Automatic Verification of Finite State Concurrent Systems Edmund M. - - PDF document

Automatic Verification of Finite State Concurrent Systems

Edmund M. Clarke, Jr. Computer Science Department Carnegie Mellon University Pittsburgh, PA 15213

1

Temporal Logic Model Checking

Specification Language: A propositional temporal logic. Verification Procedure: Exhaustive search of the state space of the concurrent system to determine truth of specification.

• E. M. Clarke and E. A. Emerson. Synthesis of

synchronization skeletons for branching time temporal logic. In Logic of programs: workshop, Yorktown Heights, NY, May 1981, volume 131 of Lecture Notes in Computer Science. Springer-Verlag, 1981.

concurrent systems in CESAR. In Proceedings of the Fifth International Symposium in Programming, volume 137 of Lecture Notes in Computer Science. Springer-Verlag, 1981.

2

Why Model Checking?

Advantages:

Main Disadvantage: State Explosion Problem

Much progress recently!!

3

Outline of Talk

• 1. Temporal Logic (CTL

• 2. Model Checking Problem.
• 3. Some Notable Successes.
• 4. Symbolic Model Checking with Binary Decision Diagrams.
• 5. Tomorrow:

Symbolic Model Checking without Binary Decision Diagrams.

• 6. Directions for Future Research.

4

• 1. Temporal Logic

a b b c c a b a b c c c b c State Transition Graph or Kripke Model (Unwind State Graph to obtain Infinite Tree) Infinite Computation Tree

5

Computation Tree Logics

Let

be a Kripke Structure, and let

be the transition relation for

. A path is an infinite sequence of states

every

• 1. Path quantifier:

• 2. Temporal Operator:

6

The Logic CTL

Two types of formulas in CTL

• 1. A state formula is either

is a path formula.

• 2. A path formula is either

path formulas.

7

The Logics CTL and LTL

In CTL each of the linear-time operators

,

, and U must be immediately preceded by a path quantifier. Example: AG

In Linear temporal logic (LTL) formulas have the form A

where

atomic propositions. Example: A FG

8

The Meaning of Path Quantifiers

Let

be a Kripke structure,

, and

formula, then

E

if and only if there exist a path

starting at

such that

A

starting at

have

9

Expressive Power

It can be shown that the three logics CTL*, CTL, and LTL have different expressive powers. For example, there is no CTL formula that is equivalent to the LTL formula A

Likewise, there is no LTL formula that is equivalent to the CTL formula AG

The disjunction A

AG

not expressible in either CTL or LTL.

10

Basic CTL Operators

This lecture will deal primarily with CTL. The four most widely used CTL operators are illustrated below. Each computation tree has the state

g . . . . . . . . . . . . g . . . . . . . . . . . . g g

EF

AF

g . . . . . . . . . . . . g g g . . . . . . . . . . . . g g g g g g

EG

AG

11

Typical CTL

Started holds but Ready does not hold.

AF

eventually Acknowledged.

• ften on every computation path.

Restart state.

GF

infinitely-often Enabled, then it is infinitely-often Executed. Note that the first four formulas are CTL formulas. The last is an LTL formula, not expressible in CTL.

12

• 2. Model Checking Problem

Let

be the state–transition graph obtained from the concurrent system. Let

be the specification expressed in temporal logic. Find all states

such that

Efficient model checking algorithms exist for CTL.

verification of finite-state concurrent systems using temporal logic specifications. ACM Trans. Programming Languages and Systems, 8(2):pages 244–263, 1986.

13

The EMC System

Preprocessor Model Checker (EMC) CTL formulas State Transition Graph 10 to 10 states 4 5 True or Counterexample

14

• H. Hiraishi (Kyoto University)

Vectorized version of EMC algorithm on Fujitsu FACOM VP400E Vector Processor using an explicit representation of the state–transition graph. State Machine size:

CTL formula:

Time for model checking:

15

• 3. Notable Examples

The following examples illustrate the power of model checking to handle industrial size problems. They come from many sources, not just my research group.

methods: State of the art and future directions. ACM Computing Surveys, 28(4):626–643, December 1996.

16

Notable Examples–IEEE Futurebus

the cache coherence protocol in the IEEE Futurebus+ Standard.

attempted to show that it satisfied a formal specification of cache coherence.

design of the protocol.

find errors in an IEEE standard.

to validate Futurebus+ were based on informal techniques.

17

Notable Examples–IEEE SCI

to verify the cache coherence protocol of the IEEE Scalable Coherent Interface.

definition of the SCI standard.

verified only small instances of the system.

uninitialized variables to subtle logical errors.

had been extensively discussed, simulated, and even implemented.

18

Notable Examples–HDLC

designed at AT&T in Madrid.

properties of the design. The design was almost finished, so no errors were expected.

verified, using the FormalCheck verifier.

reduced throughput or caused lost transmissions.

verified.

19

Notable Examples–Analog Circuits

award for proving manually the correctness of a control protocol used in Philips stereo components.

protocol automatically using HyTech.

automatically all the properties stated and hand proved by Bosscher et al.

Two years earlier this was considered out of reach for algorithmic methods.

20

Notable Examples–ISDN/ISUP

application of formal verification methods in a software project within AT&T.

the development of the CCITT ISDN User Part Procotol.

analyzed 145 requirements using a special-purpose model checker.

requirements were logically inconsistent.

21

Notable Examples–Buildings

active structural control system to make buildings more resistant to earthquakes.

and used hydraulic actuators to exert countervailing forces.

• analyzable. By using semantic minimization it was possible to

derive a much smaller model.

controller to worsen, rather than dampen, the vibration experienced during earthquakes.

22

• 4. Symbolic Model Checking with BDDs

Ken McMillan implemented a version of the CTL model checking algorithm using Binary Decision Diagrams in the fall

• f 1987.

Now able to handle much larger concurrent systems—some with more than

• J. Hwang. Symbolic model checking:

Information and Computation, 98(2):pages 142–170, 1992.

Academic Publishers, 1993.

23

Fixpoint Algorithms

EF

EX EF

p p

24

Fixpoint Algorithms (cont.)

Key properties of EF

• 1. EF

EX EF

2.

EX

implies EF

We write EF

Lfp

EX

How to compute EF

False

EX

EX

EX

. . .

25

EF

s p

26

EF

s p

EX

27

EF

s p

EX

28

EF

s p

EX

29

Ordered Binary Decision Trees and Diagrams

Ordered Binary Decision Tree for the two-bit comparator, given by the formula

is shown in the figure below:

b a2 1 b a2 b b a2 1 b a2 b b a2 1 b a2 b b a2 1 b a2 b 2 2 2 2 2 2 2 2 a 2 a 2 a 2 a 2 b 1 b 1 a 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1

30

From Binary Decision Trees to Diagrams

An Ordered Binary Decision Diagram (OBDD) is an ordered decision tree where

Given a parameter ordering, OBDD is unique up to isomorphism.

• manipulation. IEEE Transactions on Computers,

C-35(8):677–691, 1986.

31

OBDD for Comparator Example

If we use the ordering

function, we obtain the OBDD below:

1 1 1 1 b1 a1 b1 a2 b2 b2 1 1 1

32

Variable Ordering Problem

The size of an OBDD depends critically on the variable ordering. If we use the ordering

function, we get the OBDD below:

a1 a2 b b a2 b b 1 1 1 1 b b 2 2 1 1 1 1 1 1 1 1 1 1 1 a 2 a1

33

Variable Ordering Problem (Cont.)

For an

vertices will be

number of vertices is

In general, finding an optimal ordering is known to be NP-complete. Moreover, there are boolean functions that have exponential size OBDDs for any variable ordering. An example is the middle output (

• utput) of a combinational

circuit to multiply two

bit integers.

34

Logical operations on OBDD’s

Replace each leaf by its negation

– Use Shannon’s expansion as follows,

to break problem into two subproblems. Solve subproblems recursively. – Always combine isomorphic subtrees and eliminate redundant nodes. – Hash table stores previously computed subproblems – Number of subproblems bounded by

35

Logical operations (cont.)

– By definition,

–

–

Using the above operations, we can build up OBDD’s for complex boolean functions from simpler ones.

36

Symbolic Model Checking Algorithm

How to represent state-transition graphs with Ordered Binary Decision Diagrams: Assume that system behavior is determined by

• boolean state

variables

The Transition relation

will be given as a boolean formula in terms of the state variables:

where

represents the next state. Now convert

to a OBDD!!

37

Symbolic Model Checking (cont.)

Representing transition relations symbolically:

a a, b

Boolean formula for transition relation:

Now, represent as an OBDD!

38

Symbolic Model Checking (cont.)

Consider

EX

Now, introduce state variables and transition relation:

Compute OBDD for relational product on right side of formula.

39

Symbolic Model Checking (cont.)

How to evaluate fixpoint formulas using OBDDs: EF

Lfp

EX

Introduce state variables: EF

Lfp

Now, compute the sequence

until convergence. Convergence can be detected since the sets of states

represented as OBDDs.

40

Future Research

into current verification systems.

complex systems.

Investigate the use of induction with model checking techniques.

hybrid systems

approaches to verification so that control and data can both be handled.

41