1. Model Checking and Related Techniques
Liu Yang

2. Outline Model Checking Techniques Tackle the State Space Explosion
Introduction to MC
Symbolic Model Checking
Bounded Model Checking
Explicit Model Checking
Tackle the State Space Explosion
Partial Order Reduction
Compositional Reasoning
Abstraction
Symmetry
PAT: Process Analysis Toolkit
Performance Comparison
Conclusion

3. Model Checking Introduction
Model Checking is to exhaustively explore all reachable states of a finite state machine so as to tell whether a desired property is guaranteed or not.
Advantages over traditional system validation approaches based on simulation, testing and deductive reasoning
An automatic technique for verifying finite state concurrent systems
Process: modeling, specification and verification
Main challenge: state space explosion problem
An automatic technique for verifying finite state concurrent systems, where the Counterexamples can be generated if the property is false.

4. Model Checking √ ? System design or code Requirements abstract manual
Finite state model M
Set of logical
properties
for each property φ
automatic
Model checker
M |= φ ?
Yes No
√ ?

5. Model of Concurrent Systems
(Unwind State Graph
to obtain Infinite Tree)

6. Model of Concurrent Systems (Cont.)
Formally, a Kripke structure is a triple M 􀀀 <S,R,L>, where

7. Temporal logics
Temporal logics may differ according to how they handle branching in the underlying computation tree.
In a linear temporal logic (LTL), operators are provided for describing events along a single computation path.
In a Computation Tree Logics (CTL) the temporal operators quantify over the paths that are possible from a given state.

8. Temporal logics
Formulas are constructed from path quantifiers and temporal operators:
Path quantifier:
A: for every path
E: there exists a path
Linear Temporal Operator:
Xp: p holds next time
Fp: p holds sometime in the future ()
Gp: p holds globally in the future ()
pUq: p holds until q holds
In LTL, only linear temporal operators are allowed.
In CTL, each temporal operator must be immediately preceded by a path quantifier.
In CLT*, a path quantifier can prefix an assertion composed of arbitrary combinations of the usual linear-time operators.

9. CTL Examples The four most widely used CTL operators are illustrated.
Each computation tree has initial state s0 as its root.
EF(Started ^ :Ready): it is possible to get to a state where Started holds but
Ready does not hold.
AG(Req ) AFAck): if a Request occurs, then it will be eventually Acknowledged.
AG(AF DeviceEnabled): DeviceEnabled holds infinitely often on every
computation path.
AG(EF Restart): from any state it is possible to get to the Restart state.

10. Fixpoint Algorithms Key properties of EFp:
Efficient model checking algorithms exist for CTL.

11. Model Checking Problem
Let M be the state-transition graph obtained from the concurrent system.
Let f be the specification expressed in temporal logic.
M, s |= f
and check if initial states are among these.

12. Symbolic Model Checking
Method used by most “industrial strength” model checkers:
uses Boolean encoding for state machine and sets of states.
can handle much larger designs – hundreds of state variables.
BDDs traditionally used to represent Boolean functions.

13. Symbolic Model Checking with BDDs
Ken McMillan implemented a version of the CTL model checking algorithm using Binary Decision Diagrams in 1987.
Carl Pixley independently developed a similar algorithm, as did the French researchers, Coudert and Madre.
BDDs enabled handling much larger concurrent systems. (usually, an order of magnitude increase in hardware latches!)

14. Ordered Binary Decision Trees and Diagrams
Ordered Binary Decision Tree for the two-bit comparator, given by the formula

15. OBDD for Comparator Example
If we use the ordering a1 < b1 < a2 < b2 for the comparator function, we obtain the OBDD below:

16. Variable Ordering Problem
The size of an OBDD depends critically on the variable ordering.
If we use the ordering a1 < a2 < b1 < b2 for the comparator function, we get the OBDD below:
Moreover, there are boolean functions that have exponential size OBDDs for any
variable ordering.

17. Symbolic Model Checking Algorithm
How to represent state-transition graphs with Ordered Binary Decision Diagrams:
Assume that system behavior is determined by n Boolean state variables v1, v2, … , vn.
The Transition relation T will be given as a boolean formula in terms of the state variables:
where v1,…, vn represents the current state and v’1,…, v’n represents the next state.
Now convert T to a OBDD!!

18. Symbolic Model Checking (cont.)
Representing transition relations symbolically:
Boolean formula for transition relation:
Now, represent as an OBDD!

19. Symbolic Model Checking (cont.)
How to evaluate fixpoint formulas using OBDDs:
Introduce state variables:
Now, compute the sequence
until convergence.

20. Problems with BDDs
BDDs are a canonical representation. Often become too large.
Selecting right variable ordering very important for obtaining small BDDs.
Often time consuming or needs manual intervention.
Sometimes, no space efficient variable ordering exists.
Next, we describe an alternative approach to symbolic model checking that uses SAT procedures.

21. Advantages of SAT Procedures
SAT procedures also operate on Boolean expressions but do not use canonical forms.
Do not suffer from the potential space explosion of BDDs.
Can handle functions with s to s of variables.
Very efficient implementations available.

22. Bounded Model Checking
Bounded model checking uses a SAT procedure instead of BDDs.
We construct Boolean formula that is satisfiable iff there is a specific finite path of length k in underlying machine.
We look for longer and longer paths by incrementing the bound k.
After some number of iterations, we may conclude no such path exists and specification holds.
For example, to verify safety properties, number of iterations is bounded by diameter of finite state machine.

23. Main Advantages of SAT Approach
Bounded model checking works quickly. This is due to depth first nature of SAT search procedures.
It finds finite paths of minimal length. This helps user understand the example more easily.
It uses much less space than BDD based approaches.
Does not need manually selected variable order or costly reordering. Default splitting heuristics usually sufficient.

24. NuSMV: A New Symbolic Model Verifier
Finite-state Systems described in a specialized language
Specifications expressible in CTL, LTL
Provides both BDD and SAT based model checking.
Allow user specified variable ordering
Uses a number of heuristics for achieving efficiency and control state explosion

25. NuSMV language by examples
One “main” module. Three portions of code, identified by VAR,
ASSIGN, SPEC.
VAR identifies a portion of code where variables are defined.
ASSIGN identifies a portion of code where variables are initialised and
evolution is described.
SPEC defines properties to be verified.

26. Explicit Model Checking
Given a model M and an LTL formula 
All traces of M must satisfy 
If a trace of M does not satisfy 
Counterexample
M is the set of traces of M
 is the set of traces that satisfy 
M  
Equivalently M  ¬=

27. Büchi Automata Automaton which accepts infinite traces
A Büchi automaton is 4-tupleS, I,, F
S is a finite set of states
I S is a set of initial states
  S S is a transition relation
F S is a set of accepting states
An infinite sequence of states is accepted iff it contains accepting states infinitely often

28. Example 1=S0S1S2S2S2S2… 2=S0S1S2S1S2S1… 3=S0S1S2S1S1S1… S0 S1 S2
ACCEPTED
2=S0S1S2S1S2S1…
ACCEPTED
3=S0S1S2S1S1S1…
REJECTED

29. LTL and Büchi Automata LTL formula Büchi Automaton
Represents a set of infinite traces which satisfy such formula
Büchi Automaton
Accepts a set of infinite traces
We can build an automaton which accepts all and only the infinite traces represented by an LTL formula

30. LTL Model Checking Given a model M and an LTL formula 
Build the Buchi automaton B¬
Compute product of M and B¬
Each state of M is labeled with propositions
Each state of B¬ is labeled with propositions
Match states with the same labels
The product accepts the traces of M that are also traces of B¬ (M  ¬)
If the product accepts any sequence
We have found a counterexample
Construct the product of the system and the Büchi automaton generated from the negation of the property and concludes with a counterexample as soon as a fair loop is discovered

31. Nested Depth First Search
The product is a Büchi automaton
How do we find accepted sequences?
Accepted sequences must contain a cycle
In order to contain accepting states infinitely often
We are interested only in cycles that contain at least an accepting state
During depth first search start a second search when we are in an accepting states
If we can reach the same state again we have a cycle (and a counterexample)

32. Example

33. Example

34. Nested Depth First Search
procedure DFS(s)
visited = visited  {s}
for each successor s’ of s
if s’  visited then
DFS(s’)
if s’ is accepting then
DFS2(s’, s’)
end if
end for
end procedure

35. Nested Depth First Search
procedure DFS2(s, seed)
visited2 = visited2  {s}
for each successor s’ of s
if s’ = seed then
return “Cycle Detect”;
end if
if s’  visited2 then
DFS2(s’, seed)
end for
end procedure

36. Explicit Model Checking
Avoid to construct the entire state space of the modeled system, can be done On-the-Fly
Some states are not generated in the product
Counterexample can be found before searching all states
Easy to optimize
Better support for asynchronous composition.

37. SPIN Explicit State Model Checker Process Algebra
Asynchronous composition of independent processes
Communication using channels and global variables
Non-deterministic choices and interleavings
Nested Depth First Search
Uses a hashing function to store each state using only 2 bits (no guarantee of soundness)
Partial Order Reduction

38. SPIN Example of Peterson’s Algorithm
bool turn, flag[2];
byte ncrit;
active proctype user0() {
again:
flag[0] = 1;
reach: turn = 0;
cs: (flag[1 - 0] == 0 || turn == 1 - 0);
ncrit++;
ss: assert(ncrit == 1); /* critical section */
ncrit--;
flag[0] = 0;
goto again }
active proctype user1() {
again:
flag[1] = 1;
reach: turn = 1;
cs: (flag[1 - 1] == 0 || turn == 1 - 1);
ncrit++;
assert(ncrit == 1); /* critical section */
ncrit--;
flag[1] = 0;
goto again }

39. Outline Model Checking Techniques Tackle the State Space Explosion
Introduction to MC
Symbolic Model Checking
Bounded Model Checking
Explicit Model Checking
Tackle the State Space Explosion
Partial Order Reduction
Compositional Reasoning
Abstraction
Symmetry
PAT: Process Analysis Toolkit
Performance Comparison
Conclusion

40. Partial Order Reduction
The interleaving model for asynchronous systems allows concurrent events to be ordered arbitrarily.
To avoid discriminating against any particular ordering, the events are interleaved in all possible ways.
The ordering between independent transitions is largely meaningless!!

41. The State Explosion Problem
Allowing all possible orderings is a potential cause of the state explosion problem.
To see this, consider n transitions that can be executed concurrently.
In this case, there are n different orderings and 2n different states (one for each subset of the transitions).
If the specification does not distinguish between these sequences, it is beneficial to consider only one with n + 1 states.

42. Partial Order Reduction
The partial order reduction is aimed at reducing the size of the state space that needs to be searched.
It exploits the commutativity of concurrently executed transitions, which result in the same state.
Thus, this reduction technique is best suited for asynchronous systems.
(In synchronous systems, concurrent transitions are executed simultaneously rather than being interleaved.)

43. Partial Order Reduction (Cont.)
The method consists of constructing a reduced state graph.
The full state graph, which may be too big to fit in memory, is never constructed.
The behaviors of the reduced graph are a subset of the behaviors of the full state graph.
The justification of the reduction method shows that the behaviors that are not present do not add any information.

44. Partial Order Reduction (Cont.)
The name partial order reduction comes from early versions of the algorithms that were based on the partial order model of program execution.
However, the method can be described better as model checking using representatives, since the verification is performed using representatives from the equivalence classes of behaviors.

45. Compositional Reasoning
Big systems are composed by sub-processes running in parallel. The specifications for such systems can be decomposed into properties hold in the sub processes.
Communication protocol: a sender, a network and a receiver.
Assume-Guarantee Paradigm
Verify each sub-process separately by adding assumptions on sub-process.
Combine the assumed and guaranteed properties to shown the correctness of (|| sub-processes )

46. Abstraction Eliminate details irrelevant to the property
Obtain simple finite models sufficient to verify the property
E.g., Infinite state ! Finite state approximation
Disadvantage
Loss of Precision: False positives/negatives
Approaches:
Cone of influence reduction
Data abstraction

47. Cone of Influence Reduction
If f is an LTL formula that refers only to the variables in V, and C is the cone of influence of V, then <f, M> is satisfied if and only if <f, N> is satisfied, where N is the reduced model with respect to C.

48. Cone of Influence Reduction
Boolean v1, v2, v3, v4, v5, v6;
Repeat forever in parallel:
v1 = v2;
v2 = v1 & v3;
v3 = v1 & v2;
v4 = v5 & v3;
v5 = v4 & v6;
End.
A Simple System Model
A Simple LTL property
(F (~ v1)): v1 will eventually become False.
Boolean v1, v2, v3;
Repeat forever in parallel:
v1 = v2;
v2 = v1 & v3;
End.
Cone of Influence Reduction

49. Data Abstraction h S S’
Abstraction Function h : S ! S’

50. Data Abstraction Example
Abstraction proceeds component-wise, where variables are components
Even
Odd
…, -2, 0, 2, 4, …
x:int
…, -3, -1, 1, 3, …
Pos
Neg
Zero
…, -3, -2, -1
y:int
1, 2, 3, …

51. Symmetry Symmetry partitions state-space into equivalence classes
Knowledge of symmetry  search only 1 state per equivalence class
Need techniques for:
Symmetry detection
Efficient exploitation of symmetry
Ideally both should be fully automatic
Challenges: detecting & exploiting symmetries
Symmetry techniques aim to improve model checkers
Challenges: detecting & exploiting symmetries
Group structure can lead to efficient exploitation
Computational group theory can help find structure

52. Model Written in SPIN byte tok = 1; active [2] proctype user() {
byte state = N; do
:: (state == N) -> state = T
:: (state == T) && (tok == _pid) -> state = C
:: (state == C) -> state = N; if
:: tok = 1
:: tok = 2 fi od }

53. Symmetry Reduction: Example
Reduced state-graph
State-graph
N1 N2
tok=1
N1 N2
tok=2
N1 N2
tok=1
T1 N2
tok=1
N1 T2
tok=1
T1 N2
tok=1
T1 N2
tok=2
N1 T2
tok=1
N1 T2
tok=2
C1 N2
tok=1
T1 T2
tok=1
C1 N2
tok=1
T1 T2
tok=2
T1 T2
tok=1
N1 C2
tok=2
C1 T2
tok=1
C1 T2
tok=1
T1 C2
tok=2

54. Outline Model Checking Techniques Tackle the State Space Explosion
Introduction to MC
Symbolic Model Checking
Bounded Model Checking
Explicit Model Checking
Tackle the State Space Explosion
Partial Order Reduction
Compositional Reasoning
Abstraction
Symmetry
PAT: Process Analysis Toolkit
Performance Comparison
Conclusion

55. PAT: Process Analysis Toolkit
A interactive system to support: composing, simulating and reasoning of extended Process Algebra.
Modeling:
Extended CSP (Communicating Sequential Processes)
LTL
Model Checkers:
Explicit Model Checker
Bounded Model Checker
Features
Handle Fairness with Partial Order Reduction
Bounded Model Checking Process Algebra

56. PAT Workflow Diagram

57. Fairness Assumptions
Fairness properties state that if something is possible sufficiently often, then it must eventually happen.
deadlock-freeness. FALSE.
non-starvation. FALSE.

58. Specifying Fairness Let e be an event/action.
A weak fair event is written as wf(e)
A strong fair event is written as sf(e)

59. Outline Model Checking Techniques Tackle the State Space Explosion
Introduction to MC
Symbolic Model Checking
Bounded Model Checking
Explicit Model Checking
Tackle the State Space Explosion
Partial Order Reduction
Compositional Reasoning
Abstraction
Symmetry
PAT: Process Analysis Toolkit
Performance Comparison
Conclusion

60. Comparison: NuSMV-ImProviso, and SPIN
SPIN faster, if it can handle example
NuSMV-ImProviso can handle more examples
NuSMV-ImProviso matches SPIN on Best, Worst
More eg, reduction comparable,

61. Comparison: Leader Election Protocol
Models a leader elec in a distributd unidir ring – with fixed assignment of identifiers to nodes – which node has the highest identifier.
Until we consider a more general version of the protocol – all possible assignment of identifiers to nodes
With random assighnemnt of identifiers to the nodes
Models of same size in SMV and Promela
Same reduction
SPIN faster until…

62. Comparison: PAT, SPIN and FDR

63. Comparison Conclusion
Generally Spin is faster tha NuSMV, and can scale up to larger states. The partial order reduction in Spin is very helpful.
Generally, explicit model checking and BMC complements BDD-based model checking. BMC can also outperform BDD for some systems

64. Outline Model Checking Techniques Tackle the State Space Explosion
Introduction to MC
Symbolic Model Checking
Bounded Model Checking
Explicit Model Checking
Tackle the State Space Explosion
Partial Order Reduction
Equivalences and Pre-orders between Structures
Compositional Reasoning
Abstraction
Symmetry
PAT: Process Analysis Toolkit
Performance Comparison
Conclusion

65. Conclusion Three ways to do model checking
Symbolic Model Checking
Bounded Model Checking
Explicit Model Checking
Various optimization techniques
Partial Order Reduction
Compositional Reasoning
Abstraction
Symmetry

66. Model Checking Distributed Algorithms
Summary of Papers studied:
Model Checking of Consensus Algorithms [T Tsuchiya and A Schiper, SRDS 07]
MC of Distributed Dependable Protocols Semantic Property Preserving Abstractions [P Boker, M Serafini, A Pataricza and N Suri, 07]
Automatic Verification and Discovery of Byzantine Consensus Protocols [P Zielinski, DSN 07]
Model Checking Transactional Memories

67. Model Checking Distributed Algorithms
Most suitable MC technique
Explicit Model Checking
Benefits:
Better support for asynchronous communication
Better control of optimization techniques
Tools with better performance: SPIN or PAT (better support for the fairness with POR)
Possible optimization techniques
Abstraction
Compositional Reasoning
Symmetry