SLIDE 1
2/27
Context
- Starting point:
Work on general-purpose fjxed-point solvers
- Application to timed systems possible?
- Yes, and some more:
- Parameterisation: #processes, timing
- Infjnite data domains
Analysis of Parameterised Timed Systems using Horn Constraints - - PowerPoint PPT Presentation
Analysis of Parameterised Timed Systems using Horn Constraints - - PowerPoint PPT Presentation
Analysis of Parameterised Timed Systems using Horn Constraints Hossein Hojjat Philipp Rmmer Pavle Subotic Wang Yi SynCoP+PV 23 April 2017 Context Starting point: Work on general-purpose fjxed-point solvers Application to timed
SLIDE 2
SLIDE 3
3/27
Overview
Set of Horn constraints System/ Program Property, Analysis rules Horn solver (off-the-shelf) Solvable Unsolvable + Counterexample
Timed automata BIP models Parameterised systems Software programs etc. Floyd-Hoare Design by contract Owicki-Gries Rely Guarantee etc. HSF Z3 Eldarica Duality E.g., equivalent to: No error states are reachable
(timeout)
SLIDE 4
5/27
Example: ERR unreachable?
- Invariants have to satisfy conditions ...
- Need invariants
Constraints: Solution:
SLIDE 5
6/27
Outline
- Parameterised analysis by example
- Model of execution
- Encoding
- Experiments
SLIDE 6
7/27
Timed systems
Trains Controller
[FORTE'94]
Critical section
SLIDE 7
8/27
[HCVS'14]
Timed systems
System invariant: System invariant:
Constraints: Local transitions: Non-interference: + clauses for time elapse, synchronisation, initiation, assertions
SLIDE 8
9/27
Modular Separate invariant for each process Weaker Smaller invariants
Invariant schemata
Monolithic Single invariant for whole system Stronger Detailed invariants
SLIDE 9
10/27
Parameterised systems (link)
After refinements: Invariant schema that enables verification (at most one train crosses bridge at a time)
k-indexed invariant Ashcroft invariant
SLIDE 10
11/27
Basic Systems
Processes Global state space Local state space Initial states Transition relation Error states
where
SLIDE 11
12/27
Execution Model
System state space Initial system states System transition relation System error states Safety: ?
SLIDE 12
13/27
Owicki-Gries-style Horn Encoding
Finite case: is finite Unbounded homogeneous case:
One process replicated infinitely often
Unbounded heterogeneous case:
Infinitely many processes of different types
SLIDE 13
14/27
Invariant Schemata (fjnite case)
Assuming Invariant schema:
an anti-chain (component-wise comparison)
Every element of represents one invariant
SLIDE 14
15/27
Invariant Schemata (fjnite case)
Given schema
choose relation symbols to represent invariant
System invariant
SLIDE 15
16/27
Invariant Schemata (fjnite case)
For instance Modular Separate invariant for each process Monolithic Single invariant for whole system
SLIDE 16
17/27
Clauses (fjnite case)
Initiation
( non-zero entries in )
Consecution Absence of errors Context predicates:
SLIDE 17
18/27
Unbounded Invariant Schemata
Assuming
with or
Invariant schema: For instance
SLIDE 18
19/27
Clauses for (Homogeneous) Unbounded Case
Assuming and
SLIDE 19
20/27
CEX-Guided Refjnement of Schemata
Start with weakest (fully modular) invariant
schema
If Horn constraints are not solvable, check
whether CEX is genuine – Yes → System CEX – No → Choose stronger schema
Example: trains model
SLIDE 20
21/27
Extensions of the Basic Model
Physical time (discrete, dense)
– Add a global clock (global variable) – Delay transitions
Communication channels (UPPAAL-style)
– Clauses encoding simultaneous transition of two processes
Barriers BIP-style interactions
SLIDE 21
22/27
Protocol X (link)
Protocol is correct assuming timing parameters
SLIDE 22
23/27
On Completeness
Set of Horn constraints Concurrent System Owicki-Gries- style encoding Horn solver (off-the-shelf) Usually incomplete → “Best-effort” Relatively complete? Finite case (+ time) ✔ General infinite case ✘ Well-structured TS [FSE'16] ✔
SLIDE 23
24/27
Experiments
Horn solver: Eldarica Machine: Intel Core i7 Duo 2.9 GHz, 8GB Details: [HCVS'14]
SLIDE 24
25/27
Conclusions
Framework for encoding parameterised
systems as Horn clauses
Support for various features:
Time, data, communication, parameters
Feasible for real models?
initial experiments promising
https://github.com/uuverifiers/eldarica
SLIDE 25
26/27
Appendix
SLIDE 26
27/27
(Constrained) Horn clauses
Definition Suppose
- is some constraint language (e.g., Presburger A.);
- is a set of relation symbols;
- is a set of first-order variables.
Then a Horn clause is a formula where
- is a constraint in (without symbols from );
- each is a literal of the form ;
- is either , or of the same form as the .
SLIDE 27
28/27