What is SPIN(Simple Promela Interpreter) Elements of Promela. Material About SPIN. Basic Variables and Types. Typical Structure of Promela Model
|
|
- Karen Washington
- 6 years ago
- Views:
Transcription
1 What is SPIN(Simple Promela Interpreter) Lecture XX SPIN and Promela A tool for analyzing mels of reactive systems Mels described in Promela Language with concurrent processes, Communication via channels, Analysis by Simulation Mel checking Several optimizations implemented most efcient tool for explicit-state mel checking 1 2 Material About SPIN SPIN Home page Contains manuals, reference material, and tutorial Books about SPIN G.J. Holzmann SPIN MODEL CHECKER Primer and Reference Manual, G.J. Holzmann Design and Validation of Computer Protocols,, Prentice Hall 1991, older book, available on the Internet Elements of Promela Language for dening nite-state transition systems Data types with precisely dened nite mains Bits, integers, arrays, messages Processes, which can be dynamically created Communication via global variables or communication channels Simple control constructs 3 4 ypical Structure of Promela Mel Basic Variables and ypes Promela mel consists of type declarations channel declarations variable declarations process declarations init process mtype = {msg, ack; chan tos = chan tor = bool flag; proctype Sender () { proctype Receiver () { Basic types Array declaration Array access Records type denition Record declaration Record access Enumeration type f. messages bit [0.. 1] bool [0.. 1] byte [ ] short [ ] int [ ] byte anarray[24]; anarray[v] = anarray[3]; typedef Msg{ byte a[3], b; chan p Msg astruct astruct.a[1] mtype = {ack, nak, err, next 5 6
2 Expressions Basic Statements Operators + - * / % ^ > >= < <= ==!=! && & - >> << Expressions Assignments No-Op (y == false x > 9) y = 34 % 3 anarray[0] = anarray[3] * anarray[(v+2)/4] skip Conditional expression (v >= 0 -> v : -v) Goto goto label Operations on channel identers len(qid) empty(qid) full(qid) nempty(qid) nfull(qid) 7 printf Print (only in simulation) All basic statements are either executable (enabled) or blocked (disabled) (of course, depending on values of variables, etc.) Expressions are also statements Blocked evaluated to 0, otherwise executable In this way, expressions/statements can be used as guards 8 Compound Statements Compound Statements (ctd.) Sequential composition Selection test == 1 ; state = state + 1 test == 1 -> state = state + 1 :: (a == b) -> state = state + 1 :: (a!= b) -> state = state 1 equivalent Repetition :: (m > n) -> m = m - n :: (m < n) -> n = n m :: (m == n) -> break ; printf ( GCD = %d\n, m) :: (a == b) -> state = state + 1 -> state = state 1 Selection can be nonderministic :: input? offhook :: (a == b) -> b = 3 ; goto onhook :: output! wakeup :: b = 3 /*any statement can be guard*/ 9 10 Processes and process types Name proctype Sender(chan in; chan out) { Local variable declarations bit sndb, rcvb; :: out! data(sndb) -> in? ack(rcvb); formal parameters :: sndb == rcvb > sendb = 1-sndB -> skip Processes dened by proctype denitions A process type may be instantiated several times Each process has its local state (pc, local variables) Processes execute concurrently, by interleaving Process instantiations Processes are created by run statement/expression run returns process id Processes execute their rst statement some time after creation Processes can be statically created at initialization time (no formal parameters allowed) proctype Foo(byte x) { int pid = run Foo(2); run Foo(27) active[3] proctype Bar(){ 11 12
3 Communication Channels Communication Channels (ctd.) Channels used for passing messages Asynchronous (buffered, default is FIFO) Synchronously (rendez-vous) Declaring synchronous (rendez-vous) channel w. capacity 0 chan synch[3] = [0] of {mtype, int chan qid = [4] of {mtype, int, byte chan synch[3] = [0] of {mtype, int name capacity types of messages Sending qid! var1, const, var qid! err(const, var) matched Receiving qid? err(const, var) assigned Non-mying receive qid? [err, const, var] Sorted send/receive (inserts lexicographically, receives any element) qid!! err(const, var) qid?? err(const, var) Message ransmission Protocol Alternating Bit Protocol (version 1) mtype = { m0, m1, ack proctype Receiver{ mtype = { msg, ack ; Rec0: :: StoR?any -> skip /* loss */ chan s_r = [2] of {mtype, byte, bit; bit rbit, seqno = 0; :: StoR?m0 -> RtoS!ack; chan r_s = [2] of {mtype, bit ; goto Rec1 proctype Sender{ r_s! ack(seqno); Send0: Rec1: -> /* timeout */ :: StoR?any -> skip /* loss */ :: seqno == rbit -> StoR!m0 :: StoR?m1 -> RtoS!ack; rbit = 1 rbit :: RoS?ack -> /* rec ack */ goto Rec0 :: s_r! msg(data, sbit) -> SoR!m1; r_s? ack(seqno); goto Send1 ; Send1: sbit = 1 sbit; -> /* timeout */ chan StoR = [1] of { mtype ; StoR!m1 chan RtoS = [1] of { mtype ; :: RoS?ack -> /* rec ack */ SoR!m0; StoR!m0; /* start */ goto Send0 run Sender; run Receiver Alternating Bit Protocol (version 1 altern) AB Protocol (version 2, with losses ) mtype = { msg, ack ; proctype Receiver() { mtype = { msg, ack ; chan s_r = [2] of {mtype, byte, bit; bit rbit, seqno = 0; chan s_r = [2] of {mtype, byte, bit; bit rbit = 1, seqno = 0; chan r_s = [2] of {mtype, bit ; chan r_s = [2] of {mtype, bit ; proctype Sender() { r_s! ack(seqno); :: r_s! ack(seqno) :: seqno == rbit -> rbit = 1 rbit ; :: s_r! msg(data, sbit) -> :: s_r! msg(data, sbit) -> r_s? ack(seqno); r_s? ack(seqno); :: seqno == rbit -> rbit = 1 rbit sbit = 1 sbit; sbit = 1 sbit; run Sender(); run Receiver() 17 18
4 AB Protocol (v 3, w.retransmissions ) AB Protocol (v 4, checking data delivery) mtype = { msg, ack ; chan s_r = [2] of {mtype, byte, bit; chan r_s = [2] of {mtype, bit ; :: s_r! msg(data, sbit) bit rbit = 1; :: s_r? msg (recd, rbit) mtype = { msg, ack ; chan s_r = [2] of {mtype, byte, bit; chan r_s = [2] of {mtype, bit ; :: s_r! msg(data, sbit) assert(recd == expected); AB Protocol (v 4b, checking data delivery) AB Protocol (v 5, progress) mtype = { msg, ack ; chan s_r = [2] of {mtype, byte, bit; chan r_s = [2] of {mtype, bit ; :: data < 10 -> s_r! msg(data, sbit) assert(recd == expected); mtype = { msg, ack ; chan s_r = [2] of {mtype, byte, bit; chan r_s = [2] of {mtype, bit ; :: data < 10 -> s_r! msg(data, sbit) progress: assert(recd == expected); AB Protocol (v 6, progress) AB Protocol (v 7, acceptance) mtype = { msg, ack ; chan s_r = [2] of {mtype, byte, bit; chan r_s = [2] of {mtype, bit ; :: data < 10 -> s_r! msg(data, sbit) :: (1) -> progress1: skip progress: assert(recd == expected); :: (1) -> progress2: skip mtype = { msg, ack ; chan s_r = [2] of {mtype, byte, bit; chan r_s = [2] of {mtype, bit ; :: s_r! msg(data, sbit) Slabel: data < 10 -> Rlabel: rbit = 1 - rbit ; assert(recd == expected) ; expected < 10 -> 23 24
5 Vikings problem Problem with Atomicity (* insert a mel of Vikings problem *) Only basic statements are atomic Q: What is the nal value of state? byte state = 1; proctype A() { state == 1 -> state++ proctype B() { state == 1 -> state-- run A() ; run B() Solution: atomic-construct Other use of atomic{ A process whose control is inside atomic{ executes without being interrupted by other processes NOE: Make sure that such a sequence cannot be blocked inside (after the rst statement). In that case, Promela will suspend the process, and you get unintended semantics. byte state = 1; proctype A() { state == 1 -> state++ proctype B() { state == 1 -> state-- run A() ; run B() o group complex manipulation into single transition If the manipulation is deterministic and always exits at the end d_step { is more efcient cnt = 0 ; :: (cnt < Max) -> z[cnt] = 3; cnt++ :: (cnt >= Max) -> break d_step { cnt = 0 ; :: (cnt < Max) -> z[cnt] = 3; cnt++ :: (cnt >= Max) -> break Else and imeout Useful Macros else is enabled no other statement in the same process is enabled timeout is enabled no other statement in the entire Promela mel is enabled skip is best to use we want to be sure to analyze the effect of possibly premature timeout. :: (m > n) -> m = m - n :: (m < n) -> n = n m -> break ; printf ( GCD = %d\n, m) :: input? offhook :: input? ringing :: timeout -> output! wakeup Od :: input? offhook :: input? ringing -> output! wakeup 29 IF without else branch Allows to write FOR loop Allows to write which means #dene IF :: #dene FI IF b -> x++ FI #dene FOR(i,l,h) i = l ; :: i < h -> #dene ROF(i,l,h) ;i++ :: i >= h -> break FOR(i,0,N) run proc(i) ROF(i,0,N) i = 0 ; :: i < N -> run proc(i) :: i >= N -> break 30
6 Specying invariant properties Peterson-Fischer Mutual Exclusion Always executable If v <= 2 is false, SPIN exits with error Used to check invariants assert (v <= 2) #dene true 1 #dene false 0 #dene turn1 false #dene turn2 true bool y1, y2, t; byte mutex = 0; proctype P1() { l1: y1 = true; l2: t = turn2; l3: (y2 == false t == turn1) ; assert (mutex <= 1) ; l4: /* critical section */ mutex -- ; atomic{ y1 = false ; goto l1 proctype P2() { m1: y2 = true; m2: t = turn1; m3: (y1 == false t == turn2) ; assert (mutex <= 1) ; m4: /* critical section */ mutex-- ; atomic{ y2 = false ; goto m1 run P1() ; run P2() Checking by monitor Checking deadlocks #dene true 1 #dene false 0 #dene turn1 false #dene turn2 true bool y1, y2, t; byte mutex = 0; proctype P1() { l1: y1 = true; l2: t = turn2; l3: (y2 == false t == turn1) ; l4: /* critical section */ mutex -- ; atomic{ y1 = false ; goto l1 proctype P2() { m1: y2 = true; m2: t = turn1; m3: (y1 == false t == turn2) ; m4: /* critical section */ mutex-- ; atomic{ y2 = false ; goto m1 active proctype monitor() { assert (mutex <= 1) run P1() ; run P2() #dene true 1 #dene false 0 #dene turn1 false #dene turn2 true bool y1, y2, t; byte mutex = 0; proctype P1() { l1: y1 = true; l2: skip ; l3: (y2 == false) ; l4: /* critical section */ mutex -- ; atomic{ y1 = false ; goto l1 proctype P2() { m1: y2 = true; m2: skip ; m3: (y1 == false) ; m4: /* critical section */ mutex-- ; atomic{ y2 = false ; goto m1 active proctype monitor() { assert (mutex <= 1) run P1() ; run P2() Checking progress by progress-labels Checking progress (ctd.) #dene MAX 5 mtype = { mesg, ack, nak, err ; proctype sender(chan in, out) { byte o, s, r; o=max-1; :: o = (o+1)%max; /* next msg */ again: :: out!mesg(o,s) /* send */ :: (1) -> progress1: out!err(0,0) /* distort */ proctype receiver(chan in, out) { byte i; /* actual input */ byte s; /* actual seqno */ byte es; /* expected seqno */ byte ei; /* expected input */ :: in?mesg(i, s) -> :: (s == es) -> assert(i == ei); progress: es = 1 - es; ei = (ei + 1)%MAX; chan s_r = [1] of { mtype,byte,byte ; chan r_s = [1] of { mtype,byte,byte ; run sender(r_s, s_r); run receiver(s_r, r_s) :: (1) -> progress2: skip /* or lose */ ; :: timeout -> goto again :: in?err(0,0) -> goto again :: in?nak(r,0) -> goto again :: in?ack(r,0) -> :: (r == s) -> goto progress :: (r!= s) -> goto again ; progress: s = 1-s /* toggle seqno */ /* send, */ :: out!ack(s,0) /* distort */ :: (1) -> out!err(0,0) :: (s!= es) -> /* send, */ :: out!nak(s,0) /* distort */ :: (1) -> out!err(0,0) :: in?err(0,0) -> out!nak(s,0) 35 36
7 Progress labels: improved version Automata properties: never claims #dene MAX 5 mtype = { mesg, ack, nak, err ; proctype sender(chan in, out) { byte o, s, r; o=max-1; :: o = (o+1)%max; /* next msg */ again: :: out!mesg(o,s) /* send */ :: (1) -> progress1: out!err(0,0) /* distort */ :: (1) -> progress2: skip /* or lose */ ; :: timeout -> goto again :: in?err(0,0) -> goto again :: in?nak(r,0) -> goto again :: in?ack(r,0) -> :: (r == s) -> goto progress :: (r!= s) -> goto again ; progress: s = 1-s /* toggle seqno */ proctype receiver(chan in, out) { byte i; /* actual input */ byte s; /* actual seqno */ byte es; /* expected seqno */ byte ei; /* expected input */ :: in?mesg(i, s) -> :: (s == es) -> assert(i == ei); progress: es = 1 - es; ei = (ei + 1)%MAX; /* send, */ :: out!ack(s,0) /* distort */ :: (1) -> progress1: out!err(0,0) :: (1) -> progress2: skip :: (s!= es) -> /* send, */ :: out!nak(s,0) /* distort */ :: (1) -> progress3: out!err(0,0) :: (1) -> progress4: skip :: in?err(0,0) -> out!nak(s,0) 37 Automata specications can be given in Promela as Never claims, e.g., ( p -> p ) p p never { :: p -> break ; ::!p -> break Never claims execute in lock-step with the rest of the Promela mel Accept they reach the end 38 Buchi Automata as never claims Accepting states designated by labels acceptxxxxx ( p /\ q) p /\ q q never { :: p &&!q -> break ; accept: ::!q he never claim accepts the Promela mel has cycle with only!q hen SPIN reports a violating cycle. 39
What is SPIN(Simple Promela Interpreter) Material About SPIN. Elements of Promela. Basic Variables and Types. Typical Structure of Promela Model
What is SPIN(Simple Promela Interpreter) Lecture 3 SPIN and Promela A tool for analyzing mels of reactive systems Mels described in Promela Language with concurrent processes, Communication via channels,
More informationLecture 3 SPIN and Promela
Lecture 3 SPIN and Promela 1 What is SPIN(Simple Promela INterpreter) A tool for analyzing mels of concurrent systems Mels described in Promela Language with concurrent processes Communication via shared
More informationCS477 Formal Software Development Methods / 39
CS477 Formal Software Development Methods 2112 SC, UIUC egunter@illinois.edu http://courses.engr.illinois.edu/cs477 SPIN Beginners Tutorial April 11, 2018 Hello World /* A "Hello World" Promela model for
More informationNetwork Protocol Design and Evaluation
Network Protocol Design and Evaluation 05 - Validation, Part I Stefan Rührup Summer 2009 Overview In the last lectures: Specification of protocols and data/message formats In this chapter: Building a validation
More informationCS477 Formal Software Development Methods / 32
CS477 Formal Software Development Methods 2112 SC, UIUC egunter@illinois.edu http://courses.engr.illinois.edu/cs477 SPIN Beginners Tutorial April 13, 2018 Assertion Violation: mutextwrong1.pml bit flag;
More informationA Tutorial on Model Checker SPIN
A Tutorial on Model Checker SPIN Instructor: Hao Zheng Department of Computer Science and Engineering University of South Florida Tampa, FL 33620 Email: haozheng@usf.edu Phone: (813)974-4757 Fax: (813)974-5456
More informationComputer Aided Verification 2015 The SPIN model checker
Computer Aided Verification 2015 The SPIN model checker Grigory Fedyukovich Universita della Svizzera Italiana March 11, 2015 Material borrowed from Roberto Bruttomesso Outline 1 Introduction 2 PROcess
More informationDesign of Internet Protocols:
CSCI 234 Design of Internet Protocols: George Blankenship George Blankenship 1 Outline Verication and Validation History and motivation Spin Promela language Promela model George Blankenship 2 Verication
More informationComputer Lab 1: Model Checking and Logic Synthesis using Spin (lab)
Computer Lab 1: Model Checking and Logic Synthesis using Spin (lab) Richard M. Murray Nok Wongpiromsarn Ufuk Topcu Calornia Institute of Technology AFRL, 25 April 2012 Outline Spin model checker: modeling
More informationCopyright 2008 CS655 System Modeling and Analysis. Korea Advanced Institute of Science and Technology
The Spin Model Checker : Part I Copyright 2008 CS655 System Korea Advanced Institute of Science and Technology System Spec. In Promela Req. Spec. In LTL Overview of the Spin Architecture Spin Model pan.c
More informationThe SPIN Model Checker
The SPIN Model Checker Metodi di Verifica del Software Andrea Corradini GianLuigi Ferrari Lezione 3 2011 Slides per gentile concessione di Gerard J. Holzmann 2 the do-statement do :: guard 1 -> stmnt 1.1
More information4/6/2011. Model Checking. Encoding test specifications. Model Checking. Encoding test specifications. Model Checking CS 4271
Mel Checking LTL Property System Mel Mel Checking CS 4271 Mel Checking OR Abhik Roychoudhury http://www.comp.nus.edu.sg/~abhik Yes No, with Counter-example trace 2 Recap: Mel Checking for mel-based testing
More informationHello World. Slides mostly a reproduction of Theo C. Ruys SPIN Beginners Tutorial April 23, Hello() print "Hello"
Hello World CS477 Formal Software Development Methods 11 SC, UIUC egunter@illinois.edu http://courses.engr.illinois.edu/cs477 inners April 3, 014 /* A "Hello World" Promela model for SPIN. */ active Hello()
More informationPromela and SPIN. Mads Dam Dept. Microelectronics and Information Technology Royal Institute of Technology, KTH. Promela and SPIN
Promela and SPIN Mads Dam Dept. Microelectronics and Information Technology Royal Institute of Technology, KTH Promela and SPIN Promela (Protocol Meta Language): Language for modelling discrete, event-driven
More informationNetwork Protocol Design and Evaluation
Network Protocol Design and Evaluation 05 - Validation, Part III Stefan Rührup Summer 2009 Overview In the first parts of this chapter: Validation models in Promela Defining and checking correctness claims
More informationSpin: Overview of PROMELA
Spin: Overview of PROMELA Patrick Trentin patrick.trentin@unitn.it http://disi.unitn.it/trentin Formal Methods Lab Class, March 10, 2017 These slides are derived from those by Stefano Tonetta, Alberto
More informationTool demonstration: Spin
Tool demonstration: Spin 1 Spin Spin is a model checker which implements the LTL model-checking procedure described previously (and much more besides). Developed by Gerard Holzmann of Bell Labs Has won
More informationT Parallel and Distributed Systems (4 ECTS)
T 79.4301 Parallel and Distributed Systems (4 ECTS) T 79.4301 Rinnakkaiset ja hajautetut järjestelmät (4 op) Lecture 3 4th of February 2008 Keijo Heljanko Keijo.Heljanko@tkk.fi T 79.4301 Parallel and Distributed
More informationThe Spin Model Checker : Part I/II
The Spin Model Checker : Part I/II Moonzoo Kim CS Dept. KAIST Korea Advanced Institute of Science and Technology Motivation: Tragic Accidents Caused by SW Bugs 2 Cost of Software Errors June 2002 Software
More informationSoftware Engineering using Formal Methods
Software Engineering using Formal Methods Introduction to Promela Wolfgang Ahrendt 03 September 2015 SEFM: Promela /GU 150903 1 / 36 Towards Model Checking System Model Promela Program byte n = 0; active
More informationPatrick Trentin Formal Methods Lab Class, Feb 26, 2016
Spin: Introduction Patrick Trentin patrick.trentin@unitn.it http://disi.unitn.it/~trentin Formal Methods Lab Class, Feb 26, 2016 These slides are derived from those by Stefano Tonetta, Alberto Griggio,
More informationSpin: Overview of PROMELA
Spin: Overview of PROMELA Patrick Trentin patrick.trentin@unitn.it http://disi.unitn.it/~trentin Formal Methods Lab Class, Mar 04, 2016 These slides are derived from those by Stefano Tonetta, Alberto Griggio,
More informationINF672 Protocol Safety and Verification. Karthik Bhargavan Xavier Rival Thomas Clausen
INF672 Protocol Safety and Verication Karthik Bhargavan Xavier Rival Thomas Clausen 1 Course Outline Lecture 1 [Today, Sep 15] Introduction, Motivating Examples Lectures 2-4 [Sep 22,29, Oct 6] Network
More informationPatrick Trentin Formal Methods Lab Class, March 03, 2017
Spin: Introduction Patrick Trentin patrick.trentin@unitn.it http://disi.unitn.it/trentin Formal Methods Lab Class, March 03, 2017 These slides are derived from those by Stefano Tonetta, Alberto Griggio,
More informationFormal Specification and Verification
Formal Specification and Verification Introduction to Promela Bernhard Beckert Based on a lecture by Wolfgang Ahrendt and Reiner Hähnle at Chalmers University, Göteborg Formal Specification and Verification:
More informationSoftware Engineering using Formal Methods
Software Engineering using Formal Methods Introduction to Promela Wolfgang Ahrendt & Richard Bubel & Reiner Hähnle & Wojciech Mostowski 31 August 2011 SEFM: Promela /GU 110831 1 / 35 Towards Model Checking
More informationDesign and Analysis of Distributed Interacting Systems
Design and Analysis of Distributed Interacting Systems Lecture 5 Linear Temporal Logic (cont.) Prof. Dr. Joel Greenyer May 2, 2013 (Last Time:) LTL Semantics (Informally) LTL Formulae are interpreted on
More informationLogic Model Checking
Logic Model Checking Lecture Notes 14:18 Caltech 118 January-March 2006 Course Text: The Spin Model Checker: Primer and Reference Manual Addison-Wesley 2003, ISBN 0-321-22862-6, 608 pgs. Logic Model Checking
More informationThe Spin Model Checker : Part I. Moonzoo Kim KAIST
The Spin Model Checker : Part I Moonzoo Kim KAIST Hierarchy of SW Coverage Criteria Complete Value Coverage CVC (SW) Model checking Complete Path Coverage CPC Concolic testing All-DU-Paths Coverage ADUP
More informationDistributed Systems Programming F29NM1 2. Promela I. Andrew Ireland. School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh
Distributed Systems Programming F29NM1 Promela I Andrew Ireland School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh Distributed Systems Programming F29NM1 2 Overview Basic building
More informationApplications of Formal Verification
Applications of Formal Verification Model Checking: Introduction to PROMELA Bernhard Beckert Mattias Ulbrich SS 2017 KIT INSTITUT FÜR THEORETISCHE INFORMATIK KIT University of the State of Baden-Württemberg
More informationThe SPIN Model Checker
The SPIN Model Checker Metodi di Verifica del Software Andrea Corradini Lezione 1 2013 Slides liberamente adattate da Logic Model Checking, per gentile concessione di Gerard J. Holzmann http://spinroot.com/spin/doc/course/
More informationApplications of Formal Verification
Applications of Formal Verification Model Checking: Introduction to PROMELA Prof. Dr. Bernhard Beckert Dr. Vladimir Klebanov SS 2012 KIT INSTITUT FÜR THEORETISCHE INFORMATIK KIT University of the State
More informationFormal Verification by Model Checking
Formal Verication by Model Checking Jonathan Aldrich Carnegie Mellon University Based on slides developed by Natasha Sharygina 17-654/17-754: Analysis of Software Artacts Spring 2006 1 CTL Model Checking
More informationIntroduction to Model Checking
Introduction to Model Checking René Thiemann Institute of Computer Science University of Innsbruck WS 2007/2008 RT (ICS @ UIBK) week 4 1/23 Outline Promela - Syntax and Intuitive Meaning Promela - Formal
More informationApplications of Formal Verification
Applications of Formal Verification Model Checking: Introduction to PROMELA Prof. Dr. Bernhard Beckert Dr. Vladimir Klebanov SS 2010 KIT INSTITUT FÜR THEORETISCHE INFORMATIK KIT University of the State
More informationComputer Lab 1: Model Checking and Logic Synthesis using Spin (lab)
Computer Lab 1: Model Checking and Logic Synthesis using Spin (lab) Richard M. Murray Nok Wongpiromsarn Ufuk Topcu California Institute of Technology EECI 19 Mar 2013 Outline Spin model checker: modeling
More informationMulti-Threaded System int x, y, r; int *p, *q, *z; int **a; EEC 421/521: Software Engineering. Thread Interleaving SPIN. Model Checking using SPIN
EEC 421/521: Software Engineering Model Checking using SPIN 4/29/08 EEC 421/521: Software Engineering 1 Multi-Threaded System int x, y, r; int *p, *q, *z; int **a; thread_1(void) /* initialize p, q, and
More informationSPIN: Part /614 Bug Catching: Automated Program Verification. Sagar Chaki November 12, Carnegie Mellon University
SPIN: Part 1 15-414/614 Bug Catching: Automated Program Verification Sagar Chaki November 12, 2012 What is This All About? Spin On-the-fly verifier developed at Bell-labs by Gerard Holzmann and others
More informationBeginner s SPIN Tutorial
SPIN 2002 Workshop Beginner s SPIN Tutorial Grenoble, France Thursday 11-Apr-2002 Theo C. Ruys University of Twente Formal Methods & Tools group http://www.cs.utwente.nl/~ruys Credits should go to Gerard
More informationLTL Reasoning: How It Works
Distributed Systems rogramming F21DS1 LTL Reasoning: How It Works Andrew Ireland School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh Distributed Systems rogramming F21DS1 2 Overview
More informationSPIN: Introduction and Examples
SPIN: Introduction and Examples Alessandra Giordani agiordani@disi.unitn.it http://disi.unitn.it/~agiordani Formal Methods Lab Class, September 28, 2014 *These slides are derived from those by Stefano
More informationSPIN. Carla Ferreira.
SPIN Carla Ferreira http://www.spinroot.com/spin/man/intro.html Introduction PROMELA (PROcess MEta LAnguage) is the input language of SPIN (Simple Promela Interpreter) Inspired by: C and CSP Describes
More informationModel checking Timber program. Paweł Pietrzak
Model checking Timber program Paweł Pietrzak 1 Outline Background on model checking (spam?) The SPIN model checker An exercise in SPIN - model checking Timber Deriving finite models from Timber programs
More informationSWEN-220 Mathematical Models of Software. Process Synchronization Critical Section & Semaphores
SWEN-220 Mathematical Models of Software Process Synchronization Critical Section & Semaphores 1 Topics The critical section Synchronization using busy-wait Semaphores 2 The Critical Section Processes
More informationBlocking Non-blocking Caveat:
Overview of Lecture 5 1 Progress Properties 2 Blocking The Art of Multiprocessor Programming. Maurice Herlihy and Nir Shavit. Morgan Kaufmann, 2008. Deadlock-free: some thread trying to get the lock eventually
More informationTHE MODEL CHECKER SPIN
THE MODEL CHECKER SPIN Shin Hong, KAIST 17 th April,2007 1/33 Contents Introduction PROMELA Linear Temporal Logic Automata-theoretic software verification Example : Simple Elevator 2 SPIN is a software
More informationSPIN, PETERSON AND BAKERY LOCKS
Concurrent Programs reasoning about their execution proving correctness start by considering execution sequences CS4021/4521 2018 jones@scss.tcd.ie School of Computer Science and Statistics, Trinity College
More informationAutomated Reasoning. Model Checking with SPIN (II)
Automated Reasoning Model Checking with SPIN (II) Alan Bundy page 1 Verifying Global Properties Assertions can be used to verify a property locally For example, place assert(memreturned) at the end of
More informationChapter 6: Process Synchronization
Chapter 6: Process Synchronization Objectives Introduce Concept of Critical-Section Problem Hardware and Software Solutions of Critical-Section Problem Concept of Atomic Transaction Operating Systems CS
More informationUsing Spin to Help Teach Concurrent Programming
Using Spin to Help Teach Concurrent Programming John Regehr May 1, 1998 1 Introduction and Motivation Writing correct concurrent programs is very difficult; race conditions, deadlocks, and livelocks can
More informationLinear Temporal Logic. Model Checking and. Based on slides developed by Natasha Sharygina. Carnegie Mellon University.
Model Checking and Linear Temporal Logic Jonathan Aldrich Carnegie Mellon University Based on slides developed by Natasha Sharygina 17-654: Analysis of Software Artifacts 1 Formal Verification by Model
More informationTOWARDS AUTOMATED VERIFICATION OF WEB SERVICES
TOWARDS AUTOMATED VERIFICATION OF WEB SERVICES Cátia Vaz INESC-ID Lisboa, ISEL-IPL Rua Alves Redol 9, 1000-029 Lisboa cvaz@cc.isel.ipl.pt Carla Ferreira INESC-ID, IST-UTL Rua Alves Redol 9, 1000-029 Lisboa
More informationModeling Language Control Flow Advanced Usage Spin Summary Appendix: Building a Verification Suite References Japanese translation of this page Spin is a tool for analyzing the logical consistency of concurrent
More informationINF5140: Specification and Verification of Parallel Systems
INF5140: Specification and Verification of Parallel Systems Lecture 09 Defining Correctness Claims Gerar Schneider Department of Informatics University of Oslo INF5140, Spring 2007 Gerar Schneider (Ifi,
More informationBuilding Graphical Promela Models using UPPAAL GUI
Building Graphical Promela Models using UPPAAL GUI Master s Thesis Report by Vasu Hossaholal Lingegowda Software Systems Engineering Group: B2-201 under the guidance of Dr. Alexandre David Department of
More informationPrinciples of Protocol Design MVP 10A 1
Principles of Protocol Design MVP 10A 1 MVP10 plan Protocol design principles with examples: Lynch s protocol Tanenbaum protocol 2 Tanenbaum protocol 4 Mutual exclusion in a distributed environment: Lamports
More informationSiegfried Loer and Ahmed Serhrouchni. Abstract. SPIN is a tool to simulate and validate Protocols. PROMELA, its
DIMACS Series in Discrete Mathematics and Theoretical Computer Science Volume 00, 19xx Creating Implementations from PROMELA Models Siegfried Loer and Ahmed Serhrouchni Abstract. SPIN is a tool to simulate
More informationApplicant. LLC Service. LAN Segment
Verication of Group Address Registration Protocol using PROMELA and SPIN Tadashi Nakatani Fuchu Works, Toshiba Corporation, Japan February 16, 1997 Abstract This paper demonstrates robustness and eectiveness
More informationPrinciples of Protocol Design. MVP10 plan. What is a protocol? Typical SPIN applications. The three parts of a protocol description
Principles of Protocol Design MVP10 plan Protocol design principles with examples: Lynch s protocol Tanenbaum protocol 2 Tanenbaum protocol 4 Mutual exclusion in a distributed environment: Lamports algorithm
More informationLecture 2: Intro to Concurrent Processing. A Model of Concurrent Programming
Lecture 2: Intro to Concurrent Processing The SR Language. Correctness and Concurrency. Mutual Exclusion & Critical Sections. Software Solutions to Mutual Exclusion. Dekker s Algorithm. The Bakery Algorithm.
More informationCh 9: Control flow. Sequencers. Jumps. Jumps
Ch 9: Control flow Sequencers We will study a number of alternatives traditional sequencers: sequential conditional iterative jumps, low-level sequencers to transfer control escapes, sequencers to transfer
More informationModel Requirements and JAVA Programs MVP 2 1
Model Requirements and JAVA Programs MVP 2 1 Traditional Software The Waterfall Model Problem Area Development Analysis REVIEWS Design Implementation Costly wrt time and money. Errors are found too late
More informationT Parallel and Distributed Systems (4 ECTS)
T 79.4301 Parallel and Distriuted Systems (4 ECTS) T 79.4301 Rinnakkaiset ja hajautetut järjestelmät (4 op) Lecture 4 11th of Feruary 2008 Keijo Heljanko Keijo.Heljanko@tkk.fi T 79.4301 Parallel and Distriuted
More informationThe Design of a Distributed Model Checking Algorithm for Spin
The Design of a Distributed Model Checking Algorithm for Spin Gerard J. Holzmann http://eis.jpl.nasa.gov/lars http://spinroot.com/gerard/ Presented at FMCAD 2006, San Jose, California November 14, 2006
More informationSWEN-220 Mathematical Models of Software. Concurrency in SPIN Interleaving
SWEN-220 Mathematical Models of Software Concurrency in SPIN Interleaving 1 Topics Interleaving Process Interference Race Conditions Atomicity 2 Concurrency Concurrency can come in many flavors Concurrent
More informationDistributed Systems Programming (F21DS1) SPIN: Formal Analysis II
Distributed Systems Programming (F21DS1) SPIN: Formal Analysis II Andrew Ireland Department of Computer Science School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh Overview Introduce
More informationDistributed Systems Programming (F21DS1) SPIN: Formal Analysis I
Distributed Systems Programming (F21DS1) SPIN: Formal Analysis I Andrew Ireland Department of Computer Science School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh Overview Introduce
More informationFormal Methods for Software Development
Formal Methods for Software Development Verification with Spin Wolfgang Ahrendt 07 September 2018 FMSD: Spin /GU 180907 1 / 34 Spin: Previous Lecture vs. This Lecture Previous lecture Spin appeared as
More informationProcess Management And Synchronization
Process Management And Synchronization In a single processor multiprogramming system the processor switches between the various jobs until to finish the execution of all jobs. These jobs will share the
More informationDistributed Systems Programming (F21DS1) SPIN: Simple Promela INterpreter
Distributed Systems Programming (F21DS1) SPIN: Simple Promela INterpreter Andrew Ireland Department of Computer Science School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh Overview
More informationUsing Model Checking with Symbolic Execution for the Verification of Data-Dependent Properties of MPI-Based Parallel Scientific Software
Using Model Checking with Symbolic Execution for the Verification of Data-Dependent Properties of MPI-Based Parallel Scientific Software Anastasia Mironova Problem It is hard to create correct parallel
More informationA Practical approach on Model checking with Modex and Spin
International Journal of Electrical & Computer Sciences IJECS-IJENS Vol: 11 No: 05 1 A Practical approach on Model checking with Modex and Spin Muhammad Iqbal Hossain #1, Nahida Sultana Chowdhury *2 #
More informationGenerating Code from Event-B Using an Intermediate Specification Notation
Rodin User and Developer Workshop Generating Code from Event-B Using an Intermediate Specification Notation Andy Edmunds - ae02@ecs.soton.ac.uk Michael Butler - mjb@ecs.soton.ac.uk Between Abstract Development
More informationWhat is the Race Condition? And what is its solution? What is a critical section? And what is the critical section problem?
What is the Race Condition? And what is its solution? Race Condition: Where several processes access and manipulate the same data concurrently and the outcome of the execution depends on the particular
More informationModel-Checking Concurrent Systems
Model-Checking Concurrent Systems Wolfgang Schreiner Wolfgang.Schreiner@risc.jku.at Research Institute for Symbolic Computation (RISC) Johannes Kepler University, Linz, Austria http://www.risc.jku.at Wolfgang
More informationConcurrency: Mutual Exclusion and
Concurrency: Mutual Exclusion and Synchronization 1 Needs of Processes Allocation of processor time Allocation and sharing resources Communication among processes Synchronization of multiple processes
More informationThe S-Expression Design Language (SEDL) James C. Corbett. September 1, Introduction. 2 Origins of SEDL 2. 3 The Language SEDL 2.
The S-Expression Design Language (SEDL) James C. Corbett September 1, 1993 Contents 1 Introduction 1 2 Origins of SEDL 2 3 The Language SEDL 2 3.1 Scopes : : : : : : : : : : : : : : : : : : : : : : : :
More informationtransformation of PROMELA models into Channel Systems,
Transformation of PROMELA to Channel Systems Sheila Nurul Huda Jurusan Teknik Informatika, Fakultas Teknologi Industri Universitas Islam Indonesia Jl. Kaliurang Km. 14 Yogyakarta, Indonesia, 55501 Tel
More informationModel-Checking Concurrent Systems. The Model Checker Spin. The Model Checker Spin. Wolfgang Schreiner
Model-Checking Concurrent Systems Wolfgang Schreiner Wolfgang.Schreiner@risc.jku.at Research Institute for Symbolic Computation (RISC) Johannes Kepler University, Linz, Austria http://www.risc.jku.at 1.
More informationEMBEDDED C CODE 17. SPIN Version 4 supports the inclusion of embedded C code into PROMELA models through the following fiv e new primitives:
EMBEDDED C CODE 17 The purpose of analysis is not to compel belief but rather to suggest doubt. (Imre Lakatos, Proofs and Refutations) SPIN Version 4 supports the inclusion of embedded C code into PROMELA
More informationTowards Promela verification using VerICS
Part 2: Specification Towards Promela verification using VerICS Wojciech Nabia lek 1 and Pawe l Janowski 2 1 Institute of Computer Science, University of Podlasie ul. Sienkiewicza 51, 08-110 Siedlce, Poland
More informationTesting Concurrent Programs: Model Checking SPIN. Bengt Jonsson
Testing Concurrent Programs: Model Checking SPIN Bengt Jonsson Model Checking Section Weeks 15 and 16. Goal: Understand and use the basics of Model checking, using state space exploration Modeling parallel
More informationCS3733: Operating Systems
Outline CS3733: Operating Systems Topics: Synchronization, Critical Sections and Semaphores (SGG Chapter 6) Instructor: Dr. Tongping Liu 1 Memory Model of Multithreaded Programs Synchronization for coordinated
More informationOperating Systems (2INC0) 2017/18
Operating Systems (2INC0) 2017/18 Condition Synchronization (07) Dr. Courtesy of Prof. Dr. Johan Lukkien System Architecture and Networking Group Agenda Condition synchronization motivation condition variables
More informationModelling Without a Modelling Language
Modelling Without a Modelling Language Antti Valmari & Vesa Lappalainen University of Jyväskylä 1 Introduction 2 Quick Comparison to Promela 3 Demand-Driven Token Ring 4 Simple Transition Classes 5 Faster
More informationMP 6 Modeling in Promela and SPIN
MP 6 Modeling in Promela and SPIN CS 477 Spring 2018 Revision 1.0 Assigned April 23, 2018 Due May 2, 2018, 9:00 PM Extension 48 hours (penalty 20% of total points possible) 1 Change Log 1.0 Initial Release.
More informationA Verification Approach for GALS Integration of Synchronous Components
GALS 2005 Preliminary Version A Verification Approach for GALS Integration of Synchronous Components F. Doucet, M. Menarini, I. H. Krüger and R. Gupta 1 Computer Science and Engineering University of California,
More informationFormal Specification and Verification
Formal Specification and Verification Model Checking with Temporal Logic Bernhard Beckert Based on a lecture by Wolfgang Ahrendt and Reiner Hähnle at Chalmers University, Göteborg Formal Specification
More informationConcurrency: Mutual Exclusion and Synchronization
Concurrency: Mutual Exclusion and Synchronization 1 Needs of Processes Allocation of processor time Allocation and sharing resources Communication among processes Synchronization of multiple processes
More informationFormal Verification of Process Communications in Operational Flight Program for a Small-Scale Unmanned Helicopter
Formal Verication of Process Communications in Operational Flight Program for a Small-Scale Unmanned Helicopter Dong-Ah Lee 1, Junbeom Yoo 2 and Doo-Hyun Kim 3 1, 2 School of Computer Science and Engineering
More informationChapter 6: Synchronization. Chapter 6: Synchronization. 6.1 Background. Part Three - Process Coordination. Consumer. Producer. 6.
Part Three - Process Coordination Chapter 6: Synchronization 6.1 Background Concurrent access to shared data may result in data inconsistency Maintaining data consistency requires mechanisms to ensure
More informationMultitasking / Multithreading system Supports multiple tasks
Tasks and Intertask Communication Introduction Multitasking / Multithreading system Supports multiple tasks As we ve noted Important job in multitasking system Exchanging data between tasks Synchronizing
More informationLecture. DM510 - Operating Systems, Weekly Notes, Week 11/12, 2018
Lecture In the lecture on March 13 we will mainly discuss Chapter 6 (Process Scheduling). Examples will be be shown for the simulation of the Dining Philosopher problem, a solution with monitors will also
More informationChapter 6: Process Synchronization
Chapter 6: Process Synchronization Chapter 6: Synchronization 6.1 Background 6.2 The Critical-Section Problem 6.3 Peterson s Solution 6.4 Synchronization Hardware 6.5 Mutex Locks 6.6 Semaphores 6.7 Classic
More informationCHAPTER 6: PROCESS SYNCHRONIZATION
CHAPTER 6: PROCESS SYNCHRONIZATION The slides do not contain all the information and cannot be treated as a study material for Operating System. Please refer the text book for exams. TOPICS Background
More informationMapping of UML Diagrams to Extended Petri Nets for Formal Verification
Grand Valley State University ScholarWorks@GVSU Masters Theses Graduate Research and Creative Practice 8-2013 Mapping of UML Diagrams to Exted Petri Nets for Formal Verification Byron DeVries Grand Valley
More informationthese developments has been in the field of formal methods. Such methods, typically given by a
PCX: A Translation Tool from PROMELA/Spin to the C-Based Stochastic Petri et Language Abstract: Stochastic Petri ets (SPs) are a graphical tool for the formal description of systems with the features of
More informationA Deterministic Concurrent Language for Embedded Systems
A Deterministic Concurrent Language for Embedded Systems Stephen A. Edwards Columbia University Joint work with Olivier Tardieu SHIM:A Deterministic Concurrent Language for Embedded Systems p. 1/38 Definition
More informationModels of concurrency & synchronization algorithms
Models of concurrency & synchronization algorithms Lecture 3 of TDA383/DIT390 (Concurrent Programming) Carlo A. Furia Chalmers University of Technology University of Gothenburg SP3 2016/2017 Today s menu
More information