Model Checker NuSMV Hao Zheng Department of Computer Science and - - PowerPoint PPT Presentation

▶
model checker nusmv
SMART_READER_LITE
LIVE PREVIEW

Model Checker NuSMV Hao Zheng Department of Computer Science and - - PowerPoint PPT Presentation

Oct 27, 2022 145 likes •623 views

Model Checker NuSMV Hao Zheng Department of Computer Science and Engineering University of South Florida Tampa, FL 33620 Email: zheng@cse.usf.edu Phone: (813)974-4757 Fax: (813)974-5456 Hao Zheng (CSE, USF) Comp Sys Verification 1 / 35

slide-1
SLIDE 1

Model Checker NuSMV

Hao Zheng

Department of Computer Science and Engineering University of South Florida Tampa, FL 33620 Email: zheng@cse.usf.edu Phone: (813)974-4757 Fax: (813)974-5456

Hao Zheng (CSE, USF) Comp Sys Verification 1 / 35

slide-2
SLIDE 2

Overview

1

Input Language

2

Simulation

3

Model Checking

4

Modeling Examples

Hao Zheng (CSE, USF) Comp Sys Verification 2 / 35

slide-3
SLIDE 3

NuSMV

  • NuSMV is a symbolic model checker ( a reimplementation of the
  • riginal CMU SMV ).
  • The NuSMV input language allows to specify synchronous or

asynchronous systems at gate or behavioral level.

  • It provides constructs for hierarchical descriptions.
  • synchronous modules, or asynchronous processes.
  • Systems are modeled as finite state machines.
  • Only finite date types are supported: Boolean, enumeration, array, etc.
  • Source: http://nusmv.irst.itc.it/ for the software and documents.
  • User manuals, tutorials, etc.

Hao Zheng (CSE, USF) Comp Sys Verification 3 / 35

slide-4
SLIDE 4

Contents

1

Input Language

2

Simulation

3

Model Checking

4

Modeling Examples

Hao Zheng (CSE, USF) Comp Sys Verification 4 / 35

slide-5
SLIDE 5

Single Process Example

MODULE main VAR request : boolean; state : {ready, busy}; ASSIGN init(state) := ready; next(state) := case state = ready & request = 1 : busy; 1 : {ready, busy}; esac; SPEC AG (request -> AF (state = busy))

  • Comments start with “- -”.

Hao Zheng (CSE, USF) Comp Sys Verification 5 / 35

slide-6
SLIDE 6

Single Process Example

MODULE main VAR request : boolean; state : {ready, busy}; ASSIGN init(state) := ready; next(state) := case state = ready & request = 1 : busy; 1 : {ready, busy}; esac; SPEC AG (request -> AF (state = busy))

  • Top level model is “main”.

Hao Zheng (CSE, USF) Comp Sys Verification 5 / 35

slide-7
SLIDE 7

Single Process Example

MODULE main VAR request : boolean; state : {ready, busy}; ASSIGN init(state) := ready; next(state) := case state = ready & request = 1 : busy; 1 : {ready, busy}; esac; SPEC AG (request -> AF (state = busy))

  • Each module is divided into section starting with VAR, ASSIGN,

SPEC, etc

Hao Zheng (CSE, USF) Comp Sys Verification 5 / 35

slide-8
SLIDE 8

Single Process Example

MODULE main VAR request : boolean; state : {ready, busy}; ASSIGN init(state) := ready; next(state) := case state = ready & request = 1 : busy; 1 : {ready, busy}; esac; SPEC AG (request -> AF (state = busy))

  • State space of a module is defined by the variables and their types.

Hao Zheng (CSE, USF) Comp Sys Verification 5 / 35

slide-9
SLIDE 9

Single Process Example

MODULE main VAR request : boolean; state : {ready, busy}; ASSIGN init(state) := ready; next(state) := case state = ready & request = 1 : busy; 1 : {ready, busy}; esac; SPEC AG (request -> AF (state = busy))

  • Section ASSIGN defines the initialization and transition relations of

variables.

  • init(v) initializes a variable. An uninitialized variable can take any value of

its type.

  • next(v) defines the next state of v based on current states.

Hao Zheng (CSE, USF) Comp Sys Verification 5 / 35

slide-10
SLIDE 10

Single Process Example

MODULE main VAR request : boolean; state : {ready, busy}; ASSIGN init(state) := ready; next(state) := case state = ready & request = 1 : busy; 1 : {ready, busy}; esac; SPEC AG (request -> AF (state = busy))

  • case expression includes several branches, each of which returns a value

if the branch condition is true.

  • If multiple brach conditions are true, one is selected

non-deterministically.

Hao Zheng (CSE, USF) Comp Sys Verification 5 / 35

slide-11
SLIDE 11

Single Process Example

MODULE main VAR request : boolean; state : {ready, busy}; ASSIGN init(state) := ready; next(state) := case state = ready & request = 1 : busy; 1 : {ready, busy}; esac; SPEC AG (request -> AF (state = busy))

  • If a variable is not assigned by next(v), its next state is selected

non-deterministically from its type.

  • See request.

Hao Zheng (CSE, USF) Comp Sys Verification 5 / 35

slide-12
SLIDE 12

Single Process Example

MODULE main VAR request : boolean; state : {ready, busy}; ASSIGN init(state) := ready; next(state) := case state = ready & request = 1 : busy; 1 : {ready, busy}; esac; SPEC AG (request -> AF (state = busy))

  • Section SPEC includes CTL formulas.
  • Section LTLSPEC includes LTL formulas.

Hao Zheng (CSE, USF) Comp Sys Verification 5 / 35

slide-13
SLIDE 13

A Binary Counter

MODULE counter_cell(carry_in) VAR value : boolean; ASSIGN init(value) := 0; next(value) := (value + carry_in) mod 2; DEFINE carry_out := value & carry_in; MODULE main VAR bit0 : counter_cell(1); bit1 : counter_cell(bit0.carry_out); bit2 : counter_cell(bit1.carry_out);

  • The counter is a connection of three counter cell instances done as

variable declarations.

  • A module instance can take parameters.
  • Notation a.b is used to access the variables inside a component.

Hao Zheng (CSE, USF) Comp Sys Verification 6 / 35

slide-14
SLIDE 14

A Binary Counter

MODULE counter_cell(carry_in) VAR value : boolean; ASSIGN init(value) := 0; next(value) := (value + carry_in) mod 2; DEFINE carry_out := value & carry_in; MODULE main VAR bit0 : counter_cell(1); bit1 : counter_cell(bit0.carry_out); bit2 : counter_cell(bit1.carry_out);

  • Keyword DEFINE creates an alias for an expression.
  • Can also be done using ASSIGN.

Hao Zheng (CSE, USF) Comp Sys Verification 6 / 35

slide-15
SLIDE 15

Asynchronous Systems

MODULE inverter(input) VAR output : boolean; ASSIGN init(output) := 0; next(output) := !input; FAIRNESS running MODULE main VAR gate0 : process inverter(gate3.output); gate1 : process inverter(gate1.output); gate2 : process inverter(gate2.output);

  • Instances with keyword process are composed asynchronously.
  • A process is chosen non-deterministically in a state.
  • Variables in a process not chosen remain unchanged.

Hao Zheng (CSE, USF) Comp Sys Verification 7 / 35

slide-16
SLIDE 16

Asynchronous Systems

MODULE inverter(input) VAR output : boolean; ASSIGN init(output) := 0; next(output) := !input; FAIRNESS running MODULE main VAR gate0 : process inverter(gate3.output); gate1 : process inverter(gate1.output); gate2 : process inverter(gate2.output);

  • A process may never be chosen.
  • Each process needs fairness constraint ”FAIRNESS running” to make sure

it is chosen infinitely often.

Hao Zheng (CSE, USF) Comp Sys Verification 7 / 35

slide-17
SLIDE 17

Asynchronous Systems (cont’d)

  • Keyword process may be going away.

MODULE inverter(input) VAR

  • utput : boolean;

ASSIGN init(output) := 0; next(output) := (!input) union output; MODULE main VAR gate1 : inverter(gate3. output); gate2 : inverter(gate1. output); gate3 : inverter(gate2. output);

  • Use keyword union to allow each variable to nondeterministically

change or keep the current value.

  • Cannot enforce fairness.

Hao Zheng (CSE, USF) Comp Sys Verification 8 / 35

slide-18
SLIDE 18

Direct Specification

MODULE main VAR gate1 : inverter(gate3. output); gate2 : inverter(gate1. output); gate3 : inverter(gate2. output); MODULE inverter(input) VAR

  • utput : boolean;

INIT

  • utput = FALSE;

TRANS next(output) = !input | next(output) = output;

  • The set of initial states is specified as a formula in the current state

variables (INIT)

Hao Zheng (CSE, USF) Comp Sys Verification 9 / 35

slide-19
SLIDE 19

Direct Specification

MODULE main VAR gate1 : inverter(gate3. output); gate2 : inverter(gate1. output); gate3 : inverter(gate2. output); MODULE inverter(input) VAR

  • utput : boolean;

INIT

  • utput = FALSE;

TRANS next(output) = !input | next(output) = output;

  • The transition relation is specified as a propositional formula in terms of

the current and next state variables (TRANS).

  • In the example, each gate can choose non-deterministically

Hao Zheng (CSE, USF) Comp Sys Verification 9 / 35

slide-20
SLIDE 20

Contents

1

Input Language

2

Simulation

3

Model Checking

4

Modeling Examples

Hao Zheng (CSE, USF) Comp Sys Verification 10 / 35

slide-21
SLIDE 21

Running NuSMV: Simulation

  • Simulation provides some intuition of systems to be checked.
  • It allows users to selectively execute certain paths
  • Three modes: deterministic, random, or interactive.
  • Strategies used to decide how the next state is chosen.
  • Deterministic mode: the first state of a set is chosen.
  • Random mode: a state is chosen randomly.
  • Traces are generated in both modes.
  • Traces are the same in different runs with deterministic mode, but may be

different with random mode.

Hao Zheng (CSE, USF) Comp Sys Verification 11 / 35

slide-22
SLIDE 22

Interactive Simulation

  • Users have full control on trace generation.
  • Users guide the tool to choose the next state in each step.
  • Especially useful when one wants to inspect a particular path.
  • Users are allowed to specify constraints to narrow down the next state

selection.

  • Refer to section on Simulation Commands in the User Manual.

Hao Zheng (CSE, USF) Comp Sys Verification 12 / 35

slide-23
SLIDE 23

Contents

1

Input Language

2

Simulation

3

Model Checking

4

Modeling Examples

Hao Zheng (CSE, USF) Comp Sys Verification 13 / 35

slide-24
SLIDE 24

Model Checking

  • Decides the truth of CTL/LTL formulas on a model.
  • SPEC is used for CTL formulas, while LTLSPEC is used for LTL

formulas.

  • A counter-example (CE) may be generated if a formula is false.
  • CE cannot be generated for formula with E quantifier.

Hao Zheng (CSE, USF) Comp Sys Verification 14 / 35

slide-25
SLIDE 25

NuSMV CTL Specification

  • Introduced with SPEC for each module.
  • CTL operators: AG, AF, AX, A(f U g), EG, EF, EX, E(f U g),
  • Plain CTL extended with real-time.
  • Each state transition takes unit amount of time.
  • [A | E]BGm..n f : f holds from the mth state until the nth state from

the current state on all or some paths.

  • [A | E]BFm..n f : f holds in any state within from the mth state and

the nth state from the current state on all or some paths.

  • [A | E](f1BUm..n f2 : f2) holds in state si such that m ≤ i ≤ n, and

f1 holds in all state sj such that m ≤ j < i from the current state on all or some paths.

  • Refer to the NuSMV User Manual for detailed description.

Hao Zheng (CSE, USF) Comp Sys Verification 15 / 35

slide-26
SLIDE 26

NuSMV LTL Specification

  • Introduced with LTLSPEC for each module.
  • Used for complete or bounded model checking.
  • Includes past temporal operators in addition to the other usual

temporal operators.

  • Yf holds if f holds in the immediate previous state.
  • Hf holds if f holds in all previous states.
  • Of holds if f holds in a previous state.
  • fSg holds if f holds in all states until now following the state where g

holds.

  • Refer to the NuSMV User Manual for detailed description.

Hao Zheng (CSE, USF) Comp Sys Verification 16 / 35

slide-27
SLIDE 27

Contents

1

Input Language

2

Simulation

3

Model Checking

4

Modeling Examples

Hao Zheng (CSE, USF) Comp Sys Verification 17 / 35

slide-28
SLIDE 28

A 3-bit Counter: Functional Modeling

  • When reset is asserted, output goes to 0.
  • Ohterwise, output increments by 1 in each cycle.

MODULE counter(reset) VAR

  • utput : 0..7;

ASSIGN init(output) := 0; next(output) := case reset = 1 : 0;

  • utput < 7 : output + 1;
  • utput = 7 : 0;

1 : output; esac;

Hao Zheng (CSE, USF) Comp Sys Verification 18 / 35

slide-29
SLIDE 29

A 3-bit Counter: Gate-level Modeling

Hao Zheng (CSE, USF) Comp Sys Verification 19 / 35

slide-30
SLIDE 30

A 3-bit Counter: Gate-level Modeling

MODULE counter(reset) VAR v0 : boolean; v1 : boolean; v2 : boolean; ASSIGN next(v0) := case reset = 1 : 0; 1 : !v0; esac; next(v1) := case reset = 1 : 0; 1 : v0 xor v1; esac; next(v2) := case reset = 1 : 0; 1 : (v0 & v1) xor v2; esac;

Hao Zheng (CSE, USF) Comp Sys Verification 20 / 35

slide-31
SLIDE 31

A 3-bit Counter: Model Checking

MODULE main VAR reset : boolean; dut : counter(reset); ASSIGN init(reset) := 1; DEFINE cnt_out = dut.output; SPEC AG(reset -> cnt_out=0 ) SPEC AG(!reset & cnt_out=0 -> AX(cnt_out=1)) ... SPEC AG(!reset & cnt_out=7 -> AX(cnt_out=0))

Hao Zheng (CSE, USF) Comp Sys Verification 21 / 35

slide-32
SLIDE 32

A SR-Latch: Functional Modeling

  • It has two inputs S and R, and two outputs Q and NQ.
  • When S = 1 and R = 0, Q = 1 and NQ = 0.
  • When S = 0 and R = 1, Q = 0 and NQ = 1.
  • When S = 0 and R = 0, Q and NQ remain unchanged.
  • Otherwise, S = 1 and R = 1 should be avoided.

Hao Zheng (CSE, USF) Comp Sys Verification 22 / 35

slide-33
SLIDE 33

A SR-Latch: Functional Modeling (1)

MODULE SR(S, R) VAR Q : boolean; NQ : boolean; ASSIGN init(Q) := 0; next(Q) := case R = 1 : 0; S = 1 : 1; 1 : Q; esac; NQ := !Q;

Hao Zheng (CSE, USF) Comp Sys Verification 23 / 35

slide-34
SLIDE 34

A SR-Latch: Functional Modeling (2)

MODULE SR_Q(S, R) VAR Q : boolean; ASSIGN init(Q) := 0; next(Q) := case R = 1 : 0; S = 1 : 1; 1 : Q; esac;

Hao Zheng (CSE, USF) Comp Sys Verification 24 / 35

slide-35
SLIDE 35

A SR-Latch: Functional Modeling (2)

MODULE SR_NQ(S, R) VAR NQ : boolean; ASSIGN init(NQ) := 0; next(NQ) := case R = 1 : 1; S = 1 : 0; 1 : NQ; esac;

Hao Zheng (CSE, USF) Comp Sys Verification 25 / 35

slide-36
SLIDE 36

A SR-Latch: Functional Modeling (3)

MODULE SR(S, R) VAR q : process SR_Q(S, R); nq : process SR_NQ(S, R);

  • - correctnes requirement

SPEC AG( q.Q = !nq.NQ )

  • - environment assumption

INVAR !(S & R)

Hao Zheng (CSE, USF) Comp Sys Verification 26 / 35

slide-37
SLIDE 37

A SR-Latch: Gate-Level Modeling

Hao Zheng (CSE, USF) Comp Sys Verification 27 / 35

slide-38
SLIDE 38

A SR-Latch: Gate-Level Modeling

MODULE NOR2(a, b) VAR

  • utput : boolean;

ASSIGN init(output) := 0; next(output) := case a | b : 0; 1 : 1; esac;

Hao Zheng (CSE, USF) Comp Sys Verification 28 / 35

slide-39
SLIDE 39

A SR-Latch: Gate-Level Modeling

MODULE SRL(S, R) VAR Q : boolean; NQ : boolean; nor1 : process NOR2(R, NQ); nor2 : process NOR2(S, Q); ASSIGN Q := nor1.output; NQ := nor2.output; SPEC AG( S -> AX (Q & !NQ) ) SPEC AG( R -> AX (!Q & NQ) )

Hao Zheng (CSE, USF) Comp Sys Verification 29 / 35

slide-40
SLIDE 40

Semaphore

MODULE main VAR semaphore : boolean; proc1 : process user(semaphore); proc2 : process user(semaphore); ASSIGN init(semaphore) := FALSE; SPEC AG !(proc1.state = critical & proc2.state = critical) SPEC AG (proc1.state = entering -> AF proc1.state = critical)

Hao Zheng (CSE, USF) Comp Sys Verification 30 / 35

slide-41
SLIDE 41

Semaphore

MODULE user(semaphore) VAR state : {idle, entering, critical, exiting}; ASSIGN init(state) := idle; next(state) := case state = idle : {idle, entering}; state = entering & !semaphore : critical; state = critical : {critical, exiting}; state = exiting : idle; TRUE : state; esac; next(semaphore) := case state = entering : TRUE; state = exiting : FALSE; TRUE : semaphore; esac; FAIRNESS running

Hao Zheng (CSE, USF) Comp Sys Verification 31 / 35

slide-42
SLIDE 42

Semaphore − LTL Model Checking

MODULE main VAR semaphore : boolean; proc1 : process user(semaphore); proc2 : process user(semaphore); ASSIGN init(semaphore) := FALSE; LTLSPEC G !(proc1.state = critical & proc2.state = critical) LTLSPEC G (proc1.state = entering -> F proc1.state = critical)

Hao Zheng (CSE, USF) Comp Sys Verification 32 / 35

slide-43
SLIDE 43

From Promela to NuSMV

1 #define true 1 /* spinroot: file ex.4b */ 2 #define false 0 3 bool flag[2]; 4 bool turn; 5 active [2] proctype user() 6 { flag[_pid] = true; 7 turn = _pid; 8 (flag[1-_pid] == false || turn == 1-_pid); 9 crit: skip; /* critical section */ 10 flag[_pid] = false 11 }

Hao Zheng (CSE, USF) Comp Sys Verification 33 / 35

slide-44
SLIDE 44

From Promela to NuSMV

MODULE main VAR flag : array 0..1 of boolean; turn : boolean; proc1 : user(flag, turn, 0); proc2 : user(flag, turn, 1); ASSIGN init(flag[0]) := FALSE; init(flag[1]) := FALSE; init(turn) := FALSE;

Hao Zheng (CSE, USF) Comp Sys Verification 34 / 35

slide-45
SLIDE 45

From Promela to NuSMV

MODULE user(flag, turn, pid) VAR state : {s6, s7, s8, s9, s10}; ASSIGN init(state) := s6; next(state) := case state = s6 : {s6, s7}; state = s7 : {s7, s8}; state = s8 & (flag[1-pid] = FALSE | turn = 1-pid) : {s8, s9}; state = s9 : {s9, s10}; state = s10 : {s10, s6}; TRUE : state; esac;

Hao Zheng (CSE, USF) Comp Sys Verification 35 / 35

slide-46
SLIDE 46

From Promela to NuSMV

next(flag[pid]) := case state = s6 : TRUE; state = s10 : FALSE; TRUE : flag[pid]; esac; next(turn) := case state = s7 : pid; TRUE : turn; esac;

Hao Zheng (CSE, USF) Comp Sys Verification 36 / 35