A Specification Language and a Verification Engine for Reliable Reactive System Development Tevfik Bultan Department of Computer Science University of California, Santa Barbara [email protected]http://www.cs.ucsb.edu/~bultan/ http://www.cs.ucsb.edu/~bultan/com posite/
93
Embed
A Specification Language and a Verification Engine for Reliable Reactive System Development
A Specification Language and a Verification Engine for Reliable Reactive System Development. Tevfik Bultan Department of Computer Science University of California, Santa Barbara [email protected] http://www.cs.ucsb.edu/~bultan/ http://www.cs.ucsb.edu/~bultan/composite/. - PowerPoint PPT Presentation
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
A Specification Language and a Verification Engine for Reliable Reactive System Development
Applications– Synthesizing verified monitor classes– Verification of parameterized cache coherence protocols– Verification of workflow specifications
Related, Current and Future Work
Model Checking View
Every reactive system – safety-critical software specification,– cache coherence protocol,– mutual exclusion algorithm, etc.
is represented as a transition system:– S : The set of states– I S : The set of initial states– R S S : The transition relation
Model Checking View
Properties of reactive systems are expressed in temporal logics
Invariant(p) : is true in a state if property p is true in every state reachable from that state– Also known as AG
Eventually(p) : is true in a state if property p is true at some state on every execution path from that state– Also known as AF
Action Language
A state based language– Actions correspond to state changes
States correspond to valuations of variables– Integer (possibly unbounded), boolean and enumerated
variables– Parameterized constants (verified for every possible value of
the constant) Transition relation is defined using actions
– Atomic actions: Predicates on current and next state variables– Action composition:
• synchronous (&) or asynchronous (|)
Modular– Modules can have submodules– Modules are defined as synchronous and asynchronous
compositions of its actions and submodules
Actions in Action Language
Atomic actions: Predicates on current and next state variables– Current state variables: reading, nr, busy– Next state variables: reading’, nr’, busy’– Logical operators: not (!) and (&&) or (||)– Equality: = (for all variable types)– Linear arithmetic: <, >, >=, <=, +, * (by a constant)
An atomic action:!reading and !busy and nr’=nr+1 and reading’
An Action Language Specificationmodule main()
integer nr;boolean busy;restrict: nr>=0;initial: nr=0 and !busy;module Reader()boolean reading;initial: !reading;rEnter: !reading and !busy and nr’=nr+1 and reading’;rExit: reading and !reading’ and nr’=nr-1;Reader: rEnter | rExit;endmodulemodule Writer()boolean writing;initial: !writing;wEnter: !writing and nr=0 and !busy and busy’ and writing’;wExit: writing and !writing’ and !busy’;Writer: wEnter | wExit;endmodulemain: Reader() | Reader() | Writer() | Writer();spec: invariant([busy => nr=0])
endmodule
A Closer Lookmodule main()
integer nr;boolean busy;restrict: nr>=0;initial: nr=0 and !busy;
module Reader()boolean reading;initial: !reading;rEnter: !reading and !busy and nr’=nr+1 and reading’;rExit: reading and !reading’ and nr’=nr-1;Reader: rEnter | rExit;
S S :: Cartesian product ofCartesian product of variable domains defines variable domains defines the set of statesthe set of states
I I : Predicates defining : Predicates defining the initial statesthe initial states
RR : Atomic actions of the : Atomic actions of the ReaderReader
RR : Transition relation of : Transition relation of Reader defined as Reader defined as asynchronous composition asynchronous composition of its atomic actionsof its atomic actions
RR : Transition relation of main defined as : Transition relation of main defined as asynchronous composition of two Reader and asynchronous composition of two Reader and two Writer processestwo Writer processes
Asynchronous Composition
Asynchronous composition is equivalent to disjunction if composed actions have the same next state variables
a1: i > 0 and i’ = i + 1;a2: i <= 0 and i’ = i – 1;a3: a1 | a2
is equivalent to
a3: (i > 0 and i’ = i + 1) or (i <= 0 and i’ = i – 1);
Asynchronous Composition
Asynchronous composition preserves values of variables which are not explicitly updated
a1 : i > j and i’ = j;a2 : i <= j and j’ = i;a3 : a1 | a2;
is equivalent to
a3 : (i > j and i’ = j) and j’ = j or (i <= j and j’ = i) and i’ = i
Synchronous Composition
Synchronous composition is equivalent to conjunction if two actions do not disable each other
a1: i’ = i + 1;a2: j’ = j + 1;a3: a1 & a2;
is equivalent to
a3: i’ = i + 1 and j’ = j + 1;
Synchronous Composition
A disabled action does not block synchronous composition
a1: i < max and i’ = i + 1;a2: j < max and j’ = j + 1;a3: a1 & a2;
is equivalent to
a3: (i < max and i’ = i + 1 or i >= max & i’ = i) and (j < max & j’ = j + 1 or j >= max & j’ = j);
Statecharts [Harel 87]
Hierarchical state machines States can be combined to form superstates OR decomposition of a superstate
– The system can be in only one of the OR states at any given time
AND decomposition of a superstate – The system has to be in both AND states at the same time
Transitions– Transitions between states
Statecharts to Action Language
Statecharts transitions (arcs) correspond to actions OR states correspond to enumerated variables and
they define the state space Transitions (actions) of OR states are combined
using asynchronous composition Transitions (actions) of AND states are combined
using synchronous composition
Statecharts to Action Languagemodule main() enumerated Alarm {Shut, Op}; enumerated Mode {On, Off}; enumerated Vol {1, 2}; initial: Alarm=Shut and
Mode=Off and Vol=1; t1: Alarm=Shut and Alarm’=Op
and Mode’=On and Vol’=1; t2: Alarm=Shut and Alarm’=Op
and Mode’=Off and Vol’=1; t3: Alarm=Op and Alarm’=Shut; t4: Alarm=Op and Mode=On and
Applications– Synthesizing verified monitor classes– Verification of parameterized cache coherence protocols– Verification of workflow specifications
Related, Current and Future Work
Model Checking
Given a program and a temporal property p:
Either show that all the initial states satisfy the temporal property p– set of initial states truth set of p
Or find an initial state which does not satisfy the property p– a state set of initial states truth set of p
Temporal Properties Fixpoints
• • •• • •
Invariant(Invariant(pp))
ppInitialInitialstatesstates
initial states that initial states that violate Invariant(violate Invariant(pp))
BackwardBackwardfixpointfixpoint
ForwardForwardfixpointfixpoint
InitialInitialstatesstates
• • •• • •
states that can reach states that can reach pp i.e., states that violate Invariant(i.e., states that violate Invariant(pp))
reachable states reachable states of the systemof the system
pp
backwardImagebackwardImage of of pp
reachable states reachable states that violate that violate ppforward imageforward image
of initial statesof initial states
Symbolic Model Checking
Represent sets of states and the transition relation as Boolean logic formulas
Forward and backward fixpoints can be computed by iteratively manipulating these formulas– Forward, backward image: Existential variable elimination– Conjunction (intersection), disjunction (union) and negation
(set difference), and equivalence check
Use an efficient data structure for manipulation of Boolean logic formulas– BDDs
BDDs
Efficient representation for boolean functions Disjunction, conjunction complexity: at most quadratic Negation complexity: constant Equivalence checking complexity: constant or linear Image computation complexity: can be exponential
Constraint-Based Verification
Can we use linear arithmetic constraints as a symbolic representation?– Required functionality
Constraint based verification can be more efficient than BDDs for integers with large domains
BDD-based verification is more robust Constraint based approach does not scale well when
there are boolean or enumerated variables in the specification
Constraint based verification can be used to automatically verify infinite state systems– cannot be done using BDDs
Price of infinity– CTL model checking becomes undecidable
Conservative Approximations
Compute a lower ( pp ) ) or an upper ( pp++ ) )
approximation to the truth set of the property ( p p )) Model checker can give three answers:
II pppp
“The property is satisfied”
II pppp
“I don’t know”
“The property is false and here is a counter-example”
II pp ppsates whichsates whichviolate the violate the propertyproperty
pp++
Computing Upper and Lower Bounds
Approximate fixpoint computations– Widening: To compute upper bound for least-fixpoints
• We use a generalization of the polyhedra widening operator by Cousot and Halbwachs
– Collapsing (dual of widening): To compute lower bound for greatest-fixpoints
– Truncated fixpoints: To compute lower bounds for least-fixpoints and upper bounds for greatest fixpoints
Loop-closures– Compute transitive closure of self-loops– Can easily handle simple loops which increment or
decrement a counter
Is There a Better Way?
Each symbolic representation has its own deficiencies
BDD’s cannot represent infinite sets Linear arithmetic constraint representations are
expensive to manipulate– Mapping boolean variables to integers does not scale– Eliminating boolean variables by partitioning the state-space
does not scale
Composite Model Checking
Each variable type is mapped to a symbolic representation type– Map boolean and enumerated types to BDD representation– Map integer type to arithmetic constraint representation
Use a disjunctive representation to combine symbolic representations
Each disjunct is a conjunction of formulas represented by different symbolic representations
Aop denotes arithmetic operators (+,-, and * with a constant)
Composite Representation
Each composite formula A is represented as
where
– n is the number of composite atoms in A– t is the number of basic symbolic representations
Sets of states and transitions are represented using this disjunctive representation
Set operations and image computations are performed on this disjunctive representation
aA ijt
j
n
i 11
Conjunctive Decomposition
Each composite atom is a conjunction Each conjunct corresponds to a different symbolic
representation– x: integer; y: boolean;– x>0 and x’=x+1 and y´y
• Conjunct x>0 and x´x+1 will be represented by arithmetic constraints
• Conjunct y´y will be represented by a BDD
– Advantage: Image computations can be distributed over the conjunction (i.e., over different symbolic representations).
Composite Symbolic Library
Our library implements this approach using an object-oriented design – A common interface is used for each symbolic
representation– Easy to extend with new symbolic representations– Enables polymorphic verification– As a BDD library we use Colorado University Decision Diagram
Package (CUDD) [Somenzi et al]
– As an integer constraint manipulator we use Omega Library [Pugh et al]
(x>0 and x´x+1 and y´=true) or (x<=0 and x´x and y´y)
: CompSym
representation : List<compAtom>
: ListNode<compAtom> : ListNode<compAtom>
next :*ListNode<compAtom> next: *ListNode<compAtom>
data : compAtom data : compAtom
01
y´=true x>0 and x´=x+1
01
y’=yx<=0 and x’=x
Satisfiability Checking
boolean isSatisfiable(CompSym A)
for each compAtom b in A do
if b is satisfiable then
return true
return false
boolean isSatisfiable(compAtom a)
for each symbolic representation t do
if at is not satisfiable then
return false
return true
is Satisfiable?
isSatisfiable? isSatisfiable?isSatisfiable?
false false true
true
is
Satisfiable?
is
is
Satisfiable?
is
Satisfiable?
and
Backward Image: Composite Representation
CompSym backwardImage(Compsym A, CompSym B) CompSym C; for each compAtom d in A do
for each compAtom e in B do insert backwardImage(d,e) into C
return C
A: B:
C:
• • •
Backward Image: Composite Atom
compAtom backwardImage(compAtom a, compAtom b)
for each symbolic representation type t do
replace at by backwardImage(at , bt )
return a
b:
a:
Heuristics for Efficient Manipulation of Composite Representation
Masking– Mask operations on integer arithmetic constraints with
operations on BDDs
Incremental subset check– Exploit the disjunctive structure by computing subset checks
incrementally
Merge image computation with the subset check in least-fixpoint computations
Simplification – Reduce the number of disjuncts in the composite
representation by iteratively merging matching disjuncts
Cache expensive operations on arithmetic constraints
Simplification Example
(y z´ = z + 1) (x z´ = z + 1) ((x y) z´ > z)
((x y) z´ > z)((y x) z´ = z + 1)
((x y) (z´ = z + 1 z´ > z))
((x y) z´ > z )
Polymorphic Verifier
Symbolic TranSys::check(Node *f) {
• • •
Symbolic s = check(f.left)case EX:
s.backwardImage(transRelation)case EF:
do snew = s sold = s snew.backwardImage(transRelation) s.union(snew)while not sold.isEqual(s) • • •
}
Action Language Verifier Action Language Verifier is polymorphicis polymorphic When there are no integerWhen there are no integervariable in the specification it variable in the specification it becomes a BDD based model becomes a BDD based model checkerchecker
Concurrent programming is difficult– Exponential increase in the number of states by the number
of concurrent components
Monitors provide scoping rules for concurrency – Variables of a monitor can only be accessed by monitor’s
procedures– No two processes can be active in a monitor at the same
time
Java made programming using monitors a common problem
Monitors
Challenges in monitor programming– Condition variables– Wait and signal operations
Even with a few condition variables coordinating wait and signal operations can be difficult– Avoid deadlock– Avoid inefficiency due to unnecessary signaling
Monitor Specifications in Action Language
Monitors with boolean, enumerated and integer variables
Condition variables are not necessary in Action Language – Semantics of Action Language ensures that an action is
executed when it is enabled
We can automatically verify Action Language specifications
We can automatically synthesize efficient monitor implementations from Action Language specifications
What About Arbitrary Number of Processes?
Use counting abstraction [Delzanno CAV’00]
– Create an integer variable for each local state of a process type
– Each variable will count the number of processes in a particular state
Local states of the process types have to be finite– Specify only the process behavior that relates to the
correctness of the monitor– Shared variables of the monitor can be unbounded
integer nr;boolean busy;restrict: nr>=0;initial: nr=0 and !busy;module Reader()boolean reading;initial: !reading;rEnter: !reading and !busy and nr’=nr+1 and reading’;rExit: reading and !reading’ and nr’=nr-1;Reader: rEnter | rExit;endmodulemodule Writer()boolean writing;initial: !writing;wEnter: !writing and nr=0 and !busy and busy’ and writing’;wExit: writing and !writing’ and !busy’;Writer: wEnter | wExit;endmodulemain: Reader() | Reader() | Writer() | Writer();spec: invariant([busy => nr=0])
endmodule
Readers-Writers Monitor Specification After Counting Abstraction
module main()integer nr;boolean busy;
parameterized integer numReader, numWriter;restrict: nr>=0 and numReader>=0 and numWriter>=0;initial: nr=0 and !busy;module Reader()
integer readingF, readingT;initial: readingF=numReader and readingT=0;rEnter: readingF>0 and !busy and nr’=nr+1 and readingF’=readingF-1 and
readingT’=readingT+1;rExit: readingT>0 and nr’=nr-1 readingT’=readingT-1
Synthesized Monitor Class: Uses Specific Notification Pattern
public class ReadersWriters{ private int nr; private boolean busy; private Object rEnterCond, wEnterCond; private synchronized boolean Guard_rEnter() { if (!busy) { nr++; return true; } else return false; } public void rEnter() { synchronized(rEnterCond) { while(!Guard_rEnter()) rEnterCond.wait(); } public void rExit() { synchronized(this) { nr--; } synchronized(wEnterCond) { wEnterCond.notify(); } } ...}
All condition variables andAll condition variables andwait and signal operations can wait and signal operations can be generated automaticallybe generated automatically
Verification of Parameterized Cache-Coherence Protocols [Delzanno, Bultan CP01]
!grantS!grantS
!inv: ex !inv: ex ex’ex’
nonex:nonex:exex?reqS?reqS
?reqE?reqE!!invS!!invS !invE:ex !invE:ex ex’ex’
nonex:nonex:exex
!grantE: ex’!grantE: ex’
IdleIdle
ServeSServeS GrantSGrantS
ServeEServeE InvEInvE GrantEGrantE
??invS??invS?grantS?grantS
!reqS!reqS
!reqE!reqE
?reqE?reqE
ExclusiveExclusive
?invE?invE
NullNull
WaitSWaitS SharedShared
WaitEWaitE ?grantE?grantE
SERVERSERVER
CLIENTCLIENT
Parameterized Protocol in Action Language
module main() boolean ex; enumerated state {Idle, ServeE, InvE, GrantE, ServeS, GrantS}; integer xNull, xWaitS, xWaitE, xShared, xExclusive; initial: state=Idle and !ex and xNull>=1 and xShared=0 and xExclusive=0 and xWaitE=0 and
xWaitS=0; restrict: xNull>=0 and xWaitS>=0 and xWaitE>=0 and xShared>=0 and xExclusive>=0 and n>=1;
Fast changing business logicRule based logic changes frequently
New rules added into system at any time
Error prone process
Automated verification?
MIHU (May I Help yoU?)
Runs behind Web Server
Decides whether to launch
the customer representative service
MIHU (May I Help yoU?)
Source Attributes: Customer ID, Shopping cart, history logs
Target Attribute: offer_AWD
Integer variables: 40
Source lines: 800
Dependency Graph of MIHU
Experiments
SMV translation required several heuristics to get it runningSMV translation required several heuristics to get it running– Disjunctive transition BDD, variable pruning, initial image projection
SMV version does not converge in 30hrs when we increase the SMV version does not converge in 30hrs when we increase the integer widths to 16 bitsinteger widths to 16 bits
There are properties for which Action Language Verifier did not There are properties for which Action Language Verifier did not converge but SMV converged for converge but SMV converged for 15 bits 15 bits
SMV gives a false negative for property P2 for 5 bitsSMV gives a false negative for property P2 for 5 bits Both SMV and Action Language Verifier found an error for Both SMV and Action Language Verifier found an error for
Property 3Property 3
SMV(5bits) SMV(10bits) SMV(15bits) Action
P1 12s 9MB 16min 67MB 2.6hrs 86MB 10min 93MB
P2 32s 12MB 15min 66MB 2.9hrs 86MB 10min 93MB
P3 19s 10MB 18min 67MB 2.3hrs 87MB 27.7hrs 1GB
SUN ULTRA 10 (768 Mbyte main memory)
Model Checking Software Specifications
[Atlee, Gannon 93] Translating SCR mode transition tables to input language of explicit state model checker EMC [Clarke, Emerson, Sistla 86]
[Chan et al. 98,00] Translating RSML specifications to input language of symbolic model checker SMV [McMillan 93]
[Bharadwaj, Heitmeyer 99] Translating SCR specifications to Promela, input language of automata-theoretic explicit state model checker SPIN [Holzmann 97]
Specification Languages for Reactive Systems
Specification languages for verification– [Milner 80] CCS– [Chandy and Misra 88] Unity– [Lamport 94] Temporal Logic of Actions (TLA)
Specification languages for model checking– [Holzmann 98] Promela– [McMillan 93] SMV– [Alur and Henzinger 96, 99] Reactive Modules
Action Language TLA Connection [Lamport TOPLAS’94]
Similarities:– Transition relation is defined using predicates on current
(unprimed) and next state (primed) variables– Each predicate is defined using
• integer arithmetic, boolean logic, etc.
Differences: In Action Language– Temporal operators are not used in defining the transition
relation • Dual language approach: temporal properties (in CTL) are
redundant, they are used to check correctness
– Synchronous and asynchronous composition operators are not equivalent to logical operators
Constraint-Based Verification:Not a New Idea
[Cooper 71] Used a decision procedure for Presburger arithmetic to verify sequential programs represented in a block form
[Cousot and Halbwachs 78] Used real arithmetic constraints to discover invariants of sequential programs
Constraint-Based Verification
[Halbwachs 93] Constraint based delay analysis in synchronous programs
[Halbwachs et al. 94] Verification of linear hybrid systems using constraint representations
[Alur et al. 96] HyTech, a model checker for hybrid systems
Constraint-Based Verification
[Boigelot and Wolper 94] Verification with periodic sets [Boigelot et al.] Meta-transitions [Delzanno and Podelski 99] Built a model checker using
constraint logic programming framework [Boudet Comon], [Wolper and Boigelot ‘00] Translating linear
arithmetic constraints to automata [Kukula et al. 98] Comparison of automata and
constraint-based verification– no clear winner
Automata-Based Representations for Arithmetic Constraints
[Klarlund et al.] MONA, an automata manipulation tool for verification
[Boudet Comon] Translating linear arithmetic constraints to automata
[Wolper and Boigelot ‘00] verification using automata as a symbolic representation
[Kukula et al. 98] application of automata based verification to hardware verification
Combining Different Symbolic Representations
[Chan et al. CAV’97] – both linear and non-linear constraints are mapped to BDDs– Only data-memoryless and data-invariant transitions are
supported [Bharadwaj and Sims TACAS’00]
– Combines automata based representations (for linear arithmetic constraints) with BDDs
– Specialized for inductive invariant checking [Bensalem et al. 00] Symbolic Analysis Laboratory
– Designed a specification language that allows integration of different verification tools
Current Work: New Symbolic Representations
Integrating shape analysis to Composite Symbolic Library – [Sagiv et al.] Shape analysis: Used for verifying linked list
implementations– Analyze monitor specifications with linked lists– Synthesizing concurrent data structures
Integrating automata-based constraint representations to Composite Symbolic Library– [Kukula et al. 98] Comparison of automata and constraint-