Upload
tobias-west
View
219
Download
0
Embed Size (px)
Citation preview
Model Checking
Lecture 4
Tom Henzinger
Model-Checking Problem
I |= S
System model System property
-state-transition graph
-weak or strong fairness constraints
System Model
Temporal logics
-STL (finite runs) : , U
-CTL (infinite runs) : , U,
-LTL (infinite traces) : , U
Automata
-specification automata (trace containment)
-monitor automata (trace emptiness)
-simulation automata (relation between states)
System Properties
A Classification of Properties
-Finite:
-coFinite: (safety)
-Buchi: (weak fairness)
-coBuchi:
-Streett: ( ) (strong fairness)
-Rabin: ( )
The Omega-Regular Languages (Automata)
Streett = Rabin
Buchi coBuchi
FinitecoFinite
counter-free omega-regular (LTL)
Model-Checking Algorithms = Graph Algorithms
1 Finite/coFinite: reachability
2 Buchi/coBuchi: strongly connected components
3 Streett/Rabin: recursive s.c.c.s
4 Simulation: relation refinement
Graph Algorithms
Given: labeled graph (Q, , A, [ ] )
Cost: each node access and edge access has unit cost
Complexity: in terms of
|Q| = n ... number of nodes
|| = m ... number of edges
Reachability and s.c.c.s: O(m+n)
The Graph-Algorithmic View is Problematic
-The graph is given implicitly (by a program) not explicitly (e.g., by adjacency lists).
-Building an explicit graph representation is exponential, but usually unnecessary (“on-the-fly” algorithms).
-The explicit graph representation may be so big, that the “unit-cost model” is not realistic.
-A class of algorithms, called “symbolic algorithms”, do not operate on nodes and edges at all.
Symbolic Model-Checking Algorithms
Given: a “symbolic theory”, that is, an abstract data type called region with the following operations
pre, pre, post, post : region region
, , \ : region region region
, = : region region bool
< >, > < : A region
, Q : region
Intended Meaning of Symbolic Theories
region ... set of states
, , \, , =, ... set operations
<a> = { q Q | [q] = a }
>a< = { q Q | [q] a }
pre (R) = { q Q | ( r R) q r }
pre (R) = { q Q | ( r)( q r r R )}
post (R) = { q Q | ( r R) r q }
post (R) = { q Q | ( r)( r q r R )}
If the state of a system is given by variables of type Vals, and the transitions of the system can be described by operations Ops on Vals, then the first-order theory FO (Vals, Ops) is an adequate symbolic theory:
region ... formula of FO (Vals, Ops)
, , \, , =, , Q... , , , validity, validity, f, t
pre (R(X)) = ( X’)( Trans(X,X’) R(X’) )
pre (R(X)) = ( X’)( Trans(X,X’) R(X’) )
post (R(X)) = ( X”)( R(X”) Trans(X”,X) )
post (R(X)) = ( X”)( Trans(X”,X) R(X’’) )
If FO (Vals, Ops) admits quantifier elimination, then the propositional theory ZO (Vals, Ops) is an adequate symbolic theory:
each pre/post operation is a quantifier elimination
Example: Boolean Systems
-all system variables X are boolean
-region: quantifier-free boolean formula over X
-pre, post: boolean quantifier elimination
Complexity: PSPACE
Example: Presburger Systems
-all system variables X are integers
-the transition relation Trans(X,X’) is defined using only and
-region: quantifier-free formula of (Z, , )
-pre, post: quantifier elimination
An iterative language for writing symbolic model-checking algorithms
-only data type is region
-expressions: pre, post, , , \ , , =, < >, , Q
-assignment, sequencing, while-do, if-then-else
Example: Reachability a
S :=
R := <a>
while R S do
S := S R
R := pre(R)
A recursive language for writing symbolic model-checking algorithms:
The Mu-Calculus
a = ( R) (a pre(R))
a = ( R) (a pre(R))
Syntax of the Mu-Calculus
::= a | a |
| |
pre() | pre() |
(R) | (R) |
R
pre =
pre = R ... region variable
Semantics of the Mu-Calculus
[[ a ]]E := <a>
[[ a ]]E := >a<
[[ ]]E := [[ ]]E [[ ]]E
[[ ]]E := [[ ]]E [[ ]]E
[[ pre() ]]E := pre( [[ ]]E )
[[ pre() ]]E:= pre( [[ ]]E )
E maps each region variable to a region.
Operational Semantics of the Mu-Calculus
[[ (R) ]]E := S’ := ; repeat S := S’; S’ := [[]]E(RS)
until S’=S; return S
[[ (R) ]]E := S’ := Q; repeat S := S’; S’ := [[]]E(RS)
until S’=S; return S
Denotational Semantics of the Mu-Calculus
[[ (R) ]]E := smallest region S such that S = [[]]E(RS)
[[ (R) ]]E := largest region S such that S = [[]]E(RS)
These regions are unique because all operators on regions (, , pre, pre) are monotonic.
a = ( R) (a pre(R))
a = ( R) (a pre(R))
a = ( R) (a pre(R))
a = ( R) (a pre(R))
b U a = ( R) (a (b pre(R)))
a = ( R) (a pre( R )) = ( R) (a pre( ( S) (R pre(S)) ))
-every / alternation adds expressiveness
-all omega-regular languages in alternation depth 2
-model checking complexity: O( (|| (m+n))d ) for formulas of alternation depth d
-most common implementation (SMV, Mocha): use BDDs to represent boolean regions
Binary Decision Diagrams
-canonical data structure for representing quantifier-free boolean formulas
-equivalence checking in constant time
-in practice, model checkers spend more than 90% of their time in “pre-image” or “post-image” computation
-almost synonymous with “symbolic” model checking
-SAT solvers competitive in bounded model checking, which requires no termination (i.e., equivalence) check
Binary Decision Tree
-order k boolean variables x1, ..., xk
-binary tree of height k+1, each leaf labeled 0 or 1
-leaf of path “left, right, right, ...” gives value of boolean formula if x1=0, x2=1, x3=1, etc.
Binary Decision Diagram
1 Identify isomorphic subtrees (this gives a dag)
2 Eliminate nodes with identical left and right successors (for this, nodes need to be labeled with variable names)
For a given boolean formula and variable order, the result is unique.
(The choice of variable order may make an exponential difference!)
Operations on BDDs
, : recursive top-down traversal in O(u v) time if u and v are the number of respective BDD nodes
, : (x) (x) = (0) (1)
Variable reordering
Deciding Simulation
Relation Refinement
Given: state-transition graph (Q, , A, [ ] )
Find: for each state q Q, the set sim(q) Q of states that
simulate q
for each t Q do sim(t) := { u Q | [u] = [t] }
while there are three states s, t, u such thatt s & u sim(t) & sim(s) post(u) =
do
sim(t) := sim(t) \ {u}
{assert if u simulates t, then u sim(t) }
Efficient enumerative implementation: O(m n)
for each t Q do sim(t) := { u Q | [u] = [t] }
while there are three states s, t, u such thatsim(s) post(t) & u sim(t) & sim(s) post(u) =
do
sim(t) := sim(t) \ {u}
{assert s sim(s) }
{assert if u simulates t and t sim(s), then u sim(t) }
Equivalent Variation
Symbolic Implementation
Partition := { <a> | a A and <a> }
for each R Partition do sim(R) := R
while there are two regions R, S Partition such that R pre(sim(S)) &sim(R)\pre(sim(S)) do
R’ := R pre(sim(S)) ; R’’ := R\pre(sim(S))
Partition := (Partition \ {R}) R’
sim(R’) := sim(R) pre(sim(S))
if R’’ then Partition := Partition {R’’}; sim(R’’) := sim(R)
-symbolic algorithm applies also to infinite-state systems
-it terminates iff there is a finite quotient so that any two equivalent states simulate each other