A
d ide

Alexandre Duret-Lutz

23 August 2010

IITJodhpur

http://www.lrde.epita.fr/~ad l/en s/m /iit j.p df

system

properties tests?

not exhaustive!

system

properties

modelof the system model of the properties

system

properties

modelof the system model of the properties simulation?

not exhaustive!

system

properties

modelof the system model of the properties formal

veriation

system

properties

modelof the system model of the properties formal

veriation

theorem proving modelheking

1

Desribe the system in a way that allowsreasoning

2

Proveproperty by logial reasoning

Thisan beentirely manual, or using the help of a theorem prover

(e.g. Coq) that isnot fully automati.

Problem: it is hard to produe a ounterexample whena theorem is

false.

Researhwork in the area: new proof systems, study ofthe expressive

powerof various logis...

Anautomati approah to formal veriation.

Anexhaustive veriation of allbehaviorsof a model.

Theath: the model has to beabstrat enough (i.e. not too

detailed) to allowits omplete exploration.

Globalvariables: req

P

and req

Q .

Proess P (innite loop)

1. req

P

←

2. wait

(

=

)

3. Critial Setion

4. req

P

←

Proess Q (innite loop)

1. req

Q

←

2. wait

(

=

)

3. Critial Setion

4. req

Q

←

Initialstate: P

=

=

=

=

Properties to hek:

1

At anytime, there is atmost oneproess in Critial Setion.

2

Anyproess requesting entrane to the CS will eventually enter

it.

3

Theorderof entranes to the CS shouldfollow the orderof

P

=

,

P

=

Q

=

,

=

P

=

,

P

=

Q

=

,

=

P

=

,

P

=

Q

=

,

=

P

=

,

P

=

Q

=

,

=

P

=

,

P

=

Q

=

,

=

P

=

,

P

=

Q

=

,

=

P

=

,

P

=

Q

=

,

=

P

=

,

P

=

Q

=

,

=

P

=

,

P

=

Q

=

,

=

P

=

,

P

=

Q

=

,

=

P

=

,

P

=

Q

=

,

=

P

=

,

P

=

Q

=

,

=

P

=

,

P

=

Q

=

,

=

P

=

,

P

=

Q

=

,

=

P

=

,

P

=

Q

=

,

=

P

=

,

P

=

Q

=

,

=

P

=

,

P

=

Q

=

,

=

P

=

,

P

=

Q

=

,

=

P

=

,

P

=

Q

=

,

=

P

=

,

P

=

Q

=

,

=

P

=

,

P

=

Q

=

,

=

P

=

,

P

=

Q

=

,

=

P

=

,

P

=

Q

=

,

=

P

=

,

P

=

Q

=

,

=

P

=

,

P

=

Q

=

,

=

At anytime, there isat most oneproess in CS.

Translation: thereis no state with P

=

=

It istrue.

Tohek thispropertyweneed to explorethe entirestate spae one.

Weonly need to know the set of states, not how they are onneted.

Anyproess requesting entrane to CS will eventually enterit.

Translation: anyexeutionthat visits a state with P

=

visit a state with P

=

=

=

It isfalse.

Thestate

P

=

,

=

Q

=

,

=

has no suessor (it is a deadlok).

To hekthis property, wehave to know the entire graph (states

alone are not enough).

Theorder of entranes into the CS follow the order of requests.

Translation: anyexeutionpath that sees a state with

P

=

∧

=

=

a state with P

=

It istrue if we ignorethe deadlok.

Samekind of veriationas property 2.

Represent the system using a niteautomaton.

Represent the property using a temporallogiformula.

To ompare these two objets, onvert the temporal logi

formula into an automaton.

Some work onthe twoautomata will tell us ifthey are

ompatible.

Propositional logi formulas an beuse haraterizeone instant.

r: red light on

y: yellow light on

g: green light on

r

∧

∧

=

∧ ¬

∧ ¬

=

¬

∧ ¬

∧

=

¬

∧ ¬

∧ ¬

=

How an we say that preedes ?

How an we say that the system is not always ?

⇒

Letf and g betwo propositional logi formulas:

f f Present

f Xf

Next

Letf and g betwo propositional logi formulas:

f f Present

f Xf

Next

f f f f f f f f f

Gf Globally

f Ff

Finally

Letf and g betwo propositional logi formulas:

f f Present

f Xf

Next

f f f f f f f f f

Gf Globally

f Ff

Finally

f f f f f

g

f Ug Until

g g g g g g

fg

g g g g g g g g g

f Rg Releases

Next Xf f is true atnext instant

Globally Gf f it true at all instants

Finally Ff f will be trueeventually (now or in the future)

Until f Ug f stays true untilg beomes true

¬

(

∧ ¬

∧ ¬

)

G

((¬

∧

∧ ¬

) →

(

∧ ¬

∧ ¬

))

GF

(¬

∧ ¬

∧

)

These formulas an be translated into automata.

ATransition-based Generalized BühiAutomata has:

a set of states, with a designated initial state,

a setof transitions between these states, labeledbypropositional

logiformulas,

a set of sets of transitions, alled aeptane sets.

Aninnite pathin this automaton is aepted ifit visits innitely

often a transition for eah aeptane sets.

s

1

s

2

s

3 s

4 s

5

p

∧

p

¬

p

∨

q p

p

∧

p

Example of TGBA for G

(

→

)

r

∨ ¬

⊤

⊤

r

¯

a b

¯

ab

¯

ab

¯

ab

⊗

∨

¬

¯

a b

¯

ab

¯

ab

¯

ab

⊗

∨

¬

High-levelmodel

M

State-spaegeneration

State-spaeautomaton

A

M

Synhronizedprodut

L (

⊗

_¬ϕ ) = L (

) ∩ L (

¬ϕ )

Negatedformula

automaton

A

¬ϕ

LTL

→

translation

LTLformula

ϕ

Produtautomaton

A

M

⊗

_¬ϕ

Emptinesshek

L (

⊗

_¬ϕ ) = ^? ∅

M

|= ϕ

or

formula set 1 st

hild 2

nd

hild

Γ ∪ {¬⊤} Γ ∪ {⊥}

Γ ∪ {¬⊥} Γ ∪ {⊤}

Γ ∪ {¬¬

} Γ ∪ {

} Γ ∪ {

∧

} Γ ∪ {

,

}

Γ ∪ {

∨

} Γ ∪ {

} Γ ∪ {

}

Γ ∪ {¬(

∧

)} Γ ∪ {¬

} Γ ∪ {¬

}

Γ ∪ {¬(

∨

)} Γ ∪ {¬

, ¬

}

Tableau for

¬ϕ

^{ϕ = ¬(¬}

^∨

^{) ∨ (¬(}

^∧

^{) ∨ (}

^∧

⁾⁾

{¬(¬(¬

∨

) ∨ (¬(

∧

) ∨ (

∧

)))}

{¬¬(¬

∨

), ¬(¬(

∧

) ∨ (

∧

))}

{¬

∨

, ¬(¬(

∧

) ∨ (

∧

))}

{¬

∨

, ¬¬(

∧

), ¬(

∧

)}

{¬

∨

,

∧

, ¬(

∧

)}

{¬

∨

,

,

, ¬(

∧

)}

{¬

,

,

, ¬(

∧

)} {

,

,

, ¬(

∧

)}

{

,

,

, ¬

} {

,

,

, ¬

}

Xa

a

¯

¯

· · ·

⊤

⊤

aUb

a

¯

b a

¯

b ab

¯

¯

b

· · ·

b

a

⊤

aUb

≡

∨ (

∧

(

))

formula set 1 st

hild 2

nd

hild

Γ ∪ {¬⊤} Γ ∪ {⊥}

Γ ∪ {¬⊥} Γ ∪ {⊤}

Γ ∪ {¬¬

} Γ ∪ {

} Γ ∪ {

∧

} Γ ∪ {

,

}

Γ ∪ {

∨

} Γ ∪ {

} Γ ∪ {

}

Γ ∪ {¬(

∧

)} Γ ∪ {¬

} Γ ∪ {¬

}

Γ ∪ {¬(

∨

)} Γ ∪ {¬

, ¬

}

formula set 1 st

hild 2

nd

hild

Γ ∪ {¬⊤} Γ ∪ {⊥}

Γ ∪ {¬⊥} Γ ∪ {⊤}

Γ ∪ {¬¬

} Γ ∪ {

} Γ ∪ {

∧

} Γ ∪ {

,

}

Γ ∪ {

∨

} Γ ∪ {

} Γ ∪ {

} Γ ∪ {¬(

∧

)} Γ ∪ {¬

} Γ ∪ {¬

} Γ ∪ {¬(

∨

)} Γ ∪ {¬

, ¬

}

Γ ∪ {¬

} Γ ∪ {

¬

}

Γ ∪ {

} Γ ∪ {

} Γ ∪ {

,

(

),

} Γ ∪ {¬(

)} Γ ∪ {¬

, ¬

} Γ ∪ {¬

,

¬(

)}

Pg is a promise that g will befullled

Tableau for

(

) ∧ (

¬

)

{(

) ∧ (

¬

)}

Règlesdetableau

formulaset 1 st

hild 2

nd

hild

Γ ∪ {

∧

} Γ ∪ {

,

}

Γ ∪ {

∨

} Γ ∪ {

} Γ ∪ {

} Γ ∪ {

} Γ ∪ {

} Γ ∪ {

,

(

),

}

.

.

.

.

.

.

.

.

.

Tableau for

(

) ∧ (

¬

)

{(

) ∧ (

¬

)}

{

,

¬

}

{

, ¬

} {

,

,

(

¬

),

¬

}

Règlesdetableau

formulaset 1 st

hild 2

nd

hild

Γ ∪ {

∧

} Γ ∪ {

,

}

Γ ∪ {

∨

} Γ ∪ {

} Γ ∪ {

} Γ ∪ {

} Γ ∪ {

} Γ ∪ {

,

(

),

}

.

.

.

.

.

.

.

.

.

Tableau for

(

) ∧ (

¬

)

{(

) ∧ (

¬

)}

{

,

¬

} {

, ¬

}

{

}

{

,

,

(

¬

),

¬

}

Règlesdetableau

formulaset 1 st

hild 2

nd

hild

Γ ∪ {

∧

} Γ ∪ {

,

}

Γ ∪ {

∨

} Γ ∪ {

} Γ ∪ {

} Γ ∪ {

} Γ ∪ {

} Γ ∪ {

,

(

),

}

.

.

.

.

.

.

.

.

.

Tableau for

(

) ∧ (

¬

)

{(

) ∧ (

¬

)}

{

,

¬

} {

, ¬

}

{

}

∅

{

,

,

(

¬

),

¬

}

Règlesdetableau

formulaset 1 st

hild 2

nd

hild

Γ ∪ {

∧

} Γ ∪ {

,

}

Γ ∪ {

∨

} Γ ∪ {

} Γ ∪ {

} Γ ∪ {

} Γ ∪ {

} Γ ∪ {

,

(

),

}

.

.

.

.

.

.

.

.

.

Tableau for

(

) ∧ (

¬

)

{(

) ∧ (

¬

)}

{

,

¬

} {

, ¬

}

{

}

∅

{

,

,

(

¬

),

¬

} {

,

¬

}

{

, ¬

} {

,

,

(

¬

),

¬

}

Règlesdetableau

formulaset 1 st

hild 2

nd

hild

Γ ∪ {

∧

} Γ ∪ {

,

}

Γ ∪ {

∨

} Γ ∪ {

} Γ ∪ {

} Γ ∪ {

} Γ ∪ {

} Γ ∪ {

,

(

),

}

.

.

.

.

.

.

.

.

.

Tableau for

(

) ∧ (

¬

)

{(

) ∧ (

¬

)}

{

,

¬

} {

, ¬

}

{

}

∅

{

,

,

(

¬

),

¬

} {

,

¬

}

{

, ¬

} {

,

,

(

¬

),

¬

} {

¬

}

{ ¬

} {

,

(

¬

),

¬

}

Règlesdetableau

formulaset 1 st

hild 2

nd

hild

Γ ∪ {

∧

} Γ ∪ {

,

}

Γ ∪ {

∨

} Γ ∪ {

} Γ ∪ {

} Γ ∪ {

} Γ ∪ {

} Γ ∪ {

,

(

),

}

.

.

.

.

.

.

.

.

.

Tableau for

(

) ∧ (

¬

)

{(

) ∧ (

¬

)}

{

,

¬

} {

, ¬

}

{

}

∅

{

,

,

(

¬

),

¬

} {

,

¬

}

{

, ¬

} {

,

,

(

¬

),

¬

} {

¬

}

{ ¬

} {

,

(

¬

),

¬

}

Règlesdetableau

formulaset 1 st

hild 2

nd

hild

Γ ∪ {

∧

} Γ ∪ {

,

}

Γ ∪ {

∨

} Γ ∪ {

} Γ ∪ {

} Γ ∪ {

} Γ ∪ {

} Γ ∪ {

,

(

),

}

.

.

.

.

.

.

.

.

.

(

) ∧ (

¬

)

{(

) ∧ (

¬

)}

{

,

¬

} {

, ¬

}

{

}

∅

{

,

,

(

¬

),

¬

} {

,

¬

}

{

, ¬

} {

,

,

(

¬

),

¬

} {

¬

}

{ ¬

} {

,

(

¬

),

¬

}

¬

a

⊤

a

∧

b

¬

High-levelmodel

M

State-spaegeneration

State-spaeautomaton

A

M

Synhronizedprodut

L (

⊗

_¬ϕ ) = L (

) ∩ L (

¬ϕ )

Negatedformula

automaton

A

¬ϕ

LTL

→

translation

LTLformula

ϕ

Produtautomaton

A

M

⊗

_¬ϕ

Emptinesshek

L (

⊗

_¬ϕ ) = ^? ∅

M

|= ϕ

or

1 2 s

r

Client C

1

2 3

r

1

s

1

r

2

s

2

Server S

− ×

a

d

ChannelB

Synhronizationrules for the system

h

,

,

,

,

,

,

i

(

) h

i (

) h

i (

) h

i (

) h

i (

) h

, . , . , d , .

i (

) h

i (

) h

i (

) h

, . , a , . , .

i

If a lient sends a request, will healways get an answer?

111

− − −−

211

− − ×−

121

− − −×

212

− − −−

221

− − ××

123

− − −−

211

× − −−

222

− − −×

223

− − ×−

121

− × −−

221

× − −×

221

− × ×−

223

× − −−

222

− × −−

221 q0

q1 q2

q3 q4 q5

q

6

q

7

q

8

q

9

q

10

q

11

q

12

q

13

q14

Wewill write properties regarding sending and reeiving messages:

LetAP

= {

,

,

,

}

a

1

: an answeris on its way between S and C

1

a

2

: an answeris on its way between S and C

2

r

1

: a request is on its way between C

1 and S

r

2

: a request is on its way between C

2 and S

Theproperty if a lient sends a request, hewill getan answer an

be rewritten as

∀

∈ {

,

}

istrue will visit a state where a

i

is true.

¯

¯

¯

d

1

¯

d

2

¯

r1

¯

d1

¯

d2

¯

r1

¯

¯

d1d2

¯

r

1

¯

¯

d

1

¯

d

2

¯

¯

1 d

2

¯

¯

¯

d

1

¯

d

2

r1

¯

¯

d1

¯

d2

¯

r1

¯

¯

d1d2

¯

r1

¯

d1

¯

d2

¯

r1r2

¯

d1

¯

d2

r1

¯

¯

d

1 d

2

¯

r1r2

d

1

¯

d

2

r

1

¯

¯

d1

¯

d2

¯

r

1 r

2

¯

d1

¯

d2

r1r2

¯ ¯

q0

q

1

q

2

q3 q4 q5

q6 q7 q8 q9

q

10

q

11

q12 q13

q14

an exeutionthat visits a state where r

i

is true will visit a state

where a

i

is true. In LTL: G

(

→

)

(by symmetryon the model, let'sdeal onlywith i

=

Weare looking for a ounterexample: an exeutionthat visits a state

where r

1

is trueand whih will neververify a

1

fromthen on. In LTL:

¬

(

→

) =

(

∧

¬

)

an exeutionthat visits a state where r

i

is true will visit a state

where a

i

is true. In LTL: G

(

→

)

(by symmetryon the model, let'sdeal onlywith i

=

Weare looking for a ounterexample: an exeutionthat visits a state

where r

1

is trueand whih will neververify a

1

fromthen on. In LTL:

¬

(

→

) =

(

∧

¬

)

Suh a ounterexample an be represented by a (transition-based)

Bühiautomaton:

⊤

r

1

∧ ¬

¬

q

C

q

D

q0

,

q1

,

q2

,

q3

,

,

q5

,

q6

,

,

q8

,

q9

,

q10

,

,

q12

,

,

q14

,

q0

,

q1

,

,

q3

,

q4

,

,

q6

,

q7

,

,

,

q10

,

,

q12

,

,

q14

,

1

Roots:

1

DFS:

s

1

s

1

s

2

s

3 s

4 s

5

1 2

Roots:

1 2

DFS:

s

1 s

2

s

1

s

2

s

3 s

4 s

5

1 2 3

Roots:

1 2 3

DFS:

s

1 s

2 s

3

s

1

s

2

s

3 s

4 s

5

4

1 2 3

Roots:

1 2 3 4

DFS:

s

1 s

2 s

3 s

4

s

1

s

2

s

3 s

4 s

5

4

1 2 3

Roots:

1 2 3:

DFS:

s

1 s

2 s

3 s

4 s

3

s

1

s

2

s

3 s

4 s

5

4

1 2 3

Roots:

1 2 3:

DFS:

s

1 s

2 s

3 s

4

s

1

s

2

s

3 s

4 s

5

4

1 2 3

Roots:

1 2 3:

DFS:

s

1 s

2 s

3

s

1

s

2

s

3 s

4 s

5

0

1 2 0

Roots:

1 2

DFS:

s

1 s

2

s

1

s

2

s

3 s

4 s

5

0 5

1 2 0

Roots:

1 2 5

DFS:

s

1 s

2 s

5

s

1

s

2

s

3 s

4 s

5

0 5

1 2 0

Roots:

1 2 5

DFS:

s

1 s

2 s

4

s

5

s

1

s

2

s

3 s

4 s

5

0 5

1 2 0

Roots:

1 2 5

DFS:

s

1 s

2 s

5

s

1

s

2

s

3 s

4 s

5

0 5

1 2 0

Roots:

1:

DFS:

s

1 s

2 s

5 s

1

s

1

s

2

s

3 s

4 s

5

0 5

1 2 0

Roots:

1:

DFS:

s

1 s

2 s

5

s

1

s

2

s

3 s

4 s

5

0 5

1 2 0

Roots:

1:

DFS:

s

1 s

2

s

1

s

2

s

3 s

4 s

5

0 5

1 2 0

Roots:

1:

DFS:

s

1 s

2 s

1

s

1

s

2

s

3 s

4 s

5

Found!

High-levelmodel

M

State-spaegeneration

State-spaeautomaton

A

M

Synhronizedprodut

L (

⊗

_¬ϕ ) = L (

) ∩ L (

¬ϕ )

Negatedformula

automaton

A

¬ϕ

LTL

→

translation

LTLformula

ϕ

Produtautomaton

A

M

⊗

_¬ϕ

Emptinesshek

L (

⊗

_¬ϕ ) = ^? ∅

M

|= ϕ

or

ounterexample

Bühiautomata an be used to represent sets (nite or innite)

of innitebehaviors. Some operations are easy to perform on

these sets: union, intersetion, and emptiness hek. Some are

harder(e.g. omplementation, universality hek)

Byreduing the veriationproblemto someoperationsbetween

automata,we atually obtained an eient veriation

proedure.

Bottlenek: translating a formula of size n an lead to a TGBA

of size 2 O

(

)

. Thesize of the produt of two automatais

bounded by the produt of the sizes, so it is important to have

small automataon both sides. Emptiness hek is linear in the

size of the produt.

For CSE students: the automataseen in ToC are simpler beause

they reognizenite words. Yet they allow similar operations and