SPIN part 2. Verification with LTL. Jaime Ramos. Departamento de Matemática, Técnico, ULisboa

Transcription

1 SPIN part 2 Verification with LTL Jaime Ramos Departamento de Matemática, Técnico, ULisboa Borrowed from slides by David Henriques, Técnico, ULisboa

2 LTL model checking How Spin works Checks non-empty intersection requires very little space in best case Works directly with Promela no explicit conversion to TS Must provide Spin with negation of property you want to prove. jspin does this for you.

3 LTL syntax in Spin ϕ ::= p true false ϕ bin_op ϕ un_op ϕ where p is a proposition (must start with a lower case letter) and un_op ::= [] always (G) <> sometimes (F) X next (X)! not ( ) bin_op ::= U until (U) && and ( ) or ( ) -> implication ( ) <-> equivalence ( )

4 Verifying safety properties Consider the processes bool wantp = false, wantq = false; byte critical = 0; active proctype P() { do :: wantp = true;!wantq; critical++; critical--; wantp = false; od } active proctype Q() { do :: wantq = true;!wantp; critical++; critical--; wantq = false; od }

5 We want to verify that mutual exclusion is guaranteed, that is, we want to check G (critical <= 1) However, critical<=1 is not a proposition. We can avoid this by defining, at the beginning #define mutex (critial <=1) Now, we can write, in LTL, G (mutex) that translates to Promela [](mutex)

6 In jspin Write the LTL formula in the text field provided. Select Translate. Ensure that Safety is selected from the pulldown menu. Select Verify. In recent versions of Spin, we may write []({critical <= 1}) Note: if your are using the command line then you need to write the negation of the formula you want to proof in a file with the extension.ltl.

7 Verifying liveness properties bool wantp = false, wantq = false, csp = false, csq = false; active proctype P() { do :: wantp = true; do :: wantq -> wantp = false; wantp = true :: else -> break od; csp = true; /* critical section */ csp = false; wantp = false od } active proctype Q() { do :: wantq = true; do :: wantp -> wantq = false; wantq = true :: else -> break od; csq = true; /* critical section */ csq = false; wantq = false od }

8 We can check that mutual exclusion is still preserved: []!(csp && csq) But now, we also want to check liveness properties. For instance, we want to check if process P will eventually enter its critical section. This is expressed by the LTL formula Fcsp that translates to Promela <>(csp)

9 In jspin Write the LTL formula in the text field provided. Select Translate. Ensure that Acceptance is selected from the pulldown menu. Ensure that the box labeled Weak fairness is checked. Select Verify.

10 In this case, the liveness property does not hold. The error message pan:1: acceptance cycle (at depth 18) is issued. A counterexample must be a reachable state within a cycle, falsifying the desired property. (see trail file).

11 Peterson s algorithm bool wantp = false, wantq = false; byte last = 1; active proctype P() { do active proctype Q() { do :: wantp = true; last = 1; :: wantq = true; last = 2; try: (wantq == false) (last == 2); try: (wantp == false) (last == 1); cs: wantp = false cs: wantq = false od } od }

12 Let us consider now some properties: Safety [](!(pcs && qcs)) No starvation Alternation (for process P) []<>(pcs) && []<>(qcs) [](ptry->(!qcs U(qcs U (!qcs U pcs))))

13 Recall the first example. Try to show some liveness properties: Process P will eventually enter its critical section Both processes enter the critical section infinitely often...

14 Bridge crossing Four soldiers who are heavily injured,need to cross a bridge. The bridge has been damaged and can only carry two soldiers at a time. They have only 1 hour to cross the bridge. The soldiers only have a single torch. List of the crossing times (one-way!) for each of the soldiers: soldier S0 5 min soldier S2 15 min soldier S1 10 min soldier S3 20 min Is there a strategy which gets all four soldiers to the safe side within 60 minutes?

15 We are going to use two processes, unsafe and safe to model the unsafe side and the safe side. Soldiers are sent from one side to the other via channels.

16 active proctype unsafe(){ bit here[n]; soldier s1,s2; here[0]=1; here[1]=1; here[2]=1; here[3]=1; } do :: select_soldier(s1); select_soldier(s2); unsafe_to_safe! s1,s2; IF all_gone -> break FI; safe_to_unsafe? s1; here[s1]=1; stopwatch! s1 ; od

17 active proctype safe(){ bit here[n]; soldier s1,s2; } do :: unsafe_to_safe? s1,s2; here[s1]=1; here[s2]=1; stopwatch! max(s1,s2); IF all_here -> break FI; select_soldier(s1) ; safe_to_unsafe!s1 od

18 active proctype timer(){ end: do :: stopwatch? 0 ->atomic{time=time+5 ; STIME} :: stopwatch? 1 ->atomic{time=time+10 ; STIME} :: stopwatch? 2 ->atomic{time=time+15 ; STIME} :: stopwatch? 3 ->atomic{time=time+20 ; STIME} od }

19 Macros #define select_soldier(x) \ if \ :: here[0] -> x=0 \ :: here[1] -> x=1 \ :: here[2] -> x=2 \ :: here[3] -> x=3 \ fi; \ here[x] = 0 #define all_gone (!here[0] &&!here[1] &&!here[2] &&!here[3]) #define all_here (here[0] && here[1] && here[2] && here[3]) #define STIME printf("time:%d\n",time) #define IF if :: #define FI :: else fi #define max(x,y) ((x>y)->x : y)

20 How can we get Spin to search and display a solution for the problem? We would like Spin to generate a trace for us that illustrates a solution where the soldiers can get from the unsafe to the safe side in 60 minutes or less. Spin generates counter-example or property-violation traces. Therefore, we need to ask Spin to try to prove that a solution does not exist. If it finds a counterexample, it will illustrate a solution to the soldiers problem. We express the desired property using LTL The question is: what property do we need to write?

21 We want to see that, no matter what, it is possible to guarantee that the variable time will eventually have a value greater than 60. A counter-example to this will yield a solution to the problem. The property is expressed in LTL by the formula Ftime>60 which translates to Promela <>(outoftime) where #define outoftime time>60

22 In jspin Write the LTL formula in the text field provided <>(outoftime) Select Translate. Ensure that Acceptance is selected from the pulldown menu. Ensure that the box labeled Weak fairness is checked. Select Verify. What happens?

23 Let s try again: In the Options menu, select Verify and add the option -DNOREDUCE Select Verify, again. Afterward, in the command line, write spin -t -M soldiers.pml

24 Traffic controller We want to model a controller for a traffic light at a road intersection, with the following characteristics: the traffic flows either from North to South or from East to West; turning is not allowed; there are sensors in each direction to detected waiting vehicles.

25 We want to verify the following properties: Safety there are no collisions Progress each waiting car eventually gets to go Optimality light only turns green if there is traffic

26 We use three variables: bool traffic[2] there is traffic bool light[2] the light is on bool turn alternation between the two roads The sensors: active proctype sensor0() { do ::!traffic[0] -> traffic[0] = 1 :: else -> skip od } active proctype sensor1() { do ::!traffic[1] -> traffic[1] = 1 :: else -> skip od }

27 The controllers active proctype light0() active proctype light1() { { do do :: (turn == 0) -> :: (turn == 1) -> if if :: traffic[0] -> light[0] = 1; :: traffic[1] -> light[1] = 1; light[0] = 0; light[1] = 0; traffic[0] = 0 traffic[1] = 0 fi; fi; turn = 1 turn = 0 :: else -> skip :: else -> skip od od } }

28 The properties: Safety there are no collisions [](!(light[0] && light[1])) Progress each waiting car eventually gets to go []<>(!(traffic[0]) && []<>(!(traffic[1]) Optimality light only turns green if there is traffic []((!light[0] traffic[0]) && (!light[1] traffic[1]))

29 Timeouts proctype watchdog() { timeout -> printf("...\n") } Is enabled when the entire system is deadlocked and sends a message to a reset process.