PROMELA Semantics from THE SPIN MODEL CHECKER by

PROMELA Semantics from “THE SPIN MODEL CHECKER” by G. J. Holzmann Presented by Hong, Shin 5 th Oct 2007 * PROMELA Semantics Hong, Shin @ PSWLAB 1 / 25

Contents • • • * Introduction Transition Relation Operational Model Semantics Engine Interpreting PROMELA models Further study PROMELA Semantics Hong, Shin @ PSWLAB 2 / 25

Introduction 1/3 • A SPIN model can be used to specify the behavior of collections of asynchronously executing processes in a distributed system. • From a SPIN model, we can generate a large directed graph of all reachable system state, called global reachability graph. • Correctness claims in PROMELA can be interpreted as statements about the presence or absence of specific types of nodes or edges in the global reachability graph. * PROMELA Semantics Hong, Shin @ PSWLAB 3 / 25

Introduction 2/3 • The PROMELA semantics defines the behavior of a PROMEL model. • The PROMELA semantics rules define how the global reachability graph for any given PROMELA model is to be generated. chan x = [0] of { bit } ; chan y = [0] of { bit } ; active proctype A() { x? 0 unless y!0 } active proctype B() { y? 0 unless x!0 } * PROMELA Semantics Hong, Shin @ PSWLAB 4 / 25

Introduction 3/3 • The operational semantics of PROMELA should allow us to derive what the structure of the global reachability graph is for any given SPIN model in detail. - Global reachability graph’s state Operational model - Global reachability graph’s transition Transition relation * PROMELA Semantics Hong, Shin @ PSWLAB 5 / 25

Transition Relation 1/2 • Every PROMELA proctype defines a finite state automaton (S, s 0, L, T, F ). - Transition relation T defines the flow of control. - Transition label set L links each transition in T with a specific basic statement that defines the executability and the effect of that transition. active proctype not_euclid(int x, int y) { if : : (x > y) -> L: x = x – y : : (x < y) -> y = y – x : : (x == y) -> assert(x != y) ; goto L fi ; printf(“%dn”, x) ; } * PROMELA Semantics Hong, Shin @ PSWLAB 6 / 25

Transition Relation 2/2 active proctype not_euclid(int x, int y) { if : : (x > y) -> L: x = x – y : : (x < y) -> y = y – x : : (x == y) -> assert(x != y) ; goto L fi ; printf(“%dn”, x) ; } x<y x == y x>y assert(x!=y) x=x-y y=y-x print • If, goto, semicolon, arrow, do, break … do not appear as labels on transitions. • basic statements – assignments, assertions, print statements, send or receive statements, PROMELA’s expression statements. * PROMELA Semantics Hong, Shin @ PSWLAB 7 / 25

Operational Model 1/5 • Semantics engine - determines how a given PROMELA model defines system executions. - operates on abstract objects that correspond to processes, variables, and message channels. • Def. Variable (name, scope, domain, inival, curval) scope: global or local to a specific process. domain: a finite set of integers. * PROMELA Semantics Hong, Shin @ PSWLAB 8 / 25

Operational Model 2/5 • Def. Message A message is an ordered set of variables. • Def. Message Channel (ch_id, nslots, contents) nslots: maximum number of messages. contents: an ordered set of messages. * PROMELA Semantics Hong, Shin @ PSWLAB 9 / 25

Operational Model 3/5 • Def. Process (pid, lvars, lstates, initial, curstate, trans) lvars: a finite set of local variables lstates: a finite set of integer initial: an element of lstates trans: a finite set of transitions on lstates. * PROMELA Semantics Hong, Shin @ PSWLAB 10 / 25

Operational Model 4/5 • Def. Transition A transition in process P is defined by a tuple (tr_id, source, target, cond, effect, prty, rv) source, target 2 P. lstates cond: a boolean condition on global system state effect: a function that modifies the global system state prty, rv are integers. * PROMELA Semantics Hong, Shin @ PSWLAB 11 / 25

Operational Model 5/5 • Def. System State (gvars, procs, chans, exclusive, handshake, timeout, else, stutter) gvars: a finite set of variables with global scope procs: a finite set of processes chans: a finite set of message channels exclusive, handshake are integers timeout, else, stutter are booleans * PROMELA Semantics Hong, Shin @ PSWLAB 12 / 25

Semantics Engine 1/4 • The semantics engine selects one executable basic statement. • For selected statement, the effect clause from the statement is applied. And the control state of the process that executes the statement is updated. • The semantics engine continues executing statements until no executable statements remain. * PROMELA Semantics Hong, Shin @ PSWLAB 13 / 25

Semantics Engine 2/4 • PROMELA Semantics Engine executable(s) returns a set while ( (E = executable(s)) != {} ) { for some (p, t) from E { of pairs of executable s’ = apply(t. effect, s) transitions in system state s. if (handshake == 0) { apply() applies the effect of s = s’ the transition to the system p. curstate = t. target handshake is not 0, state. if rendezvous offer was made } else { with the message channel E’ = executable(s’) whose ch_id is the value of for some (p’, t’) from E’ { handshake s = apply(t’. effect, s’) ; p. curstate = t. target p’. curstate = t’. target } stutter extension handshake = 0 ; stutter is used to determine if the } } } stuttering rule is in effect while(stutter) {s = s} * PROMELA Semantics Hong, Shin @ PSWLAB 14 / 25

Semantics Engine 3/4 Set executable(State s) Any transition that is part of an atomic { new Set E = {} ; sequence sets exclusive to the value of new Set e ; p. pid. timeout = false ; checks priority level. Priorities are All. Procs: for each active process p { defined in PROMELA with the unless construct. if (exclusive == 0 or exclusive == p. pid) { for u from high to low { check whether executability e = {} ; else = false ; condition for the transition is One. Proc: satisfied. for each t in p. trans { if (t. source == p. curstate and t. prty == u and (handshake==0 or handshake==t. rv) and eval(t. cond) == true) { add (p, t) to set e ; } } * PROMELA Semantics Hong, Shin @ PSWLAB 15 / 25

Semantics Engine 4/4 if (e != {}) { add all elements of e to E ; break ; } else if (else == false){ Select the transition else = true ; goto One. Proc ; whose cond is else. } } if (E == {} exclusive } if (E == {} timeout = } return E ; and exclusive != 0) { If atomic sequence itself blocks, = 0 ; goto All. Procs ; select another process’s transtion and timeout == false) { Execute timeout sequence true ; goto All. Procs ; if no transition is selected. } * PROMELA Semantics Hong, Shin @ PSWLAB 16 / 25

Interpreting PROMELA models 1/5 • Basic objects of a PROMELA model correspond to the basic objects that are manipulated by the semantics engine. • The control-flow constructs provide convenient high-level means for defining transition relations on processes. • PROMELA basic statements (e. g. assignments, message passing operations, etc) directly correspond to the transitions of the semantic model. • All details are in MANUAL PAGES of PROMELA. – EXECUTABILITY, EFFECT * PROMELA Semantics Hong, Shin @ PSWLAB 17 / 25

Interpreting PROMELA models chan x chan y active = [0] of proctype cond: first message in x matches 0 effect: none priority : low * { bit A() { B() { } ; x? 0 unless y!0 } y? 0 unless x!0 } cond: true effect: y!0 priority : high PROMELA Semantics 2/5 cond: first message in y matches 0 effect: none priority : low cond: true effect: x!0 priority : high Hong, Shin @ PSWLAB 18 / 25

Interpreting PROMELA models cond: first message in x matches 0 effect: x? 0 priority : low cond: true effect: y!0 priority : high x!0 x? 0 * PROMELA Semantics cond: first message in y matches 0 effect: none priority : low 3/5 cond: true effect: x!0 priority : high y!0 y? 0 Hong, Shin @ PSWLAB 19 / 25

Interpreting PROMELA models chan x chan y active = [0] of proctype cond: true effect: x!0 priority : low { bit A() { B() { cond: true effect: y!0 priority : high } ; x!0 unless y!0 } y? 0 unless x? 0 } cond: first message in y is 0 effect: none priority : low y!0 * 4/5 PROMELA Semantics cond: first message in x is 0 effect: none priority : high y? 0 Hong, Shin @ PSWLAB 20 / 25

Interpreting PROMELA models chan x chan y active = [0] of proctype cond: true effect: x!0 priority : low { bit A() { B() { x? 0 * } ; x!0 unless y? 0 } y!0 unless x? 0 } cond: first message in y is 0 cond: true effect: none effect: y!0 priority : high priority : low x!0 PROMELA Semantics 5/5 cond: first message in x is 0 effect: none priority : high y!0 y? 0 Hong, Shin @ PSWLAB 21 / 25

Verification 1/2 • The semantics engine does not include any special mention or interpretation of valid end state, accepting state, assertion, etc. • Operational semantics define only behavior of a model. It does not define what kind of behavior is good or bad. • Assertion statements, never claims, trace assertion, etc are used for making meta statements about the semantics of a model. • Verification engine defines this meta-semantics for verification. * PROMELA Semantics Hong, Shin @ PSWLAB 22 / 25

Verification 2/2 • System variable stutter set to be false when an assertion statement can fail or in the presence of executions that violate the requirements for proper termination • Never claim – the purpose of the claim is to suppress the inspection of executions that could not possibly lead to a counterexample. while( (E = executable(s) != {} ) { if (check_fails()) Stop ; : } while (stutter) { s = s ; if (check_fails()) Stop ; } * PROMELA Semantics Hong, Shin @ PSWLAB 23 / 25

Further study • Search Algorithms (Ch. 8) - Checking Safety properties - Checking Liveness properties • Search Optimization (Ch. 9) * PROMELA Semantics Hong, Shin @ PSWLAB 24 / 25

Reference Gerard J. Holzmann, “THE SPIN MODEL CHECKER-PRIMER AND REFERENCE MANUAL” * PROMELA Semantics Hong, Shin @ PSWLAB 25 / 25