Reducing CTL-Live Model Checking to First-Order Logic Validity - - PowerPoint PPT Presentation

▶
reducing ctl live model checking to first order logic
SMART_READER_LITE
LIVE PREVIEW

Reducing CTL-Live Model Checking to First-Order Logic Validity - - PowerPoint PPT Presentation

Mar 16, 2024 238 likes •536 views

Reducing CTL-Live Model Checking to First-Order Logic Validity Checking Amirhossein Vakili and Nancy A. Day Cheriton School of Computer Science 24 October 2014 Vakili and Day (U. of Waterloo) CTL-Live Model Checking in FOL 24 October 2014 1

slide-1
SLIDE 1

Reducing CTL-Live Model Checking to First-Order Logic Validity Checking

Amirhossein Vakili and Nancy A. Day

Cheriton School of Computer Science

24 October 2014

Vakili and Day (U. of Waterloo) CTL-Live Model Checking in FOL 24 October 2014 1 / 10

slide-2
SLIDE 2

Model Checking based on SAT/SMT Solving

Model:

..... ..... .....

X

Model Checker

Fixpoint? SMT solver

Safety Property:

Is X reachable? YES/NO

Focus on safety properties Iteratively calls the solver

Vakili and Day (U. of Waterloo) CTL-Live Model Checking in FOL 24 October 2014 2 / 10

slide-3
SLIDE 3

Our Result: CTL-Live Model Checking as FOL Validity

Model:

..... ..... .....

X

Model Checker

Reduction SMT solver

Liveness Property:

Is X always reachable? YES/NO

Focus on liveness properties Solved by first-order logic deduction techniques (e.g., SMT solvers) No need for abstraction or invariant generation

Vakili and Day (U. of Waterloo) CTL-Live Model Checking in FOL 24 October 2014 3 / 10

slide-4
SLIDE 4

CTL-Live

CTL-Live includes CTL connectives that are defined using the least fixpoint operator of mu-calculus. Temporal part ϕ ::= π | ϕ1 ∨ ϕ2 | ϕ1 ∧ ϕ2 ::= EXϕ | AXϕ | EFϕ | AFϕ ::= ϕ1EUϕ2 | ϕ1AUϕ2 Propositional part π ::= P | ¬π | π1 ∨ π2 where P is a labelling predicate.

Vakili and Day (U. of Waterloo) CTL-Live Model Checking in FOL 24 October 2014 4 / 10

slide-5
SLIDE 5

CTL-Live

CTL-Live includes CTL connectives that are defined using the least fixpoint operator of mu-calculus. Temporal part ϕ ::= π | ϕ1 ∨ ϕ2 | ϕ1 ∧ ϕ2 ::= EXϕ | AXϕ | EFϕ | AFϕ ::= ϕ1EUϕ2 | ϕ1AUϕ2 Propositional part π ::= P | ¬π | π1 ∨ π2 where P is a labelling predicate. In CTL-Live AF P (EF¬P) AU (AXQ)

Vakili and Day (U. of Waterloo) CTL-Live Model Checking in FOL 24 October 2014 4 / 10

slide-6
SLIDE 6

CTL-Live

CTL-Live includes CTL connectives that are defined using the least fixpoint operator of mu-calculus. Temporal part ϕ ::= π | ϕ1 ∨ ϕ2 | ϕ1 ∧ ϕ2 ::= EXϕ | AXϕ | EFϕ | AFϕ ::= ϕ1EUϕ2 | ϕ1AUϕ2 Propositional part π ::= P | ¬π | π1 ∨ π2 where P is a labelling predicate. In CTL-Live AF P (EF¬P) AU (AXQ) Not In CTL-Live ¬(AF P) AG P

Vakili and Day (U. of Waterloo) CTL-Live Model Checking in FOL 24 October 2014 4 / 10

slide-7
SLIDE 7

Symbolic Kripke Structures in FOL

c = 0 initial c = 2 c = 3 c = 4 ... c = 5 ... c = 6 ... Vakili and Day (U. of Waterloo) CTL-Live Model Checking in FOL 24 October 2014 5 / 10

slide-8
SLIDE 8

Symbolic Kripke Structures in FOL

c = 0 initial c = 2 c = 3 c = 4 ... c = 5 ... c = 6 ...

S = {0, 1, 2, 3, ..} state space S0(c) ⇔ c = 0 initial states N(c, c′) ⇔ c′ = c + 2 ∨ c′ = c + 3 next-state relation

Vakili and Day (U. of Waterloo) CTL-Live Model Checking in FOL 24 October 2014 5 / 10

slide-9
SLIDE 9

Symbolic Kripke Structures in FOL

c = 0 initial c = 2 c = 3 c = 4 ... c = 5 ... c = 6 ...

S = {0, 1, 2, 3, ..} state space S0(c) ⇔ c = 0 initial states N(c, c′) ⇔ c′ = c + 2 ∨ c′ = c + 3 next-state relation Notation symbolic(K) | =c AF c > 3 [AF c > 3] = {0, 1, 2, ...}

Vakili and Day (U. of Waterloo) CTL-Live Model Checking in FOL 24 October 2014 5 / 10

slide-10
SLIDE 10

Intuition: States Satisfying AF P

According to encoding of AF in mu-calculus, [AF P] is the smallest set Y that satisfies: (1)∀s • P(s) ⇒ Y (s) (2)∀s •

  • ∀s′ • N(s, s′) ⇒ Y (s′)
  • ⇒ Y (s)

Vakili and Day (U. of Waterloo) CTL-Live Model Checking in FOL 24 October 2014 6 / 10

slide-11
SLIDE 11

Intuition: States Satisfying AF P

According to encoding of AF in mu-calculus, [AF P] is the smallest set Y that satisfies: (1)∀s • P(s) ⇒ Y (s) (2)∀s •

  • ∀s′ • N(s, s′) ⇒ Y (s′)
  • ⇒ Y (s)

State Space

Vakili and Day (U. of Waterloo) CTL-Live Model Checking in FOL 24 October 2014 6 / 10

slide-12
SLIDE 12

Intuition: States Satisfying AF P

According to encoding of AF in mu-calculus, [AF P] is the smallest set Y that satisfies: (1)∀s • P(s) ⇒ Y (s) (2)∀s •

  • ∀s′ • N(s, s′) ⇒ Y (s′)
  • ⇒ Y (s)

State Space Y1

Vakili and Day (U. of Waterloo) CTL-Live Model Checking in FOL 24 October 2014 6 / 10

slide-13
SLIDE 13

Intuition: States Satisfying AF P

According to encoding of AF in mu-calculus, [AF P] is the smallest set Y that satisfies: (1)∀s • P(s) ⇒ Y (s) (2)∀s •

  • ∀s′ • N(s, s′) ⇒ Y (s′)
  • ⇒ Y (s)

State Space Y1 Y2

Vakili and Day (U. of Waterloo) CTL-Live Model Checking in FOL 24 October 2014 6 / 10

slide-14
SLIDE 14

Intuition: States Satisfying AF P

According to encoding of AF in mu-calculus, [AF P] is the smallest set Y that satisfies: (1)∀s • P(s) ⇒ Y (s) (2)∀s •

  • ∀s′ • N(s, s′) ⇒ Y (s′)
  • ⇒ Y (s)

State Space Y1 Y2 Y3

Vakili and Day (U. of Waterloo) CTL-Live Model Checking in FOL 24 October 2014 6 / 10

slide-15
SLIDE 15

Intuition: States Satisfying AF P

According to encoding of AF in mu-calculus, [AF P] is the smallest set Y that satisfies: (1)∀s • P(s) ⇒ Y (s) (2)∀s •

  • ∀s′ • N(s, s′) ⇒ Y (s′)
  • ⇒ Y (s)

State Space Y1 Y2 Y3 Y4

Vakili and Day (U. of Waterloo) CTL-Live Model Checking in FOL 24 October 2014 6 / 10

slide-16
SLIDE 16

Intuition: States Satisfying AF P

According to encoding of AF in mu-calculus, [AF P] is the smallest set Y that satisfies: (1)∀s • P(s) ⇒ Y (s) (2)∀s •

  • ∀s′ • N(s, s′) ⇒ Y (s′)
  • ⇒ Y (s)

State Space Y1 Y2 Y3 Y4 [AF P]

[AF P] =

  • Y ∈ Θ

Y where Θ = {Y s satisfying (1), (2)}

Vakili and Day (U. of Waterloo) CTL-Live Model Checking in FOL 24 October 2014 6 / 10

slide-17
SLIDE 17

Intuition: Model Checking AF P

Model checking is about a subset relation, S0 ⊆ [AF P]: S0 ⊆

  • Y ∈ Θ

Y

Vakili and Day (U. of Waterloo) CTL-Live Model Checking in FOL 24 October 2014 7 / 10

slide-18
SLIDE 18

Intuition: Model Checking AF P

Model checking is about a subset relation, S0 ⊆ [AF P]: S0 ⊆

  • Y ∈ Θ

Y iff ∀Y ∈ Θ • S0 ⊆ Y

Vakili and Day (U. of Waterloo) CTL-Live Model Checking in FOL 24 October 2014 7 / 10

slide-19
SLIDE 19

Intuition: Model Checking AF P

Model checking is about a subset relation, S0 ⊆ [AF P]: S0 ⊆

  • Y ∈ Θ

Y iff ∀Y ∈ Θ • S0 ⊆ Y Higher-order universal quantifier

Vakili and Day (U. of Waterloo) CTL-Live Model Checking in FOL 24 October 2014 7 / 10

slide-20
SLIDE 20

Intuition: Model Checking AF P

Model checking is about a subset relation, S0 ⊆ [AF P]: S0 ⊆

  • Y ∈ Θ

Y iff ∀Y ∈ Θ • S0 ⊆ Y Higher-order universal quantifier First-order logic formula

Vakili and Day (U. of Waterloo) CTL-Live Model Checking in FOL 24 October 2014 7 / 10

slide-21
SLIDE 21

Intuition: Model Checking AF P

Model checking is about a subset relation, S0 ⊆ [AF P]: S0 ⊆

  • Y ∈ Θ

Y iff ∀Y ∈ Θ • S0 ⊆ Y Higher-order universal quantifier First-order logic formula

Definition (FOL Validity)

Γ | = Φ iff every interpretation that satisfies Γ also satisfies Φ.

Vakili and Day (U. of Waterloo) CTL-Live Model Checking in FOL 24 October 2014 7 / 10

slide-22
SLIDE 22

Intuition: Model Checking AF P

Model checking is about a subset relation, S0 ⊆ [AF P]: S0 ⊆

  • Y ∈ Θ

Y iff ∀Y ∈ Θ • S0 ⊆ Y Higher-order universal quantifier First-order logic formula

Definition (FOL Validity)

Γ | = Φ iff every interpretation that satisfies Γ also satisfies Φ.

Description of model + ∀s • P(s) ⇒ Y (s) | = S0 ⊆ Y symbolic(K) ∀s •

  • ∀s′ • N(s, s′) ⇒ Y (s′)
  • ⇒ Y (s)

Vakili and Day (U. of Waterloo) CTL-Live Model Checking in FOL 24 October 2014 7 / 10

slide-23
SLIDE 23

Our Result

Reduction Procedure: INPUT: symbolic(K) : symbolic representation of a Kripke structure. ϕ

: a CTL-Live formula.

OUTPUT: symbolic(K) CTLL2FOL(ϕ) | = S0 ⊆ ⌈ϕ⌉

Theorem (Reduction of CTL-Live Model Checking to FOL Validity)

symbolic(K) | =c ϕ iff symbolic(K)

  • CTLL2FOL(ϕ) |

= S0 ⊆ ⌈ϕ⌉

Vakili and Day (U. of Waterloo) CTL-Live Model Checking in FOL 24 October 2014 8 / 10

slide-24
SLIDE 24

Our Result

Reduction Procedure: INPUT: symbolic(K) : symbolic representation of a Kripke structure. ϕ

: a CTL-Live formula.

OUTPUT: symbolic(K) CTLL2FOL(ϕ) | = S0 ⊆ ⌈ϕ⌉

Example: ∀c • S0(c) ⇔ c = 0 ∀c, c′ • N(c, c′) ⇔ c′ = c + 2 ∨ c′ = c + 3 ∀c • c > 3 ⇒ Y (c) ∀c •

  • ∀c′ • N(c, c′) ⇒ Y (c′)
  • ⇒ Y (c)

| = S0 ⊆ Y

Vakili and Day (U. of Waterloo) CTL-Live Model Checking in FOL 24 October 2014 8 / 10

slide-25
SLIDE 25

Our Result

Reduction Procedure: INPUT: symbolic(K) : symbolic representation of a Kripke structure. ϕ

: a CTL-Live formula.

OUTPUT: symbolic(K) CTLL2FOL(ϕ) | = S0 ⊆ ⌈ϕ⌉

Example: ∀c • S0(c) ⇔ c = 0 ∀c, c′ • N(c, c′) ⇔ c′ = c + 2 ∨ c′ = c + 3 ∀c • c > 3 ⇒ Y (c) ∀c •

  • ∀c′ • N(c, c′) ⇒ Y (c′)
  • ⇒ Y (c)

| = S0 ⊆ Y

Vakili and Day (U. of Waterloo) CTL-Live Model Checking in FOL 24 October 2014 8 / 10

slide-26
SLIDE 26

Our Result

Reduction Procedure: INPUT: symbolic(K) : symbolic representation of a Kripke structure. ϕ

: a CTL-Live formula.

OUTPUT: symbolic(K) CTLL2FOL(ϕ) | = S0 ⊆ ⌈ϕ⌉

Example: ∀c • S0(c) ⇔ c = 0 ∀c, c′ • N(c, c′) ⇔ c′ = c + 2 ∨ c′ = c + 3 ∀c • c > 3 ⇒ Y (c) ∀c •

  • ∀c′ • N(c, c′) ⇒ Y (c′)
  • ⇒ Y (c)

| = S0 ⊆ Y

Vakili and Day (U. of Waterloo) CTL-Live Model Checking in FOL 24 October 2014 8 / 10

slide-27
SLIDE 27

Current Progress: Infinite State Model Checking

Based on this result, we used Z3 and CVC4 to model check CTL-Live properties of 4 infinite systems. Case studies were from different domains. SMT solvers are efficient in model checking CTL-Live properties.

Vakili and Day, “Verifying CTL-live Properties of Infinite State Models using SMT Solvers,” To appear in the proceedings of FSE’14.

Vakili and Day (U. of Waterloo) CTL-Live Model Checking in FOL 24 October 2014 9 / 10

slide-28
SLIDE 28

Conclusion

Presented CTL-Live, a fragment of CTL such that its model checking is reducible to FOL validity.

◮ No need for abstraction or invariant generation ◮ Use state-of-the-art FOL reasoners for model checking ◮ Only FOL reasoning is required for verification Vakili and Day (U. of Waterloo) CTL-Live Model Checking in FOL 24 October 2014 10 / 10