470 likes | 623 Views
Introduction to SMV. Symbolic Model Verifier. Ken McMillan, Symbolic Model Checking: An Approach to the State Explosion Problem , 1993. Finite-state Systems described in a specialized language Specifications given as CTL formulas Internal representation using OBDDs
E N D
Symbolic Model Verifier • Ken McMillan, Symbolic Model Checking: An Approach to the State Explosion Problem, 1993. • Finite-state Systems described in a specialized language • Specifications given as CTL formulas • Internal representation using OBDDs • Automatically verifies specification or produces a counterexample
Overview of SMV SMV Input Language Backend Finite State Kripke Structure OBDD based Symbolic Model Checking Yes Specification – CTL Formula No CounterExample
Language Characteristics • Allows description of completely synchronous to asynchronous systems, detailed to abstract systems • Modularized and hierarchical descriptions • Finite data types: Boolean and enumerated
Language Characteristics (cont..) • Parallel-assignment syntax • Non-determinism
A Sample SMV Program MODULE main VAR request: boolean; state: {ready, busy}; ASSIGN init(state) := ready; next(state) := case state=ready & request: busy; 1: {ready, busy}; esac; SPEC AG(request -> AF (state = busy))
SMV Syntax - Expressions Expr :: atom ;; symbolic constant | number ;; numeric constant | id ;; variable identifier | “!” expr ;; logical not | expr1 <op> expr2 | “next” “(“ id “)” ;; next value | case_expr | set_expr
The Case Expression Case_expr :: “case” expr_a1 “:” expr_b2 “;” … expr_an “:” expr_bn “;” “esac” • Guards are evaluated sequentially. • The first one that is true determines the resulting value • If none of the guards are true, result is numeric value 1
State Variables Decl :: “VAR” atom1 “:” type1 “;” atom2 “:” type2 “;” … • State is an assignment of values to a set of state variables • Type of a variable – boolean, scalar, user defined module, or array.
ASSIGN declaration Decl :: “ASSIGN” dest1 “:=“ expr1 “;” dest2 “:=“ expr2 “;” … Dest :: atom | “init” “(“ atom “)” | “next” “(“ atom “)”
Variable Assignments • Assignment to initial state: init(value) := 0; • Assignment to next state (transitionrelation)next(value) := value + carry_in mod 2; • Assignment to current state (invariant)carry_out := value & carry_in; • Either init-next or invar should be used, but not both • SMV is a parallel assignment language
Circular definitions • … are not allowed! • This is illegal: • a := next(b);next(b) := c;c := a; • This is o.k. • init(a) := 0;next(a) := !b;init(b) := 1;next(b) := !a;
Nondeterminism • Completely unassigned variable can model unconstrained input. • {val_1, …, val_n} is an expression taking on any of the given values nondeterministically. • Nondeterministic choice can be used to: • Model an implementation that has not been refined yet • Abstract behavior
ASSIGN and DEFINE • VARa: boolean;ASSIGNa := b | c; • declares a new state variable a • becomes part of invariant relation • DEFINEd:= b | c; • is effectively a macro definition, each occurrence of d is replaced by b | c • no extra BDD variable is generated for d • the BDD for b | c becomes part of each expression using d
SPEC declaration • Decl :: “SPEC” ctlform • Ctlform :: expr ;; bool expression | “!” ctlform | ctlform1 <op> ctlform2 | “E” pathform | “A” pathform • Pathform :: “X” ctlform | “F” ctlform | “G” ctlform | ctlform1 “U” ctlform2
Modules and Hierarchy • Modules can be instantiated many times, each instantiation creates a copy of the local variables • Each program has a module main • Scoping • Variables declared outside a module can be passed as parameters • Parameters are passed by reference.
Pass by reference DEFINE a := 0; VAR b : bar(a); … MODULE bar(x) DEFINE a := 1; y := x;
Pass by reference … VAR a : boolean; b : foo(a); … MODULE foo(x) ASSIGN x:=1;
MODULE main VARbit0 : counter_cell(1); bit1 : counter_cell(bit0.carry_out); bit2 : counter_cell(bit1.carry_out); SPEC AG AF bit2.carry_out MODULE counter_cell(carry_in) VARvalue : boolean; ASSIGN init(value) := 0; next(value) := value + carry_in mod 2; DEFINEcarry_out := value & carry_in;
Module Composition • Synchronous composition • All assignments are executed in parallel and synchronously. • A single step of the resulting model corresponds to a step in each of the components. • Asynchronous composition • A step of the composition is a step by exactly one process. • Variables, not assigned in that process, are left unchanged.
Asynchronous Composition MODULE main VARgate1: process inverter(gate3.output); gate2: process inverter(gate1.output); gate3: process inverter(gate2.output); SPEC (AG AFgate1.output) & (AG AF!gate1.output) MODULE inverter(input) VAR output: boolean; ASSIGN init(output) := 0; next(output) := !input;
Fairness • FAIRNESS ctl_formulae • Assumed to be true infinitely often • Model checker only explores paths satisfying fairness constraint • Each fairness constraint must be true infinitely often • If there are no fair paths • All existential formulas are false • All universal formulas are true • FAIRNESSrunning
With Fairness.. MODULE main VARgate1: process inverter(gate3.output); gate2: process inverter(gate1.output); gate3: process inverter(gate2.output); SPEC (AG AFgate1.output) & (AG AF!gate1.output) MODULE inverter(input) VAR output: boolean; ASSIGN init(output) := 0; next(output) := !input; FAIRNESS running
Counter revisited MODULE main VAR count_enable : boolean; bit0 : counter_cell(count_enable); bit1 : counter_cell(bit0.carr_out); bit2 : counter_cell(bit1.carry_out); SPEC AG AF bit2.carry_out FAIRNESS count_enable
Synchronous vs Asynchronous • In Asynchronous process, need not combine transition relation of each process • Complexity of representing set of states reachable in n steps higher in asynchronous processes occassionally due to higher number of interleavings
Implicit Modelling • TRANS - boolean valued expr restricting transition relation of system • INIT - boolean valued expression giving initial states • INVAR - boolean valued expression restricting set of all states of model
Implicit Modelling Example MODULE main VAR gate1 : inverter(gate3.output); gate2 : inverter(gate1.output); gate3 : inverter(gate2.output); SPEC (AG AF gate1.out) & (AG AF !gate1.out) MODULE inverter(input) VAR Output : boolean; INIT output = 0; TRANS next(output) = !input | next(output) = output
TRANS Advantages • Group assignments to different variables • Good for modelling guarded commands Disadvantages • Logical absurdities can lead to unimplementable descriptions
Shared Data Example Two Users assign pid to shared data in turn MODULE main VAR data : boolean; turn : boolean; user0 : user(0, data, turn); user1 : user(1, data, turn); ASSIGN next(turn) := !turn; SPEC AG (AF data & AF (!data))
Shared data example (cont..) Using ASSIGN and CASE statement won’t work(constraining sema all the time) MODULE user(pid, data, turn) ASSIGN next(data) := case turn: pid; 1 : data; esac; Line 3: multiple assignment: next(data)
Using TRANS TRANS useful for changing shared data in synchronous system between modules. MODULE user(pid, turn, data) TRANS turn -> next(data) = pid
Guarded Commands Guard1 : action1 Guard2 : action2 .. Otherwise nop TRANS (guard1 & action1)| (guard2 & action2)| … (!guard1 & !guard2 & … & “nop”)
TRANS Pitfall True -> next(b) = 0 & True -> next(b) = 1 & … Results in an empty transition relation
TRANS Guidelines • Try using ASSIGN instead • Write in a disjunction of conjunction format • Try covering all cases • Try make guards disjoint
SMV Steps • Read_Model : read model from input smv file • Flatten_hierarchy : instantiate modules and processes • Build_model : compile the model into BDDs (initial state, invar, transition relation) • Check_spec : checking specification bottom up
Run SMV • smv [options] inputfile • -c cache-size for BDD operations • -k key-table-size for BDD nodes • -v verbose • -int interactive mode • -r • prints out statistics about reachable state space
SMV Options • –f • computes set of reachable states first • Model checking algorithm traverses only the set of reachable states instead of complete state space. • useful if reachable state space is a small fraction of total state space
SMV Options: Reordering vars • Variable reordering is crucial for small BDD sizes and speed. • Generally, variables which are related need to be close in the ordering. • –i filename –o filename • Input, output BDD variable ordering to given file. • -reorder • Invokes automatic variable reordering
SMV Options: Transition relation smv -cp part_limit • Conjunctive Partitioning: Transition relation not evaluated as a whole, instead individual next() assignments are grouped into partitions that do not exceed part_limit • Uses less memory and benefits from early quantification
SMV options: -inc • Perform incremental evaluation of the transition relation • At each step in forward search, transition relation restriced to reached state set • Cuts down on size of transition relation with overhead of extra computation
Example: Client & Server MODULE client (ack) VAR state : {idle, requesting}; req : boolean; ASSIGN init(state) := idle; next(state) := case state=idle : {idle, requesting}; state=requesting & ack : {idle, requesting}; 1 : state; esac; req := (state=requesting);
MODULE server (req) VAR state : {idle, pending, acking}; ack : boolean; ASSIGN next(state) := case state=idle & req : pending; state=pending : {pending, acking}; state=acking & req : pending; state=acking & !req : idle; 1 : state; esac; ack := (state = acking);
Is the specification true? MODULE main VAR c : client(s.ack); s : server(c.req); SPEC AG (c.req -> AF s.ack) • Need fairness constraint: • Suggestion:FAIRNESS s.ack • Why is this bad? • Solution:FAIRNESS (c.req -> s.ack)
NuSMV • Specifications expressible in CTL, LTL and Real time CTL logics • Provides both BDD and SAT based model checking. • Uses a number of heuristics for achieving efficiency and control state explosion • Higher number of features in interactive mode
Cadence SMV • Provides “compositional techniques” to verify large complex systems by decomposition to smaller problems. • Provides a variety of techniques for refinement verification, symmetry reductions, uninterpreted functions, data type reductions.
Useful Links • SMV sources, binaries and manualshttp://www.cs.cmu.edu/~modelcheck/smv.html • SMV man page http://www.cs.cmu.edu/~dongw/smv.txt • SMV manualhttp://www.cs.cmu.edu/~modelcheck/smv/smvmanual.ps • Tutorial on verification techniques using Cadence SMVhttp://www-cad.eecs.berkeley.edu/~kenmcmil/tutorial.ps • SMV Input Language documentationhttp://www-cad.eecs.berkeley.edu/~kenmcmil/psdoc.html
Downloads • SMV www.cs.cmu.edu/~modelcheck/smv.html • NuSMV http://nusmv.irst.itc.it/ • Cadence SMV http://wwwcad.eecs.berkeley.edu/~kenmcmil/smv