Design and Analysis of Distributed Interacting Systems

Size: px
Start display at page:

Download "Design and Analysis of Distributed Interacting Systems"

Transcription

1 Design and Analysis of Distributed Interacting Systems Lecture 5 Linear Temporal Logic (cont.) Prof. Dr. Joel Greenyer May 2, 2013

2 (Last Time:) LTL Semantics (Informally) LTL Formulae are interpreted on the runs of a Kripke structure p... X p p p p p p p p p... G p p... F p p p p p p q... p U q an initial state of a Kripke structure means: p is element of the label of the state satisfies 2

3 (Last Time:) Typical properties in LTL p is always eventually followed by q G (p F q) p is always directly followed by q G (p X q) p will eventually be true forever F G p p will always be true G p p will be true infinitely often G F p (p will always eventually be true) 3

4 Equivalence of LTL properties Def. 4: LTL formulae φ and ψ are said to be equivalent, written φ ψ, iff for all Kripke Structures M we have M φ M ψ For example, the following holds: F φ true U φ 4

5 (Last Time:) Sematics: more formally... Def. 3: Let π be a run. Then π φ is defined as follows π p, p AP, iff p L(s 0 ), i.e., p holds in the first state of π π φ iff not π φ π φ ψ iff π φ or π ψ π X φ iff π 1 φ π G φ iff i 0 : π i φ π F φ iff i 0 : π i φ π φ U ψ iff k 0 : π k ψ and i, 0 i < k : π i φ. 5

6 Proof: Eventually by Until Proof: F φ true U φ We consider a run π π F φ i 0 : π i φ (Def. F) i 0 : π i φ j, 0 j < i : π j true (true holds in all states) π true U φ (Def. U) We show the equivalence for any run π, so the equivalence also holds for all runs of any Kripke Structure thus F φ true U φ holds according to Def. 4 6

7 More Equivalences Duality G φ F φ F φ G φ X φ X φ Idempotency G G φ G φ F F φ F φ φ U (φ U ψ) φ U ψ (φ U φ) U ψ φ U ψ 7

8 More Equivalences Absorption F G F φ G F φ G F G φ F G φ X φ X φ Distributivity X (φ U ψ) (X φ) U (X ψ) Expansion φ U ψ ψ (φ X (φ U ψ)) F φ φ X F φ G φ φ X G φ 8

9 Characterizing Properties Remember safety: nothing bad ever happes liveness: something good eventually happens φ is a safety formula iff for every run π such that π φ π has a prefix π[0..k] = s 0,, s k such that for all infinite extensions π' of π[0..k] π' φ holds. φ is a liveness formula iff for every finite sequence of states s 0,, s k can be extended so that π φ holds. 9

10 Expressive Power of LTL Are there properties that cannot be expressed in LTL? Yes Properties that refer to the branching structure of the Kripke structure: There exist a path where... can be expressed in CTL (later) No Counting: There are as many occurrences of states where p holds as there are states where q holds requires and infinite counter A property that is true in states after even occurrences of p requires counting to two 10

11 Design and Analysis of Distributed Interacting Systems Lecture 5 The Spin Model Checker Prof. Dr. Joel Greenyer April 25, 2013

12 The Spin Model Checker Spin (Simple Promela Interpreter) tool for simulating and verifying multi-threaded software and distributed system designs...operating systems, data communications protocols, switching systems, concurrent algorithms, railway signaling protocols, control software for spacecraft, nuclear power plants, etc. (from: Verification of LTL fomulae Promela: Process Meta Language C-like language for describing concurrent processes 12

13 The Spin Model Checker Succcess Stories (from: Mission Critical Software: Selected algorithms for a number of space missions were verified with the Spin model checker. The missions include Deep Space 1, Cassini, the Mars Exploration Rovers, Deep Impact, etc. Verification of medical device transmission protocols: Spin was used for about ten years in the verification of international standards that are used worldwide.... ACM Software Systen Award 2001 some others: 2002: Java, 2006: Eiffel, 2007: Statemate, 2011: Eclipse (see 13

14 Promela Allows us to describe concurrent, communicating processes concurrent processes are executed in an interleaved fashion Communication via channels synchronous and asynchronous proc A proc B Communication via shared variables 14

15 Promela Model A typical structure of a Promela model: byte brightness; variable declarations: bit (1), bool(1), byte(8), short(16), int(32) mtype = {press, hold; chan c = [0] of { mtype ; proctype light(){... proctype switch(){... mtype: symbolic names of numeric constants (press=1, hold=2,...) channel declaration with finite buffer size (0: synchronous channel); channels transfer messages with fields of different types procedure declaration (can have parameters) init{ run light(); run switch() initialization of the model, instantiation of processes 15

16 Variables and Types Basic types: bit (1), bool(1), byte(8), short(16), int(32) byte brightness; bool lighton Arrays bit lightson[3]; Records typedef Record { short f; byte g; Record r;... r.f =...; Constants #define MAXBRIGHTNESS 3; 16

17 Processes Process definition proctype <name> (<parameters>){ < body> Process execution initialize in init: init{ declare as active: two running instances of switch() run light(); run switch(); run switch() active proctype light(){... 17

18 Branching Example: if :: (counter < x) -> counter++; :: (counter >= x) -> printf( Done ) fi Non-deterministic choice if multiple guards hold: if :: (counter < x+4) -> counter++; :: (counter >= x-3) -> printf( Done ) fi else branch is taken if no other option is executable: if :: (counter < x) -> counter++; :: else -> printf( Done ) fi 18

19 Labels and Jumps Example: proctype sum(byte x){ int s, counter; printf("calculating sum from 0 to %d\n",x); AGAIN: counter++; s = s + counter; if :: (counter < x) -> goto AGAIN :: (counter >= x) -> goto DONE fi; printf("this text will not be printed.\n"); DONE: printf("the sum from 0 to %d is %d\n", x, s); 19

20 Loops do loops with different alternative options Non-deterministic choice if multiple guards hold: proctype sum(byte x){ int s, counter; printf("calculating sum from 0 to %d\n", x); do :: (counter > 2 & counter <= x) -> s = s + counter; counter++ :: (counter < 4 & counter <= x-1) -> s = s + counter + counter + 1; counter = counter + 2 :: (counter > x) -> break; od; printf("the sum from 0 to %d is %d\n", x, s); 20

21 Communication via Channels Channel declaration chan <name> = [<length>] of {<type1>,...,<typen> For example: chan intqueue = [5] of {int chan bb = [0] of {byte, byte //asynchronous //synchronous mtypes: symbolic names of numeric constants mtype = {press, hold; chan c = [0] of { mtype ; 21

22 Communication via Channels Channels are FIFO queues proc A proc B Receiver has to wait when channel is empty Sender has to wait when channel is full or messages are lost (depends on settings of Spin) Functions on channels len(c) empty(c) nempty(c) full(c) nfull(c) // number of messages in c // is channel empty? // is channel not empty? // is channel full? // is channel not full? 22

23 Communication via Channels Sending and receiving chan bb = [5] of {byte, byte; active proctype A(){ byte x, y; bb?x,y; printf("x is %d, y is %d\n", x, y); if :: bb?x,4 -> printf("x is %d\n", x) :: bb?3,y -> printf("y is %d\n", y) fi; active proctype B(){ byte x = 2; bb!x,5; bb!x+1,x*2 conditional receiving receiving and assigning the message values to (local) variables printf, printing values of decimal variables (%d) if block with different choices. non-determinism if multiple choices valid sending values over a channel ; and -> are statement separators (same meaning) 23

24 Example: Light Switch mtype = {press, hold; chan c = [0] of { mtype ; active proctype switch(){ RELEASED: if :: c!press; goto PRESSED fi; PRESSED: if :: c!hold; goto PRESSED :: goto RELEASED fi; (this is a possible pattern to model state machines in Promela) active proctype light(){ OFF: if :: c?press; goto LOW fi; LOW: if :: c?press; goto OFF :: c?hold; goto HIGH fi; HIGH: if :: c?press; goto OFF :: c?hold; goto LOW fi; 24

25 Simulating the Light Switch 25

26 Atomic Sequences Sequences of statements that will not be interleaved with statements in other processes (unless there is synchronous communication involved...) Example: active proctype TableSensor(){ do :: atomic{ blankontable = true; ts2c!blankarrived; od 27

27 Verification Options with Spin Spin supports a number of verification options check assertions find invalid end states (deadlocks) check liveness (progress conditions, similar to LTSA) check traces assertions: assertions on the order of sendings and receivings of messages check never claims: sequence of Boolean expressions over variables in the model that must never happen check LTL formulae 28

28 Spin Models and Kripke Structures A Spin model can be translated to a Kripke Structure data types, channels, max. no. of processes is finite Spin can do an exhaustive analysis of the corresponding KS Spin constructs KS on-the-fly, i.e., sometimes it finds results without constructing the complete KS 1 byte x, y; 2 active proctype mini(){ 3 do 4 :: (x < 2) -> 5 x++ 6 :: (y < 2) -> 7 y++ 8 :: else -> 9 break 10 od 11 (_, 3, 0, 0) x<2 y<2 (0, 5, 0, 0) (0, 7, 0, 0) x++ y++ (0, 3, 1, 0) (0, 3, 0, 1)... x<2 y<2 (0, 5, 0, 1)... (0, 7, 0, 1)... 29

29 Spin Models and Kripke Structures There can be multiple paths to the same state (0, 7, 1, 1) (0, 5, 0, 2) (0, 3, 1, 2) Equal states must also be the same states! How? Roughly, Spin uses a Hash table to store and lookup states: Hash value (0, 7, 1, 1) (0, 5, 0, 2) (0, 3, 1, 0) (0, 3, 1, 2) (0, 3, 0, 1) 30

30 Spin Verification more Technically... 1 byte x, y; 2 active proctype mini(){ 3 do 4 :: (x < 2) -> 5 x++ 6 :: (y < 2) -> 7 y++ 8 :: else -> 9 break 10 od 11 Promela model C program Output -4:-4:-4 1:1:17 2:1:23 3:0:0 4:1:17 5:0:4 6:1:21 7:1:23 Spin settings Error Trace 31

31 ... #define trainoncrossing 3 #define caroncrossing 2... Assertions active proctype train(){ byte state;... active proctype car(){ byte state;... during the exhaustive state space exploration during model checking, all possible interleavings of the other processes and executing this assertion will be checked when is this assertion executed? active proctype Inv(){ assert(!(train:state == trainoncrossing && car:state == caroncrossing)) 32

32 Never Claim Sequence of Boolean expressions over variables in the model that must never happen Simple example: byte x = 3; active proctype P(){ x = 1; never{ x == 3; x == 1 33

33 Never Claim... active proctype light(){ OFF: if :: c?press; goto LOW fi; LOW: if :: c?press; goto OFF :: c?hold; goto HIGH fi; HIGH: if :: c?press; goto OFF :: c?hold; goto LOW fi; never { true; light@low; true; light@high; 34

34 Verify LTL Properties mtype = {press, hold; chan c = [0] of { mtype ; active proctype switch(){ RELEASED: if :: c!press; goto PRESSED fi; PRESSED: if :: c!hold; goto PRESSED :: goto RELEASED fi; [] stands for G (always), <> stands for F (eventually),! is active proctype light(){ OFF: if :: c?press; goto LOW fi; LOW: if :: c?press; goto OFF :: c?hold; goto HIGH fi; HIGH: if :: c?press; goto OFF :: c?hold; goto LOW fi; ltl p0 {[]<> light@low ltl p1 {[]<> light@high 35

35 Simple Production Cell Simplified Production Cell example: Just one arm, no press <Demo> blanks leave system on deposit belt Arm Controller blanks enter system on feed belt TableSensor 36

36 Summary Equivalences of LTL properties Characterizing safety and liveness properties Introduction to Promela: Variables and types, processes Branching and loops, labels and jumps Synchronous and asynchronous channels Atomic sequences Verification with Spin different options assertions never claims LTL formulae 37

Computer Aided Verification 2015 The SPIN model checker

Computer Aided Verification 2015 The SPIN model checker Computer Aided Verification 2015 The SPIN model checker Grigory Fedyukovich Universita della Svizzera Italiana March 11, 2015 Material borrowed from Roberto Bruttomesso Outline 1 Introduction 2 PROcess

More information

The SPIN Model Checker

The SPIN Model Checker The SPIN Model Checker Metodi di Verifica del Software Andrea Corradini Lezione 1 2013 Slides liberamente adattate da Logic Model Checking, per gentile concessione di Gerard J. Holzmann http://spinroot.com/spin/doc/course/

More information

Applications of Formal Verification

Applications of Formal Verification Applications of Formal Verification Model Checking: Introduction to PROMELA Prof. Dr. Bernhard Beckert Dr. Vladimir Klebanov SS 2012 KIT INSTITUT FÜR THEORETISCHE INFORMATIK KIT University of the State

More information

Copyright 2008 CS655 System Modeling and Analysis. Korea Advanced Institute of Science and Technology

Copyright 2008 CS655 System Modeling and Analysis. Korea Advanced Institute of Science and Technology The Spin Model Checker : Part I Copyright 2008 CS655 System Korea Advanced Institute of Science and Technology System Spec. In Promela Req. Spec. In LTL Overview of the Spin Architecture Spin Model pan.c

More information

Applications of Formal Verification

Applications of Formal Verification Applications of Formal Verification Model Checking: Introduction to PROMELA Prof. Dr. Bernhard Beckert Dr. Vladimir Klebanov SS 2010 KIT INSTITUT FÜR THEORETISCHE INFORMATIK KIT University of the State

More information

Computer Lab 1: Model Checking and Logic Synthesis using Spin (lab)

Computer Lab 1: Model Checking and Logic Synthesis using Spin (lab) Computer Lab 1: Model Checking and Logic Synthesis using Spin (lab) Richard M. Murray Nok Wongpiromsarn Ufuk Topcu Calornia Institute of Technology AFRL, 25 April 2012 Outline Spin model checker: modeling

More information

Formal Specification and Verification

Formal Specification and Verification Formal Specification and Verification Introduction to Promela Bernhard Beckert Based on a lecture by Wolfgang Ahrendt and Reiner Hähnle at Chalmers University, Göteborg Formal Specification and Verification:

More information

Software Engineering using Formal Methods

Software Engineering using Formal Methods Software Engineering using Formal Methods Introduction to Promela Wolfgang Ahrendt 03 September 2015 SEFM: Promela /GU 150903 1 / 36 Towards Model Checking System Model Promela Program byte n = 0; active

More information

Software Engineering using Formal Methods

Software Engineering using Formal Methods Software Engineering using Formal Methods Introduction to Promela Wolfgang Ahrendt & Richard Bubel & Reiner Hähnle & Wojciech Mostowski 31 August 2011 SEFM: Promela /GU 110831 1 / 35 Towards Model Checking

More information

Spin: Overview of PROMELA

Spin: Overview of PROMELA Spin: Overview of PROMELA Patrick Trentin patrick.trentin@unitn.it http://disi.unitn.it/~trentin Formal Methods Lab Class, Mar 04, 2016 These slides are derived from those by Stefano Tonetta, Alberto Griggio,

More information

Applications of Formal Verification

Applications of Formal Verification Applications of Formal Verification Model Checking: Introduction to PROMELA Bernhard Beckert Mattias Ulbrich SS 2017 KIT INSTITUT FÜR THEORETISCHE INFORMATIK KIT University of the State of Baden-Württemberg

More information

The Spin Model Checker : Part I/II

The Spin Model Checker : Part I/II The Spin Model Checker : Part I/II Moonzoo Kim CS Dept. KAIST Korea Advanced Institute of Science and Technology Motivation: Tragic Accidents Caused by SW Bugs 2 Cost of Software Errors June 2002 Software

More information

Tool demonstration: Spin

Tool demonstration: Spin Tool demonstration: Spin 1 Spin Spin is a model checker which implements the LTL model-checking procedure described previously (and much more besides). Developed by Gerard Holzmann of Bell Labs Has won

More information

Spin: Overview of PROMELA

Spin: Overview of PROMELA Spin: Overview of PROMELA Patrick Trentin patrick.trentin@unitn.it http://disi.unitn.it/trentin Formal Methods Lab Class, March 10, 2017 These slides are derived from those by Stefano Tonetta, Alberto

More information

Network Protocol Design and Evaluation

Network Protocol Design and Evaluation Network Protocol Design and Evaluation 05 - Validation, Part I Stefan Rührup Summer 2009 Overview In the last lectures: Specification of protocols and data/message formats In this chapter: Building a validation

More information

CS477 Formal Software Development Methods / 39

CS477 Formal Software Development Methods / 39 CS477 Formal Software Development Methods 2112 SC, UIUC egunter@illinois.edu http://courses.engr.illinois.edu/cs477 SPIN Beginners Tutorial April 11, 2018 Hello World /* A "Hello World" Promela model for

More information

Computer Lab 1: Model Checking and Logic Synthesis using Spin (lab)

Computer Lab 1: Model Checking and Logic Synthesis using Spin (lab) Computer Lab 1: Model Checking and Logic Synthesis using Spin (lab) Richard M. Murray Nok Wongpiromsarn Ufuk Topcu California Institute of Technology EECI 19 Mar 2013 Outline Spin model checker: modeling

More information

Multi-Threaded System int x, y, r; int *p, *q, *z; int **a; EEC 421/521: Software Engineering. Thread Interleaving SPIN. Model Checking using SPIN

Multi-Threaded System int x, y, r; int *p, *q, *z; int **a; EEC 421/521: Software Engineering. Thread Interleaving SPIN. Model Checking using SPIN EEC 421/521: Software Engineering Model Checking using SPIN 4/29/08 EEC 421/521: Software Engineering 1 Multi-Threaded System int x, y, r; int *p, *q, *z; int **a; thread_1(void) /* initialize p, q, and

More information

4/6/2011. Model Checking. Encoding test specifications. Model Checking. Encoding test specifications. Model Checking CS 4271

4/6/2011. Model Checking. Encoding test specifications. Model Checking. Encoding test specifications. Model Checking CS 4271 Mel Checking LTL Property System Mel Mel Checking CS 4271 Mel Checking OR Abhik Roychoudhury http://www.comp.nus.edu.sg/~abhik Yes No, with Counter-example trace 2 Recap: Mel Checking for mel-based testing

More information

Distributed Systems Programming (F21DS1) SPIN: Formal Analysis I

Distributed Systems Programming (F21DS1) SPIN: Formal Analysis I Distributed Systems Programming (F21DS1) SPIN: Formal Analysis I Andrew Ireland Department of Computer Science School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh Overview Introduce

More information

Lecture 3 SPIN and Promela

Lecture 3 SPIN and Promela Lecture 3 SPIN and Promela 1 What is SPIN(Simple Promela INterpreter) A tool for analyzing mels of concurrent systems Mels described in Promela Language with concurrent processes Communication via shared

More information

A Tutorial on Model Checker SPIN

A Tutorial on Model Checker SPIN A Tutorial on Model Checker SPIN Instructor: Hao Zheng Department of Computer Science and Engineering University of South Florida Tampa, FL 33620 Email: haozheng@usf.edu Phone: (813)974-4757 Fax: (813)974-5456

More information

The Spin Model Checker : Part I. Moonzoo Kim KAIST

The Spin Model Checker : Part I. Moonzoo Kim KAIST The Spin Model Checker : Part I Moonzoo Kim KAIST Hierarchy of SW Coverage Criteria Complete Value Coverage CVC (SW) Model checking Complete Path Coverage CPC Concolic testing All-DU-Paths Coverage ADUP

More information

THE MODEL CHECKER SPIN

THE MODEL CHECKER SPIN THE MODEL CHECKER SPIN Shin Hong, KAIST 17 th April,2007 1/33 Contents Introduction PROMELA Linear Temporal Logic Automata-theoretic software verification Example : Simple Elevator 2 SPIN is a software

More information

Promela and SPIN. Mads Dam Dept. Microelectronics and Information Technology Royal Institute of Technology, KTH. Promela and SPIN

Promela and SPIN. Mads Dam Dept. Microelectronics and Information Technology Royal Institute of Technology, KTH. Promela and SPIN Promela and SPIN Mads Dam Dept. Microelectronics and Information Technology Royal Institute of Technology, KTH Promela and SPIN Promela (Protocol Meta Language): Language for modelling discrete, event-driven

More information

Formal Methods for Software Development

Formal Methods for Software Development Formal Methods for Software Development Model Checking with Temporal Logic Wolfgang Ahrendt 21st September 2018 FMSD: Model Checking with Temporal Logic /GU 180921 1 / 37 Model Checking Check whether a

More information

SPIN. Carla Ferreira.

SPIN. Carla Ferreira. SPIN Carla Ferreira http://www.spinroot.com/spin/man/intro.html Introduction PROMELA (PROcess MEta LAnguage) is the input language of SPIN (Simple Promela Interpreter) Inspired by: C and CSP Describes

More information

Model checking Timber program. Paweł Pietrzak

Model checking Timber program. Paweł Pietrzak Model checking Timber program Paweł Pietrzak 1 Outline Background on model checking (spam?) The SPIN model checker An exercise in SPIN - model checking Timber Deriving finite models from Timber programs

More information

SPIN: Part /614 Bug Catching: Automated Program Verification. Sagar Chaki November 12, Carnegie Mellon University

SPIN: Part /614 Bug Catching: Automated Program Verification. Sagar Chaki November 12, Carnegie Mellon University SPIN: Part 1 15-414/614 Bug Catching: Automated Program Verification Sagar Chaki November 12, 2012 What is This All About? Spin On-the-fly verifier developed at Bell-labs by Gerard Holzmann and others

More information

Automated Reasoning. Model Checking with SPIN (II)

Automated Reasoning. Model Checking with SPIN (II) Automated Reasoning Model Checking with SPIN (II) Alan Bundy page 1 Verifying Global Properties Assertions can be used to verify a property locally For example, place assert(memreturned) at the end of

More information

SPIN: Introduction and Examples

SPIN: Introduction and Examples SPIN: Introduction and Examples Alessandra Giordani agiordani@disi.unitn.it http://disi.unitn.it/~agiordani Formal Methods Lab Class, September 28, 2014 *These slides are derived from those by Stefano

More information

CS477 Formal Software Development Methods / 32

CS477 Formal Software Development Methods / 32 CS477 Formal Software Development Methods 2112 SC, UIUC egunter@illinois.edu http://courses.engr.illinois.edu/cs477 SPIN Beginners Tutorial April 13, 2018 Assertion Violation: mutextwrong1.pml bit flag;

More information

Formal Specification and Verification

Formal Specification and Verification Formal Specification and Verification Model Checking with Temporal Logic Bernhard Beckert Based on a lecture by Wolfgang Ahrendt and Reiner Hähnle at Chalmers University, Göteborg Formal Specification

More information

Model Requirements and JAVA Programs MVP 2 1

Model Requirements and JAVA Programs MVP 2 1 Model Requirements and JAVA Programs MVP 2 1 Traditional Software The Waterfall Model Problem Area Development Analysis REVIEWS Design Implementation Costly wrt time and money. Errors are found too late

More information

Patrick Trentin Formal Methods Lab Class, March 03, 2017

Patrick Trentin  Formal Methods Lab Class, March 03, 2017 Spin: Introduction Patrick Trentin patrick.trentin@unitn.it http://disi.unitn.it/trentin Formal Methods Lab Class, March 03, 2017 These slides are derived from those by Stefano Tonetta, Alberto Griggio,

More information

T Parallel and Distributed Systems (4 ECTS)

T Parallel and Distributed Systems (4 ECTS) T 79.4301 Parallel and Distributed Systems (4 ECTS) T 79.4301 Rinnakkaiset ja hajautetut järjestelmät (4 op) Lecture 3 4th of February 2008 Keijo Heljanko Keijo.Heljanko@tkk.fi T 79.4301 Parallel and Distributed

More information

Model-Checking Concurrent Systems. The Model Checker Spin. The Model Checker Spin. Wolfgang Schreiner

Model-Checking Concurrent Systems. The Model Checker Spin. The Model Checker Spin. Wolfgang Schreiner Model-Checking Concurrent Systems Wolfgang Schreiner Wolfgang.Schreiner@risc.jku.at Research Institute for Symbolic Computation (RISC) Johannes Kepler University, Linz, Austria http://www.risc.jku.at 1.

More information

What is SPIN(Simple Promela Interpreter) Elements of Promela. Material About SPIN. Basic Variables and Types. Typical Structure of Promela Model

What is SPIN(Simple Promela Interpreter) Elements of Promela. Material About SPIN. Basic Variables and Types. Typical Structure of Promela Model What is SPIN(Simple Promela Interpreter) Lecture XX SPIN and Promela A tool for analyzing mels of reactive systems Mels described in Promela Language with concurrent processes, Communication via channels,

More information

What is SPIN(Simple Promela Interpreter) Material About SPIN. Elements of Promela. Basic Variables and Types. Typical Structure of Promela Model

What is SPIN(Simple Promela Interpreter) Material About SPIN. Elements of Promela. Basic Variables and Types. Typical Structure of Promela Model What is SPIN(Simple Promela Interpreter) Lecture 3 SPIN and Promela A tool for analyzing mels of reactive systems Mels described in Promela Language with concurrent processes, Communication via channels,

More information

INF5140: Specification and Verification of Parallel Systems

INF5140: Specification and Verification of Parallel Systems INF5140: Specification and Verification of Parallel Systems Lecture 09 Defining Correctness Claims Gerar Schneider Department of Informatics University of Oslo INF5140, Spring 2007 Gerar Schneider (Ifi,

More information

The SPIN Model Checker

The SPIN Model Checker The SPIN Model Checker Metodi di Verifica del Software Andrea Corradini GianLuigi Ferrari Lezione 3 2011 Slides per gentile concessione di Gerard J. Holzmann 2 the do-statement do :: guard 1 -> stmnt 1.1

More information

Distributed Systems Programming (F21DS1) SPIN: Formal Analysis II

Distributed Systems Programming (F21DS1) SPIN: Formal Analysis II Distributed Systems Programming (F21DS1) SPIN: Formal Analysis II Andrew Ireland Department of Computer Science School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh Overview Introduce

More information

System Correctness. EEC 421/521: Software Engineering. System Correctness. The Problem at Hand. A system is correct when it meets its requirements

System Correctness. EEC 421/521: Software Engineering. System Correctness. The Problem at Hand. A system is correct when it meets its requirements System Correctness EEC 421/521: Software Engineering A Whirlwind Intro to Software Model Checking A system is correct when it meets its requirements a design without requirements cannot be right or wrong,

More information

INF672 Protocol Safety and Verification. Karthik Bhargavan Xavier Rival Thomas Clausen

INF672 Protocol Safety and Verification. Karthik Bhargavan Xavier Rival Thomas Clausen INF672 Protocol Safety and Verication Karthik Bhargavan Xavier Rival Thomas Clausen 1 Course Outline Lecture 1 [Today, Sep 15] Introduction, Motivating Examples Lectures 2-4 [Sep 22,29, Oct 6] Network

More information

Formal Verification by Model Checking

Formal Verification by Model Checking Formal Verication by Model Checking Jonathan Aldrich Carnegie Mellon University Based on slides developed by Natasha Sharygina 17-654/17-754: Analysis of Software Artacts Spring 2006 1 CTL Model Checking

More information

Logic Model Checking

Logic Model Checking Logic Model Checking Lecture Notes 14:18 Caltech 118 January-March 2006 Course Text: The Spin Model Checker: Primer and Reference Manual Addison-Wesley 2003, ISBN 0-321-22862-6, 608 pgs. Logic Model Checking

More information

Model-Checking Concurrent Systems

Model-Checking Concurrent Systems Model-Checking Concurrent Systems Wolfgang Schreiner Wolfgang.Schreiner@risc.jku.at Research Institute for Symbolic Computation (RISC) Johannes Kepler University, Linz, Austria http://www.risc.jku.at Wolfgang

More information

Patrick Trentin Formal Methods Lab Class, Feb 26, 2016

Patrick Trentin  Formal Methods Lab Class, Feb 26, 2016 Spin: Introduction Patrick Trentin patrick.trentin@unitn.it http://disi.unitn.it/~trentin Formal Methods Lab Class, Feb 26, 2016 These slides are derived from those by Stefano Tonetta, Alberto Griggio,

More information

Design of Internet Protocols:

Design of Internet Protocols: CSCI 234 Design of Internet Protocols: George Blankenship George Blankenship 1 Outline Verication and Validation History and motivation Spin Promela language Promela model George Blankenship 2 Verication

More information

Formal Methods for Software Development

Formal Methods for Software Development Formal Methods for Software Development Verification with Spin Wolfgang Ahrendt 07 September 2018 FMSD: Spin /GU 180907 1 / 34 Spin: Previous Lecture vs. This Lecture Previous lecture Spin appeared as

More information

SWEN-220 Mathematical Models of Software. Concurrency in SPIN Interleaving

SWEN-220 Mathematical Models of Software. Concurrency in SPIN Interleaving SWEN-220 Mathematical Models of Software Concurrency in SPIN Interleaving 1 Topics Interleaving Process Interference Race Conditions Atomicity 2 Concurrency Concurrency can come in many flavors Concurrent

More information

MP 6 Modeling in Promela and SPIN

MP 6 Modeling in Promela and SPIN MP 6 Modeling in Promela and SPIN CS 477 Spring 2018 Revision 1.0 Assigned April 23, 2018 Due May 2, 2018, 9:00 PM Extension 48 hours (penalty 20% of total points possible) 1 Change Log 1.0 Initial Release.

More information

Linear Temporal Logic. Model Checking and. Based on slides developed by Natasha Sharygina. Carnegie Mellon University.

Linear Temporal Logic. Model Checking and. Based on slides developed by Natasha Sharygina. Carnegie Mellon University. Model Checking and Linear Temporal Logic Jonathan Aldrich Carnegie Mellon University Based on slides developed by Natasha Sharygina 17-654: Analysis of Software Artifacts 1 Formal Verification by Model

More information

Distributed Systems Programming F29NM1 2. Promela I. Andrew Ireland. School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh

Distributed Systems Programming F29NM1 2. Promela I. Andrew Ireland. School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh Distributed Systems Programming F29NM1 Promela I Andrew Ireland School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh Distributed Systems Programming F29NM1 2 Overview Basic building

More information

Building Graphical Promela Models using UPPAAL GUI

Building Graphical Promela Models using UPPAAL GUI Building Graphical Promela Models using UPPAAL GUI Master s Thesis Report by Vasu Hossaholal Lingegowda Software Systems Engineering Group: B2-201 under the guidance of Dr. Alexandre David Department of

More information

Network Protocol Design and Evaluation

Network Protocol Design and Evaluation Network Protocol Design and Evaluation 05 - Validation, Part III Stefan Rührup Summer 2009 Overview In the first parts of this chapter: Validation models in Promela Defining and checking correctness claims

More information

Using Model Checking with Symbolic Execution for the Verification of Data-Dependent Properties of MPI-Based Parallel Scientific Software

Using Model Checking with Symbolic Execution for the Verification of Data-Dependent Properties of MPI-Based Parallel Scientific Software Using Model Checking with Symbolic Execution for the Verification of Data-Dependent Properties of MPI-Based Parallel Scientific Software Anastasia Mironova Problem It is hard to create correct parallel

More information

FORMAL METHODS IN NETWORKING COMPUTER SCIENCE 598D, SPRING 2010 PRINCETON UNIVERSITY LIGHTWEIGHT MODELING IN PROMELA/SPIN AND ALLOY

FORMAL METHODS IN NETWORKING COMPUTER SCIENCE 598D, SPRING 2010 PRINCETON UNIVERSITY LIGHTWEIGHT MODELING IN PROMELA/SPIN AND ALLOY FORMAL METHODS IN NETWORKING COMPUTER SCIENCE 598D, SPRING 2010 PRINCETON UNIVERSITY LIGHTWEIGHT MODELING IN PROMELA/SPIN AND ALLOY Pamela Zave AT&T Laboratories Research Florham Park, New Jersey, USA

More information

Distributed Systems Programming (F21DS1) SPIN: Simple Promela INterpreter

Distributed Systems Programming (F21DS1) SPIN: Simple Promela INterpreter Distributed Systems Programming (F21DS1) SPIN: Simple Promela INterpreter Andrew Ireland Department of Computer Science School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh Overview

More information

SPIN, PETERSON AND BAKERY LOCKS

SPIN, PETERSON AND BAKERY LOCKS Concurrent Programs reasoning about their execution proving correctness start by considering execution sequences CS4021/4521 2018 jones@scss.tcd.ie School of Computer Science and Statistics, Trinity College

More information

SPIN part 2. Verification with LTL. Jaime Ramos. Departamento de Matemática, Técnico, ULisboa

SPIN part 2. Verification with LTL. Jaime Ramos. Departamento de Matemática, Técnico, ULisboa SPIN part 2 Verification with LTL Jaime Ramos Departamento de Matemática, Técnico, ULisboa Borrowed from slides by David Henriques, Técnico, ULisboa LTL model checking How Spin works Checks non-empty intersection

More information

Application of Formal Verification to Software Security

Application of Formal Verification to Software Security Application of Formal Verification to Software Security Reynald Affeldt David Nowak AIST-RCIS, Japan TWISC Summer School 2006 Verification of Security Properties of Software Generally speaking, Software

More information

COMP 763. Eugene Syriani. Ph.D. Student in the Modelling, Simulation and Design Lab School of Computer Science. McGill University

COMP 763. Eugene Syriani. Ph.D. Student in the Modelling, Simulation and Design Lab School of Computer Science. McGill University Eugene Syriani Ph.D. Student in the Modelling, Simulation and Design Lab School of Computer Science McGill University 1 OVERVIEW In the context In Theory: Timed Automata The language: Definitions and Semantics

More information

LTL Reasoning: How It Works

LTL Reasoning: How It Works Distributed Systems rogramming F21DS1 LTL Reasoning: How It Works Andrew Ireland School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh Distributed Systems rogramming F21DS1 2 Overview

More information

Hello World. Slides mostly a reproduction of Theo C. Ruys SPIN Beginners Tutorial April 23, Hello() print "Hello"

Hello World. Slides mostly a reproduction of Theo C. Ruys SPIN Beginners Tutorial April 23, Hello() print Hello Hello World CS477 Formal Software Development Methods 11 SC, UIUC egunter@illinois.edu http://courses.engr.illinois.edu/cs477 inners April 3, 014 /* A "Hello World" Promela model for SPIN. */ active Hello()

More information

FORMAL METHODS IN NETWORKING COMPUTER SCIENCE 598D, SPRING 2010 PRINCETON UNIVERSITY LIGHTWEIGHT MODELING IN PROMELA/SPIN AND ALLOY

FORMAL METHODS IN NETWORKING COMPUTER SCIENCE 598D, SPRING 2010 PRINCETON UNIVERSITY LIGHTWEIGHT MODELING IN PROMELA/SPIN AND ALLOY FORMAL METHODS IN NETWORKING COMPUTER SCIENCE 598D, SPRING 2010 PRINCETON UNIVERSITY LIGHTWEIGHT MODELING IN PROMELA/SPIN AND ALLOY Pamela Zave AT&T Laboratories Research Florham Park, New Jersey, USA

More information

Formal Analysis and Verification of a Communication Protocol

Formal Analysis and Verification of a Communication Protocol Proceedings of the 5th WSEAS Int. Conference on Information Security and Privacy, Venice, Italy, November 20-22, 2006 103 Formal Analysis and Verification of a Communication Protocol XIN BEN LI, DE CHAO

More information

Model Checking with Automata An Overview

Model Checking with Automata An Overview Model Checking with Automata An Overview Vanessa D Carson Control and Dynamical Systems, Caltech Doyle Group Presentation, 05/02/2008 VC 1 Contents Motivation Overview Software Verification Techniques

More information

Introduction to Model Checking

Introduction to Model Checking Introduction to Model Checking René Thiemann Institute of Computer Science University of Innsbruck WS 2007/2008 RT (ICS @ UIBK) week 4 1/23 Outline Promela - Syntax and Intuitive Meaning Promela - Formal

More information

Temporal Logic and Timed Automata

Temporal Logic and Timed Automata Information Systems Analysis Temporal Logic and Timed Automata (5) UPPAAL timed automata Paweł Głuchowski, Wrocław University of Technology version 2.3 Contents of the lecture Tools for automatic verification

More information

SWEN-220 Mathematical Models of Software. Process Synchronization Critical Section & Semaphores

SWEN-220 Mathematical Models of Software. Process Synchronization Critical Section & Semaphores SWEN-220 Mathematical Models of Software Process Synchronization Critical Section & Semaphores 1 Topics The critical section Synchronization using busy-wait Semaphores 2 The Critical Section Processes

More information

A Verification Approach for GALS Integration of Synchronous Components

A Verification Approach for GALS Integration of Synchronous Components GALS 2005 Preliminary Version A Verification Approach for GALS Integration of Synchronous Components F. Doucet, M. Menarini, I. H. Krüger and R. Gupta 1 Computer Science and Engineering University of California,

More information

Design for Verification for Asynchronously Communicating Web Services

Design for Verification for Asynchronously Communicating Web Services Design for Verification for Asynchronously Communicating Web Services Aysu Betin-Can Computer Science Department University of California Santa Barbara, CA 93106, USA aysu@cs.ucsb.edu Tevfik Bultan Computer

More information

Blocking Non-blocking Caveat:

Blocking Non-blocking Caveat: Overview of Lecture 5 1 Progress Properties 2 Blocking The Art of Multiprocessor Programming. Maurice Herlihy and Nir Shavit. Morgan Kaufmann, 2008. Deadlock-free: some thread trying to get the lock eventually

More information

Lectures 20, 21: Axiomatic Semantics

Lectures 20, 21: Axiomatic Semantics Lectures 20, 21: Axiomatic Semantics Polyvios Pratikakis Computer Science Department, University of Crete Type Systems and Static Analysis Based on slides by George Necula Pratikakis (CSD) Axiomatic Semantics

More information

Formal Methods in Software Engineering. Lecture 07

Formal Methods in Software Engineering. Lecture 07 Formal Methods in Software Engineering Lecture 07 What is Temporal Logic? Objective: We describe temporal aspects of formal methods to model and specify concurrent systems and verify their correctness

More information

Proving Dekker with SPIN and PROMELA

Proving Dekker with SPIN and PROMELA 15-410...fairness disabled... Proving Dekker with SPIN and PROMELA Joshua Wise With help from Greg Hartman L36_SPIN 1 Synchronization Project 4 due Wednesday Everyone having fun? Kernel interviews If you

More information

Cyber Physical System Verification with SAL

Cyber Physical System Verification with SAL Cyber Physical System Verification with July 22, 2013 Cyber Physical System Verification with Outline 1 2 3 4 5 Cyber Physical System Verification with Table of Contents 1 2 3 4 5 Cyber Physical System

More information

The Design of a Distributed Model Checking Algorithm for Spin

The Design of a Distributed Model Checking Algorithm for Spin The Design of a Distributed Model Checking Algorithm for Spin Gerard J. Holzmann http://eis.jpl.nasa.gov/lars http://spinroot.com/gerard/ Presented at FMCAD 2006, San Jose, California November 14, 2006

More information

Temporal Logic of Actions (TLA) (a brief introduction) Shmuel Katz Computer Science Department The Technion

Temporal Logic of Actions (TLA) (a brief introduction) Shmuel Katz Computer Science Department The Technion Temporal Logic of Actions (TLA) (a brief introduction) Shmuel Katz Computer Science Department The Technion CS236368 Formal Specifications Lecture-- TLA 1 Basic Idea Combine transitions with temporal logic

More information

EECS 144/244: Fundamental Algorithms for System Modeling, Analysis, and Optimization

EECS 144/244: Fundamental Algorithms for System Modeling, Analysis, and Optimization EECS 144/244: Fundamental Algorithms for System Modeling, Analysis, and Optimization Dataflow Lecture: SDF, Kahn Process Networks Stavros Tripakis University of California, Berkeley Stavros Tripakis: EECS

More information

T Reactive Systems: Kripke Structures and Automata

T Reactive Systems: Kripke Structures and Automata Tik-79.186 Reactive Systems 1 T-79.186 Reactive Systems: Kripke Structures and Automata Spring 2005, Lecture 3 January 31, 2005 Tik-79.186 Reactive Systems 2 Properties of systems invariants: the system

More information

CSE 153 Design of Operating Systems

CSE 153 Design of Operating Systems CSE 153 Design of Operating Systems Winter 19 Lecture 7/8: Synchronization (1) Administrivia How is Lab going? Be prepared with questions for this weeks Lab My impression from TAs is that you are on track

More information

Deterministic Concurrency

Deterministic Concurrency Candidacy Exam p. 1/35 Deterministic Concurrency Candidacy Exam Nalini Vasudevan Columbia University Motivation Candidacy Exam p. 2/35 Candidacy Exam p. 3/35 Why Parallelism? Past Vs. Future Power wall:

More information

CIS 4930/6930: Principles of Cyber-Physical Systems

CIS 4930/6930: Principles of Cyber-Physical Systems CIS 4930/6930: Principles of Cyber-Physical Systems Homework Solutions Hao Zheng Department of Computer Science and Engineering University of South Florida H. Zheng (CSE USF) CIS 4930/6930: Principles

More information

Lecture1: Symbolic Model Checking with BDDs. Edmund M. Clarke, Jr. Computer Science Department Carnegie Mellon University Pittsburgh, PA 15213

Lecture1: Symbolic Model Checking with BDDs. Edmund M. Clarke, Jr. Computer Science Department Carnegie Mellon University Pittsburgh, PA 15213 Lecture: Symbolic Model Checking with BDDs Edmund M Clarke, Jr Computer Science Department Carnegie Mellon University Pittsburgh, PA 523 Temporal Logic Model Checking Specification Language: A propositional

More information

Analysis of Interacting BPEL Web Services

Analysis of Interacting BPEL Web Services Analysis of Interacting BPEL Web Services Xiang Fu fuxiang@cs.ucsb.edu Tevfik Bultan bultan@cs.ucsb.edu Department of Computer Science University of California Santa Barbara, CA 93106-5110 Jianwen Su su@cs.ucsb.edu

More information

SimGrid MC 101. Getting Started with the SimGrid Model-Checker. Da SimGrid Team. April 11, 2017

SimGrid MC 101. Getting Started with the SimGrid Model-Checker. Da SimGrid Team. April 11, 2017 SimGrid MC 101 Getting Started with the SimGrid Model-Checker Da SimGrid Team April 11, 2017 About this Presentation Goals and Contents Understanding the basics of Model checking Running SimGrid as a Model

More information

TRIAL-EXAM Software Engineering using Formal Methods TDA293 (TDA292) / DIT270. Only dictionaries may be used. Other aids are not allowed!

TRIAL-EXAM Software Engineering using Formal Methods TDA293 (TDA292) / DIT270. Only dictionaries may be used. Other aids are not allowed! TRIAL-EXAM Software Engineering using Formal Methods TDA293 (TDA292) / DIT270 Extra aid: Only dictionaries may be used. Other aids are not allowed! Please observe the following: This exam has 14 numbered

More information

TLA+ TLC. Rui Fan Stanislav Funiac Mandana Vaziri. Presented by Spring 2001

TLA+ TLC. Rui Fan Stanislav Funiac Mandana Vaziri. Presented by Spring 2001 TLA+ TLC Presented by Rui Fan Stanislav Funiac Mandana Vaziri 6.897 Spring 2001 Outline Overview of TLA/TLA+ Subset of TLA+ supported by TLC Alternating Bit Protocol example Model checking Demo L. Lamport,

More information

Software Model Checking: Theory and Practice

Software Model Checking: Theory and Practice Software Model Checking: Theory and Practice Lecture: Specification Checking - Specification Patterns Copyright 2004, Matt Dwyer, John Hatcliff, and Robby. The syllabus and all lectures for this course

More information

Synchronization: Semaphores

Synchronization: Semaphores Illinois Institute of Technology Lecture 26 4/25 solved Synchronization: Semaphores CS 536: Science of Programming, Spring 2018 A. Why Avoiding interference, while good, isn t the same as coordinating

More information

Formal Modeling for Persistence Checking of Signal Transition Graph Specification with Promela

Formal Modeling for Persistence Checking of Signal Transition Graph Specification with Promela , March 15-17, 2017, Hong Kong Formal Modeling for Persistence Checking of Signal Transition Graph Specification with Promela Kanut Boonroeangkaow, Arthit Thongtak and Wiwat Vatanawood Abstract Signal

More information

Symbolic Trajectory Evaluation - A Survey

Symbolic Trajectory Evaluation - A Survey Automated Verification Symbolic Trajectory Evaluation - A Survey by Mihaela Gheorghiu Department of Computer Science University of Toronto Instructor: Prof. Marsha Chechik January 3, 24 Motivation Simulation

More information

Behavioural Equivalences and Abstraction Techniques. Natalia Sidorova

Behavioural Equivalences and Abstraction Techniques. Natalia Sidorova Behavioural Equivalences and Abstraction Techniques Natalia Sidorova Part 1: Behavioural Equivalences p. p. The elevator example once more How to compare this elevator model with some other? The cabin

More information

Mapping of UML Diagrams to Extended Petri Nets for Formal Verification

Mapping of UML Diagrams to Extended Petri Nets for Formal Verification Grand Valley State University ScholarWorks@GVSU Masters Theses Graduate Research and Creative Practice 8-2013 Mapping of UML Diagrams to Exted Petri Nets for Formal Verification Byron DeVries Grand Valley

More information

Towards Promela verification using VerICS

Towards Promela verification using VerICS Part 2: Specification Towards Promela verification using VerICS Wojciech Nabia lek 1 and Pawe l Janowski 2 1 Institute of Computer Science, University of Podlasie ul. Sienkiewicza 51, 08-110 Siedlce, Poland

More information

Java PathFinder JPF 2 Second Generation of Java Model Checker

Java PathFinder JPF 2 Second Generation of Java Model Checker Java PathFinder JPF 2 Second Generation of Java Model Checker Guenther Brand Mat. Nr. 9430535 27. 06. 2003 Abstract This essay is based on the papers Java PathFinder, Second Generation of Java Model Checker

More information

A Simple Tutorial on NuSMV

A Simple Tutorial on NuSMV NuSMV-tutorial 1 A Simple Tutorial on NuSMV Chenyi Zhang March 28, 2007 For a comprehensive tutorial, please visit the site http://nusmv.irst.itc.it/ NuSMV-tutorial 2 Introduction History SMV is the first

More information

Using Spin to Help Teach Concurrent Programming

Using Spin to Help Teach Concurrent Programming Using Spin to Help Teach Concurrent Programming John Regehr May 1, 1998 1 Introduction and Motivation Writing correct concurrent programs is very difficult; race conditions, deadlocks, and livelocks can

More information