITUT FÜR THEORETISCHE INFORMATIK KIT University of the State
More informationApplications of Formal Verification
Applications of Formal Verification Model Checking: Introduction to PROMELA Prof. Dr. Bernhard Beckert Dr. Vladimir Klebanov SS 2010 KIT INSTITUT FÜR THEORETISCHE INFORMATIK KIT University of the State
More informationSpin: Overview of PROMELA
Spin: Overview of PROMELA Patrick Trentin patrick.trentin@unitn.it http://disi.unitn.it/~trentin Formal Methods Lab Class, Mar 04, 2016 These slides are derived from those by Stefano Tonetta, Alberto Griggio,
More informationDesign and Analysis of Distributed Interacting Systems
Design and Analysis of Distributed Interacting Systems Lecture 5 Linear Temporal Logic (cont.) Prof. Dr. Joel Greenyer May 2, 2013 (Last Time:) LTL Semantics (Informally) LTL Formulae are interpreted on
More informationPatrick Trentin Formal Methods Lab Class, March 03, 2017
Spin: Introduction Patrick Trentin patrick.trentin@unitn.it http://disi.unitn.it/trentin Formal Methods Lab Class, March 03, 2017 These slides are derived from those by Stefano Tonetta, Alberto Griggio,
More informationPatrick Trentin Formal Methods Lab Class, Feb 26, 2016
Spin: Introduction Patrick Trentin patrick.trentin@unitn.it http://disi.unitn.it/~trentin Formal Methods Lab Class, Feb 26, 2016 These slides are derived from those by Stefano Tonetta, Alberto Griggio,
More informationNetwork Protocol Design and Evaluation
Network Protocol Design and Evaluation 05 - Validation, Part III Stefan Rührup Summer 2009 Overview In the first parts of this chapter: Validation models in Promela Defining and checking correctness claims
More informationDistributed Systems Programming F29NM1 2. Promela I. Andrew Ireland. School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh
Distributed Systems Programming F29NM1 Promela I Andrew Ireland School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh Distributed Systems Programming F29NM1 2 Overview Basic building
More informationThe Spin Model Checker : Part I/II
The Spin Model Checker : Part I/II Moonzoo Kim CS Dept. KAIST Korea Advanced Institute of Science and Technology Motivation: Tragic Accidents Caused by SW Bugs 2 Cost of Software Errors June 2002 Software
More informationIntroduction to Model Checking
Introduction to Model Checking René Thiemann Institute of Computer Science University of Innsbruck WS 2007/2008 RT (ICS @ UIBK) week 4 1/23 Outline Promela - Syntax and Intuitive Meaning Promela - Formal
More informationComputer Lab 1: Model Checking and Logic Synthesis using Spin (lab)
Computer Lab 1: Model Checking and Logic Synthesis using Spin (lab) Richard M. Murray Nok Wongpiromsarn Ufuk Topcu California Institute of Technology EECI 19 Mar 2013 Outline Spin model checker: modeling
More informationSPIN: Part /614 Bug Catching: Automated Program Verification. Sagar Chaki November 12, Carnegie Mellon University
SPIN: Part 1 15-414/614 Bug Catching: Automated Program Verification Sagar Chaki November 12, 2012 What is This All About? Spin On-the-fly verifier developed at Bell-labs by Gerard Holzmann and others
More informationLogic Model Checking
Logic Model Checking Lecture Notes 14:18 Caltech 118 January-March 2006 Course Text: The Spin Model Checker: Primer and Reference Manual Addison-Wesley 2003, ISBN 0-321-22862-6, 608 pgs. Logic Model Checking
More informationThe Spin Model Checker : Part I. Moonzoo Kim KAIST
The Spin Model Checker : Part I Moonzoo Kim KAIST Hierarchy of SW Coverage Criteria Complete Value Coverage CVC (SW) Model checking Complete Path Coverage CPC Concolic testing All-DU-Paths Coverage ADUP
More informationThe SPIN Model Checker
The SPIN Model Checker Metodi di Verifica del Software Andrea Corradini Lezione 1 2013 Slides liberamente adattate da Logic Model Checking, per gentile concessione di Gerard J. Holzmann http://spinroot.com/spin/doc/course/
More informationFormal Verification by Model Checking
Formal Verication by Model Checking Jonathan Aldrich Carnegie Mellon University Based on slides developed by Natasha Sharygina 17-654/17-754: Analysis of Software Artacts Spring 2006 1 CTL Model Checking
More informationBeginner s SPIN Tutorial
SPIN 2002 Workshop Beginner s SPIN Tutorial Grenoble, France Thursday 11-Apr-2002 Theo C. Ruys University of Twente Formal Methods & Tools group http://www.cs.utwente.nl/~ruys Credits should go to Gerard
More informationSPIN: Introduction and Examples
SPIN: Introduction and Examples Alessandra Giordani agiordani@disi.unitn.it http://disi.unitn.it/~agiordani Formal Methods Lab Class, September 28, 2014 *These slides are derived from those by Stefano
More informationSPIN. Carla Ferreira.
SPIN Carla Ferreira http://www.spinroot.com/spin/man/intro.html Introduction PROMELA (PROcess MEta LAnguage) is the input language of SPIN (Simple Promela Interpreter) Inspired by: C and CSP Describes
More informationMulti-Threaded System int x, y, r; int *p, *q, *z; int **a; EEC 421/521: Software Engineering. Thread Interleaving SPIN. Model Checking using SPIN
EEC 421/521: Software Engineering Model Checking using SPIN 4/29/08 EEC 421/521: Software Engineering 1 Multi-Threaded System int x, y, r; int *p, *q, *z; int **a; thread_1(void) /* initialize p, q, and
More informationTHE MODEL CHECKER SPIN
THE MODEL CHECKER SPIN Shin Hong, KAIST 17 th April,2007 1/33 Contents Introduction PROMELA Linear Temporal Logic Automata-theoretic software verification Example : Simple Elevator 2 SPIN is a software
More informationSWEN-220 Mathematical Models of Software. Process Synchronization Critical Section & Semaphores
SWEN-220 Mathematical Models of Software Process Synchronization Critical Section & Semaphores 1 Topics The critical section Synchronization using busy-wait Semaphores 2 The Critical Section Processes
More informationINF672 Protocol Safety and Verification. Karthik Bhargavan Xavier Rival Thomas Clausen
INF672 Protocol Safety and Verication Karthik Bhargavan Xavier Rival Thomas Clausen 1 Course Outline Lecture 1 [Today, Sep 15] Introduction, Motivating Examples Lectures 2-4 [Sep 22,29, Oct 6] Network
More informationModel checking Timber program. Paweł Pietrzak
Model checking Timber program Paweł Pietrzak 1 Outline Background on model checking (spam?) The SPIN model checker An exercise in SPIN - model checking Timber Deriving finite models from Timber programs
More informationT Parallel and Distributed Systems (4 ECTS)
T 79.4301 Parallel and Distriuted Systems (4 ECTS) T 79.4301 Rinnakkaiset ja hajautetut järjestelmät (4 op) Lecture 4 11th of Feruary 2008 Keijo Heljanko Keijo.Heljanko@tkk.fi T 79.4301 Parallel and Distriuted
More informationUsing Model Checking with Symbolic Execution for the Verification of Data-Dependent Properties of MPI-Based Parallel Scientific Software
Using Model Checking with Symbolic Execution for the Verification of Data-Dependent Properties of MPI-Based Parallel Scientific Software Anastasia Mironova Problem It is hard to create correct parallel
More informationSPIN, PETERSON AND BAKERY LOCKS
Concurrent Programs reasoning about their execution proving correctness start by considering execution sequences CS4021/4521 2018 jones@scss.tcd.ie School of Computer Science and Statistics, Trinity College
More informationSWEN-220 Mathematical Models of Software. Concurrency in SPIN Interleaving
SWEN-220 Mathematical Models of Software Concurrency in SPIN Interleaving 1 Topics Interleaving Process Interference Race Conditions Atomicity 2 Concurrency Concurrency can come in many flavors Concurrent
More informationCh 9: Control flow. Sequencers. Jumps. Jumps
Ch 9: Control flow Sequencers We will study a number of alternatives traditional sequencers: sequential conditional iterative jumps, low-level sequencers to transfer control escapes, sequencers to transfer
More informationtransformation of PROMELA models into Channel Systems,
Transformation of PROMELA to Channel Systems Sheila Nurul Huda Jurusan Teknik Informatika, Fakultas Teknologi Industri Universitas Islam Indonesia Jl. Kaliurang Km. 14 Yogyakarta, Indonesia, 55501 Tel
More informationChapter 6: Process Synchronization
Chapter 6: Process Synchronization Objectives Introduce Concept of Critical-Section Problem Hardware and Software Solutions of Critical-Section Problem Concept of Atomic Transaction Operating Systems CS
More informationBlocking Non-blocking Caveat:
Overview of Lecture 5 1 Progress Properties 2 Blocking The Art of Multiprocessor Programming. Maurice Herlihy and Nir Shavit. Morgan Kaufmann, 2008. Deadlock-free: some thread trying to get the lock eventually
More informationAutomated Reasoning. Model Checking with SPIN (II)
Automated Reasoning Model Checking with SPIN (II) Alan Bundy page 1 Verifying Global Properties Assertions can be used to verify a property locally For example, place assert(memreturned) at the end of
More informationDistributed Systems Programming (F21DS1) SPIN: Simple Promela INterpreter
Distributed Systems Programming (F21DS1) SPIN: Simple Promela INterpreter Andrew Ireland Department of Computer Science School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh Overview
More informationTOWARDS AUTOMATED VERIFICATION OF WEB SERVICES
TOWARDS AUTOMATED VERIFICATION OF WEB SERVICES Cátia Vaz INESC-ID Lisboa, ISEL-IPL Rua Alves Redol 9, 1000-029 Lisboa cvaz@cc.isel.ipl.pt Carla Ferreira INESC-ID, IST-UTL Rua Alves Redol 9, 1000-029 Lisboa
More informationDistributed Systems Programming (F21DS1) SPIN: Formal Analysis II
Distributed Systems Programming (F21DS1) SPIN: Formal Analysis II Andrew Ireland Department of Computer Science School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh Overview Introduce
More informationBuilding Graphical Promela Models using UPPAAL GUI
Building Graphical Promela Models using UPPAAL GUI Master s Thesis Report by Vasu Hossaholal Lingegowda Software Systems Engineering Group: B2-201 under the guidance of Dr. Alexandre David Department of
More informationConcurrency: Mutual Exclusion and
Concurrency: Mutual Exclusion and Synchronization 1 Needs of Processes Allocation of processor time Allocation and sharing resources Communication among processes Synchronization of multiple processes
More informationLTL Reasoning: How It Works
Distributed Systems rogramming F21DS1 LTL Reasoning: How It Works Andrew Ireland School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh Distributed Systems rogramming F21DS1 2 Overview
More informationUsing Spin to Help Teach Concurrent Programming
Using Spin to Help Teach Concurrent Programming John Regehr May 1, 1998 1 Introduction and Motivation Writing correct concurrent programs is very difficult; race conditions, deadlocks, and livelocks can
More informationLinear Temporal Logic. Model Checking and. Based on slides developed by Natasha Sharygina. Carnegie Mellon University.
Model Checking and Linear Temporal Logic Jonathan Aldrich Carnegie Mellon University Based on slides developed by Natasha Sharygina 17-654: Analysis of Software Artifacts 1 Formal Verification by Model
More informationINF5140: Specification and Verification of Parallel Systems
INF5140: Specification and Verification of Parallel Systems Lecture 09 Defining Correctness Claims Gerar Schneider Department of Informatics University of Oslo INF5140, Spring 2007 Gerar Schneider (Ifi,
More informationThe Design of a Distributed Model Checking Algorithm for Spin
The Design of a Distributed Model Checking Algorithm for Spin Gerard J. Holzmann http://eis.jpl.nasa.gov/lars http://spinroot.com/gerard/ Presented at FMCAD 2006, San Jose, California November 14, 2006
More informationFormal Methods for Software Development
Formal Methods for Software Development Verification with Spin Wolfgang Ahrendt 07 September 2018 FMSD: Spin /GU 180907 1 / 34 Spin: Previous Lecture vs. This Lecture Previous lecture Spin appeared as
More informationPrinciples of Protocol Design MVP 10A 1
Principles of Protocol Design MVP 10A 1 MVP10 plan Protocol design principles with examples: Lynch s protocol Tanenbaum protocol 2 Tanenbaum protocol 4 Mutual exclusion in a distributed environment: Lamports
More informationModels of concurrency & synchronization algorithms
Models of concurrency & synchronization algorithms Lecture 3 of TDA383/DIT390 (Concurrent Programming) Carlo A. Furia Chalmers University of Technology University of Gothenburg SP3 2016/2017 Today s menu
More informationModel Requirements and JAVA Programs MVP 2 1
Model Requirements and JAVA Programs MVP 2 1 Traditional Software The Waterfall Model Problem Area Development Analysis REVIEWS Design Implementation Costly wrt time and money. Errors are found too late
More informationMapping of UML Diagrams to Extended Petri Nets for Formal Verification
Grand Valley State University ScholarWorks@GVSU Masters Theses Graduate Research and Creative Practice 8-2013 Mapping of UML Diagrams to Exted Petri Nets for Formal Verification Byron DeVries Grand Valley
More informationEMBEDDED C CODE 17. SPIN Version 4 supports the inclusion of embedded C code into PROMELA models through the following fiv e new primitives:
EMBEDDED C CODE 17 The purpose of analysis is not to compel belief but rather to suggest doubt. (Imre Lakatos, Proofs and Refutations) SPIN Version 4 supports the inclusion of embedded C code into PROMELA
More informationModeling Language Control Flow Advanced Usage Spin Summary Appendix: Building a Verification Suite References Japanese translation of this page Spin is a tool for analyzing the logical consistency of concurrent
More informationConcurrency: Mutual Exclusion and Synchronization
Concurrency: Mutual Exclusion and Synchronization 1 Needs of Processes Allocation of processor time Allocation and sharing resources Communication among processes Synchronization of multiple processes
More informationModel-Checking Concurrent Systems
Model-Checking Concurrent Systems Wolfgang Schreiner Wolfgang.Schreiner@risc.jku.at Research Institute for Symbolic Computation (RISC) Johannes Kepler University, Linz, Austria http://www.risc.jku.at Wolfgang
More informationG52CON: Concepts of Concurrency
G52CON: Concepts of Concurrency Lecture 6: Algorithms for Mutual Natasha Alechina School of Computer Science nza@cs.nott.ac.uk Outline of this lecture mutual exclusion with standard instructions example:
More informationMultitasking / Multithreading system Supports multiple tasks
Tasks and Intertask Communication Introduction Multitasking / Multithreading system Supports multiple tasks As we ve noted Important job in multitasking system Exchanging data between tasks Synchronizing
More informationModel-Checking Concurrent Systems. The Model Checker Spin. The Model Checker Spin. Wolfgang Schreiner
Model-Checking Concurrent Systems Wolfgang Schreiner Wolfgang.Schreiner@risc.jku.at Research Institute for Symbolic Computation (RISC) Johannes Kepler University, Linz, Austria http://www.risc.jku.at 1.
More informationModelling Without a Modelling Language
Modelling Without a Modelling Language Antti Valmari & Vesa Lappalainen University of Jyväskylä 1 Introduction 2 Quick Comparison to Promela 3 Demand-Driven Token Ring 4 Simple Transition Classes 5 Faster
More informationA Verification Approach for GALS Integration of Synchronous Components
GALS 2005 Preliminary Version A Verification Approach for GALS Integration of Synchronous Components F. Doucet, M. Menarini, I. H. Krüger and R. Gupta 1 Computer Science and Engineering University of California,
More informationFormal Specification and Verification
Formal Specification and Verification Model Checking with Temporal Logic Bernhard Beckert Based on a lecture by Wolfgang Ahrendt and Reiner Hähnle at Chalmers University, Göteborg Formal Specification
More informationFORMAL METHODS IN NETWORKING COMPUTER SCIENCE 598D, SPRING 2010 PRINCETON UNIVERSITY LIGHTWEIGHT MODELING IN PROMELA/SPIN AND ALLOY
FORMAL METHODS IN NETWORKING COMPUTER SCIENCE 598D, SPRING 2010 PRINCETON UNIVERSITY LIGHTWEIGHT MODELING IN PROMELA/SPIN AND ALLOY Pamela Zave AT&T Laboratories Research Florham Park, New Jersey, USA
More informationGenerating Code from Event-B Using an Intermediate Specification Notation
Rodin User and Developer Workshop Generating Code from Event-B Using an Intermediate Specification Notation Andy Edmunds - ae02@ecs.soton.ac.uk Michael Butler - mjb@ecs.soton.ac.uk Between Abstract Development
More informationConcept of a process
Concept of a process In the context of this course a process is a program whose execution is in progress States of a process: running, ready, blocked Submit Ready Running Completion Blocked Concurrent
More informationPrinciples of Protocol Design. MVP10 plan. What is a protocol? Typical SPIN applications. The three parts of a protocol description
Principles of Protocol Design MVP10 plan Protocol design principles with examples: Lynch s protocol Tanenbaum protocol 2 Tanenbaum protocol 4 Mutual exclusion in a distributed environment: Lamports algorithm
More informationProcess Management And Synchronization
Process Management And Synchronization In a single processor multiprogramming system the processor switches between the various jobs until to finish the execution of all jobs. These jobs will share the
More informationCS3733: Operating Systems
Outline CS3733: Operating Systems Topics: Synchronization, Critical Sections and Semaphores (SGG Chapter 6) Instructor: Dr. Tongping Liu 1 Memory Model of Multithreaded Programs Synchronization for coordinated
More informationReal Time & Embedded Systems. Final Exam - Review
Real Time & Embedded Systems Final Exam - Review Final Exam Review Topics Finite State Machines RTOS Context switching Process states Mutex - purpose and application Blocking versus non-blocking Synchronous
More informationDistributed Systems Programming (F21DS1) SPIN: Formal Analysis I
Distributed Systems Programming (F21DS1) SPIN: Formal Analysis I Andrew Ireland Department of Computer Science School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh Overview Introduce
More informationthese developments has been in the field of formal methods. Such methods, typically given by a
PCX: A Translation Tool from PROMELA/Spin to the C-Based Stochastic Petri et Language Abstract: Stochastic Petri ets (SPs) are a graphical tool for the formal description of systems with the features of
More informationTesting Concurrent Programs: Model Checking SPIN. Bengt Jonsson
Testing Concurrent Programs: Model Checking SPIN Bengt Jonsson Model Checking Section Weeks 15 and 16. Goal: Understand and use the basics of Model checking, using state space exploration Modeling parallel
More informationA Deterministic Concurrent Language for Embedded Systems
A Deterministic Concurrent Language for Embedded Systems Stephen A. Edwards Columbia University Joint work with Olivier Tardieu SHIM:A Deterministic Concurrent Language for Embedded Systems p. 1/38 Definition
More informationTowards Promela verification using VerICS
Part 2: Specification Towards Promela verification using VerICS Wojciech Nabia lek 1 and Pawe l Janowski 2 1 Institute of Computer Science, University of Podlasie ul. Sienkiewicza 51, 08-110 Siedlce, Poland
More informationCS4411 Intro. to Operating Systems Exam 1 Fall points 10 pages
CS4411 Intro. to Operating Systems Exam 1 Fall 2005 (October 6, 2005) 1 CS4411 Intro. to Operating Systems Exam 1 Fall 2005 150 points 10 pages Name: Most of the following questions only require very short
More informationA Deterministic Concurrent Language for Embedded Systems
SHIM:A A Deterministic Concurrent Language for Embedded Systems p. 1/28 A Deterministic Concurrent Language for Embedded Systems Stephen A. Edwards Columbia University Joint work with Olivier Tardieu SHIM:A
More informationUsing Model Checking to Debug Device Firmware
To Appear in the Proceedings of 5th USENIX Symposium on Operating Systems Design and Implementation (OSDI 2002). 1 Using Model Checking to Debug Device Firmware Sanjeev Kumar Department of Computer Science
More informationDesign for Verification for Asynchronously Communicating Web Services
Design for Verification for Asynchronously Communicating Web Services Aysu Betin-Can Computer Science Department University of California Santa Barbara, CA 93106, USA aysu@cs.ucsb.edu Tevfik Bultan Computer
More informationAnalyzing Singularity Channel Contracts
Analyzing Singularity Channel Contracts Zachary Stengel and Tevfik Bultan Computer Science Department University of Calornia Santa Barbara, CA 93106, USA {zss,bultan@cs.ucsb.edu ABSTRACT This paper presents
More informationA Practical approach on Model checking with Modex and Spin
International Journal of Electrical & Computer Sciences IJECS-IJENS Vol: 11 No: 05 1 A Practical approach on Model checking with Modex and Spin Muhammad Iqbal Hossain #1, Nahida Sultana Chowdhury *2 #
More informationTemporal Logic and Timed Automata
Information Systems Analysis Temporal Logic and Timed Automata (5) UPPAAL timed automata Paweł Głuchowski, Wrocław University of Technology version 2.3 Contents of the lecture Tools for automatic verification
More informationDr. D. M. Akbar Hussain DE5 Department of Electronic Systems
Concurrency 1 Concurrency Execution of multiple processes. Multi-programming: Management of multiple processes within a uni- processor system, every system has this support, whether big, small or complex.
More informationChapter 6: Synchronization. Chapter 6: Synchronization. 6.1 Background. Part Three - Process Coordination. Consumer. Producer. 6.
Part Three - Process Coordination Chapter 6: Synchronization 6.1 Background Concurrent access to shared data may result in data inconsistency Maintaining data consistency requires mechanisms to ensure
More information