Introduction to Spin and Promela Sagar Chaki CMU

Introduction to Spin and Promela Sagar Chaki CMU

Roadmap n n n Historical perspective Overview of Spin Overview of Promela Simulation with Spin Overview of LTL Verification with Spin

Part III Overview of LTL

Basic concepts n Set of propositions: P n n Infinite trace t over P n n n P = {a, b, c} t 0, t 1, t 2, … ti subset of P for i ≥ 0 ti denotes infinite trace ti, ti+1, … {b}, {a, c}, {a, b, c}, {a}, … Set of all infinite traces over P: G(P)

LTL syntax n f : = | | | p proposition true false (f) f binop f unop f

LTL syntax n unop : = | | | n binop : = | | [] <> X ! U && || -> <-> always (G) eventually (F) next time logical negation strong until logical AND logical OR implication equivalence

LTL semantics n An infinite trace t (over P) either satisfies or does not satisfy an LTL formula f (over P) n Satisfaction denoted by t ² f

LTL semantics n Given an infinite trace t = t 0, t 1, t 2, … and a LTL formula f we can decide if t ² f depending on the structure of f n n t ² p iff p belongs to t 0 Always t ² true Never t ² false t ² (f) iff t ² f

LTL semantics n n n t ² [] f iff ti ² f forall i ≥ 0 t ² <> f iff exists i ≥ 0 s. t. ti ² f t ² X f iff t 1 ² f t ² !f iff NOT(t ² f) t ² f 1 U f 2 iff exists i ≥ 0 s. t. tj ² f 1 for 0 ≤ j < i and ti ² f 2

LTL semantics n t ² f 1 && f 2 iff t ² f 1 AND t ² f 2 n t ² f 1 || f 2 iff t ² f 1 OR t ² f 2 n t ² f 1 -> f 2 iff t ² f 1 IMPLIES t ² f 2 n t ² f 1 <-> f 2 iff t ² f 1 IFF t ² f 2

LTL semantics n An LTL formula can also be looked at as the set of infinite traces that satisfy it n n Note the striking similarity with the case of regular expressions and finite strings over an alphabet S If S is the set of traces that satisfy f then G(P)S is the set of traces that satisfy !f

Things to remember n Every LTL formula represents the set of infinite traces which satisfy it

Buchi automata n n n Recall the similarity of LTL with regular expressions Regular languages are accepted by finite automata Are there automata for LTL n n Turns out there are They are called Buchi automata

Buchi automata n n Fix an alphabet S Buchi automaton is a 4 -tuple : <Q, I, d, F> n n n Q : set of states I : initial state d : transition relation: subset of QX S XQ F : set of accepting states In our case S is 2 P

Example b a S 0 S 1 I = S 0 , F = {S 0}

Buchi automata n A run is an infinite sequence of state s 0, s 1, s 2, … such that n n n s 0 = I Exists ai є S s. t. (si, ai, si+1) є d for i ≥ 0 A run is an accepting run iff it visits some accepting state infinitely often

Buchi automata n Given a run s = s 0, s 1, s 2, …a trace t = t 0, t 1, t 2, …is said to correspond to s iff (si, ti, si+1) є d for i ≥ 0 n The language of a Buchi automaton is the set of traces corresponding to its accepting runs n LTL also corresponds to a set of traces

Example n Traces : {{a}, {b}, …} b a S 0 S 1 I = S 0 , F = {S 0}

Cute results n BA are closed under complementation n n For every Buchi automaton A there exists another Buchi automaton B such that the language of A is the complement of the language of B Here complement means set difference from G(P)

Cute results n BA are closed under intersection and union n Checking if the language of a Buchi automaton is empty is decidable n Can check if the langauges of two Buchi automata have a non-empty intersection

Cute results n Buchi automata are not always determinisable n n There exists a non-deterministic Buchi automaton A such that there is no deterministic Buchi automaton with the same language as A Non-deterministic means some states have multiple outgoing transitions with same label

Cute results n The set of languages accepted by Buchi automata is called the set of w-regular languages n n n This is a strict superset of LTL Every LTL corresponds to some BA There exists a BA whose language does not correspond to any LTL formula

Things to remember n Every LTL formula represents the set of infinite traces which satisfy it n Every LTL formula has a corresponding Buchi automaton

Kripke structure n Is a 4 -tuple : <S, I, d, L> n n S : set of states I : initial state d : transition relation: subset of S X S L : labeling function : S -> 2 P

Computations and Traces n A computation is an infinite sequence of states s 0, s 1, s 2, … n n n s 0 = I (si, si+1) є d for i ≥ 0 Given a computation s 0, s 1, s 2, … the corresponding trace is L(s 0), L(s 1), L(s 2), …

Kripke and Buchi n Kripke looks different from Buchi n n Labels are on states not transitions No accepting states Nevertheless … For every Kripke structure K there exists a Buchi automaton which accepts exactly the set of traces corresponding to computations of K

Kripke to Buchi a b c S 0 S 1 S 2 I = S 0

Kripke to Buchi a c b S 0 S 1 S 2

Kripke to Buchi a S 3 c b a S 0 S 1 I = S 3, F = {S 0, S 1, S 2, S 3} S 2

Things to remember n n n Every LTL formula represents the set of infinite traces which satisfy it Every LTL formula has a corresponding Buchi automaton Every Kripke structure has a corresponding Buchi automaton

What do we really want? n n Kripke (M) ² LTL (f) Traces of M contained in traces of f Language of Buchi of M contained in language of Buchi of f Language of Buchi of M has empty intersection with language of Buchi of !f n This is decidable

LTL model checking n n Two ways to do it Convert Kripke to Buchi n n Convert claim (LTL) to Buchi Check language inclusion OR Convert ~Claim (LTL) to Buchi Check empty intersection

What Spin does n Checks non-empty intersection n n Works directly with Promela n n Requires very little space in best case No conversion to Kripke or Buchi Must provide Spin with negation of property you want to prove

Time for example 5

References n http: //cm. bell-labs. com/cm/cs/what/spin/ n http: //cm. belllabs. com/cm/cs/what/spin/Manual. html n http: //cm. belllabs. com/cm/cs/what/spin/Man/Quick. html