VERDS Wenhui Zhang 31 MAY 2011 System level

模型验证器VERDS Wenhui Zhang 31 MAY 2011

模型 • System level specification – – – name of the system model (optional), global variables, Initial values of the global variables, processes , fairness constraints (optional), and properties (optional). VVM VAR INIT PROC FAIRNESS SPEC name and the parameters of the module, local variables, initial values of the local variables, transition rules, Fairness constraints (optional), and properties (optional). MODULE VAR INIT TRANS FAIRNESS SPEC • Module specification – – – Keywords:

例子：互斥协议 迁移系统 VVM VAR INIT PROC me 005 x[0. . 1]: 0. . 1; t: 0. . 1; x[0]=0; x[1]=0; t=0; p 0: p 0 m(x[], t, 0); p 1: p 0 m(x[], t, 1); SPEC AG(!(p 0. a=s 2&p 1. a=s 2)); AG((!p 0. a=s 1|AF(p 0. a=s 2|p 1. a=s 2))& (!p 1. a=s 1|AF(p 0. a=s 2|p 1. a=s 2))); AG((!p 0. a=s 1|AF(p 0. a=s 2))&(!p 1. a=s 1|AF(p 1. a=s 2))); AG((!p 0. a=s 1|EF(p 0. a=s 2))&(!p 1. a=s 1|EF(p 1. a=s 2)));

例子：互斥协议 模块 MODULE VAR INIT TRANS a= s 0: a=s 1&(x[i]=0|t=i): a=s 1&!(x[i]=0|t=i): a=s 2: a=s 3: FAIRNESS p 0 m(x[], t, i) a: {s 0, s 1, s 2, s 3}; a=s 0; (x[1 -i], t, a): =(1, 1 -i, s 1); (a): =(s 2); (a): =(s 1); (x[1 -i], a): =(0, s 3); (a): =(s 2); (x[1 -i], t, a): =(1, 1 -i, s 1); running;

性质描述语言 Computation Tree Logic p p p q p q EX p EF p EG p E (p U q) E (p R q) q) q) AX p AF p AG p A (p U A (p R

例子：互斥协议 性质 AG(!(p 0. a=s 2&p 1. a=s 2)) AG((!p 0. a=s 1|AF(p 0. a=s 2|p 1. a=s 2))& (!p 1. a=s 1|AF(p 0. a=s 2|p 1. a=s 2))) AG((!p 0. a=s 1|AF(p 0. a=s 2))&(!p 1. a=s 1|AF(p 1. a=s 2)) ) AG((!p 0. a=s 1|EF(p 0. a=s 2))&(!p 1. a=s 1|EF(p 1. a=s 2)))

Fairness Fair Constraints f 1, …, fk f [[f]] F[[f]] f

Verification Results Property Conclusion AG(!(p 0. a=2&p 1. a=2)) true AG((!p 0. a=1|AF(p 0. a=2|p 1. a=2))&(!p 1. a=1|AF(p 0. a=2|p 1. a=2))) true AG((!p 0. a=1|AF(p 0. a=2))&(!p 1. a=1|AF(p 1. a=2))) false AG((!p 0. a=1|EF(p 0. a=2))&(!p 1. a=1|EF(p 1. a=2))) true

Verification Results Property Conclusion AG(!(p 0. a=2&p 1. a=2)) true AG((!p 0. a=1|AF(p 0. a=2|p 1. a=2))&(!p 1. a=1|AF(p 0. a=2|p 1. a=2))) true AG((!p 0. a=1|AF(p 0. a=2))&(!p 1. a=1|AF(p 1. a=2))) with the additional fairness constraint (a!=s 2) in the module p 0 m() true AG((!p 0. a=1|EF(p 0. a=2))&(!p 1. a=1|EF(p 1. a=2))) true

QBF/SAT-Solver

Verification Results Property (without Fairness) Conclusion AG(!(p 0. a=2&p 1. a=2)) true AG((!p 0. a=1|AF(p 0. a=2|p 1. a=2))&(!p 1. a=1|AF(p 0. a=2|p 1. a=2))) false AG((!p 0. a=1|AF(p 0. a=2))&(!p 1. a=1|AF(p 1. a=2))) false AG((!p 0. a=1|EF(p 0. a=2))&(!p 1. a=1|EF(p 1. a=2))) true