The Kind 2 Model Checker Adrien Champion Alain Mebsout Christoph - PowerPoint PPT Presentation

The Kind 2 Model Checker Adrien Champion Alain Mebsout Christoph Sticksel Cesare Tinelli

Kind 2 is for safety analysis Reactive System Model Kind 2 (Lustre) State Transition System h s , I ( s ) , T ( s , s 0 ) i Safety Property (Extension of Lustre) safe unsafe P Proof Counter- Certificate example

Kind 2 has multiple inductive, cooperating engines Supervisor invariant BMC k -induction IC3 discovery SMT SMT SMT SMT

Kind 2 exploits the modularity of the system node max (x:real) returns (m:real); let m = x -> if x > pre x then x else pre x; tel node avg (x,y:real) returns (a:real); Component-level (*@contract invariant discovery assume x <= y; guarantee x <= a and a <= y; *) let a = (x + y) / 2.0; tel Assume-guarantee node sav (x:real) returns (s:real); contracts (*@contract assume x > 0.0 and x > pre x; guarantee s <= max(x); *) let s = avg(x -> pre s, x); tel

Kind 2 reasons compositionally and modularly about the system Bottom-up verification of contracts of 4 nodes one at a time 3 Abstract behavior of components to their contract and refine with implementation only on failure. 1 2

Kind 2 reasons compositionally and modularly about the system Bottom-up verification of contracts of 4 nodes one at a time Abstract behavior of components to 3 their contract and refine with implementation only on failure. 1 2

Kind 2 reasons compositionally and modularly about the system Bottom-up verification of contracts of 4 nodes one at a time Abstract behavior of components to 3 their contract and refine with implementation only on failure. 1 2

Kind 2 reasons compositionally and modularly about the system Bottom-up verification of contracts of 4 nodes one at a time Abstract behavior of components to 3 their contract and refine with implementation only on failure. 1 2

Kind 2 reasons compositionally and modularly about the system Bottom-up verification of contracts of 4 nodes one at a time Abstract behavior of components to 3 their contract and refine with implementation only on failure. 1 2

Kind 2 reasons compositionally and modularly about the system Bottom-up verification of contracts of 4 nodes one at a time Abstract behavior of components to 3 their contract and refine with implementation only on failure. 1 2

Kind 2 reasons compositionally and modularly about the system Bottom-up verification of contracts of 4 nodes one at a time Abstract behavior of components to 3 their contract and refine with implementation only on failure. 1 2

Kind 2 reasons compositionally and modularly about the system Bottom-up verification of contracts of 4 nodes one at a time Abstract behavior of components to 3 their contract and refine with implementation only on failure. 1 2

Kind 2 reasons compositionally and modularly about the system Bottom-up verification of contracts of 4 nodes one at a time Abstract behavior of components to 3 their contract and refine with implementation only on failure. 1 2

Kind 2 reasons compositionally and modularly about the system Bottom-up verification of contracts of 4 nodes one at a time l Abstract behavior of components to 3 their contract and refine with implementation only on failure. 1 2

Kind 2 reasons compositionally and modularly about the system Bottom-up verification of contracts of 4 nodes one at a time l Abstract behavior of components to 3 their contract and refine with implementation only on failure. 1 2

Kind 2 reasons compositionally and modularly about the system Bottom-up verification of contracts of 4 nodes one at a time l Abstract behavior of components to 3 their contract and refine with implementation only on failure. 1 2

Kind 2 certifies its results with counterexamples and proofs LFSC script contains SMT SMT proofs proofs SMT • Proofs from CVC4 proofs Φ k ∧ T k | I ∧ T k | = Φ 0 = Φ • k-inductive argument Φ | = P ⇤ Φ Independently checkable ⇤ P

We have just released Kind 2 v1.0.0 Download or try it out at http://kind.cs.uiowa.edu/ Ongoing and Future Work • Explicitly mode aware contracts • Test case generation from contracts • Compilation to Rust • Parameterized reasoning through arrays

Kind 2 is competitive 10000 1000 Time in s 100 Kind 2 (866 solved) jKind (863 solved) 10 NuXmv (842 solved) PKind (780 solved) Zustre (845 solved) 1 100 200 300 400 500 600 700 800 Number of benchmarks solved