Computational Modeling and Analysis for Complex Systems Edmund M. - PowerPoint PPT Presentation

Computational Modeling and Analysis for Complex Systems Edmund M. Clarke, Paolo Zuliani School of Computer Science Carnegie Mellon University http://cmacs.cs.cmu.edu

Apologies

Lecture Structure I. Introduction to Model Checking II. Theory: Statistical Model Checking III. Applications: • Hybrid systems - Verification of Stateflow/Simulink models • Biological systems - Signaling pathways

Intel Pentium FDIV Bug  Try 4195835 – 4195835 / 3145727 * 3145727. In 94’ Pentium, it doesn’t return 0, but 256.  Intel uses the SRT algorithm for floating point division. Five entries in the lookup table are missing.  Cost: $400 - $500 million  Xudong Zhao’s Thesis on Word Level Model Checking

Temporal Logic Model Checking  Model checking is an automatic verification technique for finite state concurrent systems.  Developed independently by Clarke and Emerson and by Queille and Sifakis in early 1980’s.  Specifications are written in propositional temporal logic. (Pnueli 77)  Verification procedure is an intelligent exhaustive search of the state space of the design.

Advantages of Model Checking  No proofs!!! (Algorithmic rather than Deductive)  Fast (compared to other rigorous methods such as theorem proving)  Diagnostic counterexamples  No problem with partial specifications  Logics can easily express many concurrency properties

Main Disadvantage State Explosion Problem: 1,0 0,0 1,1 0,1 2-bit counter n-bit counter has 2 n states

Main Disadvantage (Cont.) a 1 n states, || b 2 m processes c 3 1,a n m states 2,a 1,b 2,b 3,a 1,c 3,b 2,c 3,c

Main Disadvantage (Cont.) State Explosion Problem: Unavoidable in worst case, but steady progress over the past 28 years using clever algorithms, data structures, and engineering

LTL - Linear Time Logic (Pn 77) Determines Patterns on Infinite Traces a Atomic Propositions Boolean Operations Temporal operators “a is true now” a “a is true in the neXt state” X a “a will be true in the F uture” F a “a will be G lobally true in the future” G a “a will hold true U ntil b becomes true” a U b

LTL - Linear Time Logic (Pn 77) Determines Patterns on Infinite Traces a Atomic Propositions Boolean Operations Temporal operators “a is true now” a “a is true in the neXt state” X a “a will be true in the F uture” F a “a will be G lobally true in the future” G a “a will hold true U ntil b becomes true” a U b

LTL - Linear Time Logic (Pn 77) Determines Patterns on Infinite Traces a Atomic Propositions Boolean Operations Temporal operators “a is true now” a “a is true in the neXt state” X a “a will be true in the Future” F a “a will be G lobally true in the future” G a “a will hold true U ntil b becomes true” a U b

LTL - Linear Time Logic (Pn 77) Determines Patterns on Infinite Traces a a a a a Atomic Propositions Boolean Operations Temporal operators “a is true now” a “a is true in the neXt state” X a “a will be true in the F uture” F a “a will be Globally true in the future” G a “a will hold true U ntil b becomes true” a U b

LTL - Linear Time Logic (Pn 77) Determines Patterns on Infinite Traces a a a a b Atomic Propositions Boolean Operations Temporal operators “a is true now” a “a is true in the neXt state” X a “a will be true in the F uture” F a “a will be G lobally true in the future” G a a U b “a will hold true Until b becomes true”

Branching Time (EC 80, BMP 81)

CTL: Computation Tree Logic “g will possibly become true” EF g

CTL: Computation Tree Logic “g will necessarily become true” AF g

CTL: Computation Tree Logic “g is an invariant” AG g

CTL: Computation Tree Logic “g is a potential invariant” EG g

CTL: Computation Tree Logic CTL uses the temporal operators AX, AG, AF, AU EX, EG, EF, EU CTL* allows complex nestings such as AXX, AGX, EXF, ...

CTL, LTL, CTL*  A CTL formula not expressible in LTL AG (EF p) “from any state p will necessarily become true”  A LTL formula not expressible in CTL A (FG p) “p will necessarily become an invariant”  A CTL* formula not expressible in either CTL or LTL AG (EF p) v A (FG p) 07/16/09 07/16/09 07/16/09 07/16/09 07/16/09 07/16/09

Model Checking Problem  Let M be a state-transition graph.  Let ƒ be the specification in temporal logic.  Find all states s of M such that M, s |= ƒ . • CTL Model Checking: CE 81; CES 83/86; QS 81/82. • LTL Model Checking: LP 85. • Automata Theoretic LTL Model Checking: VW 86. • CTL* Model Checking: EL 85.

Trivial Example Microwave Oven State-transition graph describes system evolving ~ Start ~ Close over time. ~ Heat ~ Error ~ Start Start ~ Start Close ~ Close Close Heat ~ Heat ~ Heat ~ Error Error ~ Error Start Start Start Close Close Close ~ Heat ~ Heat Heat Error ~ Error ~ Error

Temporal Logic and Model Checking  The oven doesn’t heat up until the door is closed  Not heat_up holds until door_closed  (~ heat_up) U door_closed

Model Checking Hardware Description Informal (VERILOG, VHDL, SMV) Specification Transition System Temporal Logic Formula (Automaton, Kripke structure) (CTL, LTL, etc.)

Counterexamples Informal Program or circuit Specification Transition System Temporal Logic Formula (CTL, LTL, etc.) Safety Property: bad state unreachable: satisfied Initial State

Counterexamples Informal Specification Program or circuit Transition System Temporal Logic Formula (CTL, LTL, etc.) Safety Property: bad state unreachable Counterexample Initial State

Counterexamples Informal Specification Program or circuit Transition System Temporal Logic Formula (CTL, LTL, etc.) Safety Property: bad state unreachable Counterexample Initial State

Two Big Breakthroughs on State Space Explosion Problem  Bounded Model Checking  Biere, Cimatti, Clarke, Zhu 99  Using Fast SAT solvers  Can handle thousands of state elements Can the given property fail in k steps? I(V 0 ) Λ T(V 0 ,V 1 ) Λ … Λ T(V k-1 ,V k ) Λ ( ¬ P(V 0 ) V … V ¬ P(V k )) Property fails Initial state k-steps in some step BMC in practice: Circuit with 9510 latches, 9499 inputs BMC formula has 4 x 10 6 variables, 1.2 x 10 7 clauses Shortest bug of length 37 found in 69 seconds

Two Big Breakthroughs on State Space Explosion Problem (Cont’d)  Counterexample Guided Abstraction Refinement (CEGAR)  Clarke, Grumberg, Jha, Lu, Veith 2000  Used in most software model checkers

Existential Abstraction Given an abstraction function : S S , the concrete states are grouped and mapped into abstract states: M Preservation Theorem ? M

Preservation Theorem  Theorem (Clarke, Grumberg, Long) If property holds on abstract model, it holds on concrete model.  Technical conditions  Property is universal i.e., no existential quantifiers  Atomic formulas respect abstraction mapping  Converse implication is not true !

Spurious Behavior “red” “go” AG AF red Spurious Counterexample: “Every path necessarily leads <go><go><go><go> ... back to red.” Artifact of the abstraction !

Automatic Abstraction M Initial Abstraction Spurious Refinement Spurious counterexample Refinement Validation or Correct ! Counterexample M Original Model

CEGAR C ounter E xample- G uided A bstraction R efinement Initial Abstraction Verification No error Circuit or or bug found Abstract Model Model Program Checker Property holds Counterexample Simulation successful Abstraction refinement Refinement Simulator Bug found Spurious counterexample

End of Part I

Problem Verification of Stochastic Systems  Uncertainties in the system environment, modeling a fault, stochastic processors, biological signaling pathways ...  Modeling uncertainty with a distribution → Stochastic systems  Models:  for example, Discrete, Continuous Time Markov Chains  Property specification:  “does the system fulfill a request within 1.2 ms with probability at least .99”?  If Ф = “system fulfills request within 1.2 ms”, decide between: P ≥.99 ( Ф ) or P <.99 ( Ф )

Equivalently  A biased coin (Bernoulli random variable):  Prob (Head) = p Prob (Tail) = 1-p  p is unknown  Question: Is p ≥ θ ? (for a fixed 0< θ <1 )  A solution: flip the coin a number of times, collect the outcomes, and use:  Statistical hypothesis testing: returns yes/no  Statistical estimation : returns “ p in (a,b)” (and compare a with θ )

Towards verification Property Ф + = Biased coin! Stochastic system M Key: define a probability measure on the set of traces (simulations) of M . The set of traces satisfying Ф is measurable. 07/16/09 07/16/09 07/16/09 07/16/09 07/16/09 07/16/09