Automated Reasoning Model Checking with Spin (III) Alan Bundy - - PowerPoint PPT Presentation

▶
automated reasoning model checking with spin iii
SMART_READER_LITE
LIVE PREVIEW

Automated Reasoning Model Checking with Spin (III) Alan Bundy - - PowerPoint PPT Presentation

Apr 22, 2023 736 likes •1.01k views

Automated Reasoning Model Checking with Spin (III) Alan Bundy Automated Reasoning Model Checking with Spin (III) Lecture 12, page 1 Outline of Verification Process Objective: form one big automata, which Spin can use for verification.

slide-1
SLIDE 1

Automated Reasoning Lecture 12, page 1 Model Checking with Spin (III)

Automated Reasoning Model Checking with Spin (III)

Alan Bundy

slide-2
SLIDE 2

Automated Reasoning Lecture 12, page 2 Model Checking with Spin (III)

Outline of Verification Process

  • Objective: form one big automata,

– which Spin can use for verification.

  • Turn Promela code into automata.
  • Combine multiple automata,

– via asynchronous products.

  • Incorporate variable valuations,

– via automata expansions.

  • Incorporate never claims,

– via synchronous products.

slide-3
SLIDE 3

Automated Reasoning Lecture 12, page 3 Model Checking with Spin (III)

Turn Promela into Automata 1

  • The meaning of a Promela model (i.e. how it executes) can be

understood from the automaton it describes.

  • Some simplifying assumptions:

– no local variables, – no atomic{...} statements, and – no run ... operators (as mentioned earlier)

(see Promela manual for complete semantics)

slide-4
SLIDE 4

Automated Reasoning Lecture 12, page 4 Model Checking with Spin (III)

Turn Promela into Automata 2

  • Code for each proctype describes a finite state automaton
  • So a Promela model can be seen as a collection of automata

running concurrently and interactively

  • We shall show by examples how to construct the automaton

described by each proctype. Roughly,

– Each location in the code becomes a state in the automaton;

recall that a location can have one or more labels (e.g. init: )

– First location becomes the initial state – Control-flow statements describe the transitions from the current

state, and

– Basic statements label the transitions

slide-5
SLIDE 5

Automated Reasoning Lecture 12, page 5 Model Checking with Spin (III)

Statements in Promela

  • Two main types of statements in Promela: basic statements

and control-flow statements

  • So far we have seen the following control-flow statements:

';', if...fi, do...od, goto, break, atomic

  • And the following basic statements:

– Expressions: x+5, !(x>3 && b==true) – Assignments: x=x+1 – Assertions: assert(x>0) – Print statements: printf(...), printm(...)

  • Some keywords are predefined in terms of others, e.g.

true = skip = 1, false = 0

slide-6
SLIDE 6

Automated Reasoning Lecture 12, page 6 Model Checking with Spin (III)

Example 1: Promela to Automata

active proctype Counter(){

bool b=false; int x=0; do ::x<N -> { x=x+1; y=y+x } ::(b && x==N) -> break ::(!b && x==N) -> { x=0; b=true }

  • d;

assert(y==N*(N+1)) }

  • The automaton A(Counter) = (S,s0,L,T,F) described by proctype Counter is

depicted below.

  • Notice that each (and only each) basic statement becomes a label.

Counter

s0 s1 s4 s2 s3 s5 s6

x<N !b&&x==N b&&x==N x=x+1 y=y+x x=0 b=true assert(y==N *(N+1)

slide-7
SLIDE 7

Automated Reasoning Lecture 12, page 7 Model Checking with Spin (III)

Example 2: Promela to Automata

active proctype Security(){ int i=0; s_try: if ::i<N -> if ::true -> goto s_okay; ::true -> i=i+1 fi; ::i>=N -> goto s_fail fi; goto s_try; s_okay: run Authorise(); goto s_end; s_fail: printf("Failed."); s_end: skip }

Security

s_try

s1

s_okay

i<N i>=N true i=i+1

s_fail

s2

true

s_end

run Authorise

s3

printf(“Failed”) skip

slide-8
SLIDE 8

Automated Reasoning Lecture 12, page 8 Model Checking with Spin (III)

Spin's Automata Generation

% spin -a -o3 Security #Build verifier for Security, -o3 = disable statement merging % cc -o pan pan.c #Compile verifier % ./pan -d #Display automata proctype Security state 10 -(tr 5)-> state 6 [id 0 tp 2] [----L] line 5 => ((i<10)) state 10 -(tr 7)-> state 15 [id 7 tp 2] [----L] line 5 => ((i>=10)) state 6 -(tr 1)-> state 13 [id 1 tp 2] [----L] line 7 => (1) state 6 -(tr 1)-> state 5 [id 3 tp 2] [----L] line 7 => (1) state 13 -(tr 8)-> state 16 [id 12 tp 2] [----G] line 16 => (run Auth...) state 16 -(tr 1)-> state 17 [id 15 tp 2] [----L] line 21 => (1) state 17 -(tr 10)-> state 0 [id 16 tp 3500] [--e-L] line 22 => -end- state 5 -(tr 6)-> state 10 [id 4 tp 2] [----L] line 9 => i = (i+1) state 15 -(tr 9)-> state 16 [id 14 tp 2] [----L] line 19 => printf('F..') proctype Authorise state 1 -(tr 3)-> state 2 [id 17 tp 2] [----L] line 25 => printf('A..') state 2 -(tr 4)-> state 0 [id 18 tp 3500] [--e-L] line 26 => -end- Transition Type: A=atomic; D=d_step; L=local; G=global Source-State Labels: p=progress; e=end; a=accept;

  • The verifier that Spin builds can display the automaton for each proctype.

Use ./pan -d

slide-9
SLIDE 9

Automated Reasoning Lecture 12, page 9 Model Checking with Spin (III)

Combining Automata 1

  • Given a Promela model M consisting of proctype Proc1,..., Procn.
  • To simplify matters, assume that all these proctypes are active and no

dynamic process creation is allowed, i.e. no run operators.

  • M can be seen as describing another automaton A(M) whose states

depend upon the state of each A(Proci). During each transition some A(Proci) changes states (hence the state of the automaton for M changes). This is called interleaving concurrency.

  • We formalise such an automaton as the so-called asynchronous

product (aka interleaving product) of its component automata.

slide-10
SLIDE 10

Automated Reasoning Lecture 12, page 10 Model Checking with Spin (III)

Example: Combining Automata

int x=0; active proctype ProcA() { do ::!(x%2) -> x=x/2

  • d

} active proctype ProcB() { do ::x<2 -> x=x+1

  • d

} a0 a1

!(x%2) x=x/2

b0 b1

x<2 x=x+1

a1,b1

!(x%2) x=x/2

a0,b0 a1,b0 a0,b1

x=x/2 !(x%2) x=x+1 x<2 x<2 x=x+1

A(ProcA) x A(ProcB) A(ProcB) A(ProcA)

Aut

Promela model Aut:

slide-11
SLIDE 11

Automated Reasoning Lecture 12, page 11 Model Checking with Spin (III)

Asynchronous Product

  • Given automata A1,A2,...,An, the asynchronous product A1x A2 x ... x An =

∏Ai is (S,s0,L,T,F) where

– S=A1.S x A2.S x ... x An.S – s0=(A1.s0, A2.s0, ..., An.s0) – L=UAi.L – T={( (s1,s2,...,sn) , l , (t1,t2,...,tn) ) ∈ S x L x S |

∃i. (si,l,ti) ∈ Ai.T and ∀j≠i. sj= tj}

– F={(s1,s2,...,sn) | ∃i. si ∈ Ai.F}

  • Promela model M consisting of proctype Proc1,..., Procn can be

viewed as the automaton A(M)= ∏A(Proci).

slide-12
SLIDE 12

Automated Reasoning Lecture 12, page 12 Model Checking with Spin (III)

Incorporating Variable Valuations

  • Let X be a set of variables in M. A valuation v over X is a function

which assigns , for each variable x, a value in its domain. E.g. a valuation v over X={x:int,b:bool} such that v(x)=0 and v(b)=true.

  • A run (a trail or an execution) in M is a (finite or infinite)

sequence of the form where

–

si ∈ A(M).S, li ∈ A(M).L, and vi a valuation over X,

–

s0 = A(M).s0 and v0 is the initial valuation

–

(si,li,si+1) ∈ A(M).T,

–

exec(li, vi) = true,

–

vi+1 = effect(li, vi)

(s0,v0) (s1,v1) (si,vi) (si+1,vi+1)

l0 l1

...

li li+1 ...

slide-13
SLIDE 13

Automated Reasoning Lecture 12, page 13 Model Checking with Spin (III)

Valuation Terminology

  • Predicate exec(l,v) is called executability condition.
  • Function effect(l,v) is called effect function.

(where l is a basic statement and v a valuation)

  • If e is an expression and e(v) the value of e under v,

– exec(e,v) = e(v)>0

effect(e,v) = v

– exec(x=e,v) = true

effect(x=e,v) = v[x:=e(v)]

– exec(l,v) = true

effect(l,v) = v (where l is an assertion or a print statement) See Promela manual for more complete descriptions

slide-14
SLIDE 14

Automated Reasoning Lecture 12, page 14 Model Checking with Spin (III)

Example: Model Runs

  • For example, a run in model Aut is
  • But the following is not

a0,b0 x=0 a0,b1 x=1 a0,b1 x=0 a0,b0 x=1

x<2 x=x+1 x<2

...

a0,b0 x=0 a1,b0 x=1 a0,b1 x=0 a0,b0 x=1

x<2 x=x+1 !(x%2)

...

a1,b1

!(x%2) x=x/2

a0,b0 a1,b0 a0,b1

x=x/2 !(x%2) x=x+1 x<2 x<2 x=x+1

!(x%2) is not executable here. exec(!(x%2),{x=1}) = false

slide-15
SLIDE 15

Automated Reasoning Lecture 12, page 15 Model Checking with Spin (III)

Automata Expansion

  • Variable valuations can be incorporated using the expansion of the

automaton A(M).

  • Given an automaton A (where each label is a basic statement using only

variables in X) and the initial valuation v0, define an automaton Av0=(S,s0,L,T,F) where

–

S={(s,v) | v a valuation and s ∈ A.S}

–

s0=(A.s0,v0)

–

L=A.L

–

T={( (s,v) , l , (s',v') ) ∈ SxLxS |(s,l,s') ∈ A.T, exec(l,v) = true, v' = effect(l,v) }

–

F={(sf,v) ∈ S | sf ∈ A.F}

  • The expansion of A with initial valuation v0, denoted Exp(A,v0), is

the restriction of Av0 to those states reachable from s0

– A run in M is simply a run in Exp(A(M),v0). – A Spin simulation of M is just a simulation of Exp(A(M),v0).

slide-16
SLIDE 16

Automated Reasoning Lecture 12, page 16 Model Checking with Spin (III)

Example: Automata Expansion

a1,b1

!(x%2) x=x/2

a0,b0 a1,b0 a0,b1

x=x/2 !(x%2) x=x+1 x<2 x<2 x=x+1

A(ProcA) x A(ProcB)

a0,b0

x=x/2

a0,b1 a1,b0 a1,b1 a0,b0 1 a0,b1 1 a1,b1 1 a1,b0 2

!(x%2) x<2 x=x+1 x<2 x=x/2

a1,b0 1

x=x+1 x<2

a0,b0 2

x<2 x=x+1 x=x+1 !(x%2) x=x/2

Exp(A(ProcA) x A(ProcB),{x=0})

slide-17
SLIDE 17

Automated Reasoning Lecture 12, page 17 Model Checking with Spin (III)

Automata for Never-Claims

  • A never-claim also describes an automaton.
  • A(N), where N is a never-claim, can be constructed as for proctypes,

but additionally:

– the accept labels are taken into account. States with accept labels

become accepting states, i.e. members of A(N).F

– If there is a terminating state (one without transitions), then add a

transition with label 'skip' from that state to itself, and make it an accepting state. In Promela, this is - in effect - as if we append the never claim code with: accept_end: skip; goto accept_end This captures the condition that “Never claims should never end”.

slide-18
SLIDE 18

Automated Reasoning Lecture 12, page 18 Model Checking with Spin (III)

Examples: Never-Claim Automata

never { /* !([]x==0 || <>x==2) */ init0: if :: !(x==0) && !(x==2) -> goto accept :: !(x==2) -> goto init0 fi; accept: if :: !(x==2) -> goto accept fi; }

Never claim N for !([]x==0 || <>x==2) i=init0, a=accept e=end

AutNever never { /* <>P */ init0: if :: P -> goto end :: true -> goto init0 fi; end: skip }

Never claim N' for <>P i

!x==0&&!x==2 !x==2 !x==2

A(N) a

true skip

i

P

A(N') e

slide-19
SLIDE 19

Automated Reasoning Lecture 12, page 19 Model Checking with Spin (III)

  • Automata described by never claims define properties on the

valuations of the global variables. It tells which sequences of valuations are bad.

  • To see this, let's say that an automaton A (for some never claim)

accepts a sequence of valuations (v0,v1,v2,...) if there exists such that

–

si ∈ A.S, li ∈ A.L

–

s0=A.s0

–

(si, li, si+1) ∈ A.T

–

exec(li,vi) = true

–

sj ∈ A.F for infinitely many j (Büchi acceptance)

  • Denote the set of valuation sequences accepted by A by ℒX(A).

Büchi Acceptance

(s0,v0) (s1,v1) (si,vi) (si+1,vi+1)

l0 l1

...

li li+1 ...

slide-20
SLIDE 20

Automated Reasoning Lecture 12, page 20 Model Checking with Spin (III)

Example: Büchi Acceptance

  • For example, the following valuation sequence is

accepted by A(N): {x=0},{x=1},{x=0},{x=1},{x=0},{x=1},...

  • But not this one:

{x=0},{x=0},{x=0},{x=0},{x=0},{x=0},...

  • We can then define that a run (in the model) violates

the never claim N if the valuation sequence in it is accepted by A(N). i

!x==0&&!x==2 !x==2 !x==2

A(N) a

slide-21
SLIDE 21

Automated Reasoning Lecture 12, page 21 Model Checking with Spin (III)

LTL Formulae and Never Claims

  • We briefly mentioned earlier that an LTL formula can be converted

into an 'equivalent' never claim. It is now possible to state this more precisely.

  • Consider LTL formulae in which each propositional symbol stands

for an expression in Promela.

  • Given a sequence of valuations (v0,v1,v2,...), there is a natural way to

interpret a Promela expression at each point in the sequence, i.e. vi ╞ e ⇔ e(vi) > 0

  • Hence an LTL formula can be interpreted on a valuation sequence.

For example, ({x=0},{x=1},{x=2},{x=1},{x=2},...)╞ □x≠0 ({x=0},{x=1},{x=0},{x=1},{x=0},...)╞ ¬(□x=0 ∨ x=2)

  • Denote the set of valuation sequences on which f holds by ℒX(f).
  • Proposition For each LTL formula f, there is a never claim N such

that ℒX(f) = ℒX(A(N)).

slide-22
SLIDE 22

Automated Reasoning Lecture 12, page 22 Model Checking with Spin (III)

Verification using Automata

  • To determine whether there is a run in the model that violates

the never claim, Spin constructs a (synchronous) product of the model automaton and never-claim automaton (i.e. running them in parallel), and then checks for accepting runs in it.

  • Essentially, the never-claim automaton is used to pick up 'bad'

runs in the model automaton

  • Error trails found by the verifier are simply accepting runs

in this product automaton. So when simulating an error trail, the verifier simulates the product automaton along the trail.

slide-23
SLIDE 23

Automated Reasoning Lecture 12, page 23 Model Checking with Spin (III)

Example: Verification

i a0,b0 i a0,b1 i a1,b0 i a1,b1 i a0,b0 1 i a0,b1 1 i a1,b1 1 i a1,b0 2 i a1,b0 1 i a0,b0 2 a a0,b0 a a0,b1 a a1,b0 a a1,b1 a a0,b0 1 a a0,b1 1 a a1,b1 1 a a1,b0 2 a a1,b0 1 a a0,b0 2

Product automaton A(N) ⊗ Exp(A(ProcA) x A(ProcB),{x=0})

Black edges: (!x==2, l) Red edges: ((!x=0 && !x==2),l) where l is a statement.

i

!x==0&&!x==2 !x==2 !x==2

A(N)

a

slide-24
SLIDE 24

Automated Reasoning Lecture 12, page 24 Model Checking with Spin (III)

Synchronous Product

  • Formally, let A = Exp(A(M),v0) and B=A(N). Define the (Büchi) automaton

B ⊗ A = (S,s0,L,T,F) where

–

S = {(sB,sA,v) | sB ∈ B.S, (sA,v) ∈ A.S},

–

s0= (B.s0,s,v0) where A.s0 = (s,v0),

–

L= B.L x A.L,

–

T= {( (sB,sA,v) , (lB,lA) , (s'B,s'A,v') ) ∈ SxLxS | (sB,lB,s'B) ∈ B.T, ((sA,v),lA,(s'A,v')) ∈ A.T, exec(lB,v) = true }

–

F= {(sB,sA,v) ∈ S | sB ∈ B.F}

  • Proposition ℒX(B ⊗ A)=ℒX(B) ∩ ℒX(A),

(where ℒX(A) = the valuation sequences in the runs in A, and

ℒX(B ⊗ A) = the valuation sequences in the accepting runs in B ⊗ A)

slide-25
SLIDE 25

Automated Reasoning Lecture 12, page 25 Model Checking with Spin (III)

Searching for Accepting Runs

  • To find an accepting run (i.e. an error trail) in the product automaton,

we need to find a cycle in the transition graph which goes through an accepting state and is reachable from the initial state

  • This can be computed by depth-first-searching the transition graph
  • The standard algorithm runs in linear-time to the size of the

automaton

  • But! the product A(N) ⊗ Exp(A(M),v0) (or even A(M) alone) is, in

practice, very large and can be exponential in the size of the code. This is due to two factors:

– Interleaving of processes in the asynchronous product ∏A(Proci), – Exponential number of possible values of variables when expanding

automata

  • Spin does not explicitly construct the product automaton. It searches

for bad cycles on-the-fly; constructs portions of the automaton only as needed.