Model Checking

1. Model Checking

2. Model Checking • Used in studying behaviors of reactive systems • Typically involves three steps: • Create a finite state model (FSM) of the system design • Specify critical correctness properties • Validate the model w/r to the specifications

3. Create a FSM • FSM languages • focus on expressing concurrency, synchronization, and communication • abstract details of internal computations • must be precise and unambiguous (formally defined syntax and semantics) • We will use Promela for giving system descriptions

4. Specify correctness properties • Safety properties: • Nothing “bad” ever happens • Formalized using state invariants • execution never reaches a “bad” state • Liveness properties: • Something “good” eventually happens • Formalized using temporal logic • special logic for describing sequences

5. Validate the model • “Execute” the model to test it • simulate executions of the system • check satisfaction of safety properties along simulated executions • Exhaustive analysis • generate reachability graph to verify safety and liveness properties • Generate counterexamples to illustrate failures

6. Home Heating System

7. Example properties • Pump is never on unless Burner is also on • Whenever Sensor calls resp-temp(LOW), eventually Controller becomes all-on

8. Reachability Graph • Graph of global states that can be “reached” during execution • global state contains a state for each concurrent “process” • transitions show how an event or action transforms the global state • Analyze global state space to verify safety properties • Analyze paths through the RG to verify liveness properties

9. Promela • The system description language of SPIN • Designed for modeling data communication protocols • System described as a collection of concurrent processes • Processes communicate and synchronize via message channels and global variables

10. Promela • Specify macro definitions #define signal 0 • Declare symbolic constants mtype = { ON, OFF, LOW, OK } • Declare a synchronous message channel chan pump_in = [0] of { mtype }

11. Promela • Create a process instance active proctype pump ( ) { statements } • Send a message pump_in!ON • Receive a message pump_in?ON

12. Promela version of HHS

13. Promela version of HHS

14. Promela version of HHS

15. SPIN simulation of HHS • SPIN automatically generates sequence diagrams to represent executions • random • guided • interactive • Automates tracing between system views • sequence diagram • Promela description • state diagram • textual execution traces

16. Verification of a safety property • Pump is never on unless Burner is also on bool burner_is_on;

17. Verification of a liveness property Whenever Sensor calls resp-temp(LOW), eventually Controller becomes all-on

18. Verification of a liveness property