Introduction Promela and state-space generation Implementation Benchmark Conclusion A Promela front-end for Spot Guillaume Sadegh LRDE – EPITA Research and Development Laboratory July 02, 2008 Guillaume Sadegh A Promela front-end for Spot 1 / 27
Introduction Promela and state-space generation Implementation Benchmark Conclusion Spot [Duret-Lutz and Poitrenaud, 2004] Reminder. . . ◮ Model Checking library. ◮ Set of algorithms and data type to build a model checker. ◮ Relies on the automata-theoretic approach to model checking. Guillaume Sadegh A Promela front-end for Spot 2 / 27
Introduction Promela and state-space generation Implementation Benchmark Conclusion Automata-theoretic approach High-level model LTL formula M ϕ Guillaume Sadegh A Promela front-end for Spot 3 / 27 Figure: Automata-theoretic approach to model-checking.
Introduction Promela and state-space generation Implementation Benchmark Conclusion Automata-theoretic approach High-level model LTL formula M ϕ State-graph LTL-to-Büchi generation translation State-graph Negated formula automaton automaton A M A ¬ ϕ Guillaume Sadegh A Promela front-end for Spot 3 / 27 Figure: Automata-theoretic approach to model-checking.
Introduction Promela and state-space generation Implementation Benchmark Conclusion Automata-theoretic approach High-level model LTL formula M ϕ State-graph LTL-to-Büchi generation translation State-graph Negated formula automaton automaton A M Synch. product A ¬ ϕ Product automaton A M ⊗ A ¬ ϕ Guillaume Sadegh A Promela front-end for Spot 3 / 27 Figure: Automata-theoretic approach to model-checking.
Introduction Promela and state-space generation Implementation Benchmark Conclusion Automata-theoretic approach High-level model LTL formula M ϕ State-graph LTL-to-Büchi generation translation State-graph Negated formula automaton automaton A M Synch. product A ¬ ϕ Product automaton A M ⊗ A ¬ ϕ Emptiness check M | = ϕ or counter-example Guillaume Sadegh A Promela front-end for Spot 3 / 27 Figure: Automata-theoretic approach to model-checking.
Introduction Promela and state-space generation Implementation Benchmark Conclusion Automata-theoretic approach High-level model LTL formula M ϕ State-graph LTL-to-Büchi generation translation State-graph Negated formula automaton automaton A M Synch. product A ¬ ϕ Product automaton A M ⊗ A ¬ ϕ Emptiness check M | = ϕ or counter-example Provided by Spot Guillaume Sadegh A Promela front-end for Spot 3 / 27 Figure: Automata-theoretic approach to model-checking.
Introduction Promela and state-space generation Implementation Benchmark Conclusion Automata-theoretic approach Missing High-level model LTL formula M ϕ State-graph LTL-to-Büchi generation translation State-graph Negated formula automaton automaton A M Synch. product A ¬ ϕ Product automaton A M ⊗ A ¬ ϕ Emptiness check M | = ϕ or counter-example Provided by Spot Guillaume Sadegh A Promela front-end for Spot 3 / 27 Figure: Automata-theoretic approach to model-checking.
Introduction Promela and state-space generation Implementation Benchmark Conclusion Adding a Promela front-end Why 1. To work on more abstract models. 2. To take advantage of a large set of models. 3. To compare Spot and another model checker (S PIN ). Guillaume Sadegh A Promela front-end for Spot 4 / 27
Introduction Promela and state-space generation Implementation Benchmark Conclusion Outline 1 Promela and state-space generation Implementation 2 Existing hack N IPS Virtual Machine Benchmark 3 Conclusion 4 Guillaume Sadegh A Promela front-end for Spot 5 / 27
Introduction Promela and state-space generation Implementation Benchmark Conclusion Outline 1 Promela and state-space generation Implementation 2 Existing hack N IPS Virtual Machine Benchmark 3 Conclusion 4 Guillaume Sadegh A Promela front-end for Spot 6 / 27
Introduction Promela and state-space generation Implementation Benchmark Conclusion Promela High-level modeling language Overview ◮ The modeling language of the S PIN model checker [Holzmann, 1990]. ◮ To represent concurrent systems with abstraction. Why Promela ? 1. S PIN is the most used model-checker worldwide. 2. There is a large collection of Promela models to test or use with our algorithms. Guillaume Sadegh A Promela front-end for Spot 7 / 27
Introduction Promela and state-space generation Implementation Benchmark Conclusion Promela High-level modeling language Overview ◮ The modeling language of the S PIN model checker [Holzmann, 1990]. ◮ To represent concurrent systems with abstraction. Why Promela ? 1. S PIN is the most used model-checker worldwide. 2. There is a large collection of Promela models to test or use with our algorithms. Guillaume Sadegh A Promela front-end for Spot 7 / 27
Introduction Promela and state-space generation Implementation Benchmark Conclusion Promela semantics A Promela program is a set of ◮ Processes. ◮ Message channels. ◮ Variables. Let’s see an example. Guillaume Sadegh A Promela front-end for Spot 8 / 27
Introduction Promela and state-space generation Implementation Benchmark Conclusion Promela example The dinning philosopher problem Dining philosophers problem ✞ ☎ chan stick_1 = [ 1 ] of { bool } ; chan stick_2 = [ 1 ] of { bool } ; byte p1 , p2 ; / ∗ Id of processes ∗ / proctype philo ( chan l e f t _ s t i c k , r i g h t _ s t i c k ) { do : : l e f t _ s t i c k ?_ ; / ∗ Wait f o r data from the l e f t s t i c k ∗ / take_r : r i g h t _ s t i c k ?_ ; / ∗ Wait f o r data from the r i g h t s t i c k ∗ / release_l : l e f t _ s t i c k ! 1 ; / ∗ F i l l the l e f t s t i c k ∗ / release_r : r i g h t _ s t i c k ! 1 ; / ∗ F i l l the r i g h t s t i c k ∗ / od } i n i t { atomic { stick_1 ! 1 ; stick_2 ! 1 ; p1 = run philo ( stick_1 , stick_2 ) ; / ∗ Philosopher 1 ∗ / p2 = run philo ( stick_2 , stick_1 ) ; / ∗ Philosopher 2 ∗ / } } ✝ ✆ Guillaume Sadegh A Promela front-end for Spot 9 / 27
Introduction Promela and state-space generation Implementation Benchmark Conclusion State-space generation with the philosophers p[p1]@take_r p[p1]@release_l p[p1]@release_r stick_1: f stick_2: f p[p2]@ proctype philo( chan left_s, right_s) take_r { do :: left_s?_; /* Wait */ p[p2]@ take_r: right_s?_; /* Wait */ release_l release_l: left_s!1; /* Send */ release_r: right_s!1; /* Send */ od p[p2]@ } release_r Guillaume Sadegh A Promela front-end for Spot 10 / 27
Introduction Promela and state-space generation Implementation Benchmark Conclusion State-space generation with the philosophers p[p1]@take_r p[p1]@release_l p[p1]@release_r stick_1: f stick_1: e stick_2: f stick_2: f p[p2]@ stick_1: f proctype philo( chan left_s, right_s) take_r stick_2: e { do :: left_s?_; /* Wait */ p[p2]@ take_r: right_s?_; /* Wait */ release_l release_l: left_s!1; /* Send */ release_r: right_s!1; /* Send */ od p[p2]@ } release_r Guillaume Sadegh A Promela front-end for Spot 10 / 27
Introduction Promela and state-space generation Implementation Benchmark Conclusion State-space generation with the philosophers p[p1]@take_r p[p1]@release_l p[p1]@release_r stick_1: f stick_1: e stick_1: e stick_2: f stick_2: f stick_2: e p[p2]@ stick_1: f stick_1: e proctype philo( chan left_s, right_s) take_r stick_2: e stick_2: e { do :: left_s?_; /* Wait */ p[p2]@ stick_1: e take_r: right_s?_; /* Wait */ release_l stick_2: e release_l: left_s!1; /* Send */ release_r: right_s!1; /* Send */ od p[p2]@ } release_r Guillaume Sadegh A Promela front-end for Spot 10 / 27
Introduction Promela and state-space generation Implementation Benchmark Conclusion State-space generation with the philosophers p[p1]@take_r p[p1]@release_l p[p1]@release_r stick_1: f stick_1: e stick_1: e stick_1: f stick_2: f stick_2: f stick_2: e stick_2: e p[p2]@ stick_1: f stick_1: e proctype philo( chan left_s, right_s) take_r stick_2: e stick_2: e { do :: left_s?_; /* Wait */ p[p2]@ stick_1: e take_r: right_s?_; /* Wait */ release_l stick_2: e release_l: left_s!1; /* Send */ release_r: right_s!1; /* Send */ od p[p2]@ stick_1: e } release_r stick_2: f Guillaume Sadegh A Promela front-end for Spot 10 / 27
Introduction Promela and state-space generation Implementation Benchmark Conclusion State-space generation with the philosophers p[p1]@take_r p[p1]@release_l p[p1]@release_r stick_1: f stick_1: e stick_1: e stick_1: f stick_2: f stick_2: f stick_2: e stick_2: e p[p2]@ stick_1: f stick_1: e proctype philo( chan left_s, right_s) take_r stick_2: e stick_2: e { do :: left_s?_; /* Wait */ p[p2]@ stick_1: e take_r: right_s?_; /* Wait */ release_l stick_2: e release_l: left_s!1; /* Send */ release_r: right_s!1; /* Send */ od p[p2]@ stick_1: e } release_r stick_2: f Guillaume Sadegh A Promela front-end for Spot 10 / 27
Recommend
More recommend
