BMCMT Bounded Model Checking of TLA + Specifications with SMT Jure - - PowerPoint PPT Presentation

bmcmt bounded model checking of tla specifications with
SMART_READER_LITE
LIVE PREVIEW

BMCMT Bounded Model Checking of TLA + Specifications with SMT Jure - - PowerPoint PPT Presentation

BMCMT Bounded Model Checking of TLA + Specifications with SMT Jure Kukovec Igor Konnov Thanh Hai Tran work in progress TLA + Community Event Oxford, UK, July 2018 APALACHE Abstraction-based Parameterized TLA + Checker A.1 TLA + patterns


slide-1
SLIDE 1

BMCMT – Bounded Model Checking of TLA+ Specifications with SMT

Jure Kukovec Igor Konnov Thanh Hai Tran

work in progress TLA+ Community Event Oxford, UK, July 2018

slide-2
SLIDE 2

APALACHE

Abstraction-based Parameterized TLA+ Checker

TLA+ patterns repository A.1 TLA+ decision procedures B.1 TLA+ predicate abstraction B.2 TLA+ abstraction refinement B.3 Techniques for parameterized fault-tolerant TLA+ designs C.1 Multi-model abstraction C.2 Parameterized refinement C.3 Verification of finite- state TLA+ designs D.1 Verification of parameterized TLA+ designs D.2 Integration with TLA+ proof system D.3

Almost automated verification: using the user input in a sound way

Igor Konnov 7 of 56

slide-3
SLIDE 3

TLA+

First-order logic with sets (ZFC) Temporal operators: ✷ (always), ✸ (eventually), ❀ (leads-to), no Nexttime Syntax for operations on sets, functions, tuples, records TLA Proof System: TLAPS Explicit-state model checker: TLC

Igor Konnov 8 of 56

slide-4
SLIDE 4

What is hard about TLA+?

Rich data sets of sets, functions, records, tuples, sequences No types TLA+ is not a programming language No imperative statements like assignments TLA+ is not a programming language No standard control flow TLA+ is not a programming language

Igor Konnov 9 of 56

slide-5
SLIDE 5

In this talk:

  • a model checker like TLC but symbolic
  • no abstractions
  • nothing parameterized

Igor Konnov 10 of 56

slide-6
SLIDE 6

Our short-term goal

Symbolic model checker that works under the assumptions of TLC: Fixed and finite constants (parameters) Finite sets, function domains and co-domains TLC restrictions on formula structure As few language restrictions as possible Technically, Quantifier-free formulas in SMT Unfolding quantified expressions, e.g., ∀x ∈ S : P as

c∈S

P[c/x]

Igor Konnov 11 of 56

slide-7
SLIDE 7

Our short-term goal

Symbolic model checker that works under the assumptions of TLC: Fixed and finite constants (parameters) Finite sets, function domains and co-domains TLC restrictions on formula structure As few language restrictions as possible Technically, Quantifier-free formulas in SMT Unfolding quantified expressions, e.g., ∀x ∈ S : P as

c∈S

P[c/x]

Igor Konnov 11 of 56

slide-8
SLIDE 8

an example

slide-9
SLIDE 9

Maximal Independent Set

Classical distributed problem [Lynch, Ch 4] 1 2 3 4 N processes placed in the nodes of an undirected graph (V, E) Processes exchange messages in synchronous rounds Goal: Find a maximal independent set I ⊆ V: (u, v) ∈ E → u / ∈ I ∨ v / ∈ I for u, v ∈ V (1) every larger set I′ ⊃ I violates Equation (1) (2) Example: I = {1, 3}

Igor Konnov 15 of 56

slide-10
SLIDE 10

Maximal Independent Set

Classical distributed problem [Lynch, Ch 4] 1 2 3 4 N processes placed in the nodes of an undirected graph (V, E) Processes exchange messages in synchronous rounds Goal: Find a maximal independent set I ⊆ V: (u, v) ∈ E → u / ∈ I ∨ v / ∈ I for u, v ∈ V (1) every larger set I′ ⊃ I violates Equation (1) (2) Example: I = {1, 3}

Igor Konnov 15 of 56

slide-11
SLIDE 11

LubyMIS

randomized distributed algorithm [Lynch, p. 73] every process cyclically executes three rounds: 1, 2, 3, 1, 2, 3, . . . at every round 1, a process i randomly picks a value val[i] ∈ 1..N4 round 1: if val[i] > val[k] for every neighbor k of i, i sends “winner” to the neighbors of i round 2: if a process i receives “winner”, it becomes a “loser” and sends “loser” to the neighbors round 3: a process i removes the losers from its neighbors if i is a winner or a loser, it falls asleep

Igor Konnov 16 of 56

slide-12
SLIDE 12

LubyMIS

randomized distributed algorithm [Lynch, p. 73] every process cyclically executes three rounds: 1, 2, 3, 1, 2, 3, . . . at every round 1, a process i randomly picks a value val[i] ∈ 1..N4 round 1: if val[i] > val[k] for every neighbor k of i, i sends “winner” to the neighbors of i round 2: if a process i receives “winner”, it becomes a “loser” and sends “loser” to the neighbors round 3: a process i removes the losers from its neighbors if i is a winner or a loser, it falls asleep

Igor Konnov 16 of 56

slide-13
SLIDE 13

LubyMIS

randomized distributed algorithm [Lynch, p. 73] every process cyclically executes three rounds: 1, 2, 3, 1, 2, 3, . . . at every round 1, a process i randomly picks a value val[i] ∈ 1..N4 round 1: if val[i] > val[k] for every neighbor k of i, i sends “winner” to the neighbors of i round 2: if a process i receives “winner”, it becomes a “loser” and sends “loser” to the neighbors round 3: a process i removes the losers from its neighbors if i is a winner or a loser, it falls asleep

Igor Konnov 16 of 56

slide-14
SLIDE 14

LubyMIS

randomized distributed algorithm [Lynch, p. 73] every process cyclically executes three rounds: 1, 2, 3, 1, 2, 3, . . . at every round 1, a process i randomly picks a value val[i] ∈ 1..N4 round 1: if val[i] > val[k] for every neighbor k of i, i sends “winner” to the neighbors of i round 2: if a process i receives “winner”, it becomes a “loser” and sends “loser” to the neighbors round 3: a process i removes the losers from its neighbors if i is a winner or a loser, it falls asleep

Igor Konnov 16 of 56

slide-15
SLIDE 15

module mis extends Integers, TLC N

= 3 N 4

= 81 Nodes

= 1 . . N variables Nb, round, val, awake, rem nbrs, status, msgs Pred(n)

= if n > 1 then n − 1 else N Succ(n)

= if n < N then n + 1 else 1 Init

= ∧ Nb = [n ∈ Nodes → {Pred(n), Succ(n)}] ∧ round = 1 ∧ val ∈ [Nodes → 1 . . N 4] ∧ awake = [n ∈ Nodes → true] ∧ rem nbrs = Nb ∧ status = [n ∈ Nodes → “unknown”] ∧ msgs = {} Senders(u)

= {v ∈ Nodes : u ∈ rem nbrs[v] ∧ awake[v]} SentValues(u)

= {val′[w] : w ∈ Senders(u)} IsWinner(u)

= ∀ v ∈ msgs′[u] : val′[u] > v Round1

= ∧ round = 1 ∧ val′ ∈ [Nodes → 1 . . N 4] non-determinism, no randomness ∧ msgs′ = [u ∈ Nodes → SentValues(u)] ∧ status′ = [n ∈ Nodes → if awake[n] ∧ IsWinner(n) then “winner” else status[n]] ∧ unchanged rem nbrs, awake SentWinners(u)

= if ∃ w ∈ Senders(u) : awake[w] ∧ status[w] = “winner” then {“winner”} else {} IsLoser(u)

= “winner” ∈ msgs′[u] Round2

= ∧ round = 2 ∧ msgs′ = [u ∈ Nodes → SentWinners(u)] ∧ status′ = [n ∈ Nodes → if awake[n] ∧ IsLoser(n) then “loser” else status[n]] ∧ unchanged rem nbrs, awake, val SentLosers(u)

= {w ∈ Senders(u) : awake[w] ∧ status[w] = “loser”} Round3

= ∧ round = 3 ∧ msgs′ = [u ∈ Nodes → SentLosers(u)] ∧ awake′ = [n ∈ Nodes → if status[n] / ∈ {“winner”, “loser”} then true else false] ∧ rem nbrs′ = [u ∈ Nodes → rem nbrs[u] \ msgs′[u]] ∧ unchanged status, val Next

= round′ = 1 + (round%3) ∧ (Round1 ∨ Round2 ∨ Round3) ∧ unchanged Nb IsIndependent

= ∀ u ∈ Nodes : ∀ v ∈ Nb[u] : (status[u] = “winner” ∨ status[v] = “winner”) Terminated

= ∀ n ∈ Nodes : awake[n] = false

\ * Modification History \ * Last modified Mon Jul 16 19:35:37 CEST 2018 by igor \ * Created Sun Jul 15 17:03:47 CEST 2018 by igor
slide-16
SLIDE 16

Declaration and initialization

EXTENDS Integers

N

= 3 N4

= 81 Nodes

= 1 . .N

VARIABLES

Nb , round , val , awake , rem_nbrs , status , msgs Pred ( n )

=

I F n > 1 THEN n − 1 ELSE N

Succ ( n )

=

I F n < N THEN n + 1 ELSE 1

Init

= ∧ Nb = [n ∈ Nodes → {Pred(n), Succ(n)}] (* a ring of size N *) ∧ round = 1 ∧ val ∈ [Nodes → 1..N4] ∧ awake = [n ∈ Nodes → TRUE] ∧ rem_nbrs = Nb ∧ status = [n ∈ Nodes → “unknown′′] ∧ msgs = {}

slide-17
SLIDE 17

Round 1

Senders ( u )

= {v ∈ Nodes : u ∈ rem_nbrs[v] ∧ awake[v]} SentValues ( u )

= {val′[w] : w ∈ Senders(u)} IsWinner ( u )

= ∀v ∈ msgs′[u] : val′[u] > v Round1

= ∧ round = 1 ∧ val′ ∈ [Nodes → 1..N4] (* non-determinism instead of randomness *) ∧ msgs′ = [u ∈ Nodes → SentValues(u)] ∧ status′ = [n ∈ Nodes →

I F awake[n] ∧ IsWinner(n) THEN “winner ′′ ELSE status[n]]

∧ UNCHANGED rem_nbrs, awake

slide-18
SLIDE 18

Round 2

SentWinners ( u )

=

I F ∃w ∈ Senders(u) : awake[w] ∧ status[w] = “winner ′′ THEN {“winner ′′ } ELSE

{ } IsLoser ( u )

= “winner ′′ ∈ msgs′[u] Round2

= ∧ round = 2 ∧ msgs′ = [u ∈ Nodes → SentWinners(u)] ∧ status′ = [n ∈ Nodes →

I F awake[n] ∧ IsLoser(n) THEN “loser ′′ ELSE status[n]]

UNCHANGED rem_nbrs, awake, val

slide-19
SLIDE 19

Round 3

SentLosers ( u )

= {w ∈ Senders(u) : awake[w] ∧ status[w] = “loser ′′} Round3

= ∧ round = 3 ∧ msgs′ = [u ∈ Nodes → SentLosers(u)] ∧ awake′ = [n ∈ Nodes →

I F status[n] ∈ {“winner ′′, “loser ′′} THEN FALSE ELSE TRUE]

∧ rem_nbrs′ = [u ∈ Nodes → rem_nbrs[u] \ msgs′[u]] ∧ UNCHANGED status, val

slide-20
SLIDE 20

Putting it all together

(* The next-state relation *) Next

= ∧ round′ = 1 + (round % 3) ∧ (Round1 ∨ Round2 ∨ Round3) ∧ UNCHANGED Nb (* An invariant *) IsIndependent

= ∀u ∈ Nodes : ∀v ∈ Nb[u] : (status[u] = ”winner” ∨ status[v] = ”winner”)

slide-21
SLIDE 21

Let’s run TLC for N = 3... One day later... still running

Why? Crunching states produced by {1, . . . , N4}, that is, 34 integers

slide-22
SLIDE 22

Let’s run TLC for N = 3... One day later... still running

Why? Crunching states produced by {1, . . . , N4}, that is, 34 integers

slide-23
SLIDE 23

Let’s be more fair to TLC

Let’s set N4 to N

(the smaller values kill progress)

slide-24
SLIDE 24

How about larger graphs?

Let’s set N and N4 to 5

slide-25
SLIDE 25

Let’s run BMCMT for N = 5 and N4 = 54 3 minutes

./bin/apalache-mc check --inv=IsIndependent mis.tla PASS #1: AssignmentFinder Found 1 initializing transitions and 3 next transitions PASS #2: Grade PASS #3: SimpleSkolemization Found 2 free existentials in the transitions PASS #4: BoundedChecker The outcome is: NoError PASS #5: Terminal Checker reports no error up to computation length 10

slide-26
SLIDE 26

3.0 3.5 4.0 4.5 5.0 5.5 6.0 6.5 7.0 Number of processes, N 101 102 103 104 Time, logscale, seconds

BMCMT (len=10)

LubyMIS: N processes and the range 1..N4 Invariant: independence for executions of length up to 10

slide-27
SLIDE 27

2 4 6 8 10 12 14 Number of processes, N 100 101 102 103 Time, logscale, seconds

TLC BMCMT (len=diam) BMCMT (len=40)

EWD840: Dijkstra’s termination detection in a ring of N nodes Invariant: when termination is detected, all nodes are inactive

Diameter is 3N, as shown by TLC for N ≤ 10

slide-28
SLIDE 28

2.0 2.5 3.0 3.5 4.0 4.5 5.0 Number of acceptors, N 100 101 102 103 104 105 Time, logscale, seconds

TLC, 3 ballots BMCMT (len=diam, 3 ballots) BMCMT (len=diam, 10 ballots) BMCMT (len=diam, 100 ballots)

Simple Paxos of N acceptors, from the TLA+ benchmarks Just computing reachable states (SAT) for 3, 10, and 100 ballots

slide-29
SLIDE 29

Can I run it?

Yes! [ forsyte.at/research/apalache ] Beware: it is fresh and crashes more often than it works

Igor Konnov 30 of 56

slide-30
SLIDE 30

how does it work?

slide-31
SLIDE 31

Essential steps

Extracting assignments and symbolic transitions somewhat similar to TLC Simple type inference as we go, for every step Bounded model checking we track potential contents of data structures

Igor Konnov 32 of 56

slide-32
SLIDE 32

assignments & symbolic transitions

slide-33
SLIDE 33

Symbolic transitions

Next

= ∧ round′ = 1 + (round % 3) ∧ (Round1 ∨ Round2 ∨ Round3) ∧ UNCHANGED Nb

Intuitively, we reason about the three cases:

∧ round′ = 1 + (round % 3) ∧ (Round1 ∨✭✭✭✭✭✭✭✭ ✭ ❤❤❤❤❤❤❤❤ ❤ Round2 ∨ Round3) ∧ UNCHANGED Nb ∧ round′ = 1 + (round % 3) ∧ (✘✘✘ ✘ ❳❳❳ ❳ Round1 ∨ Round2 ∨✘✘✘ ✘ ❳❳❳ ❳ Round3) ∧ UNCHANGED Nb ∧ round′ = 1 + (round % 3) ∧ (✭✭✭✭✭✭✭✭ ✭ ❤❤❤❤❤❤❤❤ ❤ Round1 ∨ Round2 ∨ Round3) ∧ UNCHANGED Nb

Igor Konnov 34 of 56

slide-34
SLIDE 34

Symbolic transitions

Next

= ∧ round′ = 1 + (round % 3) ∧ (Round1 ∨ Round2 ∨ Round3) ∧ UNCHANGED Nb

Intuitively, we reason about the three cases:

∧ round′ = 1 + (round % 3) ∧ (Round1 ∨✭✭✭✭✭✭✭✭ ✭ ❤❤❤❤❤❤❤❤ ❤ Round2 ∨ Round3) ∧ UNCHANGED Nb ∧ round′ = 1 + (round % 3) ∧ (✘✘✘ ✘ ❳❳❳ ❳ Round1 ∨ Round2 ∨✘✘✘ ✘ ❳❳❳ ❳ Round3) ∧ UNCHANGED Nb ∧ round′ = 1 + (round % 3) ∧ (✭✭✭✭✭✭✭✭ ✭ ❤❤❤❤❤❤❤❤ ❤ Round1 ∨ Round2 ∨ Round3) ∧ UNCHANGED Nb

Igor Konnov 34 of 56

slide-35
SLIDE 35

How does TLC find assignments?

TLC detects assignments as it explores a formula:

  • from left to right:

x′ = 1 ∧ x′ ∈ {1, 2, 3}

  • treating action-level disjunctions as non-deterministic choice
  • x′ = 1 ∨ x′ = 2
  • ∧ x′ ≥ 2
  • expecting the same kind of assignments on all branches

(x′ = 1 ∧ y′ = 2) ∨ x′ = 3

Igor Konnov 35 of 56

slide-36
SLIDE 36

Anything similar with SMT?

Looking for assignment strategies that:

  • cover every Boolean branch

(not easy to define)

  • have exactly one assignment per variable per branch
  • do not contain cyclic assignments
  • (y′ = x′ ∧ x′ ∈ {2, 3, y′}) ∨ (x′ = 2 ∧ y′ ∈ {x′})
  • ∧ x′ = 3

Sometimes, we do better than TLC (above) Sometimes, worse, e.g., when x = 0: x > 0 ∨ (x′ = x + 1 ∨ y′ = x − 1)

[Kukovec, K., Tran, ABZ’18]

Igor Konnov 36 of 56

slide-37
SLIDE 37

Anything similar with SMT?

Looking for assignment strategies that:

  • cover every Boolean branch

(not easy to define)

  • have exactly one assignment per variable per branch
  • do not contain cyclic assignments
  • (y′ = x′ ∧ x′ ∈ {2, 3, y′}) ∨ (x′ = 2 ∧ y′ ∈ {x′})
  • ∧ x′ = 3

Sometimes, we do better than TLC (above) Sometimes, worse, e.g., when x = 0: x > 0 ∨ (x′ = x + 1 ∨ y′ = x − 1)

[Kukovec, K., Tran, ABZ’18]

Igor Konnov 36 of 56

slide-38
SLIDE 38

Simple types

Igor Konnov 37 of 56

slide-39
SLIDE 39

Types: scalars and functions

Basic: constants: Const

“a”, “hello”

integers: Int

  • 1, 1024

Booleans: Bool

FALSE, TRUE

Functions: functions: τset → τset

FinSet(Int) → FinSet(Bool)

tuples: τ, . . . , τ

Int, Bool, FinSet(Int), Int → FinSet(Int)

records: [Const → τ, . . . , Const → τ]

[“a” → Int, “b” → Bool]

Igor Konnov 38 of 56

slide-40
SLIDE 40

Types: sets

finite sets: FinSet(τ)

FinSet(Int)

power sets: PowSet(τ)

PowSet(FinSet(Int))

function sets: [τset → τset]

[PowSet(FinSet(Int)) → FinSet(Int)]

products: τset × · · · × τset

[FinSet(Int) × FinSet(Bool)]

record sets: [Const : τset, . . . , Const : τset]

[“a” : FinSet(Int), “b” : FinSet(Bool)]

Igor Konnov 39 of 56

slide-41
SLIDE 41

Simple type inference

Knowing the types at the current state Compute the types of the expressions and of the primed variables e.g., if X has type FinSet(Int), then X ′ = [X → X] has type Fun(FinSet(Int), FinSet(Int)) y in {y ∈ X : y > 0} has type Int {} has type FinSet(Unknown)

hence, IF P THEN {1} ELSE {} fails

  • ne can hack it by writing {1} \ {1}

Igor Konnov 40 of 56

slide-42
SLIDE 42

Simple type inference

Knowing the types at the current state Compute the types of the expressions and of the primed variables e.g., if X has type FinSet(Int), then X ′ = [X → X] has type Fun(FinSet(Int), FinSet(Int)) y in {y ∈ X : y > 0} has type Int {} has type FinSet(Unknown)

hence, IF P THEN {1} ELSE {} fails

  • ne can hack it by writing {1} \ {1}

Igor Konnov 40 of 56

slide-43
SLIDE 43

Bounded model checking

Igor Konnov 41 of 56

slide-44
SLIDE 44

Old recipe for bounded symbolic computations

Two symbolic transitions that assign values to x

Next

= A ∨ B

Translate TLA+ expressions to SMT with some · Init x → i0 A[i0/x] x → a1 B[i0/x] x → b1 x′ ∈ {a1, b1} x → c1 A[c1/x] x → a2 B[c1/x] x → b2 x′ ∈ {a2, b2} x → c2 . . . . . .

Igor Konnov 42 of 56

slide-45
SLIDE 45

What is ·?

Igor Konnov 43 of 56

slide-46
SLIDE 46

Our idea

Let’s mimic the explicit model checker TLC Explicitely compute the memory layout of data structures Restrict memory contents with SMT Define operational semantics (for finite models)

Igor Konnov 44 of 56

slide-47
SLIDE 47

Static picture of TLA+ objects and relations between them

Arena:

τ τ τ

FinSet(τ)

SMT:

integer

sort Int

Boolean

sort Bool

finite set: ¢ of uninterpreted sort uninterpreted function in : × → Bool

slide-48
SLIDE 48

Arenas: functions

SMT:

function: ¢ of uninterpreted sort uninterpreted function fun¢ : → that keeps tracks of values

Arena:

τ1

τ1 → τ2

τ2

DOM CDM

Igor Konnov 46 of 56

slide-49
SLIDE 49

Arenas: set of functions and powerset

Arena:

Set1

[τ1 → τ2]

Set2 DOM CDM

F i n S e t ( τ

1

)

P

  • w

S e t ( . . )

DOM

SMT:

cells of uninterpreted sort

[{1, 2, 3} → {4, 5, 6}]

SUBSET {1, 2, 3}

just tracking the structure

Igor Konnov 47 of 56

slide-50
SLIDE 50

some rules for sets

Igor Konnov 48 of 56

slide-51
SLIDE 51

Set constructor

{

1, . . . , k}

Arena:

1

...

FinSet(τ)

k

SMT:

  • 1≤i≤k

in(

i,

)

Igor Konnov 49 of 56

slide-52
SLIDE 52

Set union: Z = X ∪ Y

1

X

3 4 6 2 5

Y

Arena:

1 3 4 6 2 5 Z

SMT:

  • 1≤i≤6
  • in(

i, Z)

⇔ in(

i, X) ∨ in( i, Y)

  • Igor Konnov

50 of 56

slide-53
SLIDE 53

Set filter: Z = {x ∈ S : P}

c1

S

c3

P(c1)

c2

P(c2) P(c3)

Arena:

c 1 S c 3

P(c1)

c 2

P(c2) P(c3) Z

SMT:

  • 1≤i≤3
  • in(

i, Z)

⇔ in(

i, S) ∧ P( i)

  • Igor Konnov

51 of 56

slide-54
SLIDE 54

Set membership: ¢e ∈ ¢S

1

...

S

k

  • e =

i

  • eqi

for 1 ≤ i ≤ k

Arena:

?

SMT:

? ↔

  • 1≤i≤k
  • eqi ∧ in(

i, S)

  • Igor Konnov

52 of 56

slide-55
SLIDE 55

Set inclusion and equality

1

...

S

k

S ⊆ T ↔

  • 1≤i≤k
  • in(

i, S) → i ∈ T

  • S = T

↔ S ⊆ T ∧ T ⊆ S

Igor Konnov 53 of 56

slide-56
SLIDE 56

Equality in general

Integers, Booleans, string constants

SMT equality (=)

Sets, functions, records, tuples

lazy, define X = Y when needed avoid redundant constraints exploit locality thanks to arenas cache constraints

Igor Konnov 54 of 56

slide-57
SLIDE 57

Implementation

about 100 rewriting rules, to encode semantics still, some features not covered:

recursive functions sequences set cardinalities (any ideas?)

  • perations with modules

Igor Konnov 55 of 56

slide-58
SLIDE 58

Conclusions

TLA+ can be checked symbolically TLC works surprisingly well Covering all TLA+ features is hard! We are preparing a technical report and hope to release a stable version soon We need benchmarks from you!

Igor Konnov 56 of 56