formal methods & tools. SpinS : Extending LTSmin with Promela - PowerPoint PPT Presentation

UNIVERSITY OF TWENTE. formal methods & tools. SpinS : Extending LTSmin with Promela through SpinJa Alfons Laarman Joint with Freark van der Berg Sept 17, 2012 Imperial College, London, UK

... ... Spin Model Checker Process Meta-Language ( Promela ) Spin’s strengths ◮ Popular tool - early adopter of latest techniques ◮ Highly optimized C code UNIVERSITY OF TWENTE. SpinS : Extending LTSmin with Promela through SpinJa Sept 17, 2012 2 / 19

... ... Spin Model Checker Process Meta-Language ( Promela ) Spin’s strengths ◮ Popular tool - early adopter of latest techniques ◮ Highly optimized C code Weakness ◮ Hard to extend UNIVERSITY OF TWENTE. SpinS : Extending LTSmin with Promela through SpinJa Sept 17, 2012 2 / 19

... ... SpinJa Model Checker A Java reimplementation of Spin by Mark de Jonge & Theo Ruys - University of Twente Strengths ◮ Layered OO Design - Easier to maintain & extend UNIVERSITY OF TWENTE. SpinS : Extending LTSmin with Promela through SpinJa Sept 17, 2012 3 / 19

... ... SpinJa Model Checker A Java reimplementation of Spin by Mark de Jonge & Theo Ruys - University of Twente Strengths ◮ Layered OO Design - Easier to maintain & extend Weaknesses ◮ No parallel algorithms, no state compression, etc ◮ At least a factor 5 slower UNIVERSITY OF TWENTE. SpinS : Extending LTSmin with Promela through SpinJa Sept 17, 2012 3 / 19

... ... Introducing the LTSmin Model Checker Initially, an LTS manipulation tool (explore, store, minimize). Developed at University of Twente Grown to a full-blown model checking tool set: Multi-core, Distributed, Symbolic, Sequential (algorithmic backends) × LTL, CTL, µ -calculus, invariants, etc (properties) × POR, state compression, saturation, chaining (optimizations) × µ CRL , mCRL2 , DVE ( DiVinE ), UPPAAL , PBES, ETF (language frontends) UNIVERSITY OF TWENTE. SpinS : Extending LTSmin with Promela through SpinJa Sept 17, 2012 4 / 19

... ... Goals LTSmin’s goals 1 develop new model checking algorithms 2 reuse existing model checking algorithms 3 compare model checking algorithms UNIVERSITY OF TWENTE. SpinS : Extending LTSmin with Promela through SpinJa Sept 17, 2012 5 / 19

... ... Goals LTSmin’s goals 1 develop new model checking algorithms 2 reuse existing model checking algorithms 3 compare model checking algorithms Good Promela support enables reuse of our algorithms and a multitude of comparisons! UNIVERSITY OF TWENTE. SpinS : Extending LTSmin with Promela through SpinJa Sept 17, 2012 5 / 19

... ... Approach SpinJa ’s and SpinS’ workflow: generate compile parse verify load Model.prom Model.java SpinJa Model.class SpinJa result

... ... Approach SpinJa ’s and SpinS’ workflow: generate compile parse verify load Model.prom Model.java SpinJa Model.class SpinJa result generate compile parse verify load Model.prom Model.spins SpinS Model.c LTSmin result

... ... Approach SpinJa ’s and SpinS’ workflow: generate compile parse verify load Model.prom Model.java SpinJa Model.class SpinJa result generate compile parse verify load Model.prom Model.spins SpinS Model.c LTSmin result pins UNIVERSITY OF TWENTE. SpinS : Extending LTSmin with Promela through SpinJa Sept 17, 2012 6 / 19

... ... The Partitioned Next-State Interface pins defines: ◮ A state vector type: S : � s 1 , . . . , s n � ◮ An initial state function: initial() : S ◮ A k -partitioned next-state function: next-state i ( S ): S ◮ A dependency matrix: D k × n with D i , j ∈ 2 { read , write } UNIVERSITY OF TWENTE. SpinS : Extending LTSmin with Promela through SpinJa Sept 17, 2012 7 / 19

... ... The Partitioned Next-State Interface pins defines: ◮ A state vector type: S : � s 1 , . . . , s n � ◮ An initial state function: initial() : S ◮ A k -partitioned next-state function: next-state i ( S ): S ◮ A dependency matrix: D k × n with D i , j ∈ 2 { read , write } A few additional dependency matrixes with guard-information for partial order reduction. UNIVERSITY OF TWENTE. SpinS : Extending LTSmin with Promela through SpinJa Sept 17, 2012 7 / 19

... ... Promela Example (simplified) int x = 0; chan c; active proctype p1() { c?; } proctype p2() { byte y = 1; c!; x = x + y; } init { run p2(); x > 0; } UNIVERSITY OF TWENTE. SpinS : Extending LTSmin with Promela through SpinJa Sept 17, 2012 8 / 19

... ... From Promela to a pins state vector int x = 0; chan c; active proctype p1() { c?; } proctype p2() { byte y = 1; c!; x = x + y; } init { run p2(); x > 0; } UNIVERSITY OF TWENTE. SpinS : Extending LTSmin with Promela through SpinJa Sept 17, 2012 9 / 19

... ... From Promela to a pins state vector typedef struct state s { int x; int x = 0; struct proctype p1 { chan c; int pc; } p1; struct proctype p2 { active proctype p1() { int pc; c?; char y; } } p2; struct proctype init { proctype p2() { int pc; byte y = 1; } init; c!; } state t; x = x + y; } init { run p2(); x > 0; } UNIVERSITY OF TWENTE. SpinS : Extending LTSmin with Promela through SpinJa Sept 17, 2012 9 / 19

... ... From Promela to a pins state vector typedef struct state s { int x; int x = 0; struct proctype p1 { chan c; int pc; } p1; struct proctype p2 { active proctype p1() { int pc; c?; char y; } } p2; struct proctype init { proctype p2() { int pc; byte y = 1; } init; c!; } state t; x = x + y; } state t ∗ initial() { state t ∗ s = malloc( sizeof (state t)); init { s -> x = 0; run p2(); s -> p1. pc = 0; x > 0; s -> p2. pc = − 1; } s -> p2.y = 1; s -> init. pc = 0; return s; } UNIVERSITY OF TWENTE. SpinS : Extending LTSmin with Promela through SpinJa Sept 17, 2012 9 / 19

... ... From Promela to a pins next-state and dependencies int x = 0; chan c; active proctype p1() { c?; } proctype p2() { byte y = 1; c!; x = x + y; } init { run p2(); x > 0; } UNIVERSITY OF TWENTE. SpinS : Extending LTSmin with Promela through SpinJa Sept 17, 2012 10 / 19

... ... From Promela to a pins next-state and dependencies int x = 0; chan c; active proctype p1() { x=x+y x>0 run c! c? c?; p1 0 p1 0 } proctype p2() { byte y = 1; c!; p2 0 p2 1 p2 2 x = x + y; } init { run p2(); x > 0; } init 0 init 1 init 2 UNIVERSITY OF TWENTE. SpinS : Extending LTSmin with Promela through SpinJa Sept 17, 2012 10 / 19

... ... From Promela to a pins next-state and dependencies int x = 0; chan c; active proctype p1() { x=x+y x>0 run c! c? c?; p1 0 p1 0 } proctype p2() { × c byte y = 1; c!; p2 0 p2 1 p2 2 x = x + y; } init { × c run p2(); x > 0; } init 0 init 1 init 2 UNIVERSITY OF TWENTE. SpinS : Extending LTSmin with Promela through SpinJa Sept 17, 2012 10 / 19

... ... From Promela to a pins next-state and dependencies x=x+y c?/c! x>0 run p * 0 p * 1 p2 2 init 0 init 1 init 2 UNIVERSITY OF TWENTE. SpinS : Extending LTSmin with Promela through SpinJa Sept 17, 2012 11 / 19

... ... From Promela to a pins next-state and dependencies x=x+y c?/c! x>0 run p * 0 p * 1 p2 2 (1) (2) (3) (4) init 0 init 1 init 2 UNIVERSITY OF TWENTE. SpinS : Extending LTSmin with Promela through SpinJa Sept 17, 2012 11 / 19

... ... From Promela to a pins next-state and dependencies state t ∗ next − state( int i, state t ∗ in) { switch (i) { . . . case 2 : if (in -> p2. pc == 1) { state t ∗ out = malloc( sizeof (state t)); x=x+y c?/c! memcpy(out, in, sizeof (state t)); run x>0 p * 0 p * 1 p2 2 out -> p2. pc = 2; (4) (2) (1) (3) out -> x = out -> x + out -> p2.y; return out; } break ; . . . }} init 0 init 1 init 2 UNIVERSITY OF TWENTE. SpinS : Extending LTSmin with Promela through SpinJa Sept 17, 2012 11 / 19

... ... From Promela to a pins next-state and dependencies state t ∗ next − state( int i, state t ∗ in) { switch (i) { . . . case 2 : if (in -> p2. pc == 1) { state t ∗ out = malloc( sizeof (state t)); x=x+y c?/c! memcpy(out, in, sizeof (state t)); x>0 run p * 0 p * 1 p2 2 out -> p2. pc = 2; (1) (2) (3) (4) out -> x = out -> x + out -> p2.y; return out; } break ; . . . }} Dependency matrix: x p1 p2 y init init 0 init 1 init 2 1 rw rw 2 rw rw r 3 rw rw 4 r rw UNIVERSITY OF TWENTE. SpinS : Extending LTSmin with Promela through SpinJa Sept 17, 2012 11 / 19

... ... SpinS Extends SpinJa We extended SpinJa with: ◮ channel operations ( empty , full , etc) ◮ user-defined structures ( typedef ) ◮ pre-defined variables ( pid and nr pr ) ◮ channel polling and random receives ( ?[] and ?? ), ◮ remote references (@) ◮ preprocessor ( #if, #ifdef , #define f(a,b) , inline, and #include ) ◮ and others UNIVERSITY OF TWENTE. SpinS : Extending LTSmin with Promela through SpinJa Sept 17, 2012 12 / 19