1 / 55

Model Checking I I

Model Checking I I. How CTL model checking works. CTL. A E X F G U Model checking problem Determine M, s0 f Or find all s s.t. M, s f. Need only E X F G U define others

calista-riley
Download Presentation

Model Checking I I

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Model Checking II How CTL model checking works

  2. CTL A E X F G U Model checking problem Determine M, s0 f Or find alls s.t. M, s f

  3. Need only E X F G U define others e.g. AG p   EF p AF p   EG p

  4. Explicit state model checking Option 1 CES (original paper) Represent state transition graph explicitly Walk around marking states Graph algorithms involving strongly connected components etc. Not covered in this course (cf. SPIN) Used particularly in software model checking

  5. Symbolic MC Option 2 McMillan et al because of STATE EXPLOSION problem State graph exponential in program/circuit size Graph algorithms linear in state graph size INSTEAD Use symbolic representation of both sets of states and of state transtion graph

  6. Symbolic MC Sets of states formulas relations between states (BDDs) Fixed point characerisations of CTL ops NO explicit state graph

  7. A state Vector of boolean variables (v1,v2,v3, …., vn)  {0,1}n

  8. Boolean formulas (x  y)  z ( is exclusive or) (1  0)  0 = 1 assignment [x=1,y=0,z=0] gives answer 1 is a model or satisfying assignment Write as 101 Exercise: Find another model

  9. Boolean formulas (x  y)  z ( is exclusive or) (1  1)  0 = 0 assignment [x=1,y=1,z=0] is not a model

  10. Formula is a tautology if ALL assignments are models and is contradictory if NONE is.

  11. Boolean formulas For us, interesting formulas are somewhere in between: some assignments are models, some not IDEA: A formula can represent a set of states (its models)

  12. {} false {111} x  y  z {101} x  y  z {111,101} x  z . . {000,001, … , 111} true

  13. Example (x  y)  z represents {100,010,110,111} (x  y)  z is in form ({100,010,110,111},xyz) Exercise: Find formulas (with var. names x,y,z) for the sets {} {100} {110,100,010,000}

  14. Exercise Find an element of form({001,010,100},abc) Will slarva and write form(P,vs) to stand for a formula representing P and using variables vs

  15. What is needed now? A good data structure for boolean formulas Binary Decision Diagrams (BDDs) Akers (IEEE Trans. Comp 78) Bryant (IEEE Trans. Comp. 86, most cited CS paper!) see also Bryant’s document about a Hitachi patent from 93 McMillan saw application to symbolic MC

  16. Binary Decision Diagrams Canonical form (constant time comparison) Polynomial algorithms for ’and’, ’or’, ’not’ etc. Exponential but practically efficient algorithm for boolean quantification (Presentation based on lecture notes by Ken McMillan)

  17. Ordered Decision Tree ab + cd (ab)  (cd) a 0 1 b b 0 1 0 1 c c c c 0 1 0 1 0 1 0 1 d d d d d d d d 0 0 0 1 0 0 0 1 0 0 0 1 1 1 1 1

  18. To get OBDD Combine isomorphic subtrees Eliminate redundant nodes (those with identical children) Tree becomes a graph

  19. (O)BDD ab + cd (ab)  (cd) a 1 0 b 0 c 1 d 0 0 1 0 1

  20. Make BDD for (x  y)  z

  21. Combining BDDs apply algorithm (for building and of two BDDs, or of two BDDs etc.) v is top variable in either f or g Solve recursively for v=0 and v=1 to get 0 and 1 branches of result node Do not create new result node if both brances equal (return that result) or if equivalent node already exists in reduce table. (The apply function is also memoized.) Terminates when both f and g constants (1 or 0)

  22. Quantification b. f isf | b=0  f | b=1 get by replacing each b node by its 0 branch also have efficient algorithm for quantifying over a set of variables

  23. BDDs + Many formulas (and circuits) have small representations -Some do not! Multipliers - BDD representation of a function can vary exponentially in size depending on variable ordering; users may need to play with variable orderings (less automatic) + Good algorithms and packages (e.g. CUDD) + EXTREMELY useful in practice - Size limitations a big problem

  24. Exercise revisited Find a BDD for your form({001,010,100},abc)

  25. Lattice {000,001, …. , 110, 111} . . {000,001} {000,010} {110,111} {000} {001} {010} . . . . {110} {111} {}

  26. form({},v) false form(PQ,v) form(P,v)  form(Q,v) form(PQ,v) form(P,v)  form(Q,v)

  27. R set of pairs of states R R R R p Image(P,R) {t  s s  P  s R t}

  28. Forward image R R R R Image(P,R) {t  s s  P  s R t} p form(Image(P,R),v’) = v form(P,v)  form(R,(v,v’)) 

  29. Backward image R R R R Q {s  t t  Q  s R t} form(Image-1(Q,R),v) = v form(Q,v’)  form(R,(v,v’)) 

  30. Symbolic MC of CTL Compute set of states satisfying a formula recursively (and use BDDs as rep.) consider E cases define others e.g. AX p   EX p A (p U q)  ?

  31. CTL formula f H(f) set of states satisfying f a (atomic) L(a) (cf. Lars) p S – H(p) p  qH(p)  H(q) P  q ? EX p familiar ?

  32. CTL formula f H(f) set of states satisfying f P  q H(p) H(q) EX p Image-1(H(p),R)

  33. Remaining operators Fixed point characterisation EF p p  EX (EF p) least fixed point

  34. Fixed points f : set of S -> set of S Monotonic x  y => f(x)  f(y) Fixed point y s.t. f(y) = y

  35. Fixed points monotonic f has Least fixed point y. f(y) [lfp y. f(y)] Greatest fixed point y. F(y) [gfp y. F(y)]

  36. Lattice again {000,001, …. , 110, 111} . . {000,001} {000,010} {110,111} {000} {001} {010} . . . . {110} {111} {}

  37. Lattice (S finite) S . . {}

  38. Fixed points {}  f({})  f(f({}))  f(f(f({})))  …. Limit is the least fixed point y. f(y) S  f(S)  f(f(S)  f(f(f(S)))  …. Limit is greatest fixed point y. f(y)

  39. CTL EF p p  EX (EF p) H(EF p) = y. H(p)  H( EXy) = y. H(p)  Image-1(y,R)

  40. Fixed point iteration S0 = H(p) Si+1 = H(p)  Image-1(Si,R)

  41. Fixed point iteration P

  42. Fixed point iteration p  EX (p  EX p) P

  43. Fixed point iteration Evetually stops! P . . . .

  44. Concrete example 000 100 110 111 001 101 010 011

  45. Concrete example 7 4 6 0 000 100 110 111 001 101 010 011 1 5 2 3 EF p p = dreq  q0  dack

  46. dack and or q0 dreq and

  47. EG EG p p  EX (EG p) H(EG p) = y. H(p) Image-1(y,R)

  48. EG EG p  p  EX (EG p) H(EG p) = y. H(p) Image-1(y,R) NB: We can do all of these operations using BDDs to represent the sets

  49. Fixed point interationin the other direction P

  50. Fixed point interationin the other direction p EX p P

More Related