1. Formal verification in SPIN
Karthikeyan Bhargavan,
Davor Obradovic
CIS573, Fall 1999

2. Formal verification
Formal verification means using methods of mathematical argument to determine correctness of systems.
Can be applied to hardware, software and other kinds of systems.
Bugs are expensive when discovered in a finished product. Idea: use FV to discover bugs during the design phase.

3. Model checkers Model checkers are among the most widely used FV tools.
Human inspection is not effective:
Currently designed systems are too large
Concurrency, race conditions
Big verifications done by paper and pencil are hard to re-construct and re-check
Model checkers are good at doing massive (but often simple) case analyses.

4. The BIG picture Model checker model description property YES NO +
counterexample

5. Spin Developed in Bell Labs, starting in 1980.
Designed for verification of distributed systems.
Model descriptions need to be given in PROMELA (PROcess MEta LAnguage).
Properties are described in LTL (Linear Temporal Logic).

6. PROMELA overview
A PROMELA program describes a set of concurrent processes.
Execution is asynchronous (each time only one process does a step), except in special cases (rendezvous message passing).
Processes can die or be created dynamically.
Processes can communicate through global variables and channels (message passing).

7. PROMELA example  Each Promela program generates
proctype Pr1 (){ do
:: x==0 ->y=1;
:: x==1 ->y=0;
od; }
proctype Pr2 (){
:: y==0 ->x=1;
:: y==1 ->x=0;
init {
x=0; y=0;
run Pr1();
run Pr2();
X=1
y=0
X=0
y=1
 Each Promela program generates
a unique state transition system.
 Promela “instructions” correspond
to state transitions.
:: y==0 ->x=1;

8. PROMELA special features
Nondeterministic choice:
if if
:: g1 -> s1; :: (x>3) -> x--;
:: g2 -> s2; :: true -> y=1;
:: y -> x=x+y;
fi fi;
At each step, execute one of the statements whose guard evaluates to true.

9. PROMELA special features
Nondeterministic loop:
do do
:: g1 -> s1; :: (x>3) -> x--;
:: g2 -> s2; :: true -> y=1;
:: y -> x=x+y;
od od;
Repeat, choosing nondeterministically at each step.

10. PROMELA special features
Channel communication:
chan c = [2] of {bit};
chan din = [0] of {byte};
chan dout = [1] of {byte};
Send a message m on channel c: c!m
Receive a message from channel c: c?x
din?v -> dout!(v+v);
c?1 -> x++;
dout!v -> skip;

11. Other PROMELA features
Labels and goto statement
Types: bit, bool, byte, short, int
User-defined types
. . .
More about PROMELA on the course webpage.

12. LTL overview Expresses properties dependent on time (temporal)
LTL formulas are evaluated on sequences of states (linear)
Standard predicate logic + temporal operators:
[] = always
<> = eventually

13. []((x<0) ==> <>(y<0))
LTL in practice
x is always strictly greater than y: [](x>y)
Eventually x becomes equal to 1: <>(x==1)
Eventually x becomes equal to 1 and never changes afterwards:
<>[](x==1)
If at any moment x becomes negative, y will become negative at some later moment:
[]((x<0) ==> <>(y<0))

14. LTL, formal definitions
F ::= p (a state predicate, like (x>0) or (x!=y))
| F1 && F2
| F1 || F2
| !F
| []F
| <>F
Given a sequence of states s = s(0), s(1), s(2), ...
 s(i) satisfies []F if for every j>=i, s(j) satisfies F.
 s(i) satisfies <>F if for some j>=i, s(j) satisfies F.
The whole sequence s satisfies F if s(0) satisfies F.

15. LTL examples p !p ... <>(!p) []p []<>p <>[]p + + - -
p,!q
!p,q
...
[](p||q)
[]<>q
<>(p&&q)
(<>p)&&(<>q) + + - +

16. LTL verification in Spin
Given a PROMELA program and an LTL formula, Spin checks whether all possible computation paths satisfy the formula.
int a,b,d; init {
bit ready=0; a=100;
proctype Euclid (int x,y){ b=1;
do do
::(x>y) -> x=x-y :: (b<a) -> b++
::(y>x) -> y=y-x :: true -> goto enough
:: (x==y)-> goto done od;
od; enough: run Euclid(a,b)}
done:
ready=1; d=x }
LTL: <>(ready && (a%d==0))