Symbolic CTL Model Checking

Transcription

1 Symbolic CTL Model Checking Crystal Chang Din Precise Modeling and Analysis group (PMA), University of Oslo INF Specification and Verification of Parallel Systems Crystal Chang UiO Symbolic CTL Model Checking / 27

2 Outline 1 Computation Tree Logic (CTL) 2 CTL Model Checking Algorithm 3 Symbolic CTL Model Checking Crystal Chang UiO Symbolic CTL Model Checking / 27

3 Recall of LTL A linear logic over an infinite sequence of states. Crystal Chang UiO Symbolic CTL Model Checking / 27

4 Transition System and Computation Tree Assume TS is finite, and has no terminal states, we can unfold it at a chosen state into an infinite computation tree. CTL introduces two path quantifiers: : all computations that start in a state (implicitly expressed in LTL) : some computations that start in a state (cannot be expressed in LTL) Crystal Chang UiO Symbolic CTL Model Checking / 27

5 Some Basic CTL Formulae Crystal Chang UiO Symbolic CTL Model Checking / 27

6 Syntax of CTL State formulae: Φ ::= true α Φ Φ 1 Φ 2 ϕ ϕ where α AP (atomic proposition) Path formulae: ϕ ::= Φ Φ 1 U Φ 2 Four possible ways to turn path formulae into state formulae: U U Crystal Chang UiO Symbolic CTL Model Checking / 27

7 Examples of CTL formulae Illegal CTL formulae (x = 1 y > 4) (true U (x = 1)) Legal CTL formulae (x = 1 y > 4) (true U (x = 1)) Crystal Chang UiO Symbolic CTL Model Checking / 27

8 Derived Temporal Modalities eventually Φ (true U Φ) Φ holds potentially Φ (true U Φ) Φ is inevitable always Φ Φ ( Φ) potentially always Φ Φ Φ ( Φ) invariantly Φ Crystal Chang UiO Symbolic CTL Model Checking / 27

9 Satisfaction Relation for CTL Let transition system TS = (S,Act,,I,AP,L), state s S, α be an atomic proposition, Φ 1, Φ 2 be CTL state formulae, and ϕ be a CTL path formulae. The satisfaction relation is defined for state formulae by s α iff α L(s) s Φ iff not s Φ s Φ 1 Φ 2 iff (s Φ 1 ) and (s Φ 2 ) s ϕ iff π ϕ for some π Path(s) s ϕ iff π ϕ for all π Path(s) For path π, the satisfaction relation for path formulae is defined by π Φ iff π[1] Φ π Φ 1 U Φ 2 iff j 0. (π[j] Φ 2 ( 0 k < j.π[k] Φ 1 )) Crystal Chang UiO Symbolic CTL Model Checking / 27

10 Expressiveness of CTL vs. LTL Intuitively, the LTL formula α is equivalent to the CTL formula α. However, s 0 α and s 0 α are shown in the following case. 1 α: α will eventually forever hold from some state 2 α: On any computation, eventually some state, s say, is reached such that s α Crystal Chang UiO Symbolic CTL Model Checking / 27

11 Satisfaction Set Given a transition system TS, the satisfaction set Sat(Φ) for CTL-state formula Φ is defined by: For example: Sat(Φ) = { s S s Φ} Sat( a) = {s 3 } Crystal Chang UiO Symbolic CTL Model Checking / 27

12 CTL Semantics for Transition System TS Φ iff s 0 I. s 0 Φ in other words, TS Φ iff I Sat(Φ) Crystal Chang UiO Symbolic CTL Model Checking / 27

13 Outline 1 Computation Tree Logic (CTL) 2 CTL Model Checking Algorithm 3 Symbolic CTL Model Checking Crystal Chang UiO Symbolic CTL Model Checking / 27

14 CTL in Existential Normal Form (ENF) Φ ::= true α Φ Φ 1 Φ 2 Φ ( Φ 1 U Φ 2 ) Φ Other CTL formulae can be translated into equivalent ENF formulae: Φ (true U Φ) Φ Φ (Φ 1 U Φ 2 ) ( Φ 2 U ( Φ 1 Φ 2 )) Φ 2 Φ Φ Φ Φ = (true U Φ) CTL in ENF has the same expressiveness as CTL We will use ENF of CTL in the model checking algorithm Crystal Chang UiO Symbolic CTL Model Checking / 27

15 Overview of the Algorithm To verify for a given transition system TS and CTL formula Φ whether TS Φ, the procedure is: 1 recursive computation of the sets Sat(Ψ) for all subformulae Ψ of Φ 2 checking whether I Sat(Φ) Crystal Chang UiO Symbolic CTL Model Checking / 27

16 Computation of the Satisfaction Sets Crystal Chang UiO Symbolic CTL Model Checking / 27

17 Sat( Φ) T 0 = Sat(Φ) and T i+1 = T i {s Sat(Φ) Post(s) T i } until T i+1 = T i (reach the greatest fix point) i.e. Sat( b) = {s 0, s 2, s 4 } Crystal Chang UiO Symbolic CTL Model Checking / 27

18 Sat( (Φ 1 U Φ 2 )) T 0 = Sat(Φ 2 ) and T i+1 = T i {s Sat(Φ 1 ) Post(s) T i } until T i+1 = T i (reach the smallest fix point) i.e. Sat( (true U (a = c) (a b))) = {s 4, s 5, s 6, s 7 } Crystal Chang UiO Symbolic CTL Model Checking / 27

19 Time Complexity Let TS be a finite transition system with N states and K transitions. Ψ a subformula of Φ. The time complexity of calculating Sat(Ψ) is O(N+K) Also, there are Φ subformulae of Φ. The total time complexity of calculating Sat(Φ) is therefore O((N+K) Φ ) Crystal Chang UiO Symbolic CTL Model Checking / 27

20 Outline 1 Computation Tree Logic (CTL) 2 CTL Model Checking Algorithm 3 Symbolic CTL Model Checking Crystal Chang UiO Symbolic CTL Model Checking / 27

21 Why Symbolic? Original version of CTL model checking single state and single transition at a time record all the predecessors and successors in each state iterative computation: union and intersection of sets state explosion problem in large transition systems Symbolic version sets of states and sets of transitions at a time binary encoding of states one boolean function for each satisfaction set one boolean function for all the transitions iterative computation:conjunction and disjunction of a sequence of bits very efficient Crystal Chang UiO Symbolic CTL Model Checking / 27

22 Encoding States Binary encoding (enc) of states, as vectors of n bits: enc : S {0, 1} n For example: 8 states (s 0, s 1,..., s 7 ) can be encoded with 3 bits s 0 : 000 s 1 : s 7 : 111 Crystal Chang UiO Symbolic CTL Model Checking / 27

23 Two Boolean Functions (X T and ) X T : to encode set of states T S (i.e. T=Sat(α)): X T : {0, 1} n {0,1} s.t. X T (s)=1 iff s T : to encode set of transitions S x S: : {0, 1} 2n {0,1} s.t. (s,s )=1 iff s s Crystal Chang UiO Symbolic CTL Model Checking / 27

24 Sat( b) in Symbolic Version binary decision tree (BDT) 8 states (s 0, s 1,..., s 7 ) can be encoded with 3 bits (z 1 z 2 z 3 ) X T (z 1, z 2, z 3 ) {0,1},T=Sat(b) i.e. X T (s 2 ) = X T (0,1,0) = 1 (z 1, z 2, z 3, z 1, z 2, z 3 ) {0,1} i.e. (s 1, s 2 ) = (0,0,1,0,1,0) = 0 Crystal Chang UiO Symbolic CTL Model Checking / 27

25 Symbolic Computation T 0 = Sat(Φ 2 ) and T i+1 = T i {s Sat(Φ 1 ) Post(s) T i } T 0 = Sat(Φ) and T i+1 = T i {s Sat(Φ) Post(s) T i } continue the example from last slide: f 0 : f 1 : f 2 : Crystal Chang UiO Symbolic CTL Model Checking / 27

26 From BDT to BDD binary decision diagram (BDD): a reduced version of BDT Crystal Chang UiO Symbolic CTL Model Checking / 27

27 Reference C. Baier and J.-P. Katoen, Principles of Model Checking (The MIT Press, 2008). Figures, algorithms and samples taken from Chapter 6 of the book above. Crystal Chang UiO Symbolic CTL Model Checking / 27