并发模型的验证 ( 例子 )

2 互斥协议模型：示意图 x==0||t==0 t0 x=1,t=0 t1 t2 y==0||t==1 t3 x=0 s0 y=1,t=1 s1 s2 s3 y=0 初始状态 s0 t0 x=0 y=0 t=0

互斥协议模型 (2) a=s0 b=t0 x=0 y=0 t=0

并发模型的验证 验证问题 Model 建模

并发模型 ( 主程序 ) VVM VAR x: 0..1; y: 0..1; t: 0..1; INIT x=0; y=0; t=0; PROC p0: p0m(); p1: p1m(); SPEC AG(!(p0.a=s2&p1.b=t2)); AG((!p0.a=s1|AF(p0.a=s2|p1.b=t2))&(!p1.b=t1|AF(p0.a=s2|p1.b=t2))); AG((!p0.a=s1|AF(p0.a=s2))&(!p1.b=t1|AF(p1.b=t2))); AG((!p0.a=s1|EF(p0.a=s2))&(!p1.b=t1|EF(p1.b=t2)));

并发模型 ( 进程模块说明 1) MODULE p0m() VAR a: {s0,s1,s2,s3}; INIT a=s0; TRANS a=s0: (y,t,a):=(1,1,s1); a=s1&(x=0|t=0): (a):=(s2); a=s1&!(x=0|t=0):(a):=(s1); a=s2: (y,a):=(0,s3); a=s2: (a):=(s2); a=s3: (y,t,a):=(1,1,s1);

并发模型 ( 进程模块说明 2) MODULE p1m() VAR b: {t0,t1,t2,t3}; INIT b=t0; TRANS b=t0: (x,t,b):=(1,0,t1); b=t1&(y=0|t=1): (b):=(t2); b=t1&!(y=0|t=1):(b):=(t1); b=t2: (x,b):=(0,t3); b=t2: (b):=(t2); b=t3: (x,t,b):=(1,0,t1);

模型检测./verds -ck 1 me002.vvm VERSION: verds DEC 2012 FILE: me001.vvm PROPERTY: A G ! ((a = 2 )& (b = 2 )) bound = 1 time = time = 0 bound = 2 time = time = 0 bound = 3 time = time = 0 bound = 4 time = time = 0 bound = 5 time = time = 0 bound = 6 time = time = 0 CONCLUSION: TRUE (time=0)

模型检测结论 PropertyConclusion AG(!(p0.a=2&p1.a=2))true AG((!p0.a=1|AF(p0.a=2|p1.a=2))&(!p1.a=1|AF(p0.a=2|p1.a=2)))false AG((!p0.a=1|AF(p0.a=2))&(!p1.a=1|AF(p1.a=2)))false AG((!p0.a=1|EF(p0.a=2))&(!p1.a=1|EF(p1.a=2)))true

进程公平性说明

并发模型 ( 主程序 ) VVM VAR x: 0..1; y: 0..1; t: 0..1; INIT x=0; y=0; t=0; PROC p0: p0m(); p1: p1m(); SPEC AG(!(p0.a=s2&p1.b=t2)); AG((!p0.a=s1|AF(p0.a=s2|p1.b=t2))&(!p1.b=t1|AF(p0.a=s2|p1.b=t2))); AG((!p0.a=s1|AF(p0.a=s2))&(!p1.b=t1|AF(p1.b=t2))); AG((!p0.a=s1|EF(p0.a=s2))&(!p1.b=t1|EF(p1.b=t2)));

并发模型 ( 进程模块说明 1a) MODULE p0m() VAR a: {s0,s1,s2,s3}; INIT a=s0; TRANS a=s0: (y,t,a):=(1,1,s1); a=s1&(x=0|t=0): (a):=(s2); a=s1&!(x=0|t=0):(a):=(s1); a=s2: (y,a):=(0,s3); a=s2: (a):=(s2); a=s3: (y,t,a):=(1,1,s1); FAIRNESS running;

并发模型 ( 进程模块说明 2a) MODULE p1m() VAR b: {t0,t1,t2,t3}; INIT b=t0; TRANS b=t0: (x,t,b):=(1,0,t1); b=t1&(y=0|t=1): (b):=(t2); b=t1&!(y=0|t=1):(b):=(t1); b=t2: (x,b):=(0,t3); b=t2: (b):=(t2); b=t3: (x,t,b):=(1,0,t1); FAIRNESS running;

模型检测结论 PropertyConclusion AG(!(p0.a=2&p1.a=2))true AG((!p0.a=1|AF(p0.a=2|p1.a=2))&(!p1.a=1|AF(p0.a=2|p1.a=2)))true AG((!p0.a=1|AF(p0.a=2))&(!p1.a=1|AF(p1.a=2)))false AG((!p0.a=1|EF(p0.a=2))&(!p1.a=1|EF(p1.a=2)))true

进程公平性说明 2

并发模型 ( 主程序 ) VVM VAR x: 0..1; y: 0..1; t: 0..1; INIT x=0; y=0; t=0; PROC p0: p0m(); p1: p1m(); SPEC AG(!(p0.a=s2&p1.b=t2)); AG((!p0.a=s1|AF(p0.a=s2|p1.b=t2))&(!p1.b=t1|AF(p0.a=s2|p1.b=t2))); AG((!p0.a=s1|AF(p0.a=s2))&(!p1.b=t1|AF(p1.b=t2))); AG((!p0.a=s1|EF(p0.a=s2))&(!p1.b=t1|EF(p1.b=t2)));

并发模型 ( 进程模块说明 1b) MODULE p0m() VAR a: {s0,s1,s2,s3}; INIT a=s0; TRANS a=s0: (y,t,a):=(1,1,s1); a=s1&(x=0|t=0): (a):=(s2); a=s1&!(x=0|t=0):(a):=(s1); a=s2: (y,a):=(0,s3); a=s2: (a):=(s2); a=s3: (y,t,a):=(1,1,s1); FAIRNESS running; a!=s2;

并发模型 ( 进程模块说明 2b) MODULE p1m() VAR b: {t0,t1,t2,t3}; INIT b=t0; TRANS b=t0: (x,t,b):=(1,0,t1); b=t1&(y=0|t=1): (b):=(t2); b=t1&!(y=0|t=1):(b):=(t1); b=t2: (x,b):=(0,t3); b=t2: (b):=(t2); b=t3: (x,t,b):=(1,0,t1); FAIRNESS running; b!=t2;

模型检测结论 PropertyConclusion AG(!(p0.a=2&p1.a=2))true AG((!p0.a=1|AF(p0.a=2|p1.a=2))&(!p1.a=1|AF(p0.a=2|p1.a=2)))true AG((!p0.a=1|AF(p0.a=2))&(!p1.a=1|AF(p1.a=2)))true AG((!p0.a=1|EF(p0.a=2))&(!p1.a=1|EF(p1.a=2)))true

验证过程 验证问题 Model 建模 VERDS Model Checker VERDS Model Checker Positive Conclusion Negative Conclusion Negative Conclusion Error Trace 安全性质

问题 ?