Formal verification of contracts for synchronous software components using NuSMV

Size: px

Start display at page:

Download "Formal verification of contracts for synchronous software components using NuSMV"

Derick Fleming
8 years ago
Views:

1 Formal verification of contracts for synchronous software components using NuSMV Tobias Polzer Lehrstuhl für Informatik 8 Bachelorarbeit / 19

2 Problem description and goals Problem description and goals The VerSyKo Project: Verify distributed safety-critical embedded systems Two-layered approach to verification Locally synchronous automata communicate asynchronously Improve scalability by abstraction of synchronous components 2 / 19

3 Problem description and goals SCADE VerSyKo uses SCADE for synchronous components Provides nice graphical modelling Integrated design verifier Provides native code generation Expensive Closed source 3 / 19

4 Problem description and goals My work Replace this with NuSMV: Free software Symbolic BDD based model checking Supports LTL 4 / 19

5 Overview The GALS Transformation Language Global / local verification NuSMV Integrating NuSMV with GTL Results Future (/Current) work Quantitative evaluation Code generation 5 / 19

6 The GALS Transformation Language The GALS Transformation Language GALS = globally asynchronous locally synchronous local components as finite state machines perform one step every local clock cycle components are scheduled asynchronously components communicate over unidirectional shared variables 6 / 19

7 The GALS Transformation Language The GALS Transformation Language Global state space scales exponentially with component size keep it small by verifying against contracts Contracts are nondeterministic The traces of a valid contract are a superset of implementation traces (overapproximation). 7 / 19

8 The GALS Transformation Language Mutex Example Contract for a mutex client:!proceed proceed nc acq cs rel 8 / 19

9 The GALS Transformation Language Mutex Example in GTL model [ none ] c l i e n t ( ) { i n p u t bool proceed ; output enum { nc, acq, cs, r e l } s t ; automaton { i n i t f i n a l state nc { s t = nc ; t r a n s i t i o n acq ; t r a n s i t i o n nc ; } f i n a l state acq { s t = acq ; t r a n s i t i o n [ proceed ] cs ; t r a n s i t i o n [! proceed ] acq ; } } f i n a l state cs { s t = cs ; t r a n s i t i o n r e l ; t r a n s i t i o n cs ; } f i n a l state r e l { s t = r e l ; t r a n s i t i o n nc ; } } ; 9 / 19

10 The GALS Transformation Language Mutex Example The resulting contract has only 2 (3 with input) bits of state. Abstracts away: Actual computation done Time in (non-)critical section 10 / 19

11 The GALS Transformation Language Global / local verification Global / local verification For global verification the contract network can be translated to UPAAL timed automata SPIN reactive processes Translation to SMT for fast counter-examples SCADE for implementing, verifying local components 11 / 19

12 NuSMV NuSMV Symbolic BDD based model checking of finite state systems Can also do SAT based bounded model checking LGPL license Can prove absence of deadlocks Can model check LTL (amongst other temporal logics) 12 / 19

13 NuSMV NuSMV example MODULE counter ( out, r e s e t ) ASSIGN i n i t ( out ) := 0; next ( out ) := r e s e t? 2 : out = 0? 0 : out 1; MODULE c l i e n t ( proceed ) VAR counter : counter ( time, r e s e t ) ; r e s e t : boolean ; time : 0.. 2; s t : { nc, acq, cs, r e l } ; 13 / 19

14 Integrating NuSMV with GTL Integrating NuSMV with GTL Translating LTL contracts is mostly straigthforward Unfold timed expressions next[2cy] φ φ & Xφ finally[2cy] φ φ Xφ φ until[2cy] ψ ψ (φ & Xψ) Deconstruct arrays a = [1, 2] a[0] = 1 & a[1] = 2 14 / 19

15 Integrating NuSMV with GTL Integrating NuSMV with GTL Use nondeterministic inputs Automata contracts Have to be determinized using powerset construction (exponential blowup!) Determinized automata are composed with implementation LTLSPEC G state!= {} 15 / 19

16 Results Results Automata determinization in GTL was already implemented and produced small automata unfortunately it was also broken... Full machine integers are somewhat slow in NuSMV, range types do not exist in GTL Natively supported LTL allows for more expressiveness, better performance Implementation could still use some polishing Current state can be seen at 16 / 19

17 Future (/Current) work Quantitative evaluation Quantitative evaluation Current work Implement (a) component(s) with nontrivial differences between contract and implementation and / or large size in both SCADE and NuSMV Compare performance Reuse the level-crossing case study that was done with SCADE in VerSyKo. 17 / 19

18 Future (/Current) work Code generation Code generation At the moment necessary to check against false negatives Necessary for real projects 18 / 19

19 Future (/Current) work Future work Correctness proof of the gtl NuSMV transformation Apply in real project? 19 / 19

Fundamentals of Software Engineering

Fundamentals of Software Engineering Model Checking with Temporal Logic Ina Schaefer Institute for Software Systems Engineering TU Braunschweig, Germany Slides by Wolfgang Ahrendt, Richard Bubel, Reiner