Lecture 4: Checking properties in NuSMV B. Srivathsan Chennai - PowerPoint PPT Presentation

Lecture 4: Checking properties in NuSMV B. Srivathsan Chennai Mathematical Institute Model Checking and Systems Verification January - April 2016 1 / 43

Outline ◮ Module 1: Synchronous Vs Asynchronous composition ◮ Module 2: More examples of NuSMV models and properties ◮ Module 3: A problem in concurrency ◮ Module 4: What is a property? 2 / 43

Module 1: Synchronous Vs Asynchronous composition 3 / 43

Acknowledgements: Content in this part of module taken from lecture slides of Prof. Supratik Chakraborty, IIT Bombay 4 / 43

L 1 L 1 L 2 .red L 2 L 2 L 1 .red 5 / 43

L 1 L 1 L 2 .red L 2 L 2 L 1 .red If a light is red , it can stay red for an arbitrary period If it goes yellow , it should become green within one cycle If it is green , it can stay green for an arbitrary period 5 / 43

MODULE light(other) VAR state: {r,y,g}; ASSIGN init(state) := r; next(state) := case state=r & other=r : {r, y}; state=y : g; state=g : {g, r}; TRUE : state; esac; MODULE main VAR tl1: light(tl2.state); tl2: light(tl1.state); 6 / 43

Synchronous composition MODULE light(other) VAR state: {r,y,g}; ASSIGN init(state) := r; next(state) := case state=r & other=r : {r, y}; state=y : g; state=g : {g, r}; TRUE : state; esac; MODULE main VAR tl1: light(tl2.state); tl2: light(tl1.state); 6 / 43

Synchronous composition 7 / 43

Synchronous composition Both lights can simultaneously become green ! 7 / 43

Asynchronous composition MODULE light(other) VAR state: {r,y,g}; ASSIGN init(state) := r; next(state) := case state=r & other=r : {r, y}; state=y : g; state=g : {g, r}; TRUE : state; esac; MODULE main VAR tl1: process light(tl2.state); tl2: process light(tl1.state); 8 / 43

Asynchronous composition ... 9 / 43

Asynchronous composition ... Only one light can become green at a time 9 / 43

◮ Synchronous: ◮ all assignments to all modules made simultaneously ◮ suitable when all modules are synchronized to a global clock ◮ Asynchronous: ◮ execution of modules is interleaved ◮ at a time, only one module executes ◮ choice of next module to be executed is non-deterministic ◮ suitable when no assumptions can be made about communication delay between modules 10 / 43

Synchronous vs. Asynchronous systems 11 / 43

Module 2: More examples 12 / 43

... P 1 P 2 P n S HARED R ESOURCE (variable, printer, ... ) Mutual Exclusion: No two processes can access the resource simultaneously 13 / 43

P 1 P 2 loop forever loop forever . . . . *non-critical actions* *non-critical actions* . . request request critical section critical section release release . . . . *non-critical actions* *non-critical actions* . . end loop end loop 14 / 43

P 1 P 2 loop forever loop forever . . . . *non-critical actions* *non-critical actions* . . request request critical section critical section release release . . . . *non-critical actions* *non-critical actions* . . end loop end loop PG 1 PG 2 noncrit 1 noncrit 2 wait 1 wait 2 crit 1 crit 2 14 / 43

P 1 P 2 loop forever loop forever . . . . *non-critical actions* *non-critical actions* . . 〈 if y>0 : y:=y-1 〉 〈 if y>0 : y:=y-1 〉 *request* *request* critical section critical section y:=y+1 y:=y+1 *release* *release* . . . . *non-critical actions* *non-critical actions* . . end loop end loop PG 1 PG 2 noncrit 1 noncrit 2 y:= y+1 wait 1 y:= y+1 wait 2 y>0:y:=y-1 y>0:y:=y-1 crit 1 crit 2 14 / 43

P 1 P 2 loop forever loop forever . . . . *non-critical actions* *non-critical actions* . . 〈 if y>0 : y:=y-1 〉 〈 if y>0 : y:=y-1 〉 *request* *request* critical section critical section y:=y+1 y:=y+1 *release* *release* . . . . *non-critical actions* *non-critical actions* . . end loop end loop PG 1 PG 2 noncrit 1 noncrit 2 atomic y:= y+1 wait 1 y:= y+1 wait 2 y>0:y:=y-1 y>0:y:=y-1 crit 1 crit 2 14 / 43

P 1 P 2 loop forever loop forever . . . . *non-critical actions* *non-critical actions* . . 〈 if y>0 : y:=y-1 〉 〈 if y>0 : y:=y-1 〉 *request* *request* critical section critical section y:=y+1 y:=y+1 *release* *release* . . . . *non-critical actions* *non-critical actions* . . end loop end loop PG 1 PG 2 noncrit 1 noncrit 2 atomic y:= y+1 wait 1 y:= y+1 wait 2 y>0:y:=y-1 y>0:y:=y-1 crit 1 crit 2 NuSMV demo: mutex-demo.smv 14 / 43

Coming next: A slight modification of previous mutual exclusion protocol 15 / 43

non-crit wait PG 1 y:=y+1 y>0:y:=y-1 exiting crit non-crit wait PG 2 y:=y+1 y>0:y:=y-1 exiting crit 16 / 43

non-crit wait PG 1 y:=y+1 y>0:y:=y-1 exiting crit non-crit wait PG 2 y:=y+1 y>0:y:=y-1 exiting crit NuSMV demo: mutex-demo1.smv 16 / 43

Synchronous vs. Mutual Exclusion Asynchronous systems 17 / 43

while x < 200 while x>0 while x=200 x := x+1 x := x-1 x := 0 m 1 n 1 l 1 x := x+1 x < 200 x:=x-1 x > 0 x:=0 x = 200 m 2 n 2 l 2 18 / 43

while x < 200 while x>0 while x=200 x := x+1 x := x-1 x := 0 m 1 n 1 l 1 x := x+1 x < 200 x:=x-1 x > 0 x:=0 x = 200 m 2 n 2 l 2 NuSMV demo : three-program-demo.smv 18 / 43

Synchronous vs. Mutual Exclusion Asynchronous systems Concurrent programs example 19 / 43

Module 3: A problem in concurrency 20 / 43

processes P 0 ... P 3 : P 0 S 3 S 0 S 0 ... S 3 : resources P 3 P 1 S 2 S 1 P 2 21 / 43

processes P 0 ... P 3 : P 0 S 3 S 0 S 0 ... S 3 : resources P 3 P 1 Process P i can execute only if it has access to resources S 2 S 1 S ( i − 1 ) and S i P 2 21 / 43

processes P 0 ... P 3 : P 0 S 3 S 0 S 0 ... S 3 : resources P 3 P 1 Process P i can execute only if it has access to resources S 2 S 1 S ( i − 1 ) mod 4 and S i mod 4 P 2 21 / 43

processes P 0 ... P 3 : P 0 S 3 S 0 S 0 ... S 3 : resources P 3 P 1 Process P i can execute only if it has access to resources S 2 S 1 S ( i − 1 ) mod 4 and S i mod 4 P 2 How should the processes be scheduled so that every process can execute infinitely often ? 21 / 43

Dining philosophers problem (Dijkstra) P 0 ... P 3 : philosophers P 0 S 3 S 0 S 0 ... S 3 : chop-sticks P 3 P 1 Philosopher P i can eat only if he has access to chop-sticks S 2 S 1 S ( i − 1 ) mod 4 and S i mod 4 P 2 22 / 43

Dining philosophers problem (Dijkstra) P 0 ... P 3 : philosophers P 0 S 3 S 0 S 0 ... S 3 : chop-sticks P 3 P 1 Philosopher P i can eat only if he has access to chop-sticks S 2 S 1 S ( i − 1 ) mod 4 and S i mod 4 P 2 What should the protocol be so that every philosopher can eat infinitely often ? 22 / 43

Coming next: A protocol for the dining philosophers 23 / 43

Philosopher i think req_left req_right sticks[i]=free sticks[i-1]=free sticks[i]:=i sticks[i-1]:=i have_left have_right sticks[i-1]=free sticks[i]=free sticks[i-1]:=i sticks[i]:=i eat return sticks[i]=free sticks[i-1]=free 24 / 43

Philosopher i think req_left req_right sticks[i]=free sticks[i-1]=free sticks[i]:=i sticks[i-1]:=i have_left have_right sticks[i-1]=free sticks[i]=free sticks[i-1]:=i sticks[i]:=i eat return sticks[i]=free sticks[i-1]=free NuSMV demo 24 / 43

A deadlock Sticks 〈 think, think, think, think 〉 0 1 2 3 〈 have_left, have_left, have_left, have_left 〉 25 / 43

Question: What properties should be checked to detect deadlocks ? 26 / 43

Question: What properties should be checked to detect deadlocks ? ◮ Next module: Attach a mathematical meaning to properties 26 / 43

Question: What properties should be checked to detect deadlocks ? ◮ Next module: Attach a mathematical meaning to properties ◮ Next lecture: Classification of properties into various types 26 / 43

Question: What properties should be checked to detect deadlocks ? ◮ Next module: Attach a mathematical meaning to properties ◮ Next lecture: Classification of properties into various types ◮ Next lecture: Answer to the above question 26 / 43

Module 4: What is a “property”? 27 / 43

Goal: Attach a mathematical meaning to “property” 28 / 43

MODULE main request=1 request=1 VAR ready busy request: boolean; status: {ready, busy} ASSIGN init(status) := ready; next(status) := case request=0 request=0 request : busy; ready busy TRUE : {ready,busy}; esac; 29 / 43

MODULE main request=1 request=1 VAR ready busy request: boolean; status: {ready, busy} ASSIGN init(status) := ready; next(status) := case request=0 request=0 request : busy; ready busy TRUE : {ready,busy}; esac; p 1 : (request=1) p 2 : (status=busy) 29 / 43

MODULE main request=1 request=1 VAR ready busy request: boolean; status: {ready, busy} ASSIGN init(status) := ready; next(status) := case request=0 request=0 request : busy; ready busy TRUE : {ready,busy}; esac; Atomic propositions p 1 : (request=1) p 2 : (status=busy) 29 / 43

{ p 1 } MODULE main request=1 request=1 VAR ready busy request: boolean; status: {ready, busy} ASSIGN init(status) := ready; next(status) := case request=0 request=0 request : busy; ready busy TRUE : {ready,busy}; esac; Atomic propositions p 1 : (request=1) p 2 : (status=busy) 29 / 43