Lecture 4: Checking properties in NuSMV B. Srivathsan Chennai - - PowerPoint PPT Presentation

▶
lecture 4 checking properties in nusmv
SMART_READER_LITE
LIVE PREVIEW

Lecture 4: Checking properties in NuSMV B. Srivathsan Chennai - - PowerPoint PPT Presentation

Aug 20, 2023 194 likes •1.11k views

Lecture 4: Checking properties in NuSMV B. Srivathsan Chennai Mathematical Institute Model Checking and Systems Verification January - April 2016 1 / 43 Outline Module 1: Synchronous Vs Asynchronous composition Module 2: More examples

slide-1
SLIDE 1

Lecture 4: Checking properties in NuSMV

  • B. Srivathsan

Chennai Mathematical Institute

Model Checking and Systems Verification January - April 2016

1/43

slide-2
SLIDE 2

Outline

◮ Module 1: Synchronous Vs Asynchronous composition ◮ Module 2: More examples of NuSMV models and

properties

◮ Module 3: A problem in concurrency ◮ Module 4: What is a property?

2/43

slide-3
SLIDE 3

Module 1: Synchronous Vs Asynchronous composition

3/43

slide-4
SLIDE 4

Acknowledgements: Content in this part of module taken from lecture slides of

  • Prof. Supratik Chakraborty, IIT Bombay

4/43

slide-5
SLIDE 5

L2 L1

L2.red

L1

L1.red

L2

5/43

slide-6
SLIDE 6

L2 L1

L2.red

L1

L1.red

L2 If a light is red, it can stay red for an arbitrary period If it goes yellow, it should become green within one cycle If it is green, it can stay green for an arbitrary period

5/43

slide-7
SLIDE 7

MODULE light(other) VAR state: {r,y,g}; ASSIGN init(state) := r; next(state) := case state=r & other=r : {r, y}; state=y : g; state=g : {g, r}; TRUE : state; esac; MODULE main VAR tl1: light(tl2.state); tl2: light(tl1.state);

6/43

slide-8
SLIDE 8

Synchronous composition

MODULE light(other) VAR state: {r,y,g}; ASSIGN init(state) := r; next(state) := case state=r & other=r : {r, y}; state=y : g; state=g : {g, r}; TRUE : state; esac; MODULE main VAR tl1: light(tl2.state); tl2: light(tl1.state);

6/43

slide-9
SLIDE 9

Synchronous composition

7/43

slide-10
SLIDE 10

Synchronous composition

Both lights can simultaneously become green!

7/43

slide-11
SLIDE 11

Asynchronous composition

MODULE light(other) VAR state: {r,y,g}; ASSIGN init(state) := r; next(state) := case state=r & other=r : {r, y}; state=y : g; state=g : {g, r}; TRUE : state; esac; MODULE main VAR tl1: process light(tl2.state); tl2: process light(tl1.state);

8/43

slide-12
SLIDE 12

Asynchronous composition

...

9/43

slide-13
SLIDE 13

Asynchronous composition

...

Only one light can become green at a time

9/43

slide-14
SLIDE 14

◮ Synchronous:

◮ all assignments to all modules made simultaneously ◮ suitable when all modules are synchronized to a global

clock

◮ Asynchronous:

◮ execution of modules is interleaved ◮ at a time, only one module executes ◮ choice of next module to be executed is

non-deterministic

◮ suitable when no assumptions can be made about

communication delay between modules

10/43

slide-15
SLIDE 15

Synchronous vs. Asynchronous systems

11/43

slide-16
SLIDE 16

Module 2: More examples

12/43

slide-17
SLIDE 17

SHARED RESOURCE

P1 P2 Pn

...

(variable, printer, ...) Mutual Exclusion: No two processes can access the resource simultaneously

13/43

slide-18
SLIDE 18

loop forever

. . .

request critical section release

. . .

end loop *non-critical actions* *non-critical actions*

P1

loop forever

. . .

request critical section release

. . .

end loop *non-critical actions* *non-critical actions*

P2

14/43

slide-19
SLIDE 19

loop forever

. . .

request critical section release

. . .

end loop *non-critical actions* *non-critical actions*

P1 PG1

noncrit1 wait1 crit1 loop forever

. . .

request critical section release

. . .

end loop *non-critical actions* *non-critical actions*

P2 PG2

noncrit2 wait2 crit2

14/43

slide-20
SLIDE 20

loop forever

. . .

critical section

. . .

end loop *non-critical actions* *non-critical actions*

*request* *release*

〈 if y>0: y:=y-1 〉 y:=y+1

P1 PG1

noncrit1 wait1 crit1 y>0:y:=y-1 y:= y+1 loop forever

. . .

critical section

. . .

end loop *non-critical actions* *non-critical actions*

*request* *release*

〈 if y>0: y:=y-1 〉 y:=y+1

P2 PG2

noncrit2 wait2 crit2 y>0:y:=y-1 y:= y+1

14/43

slide-21
SLIDE 21

loop forever

. . .

critical section

. . .

end loop *non-critical actions* *non-critical actions*

*request* *release*

〈 if y>0: y:=y-1 〉 y:=y+1

P1 PG1

noncrit1 wait1 crit1 y>0:y:=y-1 y:= y+1 loop forever

. . .

critical section

. . .

end loop *non-critical actions* *non-critical actions*

*request* *release*

〈 if y>0: y:=y-1 〉 y:=y+1

P2 PG2

noncrit2 wait2 crit2 y>0:y:=y-1 y:= y+1

atomic

14/43

slide-22
SLIDE 22

loop forever

. . .

critical section

. . .

end loop *non-critical actions* *non-critical actions*

*request* *release*

〈 if y>0: y:=y-1 〉 y:=y+1

P1 PG1

noncrit1 wait1 crit1 y>0:y:=y-1 y:= y+1 loop forever

. . .

critical section

. . .

end loop *non-critical actions* *non-critical actions*

*request* *release*

〈 if y>0: y:=y-1 〉 y:=y+1

P2 PG2

noncrit2 wait2 crit2 y>0:y:=y-1 y:= y+1

atomic NuSMV demo: mutex-demo.smv

14/43

slide-23
SLIDE 23

Coming next: A slight modification of previous mutual exclusion protocol

15/43

slide-24
SLIDE 24

non-crit wait crit exiting y>0:y:=y-1 y:=y+1

PG1

non-crit wait crit exiting y>0:y:=y-1 y:=y+1

PG2

16/43

slide-25
SLIDE 25

non-crit wait crit exiting y>0:y:=y-1 y:=y+1

PG1

non-crit wait crit exiting y>0:y:=y-1 y:=y+1

PG2 NuSMV demo: mutex-demo1.smv

16/43

slide-26
SLIDE 26

Synchronous vs. Asynchronous systems Mutual Exclusion

17/43

slide-27
SLIDE 27

while x < 200 x := x+1

l1 l2 x < 200 x := x+1

while x>0 x := x-1

m1 m2 x > 0 x:=x-1

while x=200 x := 0

n1 n2 x = 200 x:=0

18/43

slide-28
SLIDE 28

while x < 200 x := x+1

l1 l2 x < 200 x := x+1

while x>0 x := x-1

m1 m2 x > 0 x:=x-1

while x=200 x := 0

n1 n2 x = 200 x:=0

NuSMV demo: three-program-demo.smv

18/43

slide-29
SLIDE 29

Synchronous vs. Asynchronous systems Mutual Exclusion Concurrent programs example

19/43

slide-30
SLIDE 30

Module 3: A problem in concurrency

20/43

slide-31
SLIDE 31

P0 ... P3 : processes S0 ... S3 : resources P0 P1 P2 P3 S0 S1 S3 S2

21/43

slide-32
SLIDE 32

P0 ... P3 : processes S0 ... S3 : resources Process Pi can execute

  • nly if

it has access to resources S(i−1) and Si P0 P1 P2 P3 S0 S1 S3 S2

21/43

slide-33
SLIDE 33

P0 ... P3 : processes S0 ... S3 : resources Process Pi can execute

  • nly if

it has access to resources S(i−1) mod 4 and Si mod 4 P0 P1 P2 P3 S0 S1 S3 S2

21/43

slide-34
SLIDE 34

P0 ... P3 : processes S0 ... S3 : resources Process Pi can execute

  • nly if

it has access to resources S(i−1) mod 4 and Si mod 4 P0 P1 P2 P3 S0 S1 S3 S2 How should the processes be scheduled so that every process can execute infinitely often?

21/43

slide-35
SLIDE 35

Dining philosophers problem (Dijkstra)

P0 ... P3 : philosophers S0 ... S3 : chop-sticks Philosopher Pi can eat

  • nly if

he has access to chop-sticks S(i−1) mod 4 and Si mod 4 P0 P1 P2 P3 S0 S1 S3 S2

22/43

slide-36
SLIDE 36

Dining philosophers problem (Dijkstra)

P0 ... P3 : philosophers S0 ... S3 : chop-sticks Philosopher Pi can eat

  • nly if

he has access to chop-sticks S(i−1) mod 4 and Si mod 4 P0 P1 P2 P3 S0 S1 S3 S2 What should the protocol be so that every philosopher can eat infinitely

  • ften?

22/43

slide-37
SLIDE 37

Coming next: A protocol for the dining philosophers

23/43

slide-38
SLIDE 38

Philosopher i

think req_left req_right have_left have_right eat return sticks[i]=free sticks[i]:=i sticks[i-1]=free sticks[i-1]:=i sticks[i-1]=free sticks[i-1]:=i sticks[i]=free sticks[i]:=i sticks[i]=free sticks[i-1]=free

24/43

slide-39
SLIDE 39

Philosopher i

think req_left req_right have_left have_right eat return sticks[i]=free sticks[i]:=i sticks[i-1]=free sticks[i-1]:=i sticks[i-1]=free sticks[i-1]:=i sticks[i]=free sticks[i]:=i sticks[i]=free sticks[i-1]=free

NuSMV demo

24/43

slide-40
SLIDE 40

A deadlock

〈 think, think, think, think 〉 〈 have_left, have_left, have_left, have_left 〉 1 2 3

Sticks

25/43

slide-41
SLIDE 41

Question: What properties should be checked to detect deadlocks?

26/43

slide-42
SLIDE 42

Question: What properties should be checked to detect deadlocks?

◮ Next module: Attach a mathematical meaning to properties

26/43

slide-43
SLIDE 43

Question: What properties should be checked to detect deadlocks?

◮ Next module: Attach a mathematical meaning to properties ◮ Next lecture: Classification of properties into various types

26/43

slide-44
SLIDE 44

Question: What properties should be checked to detect deadlocks?

◮ Next module: Attach a mathematical meaning to properties ◮ Next lecture: Classification of properties into various types ◮ Next lecture: Answer to the above question

26/43

slide-45
SLIDE 45

Module 4: What is a “property”?

27/43

slide-46
SLIDE 46

Goal: Attach a mathematical meaning to “property”

28/43

slide-47
SLIDE 47

request=1 ready request=1 busy request=0 ready request=0 busy MODULE main VAR request: boolean; status: {ready, busy} ASSIGN init(status) := ready; next(status) := case request : busy; TRUE : {ready,busy}; esac;

29/43

slide-48
SLIDE 48

p1: (request=1) p2: (status=busy)

request=1 ready request=1 busy request=0 ready request=0 busy MODULE main VAR request: boolean; status: {ready, busy} ASSIGN init(status) := ready; next(status) := case request : busy; TRUE : {ready,busy}; esac;

29/43

slide-49
SLIDE 49

p1: (request=1) p2: (status=busy) Atomic propositions

request=1 ready request=1 busy request=0 ready request=0 busy MODULE main VAR request: boolean; status: {ready, busy} ASSIGN init(status) := ready; next(status) := case request : busy; TRUE : {ready,busy}; esac;

29/43

slide-50
SLIDE 50

p1: (request=1) p2: (status=busy) Atomic propositions

{ p1 }

request=1 ready request=1 busy request=0 ready request=0 busy MODULE main VAR request: boolean; status: {ready, busy} ASSIGN init(status) := ready; next(status) := case request : busy; TRUE : {ready,busy}; esac;

29/43

slide-51
SLIDE 51

p1: (request=1) p2: (status=busy) Atomic propositions

{ p1 } { p1,p2 }

request=1 ready request=1 busy request=0 ready request=0 busy MODULE main VAR request: boolean; status: {ready, busy} ASSIGN init(status) := ready; next(status) := case request : busy; TRUE : {ready,busy}; esac;

29/43

slide-52
SLIDE 52

p1: (request=1) p2: (status=busy) Atomic propositions

{ p1 } { p1,p2 } { p2 }

request=1 ready request=1 busy request=0 ready request=0 busy MODULE main VAR request: boolean; status: {ready, busy} ASSIGN init(status) := ready; next(status) := case request : busy; TRUE : {ready,busy}; esac;

29/43

slide-53
SLIDE 53

p1: (request=1) p2: (status=busy) Atomic propositions

{ p1 } { p1,p2 } { p2 } {}

request=1 ready request=1 busy request=0 ready request=0 busy MODULE main VAR request: boolean; status: {ready, busy} ASSIGN init(status) := ready; next(status) := case request : busy; TRUE : {ready,busy}; esac;

29/43

slide-54
SLIDE 54

Execution

request=0 ready request=0 busy request=0 ready request=1 busy request=1 busy

. . .

30/43

slide-55
SLIDE 55

{ } Execution

request=0 ready request=0 busy request=0 ready request=1 busy request=1 busy

. . .

30/43

slide-56
SLIDE 56

{ } { p2 } Execution

request=0 ready request=0 busy request=0 ready request=1 busy request=1 busy

. . .

30/43

slide-57
SLIDE 57

{ } { p2 } { } Execution

request=0 ready request=0 busy request=0 ready request=1 busy request=1 busy

. . .

30/43

slide-58
SLIDE 58

{ } { p2 } { } { p1,p2 } Execution

request=0 ready request=0 busy request=0 ready request=1 busy request=1 busy

. . .

30/43

slide-59
SLIDE 59

{ } { p2 } { } { p1,p2 } { p1,p2 } Execution

request=0 ready request=0 busy request=0 ready request=1 busy request=1 busy

. . .

30/43

slide-60
SLIDE 60

Trace { } { p2 } { } { p1,p2 } { p1,p2 } Execution

request=0 ready request=0 busy request=0 ready request=1 busy request=1 busy

. . .

30/43

slide-61
SLIDE 61

Trace { } { p2 } { } { p1,p2 } { p1,p2 } Execution

request=0 ready request=0 busy request=0 ready request=1 busy request=1 busy

. . .

Trace { p1 } { p1,p2 } { p2 } { p1,p2 } { p2 } Execution

request=1 ready request=1 busy request=0 busy request=1 busy request=0 busy

. . .

30/43

slide-62
SLIDE 62

AP = { p1,p2, ... ,pk }

31/43

slide-63
SLIDE 63

AP = { p1,p2, ... ,pk } PowerSet(AP) = { { }, {p1}, ... , {pk}, { p1,p2 }, { p1,p3 }, ... , { pk−1,pk },

...

{ p1,p2, ..., pk } }

31/43

slide-64
SLIDE 64

AP = { p1,p2, ... ,pk } PowerSet(AP) = { { }, {p1}, ... , {pk}, { p1,p2 }, { p1,p3 }, ... , { pk−1,pk },

...

{ p1,p2, ..., pk } } Trace(Execution) is an infinite word over PowerSet(AP)

31/43

slide-65
SLIDE 65

AP = { p1,p2, ... ,pk } PowerSet(AP) = { { }, {p1}, ... , {pk}, { p1,p2 }, { p1,p3 }, ... , { pk−1,pk },

...

{ p1,p2, ..., pk } } Trace(Execution) is an infinite word over PowerSet(AP) Traces(TS) is the { Trace(σ) | σ is an execution of the TS }

31/43

slide-66
SLIDE 66

{ p1 } { p1,p2 } { p2 } {}

request=1 ready request=1 busy request=0 ready request=0 busy

Traces:

32/43

slide-67
SLIDE 67

{ p1 } { p1,p2 } { p2 } {}

request=1 ready request=1 busy request=0 ready request=0 busy { } { } { } { } { } { } { } { } ...

Traces:

32/43

slide-68
SLIDE 68

{ p1 } { p1,p2 } { p2 } {}

request=1 ready request=1 busy request=0 ready request=0 busy { } { } { } { } { } { } { } { } ... { } { p2 } { p2 } { p2 } { p2 } { p2 } { p2 } ...

Traces:

32/43

slide-69
SLIDE 69

{ p1 } { p1,p2 } { p2 } {}

request=1 ready request=1 busy request=0 ready request=0 busy { } { } { } { } { } { } { } { } ... { } { p2 } { p2 } { p2 } { p2 } { p2 } { p2 } ... { p1 } { p1,p2 } { p2 } { p1,p2 } { p2 } { p1,p2 } ...

Traces:

32/43

slide-70
SLIDE 70

{ p1 } { p1,p2 } { p2 } {}

request=1 ready request=1 busy request=0 ready request=0 busy { } { } { } { } { } { } { } { } ... { } { p2 } { p2 } { p2 } { p2 } { p2 } { p2 } ... { p1 } { p1,p2 } { p2 } { p1,p2 } { p2 } { p1,p2 } ... {} { p1,p2 } { p1,p2 } { p1,p2 } { p1,p2 } { p1,p2 } ...

Traces:

32/43

slide-71
SLIDE 71

{ p1 } { p1,p2 } { p2 } {}

request=1 ready request=1 busy request=0 ready request=0 busy { } { } { } { } { } { } { } { } ... { } { p2 } { p2 } { p2 } { p2 } { p2 } { p2 } ... { p1 } { p1,p2 } { p2 } { p1,p2 } { p2 } { p1,p2 } ... {} { p1,p2 } { p1,p2 } { p1,p2 } { p1,p2 } { p1,p2 } ...

. . .

Traces:

32/43

slide-72
SLIDE 72

Traces of a TS describe its behaviour with respect to the atomic propositions

33/43

slide-73
SLIDE 73

Behaviour of TS

Atomic propositions Set of its traces

34/43

slide-74
SLIDE 74

Coming next: What is a property?

35/43

slide-75
SLIDE 75

AP-INF = set of infinite words over PowerSet(AP)

36/43

slide-76
SLIDE 76

AP-INF = set of infinite words over PowerSet(AP) Property 1: p1 is always true

36/43

slide-77
SLIDE 77

AP-INF = set of infinite words over PowerSet(AP) Property 1: p1 is always true { A0A1A2 ··· ∈ AP-INF | each Ai contains p1 }

{ p1 } { p1 } { p1 } { p1 } { p1 } { p1 } { p1 } ... { p1 } { p1,p2 } { p1 } { p1,p2 } { p1 } { p1,p2 } ... . . .

36/43

slide-78
SLIDE 78

AP-INF = set of infinite words over PowerSet(AP) Property 1: p1 is always true { A0A1A2 ··· ∈ AP-INF | each Ai contains p1 }

{ p1 } { p1 } { p1 } { p1 } { p1 } { p1 } { p1 } ... { p1 } { p1,p2 } { p1 } { p1,p2 } { p1 } { p1,p2 } ... . . .

Property 2: p1 is true at least once and p2 is always true

36/43

slide-79
SLIDE 79

AP-INF = set of infinite words over PowerSet(AP) Property 1: p1 is always true { A0A1A2 ··· ∈ AP-INF | each Ai contains p1 }

{ p1 } { p1 } { p1 } { p1 } { p1 } { p1 } { p1 } ... { p1 } { p1,p2 } { p1 } { p1,p2 } { p1 } { p1,p2 } ... . . .

Property 2: p1 is true at least once and p2 is always true { A0A1A2 ··· ∈ AP-INF | exists Ai containing p1 and every Aj contains p2 }

{ p2 } { p1,p2 } { p2 } { p2 } { p2 } { p1,p2 } { p2 } ... { p1,p2 } { p2 } { p2 } { p2 } { p2 } { p2 } ... . . .

36/43

slide-80
SLIDE 80

AP-INF = set of infinite words over PowerSet(AP) A property over AP is a subset of AP-INF

37/43

slide-81
SLIDE 81

Behaviour of TS

Atomic propositions Set of its traces

Property over AP

Subset of AP-INF

38/43

slide-82
SLIDE 82

When does a transition system satisfy a property?

39/43

slide-83
SLIDE 83

{ p1 } { p1,p2 } { p2 } {}

request=1 ready request=1 busy request=0 ready request=0 busy

Transition System AP = { p1, p2 }

40/43

slide-84
SLIDE 84

{ p1 } { p1,p2 } { p2 } {}

request=1 ready request=1 busy request=0 ready request=0 busy

Transition System AP = { p1, p2 } Property

40/43

slide-85
SLIDE 85

{ p1 } { p1,p2 } { p2 } {}

request=1 ready request=1 busy request=0 ready request=0 busy

Transition System AP = { p1, p2 } Property G p1

40/43

slide-86
SLIDE 86

{ p1 } { p1,p2 } { p2 } {}

request=1 ready request=1 busy request=0 ready request=0 busy

Transition System AP = { p1, p2 } Property G p1 Transition system TS satisfies property P if Traces(TS) ⊆ P

40/43

slide-87
SLIDE 87

A property over AP is a subset of AP-INF

41/43

slide-88
SLIDE 88

A property over AP is a subset of AP-INF − → hence also called Linear-time property

41/43

slide-89
SLIDE 89

Behaviour of TS

Atomic propositions Set of its traces

Property over AP

Subset of AP-INF

When does system satisfy property?

42/43

slide-90
SLIDE 90

Take-away

◮ Use of MODULE in NuSMV ◮ Synchronous Vs Asynchronous composition of

modules

◮ Mutual exclusion: checked some kind of safety property ◮ What properties do we check for detecting deadlocks? ◮ Definition of property

43/43