1. Temporal Logic and the NuSMV Model Checker CS 680 Formal Methods Jeremy Johnson

2. Formal Verification  Framework for modelling systems  A specification language for describing properties to be verified  A verification method to establish whether the description of the system satisfies its specification

3. Approaches to Verification  Proof based vs model based  Degree of automation  Full vs. property verification  Intended domain of application  Pre vs post development

4. Model Checking  Describe a model for the system  Describe properties using temporal logic  Run the model checker to see if the property is satisfied in the model  Contrast to Alloy

5. Linear-Time Temporal Logic

6. Transition System p,q q,rr S0S0 S1S1 S2S2

7. Tree of Computation Paths p,q S0S0 r S2S2 r S2S2 q,r S1S1 r S2S2 r S2S2 p,q S0S0 r S2S2 q,r S1S1 … … … … …

8. Semantics of LTL

13. Examples p,q S0S0 r S2S2 r S2S2 q,r S1S1 r S2S2 r S2S2 p,q S0S0 r S2S2 q,r S1S1 … … … … …

14. Examples

16. Practical Examples  It is impossible to get to a state where started holds, but ready does not hold  G  (started  ready)  Negation says it is possible but only interpreted on paths. Does not say for all states there exists a path to get to such a state

17. Practical Examples  For any state, if a request occurs then it will eventually be acknowledged  G(requested  F acknowledged)  A certain process is enabled infinitely often  GF enabled

18. Practical Examples  Whatever happens a certain process will eventually be permantently deadlocked  F G deadlocked  If a process is enabled infinitely often it runs infinitely often  GF enabled  GF running

19. Practical Examples  An upwards travelling elevator at the second floor does not change its direction when it has passengers wishing to go to the 5 th floor  G(floor2  up  Button5Pressed  (up U floor5)

20. What can’t you say  From any state it is possible to get to a restart state  An elevator can remain idle on the third floor  LT can not assert the existence of paths.  CTL can

21. Equivalent Formulas  Negation   G   F    F   G    X   X    (  U  )  (   R   )   (  R  )  (   U   )

22. Equivalent Formulas  Distributivity  F(    )  F   F   G(    )  G   G   What about the other way?

23. Equivalent Formulas

24. Mutual Exlcusion  Critical section (c, t, n)  Two processes that can be interleaved  Safety (only one process is in its critical section at a time)  G  (c 1  c 2 )  Liveness (whenever a process requests to enter its critical section it will eventually be permitted to do so)  G(t 1  F c 1 )

25. Mutual Exclusion  Critical section (c, t, n)  Non-blocking (a process can always request to enter its critical section)  Every state satisfying n there is a path satisfying t  No strict sequencing (processes need not enter their critical section in strict sequence)  There is a path with two distinct states satisfying c1 [not expressible in LTL]  Complement (all paths having c1 can not have further c1 until c2 occurs  G(c1  c1W(  c1   c1 W c2))

26. First Attempt n1n2n1n2 t1n2t1n2 n1t2n1t2 t1t2t1t2 c1n2c1n2 c1t2c1t2 n1c2n1c2 t1c2t1c2 s0s0 s1s1 s2s2 s3s3 s4s4 s5s5 s6s6 s7s7

27. Second Attempt n1n2n1n2 t1n2t1n2 n1t2n1t2 t1t2t1t2 c1n2c1n2 c1t2c1t2 n1c2n1c2 t1c2t1c2 s0s0 s1s1 s2s2 s3s3 s5s5 s6s6 s7s7 s4s4 t1t2t1t2 s9s9

28. Branching-Time Logic  In LTL a state of a system satisfies  iff for all paths from that state  is satisfied  Implicit universal quantifier  Properties which assert the existence of a path can not be expressed (partially solved by considering negation     Branching-time logic solve this problem by allowing quantifiers over paths

29. Computation Tree Logic (CTL)  Branching time logic where model of time is tree-like: there are different paths in the future, any of which might be the actual path

30. Computation Tree Logic (CTL)

31. Examples  There is a reachable state satisfying q  EF q  From all reachable states satisfying p, it is possible to maintain p continuously until reaching a state satisfying q  AG(p  E(p U q))

32. Examples  Whenever a state satisfying p is reached, the system can exhibit q continuously forevermore  AG (p  EG q)  There is a reachable state from which all reachable states satisfy p  EF AG p

33. Mutual Exclusion Revisited  Critical section (c, t, n)  Non-blocking (a process can always request to enter its critical section)  Every state satisfying n there is a path satisfying t  AG( n 1  EX t 1 )  No strict sequencing (processes need not enter their critical section in strict sequence)  There is a path with two distinct states satisfying c1 [not expressible in LTL]  EF(c1  E[c1 U (  c1  E[  c2 U c1])])

34. Second Attempt n1n2n1n2 t1n2t1n2 n1t2n1t2 t1t2t1t2 c1n2c1n2 c1t2c1t2 n1c2n1c2 t1c2t1c2 s0s0 s1s1 s2s2 s3s3 s5s5 s6s6 s7s7 s4s4 t1t2t1t2 s9s9

35. Semantics of CTL