Model checking Timber program. Paweł Pietrzak
|
|
- Sibyl Fletcher
- 5 years ago
- Views:
Transcription
1 Model checking Timber program Paweł Pietrzak 1
2 Outline Background on model checking (spam?) The SPIN model checker An exercise in SPIN - model checking Timber Deriving finite models from Timber programs 2
3 Software verification Peer reviewing - static technique: manual code inspection, no software execution - detects between 31 and 93% of defects with median of about 60% - subtle errors (concurrency and algorithm defects) hard to catch Testing - dynamic technique in which software is executed Some figures - 30% to 50% of software project costs devoted to testing - more time and effort is spent on validation than on construction - accepted defect density: about 1 defects per 1,000 code lines 3
4 Formal verification Mathematical approach towards program correctness (Turing, 1949) Syntax-based technique for sequential programs! (Hoare, 1969) - for a given input, does a computer program generate the correct output? Syntax-based technique for concurrent programs! (Pnueli, 1977) - based on proof rules expressed in temporal logic Semantic-based approach (Cousot & Cousot 1977) - abstract interpretation - collapse abstract states with lattice Automated verification of concurrent programs (Emerson & Clarke, 1981) - model-based instead of proof-rule based approach does the concurrent program/system satisfy a given (logical) property? 4
5 The 2007 Turing Award winners Edmund E. Clarke E. Allen Emerson Joseph Sifakis 5
6 Why model checking? No proofs!!! Fast Counterexamples No problem with partial specifications Logics can easily express many concurrency properties 6
7 Model checking Computation Model: A finite-state machine (Kripke structures, timed automata, etc.) Specification Language: A propositional temporal logic. Verification Procedure: Exhaustive search of the state space of the concurrent system to determine truth of specification. 7
8 Model of computation State transition graph of Kripke Model Infinite computation tree 8
9 Model of computation Microwave oven example ~ Start ~ Close ~ Heat ~ Error Start ~ Close ~ Heat Error ~ Start Close ~ Heat ~ Error ~ Start Close Heat ~ Error Start Close ~ Heat Error Start Close ~ Heat ~ Error Start Close Heat ~ Error 9
10 What properties Safety: something bad will never happen Liveness: something good will happen(but we don t know when) Fairness: something good will happen infinitely often (under certain condition) Reachability: something ( good or bad ) can happen 10
11 Temporal Logic The oven doesn t heat up until the door is closed. Not heat_up holds until door_closed! (~ heat_up) U door_closed 11
12 Linear Temporal Logic (LTL) The symbol p is an atomic proposition, e.g. Device Enabled. p! - p holds sometime in the future (Fp). p! - p holds globally in the future. (Gp) p!- p holds next time (Xp). puq!- p holds until q holds. 12
13 Example LTL formulae Always eventually p: p (fairness) Always after p there is eventually q: (p ( q)) 13
14 Computation Tree Logic (CTL) Path qualifiers A for every path E there exists a path 14
15 Semantics by pictures E red E red A red 15 A red
16 Example LTL specs Safety - mutual exclusion (C 1 C 2 ) C 1, C 2 -critical sections; can be expressed as negation of reachability E (C 1 C 2 ) (cannot in LTL) Responsiveness (request ack) 16
17 Model checking Summary I S implementation (system model) FSM, timed automata specification (system property) CTL, CTL*, LTL satisfies, implements, refines (satisfaction relation)
18 MC in practice 90s, 00s: Industrial applications Considerable success in hardware verification (e.g. Pentium arithmetic verified) Groups in all big companies: IBM, Intel, Lucent, Microsoft, Motorola, Siemens... Many commercial and non-commercial tools: FormalCheck, PEP, SMV, SPIN... (over 30 listed in WikipediA) 18
19 The SPIN model checker [Gerard J. Holzmann 1991] 19
20 Explicit State Model Checker Represents the system as an finite state machine (no clocks) Visits each reachable state (state space) explicitly On-the-fly (the state space constructed and verified at the same time) Checks a property (LTL) Property is satisfied Counterexample Can embed C code Original application: verification of communication protocols! 20
21 Promela Roots in Process Algebra Describes the system in a way similar to a programming language Asynchronous composition of independent processes Communication using channels and global variables Non-deterministic choices and interleavings 21
22 An Example type = { NONCRITICAL, TRYING, CRITICAL }; show mtype state[2]; proctype process(int id) { beginning: noncritical: state[id] = NONCRITICAL; if :: goto noncritical; :: true; fi; trying: state[id] = TRYING; if :: goto trying; :: true; fi; critical: state[id] = CRITICAL; if :: goto critical; :: true; fi; goto beginning;} init { run process(0); run process(1); } 22 NC T C
23 Other constructs Do loops do :: count = count + 1; :: count = count - 1; :: (count == 0) -> break od 23
24 Other constructs Communication over channels proctype sender(chan out) { int x; if :: x=0; :: x=1; fi out! x; } 24
25 Other constructs Assertions proctype receiver(chan in) { int value; out? value; assert(value == 0 value == 1) } 25
26 Other constructs Atomic Steps int value; proctype increment() { atomic { x = value; x = x + 1; value = x; } } 26
27 SPIN verification Should be empty! 27
28 Software model checking 28
29 Why it is a challenge base data types Float, String, Int large/unbound recursive procedure calls / loops unbound dynamic allocations unbound number of threads dynamic communication structure 29
30 Gets even worse... External events/interrupts/exceptions/ callbacks Use of secondary storage Self-modifying code! 30
31 The approach Use static analysis to extract finite model of communication (synchronization) patterns Then, model check that model against specification 31
32 Timber program RTS Specification φ (LTL) Abstract model M in Promela SPIN model checker M φ? yes or counterexamples 32
33 Timber program RTS Specification φ (LTL) Abstract model M in Promela SPIN model checker M φ? yes or counterexamples 33
34 Timber recap object-oriented with mutable states synchronous or asynchronous messages triggering a method execution, possibly concurrent object states protected by mutual exclusion deadlines/baselines can be specified à scheduling reacts to external, events
35 Timber Synchronous messages Asynchronous messages (with or without randezvous) S:=0 sync Method A S:=S+1 B... send C async (can have after and before annotation) Method B... Method C
36 What we want to verify Responsiveness Sound communication Absence of deadlocks Schedulability... 36
37 Timber in Promela - kernel primitives c1 = class s := 0 meth11 = action... meth12 a = request... result s result c1 {..} c2 x = class meth2 = action... send x.meth11 tmp <- x.meth result c2 {..} obj1 = new c1 obj2 = new c2 obj1 Timber chan msgq = [MAXBUF] of { byte }; bool locks[nobj]; inline async(m) { ( len(msgq) < MAXBUF ) -> msgq!m } inline lock(obj) { atomic { locks[obj] == 0 -> locks[obj] = 1} } inline unlock(obj){ locks[obj]=0; } inline dispatch(m){ if :: (m==m11) -> run meth11() :: (m==m2) -> run meth2() fi } active proctype loop() { msg m; do :: msgq?m -> dispatch(m) od } Promela
38 Timber in Promela - user program c1 = class s := 0 meth11 = action... meth12 a = request... result s result c1 {..} c2 x = class meth2 = action... send x.meth11 tmp <- x.meth result c2 {..} obj1 = new c1 obj2 = new c2 obj1 Timber proctype meth11() { lock(o1); crit1++; assert(crit1 == 1); crit1--; unlock(o1); } inline meth12() { lock(o1); /* some code */ unlock(o1); } proctype meth2() { lock(o2); async(m11); meth12(); unlock(o2); } /* external stimuli */ active proctype stimuli() { do :: async(m11) :: async(m2) od } Promela
39 We need to know at compile-time c1 = class s := 0 meth11 = action... meth12 a = request... result s result c1 {..} c2 x = class meth2 = action... send x.meth11 tmp <- x.meth result c2 {..} obj1 = new c1 obj2 = new c2 obj1 Timber proctype meth11() { lock(o1); crit1++; assert(crit1 == 1); crit1--; unlock(o1); } inline meth12() { lock(o1); /* some code */ unlock(o1); } proctype meth2() { lock(o2); async(m11); meth12(); unlock(o2); } /* external stimuli */ active proctype stimuli() { do :: async(m11) :: async(m2) od } Promela
40 Timber and static evaluation of functions in collaboration with Johan Nordlander 40
41 Timber program RTS Specification φ (LTL) Abstract model M in Promela SPIN model checker M φ? yes or counterexamples 41
42 The problem To determine at compile-time - which objects will be created at runtime - which of these objects are locked by tasks and what are the patterns of the locking In general undecidable, but for embedded applications a suitable solution exists. 42
43 Key observations For typical embedded applications: - Objects often correspond to physical components, and thus are created at top-level (root) or at initialization parts of already created objects. - Tasks, their deadlines*, and communication structure between often tasks can be statically determined. We can infer the needed information if certain expressions at functional layer can be statically evaluated. * Original motivation for this work was SRP schedulability analysis 43
44 The analysis Traverse abstract syntax of the program, and evaluate expressions as much as possible at compile-time: Eval[[E]] computes a value of E if it can, or unknown, otherwise 44
45 Some internals of the analysis The main idea due to [Might&Van Horn 2010] Abstract interpretation - a computable approximation of program s semantics Based on CESK* abstract machine - an idealized low-level model of an interpreter - a state transition system S S 45
46 The main idea state: E,ρ, σ,c expression environment store continuation cycles causing termination problems can be present in value closures or continuations both go to store 46
47 The main idea state: E,ρ, σ,c expression environment store continuation by assuring Addr to be finite we make the whole analysis terminate single abstraction point = the store 47
48 The complete machine... 48
49 Static value analysis Eval[[E]] = V iff E,[], [], mt V,,, mt 49
50 Discussion Deriving the communication structure is an absraction Is the abstraction sound/complete w.r.t. a given LTL property? 50
51 Future work Static evaluation is an ongoing work; immediate todo s: - finishing off description of the analysis - implementation (partly done) Model checking Timber/Timber-like programs - Study properties of the abstraction - Uppaal could be used as well - Could Combined with WCET info for basic blocks and max sizes of state variables - Could include internal computation into the PROMELA/Uppaal model 51
Formal Verification by Model Checking
Formal Verication by Model Checking Jonathan Aldrich Carnegie Mellon University Based on slides developed by Natasha Sharygina 17-654/17-754: Analysis of Software Artacts Spring 2006 1 CTL Model Checking
More informationLinear Temporal Logic. Model Checking and. Based on slides developed by Natasha Sharygina. Carnegie Mellon University.
Model Checking and Linear Temporal Logic Jonathan Aldrich Carnegie Mellon University Based on slides developed by Natasha Sharygina 17-654: Analysis of Software Artifacts 1 Formal Verification by Model
More informationLecture 1: Model Checking. Edmund Clarke School of Computer Science Carnegie Mellon University
Lecture 1: Model Checking Edmund Clarke School of Computer Science Carnegie Mellon University 1 Cost of Software Errors June 2002 Software bugs, or errors, are so prevalent and so detrimental that they
More informationTool demonstration: Spin
Tool demonstration: Spin 1 Spin Spin is a model checker which implements the LTL model-checking procedure described previously (and much more besides). Developed by Gerard Holzmann of Bell Labs Has won
More informationDesign and Analysis of Distributed Interacting Systems
Design and Analysis of Distributed Interacting Systems Lecture 5 Linear Temporal Logic (cont.) Prof. Dr. Joel Greenyer May 2, 2013 (Last Time:) LTL Semantics (Informally) LTL Formulae are interpreted on
More informationComputer Lab 1: Model Checking and Logic Synthesis using Spin (lab)
Computer Lab 1: Model Checking and Logic Synthesis using Spin (lab) Richard M. Murray Nok Wongpiromsarn Ufuk Topcu Calornia Institute of Technology AFRL, 25 April 2012 Outline Spin model checker: modeling
More information4/6/2011. Model Checking. Encoding test specifications. Model Checking. Encoding test specifications. Model Checking CS 4271
Mel Checking LTL Property System Mel Mel Checking CS 4271 Mel Checking OR Abhik Roychoudhury http://www.comp.nus.edu.sg/~abhik Yes No, with Counter-example trace 2 Recap: Mel Checking for mel-based testing
More informationThe Spin Model Checker : Part I/II
The Spin Model Checker : Part I/II Moonzoo Kim CS Dept. KAIST Korea Advanced Institute of Science and Technology Motivation: Tragic Accidents Caused by SW Bugs 2 Cost of Software Errors June 2002 Software
More informationSystem Correctness. EEC 421/521: Software Engineering. System Correctness. The Problem at Hand. A system is correct when it meets its requirements
System Correctness EEC 421/521: Software Engineering A Whirlwind Intro to Software Model Checking A system is correct when it meets its requirements a design without requirements cannot be right or wrong,
More informationModel Checking with Automata An Overview
Model Checking with Automata An Overview Vanessa D Carson Control and Dynamical Systems, Caltech Doyle Group Presentation, 05/02/2008 VC 1 Contents Motivation Overview Software Verification Techniques
More informationThe SPIN Model Checker
The SPIN Model Checker Metodi di Verifica del Software Andrea Corradini Lezione 1 2013 Slides liberamente adattate da Logic Model Checking, per gentile concessione di Gerard J. Holzmann http://spinroot.com/spin/doc/course/
More informationCopyright 2008 CS655 System Modeling and Analysis. Korea Advanced Institute of Science and Technology
The Spin Model Checker : Part I Copyright 2008 CS655 System Korea Advanced Institute of Science and Technology System Spec. In Promela Req. Spec. In LTL Overview of the Spin Architecture Spin Model pan.c
More informationModel-Checking Concurrent Systems. The Model Checker Spin. The Model Checker Spin. Wolfgang Schreiner
Model-Checking Concurrent Systems Wolfgang Schreiner Wolfgang.Schreiner@risc.jku.at Research Institute for Symbolic Computation (RISC) Johannes Kepler University, Linz, Austria http://www.risc.jku.at 1.
More informationNetwork Protocol Design and Evaluation
Network Protocol Design and Evaluation 05 - Validation, Part III Stefan Rührup Summer 2009 Overview In the first parts of this chapter: Validation models in Promela Defining and checking correctness claims
More informationComputer Aided Verification 2015 The SPIN model checker
Computer Aided Verification 2015 The SPIN model checker Grigory Fedyukovich Universita della Svizzera Italiana March 11, 2015 Material borrowed from Roberto Bruttomesso Outline 1 Introduction 2 PROcess
More informationApplications of Formal Verification
Applications of Formal Verification Model Checking: Introduction to PROMELA Bernhard Beckert Mattias Ulbrich SS 2017 KIT INSTITUT FÜR THEORETISCHE INFORMATIK KIT University of the State of Baden-Württemberg
More informationApplications of Formal Verification
Applications of Formal Verification Model Checking: Introduction to PROMELA Prof. Dr. Bernhard Beckert Dr. Vladimir Klebanov SS 2012 KIT INSTITUT FÜR THEORETISCHE INFORMATIK KIT University of the State
More informationModel-Checking Concurrent Systems
Model-Checking Concurrent Systems Wolfgang Schreiner Wolfgang.Schreiner@risc.jku.at Research Institute for Symbolic Computation (RISC) Johannes Kepler University, Linz, Austria http://www.risc.jku.at Wolfgang
More informationSérgio Campos, Edmund Clarke
Sérgio Campos, Edmund 1 / 23 Model checking is a technique that relies on building a finite model of a system and checking that a desired property holds in that model. The check is performed by an exhaustive
More informationDesign of Internet Protocols:
CSCI 234 Design of Internet Protocols: George Blankenship George Blankenship 1 Outline Verication and Validation History and motivation Spin Promela language Promela model George Blankenship 2 Verication
More informationDistributed Systems Programming (F21DS1) SPIN: Formal Analysis II
Distributed Systems Programming (F21DS1) SPIN: Formal Analysis II Andrew Ireland Department of Computer Science School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh Overview Introduce
More informationINF672 Protocol Safety and Verification. Karthik Bhargavan Xavier Rival Thomas Clausen
INF672 Protocol Safety and Verication Karthik Bhargavan Xavier Rival Thomas Clausen 1 Course Outline Lecture 1 [Today, Sep 15] Introduction, Motivating Examples Lectures 2-4 [Sep 22,29, Oct 6] Network
More informationApplications of Formal Verification
Applications of Formal Verification Model Checking: Introduction to PROMELA Prof. Dr. Bernhard Beckert Dr. Vladimir Klebanov SS 2010 KIT INSTITUT FÜR THEORETISCHE INFORMATIK KIT University of the State
More informationFormal Specification and Verification
Formal Specification and Verification Model Checking with Temporal Logic Bernhard Beckert Based on a lecture by Wolfgang Ahrendt and Reiner Hähnle at Chalmers University, Göteborg Formal Specification
More informationFormal Specification and Verification
Formal Specification and Verification Introduction to Promela Bernhard Beckert Based on a lecture by Wolfgang Ahrendt and Reiner Hähnle at Chalmers University, Göteborg Formal Specification and Verification:
More informationComputer Lab 1: Model Checking and Logic Synthesis using Spin (lab)
Computer Lab 1: Model Checking and Logic Synthesis using Spin (lab) Richard M. Murray Nok Wongpiromsarn Ufuk Topcu California Institute of Technology EECI 19 Mar 2013 Outline Spin model checker: modeling
More informationSPIN: Part /614 Bug Catching: Automated Program Verification. Sagar Chaki November 12, Carnegie Mellon University
SPIN: Part 1 15-414/614 Bug Catching: Automated Program Verification Sagar Chaki November 12, 2012 What is This All About? Spin On-the-fly verifier developed at Bell-labs by Gerard Holzmann and others
More informationMore on Verification and Model Checking
More on Verification and Model Checking Wednesday Oct 07, 2015 Philipp Rümmer Uppsala University Philipp.Ruemmer@it.uu.se 1/60 Course fair! 2/60 Exam st October 21, 8:00 13:00 If you want to participate,
More informationLecture 3 SPIN and Promela
Lecture 3 SPIN and Promela 1 What is SPIN(Simple Promela INterpreter) A tool for analyzing mels of concurrent systems Mels described in Promela Language with concurrent processes Communication via shared
More informationPromela and SPIN. Mads Dam Dept. Microelectronics and Information Technology Royal Institute of Technology, KTH. Promela and SPIN
Promela and SPIN Mads Dam Dept. Microelectronics and Information Technology Royal Institute of Technology, KTH Promela and SPIN Promela (Protocol Meta Language): Language for modelling discrete, event-driven
More informationFormal Methods for Software Development
Formal Methods for Software Development Model Checking with Temporal Logic Wolfgang Ahrendt 21st September 2018 FMSD: Model Checking with Temporal Logic /GU 180921 1 / 37 Model Checking Check whether a
More informationIntroduction to Model Checking
Introduction to Model Checking René Thiemann Institute of Computer Science University of Innsbruck WS 2007/2008 RT (ICS @ UIBK) week 4 1/23 Outline Promela - Syntax and Intuitive Meaning Promela - Formal
More informationModel-Driven Verifying Compilation of Synchronous Distributed Applications
Model-Driven Verifying Compilation of Synchronous Distributed Applications Sagar Chaki, James Edmondson October 1, 2014 MODELS 14, Valencia, Spain Copyright 2014 Carnegie Mellon University This material
More informationDistributed Systems Programming (F21DS1) Formal Verification
Distributed Systems Programming (F21DS1) Formal Verification Andrew Ireland Department of Computer Science School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh Overview Focus on
More informationSoftware Engineering using Formal Methods
Software Engineering using Formal Methods Introduction to Promela Wolfgang Ahrendt & Richard Bubel & Reiner Hähnle & Wojciech Mostowski 31 August 2011 SEFM: Promela /GU 110831 1 / 35 Towards Model Checking
More informationSoftware Engineering using Formal Methods
Software Engineering using Formal Methods Introduction to Promela Wolfgang Ahrendt 03 September 2015 SEFM: Promela /GU 150903 1 / 36 Towards Model Checking System Model Promela Program byte n = 0; active
More informationTHE MODEL CHECKER SPIN
THE MODEL CHECKER SPIN Shin Hong, KAIST 17 th April,2007 1/33 Contents Introduction PROMELA Linear Temporal Logic Automata-theoretic software verification Example : Simple Elevator 2 SPIN is a software
More informationLTL Reasoning: How It Works
Distributed Systems rogramming F21DS1 LTL Reasoning: How It Works Andrew Ireland School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh Distributed Systems rogramming F21DS1 2 Overview
More informationNetwork Protocol Design and Evaluation
Network Protocol Design and Evaluation 05 - Validation, Part I Stefan Rührup Summer 2009 Overview In the last lectures: Specification of protocols and data/message formats In this chapter: Building a validation
More informationWhat is SPIN(Simple Promela Interpreter) Material About SPIN. Elements of Promela. Basic Variables and Types. Typical Structure of Promela Model
What is SPIN(Simple Promela Interpreter) Lecture 3 SPIN and Promela A tool for analyzing mels of reactive systems Mels described in Promela Language with concurrent processes, Communication via channels,
More informationMulti-Threaded System int x, y, r; int *p, *q, *z; int **a; EEC 421/521: Software Engineering. Thread Interleaving SPIN. Model Checking using SPIN
EEC 421/521: Software Engineering Model Checking using SPIN 4/29/08 EEC 421/521: Software Engineering 1 Multi-Threaded System int x, y, r; int *p, *q, *z; int **a; thread_1(void) /* initialize p, q, and
More informationT Reactive Systems: Kripke Structures and Automata
Tik-79.186 Reactive Systems 1 T-79.186 Reactive Systems: Kripke Structures and Automata Spring 2005, Lecture 3 January 31, 2005 Tik-79.186 Reactive Systems 2 Properties of systems invariants: the system
More informationWhat is SPIN(Simple Promela Interpreter) Elements of Promela. Material About SPIN. Basic Variables and Types. Typical Structure of Promela Model
What is SPIN(Simple Promela Interpreter) Lecture XX SPIN and Promela A tool for analyzing mels of reactive systems Mels described in Promela Language with concurrent processes, Communication via channels,
More informationFormal Methods in Software Engineering. Lecture 07
Formal Methods in Software Engineering Lecture 07 What is Temporal Logic? Objective: We describe temporal aspects of formal methods to model and specify concurrent systems and verify their correctness
More informationTimo Latvala. January 28, 2004
Reactive Systems: Kripke Structures and Automata Timo Latvala January 28, 2004 Reactive Systems: Kripke Structures and Automata 3-1 Properties of systems invariants: the system never reaches a bad state
More informationTo be or not programmable Dimitri Papadimitriou, Bernard Sales Alcatel-Lucent April 2013 COPYRIGHT 2011 ALCATEL-LUCENT. ALL RIGHTS RESERVED.
To be or not programmable Dimitri Papadimitriou, Bernard Sales Alcatel-Lucent April 2013 Introduction SDN research directions as outlined in IRTF RG outlines i) need for more flexibility and programmability
More informationSPIN, PETERSON AND BAKERY LOCKS
Concurrent Programs reasoning about their execution proving correctness start by considering execution sequences CS4021/4521 2018 jones@scss.tcd.ie School of Computer Science and Statistics, Trinity College
More informationThe SPIN Model Checker
The SPIN Model Checker Metodi di Verifica del Software Andrea Corradini GianLuigi Ferrari Lezione 3 2011 Slides per gentile concessione di Gerard J. Holzmann 2 the do-statement do :: guard 1 -> stmnt 1.1
More informationLecture1: Symbolic Model Checking with BDDs. Edmund M. Clarke, Jr. Computer Science Department Carnegie Mellon University Pittsburgh, PA 15213
Lecture: Symbolic Model Checking with BDDs Edmund M Clarke, Jr Computer Science Department Carnegie Mellon University Pittsburgh, PA 523 Temporal Logic Model Checking Specification Language: A propositional
More informationBuilding Graphical Promela Models using UPPAAL GUI
Building Graphical Promela Models using UPPAAL GUI Master s Thesis Report by Vasu Hossaholal Lingegowda Software Systems Engineering Group: B2-201 under the guidance of Dr. Alexandre David Department of
More informationTemporal Logic and Timed Automata
Information Systems Analysis Temporal Logic and Timed Automata (5) UPPAAL timed automata Paweł Głuchowski, Wrocław University of Technology version 2.3 Contents of the lecture Tools for automatic verification
More informationSPIN part 2. Verification with LTL. Jaime Ramos. Departamento de Matemática, Técnico, ULisboa
SPIN part 2 Verification with LTL Jaime Ramos Departamento de Matemática, Técnico, ULisboa Borrowed from slides by David Henriques, Técnico, ULisboa LTL model checking How Spin works Checks non-empty intersection
More informationResearch Collection. Formal background and algorithms. Other Conference Item. ETH Library. Author(s): Biere, Armin. Publication Date: 2001
Research Collection Other Conference Item Formal background and algorithms Author(s): Biere, Armin Publication Date: 2001 Permanent Link: https://doi.org/10.3929/ethz-a-004239730 Rights / License: In Copyright
More informationAutomated Reasoning. Model Checking with SPIN (II)
Automated Reasoning Model Checking with SPIN (II) Alan Bundy page 1 Verifying Global Properties Assertions can be used to verify a property locally For example, place assert(memreturned) at the end of
More informationINF5140: Specification and Verification of Parallel Systems
INF5140: Specification and Verification of Parallel Systems Lecture 09 Defining Correctness Claims Gerar Schneider Department of Informatics University of Oslo INF5140, Spring 2007 Gerar Schneider (Ifi,
More informationDistributed Systems Programming (F21DS1) SPIN: Formal Analysis I
Distributed Systems Programming (F21DS1) SPIN: Formal Analysis I Andrew Ireland Department of Computer Science School of Mathematical and Computer Sciences Heriot-Watt University Edinburgh Overview Introduce
More informationModel Checking. Automatic Verification Model Checking. Process A Process B. when not possible (not AI).
Sérgio Campos scampos@dcc.ufmg.br Why? Imagine the implementation of a complex hardware or software system: A 100K gate ASIC perhaps 100 concurrent modules; A flight control system dozens of concurrent
More informationPatrick Trentin Formal Methods Lab Class, March 03, 2017
Spin: Introduction Patrick Trentin patrick.trentin@unitn.it http://disi.unitn.it/trentin Formal Methods Lab Class, March 03, 2017 These slides are derived from those by Stefano Tonetta, Alberto Griggio,
More informationModel Checking Revision: Model Checking for Infinite Systems Revision: Traffic Light Controller (TLC) Revision: 1.12
Model Checking mc Revision:.2 Model Checking for Infinite Systems mc 2 Revision:.2 check algorithmically temporal / sequential properties fixpoint algorithms with symbolic representations: systems are
More informationDouble Header. Two Lectures. Flying Boxes. Some Key Players: Model Checking Software Model Checking SLAM and BLAST
Model Checking #1 Double Header Two Lectures Model Checking Software Model Checking SLAM and BLAST Flying Boxes It is traditional to describe this stuff (especially SLAM and BLAST) with high-gloss animation
More informationModel Requirements and JAVA Programs MVP 2 1
Model Requirements and JAVA Programs MVP 2 1 Traditional Software The Waterfall Model Problem Area Development Analysis REVIEWS Design Implementation Costly wrt time and money. Errors are found too late
More informationCOMP 763. Eugene Syriani. Ph.D. Student in the Modelling, Simulation and Design Lab School of Computer Science. McGill University
Eugene Syriani Ph.D. Student in the Modelling, Simulation and Design Lab School of Computer Science McGill University 1 OVERVIEW In the context In Theory: Timed Automata The language: Definitions and Semantics
More informationCover Page. The handle holds various files of this Leiden University dissertation
Cover Page The handle http://hdl.handle.net/1887/22891 holds various files of this Leiden University dissertation Author: Gouw, Stijn de Title: Combining monitoring with run-time assertion checking Issue
More informationProving Dekker with SPIN and PROMELA
15-410...fairness disabled... Proving Dekker with SPIN and PROMELA Joshua Wise With help from Greg Hartman L36_SPIN 1 Synchronization Project 4 due Wednesday Everyone having fun? Kernel interviews If you
More informationWHEN concurrent processes share a resource such as a file
1 Verification of mutual exclusion algorithms with SMV System Nikola Bogunović, Edgar Pek Faculty of Electrical Engineering and Computing Unska 3 Croatia email: nikola.bogunovic@fer.hr, edgar.pek@fer.hr
More informationTOWARDS AUTOMATED VERIFICATION OF WEB SERVICES
TOWARDS AUTOMATED VERIFICATION OF WEB SERVICES Cátia Vaz INESC-ID Lisboa, ISEL-IPL Rua Alves Redol 9, 1000-029 Lisboa cvaz@cc.isel.ipl.pt Carla Ferreira INESC-ID, IST-UTL Rua Alves Redol 9, 1000-029 Lisboa
More informationAlgorithmic Verification. Algorithmic Verification. Model checking. Algorithmic verification. The software crisis (and hardware as well)
Algorithmic Verification The software crisis (and hardware as well) Algorithmic Verification Comp4151 Lecture 1-B Ansgar Fehnker Computer become more powerful (Moore s law) The quality of programs cannot
More informationIntroduction to Linear-Time Temporal Logic. CSE 814 Introduction to LTL
Introduction to Linear-Time Temporal Logic CSE 814 Introduction to LTL 1 Outline Motivation for TL in general Types of properties to be expressed in TL Structures on which LTL formulas are evaluated Syntax
More informationThe Spin Model Checker : Part I. Moonzoo Kim KAIST
The Spin Model Checker : Part I Moonzoo Kim KAIST Hierarchy of SW Coverage Criteria Complete Value Coverage CVC (SW) Model checking Complete Path Coverage CPC Concolic testing All-DU-Paths Coverage ADUP
More informationCS477 Formal Software Development Methods / 39
CS477 Formal Software Development Methods 2112 SC, UIUC egunter@illinois.edu http://courses.engr.illinois.edu/cs477 SPIN Beginners Tutorial April 11, 2018 Hello World /* A "Hello World" Promela model for
More informationSpin: Overview of PROMELA
Spin: Overview of PROMELA Patrick Trentin patrick.trentin@unitn.it http://disi.unitn.it/~trentin Formal Methods Lab Class, Mar 04, 2016 These slides are derived from those by Stefano Tonetta, Alberto Griggio,
More informationThe Maude LTL Model Checker and Its Implementation
The Maude LTL Model Checker and Its Implementation Steven Eker 1,José Meseguer 2, and Ambarish Sridharanarayanan 2 1 Computer Science Laboratory, SRI International Menlo Park, CA 94025 eker@csl.sri.com
More informationFormal Verification of Process Communications in Operational Flight Program for a Small-Scale Unmanned Helicopter
Formal Verication of Process Communications in Operational Flight Program for a Small-Scale Unmanned Helicopter Dong-Ah Lee 1, Junbeom Yoo 2 and Doo-Hyun Kim 3 1, 2 School of Computer Science and Engineering
More informationSWEN-220 Mathematical Models of Software. Concurrency in SPIN Interleaving
SWEN-220 Mathematical Models of Software Concurrency in SPIN Interleaving 1 Topics Interleaving Process Interference Race Conditions Atomicity 2 Concurrency Concurrency can come in many flavors Concurrent
More informationTesting Concurrent Programs: Model Checking SPIN. Bengt Jonsson
Testing Concurrent Programs: Model Checking SPIN Bengt Jonsson Model Checking Section Weeks 15 and 16. Goal: Understand and use the basics of Model checking, using state space exploration Modeling parallel
More informationPatrick Trentin Formal Methods Lab Class, Feb 26, 2016
Spin: Introduction Patrick Trentin patrick.trentin@unitn.it http://disi.unitn.it/~trentin Formal Methods Lab Class, Feb 26, 2016 These slides are derived from those by Stefano Tonetta, Alberto Griggio,
More informationA Tutorial on Model Checker SPIN
A Tutorial on Model Checker SPIN Instructor: Hao Zheng Department of Computer Science and Engineering University of South Florida Tampa, FL 33620 Email: haozheng@usf.edu Phone: (813)974-4757 Fax: (813)974-5456
More informationNo model may be available. Software Abstractions. Recap on Model Checking. Model Checking for SW Verif. More on the big picture. Abst -> MC -> Refine
No model may be available Programmer Software Abstractions Tests Coverage Code Abhik Roychoudhury CS 5219 National University of Singapore Testing Debug Today s lecture Abstract model (Boolean pgm.) Desirable
More informationFormal Methods for Software Development
Formal Methods for Software Development Verification with Spin Wolfgang Ahrendt 07 September 2018 FMSD: Spin /GU 180907 1 / 34 Spin: Previous Lecture vs. This Lecture Previous lecture Spin appeared as
More informationTutorial on Model Checking Modelling and Verification in Computer Science
Tutorial on Model Checking Modelling and Verification in Computer Science Armin Biere Institute for Formal Models and Verification Johannes Kepler University, Linz, Austria Abstract. This paper serves
More informationA Case Study for CTL Model Update
A Case Study for CTL Model Update Yulin Ding and Yan Zhang School of Computing & Information Technology University of Western Sydney Kingswood, N.S.W. 1797, Australia email: {yding,yan}@cit.uws.edu.au
More informationFachgebiet Softwaretechnik, Heinz Nixdorf Institut, Universität Paderborn. 2.3 Timed Automata and Real-Time Statecharts
2.3 Timed Automata and Real-Time Statecharts Develop a BOOK RATING APP and win awesome prizes! The creators of the best submissions will be invited to an exclusive party in February
More informationSpin: Overview of PROMELA
Spin: Overview of PROMELA Patrick Trentin patrick.trentin@unitn.it http://disi.unitn.it/trentin Formal Methods Lab Class, March 10, 2017 These slides are derived from those by Stefano Tonetta, Alberto
More informationSoftware Model Checking. From Programs to Kripke Structures
Software Model Checking (in (in C or or Java) Java) Model Model Extraction 1: int x = 2; int y = 2; 2: while (y
More informationProving the Correctness of Distributed Algorithms using TLA
Proving the Correctness of Distributed Algorithms using TLA Khushboo Kanjani, khush@cs.tamu.edu, Texas A & M University 11 May 2007 Abstract This work is a summary of the Temporal Logic of Actions(TLA)
More informationTransforming UML Collaborating Statecharts for Verification and Simulation
Transforming UML Collaborating Statecharts for Verification and Simulation Patrick O. Bobbie, Yiming Ji, and Lusheng Liang School of Computing and Software Engineering Southern Polytechnic State University
More informationModel-Driven Verifying Compilation of Synchronous Distributed Applications
Model-Driven Verifying Compilation of Synchronous Distributed Applications Sagar Chaki, James Edmondson October 1, 2014 MODELS 14, Valencia, Spain Report Documentation Page Form Approved OMB No. 0704-0188
More informationReducing Fair Stuttering Refinement of Transaction Systems
Reducing Fair Stuttering Refinement of Transaction Systems Rob Sumners Advanced Micro Devices robert.sumners@amd.com November 16th, 2015 Rob Sumners (AMD) Transaction Progress Checking November 16th, 2015
More informationCIS 1.5 Course Objectives. a. Understand the concept of a program (i.e., a computer following a series of instructions)
By the end of this course, students should CIS 1.5 Course Objectives a. Understand the concept of a program (i.e., a computer following a series of instructions) b. Understand the concept of a variable
More informationSPIN: Introduction and Examples
SPIN: Introduction and Examples Alessandra Giordani agiordani@disi.unitn.it http://disi.unitn.it/~agiordani Formal Methods Lab Class, September 28, 2014 *These slides are derived from those by Stefano
More informationUsing Spin to Help Teach Concurrent Programming
Using Spin to Help Teach Concurrent Programming John Regehr May 1, 1998 1 Introduction and Motivation Writing correct concurrent programs is very difficult; race conditions, deadlocks, and livelocks can
More informationDirected Model Checking for PROMELA with Relaxation-Based Distance Functions
Directed Model Checking for PROMELA with Relaxation-Based Distance Functions Ahmad Siyar Andisha and Martin Wehrle 2 and Bernd Westphal Albert-Ludwigs-Universität Freiburg, Germany {andishaa,westphal}@informatik.uni-freiburg.de
More informationApplication of Formal Verification to Software Security
Application of Formal Verification to Software Security Reynald Affeldt David Nowak AIST-RCIS, Japan TWISC Summer School 2006 Verification of Security Properties of Software Generally speaking, Software
More informationLectures 20, 21: Axiomatic Semantics
Lectures 20, 21: Axiomatic Semantics Polyvios Pratikakis Computer Science Department, University of Crete Type Systems and Static Analysis Based on slides by George Necula Pratikakis (CSD) Axiomatic Semantics
More informationVerification of Web Service Flows with Model-Checking Techniques
Verification of Web Service Flows with Model-Checking Techniques Shin NAKAJIMA Hosei University and PRESTO, JST nkjm@i.hosei.ac.jp Abstract UDDI register Web service is an emerging software technology
More informationFormal Analysis and Verification of a Communication Protocol
Proceedings of the 5th WSEAS Int. Conference on Information Security and Privacy, Venice, Italy, November 20-22, 2006 103 Formal Analysis and Verification of a Communication Protocol XIN BEN LI, DE CHAO
More informationCS558 Programming Languages
CS558 Programming Languages Fall 2016 Lecture 7a Andrew Tolmach Portland State University 1994-2016 Values and Types We divide the universe of values according to types A type is a set of values and a
More informationA Verification Approach for GALS Integration of Synchronous Components
GALS 2005 Preliminary Version A Verification Approach for GALS Integration of Synchronous Components F. Doucet, M. Menarini, I. H. Krüger and R. Gupta 1 Computer Science and Engineering University of California,
More informationCS477 Formal Software Development Methods / 32
CS477 Formal Software Development Methods 2112 SC, UIUC egunter@illinois.edu http://courses.engr.illinois.edu/cs477 SPIN Beginners Tutorial April 13, 2018 Assertion Violation: mutextwrong1.pml bit flag;
More informationDeterministic Concurrency
Candidacy Exam p. 1/35 Deterministic Concurrency Candidacy Exam Nalini Vasudevan Columbia University Motivation Candidacy Exam p. 2/35 Candidacy Exam p. 3/35 Why Parallelism? Past Vs. Future Power wall:
More information