Formal Verification and Linear-time Model Checking

Formal Verification and Linear-time Model Checking Paul Jackson University of Edinburgh Automated Reasoning 21st and 24th October 2013

Why Automated Reasoning? Intellectually stimulating and challenging area AI Building autonomous agents that can reason and interact with each other Formal mathematics & assisting with mathematical reasoning Formal verification

Formal Verification Create a formal model of some system of interest Hardware Communication protocol Software, esp. concurrent software Describe formally a specification which we desire the model to satisfy Check the model satisfies the specification Interactive theorem proving Model checking

Formal Verification Examples Floating Point Hardware Verification FDIV bug. Cost Intel $500M. Now cost would be several $B. Concurrent Software Verification Microsoft s Static Driver Verifier

Model Checking Introduction - Models A model of some system has A set of states A subset of states consider the initial states A transition relation which, given a current state, describes which next states a system Good for Software, both sequential and concurrent Digital hardware Communication protocols Refinements handle state with continuous components and continuous rather than step-wise state evolution. Good for hybrid and control systems

Model Checking Introduction - Specifications Interested in specifying behaviours of systems over time Elementary parts of specifications refer to properties of individual states Temporal specifications then relate properties at different times At all times, the read and write signals are never simultaneously asserted If a request signal is asserted at some time, a corresponding grant signal will be asserted within 10 time units. Two common treatments of time Linear Branching Differ in how they incorporate reasoning about non-determinism

Non-determinism In general system descriptions are non-deterministic A system is non-deterministic when, from some state there are multiple alternative next states the system could transition to. Non-determinism good for Modelling alternate inputs to the system from its environment (External non-determinism) Allowing model to be under-specified, allowing it to capture many possible system implementations. (Internal non-determinism)

Linear vs. Branching Time Linear Time Considers paths (sequences of states) If system non-deterministic, many paths for each initial state Questions of form For all paths, does some path property hold? Does there exist a path such that some path property holds? Branching Time Considers tree of possible future states from each initial state If system non-deterministic at some state, tree forks Questions more complex. E.g. For all states reachable from an initial state, does there exist an onwards path to a state satisfying some property? Most-basic branching-time logic (CTL) is complementary to most-basic linear-time logic (LTL) Richer branching-time logic (CTL*) incorporates both CTL and LTL.

LTL Syntax LTL = Linear Temporal Logic Assume some set Atom of atomic propositions Syntax of LTL formulas φ: φ ::= p φ φ φ φ φ φ φ X φ F φ G φ φ U φ where p Atom Temporal operators are X NeXt G Globally F Future U Until Other common temporal operators are W (Weak until) and R (Release) Precedence high-to-low: (X, F, G, ), ( U, R ), (, ),

LTL Semantics 1: Transition Systems and Paths Definition (Transition System) A transition system M = S,, L consists of S S S L : S P(Atom) such that s. t. s t. Definition (Path) set of states transition relation labelling function A path in a model M = S,, L is an infinite sequence of states s 0, s 1,... such that i 0. s i s i+1. We write the path as s 0 s 1....

LTL Semantics 2: Satisfaction by Path Satisfaction relation π = i φ read as path π at position i satisfies LTL formula φ. π = i π = i π = i p iff p L(s i ) π = i φ iff π = i φ π = i φ 1 φ 2 iff π = i φ 1 and π = i φ 2 π = i φ 1 φ 2 iff π = i φ 1 or π = i φ 2 π = i φ 1 φ 2 iff π = i φ 1 implies π = i φ 2 π = i X φ iff π = i+1 φ π = i F φ iff j i. π = j φ π = i G φ iff j i. π = j φ π = i φ 1 U φ 2 iff j i. π = j φ 2 and k {i..j 1}. π = k φ 1 π = i φ 1 R φ 2 iff ( j i. π = j φ 2 ) or k i. π = k φ 1 and j {i..k}. π = k φ 2

LTL Semantics 3: Alternative Satisfaction by Path Alternatively, we can define π = φ using the notion of ith suffix π i = s i s i+1... of a path π = s 0 s 1.... E.g. write instead of π = G φ iff j 0. π j = φ π = i G φ iff j i. π = j φ π = i φ better for understanding and needed for past time operators. π = φ needed for semantics of CTL branching-time temporal logic.

LTL Semantics 4: Satisfaction by Model We write M, s = φ if, for every execution path π of model M starting at state s, we have π = 0 φ.

LTL Formula Examples 1. G invar 2. G (read write) 3. G (request F grant) 4. G (request (request U grant)) 5. G F enabled 6. F G stable Understand formulas by using semantics: e.g. π = 0 F G stable i 0. j i. stable L(s j )

LTL Equivalences 1 φ ψ. = M. π M. π = 0 φ π = 0 ψ Dualities in Propositional Logic (φ ψ) φ ψ (φ ψ) φ ψ Dualities in LTL X φ X φ G φ F φ F φ G φ (φ U ψ) φ R ψ (φ R ψ) φ U ψ Distributive laws G (φ ψ) G φ G ψ F (φ ψ) F φ F ψ

LTL Equivalences 2 Inter-definitions F φ G φ G φ F φ F φ U φ Idempotency F F φ F φ Weak and strong Until φ U ψ φ W ψ F ψ G φ R φ G G φ G φ φ W ψ φ U ψ G φ Some more suprising equivalences G F G φ F G φ F G F φ G F φ G (F φ F ψ) G F φ G F ψ